@inquir/compute-cli 0.2.2 → 0.3.0

package/dist/commands/apps.js

@@ -1,17 +1,23 @@
 import path from 'node:path';
-import { hasFlag, readFlagValue, readJsonFlag, readMultiFlag, readPositionalArgs } from '../utils/args.js';
-import { addApplicationDomain, archiveApplication, cancelBuild, createApplication, getBuild, listApplicationDomains, listBuilds, queueBuild, removeApplicationDomain, createRelease, execInRelease, getApplication, getRelease, listApplications, promoteRelease, requireAuth, resolveApplication, rollbackApplication, stopRelease, streamBuildLogs, streamReleaseLogs, updateApplication, verifyApplicationDomain, } from '../utils/api.js';
+import { hasFlag, readFlagValue, readJsonFlag, readLimitFlag, readMultiFlag, readPositionalArgs, } from '../utils/args.js';
+import { listAppBackups, getAppBackup, createAppBackup, deleteAppBackup, restoreAppBackup, getAppConnectionUrl, connectApps, addApplicationDomain, archiveApplication, cancelBuild, createApplication, getBuild, listApplicationDomains, listBuilds, queueBuild, removeApplicationDomain, createRelease, redeployApplication, execInApplication, getAppLimits, getApplication, getRelease, listApplications, promoteRelease, requireAuth, resolveApplication, rollbackApplication, stopRelease, streamBuildLogs, streamReleaseLogs, updateApplication, wakeApplication, pauseApplication, verifyApplicationDomain, } from '../utils/api.js';
 import { createZipBase64, isSettledReleaseStatus, isTerminalBuildStatus } from '../sdk.js';
-import { formatElapsed, humanizeApiError, presentRelease } from '../utils/apps-presentation.js';
+import { formatBytes, formatElapsed, humanizeApiError, permanentAddress, presentRelease, } from '../utils/apps-presentation.js';
 import { buildApiOptions, runtime } from '../utils/context.js';
+import { confirm } from '../utils/prompt.js';
+import { resolveCreateProject } from '../utils/project-context.js';
 import { CliError, ExitCode, usageError } from '../utils/errors.js';
-import { redact } from '../utils/redact.js';
-import { dim, formatTable, printCommandHelp, printInfo, printLine, printSuccess } from '../utils/output.js';
+import { redact, registerSecret } from '../utils/redact.js';
+import { dim, formatTable, printCommandHelp, printError, printInfo, printLine, printSuccess } from '../utils/output.js';
 /** Value flags across every subcommand — readPositionalArgs must know them all. */
 const VALUE_FLAGS = [
+    '--project',
+    '--template',
     '--image',
     '--port',
     '--tcp',
+    '--volume',
+    '--volume-runner',
     '--env',
     '--set',
     '--memory',
@@ -22,6 +28,7 @@ const VALUE_FLAGS = [
     '--tail',
     '--timeout',
     '--limit',
+    '--cursor',
     '--dir',
     '--dockerfile',
     '--context',
@@ -29,9 +36,22 @@ const VALUE_FLAGS = [
     '--build-arg',
     '--build',
     '--egress',
+    '--ingress',
+    '--activation',
+    '--mode',
+    '--idle',
+    '--idle-timeout',
+    '--activation-timeout',
+    '--stabilization',
+    '--scale-down-stabilization',
+    '--replicas',
 ];
 export async function appsCommand(args) {
     const [subcommand, ...rest] = readPositionalArgs(args, { valueFlags: VALUE_FLAGS });
+    if (subcommand && (hasFlag(args, '--help') || hasFlag(args, '-h')) && SUBCOMMAND_HELP[subcommand]) {
+        SUBCOMMAND_HELP[subcommand].forEach((line) => printLine(line));
+        return;
+    }
     if (!subcommand || hasFlag(args, '--help') || hasFlag(args, '-h')) {
         printAppsHelp();
         if (!subcommand && !hasFlag(args, '--help') && !hasFlag(args, '-h')) {
@@ -40,6 +60,10 @@ export async function appsCommand(args) {
         return;
     }
     const apiOptions = buildApiOptions(args);
+    const flagArgs = args.includes('--') ? args.slice(0, args.indexOf('--')) : args;
+    if (subcommand !== 'create' && hasFlag(flagArgs, '--project')) {
+        throw usageError('--project is only supported by apps create', 'inquir projects add <project> <app>');
+    }
     switch (subcommand) {
         case 'list':
             return listAppsSubcommand(args, apiOptions);
@@ -47,6 +71,8 @@ export async function appsCommand(args) {
             return createAppSubcommand(args, rest, apiOptions);
         case 'deploy':
             return deploySubcommand(args, rest, apiOptions);
+        case 'redeploy':
+            return redeploySubcommand(args, rest, apiOptions);
         case 'status':
             return statusSubcommand(args, rest, apiOptions);
         case 'logs':
@@ -65,9 +91,21 @@ export async function appsCommand(args) {
             return buildsSubcommand(args, rest, apiOptions);
         case 'update':
             return updateSubcommand(args, rest, apiOptions);
+        case 'scale':
+            return scaleSubcommand(args, rest, apiOptions);
+        case 'wake':
+            return wakeSubcommand(args, rest, apiOptions);
+        case 'pause':
+            return pauseSubcommand(args, rest, apiOptions);
         case 'domain':
         case 'domains':
             return domainSubcommand(args, rest, apiOptions);
+        case 'backups':
+            return backupsSubcommand(args, rest, apiOptions);
+        case 'connect':
+            return connectSubcommand(args, rest, apiOptions);
+        case 'connection-url':
+            return connectionUrlSubcommand(args, rest, apiOptions);
         case 'delete':
             return deleteSubcommand(args, rest, apiOptions);
         default:
@@ -79,6 +117,10 @@ function printAppsHelp() {
         'list                        List applications',
         'create <name>               Create an application',
         'deploy <app> [--image <ref>] Release from an image, or build the current directory',
+        'redeploy <app>              Release what production runs again; promote when healthy',
+        'backups <app> [list|create|restore <id>|delete <id>]  Volume backups (databases)',
+        'connect <db> <app>          Put the database URL into another app\'s env',
+        'connection-url <db>         Print a private URL, or public fallback (--private/--public)',
         'build <app> [--dir <path>]  Build an image from source (Dockerfile) without releasing',
         'builds <app>                List image builds',
         'status <app>                Endpoints and recent releases',
@@ -88,47 +130,68 @@ function printAppsHelp() {
         'stop <release>              Stop a release that is not serving production',
         'exec <release> -- <cmd>     Run a command inside the container',
         'update <app>                Change env vars, ports, resources, egress',
+        'scale <app> [mode]          Set always/http/manual scaling (--replicas for always)',
+        'wake <app>                  Start a sleeping application',
+        'pause <app>                 Stop an http/manual app (HTTP wakes only http mode)',
         'domain <app> [hostname]     Bind a hostname (or list them); --verify / --remove',
         'delete <app>                Archive an application (stops every release)',
         '',
         'Create/deploy flags:',
+        '--project <id|slug>         create: use this project (overrides projects use)',
         '--image <ref>               Container image, e.g. nginx:alpine (omit to build from source)',
+        '--promote                   deploy: take production by itself once healthy (needs apps:promote)',
+        '--template <name>           postgres | redis: volume, stable TCP endpoint, generated password, first release',
         '--dir <path>                Source directory to build (default: current directory)',
         '--dockerfile <path>         Dockerfile relative to the context (default: Dockerfile)',
         '--context <path>            Build context inside the source tree (default: .)',
         '--build-arg KEY=VALUE       Docker build argument (repeatable)',
         '--build <buildId>           Release an existing successful build',
         '--port <n>                  HTTP port (omit for a TCP-only service)',
-        '--tcp <name:port[:public][:hostPort]>  Extra TCP port (repeatable)',
+        '--tcp <name:port[:public]>  Extra TCP port; endpoint port is platform-managed (repeatable)',
+        '--volume <name:/path[:ro]> Persistent volume mount (repeatable)',
+        '--volume-runner <id>        Pin volumes (and the container) to a worker runner',
         '--set KEY=VALUE             Environment variable (repeatable)',
         '--memory <mb>               Memory ceiling (default 512)',
         '--cpu <vcpus>               CPU ceiling (default 0.5)',
         '--egress <none|full>        Outbound network policy',
+        '--ingress <private|public>  Public Networking: public creates the generated domain (new apps are private)',
         '--health-path </path>       HTTP health check path',
         '--health-command <cmd>      Health command inside the container (databases)',
         '--no-wait                   Return as soon as the release is queued',
         '--json                      Machine-readable JSON output',
+        '',
+        'Scaling flags:',
+        '--activation <mode>         always, http (sleep when idle), or manual',
+        '--replicas <n>              Horizontal replicas for always mode (allocation plane; 1..8)',
+        '--idle-timeout <duration>   HTTP idle time before sleep (minimum 5m)',
+        '--activation-timeout <duration>  Maximum wake time (5s–5m)',
+        '--stabilization <duration>  Quiet period before sleeping (minimum 0s)',
     ], [
         'inquir apps create web --port 3000',
         'inquir apps deploy web                # builds ./Dockerfile, then releases it',
         'inquir apps deploy web --image nginx:alpine',
-        'inquir apps deploy cache --image redis:7-alpine --tcp redis:6379:public:26379 \\',
+        'inquir apps deploy cache --image redis:7-alpine --tcp redis:6379:public \\',
         '  --health-command "redis-cli ping"',
+        'inquir apps deploy db --image postgres:16 --volume data:/var/lib/postgresql/data',
+        'inquir apps scale web http --idle-timeout 15m',
+        'inquir apps wake web',
+        'inquir apps pause web',
         'inquir apps logs web --tail 100',
         'inquir apps promote <releaseId>',
         'inquir apps domain web shop.example.com && inquir apps domain web shop.example.com --verify',
     ]);
 }
 /**
- * `--tcp name:port[:public][:hostPort]` — the shorthand people actually want
- * to type for a database or SSH endpoint.
+ * `--tcp name:port[:public][:hostPort]` — ordinary usage stops at `public` and
+ * lets the platform lease a stable endpoint port. The final numeric modifier
+ * remains an API/CLI compatibility escape hatch for an existing installation.
  */
 export function parseTcpPortFlag(value) {
     const parts = value.split(':');
     const [name, portRaw, ...flags] = parts;
     const port = Number(portRaw);
     if (!name || !Number.isInteger(port) || port < 1 || port > 65535) {
-        throw usageError(`Invalid --tcp value '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public:25432');
+        throw usageError(`Invalid --tcp value '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public');
     }
     const spec = { name, port, protocol: 'tcp' };
     for (const flag of flags) {
@@ -143,7 +206,7 @@ export function parseTcpPortFlag(value) {
             spec.public = true;
             continue;
         }
-        throw usageError(`Invalid --tcp modifier '${flag}' in '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public:25432');
+        throw usageError(`Invalid --tcp modifier '${flag}' in '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public');
     }
     return spec;
 }
@@ -158,27 +221,192 @@ export function parseSetFlags(values) {
     }
     return env;
 }
-/** Runtime spec assembled from flags; undefined when nothing was specified. */
-export function buildRuntimeFromFlags(args) {
+const MAX_SCALING_DELAY_SECONDS = 30 * 24 * 60 * 60;
+const SCALING_ACTIVATIONS = new Set(['always', 'http', 'manual']);
+/** Parse a CLI duration such as `90`, `90s`, `15m`, `1h30m`, or `1.5m`. */
+export function parseDurationSeconds(value) {
+    if (!value || value !== value.trim()) {
+        throw usageError(`Invalid duration '${value}'`, 'Use seconds or a duration such as 30s, 15m, or 1h30m');
+    }
+    if (/^\d+$/.test(value)) {
+        const seconds = Number(value);
+        if (Number.isSafeInteger(seconds))
+            return seconds;
+        throw usageError(`Invalid duration '${value}'`, 'Duration is too large');
+    }
+    const unitSeconds = { s: 1, m: 60, h: 3600, d: 86_400 };
+    const component = /(\d+(?:\.\d+)?)([smhd])/gy;
+    let position = 0;
+    let seconds = 0;
+    while (position < value.length) {
+        component.lastIndex = position;
+        const match = component.exec(value);
+        if (!match) {
+            throw usageError(`Invalid duration '${value}'`, 'Use seconds or a duration such as 30s, 15m, or 1h30m');
+        }
+        seconds += Number(match[1]) * unitSeconds[match[2]];
+        position = component.lastIndex;
+    }
+    if (!Number.isSafeInteger(seconds)) {
+        throw usageError(`Duration '${value}' must resolve to a whole number of seconds`, 'Use an exact duration such as 90s or 1.5m');
+    }
+    return seconds;
+}
+function readAliasedFlagValue(args, flags) {
+    const present = flags.filter((flag) => hasFlag(args, flag));
+    if (present.length > 1) {
+        throw usageError(`Use only one of ${flags.join(', ')}`, `inquir apps scale <app> ${flags[0]} <duration>`);
+    }
+    if (present.length === 0)
+        return undefined;
+    const value = readFlagValue(args, present[0]);
+    if (value === undefined) {
+        throw usageError(`Missing value for ${present[0]}`, `inquir apps scale <app> ${present[0]} <value>`);
+    }
+    return value;
+}
+function parseScalingDuration(raw, flag, min, max) {
+    if (raw === undefined)
+        return undefined;
+    const seconds = parseDurationSeconds(raw);
+    if (seconds < min || seconds > max) {
+        throw usageError(`Invalid ${flag} '${raw}' (${seconds}s); expected ${min}s–${max}s`, `inquir apps scale <app> ${flag} <duration>`);
+    }
+    return seconds;
+}
+/** Build the partial policy sent by `apps scale`; omitted values remain unchanged server-side. */
+export function buildScalingPatchFromFlags(args, positionalActivation) {
+    const flagActivation = readAliasedFlagValue(args, ['--activation', '--mode']);
+    if (positionalActivation && flagActivation && positionalActivation !== flagActivation) {
+        throw usageError(`Conflicting scaling modes '${positionalActivation}' and '${flagActivation}'`, 'inquir apps scale <app> <always|http|manual>');
+    }
+    const activationRaw = positionalActivation ?? flagActivation;
+    if (activationRaw && !SCALING_ACTIVATIONS.has(activationRaw)) {
+        throw usageError(`Invalid scaling mode '${activationRaw}'`, 'inquir apps scale <app> <always|http|manual>');
+    }
+    const idleTimeoutSeconds = parseScalingDuration(readAliasedFlagValue(args, ['--idle-timeout', '--idle']), '--idle-timeout', 300, MAX_SCALING_DELAY_SECONDS);
+    const activationTimeoutSeconds = parseScalingDuration(readAliasedFlagValue(args, ['--activation-timeout']), '--activation-timeout', 5, 300);
+    const scaleDownStabilizationSeconds = parseScalingDuration(readAliasedFlagValue(args, ['--stabilization', '--scale-down-stabilization']), '--stabilization', 0, MAX_SCALING_DELAY_SECONDS);
+    const replicasRaw = readAliasedFlagValue(args, ['--replicas']);
+    let maxReplicas;
+    if (replicasRaw !== undefined) {
+        const parsed = Number.parseInt(replicasRaw, 10);
+        if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 8) {
+            throw usageError(`Invalid --replicas '${replicasRaw}' (1..8; above 1 needs always mode and the allocation plane)`, 'inquir apps scale <app> always --replicas <n>');
+        }
+        maxReplicas = parsed;
+    }
+    return {
+        ...(activationRaw ? { activation: activationRaw } : {}),
+        ...(maxReplicas !== undefined ? { maxReplicas } : {}),
+        ...(idleTimeoutSeconds !== undefined ? { idleTimeoutSeconds } : {}),
+        ...(activationTimeoutSeconds !== undefined ? { activationTimeoutSeconds } : {}),
+        ...(scaleDownStabilizationSeconds !== undefined ? { scaleDownStabilizationSeconds } : {}),
+    };
+}
+const VOLUME_NAME_RE = /^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?$/;
+const MAX_APP_VOLUMES = 16;
+const CONTROL_CHAR_RE = /[\u0000-\u001f\u007f]/;
+/** `--volume name:/absolute/container/path[:ro]`; host paths are never accepted. */
+export function parseVolumeFlag(value) {
+    const separator = value.indexOf(':');
+    const name = separator > 0 ? value.slice(0, separator) : '';
+    let mountPath = separator > 0 ? value.slice(separator + 1) : '';
+    let readOnly = false;
+    if (/^[A-Za-z]:[\\/]/.test(mountPath)) {
+        throw usageError(`Invalid --volume mount path '${mountPath}'`, 'Volume targets are absolute paths inside the Linux container, for example data:/var/lib/data');
+    }
+    const modifierAt = mountPath.lastIndexOf(':');
+    if (modifierAt >= 0) {
+        const modifier = mountPath.slice(modifierAt + 1);
+        if (modifier !== 'ro') {
+            throw usageError(`Invalid --volume modifier '${modifier}' in '${value}'`, 'inquir apps deploy <app> --volume data:/var/lib/data[:ro]');
+        }
+        readOnly = true;
+        mountPath = mountPath.slice(0, modifierAt);
+    }
+    if (!VOLUME_NAME_RE.test(name)) {
+        throw usageError(`Invalid --volume name '${name || value}'`, 'inquir apps deploy <app> --volume data:/var/lib/data[:ro]');
+    }
+    const pathSegments = mountPath.split('/');
+    if (mountPath !== mountPath.trim() ||
+        mountPath.length < 2 ||
+        mountPath.length > 1024 ||
+        !mountPath.startsWith('/') ||
+        mountPath.includes('\\') ||
+        pathSegments.includes('..') ||
+        CONTROL_CHAR_RE.test(mountPath)) {
+        throw usageError(`Invalid --volume mount path '${mountPath || value}'`, 'inquir apps deploy <app> --volume data:/var/lib/data[:ro]');
+    }
+    const normalizedPath = path.posix.normalize(mountPath);
+    const normalized = normalizedPath.length > 1 ? normalizedPath.replace(/\/+$/, '') : normalizedPath;
+    if (normalized === '/' ||
+        ['/dev', '/proc', '/sys'].some((root) => normalized === root || normalized.startsWith(`${root}/`))) {
+        throw usageError(`Invalid --volume mount path '${mountPath}'`, 'Mount below an application data directory, for example data:/var/lib/data');
+    }
+    return { name, mountPath: normalized, ...(readOnly ? { readOnly: true } : {}) };
+}
+function assertVolumeSet(volumes) {
+    if (volumes.length > MAX_APP_VOLUMES) {
+        throw usageError(`At most ${MAX_APP_VOLUMES} --volume entries are supported`, 'inquir apps deploy --help');
+    }
+    const names = new Set();
+    const targets = new Set();
+    for (const volume of volumes) {
+        if (names.has(volume.name)) {
+            throw usageError(`Duplicate --volume name '${volume.name}'`, 'Use each volume name once');
+        }
+        if (targets.has(volume.mountPath)) {
+            throw usageError(`Duplicate --volume mount path '${volume.mountPath}'`, 'Use each mount path once');
+        }
+        names.add(volume.name);
+        targets.add(volume.mountPath);
+    }
+}
+function mergeVolumes(base, overrides) {
+    const overrideNames = new Set();
+    for (const volume of overrides) {
+        if (overrideNames.has(volume.name)) {
+            throw usageError(`Duplicate --volume name '${volume.name}'`, 'Use each volume name once');
+        }
+        overrideNames.add(volume.name);
+    }
+    const merged = [...(base ?? []).filter((volume) => !overrideNames.has(volume.name)), ...overrides];
+    assertVolumeSet(merged);
+    return merged;
+}
+/** Runtime flags patch the saved application runtime rather than replacing unrelated fields. */
+export function buildRuntimeFromFlags(args, baseRuntime) {
     const portRaw = readFlagValue(args, '--port');
     const tcpValues = readMultiFlag(args, '--tcp');
+    const volumeValues = readMultiFlag(args, '--volume');
     const memory = readFlagValue(args, '--memory');
     const cpu = readFlagValue(args, '--cpu');
     const healthPath = readFlagValue(args, '--health-path');
     const healthCommand = readFlagValue(args, '--health-command');
     const ports = tcpValues.map(parseTcpPortFlag);
+    const volumes = volumeValues.map(parseVolumeFlag);
     const port = portRaw ? Number(portRaw) : undefined;
     if (portRaw && (!Number.isInteger(port) || port < 1 || port > 65535)) {
         throw usageError(`Invalid --port value '${portRaw}'`, 'inquir apps create <name> --port 3000');
     }
-    if (port === undefined && ports.length === 0 && !memory && !cpu && !healthPath && !healthCommand) {
+    if (!portRaw && tcpValues.length === 0 && volumeValues.length === 0 && !memory && !cpu && !healthPath && !healthCommand) {
         return undefined;
     }
     const spec = {
-        ...(port !== undefined ? { port } : {}),
-        ...(ports.length > 0 ? { ports } : {}),
-        resources: { cpuVCpus: cpu ? Number(cpu) : 0.5, memoryMb: memory ? Number(memory) : 512 },
+        ...(baseRuntime ?? {}),
+        ...(portRaw ? { port } : {}),
+        ...(tcpValues.length > 0 ? { ports } : {}),
+        ...(volumeValues.length > 0 ? { volumes: mergeVolumes(baseRuntime?.volumes, volumes) } : {}),
     };
+    if (memory || cpu) {
+        const parsedMemory = memory ? Number(memory) : (baseRuntime?.resources?.memoryMb ?? 512);
+        const parsedCpu = cpu ? Number(cpu) : (baseRuntime?.resources?.cpuVCpus ?? 0.5);
+        if (!Number.isInteger(parsedMemory) || parsedMemory < 1 || !Number.isFinite(parsedCpu) || parsedCpu <= 0) {
+            throw usageError('Invalid --memory or --cpu value', 'inquir apps update <app> --memory 512 --cpu 0.5');
+        }
+        spec.resources = { cpuVCpus: parsedCpu, memoryMb: parsedMemory };
+    }
     if (healthCommand) {
         spec.healthcheck = {
             type: 'command',
@@ -187,7 +415,7 @@ export function buildRuntimeFromFlags(args) {
             timeoutSeconds: 5,
         };
     }
-    else if (port !== undefined) {
+    else if (healthPath || (portRaw && !baseRuntime?.healthcheck)) {
         spec.healthcheck = {
             type: 'http',
             path: healthPath || '/',
@@ -224,23 +452,346 @@ async function createAppSubcommand(args, positionals, apiOptions) {
     const [name] = positionals;
     if (!name)
         throw usageError('Missing application name', 'inquir apps create <name> --port 3000');
+    if (positionals.length > 1)
+        throw usageError('Expected one application name', 'inquir apps create <name> --project <id|slug>');
     await requireAuth(apiOptions);
+    const template = readFlagValue(args, '--template');
+    if (template && !TEMPLATE_NAMES.includes(template)) {
+        throw usageError(`Unknown template '${template}'. Available: ${TEMPLATE_NAMES.join(', ')}`, `inquir apps create ${name} --template postgres`);
+    }
     const envVars = parseSetFlags(readMultiFlag(args, '--set'));
+    const volumeRunner = readFlagValue(args, '--volume-runner');
+    // Omitted flags leave the server defaults in force: full egress, and a
+    // private-only service until a public domain is asked for.
+    const networkPolicy = buildNetworkPolicyPatch({
+        egress: readFlagValue(args, '--egress'),
+        ingress: readFlagValue(args, '--ingress'),
+    });
+    const project = await resolveCreateProject(args, apiOptions);
     const app = await createApplication({
         name,
+        ...(project.projectId ? { projectId: project.projectId } : {}),
         description: readFlagValue(args, '--description'),
+        ...(template ? { template } : {}),
+        ...(volumeRunner ? { volumeRunner } : {}),
         runtime: buildRuntimeFromFlags(args),
         ...(Object.keys(envVars).length > 0 ? { envVars } : {}),
-    }, apiOptions);
+        ...(networkPolicy ? { networkPolicy } : {}),
+    }, project.apiOptions);
+    const firstRelease = app.firstRelease;
     if (readJsonFlag(args)) {
-        printLine(JSON.stringify(app, null, 2));
+        // A scripted create must answer the same question the human one does:
+        // "is it up, and where do I reach it?" — so it waits for the release too.
+        const settled = template && firstRelease ? await waitForRelease(firstRelease.releaseId, project.apiOptions) : null;
+        printLine(JSON.stringify(settled ? { ...app, firstRelease: settled } : app, null, 2));
+        if (settled && !isHealthyRelease(settled))
+            process.exitCode = ExitCode.ERROR;
         return;
     }
     printSuccess(`Created application ${app.name}`);
     printInfo(dim(`  id: ${app.id}`));
+    if (app.projectIds?.length)
+        printInfo(dim(`  project: ${app.projectIds.join(', ')}`));
+    if (template && firstRelease) {
+        printInfo(dim(`  template: ${template} — first release ${firstRelease.releaseId.slice(0, 8)} is starting`));
+        const release = await waitForRelease(firstRelease.releaseId, project.apiOptions);
+        renderRelease(release);
+        if (!isHealthyRelease(release)) {
+            process.exitCode = ExitCode.ERROR;
+            return;
+        }
+        printInfo(dim(`  connection string: inquir apps connection-url ${app.name}`));
+        printInfo(dim(`  wire an app to it: inquir apps connect ${app.name} <target-app>`));
+        return;
+    }
     printInfo(dim(`  deploy it: inquir apps deploy ${app.name}            (builds the Dockerfile in the current directory)`));
     printInfo(dim(`         or: inquir apps deploy ${app.name} --image <ref>`));
 }
+const TEMPLATE_NAMES = ['postgres', 'redis'];
+/** `apps <sub> --help` answered per subcommand; the global page is the fallback. */
+const SUBCOMMAND_HELP = {
+    redeploy: [
+        'Usage: inquir apps redeploy <app> [--no-promote] [--no-wait]',
+        '',
+        '  Releases what production runs now — the same build, or the same image',
+        "  reference pulled again — under the application's current env, ports and",
+        '  resources, and promotes it once it is healthy. Use it after `apps update`',
+        '  to apply changed settings, or to start over from a clean container.',
+        '  --no-promote        Only queue the release; promote it yourself later',
+        '  --no-wait           Return as soon as the release is queued',
+        '',
+        'Applications with volumes are recreated: the service is down for the swap.',
+    ],
+    create: [
+        'Usage: inquir apps create <name> [--template postgres|redis] [flags]',
+        '',
+        '  --project <id|slug>  Add to this project. Otherwise uses projects use;',
+        '                      without a selection, creates a project named after the app.',
+        '  --template <name>   postgres | redis: volume, pinned public TCP port,',
+        '                      generated password, and the first release — one command',
+        '                      from nothing to a running database.',
+        '  --volume-runner <id>  Pin volumes + container to a worker runner (id or',
+        '                      unique prefix); the data lives on that machine.',
+        '  --port, --tcp, --volume, --memory, --cpu, --health-command, --set KEY=VALUE',
+        '',
+        'Examples:',
+        '  inquir apps create mydb --template postgres',
+        '  inquir apps create web --port 3000',
+    ],
+    backups: [
+        'Usage: inquir apps backups <app> [list|create|restore <backupId>|delete <backupId>]',
+        '',
+        '  list (default)      Snapshots of this app\'s volumes, newest first',
+        '                      --volume <name>  only that volume',
+        '                      --limit <n>, --cursor <c>  page through older ones',
+        '  create              Snapshot every mounted volume now, then follow the',
+        '                      rows until they settle (--no-wait returns at once)',
+        '  restore <backupId>  OVERWRITE a volume from a snapshot — asks for',
+        '                      confirmation, or pass --yes in a script',
+        '  delete <backupId>   Drop a restore point for good — asks for confirmation',
+        '',
+        'Backups are crash-consistent and only exist for applications with volumes.',
+        'Restore stops the application while it runs.',
+    ],
+    connect: [
+        'Usage: inquir apps connect <database-app> <target-app> [--overwrite]',
+        '',
+        'Writes the database connection URL into the target app\'s environment',
+        '(DATABASE_URL for postgres, REDIS_URL for redis). The password never',
+        'passes through your terminal. Takes effect on the target\'s next release.',
+        '',
+        '  --overwrite   Replace a DATABASE_URL/REDIS_URL the target already has —',
+        '                e.g. to repoint it at the database\'s private address',
+        '                (<slug>.apps.internal) after a hand-written hostname.',
+    ],
+    'connection-url': [
+        'Usage: inquir apps connection-url <database-app> [--private|--public]',
+        '',
+        'Prints the private URL when available, otherwise the explicit Public',
+        'Access URL. Use --private or --public to require one visibility.',
+        'Public TCP exposure does not add database TLS. Prefer',
+        '`inquir apps connect` when the consumer is another app on the platform.',
+    ],
+};
+const BACKUPS_USAGE = 'inquir apps backups <app> [list|create|restore <backupId>|delete <backupId>]';
+/** The one backup table: `create` prints it too, once the rows settle. */
+function renderBackupTable(items) {
+    printLine(formatTable(items.map((b) => ({
+        id: b.id.slice(0, 8),
+        volume: b.volumeName,
+        status: b.status,
+        trigger: b.trigger,
+        size: formatBytes(b.sizeBytes ?? b.artifactSizeBytes),
+        created: b.createdAt.replace('T', ' ').slice(0, 19),
+    })), ['id', 'volume', 'status', 'trigger', 'size', 'created']));
+}
+/** Accept a short id, the way the release commands do. */
+async function resolveBackup(applicationId, needle, identifier, apiOptions) {
+    const { items } = await listAppBackups(applicationId, { limit: 100 }, apiOptions);
+    const match = items.find((b) => b.id === needle || b.id.startsWith(needle));
+    if (!match)
+        throw usageError(`No backup matching '${needle}'`, `inquir apps backups ${identifier} list`);
+    return match;
+}
+/**
+ * Follow the rows a backup run created until none is PENDING. The copy outlives
+ * the request that started it (the API answers 202), so the rows — not the
+ * response — carry the outcome.
+ */
+async function waitForBackups(applicationId, started, apiOptions, json, timeoutMs = 30 * 60_000) {
+    const deadline = Date.now() + timeoutMs;
+    const startedAt = Date.now();
+    const settled = new Map();
+    const announce = (line) => {
+        // Under --json only stdout must stay parseable; progress goes to stderr.
+        if (json)
+            process.stderr.write(`${line}\n`);
+        else
+            printInfo(dim(line));
+    };
+    announce(`— copying ${started.length} volume(s); a large volume takes minutes —`);
+    for (;;) {
+        for (const row of started) {
+            if (settled.has(row.id))
+                continue;
+            const current = await getAppBackup(applicationId, row.id, apiOptions);
+            if (current.status === 'PENDING')
+                continue;
+            settled.set(row.id, current);
+            const size = current.status === 'READY' ? ` ${formatBytes(current.sizeBytes ?? current.artifactSizeBytes)}` : '';
+            announce(`— ${current.volumeName} ${current.status}${size} (${formatElapsed(Date.now() - startedAt)}) —`);
+        }
+        if (settled.size === started.length)
+            return started.map((row) => settled.get(row.id));
+        if (Date.now() > deadline) {
+            throw new CliError(`Backup of ${applicationId} did not settle within ${Math.round(timeoutMs / 60_000)}m`, {
+                code: 'BACKUP_TIMEOUT',
+                exitCode: ExitCode.ERROR,
+                fix: 'The copy keeps running server-side; check the rows later.',
+                command: `inquir apps backups ${applicationId} list`,
+            });
+        }
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+    }
+}
+async function backupsSubcommand(args, positionals, apiOptions) {
+    const [identifier, verb = 'list', backupId] = positionals;
+    if (!identifier) {
+        throw usageError('Missing application', BACKUPS_USAGE);
+    }
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const json = readJsonFlag(args);
+    if (verb === 'list') {
+        const cursor = readFlagValue(args, '--cursor');
+        const volumeName = readFlagValue(args, '--volume');
+        const page = await listAppBackups(app.id, {
+            // Each flag is sent only when given, so an unset one keeps the API's
+            // own page size instead of pinning a second default here.
+            ...(readFlagValue(args, '--limit') ? { limit: readLimitFlag(args, 0) } : {}),
+            ...(cursor ? { cursor } : {}),
+            ...(volumeName ? { volumeName } : {}),
+        }, apiOptions);
+        if (json)
+            return printLine(JSON.stringify(page, null, 2));
+        if (page.items.length === 0) {
+            printInfo(`No backups for ${app.name} yet — create one: inquir apps backups ${app.name} create`);
+            return;
+        }
+        renderBackupTable(page.items);
+        if (page.nextCursor) {
+            printInfo(dim(`  older: inquir apps backups ${app.name} list --cursor ${page.nextCursor}`));
+        }
+        return;
+    }
+    if (verb === 'create') {
+        const run = await createAppBackup(app.id, apiOptions);
+        if (hasFlag(args, '--no-wait')) {
+            if (json)
+                return printLine(JSON.stringify(run, null, 2));
+            renderBackupTable(run.items);
+            printInfo(dim(`  follow them: inquir apps backups ${app.name} list`));
+            return;
+        }
+        const items = await waitForBackups(app.id, run.items, apiOptions, json);
+        if (json)
+            printLine(JSON.stringify({ items, statusUrl: run.statusUrl }, null, 2));
+        else
+            renderBackupTable(items);
+        // A snapshot that never became READY is a failed command, not a note.
+        if (items.some((b) => b.status !== 'READY'))
+            process.exitCode = ExitCode.ERROR;
+        return;
+    }
+    if (verb === 'restore') {
+        if (!backupId) {
+            throw usageError('Missing backup id', `inquir apps backups ${identifier} restore <backupId>`);
+        }
+        // Resolve the backup BEFORE asking for confirmation: a warning that cannot
+        // name the volume, the moment, and the size is a warning nobody reads.
+        const match = await resolveBackup(app.id, backupId, identifier, apiOptions);
+        if (match.status !== 'READY') {
+            throw usageError(`Backup ${match.id.slice(0, 8)} is ${match.status} and cannot be restored`, `inquir apps backups ${identifier} list`);
+        }
+        const when = match.createdAt.replace('T', ' ').slice(0, 16);
+        const summary = `${app.name} volume ${match.volumeName} from the ${when} backup (${formatBytes(match.sizeBytes ?? match.artifactSizeBytes)})`;
+        if (!runtime().yes) {
+            const approved = await confirm(`Overwrite ${summary}? Everything written since ${when} is lost, and ${app.name} stops during the restore.`, false);
+            if (!approved) {
+                throw usageError(`Refusing to restore ${app.name} without confirmation`, `inquir apps backups ${identifier} restore ${match.id.slice(0, 8)} --yes`);
+            }
+        }
+        await restoreAppBackup(app.id, match.id, apiOptions);
+        if (json) {
+            return printLine(JSON.stringify({ restored: true, application: app.name, backupId: match.id, volumeName: match.volumeName, createdAt: match.createdAt }, null, 2));
+        }
+        printSuccess(`Restored ${app.name} volume ${match.volumeName} from backup ${match.id.slice(0, 8)}`);
+        return;
+    }
+    if (verb === 'delete') {
+        if (!backupId) {
+            throw usageError('Missing backup id', `inquir apps backups ${identifier} delete <backupId>`);
+        }
+        const match = await resolveBackup(app.id, backupId, identifier, apiOptions);
+        const when = match.createdAt.replace('T', ' ').slice(0, 16);
+        if (!runtime().yes) {
+            const approved = await confirm(`Delete the ${when} backup of ${app.name} volume ${match.volumeName}? This restore point is gone for good.`, false);
+            if (!approved) {
+                throw usageError(`Refusing to delete a backup of ${app.name} without confirmation`, `inquir apps backups ${identifier} delete ${match.id.slice(0, 8)} --yes`);
+            }
+        }
+        await deleteAppBackup(app.id, match.id, apiOptions);
+        if (json) {
+            return printLine(JSON.stringify({ deleted: true, application: app.name, backupId: match.id, volumeName: match.volumeName, createdAt: match.createdAt }, null, 2));
+        }
+        printSuccess(`Deleted backup ${match.id.slice(0, 8)} of ${app.name} volume ${match.volumeName}`);
+        return;
+    }
+    throw usageError(`Unknown backups action '${verb}'`, BACKUPS_USAGE);
+}
+async function connectSubcommand(args, positionals, apiOptions) {
+    const [dbIdentifier, targetIdentifier] = positionals;
+    if (!dbIdentifier || !targetIdentifier) {
+        throw usageError('Usage: apps connect <database-app> <target-app>', 'inquir apps connect mydb web');
+    }
+    await requireAuth(apiOptions);
+    const db = await resolveApplication(dbIdentifier, apiOptions);
+    // The server refuses to replace a key the target already carries; the flag
+    // is how an app is repointed at the database's current private address
+    // (the composed URL never passes through this terminal).
+    const overwrite = args.includes('--overwrite');
+    const result = await connectApps(db.id, targetIdentifier, { ...apiOptions, overwrite });
+    if (readJsonFlag(args)) {
+        return printLine(JSON.stringify(result, null, 2));
+    }
+    printSuccess(`${result.envKey} set on ${result.target}`);
+    printInfo(dim(`  Applies on the next release — deploy it: inquir apps deploy ${result.target}`));
+}
+async function connectionUrlSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps connection-url mydb');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const result = await getAppConnectionUrl(app.id, apiOptions);
+    const requirePrivate = args.includes('--private');
+    const requirePublic = args.includes('--public');
+    if (requirePrivate && requirePublic) {
+        throw usageError('Use either --private or --public, not both', 'inquir apps connection-url mydb --private');
+    }
+    // Print BEFORE registering: this command exists to hand the credential over,
+    // and the redaction filter would otherwise mask its own output. Registering
+    // afterwards keeps it out of anything that prints later in this process.
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(result, null, 2));
+        if (result.url)
+            registerSecret(result.url);
+        if (result.publicUrl)
+            registerSecret(result.publicUrl);
+        return;
+    }
+    const selected = selectConnectionUrl(result, requirePrivate ? 'private' : requirePublic ? 'public' : 'auto');
+    printLine(selected.url);
+    registerSecret(selected.url);
+    if (process.stderr.isTTY) {
+        if (selected.visibility === 'public') {
+            process.stderr.write(dim('Public TCP exposure does not add database TLS; require and verify TLS in the database itself.\n'));
+        }
+        process.stderr.write(dim(`This is a live credential and it is now in your shell history. To grant another app access without copying it: inquir apps connect ${app.name} <target-app>\n`));
+    }
+}
+export function selectConnectionUrl(result, preference = 'auto') {
+    if (preference !== 'public' && result.url) {
+        return { url: result.url, visibility: 'private' };
+    }
+    if (preference !== 'private' && result.publicUrl) {
+        return { url: result.publicUrl, visibility: 'public' };
+    }
+    const requested = preference === 'auto' ? 'private or public' : preference;
+    throw usageError(`No ${requested} database connection URL is available`, preference === 'public'
+        ? 'Enable Public Access in the application Networking settings.'
+        : 'Configure private networking, or use --public after explicitly enabling Public Access.');
+}
 async function deploySubcommand(args, positionals, apiOptions) {
     const [identifier] = positionals;
     const image = readFlagValue(args, '--image');
@@ -253,8 +804,9 @@ async function deploySubcommand(args, positionals, apiOptions) {
     }
     await requireAuth(apiOptions);
     const app = await resolveApplication(identifier, apiOptions);
-    const runtimeSpec = buildRuntimeFromFlags(args);
+    const runtimeSpec = buildRuntimeFromFlags(args, app.runtime);
     const json = readJsonFlag(args);
+    const promote = hasFlag(args, '--promote');
     // No image and no build id: build the source directory first, then release
     // the produced image. That is the Railway-shaped default — a Dockerfile in
     // the current directory is all a project needs.
@@ -270,12 +822,23 @@ async function deploySubcommand(args, positionals, apiOptions) {
         }
         buildId = build.id;
     }
-    const queued = await createRelease(app.id, {
-        ...(buildId ? { buildId } : { imageRef: image }),
-        ...(runtimeSpec ? { runtime: runtimeSpec } : {}),
-    }, apiOptions);
+    let queued;
+    try {
+        queued = await createRelease(app.id, {
+            ...(buildId ? { buildId } : { imageRef: image }),
+            ...(runtimeSpec ? { runtime: runtimeSpec } : {}),
+            ...(promote ? { promote: true } : {}),
+        }, apiOptions);
+    }
+    catch (err) {
+        if (err instanceof Error)
+            err.message = humanizeApiError(err.message);
+        throw err;
+    }
     if (!json) {
         printInfo(`Release ${queued.releaseId.slice(0, 8)} queued for ${app.name} (${image ?? `build ${buildId.slice(0, 8)}`})`);
+        if (promote)
+            printInfo(dim('  it takes production by itself once healthy'));
     }
     if (hasFlag(args, '--no-wait')) {
         if (json)
@@ -284,17 +847,109 @@ async function deploySubcommand(args, positionals, apiOptions) {
             printInfo(dim(`  status: inquir apps status ${app.name}`));
         return;
     }
-    const release = await waitForRelease(queued.releaseId, apiOptions);
+    await followQueuedRelease(app, queued, promote, json, apiOptions);
+}
+/**
+ * Wait for a queued release to settle and say where it ended up; with
+ * promote-on-ready, also wait for production to point at it.
+ */
+async function followQueuedRelease(app, queued, promote, json, apiOptions) {
+    let release = await waitForRelease(queued.releaseId, apiOptions);
+    const production = promote && isHealthyRelease(release)
+        ? await waitForProduction(app.id, queued.releaseId, apiOptions)
+        : undefined;
+    if (production)
+        release = production.release;
+    const served = production?.servingProduction ?? false;
     if (json) {
-        printLine(JSON.stringify(release, null, 2));
+        printLine(JSON.stringify(promote ? {
+            ...release,
+            servingProduction: served,
+            ...(production?.promotionError ? { promotionError: production.promotionError } : {}),
+        } : release, null, 2));
     }
     else {
         renderRelease(release, queued.previewUrl);
+        if (production) {
+            if (served)
+                printSuccess(`Production now serves ${queued.releaseId.slice(0, 8)}`);
+            else
+                printError(`${production.promotionError.message} — see: inquir apps status ${app.name}`);
+        }
     }
-    // A release that never became healthy is a failed command, not a note.
-    if (release.status === 'FAILED')
+    // A settled release can be stopped, and a healthy preview is not the
+    // requested result when the caller explicitly asked to serve production.
+    if (!isHealthyRelease(release) || (promote && !served))
         process.exitCode = ExitCode.ERROR;
 }
+function isHealthyRelease(release) {
+    return release.status === 'READY' || release.status === 'ACTIVE';
+}
+/**
+ * Observe both the production pointer and current release health. Return the
+ * latest row so a late failure cannot be hidden by the earlier READY snapshot.
+ * Transport/auth errors propagate; refused promotion and timeout are outcomes.
+ */
+async function waitForProduction(applicationId, releaseId, apiOptions, timeoutMs = 120_000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const app = await getApplication(applicationId, apiOptions);
+        const release = await getRelease(releaseId, apiOptions);
+        if (app.productionReleaseId === releaseId && isHealthyRelease(release)) {
+            return { release, servingProduction: true };
+        }
+        if (release.status === 'FAILED' || release.status === 'STOPPED' || release.failureReason?.startsWith('Auto-promote failed')) {
+            return {
+                release, servingProduction: false,
+                promotionError: {
+                    code: 'PROMOTION_FAILED',
+                    message: release.failureReason ?? `Release ${releaseId} is ${release.status.toLowerCase()} and is not serving production`,
+                },
+            };
+        }
+        if (Date.now() >= deadline) {
+            return {
+                release, servingProduction: false,
+                promotionError: {
+                    code: 'PROMOTION_TIMEOUT',
+                    message: `Release ${releaseId} did not begin serving production within ${Math.round(timeoutMs / 1000)}s. The CLI stopped waiting; check its status before retrying`,
+                },
+            };
+        }
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+    }
+}
+async function redeploySubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps redeploy <app>');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const json = readJsonFlag(args);
+    const promote = !hasFlag(args, '--no-promote');
+    let queued;
+    try {
+        queued = await redeployApplication(app.id, { promote }, apiOptions);
+    }
+    catch (err) {
+        if (err instanceof Error)
+            err.message = humanizeApiError(err.message);
+        throw err;
+    }
+    if (!json) {
+        printInfo(`Release ${queued.releaseId.slice(0, 8)} queued for ${app.name} (redeploy of ${queued.redeployOf.slice(0, 8)})`);
+        if (promote)
+            printInfo(dim('  it takes production by itself once healthy'));
+    }
+    if (hasFlag(args, '--no-wait')) {
+        if (json)
+            printLine(JSON.stringify(queued, null, 2));
+        else
+            printInfo(dim(`  status: inquir apps status ${app.name}`));
+        return;
+    }
+    await followQueuedRelease(app, queued, promote, json, apiOptions);
+}
 /**
  * Zip a source directory, queue a build for it and follow the build log until
  * it settles. Returns the final build row.
@@ -393,8 +1048,8 @@ async function waitForRelease(releaseId, apiOptions, timeoutMs = 10 * 60_000) {
 }
 function renderRelease(release, previewUrl) {
     const shown = presentRelease(release);
-    if (release.status === 'FAILED') {
-        printLine(`✗ Release ${release.id.slice(0, 8)} failed: ${release.failureReason ?? 'unknown reason'}`);
+    if (!isHealthyRelease(release)) {
+        printError(`Release ${release.id.slice(0, 8)} is ${shown.label}${release.failureReason ? `: ${release.failureReason}` : ''}`);
         if (shown.hint)
             printInfo(dim(`  ${shown.hint}`));
         printInfo(dim(`  logs: inquir apps logs ${release.id}`));
@@ -443,6 +1098,51 @@ export function releaseEndpointLines(release, previewUrl, options = {}) {
     }
     return lines;
 }
+/**
+ * Where same-workspace services reach this application. The server projects
+ * `privateDomain` only once the private route is verified end to end, so a
+ * missing domain on an installation with private networking means "still
+ * being reconciled", not "no such thing" — and that is worth a line too.
+ */
+export function privateEndpointLines(detail, active, options = {}) {
+    if (!detail.privateDomain) {
+        return options.privateNetworking
+            ? ['(provisioning — private DNS and routing are being verified)']
+            : [];
+    }
+    const lines = [];
+    if (detail.privateBaseUrl)
+        lines.push(detail.privateBaseUrl);
+    for (const port of active?.ports ?? []) {
+        if (port.protocol !== 'tcp' || !port.containerPort)
+            continue;
+        lines.push(`${detail.privateDomain}:${port.containerPort}  (${port.name})`);
+    }
+    return lines;
+}
+/**
+ * The networkPolicy patch for `--egress` / `--ingress`. The API requires
+ * egress inside networkPolicy, so a lone --ingress change carries the
+ * application's current egress along unchanged, and vice versa; with neither
+ * flag the policy is left alone (the server's defaults apply on create).
+ */
+export function buildNetworkPolicyPatch(input) {
+    const { egress, ingress, current } = input;
+    if (egress && egress !== 'none' && egress !== 'full') {
+        throw usageError(`Invalid --egress '${egress}'`, 'inquir apps update <app> --egress none');
+    }
+    if (ingress && ingress !== 'private' && ingress !== 'public') {
+        throw usageError(`Invalid --ingress '${ingress}'`, 'inquir apps update <app> --ingress public');
+    }
+    if (!egress && !ingress)
+        return undefined;
+    const resolvedIngress = (ingress ?? current?.ingress);
+    return {
+        egress: (egress ?? current?.egress ?? 'full'),
+        allow: [],
+        ...(resolvedIngress ? { ingress: resolvedIngress } : {}),
+    };
+}
 /** A build-sourced release is best named by its build; a pulled one by its ref. */
 export function describeImage(release) {
     if (release.imageSource === 'build' && release.buildId)
@@ -462,18 +1162,69 @@ function describeRuntimePorts(spec) {
     }
     return parts.join(' ');
 }
+function formatDurationSeconds(seconds) {
+    const units = [
+        [86_400, 'd'],
+        [3600, 'h'],
+        [60, 'm'],
+        [1, 's'],
+    ];
+    let remaining = seconds;
+    const parts = [];
+    for (const [size, suffix] of units) {
+        const count = Math.floor(remaining / size);
+        if (count > 0 || (size === 1 && parts.length === 0)) {
+            parts.push(`${count}${suffix}`);
+            remaining -= count * size;
+        }
+    }
+    return parts.join(' ');
+}
+export function describeScalingPolicy(policy) {
+    const range = `${policy.minReplicas}–${policy.maxReplicas} replicas`;
+    if (policy.activation === 'http') {
+        return `http (sleep after ${formatDurationSeconds(policy.idleTimeoutSeconds)} idle), ${range}`;
+    }
+    return `${policy.activation}, ${range}`;
+}
 async function statusSubcommand(args, positionals, apiOptions) {
     const [identifier] = positionals;
     if (!identifier)
         throw usageError('Missing application', 'inquir apps status <app>');
     await requireAuth(apiOptions);
     const app = await resolveApplication(identifier, apiOptions);
-    const detail = await getApplication(app.id, apiOptions);
-    if (readJsonFlag(args)) {
+    const json = readJsonFlag(args);
+    // The apps suffix lives on the platform limits, never on the application, so
+    // the permanent address needs both. Fetched alongside the detail and only
+    // for the human output; losing it costs the address line, nothing else.
+    const [detail, limits] = await Promise.all([
+        getApplication(app.id, apiOptions),
+        json ? Promise.resolve(null) : getAppLimits(apiOptions).catch(() => null),
+    ]);
+    if (json) {
         printLine(JSON.stringify(detail, null, 2));
         return;
     }
     printLine(`${detail.name}${detail.description ? dim(` — ${detail.description}`) : ''}`);
+    if (detail.scaling)
+        printLine(`  scaling:    ${describeScalingPolicy(detail.scaling)}`);
+    if (detail.desiredReplicas !== undefined) {
+        const cap = detail.scaling ? ` (maximum ${detail.scaling.maxReplicas})` : '';
+        printLine(`  replicas:   ${detail.desiredReplicas} desired${cap}`);
+    }
+    const pinnedRunner = detail.volumeRunnerId;
+    if (pinnedRunner)
+        printLine(`  volume pin: runner ${pinnedRunner}`);
+    if (detail.lastActivityAt)
+        printLine(`  activity:   ${detail.lastActivityAt}`);
+    if (detail.lastScaledAt)
+        printLine(`  last scale: ${detail.lastScaledAt}`);
+    // Where this app answers forever, as opposed to where it answers now: the
+    // production lines below follow the routes, this one is the identity a
+    // custom domain should CNAME to.
+    const address = permanentAddress(detail.slug, limits?.appsPublicSuffix);
+    if (address)
+        printLine(`  address:    ${address} ${dim('(permanent — a rename never moves it)')}`);
     for (const url of detail.production?.urls ?? [])
         printLine(`  production: ${url}`);
     if (detail.production && (detail.production.urls ?? []).length === 0) {
@@ -486,6 +1237,29 @@ async function statusSubcommand(args, positionals, apiOptions) {
     const endpoints = active ? releaseEndpointLines(active, undefined, { includeHostLocal: !hasProductionUrl }) : [];
     for (const endpoint of endpoints)
         printLine(`  endpoint:   ${endpoint}`);
+    // The private address is what another app in the workspace dials; it is
+    // shown only once the platform has verified the route, never guessed.
+    const privateLines = privateEndpointLines(detail, active, {
+        privateNetworking: limits?.features?.privateNetworking,
+    });
+    for (const line of privateLines)
+        printLine(`  private:    ${line}`);
+    // The serving release's frozen runtime is the truth about what is mounted
+    // NOW. An app-level volume added after the deploy applies only to the next
+    // release — showing it as mounted would tell the operator their database is
+    // persistent when it is not.
+    const mountedVolumes = active ? (active.runtime?.volumes ?? []) : (detail.runtime?.volumes ?? []);
+    for (const volume of mountedVolumes) {
+        printLine(`  volume:     ${volume.name} → ${volume.mountPath}${volume.readOnly ? ' (read-only)' : ''}`);
+    }
+    if (active) {
+        const mountedNames = new Set(mountedVolumes.map((volume) => volume.name));
+        for (const volume of detail.runtime?.volumes ?? []) {
+            if (!mountedNames.has(volume.name)) {
+                printLine(`  volume:     ${volume.name} → ${volume.mountPath} ${dim('(next release — not mounted yet)')}`);
+            }
+        }
+    }
     for (const domain of detail.domains ?? []) {
         if (domain.custom && !domain.verified) {
             printLine(`  domain:     ${domain.hostname} ${dim('(unverified — inquir apps domain ' + detail.name + ' ' + domain.hostname + ' --verify)')}`);
@@ -737,6 +1511,59 @@ async function buildsSubcommand(args, positionals, apiOptions) {
         created: b.createdAt,
     })), ['build', 'status', 'dockerfile', 'image', 'cached', 'created']));
 }
+/** `apps scale <app> [always|http|manual]` — update only the scaling policy. */
+async function scaleSubcommand(args, positionals, apiOptions) {
+    const [identifier, positionalActivation, ...extra] = positionals;
+    if (!identifier) {
+        throw usageError('Missing application', 'inquir apps scale <app> <always|http|manual>');
+    }
+    if (extra.length > 0) {
+        throw usageError(`Unexpected argument '${extra[0]}'`, 'inquir apps scale <app> <always|http|manual>');
+    }
+    const scaling = buildScalingPatchFromFlags(args, positionalActivation);
+    if (Object.keys(scaling).length === 0) {
+        throw usageError('Nothing to scale', 'inquir apps scale <app> <always|http|manual> [--idle-timeout 15m]');
+    }
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const updated = await updateApplication(app.id, { scaling }, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(updated, null, 2));
+        return;
+    }
+    printSuccess(`Updated scaling for ${updated.name}`);
+    printInfo(dim(`  ${describeScalingPolicy(updated.scaling)}`));
+    printInfo(dim(`  desired replicas: ${updated.desiredReplicas}`));
+}
+async function runScaleActionSubcommand(action, args, positionals, apiOptions) {
+    const [identifier, ...extra] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', `inquir apps ${action} <app>`);
+    if (extra.length > 0) {
+        throw usageError(`Unexpected argument '${extra[0]}'`, `inquir apps ${action} <app>`);
+    }
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const result = action === 'wake'
+        ? await wakeApplication(app.id, apiOptions)
+        : await pauseApplication(app.id, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(result, null, 2));
+        return;
+    }
+    const verb = action === 'wake' ? 'Wake' : 'Pause';
+    if (result.accepted)
+        printSuccess(`${verb} requested for ${app.name}`);
+    else
+        printInfo(`${verb} was not accepted for ${app.name}`);
+    printInfo(dim(`  desired replicas: ${result.desiredReplicas}${result.state ? ` (${result.state})` : ''}`));
+}
+async function wakeSubcommand(args, positionals, apiOptions) {
+    return runScaleActionSubcommand('wake', args, positionals, apiOptions);
+}
+async function pauseSubcommand(args, positionals, apiOptions) {
+    return runScaleActionSubcommand('pause', args, positionals, apiOptions);
+}
 /** `apps update <app>` — env vars, ports, resources, health, egress. */
 async function updateSubcommand(args, positionals, apiOptions) {
     const [identifier] = positionals;
@@ -745,19 +1572,22 @@ async function updateSubcommand(args, positionals, apiOptions) {
     await requireAuth(apiOptions);
     const app = await resolveApplication(identifier, apiOptions);
     const envVars = parseSetFlags(readMultiFlag(args, '--set'));
-    const runtimeSpec = buildRuntimeFromFlags(args);
-    const egress = readFlagValue(args, '--egress');
+    const runtimeSpec = buildRuntimeFromFlags(args, app.runtime);
     const description = readFlagValue(args, '--description');
-    if (egress && egress !== 'none' && egress !== 'full') {
-        throw usageError(`Invalid --egress '${egress}'`, 'inquir apps update <app> --egress none');
-    }
+    const networkPolicy = buildNetworkPolicyPatch({
+        egress: readFlagValue(args, '--egress'),
+        ingress: readFlagValue(args, '--ingress'),
+        current: app.networkPolicy,
+    });
+    const volumeRunner = readFlagValue(args, '--volume-runner');
     const patch = {
         ...(description !== undefined ? { description } : {}),
+        ...(volumeRunner ? { volumeRunner } : {}),
         ...(runtimeSpec ? { runtime: runtimeSpec } : {}),
         // Only the keys given here change; the server merges masked values, so
         // untouched secrets survive.
         ...(Object.keys(envVars).length > 0 ? { envVars: { ...(app.envVars ?? {}), ...envVars } } : {}),
-        ...(egress ? { networkPolicy: { egress: egress, allow: [] } } : {}),
+        ...(networkPolicy ? { networkPolicy } : {}),
     };
     if (Object.keys(patch).length === 0) {
         throw usageError('Nothing to update', 'inquir apps update <app> --set KEY=VALUE');
@@ -773,16 +1603,19 @@ async function updateSubcommand(args, positionals, apiOptions) {
 async function execSubcommand(args, positionals, apiOptions) {
     const [identifier, ...commandParts] = positionals;
     if (!identifier)
-        throw usageError('Missing release', 'inquir apps exec <app> -- <command>');
+        throw usageError('Missing application', 'inquir apps exec <app> -- <command>');
     const command = commandParts.join(' ').trim();
     if (!command)
         throw usageError('Missing command', 'inquir apps exec <app> -- ls -la');
     await requireAuth(apiOptions);
-    const releaseId = await resolveReleaseId(identifier, apiOptions);
+    // `apps exec` is intentionally application-scoped. Accepting a stale or
+    // preview release id here and then calling the production-only app endpoint
+    // would silently change the operator's target to production.
+    const application = await resolveApplication(identifier, apiOptions);
     const timeoutRaw = readFlagValue(args, '--timeout');
     let result;
     try {
-        result = await execInRelease(releaseId, command, timeoutRaw ? Number(timeoutRaw) : undefined, apiOptions);
+        result = await execInApplication(application.id, command, timeoutRaw ? Number(timeoutRaw) : undefined, apiOptions);
     }
     catch (err) {
         if (err instanceof Error)
@@ -889,6 +1722,9 @@ async function deleteSubcommand(args, positionals, apiOptions) {
         });
     }
     await archiveApplication(app.id, apiOptions);
+    if (readJsonFlag(args)) {
+        return printLine(JSON.stringify({ ok: true, archived: { id: app.id, name: app.name } }, null, 2));
+    }
     printSuccess(`Archived ${app.name}`);
     printInfo(dim('  every release was stopped and every hostname unbound'));
 }