@deaduchiha/orbito 0.1.1 → 0.1.2

package/dist/orbito.js

@@ -2118,9 +2118,9 @@ __exportCjs(exports_commander, {
 import process2 from "node:process";
 
 // src/cli.ts
-import crypto from "node:crypto";
-import fs3 from "node:fs";
-import path3 from "node:path";
+import crypto2 from "node:crypto";
+import fs4 from "node:fs";
+import path4 from "node:path";
 
 // ../../node_modules/.bun/commander@14.0.3/node_modules/commander/index.js
 var { Argument } = require_argument();
@@ -2154,37 +2154,6 @@ var {
   Option: Option2,
   Help: Help2
 } = exports_commander;
-// package.json
-var package_default = {
-  name: "@deaduchiha/orbito",
-  version: "0.1.1",
-  description: "Deploy, follow logs and check migrations of apps on an Orbito server",
-  license: "UNLICENSED",
-  bin: {
-    orbito: "dist/orbito.js"
-  },
-  files: [
-    "dist",
-    "config.schema.json"
-  ],
-  type: "module",
-  exports: {
-    "./config.schema.json": "./config.schema.json"
-  },
-  scripts: {
-    build: "bun build src/main.ts --target node --outfile dist/orbito.js && bun run schema",
-    schema: "bun scripts/write-schema.ts",
-    test: "bun test",
-    prepack: "bun run build"
-  },
-  engines: {
-    node: ">=20"
-  },
-  devDependencies: {
-    commander: "^14.0.0",
-    zod: "^4.6.7"
-  }
-};
 
 // ../../node_modules/.bun/zod@4.6.7/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
@@ -3173,6 +3142,7 @@ function datetime(args) {
   return new RegExp(`^${dateSource}T(?:${timeRegex})$`);
 }
 var anyString = /^[\s\S]{0,}$/;
+var integer = /^-?\d+$/;
 var number = /^-?\d+(?:\.\d+)?$/;
 var boolean = /^(?:true|false)$/i;
 var lowercase = /^[^A-Z]*$/;
@@ -4643,6 +4613,161 @@ function handleIntersectionResults(result, left, right) {
   result.value = merged.data;
   return result;
 }
+var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
+  $ZodType.init(inst, def);
+  const memo = globalConfig.memoizer;
+  memo?.attach(inst);
+  inst._zod.parse = (payload, ctx) => {
+    const input = payload.value;
+    if (!isPlainObject(input)) {
+      payload.issues.push({
+        expected: "record",
+        code: "invalid_type",
+        input,
+        inst
+      });
+      return payload;
+    }
+    const proms = [];
+    const values = def.keyType._zod.values;
+    if (values && !def.partial) {
+      payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};
+      const recordKeys = new Set;
+      for (const key of values) {
+        if (typeof key === "string" || typeof key === "number" || typeof key === "symbol") {
+          recordKeys.add(typeof key === "number" ? key.toString() : key);
+          if (key === "__proto__")
+            continue;
+          const keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+          if (keyResult instanceof Promise) {
+            throw new Error("Async schemas not supported in object keys currently");
+          }
+          if (keyResult.issues.length) {
+            payload.issues.push({
+              code: "invalid_key",
+              origin: "record",
+              issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+              input: key,
+              path: [key],
+              inst
+            });
+            continue;
+          }
+          const outKey = keyResult.value;
+          if (outKey === "__proto__")
+            continue;
+          const result = def.valueType._zod.run({ value: input[key], issues: [] }, ctx);
+          if (result instanceof Promise) {
+            proms.push(result.then((result) => {
+              if (result.issues.length) {
+                payload.issues.push(...prefixIssues(key, result.issues));
+              }
+              payload.value[outKey] = result.value;
+            }));
+          } else {
+            if (result.issues.length) {
+              payload.issues.push(...prefixIssues(key, result.issues));
+            }
+            payload.value[outKey] = result.value;
+          }
+        }
+      }
+      let unrecognized;
+      for (const key in input) {
+        if (!recordKeys.has(key)) {
+          if (def.mode === "loose") {
+            if (key === "__proto__")
+              continue;
+            payload.value[key] = input[key];
+          } else {
+            unrecognized = unrecognized ?? [];
+            unrecognized.push(key);
+          }
+        }
+      }
+      if (unrecognized && unrecognized.length > 0) {
+        payload.issues.push({
+          code: "unrecognized_keys",
+          input,
+          inst,
+          keys: unrecognized,
+          continue: true
+        });
+      }
+    } else {
+      payload.value = memo ? memo.alloc(inst, payload, {}, ctx) : {};
+      let unrecognized;
+      for (const key of Reflect.ownKeys(input)) {
+        if (key === "__proto__")
+          continue;
+        if (!Object.prototype.propertyIsEnumerable.call(input, key))
+          continue;
+        let keyResult = def.keyType._zod.run({ value: key, issues: [] }, ctx);
+        if (keyResult instanceof Promise) {
+          throw new Error("Async schemas not supported in object keys currently");
+        }
+        const checkNumericKey = typeof key === "string" && number.test(key) && keyResult.issues.length;
+        if (checkNumericKey) {
+          const retryResult = def.keyType._zod.run({ value: Number(key), issues: [] }, ctx);
+          if (retryResult instanceof Promise) {
+            throw new Error("Async schemas not supported in object keys currently");
+          }
+          if (retryResult.issues.length === 0) {
+            keyResult = retryResult;
+          }
+        }
+        if (keyResult.issues.length) {
+          if (def.mode === "loose") {
+            payload.value[key] = input[key];
+          } else if (values) {
+            unrecognized = unrecognized ?? [];
+            unrecognized.push(key);
+          } else {
+            payload.issues.push({
+              code: "invalid_key",
+              origin: "record",
+              issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
+              input: key,
+              path: [key],
+              inst
+            });
+          }
+          continue;
+        }
+        const outKey = keyResult.value;
+        if (outKey === "__proto__")
+          continue;
+        const result = def.valueType._zod.run({ value: input[key], issues: [] }, ctx);
+        if (result instanceof Promise) {
+          proms.push(result.then((result) => {
+            if (result.issues.length) {
+              payload.issues.push(...prefixIssues(key, result.issues));
+            }
+            payload.value[outKey] = result.value;
+          }));
+        } else {
+          if (result.issues.length) {
+            payload.issues.push(...prefixIssues(key, result.issues));
+          }
+          payload.value[outKey] = result.value;
+        }
+      }
+      if (unrecognized && unrecognized.length > 0) {
+        payload.issues.push({
+          code: "unrecognized_keys",
+          input,
+          inst,
+          keys: unrecognized,
+          continue: true
+        });
+      }
+    }
+    if (proms.length) {
+      return Promise.all(proms).then(() => payload);
+    }
+    return payload;
+  };
+});
 var $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
   $ZodType.init(inst, def);
   const values = getEnumValues(def.entries);
@@ -6683,7 +6808,112 @@ var intersectionProcessor = (schema, ctx, json, params) => {
   json.allOf = allOf;
   ctx.intersections.push(allOf);
 };
+function stringifyKeyNames(bySchema, json, visited) {
+  if (json.$ref) {
+    if (visited.has(json))
+      return json;
+    visited.add(json);
+    const def = bySchema.get(json)?.def;
+    if (!def)
+      return json;
+    const inlined = stringifyKeyNames(bySchema, def, visited);
+    return inlined === def ? json : inlined;
+  }
+  for (const keyword of ["anyOf", "oneOf"]) {
+    const branches = json[keyword];
+    if (!Array.isArray(branches))
+      continue;
+    const mapped = branches.map((branch) => stringifyKeyNames(bySchema, branch, visited));
+    if (mapped.some((branch, i) => branch !== branches[i]))
+      json = { ...json, [keyword]: mapped };
+  }
+  const types = Array.isArray(json.type) ? json.type : [json.type];
+  const numericType = !types.includes("string") && types.some((t) => t === "number" || t === "integer");
+  const values = json.enum ?? (json.const !== undefined ? [json.const] : undefined);
+  if (!numericType && !values?.some((v) => typeof v === "number"))
+    return json;
+  const { minimum, maximum, exclusiveMinimum, exclusiveMaximum, multipleOf, format, id, ...rest } = json;
+  if (rest.enum)
+    rest.enum = rest.enum.map((v) => typeof v === "number" ? String(v) : v);
+  else if (typeof rest.const === "number")
+    rest.const = String(rest.const);
+  if (!numericType)
+    return rest;
+  rest.type = "string";
+  if (!values)
+    rest.pattern = (types.includes("number") ? number : integer).source;
+  return rest;
+}
 var pendingRecords = new WeakMap;
+function rewriteKeyNames(ctx) {
+  const bySchema = new Map;
+  for (const entry of ctx.seen.values()) {
+    if (entry.def && !bySchema.has(entry.schema))
+      bySchema.set(entry.schema, entry);
+  }
+  const rewrites = new Map;
+  for (const record of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record);
+    const names = (seen?.def ?? seen?.schema)?.propertyNames;
+    if (!names || names === true || rewrites.has(names))
+      continue;
+    const rewritten = stringifyKeyNames(bySchema, names, new Set);
+    if (rewritten !== names)
+      rewrites.set(names, rewritten);
+  }
+  if (!rewrites.size)
+    return;
+  for (const entry of ctx.seen.values()) {
+    for (const carrier of [entry.schema, entry.def]) {
+      const rewritten = carrier && rewrites.get(carrier.propertyNames);
+      if (rewritten)
+        carrier.propertyNames = rewritten;
+    }
+  }
+}
+var recordProcessor = (schema, ctx, _json, params) => {
+  const json = _json;
+  const def = schema._zod.def;
+  json.type = "object";
+  const keyType = def.keyType;
+  const patterns = aggregateChecks(keyType).patterns;
+  if (def.mode === "loose" && patterns && patterns.size > 0) {
+    const valueSchema = processSchema(def.valueType, ctx, {
+      ...params,
+      path: [...params.path, "patternProperties", "*"]
+    });
+    json.patternProperties = {};
+    for (const pattern of patterns) {
+      assignProp(json.patternProperties, exactPattern(pattern).source, valueSchema);
+    }
+  } else {
+    if (ctx.target === "draft-07" || ctx.target === "draft-2020-12") {
+      json.propertyNames = processSchema(def.keyType, ctx, {
+        ...params,
+        path: [...params.path, "propertyNames"]
+      });
+      let pending = pendingRecords.get(ctx);
+      if (!pending) {
+        pending = [];
+        pendingRecords.set(ctx, pending);
+        ctx.deferred.push(() => rewriteKeyNames(ctx));
+      }
+      pending.push(schema);
+    }
+    json.additionalProperties = processSchema(def.valueType, ctx, {
+      ...params,
+      path: [...params.path, "additionalProperties"]
+    });
+  }
+  const keyValues = keyType._zod.values;
+  const omittableOnInput = ctx.io === "input" && inputOptin(def.valueType) !== undefined;
+  if (keyValues && !def.partial && !omittableOnInput) {
+    const validKeyValues = [...keyValues].filter((v) => typeof v === "string" || typeof v === "number");
+    if (validKeyValues.length > 0) {
+      json.required = validKeyValues.map(String);
+    }
+  }
+};
 var nullableProcessor = (schema, ctx, json, params) => {
   const def = schema._zod.def;
   const inner = processSchema(def.innerType, ctx, params);
@@ -7466,6 +7696,30 @@ function intersection(left, right) {
     right
   });
 }
+var ZodRecord = /* @__PURE__ */ $constructor("ZodRecord", (inst, def) => {
+  _ensureDefaultMemoizer();
+  $ZodRecord.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => recordProcessor(inst, ctx, json, params);
+  inst.keyType = def.keyType;
+  inst.valueType = def.valueType;
+});
+function record(keyType, valueType, params) {
+  if (!valueType || !valueType._zod) {
+    return new ZodRecord({
+      type: "record",
+      keyType: string2(),
+      valueType: keyType,
+      ...normalizeParams(valueType)
+    });
+  }
+  return new ZodRecord({
+    type: "record",
+    keyType,
+    valueType,
+    ...normalizeParams(params)
+  });
+}
 var ZodEnum = /* @__PURE__ */ $constructor("ZodEnum", (inst, def) => {
   $ZodEnum.init(inst, def);
   ZodType.init(inst, def);
@@ -7704,23 +7958,108 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
   return _superRefine(fn, params);
 }
+// package.json
+var package_default = {
+  name: "@deaduchiha/orbito",
+  version: "0.1.2",
+  description: "Deploy, follow logs and check migrations of apps on an Orbito server",
+  license: "UNLICENSED",
+  bin: {
+    orbito: "dist/orbito.js"
+  },
+  files: [
+    "dist",
+    "config.schema.json"
+  ],
+  type: "module",
+  exports: {
+    "./config.schema.json": "./config.schema.json"
+  },
+  scripts: {
+    build: "bun build src/main.ts --target node --outfile dist/orbito.js && bun run schema",
+    schema: "bun scripts/write-schema.ts",
+    test: "bun test",
+    prepack: "bun run build"
+  },
+  engines: {
+    node: ">=20"
+  },
+  devDependencies: {
+    commander: "^14.0.0",
+    zod: "^4.6.7"
+  }
+};
+
 // src/contracts.ts
 var API_VERSION = 1;
 var API_PREFIX = "/api/cli/v1";
 var CLI_CLIENT_ID = "orbito-cli";
 var APP_ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
 var LEVELS = ["read", "deploy", "migrate"];
+var DesiredShape = {
+  preset: string2().max(40).optional(),
+  branch: string2().max(100).optional(),
+  install: string2().max(10).optional(),
+  build: string2().max(10).optional(),
+  migrate: string2().max(10).optional(),
+  restart: string2().max(10).optional(),
+  pm2Name: string2().max(64).optional(),
+  healthPath: string2().max(201).optional(),
+  layout: string2().max(10).optional(),
+  shared: array(string2().max(200)).max(50).optional(),
+  vars: record(string2().max(64), string2().max(4096)).optional(),
+  secrets: strictObject({ required: array(string2().max(64)).max(100) }).optional()
+};
+var Desired = strictObject(DesiredShape);
 var ConfigSchema = strictObject({
   $schema: string2().optional(),
-  version: literal(1, { error: "Unsupported orbito.json version: this CLI reads version 1" }),
+  version: union([literal(1), literal(2)], {
+    error: "Unsupported orbito.json version: this CLI reads versions 1 and 2"
+  }),
   server: url({ protocol: /^https?$/, error: "server must be an http(s) URL" }),
-  appId: string2().regex(APP_ID, "appId must be an Orbito app id such as my-app")
+  appId: string2().regex(APP_ID, "appId must be an Orbito app id such as my-app"),
+  ...DesiredShape,
+  dev: strictObject({
+    database: _enum(["sqlite", "postgres"]).optional(),
+    postgres: string2().regex(/^\d{2}(\.\d{1,2})?$/, "postgres must be a version such as 18.6").optional()
+  }).optional()
+}).refine((c) => c.version === 2 || Object.keys(c).every((k) => !(k in DesiredShape) && k !== "dev"), {
+  error: 'Build and runtime settings need "version": 2 in orbito.json'
+});
+function desiredOf(c) {
+  return Object.fromEntries(Object.entries(c).filter(([k]) => (k in DesiredShape)));
+}
+var ManifestPlan = object({
+  appId: string2(),
+  changes: array(object({ op: _enum(["add", "change"]), what: string2(), detail: string2() })),
+  blockers: array(string2()),
+  upToDate: boolean2(),
+  hash: string2()
+});
+var ApplyManifest = object({ desired: Desired, hash: string2().max(80) });
+var UnmanagedProject = object({
+  project: string2(),
+  name: string2(),
+  suggestedPort: number2().nullable(),
+  runtimes: array(string2())
 });
 var Capabilities = object({
   api: number2().int(),
   features: object({
     migrations: boolean2(),
-    stagedReleases: boolean2()
+    stagedReleases: boolean2(),
+    rollbackPlan: boolean2().optional(),
+    envOnly: boolean2().optional(),
+    envCommands: boolean2().optional(),
+    usage: boolean2().optional(),
+    dbBackups: boolean2().optional(),
+    manifest: boolean2().optional(),
+    domains: boolean2().optional(),
+    buckets: boolean2().optional(),
+    envValues: boolean2().optional(),
+    environments: boolean2().optional(),
+    export: boolean2().optional(),
+    licence: boolean2().optional()
   })
 });
 var Identity = object({ kind: _enum(["user", "automation"]), label: string2() });
@@ -7773,12 +8112,100 @@ var SubmitDeploy = object({
   sha: string2().regex(/^[0-9a-f]{40}$/),
   recipeHash: string2().min(8).max(80),
   idempotencyKey: string2().regex(/^[A-Za-z0-9_-]{8,80}$/),
-  confirmMigrations: boolean2().optional()
+  confirmMigrations: boolean2().optional(),
+  envOnly: boolean2().optional()
 });
 var SubmitRollback = object({
   idempotencyKey: string2().regex(/^[A-Za-z0-9_-]{8,80}$/),
   deploymentId: string2().max(60).optional()
 });
+var EnvList = array(object({
+  name: string2(),
+  secret: boolean2(),
+  updatedAt: string2(),
+  value: string2().optional()
+}));
+var SetEnv = object({
+  name: string2().max(200),
+  value: string2(),
+  secret: boolean2().optional()
+});
+var AppUsage = object({
+  appId: string2(),
+  range: string2(),
+  measured: boolean2(),
+  at: string2().nullable(),
+  memoryBytes: number2().nullable(),
+  memoryPeakBytes: number2().nullable(),
+  cpuPercent: number2().nullable(),
+  pids: number2().nullable(),
+  restarts: number2().nullable(),
+  oomKills: number2().nullable(),
+  diskBytes: number2().nullable(),
+  requests: number2().nullable().optional(),
+  errors: number2().nullable().optional(),
+  p50Ms: number2().nullable().optional(),
+  p95Ms: number2().nullable().optional(),
+  alerts: array(object({ kind: string2(), message: string2(), since: string2().nullable() })).optional(),
+  points: array(object({
+    at: string2(),
+    memoryBytes: number2().nullable(),
+    cpuPercent: number2().nullable(),
+    p95Ms: number2().nullable().optional()
+  }))
+});
+var RestoreDump = object({
+  file: string2().max(100),
+  confirm: string2().max(80)
+});
+var DomainList = object({
+  domains: array(object({ domain: string2(), stage: string2(), detail: string2() })),
+  applied: array(string2()).optional(),
+  note: string2().nullable().optional()
+});
+var AddConnection = object({
+  name: string2().max(40),
+  endpoint: string2().max(300),
+  region: string2().max(60),
+  accessKey: string2().max(300),
+  secretKey: string2().max(300)
+});
+var StorageConnection = object({
+  name: string2(),
+  endpoint: string2(),
+  region: string2(),
+  verifiedAt: string2().nullable()
+});
+var CreateBucket = object({ connection: string2().max(40), binding: string2().max(31).optional() });
+var AppBucket = object({
+  binding: string2(),
+  bucket: string2(),
+  connection: string2(),
+  bytes: number2().nullable(),
+  objects: number2().nullable(),
+  measuredAt: string2().nullable()
+});
+var CreateEnvironment = object({
+  name: string2().max(12),
+  port: number2().int().optional(),
+  branch: string2().max(100).optional()
+});
+var AppEnvironment = object({
+  id: string2(),
+  environment: string2(),
+  port: number2().nullable(),
+  deployedSha: string2().nullable()
+});
+var LicenceState = object({
+  limited: boolean2(),
+  plan: string2(),
+  customer: string2().nullable(),
+  maxApps: number2().nullable(),
+  used: number2(),
+  expires: string2().nullable(),
+  problem: string2().nullable()
+});
+var RollbackPlanRequest = object({ deploymentId: string2().max(60) });
 var DeployEvent = object({
   id: number2().int(),
   ts: string2(),
@@ -7809,10 +8236,13 @@ var EXIT = {
   invalid: 2,
   denied: 3,
   connect: 4,
+  confirm: 5,
+  conflict: 6,
   interrupted: 130
 };
 
 // src/runtime.ts
+import { spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -7852,6 +8282,37 @@ function realRuntime() {
         resolve(a);
       });
     }),
+    color: Boolean(process.stdout.isTTY && !env.NO_COLOR && env.TERM !== "dumb") || Boolean(env.FORCE_COLOR),
+    onEnter: (fn) => {
+      const rl = readline.createInterface({ input: process.stdin });
+      rl.once("line", () => {
+        rl.close();
+        fn();
+      });
+      return () => rl.close();
+    },
+    openUrl: (url) => {
+      const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+      spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => {}).unref();
+    },
+    run: (cmd, args, opts = {}) => new Promise((resolve, reject) => {
+      const child = spawn(cmd, args, {
+        cwd: process.cwd(),
+        env: { ...env, ...opts.env },
+        stdio: opts.capture ? ["ignore", "pipe", "pipe"] : "inherit"
+      });
+      let out = "";
+      child.stdout?.on("data", (d) => out += String(d));
+      child.stderr?.on("data", (d) => out += String(d));
+      child.once("error", reject);
+      child.once("close", (code) => resolve({ code: code ?? 1, out }));
+    }),
+    readStdin: async () => {
+      const chunks = [];
+      for await (const c of process.stdin)
+        chunks.push(c);
+      return Buffer.concat(chunks).toString("utf8");
+    },
     onInterrupt: (fn) => {
       process.on("SIGINT", fn);
       return () => process.off("SIGINT", fn);
@@ -7900,13 +8361,28 @@ function loadToken(rt, server) {
     return null;
   return c.token;
 }
+var settingsFile = (rt) => path.join(rt.configDir, "settings.json");
+function savedServer(rt) {
+  try {
+    const s = JSON.parse(fs.readFileSync(settingsFile(rt), "utf8"));
+    return s.server ? origin(s.server) : null;
+  } catch {
+    return null;
+  }
+}
+function saveServer(rt, server) {
+  fs.mkdirSync(rt.configDir, { recursive: true, mode: 448 });
+  fs.writeFileSync(settingsFile(rt), JSON.stringify({ server: origin(server) }, null, 2), {
+    mode: 384
+  });
+}
 
 // src/client.ts
 class ApiFailure extends CliError {
   status;
   code;
   constructor(message, status, code) {
-    super(message, status === 502 || status === 503 || status === 504 ? EXIT.connect : status === 401 || status === 403 || status === 404 ? EXIT.denied : status === 400 || status === 426 ? EXIT.invalid : EXIT.failed);
+    super(message, status === 502 || status === 503 || status === 504 ? EXIT.connect : status === 401 || status === 403 || status === 404 ? EXIT.denied : status === 409 ? EXIT.conflict : status === 400 || status === 426 ? EXIT.invalid : EXIT.failed);
     this.status = status;
     this.code = code;
   }
@@ -7970,20 +8446,270 @@ class Client {
   }
 }
 
-// src/config.ts
+// src/completion.ts
+var shown = (c) => c.commands.filter((s) => s.name() !== "help");
+var nextWords = (c) => [
+  ...shown(c).flatMap((s) => [s.name(), ...s.aliases()]),
+  ...c.options.flatMap((o) => o.long ? [o.long] : [])
+];
+function bash(program) {
+  const cases = shown(program).map((c) => `    ${[c.name(), ...c.aliases()].join("|")}) words="${nextWords(c).join(" ")}" ;;`).join(`
+`);
+  return `_orbito() {
+  local cur="\${COMP_WORDS[COMP_CWORD]}" words="${nextWords(program).join(" ")}"
+  if [ "$COMP_CWORD" -gt 1 ]; then
+    case "\${COMP_WORDS[1]}" in
+${cases}
+    esac
+  fi
+  COMPREPLY=($(compgen -W "$words" -- "$cur"))
+}
+complete -F _orbito orbito
+`;
+}
+function fish(program) {
+  const lines = [
+    `complete -c orbito -f -n __fish_use_subcommand -a "${shown(program).flatMap((c) => [c.name(), ...c.aliases()]).join(" ")}"`
+  ];
+  for (const c of shown(program)) {
+    const names = [c.name(), ...c.aliases()].join(" ");
+    const subs = shown(c).map((s) => s.name());
+    if (subs.length)
+      lines.push(`complete -c orbito -f -n "__fish_seen_subcommand_from ${names}" -a "${subs.join(" ")}"`);
+    for (const o of c.options)
+      if (o.long)
+        lines.push(`complete -c orbito -n "__fish_seen_subcommand_from ${names}" -l ${o.long.slice(2)}`);
+  }
+  return lines.join(`
+`) + `
+`;
+}
+function completionScript(shell, program) {
+  if (shell === "bash")
+    return bash(program);
+  if (shell === "zsh")
+    return `autoload -U +X compinit && compinit
+autoload -U +X bashcompinit && bashcompinit
+${bash(program)}`;
+  if (shell === "fish")
+    return fish(program);
+  return null;
+}
+
+// src/dev.ts
+import crypto from "node:crypto";
 import fs2 from "node:fs";
+import net from "node:net";
 import path2 from "node:path";
+var ENV_FILE = ".env.local";
+var STATE_DIR = ".orbito";
+var DEFAULT_POSTGRES = "18.6";
+var SQLITE_FILE = "dev.db";
+var containerName = (c) => `orbito-dev-${c.appId}`;
+var stateFile = (rt) => path2.join(rt.cwd, STATE_DIR, "postgres.json");
+function packageManager(cwd) {
+  if (["bun.lock", "bun.lockb"].some((f) => fs2.existsSync(path2.join(cwd, f))))
+    return "bun";
+  if (fs2.existsSync(path2.join(cwd, "pnpm-lock.yaml")))
+    return "pnpm";
+  return "npm";
+}
+function scriptsOf(cwd) {
+  try {
+    const pkg = JSON.parse(fs2.readFileSync(path2.join(cwd, "package.json"), "utf8"));
+    return pkg.scripts ?? {};
+  } catch {
+    return {};
+  }
+}
+function parseEnv(text) {
+  const out = {};
+  for (const line of text.split(/\r?\n/)) {
+    const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!m)
+      continue;
+    const v = m[2].trim();
+    out[m[1]] = /^(['"]).*\1$/.test(v) ? v.slice(1, -1) : v;
+  }
+  return out;
+}
+var readEnvLocal = (rt) => {
+  try {
+    return parseEnv(fs2.readFileSync(path2.join(rt.cwd, ENV_FILE), "utf8"));
+  } catch {
+    return {};
+  }
+};
+function writeEnvLocal(rt, values) {
+  const file = path2.join(rt.cwd, ENV_FILE);
+  const lines = fs2.existsSync(file) ? fs2.readFileSync(file, "utf8").split(`
+`) : [];
+  const left = new Map(Object.entries(values));
+  const out = lines.map((line) => {
+    const name = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=/.exec(line)?.[1];
+    if (!name || !left.has(name))
+      return line;
+    const v = left.get(name);
+    left.delete(name);
+    return `${name}=${v}`;
+  });
+  while (out.length > 0 && out[out.length - 1] === "")
+    out.pop();
+  for (const [k, v] of left)
+    out.push(`${k}=${v}`);
+  fs2.writeFileSync(file, `${out.join(`
+`)}
+`, { mode: 384 });
+  fs2.chmodSync(file, 384);
+}
+async function ensureIgnored(rt) {
+  const tracked = await rt.run("git", ["ls-files", "--error-unmatch", ENV_FILE], { capture: true }).catch(() => null);
+  if (tracked?.code === 0)
+    throw new CliError(`${ENV_FILE} is committed to git. Remove it first: git rm --cached ${ENV_FILE}`, EXIT.failed);
+  const file = path2.join(rt.cwd, ".gitignore");
+  const text = fs2.existsSync(file) ? fs2.readFileSync(file, "utf8") : "";
+  const have = text.split(`
+`).map((l) => l.trim());
+  const missing = [ENV_FILE, `${STATE_DIR}/`].filter((p) => !have.includes(p));
+  if (missing.length > 0)
+    fs2.writeFileSync(file, `${text}${text && !text.endsWith(`
+`) ? `
+` : ""}${missing.join(`
+`)}
+`);
+}
+var isLocalUrl = (url) => {
+  if (url.startsWith("file:"))
+    return true;
+  try {
+    return ["localhost", "127.0.0.1", "[::1]"].includes(new URL(url).hostname);
+  } catch {
+    return false;
+  }
+};
+var freePort = () => new Promise((resolve, reject) => {
+  const s = net.createServer();
+  s.once("error", reject);
+  s.listen(0, "127.0.0.1", () => {
+    const { port } = s.address();
+    s.close(() => resolve(port));
+  });
+});
+async function docker(rt, args) {
+  const r = await rt.run("docker", args, { capture: true }).catch(() => null);
+  if (!r)
+    throw new CliError("Docker is needed for a local PostgreSQL. Install and start it, or use SQLite.", EXIT.failed);
+  return r;
+}
+async function startPostgres(rt, c, version) {
+  const name = containerName(c);
+  let state = null;
+  try {
+    state = JSON.parse(fs2.readFileSync(stateFile(rt), "utf8"));
+  } catch {}
+  const running = await docker(rt, ["inspect", "-f", "{{.State.Running}}", name]);
+  if (running.code !== 0) {
+    state ??= { password: crypto.randomBytes(18).toString("base64url"), port: await freePort() };
+    const data = Number(version.split(".")[0]) >= 18 ? "/var/lib/postgresql" : "/var/lib/postgresql/data";
+    const made = await docker(rt, [
+      "run",
+      "-d",
+      "--name",
+      name,
+      "-e",
+      `POSTGRES_PASSWORD=${state.password}`,
+      "-e",
+      "POSTGRES_DB=app",
+      "-p",
+      `127.0.0.1:${state.port}:5432`,
+      "-v",
+      `${name}:${data}`,
+      `postgres:${version}-alpine`
+    ]);
+    if (made.code !== 0)
+      throw new CliError(`Could not start PostgreSQL: ${made.out}`, EXIT.failed);
+    fs2.mkdirSync(path2.dirname(stateFile(rt)), { recursive: true });
+    fs2.writeFileSync(stateFile(rt), JSON.stringify(state), { mode: 384 });
+  } else if (running.out.trim() !== "true") {
+    await docker(rt, ["start", name]);
+  }
+  if (!state)
+    throw new CliError(`The container ${name} exists but ${stateFile(rt)} is gone. Run: orbito db reset`, EXIT.failed);
+  for (let i = 0;i < 90; i++) {
+    const ready = await docker(rt, ["exec", name, "pg_isready", "-U", "postgres", "-d", "app", "-h", "127.0.0.1"]);
+    if (ready.code === 0)
+      return `postgresql://postgres:${encodeURIComponent(state.password)}@127.0.0.1:${state.port}/app`;
+    await rt.sleep(1000);
+  }
+  throw new CliError("PostgreSQL did not become ready in time.", EXIT.failed);
+}
+async function setupDatabase(rt, c) {
+  await ensureIgnored(rt);
+  const existing = readEnvLocal(rt).DATABASE_URL;
+  const engine = c.dev?.database;
+  const managedUrl = existing?.startsWith(`file:./${STATE_DIR}/`);
+  if (existing && !isLocalUrl(existing))
+    throw new CliError("DATABASE_URL in .env.local is not on this machine. orbito dev never connects to a remote database. Remove it, then run this again.", EXIT.failed);
+  if (existing && !managedUrl && !fs2.existsSync(stateFile(rt)))
+    return { engine: "external", url: existing };
+  if (engine === "postgres") {
+    const url = await startPostgres(rt, c, c.dev?.postgres ?? DEFAULT_POSTGRES);
+    writeEnvLocal(rt, { DATABASE_URL: url });
+    return { engine: "postgres", url };
+  }
+  if (engine === "sqlite") {
+    fs2.mkdirSync(path2.join(rt.cwd, STATE_DIR), { recursive: true });
+    const url = `file:./${STATE_DIR}/${SQLITE_FILE}`;
+    writeEnvLocal(rt, { DATABASE_URL: url });
+    return { engine: "sqlite", url };
+  }
+  return { engine: "none", url: null };
+}
+async function runScript(rt, script) {
+  if (!scriptsOf(rt.cwd)[script])
+    return null;
+  const pm = packageManager(rt.cwd);
+  const r = await rt.run(pm, ["run", script], { env: readEnvLocal(rt) });
+  return r.code;
+}
+async function dropDatabase(rt, c) {
+  if (c.dev?.database === "postgres") {
+    const name = containerName(c);
+    await docker(rt, ["rm", "-f", name]);
+    await docker(rt, ["volume", "rm", "-f", name]);
+    fs2.rmSync(stateFile(rt), { force: true });
+    const file = path2.join(rt.cwd, ENV_FILE);
+    if (fs2.existsSync(file))
+      fs2.writeFileSync(file, fs2.readFileSync(file, "utf8").replace(/^\s*(?:export\s+)?DATABASE_URL=.*\n?/m, ""));
+  } else if (c.dev?.database === "sqlite") {
+    for (const suffix of ["", "-wal", "-shm"])
+      fs2.rmSync(path2.join(rt.cwd, STATE_DIR, `${SQLITE_FILE}${suffix}`), { force: true });
+  } else {
+    throw new CliError('Say which local database this app uses: "dev": { "database": "sqlite" } in orbito.json.', EXIT.invalid);
+  }
+}
+function shellCommand(c, cwd) {
+  if (c.dev?.database === "postgres")
+    return ["docker", ["exec", "-it", containerName(c), "psql", "-U", "postgres", "-d", "app"]];
+  if (c.dev?.database === "sqlite")
+    return ["sqlite3", [path2.join(cwd, STATE_DIR, SQLITE_FILE)]];
+  throw new CliError('Say which local database this app uses: "dev": { "database": "sqlite" } in orbito.json.', EXIT.invalid);
+}
+
+// src/config.ts
+import fs3 from "node:fs";
+import path3 from "node:path";
 var CONFIG_FILE = "orbito.json";
 function configPath(rt, explicit) {
-  return path2.resolve(rt.cwd, explicit ?? CONFIG_FILE);
+  return path3.resolve(rt.cwd, explicit ?? CONFIG_FILE);
 }
 function loadConfig(rt, explicit) {
   const file = configPath(rt, explicit);
   let raw;
   try {
-    raw = fs2.readFileSync(file, "utf8");
+    raw = fs3.readFileSync(file, "utf8");
   } catch {
-    throw new CliError(`No ${path2.basename(file)} found at ${file}. Run: orbito init --app <id>`, EXIT.invalid);
+    throw new CliError(`No ${path3.basename(file)} found at ${file}. Run: orbito init --app <id>`, EXIT.invalid);
   }
   let json;
   try {
@@ -8002,11 +8728,28 @@ ${lines.join(`
 }
 function writeConfig(rt, config, explicit) {
   const file = configPath(rt, explicit);
-  fs2.writeFileSync(file, JSON.stringify(config, null, 2) + `
+  fs3.writeFileSync(file, JSON.stringify(config, null, 2) + `
 `);
   return file;
 }
 
+// src/ui.ts
+function styles(rt) {
+  const on = rt.color === true;
+  const wrap = (open, close) => (t) => on ? `\x1B[${open}m${t}\x1B[${close}m` : t;
+  return {
+    orange: wrap("38;5;208", "39"),
+    bold: wrap("1", "22"),
+    dim: wrap("2", "22"),
+    green: wrap("32", "39")
+  };
+}
+function table(rows, gap = 2) {
+  const len = (t) => t.replace(/\x1b\[[0-9;]*m/g, "").length;
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => len(r[i] ?? ""))));
+  return rows.map((r) => r.map((c, i) => i === r.length - 1 ? c : c + " ".repeat(widths[i] - len(c) + gap)).join(""));
+}
+
 // src/cli.ts
 var VERSION = package_default.version;
 var DEPLOY_SCRIPTS = {
@@ -8018,7 +8761,24 @@ var DEPLOY_SCRIPTS = {
 async function run(argv, rt) {
   const program = new Command2;
   let exit = EXIT.ok;
-  program.name("orbito").version(VERSION).option("--config <path>", "path to orbito.json (for monorepos)").option("--json", "machine-readable output on stdout (newline-delimited for streams)").exitOverride().configureOutput({ writeOut: rt.out, writeErr: rt.err });
+  program.name("orbito").version(`${VERSION} (CLI API ${API_VERSION})`).option("--config <path>", "path to orbito.json (for monorepos)").option("--json", "machine-readable output on stdout (newline-delimited for streams)").option("--env <name>", "act on another environment of the app, for example staging").exitOverride().configureOutput({ writeOut: rt.out, writeErr: rt.err }).addHelpText("after", `
+Examples:
+  orbito login
+  orbito whoami
+  orbito deploy --dry-run
+  orbito deploy --yes --json
+  orbito logs --lines 50
+
+Exit codes:
+  0    success
+  1    the operation failed
+  2    invalid usage or configuration
+  3    not logged in, or no access
+  4    server unreachable
+  5    needs confirmation (no terminal and no --yes, or answered no)
+  6    refused by the server because of the current state
+  130  stopped following with Ctrl+C (the job continues on the server)
+`);
   const g = () => program.opts();
   const emit = (v) => rt.out(JSON.stringify(v) + `
 `);
@@ -8026,11 +8786,32 @@ async function run(argv, rt) {
 `);
   const say = (s) => g().json ? info(s) : rt.out(s + `
 `);
-  const cfg = () => loadConfig(rt, g().config);
+  const confirmOr = async (question, yes) => {
+    if (yes)
+      return;
+    if (!rt.isTTY)
+      throw new CliError("Not a terminal: pass --yes to accept the plan.", EXIT.confirm);
+    if (!await rt.confirm(question))
+      throw new CliError("Cancelled.", EXIT.confirm);
+  };
+  const cfg = () => {
+    const c = loadConfig(rt, g().config);
+    const app = rt.env.ORBITO_APP;
+    if (app && !APP_ID.test(app))
+      throw new CliError(`ORBITO_APP is not an app id: ${app}`, EXIT.invalid);
+    const base = app || c.appId;
+    const env = g().env;
+    if (!env || env === "production")
+      return { ...c, appId: base };
+    const appId = `${base}-${env}`;
+    if (!APP_ID.test(appId))
+      throw new CliError(`'${env}' is not an environment name.`, EXIT.invalid);
+    return { ...c, appId };
+  };
   const clientFor = (server, needToken = true) => {
     const token = loadToken(rt, server);
     if (needToken && !token)
-      throw new CliError(`Not logged in to ${server}. Run: orbito login --server ${server}`, EXIT.denied);
+      throw new CliError(`Not logged in to ${server}. Run: orbito login`, EXIT.denied);
     return new Client(rt, server, token);
   };
   const authed = () => {
@@ -8039,10 +8820,35 @@ async function run(argv, rt) {
   };
   async function checkServer(api) {
     const caps = Capabilities.safeParse(await api.call("GET", "/capabilities"));
-    if (!caps.success || caps.data.api !== API_VERSION)
+    if (!caps.success)
       throw new CliError(`This server does not speak CLI API ${API_VERSION}. Update the CLI or the server.`, EXIT.invalid);
+    if (caps.data.api > API_VERSION)
+      throw new CliError(`This server speaks CLI API ${caps.data.api}, this CLI speaks ${API_VERSION}. Update the CLI: npm install -g @deaduchiha/orbito`, EXIT.invalid);
+    if (caps.data.api < API_VERSION)
+      throw new CliError(`This server speaks CLI API ${caps.data.api}, this CLI speaks ${API_VERSION}. Update the server: orbito-update`, EXIT.invalid);
     return caps.data;
   }
+  async function resolveServer(flag) {
+    let raw = flag || rt.env.ORBITO_SERVER;
+    if (!raw) {
+      try {
+        raw = loadConfig(rt, g().config).server;
+      } catch {}
+    }
+    raw ||= savedServer(rt) ?? undefined;
+    if (!raw) {
+      if (!rt.isTTY)
+        throw new CliError("No server. Set ORBITO_SERVER or pass --server <url>.", EXIT.invalid);
+      raw = (await rt.ask("Orbito server (for example orbito.example.com): ")).trim();
+      if (!raw)
+        throw new CliError("Cancelled.", EXIT.invalid);
+    }
+    try {
+      return new URL(/^https?:\/\//.test(raw) ? raw : `https://${raw}`).origin;
+    } catch {
+      throw new CliError("The server must be a URL, for example https://orbito.example.com", EXIT.invalid);
+    }
+  }
   async function loginTo(serverUrl) {
     let server;
     try {
@@ -8072,47 +8878,60 @@ async function run(argv, rt) {
     if (!start.ok)
       throw new CliError(`The server refused the login (${start.status}).`, EXIT.denied);
     const d = await start.json();
-    info(`Open ${d.verification_uri_complete ?? d.verification_uri} and check that the code is ${d.user_code}.`);
+    const link = d.verification_uri_complete ?? d.verification_uri;
+    info(`Open ${link} and check that the code is ${d.user_code}.`);
     info("If you are asked to sign in, sign in and open the link again.");
-    let wait = Math.max(1, d.interval) * 1000;
-    const until = Date.now() + d.expires_in * 1000;
-    while (Date.now() < until) {
-      await rt.sleep(wait);
-      const t = await post("/device/token", {
-        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-        device_code: d.device_code,
-        client_id: CLI_CLIENT_ID
-      });
-      const body = await t.json().catch(() => ({}));
-      if (t.ok && body.access_token) {
-        const ex = await new Client(rt, server.origin, null).call("POST", "/auth/exchange", {
-          sessionToken: body.access_token,
-          label: `orbito cli on ${rt.hostname}`
-        });
-        saveCredential(rt, server.origin, {
-          token: ex.token,
-          expiresAt: ex.expiresAt
-        });
-        say(`Logged in to ${server.origin}. Apps: ${ex.apps.map((a) => `${a.id} (${a.level})`).join(", ") || "none yet"}`);
-        if (g().json)
-          emit({ type: "login", server: server.origin, apps: ex.apps });
-        return;
+    let stopEnter = () => {};
+    try {
+      if (rt.isTTY && rt.onEnter && rt.openUrl && new URL(link).origin === server.origin) {
+        info("Press Enter to open it in your browser.");
+        stopEnter = rt.onEnter(() => rt.openUrl(link));
       }
-      if (body.error === "authorization_pending")
-        continue;
-      if (body.error === "slow_down" || t.status === 429) {
-        wait += 5000;
-        continue;
+    } catch {}
+    try {
+      let wait = Math.max(1, d.interval) * 1000;
+      const until = Date.now() + d.expires_in * 1000;
+      while (Date.now() < until) {
+        await rt.sleep(wait);
+        const t = await post("/device/token", {
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: d.device_code,
+          client_id: CLI_CLIENT_ID
+        });
+        const body = await t.json().catch(() => ({}));
+        if (t.ok && body.access_token) {
+          const ex = await new Client(rt, server.origin, null).call("POST", "/auth/exchange", {
+            sessionToken: body.access_token,
+            label: `orbito cli on ${rt.hostname}`
+          });
+          saveServer(rt, server.origin);
+          saveCredential(rt, server.origin, {
+            token: ex.token,
+            expiresAt: ex.expiresAt
+          });
+          say(`Logged in to ${server.origin}. Apps: ${ex.apps.map((a) => `${a.id} (${a.level})`).join(", ") || "none yet"}`);
+          if (g().json)
+            emit({ type: "login", server: server.origin, apps: ex.apps });
+          return;
+        }
+        if (body.error === "authorization_pending")
+          continue;
+        if (body.error === "slow_down" || t.status === 429) {
+          wait += 5000;
+          continue;
+        }
+        if (body.error === "access_denied")
+          throw new CliError("The login was denied in the browser.", EXIT.denied);
+        if (body.error === "expired_token")
+          break;
+        throw new CliError(`Login failed: ${body.error ?? t.status}`, EXIT.failed);
       }
-      if (body.error === "access_denied")
-        throw new CliError("The login was denied in the browser.", EXIT.denied);
-      if (body.error === "expired_token")
-        break;
-      throw new CliError(`Login failed: ${body.error ?? t.status}`, EXIT.failed);
+      throw new CliError("The login code expired. Run orbito login again.", EXIT.denied);
+    } finally {
+      stopEnter();
     }
-    throw new CliError("The login code expired. Run orbito login again.", EXIT.denied);
   }
-  program.command("login").description("authorize this machine through your browser").requiredOption("--server <url>", "Orbito server, for example https://orbito.example.com").action((o) => loginTo(o.server));
+  program.command("login").description("authorize this machine through your browser").option("--server <url>", "Orbito server; defaults to orbito.json, then the last server used, then asks").action(async (o) => loginTo(await resolveServer(o.server)));
   program.command("logout").description("revoke and remove the machine credential").option("--server <url>", "defaults to the server in orbito.json").action(async (o) => {
     const server = o.server ?? cfg().server;
     const token = loadToken(rt, server);
@@ -8127,37 +8946,73 @@ async function run(argv, rt) {
       forgetCredential(rt, server);
     } catch {}
     say("Logged out.");
+    if (g().json)
+      emit({ type: "logout", server });
   });
-  program.command("whoami").description("show server, identity and granted apps").action(async () => {
-    const { c, api } = authed();
+  program.command("whoami").description("show who you are, the server, and your access").option("--all", "list every app you can reach").action(async (o) => {
+    let c;
+    let api;
+    try {
+      ({ c, api } = authed());
+    } catch (e) {
+      if (!rt.env.ORBITO_SERVER && !savedServer(rt))
+        throw e;
+      c = { server: await resolveServer() };
+      api = clientFor(c.server);
+    }
     const me = await api.call("GET", "/me");
     if (g().json)
       return emit({ server: c.server, ...me });
-    rt.out(`${me.identity.label} (${me.identity.kind}) on ${c.server}
-`);
+    const st = styles(rt);
+    const host = new URL(c.server).host;
+    const here = me.apps.find((a) => a.id === c.appId);
+    const levels = new Map;
     for (const a of me.apps)
-      rt.out(`  ${a.id}  ${a.level}  ${a.name}
+      levels.set(a.level, (levels.get(a.level) ?? 0) + 1);
+    const summary = [...levels].map(([l, n]) => `${n} ${l}`).join(", ");
+    const rows = [
+      ["Account", `${st.bold(me.identity.label)} ${st.dim(`(${me.identity.kind})`)}`],
+      ["Server", host],
+      ...c.appId ? [
+        [
+          "Project",
+          here ? `${st.orange(here.id)} ${st.dim("·")} ${here.level}` : `${c.appId} ${st.dim("· no access")}`
+        ]
+      ] : [],
+      [
+        "Access",
+        `${me.apps.length} app${me.apps.length === 1 ? "" : "s"} ${st.dim(summary ? `· ${summary}` : "")}`
+      ]
+    ];
+    rt.out(`
+ ${st.orange("◆")} ${st.bold("Orbito")}
+
+`);
+    for (const l of table(rows.map(([k, v]) => [st.dim(k), v])))
+      rt.out(`  ${l}
+`);
+    if (o.all) {
+      rt.out(`
+`);
+      const head = ["APP", "ACCESS", "NAME"].map((h) => st.dim(h));
+      const body = me.apps.map((a) => [
+        a.id === c.appId ? st.orange(`● ${a.id}`) : `  ${a.id}`,
+        a.level,
+        a.name
+      ]);
+      for (const l of table([head.map((h, i) => i === 0 ? `  ${h}` : h), ...body]))
+        rt.out(`  ${l}
+`);
+    } else if (me.apps.length > 1) {
+      rt.out(`
+  ${st.dim("Run")} orbito whoami --all ${st.dim("to list every app.")}
+`);
+    }
+    rt.out(`
 `);
   });
   program.command("init").description("link this repository to an Orbito app (asks what it needs)").option("--app <id>", "the app id; omit to pick from the apps you can reach").option("--server <url>", "Orbito server (defaults to the one in an existing orbito.json)").option("--scripts", "add deploy, tail, deploy:status and db:remote:status to package.json").action(async (o) => {
-    let server = o.server;
-    if (!server) {
-      try {
-        server = loadConfig(rt, g().config).server;
-      } catch {
-        if (!rt.isTTY)
-          throw new CliError("Pass --server <url> the first time.", EXIT.invalid);
-        const a = (await rt.ask("Orbito server (for example orbito.example.com): ")).trim();
-        if (!a)
-          throw new CliError("Cancelled.", EXIT.invalid);
-        server = /^https?:\/\//.test(a) ? a : `https://${a}`;
-      }
-    }
-    try {
-      server = new URL(server).origin;
-    } catch {
-      throw new CliError("The server must be a URL, for example https://orbito.example.com", EXIT.invalid);
-    }
+    const server = await resolveServer(o.server);
     if (!loadToken(rt, server)) {
       info(`Not logged in to ${server} yet, logging in first.`);
       await loginTo(server);
@@ -8193,9 +9048,9 @@ ${list}`);
       appId: app
     }, g().config);
     say(`Linked to '${app}' on ${server} (you have '${mine.level}'). Wrote ${file}; commit it, credentials stay outside the repository.`);
-    const pkgFile = path3.join(path3.dirname(file), "package.json");
-    if (fs3.existsSync(pkgFile)) {
-      const pkg = JSON.parse(fs3.readFileSync(pkgFile, "utf8"));
+    const pkgFile = path4.join(path4.dirname(file), "package.json");
+    if (fs4.existsSync(pkgFile)) {
+      const pkg = JSON.parse(fs4.readFileSync(pkgFile, "utf8"));
       const add = Object.entries(DEPLOY_SCRIPTS).filter(([k]) => !pkg.scripts?.[k]);
       if (add.length > 0) {
         say(`package.json scripts to add:
@@ -8204,7 +9059,7 @@ ${add.map(([k, v]) => `  "${k}": "${v}"`).join(`
         const yes = o.scripts || rt.isTTY && !/^n/i.test((await rt.ask("Add them? [Y/n] ")).trim());
         if (yes) {
           pkg.scripts = { ...pkg.scripts, ...Object.fromEntries(add) };
-          fs3.writeFileSync(pkgFile, JSON.stringify(pkg, null, 2) + `
+          fs4.writeFileSync(pkgFile, JSON.stringify(pkg, null, 2) + `
 `);
           say("Added.");
         } else
@@ -8213,6 +9068,8 @@ ${add.map(([k, v]) => `  "${k}": "${v}"`).join(`
     }
     say(`
 Next: orbito doctor   then   orbito deploy --dry-run`);
+    if (g().json)
+      emit({ type: "init", server, appId: app, level: mine.level, file });
   });
   const configCmd = program.command("config").description("configuration commands");
   configCmd.command("validate").description("validate orbito.json and server compatibility").action(async () => {
@@ -8222,6 +9079,34 @@ Next: orbito doctor   then   orbito deploy --dry-run`);
     if (g().json)
       emit({ ok: true, server: c.server, appId: c.appId, api: caps.api });
   });
+  configCmd.command("show").description("show each setting and where it came from (never prints a token)").action(() => {
+    const c = cfg();
+    const file = configPath(rt, g().config);
+    const settings = {
+      server: { value: c.server, source: file },
+      appId: { value: c.appId, source: rt.env.ORBITO_APP ? "ORBITO_APP" : file },
+      token: {
+        source: rt.env.ORBITO_TOKEN ? "ORBITO_TOKEN" : loadToken(rt, c.server) ? "saved login" : "none"
+      }
+    };
+    if (g().json)
+      return emit({ type: "config", ...settings });
+    rt.out(`server  ${c.server}  (${settings.server.source})
+`);
+    rt.out(`appId   ${c.appId}  (${settings.appId.source})
+`);
+    rt.out(`token   ${settings.token.source}
+`);
+  });
+  program.command("completion").description("print a shell completion script").argument("<shell>", "bash, zsh or fish").addHelpText("after", `
+Example:
+  orbito completion zsh >> ~/.zshrc
+`).action((shell) => {
+    const script = completionScript(shell, program);
+    if (!script)
+      throw new CliError("Supported shells: bash, zsh, fish.", EXIT.invalid);
+    rt.out(script);
+  });
   program.command("status").description("deployed commit, health and active job").action(async () => {
     const { c, api } = authed();
     const s = await api.call("GET", `/apps/${c.appId}/status`, undefined, AppStatus);
@@ -8280,12 +9165,14 @@ Next: orbito doctor   then   orbito deploy --dry-run`);
     if (g().json)
       emit({ type: "result", ...d });
     else
-      say(d.status === "deployed" ? `Done: ${d.sha?.slice(0, 12) ?? ""} is live.` : `${d.status}: ${d.reason ?? ""}`);
+      say(d.status === "deployed" ? `Done: ${d.sha?.slice(0, 12) ?? ""} is live.${d.reason ? ` ${d.reason}` : ""}` : `${d.status}: ${d.reason ?? ""}`);
     return d.status === "deployed" ? EXIT.ok : EXIT.failed;
   }
-  program.command("deploy").description("plan, confirm, deploy and follow progress").option("--dry-run", "show the target commit, recipe, migrations and blockers; change nothing").option("--detach", "submit and return the deployment id").option("--yes", "accept the displayed plan without asking (never skips permissions or blockers)").action(async (o) => {
+  program.command("deploy").description("plan, confirm, deploy and follow progress").option("--dry-run", "show the target commit, recipe, migrations and blockers; change nothing").option("--detach", "submit and return the deployment id").option("--yes", "accept the displayed plan without asking (never skips permissions or blockers)").option("--env-only", "apply the variables only: keep the running commit, run no migrations").action(async (o) => {
     const { c, api } = authed();
     const caps = await checkServer(api);
+    if (o.envOnly && !caps.features.envOnly)
+      throw new CliError("This server cannot apply variables only. Update the server: orbito-update", EXIT.invalid);
     const plan = await api.call("POST", `/apps/${c.appId}/deploy/plan`, {}, DeployPlan);
     if (g().json)
       emit({ type: "plan", ...plan });
@@ -8297,7 +9184,10 @@ Next: orbito doctor   then   orbito deploy --dry-run`);
       if (plan.recipe)
         rt.out(`  recipe    install ${plan.recipe.install}, build ${plan.recipe.build}, migrate ${plan.recipe.migrate}, restart ${plan.recipe.restart}
 `);
-      rt.out(`  migration ${plan.migration.required ? `yes (needs '${plan.migration.neededLevel}')` : "no"}
+      rt.out(`  migration ${plan.migration.required && !o.envOnly ? `yes (needs '${plan.migration.neededLevel}')` : "no"}
+`);
+      if (o.envOnly)
+        rt.out(`  NOTE      variables only: the running commit stays.
 `);
       for (const b of plan.blockers)
         rt.out(`  BLOCKED   ${b}
@@ -8314,19 +9204,15 @@ Next: orbito doctor   then   orbito deploy --dry-run`);
       return;
     if (!plan.sha)
       throw new CliError("The commit could not be resolved.", EXIT.failed);
-    if (plan.upToDate)
+    if (plan.upToDate && !o.envOnly)
       return say("Already up to date.");
-    if (!o.yes) {
-      if (!rt.isTTY)
-        throw new CliError("Not a terminal: pass --yes to accept the plan.", EXIT.invalid);
-      if (!await rt.confirm("Deploy this?"))
-        throw new CliError("Cancelled.", EXIT.invalid);
-    }
+    await confirmOr("Deploy this?", o.yes);
     const body = {
       sha: plan.sha,
       recipeHash: plan.recipeHash,
-      idempotencyKey: crypto.randomBytes(12).toString("hex"),
-      ...plan.migration.required ? { confirmMigrations: true } : {}
+      idempotencyKey: crypto2.randomBytes(12).toString("hex"),
+      ...plan.migration.required && !o.envOnly ? { confirmMigrations: true } : {},
+      ...o.envOnly ? { envOnly: true } : {}
     };
     let sub = null;
     for (let i = 0;!sub; i++) {
@@ -8351,6 +9237,423 @@ Next: orbito doctor   then   orbito deploy --dry-run`);
     }
     exit = await finish(api, sub.deploymentId);
   });
+  async function planFrom(api, c) {
+    if (!(await checkServer(api)).features.manifest)
+      throw new CliError("This server cannot plan from orbito.json. Update the server: orbito-update", EXIT.invalid);
+    const desired = desiredOf(c);
+    const plan = await api.call("POST", `/apps/${c.appId}/plan`, desired, ManifestPlan);
+    if (g().json)
+      emit({ type: "plan", ...plan });
+    else {
+      if (plan.upToDate)
+        say("Nothing to do: the server matches orbito.json.");
+      for (const x of plan.changes)
+        rt.out(`${x.op === "add" ? "+" : "~"} ${x.what}: ${x.detail}
+`);
+      for (const b of plan.blockers)
+        rt.out(`! ${b}
+`);
+    }
+    return { desired, plan };
+  }
+  program.command("plan").description("compare orbito.json with the server; changes nothing").action(async () => {
+    const { c, api } = authed();
+    if ((await planFrom(api, c)).plan.blockers.length > 0)
+      exit = EXIT.failed;
+  });
+  program.command("apply").description("make the server match orbito.json; running it twice changes nothing").option("--yes", "accept the displayed plan without asking (never skips blockers)").action(async (o) => {
+    const { c, api } = authed();
+    const { desired, plan } = await planFrom(api, c);
+    if (plan.blockers.length > 0)
+      throw new CliError("The plan is blocked.", EXIT.failed);
+    if (plan.upToDate)
+      return;
+    await confirmOr("Apply this?", o.yes);
+    const done = await api.call("POST", `/apps/${c.appId}/apply`, { desired, hash: plan.hash });
+    if (g().json)
+      return emit({ type: "applied", ...done });
+    say(`Applied ${done.applied} change(s). They take effect on the next deploy: orbito deploy`);
+  });
+  const serverFor = (explicit) => {
+    if (explicit)
+      return clientFor(new URL(explicit).origin);
+    return clientFor(cfg().server);
+  };
+  const needManifest = async (api) => {
+    if (!(await checkServer(api)).features.manifest)
+      throw new CliError("This server cannot list projects. Update the server: orbito-update", EXIT.invalid);
+  };
+  program.command("projects").description("projects on the server that are not set up as apps yet (administrators)").option("--server <url>", "defaults to the server in orbito.json").action(async (o) => {
+    const api = serverFor(o.server);
+    await needManifest(api);
+    const rows = await api.call("GET", "/projects");
+    if (g().json)
+      return emit(rows);
+    if (rows.length === 0)
+      return say("Every project found on the server is set up.");
+    for (const r of rows)
+      rt.out(`${r.project}  ${r.runtimes.join(",") || "not running"}  port ${r.suggestedPort ?? "-"}
+`);
+  });
+  program.command("adopt").description("set a project up as an app. Nothing on the server changes: it is watched until you deploy").argument("<project>", "a name from orbito projects").option("--server <url>", "defaults to the server in orbito.json").action(async (project, o) => {
+    const api = serverFor(o.server);
+    await needManifest(api);
+    const made = await api.call("POST", "/projects/adopt", { project });
+    if (g().json)
+      return emit({ type: "adopted", ...made });
+    say(`'${project}' is now the app '${made.appId}'. It runs as before. Next: orbito init --app ${made.appId}`);
+  });
+  const needBuckets = async (api) => {
+    if (!(await checkServer(api)).features.buckets)
+      throw new CliError("This server has no storage commands. Update the server: orbito-update", EXIT.invalid);
+  };
+  const connection = program.command("storage").description("S3-compatible providers for app files (administrators)").command("connection").description("providers Orbito can create buckets on");
+  connection.command("add").description("add a provider. It is saved only after a real check of every operation").argument("<name>").requiredOption("--endpoint <url>", "for example https://s3.ir-thr-at1.arvanstorage.ir").requiredOption("--region <region>", "for example ir-thr-at1").requiredOption("--access-key <key>", "the access key id").option("--server <url>", "defaults to the server in orbito.json").addHelpText("after", `
+The secret key is read from stdin, never from an argument:
+  printf %s "$SECRET" | orbito storage connection add arvan --endpoint ... --region ... --access-key ...
+`).action(async (name, o) => {
+    const api = serverFor(o.server);
+    await needBuckets(api);
+    const raw = rt.isTTY ? await rt.ask("Secret key (shown as you type): ") : await rt.readStdin();
+    const secretKey = raw.trim();
+    if (!secretKey)
+      throw new CliError("Pipe in the secret key.", EXIT.invalid);
+    const made = await api.call("POST", "/storage/connections", {
+      name,
+      endpoint: o.endpoint,
+      region: o.region,
+      accessKey: o.accessKey,
+      secretKey
+    });
+    if (g().json)
+      return emit({ type: "connection", ...made });
+    say(`Checked and saved '${made.name}'. Next: orbito bucket create --connection ${made.name}`);
+  });
+  connection.command("ls").description("names and endpoints; keys are never shown").option("--server <url>", "defaults to the server in orbito.json").action(async (o) => {
+    const api = serverFor(o.server);
+    await needBuckets(api);
+    const rows = await api.call("GET", "/storage/connections", undefined, array(StorageConnection));
+    if (g().json)
+      return emit(rows);
+    for (const r of rows)
+      rt.out(`${r.name}  ${r.endpoint}  ${r.region}  checked ${r.verifiedAt ?? "never"}
+`);
+  });
+  connection.command("verify").description("run the check again").argument("<name>").option("--server <url>", "defaults to the server in orbito.json").action(async (name, o) => {
+    const api = serverFor(o.server);
+    await needBuckets(api);
+    const done = await api.call("POST", `/storage/connections/${encodeURIComponent(name)}/verify`, {});
+    if (g().json)
+      return emit({ type: "connection", ...done });
+    say(`'${done.name}' passed every step.`);
+  });
+  const bucketCmd = program.command("bucket").description("the app's buckets (sizes are measured, never limited)");
+  bucketCmd.command("ls").action(async () => {
+    const { c, api } = authed();
+    await needBuckets(api);
+    const rows = await api.call("GET", `/apps/${c.appId}/buckets`, undefined, array(AppBucket));
+    if (g().json)
+      return emit(rows);
+    for (const b of rows)
+      rt.out(`${b.binding}  ${b.bucket}  on ${b.connection}  ${b.bytes === null ? "not measured yet" : `${b.bytes} bytes, ${b.objects} objects`}
+`);
+  });
+  bucketCmd.command("create").description("create a private bucket and bind it to the app as S3_* variables").requiredOption("--connection <name>", "from orbito storage connection ls").option("--binding <name>", "for a second bucket: UPLOADS gives UPLOADS_S3_* variables").action(async (o) => {
+    const { c, api } = authed();
+    await needBuckets(api);
+    const made = await api.call("POST", `/apps/${c.appId}/buckets`, o);
+    if (g().json)
+      return emit({ type: "bucket", ...made });
+    say(`Created ${made.bucket}, bound as ${made.binding}. It takes effect on the next deploy: orbito deploy --env-only`);
+    info(`Note: ${made.note}`);
+  });
+  bucketCmd.command("remove").description("unbind a bucket. The bucket and its files stay at the provider").argument("<binding>").option("--confirm <binding>", "the binding again, for scripts").action(async (binding, o) => {
+    const { c, api } = authed();
+    await needBuckets(api);
+    let typed = o.confirm;
+    if (!typed) {
+      if (!rt.isTTY)
+        throw new CliError(`Not a terminal: pass --confirm ${binding}.`, EXIT.confirm);
+      typed = (await rt.ask(`Type ${binding} to confirm: `)).trim();
+    }
+    if (typed !== binding)
+      throw new CliError("It did not match. Nothing was changed.", EXIT.confirm);
+    const done = await api.call("DELETE", `/apps/${c.appId}/buckets/${encodeURIComponent(binding)}?confirm=${encodeURIComponent(typed)}`);
+    if (g().json)
+      return emit({ type: "bucket.removed", binding, note: done.note });
+    say(`Unbound ${binding}. ${done.note}`);
+  });
+  const environmentCmd = program.command("environment").description("the app's other environments, such as staging");
+  const needEnvironments = async (api) => {
+    if (!(await checkServer(api)).features.environments)
+      throw new CliError("This server has no environments. Update the server: orbito-update", EXIT.invalid);
+  };
+  environmentCmd.command("ls").action(async () => {
+    const { c, api } = authed();
+    await needEnvironments(api);
+    const rows = await api.call("GET", `/apps/${c.appId}/environments`, undefined, array(AppEnvironment));
+    if (g().json)
+      return emit(rows);
+    if (rows.length === 0)
+      say("Only production so far.");
+    for (const e of rows)
+      rt.out(`${e.environment}  ${e.id}  port ${e.port ?? "-"}  ${e.deployedSha?.slice(0, 12) ?? "not deployed"}
+`);
+  });
+  environmentCmd.command("create").description("add an environment: its own folder, user, port, database and variables (administrators)").argument("<name>", "for example staging").option("--port <port>", "the port it listens on; omit to let Orbito pick a free one").option("--branch <branch>", "the branch it deploys; defaults to the same as production").action(async (name, o) => {
+    const { c, api } = authed();
+    await needEnvironments(api);
+    const made = await api.call("POST", `/apps/${c.appId}/environments`, {
+      name,
+      ...o.port ? { port: Number(o.port) } : {},
+      ...o.branch ? { branch: o.branch } : {}
+    });
+    if (g().json)
+      return emit({ type: "environment", ...made });
+    say(`Created '${made.id}' on port ${made.port}. Copied ${made.copied.length} plain variable(s); production's secrets and database were not copied.`);
+    for (const n of made.secretsToSet)
+      say(`  set it: orbito env set ${n} --secret --env ${name}`);
+    say(`Next: orbito deploy --env ${name}`);
+  });
+  program.command("export").description("write files to run the app without Orbito: Dockerfile, Compose, a systemd unit, .env.example").option("--out <dir>", "an empty or new folder", "orbito-export").action(async (o) => {
+    const { c, api } = authed();
+    if (!(await checkServer(api)).features.export)
+      throw new CliError("This server cannot export. Update the server: orbito-update", EXIT.invalid);
+    const dir = path4.resolve(rt.cwd, o.out);
+    if (fs4.existsSync(dir) && fs4.readdirSync(dir).length > 0)
+      throw new CliError(`${dir} is not empty. Nothing was written.`, EXIT.invalid);
+    const { files } = await api.call("GET", `/apps/${c.appId}/export`);
+    fs4.mkdirSync(dir, { recursive: true });
+    for (const [name, text] of Object.entries(files)) {
+      if (name !== path4.basename(name))
+        throw new CliError(`The server sent an odd file name: ${name}`, EXIT.failed);
+      fs4.writeFileSync(path4.join(dir, name), text);
+    }
+    if (g().json)
+      return emit({ type: "export", dir, files: Object.keys(files) });
+    say(`Wrote ${Object.keys(files).length} files to ${dir}. They hold variable names, never values.`);
+  });
+  program.command("licence").description("the plan, the limit and how many apps count").option("--server <url>", "defaults to the server in orbito.json").action(async (o) => {
+    const api = serverFor(o.server);
+    if (!(await checkServer(api)).features.licence)
+      throw new CliError("This server does not report a licence. Update the server: orbito-update", EXIT.invalid);
+    const s = await api.call("GET", "/licence", undefined, LicenceState);
+    if (g().json)
+      return emit(s);
+    rt.out(`${s.plan}${s.customer ? ` for ${s.customer}` : ""}: ${s.used} of ${s.maxApps ?? "unlimited"} apps
+`);
+    if (s.expires)
+      rt.out(`Expires ${s.expires.slice(0, 10)}
+`);
+    if (s.problem)
+      rt.out(`${s.problem}
+`);
+  });
+  const domainCmd = program.command("domain").description("the app's domains, DNS and certificates");
+  const needDomains = async (api) => {
+    if (!(await checkServer(api)).features.domains)
+      throw new CliError("This server has no domain commands. Update the server: orbito-update", EXIT.invalid);
+  };
+  const showDomains = (list) => {
+    if (g().json)
+      return emit(list);
+    for (const d of list.domains)
+      rt.out(`${d.domain}  ${d.stage}
+  ${d.detail}
+`);
+    if (list.applied?.length)
+      rt.out(`Routed: ${list.applied.join(", ")}
+`);
+    if (list.note)
+      rt.out(`${list.note}
+`);
+  };
+  domainCmd.command("ls").description("each domain and how far along it is").action(async () => {
+    const { c, api } = authed();
+    await needDomains(api);
+    showDomains(await api.call("GET", `/apps/${c.appId}/domains`, undefined, DomainList));
+  });
+  domainCmd.command("add").description("add a domain; it is routed once its DNS points here").argument("<domain>").action(async (domain) => {
+    const { c, api } = authed();
+    await needDomains(api);
+    showDomains(await api.call("POST", `/apps/${c.appId}/domains`, { domain }, DomainList));
+  });
+  domainCmd.command("check").description("check DNS again and route what is ready").action(async () => {
+    const { c, api } = authed();
+    await needDomains(api);
+    showDomains(await api.call("POST", `/apps/${c.appId}/domains/check`, {}, DomainList));
+  });
+  domainCmd.command("remove").description("remove a domain; needs the domain typed again, or --confirm <domain>").argument("<domain>").option("--dry-run", "say what would happen; change nothing").option("--confirm <domain>", "the domain again, for scripts").action(async (domain, o) => {
+    const { c, api } = authed();
+    await needDomains(api);
+    say(`This stops '${c.appId}' answering on ${domain}.`);
+    if (o.dryRun)
+      return;
+    let typed = o.confirm;
+    if (!typed) {
+      if (!rt.isTTY)
+        throw new CliError(`Not a terminal: pass --confirm ${domain}.`, EXIT.confirm);
+      typed = (await rt.ask(`Type ${domain} to confirm: `)).trim();
+    }
+    if (typed !== domain)
+      throw new CliError("It did not match. Nothing was changed.", EXIT.confirm);
+    const done = await api.call("DELETE", `/apps/${c.appId}/domains/${encodeURIComponent(domain)}`);
+    if (g().json)
+      return emit({ type: "domain.removed", domain, note: done.note });
+    say(`Removed ${domain}.${done.note ? ` ${done.note}` : ""}`);
+  });
+  program.command("dev").description("start the local database, migrate, and run the dev script. Needs no Orbito server").option("--setup-only", "stop before running the dev script").action(async (o) => {
+    const c = cfg();
+    const database = await setupDatabase(rt, c);
+    if (database.engine === "none")
+      info('No local database: add "dev": { "database": "sqlite" } to orbito.json to get one.');
+    else
+      info(`Local database: ${database.engine}`);
+    const migrated = await runScript(rt, "db:migrate");
+    if (migrated)
+      throw new CliError("db:migrate failed.", EXIT.failed);
+    if (o.setupOnly)
+      return;
+    const code = await runScript(rt, "dev");
+    if (code === null)
+      throw new CliError("package.json has no dev script.", EXIT.invalid);
+    exit = code;
+  });
+  program.command("usage").description("what the app uses: memory, CPU, processes, restarts, disk (never limited)").option("--range <range>", "24h, 7d or 30d", "24h").action(async (o) => {
+    const { c, api } = authed();
+    if (!(await checkServer(api)).features.usage)
+      throw new CliError("This server does not measure usage. Update the server: orbito-update", EXIT.invalid);
+    const u = await api.call("GET", `/apps/${c.appId}/usage?range=${encodeURIComponent(o.range)}`, undefined, AppUsage);
+    if (g().json)
+      return emit(u);
+    if (!u.measured)
+      return say("No usage recorded yet. Only apps run by systemd are measured so far.");
+    const mb = (n) => n === null ? "-" : `${(n / 1048576).toFixed(0)} MB`;
+    rt.out(`${c.appId} at ${u.at}
+`);
+    rt.out(`  memory    ${mb(u.memoryBytes)} (peak ${mb(u.memoryPeakBytes)} in ${u.range})
+`);
+    rt.out(`  cpu       ${u.cpuPercent ?? "-"}% of one core
+`);
+    rt.out(`  processes ${u.pids ?? "-"}
+`);
+    rt.out(`  restarts  ${u.restarts ?? "-"}, out of memory ${u.oomKills ?? "-"}
+`);
+    rt.out(`  disk      ${mb(u.diskBytes)}
+`);
+    if (u.p50Ms != null)
+      rt.out(`  response  p50 ${u.p50Ms} ms, p95 ${u.p95Ms} ms, ${u.requests} requests, ${u.errors} server errors in ${u.range}
+`);
+    for (const a of u.alerts ?? [])
+      rt.out(`  ALERT     ${a.message}
+`);
+  });
+  const envCmd = program.command("env").description("variables Orbito holds for the app");
+  const needEnvCommands = async (api) => {
+    if (!(await checkServer(api)).features.envCommands)
+      throw new CliError("This server has no env commands. Update the server: orbito-update", EXIT.invalid);
+  };
+  envCmd.command("pull").description("copy variables to .env.local. Secrets are not copied: development uses its own").action(async () => {
+    const { c, api } = authed();
+    if (!(await checkServer(api)).features.envValues)
+      throw new CliError("This server cannot do this. Update the server: orbito-update", EXIT.invalid);
+    await ensureIgnored(rt);
+    const rows = await api.call("GET", `/apps/${c.appId}/env?values=plain`, undefined, EnvList);
+    const have = readEnvLocal(rt);
+    const pulled = rows.filter((v) => !v.secret && v.value !== undefined && v.name !== "DATABASE_URL");
+    writeEnvLocal(rt, Object.fromEntries(pulled.map((v) => [v.name, v.value])));
+    const missing = rows.filter((v) => v.secret && !(v.name in have) && v.name !== "DATABASE_URL").map((v) => v.name);
+    if (g().json)
+      return emit({ type: "env.pull", pulled: pulled.map((v) => v.name), secretsToSet: missing });
+    say(`Wrote ${pulled.length} variable(s) to .env.local.`);
+    if (missing.length)
+      say(`Secrets to set yourself in .env.local: ${missing.join(", ")}`);
+  });
+  envCmd.command("diff").description("names that differ between .env.local and the server; values are never shown").action(async () => {
+    const { c, api } = authed();
+    await needEnvCommands(api);
+    const rows = await api.call("GET", `/apps/${c.appId}/env`, undefined, EnvList);
+    const local = new Set(Object.keys(readEnvLocal(rt)));
+    const server = new Set(rows.map((r) => r.name));
+    const onlyLocal = [...local].filter((n) => !server.has(n)).sort();
+    const onlyServer = [...server].filter((n) => !local.has(n)).sort();
+    if (g().json)
+      return emit({ type: "env.diff", onlyLocal, onlyServer });
+    for (const n of onlyLocal)
+      rt.out(`local only   ${n}
+`);
+    for (const n of onlyServer)
+      rt.out(`server only  ${n}
+`);
+    if (!onlyLocal.length && !onlyServer.length)
+      say("The same names on both sides.");
+  });
+  envCmd.command("push").description("add variables from a file to the server. Never replaces one unless --overwrite").argument("<file>", "an env file").option("--overwrite", "also replace variables the server already has").option("--dry-run", "list what would change; change nothing").option("--yes", "do not ask").action(async (file, o) => {
+    const { c, api } = authed();
+    await needEnvCommands(api);
+    let text;
+    try {
+      text = fs4.readFileSync(path4.resolve(rt.cwd, file), "utf8");
+    } catch {
+      throw new CliError(`Cannot read ${file}.`, EXIT.invalid);
+    }
+    const rows = await api.call("GET", `/apps/${c.appId}/env`, undefined, EnvList);
+    const server = new Set(rows.map((r) => r.name));
+    const all = Object.entries(parseEnv(text)).filter(([n]) => n !== "DATABASE_URL");
+    const send = all.filter(([n]) => o.overwrite || !server.has(n));
+    for (const [n] of send)
+      rt[g().json ? "err" : "out"](`${server.has(n) ? "~" : "+"} ${n}
+`);
+    const skipped = all.length - send.length;
+    if (skipped)
+      info(`Left ${skipped} the server already has. Pass --overwrite to replace them.`);
+    if (o.dryRun || send.length === 0)
+      return;
+    await confirmOr("Send these to the server?", o.yes);
+    for (const [name, value] of send)
+      await api.call("POST", `/apps/${c.appId}/env`, { name, value });
+    if (g().json)
+      return emit({ type: "env.push", names: send.map(([n]) => n) });
+    say(`Sent ${send.length}. They take effect on the next deploy: orbito deploy --env-only`);
+  });
+  envCmd.command("ls").description("names only; values are never printed").action(async () => {
+    const { c, api } = authed();
+    await needEnvCommands(api);
+    const rows = await api.call("GET", `/apps/${c.appId}/env`, undefined, EnvList);
+    if (g().json)
+      return emit(rows);
+    for (const v of rows)
+      rt.out(`${v.name}${v.secret ? "  (secret)" : ""}  ${v.updatedAt}
+`);
+  });
+  envCmd.command("set").description("set a variable; the value comes from stdin, never from an argument").argument("<name>").option("--secret", "treat it as a secret").addHelpText("after", `
+Example:
+  printf %s "$VALUE" | orbito env set API_KEY --secret
+`).action(async (name, o) => {
+    const { c, api } = authed();
+    await needEnvCommands(api);
+    const raw = rt.isTTY ? await rt.ask(`Value for ${name} (shown as you type): `) : await rt.readStdin();
+    const value = raw.replace(/\r?\n$/, "");
+    await api.call("POST", `/apps/${c.appId}/env`, {
+      name,
+      value,
+      ...o.secret ? { secret: true } : {}
+    });
+    say(`Set ${name}. It takes effect on the next deploy: orbito deploy --env-only`);
+    if (g().json)
+      emit({ type: "env.set", name });
+  });
+  envCmd.command("unset").description("remove a variable from what Orbito holds").argument("<name>").option("--dry-run", "say what would be removed; change nothing").option("--yes", "do not ask").action(async (name, o) => {
+    const { c, api } = authed();
+    await needEnvCommands(api);
+    if (o.dryRun)
+      return say(`Would remove ${name}.`);
+    await confirmOr(`Remove ${name}?`, o.yes);
+    await api.call("DELETE", `/apps/${c.appId}/env/${encodeURIComponent(name)}`);
+    say(`Removed ${name} from Orbito. A deploy does not delete it from the .env already on the server.`);
+    if (g().json)
+      emit({ type: "env.unset", name });
+  });
   const dep = program.command("deployments").description("deployment history");
   dep.command("list").description("recent deployments").option("--limit <n>", "how many", "10").action(async (o) => {
     const { c, api } = authed();
@@ -8361,7 +9664,7 @@ Next: orbito doctor   then   orbito deploy --dry-run`);
       rt.out(`${d.id}  ${d.startedAt}  ${d.kind}  ${d.status}  ${d.sha?.slice(0, 12) ?? "-"}  ${d.actor}
 `);
   });
-  program.command("tail").description("follow runtime logs, or a deployment with --deployment").option("--deployment <id>", "follow a deployment and migration output instead").option("--lines <n>", "lines of history first (0-500)", "100").option("--since <iso>", "continue after this time (container logs only)").action(async (o) => {
+  program.command("tail").alias("logs").description("follow runtime logs, or a deployment with --deployment").option("--deployment <id>", "follow a deployment and migration output instead").option("--lines <n>", "lines of history first (0-500)", "100").option("--since <iso>", "continue after this time (container logs only)").action(async (o) => {
     const { c, api } = authed();
     if (o.deployment) {
       if (await follow(api, o.deployment) === "interrupted")
@@ -8434,19 +9737,129 @@ Next: orbito doctor   then   orbito deploy --dry-run`);
 `);
     for (const r of s.recent)
       rt.out(`  ${r.at}  ${r.deploymentId}  ${r.migration}  backup ${r.backup ?? "-"}
+`);
+  });
+  db.command("copy").description("replace an environment's data with a fresh copy of production's (use with --env)").option("--confirm <id>", "the environment id, for scripts; --yes is not accepted here").action(async (o) => {
+    const { c, api } = authed();
+    await needEnvironments(api);
+    say(`This replaces all data of '${c.appId}' with a copy of production's. Real data will be in this environment. A safety dump is taken first.`);
+    let typed = o.confirm;
+    if (!typed) {
+      if (!rt.isTTY)
+        throw new CliError(`Not a terminal: pass --confirm ${c.appId}.`, EXIT.confirm);
+      typed = (await rt.ask(`Type ${c.appId} to confirm: `)).trim();
+    }
+    if (typed !== c.appId)
+      throw new CliError("It did not match. Nothing was changed.", EXIT.confirm);
+    const done = await api.call("POST", `/apps/${c.appId}/db/copy`, { confirm: typed });
+    if (g().json)
+      return emit({ type: "db.copy", ...done });
+    rt.out(`Copied from ${done.from}. Safety dump: ${done.safety}
+`);
+  });
+  db.command("seed").description("local: run the db:seed script against the local database").action(async () => {
+    const code = await runScript(rt, "db:seed");
+    if (code === null)
+      throw new CliError("package.json has no db:seed script.", EXIT.invalid);
+    exit = code;
+  });
+  db.command("studio").description("local: run the db:studio script against the local database").action(async () => {
+    const code = await runScript(rt, "db:studio");
+    if (code === null)
+      throw new CliError("package.json has no db:studio script.", EXIT.invalid);
+    exit = code;
+  });
+  db.command("shell").description("local: open a shell on the local database").action(async () => {
+    const [cmd, args] = shellCommand(cfg(), rt.cwd);
+    exit = (await rt.run(cmd, args)).code;
+  });
+  db.command("reset").description("local: delete the local database, then migrate and seed. Never touches a server").option("--confirm <app-id>", "the app id, for scripts").action(async (o) => {
+    const c = cfg();
+    let typed = o.confirm;
+    if (!typed) {
+      if (!rt.isTTY)
+        throw new CliError(`Not a terminal: pass --confirm ${c.appId}.`, EXIT.confirm);
+      typed = (await rt.ask(`This deletes the local database. Type ${c.appId} to confirm: `)).trim();
+    }
+    if (typed !== c.appId)
+      throw new CliError("The app id did not match. Nothing was changed.", EXIT.confirm);
+    await dropDatabase(rt, c);
+    await setupDatabase(rt, c);
+    for (const script of ["db:migrate", "db:seed"]) {
+      const code = await runScript(rt, script);
+      if (code)
+        throw new CliError(`${script} failed.`, EXIT.failed);
+    }
+    say("The local database was recreated.");
+  });
+  const needDbBackups = async (api) => {
+    if (!(await checkServer(api)).features.dbBackups)
+      throw new CliError("This server has no database backup commands. Update the server: orbito-update", EXIT.invalid);
+  };
+  db.command("backup").description("take a dump of the database now").action(async () => {
+    const { c, api } = authed();
+    await needDbBackups(api);
+    const made = await api.call("POST", `/apps/${c.appId}/db/backup`, {});
+    if (g().json)
+      return emit({ type: "backup", ...made });
+    rt.out(`${made.file} (${made.bytes} bytes)
+`);
+  });
+  db.command("dumps").description("the dumps kept on the server").action(async () => {
+    const { c, api } = authed();
+    await needDbBackups(api);
+    const rows = await api.call("GET", `/apps/${c.appId}/db/dumps`);
+    if (g().json)
+      return emit(rows);
+    for (const d of rows)
+      rt.out(`${d.name}  ${d.bytes} bytes  ${d.at}
+`);
+  });
+  db.command("restore").description("replace the database with a kept dump (a safety dump is taken first; needs the app id typed)").argument("<file>", "a name from orbito db dumps").option("--dry-run", "say what would happen; change nothing").option("--confirm <app-id>", "the app id, for scripts; --yes is not accepted here").action(async (file, o) => {
+    const { c, api } = authed();
+    await needDbBackups(api);
+    say(`This replaces all data of '${c.appId}' with ${file}. A safety dump is taken first.`);
+    if (o.dryRun)
+      return;
+    let typed = o.confirm;
+    if (!typed) {
+      if (!rt.isTTY)
+        throw new CliError(`Not a terminal: pass --confirm ${c.appId}.`, EXIT.confirm);
+      typed = (await rt.ask(`Type ${c.appId} to confirm: `)).trim();
+    }
+    if (typed !== c.appId)
+      throw new CliError("The app id did not match. Nothing was changed.", EXIT.confirm);
+    const done = await api.call("POST", `/apps/${c.appId}/db/restore`, { file, confirm: typed });
+    if (g().json)
+      return emit({ type: "restore", ...done });
+    rt.out(`Restored ${done.restored}. Safety dump: ${done.safety}
 `);
   });
   db.command("migrate").description("apply migrations from a deployment (refused unless the server can prove it is safe)").requiredOption("--deployment <id>", "the deployment whose source to migrate from").action(async () => {
     const { c, api } = authed();
     await api.call("POST", `/apps/${c.appId}/db/migrate`, {});
   });
-  program.command("rollback").description("restore the earlier code release (refused if the database changed since)").requiredOption("--deployment <id>", "the latest successful deployment, which is undone").option("--detach", "return the deployment id without following").action(async (o) => {
+  program.command("rollback").description("restore the earlier code release (refused if the database changed since)").requiredOption("--deployment <id>", "the latest successful deployment, which is undone").option("--dry-run", "show what would be undone, or why it is refused; change nothing").option("--yes", "accept the displayed plan without asking").option("--detach", "return the deployment id without following").action(async (o) => {
     const { c, api } = authed();
+    if (!(await checkServer(api)).features.rollbackPlan)
+      throw new CliError("This server cannot plan a rollback. Update the server: orbito-update", EXIT.invalid);
+    const plan = await api.call("POST", `/apps/${c.appId}/rollback/plan`, { deploymentId: o.deployment }, Deployment);
+    if (g().json)
+      emit({ type: "plan", ...plan });
+    else
+      rt.out(`Roll back ${plan.id}: ${plan.sha?.slice(0, 12) ?? "unknown"} -> ${plan.from?.slice(0, 12) ?? "the earlier release"}
+`);
+    if (o.dryRun)
+      return;
+    await confirmOr("Roll back?", o.yes);
     const sub = await api.call("POST", `/apps/${c.appId}/rollback`, {
-      idempotencyKey: crypto.randomBytes(12).toString("hex"),
+      idempotencyKey: crypto2.randomBytes(12).toString("hex"),
       deploymentId: o.deployment
     });
-    say(`Submitted ${sub.deploymentId}.`);
+    if (g().json)
+      emit({ type: "submitted", ...sub });
+    else
+      say(`Submitted ${sub.deploymentId}.`);
     if (o.detach)
       return;
     if (await follow(api, sub.deploymentId) === "interrupted")
@@ -8555,5 +9968,55 @@ async function readSse(res, signal, on) {
   }
 }
 
+// src/update.ts
+import fs5 from "node:fs";
+import path5 from "node:path";
+var DAY = 24 * 60 * 60 * 1000;
+var newer = (a, b) => {
+  const p = (v) => v.split("-")[0].split(".").map((n) => Number(n) || 0);
+  const [x, y] = [p(a), p(b)];
+  for (let i = 0;i < 3; i++)
+    if ((x[i] ?? 0) !== (y[i] ?? 0))
+      return (x[i] ?? 0) > (y[i] ?? 0);
+  return false;
+};
+async function updateNotice(rt, name, current) {
+  if (!rt.isTTY || rt.env.CI || rt.env.ORBITO_NO_UPDATE_CHECK)
+    return null;
+  const cache = path5.join(rt.configDir, "update-check.json");
+  let latest;
+  try {
+    const c = JSON.parse(fs5.readFileSync(cache, "utf8"));
+    if (Date.now() - c.at < DAY)
+      latest = c.latest;
+  } catch {}
+  if (!latest) {
+    try {
+      const registry = (rt.env.npm_config_registry || "https://registry.npmjs.org").replace(/\/$/, "");
+      const res = await rt.fetch(`${registry}/${name.replace("/", "%2f")}/latest`, {
+        signal: AbortSignal.timeout(1500)
+      });
+      if (!res.ok)
+        return null;
+      latest = (await res.json()).version;
+      if (!latest)
+        return null;
+      fs5.mkdirSync(rt.configDir, { recursive: true, mode: 448 });
+      fs5.writeFileSync(cache, JSON.stringify({ at: Date.now(), latest }));
+    } catch {
+      return null;
+    }
+  }
+  return newer(latest, current) ? `Update available: ${current} → ${latest}. Run: bun add --dev --exact ${name}@latest` : null;
+}
+
 // src/main.ts
-process2.exitCode = await run(process2.argv.slice(2), realRuntime());
+var rt = realRuntime();
+var argv = process2.argv.slice(2);
+var notice = argv.includes("--json") ? Promise.resolve(null) : updateNotice(rt, "@deaduchiha/orbito", VERSION);
+process2.exitCode = await run(argv, rt);
+var n = await notice;
+if (n)
+  rt.err(`
+${n}
+`);