@maxceem/agw 0.1.9 → 0.1.10

package/README.md

@@ -88,7 +88,10 @@ The whole documentation is also published as
 [agents.md](https://docs.appaigateway.com/agents.md).
 
 **Output.** Add `--json` for exactly one JSON document on stdout; progress goes
-to stderr. Add `--no-input` to fail instead of prompting.
+to stderr. Without `--json`, output is plain text and a failure is printed to
+stderr, so stdout carries only the command's own output. Colour is used only
+when the destination is a terminal, and `NO_COLOR` turns it off. Add
+`--no-input` to fail instead of prompting.
 
 ```json
 { "schemaVersion": 1, "ok": true,  "context": { "url": "...", "accountId": "..." }, "result": { } }

package/dist/agw.mjs

@@ -6,10 +6,10 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.1.9", wrangler: "4.96.0", upgradeFrom: ["0.1.9", "0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.1.9/gateway-0.1.9.tar.gz", sha256: "a3722d70b8345b41d9e57662985141006214a1b02628af6016b4763e0d177287", manifest: "40ef2a1c2a44d1530a45a3a20eb4df4eb2a840af71ee53762432430f8262c142" } };
+var define_AGW_MANIFEST_default = { version: "0.1.10", wrangler: "4.96.0", upgradeFrom: ["0.1.10", "0.1.9", "0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.1.10/gateway-0.1.10.tar.gz", sha256: "39a8b65f05d666e323a08db70c90e345dd3eec698cbf7491b288dd5b9f864efa", manifest: "5f58bcdb8dee3dd4ca72f6da3a52ca086f2f7529cd39bd0e331a72779b8fd506" } };
 
 // src/main.ts
-import { Writable } from "node:stream";
+import { Writable as Writable2 } from "node:stream";
 
 // ../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -16050,6 +16050,11 @@ function validate(schema, value) {
 // src/input.ts
 import { createInterface } from "node:readline/promises";
 import { stdin, stderr } from "node:process";
+var MASK_LIMIT = 64;
+function maskDelta(shown, length) {
+  const target = Math.min(length, MASK_LIMIT);
+  return target > shown ? "*".repeat(target - shown) : "\b \b".repeat(shown - target);
+}
 async function prompt(label, flags, { hidden = false, defaultValue } = {}) {
   if (flags["no-input"] || !stdin.isTTY || !stderr.isTTY)
     fail(
@@ -16073,6 +16078,12 @@ async function prompt(label, flags, { hidden = false, defaultValue } = {}) {
   stdin.resume();
   return new Promise((resolve3, reject2) => {
     let value = "";
+    let shown = 0;
+    function mask() {
+      const delta = maskDelta(shown, value.length);
+      if (delta) stderr.write(delta);
+      shown = Math.min(value.length, MASK_LIMIT);
+    }
     function done(error51) {
       stdin.off("data", onData);
       stdin.setRawMode(wasRaw);
@@ -16093,9 +16104,13 @@ async function prompt(label, flags, { hidden = false, defaultValue } = {}) {
         }
         if (char === "\x7F" || char === "\b") {
           value = value.slice(0, -1);
+          mask();
           continue;
         }
-        if (char >= " ") value += char;
+        if (char >= " ") {
+          value += char;
+          mask();
+        }
         if (value.length > 16384) {
           done(new Error("input too long"));
           return;
@@ -16258,9 +16273,9 @@ function parse3(argv) {
         fail("missing_value", `--${name} requires a value.`);
       if (type === "multiple") {
         const existing = collected[name];
-        const list = Array.isArray(existing) ? existing : [];
-        list.push(value);
-        collected[name] = list;
+        const list2 = Array.isArray(existing) ? existing : [];
+        list2.push(value);
+        collected[name] = list2;
       } else collected[name] = value;
     }
   }
@@ -17032,32 +17047,32 @@ function exampleNotes(example) {
 }
 function exampleUrl(baseUrl, appId, target) {
   const origin2 = baseUrl.replace(/\/+$/, "");
-  const app = `${origin2}/v1/apps/${encodeURIComponent(appId)}`;
-  return "endpoint" in target ? `${app}/endpoints/${encodeURIComponent(target.endpoint)}` : `${app}/proxy/${encodeURIComponent(target.provider)}/${target.path}`;
+  const app2 = `${origin2}/v1/apps/${encodeURIComponent(appId)}`;
+  return "endpoint" in target ? `${app2}/endpoints/${encodeURIComponent(target.endpoint)}` : `${app2}/proxy/${encodeURIComponent(target.provider)}/${target.path}`;
 }
 function shellQuote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
-function commented(notes, marker) {
-  return (notes ?? []).map((note) => `${marker} ${note}
+function commented(notes2, marker) {
+  return (notes2 ?? []).map((note) => `${marker} ${note}
 `).join("");
 }
 function curlSnippet(options) {
-  const { baseUrl, appId, example, notes, keyExpression = "$APP_AI_GATEWAY_KEY" } = options;
+  const { baseUrl, appId, example, notes: notes2, keyExpression = "$APP_AI_GATEWAY_KEY" } = options;
   const body = example.body ? JSON.stringify(example.body) : BODY_PLACEHOLDER;
-  return commented(notes, "#") + `curl --fail-with-body ${shellQuote(exampleUrl(baseUrl, appId, example.target))} \\
+  return commented(notes2, "#") + `curl --fail-with-body ${shellQuote(exampleUrl(baseUrl, appId, example.target))} \\
   -H "Authorization: Bearer ${keyExpression}" \\
   -H 'Content-Type: application/json' \\
 ` + (example.anthropic ? "  -H 'anthropic-version: 2023-06-01' \\\n" : "") + `  -d ${shellQuote(body)}
 `;
 }
 function swiftSnippet(options) {
-  const { baseUrl, appId, example, notes, authMode = ".appAttestInstall" } = options;
+  const { baseUrl, appId, example, notes: notes2, authMode = ".appAttestInstall" } = options;
   const target = "endpoint" in example.target ? `endpointSlug: ${JSON.stringify(example.target.endpoint)}` : `provider: ${JSON.stringify(example.target.provider)},
     providerPath: ${JSON.stringify(example.target.path)}`;
   const body = example.body ? `request.httpBody = Data(${JSON.stringify(JSON.stringify(example.body))}.utf8)` : `// Supply the provider-native JSON body.
 request.httpBody = Data(${JSON.stringify(BODY_PLACEHOLDER)}.utf8)`;
-  return commented(notes, "//") + `import Foundation
+  return commented(notes2, "//") + `import Foundation
 import AppAIGateway
 
 let gateway = AppAIGatewayClient(
@@ -17082,8 +17097,8 @@ var unlimited = () => ({
   spending: { monthly_usd: null }
 });
 var policy = () => ({ allowed_paths: [], allowed_models: [] });
-function documentOf(app) {
-  return localApp({ name: app.name, config: app.config, status: app.status });
+function documentOf(app2) {
+  return localApp({ name: app2.name, config: app2.config, status: app2.status });
 }
 function localApp(value) {
   const doc = validate(AppWriteSchema, value);
@@ -17284,14 +17299,14 @@ async function appCommand(ctx, command, args, flags) {
       };
     const output = action === "add" && doc2.config.authentication.type === "api_key" ? await ctx.keyOutput(operations.createApp.path(), doc2, flags["key-output"]) : null;
     try {
-      let app;
+      let app2;
       let resolved;
       let configError;
       let key;
       if (action === "add") {
         await ctx.bootstrap();
         const created = await ctx.create("createApp", [], doc2);
-        ({ app, resolved, config_error: configError } = created.data);
+        ({ app: app2, resolved, config_error: configError } = created.data);
         if (output) {
           if (created.keyMetadata) key = created.keyMetadata;
           else {
@@ -17303,7 +17318,7 @@ async function appCommand(ctx, command, args, flags) {
                 "Inspect the app key list before retrying.",
                 3
               );
-            key = await saveKey(ctx, minted, output, app.id);
+            key = await saveKey(ctx, minted, output, app2.id);
           }
           await created.keyStored?.(key);
         }
@@ -17312,11 +17327,11 @@ async function appCommand(ctx, command, args, flags) {
         const updated = await ctx.call("updateApp", [appId2], {
           body: { ...doc2, revision }
         });
-        ({ app, resolved, config_error: configError } = updated.data);
+        ({ app: app2, resolved, config_error: configError } = updated.data);
       }
       let snippet;
       try {
-        const example = await appCommand(ctx, "app snippet", [app.id], {});
+        const example = await appCommand(ctx, "app snippet", [app2.id], {});
         if ("snippet" in example) snippet = example.snippet;
       } catch {
       }
@@ -17326,11 +17341,11 @@ async function appCommand(ctx, command, args, flags) {
 ${snippet}`;
       return {
         ...snippet ? { snippet } : {},
-        app,
+        app: app2,
         resolved,
         config_error: configError,
         ...key ? { applicationKey: key } : {},
-        guidance: doc2.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.0.0, enable App Attest, and test on a supported physical device. Run agw app snippet ${app.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : `Store the generated key on your server; never embed it in a mobile application. Run agw app snippet ${app.id} for this request again.`
+        guidance: doc2.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.0.0, enable App Attest, and test on a supported physical device. Run agw app snippet ${app2.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : `Store the generated key on your server; never embed it in a mobile application. Run agw app snippet ${app2.id} for this request again.`
       };
     } finally {
       await output?.cancel();
@@ -17339,8 +17354,8 @@ ${snippet}`;
   if (action.startsWith("key ")) {
     const sub = action.slice(4);
     const appId2 = args[0] ?? "";
-    const { data: app } = await ctx.call("getApp", [appId2]);
-    if (documentOf(app.app).config.authentication.type !== "api_key")
+    const { data: app2 } = await ctx.call("getApp", [appId2]);
+    if (documentOf(app2.app).config.authentication.type !== "api_key")
       fail(
         "invalid_input",
         "Only server applications support application keys."
@@ -17427,7 +17442,7 @@ ${snippet}`;
         ios ? "iOS applications authenticate with App Attest, which curl cannot perform." : "Swift snippets are for iOS applications.",
         `Run agw app snippet ${appId} --language ${ios ? "swift" : "curl"}.`
       );
-    const notes = [];
+    const notes2 = [];
     let example;
     if (flags.endpoint) {
       const endpoint = doc.config.endpoints?.[flags.endpoint];
@@ -17460,16 +17475,16 @@ ${snippet}`;
       const providers = requested ? reachable.filter((p) => p.slug === requested) : reachable;
       example = firstRequest(routing, providers, catalog.prices);
       if (!requested && reachable.length > 1)
-        notes.push(`This app can reach ${reachable.length} providers. Add --provider <slug> for a different one.`);
+        notes2.push(`This app can reach ${reachable.length} providers. Add --provider <slug> for a different one.`);
     }
-    notes.push(...exampleNotes(example));
+    notes2.push(...exampleNotes(example));
     const clientUrl = ctx.active?.deployment?.apiUrl ?? ctx.url;
     let snippet;
     if (ios) {
       const endUser = doc.config.authentication.type === "apple_app_attest" ? doc.config.authentication.end_user : void 0;
       const issuer = endUser?.source === "issuer";
       if (issuer)
-        notes.push(
+        notes2.push(
           "Replace yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh) with your configured issuer integration."
         );
       snippet = swiftSnippet({
@@ -17480,11 +17495,11 @@ ${snippet}`;
         notes: [
           "Swift package: https://github.com/maxceem/app-ai-gateway-swift (from: 1.0.0)",
           "Enable App Attest and test on a supported physical device.",
-          ...notes
+          ...notes2
         ]
       });
     } else {
-      snippet = curlSnippet({ baseUrl: clientUrl, appId, example, notes });
+      snippet = curlSnippet({ baseUrl: clientUrl, appId, example, notes: notes2 });
     }
     if (flags.output) {
       const output = await reserveOutput(flags.output);
@@ -17495,7 +17510,7 @@ ${snippet}`;
         await output.cancel();
       }
     }
-    return { language: ios ? "swift" : "shell", snippet, notes };
+    return { language: ios ? "swift" : "shell", snippet, notes: notes2 };
   }
   fail("unknown_command", "Unknown command.");
 }
@@ -17526,8 +17541,8 @@ var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 425, 429]);
 var RECEIPT_BOUND_STATUS = /* @__PURE__ */ new Set([409, 410]);
 function definitiveRefusal(error51) {
   if (!(error51 instanceof CliError)) return false;
-  const status = error51.details?.status;
-  return typeof status === "number" && status >= 400 && status < 500 && !RETRYABLE_STATUS.has(status) && !RECEIPT_BOUND_STATUS.has(status);
+  const status2 = error51.details?.status;
+  return typeof status2 === "number" && status2 >= 400 && status2 < 500 && !RETRYABLE_STATUS.has(status2) && !RECEIPT_BOUND_STATUS.has(status2);
 }
 var Context = class {
   store;
@@ -17627,7 +17642,7 @@ var Context = class {
         (entry) => entry.requestHash === requestHash && (entry.accountId === null || entry.accountId === this.active?.account?.id)
       ),
       (state) => {
-        const mutation = {
+        const mutation2 = {
           id: randomToken(),
           proof: randomToken(),
           requestHash,
@@ -17636,27 +17651,27 @@ var Context = class {
           path,
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        (state.mutations ??= {})[mutation.id] = mutation;
-        return mutation;
+        (state.mutations ??= {})[mutation2.id] = mutation2;
+        return mutation2;
       }
     );
   }
   async keyOutput(path, body, requestedPath) {
-    const mutation = await this.prepareCreate(path, body);
-    const chosen = requestedPath ? resolve2(requestedPath) : mutation.output?.path;
-    if (mutation.completedAt && chosen !== mutation.output?.path)
+    const mutation2 = await this.prepareCreate(path, body);
+    const chosen = requestedPath ? resolve2(requestedPath) : mutation2.output?.path;
+    if (mutation2.completedAt && chosen !== mutation2.output?.path)
       fail(
         "output_changed",
         "A completed key creation cannot move its output.",
         "Copy the protected existing file, or create a replacement with a new key name.",
         4
       );
-    const existing = chosen && chosen === mutation.output?.path ? mutation.output : void 0;
+    const existing = chosen && chosen === mutation2.output?.path ? mutation2.output : void 0;
     const output = await this.store.keyOutput(chosen, {
       reservation: existing,
       retain: true
     });
-    if (mutation.completedAt && mutation.keyMetadata?.contentHash !== await output.contentHash()) {
+    if (mutation2.completedAt && mutation2.keyMetadata?.contentHash !== await output.contentHash()) {
       await output.cancel();
       fail(
         "output_changed",
@@ -17665,15 +17680,15 @@ var Context = class {
         4
       );
     }
-    mutation.output = output.reservation;
+    mutation2.output = output.reservation;
     await this.save();
     return {
       ...output,
-      recoveryAvailable: () => Boolean(mutation.response),
-      mutation,
+      recoveryAvailable: () => Boolean(mutation2.response),
+      mutation: mutation2,
       cancel: async () => {
         await output.cancel();
-        if (!this.state.mutations?.[mutation.id])
+        if (!this.state.mutations?.[mutation2.id])
           await releaseOutput(output.reservation);
       }
     };
@@ -17694,32 +17709,32 @@ var Context = class {
       );
     const descriptor = operations[name];
     const path = descriptor.path(...params);
-    const mutation = await this.prepareCreate(path, body);
-    if (mutation.accountId === null) {
-      mutation.accountId = this.active.account?.id ?? null;
+    const mutation2 = await this.prepareCreate(path, body);
+    if (mutation2.accountId === null) {
+      mutation2.accountId = this.active.account?.id ?? null;
       await this.save();
     }
-    if (mutation.failure)
+    if (mutation2.failure)
       fail(
         "key_storage_failed",
         "This creation ended with a revoked or unverified key.",
-        `Inspect agw app key list ${mutation.failure.appId}; use a new key name to replace it.`,
+        `Inspect agw app key list ${mutation2.failure.appId}; use a new key name to replace it.`,
         4,
-        mutation.failure
+        mutation2.failure
       );
-    if (mutation.completedAt) {
-      this.deliveredMutations.add(mutation.id);
+    if (mutation2.completedAt) {
+      this.deliveredMutations.add(mutation2.id);
       return {
         // Parsed against the recorded shape, not the live one: this copy never
         // held the plaintext, so the live schema would reject it — and a state
         // file that somehow grew one is stripped again on the way out.
-        data: this.parseRecorded(name, mutation.result),
-        keyMetadata: mutation.keyMetadata,
+        data: this.parseRecorded(name, mutation2.result),
+        keyMetadata: mutation2.keyMetadata,
         complete: async () => {
         }
       };
     }
-    if (!mutation.response && Date.now() - Date.parse(mutation.createdAt) > 90 * 24 * 60 * 60 * 1e3)
+    if (!mutation2.response && Date.now() - Date.parse(mutation2.createdAt) > 90 * 24 * 60 * 60 * 1e3)
       fail(
         "resource_retry_expired",
         "This unfinished creation is older than the supported 90-day retry window.",
@@ -17727,8 +17742,8 @@ var Context = class {
         4
       );
     let data;
-    if (mutation.response !== void 0) {
-      const recovered = this.parse(name, mutation.response);
+    if (mutation2.response !== void 0) {
+      const recovered = this.parse(name, mutation2.response);
       const keyRecord = recoveredKey(name, recovered);
       if (keyRecord) {
         const appId = recoveredAppId(name, recovered, params);
@@ -17736,15 +17751,15 @@ var Context = class {
         if (!existing.keys.some(
           (key) => key.id === keyRecord.id && key.status === "active"
         )) {
-          mutation.failure = { appId, keyId: keyRecord.id, revoked: true };
-          delete mutation.response;
+          mutation2.failure = { appId, keyId: keyRecord.id, revoked: true };
+          delete mutation2.response;
           await this.save();
           fail(
             "resource_key_unavailable",
             "The recovered application key was revoked or removed.",
             "Create a replacement key with a new name; the previous creation will not be repeated.",
             4,
-            mutation.failure
+            mutation2.failure
           );
         }
       }
@@ -17753,29 +17768,29 @@ var Context = class {
       const response = await this.call(name, params, {
         body,
         headers: {
-          "Idempotency-Key": mutation.id,
-          "X-Idempotency-Proof": mutation.proof
+          "Idempotency-Key": mutation2.id,
+          "X-Idempotency-Proof": mutation2.proof
         }
       }).catch(async (error51) => {
-        await this.discard(mutation, error51);
+        await this.discard(mutation2, error51);
         throw error51;
       });
       data = response.data;
-      mutation.response = data;
+      mutation2.response = data;
       await this.save();
     }
     return {
       data,
       keyStored: async (metadata) => {
-        mutation.keyMetadata = metadata;
+        mutation2.keyMetadata = metadata;
         await this.save();
       },
       complete: async () => {
-        mutation.result = recordedResultFor[name].parse(data);
-        mutation.completedAt = (/* @__PURE__ */ new Date()).toISOString();
-        delete mutation.response;
+        mutation2.result = recordedResultFor[name].parse(data);
+        mutation2.completedAt = (/* @__PURE__ */ new Date()).toISOString();
+        delete mutation2.response;
         await this.save();
-        this.deliveredMutations.add(mutation.id);
+        this.deliveredMutations.add(mutation2.id);
       }
     };
   }
@@ -17787,9 +17802,9 @@ var Context = class {
    * different failure. The worst a failed write leaves behind is the record
    * this would have removed, which is where the CLI stood before.
    */
-  async discard(mutation, error51) {
+  async discard(mutation2, error51) {
     if (!definitiveRefusal(error51)) return;
-    delete this.state.mutations?.[mutation.id];
+    delete this.state.mutations?.[mutation2.id];
     await this.save().catch(() => {
     });
   }
@@ -17914,12 +17929,12 @@ var Context = class {
       };
       await this.save();
     }
-    const operation2 = this.state.operations[localId];
+    const operation3 = this.state.operations[localId];
     const { data: capabilities } = await this.publicCall("getCliCapabilities", [], {
       url: target
     });
     const { data } = await this.publicCall("createCliOperation", [], {
-      body: { kind, payload, pollToken: operation2.pollToken },
+      body: { kind, payload, pollToken: operation3.pollToken },
       url: target,
       ...authenticated ? { key: this.active?.credential } : {}
     });
@@ -17932,7 +17947,7 @@ var Context = class {
         "invalid_response",
         "The handoff URL is not on this deployment\u2019s trusted console origin."
       );
-    this.state.operations[data.id] = { ...operation2, phase: "pending" };
+    this.state.operations[data.id] = { ...operation3, phase: "pending" };
     delete this.state.operations[localId];
     await this.save();
     if (!this.flags["no-open"]) await openBrowser(data.url);
@@ -17946,15 +17961,15 @@ Operation: ${data.id}
     return this.wait(data.id, 300);
   }
   async poll(id) {
-    const operation2 = this.state.operations[id];
-    if (!operation2)
+    const operation3 = this.state.operations[id];
+    if (!operation3)
       fail(
         "operation_unknown",
         "This operation has no locally stored polling authorization.",
         "Resume it from the machine that initiated the operation.",
         4
       );
-    if (this.active && this.active.url !== operation2.url)
+    if (this.active && this.active.url !== operation3.url)
       fail(
         "operation_context",
         "This operation belongs to another selected deployment.",
@@ -17962,18 +17977,18 @@ Operation: ${data.id}
         4
       );
     const { data } = await this.publicCall("pollCliOperation", [id], {
-      key: operation2.pollToken,
-      url: operation2.url
+      key: operation3.pollToken,
+      url: operation3.url
     });
-    if (data.state === "completed" && !operation2.completed && operation2.kind === "claim") {
-      if ((this.state.generation ?? 0) !== operation2.generation)
+    if (data.state === "completed" && !operation3.completed && operation3.kind === "claim") {
+      if ((this.state.generation ?? 0) !== operation3.generation)
         fail(
           "operation_context",
           "The active connection changed after this operation began.",
           "Start a new login for the intended connection.",
           4
         );
-      operation2.completed = true;
+      operation3.completed = true;
       if (this.active && data.account) this.active.account = data.account;
       await this.save();
     }
@@ -18981,60 +18996,570 @@ async function deploymentCommand(ctx, command, flags, cf = new Cloudflare(), loa
   }
 }
 
+// src/style.ts
+import { Writable } from "node:stream";
+import { styleText } from "node:util";
+var STATES = /* @__PURE__ */ new Map([
+  ["active", "green"],
+  ["ready", "green"],
+  ["completed", "green"],
+  ["yes", "green"],
+  ["pending", "yellow"],
+  ["failed", "red"],
+  ["expired", "red"],
+  ["blocked", "red"],
+  ["inactive", "red"],
+  ["disabled", "red"],
+  ["revoked", "red"],
+  ["no", "red"]
+]);
+function colorEnabled(sink, env = process.env) {
+  if (env["NO_COLOR"]) return false;
+  if (!(sink instanceof Writable)) return false;
+  if (env["FORCE_COLOR"] && env["FORCE_COLOR"] !== "0") return true;
+  if (!("isTTY" in sink && sink.isTTY === true)) return false;
+  return styleText("dim", "?", { stream: sink, validateStream: true }) !== "?";
+}
+var plain = style(false);
+var styleFor = (sink) => style(colorEnabled(sink));
+function style(enabled) {
+  const paint = (format, text2) => enabled ? styleText(format, text2, { validateStream: false }) : text2;
+  const self = {
+    enabled,
+    headline: (text2) => paint("bold", text2),
+    dim: (text2) => paint("dim", text2),
+    alert: (text2) => paint("red", text2),
+    warn: (text2) => paint("yellow", text2),
+    state: (value) => {
+      const tone = STATES.get(value.toLowerCase());
+      return tone ? paint(tone, value) : value;
+    },
+    code: (text2, language) => {
+      const rule = `\u2500\u2500 ${language} \u2500\u2500`;
+      return [
+        self.dim(rule),
+        ...text2.split("\n").map((line) => self.dim(line)),
+        self.dim("\u2500".repeat(rule.length))
+      ];
+    },
+    json: (value) => JSON.stringify(value, null, 2).split("\n").map((line) => jsonLine(line, paint)).join("\n")
+  };
+  return self;
+}
+function jsonLine(line, paint) {
+  const match = /^(\s*)(?:("(?:[^"\\]|\\.)*")(: ))?(.*?)(,?)$/.exec(line);
+  if (!match) return line;
+  const [, indent = "", key, colon, value = "", comma = ""] = match;
+  const painted = value === "" ? "" : /^[[\]{}]+$/.test(value) ? paint("dim", value) : value.startsWith('"') ? value : paint("green", value);
+  return indent + (key && colon ? paint("bold", key) + paint("dim", colon) : "") + painted + (comma ? paint("dim", comma) : "");
+}
+
 // src/human.ts
-function humanResult(command, result, context) {
-  const lines = [];
-  if (command === "app snippet" && "snippet" in result && typeof result.snippet === "string")
-    return result.snippet;
-  if ("state" in result && result.state === "pending" && "url" in result) {
-    lines.push(`Waiting for browser handoff (${result.id}).`, result.url);
-    lines.push(`Resume: agw operation wait ${result.id}`);
-  } else if ("guidance" in result && "app" in result) {
-    lines.push(
-      `${command === "app add" ? "Created" : "Updated"} ${result.app.name}`,
-      `Gateway: ${context.url}`,
-      `App ID: ${result.app.id}`,
-      ""
-    );
-    const parsed = AppConfigSchema.safeParse(result.app.config);
-    if (parsed.success) {
-      const config2 = parsed.data;
-      if (config2.authentication.type === "apple_app_attest") {
-        const endUser = config2.authentication.end_user;
-        lines.push(
-          `App Attest: ${(config2.authentication.app_attest.environments ?? ["production"]).join(" + ")}`,
-          `User identity: ${endUser.source === "app_install" ? "per installation; sign-in not required" : "verified issuer; integrate your sign-in SDK"}`,
-          `Paid subscription check: ${endUser.source === "issuer" && endUser.issuer.required_claims.length ? "configured claim requirements" : "off"}`
-        );
-      } else lines.push("Authentication: server application API key");
-      const limits = config2.limits?.per_user;
-      lines.push(
-        `Per-user limits: ${limits?.requests.per_minute ?? "unlimited"} requests/minute, ${limits?.requests.per_day ?? "unlimited"}/day`
-      );
-    }
-    if (result.applicationKey)
-      lines.push(`Key saved: ${result.applicationKey.storagePath}`);
-    if (result.guidance) lines.push("", result.guidance);
-    if ("snippet" in result && result.snippet) lines.push("", result.snippet);
-  } else if (command === "provider add" || command === "provider-gateway add") {
-    const stored = "provider" in result ? result.provider : "gateway" in result ? result.gateway : void 0;
-    const label = stored?.name ?? stored?.type ?? "connection";
-    const id = stored?.id ?? ("id" in result ? result.id : void 0);
-    lines.push(
-      `Stored ${label} (${id}).`,
-      `Gateway: ${context.url}`,
-      "Credential stored; no upstream probe or inference was performed."
-    );
-  } else if ("output" in result && typeof result.output === "string") {
-    lines.push(`Saved: ${result.output}`);
-  } else lines.push(JSON.stringify(result, null, 2));
-  if (context.accountId) lines.push(`Account: ${context.accountId}`);
+function kv(entries, style2) {
+  const rows = [];
+  for (const [key, value] of entries)
+    if (value !== void 0 && value !== null) rows.push([key, String(value)]);
+  const width = Math.max(0, ...rows.map(([key]) => key.length + 1));
+  return rows.map(
+    ([key, value]) => style2.dim(`${key}:`.padEnd(width + 1)) + style2.state(value)
+  );
+}
+function table(headers, rows, style2) {
+  const widths = headers.map(
+    (header, column) => Math.max(header.length, ...rows.map((row) => (row[column] ?? "").length))
+  );
+  const line = (cells, tone) => cells.map(
+    (cell, column) => tone(cell) + (column === widths.length - 1 ? "" : " ".repeat((widths[column] ?? 0) + 2 - cell.length))
+  ).join("").trimEnd();
+  return [
+    line(headers, (cell) => style2.dim(cell)),
+    ...rows.map((row) => line(row, (cell) => style2.state(cell)))
+  ];
+}
+var yesNo = (value) => value ? "yes" : "no";
+function humanResult(command, result, context, style2 = plain) {
+  if (command === "app snippet" && "snippet" in result && typeof result.snippet === "string") {
+    if (!style2.enabled) return result.snippet;
+    const language = "language" in result ? result.language : "code";
+    return style2.code(result.snippet, language).join("\n") + "\n";
+  }
+  const lines = render(command, result, context, style2);
   if ("trial" in result && result.trial)
     lines.push(`Free access ends: ${result.trial.endsAt}`);
   if ("account" in result && result.account?.expiresAt)
     lines.push(`Recovery deadline: ${result.account.expiresAt}`);
   return lines.join("\n") + "\n";
 }
+function render(command, result, context, style2) {
+  if ("state" in result && result.state === "pending" && "url" in result)
+    return [
+      style2.headline(`Waiting for browser handoff (${result.id}).`),
+      result.url,
+      `Resume: agw operation wait ${result.id}`
+    ];
+  switch (command) {
+    case "account status":
+    case "account login":
+    case "account claim":
+    case "deployment connect":
+    case "deployment status":
+      return status(command, result, context, style2);
+    case "provider types":
+    case "provider-gateway types":
+    case "provider list":
+    case "provider-gateway list":
+    case "app list":
+    case "app key list":
+      return list(command, result, style2);
+    case "provider show":
+    case "provider-gateway show":
+    case "app show":
+      return show(command, result, style2);
+    case "provider update":
+    case "provider-gateway update":
+    case "provider rotate-key":
+    case "provider-gateway rotate-key":
+    case "provider add":
+    case "provider-gateway add":
+    case "provider remove":
+    case "provider-gateway remove":
+    case "app remove":
+    case "app key add":
+    case "app key revoke":
+    case "account logout":
+      return mutation(command, result, context, style2);
+    case "usage show":
+    case "usage breakdown":
+      return usage(command, result, style2);
+    case "operation status":
+    case "operation wait":
+      return operation2(result, style2);
+    case "app add":
+    case "app update":
+    case "app validate":
+    case "app check":
+    case "app snippet":
+      return app(command, result, context, style2);
+    case "deployment setup":
+    case "deployment update":
+    case "deployment domain":
+      return deployment(result, style2);
+  }
+}
+function status(command, result, context, style2) {
+  const did = command === "account login" ? [style2.headline(`Signed in to ${context.url}.`)] : command === "deployment connect" ? [style2.headline(`Connected to ${context.url}.`)] : [];
+  if ("billing" in result)
+    return [
+      ...did,
+      ...kv(
+        [
+          ["Gateway", context.url],
+          ["Account", `${result.account.name} (${result.account.id})`],
+          ["Claimed", yesNo(result.account.claimed)],
+          ["Deployment", result.deployment.mode === "cloud" ? "cloud" : "self-hosted"],
+          ["Console", result.deployment.consoleOrigin]
+        ],
+        style2
+      )
+    ];
+  if ("protocolVersion" in result)
+    return [
+      ...did,
+      ...kv(
+        [
+          ["Gateway", result.url],
+          ["Connected", yesNo(result.connected)],
+          ["Authenticated", yesNo(result.authenticated)],
+          ["Version", result.serverVersion],
+          ["Deployment", result.deployment.mode === "cloud" ? "cloud" : "self-hosted"],
+          ["Console", result.consoleOrigin],
+          ["Provider types", result.providers.length],
+          ["Provider gateway types", result.providerGateways.length]
+        ],
+        style2
+      )
+    ];
+  if ("state" in result) return [...did, ...operation2(result, style2)];
+  return [...did, style2.json(result)];
+}
+function list(command, result, style2) {
+  if (command === "provider types" || command === "provider-gateway types") {
+    if (!Array.isArray(result)) return [style2.json(result)];
+    const types = result;
+    if (!types.length) return ["No types."];
+    return table(
+      ["TYPE", "NAME", "BASE URL"],
+      types.map((entry) => [entry.type, entry.name, "baseUrl" in entry ? entry.baseUrl : ""]),
+      style2
+    );
+  }
+  if (command === "provider list") {
+    if (!("providers" in result) || "appId" in result || "protocolVersion" in result)
+      return [style2.json(result)];
+    if (!result.providers.length) return ["No providers."];
+    return table(
+      ["ID", "SLUG", "TYPE", "NAME", "STATUS", "CREATED"],
+      result.providers.map((provider) => [
+        provider.id,
+        provider.slug,
+        provider.type,
+        provider.name,
+        provider.status,
+        provider.createdAt
+      ]),
+      style2
+    );
+  }
+  if (command === "provider-gateway list" && "gateways" in result) {
+    if (!result.gateways.length) return ["No provider gateways."];
+    return table(
+      ["ID", "TYPE", "NAME", "STATUS", "PROVIDERS", "CREATED"],
+      result.gateways.map((gateway) => [
+        gateway.id,
+        gateway.type,
+        gateway.name,
+        gateway.status,
+        String(gateway.providerCount),
+        gateway.createdAt
+      ]),
+      style2
+    );
+  }
+  if (command === "app list" && "apps" in result && !("totals" in result)) {
+    if (!result.apps.length) return ["No apps."];
+    return table(
+      ["ID", "NAME", "AUTH", "STATUS", "PROVIDERS", "CREATED"],
+      result.apps.map((entry) => [
+        entry.id,
+        entry.name,
+        entry.authentication_type,
+        entry.status,
+        String(entry.providers.length),
+        entry.created_at
+      ]),
+      style2
+    );
+  }
+  if (command === "app key list" && "keys" in result && "app_id" in result) {
+    if (!result.keys.length) return [`No keys for ${result.app_id}.`];
+    return table(
+      ["ID", "NAME", "PREFIX", "STATUS", "CREATED", "LAST USED"],
+      result.keys.map((key) => [
+        key.id,
+        key.name,
+        key.key_prefix,
+        key.status,
+        key.created_at,
+        key.last_used_at ?? "never"
+      ]),
+      style2
+    );
+  }
+  return [style2.json(result)];
+}
+function show(command, result, style2) {
+  if (command === "app show" && "app" in result && !("guidance" in result)) {
+    const lines = [style2.headline(`${result.app.name} (${result.app.id})`)];
+    if (result.config_error)
+      lines.push(style2.alert(`Configuration error: ${result.config_error}`));
+    return [...lines, "", style2.json(result)];
+  }
+  if ("slug" in result)
+    return [
+      style2.headline(`${result.name} (${result.id}), type ${result.type}, slug ${result.slug}`),
+      "",
+      style2.json(result)
+    ];
+  if ("referencedCount" in result)
+    return [
+      style2.headline(`${result.name} (${result.id}), type ${result.type}`),
+      "",
+      style2.json(result)
+    ];
+  return [style2.json(result)];
+}
+function mutation(command, result, context, style2) {
+  if ("loggedOut" in result)
+    return [
+      style2.headline(`Signed out of ${context.url}.`) + " The stored credential was removed."
+    ];
+  if ("deleted" in result) {
+    if ("provider_id" in result)
+      return [style2.headline(`Removed provider ${result.provider_id}.`)];
+    if ("provider_gateway_id" in result)
+      return [style2.headline(`Removed provider gateway ${result.provider_gateway_id}.`)];
+    return [
+      style2.headline(`Removed app ${result.app_id}.`) + ` ${result.removed_users} users removed; usage events retained.`
+    ];
+  }
+  if ("key" in result)
+    return [
+      style2.headline(
+        `Revoked key ${result.key.name} (${result.key.id}) for app ${result.app_id}.`
+      )
+    ];
+  if ("applicationKey" in result && "appId" in result)
+    return [
+      style2.headline(
+        `Created key ${result.applicationKey.name} (${result.applicationKey.id}) for app ${result.appId}.`
+      ),
+      ...kv([["Key saved", result.applicationKey.storagePath]], style2)
+    ];
+  if ("provider" in result) {
+    const added = command === "provider add";
+    return [
+      style2.headline(
+        `${added ? "Stored" : "Updated"} provider ${result.provider.name} (${result.provider.id}).`
+      ),
+      ...kv(
+        [
+          ["Gateway", context.url],
+          ["Status", result.provider.status],
+          ["Key hint", result.provider.secretHint]
+        ],
+        style2
+      ),
+      ...added ? ["Credential stored; no upstream probe or inference was performed."] : []
+    ];
+  }
+  if ("gateway" in result) {
+    const added = command === "provider-gateway add";
+    return [
+      style2.headline(
+        `${added ? "Stored" : "Updated"} provider gateway ${result.gateway.name} (${result.gateway.id}).`
+      ),
+      ...kv(
+        [
+          ["Gateway", context.url],
+          ["Status", result.gateway.status],
+          ["Token hint", result.gateway.secretHint]
+        ],
+        style2
+      ),
+      ...added ? ["Credential stored; no upstream probe or inference was performed."] : []
+    ];
+  }
+  return [style2.json(result)];
+}
+function usage(command, result, style2) {
+  if (command === "usage breakdown" && "rows" in result) {
+    const head = kv(
+      [
+        ["App", result.app_id],
+        ["Grouped by", result.by],
+        ["Period", `${result.from} to ${result.to}`]
+      ],
+      style2
+    );
+    const rows = result.rows.length ? table(
+      ["KEY", "REQUESTS", "INPUT", "OUTPUT", "COST USD", "ERRORS", "BLOCKED"],
+      result.rows.map((row) => [
+        row.key ?? "(none)",
+        String(row.requests),
+        String(row.input_tokens),
+        String(row.output_tokens),
+        row.cost_usd.toFixed(4),
+        String(row.errors),
+        String(row.blocked)
+      ]),
+      style2
+    ) : ["No usage in this period."];
+    return [...head, "", ...rows, "", result.coverage.source];
+  }
+  if ("totals" in result)
+    return [
+      ...kv(
+        [
+          ["Month", result.month],
+          ["Requests", result.totals.requests],
+          ["Input tokens", result.totals.input_tokens],
+          ["Output tokens", result.totals.output_tokens],
+          ["Cost USD", result.totals.cost_usd.toFixed(4)],
+          ["Errors", result.totals.errors],
+          ["Blocked", result.totals.blocked]
+        ],
+        style2
+      ),
+      "",
+      // The totals are the sum of these rows, so the apps they came from are
+      // printed rather than counted: a month is read to find which app spent it.
+      ...result.apps.length ? table(
+        ["APP", "REQUESTS", "INPUT", "OUTPUT", "COST USD", "ERRORS", "BLOCKED"],
+        result.apps.map((entry) => [
+          entry.deleted ? `${entry.appId} (deleted)` : entry.appId,
+          String(entry.requests),
+          String(entry.input_tokens),
+          String(entry.output_tokens),
+          entry.cost_usd.toFixed(4),
+          String(entry.errors),
+          String(entry.blocked)
+        ]),
+        style2
+      ) : ["No app usage recorded."],
+      "",
+      result.coverage.historicalAttribution
+    ];
+  if ("requests" in result)
+    return kv(
+      [
+        ["App", result.app_id],
+        ["Month", result.month],
+        ["Requests", result.requests],
+        ["Input tokens", result.input_tokens],
+        ["Cached input tokens", result.cached_input_tokens],
+        ["Cache write tokens", result.cache_write_tokens],
+        ["Output tokens", result.output_tokens],
+        ["Cost USD", result.cost_usd.toFixed(4)]
+      ],
+      style2
+    );
+  return [style2.json(result)];
+}
+function operation2(result, style2) {
+  if (!("state" in result)) return [style2.json(result)];
+  const stored = "result" in result ? result.result : void 0;
+  return kv(
+    [
+      ["Operation", result.id],
+      ["State", result.state],
+      ["Expires", result.expiresAt],
+      ["Account", stored?.accountId],
+      ["Provider", stored?.provider && `${stored.provider.name} (${stored.provider.id})`],
+      ["Provider gateway", stored?.gateway && `${stored.gateway.name} (${stored.gateway.id})`]
+    ],
+    style2
+  );
+}
+function app(command, result, context, style2) {
+  if ("output" in result) return [style2.headline(`Saved: ${result.output}`)];
+  if ("ready" in result)
+    return [
+      style2.headline(
+        `${result.appId} is ${result.ready ? "ready to serve requests" : "not ready to serve requests"}.`
+      ),
+      ...kv(
+        [
+          ["Status", result.status],
+          ["Providers", result.providers.length],
+          ["Active providers", result.providers.filter((p) => p.status === "active").length]
+        ],
+        style2
+      ),
+      ...notes([
+        ...result.validation.remote ? [] : result.validation.skipped,
+        ...result.limitations
+      ])
+    ];
+  if ("definition" in result) {
+    const dryRun = "dryRun" in result;
+    return [
+      style2.headline(
+        `${dryRun ? "Dry run: " : ""}${result.definition.name} is valid${result.validation.remote ? " here and on the gateway" : " locally"}.`
+      ),
+      ...kv(
+        [
+          ["Gateway", context.url],
+          ["Status", result.definition.status],
+          ["Authentication", result.definition.config.authentication.type],
+          ["App ID", result.validation.remote ? result.validation.app_id : void 0]
+        ],
+        style2
+      ),
+      ...notes(result.validation.remote ? [] : result.validation.skipped),
+      ...dryRun ? ["", "Nothing was written."] : []
+    ];
+  }
+  if ("guidance" in result && "app" in result)
+    return written(command, result, context, style2);
+  return [style2.json(result)];
+}
+var notes = (values) => values.length ? ["", ...values.map((value) => `- ${value}`)] : [];
+function written(command, result, context, style2) {
+  const parsed = AppConfigSchema.safeParse(result.app.config);
+  const details = [];
+  let language = "shell";
+  if (parsed.success) {
+    const config2 = parsed.data;
+    if (config2.authentication.type === "apple_app_attest") {
+      language = "swift";
+      const endUser = config2.authentication.end_user;
+      details.push(
+        [
+          "App Attest",
+          (config2.authentication.app_attest.environments ?? ["production"]).join(" + ")
+        ],
+        [
+          "User identity",
+          endUser.source === "app_install" ? "per installation; sign-in not required" : "verified issuer; integrate your sign-in SDK"
+        ],
+        [
+          "Paid subscription check",
+          endUser.source === "issuer" && endUser.issuer.required_claims.length ? "configured claim requirements" : "off"
+        ]
+      );
+    } else details.push(["Authentication", "server application API key"]);
+    const limits = config2.limits?.per_user;
+    details.push([
+      "Per-user limits",
+      `${limits?.requests.per_minute ?? "unlimited"} requests/minute, ${limits?.requests.per_day ?? "unlimited"}/day`
+    ]);
+  }
+  if (result.applicationKey)
+    details.push(["Key saved", result.applicationKey.storagePath]);
+  return [
+    style2.headline(
+      `${command === "app add" ? "Created" : "Updated"} app ${result.app.name} (${result.app.id}).`
+    ),
+    ...kv([["Gateway", context.url], ...details], style2),
+    ...result.guidance ? ["", result.guidance] : [],
+    ..."snippet" in result && result.snippet ? ["", ...style2.code(result.snippet, language)] : []
+  ];
+}
+function deployment(result, style2) {
+  if ("hostname" in result)
+    return kv(
+      [
+        [result.dryRun ? "Would attach domain" : "Domain", result.hostname],
+        ["Worker", result.worker],
+        ["Cloudflare account", result.accountId],
+        ["Zone", result.zoneId],
+        ["Previous URL", result.previousUrl],
+        ["URL", result.url],
+        ["Note", result.note]
+      ],
+      style2
+    );
+  if ("fromVersion" in result)
+    return kv(
+      [
+        [result.dryRun ? "Would update worker" : "Worker", result.worker],
+        ["Cloudflare account", result.accountId],
+        ["Database", result.databaseId],
+        ["From version", result.fromVersion],
+        ["To version", result.toVersion],
+        ["Updated", result.updated ? "yes" : void 0]
+      ],
+      style2
+    );
+  if ("installed" in result || "resources" in result)
+    return kv(
+      [
+        [result.dryRun ? "Would install worker" : "Worker", result.name],
+        ["Cloudflare account", result.accountId],
+        ["URL", result.url],
+        ["Version", result.version],
+        ["Domain", result.domain],
+        ["Pending domain", result.pendingDomain],
+        ["Deployment", result.deploymentId],
+        ["Resources", result.resources?.join(", ")],
+        ["Backup", result.backup],
+        ["Installed", result.installed ? "yes" : void 0],
+        ["Note", result.note]
+      ],
+      style2
+    );
+  return [style2.json(result)];
+}
 
 // src/transport.ts
 var MESSAGE_LIMIT = 300;
@@ -19062,11 +19587,11 @@ var LIMIT_CODES = [
 ];
 var LIMIT_TEXT_FIELDS = ["scope", "resetAt"];
 var LIMIT_NUMBER_FIELDS = ["limit", "used", "windowSeconds", "retryAfterSeconds"];
-function nextActionFor(status, code, details) {
-  if (status === 401) return "Run agw account login.";
+function nextActionFor(status2, code, details) {
+  if (status2 === 401) return "Run agw account login.";
   if (code === "billing_plan_limit_reached")
     return "Delete one you no longer need, or move to a plan whose limits are higher.";
-  if (status === 429) {
+  if (status2 === 429) {
     const seconds = details.retryAfterSeconds;
     if (seconds === void 0)
       return "Wait for the limit named in the message to reset, then run the same command again.";
@@ -19184,7 +19709,7 @@ async function usageCommand(ctx, command, flags) {
     const m = month(flags.month ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 7));
     return flags.app ? (await ctx.call("getAppUsage", [flags.app, { month: m }])).data : (await ctx.call("getCliUsage", [{ month: m }])).data;
   }
-  const app = await required2(flags, "app");
+  const app2 = await required2(flags, "app");
   const by = flags.by ?? "model";
   if (!["provider", "model", "status"].includes(by))
     fail("invalid_input", "--by must be provider, model or status.");
@@ -19196,7 +19721,7 @@ async function usageCommand(ctx, command, flags) {
   if (from > to) fail("invalid_input", "--from must not be later than --to.");
   const limit = positive(flags.limit ?? 50, 200);
   return {
-    ...(await ctx.call("getAppUsageBreakdown", [app, { from, to, by, limit }])).data,
+    ...(await ctx.call("getAppUsageBreakdown", [app2, { from, to, by, limit }])).data,
     coverage: {
       from,
       to,
@@ -19250,7 +19775,8 @@ async function execute(parsed, ctx) {
 async function main(argv = process.argv.slice(2), {
   store = new StateStore(),
   transport = new Transport(),
-  stdout = process.stdout
+  stdout = process.stdout,
+  stderr: stderr2 = process.stderr
 } = {}) {
   const json2 = argv.includes("--json");
   try {
@@ -19274,8 +19800,8 @@ async function main(argv = process.argv.slice(2), {
       };
       const rendered = ctx.onboarding ? { ...result, ...ctx.onboarding } : result;
       const output = { schemaVersion: 1, ok: true, context, result: rendered };
-      const text2 = json2 ? JSON.stringify(output) + "\n" : humanResult(parsed.command, rendered, context);
-      if (stdout instanceof Writable) {
+      const text2 = json2 ? JSON.stringify(output) + "\n" : humanResult(parsed.command, rendered, context, styleFor(stdout));
+      if (stdout instanceof Writable2) {
         await new Promise(
           (resolve3, reject2) => stdout.write(
             text2,
@@ -19297,17 +19823,27 @@ async function main(argv = process.argv.slice(2), {
       4
     );
     const details = e.details ? CliErrorDetailsSchema.safeParse(e.details) : void 0;
-    const output = {
-      schemaVersion: 1,
-      ok: false,
-      error: {
-        code: e.code,
-        message: e.message,
-        nextAction: e.nextAction,
-        ...details?.success ? { details: details.data } : {}
-      }
+    const reported2 = {
+      code: e.code,
+      message: e.message,
+      nextAction: e.nextAction,
+      ...details?.success ? { details: details.data } : {}
     };
-    stdout.write(JSON.stringify(output, null, json2 ? void 0 : 2) + "\n");
+    if (json2) {
+      stdout.write(
+        JSON.stringify({ schemaVersion: 1, ok: false, error: reported2 }) + "\n"
+      );
+      return e.exitCode;
+    }
+    const style2 = styleFor(stderr2);
+    const lines = [
+      style2.alert(`Error: ${e.message}`),
+      style2.warn(`Next: ${e.nextAction}`),
+      style2.dim(`Code: ${e.code}`)
+    ];
+    for (const [key, value] of Object.entries(reported2.details ?? {}))
+      lines.push(`  ${style2.dim(`${key}:`)} ${String(value)}`);
+    stderr2.write(lines.join("\n") + "\n");
     return e.exitCode;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "type": "module",
   "description": "Manage App AI Gateway from a terminal or coding agent: providers, iOS and server apps, usage, and self-hosted deployment on Cloudflare",
   "keywords": [
@@ -25,7 +25,18 @@
     "directory": "cli"
   },
   "bugs": "https://github.com/maxceem/app-ai-gateway/issues",
-  "upgradeFrom": ["0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"],
+  "upgradeFrom": [
+    "0.1.9",
+    "0.1.8",
+    "0.1.7",
+    "0.1.6",
+    "0.1.5",
+    "0.1.4",
+    "0.1.3",
+    "0.1.2",
+    "0.1.1",
+    "0.1.0"
+  ],
   "license": "Apache-2.0",
   "bin": {
     "agw": "dist/agw.mjs"