@inquir/compute-cli 0.1.3 → 0.2.0

package/dist/commands/apps.js

@@ -0,0 +1,857 @@
+import path from 'node:path';
+import { hasFlag, readFlagValue, readJsonFlag, readMultiFlag, readPositionalArgs } from '../utils/args.js';
+import { addApplicationDomain, archiveApplication, cancelBuild, createApplication, getBuild, listApplicationDomains, listBuilds, queueBuild, removeApplicationDomain, createRelease, execInRelease, getApplication, getRelease, listApplications, promoteRelease, requireAuth, resolveApplication, rollbackApplication, stopRelease, streamBuildLogs, streamReleaseLogs, updateApplication, verifyApplicationDomain, } from '../utils/api.js';
+import { createZipBase64, isSettledReleaseStatus, isTerminalBuildStatus } from '../sdk.js';
+import { formatElapsed, humanizeApiError, presentRelease } from '../utils/apps-presentation.js';
+import { buildApiOptions, runtime } from '../utils/context.js';
+import { CliError, ExitCode, usageError } from '../utils/errors.js';
+import { redact } from '../utils/redact.js';
+import { dim, formatTable, printCommandHelp, printInfo, printLine, printSuccess } from '../utils/output.js';
+/** Value flags across every subcommand — readPositionalArgs must know them all. */
+const VALUE_FLAGS = [
+    '--image',
+    '--port',
+    '--tcp',
+    '--env',
+    '--set',
+    '--memory',
+    '--cpu',
+    '--health-path',
+    '--health-command',
+    '--description',
+    '--tail',
+    '--timeout',
+    '--limit',
+    '--dir',
+    '--dockerfile',
+    '--context',
+    '--target',
+    '--build-arg',
+    '--build',
+    '--egress',
+];
+export async function appsCommand(args) {
+    const [subcommand, ...rest] = readPositionalArgs(args, { valueFlags: VALUE_FLAGS });
+    if (!subcommand || hasFlag(args, '--help') || hasFlag(args, '-h')) {
+        printAppsHelp();
+        if (!subcommand && !hasFlag(args, '--help') && !hasFlag(args, '-h')) {
+            throw usageError('Missing apps subcommand', 'inquir apps list');
+        }
+        return;
+    }
+    const apiOptions = buildApiOptions(args);
+    switch (subcommand) {
+        case 'list':
+            return listAppsSubcommand(args, apiOptions);
+        case 'create':
+            return createAppSubcommand(args, rest, apiOptions);
+        case 'deploy':
+            return deploySubcommand(args, rest, apiOptions);
+        case 'status':
+            return statusSubcommand(args, rest, apiOptions);
+        case 'logs':
+            return logsSubcommand(args, rest, apiOptions);
+        case 'promote':
+            return promoteSubcommand(args, rest, apiOptions);
+        case 'rollback':
+            return rollbackSubcommand(args, rest, apiOptions);
+        case 'stop':
+            return stopSubcommand(args, rest, apiOptions);
+        case 'exec':
+            return execSubcommand(args, rest, apiOptions);
+        case 'build':
+            return buildSubcommand(args, rest, apiOptions);
+        case 'builds':
+            return buildsSubcommand(args, rest, apiOptions);
+        case 'update':
+            return updateSubcommand(args, rest, apiOptions);
+        case 'domain':
+        case 'domains':
+            return domainSubcommand(args, rest, apiOptions);
+        case 'delete':
+            return deleteSubcommand(args, rest, apiOptions);
+        default:
+            throw usageError(`Unknown apps subcommand: ${subcommand}`, 'inquir apps list');
+    }
+}
+function printAppsHelp() {
+    printCommandHelp('apps', 'apps <subcommand> [options]', [
+        'list                        List applications',
+        'create <name>               Create an application',
+        'deploy <app> [--image <ref>] Release from an image, or build the current directory',
+        'build <app> [--dir <path>]  Build an image from source (Dockerfile) without releasing',
+        'builds <app>                List image builds',
+        'status <app>                Endpoints and recent releases',
+        'logs <app|release|build>    Stream container (or build) logs',
+        'promote <release>           Send production traffic to a release',
+        'rollback <app>              Return production to the previous release',
+        'stop <release>              Stop a release that is not serving production',
+        'exec <release> -- <cmd>     Run a command inside the container',
+        'update <app>                Change env vars, ports, resources, egress',
+        'domain <app> [hostname]     Bind a hostname (or list them); --verify / --remove',
+        'delete <app>                Archive an application (stops every release)',
+        '',
+        'Create/deploy flags:',
+        '--image <ref>               Container image, e.g. nginx:alpine (omit to build from source)',
+        '--dir <path>                Source directory to build (default: current directory)',
+        '--dockerfile <path>         Dockerfile relative to the context (default: Dockerfile)',
+        '--context <path>            Build context inside the source tree (default: .)',
+        '--build-arg KEY=VALUE       Docker build argument (repeatable)',
+        '--build <buildId>           Release an existing successful build',
+        '--port <n>                  HTTP port (omit for a TCP-only service)',
+        '--tcp <name:port[:public][:hostPort]>  Extra TCP port (repeatable)',
+        '--set KEY=VALUE             Environment variable (repeatable)',
+        '--memory <mb>               Memory ceiling (default 512)',
+        '--cpu <vcpus>               CPU ceiling (default 0.5)',
+        '--egress <none|full>        Outbound network policy',
+        '--health-path </path>       HTTP health check path',
+        '--health-command <cmd>      Health command inside the container (databases)',
+        '--no-wait                   Return as soon as the release is queued',
+        '--json                      Machine-readable JSON output',
+    ], [
+        'inquir apps create web --port 3000',
+        'inquir apps deploy web                # builds ./Dockerfile, then releases it',
+        'inquir apps deploy web --image nginx:alpine',
+        'inquir apps deploy cache --image redis:7-alpine --tcp redis:6379:public:26379 \\',
+        '  --health-command "redis-cli ping"',
+        'inquir apps logs web --tail 100',
+        'inquir apps promote <releaseId>',
+        'inquir apps domain web shop.example.com && inquir apps domain web shop.example.com --verify',
+    ]);
+}
+/**
+ * `--tcp name:port[:public][:hostPort]` — the shorthand people actually want
+ * to type for a database or SSH endpoint.
+ */
+export function parseTcpPortFlag(value) {
+    const parts = value.split(':');
+    const [name, portRaw, ...flags] = parts;
+    const port = Number(portRaw);
+    if (!name || !Number.isInteger(port) || port < 1 || port > 65535) {
+        throw usageError(`Invalid --tcp value '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public:25432');
+    }
+    const spec = { name, port, protocol: 'tcp' };
+    for (const flag of flags) {
+        if (flag === 'public') {
+            spec.public = true;
+            continue;
+        }
+        const hostPort = Number(flag);
+        if (Number.isInteger(hostPort) && hostPort > 0) {
+            spec.hostPort = hostPort;
+            // Pinning a host port is only meaningful for a port clients can reach.
+            spec.public = true;
+            continue;
+        }
+        throw usageError(`Invalid --tcp modifier '${flag}' in '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public:25432');
+    }
+    return spec;
+}
+export function parseSetFlags(values) {
+    const env = {};
+    for (const entry of values) {
+        const index = entry.indexOf('=');
+        if (index <= 0) {
+            throw usageError(`Invalid --set value '${entry}'`, 'inquir apps deploy <app> --set KEY=VALUE');
+        }
+        env[entry.slice(0, index)] = entry.slice(index + 1);
+    }
+    return env;
+}
+/** Runtime spec assembled from flags; undefined when nothing was specified. */
+export function buildRuntimeFromFlags(args) {
+    const portRaw = readFlagValue(args, '--port');
+    const tcpValues = readMultiFlag(args, '--tcp');
+    const memory = readFlagValue(args, '--memory');
+    const cpu = readFlagValue(args, '--cpu');
+    const healthPath = readFlagValue(args, '--health-path');
+    const healthCommand = readFlagValue(args, '--health-command');
+    const ports = tcpValues.map(parseTcpPortFlag);
+    const port = portRaw ? Number(portRaw) : undefined;
+    if (portRaw && (!Number.isInteger(port) || port < 1 || port > 65535)) {
+        throw usageError(`Invalid --port value '${portRaw}'`, 'inquir apps create <name> --port 3000');
+    }
+    if (port === undefined && ports.length === 0 && !memory && !cpu && !healthPath && !healthCommand) {
+        return undefined;
+    }
+    const spec = {
+        ...(port !== undefined ? { port } : {}),
+        ...(ports.length > 0 ? { ports } : {}),
+        resources: { cpuVCpus: cpu ? Number(cpu) : 0.5, memoryMb: memory ? Number(memory) : 512 },
+    };
+    if (healthCommand) {
+        spec.healthcheck = {
+            type: 'command',
+            command: healthCommand,
+            intervalSeconds: 30,
+            timeoutSeconds: 5,
+        };
+    }
+    else if (port !== undefined) {
+        spec.healthcheck = {
+            type: 'http',
+            path: healthPath || '/',
+            intervalSeconds: 30,
+            timeoutSeconds: 3,
+        };
+    }
+    return spec;
+}
+async function listAppsSubcommand(args, apiOptions) {
+    await requireAuth(apiOptions);
+    const result = await listApplications({ limit: 100 }, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (result.items.length === 0) {
+        printLine('No applications yet. Create one with: inquir apps create <name> --port 3000');
+        return;
+    }
+    // Health at a glance: what production is doing and where it answers.
+    printLine(formatTable(result.items.map((app) => ({
+        name: app.name,
+        production: app.production
+            ? presentRelease({ status: app.production.status, kind: 'production', failureReason: app.production.failureReason }).label
+            : 'nothing promoted',
+        url: app.production?.url ?? (app.production ? '(tcp only)' : ''),
+        ports: describeRuntimePorts(app.runtime) || '(per release)',
+        egress: app.networkPolicy?.egress ?? 'full',
+        id: app.id,
+    })), ['name', 'production', 'url', 'ports', 'egress', 'id']));
+}
+async function createAppSubcommand(args, positionals, apiOptions) {
+    const [name] = positionals;
+    if (!name)
+        throw usageError('Missing application name', 'inquir apps create <name> --port 3000');
+    await requireAuth(apiOptions);
+    const envVars = parseSetFlags(readMultiFlag(args, '--set'));
+    const app = await createApplication({
+        name,
+        description: readFlagValue(args, '--description'),
+        runtime: buildRuntimeFromFlags(args),
+        ...(Object.keys(envVars).length > 0 ? { envVars } : {}),
+    }, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(app, null, 2));
+        return;
+    }
+    printSuccess(`Created application ${app.name}`);
+    printInfo(dim(`  id: ${app.id}`));
+    printInfo(dim(`  deploy it: inquir apps deploy ${app.name}            (builds the Dockerfile in the current directory)`));
+    printInfo(dim(`         or: inquir apps deploy ${app.name} --image <ref>`));
+}
+async function deploySubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    const image = readFlagValue(args, '--image');
+    const existingBuild = readFlagValue(args, '--build');
+    if (!identifier) {
+        throw usageError('Missing application', 'inquir apps deploy <app> [--image nginx:alpine]');
+    }
+    if (image && existingBuild) {
+        throw usageError('Use either --image or --build, not both', 'inquir apps deploy <app> --image nginx:alpine');
+    }
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const runtimeSpec = buildRuntimeFromFlags(args);
+    const json = readJsonFlag(args);
+    // No image and no build id: build the source directory first, then release
+    // the produced image. That is the Railway-shaped default — a Dockerfile in
+    // the current directory is all a project needs.
+    let buildId = existingBuild;
+    if (!image && !buildId) {
+        const build = await runSourceBuild(app.id, app.name, args, apiOptions);
+        if (build.status !== 'success') {
+            throw new CliError(`Build ${build.id.slice(0, 8)} ${build.status}: ${build.error ?? 'see logs'}`, {
+                code: 'BUILD_FAILED',
+                exitCode: ExitCode.ERROR,
+                fix: `Inspect it: inquir apps logs ${build.id}`,
+            });
+        }
+        buildId = build.id;
+    }
+    const queued = await createRelease(app.id, {
+        ...(buildId ? { buildId } : { imageRef: image }),
+        ...(runtimeSpec ? { runtime: runtimeSpec } : {}),
+    }, apiOptions);
+    if (!json) {
+        printInfo(`Release ${queued.releaseId.slice(0, 8)} queued for ${app.name} (${image ?? `build ${buildId.slice(0, 8)}`})`);
+    }
+    if (hasFlag(args, '--no-wait')) {
+        if (json)
+            printLine(JSON.stringify(queued, null, 2));
+        else
+            printInfo(dim(`  status: inquir apps status ${app.name}`));
+        return;
+    }
+    const release = await waitForRelease(queued.releaseId, apiOptions);
+    if (json) {
+        printLine(JSON.stringify(release, null, 2));
+    }
+    else {
+        renderRelease(release, queued.previewUrl);
+    }
+    // A release that never became healthy is a failed command, not a note.
+    if (release.status === 'FAILED')
+        process.exitCode = ExitCode.ERROR;
+}
+/**
+ * Zip a source directory, queue a build for it and follow the build log until
+ * it settles. Returns the final build row.
+ */
+async function runSourceBuild(applicationId, appName, args, apiOptions) {
+    const dir = path.resolve(readFlagValue(args, '--dir') ?? process.cwd());
+    const json = readJsonFlag(args);
+    const buildArgs = parseSetFlags(readMultiFlag(args, '--build-arg'));
+    if (!json)
+        printInfo(dim(`— packing ${dir} —`));
+    const sourceZipBase64 = await createZipBase64(dir);
+    const queued = await queueBuild(applicationId, {
+        sourceZipBase64,
+        source: 'cli',
+        force: hasFlag(args, '--force'),
+        build: {
+            ...(readFlagValue(args, '--dockerfile') ? { dockerfile: readFlagValue(args, '--dockerfile') } : {}),
+            ...(readFlagValue(args, '--context') ? { context: readFlagValue(args, '--context') } : {}),
+            ...(readFlagValue(args, '--target') ? { target: readFlagValue(args, '--target') } : {}),
+            ...(Object.keys(buildArgs).length > 0 ? { args: buildArgs } : {}),
+        },
+    }, apiOptions);
+    if (!json) {
+        printInfo(queued.deduplicated
+            ? `Build ${queued.buildId.slice(0, 8)} reused (identical source already built)`
+            : `Build ${queued.buildId.slice(0, 8)} queued for ${appName}`);
+    }
+    if (queued.deduplicated || isTerminalBuildStatus(queued.status)) {
+        return getBuild(queued.buildId, apiOptions);
+    }
+    // Follow the build log to the terminal event; the SSE stream ends on completion.
+    for await (const event of streamBuildLogs(queued.buildId, apiOptions)) {
+        if (event.type === 'log' && event.line) {
+            if (json)
+                process.stderr.write(`${redact(event.line)}\n`);
+            else
+                printLine(dim(`  ${event.line}`));
+        }
+        else if (event.type === 'complete') {
+            break;
+        }
+        else if (event.type === 'error') {
+            printLine(dim(`— ${event.message ?? 'stream error'} —`));
+            break;
+        }
+    }
+    return waitForBuild(queued.buildId, apiOptions);
+}
+async function waitForBuild(buildId, apiOptions, timeoutMs = 20 * 60_000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const build = await getBuild(buildId, apiOptions);
+        if (isTerminalBuildStatus(build.status))
+            return build;
+        if (Date.now() > deadline) {
+            throw new CliError(`Build ${buildId} did not finish within ${Math.round(timeoutMs / 1000)}s`, {
+                code: 'BUILD_TIMEOUT',
+                exitCode: ExitCode.ERROR,
+                fix: `Check its logs: inquir apps logs ${buildId}`,
+            });
+        }
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+}
+/** Poll until the release settles; the platform decides when it is healthy. */
+async function waitForRelease(releaseId, apiOptions, timeoutMs = 10 * 60_000) {
+    const deadline = Date.now() + timeoutMs;
+    const startedAt = Date.now();
+    let lastStatus = '';
+    const json = readJsonFlag(process.argv);
+    for (;;) {
+        const release = await getRelease(releaseId, apiOptions);
+        if (release.status !== lastStatus) {
+            lastStatus = release.status;
+            // Say what is happening in words, with elapsed time — a two-minute health
+            // gate in silence reads as a hang. Under --json only stdout must stay
+            // parseable; progress goes to stderr.
+            const shown = presentRelease(release);
+            const line = `— ${shown.label} (${formatElapsed(Date.now() - startedAt)})${shown.meaning ? `: ${shown.meaning}` : ''} —`;
+            if (json)
+                process.stderr.write(`${line}\n`);
+            else
+                printInfo(dim(line));
+        }
+        if (isSettledReleaseStatus(release.status))
+            return release;
+        if (Date.now() > deadline) {
+            throw new CliError(`Release ${releaseId} did not settle within ${Math.round(timeoutMs / 1000)}s`, {
+                code: 'RELEASE_TIMEOUT',
+                exitCode: ExitCode.ERROR,
+                fix: `Check its logs: inquir apps logs ${releaseId}`,
+            });
+        }
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+}
+function renderRelease(release, previewUrl) {
+    const shown = presentRelease(release);
+    if (release.status === 'FAILED') {
+        printLine(`✗ Release ${release.id.slice(0, 8)} failed: ${release.failureReason ?? 'unknown reason'}`);
+        if (shown.hint)
+            printInfo(dim(`  ${shown.hint}`));
+        printInfo(dim(`  logs: inquir apps logs ${release.id}`));
+        return;
+    }
+    printSuccess(`Release ${release.id.slice(0, 8)} is ${shown.label}`);
+    const endpoints = releaseEndpointLines(release, previewUrl);
+    if (endpoints.length === 0) {
+        printInfo(dim('  no reachable endpoint — the ports are internal to the host'));
+    }
+    else {
+        for (const line of endpoints)
+            printLine(`  ${line}`);
+    }
+    if (release.kind !== 'production') {
+        printInfo(dim(`  send production traffic to it: inquir apps promote ${release.id}`));
+    }
+}
+/**
+ * Where a client can actually connect. Public endpoints first; a host-local
+ * port is still printed (marked as such) because on an installation with no
+ * public hostname it is the only way in.
+ */
+export function releaseEndpointLines(release, previewUrl, options = {}) {
+    const lines = [];
+    if (previewUrl)
+        lines.push(previewUrl);
+    for (const url of release.urls ?? []) {
+        if (!lines.includes(url.url))
+            lines.push(url.url);
+    }
+    for (const port of release.ports ?? []) {
+        if (port.protocol === 'tcp' && port.public) {
+            lines.push(`${port.endpoint ?? `localhost:${port.hostPort ?? '?'}`}  (${port.name})`);
+        }
+    }
+    if (lines.length === 0 && options.includeHostLocal !== false) {
+        for (const port of release.ports ?? []) {
+            if (port.hostPort === undefined)
+                continue;
+            const address = port.protocol === 'http'
+                ? `http://localhost:${port.hostPort}`
+                : `localhost:${port.hostPort}`;
+            lines.push(`${address}  (${port.name}, host-local)`);
+        }
+    }
+    return lines;
+}
+/** A build-sourced release is best named by its build; a pulled one by its ref. */
+export function describeImage(release) {
+    if (release.imageSource === 'build' && release.buildId)
+        return `build ${release.buildId.slice(0, 8)}`;
+    return release.imageRef ?? release.imageDigest.slice(0, 19);
+}
+function describeRuntimePorts(spec) {
+    if (!spec)
+        return '';
+    const parts = [];
+    if (spec.port)
+        parts.push(`http:${spec.port}`);
+    for (const port of spec.ports ?? []) {
+        if (port.port === spec.port)
+            continue;
+        parts.push(`${port.protocol}:${port.port}${port.public ? '*' : ''}`);
+    }
+    return parts.join(' ');
+}
+async function statusSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps status <app>');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const detail = await getApplication(app.id, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(detail, null, 2));
+        return;
+    }
+    printLine(`${detail.name}${detail.description ? dim(` — ${detail.description}`) : ''}`);
+    for (const url of detail.production?.urls ?? [])
+        printLine(`  production: ${url}`);
+    if (detail.production && (detail.production.urls ?? []).length === 0) {
+        printLine(`  production: release ${detail.production.activeReleaseId?.slice(0, 8) ?? '?'} (no hostname)`);
+    }
+    const active = detail.releases.find((r) => r.id === detail.production?.activeReleaseId);
+    // With a production hostname the loopback port is noise; without one it is
+    // the only way in and must be shown.
+    const hasProductionUrl = (detail.production?.urls ?? []).length > 0;
+    const endpoints = active ? releaseEndpointLines(active, undefined, { includeHostLocal: !hasProductionUrl }) : [];
+    for (const endpoint of endpoints)
+        printLine(`  endpoint:   ${endpoint}`);
+    for (const domain of detail.domains ?? []) {
+        if (domain.custom && !domain.verified) {
+            printLine(`  domain:     ${domain.hostname} ${dim('(unverified — inquir apps domain ' + detail.name + ' ' + domain.hostname + ' --verify)')}`);
+        }
+    }
+    if (detail.releases.length === 0) {
+        printLine('  no releases yet');
+        return;
+    }
+    printLine('');
+    printLine(formatTable(detail.releases.slice(0, 10).map((release) => ({
+        release: release.id.slice(0, 8),
+        status: presentRelease(release).label,
+        kind: release.kind,
+        image: describeImage(release),
+        restarts: String(release.restartCount),
+        created: release.createdAt,
+    })), ['release', 'status', 'kind', 'image', 'restarts', 'created']));
+}
+/** Accepts a release id, or an app whose running release we pick. */
+async function resolveReleaseId(identifier, apiOptions) {
+    try {
+        const release = await getRelease(identifier, apiOptions);
+        return release.id;
+    }
+    catch {
+        /* not a release id — fall through to the application lookup */
+    }
+    const app = await resolveApplication(identifier, apiOptions);
+    const detail = await getApplication(app.id, apiOptions);
+    const active = detail.releases.find((r) => r.id === detail.production?.activeReleaseId) ??
+        detail.releases.find((r) => r.status === 'ACTIVE' || r.status === 'READY') ??
+        detail.releases[0];
+    if (!active) {
+        throw new CliError(`Application ${app.name} has no releases`, {
+            code: 'NO_RELEASES',
+            exitCode: ExitCode.ERROR,
+            fix: `Deploy one: inquir apps deploy ${app.name} --image <image>`,
+        });
+    }
+    return active.id;
+}
+async function logsSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application or release', 'inquir apps logs <app>');
+    await requireAuth(apiOptions);
+    const json = readJsonFlag(args);
+    // A build id streams the build log instead of container output.
+    const build = await getBuild(identifier, apiOptions).catch(() => null);
+    if (build) {
+        printInfo(dim(`— build ${build.id.slice(0, 8)} (${build.status}) —`));
+        for await (const event of streamBuildLogs(build.id, apiOptions)) {
+            if (event.type === 'log' && event.line) {
+                if (json)
+                    process.stderr.write(`${redact(event.line)}\n`);
+                else
+                    printLine(event.line);
+            }
+            else if (event.type === 'complete') {
+                printInfo(dim(`— build ${event.status ?? 'finished'} —`));
+                break;
+            }
+            else if (event.type === 'error') {
+                printLine(dim(`— ${event.message ?? 'stream error'} —`));
+                break;
+            }
+        }
+        return;
+    }
+    const releaseId = await resolveReleaseId(identifier, apiOptions);
+    const tailRaw = readFlagValue(args, '--tail');
+    const tail = tailRaw ? Number(tailRaw) : 200;
+    printInfo(dim(`— streaming logs for release ${releaseId.slice(0, 8)} (ctrl-c to stop) —`));
+    for await (const event of streamReleaseLogs(releaseId, { tail }, apiOptions)) {
+        if (event.type === 'log' && event.line) {
+            // Under --json the log tail goes to stderr so stdout stays parseable.
+            if (json)
+                process.stderr.write(`${redact(event.line)}\n`);
+            else
+                printLine(event.line);
+        }
+        else if (event.type === 'error') {
+            printLine(dim(`— ${event.message ?? 'stream error'} —`));
+        }
+        else if (event.type === 'complete') {
+            printInfo(dim('— stream ended —'));
+            break;
+        }
+    }
+}
+async function promoteSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing release', 'inquir apps promote <release>');
+    await requireAuth(apiOptions);
+    const releaseId = await resolveReleaseId(identifier, apiOptions);
+    const json = readJsonFlag(args);
+    // Say up front what promotion does to this release: a preview-profile
+    // release with production-only variables is restarted with them before
+    // traffic moves, and its preview URL retires.
+    if (!json) {
+        const release = await getRelease(releaseId, apiOptions).catch(() => null);
+        const app = release ? await getApplication(release.applicationId, apiOptions).catch(() => null) : null;
+        if (release && release.envProfile !== 'production' && (app?.productionOnlyEnvKeys?.length ?? 0) > 0) {
+            printInfo(dim('  the container restarts with production-only variables before traffic moves'));
+        }
+        if (release?.urls?.some((u) => u.kind === 'preview')) {
+            printInfo(dim('  its preview URL retires once it serves production'));
+        }
+    }
+    let result;
+    try {
+        result = await promoteRelease(releaseId, apiOptions);
+    }
+    catch (err) {
+        if (err instanceof Error)
+            err.message = humanizeApiError(err.message);
+        throw err;
+    }
+    if (json) {
+        printLine(JSON.stringify(result, null, 2));
+        return;
+    }
+    printSuccess(`Production now serves ${releaseId.slice(0, 8)}`);
+    for (const url of result.productionUrls ?? (result.productionUrl ? [result.productionUrl] : [])) {
+        printLine(`  ${url}`);
+    }
+    if ((result.productionUrls ?? []).length === 0 && !result.productionUrl) {
+        printInfo(dim('  no hostname — reach it at its TCP endpoints (inquir apps status <app>)'));
+    }
+    if (result.previousReleaseId) {
+        printInfo(dim(`  previous release ${result.previousReleaseId.slice(0, 8)} kept for rollback`));
+    }
+}
+async function rollbackSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps rollback <app>');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const result = await rollbackApplication(app.id, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(result, null, 2));
+        return;
+    }
+    printSuccess(result.mode === 'instant'
+        ? `Rolled back to ${result.releaseId.slice(0, 8)} — traffic moved instantly (its container was still running)`
+        : `Restarting ${result.releaseId.slice(0, 8)} to roll back — traffic moves once it passes its health check`);
+    if (result.mode !== 'instant')
+        printInfo(dim(`  watch it: inquir apps status ${app.name}`));
+}
+async function stopSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing release', 'inquir apps stop <release>');
+    await requireAuth(apiOptions);
+    const releaseId = await resolveReleaseId(identifier, apiOptions);
+    await stopRelease(releaseId, apiOptions);
+    printSuccess(`Stopped release ${releaseId.slice(0, 8)} — its container is gone and its URL no longer resolves`);
+}
+/** `apps build <app> [--dir] [--dockerfile] [--context] [--build-arg]` — build only, no release. */
+async function buildSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps build <app> --dir .');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const build = await runSourceBuild(app.id, app.name, args, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(build, null, 2));
+    }
+    else if (build.status === 'success') {
+        printSuccess(`Build ${build.id.slice(0, 8)} succeeded (${build.imageDigest?.slice(0, 19) ?? 'no digest'})`);
+        printInfo(dim(`  release it: inquir apps deploy ${app.name} --build ${build.id}`));
+    }
+    else {
+        printLine(`✗ Build ${build.id.slice(0, 8)} ${build.status}: ${build.error ?? 'see logs'}`);
+    }
+    if (build.status !== 'success')
+        process.exitCode = ExitCode.ERROR;
+}
+/** `apps builds <app>` — build history; `--cancel <buildId>` drops a queued one. */
+async function buildsSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps builds <app>');
+    await requireAuth(apiOptions);
+    const cancelId = readFlagValue(args, '--cancel');
+    if (cancelId) {
+        await cancelBuild(cancelId, apiOptions);
+        printSuccess(`Cancelled build ${cancelId.slice(0, 8)}`);
+        return;
+    }
+    const app = await resolveApplication(identifier, apiOptions);
+    const { items } = await listBuilds(app.id, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(items, null, 2));
+        return;
+    }
+    if (items.length === 0) {
+        printLine(`No builds yet for ${app.name}. Build one: inquir apps build ${app.name}`);
+        return;
+    }
+    printLine(formatTable(items.map((b) => ({
+        build: b.id.slice(0, 8),
+        status: b.status,
+        dockerfile: b.dockerfile ?? 'Dockerfile',
+        image: b.imageDigest?.slice(0, 19) ?? '',
+        cached: b.reusedFromBuildId ? 'yes' : '',
+        created: b.createdAt,
+    })), ['build', 'status', 'dockerfile', 'image', 'cached', 'created']));
+}
+/** `apps update <app>` — env vars, ports, resources, health, egress. */
+async function updateSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps update <app> --set KEY=VALUE');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const envVars = parseSetFlags(readMultiFlag(args, '--set'));
+    const runtimeSpec = buildRuntimeFromFlags(args);
+    const egress = readFlagValue(args, '--egress');
+    const description = readFlagValue(args, '--description');
+    if (egress && egress !== 'none' && egress !== 'full') {
+        throw usageError(`Invalid --egress '${egress}'`, 'inquir apps update <app> --egress none');
+    }
+    const patch = {
+        ...(description !== undefined ? { description } : {}),
+        ...(runtimeSpec ? { runtime: runtimeSpec } : {}),
+        // Only the keys given here change; the server merges masked values, so
+        // untouched secrets survive.
+        ...(Object.keys(envVars).length > 0 ? { envVars: { ...(app.envVars ?? {}), ...envVars } } : {}),
+        ...(egress ? { networkPolicy: { egress: egress, allow: [] } } : {}),
+    };
+    if (Object.keys(patch).length === 0) {
+        throw usageError('Nothing to update', 'inquir apps update <app> --set KEY=VALUE');
+    }
+    const updated = await updateApplication(app.id, patch, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(updated, null, 2));
+        return;
+    }
+    printSuccess(`Updated ${updated.name}`);
+    printInfo(dim('  changes apply to the next release: inquir apps deploy ' + updated.name));
+}
+async function execSubcommand(args, positionals, apiOptions) {
+    const [identifier, ...commandParts] = positionals;
+    if (!identifier)
+        throw usageError('Missing release', 'inquir apps exec <app> -- <command>');
+    const command = commandParts.join(' ').trim();
+    if (!command)
+        throw usageError('Missing command', 'inquir apps exec <app> -- ls -la');
+    await requireAuth(apiOptions);
+    const releaseId = await resolveReleaseId(identifier, apiOptions);
+    const timeoutRaw = readFlagValue(args, '--timeout');
+    let result;
+    try {
+        result = await execInRelease(releaseId, command, timeoutRaw ? Number(timeoutRaw) : undefined, apiOptions);
+    }
+    catch (err) {
+        if (err instanceof Error)
+            err.message = humanizeApiError(err.message);
+        throw err;
+    }
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(result, null, 2));
+    }
+    else {
+        if (result.stdout)
+            process.stdout.write(result.stdout);
+        if (result.stderr)
+            process.stderr.write(result.stderr);
+        if (result.truncated)
+            printInfo(dim('— output truncated —'));
+    }
+    if (result.exitCode !== 0)
+        process.exitCode = ExitCode.ERROR;
+}
+function printVerificationInstructions(domain) {
+    const v = domain.verification;
+    if (!v)
+        return;
+    printInfo(dim('  prove ownership, then verify:'));
+    printLine(`    TXT   ${v.txtName}  →  ${v.txtValue}`);
+    for (const target of v.cnameTargets)
+        printLine(`    CNAME ${domain.hostname}  →  ${target}`);
+    for (const ip of v.ingressIps)
+        printLine(`    A     ${domain.hostname}  →  ${ip}`);
+    if (v.ingressAliasTarget)
+        printLine(`    ALIAS ${domain.hostname}  →  ${v.ingressAliasTarget}`);
+}
+/**
+ * `apps domain <app> [hostname] [--verify|--remove]` — bind a custom hostname
+ * to an application. A new hostname starts unverified: publish the TXT record
+ * and point DNS at the platform, then run again with --verify.
+ */
+async function domainSubcommand(args, positionals, apiOptions) {
+    const [identifier, hostname] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps domain <app> <hostname>');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    if (!hostname) {
+        const { items } = await listApplicationDomains(app.id, apiOptions);
+        if (readJsonFlag(args)) {
+            printLine(JSON.stringify(items, null, 2));
+            return;
+        }
+        if (items.length === 0) {
+            printLine(`No hostnames bound to ${app.name}`);
+            printInfo(dim(`  bind one: inquir apps domain ${app.name} app.example.com`));
+            return;
+        }
+        printLine(formatTable(items.map((d) => ({
+            hostname: d.hostname,
+            kind: d.kind,
+            source: d.custom ? 'custom' : 'generated',
+            verified: d.verified ? 'yes' : 'no',
+        })), ['hostname', 'kind', 'source', 'verified']));
+        for (const d of items)
+            if (!d.verified)
+                printVerificationInstructions(d);
+        return;
+    }
+    if (hasFlag(args, '--remove')) {
+        await removeApplicationDomain(app.id, hostname, apiOptions);
+        printSuccess(`Unbound ${hostname} from ${app.name}`);
+        return;
+    }
+    if (hasFlag(args, '--verify')) {
+        const verified = await verifyApplicationDomain(app.id, hostname, apiOptions);
+        if (readJsonFlag(args)) {
+            printLine(JSON.stringify(verified, null, 2));
+            return;
+        }
+        printSuccess(`${verified.hostname} verified — it now serves ${app.name}`);
+        if (!verified.activeReleaseId) {
+            printInfo(dim('  no release is promoted yet: inquir apps promote <release>'));
+        }
+        return;
+    }
+    const domain = await addApplicationDomain(app.id, hostname, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(domain, null, 2));
+        return;
+    }
+    printSuccess(`${domain.hostname} bound to ${app.name} (unverified)`);
+    printVerificationInstructions(domain);
+    printInfo(dim(`  then: inquir apps domain ${app.name} ${domain.hostname} --verify`));
+}
+async function deleteSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps delete <app>');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    if (!runtime().yes) {
+        throw new CliError(`Refusing to archive ${app.name} without confirmation`, {
+            code: 'CONFIRMATION_REQUIRED',
+            exitCode: ExitCode.USAGE,
+            fix: `Re-run with --yes: inquir apps delete ${app.name} --yes`,
+        });
+    }
+    await archiveApplication(app.id, apiOptions);
+    printSuccess(`Archived ${app.name}`);
+    printInfo(dim('  every release was stopped and every hostname unbound'));
+}
+//# sourceMappingURL=apps.js.map