@mondaydotcomorg/z2h-cli 0.13.0 → 0.13.2

package/dist/esm/util/tags.mjs

@@ -0,0 +1,63 @@
+import { brokerBaseUrl, routingHeaders } from '../constants.mjs';
+import { readZthAuth } from './auth/auth-store.mjs';
+
+/** The tag dimensions, in prompt order. */
+const TAG_TYPES = ['app_type', 'team'];
+/** Human labels for each dimension (CLI prompts / output). */
+const TAG_TYPE_LABELS = {
+    app_type: 'App type',
+    team: 'Team',
+};
+/**
+ * Authenticated request to the bigbrain-zth tag endpoints. Mirrors the Bearer
+ * pattern used by the STS broker / lock-release calls, with network-error
+ * wrapping, auth-failure guidance, and response-body inclusion on failure.
+ */
+async function tagFetch(method, path, body) {
+    const { token } = await readZthAuth();
+    let res;
+    try {
+        res = await fetch(`${brokerBaseUrl()}${path}`, {
+            method,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/json',
+                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+                ...routingHeaders(),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Z2H tag request failed: ${message}`);
+    }
+    if (res.status === 401 || res.status === 403) {
+        throw new Error(`Z2H tag request rejected by the broker (${res.status}). Refresh your token by running 'z2h-cli generate-z2h-token'.`);
+    }
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Z2H tag request returned ${res.status}: ${text.slice(0, 1024)}`);
+    }
+    return res;
+}
+/** The full closed tag catalog (app types + teams), with usage counts. */
+async function fetchTagCatalog() {
+    const res = await tagFetch('GET', '/z2h-cli/tags');
+    const data = (await res.json());
+    return data.tags ?? [];
+}
+/** Tags currently assigned to an app (bare slug). */
+async function fetchAppTags(appSlug) {
+    const res = await tagFetch('GET', `/z2h-cli/tags/${encodeURIComponent(appSlug)}`);
+    const data = (await res.json());
+    return data.tags ?? [];
+}
+/** Full-replace an app's tag set; returns the resulting tags. */
+async function setAppTags(appSlug, tags) {
+    const res = await tagFetch('PUT', `/z2h-cli/tags/${encodeURIComponent(appSlug)}`, { tags });
+    const data = (await res.json());
+    return data.tags ?? [];
+}
+
+export { TAG_TYPES, TAG_TYPE_LABELS, fetchAppTags, fetchTagCatalog, setAppTags };

package/dist/index.js

@@ -8,11 +8,13 @@ const commands_dev = require('./commands/dev.js');
 const commands_build = require('./commands/build.js');
 const commands_clean = require('./commands/clean.js');
 const commands_deploy = require('./commands/deploy.js');
+const commands_delete = require('./commands/delete.js');
 const commands_grant = require('./commands/grant.js');
 const commands_createWorkspace = require('./commands/create-workspace.js');
 const commands_create = require('./commands/create.js');
 const commands_generateZ2hToken = require('./commands/generate-z2h-token.js');
 const commands_migrate = require('./commands/migrate.js');
+const commands_tag = require('./commands/tag.js');
 const commands_edit = require('./commands/edit.js');
 const util_logger = require('./util/logger.js');
 const util_tracker = require('./util/tracker.js');
@@ -43,6 +45,10 @@ function stripConflictingEnvVars() {
         delete process.env[name];
     }
 }
+/** commander collector for a repeatable `--tag` option. */
+function collectTag(value, previous) {
+    return previous.concat(value);
+}
 async function main() {
     stripConflictingEnvVars();
     const program = new commander.Command();
@@ -115,6 +121,21 @@ async function main() {
             await util_logger.fail(`deploy failed: ${err.message}`, { command: 'deploy' }, 2);
         }
     });
+    program
+        .command('tag [app-name]')
+        .description("Set an app's category tags — app type & team (interactive unless --tag or --json is given)")
+        .option('--tag <tag>', 'set a tag (repeatable); full-replaces the tag set non-interactively', collectTag, [])
+        .option('--json', "read-only: print the popular catalog + the app's current tags as JSON (no prompt)")
+        .action(async (appName, opts) => {
+        try {
+            await util_tracker.trackDuration('z2h_app_tag_success', () => commands_tag.tagCommand(appName, opts), {
+                app_name: appName ?? util_appName.getCwdAppName(),
+            });
+        }
+        catch (err) {
+            await util_logger.fail(`tag failed: ${err.message}`, { command: 'tag' }, 1);
+        }
+    });
     program
         .command('create-workspace')
         .description(`Bootstrap the ${util_workspace.getWorkspaceHome()}/ yarn workspace (one-time setup)`)
@@ -214,6 +235,21 @@ async function main() {
             await util_logger.fail(`transfer-owner failed: ${err.message}`, { command: 'transfer-owner' }, 1);
         }
     });
+    program
+        .command('delete')
+        .description('Permanently delete the current app and take it offline (owners/admins only)')
+        .option('--yes', 'skip the confirmation prompt (required for --json / non-interactive)')
+        .option('--json', 'emit structured JSON on stdout')
+        .action(async (opts) => {
+        try {
+            await util_tracker.trackDuration('z2h_app_delete_success', () => commands_delete.deleteCommand(opts), {
+                app_name: util_appName.getCwdAppName(),
+            });
+        }
+        catch (err) {
+            await util_logger.fail(`delete failed: ${err.message}`, { command: 'delete' }, 1);
+        }
+    });
     program
         .command('migrate')
         .description('Run pending workspace migrations')

package/dist/util/git/repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../../src/util/git/repo.ts"],"names":[],"mappings":"AAkBA,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAKD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAI3E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/D;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5G;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAclE;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAe7F;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB3F;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO7D;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5D"}
+{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../../src/util/git/repo.ts"],"names":[],"mappings":"AAkBA,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAKD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAI3E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/D;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5G;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAclE;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7F;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB3F;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO7D;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5D"}

package/dist/util/git/repo.js

@@ -76,6 +76,16 @@ async function safeBackupIfDirty(dir) {
 }
 async function pullAndResolve(dir, env) {
     const gitEnv = env ? { ...process.env, ...env } : undefined;
+    // If the remote has no master branch there's nothing to pull — treat it as a
+    // first deploy and let the subsequent push create it. This covers a brand-new
+    // remote as well as one whose objects were removed (e.g. the app was deleted,
+    // wiping its S3 git prefix), which would otherwise surface as a bogus conflict.
+    const hasRemoteMaster = await execGit(['ls-remote', '--heads', 'origin', 'master'], dir, gitEnv)
+        .then(r => Boolean(r.stdout.trim()))
+        .catch(() => false);
+    if (!hasRemoteMaster) {
+        return;
+    }
     try {
         await execGit(['pull', '--ff-only'], dir, gitEnv);
     }

package/dist/util/tags.d.ts

@@ -0,0 +1,24 @@
+/** The dimension a tag categorizes an app by. */
+export type TagType = 'app_type' | 'team';
+/** The tag dimensions, in prompt order. */
+export declare const TAG_TYPES: TagType[];
+/** Human labels for each dimension (CLI prompts / output). */
+export declare const TAG_TYPE_LABELS: Record<TagType, string>;
+/** A catalog entry: one selectable tag with its dimension + global usage count. */
+export interface CatalogEntry {
+    name: string;
+    type: TagType;
+    count: number;
+}
+/** A tag assigned to an app — name + dimension. */
+export interface AppTag {
+    name: string;
+    type: TagType;
+}
+/** The full closed tag catalog (app types + teams), with usage counts. */
+export declare function fetchTagCatalog(): Promise<CatalogEntry[]>;
+/** Tags currently assigned to an app (bare slug). */
+export declare function fetchAppTags(appSlug: string): Promise<AppTag[]>;
+/** Full-replace an app's tag set; returns the resulting tags. */
+export declare function setAppTags(appSlug: string, tags: string[]): Promise<AppTag[]>;
+//# sourceMappingURL=tags.d.ts.map

package/dist/util/tags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../../src/util/tags.ts"],"names":[],"mappings":"AAGA,iDAAiD;AACjD,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAE1C,2CAA2C;AAC3C,eAAO,MAAM,SAAS,EAAE,OAAO,EAAyB,CAAC;AAEzD,8DAA8D;AAC9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAGnD,CAAC;AAEF,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mDAAmD;AACnD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;CACf;AAgDD,0EAA0E;AAC1E,wBAAsB,eAAe,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAI/D;AAED,qDAAqD;AACrD,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAIrE;AAED,iEAAiE;AACjE,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAInF"}

package/dist/util/tags.js

@@ -0,0 +1,69 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const constants = require('../constants.js');
+const util_auth_authStore = require('./auth/auth-store.js');
+
+/** The tag dimensions, in prompt order. */
+const TAG_TYPES = ['app_type', 'team'];
+/** Human labels for each dimension (CLI prompts / output). */
+const TAG_TYPE_LABELS = {
+    app_type: 'App type',
+    team: 'Team',
+};
+/**
+ * Authenticated request to the bigbrain-zth tag endpoints. Mirrors the Bearer
+ * pattern used by the STS broker / lock-release calls, with network-error
+ * wrapping, auth-failure guidance, and response-body inclusion on failure.
+ */
+async function tagFetch(method, path, body) {
+    const { token } = await util_auth_authStore.readZthAuth();
+    let res;
+    try {
+        res = await fetch(`${constants.brokerBaseUrl()}${path}`, {
+            method,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/json',
+                ...(body === undefined ? {} : { 'Content-Type': 'application/json' }),
+                ...constants.routingHeaders(),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Z2H tag request failed: ${message}`);
+    }
+    if (res.status === 401 || res.status === 403) {
+        throw new Error(`Z2H tag request rejected by the broker (${res.status}). Refresh your token by running 'z2h-cli generate-z2h-token'.`);
+    }
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Z2H tag request returned ${res.status}: ${text.slice(0, 1024)}`);
+    }
+    return res;
+}
+/** The full closed tag catalog (app types + teams), with usage counts. */
+async function fetchTagCatalog() {
+    const res = await tagFetch('GET', '/z2h-cli/tags');
+    const data = (await res.json());
+    return data.tags ?? [];
+}
+/** Tags currently assigned to an app (bare slug). */
+async function fetchAppTags(appSlug) {
+    const res = await tagFetch('GET', `/z2h-cli/tags/${encodeURIComponent(appSlug)}`);
+    const data = (await res.json());
+    return data.tags ?? [];
+}
+/** Full-replace an app's tag set; returns the resulting tags. */
+async function setAppTags(appSlug, tags) {
+    const res = await tagFetch('PUT', `/z2h-cli/tags/${encodeURIComponent(appSlug)}`, { tags });
+    const data = (await res.json());
+    return data.tags ?? [];
+}
+
+exports.TAG_TYPES = TAG_TYPES;
+exports.TAG_TYPE_LABELS = TAG_TYPE_LABELS;
+exports.fetchAppTags = fetchAppTags;
+exports.fetchTagCatalog = fetchTagCatalog;
+exports.setAppTags = setAppTags;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/commands/delete.ts

@@ -0,0 +1,63 @@
+import { createInterface } from 'node:readline';
+import { output, info, setOutputMode } from '../util/logger';
+import { getCwdAppName, cleanAppName, mfAppName } from '../util/app-name';
+import { brokerBaseUrl, routingHeaders } from '../constants';
+import { readZthAuth } from '../util/auth/auth-store';
+
+export interface DeleteOptions {
+  yes?: boolean;
+  json?: boolean;
+}
+
+// Type-the-app-name confirmation. The caller must retype the de-scoped app
+// name (what they see in the URL) to guard against accidental deletes.
+async function confirmByName(appSlug: string): Promise<boolean> {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise<string>(resolve => {
+    rl.question(
+      `This permanently deletes "${appSlug}" and takes it offline. This cannot be undone.\n` +
+        `Type the app name to confirm: `,
+      resolve
+    );
+  });
+  rl.close();
+  return answer.trim() === appSlug;
+}
+
+// Should be run from the consumer app directory — uses process.cwd() to locate it.
+export async function deleteCommand(opts: DeleteOptions = {}): Promise<void> {
+  if (opts.json) {
+    setOutputMode('json');
+  }
+
+  const cwdName = getCwdAppName();
+  if (!cwdName) {
+    throw new Error('Run this from inside a consumer app directory (the one with your package.json).');
+  }
+  const appSlug = cleanAppName(cwdName); // user-facing name (matches the bigbrain.me URL)
+  const appName = mfAppName(cwdName); // canonical mf- bundle name the backend keys on
+
+  // Confirmation. --json is always non-interactive, so it requires --yes.
+  if (!opts.yes) {
+    if (opts.json || !process.stdin.isTTY) {
+      throw new Error('Refusing to delete without confirmation — pass --yes to delete non-interactively.');
+    }
+    if (!(await confirmByName(appSlug))) {
+      throw new Error(`Name did not match "${appSlug}" — aborted, nothing was deleted.`);
+    }
+  }
+
+  const { token } = await readZthAuth();
+
+  info(`deleting "${appName}"`);
+  const res = await fetch(`${brokerBaseUrl()}/z2h-apps/${encodeURIComponent(appName)}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${token}`, ...routingHeaders() },
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Delete failed (${res.status}): ${text.slice(0, 1024)}`);
+  }
+
+  output(`[z2h-cli] "${appName}" deleted ✅ — it is now offline.`, { ok: true, appName, deleted: true });
+}

package/src/commands/deploy.ts

@@ -2,8 +2,9 @@ import path from 'node:path';
 import os from 'node:os';
 import { createInterface } from 'node:readline';
 import { pathExists, readJson } from 'fs-extra';
-import { info, output, setOutputMode, warn } from '../util/logger';
+import { info, warn, output, setOutputMode, getOutputMode } from '../util/logger';
 import { resolveConsumerPaths } from '../shadow/paths';
+import { fetchAppTags, fetchTagCatalog, setAppTags } from '../util/tags';
 import { type AssetManifestFile, type ManifestEntry } from '../util/manifest';
 import { uploadDir } from '../util/s3/upload';
 import { BUCKET_WRITE_NAME, BUCKET_READ_DNS_URL, brokerBaseUrl, routingHeaders } from '../constants';
@@ -15,6 +16,7 @@ import { getRemoteUrl, guardCleanTree, pullAndResolve, pushToRemote, initRepo }
 import { resolveGitEnv } from '../util/git/git-env';
 import { type RemoteType, validateRemoteOptions, resolveRemoteUrl } from '../util/git/remote-options';
 import { setupS3Client } from '../util/s3/client';
+import { promptForTags } from './tag';
 import { buildCommand } from './build';
 
 export interface DeployOptions {
@@ -158,6 +160,10 @@ export async function deployCommand(opts: DeployOptions = {}): Promise<void> {
     await releaseLockBestEffort(appName, token);
   }
 
+  // Tags are a post-deploy concern: the S3 upload has already succeeded, so a
+  // tag failure never fails the deploy (handled inside).
+  await handleDeployTags(appName);
+
   // The host MF parses the app name from the URL and prepends `mf-` itself
   // before looking it up in the manifest. So the user-facing URL must use
   // the consumer's de-scoped package name (no `mf-` prefix, no `@scope/`).
@@ -193,6 +199,30 @@ async function registerApp(
   }
 }
 
+const TAG_NUDGE = "run 'z2h-cli tag' to categorize this app (app type & team)";
+
+async function handleDeployTags(appSlug: string): Promise<void> {
+  try {
+    const interactive = getOutputMode() === 'human' && Boolean(process.stdin.isTTY);
+    if (!interactive) {
+      info(TAG_NUDGE);
+      return;
+    }
+
+    const current = await fetchAppTags(appSlug);
+    if (current.length > 0) {
+      return; // already tagged — don't prompt on every redeploy
+    }
+
+    const catalog = await fetchTagCatalog();
+    const selected = await promptForTags(appSlug, catalog, current);
+    const tags = await setAppTags(appSlug, selected);
+    info(tags.length > 0 ? `tags set: ${tags.map(t => t.name).join(', ')}` : TAG_NUDGE);
+  } catch (err) {
+    warn(`could not update tags: ${(err as Error).message}`);
+  }
+}
+
 // Acquire the per-app deploy lock. Throws a friendly error on 409 (someone else is deploying)
 // so the deploy stops and the caller can retry; the backend TTL backstops a crashed holder.
 async function acquireDeployLock(appName: string, token: string): Promise<void> {

package/src/commands/tag.ts

@@ -0,0 +1,134 @@
+import readline from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+import { readJson } from 'fs-extra';
+import { resolveConsumerPaths } from '../shadow/paths';
+import { mfAppName } from '../util/app-name';
+import { info, output, setOutputMode } from '../util/logger';
+import {
+  fetchAppTags,
+  fetchTagCatalog,
+  setAppTags,
+  TAG_TYPES,
+  TAG_TYPE_LABELS,
+  type AppTag,
+  type CatalogEntry,
+} from '../util/tags';
+
+export interface TagOptions {
+  /** Repeatable `--tag` — sets the full tag set non-interactively. */
+  tag?: string[];
+  json?: boolean;
+}
+
+/** Render an app's tags as `name (Type), ...` — or `(none)`. */
+function formatTags(tags: AppTag[]): string {
+  return tags.map(t => `${t.name} (${TAG_TYPE_LABELS[t.type]})`).join(', ') || '(none)';
+}
+
+/**
+ * Resolve the target app name: an explicit arg wins, else the consumer
+ * package.json `name` in the cwd. Normalized to the `mf-` bundle name the
+ * broker stores (via `mfAppName`), so the server finds the app.
+ */
+async function resolveAppSlug(appArg?: string): Promise<string> {
+  if (appArg) {
+    return mfAppName(appArg);
+  }
+  const paths = resolveConsumerPaths(process.cwd());
+  let pkg: { name?: string };
+  try {
+    pkg = (await readJson(paths.consumerPkg)) as { name?: string };
+  } catch {
+    throw new Error(
+      'Could not read a consumer package.json in the current directory. ' +
+        'Either cd into your app folder or pass an app name: z2h-cli tag <app-name>.'
+    );
+  }
+  if (!pkg.name) {
+    throw new Error('Consumer package.json must have a "name" field (or pass an app name argument).');
+  }
+  return mfAppName(pkg.name);
+}
+
+/**
+ * Closed-list prompt: one numbered pick per dimension (app type, team). Enter
+ * keeps the current value for that dimension (or skips it if unset). Returns
+ * the full replacement set of tag names.
+ */
+export async function promptForTags(appSlug: string, catalog: CatalogEntry[], current: AppTag[]): Promise<string[]> {
+  const rl = readline.createInterface({ input: stdin, output: stdout });
+  const selected: string[] = [];
+  try {
+    info(`Tagging "${appSlug}".`);
+    for (const type of TAG_TYPES) {
+      const options = catalog.filter(t => t.type === type);
+      if (options.length === 0) {
+        continue;
+      }
+      const currentName = current.find(c => c.type === type)?.name;
+      const label = TAG_TYPE_LABELS[type];
+      info(`\n${label}${currentName ? ` (current: ${currentName})` : ''}:`);
+      options.forEach((o, i) => info(`  ${i + 1}) ${o.name}`));
+
+      const raw = await rl.question(
+        `Pick a ${label} (number or name; Enter to ${currentName ? 'keep current' : 'skip'}):\n> `
+      );
+      const trimmed = raw.trim();
+      if (!trimmed) {
+        if (currentName) {
+          selected.push(currentName);
+        }
+        continue;
+      }
+      // Accept either the 1-based number or the tag name (case-insensitive).
+      const idx = Number(trimmed) - 1;
+      const byNumber = Number.isInteger(idx) && idx >= 0 && idx < options.length ? options[idx] : undefined;
+      const chosen = byNumber ?? options.find(o => o.name.toLowerCase() === trimmed.toLowerCase());
+      if (chosen) {
+        selected.push(chosen.name);
+      } else {
+        info(`Invalid choice "${trimmed}" — ${currentName ? 'keeping current' : 'skipping'} ${label}.`);
+        if (currentName) {
+          selected.push(currentName);
+        }
+      }
+    }
+    return selected;
+  } finally {
+    rl.close();
+  }
+}
+
+export async function tagCommand(appArg: string | undefined, opts: TagOptions): Promise<void> {
+  if (opts.json) {
+    setOutputMode('json');
+  }
+
+  const appSlug = await resolveAppSlug(appArg);
+
+  // Non-interactive write: `--tag` flags set the full set directly.
+  if (opts.tag && opts.tag.length > 0) {
+    const tags = await setAppTags(appSlug, opts.tag);
+    output(`[z2h-cli] tags for "${appSlug}": ${formatTags(tags)}`, { ok: true, appName: appSlug, tags });
+    return;
+  }
+
+  const [catalog, current] = await Promise.all([fetchTagCatalog(), fetchAppTags(appSlug)]);
+
+  // Read-only listing: agents (`--json`) and any non-TTY caller get the catalog
+  // + current tags without a prompt — then they set tags via `--tag`. This also
+  // avoids hanging on `readline` when no human is attached to stdin.
+  if (opts.json || !process.stdin.isTTY) {
+    output(
+      `[z2h-cli] "${appSlug}"\n  catalog: ${
+        catalog.map(t => `${t.name} (${TAG_TYPE_LABELS[t.type]})`).join(', ') || '(none)'
+      }\n  current: ${formatTags(current)}`,
+      { ok: true, appName: appSlug, catalog, current }
+    );
+    return;
+  }
+
+  const selected = await promptForTags(appSlug, catalog, current);
+  const tags = await setAppTags(appSlug, selected);
+  output(`[z2h-cli] tags for "${appSlug}": ${formatTags(tags)}`, { ok: true, appName: appSlug, tags });
+}

package/src/index.ts

@@ -8,11 +8,13 @@ import { devCommand } from './commands/dev';
 import { buildCommand } from './commands/build';
 import { cleanCommand } from './commands/clean';
 import { deployCommand } from './commands/deploy';
+import { deleteCommand } from './commands/delete';
 import { grantCommand, revokeCommand, transferOwnerCommand } from './commands/grant';
 import { createWorkspaceCommand } from './commands/create-workspace';
 import { createCommand, CreateOptions } from './commands/create';
 import { generateZ2HTokenCommand } from './commands/generate-z2h-token';
 import { migrateCommand } from './commands/migrate';
+import { tagCommand } from './commands/tag';
 import { editCommand } from './commands/edit';
 import { errorLog, fail, getOutputMode } from './util/logger';
 import { trackDuration } from './util/tracker';
@@ -41,6 +43,11 @@ function stripConflictingEnvVars(): void {
   }
 }
 
+/** commander collector for a repeatable `--tag` option. */
+function collectTag(value: string, previous: string[]): string[] {
+  return previous.concat(value);
+}
+
 async function main(): Promise<void> {
   stripConflictingEnvVars();
 
@@ -127,6 +134,21 @@ async function main(): Promise<void> {
       }
     });
 
+  program
+    .command('tag [app-name]')
+    .description("Set an app's category tags — app type & team (interactive unless --tag or --json is given)")
+    .option('--tag <tag>', 'set a tag (repeatable); full-replaces the tag set non-interactively', collectTag, [])
+    .option('--json', "read-only: print the popular catalog + the app's current tags as JSON (no prompt)")
+    .action(async (appName: string | undefined, opts: { tag?: string[]; json?: boolean }) => {
+      try {
+        await trackDuration('z2h_app_tag_success', () => tagCommand(appName, opts), {
+          app_name: appName ?? getCwdAppName(),
+        });
+      } catch (err) {
+        await fail(`tag failed: ${(err as Error).message}`, { command: 'tag' }, 1);
+      }
+    });
+
   program
     .command('create-workspace')
     .description(`Bootstrap the ${getWorkspaceHome()}/ yarn workspace (one-time setup)`)
@@ -233,6 +255,21 @@ async function main(): Promise<void> {
       }
     });
 
+  program
+    .command('delete')
+    .description('Permanently delete the current app and take it offline (owners/admins only)')
+    .option('--yes', 'skip the confirmation prompt (required for --json / non-interactive)')
+    .option('--json', 'emit structured JSON on stdout')
+    .action(async (opts: { yes?: boolean; json?: boolean }) => {
+      try {
+        await trackDuration('z2h_app_delete_success', () => deleteCommand(opts), {
+          app_name: getCwdAppName(),
+        });
+      } catch (err) {
+        await fail(`delete failed: ${(err as Error).message}`, { command: 'delete' }, 1);
+      }
+    });
+
   program
     .command('migrate')
     .description('Run pending workspace migrations')

package/src/util/git/__tests__/repo.test.ts

@@ -179,13 +179,35 @@ describe('safeBackupIfDirty', () => {
 
 describe('pullAndResolve', () => {
   it('resolves when pull fast-forwards cleanly', async () => {
-    mockExeca.mockResolvedValueOnce(execaOk()); // git pull --ff-only
+    mockExeca
+      .mockResolvedValueOnce(execaOk('deadbeef\trefs/heads/master')) // ls-remote --heads origin master
+      .mockResolvedValueOnce(execaOk()); // git pull --ff-only
 
     await expect(pullAndResolve(DIR)).resolves.toBeUndefined();
   });
 
+  it('skips the pull (first-deploy) when the remote has no master ref', async () => {
+    mockExeca.mockResolvedValueOnce(execaOk('')); // ls-remote --heads origin master → empty (gone/new remote)
+
+    await expect(pullAndResolve(DIR)).resolves.toBeUndefined();
+
+    const calls = mockExeca.mock.calls.map(c => c.slice(0, 2));
+    expect(calls).toContainEqual(['git', ['ls-remote', '--heads', 'origin', 'master']]);
+    expect(calls).not.toContainEqual(['git', ['pull', '--ff-only']]);
+  });
+
+  it('treats an unreachable ls-remote as no remote and skips the pull', async () => {
+    mockExeca.mockRejectedValueOnce(new Error('fatal: could not read from remote')); // ls-remote fails
+
+    await expect(pullAndResolve(DIR)).resolves.toBeUndefined();
+
+    const calls = mockExeca.mock.calls.map(c => c.slice(0, 2));
+    expect(calls).not.toContainEqual(['git', ['pull', '--ff-only']]);
+  });
+
   it('throws GitConflictError with structured JSON on non-fast-forward', async () => {
     mockExeca
+      .mockResolvedValueOnce(execaOk('deadbeef\trefs/heads/master')) // ls-remote --heads origin master
       .mockRejectedValueOnce(new Error('fatal: Not possible to fast-forward')) // git pull
       .mockResolvedValueOnce(execaOk('')) // safeBackupIfDirty: git status --porcelain (clean)
       .mockResolvedValueOnce(execaOk()) // gatherConflictInfo: git fetch origin

package/src/util/git/repo.ts

@@ -86,6 +86,18 @@ export async function safeBackupIfDirty(dir: string): Promise<void> {
 
 export async function pullAndResolve(dir: string, env?: Record<string, string>): Promise<void> {
   const gitEnv = env ? { ...process.env, ...env } : undefined;
+
+  // If the remote has no master branch there's nothing to pull — treat it as a
+  // first deploy and let the subsequent push create it. This covers a brand-new
+  // remote as well as one whose objects were removed (e.g. the app was deleted,
+  // wiping its S3 git prefix), which would otherwise surface as a bogus conflict.
+  const hasRemoteMaster = await execGit(['ls-remote', '--heads', 'origin', 'master'], dir, gitEnv)
+    .then(r => Boolean(r.stdout.trim()))
+    .catch(() => false);
+  if (!hasRemoteMaster) {
+    return;
+  }
+
   try {
     await execGit(['pull', '--ff-only'], dir, gitEnv);
   } catch (err) {