@maxceem/agw 0.1.8 → 0.1.10

package/dist/agw.mjs

@@ -6,10 +6,10 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.1.8", wrangler: "4.96.0", upgradeFrom: ["0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.1.8/gateway-0.1.8.tar.gz", sha256: "a4123a9186809038e7613f80d299637075eee47016b7aa309fd82f3a6a978ee9", manifest: "f6b6451ba84b7409c5f1e239e57319aa2e92bb54739bb07f27171d652c68b326" } };
+var define_AGW_MANIFEST_default = { version: "0.1.10", wrangler: "4.96.0", upgradeFrom: ["0.1.10", "0.1.9", "0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.1.10/gateway-0.1.10.tar.gz", sha256: "39a8b65f05d666e323a08db70c90e345dd3eec698cbf7491b288dd5b9f864efa", manifest: "5f58bcdb8dee3dd4ca72f6da3a52ca086f2f7529cd39bd0e331a72779b8fd506" } };
 
 // src/main.ts
-import { Writable } from "node:stream";
+import { Writable as Writable2 } from "node:stream";
 
 // ../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -15018,7 +15018,7 @@ var ErrorResponseSchema = external_exports.object({
     code: external_exports.string(),
     message: external_exports.string(),
     data: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).optional().meta({
-      description: "Machine-readable facts about this rejection, present only where the code alone is not actionable. A billing_request_quota_exceeded rejection carries periodId, periodStart, periodEnd, limit, used, and resetAt; an app_rate_limited or app_budget_exhausted rejection carries scope, either user or app."
+      description: "Machine-readable facts about this rejection, present only where the code alone is not actionable. A billing_request_quota_exceeded rejection carries periodId, periodStart, periodEnd, limit, used, and resetAt; a billing_plan_limit_reached rejection carries limit and used; an app_rate_limited or app_budget_exhausted rejection carries scope, either user or app; a rate_limited rejection carries scope naming the endpoint policy that refused, plus limit, windowSeconds, retryAfterSeconds and resetAt."
     })
   })
 }).meta({ id: "ErrorResponse" });
@@ -15751,12 +15751,27 @@ var CliErrorDetailsSchema = external_exports.object({
   providerGatewayId: external_exports.string().optional(),
   revoked: external_exports.boolean().optional(),
   storagePath: external_exports.string().optional(),
+  /** Which ceiling refused the request, for the codes that name one. */
+  scope: external_exports.string().optional(),
+  limit: external_exports.number().optional(),
+  used: external_exports.number().optional(),
+  windowSeconds: external_exports.number().optional(),
+  retryAfterSeconds: external_exports.number().optional(),
+  resetAt: external_exports.string().optional(),
   id: external_exports.string().optional(),
   state: external_exports.string().optional(),
   expiresAt: external_exports.string().optional(),
   url: external_exports.string().optional(),
   /** The tail of a failed subprocess's own output, for failures it explains. */
-  output: external_exports.string().optional()
+  output: external_exports.string().optional(),
+  /**
+   * What Cloudflare itself said about a refused API call: each error's message
+   * and its code. Carried because the things that refuse a deployment — an
+   * account ceiling, a permission a token lacks — are named only there, and
+   * wrangler reports an API refusal it aggregates as the bare sentence that a
+   * request failed.
+   */
+  apiErrors: external_exports.string().optional()
 });
 
 // src/apps.ts
@@ -16035,6 +16050,11 @@ function validate(schema, value) {
 // src/input.ts
 import { createInterface } from "node:readline/promises";
 import { stdin, stderr } from "node:process";
+var MASK_LIMIT = 64;
+function maskDelta(shown, length) {
+  const target = Math.min(length, MASK_LIMIT);
+  return target > shown ? "*".repeat(target - shown) : "\b \b".repeat(shown - target);
+}
 async function prompt(label, flags, { hidden = false, defaultValue } = {}) {
   if (flags["no-input"] || !stdin.isTTY || !stderr.isTTY)
     fail(
@@ -16058,6 +16078,12 @@ async function prompt(label, flags, { hidden = false, defaultValue } = {}) {
   stdin.resume();
   return new Promise((resolve3, reject2) => {
     let value = "";
+    let shown = 0;
+    function mask() {
+      const delta = maskDelta(shown, value.length);
+      if (delta) stderr.write(delta);
+      shown = Math.min(value.length, MASK_LIMIT);
+    }
     function done(error51) {
       stdin.off("data", onData);
       stdin.setRawMode(wasRaw);
@@ -16078,9 +16104,13 @@ async function prompt(label, flags, { hidden = false, defaultValue } = {}) {
         }
         if (char === "\x7F" || char === "\b") {
           value = value.slice(0, -1);
+          mask();
           continue;
         }
-        if (char >= " ") value += char;
+        if (char >= " ") {
+          value += char;
+          mask();
+        }
         if (value.length > 16384) {
           done(new Error("input too long"));
           return;
@@ -16223,7 +16253,10 @@ function parse3(argv) {
     if (!match || !types[match[1]])
       fail(
         "unknown_flag",
-        `Unknown flag ${token.split("=")[0]} for ${command}.`
+        `Unknown flag ${token.split("=")[0]} for ${command}.`,
+        // Resources are addressed positionally throughout, so the one mistake
+        // worth answering with more than the help text is naming one as a flag.
+        spec.args && ["id", "app", "app-id"].includes(match?.[1] ?? "") ? `Pass the identifier as an argument: agw ${command}${" <id>".repeat(spec.args)}.` : void 0
       );
     const name = match[1];
     const inline = match[2];
@@ -16240,9 +16273,9 @@ function parse3(argv) {
         fail("missing_value", `--${name} requires a value.`);
       if (type === "multiple") {
         const existing = collected[name];
-        const list = Array.isArray(existing) ? existing : [];
-        list.push(value);
-        collected[name] = list;
+        const list2 = Array.isArray(existing) ? existing : [];
+        list2.push(value);
+        collected[name] = list2;
       } else collected[name] = value;
     }
   }
@@ -16935,14 +16968,137 @@ var StateStore = class {
   }
 };
 
+// ../src/shared/first-request.ts
+var PROVIDER_PLACEHOLDER = "PROVIDER_SLUG";
+var MODEL_PLACEHOLDER = "MODEL";
+var BODY_PLACEHOLDER = "REQUEST_BODY";
+var EXAMPLE_GAP_NOTES = {
+  provider: `No provider is configured yet, so ${PROVIDER_PLACEHOLDER} stands in for one. Add a provider key, then use its slug.`,
+  model: `No priced model was found for this provider, so ${MODEL_PLACEHOLDER} stands in for one. Use a model the provider serves.`,
+  body: `This app allows no path whose request shape is known here, so ${BODY_PLACEHOLDER} stands in for the body the provider documents.`
+};
+function examplePath(type, { gatewayRouted = false, model } = {}) {
+  if (type === "openai") return "v1/responses";
+  if (type === "anthropic") return "v1/messages";
+  if (type === "gemini")
+    return model ? `v1beta/models/${model}:generateContent` : void 0;
+  if (gatewayRouted) return "v1/chat/completions";
+  if (type === "groq") return "openai/v1/chat/completions";
+  if (type === "fireworks") return "inference/v1/chat/completions";
+  if (["deepseek", "perplexity", "bytedance"].includes(type)) return "chat/completions";
+  return "v1/chat/completions";
+}
+function bodyFor(path, model) {
+  const messages = [{ role: "user", content: "Say hello." }];
+  if (path.endsWith("responses")) return { model, input: "Say hello." };
+  if (path.endsWith("chat/completions")) return { model, messages };
+  if (path.endsWith("messages")) return { model, max_tokens: 128, messages };
+  if (path.endsWith(":generateContent"))
+    return { contents: [{ parts: [{ text: "Say hello." }] }] };
+  return null;
+}
+function modelsFor(provider, policy2, prices) {
+  if (policy2?.allowed_models?.length) return policy2.allowed_models;
+  return [
+    ...Object.keys(provider.pricing ?? {}),
+    ...Object.entries(prices[provider.type] ?? {}).filter(([, price]) => price.output !== void 0).map(([model]) => model)
+  ];
+}
+function firstRequest(routing, providers, prices) {
+  let fallback;
+  for (const provider of providers) {
+    if (provider.status !== "active") continue;
+    const policy2 = routing?.providers?.[provider.slug];
+    if (routing?.providerMode === "selected" && !policy2) continue;
+    const models = modelsFor(provider, policy2, prices);
+    const model = models[0] ?? MODEL_PLACEHOLDER;
+    const gaps = models.length ? [] : ["model"];
+    const fallbackPath = examplePath(provider.type, {
+      gatewayRouted: Boolean(provider.providerGatewayId),
+      model
+    });
+    const paths = policy2?.allowed_paths?.length ? policy2.allowed_paths : fallbackPath ? [fallbackPath] : [];
+    for (const entry of paths) {
+      const path = typeof entry === "string" ? entry : entry.path;
+      if (path.includes("*")) continue;
+      const fixed = typeof entry !== "string" ? entry.fixed_model : void 0;
+      const body = bodyFor(path, fixed ?? model);
+      const example = {
+        target: { provider: provider.slug, path },
+        body,
+        anthropic: path.endsWith("messages"),
+        // A fixed model is the app's own, so a catalog that has none of its
+        // own to offer is not a gap on a path that never carries one.
+        gaps: body && fixed ? [] : gaps
+      };
+      if (body) return example;
+      fallback ??= { ...example, gaps: [...example.gaps, "body"] };
+    }
+  }
+  return fallback ?? {
+    target: { provider: PROVIDER_PLACEHOLDER, path: "v1/chat/completions" },
+    body: bodyFor("v1/chat/completions", MODEL_PLACEHOLDER),
+    anthropic: false,
+    gaps: ["provider", "model"]
+  };
+}
+function exampleNotes(example) {
+  return example.gaps.map((gap) => EXAMPLE_GAP_NOTES[gap]);
+}
+function exampleUrl(baseUrl, appId, target) {
+  const origin2 = baseUrl.replace(/\/+$/, "");
+  const app2 = `${origin2}/v1/apps/${encodeURIComponent(appId)}`;
+  return "endpoint" in target ? `${app2}/endpoints/${encodeURIComponent(target.endpoint)}` : `${app2}/proxy/${encodeURIComponent(target.provider)}/${target.path}`;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function commented(notes2, marker) {
+  return (notes2 ?? []).map((note) => `${marker} ${note}
+`).join("");
+}
+function curlSnippet(options) {
+  const { baseUrl, appId, example, notes: notes2, keyExpression = "$APP_AI_GATEWAY_KEY" } = options;
+  const body = example.body ? JSON.stringify(example.body) : BODY_PLACEHOLDER;
+  return commented(notes2, "#") + `curl --fail-with-body ${shellQuote(exampleUrl(baseUrl, appId, example.target))} \\
+  -H "Authorization: Bearer ${keyExpression}" \\
+  -H 'Content-Type: application/json' \\
+` + (example.anthropic ? "  -H 'anthropic-version: 2023-06-01' \\\n" : "") + `  -d ${shellQuote(body)}
+`;
+}
+function swiftSnippet(options) {
+  const { baseUrl, appId, example, notes: notes2, authMode = ".appAttestInstall" } = options;
+  const target = "endpoint" in example.target ? `endpointSlug: ${JSON.stringify(example.target.endpoint)}` : `provider: ${JSON.stringify(example.target.provider)},
+    providerPath: ${JSON.stringify(example.target.path)}`;
+  const body = example.body ? `request.httpBody = Data(${JSON.stringify(JSON.stringify(example.body))}.utf8)` : `// Supply the provider-native JSON body.
+request.httpBody = Data(${JSON.stringify(BODY_PLACEHOLDER)}.utf8)`;
+  return commented(notes2, "//") + `import Foundation
+import AppAIGateway
+
+let gateway = AppAIGatewayClient(
+    appID: ${JSON.stringify(appId)},
+    baseURL: URL(string: ${JSON.stringify(baseUrl.replace(/\/+$/, ""))})!,
+    authMode: ${authMode}
+)
+
+var request = try await gateway.authorizedRequest(
+    ${target}
+)
+request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+${example.anthropic ? 'request.setValue("2023-06-01", forHTTPHeaderField: "anthropic-version")\n' : ""}${body}
+let (data, _) = try await URLSession.shared.data(for: request)
+print(String(decoding: data, as: UTF8.self))
+`;
+}
+
 // src/apps.ts
 var unlimited = () => ({
   requests: { per_minute: null, per_day: null },
   spending: { monthly_usd: null }
 });
 var policy = () => ({ allowed_paths: [], allowed_models: [] });
-function documentOf(app) {
-  return localApp({ name: app.name, config: app.config, status: app.status });
+function documentOf(app2) {
+  return localApp({ name: app2.name, config: app2.config, status: app2.status });
 }
 function localApp(value) {
   const doc = validate(AppWriteSchema, value);
@@ -17143,14 +17299,14 @@ async function appCommand(ctx, command, args, flags) {
       };
     const output = action === "add" && doc2.config.authentication.type === "api_key" ? await ctx.keyOutput(operations.createApp.path(), doc2, flags["key-output"]) : null;
     try {
-      let app;
+      let app2;
       let resolved;
       let configError;
       let key;
       if (action === "add") {
         await ctx.bootstrap();
         const created = await ctx.create("createApp", [], doc2);
-        ({ app, resolved, config_error: configError } = created.data);
+        ({ app: app2, resolved, config_error: configError } = created.data);
         if (output) {
           if (created.keyMetadata) key = created.keyMetadata;
           else {
@@ -17162,7 +17318,7 @@ async function appCommand(ctx, command, args, flags) {
                 "Inspect the app key list before retrying.",
                 3
               );
-            key = await saveKey(ctx, minted, output, app.id);
+            key = await saveKey(ctx, minted, output, app2.id);
           }
           await created.keyStored?.(key);
         }
@@ -17171,23 +17327,25 @@ async function appCommand(ctx, command, args, flags) {
         const updated = await ctx.call("updateApp", [appId2], {
           body: { ...doc2, revision }
         });
-        ({ app, resolved, config_error: configError } = updated.data);
+        ({ app: app2, resolved, config_error: configError } = updated.data);
       }
       let snippet;
-      if (doc2.config.authentication.type === "apple_app_attest") {
-        try {
-          const example = await appCommand(ctx, "app snippet", [app.id], {});
-          if ("snippet" in example) snippet = example.snippet;
-        } catch {
-        }
+      try {
+        const example = await appCommand(ctx, "app snippet", [app2.id], {});
+        if ("snippet" in example) snippet = example.snippet;
+      } catch {
       }
+      if (snippet && key)
+        snippet = `export APP_AI_GATEWAY_KEY="$(cat ${shellQuote(key.storagePath)})"
+
+${snippet}`;
       return {
         ...snippet ? { snippet } : {},
-        app,
+        app: app2,
         resolved,
         config_error: configError,
         ...key ? { applicationKey: key } : {},
-        guidance: doc2.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.0.0, enable App Attest, and test on a supported physical device. Run agw app snippet ${app.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : "Store the generated key on your server; never embed it in a mobile application."
+        guidance: doc2.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.0.0, enable App Attest, and test on a supported physical device. Run agw app snippet ${app2.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : `Store the generated key on your server; never embed it in a mobile application. Run agw app snippet ${app2.id} for this request again.`
       };
     } finally {
       await output?.cancel();
@@ -17196,8 +17354,8 @@ async function appCommand(ctx, command, args, flags) {
   if (action.startsWith("key ")) {
     const sub = action.slice(4);
     const appId2 = args[0] ?? "";
-    const { data: app } = await ctx.call("getApp", [appId2]);
-    if (documentOf(app.app).config.authentication.type !== "api_key")
+    const { data: app2 } = await ctx.call("getApp", [appId2]);
+    if (documentOf(app2.app).config.authentication.type !== "api_key")
       fail(
         "invalid_input",
         "Only server applications support application keys."
@@ -17274,62 +17432,75 @@ async function appCommand(ctx, command, args, flags) {
     };
   }
   if (action === "snippet") {
-    if (flags.language && flags.language !== "swift")
-      fail("invalid_input", "Only --language swift is supported.");
-    if (doc.config.authentication.type !== "apple_app_attest")
+    const ios = doc.config.authentication.type === "apple_app_attest";
+    const language = flags.language ?? (ios ? "swift" : "curl");
+    if (!["swift", "curl"].includes(language))
+      fail("invalid_input", "--language must be swift or curl.");
+    if (language === "swift" !== ios)
       fail(
         "unsupported_snippet",
-        "Swift snippets are for iOS applications.",
-        "Use your server HTTP client with the stored application key."
+        ios ? "iOS applications authenticate with App Attest, which curl cannot perform." : "Swift snippets are for iOS applications.",
+        `Run agw app snippet ${appId} --language ${ios ? "swift" : "curl"}.`
       );
-    let target;
+    const notes2 = [];
+    let example;
     if (flags.endpoint) {
-      if (!doc.config.endpoints?.[flags.endpoint])
+      const endpoint = doc.config.endpoints?.[flags.endpoint];
+      if (!endpoint)
         fail("endpoint_not_found", "Choose an existing named endpoint.");
-      target = `endpointSlug: ${JSON.stringify(flags.endpoint)}`;
+      const responses = endpoint.api_style === "responses";
+      example = {
+        target: { endpoint: flags.endpoint },
+        body: responses ? { input: "Say hello." } : null,
+        anthropic: false,
+        gaps: responses ? [] : ["body"]
+      };
     } else {
+      const routing = {
+        providerMode: doc.config.routing.providers.mode,
+        providers: doc.config.routing.providers.selected
+      };
       const { data: all } = await ctx.call("listProviders", []);
-      let providers = all.providers.filter(
-        (p2) => p2.status === "active" && (doc.config.routing.providers.mode === "all" || Object.hasOwn(doc.config.routing.providers.selected ?? {}, p2.slug))
+      const reachable = all.providers.filter(
+        (p) => p.status === "active" && (routing.providerMode === "all" || Object.hasOwn(routing.providers ?? {}, p.slug))
       );
       const requested = typeof flags.provider === "string" ? flags.provider : void 0;
-      if (requested) providers = providers.filter((p2) => p2.slug === requested);
-      const p = providers[0];
-      if (providers.length !== 1 || !p)
+      if (requested && !reachable.some((p) => p.slug === requested))
         fail(
-          "provider_required",
-          "Choose one available provider slug using --provider, or use --endpoint."
+          all.providers.some((p) => p.slug === requested) ? "provider_unavailable" : "provider_not_found",
+          all.providers.some((p) => p.slug === requested) ? "That provider is disabled or outside this app's proxy policy." : "No provider has that slug.",
+          "Run agw provider list for the slugs, and agw app show <id> for the policy."
         );
-      const { data: capabilities } = await ctx.publicCall("getCliCapabilities", []);
-      const cap = capabilities.providers.find((c) => c.type === p.type);
-      const path = cap?.defaultPath;
-      if (!path)
-        fail(
-          "provider_path_required",
-          "This provider has no default snippet path in deployment capabilities.",
-          "Configure and select a named endpoint."
+      const { data: catalog } = await ctx.call("listModelPrices", []);
+      const providers = requested ? reachable.filter((p) => p.slug === requested) : reachable;
+      example = firstRequest(routing, providers, catalog.prices);
+      if (!requested && reachable.length > 1)
+        notes2.push(`This app can reach ${reachable.length} providers. Add --provider <slug> for a different one.`);
+    }
+    notes2.push(...exampleNotes(example));
+    const clientUrl = ctx.active?.deployment?.apiUrl ?? ctx.url;
+    let snippet;
+    if (ios) {
+      const endUser = doc.config.authentication.type === "apple_app_attest" ? doc.config.authentication.end_user : void 0;
+      const issuer = endUser?.source === "issuer";
+      if (issuer)
+        notes2.push(
+          "Replace yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh) with your configured issuer integration."
         );
-      target = `provider: ${JSON.stringify(p.slug)},
-    providerPath: ${JSON.stringify(path)}`;
-    }
-    const issuer = doc.config.authentication.end_user.source === "issuer";
-    const authMode = issuer ? ".appAttest(issuerTokenProvider: { forceRefresh in\n        // Return a fresh signed token from your configured identity SDK.\n        try await yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh)\n    })" : ".appAttestInstall";
-    const snippet = `// Swift package: https://github.com/maxceem/app-ai-gateway-swift (from: 1.0.0)
-// Enable App Attest and test on a supported physical device.
-import Foundation
-import AppAIGateway
-
-let gateway = AppAIGatewayClient(
-    appID: ${JSON.stringify(appId)},
-    baseURL: URL(string: ${JSON.stringify(ctx.url)})!,
-    authMode: ${authMode}
-)
-
-var request = try await gateway.authorizedRequest(
-    ${target}
-)
-// Supply the provider-native JSON body, then send request with URLSession.
-`;
+      snippet = swiftSnippet({
+        baseUrl: clientUrl,
+        appId,
+        example,
+        authMode: issuer ? ".appAttest(issuerTokenProvider: { forceRefresh in\n        // Return a fresh signed token from your configured identity SDK.\n        try await yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh)\n    })" : ".appAttestInstall",
+        notes: [
+          "Swift package: https://github.com/maxceem/app-ai-gateway-swift (from: 1.0.0)",
+          "Enable App Attest and test on a supported physical device.",
+          ...notes2
+        ]
+      });
+    } else {
+      snippet = curlSnippet({ baseUrl: clientUrl, appId, example, notes: notes2 });
+    }
     if (flags.output) {
       const output = await reserveOutput(flags.output);
       try {
@@ -17339,13 +17510,7 @@ var request = try await gateway.authorizedRequest(
         await output.cancel();
       }
     }
-    return {
-      language: "swift",
-      snippet,
-      ...issuer ? {
-        requires: "Replace yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh) with your configured issuer integration."
-      } : {}
-    };
+    return { language: ios ? "swift" : "shell", snippet, notes: notes2 };
   }
   fail("unknown_command", "Unknown command.");
 }
@@ -17376,8 +17541,8 @@ var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 425, 429]);
 var RECEIPT_BOUND_STATUS = /* @__PURE__ */ new Set([409, 410]);
 function definitiveRefusal(error51) {
   if (!(error51 instanceof CliError)) return false;
-  const status = error51.details?.status;
-  return typeof status === "number" && status >= 400 && status < 500 && !RETRYABLE_STATUS.has(status) && !RECEIPT_BOUND_STATUS.has(status);
+  const status2 = error51.details?.status;
+  return typeof status2 === "number" && status2 >= 400 && status2 < 500 && !RETRYABLE_STATUS.has(status2) && !RECEIPT_BOUND_STATUS.has(status2);
 }
 var Context = class {
   store;
@@ -17477,7 +17642,7 @@ var Context = class {
         (entry) => entry.requestHash === requestHash && (entry.accountId === null || entry.accountId === this.active?.account?.id)
       ),
       (state) => {
-        const mutation = {
+        const mutation2 = {
           id: randomToken(),
           proof: randomToken(),
           requestHash,
@@ -17486,27 +17651,27 @@ var Context = class {
           path,
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        (state.mutations ??= {})[mutation.id] = mutation;
-        return mutation;
+        (state.mutations ??= {})[mutation2.id] = mutation2;
+        return mutation2;
       }
     );
   }
   async keyOutput(path, body, requestedPath) {
-    const mutation = await this.prepareCreate(path, body);
-    const chosen = requestedPath ? resolve2(requestedPath) : mutation.output?.path;
-    if (mutation.completedAt && chosen !== mutation.output?.path)
+    const mutation2 = await this.prepareCreate(path, body);
+    const chosen = requestedPath ? resolve2(requestedPath) : mutation2.output?.path;
+    if (mutation2.completedAt && chosen !== mutation2.output?.path)
       fail(
         "output_changed",
         "A completed key creation cannot move its output.",
         "Copy the protected existing file, or create a replacement with a new key name.",
         4
       );
-    const existing = chosen && chosen === mutation.output?.path ? mutation.output : void 0;
+    const existing = chosen && chosen === mutation2.output?.path ? mutation2.output : void 0;
     const output = await this.store.keyOutput(chosen, {
       reservation: existing,
       retain: true
     });
-    if (mutation.completedAt && mutation.keyMetadata?.contentHash !== await output.contentHash()) {
+    if (mutation2.completedAt && mutation2.keyMetadata?.contentHash !== await output.contentHash()) {
       await output.cancel();
       fail(
         "output_changed",
@@ -17515,15 +17680,15 @@ var Context = class {
         4
       );
     }
-    mutation.output = output.reservation;
+    mutation2.output = output.reservation;
     await this.save();
     return {
       ...output,
-      recoveryAvailable: () => Boolean(mutation.response),
-      mutation,
+      recoveryAvailable: () => Boolean(mutation2.response),
+      mutation: mutation2,
       cancel: async () => {
         await output.cancel();
-        if (!this.state.mutations?.[mutation.id])
+        if (!this.state.mutations?.[mutation2.id])
           await releaseOutput(output.reservation);
       }
     };
@@ -17544,32 +17709,32 @@ var Context = class {
       );
     const descriptor = operations[name];
     const path = descriptor.path(...params);
-    const mutation = await this.prepareCreate(path, body);
-    if (mutation.accountId === null) {
-      mutation.accountId = this.active.account?.id ?? null;
+    const mutation2 = await this.prepareCreate(path, body);
+    if (mutation2.accountId === null) {
+      mutation2.accountId = this.active.account?.id ?? null;
       await this.save();
     }
-    if (mutation.failure)
+    if (mutation2.failure)
       fail(
         "key_storage_failed",
         "This creation ended with a revoked or unverified key.",
-        `Inspect agw app key list ${mutation.failure.appId}; use a new key name to replace it.`,
+        `Inspect agw app key list ${mutation2.failure.appId}; use a new key name to replace it.`,
         4,
-        mutation.failure
+        mutation2.failure
       );
-    if (mutation.completedAt) {
-      this.deliveredMutations.add(mutation.id);
+    if (mutation2.completedAt) {
+      this.deliveredMutations.add(mutation2.id);
       return {
         // Parsed against the recorded shape, not the live one: this copy never
         // held the plaintext, so the live schema would reject it — and a state
         // file that somehow grew one is stripped again on the way out.
-        data: this.parseRecorded(name, mutation.result),
-        keyMetadata: mutation.keyMetadata,
+        data: this.parseRecorded(name, mutation2.result),
+        keyMetadata: mutation2.keyMetadata,
         complete: async () => {
         }
       };
     }
-    if (!mutation.response && Date.now() - Date.parse(mutation.createdAt) > 90 * 24 * 60 * 60 * 1e3)
+    if (!mutation2.response && Date.now() - Date.parse(mutation2.createdAt) > 90 * 24 * 60 * 60 * 1e3)
       fail(
         "resource_retry_expired",
         "This unfinished creation is older than the supported 90-day retry window.",
@@ -17577,8 +17742,8 @@ var Context = class {
         4
       );
     let data;
-    if (mutation.response !== void 0) {
-      const recovered = this.parse(name, mutation.response);
+    if (mutation2.response !== void 0) {
+      const recovered = this.parse(name, mutation2.response);
       const keyRecord = recoveredKey(name, recovered);
       if (keyRecord) {
         const appId = recoveredAppId(name, recovered, params);
@@ -17586,15 +17751,15 @@ var Context = class {
         if (!existing.keys.some(
           (key) => key.id === keyRecord.id && key.status === "active"
         )) {
-          mutation.failure = { appId, keyId: keyRecord.id, revoked: true };
-          delete mutation.response;
+          mutation2.failure = { appId, keyId: keyRecord.id, revoked: true };
+          delete mutation2.response;
           await this.save();
           fail(
             "resource_key_unavailable",
             "The recovered application key was revoked or removed.",
             "Create a replacement key with a new name; the previous creation will not be repeated.",
             4,
-            mutation.failure
+            mutation2.failure
           );
         }
       }
@@ -17603,29 +17768,29 @@ var Context = class {
       const response = await this.call(name, params, {
         body,
         headers: {
-          "Idempotency-Key": mutation.id,
-          "X-Idempotency-Proof": mutation.proof
+          "Idempotency-Key": mutation2.id,
+          "X-Idempotency-Proof": mutation2.proof
         }
       }).catch(async (error51) => {
-        await this.discard(mutation, error51);
+        await this.discard(mutation2, error51);
         throw error51;
       });
       data = response.data;
-      mutation.response = data;
+      mutation2.response = data;
       await this.save();
     }
     return {
       data,
       keyStored: async (metadata) => {
-        mutation.keyMetadata = metadata;
+        mutation2.keyMetadata = metadata;
         await this.save();
       },
       complete: async () => {
-        mutation.result = recordedResultFor[name].parse(data);
-        mutation.completedAt = (/* @__PURE__ */ new Date()).toISOString();
-        delete mutation.response;
+        mutation2.result = recordedResultFor[name].parse(data);
+        mutation2.completedAt = (/* @__PURE__ */ new Date()).toISOString();
+        delete mutation2.response;
         await this.save();
-        this.deliveredMutations.add(mutation.id);
+        this.deliveredMutations.add(mutation2.id);
       }
     };
   }
@@ -17637,9 +17802,9 @@ var Context = class {
    * different failure. The worst a failed write leaves behind is the record
    * this would have removed, which is where the CLI stood before.
    */
-  async discard(mutation, error51) {
+  async discard(mutation2, error51) {
     if (!definitiveRefusal(error51)) return;
-    delete this.state.mutations?.[mutation.id];
+    delete this.state.mutations?.[mutation2.id];
     await this.save().catch(() => {
     });
   }
@@ -17764,12 +17929,12 @@ var Context = class {
       };
       await this.save();
     }
-    const operation2 = this.state.operations[localId];
+    const operation3 = this.state.operations[localId];
     const { data: capabilities } = await this.publicCall("getCliCapabilities", [], {
       url: target
     });
     const { data } = await this.publicCall("createCliOperation", [], {
-      body: { kind, payload, pollToken: operation2.pollToken },
+      body: { kind, payload, pollToken: operation3.pollToken },
       url: target,
       ...authenticated ? { key: this.active?.credential } : {}
     });
@@ -17782,7 +17947,7 @@ var Context = class {
         "invalid_response",
         "The handoff URL is not on this deployment\u2019s trusted console origin."
       );
-    this.state.operations[data.id] = { ...operation2, phase: "pending" };
+    this.state.operations[data.id] = { ...operation3, phase: "pending" };
     delete this.state.operations[localId];
     await this.save();
     if (!this.flags["no-open"]) await openBrowser(data.url);
@@ -17796,15 +17961,15 @@ Operation: ${data.id}
     return this.wait(data.id, 300);
   }
   async poll(id) {
-    const operation2 = this.state.operations[id];
-    if (!operation2)
+    const operation3 = this.state.operations[id];
+    if (!operation3)
       fail(
         "operation_unknown",
         "This operation has no locally stored polling authorization.",
         "Resume it from the machine that initiated the operation.",
         4
       );
-    if (this.active && this.active.url !== operation2.url)
+    if (this.active && this.active.url !== operation3.url)
       fail(
         "operation_context",
         "This operation belongs to another selected deployment.",
@@ -17812,18 +17977,18 @@ Operation: ${data.id}
         4
       );
     const { data } = await this.publicCall("pollCliOperation", [id], {
-      key: operation2.pollToken,
-      url: operation2.url
+      key: operation3.pollToken,
+      url: operation3.url
     });
-    if (data.state === "completed" && !operation2.completed && operation2.kind === "claim") {
-      if ((this.state.generation ?? 0) !== operation2.generation)
+    if (data.state === "completed" && !operation3.completed && operation3.kind === "claim") {
+      if ((this.state.generation ?? 0) !== operation3.generation)
         fail(
           "operation_context",
           "The active connection changed after this operation began.",
           "Start a new login for the intended connection.",
           4
         );
-      operation2.completed = true;
+      operation3.completed = true;
       if (this.active && data.account) this.active.account = data.account;
       await this.save();
     }
@@ -17885,9 +18050,11 @@ async function openBrowser(url2) {
 
 // src/deployment.ts
 import { spawn as spawn2 } from "node:child_process";
+import { stripVTControlCharacters } from "node:util";
 import { createRequire as createRequire2 } from "node:module";
 import { randomUUID } from "node:crypto";
 import { cp, writeFile as writeFile2, unlink as unlink2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { join as join3 } from "node:path";
 import { setTimeout as delay3 } from "node:timers/promises";
 
@@ -18133,9 +18300,11 @@ async function release(requested = VERSION, base = dirname(fileURLToPath(import.
 
 // src/deployment.ts
 var require2 = createRequire2(import.meta.url);
-var OUTPUT_TAIL = 2e3;
+var OUTPUT_TAIL = 5e3;
 function wranglerFailure(args, code, output, redact = []) {
-  const tail = redact.filter((value) => value.length >= 8).reduce((text2, value) => text2.split(value).join("[redacted]"), output).trim().slice(-OUTPUT_TAIL);
+  const tail = stripVTControlCharacters(
+    redact.filter((value) => value.length >= 8).reduce((text2, value) => text2.split(value).join("[redacted]"), output)
+  ).trim().slice(-OUTPUT_TAIL);
   return new CliError(
     "wrangler_failed",
     `wrangler ${args[0] ?? ""} failed${code === null ? "" : ` (exit ${code})`}.`,
@@ -18144,16 +18313,21 @@ function wranglerFailure(args, code, output, redact = []) {
     tail ? { output: tail } : void 0
   );
 }
+function wranglerEnvironment({
+  interactive = false
+} = {}) {
+  return {
+    ...process.env,
+    WRANGLER_SEND_METRICS: "false",
+    WRANGLER_LOG: "log",
+    CI: interactive ? "" : "true"
+  };
+}
 async function runWrangler(args, { cwd, input, interactive = false, redact } = {}) {
   return new Promise((resolve3, reject2) => {
     const child = spawn2(process.execPath, [require2.resolve("wrangler/bin/wrangler.js"), ...args], {
       ...cwd === void 0 ? {} : { cwd },
-      env: {
-        ...process.env,
-        WRANGLER_SEND_METRICS: "false",
-        WRANGLER_LOG: "error",
-        CI: interactive ? "" : "true"
-      },
+      env: wranglerEnvironment({ interactive }),
       stdio: [input ? "pipe" : interactive ? "inherit" : "ignore", "pipe", "pipe"]
     });
     let output = "";
@@ -18184,6 +18358,24 @@ async function runWrangler(args, { cwd, input, interactive = false, redact } = {
     });
   });
 }
+function usable(auth) {
+  return auth.type === "api_key" ? Boolean(auth.key && auth.email) : Boolean(auth.token);
+}
+function environmentCredentials() {
+  const env = process.env;
+  const token = env.CLOUDFLARE_API_TOKEN ?? env.CF_API_TOKEN;
+  const key = env.CLOUDFLARE_API_KEY ?? env.CF_API_KEY;
+  const email3 = env.CLOUDFLARE_EMAIL ?? env.CF_EMAIL;
+  return [token, key && email3 ? key : void 0].filter(
+    (value) => Boolean(value)
+  );
+}
+var API_ERROR_TAIL = 500;
+function apiErrors(data) {
+  return (data.errors ?? []).map(
+    (error51) => [error51.message, error51.code === void 0 ? "" : `[code: ${error51.code}]`].filter(Boolean).join(" ")
+  ).filter(Boolean).join("; ").slice(0, API_ERROR_TAIL);
+}
 var Cloudflare = class {
   run;
   fetch;
@@ -18192,22 +18384,62 @@ var Cloudflare = class {
     this.run = run;
     this.fetch = fetchImpl;
   }
-  async authenticate(flags) {
+  /**
+   * The authorization wrangler holds, or undefined when it holds none.
+   *
+   * Only one outcome may be read as "logged out": wrangler exiting non-zero
+   * with nothing in the environment for it to have used. A run that failed
+   * while credentials were set failed at something else, a run that could not
+   * start failed at nothing to do with authorization, and output that will not
+   * parse means this CLI and the wrangler it drives disagree about the
+   * command. Answering any of those with a login would hide the cause behind a
+   * message about something the caller had already done.
+   */
+  async readAuth() {
+    const credentials = environmentCredentials();
+    let reported2;
+    try {
+      reported2 = await this.run(["auth", "token", "--json"], {
+        cwd: tmpdir(),
+        redact: credentials
+      });
+    } catch (error51) {
+      if (credentials.length > 0 || !(error51 instanceof CliError) || error51.code !== "wrangler_failed")
+        throw error51;
+      return void 0;
+    }
+    let auth;
     try {
-      this.auth = JSON.parse(await this.run(["auth", "token", "--json"]));
+      auth = JSON.parse(reported2);
     } catch {
-      if (flags["no-input"] || flags["dry-run"])
-        fail(
-          "cloudflare_auth_required",
-          "Cloudflare authentication is required.",
-          "Set CLOUDFLARE_API_TOKEN securely, or run setup interactively to authorize Cloudflare.",
-          4
-        );
-      await this.run(["login"], { interactive: true });
-      this.auth = JSON.parse(await this.run(["auth", "token", "--json"]));
+      fail(
+        "cloudflare_auth_unreadable",
+        "Wrangler did not report the Cloudflare authorization it holds.",
+        "Reinstall the CLI so the wrangler it bundles is the one it expects, then retry.",
+        3
+      );
     }
-    if (!this.auth?.token && this.auth?.type !== "api_key")
-      fail("cloudflare_auth_required", "No Cloudflare authorization is available.");
+    return usable(auth) ? auth : void 0;
+  }
+  async authenticate(flags) {
+    this.auth = await this.readAuth();
+    if (this.auth) return;
+    if (flags["no-input"] || flags["dry-run"])
+      fail(
+        "cloudflare_auth_required",
+        "Cloudflare authentication is required.",
+        "Set CLOUDFLARE_API_TOKEN securely, or run setup interactively to authorize Cloudflare.",
+        4
+      );
+    await this.run(["login"], { interactive: true, cwd: tmpdir() });
+    this.auth = await this.readAuth();
+    if (!this.auth)
+      fail(
+        "cloudflare_auth_required",
+        "Cloudflare authorization was not completed.",
+        "Read the wrangler output above, complete the browser login, then retry the same command.",
+        4
+      );
   }
   authHeaders() {
     const auth = this.auth;
@@ -18243,13 +18475,16 @@ var Cloudflare = class {
     } catch {
       fail("cloudflare_error", "Cloudflare returned an invalid response.");
     }
-    if (!response.ok || !data.success)
+    if (!response.ok || !data.success) {
+      const reported2 = apiErrors(data);
       fail(
         "cloudflare_error",
-        `Cloudflare rejected the request (HTTP ${response.status}).`,
+        `Cloudflare rejected the request (HTTP ${response.status})${reported2 ? `: ${reported2}` : ""}`,
         "Check Cloudflare permissions and the deployment resource IDs; retry the same command.",
-        3
+        3,
+        reported2 ? { apiErrors: reported2 } : void 0
       );
+    }
     return data;
   }
   async all(path) {
@@ -18761,60 +18996,570 @@ async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loa
   }
 }
 
+// src/style.ts
+import { Writable } from "node:stream";
+import { styleText } from "node:util";
+var STATES = /* @__PURE__ */ new Map([
+  ["active", "green"],
+  ["ready", "green"],
+  ["completed", "green"],
+  ["yes", "green"],
+  ["pending", "yellow"],
+  ["failed", "red"],
+  ["expired", "red"],
+  ["blocked", "red"],
+  ["inactive", "red"],
+  ["disabled", "red"],
+  ["revoked", "red"],
+  ["no", "red"]
+]);
+function colorEnabled(sink, env = process.env) {
+  if (env["NO_COLOR"]) return false;
+  if (!(sink instanceof Writable)) return false;
+  if (env["FORCE_COLOR"] && env["FORCE_COLOR"] !== "0") return true;
+  if (!("isTTY" in sink && sink.isTTY === true)) return false;
+  return styleText("dim", "?", { stream: sink, validateStream: true }) !== "?";
+}
+var plain = style(false);
+var styleFor = (sink) => style(colorEnabled(sink));
+function style(enabled) {
+  const paint = (format, text2) => enabled ? styleText(format, text2, { validateStream: false }) : text2;
+  const self = {
+    enabled,
+    headline: (text2) => paint("bold", text2),
+    dim: (text2) => paint("dim", text2),
+    alert: (text2) => paint("red", text2),
+    warn: (text2) => paint("yellow", text2),
+    state: (value) => {
+      const tone = STATES.get(value.toLowerCase());
+      return tone ? paint(tone, value) : value;
+    },
+    code: (text2, language) => {
+      const rule = `\u2500\u2500 ${language} \u2500\u2500`;
+      return [
+        self.dim(rule),
+        ...text2.split("\n").map((line) => self.dim(line)),
+        self.dim("\u2500".repeat(rule.length))
+      ];
+    },
+    json: (value) => JSON.stringify(value, null, 2).split("\n").map((line) => jsonLine(line, paint)).join("\n")
+  };
+  return self;
+}
+function jsonLine(line, paint) {
+  const match = /^(\s*)(?:("(?:[^"\\]|\\.)*")(: ))?(.*?)(,?)$/.exec(line);
+  if (!match) return line;
+  const [, indent = "", key, colon, value = "", comma = ""] = match;
+  const painted = value === "" ? "" : /^[[\]{}]+$/.test(value) ? paint("dim", value) : value.startsWith('"') ? value : paint("green", value);
+  return indent + (key && colon ? paint("bold", key) + paint("dim", colon) : "") + painted + (comma ? paint("dim", comma) : "");
+}
+
 // src/human.ts
-function humanResult(command, result, context) {
-  const lines = [];
-  if (command === "app snippet" && "snippet" in result && typeof result.snippet === "string")
-    return result.snippet;
-  if ("state" in result && result.state === "pending" && "url" in result) {
-    lines.push(`Waiting for browser handoff (${result.id}).`, result.url);
-    lines.push(`Resume: agw operation wait ${result.id}`);
-  } else if ("guidance" in result && "app" in result) {
-    lines.push(
-      `${command === "app add" ? "Created" : "Updated"} ${result.app.name}`,
-      `Gateway: ${context.url}`,
-      `App ID: ${result.app.id}`,
-      ""
-    );
-    const parsed = AppConfigSchema.safeParse(result.app.config);
-    if (parsed.success) {
-      const config2 = parsed.data;
-      if (config2.authentication.type === "apple_app_attest") {
-        const endUser = config2.authentication.end_user;
-        lines.push(
-          `App Attest: ${(config2.authentication.app_attest.environments ?? ["production"]).join(" + ")}`,
-          `User identity: ${endUser.source === "app_install" ? "per installation; sign-in not required" : "verified issuer; integrate your sign-in SDK"}`,
-          `Paid subscription check: ${endUser.source === "issuer" && endUser.issuer.required_claims.length ? "configured claim requirements" : "off"}`
-        );
-      } else lines.push("Authentication: server application API key");
-      const limits = config2.limits?.per_user;
-      lines.push(
-        `Per-user limits: ${limits?.requests.per_minute ?? "unlimited"} requests/minute, ${limits?.requests.per_day ?? "unlimited"}/day`
-      );
-    }
-    if (result.applicationKey)
-      lines.push(`Key saved: ${result.applicationKey.storagePath}`);
-    if (result.guidance) lines.push("", result.guidance);
-    if ("snippet" in result && result.snippet) lines.push("", result.snippet);
-  } else if (command === "provider add" || command === "provider-gateway add") {
-    const stored = "provider" in result ? result.provider : "gateway" in result ? result.gateway : void 0;
-    const label = stored?.name ?? stored?.type ?? "connection";
-    const id = stored?.id ?? ("id" in result ? result.id : void 0);
-    lines.push(
-      `Stored ${label} (${id}).`,
-      `Gateway: ${context.url}`,
-      "Credential stored; no upstream probe or inference was performed."
-    );
-  } else if ("output" in result && typeof result.output === "string") {
-    lines.push(`Saved: ${result.output}`);
-  } else lines.push(JSON.stringify(result, null, 2));
-  if (context.accountId) lines.push(`Account: ${context.accountId}`);
+function kv(entries, style2) {
+  const rows = [];
+  for (const [key, value] of entries)
+    if (value !== void 0 && value !== null) rows.push([key, String(value)]);
+  const width = Math.max(0, ...rows.map(([key]) => key.length + 1));
+  return rows.map(
+    ([key, value]) => style2.dim(`${key}:`.padEnd(width + 1)) + style2.state(value)
+  );
+}
+function table(headers, rows, style2) {
+  const widths = headers.map(
+    (header, column) => Math.max(header.length, ...rows.map((row) => (row[column] ?? "").length))
+  );
+  const line = (cells, tone) => cells.map(
+    (cell, column) => tone(cell) + (column === widths.length - 1 ? "" : " ".repeat((widths[column] ?? 0) + 2 - cell.length))
+  ).join("").trimEnd();
+  return [
+    line(headers, (cell) => style2.dim(cell)),
+    ...rows.map((row) => line(row, (cell) => style2.state(cell)))
+  ];
+}
+var yesNo = (value) => value ? "yes" : "no";
+function humanResult(command, result, context, style2 = plain) {
+  if (command === "app snippet" && "snippet" in result && typeof result.snippet === "string") {
+    if (!style2.enabled) return result.snippet;
+    const language = "language" in result ? result.language : "code";
+    return style2.code(result.snippet, language).join("\n") + "\n";
+  }
+  const lines = render(command, result, context, style2);
   if ("trial" in result && result.trial)
     lines.push(`Free access ends: ${result.trial.endsAt}`);
   if ("account" in result && result.account?.expiresAt)
     lines.push(`Recovery deadline: ${result.account.expiresAt}`);
   return lines.join("\n") + "\n";
 }
+function render(command, result, context, style2) {
+  if ("state" in result && result.state === "pending" && "url" in result)
+    return [
+      style2.headline(`Waiting for browser handoff (${result.id}).`),
+      result.url,
+      `Resume: agw operation wait ${result.id}`
+    ];
+  switch (command) {
+    case "account status":
+    case "account login":
+    case "account claim":
+    case "deployment connect":
+    case "deployment status":
+      return status(command, result, context, style2);
+    case "provider types":
+    case "provider-gateway types":
+    case "provider list":
+    case "provider-gateway list":
+    case "app list":
+    case "app key list":
+      return list(command, result, style2);
+    case "provider show":
+    case "provider-gateway show":
+    case "app show":
+      return show(command, result, style2);
+    case "provider update":
+    case "provider-gateway update":
+    case "provider rotate-key":
+    case "provider-gateway rotate-key":
+    case "provider add":
+    case "provider-gateway add":
+    case "provider remove":
+    case "provider-gateway remove":
+    case "app remove":
+    case "app key add":
+    case "app key revoke":
+    case "account logout":
+      return mutation(command, result, context, style2);
+    case "usage show":
+    case "usage breakdown":
+      return usage(command, result, style2);
+    case "operation status":
+    case "operation wait":
+      return operation2(result, style2);
+    case "app add":
+    case "app update":
+    case "app validate":
+    case "app check":
+    case "app snippet":
+      return app(command, result, context, style2);
+    case "deployment setup":
+    case "deployment update":
+    case "deployment domain":
+      return deployment(result, style2);
+  }
+}
+function status(command, result, context, style2) {
+  const did = command === "account login" ? [style2.headline(`Signed in to ${context.url}.`)] : command === "deployment connect" ? [style2.headline(`Connected to ${context.url}.`)] : [];
+  if ("billing" in result)
+    return [
+      ...did,
+      ...kv(
+        [
+          ["Gateway", context.url],
+          ["Account", `${result.account.name} (${result.account.id})`],
+          ["Claimed", yesNo(result.account.claimed)],
+          ["Deployment", result.deployment.mode === "cloud" ? "cloud" : "self-hosted"],
+          ["Console", result.deployment.consoleOrigin]
+        ],
+        style2
+      )
+    ];
+  if ("protocolVersion" in result)
+    return [
+      ...did,
+      ...kv(
+        [
+          ["Gateway", result.url],
+          ["Connected", yesNo(result.connected)],
+          ["Authenticated", yesNo(result.authenticated)],
+          ["Version", result.serverVersion],
+          ["Deployment", result.deployment.mode === "cloud" ? "cloud" : "self-hosted"],
+          ["Console", result.consoleOrigin],
+          ["Provider types", result.providers.length],
+          ["Provider gateway types", result.providerGateways.length]
+        ],
+        style2
+      )
+    ];
+  if ("state" in result) return [...did, ...operation2(result, style2)];
+  return [...did, style2.json(result)];
+}
+function list(command, result, style2) {
+  if (command === "provider types" || command === "provider-gateway types") {
+    if (!Array.isArray(result)) return [style2.json(result)];
+    const types = result;
+    if (!types.length) return ["No types."];
+    return table(
+      ["TYPE", "NAME", "BASE URL"],
+      types.map((entry) => [entry.type, entry.name, "baseUrl" in entry ? entry.baseUrl : ""]),
+      style2
+    );
+  }
+  if (command === "provider list") {
+    if (!("providers" in result) || "appId" in result || "protocolVersion" in result)
+      return [style2.json(result)];
+    if (!result.providers.length) return ["No providers."];
+    return table(
+      ["ID", "SLUG", "TYPE", "NAME", "STATUS", "CREATED"],
+      result.providers.map((provider) => [
+        provider.id,
+        provider.slug,
+        provider.type,
+        provider.name,
+        provider.status,
+        provider.createdAt
+      ]),
+      style2
+    );
+  }
+  if (command === "provider-gateway list" && "gateways" in result) {
+    if (!result.gateways.length) return ["No provider gateways."];
+    return table(
+      ["ID", "TYPE", "NAME", "STATUS", "PROVIDERS", "CREATED"],
+      result.gateways.map((gateway) => [
+        gateway.id,
+        gateway.type,
+        gateway.name,
+        gateway.status,
+        String(gateway.providerCount),
+        gateway.createdAt
+      ]),
+      style2
+    );
+  }
+  if (command === "app list" && "apps" in result && !("totals" in result)) {
+    if (!result.apps.length) return ["No apps."];
+    return table(
+      ["ID", "NAME", "AUTH", "STATUS", "PROVIDERS", "CREATED"],
+      result.apps.map((entry) => [
+        entry.id,
+        entry.name,
+        entry.authentication_type,
+        entry.status,
+        String(entry.providers.length),
+        entry.created_at
+      ]),
+      style2
+    );
+  }
+  if (command === "app key list" && "keys" in result && "app_id" in result) {
+    if (!result.keys.length) return [`No keys for ${result.app_id}.`];
+    return table(
+      ["ID", "NAME", "PREFIX", "STATUS", "CREATED", "LAST USED"],
+      result.keys.map((key) => [
+        key.id,
+        key.name,
+        key.key_prefix,
+        key.status,
+        key.created_at,
+        key.last_used_at ?? "never"
+      ]),
+      style2
+    );
+  }
+  return [style2.json(result)];
+}
+function show(command, result, style2) {
+  if (command === "app show" && "app" in result && !("guidance" in result)) {
+    const lines = [style2.headline(`${result.app.name} (${result.app.id})`)];
+    if (result.config_error)
+      lines.push(style2.alert(`Configuration error: ${result.config_error}`));
+    return [...lines, "", style2.json(result)];
+  }
+  if ("slug" in result)
+    return [
+      style2.headline(`${result.name} (${result.id}), type ${result.type}, slug ${result.slug}`),
+      "",
+      style2.json(result)
+    ];
+  if ("referencedCount" in result)
+    return [
+      style2.headline(`${result.name} (${result.id}), type ${result.type}`),
+      "",
+      style2.json(result)
+    ];
+  return [style2.json(result)];
+}
+function mutation(command, result, context, style2) {
+  if ("loggedOut" in result)
+    return [
+      style2.headline(`Signed out of ${context.url}.`) + " The stored credential was removed."
+    ];
+  if ("deleted" in result) {
+    if ("provider_id" in result)
+      return [style2.headline(`Removed provider ${result.provider_id}.`)];
+    if ("provider_gateway_id" in result)
+      return [style2.headline(`Removed provider gateway ${result.provider_gateway_id}.`)];
+    return [
+      style2.headline(`Removed app ${result.app_id}.`) + ` ${result.removed_users} users removed; usage events retained.`
+    ];
+  }
+  if ("key" in result)
+    return [
+      style2.headline(
+        `Revoked key ${result.key.name} (${result.key.id}) for app ${result.app_id}.`
+      )
+    ];
+  if ("applicationKey" in result && "appId" in result)
+    return [
+      style2.headline(
+        `Created key ${result.applicationKey.name} (${result.applicationKey.id}) for app ${result.appId}.`
+      ),
+      ...kv([["Key saved", result.applicationKey.storagePath]], style2)
+    ];
+  if ("provider" in result) {
+    const added = command === "provider add";
+    return [
+      style2.headline(
+        `${added ? "Stored" : "Updated"} provider ${result.provider.name} (${result.provider.id}).`
+      ),
+      ...kv(
+        [
+          ["Gateway", context.url],
+          ["Status", result.provider.status],
+          ["Key hint", result.provider.secretHint]
+        ],
+        style2
+      ),
+      ...added ? ["Credential stored; no upstream probe or inference was performed."] : []
+    ];
+  }
+  if ("gateway" in result) {
+    const added = command === "provider-gateway add";
+    return [
+      style2.headline(
+        `${added ? "Stored" : "Updated"} provider gateway ${result.gateway.name} (${result.gateway.id}).`
+      ),
+      ...kv(
+        [
+          ["Gateway", context.url],
+          ["Status", result.gateway.status],
+          ["Token hint", result.gateway.secretHint]
+        ],
+        style2
+      ),
+      ...added ? ["Credential stored; no upstream probe or inference was performed."] : []
+    ];
+  }
+  return [style2.json(result)];
+}
+function usage(command, result, style2) {
+  if (command === "usage breakdown" && "rows" in result) {
+    const head = kv(
+      [
+        ["App", result.app_id],
+        ["Grouped by", result.by],
+        ["Period", `${result.from} to ${result.to}`]
+      ],
+      style2
+    );
+    const rows = result.rows.length ? table(
+      ["KEY", "REQUESTS", "INPUT", "OUTPUT", "COST USD", "ERRORS", "BLOCKED"],
+      result.rows.map((row) => [
+        row.key ?? "(none)",
+        String(row.requests),
+        String(row.input_tokens),
+        String(row.output_tokens),
+        row.cost_usd.toFixed(4),
+        String(row.errors),
+        String(row.blocked)
+      ]),
+      style2
+    ) : ["No usage in this period."];
+    return [...head, "", ...rows, "", result.coverage.source];
+  }
+  if ("totals" in result)
+    return [
+      ...kv(
+        [
+          ["Month", result.month],
+          ["Requests", result.totals.requests],
+          ["Input tokens", result.totals.input_tokens],
+          ["Output tokens", result.totals.output_tokens],
+          ["Cost USD", result.totals.cost_usd.toFixed(4)],
+          ["Errors", result.totals.errors],
+          ["Blocked", result.totals.blocked]
+        ],
+        style2
+      ),
+      "",
+      // The totals are the sum of these rows, so the apps they came from are
+      // printed rather than counted: a month is read to find which app spent it.
+      ...result.apps.length ? table(
+        ["APP", "REQUESTS", "INPUT", "OUTPUT", "COST USD", "ERRORS", "BLOCKED"],
+        result.apps.map((entry) => [
+          entry.deleted ? `${entry.appId} (deleted)` : entry.appId,
+          String(entry.requests),
+          String(entry.input_tokens),
+          String(entry.output_tokens),
+          entry.cost_usd.toFixed(4),
+          String(entry.errors),
+          String(entry.blocked)
+        ]),
+        style2
+      ) : ["No app usage recorded."],
+      "",
+      result.coverage.historicalAttribution
+    ];
+  if ("requests" in result)
+    return kv(
+      [
+        ["App", result.app_id],
+        ["Month", result.month],
+        ["Requests", result.requests],
+        ["Input tokens", result.input_tokens],
+        ["Cached input tokens", result.cached_input_tokens],
+        ["Cache write tokens", result.cache_write_tokens],
+        ["Output tokens", result.output_tokens],
+        ["Cost USD", result.cost_usd.toFixed(4)]
+      ],
+      style2
+    );
+  return [style2.json(result)];
+}
+function operation2(result, style2) {
+  if (!("state" in result)) return [style2.json(result)];
+  const stored = "result" in result ? result.result : void 0;
+  return kv(
+    [
+      ["Operation", result.id],
+      ["State", result.state],
+      ["Expires", result.expiresAt],
+      ["Account", stored?.accountId],
+      ["Provider", stored?.provider && `${stored.provider.name} (${stored.provider.id})`],
+      ["Provider gateway", stored?.gateway && `${stored.gateway.name} (${stored.gateway.id})`]
+    ],
+    style2
+  );
+}
+function app(command, result, context, style2) {
+  if ("output" in result) return [style2.headline(`Saved: ${result.output}`)];
+  if ("ready" in result)
+    return [
+      style2.headline(
+        `${result.appId} is ${result.ready ? "ready to serve requests" : "not ready to serve requests"}.`
+      ),
+      ...kv(
+        [
+          ["Status", result.status],
+          ["Providers", result.providers.length],
+          ["Active providers", result.providers.filter((p) => p.status === "active").length]
+        ],
+        style2
+      ),
+      ...notes([
+        ...result.validation.remote ? [] : result.validation.skipped,
+        ...result.limitations
+      ])
+    ];
+  if ("definition" in result) {
+    const dryRun = "dryRun" in result;
+    return [
+      style2.headline(
+        `${dryRun ? "Dry run: " : ""}${result.definition.name} is valid${result.validation.remote ? " here and on the gateway" : " locally"}.`
+      ),
+      ...kv(
+        [
+          ["Gateway", context.url],
+          ["Status", result.definition.status],
+          ["Authentication", result.definition.config.authentication.type],
+          ["App ID", result.validation.remote ? result.validation.app_id : void 0]
+        ],
+        style2
+      ),
+      ...notes(result.validation.remote ? [] : result.validation.skipped),
+      ...dryRun ? ["", "Nothing was written."] : []
+    ];
+  }
+  if ("guidance" in result && "app" in result)
+    return written(command, result, context, style2);
+  return [style2.json(result)];
+}
+var notes = (values) => values.length ? ["", ...values.map((value) => `- ${value}`)] : [];
+function written(command, result, context, style2) {
+  const parsed = AppConfigSchema.safeParse(result.app.config);
+  const details = [];
+  let language = "shell";
+  if (parsed.success) {
+    const config2 = parsed.data;
+    if (config2.authentication.type === "apple_app_attest") {
+      language = "swift";
+      const endUser = config2.authentication.end_user;
+      details.push(
+        [
+          "App Attest",
+          (config2.authentication.app_attest.environments ?? ["production"]).join(" + ")
+        ],
+        [
+          "User identity",
+          endUser.source === "app_install" ? "per installation; sign-in not required" : "verified issuer; integrate your sign-in SDK"
+        ],
+        [
+          "Paid subscription check",
+          endUser.source === "issuer" && endUser.issuer.required_claims.length ? "configured claim requirements" : "off"
+        ]
+      );
+    } else details.push(["Authentication", "server application API key"]);
+    const limits = config2.limits?.per_user;
+    details.push([
+      "Per-user limits",
+      `${limits?.requests.per_minute ?? "unlimited"} requests/minute, ${limits?.requests.per_day ?? "unlimited"}/day`
+    ]);
+  }
+  if (result.applicationKey)
+    details.push(["Key saved", result.applicationKey.storagePath]);
+  return [
+    style2.headline(
+      `${command === "app add" ? "Created" : "Updated"} app ${result.app.name} (${result.app.id}).`
+    ),
+    ...kv([["Gateway", context.url], ...details], style2),
+    ...result.guidance ? ["", result.guidance] : [],
+    ..."snippet" in result && result.snippet ? ["", ...style2.code(result.snippet, language)] : []
+  ];
+}
+function deployment(result, style2) {
+  if ("hostname" in result)
+    return kv(
+      [
+        [result.dryRun ? "Would attach domain" : "Domain", result.hostname],
+        ["Worker", result.worker],
+        ["Cloudflare account", result.accountId],
+        ["Zone", result.zoneId],
+        ["Previous URL", result.previousUrl],
+        ["URL", result.url],
+        ["Note", result.note]
+      ],
+      style2
+    );
+  if ("fromVersion" in result)
+    return kv(
+      [
+        [result.dryRun ? "Would update worker" : "Worker", result.worker],
+        ["Cloudflare account", result.accountId],
+        ["Database", result.databaseId],
+        ["From version", result.fromVersion],
+        ["To version", result.toVersion],
+        ["Updated", result.updated ? "yes" : void 0]
+      ],
+      style2
+    );
+  if ("installed" in result || "resources" in result)
+    return kv(
+      [
+        [result.dryRun ? "Would install worker" : "Worker", result.name],
+        ["Cloudflare account", result.accountId],
+        ["URL", result.url],
+        ["Version", result.version],
+        ["Domain", result.domain],
+        ["Pending domain", result.pendingDomain],
+        ["Deployment", result.deploymentId],
+        ["Resources", result.resources?.join(", ")],
+        ["Backup", result.backup],
+        ["Installed", result.installed ? "yes" : void 0],
+        ["Note", result.note]
+      ],
+      style2
+    );
+  return [style2.json(result)];
+}
 
 // src/transport.ts
 var MESSAGE_LIMIT = 300;
@@ -18833,6 +19578,27 @@ function reported(value, sent) {
 }
 var RECOVERABLE_RESOURCE_CODES = ["resource_receipt_expired", "resource_key_unavailable"];
 var RECOVERABLE_RESOURCE_FIELDS = ["appId", "keyId", "providerId", "providerGatewayId"];
+var LIMIT_CODES = [
+  "rate_limited",
+  "app_rate_limited",
+  "app_budget_exhausted",
+  "billing_request_quota_exceeded",
+  "billing_plan_limit_reached"
+];
+var LIMIT_TEXT_FIELDS = ["scope", "resetAt"];
+var LIMIT_NUMBER_FIELDS = ["limit", "used", "windowSeconds", "retryAfterSeconds"];
+function nextActionFor(status2, code, details) {
+  if (status2 === 401) return "Run agw account login.";
+  if (code === "billing_plan_limit_reached")
+    return "Delete one you no longer need, or move to a plan whose limits are higher.";
+  if (status2 === 429) {
+    const seconds = details.retryAfterSeconds;
+    if (seconds === void 0)
+      return "Wait for the limit named in the message to reset, then run the same command again.";
+    return seconds >= 3600 && details.resetAt !== void 0 ? `Wait until ${details.resetAt}, then run the same command again.` : `Wait ${seconds} seconds, then run the same command again.`;
+  }
+  return "Review command configuration and account status.";
+}
 var Transport = class {
   fetch;
   constructor(fetchImpl = fetch) {
@@ -18887,18 +19653,27 @@ var Transport = class {
       const wire = data ?? {};
       const code = typeof wire.error?.code === "string" ? wire.error.code : typeof wire.code === "string" ? wire.code : `http_${response.status}`;
       const details = { status: response.status };
-      if (RECOVERABLE_RESOURCE_CODES.includes(code)) {
-        const reported2 = wire.error?.data ?? {};
+      const facts = wire.error?.data ?? {};
+      if (RECOVERABLE_RESOURCE_CODES.includes(code))
         for (const field of RECOVERABLE_RESOURCE_FIELDS) {
-          const value = reported2[field];
+          const value = facts[field];
           if (typeof value === "string") details[field] = value;
         }
+      if (LIMIT_CODES.includes(code)) {
+        for (const field of LIMIT_TEXT_FIELDS) {
+          const value = facts[field];
+          if (typeof value === "string") details[field] = value;
+        }
+        for (const field of LIMIT_NUMBER_FIELDS) {
+          const value = facts[field];
+          if (typeof value === "number") details[field] = value;
+        }
       }
       const explanation = reported(wire.error?.message ?? wire.message, body);
       fail(
         code,
         `Deployment rejected the request (HTTP ${response.status})` + (explanation ? `: ${explanation}` : "."),
-        response.status === 401 ? "Run agw account login." : "Review command configuration and account status.",
+        nextActionFor(response.status, code, details),
         3,
         details
       );
@@ -18934,7 +19709,7 @@ async function usageCommand(ctx, command, flags) {
     const m = month(flags.month ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 7));
     return flags.app ? (await ctx.call("getAppUsage", [flags.app, { month: m }])).data : (await ctx.call("getCliUsage", [{ month: m }])).data;
   }
-  const app = await required2(flags, "app");
+  const app2 = await required2(flags, "app");
   const by = flags.by ?? "model";
   if (!["provider", "model", "status"].includes(by))
     fail("invalid_input", "--by must be provider, model or status.");
@@ -18946,7 +19721,7 @@ async function usageCommand(ctx, command, flags) {
   if (from > to) fail("invalid_input", "--from must not be later than --to.");
   const limit = positive(flags.limit ?? 50, 200);
   return {
-    ...(await ctx.call("getAppUsageBreakdown", [app, { from, to, by, limit }])).data,
+    ...(await ctx.call("getAppUsageBreakdown", [app2, { from, to, by, limit }])).data,
     coverage: {
       from,
       to,
@@ -19000,7 +19775,8 @@ async function execute(parsed, ctx) {
 async function main(argv = process.argv.slice(2), {
   store = new StateStore(),
   transport = new Transport(),
-  stdout = process.stdout
+  stdout = process.stdout,
+  stderr: stderr2 = process.stderr
 } = {}) {
   const json2 = argv.includes("--json");
   try {
@@ -19024,8 +19800,8 @@ async function main(argv = process.argv.slice(2), {
       };
       const rendered = ctx.onboarding ? { ...result, ...ctx.onboarding } : result;
       const output = { schemaVersion: 1, ok: true, context, result: rendered };
-      const text2 = json2 ? JSON.stringify(output) + "\n" : humanResult(parsed.command, rendered, context);
-      if (stdout instanceof Writable) {
+      const text2 = json2 ? JSON.stringify(output) + "\n" : humanResult(parsed.command, rendered, context, styleFor(stdout));
+      if (stdout instanceof Writable2) {
         await new Promise(
           (resolve3, reject2) => stdout.write(
             text2,
@@ -19047,17 +19823,27 @@ async function main(argv = process.argv.slice(2), {
       4
     );
     const details = e.details ? CliErrorDetailsSchema.safeParse(e.details) : void 0;
-    const output = {
-      schemaVersion: 1,
-      ok: false,
-      error: {
-        code: e.code,
-        message: e.message,
-        nextAction: e.nextAction,
-        ...details?.success ? { details: details.data } : {}
-      }
+    const reported2 = {
+      code: e.code,
+      message: e.message,
+      nextAction: e.nextAction,
+      ...details?.success ? { details: details.data } : {}
     };
-    stdout.write(JSON.stringify(output, null, json2 ? void 0 : 2) + "\n");
+    if (json2) {
+      stdout.write(
+        JSON.stringify({ schemaVersion: 1, ok: false, error: reported2 }) + "\n"
+      );
+      return e.exitCode;
+    }
+    const style2 = styleFor(stderr2);
+    const lines = [
+      style2.alert(`Error: ${e.message}`),
+      style2.warn(`Next: ${e.nextAction}`),
+      style2.dim(`Code: ${e.code}`)
+    ];
+    for (const [key, value] of Object.entries(reported2.details ?? {}))
+      lines.push(`  ${style2.dim(`${key}:`)} ${String(value)}`);
+    stderr2.write(lines.join("\n") + "\n");
     return e.exitCode;
   }
 }