@inquir/compute-cli 0.2.2 → 0.4.0

package/dist/commands/apps.js

@@ -1,27 +1,41 @@
 import path from 'node:path';
-import { hasFlag, readFlagValue, readJsonFlag, readMultiFlag, readPositionalArgs } from '../utils/args.js';
-import { addApplicationDomain, archiveApplication, cancelBuild, createApplication, getBuild, listApplicationDomains, listBuilds, queueBuild, removeApplicationDomain, createRelease, execInRelease, getApplication, getRelease, listApplications, promoteRelease, requireAuth, resolveApplication, rollbackApplication, stopRelease, streamBuildLogs, streamReleaseLogs, updateApplication, verifyApplicationDomain, } from '../utils/api.js';
-import { createZipBase64, isSettledReleaseStatus, isTerminalBuildStatus } from '../sdk.js';
-import { formatElapsed, humanizeApiError, presentRelease } from '../utils/apps-presentation.js';
+import { alertsSubcommand, logHistorySubcommand, metricsSubcommand, OBSERVATION_HELP, OBSERVATION_VALUE_FLAGS } from './apps-observability.js';
+import { RESOURCES_HELP, RESOURCES_VALUE_FLAGS, resourcesSubcommand } from './apps-resources.js';
+import { DESCRIBE_HELP, describeSubcommand } from './apps-describe.js';
+import { followPromoteRollout } from './apps-promote.js';
+import { hasFlag, readFlagValue, readJsonFlag, readLimitFlag, readMultiFlag, readPositionalArgs, } from '../utils/args.js';
+import { listAppBackups, getAppBackup, createAppBackup, deleteAppBackup, restoreAppBackup, getAppConnectionUrl, connectApps, addApplicationDomain, archiveApplication, cancelBuild, createApplication, getBuild, listApplicationDomains, listBuilds, queueBuild, removeApplicationDomain, createRelease, redeployApplication, execInApplication, getAppLimits, getApplication, getProject, getRelease, listApplications, promoteRelease, isPromoteAccepted, requireAuth, resolveApplication, rollbackApplication, stopRelease, streamBuildLogs, streamReleaseLogs, updateApplication, wakeApplication, pauseApplication, verifyApplicationDomain, } from '../utils/api.js';
+import { ApiError, DEFAULT_BUILD_TIMEOUT_POLICY, createZipBase64, isSettledReleaseStatus, isTerminalBuildStatus } from '../sdk.js';
+import { formatBytes, formatElapsed, humanizeApiError, permanentAddress, presentRelease, } from '../utils/apps-presentation.js';
 import { buildApiOptions, runtime } from '../utils/context.js';
-import { CliError, ExitCode, usageError } from '../utils/errors.js';
-import { redact } from '../utils/redact.js';
-import { dim, formatTable, printCommandHelp, printInfo, printLine, printSuccess } from '../utils/output.js';
+import { confirm } from '../utils/prompt.js';
+import { resolveCreateProject } from '../utils/project-context.js';
+import { CliError, ExitCode, toCliError, usageError } from '../utils/errors.js';
+import { redact, registerSecret } from '../utils/redact.js';
+import { dim, formatTable, printCommandHelp, printError, printInfo, printLine, printSuccess } from '../utils/output.js';
 /** Value flags across every subcommand — readPositionalArgs must know them all. */
 const VALUE_FLAGS = [
+    ...OBSERVATION_VALUE_FLAGS,
+    ...RESOURCES_VALUE_FLAGS,
+    '--project',
+    '--template',
     '--image',
     '--port',
     '--tcp',
+    '--volume',
+    '--volume-runner',
     '--env',
     '--set',
     '--memory',
     '--cpu',
+    '--drain-grace',
     '--health-path',
     '--health-command',
     '--description',
     '--tail',
     '--timeout',
     '--limit',
+    '--cursor',
     '--dir',
     '--dockerfile',
     '--context',
@@ -29,9 +43,22 @@ const VALUE_FLAGS = [
     '--build-arg',
     '--build',
     '--egress',
+    '--ingress',
+    '--activation',
+    '--mode',
+    '--idle',
+    '--idle-timeout',
+    '--activation-timeout',
+    '--stabilization',
+    '--scale-down-stabilization',
+    '--replicas',
 ];
 export async function appsCommand(args) {
     const [subcommand, ...rest] = readPositionalArgs(args, { valueFlags: VALUE_FLAGS });
+    if (subcommand && (hasFlag(args, '--help') || hasFlag(args, '-h')) && SUBCOMMAND_HELP[subcommand]) {
+        SUBCOMMAND_HELP[subcommand].forEach((line) => printLine(line));
+        return;
+    }
     if (!subcommand || hasFlag(args, '--help') || hasFlag(args, '-h')) {
         printAppsHelp();
         if (!subcommand && !hasFlag(args, '--help') && !hasFlag(args, '-h')) {
@@ -40,6 +67,10 @@ export async function appsCommand(args) {
         return;
     }
     const apiOptions = buildApiOptions(args);
+    const flagArgs = args.includes('--') ? args.slice(0, args.indexOf('--')) : args;
+    if (subcommand !== 'create' && hasFlag(flagArgs, '--project')) {
+        throw usageError('--project is only supported by apps create', 'inquir projects add <project> <app>');
+    }
     switch (subcommand) {
         case 'list':
             return listAppsSubcommand(args, apiOptions);
@@ -47,10 +78,24 @@ export async function appsCommand(args) {
             return createAppSubcommand(args, rest, apiOptions);
         case 'deploy':
             return deploySubcommand(args, rest, apiOptions);
+        case 'redeploy':
+            return redeploySubcommand(args, rest, apiOptions);
         case 'status':
             return statusSubcommand(args, rest, apiOptions);
         case 'logs':
+            if (hasFlag(args, '--history'))
+                return logHistorySubcommand(args, rest, apiOptions);
             return logsSubcommand(args, rest, apiOptions);
+        case 'metrics':
+            return metricsSubcommand(args, rest, apiOptions);
+        case 'log-history':
+            return logHistorySubcommand(args, rest, apiOptions);
+        case 'alerts':
+            return alertsSubcommand(args, rest, apiOptions);
+        case 'resources':
+            return resourcesSubcommand(args, rest, apiOptions);
+        case 'describe':
+            return describeSubcommand(args, rest, apiOptions);
         case 'promote':
             return promoteSubcommand(args, rest, apiOptions);
         case 'rollback':
@@ -65,9 +110,21 @@ export async function appsCommand(args) {
             return buildsSubcommand(args, rest, apiOptions);
         case 'update':
             return updateSubcommand(args, rest, apiOptions);
+        case 'scale':
+            return scaleSubcommand(args, rest, apiOptions);
+        case 'wake':
+            return wakeSubcommand(args, rest, apiOptions);
+        case 'pause':
+            return pauseSubcommand(args, rest, apiOptions);
         case 'domain':
         case 'domains':
             return domainSubcommand(args, rest, apiOptions);
+        case 'backups':
+            return backupsSubcommand(args, rest, apiOptions);
+        case 'connect':
+            return connectSubcommand(args, rest, apiOptions);
+        case 'connection-url':
+            return connectionUrlSubcommand(args, rest, apiOptions);
         case 'delete':
             return deleteSubcommand(args, rest, apiOptions);
         default:
@@ -79,56 +136,87 @@ function printAppsHelp() {
         'list                        List applications',
         'create <name>               Create an application',
         'deploy <app> [--image <ref>] Release from an image, or build the current directory',
+        'redeploy <app>              Release what production runs again; promote when healthy',
+        'backups <app> [list|create|restore <id>|delete <id>]  Volume backups (databases)',
+        'connect <db> <app>          Put the database URL into another app\'s env',
+        'connection-url <db>         Print a private URL, or public fallback (--private/--public)',
         'build <app> [--dir <path>]  Build an image from source (Dockerfile) without releasing',
         'builds <app>                List image builds',
         'status <app>                Endpoints and recent releases',
+        'describe <app>              Why it is (not) running: conditions, placement, events',
         'logs <app|release|build>    Stream container (or build) logs',
+        'log-history <app>          Persisted runtime or HTTP logs with time/replica filters',
+        'metrics <app>              CPU/RAM, network, disk I/O or HTTP history (--json)',
+        'alerts <app> [action]      Configure resource/deployment alerts and read incidents',
+        'resources recommend <app>   CPU/RAM right-sizing from observed usage (read-only)',
         'promote <release>           Send production traffic to a release',
         'rollback <app>              Return production to the previous release',
         'stop <release>              Stop a release that is not serving production',
         'exec <release> -- <cmd>     Run a command inside the container',
         'update <app>                Change env vars, ports, resources, egress',
+        'scale <app> [mode]          Set always/http/manual scaling (--replicas for always)',
+        'wake <app>                  Start a sleeping application',
+        'pause <app>                 Stop an http/manual app (HTTP wakes only http mode)',
         'domain <app> [hostname]     Bind a hostname (or list them); --verify / --remove',
         'delete <app>                Archive an application (stops every release)',
         '',
         'Create/deploy flags:',
+        '--project <project>         create: this project by id, slug or unique name (overrides projects use)',
         '--image <ref>               Container image, e.g. nginx:alpine (omit to build from source)',
+        '--promote                   deploy: take production by itself once healthy (needs apps:promote)',
+        '--template <name>           postgres | redis: volume, stable TCP endpoint, generated password, first release',
         '--dir <path>                Source directory to build (default: current directory)',
         '--dockerfile <path>         Dockerfile relative to the context (default: Dockerfile)',
         '--context <path>            Build context inside the source tree (default: .)',
         '--build-arg KEY=VALUE       Docker build argument (repeatable)',
         '--build <buildId>           Release an existing successful build',
         '--port <n>                  HTTP port (omit for a TCP-only service)',
-        '--tcp <name:port[:public][:hostPort]>  Extra TCP port (repeatable)',
+        '--tcp <name:port[:public]>  Extra TCP port; endpoint port is platform-managed (repeatable)',
+        '--volume <name:/path[:ro]> Persistent volume mount (repeatable)',
+        '--volume-runner <id>        Pin volumes (and the container) to a worker runner',
         '--set KEY=VALUE             Environment variable (repeatable)',
         '--memory <mb>               Memory ceiling (default 512)',
         '--cpu <vcpus>               CPU ceiling (default 0.5)',
+        '--drain-grace <seconds>     Time the old container gets after SIGTERM before it is killed (0-3600)',
         '--egress <none|full>        Outbound network policy',
+        '--ingress <private|public>  Public Networking: public creates the generated domain (new apps are private)',
         '--health-path </path>       HTTP health check path',
         '--health-command <cmd>      Health command inside the container (databases)',
         '--no-wait                   Return as soon as the release is queued',
         '--json                      Machine-readable JSON output',
+        '',
+        'Scaling flags:',
+        '--activation <mode>         always, http (sleep when idle), or manual',
+        '--replicas <n>              Horizontal replicas for always mode (allocation plane; 1..8)',
+        '--idle-timeout <duration>   HTTP idle time before sleep (minimum 5m)',
+        '--activation-timeout <duration>  Maximum wake time (5s–5m)',
+        '--stabilization <duration>  Quiet period before sleeping (minimum 0s)',
     ], [
         'inquir apps create web --port 3000',
         'inquir apps deploy web                # builds ./Dockerfile, then releases it',
         'inquir apps deploy web --image nginx:alpine',
-        'inquir apps deploy cache --image redis:7-alpine --tcp redis:6379:public:26379 \\',
+        'inquir apps deploy cache --image redis:7-alpine --tcp redis:6379:public \\',
         '  --health-command "redis-cli ping"',
+        'inquir apps deploy db --image postgres:16 --volume data:/var/lib/postgresql/data',
+        'inquir apps scale web http --idle-timeout 15m',
+        'inquir apps wake web',
+        'inquir apps pause web',
         'inquir apps logs web --tail 100',
         'inquir apps promote <releaseId>',
         'inquir apps domain web shop.example.com && inquir apps domain web shop.example.com --verify',
     ]);
 }
 /**
- * `--tcp name:port[:public][:hostPort]` — the shorthand people actually want
- * to type for a database or SSH endpoint.
+ * `--tcp name:port[:public][:hostPort]` — ordinary usage stops at `public` and
+ * lets the platform lease a stable endpoint port. The final numeric modifier
+ * remains an API/CLI compatibility escape hatch for an existing installation.
  */
 export function parseTcpPortFlag(value) {
     const parts = value.split(':');
     const [name, portRaw, ...flags] = parts;
     const port = Number(portRaw);
     if (!name || !Number.isInteger(port) || port < 1 || port > 65535) {
-        throw usageError(`Invalid --tcp value '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public:25432');
+        throw usageError(`Invalid --tcp value '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public');
     }
     const spec = { name, port, protocol: 'tcp' };
     for (const flag of flags) {
@@ -143,7 +231,7 @@ export function parseTcpPortFlag(value) {
             spec.public = true;
             continue;
         }
-        throw usageError(`Invalid --tcp modifier '${flag}' in '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public:25432');
+        throw usageError(`Invalid --tcp modifier '${flag}' in '${value}'`, 'inquir apps deploy <app> --tcp postgres:5432:public');
     }
     return spec;
 }
@@ -158,27 +246,211 @@ export function parseSetFlags(values) {
     }
     return env;
 }
-/** Runtime spec assembled from flags; undefined when nothing was specified. */
-export function buildRuntimeFromFlags(args) {
+const MAX_SCALING_DELAY_SECONDS = 30 * 24 * 60 * 60;
+const SCALING_ACTIVATIONS = new Set(['always', 'http', 'manual']);
+/** Parse a CLI duration such as `90`, `90s`, `15m`, `1h30m`, or `1.5m`. */
+export function parseDurationSeconds(value) {
+    if (!value || value !== value.trim()) {
+        throw usageError(`Invalid duration '${value}'`, 'Use seconds or a duration such as 30s, 15m, or 1h30m');
+    }
+    if (/^\d+$/.test(value)) {
+        const seconds = Number(value);
+        if (Number.isSafeInteger(seconds))
+            return seconds;
+        throw usageError(`Invalid duration '${value}'`, 'Duration is too large');
+    }
+    const unitSeconds = { s: 1, m: 60, h: 3600, d: 86_400 };
+    const component = /(\d+(?:\.\d+)?)([smhd])/gy;
+    let position = 0;
+    let seconds = 0;
+    while (position < value.length) {
+        component.lastIndex = position;
+        const match = component.exec(value);
+        if (!match) {
+            throw usageError(`Invalid duration '${value}'`, 'Use seconds or a duration such as 30s, 15m, or 1h30m');
+        }
+        seconds += Number(match[1]) * unitSeconds[match[2]];
+        position = component.lastIndex;
+    }
+    if (!Number.isSafeInteger(seconds)) {
+        throw usageError(`Duration '${value}' must resolve to a whole number of seconds`, 'Use an exact duration such as 90s or 1.5m');
+    }
+    return seconds;
+}
+function readAliasedFlagValue(args, flags) {
+    const present = flags.filter((flag) => hasFlag(args, flag));
+    if (present.length > 1) {
+        throw usageError(`Use only one of ${flags.join(', ')}`, `inquir apps scale <app> ${flags[0]} <duration>`);
+    }
+    if (present.length === 0)
+        return undefined;
+    const value = readFlagValue(args, present[0]);
+    if (value === undefined) {
+        throw usageError(`Missing value for ${present[0]}`, `inquir apps scale <app> ${present[0]} <value>`);
+    }
+    return value;
+}
+function parseScalingDuration(raw, flag, min, max) {
+    if (raw === undefined)
+        return undefined;
+    const seconds = parseDurationSeconds(raw);
+    if (seconds < min || seconds > max) {
+        throw usageError(`Invalid ${flag} '${raw}' (${seconds}s); expected ${min}s–${max}s`, `inquir apps scale <app> ${flag} <duration>`);
+    }
+    return seconds;
+}
+/** Build the partial policy sent by `apps scale`; omitted values remain unchanged server-side. */
+export function buildScalingPatchFromFlags(args, positionalActivation) {
+    const flagActivation = readAliasedFlagValue(args, ['--activation', '--mode']);
+    if (positionalActivation && flagActivation && positionalActivation !== flagActivation) {
+        throw usageError(`Conflicting scaling modes '${positionalActivation}' and '${flagActivation}'`, 'inquir apps scale <app> <always|http|manual>');
+    }
+    const activationRaw = positionalActivation ?? flagActivation;
+    if (activationRaw && !SCALING_ACTIVATIONS.has(activationRaw)) {
+        throw usageError(`Invalid scaling mode '${activationRaw}'`, 'inquir apps scale <app> <always|http|manual>');
+    }
+    const idleTimeoutSeconds = parseScalingDuration(readAliasedFlagValue(args, ['--idle-timeout', '--idle']), '--idle-timeout', 300, MAX_SCALING_DELAY_SECONDS);
+    const activationTimeoutSeconds = parseScalingDuration(readAliasedFlagValue(args, ['--activation-timeout']), '--activation-timeout', 5, 300);
+    const scaleDownStabilizationSeconds = parseScalingDuration(readAliasedFlagValue(args, ['--stabilization', '--scale-down-stabilization']), '--stabilization', 0, MAX_SCALING_DELAY_SECONDS);
+    const replicasRaw = readAliasedFlagValue(args, ['--replicas']);
+    let maxReplicas;
+    if (replicasRaw !== undefined) {
+        const parsed = Number.parseInt(replicasRaw, 10);
+        if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 8) {
+            throw usageError(`Invalid --replicas '${replicasRaw}' (1..8; above 1 needs always mode and the allocation plane)`, 'inquir apps scale <app> always --replicas <n>');
+        }
+        maxReplicas = parsed;
+    }
+    return {
+        ...(activationRaw ? { activation: activationRaw } : {}),
+        ...(maxReplicas !== undefined ? { maxReplicas } : {}),
+        ...(idleTimeoutSeconds !== undefined ? { idleTimeoutSeconds } : {}),
+        ...(activationTimeoutSeconds !== undefined ? { activationTimeoutSeconds } : {}),
+        ...(scaleDownStabilizationSeconds !== undefined ? { scaleDownStabilizationSeconds } : {}),
+    };
+}
+const VOLUME_NAME_RE = /^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?$/;
+const MAX_APP_VOLUMES = 16;
+// eslint-disable-next-line no-control-regex -- Container mount paths must reject control characters.
+const CONTROL_CHAR_RE = /[\u0000-\u001f\u007f]/;
+/** `--volume name:/absolute/container/path[:ro]`; host paths are never accepted. */
+export function parseVolumeFlag(value) {
+    const separator = value.indexOf(':');
+    const name = separator > 0 ? value.slice(0, separator) : '';
+    let mountPath = separator > 0 ? value.slice(separator + 1) : '';
+    let readOnly = false;
+    if (/^[A-Za-z]:[\\/]/.test(mountPath)) {
+        throw usageError(`Invalid --volume mount path '${mountPath}'`, 'Volume targets are absolute paths inside the Linux container, for example data:/var/lib/data');
+    }
+    const modifierAt = mountPath.lastIndexOf(':');
+    if (modifierAt >= 0) {
+        const modifier = mountPath.slice(modifierAt + 1);
+        if (modifier !== 'ro') {
+            throw usageError(`Invalid --volume modifier '${modifier}' in '${value}'`, 'inquir apps deploy <app> --volume data:/var/lib/data[:ro]');
+        }
+        readOnly = true;
+        mountPath = mountPath.slice(0, modifierAt);
+    }
+    if (!VOLUME_NAME_RE.test(name)) {
+        throw usageError(`Invalid --volume name '${name || value}'`, 'inquir apps deploy <app> --volume data:/var/lib/data[:ro]');
+    }
+    const pathSegments = mountPath.split('/');
+    if (mountPath !== mountPath.trim() ||
+        mountPath.length < 2 ||
+        mountPath.length > 1024 ||
+        !mountPath.startsWith('/') ||
+        mountPath.includes('\\') ||
+        pathSegments.includes('..') ||
+        CONTROL_CHAR_RE.test(mountPath)) {
+        throw usageError(`Invalid --volume mount path '${mountPath || value}'`, 'inquir apps deploy <app> --volume data:/var/lib/data[:ro]');
+    }
+    const normalizedPath = path.posix.normalize(mountPath);
+    const normalized = normalizedPath.length > 1 ? normalizedPath.replace(/\/+$/, '') : normalizedPath;
+    if (normalized === '/' ||
+        ['/dev', '/proc', '/sys'].some((root) => normalized === root || normalized.startsWith(`${root}/`))) {
+        throw usageError(`Invalid --volume mount path '${mountPath}'`, 'Mount below an application data directory, for example data:/var/lib/data');
+    }
+    return { name, mountPath: normalized, ...(readOnly ? { readOnly: true } : {}) };
+}
+function assertVolumeSet(volumes) {
+    if (volumes.length > MAX_APP_VOLUMES) {
+        throw usageError(`At most ${MAX_APP_VOLUMES} --volume entries are supported`, 'inquir apps deploy --help');
+    }
+    const names = new Set();
+    const targets = new Set();
+    for (const volume of volumes) {
+        if (names.has(volume.name)) {
+            throw usageError(`Duplicate --volume name '${volume.name}'`, 'Use each volume name once');
+        }
+        if (targets.has(volume.mountPath)) {
+            throw usageError(`Duplicate --volume mount path '${volume.mountPath}'`, 'Use each mount path once');
+        }
+        names.add(volume.name);
+        targets.add(volume.mountPath);
+    }
+}
+function mergeVolumes(base, overrides) {
+    const overrideNames = new Set();
+    for (const volume of overrides) {
+        if (overrideNames.has(volume.name)) {
+            throw usageError(`Duplicate --volume name '${volume.name}'`, 'Use each volume name once');
+        }
+        overrideNames.add(volume.name);
+    }
+    const merged = [...(base ?? []).filter((volume) => !overrideNames.has(volume.name)), ...overrides];
+    assertVolumeSet(merged);
+    return merged;
+}
+/** Largest `runtimeSpec.drainGraceSeconds` the API accepts. */
+const MAX_DRAIN_GRACE_SECONDS = 3600;
+/** `--drain-grace <seconds>`: whole seconds, 0..3600, as the API's runtime schema. */
+export function parseDrainGraceFlag(value) {
+    const seconds = /^\d{1,4}$/.test(value) ? Number(value) : Number.NaN;
+    if (!(seconds <= MAX_DRAIN_GRACE_SECONDS)) {
+        throw usageError(`Invalid --drain-grace value '${value}' (whole seconds, 0-${MAX_DRAIN_GRACE_SECONDS})`, 'inquir apps deploy <app> --drain-grace 30');
+    }
+    return seconds;
+}
+/** Runtime flags patch the saved application runtime rather than replacing unrelated fields. */
+export function buildRuntimeFromFlags(args, baseRuntime) {
     const portRaw = readFlagValue(args, '--port');
     const tcpValues = readMultiFlag(args, '--tcp');
+    const volumeValues = readMultiFlag(args, '--volume');
     const memory = readFlagValue(args, '--memory');
     const cpu = readFlagValue(args, '--cpu');
+    const drainGraceRaw = readFlagValue(args, '--drain-grace');
     const healthPath = readFlagValue(args, '--health-path');
     const healthCommand = readFlagValue(args, '--health-command');
     const ports = tcpValues.map(parseTcpPortFlag);
+    const volumes = volumeValues.map(parseVolumeFlag);
     const port = portRaw ? Number(portRaw) : undefined;
     if (portRaw && (!Number.isInteger(port) || port < 1 || port > 65535)) {
         throw usageError(`Invalid --port value '${portRaw}'`, 'inquir apps create <name> --port 3000');
     }
-    if (port === undefined && ports.length === 0 && !memory && !cpu && !healthPath && !healthCommand) {
+    // `--drain-grace` without a value reads as undefined; refuse it rather than
+    // silently deploying without the setting the caller asked for.
+    if (drainGraceRaw === undefined && hasFlag(args, '--drain-grace'))
+        parseDrainGraceFlag('');
+    const drainGraceSeconds = drainGraceRaw !== undefined ? parseDrainGraceFlag(drainGraceRaw) : undefined;
+    if (!portRaw && tcpValues.length === 0 && volumeValues.length === 0 && !memory && !cpu &&
+        drainGraceSeconds === undefined && !healthPath && !healthCommand) {
         return undefined;
     }
     const spec = {
-        ...(port !== undefined ? { port } : {}),
-        ...(ports.length > 0 ? { ports } : {}),
-        resources: { cpuVCpus: cpu ? Number(cpu) : 0.5, memoryMb: memory ? Number(memory) : 512 },
+        ...(baseRuntime ?? {}),
+        ...(portRaw ? { port } : {}),
+        ...(tcpValues.length > 0 ? { ports } : {}),
+        ...(volumeValues.length > 0 ? { volumes: mergeVolumes(baseRuntime?.volumes, volumes) } : {}),
+        ...(drainGraceSeconds !== undefined ? { drainGraceSeconds } : {}),
     };
+    if (memory || cpu) {
+        const parsedMemory = memory ? Number(memory) : (baseRuntime?.resources?.memoryMb ?? 512);
+        const parsedCpu = cpu ? Number(cpu) : (baseRuntime?.resources?.cpuVCpus ?? 0.5);
+        if (!Number.isInteger(parsedMemory) || parsedMemory < 1 || !Number.isFinite(parsedCpu) || parsedCpu <= 0) {
+            throw usageError('Invalid --memory or --cpu value', 'inquir apps update <app> --memory 512 --cpu 0.5');
+        }
+        spec.resources = { cpuVCpus: parsedCpu, memoryMb: parsedMemory };
+    }
     if (healthCommand) {
         spec.healthcheck = {
             type: 'command',
@@ -187,7 +459,7 @@ export function buildRuntimeFromFlags(args) {
             timeoutSeconds: 5,
         };
     }
-    else if (port !== undefined) {
+    else if (healthPath || (portRaw && !baseRuntime?.healthcheck)) {
         spec.healthcheck = {
             type: 'http',
             path: healthPath || '/',
@@ -224,23 +496,496 @@ async function createAppSubcommand(args, positionals, apiOptions) {
     const [name] = positionals;
     if (!name)
         throw usageError('Missing application name', 'inquir apps create <name> --port 3000');
+    if (positionals.length > 1)
+        throw usageError('Expected one application name', 'inquir apps create <name> --project <project>');
     await requireAuth(apiOptions);
+    const template = readFlagValue(args, '--template');
+    if (template && !TEMPLATE_NAMES.includes(template)) {
+        throw usageError(`Unknown template '${template}'. Available: ${TEMPLATE_NAMES.join(', ')}`, `inquir apps create ${name} --template postgres`);
+    }
     const envVars = parseSetFlags(readMultiFlag(args, '--set'));
+    const volumeRunner = readFlagValue(args, '--volume-runner');
+    // Omitted flags leave the server defaults in force: full egress, and a
+    // private-only service until a public domain is asked for.
+    const networkPolicy = buildNetworkPolicyPatch({
+        egress: readFlagValue(args, '--egress'),
+        ingress: readFlagValue(args, '--ingress'),
+    });
+    const project = await resolveCreateProject(args, apiOptions);
     const app = await createApplication({
         name,
+        ...(project.projectId ? { projectId: project.projectId } : {}),
         description: readFlagValue(args, '--description'),
+        ...(template ? { template } : {}),
+        ...(volumeRunner ? { volumeRunner } : {}),
         runtime: buildRuntimeFromFlags(args),
         ...(Object.keys(envVars).length > 0 ? { envVars } : {}),
-    }, apiOptions);
+        ...(networkPolicy ? { networkPolicy } : {}),
+    }, project.apiOptions).catch((error) => {
+        // A worker runner pulls only a digest-pinned registry image, and this
+        // installation has no mirror of the template's image yet.
+        if (error instanceof ApiError && error.code === 'APP_TEMPLATE_IMAGE_NOT_MIRRORED') {
+            throw new CliError(`The ${template} template cannot run on a worker runner on this installation yet`, {
+                code: error.code,
+                exitCode: ExitCode.ERROR,
+                requestId: error.requestId,
+                details: error.payload,
+                explanation: error.message,
+                fix: 'An operator mirrors the template image into the platform registry and sets APPS_TEMPLATE_IMAGES (docs/operations/template-images.md). Until then, create the database without --volume-runner: it runs on the control-plane runner.',
+                command: `inquir apps create ${name} --template ${template}`,
+            });
+        }
+        throw error;
+    });
+    const firstRelease = app.firstRelease;
     if (readJsonFlag(args)) {
-        printLine(JSON.stringify(app, null, 2));
+        // A scripted create must answer the same question the human one does:
+        // "is it up, and where do I reach it?" — so it waits for the release too.
+        const settled = template && firstRelease ? await waitForRelease(firstRelease.releaseId, project.apiOptions) : null;
+        printLine(JSON.stringify(settled ? { ...app, firstRelease: settled } : app, null, 2));
+        if (settled && !isHealthyRelease(settled))
+            process.exitCode = ExitCode.ERROR;
         return;
     }
     printSuccess(`Created application ${app.name}`);
     printInfo(dim(`  id: ${app.id}`));
+    for (const line of await landingProjectLines(app, project.projectId, project.apiOptions)) {
+        printInfo(dim(`  ${line}`));
+    }
+    if (template && firstRelease) {
+        printInfo(dim(`  template: ${template} — first release ${firstRelease.releaseId.slice(0, 8)} is starting`));
+        const release = await waitForRelease(firstRelease.releaseId, project.apiOptions);
+        renderRelease(release);
+        if (!isHealthyRelease(release)) {
+            process.exitCode = ExitCode.ERROR;
+            return;
+        }
+        printInfo(dim(`  connection string: inquir apps connection-url ${app.name}`));
+        printInfo(dim(`  wire an app to it: inquir apps connect ${app.name} <target-app>`));
+        return;
+    }
     printInfo(dim(`  deploy it: inquir apps deploy ${app.name}            (builds the Dockerfile in the current directory)`));
     printInfo(dim(`         or: inquir apps deploy ${app.name} --image <ref>`));
 }
+/**
+ * Which project a new application landed in, by name. With neither --project
+ * nor a selection the server creates one named after the application, so a
+ * database and the app using it land in two projects: say so, and how to
+ * group them.
+ */
+async function landingProjectLines(app, requestedProject, apiOptions) {
+    const projectId = app.projectIds?.[0];
+    if (!projectId)
+        return [];
+    const project = await getProject(projectId, apiOptions).catch(() => null);
+    const label = project ? `${project.name} (${project.slug})` : projectId;
+    if (requestedProject)
+        return [`project: ${label}`];
+    return [
+        `project: ${label}, created for it since no project is selected here`,
+        `  group it with another application: inquir projects move <project> ${app.name}`,
+        '  put new applications in one project: inquir projects use <project>',
+    ];
+}
+const TEMPLATE_NAMES = ['postgres', 'redis'];
+/** `apps <sub> --help` answered per subcommand; the global page is the fallback. */
+const SUBCOMMAND_HELP = {
+    ...OBSERVATION_HELP,
+    ...RESOURCES_HELP,
+    ...DESCRIBE_HELP,
+    logs: [
+        'Usage: inquir apps logs <app|release|build> [--tail <n>]',
+        '  Streams container or build logs. Ctrl-C stops following.',
+        '  --history selects persisted history instead; see apps log-history --help.',
+    ],
+    promote: [
+        'Usage: inquir apps promote <release> [--no-wait] [--json]',
+        '',
+        '  Sends production traffic to a healthy release. A multi-replica service',
+        '  may be promoted as a rolling rollout: the server starts the new replicas a',
+        '  few at a time and switches production once enough of them serve, and the',
+        '  CLI follows it until then.',
+        '  --no-wait           Return as soon as the rollout has started',
+    ],
+    redeploy: [
+        'Usage: inquir apps redeploy <app> [--no-promote] [--no-wait]',
+        '',
+        '  Releases what production runs now — the same build, or the same image',
+        "  reference pulled again — under the application's current env, ports and",
+        '  resources, and promotes it once it is healthy. Use it after `apps update`',
+        '  to apply changed settings, or to start over from a clean container.',
+        '  --no-promote        Only queue the release; promote it yourself later',
+        '  --no-wait           Return as soon as the release is queued',
+        '',
+        'Applications with volumes are recreated: the service is down for the swap.',
+    ],
+    create: [
+        'Usage: inquir apps create <name> [--template postgres|redis] [flags]',
+        '',
+        '  --project <project>  Add to this project (id, slug or unique name). Otherwise',
+        '                      uses projects use; without a selection, creates a project',
+        '                      named after the app (group it later: inquir projects move).',
+        '  --template <name>   postgres | redis: volume, pinned public TCP port,',
+        '                      generated password, and the first release — one command',
+        '                      from nothing to a running database.',
+        '  --volume-runner <id>  Pin volumes + container to a worker runner (id or',
+        '                      unique prefix); the data lives on that machine. With',
+        '                      --template the worker runs the operator\'s digest-pinned',
+        '                      mirror of the template image (APPS_TEMPLATE_IMAGES).',
+        '  --port, --tcp, --volume, --memory, --cpu, --drain-grace, --health-command, --set KEY=VALUE',
+        '',
+        'Examples:',
+        '  inquir apps create mydb --template postgres',
+        '  inquir apps create web --port 3000',
+    ],
+    backups: [
+        'Usage: inquir apps backups <app> [list|create|restore <backupId>|delete <backupId>]',
+        '',
+        '  list (default)      Snapshots of this app\'s volumes, newest first',
+        '                      --volume <name>  only that volume',
+        '                      --limit <n>, --cursor <c>  page through older ones',
+        '  create              Snapshot every mounted volume now, then follow the',
+        '                      rows until they settle (--no-wait returns at once)',
+        '  restore <backupId>  OVERWRITE a volume from a snapshot — asks for',
+        '                      confirmation, or pass --yes in a script',
+        '  delete <backupId>   Drop a restore point for good — asks for confirmation',
+        '',
+        'Backups are crash-consistent and only exist for applications with volumes.',
+        'Restore stops the application while it runs.',
+    ],
+    connect: [
+        'Usage: inquir apps connect <database-app> <target-app> [--overwrite]',
+        '',
+        'Writes the database connection URL into the target app\'s environment',
+        '(DATABASE_URL for postgres, REDIS_URL for redis). The password never',
+        'passes through your terminal. Takes effect on the target\'s next release.',
+        'The URL names the database\'s private address, <slug>.apps.internal:<port>,',
+        'on the control-plane runner and on a worker alike, once the platform has',
+        'verified it (`inquir apps status <db>` lists it).',
+        '',
+        '  --overwrite   Replace a DATABASE_URL/REDIS_URL the target already has —',
+        '                e.g. to repoint it at the database\'s private address',
+        '                (<slug>.apps.internal) after a hand-written hostname.',
+    ],
+    'connection-url': [
+        'Usage: inquir apps connection-url <database-app> [--private|--public]',
+        '',
+        'Prints the private URL when available, otherwise the explicit Public',
+        'Access URL. Use --private or --public to require one visibility.',
+        'Public TCP exposure does not add database TLS. Prefer',
+        '`inquir apps connect` when the consumer is another app on the platform.',
+    ],
+};
+const BACKUPS_USAGE = 'inquir apps backups <app> [list|create|restore <backupId>|delete <backupId>]';
+/** The one backup table: `create` prints it too, once the rows settle. */
+function renderBackupTable(items) {
+    printLine(formatTable(items.map((b) => ({
+        id: b.id.slice(0, 8),
+        volume: b.volumeName,
+        status: b.status,
+        trigger: b.trigger,
+        size: formatBytes(b.sizeBytes ?? b.artifactSizeBytes),
+        created: b.createdAt.replace('T', ' ').slice(0, 19),
+    })), ['id', 'volume', 'status', 'trigger', 'size', 'created']));
+}
+/** Accept a short id, the way the release commands do. */
+async function resolveBackup(applicationId, needle, identifier, apiOptions) {
+    const { items } = await listAppBackups(applicationId, { limit: 100 }, apiOptions);
+    const match = items.find((b) => b.id === needle || b.id.startsWith(needle));
+    if (!match)
+        throw usageError(`No backup matching '${needle}'`, `inquir apps backups ${identifier} list`);
+    return match;
+}
+/**
+ * Follow the rows a backup run created until none is PENDING. The copy outlives
+ * the request that started it (the API answers 202), so the rows — not the
+ * response — carry the outcome.
+ */
+async function waitForBackups(applicationId, started, apiOptions, json, timeoutMs = 30 * 60_000) {
+    const deadline = Date.now() + timeoutMs;
+    const startedAt = Date.now();
+    const settled = new Map();
+    const announce = (line) => {
+        // Under --json only stdout must stay parseable; progress goes to stderr.
+        if (json)
+            process.stderr.write(`${line}\n`);
+        else
+            printInfo(dim(line));
+    };
+    announce(`— copying ${started.length} volume(s); a large volume takes minutes —`);
+    for (;;) {
+        for (const row of started) {
+            if (settled.has(row.id))
+                continue;
+            const current = await getAppBackup(applicationId, row.id, apiOptions);
+            if (current.status === 'PENDING')
+                continue;
+            settled.set(row.id, current);
+            const size = current.status === 'READY' ? ` ${formatBytes(current.sizeBytes ?? current.artifactSizeBytes)}` : '';
+            announce(`— ${current.volumeName} ${current.status}${size} (${formatElapsed(Date.now() - startedAt)}) —`);
+        }
+        if (settled.size === started.length)
+            return started.map((row) => settled.get(row.id));
+        if (Date.now() > deadline) {
+            throw new CliError(`Backup of ${applicationId} did not settle within ${Math.round(timeoutMs / 60_000)}m`, {
+                code: 'BACKUP_TIMEOUT',
+                exitCode: ExitCode.ERROR,
+                fix: 'The copy keeps running server-side; check the rows later.',
+                command: `inquir apps backups ${applicationId} list`,
+            });
+        }
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+    }
+}
+async function backupsSubcommand(args, positionals, apiOptions) {
+    const [identifier, verb = 'list', backupId] = positionals;
+    if (!identifier) {
+        throw usageError('Missing application', BACKUPS_USAGE);
+    }
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const json = readJsonFlag(args);
+    if (verb === 'list') {
+        const cursor = readFlagValue(args, '--cursor');
+        const volumeName = readFlagValue(args, '--volume');
+        const page = await listAppBackups(app.id, {
+            // Each flag is sent only when given, so an unset one keeps the API's
+            // own page size instead of pinning a second default here.
+            ...(readFlagValue(args, '--limit') ? { limit: readLimitFlag(args, 0) } : {}),
+            ...(cursor ? { cursor } : {}),
+            ...(volumeName ? { volumeName } : {}),
+        }, apiOptions);
+        if (json)
+            return printLine(JSON.stringify(page, null, 2));
+        if (page.items.length === 0) {
+            printInfo(`No backups for ${app.name} yet — create one: inquir apps backups ${app.name} create`);
+            return;
+        }
+        renderBackupTable(page.items);
+        if (page.nextCursor) {
+            printInfo(dim(`  older: inquir apps backups ${app.name} list --cursor ${page.nextCursor}`));
+        }
+        return;
+    }
+    if (verb === 'create') {
+        const run = await createAppBackup(app.id, apiOptions);
+        if (hasFlag(args, '--no-wait')) {
+            if (json)
+                return printLine(JSON.stringify(run, null, 2));
+            renderBackupTable(run.items);
+            printInfo(dim(`  follow them: inquir apps backups ${app.name} list`));
+            return;
+        }
+        const items = await waitForBackups(app.id, run.items, apiOptions, json);
+        if (json)
+            printLine(JSON.stringify({ items, statusUrl: run.statusUrl }, null, 2));
+        else
+            renderBackupTable(items);
+        // A snapshot that never became READY is a failed command, not a note.
+        if (items.some((b) => b.status !== 'READY'))
+            process.exitCode = ExitCode.ERROR;
+        return;
+    }
+    if (verb === 'restore') {
+        if (!backupId) {
+            throw usageError('Missing backup id', `inquir apps backups ${identifier} restore <backupId>`);
+        }
+        // Resolve the backup BEFORE asking for confirmation: a warning that cannot
+        // name the volume, the moment, and the size is a warning nobody reads.
+        const match = await resolveBackup(app.id, backupId, identifier, apiOptions);
+        if (match.status !== 'READY') {
+            throw usageError(`Backup ${match.id.slice(0, 8)} is ${match.status} and cannot be restored`, `inquir apps backups ${identifier} list`);
+        }
+        const when = match.createdAt.replace('T', ' ').slice(0, 16);
+        const summary = `${app.name} volume ${match.volumeName} from the ${when} backup (${formatBytes(match.sizeBytes ?? match.artifactSizeBytes)})`;
+        if (!runtime().yes) {
+            const approved = await confirm(`Overwrite ${summary}? Everything written since ${when} is lost, and ${app.name} stops during the restore.`, false);
+            if (!approved) {
+                throw usageError(`Refusing to restore ${app.name} without confirmation`, `inquir apps backups ${identifier} restore ${match.id.slice(0, 8)} --yes`);
+            }
+        }
+        await restoreAppBackup(app.id, match.id, apiOptions);
+        if (json) {
+            return printLine(JSON.stringify({ restored: true, application: app.name, backupId: match.id, volumeName: match.volumeName, createdAt: match.createdAt }, null, 2));
+        }
+        printSuccess(`Restored ${app.name} volume ${match.volumeName} from backup ${match.id.slice(0, 8)}`);
+        return;
+    }
+    if (verb === 'delete') {
+        if (!backupId) {
+            throw usageError('Missing backup id', `inquir apps backups ${identifier} delete <backupId>`);
+        }
+        const match = await resolveBackup(app.id, backupId, identifier, apiOptions);
+        const when = match.createdAt.replace('T', ' ').slice(0, 16);
+        if (!runtime().yes) {
+            const approved = await confirm(`Delete the ${when} backup of ${app.name} volume ${match.volumeName}? This restore point is gone for good.`, false);
+            if (!approved) {
+                throw usageError(`Refusing to delete a backup of ${app.name} without confirmation`, `inquir apps backups ${identifier} delete ${match.id.slice(0, 8)} --yes`);
+            }
+        }
+        await deleteAppBackup(app.id, match.id, apiOptions);
+        if (json) {
+            return printLine(JSON.stringify({ deleted: true, application: app.name, backupId: match.id, volumeName: match.volumeName, createdAt: match.createdAt }, null, 2));
+        }
+        printSuccess(`Deleted backup ${match.id.slice(0, 8)} of ${app.name} volume ${match.volumeName}`);
+        return;
+    }
+    throw usageError(`Unknown backups action '${verb}'`, BACKUPS_USAGE);
+}
+/**
+ * The refusals of `apps connect` and `apps connection-url`, told as what to do
+ * next. The server's code and message are kept; the cause, the fix and the
+ * command to try are the CLI's. Anything else passes through unchanged to the
+ * generic rendering.
+ */
+export function explainDatabaseConnectionError(error, context) {
+    if (!(error instanceof ApiError) || !error.code)
+        return error;
+    const { database, target } = context;
+    const base = {
+        code: error.code,
+        exitCode: ExitCode.ERROR,
+        requestId: error.requestId,
+        details: error.payload,
+    };
+    const status = `inquir apps status ${database}`;
+    const retry = target ? `inquir apps connect ${database} ${target}` : `inquir apps connection-url ${database}`;
+    switch (error.code) {
+        case 'APP_NOT_A_TEMPLATE':
+            return new CliError(`${database} was not created from a database template`, {
+                ...base,
+                explanation: 'connect and connection-url compose URLs only for postgres and redis template databases: the template says which variables hold the user, the password and the database.',
+                fix: target
+                    ? `Create the database with --template (on a worker too: --template postgres --volume-runner <runner>), or set the URL on ${target} yourself; a URL set by hand is not recorded as a dependency.`
+                    : 'Create the database with --template (on a worker too: --template postgres --volume-runner <runner>), or compose the URL from its own credentials and its private address.',
+                command: target ? `inquir apps update ${target} --set DATABASE_URL=<url>` : status,
+            });
+        case 'APP_PRIVATE_ENDPOINT_NOT_READY':
+            return new CliError(`${database} has no verified private address yet`, {
+                ...base,
+                explanation: error.message,
+                cause: 'The platform verifies a database\'s private proxy once its replica serves, on a worker runner too, and re-checks it about every 20 seconds.',
+                fix: `Retry in a minute. If it lasts, check that the database is serving: ${status}`,
+                command: retry,
+            });
+        case 'APP_NO_TCP_ENDPOINT':
+            return new CliError(error.message, {
+                ...base,
+                // An older control plane also answers this for a database a worker
+                // serves: it looked for the port only in the release's port mappings,
+                // which such a release never has (src/apps/app-connection-endpoint.ts).
+                cause: 'The server found no private TCP port on the database\'s production release: it declares none, or it runs on a worker runner and the control plane predates reading those ports.',
+                fix: `Check the release's ports with ${status}. If it declares one (e.g. --tcp postgres:5432), the control plane needs the update that reads worker-served ports; otherwise declare the port and deploy the database again.`,
+                command: status,
+            });
+        case 'PRIVATE_NETWORK_NOT_CONFIGURED':
+            return new CliError(error.message, {
+                ...base,
+                cause: 'The control plane offers no private address for this database.',
+                fix: target
+                    ? 'connect writes private URLs only. A client outside the platform can use the public URL once Public Access is enabled on the database. If other apps have private addresses here, the database\'s may just not be verified yet: retry in a minute.'
+                    : 'Enable Public Access on the database and ask for its public URL. If other apps have private addresses here, the database\'s may just not be verified yet: retry in a minute.',
+                command: `inquir apps connection-url ${database} --public`,
+            });
+        case 'APP_NO_PRODUCTION_RELEASE':
+            return new CliError(error.message, {
+                ...base,
+                fix: 'Deploy the database first; a template database ships its first release when it is created.',
+                command: status,
+            });
+        case 'APP_PRODUCTION_RELEASE_NOT_ACTIVE':
+            return new CliError(error.message, {
+                ...base,
+                fix: 'Wait until its release serves: on a worker runner the replica must start and pass its health check first.',
+                command: status,
+            });
+        case 'APP_CREDENTIALS_MISSING':
+            return new CliError(error.message, {
+                ...base,
+                cause: 'The running release\'s env has no password under the template\'s key (POSTGRES_PASSWORD, REDIS_PASSWORD).',
+                fix: 'Set it on the database to the password its data actually uses, then deploy the database again; a new value does not change the password of existing data.',
+                command: `inquir apps update ${database} --set <POSTGRES_PASSWORD|REDIS_PASSWORD>=<password>`,
+            });
+        case 'ENV_KEY_ALREADY_SET':
+            return new CliError(error.message, {
+                ...base,
+                fix: 'Replace it on purpose: the new URL applies on the target\'s next release.',
+                command: `${retry} --overwrite`,
+            });
+        default:
+            return error;
+    }
+}
+async function connectSubcommand(args, positionals, apiOptions) {
+    const [dbIdentifier, targetIdentifier] = positionals;
+    if (!dbIdentifier || !targetIdentifier) {
+        throw usageError('Usage: apps connect <database-app> <target-app>', 'inquir apps connect mydb web');
+    }
+    await requireAuth(apiOptions);
+    const db = await resolveApplication(dbIdentifier, apiOptions);
+    // The server refuses to replace a key the target already carries; the flag
+    // is how an app is repointed at the database's current private address
+    // (the composed URL never passes through this terminal).
+    const overwrite = args.includes('--overwrite');
+    const result = await connectApps(db.id, targetIdentifier, { ...apiOptions, overwrite }).catch((error) => {
+        throw explainDatabaseConnectionError(error, { database: db.name, target: targetIdentifier });
+    });
+    if (readJsonFlag(args)) {
+        return printLine(JSON.stringify(result, null, 2));
+    }
+    printSuccess(`${result.envKey} set on ${result.target}`);
+    printInfo(dim(`  Applies on the next release — deploy it: inquir apps deploy ${result.target}`));
+}
+async function connectionUrlSubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps connection-url mydb');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const result = await getAppConnectionUrl(app.id, apiOptions).catch((error) => {
+        throw explainDatabaseConnectionError(error, { database: app.name });
+    });
+    const requirePrivate = args.includes('--private');
+    const requirePublic = args.includes('--public');
+    if (requirePrivate && requirePublic) {
+        throw usageError('Use either --private or --public, not both', 'inquir apps connection-url mydb --private');
+    }
+    // Print BEFORE registering: this command exists to hand the credential over,
+    // and the redaction filter would otherwise mask its own output. Registering
+    // afterwards keeps it out of anything that prints later in this process.
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(result, null, 2));
+        if (result.url)
+            registerSecret(result.url);
+        if (result.publicUrl)
+            registerSecret(result.publicUrl);
+        return;
+    }
+    const selected = selectConnectionUrl(result, requirePrivate ? 'private' : requirePublic ? 'public' : 'auto');
+    printLine(selected.url);
+    registerSecret(selected.url);
+    if (process.stderr.isTTY) {
+        if (selected.visibility === 'public') {
+            process.stderr.write(dim('Public TCP exposure does not add database TLS; require and verify TLS in the database itself.\n'));
+        }
+        process.stderr.write(dim(`This is a live credential and it is now in your shell history. To grant another app access without copying it: inquir apps connect ${app.name} <target-app>\n`));
+    }
+}
+export function selectConnectionUrl(result, preference = 'auto') {
+    if (preference !== 'public' && result.url) {
+        return { url: result.url, visibility: 'private' };
+    }
+    if (preference !== 'private' && result.publicUrl) {
+        return { url: result.publicUrl, visibility: 'public' };
+    }
+    const requested = preference === 'auto' ? 'private or public' : preference;
+    const reason = preference !== 'public' ? result.privateUnavailable : undefined;
+    throw usageError(`No ${requested} database connection URL is available${reason ? `: ${reason.message}` : ''}`, preference === 'public'
+        ? 'Enable Public Access in the application Networking settings.'
+        : reason?.code === 'APP_PRIVATE_ENDPOINT_NOT_READY'
+            ? 'Retry in a minute; the private address is verified once the database serves.'
+            : 'Configure private networking, or use --public after explicitly enabling Public Access.');
+}
 async function deploySubcommand(args, positionals, apiOptions) {
     const [identifier] = positionals;
     const image = readFlagValue(args, '--image');
@@ -253,8 +998,9 @@ async function deploySubcommand(args, positionals, apiOptions) {
     }
     await requireAuth(apiOptions);
     const app = await resolveApplication(identifier, apiOptions);
-    const runtimeSpec = buildRuntimeFromFlags(args);
+    const runtimeSpec = buildRuntimeFromFlags(args, app.runtime);
     const json = readJsonFlag(args);
+    const promote = hasFlag(args, '--promote');
     // No image and no build id: build the source directory first, then release
     // the produced image. That is the Railway-shaped default — a Dockerfile in
     // the current directory is all a project needs.
@@ -270,12 +1016,23 @@ async function deploySubcommand(args, positionals, apiOptions) {
         }
         buildId = build.id;
     }
-    const queued = await createRelease(app.id, {
-        ...(buildId ? { buildId } : { imageRef: image }),
-        ...(runtimeSpec ? { runtime: runtimeSpec } : {}),
-    }, apiOptions);
+    let queued;
+    try {
+        queued = await createRelease(app.id, {
+            ...(buildId ? { buildId } : { imageRef: image }),
+            ...(runtimeSpec ? { runtime: runtimeSpec } : {}),
+            ...(promote ? { promote: true } : {}),
+        }, apiOptions);
+    }
+    catch (err) {
+        if (err instanceof Error)
+            err.message = humanizeApiError(err.message);
+        throw err;
+    }
     if (!json) {
         printInfo(`Release ${queued.releaseId.slice(0, 8)} queued for ${app.name} (${image ?? `build ${buildId.slice(0, 8)}`})`);
+        if (promote)
+            printInfo(dim('  it takes production by itself once healthy'));
     }
     if (hasFlag(args, '--no-wait')) {
         if (json)
@@ -284,17 +1041,109 @@ async function deploySubcommand(args, positionals, apiOptions) {
             printInfo(dim(`  status: inquir apps status ${app.name}`));
         return;
     }
-    const release = await waitForRelease(queued.releaseId, apiOptions);
+    await followQueuedRelease(app, queued, promote, json, apiOptions);
+}
+/**
+ * Wait for a queued release to settle and say where it ended up; with
+ * promote-on-ready, also wait for production to point at it.
+ */
+async function followQueuedRelease(app, queued, promote, json, apiOptions) {
+    let release = await waitForRelease(queued.releaseId, apiOptions);
+    const production = promote && isHealthyRelease(release)
+        ? await waitForProduction(app.id, queued.releaseId, apiOptions)
+        : undefined;
+    if (production)
+        release = production.release;
+    const served = production?.servingProduction ?? false;
     if (json) {
-        printLine(JSON.stringify(release, null, 2));
+        printLine(JSON.stringify(promote ? {
+            ...release,
+            servingProduction: served,
+            ...(production?.promotionError ? { promotionError: production.promotionError } : {}),
+        } : release, null, 2));
     }
     else {
         renderRelease(release, queued.previewUrl);
+        if (production) {
+            if (served)
+                printSuccess(`Production now serves ${queued.releaseId.slice(0, 8)}`);
+            else
+                printError(`${production.promotionError.message} — see: inquir apps status ${app.name}`);
+        }
     }
-    // A release that never became healthy is a failed command, not a note.
-    if (release.status === 'FAILED')
+    // A settled release can be stopped, and a healthy preview is not the
+    // requested result when the caller explicitly asked to serve production.
+    if (!isHealthyRelease(release) || (promote && !served))
         process.exitCode = ExitCode.ERROR;
 }
+function isHealthyRelease(release) {
+    return release.status === 'READY' || release.status === 'ACTIVE';
+}
+/**
+ * Observe both the production pointer and current release health. Return the
+ * latest row so a late failure cannot be hidden by the earlier READY snapshot.
+ * Transport/auth errors propagate; refused promotion and timeout are outcomes.
+ */
+async function waitForProduction(applicationId, releaseId, apiOptions, timeoutMs = 120_000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const app = await getApplication(applicationId, apiOptions);
+        const release = await getRelease(releaseId, apiOptions);
+        if (app.productionReleaseId === releaseId && isHealthyRelease(release)) {
+            return { release, servingProduction: true };
+        }
+        if (release.status === 'FAILED' || release.status === 'STOPPED' || release.failureReason?.startsWith('Auto-promote failed')) {
+            return {
+                release, servingProduction: false,
+                promotionError: {
+                    code: 'PROMOTION_FAILED',
+                    message: release.failureReason ?? `Release ${releaseId} is ${release.status.toLowerCase()} and is not serving production`,
+                },
+            };
+        }
+        if (Date.now() >= deadline) {
+            return {
+                release, servingProduction: false,
+                promotionError: {
+                    code: 'PROMOTION_TIMEOUT',
+                    message: `Release ${releaseId} did not begin serving production within ${Math.round(timeoutMs / 1000)}s. The CLI stopped waiting; check its status before retrying`,
+                },
+            };
+        }
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+    }
+}
+async function redeploySubcommand(args, positionals, apiOptions) {
+    const [identifier] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', 'inquir apps redeploy <app>');
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const json = readJsonFlag(args);
+    const promote = !hasFlag(args, '--no-promote');
+    let queued;
+    try {
+        queued = await redeployApplication(app.id, { promote }, apiOptions);
+    }
+    catch (err) {
+        if (err instanceof Error)
+            err.message = humanizeApiError(err.message);
+        throw err;
+    }
+    if (!json) {
+        printInfo(`Release ${queued.releaseId.slice(0, 8)} queued for ${app.name} (redeploy of ${queued.redeployOf.slice(0, 8)})`);
+        if (promote)
+            printInfo(dim('  it takes production by itself once healthy'));
+    }
+    if (hasFlag(args, '--no-wait')) {
+        if (json)
+            printLine(JSON.stringify(queued, null, 2));
+        else
+            printInfo(dim(`  status: inquir apps status ${app.name}`));
+        return;
+    }
+    await followQueuedRelease(app, queued, promote, json, apiOptions);
+}
 /**
  * Zip a source directory, queue a build for it and follow the build log until
  * it settles. Returns the final build row.
@@ -322,65 +1171,202 @@ async function runSourceBuild(applicationId, appName, args, apiOptions) {
             ? `Build ${queued.buildId.slice(0, 8)} reused (identical source already built)`
             : `Build ${queued.buildId.slice(0, 8)} queued for ${appName}`);
     }
-    if (queued.deduplicated || isTerminalBuildStatus(queued.status)) {
-        return getBuild(queued.buildId, apiOptions);
+    return waitForBuild(queued.buildId, apiOptions, {
+        json, initial: queued, noLogs: queued.deduplicated || isTerminalBuildStatus(queued.status),
+    });
+}
+const BUILD_WAIT_PHASE = { QUEUED: 'queued', EXECUTING: 'building' };
+const BUILD_WAIT_ERROR = { QUEUE: 'BUILD_QUEUE_TIMEOUT', EXECUTION: 'BUILD_TIMEOUT', STATUS_REQUEST: 'BUILD_STATUS_TIMEOUT' };
+const BUILD_STATUS_REQUEST_TIMEOUT_MS = 15_000;
+const BUILD_STATUS_POLL_INTERVAL_MS = 1_000;
+const BUILD_STATUS_RETRY_BACKOFF_MS = 2_000;
+const BUILD_LOG_DRAIN_TIMEOUT_MS = 250;
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+const HTTP_TOO_MANY_REQUESTS = 429;
+const HTTP_SERVER_ERROR_MIN = 500;
+function buildWaitPolicy(value) {
+    if (!value || !Number.isSafeInteger(value.executionTimeoutMs) || value.executionTimeoutMs < 1 ||
+        !Number.isSafeInteger(value.queueTimeoutMs) || value.queueTimeoutMs < 1 ||
+        !Number.isSafeInteger(value.completionGraceMs) || value.completionGraceMs < 0 ||
+        value.executionTimeoutMs > MAX_TIMER_DELAY_MS || value.queueTimeoutMs > MAX_TIMER_DELAY_MS ||
+        value.completionGraceMs > MAX_TIMER_DELAY_MS) {
+        return DEFAULT_BUILD_TIMEOUT_POLICY;
+    }
+    return value;
+}
+function buildWaitSleep(ms, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const onAbort = () => { clearTimeout(timer); signal.removeEventListener('abort', onAbort); reject(signal.reason); };
+        const timer = setTimeout(() => { signal.removeEventListener('abort', onAbort); resolve(); }, ms);
+        signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+/** Authoritative phase observation, independent of an open or broken log stream. */
+export async function waitForBuild(buildId, apiOptions, options = {}) {
+    const clock = () => globalThis.performance.now();
+    const controller = new AbortController();
+    const initialPolicy = buildWaitPolicy(options.initial?.timeoutPolicy);
+    const overallDeadline = clock() + initialPolicy.queueTimeoutMs + initialPolicy.executionTimeoutMs + initialPolicy.completionGraceMs;
+    let phase = options.initial?.status === BUILD_WAIT_PHASE.EXECUTING
+        ? BUILD_WAIT_PHASE.EXECUTING : BUILD_WAIT_PHASE.QUEUED;
+    let deadline = overallDeadline;
+    let timer;
+    let expire;
+    const expired = new Promise((_, reject) => { expire = reject; });
+    function observe(value) {
+        const next = value.status === BUILD_WAIT_PHASE.EXECUTING ? BUILD_WAIT_PHASE.EXECUTING : BUILD_WAIT_PHASE.QUEUED;
+        // A stale queued observation cannot restart an already-running budget.
+        if (phase === BUILD_WAIT_PHASE.EXECUTING && next === BUILD_WAIT_PHASE.QUEUED)
+            return;
+        const policy = buildWaitPolicy(value.timeoutPolicy ?? initialPolicy);
+        const cap = next === BUILD_WAIT_PHASE.QUEUED ? policy.queueTimeoutMs : policy.executionTimeoutMs + policy.completionGraceMs;
+        const remaining = typeof value.timeoutRemainingMs === 'number' && Number.isFinite(value.timeoutRemainingMs) && value.timeoutRemainingMs >= 0
+            ? Math.min(value.timeoutRemainingMs, cap) : cap;
+        const candidate = Math.min(overallDeadline, clock() + remaining);
+        deadline = next === phase ? Math.min(deadline, candidate) : candidate;
+        phase = next;
+        armDeadline();
+    }
+    function armDeadline() {
+        clearTimeout(timer);
+        timer = setTimeout(() => {
+            // Node clamps oversized delays to 1ms. Keep long valid policies bounded
+            // by scheduling slices, and tolerate a timer waking before its deadline.
+            if (clock() < deadline) {
+                armDeadline();
+                return;
+            }
+            const error = new CliError(`Build ${buildId} exceeded the CLI ${phase === BUILD_WAIT_PHASE.QUEUED ? 'queue' : 'execution'} wait deadline`, {
+                code: phase === BUILD_WAIT_PHASE.QUEUED ? BUILD_WAIT_ERROR.QUEUE : BUILD_WAIT_ERROR.EXECUTION, exitCode: ExitCode.ERROR,
+                explanation: `The CLI stopped waiting for build ${buildId}; it has not cancelled the remote build. Check this build before retrying.`,
+                fix: `Inspect its logs: inquir apps logs ${buildId}`,
+            });
+            expire(error);
+            controller.abort(error);
+        }, Math.min(MAX_TIMER_DELAY_MS, Math.max(0, deadline - clock())));
+    }
+    async function statusRequest() {
+        controller.signal.throwIfAborted();
+        const request = new AbortController();
+        const onAbort = () => request.abort(controller.signal.reason);
+        controller.signal.addEventListener('abort', onAbort, { once: true });
+        let requestTimer;
+        const timedOut = new Promise((_, reject) => {
+            requestTimer = setTimeout(() => {
+                const error = new CliError('Build status request timed out', { code: BUILD_WAIT_ERROR.STATUS_REQUEST, exitCode: ExitCode.NETWORK });
+                reject(error);
+                request.abort(error);
+            }, Math.min(BUILD_STATUS_REQUEST_TIMEOUT_MS, Math.max(0, deadline - clock())));
+        });
+        try {
+            return await Promise.race([getBuild(buildId, apiOptions, request.signal), timedOut]);
+        }
+        finally {
+            clearTimeout(requestTimer);
+            controller.signal.removeEventListener('abort', onAbort);
+            request.abort();
+        }
     }
-    // Follow the build log to the terminal event; the SSE stream ends on completion.
-    for await (const event of streamBuildLogs(queued.buildId, apiOptions)) {
-        if (event.type === 'log' && event.line) {
-            if (json)
-                process.stderr.write(`${redact(event.line)}\n`);
-            else
-                printLine(dim(`  ${event.line}`));
+    async function poll() {
+        for (;;) {
+            controller.signal.throwIfAborted();
+            try {
+                const build = await statusRequest();
+                controller.signal.throwIfAborted();
+                if (isTerminalBuildStatus(build.status))
+                    return build;
+                observe(build);
+            }
+            catch (error) {
+                controller.signal.throwIfAborted();
+                const retryable = error instanceof ApiError ? error.status === HTTP_TOO_MANY_REQUESTS || error.status >= HTTP_SERVER_ERROR_MIN : toCliError(error).exitCode === ExitCode.NETWORK;
+                if (!retryable)
+                    throw error;
+                await buildWaitSleep(BUILD_STATUS_RETRY_BACKOFF_MS, controller.signal);
+            }
+            await buildWaitSleep(BUILD_STATUS_POLL_INTERVAL_MS, controller.signal);
         }
-        else if (event.type === 'complete') {
-            break;
+    }
+    async function consumeLogs() {
+        if (options.noLogs)
+            return;
+        try {
+            for await (const event of streamBuildLogs(buildId, apiOptions, controller.signal)) {
+                if (controller.signal.aborted)
+                    break;
+                if (event.type === 'log' && event.line) {
+                    if (options.json)
+                        process.stderr.write(`${redact(event.line)}\n`);
+                    else
+                        printLine(dim(`  ${event.line}`));
+                }
+                else if (event.type === 'complete' || event.type === 'error')
+                    break;
+            }
         }
-        else if (event.type === 'error') {
-            printLine(dim(`— ${event.message ?? 'stream error'} —`));
-            break;
+        catch {
+            // Logs are best effort. Only the build row decides the result.
         }
     }
-    return waitForBuild(queued.buildId, apiOptions);
-}
-async function waitForBuild(buildId, apiOptions, timeoutMs = 20 * 60_000) {
-    const deadline = Date.now() + timeoutMs;
-    for (;;) {
-        const build = await getBuild(buildId, apiOptions);
-        if (isTerminalBuildStatus(build.status))
-            return build;
-        if (Date.now() > deadline) {
-            throw new CliError(`Build ${buildId} did not finish within ${Math.round(timeoutMs / 1000)}s`, {
-                code: 'BUILD_TIMEOUT',
-                exitCode: ExitCode.ERROR,
-                fix: `Check its logs: inquir apps logs ${buildId}`,
-            });
+    observe(options.initial ?? { status: BUILD_WAIT_PHASE.QUEUED });
+    const logs = consumeLogs();
+    try {
+        const result = await Promise.race([poll(), expired]);
+        let drainTimer;
+        try {
+            await Promise.race([logs, new Promise((resolve) => {
+                    drainTimer = setTimeout(resolve, Math.max(0, Math.min(BUILD_LOG_DRAIN_TIMEOUT_MS, deadline - clock())));
+                })]);
         }
-        await new Promise((resolve) => setTimeout(resolve, 1000));
+        finally {
+            clearTimeout(drainTimer);
+        }
+        return result;
+    }
+    finally {
+        clearTimeout(timer);
+        controller.abort();
     }
 }
+/**
+ * A release only the allocation plane serves (volumes pinned to a worker) stays
+ * STARTING while that runner refuses its starts, and the plane retries them
+ * forever with backoff. After this many failed attempts the wait reports the
+ * reason instead of sitting out its whole timeout.
+ */
+const FAILED_STARTS_BEFORE_REPORTING = 3;
 /** Poll until the release settles; the platform decides when it is healthy. */
 async function waitForRelease(releaseId, apiOptions, timeoutMs = 10 * 60_000) {
     const deadline = Date.now() + timeoutMs;
     const startedAt = Date.now();
-    let lastStatus = '';
+    let lastProgress = '';
     const json = readJsonFlag(process.argv);
     for (;;) {
         const release = await getRelease(releaseId, apiOptions);
-        if (release.status !== lastStatus) {
-            lastStatus = release.status;
+        // A failed start on the pinned runner changes the reason, not the status.
+        const reason = release.serving ? release.failureReason ?? '' : '';
+        if (`${release.status}\n${reason}` !== lastProgress) {
+            lastProgress = `${release.status}\n${reason}`;
             // Say what is happening in words, with elapsed time — a two-minute health
             // gate in silence reads as a hang. Under --json only stdout must stay
             // parseable; progress goes to stderr.
             const shown = presentRelease(release);
-            const line = `— ${shown.label} (${formatElapsed(Date.now() - startedAt)})${shown.meaning ? `: ${shown.meaning}` : ''} —`;
-            if (json)
-                process.stderr.write(`${line}\n`);
-            else
-                printInfo(dim(line));
+            const lines = [
+                `— ${shown.label} (${formatElapsed(Date.now() - startedAt)})${shown.meaning ? `: ${shown.meaning}` : ''} —`,
+                ...(reason ? [`  ${reason}`] : []),
+            ];
+            for (const line of lines) {
+                if (json)
+                    process.stderr.write(`${line}\n`);
+                else
+                    printInfo(dim(line));
+            }
         }
         if (isSettledReleaseStatus(release.status))
             return release;
+        if ((release.serving?.failedStarts ?? 0) >= FAILED_STARTS_BEFORE_REPORTING)
+            return release;
         if (Date.now() > deadline) {
             throw new CliError(`Release ${releaseId} did not settle within ${Math.round(timeoutMs / 1000)}s`, {
                 code: 'RELEASE_TIMEOUT',
@@ -393,8 +1379,8 @@ async function waitForRelease(releaseId, apiOptions, timeoutMs = 10 * 60_000) {
 }
 function renderRelease(release, previewUrl) {
     const shown = presentRelease(release);
-    if (release.status === 'FAILED') {
-        printLine(`✗ Release ${release.id.slice(0, 8)} failed: ${release.failureReason ?? 'unknown reason'}`);
+    if (!isHealthyRelease(release)) {
+        printError(`Release ${release.id.slice(0, 8)} is ${shown.label}${release.failureReason ? `: ${release.failureReason}` : ''}`);
         if (shown.hint)
             printInfo(dim(`  ${shown.hint}`));
         printInfo(dim(`  logs: inquir apps logs ${release.id}`));
@@ -443,6 +1429,57 @@ export function releaseEndpointLines(release, previewUrl, options = {}) {
     }
     return lines;
 }
+/**
+ * Where same-workspace services reach this application. The server projects
+ * `privateDomain` only once the private route is verified end to end, so a
+ * missing domain on an installation with private networking means "still
+ * being reconciled", not "no such thing" — and that is worth a line too.
+ */
+export function privateEndpointLines(detail, active, options = {}) {
+    if (!detail.privateDomain) {
+        return options.privateNetworking
+            ? ['(provisioning — private DNS and routing are being verified)']
+            : [];
+    }
+    const lines = [];
+    if (detail.privateBaseUrl)
+        lines.push(detail.privateBaseUrl);
+    // The private proxy listens on a TCP port's container port. A container the
+    // control plane started reports its ports on the release; a release the
+    // allocation plane serves on a worker reports none (its endpoints live on
+    // its allocations), so its declared TCP ports stand in.
+    const reported = (active?.ports ?? []).filter((port) => port.protocol === 'tcp' && port.containerPort);
+    const tcpPorts = reported.length > 0
+        ? reported.map((port) => ({ name: port.name, port: port.containerPort }))
+        : (active?.runtime?.ports ?? []).filter((port) => port.protocol === 'tcp');
+    for (const port of tcpPorts) {
+        lines.push(`${detail.privateDomain}:${port.port}  (${port.name})`);
+    }
+    return lines;
+}
+/**
+ * The networkPolicy patch for `--egress` / `--ingress`. The API requires
+ * egress inside networkPolicy, so a lone --ingress change carries the
+ * application's current egress along unchanged, and vice versa; with neither
+ * flag the policy is left alone (the server's defaults apply on create).
+ */
+export function buildNetworkPolicyPatch(input) {
+    const { egress, ingress, current } = input;
+    if (egress && egress !== 'none' && egress !== 'full') {
+        throw usageError(`Invalid --egress '${egress}'`, 'inquir apps update <app> --egress none');
+    }
+    if (ingress && ingress !== 'private' && ingress !== 'public') {
+        throw usageError(`Invalid --ingress '${ingress}'`, 'inquir apps update <app> --ingress public');
+    }
+    if (!egress && !ingress)
+        return undefined;
+    const resolvedIngress = (ingress ?? current?.ingress);
+    return {
+        egress: (egress ?? current?.egress ?? 'full'),
+        allow: [],
+        ...(resolvedIngress ? { ingress: resolvedIngress } : {}),
+    };
+}
 /** A build-sourced release is best named by its build; a pulled one by its ref. */
 export function describeImage(release) {
     if (release.imageSource === 'build' && release.buildId)
@@ -462,18 +1499,74 @@ function describeRuntimePorts(spec) {
     }
     return parts.join(' ');
 }
+function formatDurationSeconds(seconds) {
+    const units = [
+        [86_400, 'd'],
+        [3600, 'h'],
+        [60, 'm'],
+        [1, 's'],
+    ];
+    let remaining = seconds;
+    const parts = [];
+    for (const [size, suffix] of units) {
+        const count = Math.floor(remaining / size);
+        if (count > 0 || (size === 1 && parts.length === 0)) {
+            parts.push(`${count}${suffix}`);
+            remaining -= count * size;
+        }
+    }
+    return parts.join(' ');
+}
+export function describeScalingPolicy(policy) {
+    const range = `${policy.minReplicas}–${policy.maxReplicas} replicas`;
+    if (policy.activation === 'http') {
+        return `http (sleep after ${formatDurationSeconds(policy.idleTimeoutSeconds)} idle), ${range}`;
+    }
+    return `${policy.activation}, ${range}`;
+}
 async function statusSubcommand(args, positionals, apiOptions) {
     const [identifier] = positionals;
     if (!identifier)
         throw usageError('Missing application', 'inquir apps status <app>');
     await requireAuth(apiOptions);
     const app = await resolveApplication(identifier, apiOptions);
-    const detail = await getApplication(app.id, apiOptions);
-    if (readJsonFlag(args)) {
+    const json = readJsonFlag(args);
+    // The apps suffix lives on the platform limits, never on the application, so
+    // the permanent address needs both. Fetched alongside the detail and only
+    // for the human output; losing it costs the address line, nothing else.
+    const [detail, limits] = await Promise.all([
+        getApplication(app.id, apiOptions),
+        json ? Promise.resolve(null) : getAppLimits(apiOptions).catch(() => null),
+    ]);
+    if (json) {
         printLine(JSON.stringify(detail, null, 2));
         return;
     }
     printLine(`${detail.name}${detail.description ? dim(` — ${detail.description}`) : ''}`);
+    if (detail.scaling)
+        printLine(`  scaling:    ${describeScalingPolicy(detail.scaling)}`);
+    if (detail.desiredReplicas !== undefined) {
+        const cap = detail.scaling ? ` (maximum ${detail.scaling.maxReplicas})` : '';
+        printLine(`  replicas:   ${detail.desiredReplicas} desired${cap}`);
+    }
+    const pinnedRunner = detail.volumeRunnerId;
+    if (pinnedRunner)
+        printLine(`  volume pin: runner ${pinnedRunner}`);
+    const servingRelease = detail.releases.find((r) => r.id === detail.production?.activeReleaseId);
+    if (servingRelease?.serving && servingRelease.serving.ready < servingRelease.serving.desired) {
+        // Production points at it, but its replica does not answer on the runner yet.
+        printLine(`  serving:    not yet — ${servingRelease.failureReason ?? 'its replica is starting on the pinned runner'}`);
+    }
+    if (detail.lastActivityAt)
+        printLine(`  activity:   ${detail.lastActivityAt}`);
+    if (detail.lastScaledAt)
+        printLine(`  last scale: ${detail.lastScaledAt}`);
+    // Where this app answers forever, as opposed to where it answers now: the
+    // production lines below follow the routes, this one is the identity a
+    // custom domain should CNAME to.
+    const address = permanentAddress(detail.slug, limits?.appsPublicSuffix);
+    if (address)
+        printLine(`  address:    ${address} ${dim('(permanent — a rename never moves it)')}`);
     for (const url of detail.production?.urls ?? [])
         printLine(`  production: ${url}`);
     if (detail.production && (detail.production.urls ?? []).length === 0) {
@@ -486,6 +1579,29 @@ async function statusSubcommand(args, positionals, apiOptions) {
     const endpoints = active ? releaseEndpointLines(active, undefined, { includeHostLocal: !hasProductionUrl }) : [];
     for (const endpoint of endpoints)
         printLine(`  endpoint:   ${endpoint}`);
+    // The private address is what another app in the workspace dials; it is
+    // shown only once the platform has verified the route, never guessed.
+    const privateLines = privateEndpointLines(detail, active, {
+        privateNetworking: limits?.features?.privateNetworking,
+    });
+    for (const line of privateLines)
+        printLine(`  private:    ${line}`);
+    // The serving release's frozen runtime is the truth about what is mounted
+    // NOW. An app-level volume added after the deploy applies only to the next
+    // release — showing it as mounted would tell the operator their database is
+    // persistent when it is not.
+    const mountedVolumes = active ? (active.runtime?.volumes ?? []) : (detail.runtime?.volumes ?? []);
+    for (const volume of mountedVolumes) {
+        printLine(`  volume:     ${volume.name} → ${volume.mountPath}${volume.readOnly ? ' (read-only)' : ''}`);
+    }
+    if (active) {
+        const mountedNames = new Set(mountedVolumes.map((volume) => volume.name));
+        for (const volume of detail.runtime?.volumes ?? []) {
+            if (!mountedNames.has(volume.name)) {
+                printLine(`  volume:     ${volume.name} → ${volume.mountPath} ${dim('(next release — not mounted yet)')}`);
+            }
+        }
+    }
     for (const domain of detail.domains ?? []) {
         if (domain.custom && !domain.verified) {
             printLine(`  domain:     ${domain.hostname} ${dim('(unverified — inquir apps domain ' + detail.name + ' ' + domain.hostname + ' --verify)')}`);
@@ -644,6 +1760,12 @@ async function promoteSubcommand(args, positionals, apiOptions) {
             err.message = humanizeApiError(err.message);
         throw err;
     }
+    // 202: the server runs it as a rolling rollout and goes on in the
+    // background. An older server always answers with the outcome below.
+    if (isPromoteAccepted(result)) {
+        await followPromoteRollout(releaseId, result, { json, wait: !hasFlag(args, '--no-wait') }, apiOptions);
+        return;
+    }
     if (json) {
         printLine(JSON.stringify(result, null, 2));
         return;
@@ -737,6 +1859,59 @@ async function buildsSubcommand(args, positionals, apiOptions) {
         created: b.createdAt,
     })), ['build', 'status', 'dockerfile', 'image', 'cached', 'created']));
 }
+/** `apps scale <app> [always|http|manual]` — update only the scaling policy. */
+async function scaleSubcommand(args, positionals, apiOptions) {
+    const [identifier, positionalActivation, ...extra] = positionals;
+    if (!identifier) {
+        throw usageError('Missing application', 'inquir apps scale <app> <always|http|manual>');
+    }
+    if (extra.length > 0) {
+        throw usageError(`Unexpected argument '${extra[0]}'`, 'inquir apps scale <app> <always|http|manual>');
+    }
+    const scaling = buildScalingPatchFromFlags(args, positionalActivation);
+    if (Object.keys(scaling).length === 0) {
+        throw usageError('Nothing to scale', 'inquir apps scale <app> <always|http|manual> [--idle-timeout 15m]');
+    }
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const updated = await updateApplication(app.id, { scaling }, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(updated, null, 2));
+        return;
+    }
+    printSuccess(`Updated scaling for ${updated.name}`);
+    printInfo(dim(`  ${describeScalingPolicy(updated.scaling)}`));
+    printInfo(dim(`  desired replicas: ${updated.desiredReplicas}`));
+}
+async function runScaleActionSubcommand(action, args, positionals, apiOptions) {
+    const [identifier, ...extra] = positionals;
+    if (!identifier)
+        throw usageError('Missing application', `inquir apps ${action} <app>`);
+    if (extra.length > 0) {
+        throw usageError(`Unexpected argument '${extra[0]}'`, `inquir apps ${action} <app>`);
+    }
+    await requireAuth(apiOptions);
+    const app = await resolveApplication(identifier, apiOptions);
+    const result = action === 'wake'
+        ? await wakeApplication(app.id, apiOptions)
+        : await pauseApplication(app.id, apiOptions);
+    if (readJsonFlag(args)) {
+        printLine(JSON.stringify(result, null, 2));
+        return;
+    }
+    const verb = action === 'wake' ? 'Wake' : 'Pause';
+    if (result.accepted)
+        printSuccess(`${verb} requested for ${app.name}`);
+    else
+        printInfo(`${verb} was not accepted for ${app.name}`);
+    printInfo(dim(`  desired replicas: ${result.desiredReplicas}${result.state ? ` (${result.state})` : ''}`));
+}
+async function wakeSubcommand(args, positionals, apiOptions) {
+    return runScaleActionSubcommand('wake', args, positionals, apiOptions);
+}
+async function pauseSubcommand(args, positionals, apiOptions) {
+    return runScaleActionSubcommand('pause', args, positionals, apiOptions);
+}
 /** `apps update <app>` — env vars, ports, resources, health, egress. */
 async function updateSubcommand(args, positionals, apiOptions) {
     const [identifier] = positionals;
@@ -745,19 +1920,22 @@ async function updateSubcommand(args, positionals, apiOptions) {
     await requireAuth(apiOptions);
     const app = await resolveApplication(identifier, apiOptions);
     const envVars = parseSetFlags(readMultiFlag(args, '--set'));
-    const runtimeSpec = buildRuntimeFromFlags(args);
-    const egress = readFlagValue(args, '--egress');
+    const runtimeSpec = buildRuntimeFromFlags(args, app.runtime);
     const description = readFlagValue(args, '--description');
-    if (egress && egress !== 'none' && egress !== 'full') {
-        throw usageError(`Invalid --egress '${egress}'`, 'inquir apps update <app> --egress none');
-    }
+    const networkPolicy = buildNetworkPolicyPatch({
+        egress: readFlagValue(args, '--egress'),
+        ingress: readFlagValue(args, '--ingress'),
+        current: app.networkPolicy,
+    });
+    const volumeRunner = readFlagValue(args, '--volume-runner');
     const patch = {
         ...(description !== undefined ? { description } : {}),
+        ...(volumeRunner ? { volumeRunner } : {}),
         ...(runtimeSpec ? { runtime: runtimeSpec } : {}),
         // Only the keys given here change; the server merges masked values, so
         // untouched secrets survive.
         ...(Object.keys(envVars).length > 0 ? { envVars: { ...(app.envVars ?? {}), ...envVars } } : {}),
-        ...(egress ? { networkPolicy: { egress: egress, allow: [] } } : {}),
+        ...(networkPolicy ? { networkPolicy } : {}),
     };
     if (Object.keys(patch).length === 0) {
         throw usageError('Nothing to update', 'inquir apps update <app> --set KEY=VALUE');
@@ -773,16 +1951,19 @@ async function updateSubcommand(args, positionals, apiOptions) {
 async function execSubcommand(args, positionals, apiOptions) {
     const [identifier, ...commandParts] = positionals;
     if (!identifier)
-        throw usageError('Missing release', 'inquir apps exec <app> -- <command>');
+        throw usageError('Missing application', 'inquir apps exec <app> -- <command>');
     const command = commandParts.join(' ').trim();
     if (!command)
         throw usageError('Missing command', 'inquir apps exec <app> -- ls -la');
     await requireAuth(apiOptions);
-    const releaseId = await resolveReleaseId(identifier, apiOptions);
+    // `apps exec` is intentionally application-scoped. Accepting a stale or
+    // preview release id here and then calling the production-only app endpoint
+    // would silently change the operator's target to production.
+    const application = await resolveApplication(identifier, apiOptions);
     const timeoutRaw = readFlagValue(args, '--timeout');
     let result;
     try {
-        result = await execInRelease(releaseId, command, timeoutRaw ? Number(timeoutRaw) : undefined, apiOptions);
+        result = await execInApplication(application.id, command, timeoutRaw ? Number(timeoutRaw) : undefined, apiOptions);
     }
     catch (err) {
         if (err instanceof Error)
@@ -807,14 +1988,27 @@ function printVerificationInstructions(domain) {
     const v = domain.verification;
     if (!v)
         return;
-    printInfo(dim('  prove ownership, then verify:'));
-    printLine(`    TXT   ${v.txtName}  →  ${v.txtValue}`);
-    for (const target of v.cnameTargets)
-        printLine(`    CNAME ${domain.hostname}  →  ${target}`);
+    // A verified hostname keeps its records on display: they are what gets compared with the
+    // registrar when the name stops resolving.
+    printInfo(dim(domain.verified
+        ? `  ${domain.hostname} — verified with these records (the routing record must stay in place):`
+        : `  ${domain.hostname} — prove ownership, then verify:`));
+    const row = (label, name, value) => printLine(`    ${label.padEnd(8)} ${name}  →  ${value}`);
+    row('TXT', v.txtName, v.txtValue);
+    // One target, not a menu: every entry is accepted by verify and leads to the same ingress. The first is the
+    // app's own hostname when an apps suffix is configured, otherwise the platform target.
+    if (v.cnameTargets[0])
+        row('CNAME', domain.hostname, v.cnameTargets[0]);
     for (const ip of v.ingressIps)
-        printLine(`    A     ${domain.hostname}  →  ${ip}`);
+        row('A', domain.hostname, ip);
     if (v.ingressAliasTarget)
-        printLine(`    ALIAS ${domain.hostname}  →  ${v.ingressAliasTarget}`);
+        row('ALIAS', domain.hostname, v.ingressAliasTarget);
+    if (v.apexCnameTargets?.length) {
+        printInfo(dim(domain.verified
+            ? '  verified by the TXT record alone — where the apex points was never checked; traffic reaches the app only through ALIAS/ANAME/CNAME flattening onto:'
+            : '  an apex domain is verified by the TXT record alone; point it with ALIAS/ANAME/CNAME flattening so traffic reaches the app:'));
+        row('ALIAS', domain.hostname, v.apexCnameTargets[0]);
+    }
 }
 /**
  * `apps domain <app> [hostname] [--verify|--remove]` — bind a custom hostname
@@ -845,8 +2039,7 @@ async function domainSubcommand(args, positionals, apiOptions) {
             verified: d.verified ? 'yes' : 'no',
         })), ['hostname', 'kind', 'source', 'verified']));
         for (const d of items)
-            if (!d.verified)
-                printVerificationInstructions(d);
+            printVerificationInstructions(d);
         return;
     }
     if (hasFlag(args, '--remove')) {
@@ -871,6 +2064,14 @@ async function domainSubcommand(args, positionals, apiOptions) {
         printLine(JSON.stringify(domain, null, 2));
         return;
     }
+    if (domain.verified) {
+        // An operator-granted platform hostname verifies on bind: no records to publish.
+        printSuccess(`${domain.hostname} bound to ${app.name} and verified — it now serves ${app.name}`);
+        if (!domain.activeReleaseId) {
+            printInfo(dim('  no release is promoted yet: inquir apps promote <release>'));
+        }
+        return;
+    }
     printSuccess(`${domain.hostname} bound to ${app.name} (unverified)`);
     printVerificationInstructions(domain);
     printInfo(dim(`  then: inquir apps domain ${app.name} ${domain.hostname} --verify`));
@@ -889,6 +2090,9 @@ async function deleteSubcommand(args, positionals, apiOptions) {
         });
     }
     await archiveApplication(app.id, apiOptions);
+    if (readJsonFlag(args)) {
+        return printLine(JSON.stringify({ ok: true, archived: { id: app.id, name: app.name } }, null, 2));
+    }
     printSuccess(`Archived ${app.name}`);
     printInfo(dim('  every release was stopped and every hostname unbound'));
 }