@mybase-dev/cli 1.0.0 → 1.0.1

package/dist/mybase.js

@@ -1,15 +1,107 @@
 #!/usr/bin/env bun
 // @bun
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+
+// ../../node_modules/.bun/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
+var require_src = __commonJS(function(exports, module) {
+  var ESC = "\x1B";
+  var CSI = `${ESC}[`;
+  var beep = "\x07";
+  var cursor = {
+    to(x, y) {
+      if (!y)
+        return `${CSI}${x + 1}G`;
+      return `${CSI}${y + 1};${x + 1}H`;
+    },
+    move(x, y) {
+      let ret = "";
+      if (x < 0)
+        ret += `${CSI}${-x}D`;
+      else if (x > 0)
+        ret += `${CSI}${x}C`;
+      if (y < 0)
+        ret += `${CSI}${-y}A`;
+      else if (y > 0)
+        ret += `${CSI}${y}B`;
+      return ret;
+    },
+    up: (count = 1) => `${CSI}${count}A`,
+    down: (count = 1) => `${CSI}${count}B`,
+    forward: (count = 1) => `${CSI}${count}C`,
+    backward: (count = 1) => `${CSI}${count}D`,
+    nextLine: (count = 1) => `${CSI}E`.repeat(count),
+    prevLine: (count = 1) => `${CSI}F`.repeat(count),
+    left: `${CSI}G`,
+    hide: `${CSI}?25l`,
+    show: `${CSI}?25h`,
+    save: `${ESC}7`,
+    restore: `${ESC}8`
+  };
+  var scroll = {
+    up: (count = 1) => `${CSI}S`.repeat(count),
+    down: (count = 1) => `${CSI}T`.repeat(count)
+  };
+  var erase = {
+    screen: `${CSI}2J`,
+    up: (count = 1) => `${CSI}1J`.repeat(count),
+    down: (count = 1) => `${CSI}J`.repeat(count),
+    line: `${CSI}2K`,
+    lineEnd: `${CSI}K`,
+    lineStart: `${CSI}1K`,
+    lines(count) {
+      let clear = "";
+      for (let i = 0;i < count; i++)
+        clear += this.line + (i < count - 1 ? cursor.up() : "");
+      if (count)
+        clear += cursor.left;
+      return clear;
+    }
+  };
+  module.exports = { cursor, scroll, erase, beep };
+});
 
 // src/agent.ts
 import { mkdir as mkdir2 } from "fs/promises";
-import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
+import { dirname as dirname2, join as join2, resolve as resolve3 } from "path";
 
 // ../../packages/shared/src/index.ts
 var DEFAULT_API_URL = "http://localhost:4000";
 var ANALYTICS_RANGES = ["24h", "7d", "30d", "90d"];
 var RATELIMIT_STATS_RANGES = ["24h", "7d"];
 var QUEUE_STATS_RANGES = ["24h", "7d"];
+var ADMIN_PASSWORD_MIN = 10;
 var KEY_RESOURCES = [
   { id: "projects", name: "Projects", description: "List projects; create, delete, and turn services on or off" },
   { id: "database", name: "Database", description: "Database details, tables, and rows (the SQL editor needs admin)" },
@@ -18,12 +110,36 @@ var KEY_RESOURCES = [
   { id: "analytics", name: "Analytics", description: "Reports, events, and settings" },
   { id: "cache", name: "Cache", description: "Keys, and HTTP commands (write)" },
   { id: "ratelimit", name: "Rate limits", description: "Rules and stats, and limit checks (write)" },
-  { id: "queue", name: "Queues", description: "Queues and messages (receiving is a write)" }
+  { id: "queue", name: "Queues", description: "Queues and messages (receiving is a write)" },
+  { id: "search", name: "Web search", description: "Web searches and page reads (read)" },
+  { id: "secrets", name: "Secrets", description: "Secret values per environment (read), and changing them (write)" },
+  { id: "vector", name: "Vector search", description: "Indexes, documents, and queries (read), and changing them (write)" },
+  { id: "users", name: "Users", description: "Your app's users and sessions (read), revoking and deleting them, and sending sign-in events (write)" },
+  { id: "captcha", name: "Captcha", description: "Captcha settings (read), and verifying tokens (write)" },
+  { id: "audit", name: "Audit log", description: "Who did what: sign-ins, key and project changes, secret reads (read only)" }
 ];
+function parseDotenv(text) {
+  const out = {};
+  const re = /^[ \t]*(?:export[ \t]+)?([A-Za-z_][A-Za-z0-9_.-]*)[ \t]*=[ \t]*('[^']*'|"(?:\\.|[^"\\])*"|[^\n]*?)[ \t]*$/gm;
+  for (const m of text.replace(/\r\n?/g, `
+`).matchAll(re)) {
+    const key = m[1];
+    let value = m[2];
+    if (value.startsWith("'"))
+      value = value.slice(1, -1);
+    else if (value.startsWith('"'))
+      value = value.slice(1, -1).replace(/\\([nrt"\\])/g, (_, c) => ({ n: `
+`, r: "\r", t: "\t" })[c] ?? c);
+    else
+      value = value.replace(/\s+#.*$/, "").trim();
+    out[key] = value;
+  }
+  return out;
+}
 // package.json
 var package_default = {
   name: "@mybase-dev/cli",
-  version: "1.0.0",
+  version: "1.0.1",
   description: "The mybase CLI: projects, keys, cron, queues, cache, rate limits, analytics, docs, and agent setup for a self-hosted mybase.",
   type: "module",
   repository: {
@@ -50,9 +166,9 @@ var package_default = {
 };
 
 // src/config.ts
-import { chmod, mkdir, rm } from "fs/promises";
+import { chmod, mkdir } from "fs/promises";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname, join, resolve, sep } from "path";
 var configPath = join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "mybase", "config.json");
 async function loadConfig() {
   const file = Bun.file(configPath);
@@ -64,18 +180,56 @@ async function loadConfig() {
     throw new Error(`${configPath} isn't valid JSON. Fix it, or delete it and run \`mybase login\` again.`);
   }
 }
-async function saveConfig(config) {
+async function writeConfig(config) {
   await mkdir(dirname(configPath), { recursive: true, mode: 448 });
   await Bun.write(configPath, `${JSON.stringify(config, null, 2)}
 `);
   await chmod(configPath, 384);
 }
+async function saveConfig(config) {
+  const { url: _url, token: _token, ...rest } = await loadConfig();
+  await writeConfig({ ...config, ...rest });
+}
 async function clearConfig() {
-  await rm(configPath, { force: true });
+  const { url: _url, token: _token, ...rest } = await loadConfig();
+  await writeConfig(rest);
+}
+async function saveServerDir(dir) {
+  await writeConfig({ ...await loadConfig(), server: resolve(dir) });
+}
+async function dirSetup(dir = process.cwd()) {
+  const { dirs = {} } = await loadConfig();
+  for (let d = resolve(dir);; d = dirname(d)) {
+    const setup = dirs[d];
+    if (setup)
+      return { ...setup, dir: d };
+    if (d === dirname(d))
+      return null;
+  }
+}
+async function saveDirSetup(dir, setup) {
+  const config = await loadConfig();
+  await writeConfig({ ...config, dirs: { ...config.dirs, [resolve(dir).replace(new RegExp(`\\${sep}$`), "") || sep]: setup } });
 }
 
 // src/output.ts
-var jsonMode = process.argv.includes("--json");
+var RUN_VALUE_FLAGS = new Set(["-p", "-e", "--project", "--env"]);
+function splitRunArgs(args) {
+  let i = 0;
+  while (i < args.length && args[i].startsWith("-")) {
+    if (args[i] === "--")
+      return { options: args.slice(0, i), command: args.slice(i + 1) };
+    i += RUN_VALUE_FLAGS.has(args[i]) ? 2 : 1;
+  }
+  return { options: args.slice(0, i), command: args.slice(i) };
+}
+function ownArgs(args) {
+  if (args[0] === "run")
+    return ["run", ...splitRunArgs(args.slice(1)).options];
+  const dash = args.indexOf("--");
+  return dash === -1 ? args : args.slice(0, dash);
+}
+var jsonMode = ownArgs(Bun.argv.slice(2)).includes("--json");
 
 class CliError extends Error {
   exitCode;
@@ -134,7 +288,7 @@ async function api(path, init) {
 }
 
 // src/cron.ts
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 
 // ../../packages/sdk/src/cron.ts
 var encoder = new TextEncoder;
@@ -371,7 +525,7 @@ async function fetchTask(project, body) {
   return { task, created };
 }
 async function readConfigFile(file) {
-  const path = resolve(file);
+  const path = resolve2(file);
   if (!await Bun.file(path).exists())
     throw new Error(`no config at ${path}`);
   const config = (await import(path)).default;
@@ -465,6 +619,13 @@ function contextMarkdown(c) {
   }
   if (c.cache)
     out.push("## Cache", "", `TCP ${c.cache.url} (password shown once at enable), HTTP ${c.cache.httpUrl}. Every key starts with \`${c.cache.keyPrefix}\`.`, "");
+  if (c.search)
+    out.push("## Web search", "", `GET ${c.search.searchUrl}?q=\u2026 and ${c.search.fetchUrl}?url=\u2026 with a \`search:read\` key.`, "");
+  if (c.users) {
+    out.push("## Users (Better Auth)", "", c.users.ready ? `${c.users.users} user(s). Better Auth's tables are in schema \`${c.users.schema}\`; the app connects with \`authDatabaseUrl(DATABASE_URL)\` from @mybase-dev/sdk/better-auth.` : `On, but Better Auth's tables aren't there yet: run \`npx @better-auth/cli migrate\` in the app (schema \`${c.users.schema}\`). Start from \`mybase users init ${c.project}\`.`, "");
+  }
+  if (c.captcha)
+    out.push("## Captcha", "", `Script: ${c.captcha.scriptUrl} (data-project="${c.project}"). Check tokens with \`createCaptchaClient\` (\`captcha:write\` key) or Better Auth's captcha plugin via \`mybaseCaptcha()\`.`, "");
   if (c.analytics)
     out.push("## Analytics", "", `Public write key \`${c.analytics.writeKey}\`, script ${c.analytics.scriptUrl}`, "");
   out.push("## Env vars", "", ...c.env.map((e) => `- \`${e.name}\`: ${e.description}`), "");
@@ -533,7 +694,9 @@ var SDK_ENTRY = {
   analytics: "`@mybase-dev/sdk/analytics` (page views, events, errors)",
   cache: "`@mybase-dev/sdk/cache` (HTTP cache client)",
   ratelimit: "`@mybase-dev/sdk/ratelimit` (check limits)",
-  queue: "`@mybase-dev/sdk/queue` (send, receive, consume)"
+  queue: "`@mybase-dev/sdk/queue` (send, receive, consume)",
+  search: "`@mybase-dev/sdk/search` (web search + page reads, `searchTools` for LLM agents)",
+  vector: "`@mybase-dev/sdk/vector` (vector, full-text, and hybrid search over documents; `retrievalTool` for RAG)"
 };
 function agentsSection(c) {
   const sdk = c.services.filter((s) => SDK_ENTRY[s]).map((s) => `  - ${SDK_ENTRY[s]}`);
@@ -548,13 +711,13 @@ This app's backend is the mybase project \`${c.project}\` at ${c.apiUrl} (self-h
 ${sdk.length ? `- **SDK** (\`npm i @mybase-dev/sdk\`):
 ${sdk.join(`
 `)}
-` : ""}- **Config in code:** cron jobs, rate limit rules, and queues the app depends on go in \`mybase.config.ts\` (\`defineConfig\` from \`@mybase-dev/sdk/config\`) and are applied with \`mybase cron|ratelimit|queue sync\` (\`--dry-run\` first).
+` : ""}- **Config in code:** cron jobs, rate limit rules, queues, and vector indexes the app depends on go in \`mybase.config.ts\` (\`defineConfig\` from \`@mybase-dev/sdk/config\`) and are applied with \`mybase cron|ratelimit|queue|vector sync\` (\`--dry-run\` first).
 - \`MYBASE_API_KEY\` is server-side only. Browser code may use only the analytics write key.`;
 }
 function skill(c) {
   return `---
 name: mybase
-description: Use for anything touching this app's backend on mybase (self-hosted Postgres, S3 storage, cron, queues, cache, rate limits, analytics), project "${c.project}". Covers the mybase CLI, MCP tools, @mybase-dev/sdk, and mybase.config.ts.
+description: Use for anything touching this app's backend on mybase (self-hosted Postgres, S3 storage, cron, queues, cache, rate limits, analytics, vector search), project "${c.project}". Covers the mybase CLI, MCP tools, @mybase-dev/sdk, and mybase.config.ts.
 ---
 
 # mybase
@@ -565,7 +728,7 @@ Project \`${c.project}\` on ${c.apiUrl}. Services: database, storage${c.services
 
 1. Ground yourself: \`mybase context ${c.project} --json\` or MCP \`get_project_context\` (project "${c.project}").
 2. Look up the exact API before writing code: \`mybase docs --search "<words>"\`, then \`mybase docs <slug>\`. Index: ${c.docsUrl}
-3. Declare cron jobs, queues, and rate limit rules in \`mybase.config.ts\`; preview with \`mybase <service> sync --dry-run\`, then sync.
+3. Declare cron jobs, queues, rate limit rules, and vector indexes in \`mybase.config.ts\`; preview with \`mybase <service> sync --dry-run\`, then sync.
 4. Verify against the live project: \`mybase queue peek\`, \`mybase cron runs\`, MCP \`list_cron_runs\`, \`peek_messages\`, \`analytics_stats\`.
 
 ## Rules
@@ -616,7 +779,7 @@ async function agent(sub, args) {
   if (sub !== "init")
     return false;
   const { flags } = parseArgs(args);
-  const dir = resolve2(flagString(flags, "dir") ?? ".");
+  const dir = resolve3(flagString(flags, "dir") ?? ".");
   const c = await getContext(await chooseProject(flagString(flags, "project"), dir));
   const written = [];
   const notes = [];
@@ -770,29 +933,194 @@ async function analytics(sub, args) {
   return false;
 }
 
+// src/alerts.ts
+var alertsUsage = `  alerts                         Alert channels and rules (admin key)
+  alerts add webhook|ntfy <url> [--name n] [--token t]  Send alerts to a webhook (signed) or an ntfy topic URL
+  alerts test <channel-id>       Send a test alert and wait for the result
+  alerts remove <channel-id> [--yes]  Stop sending alerts there
+  alerts rotate <channel-id>     New webhook signing secret
+  alerts rule <rule> on|off      Turn one rule on or off (rule ids: see \`mybase alerts\`)`;
+function printChannel(c) {
+  const state = c.enabled ? "" : " (paused)";
+  console.log(`  ${c.id}  ${c.kind.padEnd(7)}  ${c.name}${state}`);
+  console.log(`      ${c.url}${c.lastError ? `  last error: ${c.lastError}` : c.lastSentAt ? `  last sent ${c.lastSentAt}` : ""}`);
+  if (c.secret)
+    console.log(`      signing secret ${c.secret}  (verify with verifyCronSignature from @mybase-dev/sdk/cron)`);
+}
+async function alerts(args) {
+  const { positional, flags } = parseArgs(args);
+  const [sub, a, b] = positional;
+  switch (sub) {
+    case undefined: {
+      const o = await api("/alerts");
+      print(o, () => {
+        console.log("Channels:");
+        if (o.channels.length === 0)
+          console.log("  None. Add one with: mybase alerts add ntfy https://ntfy.sh/<topic>");
+        for (const c of o.channels)
+          printChannel(c);
+        console.log(`
+Rules:`);
+        for (const r of o.rules)
+          console.log(`  ${r.enabled ? "on " : "off"}  ${r.id.padEnd(24)}  ${r.description}`);
+      });
+      return;
+    }
+    case "add": {
+      if (a !== "webhook" && a !== "ntfy" || !b)
+        throw usageError(`usage: mybase alerts add webhook|ntfy <url>
+
+${alertsUsage}`);
+      const c = await api("/alerts/channels", {
+        method: "POST",
+        body: JSON.stringify({ kind: a, url: b, name: flagString(flags, "name"), token: flagString(flags, "token") })
+      });
+      print(c, () => {
+        console.log(`Added ${c.kind} channel "${c.name}"`);
+        printChannel(c);
+        console.log(`
+Try it: mybase alerts test ${c.id}`);
+      });
+      return;
+    }
+    case "test": {
+      if (!a)
+        throw usageError("missing channel id");
+      const r = await api(`/alerts/channels/${encodeURIComponent(a)}/test`, { method: "POST" });
+      print(r, () => console.log(r.ok ? "Sent. Check that it arrived." : `Not delivered: ${r.error}`));
+      if (!r.ok)
+        process.exitCode = 1;
+      return;
+    }
+    case "remove": {
+      if (!a)
+        throw usageError("missing channel id");
+      confirm(args.includes("--yes"), `Alerts will no longer be sent to channel ${a}.`, a, "the channel id");
+      await api(`/alerts/channels/${encodeURIComponent(a)}`, { method: "DELETE" });
+      print({ removed: a }, () => console.log(`Removed channel ${a}`));
+      return;
+    }
+    case "rotate": {
+      if (!a)
+        throw usageError("missing channel id");
+      const c = await api(`/alerts/channels/${encodeURIComponent(a)}/secret/rotate`, { method: "POST" });
+      print(c, () => {
+        console.log("Rotated. The old secret stops working now.");
+        printChannel(c);
+      });
+      return;
+    }
+    case "rule": {
+      if (!a || b !== "on" && b !== "off")
+        throw usageError("usage: mybase alerts rule <rule> on|off");
+      const o = await api(`/alerts/rules/${encodeURIComponent(a)}`, { method: "PUT", body: JSON.stringify({ enabled: b === "on" }) });
+      print(o.rules.find((r) => r.id === a), () => console.log(`Rule ${a} is ${b}.`));
+      return;
+    }
+  }
+  throw usageError(`unknown: mybase alerts ${sub}
+
+${alertsUsage}`);
+}
+
+// src/audit.ts
+var auditUsage = `  audit [--project p] [--action auth|auth.login] [--outcome ok|denied|failed] [--since 24h|7d|<ISO date>] [--limit n] [--follow]
+                                 Recent audit log entries, newest first (--follow: keep printing new ones)
+  audit retention [<days>]       Show (or set, 7\u2013365, admin key) how long entries are kept`;
+function sinceDate(value, now = Date.now()) {
+  const m = /^(\d+)(m|h|d)$/.exec(value);
+  if (m)
+    return new Date(now - Number(m[1]) * { m: 60000, h: 3600000, d: 86400000 }[m[2]]).toISOString();
+  if (Number.isNaN(Date.parse(value)))
+    throw usageError(`--since must be like 24h, 7d, or a date (got "${value}")`);
+  return new Date(value).toISOString();
+}
+var actorLabel = (e) => e.actor.kind === "token" ? `key "${e.actor.name}"` : e.actor.kind === "session" ? e.actor.name ?? "admin" : e.actor.kind === "system" ? "mybase" : e.actor.name ? `${e.actor.name} (not signed in)` : "anonymous";
+function formatEvent(e) {
+  const where = [e.project && `[${e.project}]`, e.target].filter(Boolean).join(" ");
+  const meta = e.meta ? ` ${Object.entries(e.meta).map(([k, v]) => `${k}=${v}`).join(" ")}` : "";
+  return `${e.at.replace("T", " ").slice(0, 19)}  ${e.outcome.padEnd(6)}  ${e.action.padEnd(24)}  ${actorLabel(e)}${e.ip ? ` from ${e.ip}` : ""}${where ? `  ${where}` : ""}${meta}`;
+}
+async function audit(args) {
+  const { positional, flags } = parseArgs(args);
+  if (positional[0] === "retention") {
+    const days = positional[1];
+    const settings = days ? await api("/audit/settings", { method: "PUT", body: JSON.stringify({ retentionDays: Number(days) }) }) : await api("/audit/settings");
+    print(settings, () => console.log(`Audit entries are kept for ${settings.retentionDays} days.`));
+    return;
+  }
+  if (positional.length)
+    throw usageError(`unknown: mybase audit ${positional[0]}
+
+${auditUsage}`);
+  const query = new URLSearchParams;
+  for (const name of ["project", "action", "outcome", "actor"]) {
+    const value = flagString(flags, name);
+    if (value)
+      query.set(name, value);
+  }
+  const since = flagString(flags, "since");
+  if (since)
+    query.set("since", sinceDate(since));
+  query.set("limit", String(flagInt(flags, "limit") ?? 50));
+  const page = await api(`/audit?${query}`);
+  if (!flags.has("follow")) {
+    print(page, () => {
+      if (page.events.length === 0)
+        console.log("No audit entries match.");
+      for (const e of [...page.events].reverse())
+        console.log(formatEvent(e));
+    });
+    return;
+  }
+  let last = page.events[0]?.id ?? "0";
+  const show = (events) => {
+    for (const e of [...events].reverse())
+      console.log(jsonMode ? JSON.stringify(e) : formatEvent(e));
+  };
+  show(page.events);
+  query.delete("since");
+  for (;; ) {
+    await Bun.sleep(5000);
+    const fresh = await api(`/audit?${query}`);
+    const newer = fresh.events.filter((e) => BigInt(e.id) > BigInt(last));
+    if (newer.length) {
+      show(newer);
+      last = newer[0].id;
+    }
+  }
+}
+
 // src/auth.ts
 import { hostname } from "os";
 
 // src/token.ts
 var tokenUsage = `  token list                     List API keys and what they may do
-  token create <name> (--perm <p,\u2026> [--project <name,\u2026>] | --admin)
+  token create <name> (--perm <p,\u2026> [--project <name,\u2026>] [--env <env,\u2026>] | --admin)
                                  Make a key and print it once. <p>: <resource>:read|write,
                                  resources: ${KEY_RESOURCES.map((r) => r.id).join(", ")}
-  token update <id> [--name <n>] [--perm <p,\u2026>] [--project <name,\u2026>|--all-projects] [--admin]
+                                 --env limits secrets to those environments
+  token update <id> [--name <n>] [--perm <p,\u2026>] [--project <name,\u2026>|--all-projects]
+         [--env <env,\u2026>|--all-envs] [--admin]
   token delete <id>              Revoke a key (it stops working now)`;
 var list = (value) => value?.split(",").map((v) => v.trim()).filter(Boolean);
-var describeGrant = (t) => `${t.permissions.join(",")} on ${t.projects ? t.projects.join(",") : "all projects"}`;
+var describeGrant = (t) => `${t.permissions.join(",")} on ${t.projects ? t.projects.join(",") : "all projects"}${t.environments ? ` (secrets envs ${t.environments.join(",")})` : ""}`;
 function grantFlags(flags) {
   const body = {};
   if (flags.has("admin")) {
     body.permissions = ["admin"];
     body.projects = null;
+    body.environments = null;
   } else if (flags.has("perm"))
     body.permissions = list(flagString(flags, "perm"));
   if (flags.has("all-projects"))
     body.projects = null;
   else if (flags.has("project"))
     body.projects = list(flagString(flags, "project")) ?? null;
+  if (flags.has("all-envs"))
+    body.environments = null;
+  else if (flags.has("env"))
+    body.environments = list(flagString(flags, "env")) ?? null;
   return body;
 }
 async function token(sub, args) {
@@ -828,7 +1156,7 @@ async function token(sub, args) {
       const id = need(first, "key id");
       const body = { ...grantFlags(flags), ...flags.has("name") ? { name: flagString(flags, "name") } : {} };
       if (Object.keys(body).length === 0)
-        throw new Error("nothing to change: pass --name, --perm, --project, --all-projects, or --admin");
+        throw new Error("nothing to change: pass --name, --perm, --project, --all-projects, --env, --all-envs, or --admin");
       const updated = await api(`/auth/tokens/${encodeURIComponent(id)}`, { method: "PATCH", body: JSON.stringify(body) });
       print(updated, () => console.log(`Updated "${updated.name}" (${describeGrant(updated)})`));
       return true;
@@ -902,16 +1230,28 @@ async function login(args) {
     throw new Error("missing username");
   const password = await readSecret("Password: ");
   const tokenName = `cli on ${hostname()}`;
-  const res = await fetch(`${url}/auth/login`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ username, password, tokenName })
-  }).catch(() => {
-    throw new Error(`can't reach the API at ${url}`);
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.token)
-    throw new Error(body.error ?? res.statusText);
+  const post = async (path, input) => {
+    const res = await fetch(`${url}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(input)
+    }).catch(() => {
+      throw new Error(`can't reach the API at ${url}`);
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok)
+      throw new Error(body.error ?? res.statusText);
+    return body;
+  };
+  let body = await post("/auth/login", { username, password, tokenName });
+  if (body.mfaRequired && body.challenge) {
+    const code = (await readLine("Code (or recovery code):")).trim();
+    if (!code)
+      throw new Error("missing code");
+    body = await post("/auth/login/mfa", { challenge: body.challenge, code });
+  }
+  if (!body.token)
+    throw new Error("the server didn't return a token");
   const previous = await loadConfig();
   await saveConfig({ url, token: body.token });
   if (previous.token && previous.url)
@@ -953,7 +1293,7 @@ async function whoami() {
     if (!status.authenticated)
       console.log(`not signed in to ${API_URL}. Run \`mybase login\`.`);
     else {
-      const grant = status.permissions ? ` (${describeGrant({ permissions: status.permissions, projects: status.projects })})` : "";
+      const grant = status.permissions ? ` (${describeGrant({ permissions: status.permissions, projects: status.projects, environments: status.environments ?? null })})` : "";
       console.log(`${status.username} on ${API_URL}${grant}`);
     }
     if (warning)
@@ -1059,6 +1399,64 @@ async function cache(sub, args) {
   return false;
 }
 
+// src/captcha.ts
+var captchaUsage = `  captcha enable <project>       Turn on the captcha and print the script tag and secret
+  captcha key <project> [--rotate]  Show (or replace) the secret your server checks tokens with
+  captcha difficulty <project> <n>  Numbers a browser may try per challenge (1000\u20131000000; default 50000)
+  captcha disable <project> [--yes]  Turn it off (forms that need it stop accepting submissions)`;
+var base3 = (project) => `/projects/${encodeURIComponent(project)}/captcha`;
+function printSettings2(project, s) {
+  console.log("Script tag (forms marked data-mybase-captcha get a hidden mybase-captcha field):");
+  console.log(`  <script defer src="${s.scriptUrl}" data-project="${project}"></script>
+`);
+  console.log(`  secret      ${s.secretKey}  (server-side only: MYBASE_CAPTCHA_SECRET)`);
+  console.log(`  difficulty  ${s.maxNumber.toLocaleString()} numbers per challenge`);
+  console.log(`  siteverify  ${s.siteVerifyUrl}  (Turnstile-compatible; Better Auth: mybaseCaptcha())`);
+}
+async function captcha(sub, args) {
+  const { positional, flags } = parseArgs(args);
+  const [project, value] = positional;
+  switch (sub) {
+    case "enable": {
+      const p = need(project, "project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/captcha`, { method: "PUT" });
+      const s = await api(base3(p));
+      print({ enabled: "captcha", project: p, ...s }, () => {
+        console.log(`Captcha enabled for "${p}"
+`);
+        printSettings2(p, s);
+      });
+      return true;
+    }
+    case "key": {
+      const p = need(project, "project name");
+      const s = flags.has("rotate") ? await api(`${base3(p)}/secret/rotate`, { method: "POST" }) : await api(base3(p));
+      print(s, () => {
+        if (flags.has("rotate"))
+          console.log(`Rotated. The old secret stops working now.
+`);
+        printSettings2(p, s);
+      });
+      return true;
+    }
+    case "difficulty": {
+      const p = need(project, "project name");
+      const n = Number(need(value, "a number"));
+      const s = await api(base3(p), { method: "PATCH", body: JSON.stringify({ maxNumber: n }) });
+      print(s, () => console.log(`Challenges now take up to ${s.maxNumber.toLocaleString()} tries.`));
+      return true;
+    }
+    case "disable": {
+      const p = need(project, "project name");
+      confirm(args.includes("--yes"), `Forms on "${p}" that check the captcha will refuse every submission until you remove the check.`, p, "the project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/captcha`, { method: "DELETE" });
+      print({ disabled: "captcha", project: p }, () => console.log(`Captcha disabled for "${p}"`));
+      return true;
+    }
+  }
+  return false;
+}
+
 // src/docs.ts
 var docsUsage = `  docs                           List docs pages
   docs <slug>                    Print a page as markdown (e.g. quickstart, queues, sdk/queues)
@@ -1105,6 +1503,35 @@ Read one: mybase docs <slug>. For agents: ${API_URL}/llms.txt`);
   return true;
 }
 
+// src/doctor.ts
+var doctorUsage = `  doctor [<project>]             Security checks: the whole instance (admin key), or one project. Exits 1 on critical findings`;
+var LABELS = { critical: "CRITICAL", warn: "warning", info: "info" };
+async function doctor(args) {
+  const project = args.find((a) => !a.startsWith("-"));
+  const report = await api(project ? `/projects/${encodeURIComponent(project)}/advisor` : "/advisor");
+  print(report, () => {
+    const scope = project ? `project "${project}"` : "this instance";
+    if (report.findings.length === 0) {
+      console.log(`No problems found in ${scope} (${report.checks.length} checks).`);
+      return;
+    }
+    console.log(`${report.findings.length} finding(s) in ${scope}:
+`);
+    for (const f of report.findings) {
+      console.log(`${LABELS[f.severity]}  ${f.title}${f.project && !project ? `  [${f.project}]` : ""}`);
+      console.log(`  ${f.detail}`);
+      console.log(`  Fix: ${f.fix}
+`);
+    }
+  });
+  const critical = report.findings.filter((f) => f.severity === "critical").length;
+  if (critical) {
+    if (jsonMode)
+      process.exit(1);
+    throw new CliError(`${critical} critical finding(s)`);
+  }
+}
+
 // src/queue.ts
 var queueUsage = `  queue enable <project>         Turn on queues
   queue disable <project> [--yes]  Turn them off, deleting every queue and message
@@ -1119,8 +1546,8 @@ var queueUsage = `  queue enable <project>         Turn on queues
   queue redrive <project> <dlq> [--to <queue>]  Move dead letters back to their queues
   queue stats <project> [--range 24h|7d]  Sent, received, deleted, dead-lettered per queue
   queue sync [--config <file>] [--dry-run] [--yes]  Make code-defined queues match mybase.config.ts`;
-var base3 = (project) => `/projects/${encodeURIComponent(project)}/queue`;
-var queuePath = (project, name, rest = "") => `${base3(project)}/queues/${encodeURIComponent(name)}${rest}`;
+var base4 = (project) => `/projects/${encodeURIComponent(project)}/queue`;
+var queuePath = (project, name, rest = "") => `${base4(project)}/queues/${encodeURIComponent(name)}${rest}`;
 function formatMs(ms) {
   for (const [unit, size] of [["d", 86400000], ["h", 3600000], ["m", 60000], ["s", 1000]]) {
     if (ms >= size && ms % size === 0)
@@ -1144,7 +1571,7 @@ async function queue(sub, args) {
     case "enable": {
       const p = need(project, "project name");
       await api(`/projects/${encodeURIComponent(p)}/services/queue`, { method: "PUT" });
-      const settings = await api(base3(p));
+      const settings = await api(base4(p));
       print({ enabled: "queue", project: p, ...settings }, () => {
         console.log(`Queues enabled for "${p}"
 `);
@@ -1161,7 +1588,7 @@ async function queue(sub, args) {
     }
     case "list": {
       const p = need(project, "project name");
-      const queues = await api(`${base3(p)}/queues`);
+      const queues = await api(`${base4(p)}/queues`);
       print(queues, () => {
         if (queues.length === 0)
           console.log("No queues yet.");
@@ -1187,7 +1614,7 @@ async function queue(sub, args) {
         contentDedup: flags.has("content-dedup") || undefined,
         deadLetter: dlq ? { queue: dlq, maxReceives: flagInt(flags, "max-receives") ?? 5 } : undefined
       };
-      const q = await api(`${base3(p)}/queues`, { method: "POST", body: JSON.stringify(body) });
+      const q = await api(`${base4(p)}/queues`, { method: "POST", body: JSON.stringify(body) });
       print(q, () => console.log(`Created ${q.fifo ? "FIFO" : "standard"} queue "${q.name}" (visibility ${formatMs(q.visibilityTimeoutMs)}, retention ${formatMs(q.retentionMs)})`));
       return true;
     }
@@ -1272,7 +1699,7 @@ async function queue(sub, args) {
       const range = flagString(flags, "range") ?? "24h";
       if (!QUEUE_STATS_RANGES.includes(range))
         throw new Error(`--range must be one of ${QUEUE_STATS_RANGES.join(", ")}`);
-      const stats = await api(`${base3(p)}/stats?range=${range}`);
+      const stats = await api(`${base4(p)}/stats?range=${range}`);
       print(stats, () => {
         const { queues } = stats;
         console.log(`Last ${range}:`);
@@ -1301,7 +1728,7 @@ function parseDuration(value) {
 async function sync2(file, dryRun, yes) {
   const config = await readConfigFile(file);
   const queues = Object.entries(config.queue?.queues ?? {}).map(([name, q]) => ({ ...q, name }));
-  const path = `${base3(config.project)}/queues`;
+  const path = `${base4(config.project)}/queues`;
   const plan = await api(path, { method: "PUT", body: JSON.stringify({ queues, dryRun: true }) });
   if (dryRun)
     return printSync(config.project, true, plan);
@@ -1311,6 +1738,192 @@ async function sync2(file, dryRun, yes) {
   printSync(config.project, false, await api(path, { method: "PUT", body: JSON.stringify({ queues }) }));
 }
 
+// src/vector.ts
+var vectorUsage = `  vector enable <project>        Turn on vector + full-text search
+  vector disable <project> [--yes]  Turn it off, deleting every index and document
+  vector settings <project>      Show the embedding provider
+  vector embedding <project> --url <url> --model <m> --dims <n> [--key]  Set it (--key prompts for an API key)
+  vector embedding <project> --off  Remove it
+  vector list <project>          List indexes with document counts
+  vector create <project> <index> [--dims <n>] [--metric cosine|l2|ip] [--lang english] [--embed]
+  vector delete <project> <index> [--yes]  Delete an index and its documents
+  vector upsert <project> <index> <file.jsonl>  Upsert documents, one JSON object per line
+  vector documents <project> <index> [--limit 20] [--after <id>]  List documents in id order
+  vector query <project> <index> [<text>] [--mode text|vector|hybrid] [--top 10] [--filter <json>]
+  vector sync [--config <file>] [--dry-run] [--yes]  Make code-defined indexes match mybase.config.ts`;
+var base5 = (project) => `/projects/${encodeURIComponent(project)}/vector`;
+var indexPath = (project, name, rest = "") => `${base5(project)}/indexes/${encodeURIComponent(name)}${rest}`;
+function describe(i) {
+  const vectors = i.dimensions ? `${i.dimensions}d ${i.metric}` : "text only";
+  return [i.name, vectors, i.language, i.embed ? "embeds" : "", `${i.documents} docs`, i.source].filter(Boolean).join("\t");
+}
+function printUsage2(project, settings) {
+  console.log("In your app (@mybase-dev/sdk), with an API key that has vector:write for this project:");
+  console.log(`  mybase token create ${project}-app --project ${project} --perm vector:write
+`);
+  console.log(`  const vector = createVectorClient({ apiUrl: "${settings.apiUrl}", project: "${project}", apiKey: process.env.MYBASE_API_KEY! })`);
+  console.log(`  const { matches } = await vector.index("<index>").query("search text")`);
+}
+async function vector(sub, args) {
+  const { positional, flags } = parseArgs(args);
+  const [project, name, third] = positional;
+  switch (sub) {
+    case "enable": {
+      const p = need(project, "project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/vector`, { method: "PUT" });
+      const settings = await api(base5(p));
+      print({ enabled: "vector", project: p, ...settings }, () => {
+        console.log(`Vector search enabled for "${p}"
+`);
+        printUsage2(p, settings);
+      });
+      return true;
+    }
+    case "disable": {
+      const p = need(project, "project name");
+      confirm(flags.has("yes"), `This deletes every vector index and document of "${p}".`, p, "the project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/vector`, { method: "DELETE" });
+      print({ disabled: "vector", project: p }, () => console.log(`Vector search disabled for "${p}"`));
+      return true;
+    }
+    case "settings": {
+      const p = need(project, "project name");
+      const settings = await api(base5(p));
+      print(settings, () => {
+        const e = settings.embedding;
+        console.log(e ? `embedding  ${e.model} (${e.dimensions}d) at ${e.url}${e.hasKey ? ", API key stored" : ""}` : "embedding  none (apps send their own vectors)");
+      });
+      return true;
+    }
+    case "embedding": {
+      const p = need(project, "project name");
+      let body;
+      if (flags.has("off"))
+        body = { embedding: null };
+      else {
+        const dims = flagInt(flags, "dims");
+        if (dims === undefined)
+          throw new Error("--dims is required (the model's vector length, e.g. 1536)");
+        const apiKey = flags.has("key") ? await readSecret("API key: ") : undefined;
+        body = { embedding: { url: need(flagString(flags, "url"), "--url"), model: need(flagString(flags, "model"), "--model"), dimensions: dims, apiKey } };
+      }
+      const settings = await api(base5(p), { method: "PUT", body: JSON.stringify(body) });
+      print(settings, () => console.log(settings.embedding ? `Embedding with ${settings.embedding.model} (${settings.embedding.dimensions}d)` : "Embedding provider removed"));
+      return true;
+    }
+    case "list": {
+      const p = need(project, "project name");
+      const indexes = await api(`${base5(p)}/indexes`);
+      print(indexes, () => {
+        if (indexes.length === 0)
+          console.log("No indexes yet.");
+        for (const i of indexes)
+          console.log(describe(i));
+      });
+      return true;
+    }
+    case "create": {
+      const p = need(project, "project name");
+      const body = {
+        name: need(name, "index name"),
+        dimensions: flagInt(flags, "dims"),
+        metric: flagString(flags, "metric"),
+        language: flagString(flags, "lang"),
+        embed: flags.has("embed") || undefined
+      };
+      const index = await api(`${base5(p)}/indexes`, { method: "POST", body: JSON.stringify(body) });
+      print(index, () => console.log(`Created index "${index.name}" (${index.dimensions ? `${index.dimensions}d ${index.metric}` : "text only"}, ${index.language})`));
+      return true;
+    }
+    case "delete": {
+      const p = need(project, "project name");
+      const n = need(name, "index name");
+      confirm(flags.has("yes"), `This deletes index "${n}" and every document in it.`, n, "the index name");
+      await api(indexPath(p, n), { method: "DELETE" });
+      print({ deleted: n }, () => console.log(`Deleted index "${n}"`));
+      return true;
+    }
+    case "upsert": {
+      const p = need(project, "project name");
+      const n = need(name, "index name");
+      const file = need(third, "JSONL file");
+      const lines = (await Bun.file(file).text()).split(/\r?\n/).filter((l) => l.trim());
+      const documents = lines.map((line, i) => {
+        try {
+          return JSON.parse(line);
+        } catch {
+          throw new Error(`${file}:${i + 1} is not JSON`);
+        }
+      });
+      let upserted = 0;
+      let embedded = 0;
+      for (let i = 0;i < documents.length; i += 100) {
+        const res = await api(indexPath(p, n, "/documents"), { method: "POST", body: JSON.stringify({ documents: documents.slice(i, i + 100) }) });
+        upserted += res.upserted;
+        embedded += res.embedded;
+      }
+      print({ upserted, embedded }, () => console.log(`Upserted ${upserted} documents into "${n}"${embedded ? ` (${embedded} embedded)` : ""}`));
+      return true;
+    }
+    case "query": {
+      const p = need(project, "project name");
+      const n = need(name, "index name");
+      const rawFilter = flagString(flags, "filter");
+      let filter;
+      try {
+        filter = rawFilter === undefined ? undefined : JSON.parse(rawFilter);
+      } catch {
+        throw new Error(`--filter must be JSON, e.g. '{"lang":"en"}'`);
+      }
+      const body = { text: third, mode: flagString(flags, "mode"), topK: flagInt(flags, "top"), filter, highlight: true };
+      const res = await api(indexPath(p, n, "/query"), { method: "POST", body: JSON.stringify(body) });
+      print(res, () => {
+        if (res.matches.length === 0)
+          console.log(`No matches (${res.mode}).`);
+        for (const m of res.matches) {
+          console.log(`${m.score.toFixed(4)}  ${m.id}${m.title ? `  ${m.title}` : ""}`);
+          const snippet = m.highlight ?? m.text?.slice(0, 160);
+          if (snippet)
+            console.log(`        ${snippet.replace(/\s+/g, " ")}`);
+        }
+      });
+      return true;
+    }
+    case "documents": {
+      const p = need(project, "project name");
+      const n = need(name, "index name");
+      const params = new URLSearchParams({ limit: String(flagInt(flags, "limit") ?? 20) });
+      const after = flagString(flags, "after");
+      if (after)
+        params.set("after", after);
+      const res = await api(indexPath(p, n, `/documents?${params}`));
+      print(res, () => {
+        for (const d of res.documents)
+          console.log(`${d.id}	${d.title ?? d.text.slice(0, 80).replace(/\s+/g, " ")}`);
+        if (res.next)
+          console.log(`more: --after ${res.next}`);
+      });
+      return true;
+    }
+    case "sync":
+      await sync3(flagString(flags, "config") ?? "mybase.config.ts", flags.has("dry-run"), flags.has("yes"));
+      return true;
+  }
+  return false;
+}
+async function sync3(file, dryRun, yes) {
+  const config = await readConfigFile(file);
+  const indexes = Object.entries(config.vector?.indexes ?? {}).map(([name, i]) => ({ ...i, name }));
+  const path = `${base5(config.project)}/indexes`;
+  const plan = await api(path, { method: "PUT", body: JSON.stringify({ indexes, dryRun: true }) });
+  if (dryRun)
+    return printSync(config.project, true, plan);
+  if (plan.deleted.length > 0) {
+    confirm(yes, `This deletes ${plan.deleted.map((n) => `"${n}"`).join(", ")} and every document in ${plan.deleted.length === 1 ? "it" : "them"}.`, "yes");
+  }
+  printSync(config.project, false, await api(path, { method: "PUT", body: JSON.stringify({ indexes }) }));
+}
+
 // src/ratelimit.ts
 var ratelimitUsage = `  ratelimit enable <project>     Turn on rate limits
   ratelimit disable <project> [--yes]  Turn them off, deleting every rule and counter
@@ -1320,7 +1933,7 @@ var ratelimitUsage = `  ratelimit enable <project>     Turn on rate limits
   ratelimit delete <project> <name>  Delete a rule
   ratelimit stats <project> [--range 24h|7d]  Allowed and blocked requests per rule
   ratelimit sync [--config <file>] [--dry-run]  Make code-defined rules match mybase.config.ts`;
-var base4 = (project) => `/projects/${encodeURIComponent(project)}/ratelimit`;
+var base6 = (project) => `/projects/${encodeURIComponent(project)}/ratelimit`;
 function formatWindow(ms) {
   for (const [unit, size] of [["d", 86400000], ["h", 3600000], ["m", 60000], ["s", 1000]]) {
     if (ms % size === 0)
@@ -1328,7 +1941,7 @@ function formatWindow(ms) {
   }
   return `${ms}ms`;
 }
-function printUsage2(project, settings) {
+function printUsage3(project, settings) {
   console.log(`  check URL  ${settings.limitUrl}
 `);
   console.log("In your app (@mybase-dev/sdk), with an API key that has ratelimit:write for this project:");
@@ -1344,11 +1957,11 @@ async function ratelimit(sub, args) {
     case "enable": {
       const p = need(project, "project name");
       await api(`/projects/${encodeURIComponent(p)}/services/ratelimit`, { method: "PUT" });
-      const settings = await api(base4(p));
+      const settings = await api(base6(p));
       print({ enabled: "ratelimit", project: p, ...settings }, () => {
         console.log(`Rate limits enabled for "${p}"
 `);
-        printUsage2(p, settings);
+        printUsage3(p, settings);
       });
       return true;
     }
@@ -1361,7 +1974,7 @@ async function ratelimit(sub, args) {
     }
     case "rules": {
       const p = need(project, "project name");
-      const rules = await api(`${base4(p)}/rules`);
+      const rules = await api(`${base6(p)}/rules`);
       print(rules, () => {
         if (rules.length === 0)
           console.log("No rules yet. Inline limits still work.");
@@ -1381,14 +1994,14 @@ async function ratelimit(sub, args) {
         algorithm: flagString(flags, "algorithm"),
         burst: flagInt(flags, "burst")
       };
-      const r = await api(`${base4(p)}/rules`, { method: "POST", body: JSON.stringify(body) });
+      const r = await api(`${base6(p)}/rules`, { method: "POST", body: JSON.stringify(body) });
       print(r, () => console.log(`Created rule "${r.name}": ${r.limit} per ${formatWindow(r.windowMs)} (${r.algorithm})`));
       return true;
     }
     case "delete": {
       const p = need(project, "project name");
       const n = need(name, "rule name");
-      await api(`${base4(p)}/rules/${encodeURIComponent(n)}`, { method: "DELETE" });
+      await api(`${base6(p)}/rules/${encodeURIComponent(n)}`, { method: "DELETE" });
       print({ deleted: n }, () => console.log(`Deleted rule "${n}"`));
       return true;
     }
@@ -1397,7 +2010,7 @@ async function ratelimit(sub, args) {
       const range = flagString(flags, "range") ?? "24h";
       if (!RATELIMIT_STATS_RANGES.includes(range))
         throw new Error(`--range must be one of ${RATELIMIT_STATS_RANGES.join(", ")}`);
-      const stats = await api(`${base4(p)}/stats?range=${range}`);
+      const stats = await api(`${base6(p)}/stats?range=${range}`);
       print(stats, () => {
         const { rules } = stats;
         console.log(`Last ${range}:`);
@@ -1410,13 +2023,13 @@ async function ratelimit(sub, args) {
       return true;
     }
     case "sync": {
-      await sync3(flagString(flags, "config") ?? "mybase.config.ts", flags.has("dry-run"));
+      await sync4(flagString(flags, "config") ?? "mybase.config.ts", flags.has("dry-run"));
       return true;
     }
   }
   return false;
 }
-async function sync3(file, dryRun) {
+async function sync4(file, dryRun) {
   const config = await readConfigFile(file);
   const body = {
     dryRun,
@@ -1428,76 +2041,3188 @@ async function sync3(file, dryRun) {
       burst: rule.burst
     }))
   };
-  printSync(config.project, dryRun, await api(`${base4(config.project)}/rules`, { method: "PUT", body: JSON.stringify(body) }));
+  printSync(config.project, dryRun, await api(`${base6(config.project)}/rules`, { method: "PUT", body: JSON.stringify(body) }));
 }
 
-// src/index.ts
-var projectUsage = `  project create <name>          Create a new project (database + storage bucket)
-  project list                   List projects
-  project delete <name> [--yes]  Delete a project, its database, and all its files`;
-var USAGE = {
-  auth: authUsage,
-  token: tokenUsage,
-  project: projectUsage,
-  context: contextUsage,
-  docs: docsUsage,
-  mcp: mcpUsage,
-  agent: agentUsage,
-  cron: cronUsage,
-  analytics: analyticsUsage,
-  cache: cacheUsage,
-  ratelimit: ratelimitUsage,
-  queue: queueUsage
-};
-var GLOBAL_FLAGS = `  --json                         Print results as JSON (errors too, on stderr)
-  --yes                          Skip confirmations (required without a terminal)
-  MYBASE_API_URL, MYBASE_TOKEN   Override the saved server and token
-  Exit codes: 0 ok, 1 failure, 2 usage, 3 not signed in / bad token, 4 not found`;
-var usage = `Usage: mybase <command> [--json]
-
-Commands:
-${Object.values(USAGE).join(`
-`)}
-  help [<command>]               Show this message, or one command's
+// src/run.ts
+import { constants } from "os";
 
-Flags:
-${GLOBAL_FLAGS}`;
-async function main(args) {
-  const [command, sub, ...rest] = args;
-  if (command === "help" && sub) {
-    const key = ["login", "logout", "whoami", "version"].includes(sub) ? "auth" : sub;
-    if (USAGE[key])
-      return console.log(USAGE[key]);
+// src/secrets.ts
+var secretsUsage = `  secrets enable <project>       Turn on secrets (dev, staging, prod to start)
+  secrets disable <project> [--yes]  Turn them off, deleting every env, value, and revision
+  secrets setup -p <project> -e <env>  Use this project + env in this directory (and below)
+  secrets envs                   List environments
+  secrets env create <name> [--from <root env>]  Create an env (a branch env with --from)
+  secrets env rename <name> <new name>
+  secrets env delete <name> [--yes]  Delete an env, its branch envs, and their history
+  secrets list [--values]        List keys (values hidden unless --values)
+  secrets get <KEY>              Print one value
+  secrets set <KEY=value>\u2026 [--message <m>]  Set keys (KEY=- reads the value from stdin)
+  secrets unset <KEY>\u2026 [--message <m>]
+  secrets upload <.env file> [--message <m>]  Set every key in a .env file
+  secrets history [--limit 20]   Revisions, newest first
+  secrets restore <revision> [--yes]  Put values back as they were after <revision>
+  secrets link --env <env,\u2026> [--yes]  Rotate the project's DB/S3/cache credentials and keep them
+                                 in these envs (DATABASE_URL, S3_*, REDIS_URL, MYBASE_URL)
+  secrets unlink [--yes]         Remove the credentials from the env (they stay valid)
+                                 Project/env: -p/--project, -e/--env, else MYBASE_PROJECT/MYBASE_ENV,
+                                 else \`secrets setup\` for this directory`;
+var expandShortFlags = (args) => args.map((a) => a === "-p" ? "--project" : a === "-e" ? "--env" : a);
+async function target(flags, needEnv = true) {
+  const setup = await dirSetup();
+  const project = flagString(flags, "project") ?? process.env.MYBASE_PROJECT ?? setup?.project;
+  const env = flagString(flags, "env") ?? process.env.MYBASE_ENV ?? setup?.env;
+  if (!project || needEnv && !env) {
+    throw usageError(`which ${project ? "env" : "project"}? Pass -p <project> -e <env>, or run \`mybase secrets setup -p <project> -e <env>\` here once`);
   }
-  if (command && await auth(command, args.slice(1)))
-    return;
-  if (command === "docs" && await docs(args.slice(1)))
-    return;
-  if (command === "context" && await context(args.slice(1)))
-    return;
-  if (command === "mcp" && await mcp(args.slice(1)))
-    return;
-  if (command === "agent" && sub && await agent(sub, rest))
-    return;
-  if (command === "project" && sub === "create") {
-    const name = need(rest[0], "project name");
-    const project = await api("/projects", {
-      method: "POST",
-      body: JSON.stringify({ name })
-    });
-    const { database, storage } = project.credentials;
-    if (jsonMode)
-      return print(project, () => {});
-    console.log(`Created project "${project.name}"
-`);
-    console.log(`Postgres:
-  ${database.url}
+  return { project, env: env ?? "" };
+}
+var base7 = (project) => `/projects/${encodeURIComponent(project)}/secrets`;
+var envPath = (project, env, rest = "") => `${base7(project)}/envs/${encodeURIComponent(env)}${rest}`;
+var fetchSecrets = (project, env) => api(`/secrets/${encodeURIComponent(project)}/${encodeURIComponent(env)}`);
+var describeEnv = (e) => [e.name, e.parent ? `branch of ${e.parent}` : "root", `${e.keys} keys`, `rev ${e.revision}`, e.linked ? "linked" : ""].filter(Boolean).join("\t");
+async function readStdin() {
+  if (process.stdin.isTTY)
+    return (prompt("Value:") ?? "").replace(/\n$/, "");
+  return (await Bun.stdin.text()).replace(/\r?\n$/, "");
+}
+function printUpdate(result, env) {
+  print(result, () => console.log(result.changed === 0 ? `No changes in "${env}".` : `Updated "${env}": ${result.changed} key(s), revision ${result.revision}`));
+}
+async function secrets(sub, args) {
+  const { positional, flags } = parseArgs(expandShortFlags(args));
+  const yes = flags.has("yes");
+  const message = flagString(flags, "message");
+  switch (sub) {
+    case "enable": {
+      const p = need(positional[0] ?? flagString(flags, "project"), "project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/secrets`, { method: "PUT" });
+      const overview = await api(base7(p));
+      print({ enabled: "secrets", project: p, ...overview }, () => {
+        console.log(`Secrets enabled for "${p}": ${overview.envs.map((e) => e.name).join(", ")}
 `);
-    console.log("Storage (S3):");
-    console.log(`  endpoint           ${storage.endpoint}`);
-    console.log(`  region             ${storage.region}`);
-    console.log(`  bucket             ${storage.bucket}`);
-    console.log(`  access key id      ${storage.accessKeyId}`);
+        console.log("Next:");
+        console.log(`  mybase secrets setup -p ${p} -e dev       # once per repo`);
+        console.log(`  mybase secrets set API_URL=https://\u2026      # or: mybase secrets upload .env`);
+        console.log(`  mybase run -- bun start                    # starts your app with them`);
+      });
+      return true;
+    }
+    case "disable": {
+      const p = need(positional[0] ?? flagString(flags, "project"), "project name");
+      confirm(yes, `This deletes every secrets environment, value, and revision of "${p}". They can't be recovered.`, p, "the project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/secrets`, { method: "DELETE" });
+      print({ disabled: "secrets", project: p }, () => console.log(`Secrets disabled for "${p}"`));
+      return true;
+    }
+    case "setup": {
+      const { project, env } = await target(flags);
+      const overview = await api(base7(project));
+      if (!overview.envs.some((e) => e.name === env)) {
+        throw usageError(`"${project}" has no env "${env}" (envs: ${overview.envs.map((e) => e.name).join(", ")})`);
+      }
+      await saveDirSetup(process.cwd(), { project, env });
+      print({ dir: process.cwd(), project, env }, () => console.log(`This directory now uses "${project}" / "${env}". Try: mybase run -- <command>`));
+      return true;
+    }
+    case "envs": {
+      const { project } = await target(flags, false);
+      const overview = await api(base7(project));
+      print(overview.envs, () => {
+        for (const e of overview.envs)
+          console.log(describeEnv(e));
+      });
+      return true;
+    }
+    case "env": {
+      const [action, name, next] = positional;
+      const { project } = await target(flags, false);
+      if (action === "create") {
+        const env = await api(`${base7(project)}/envs`, {
+          method: "POST",
+          body: JSON.stringify({ name: need(name, "env name"), parent: flagString(flags, "from") ?? null })
+        });
+        print(env, () => console.log(`Created "${env.name}"${env.parent ? ` (inherits "${env.parent}")` : ""}`));
+        return true;
+      }
+      if (action === "rename") {
+        const env = await api(envPath(project, need(name, "env name")), { method: "PATCH", body: JSON.stringify({ name: need(next, "new name") }) });
+        print(env, () => console.log(`Renamed "${name}" to "${env.name}"`));
+        return true;
+      }
+      if (action === "delete") {
+        const env = need(name, "env name");
+        confirm(yes, `This deletes env "${env}" of "${project}", its branch envs, and all their values and history.`, env, "the env name");
+        await api(envPath(project, env), { method: "DELETE" });
+        print({ deleted: env, project }, () => console.log(`Deleted "${env}"`));
+        return true;
+      }
+      throw usageError("mybase secrets env create|rename|delete <name>");
+    }
+    case "list": {
+      const { project, env } = await target(flags);
+      const values = flags.has("values");
+      const detail = await api(`${envPath(project, env)}${values ? "?values=1" : ""}`);
+      print(detail, () => {
+        if (detail.secrets.length === 0)
+          console.log(`No keys in "${env}" yet.`);
+        for (const s of detail.secrets) {
+          const tags = [s.inherited ? `from ${detail.env.parent}` : "", s.managed ? "managed" : ""].filter(Boolean).join(", ");
+          console.log(`${values ? `${s.key}=${s.value}` : s.key}${tags ? `	(${tags})` : ""}`);
+        }
+      });
+      return true;
+    }
+    case "get": {
+      const key = need(positional[0], "key");
+      const { project, env } = await target(flags);
+      const { value } = await api(`/secrets/${encodeURIComponent(project)}/${encodeURIComponent(env)}/${encodeURIComponent(key)}`);
+      if (jsonMode)
+        print({ key, value }, () => {});
+      else
+        process.stdout.write(`${value}
+`);
+      return true;
+    }
+    case "set": {
+      if (positional.length === 0)
+        throw usageError("mybase secrets set KEY=value \u2026");
+      const { project, env } = await target(flags);
+      const set = {};
+      for (const pair of positional) {
+        const eq = pair.indexOf("=");
+        if (eq <= 0)
+          throw usageError(`expected KEY=value, got "${pair}"`);
+        const value = pair.slice(eq + 1);
+        set[pair.slice(0, eq)] = value === "-" ? await readStdin() : value;
+      }
+      printUpdate(await api(envPath(project, env, "/secrets"), { method: "PATCH", body: JSON.stringify({ set, message }) }), env);
+      return true;
+    }
+    case "unset": {
+      if (positional.length === 0)
+        throw usageError("mybase secrets unset KEY \u2026");
+      const { project, env } = await target(flags);
+      printUpdate(await api(envPath(project, env, "/secrets"), { method: "PATCH", body: JSON.stringify({ unset: positional, message }) }), env);
+      return true;
+    }
+    case "upload": {
+      const file = Bun.file(need(positional[0], ".env file"));
+      if (!await file.exists())
+        throw usageError(`no file ${positional[0]}`);
+      const set = parseDotenv(await file.text());
+      if (Object.keys(set).length === 0)
+        throw usageError(`no KEY=value lines in ${positional[0]}`);
+      const { project, env } = await target(flags);
+      printUpdate(await api(envPath(project, env, "/secrets"), { method: "PATCH", body: JSON.stringify({ set, message: message ?? `uploaded ${positional[0]}` }) }), env);
+      return true;
+    }
+    case "history": {
+      const { project, env } = await target(flags);
+      const revisions = await api(`${envPath(project, env, "/revisions")}?limit=${flagInt(flags, "limit") ?? 20}`);
+      print(revisions, () => {
+        if (revisions.length === 0)
+          console.log(`No changes in "${env}" yet.`);
+        for (const r of revisions) {
+          const changes = r.changes.map((c) => `${c.action === "added" ? "+" : c.action === "removed" ? "-" : "~"}${c.key}`).join(" ");
+          console.log([`#${r.revision}`, r.createdAt, r.actor, r.message ?? "", changes].join("\t"));
+        }
+      });
+      return true;
+    }
+    case "restore": {
+      const revision = need(positional[0], "revision");
+      const { project, env } = await target(flags);
+      confirm(yes, `This puts the values of "${env}" back as they were after revision ${revision} (as a new revision; linked credentials stay).`, revision, "the revision");
+      printUpdate(await api(envPath(project, env, `/revisions/${encodeURIComponent(revision)}/restore`), { method: "POST" }), env);
+      return true;
+    }
+    case "link": {
+      const { project, env } = await target(flags);
+      const envs = env.split(",").map((e) => e.trim()).filter(Boolean);
+      confirm(yes, `This rotates the credentials of "${project}" (database password, storage key, and cache password if the cache is on) and stores the new ones in ${envs.join(", ")} plus any env linked before. Apps still using the old credentials will stop working.`, project, "the project name");
+      const result = await api(`${base7(project)}/link`, { method: "POST", body: JSON.stringify({ envs }) });
+      print(result, () => {
+        console.log(`Rotated and stored in ${result.envs.join(", ")}: ${result.keys.join(", ")}`);
+        console.log("Restart your apps with `mybase run` to pick them up.");
+      });
+      return true;
+    }
+    case "unlink": {
+      const { project, env } = await target(flags);
+      confirm(yes, `This removes the project credentials from "${env}". They stay valid; nothing is rotated.`, env, "the env name");
+      await api(`${base7(project)}/link/${encodeURIComponent(env)}`, { method: "DELETE" });
+      print({ unlinked: env, project }, () => console.log(`Removed the credentials from "${env}"`));
+      return true;
+    }
+    default:
+      return false;
+  }
+}
+
+// src/run.ts
+var runUsage = `  run [-p <project>] [-e <env>] [--preserve-env] -- <command> [args\u2026]
+                                 Start <command> with the env's secrets as env vars
+                                 (--preserve-env: vars already set win over secrets)`;
+async function run(args) {
+  const { options, command } = splitRunArgs(args);
+  if (command.length === 0)
+    throw usageError(`missing command
+
+${runUsage}`);
+  const { flags } = parseArgs(expandShortFlags(options));
+  const { project, env } = await target(flags);
+  const { secrets } = await fetchSecrets(project, env);
+  const vars = flags.has("preserve-env") ? { ...secrets, ...process.env } : { ...process.env, ...secrets };
+  vars.MYBASE_PROJECT ??= project;
+  vars.MYBASE_ENV = env;
+  let proc;
+  try {
+    proc = Bun.spawn(command, { env: vars, stdio: ["inherit", "inherit", "inherit"] });
+  } catch {
+    throw new CliError(`command not found: ${command[0]}`, 127);
+  }
+  process.on("SIGINT", () => {});
+  for (const signal of ["SIGTERM", "SIGHUP"])
+    process.on(signal, () => proc.kill(signal));
+  const code = await proc.exited;
+  const signal = proc.signalCode;
+  process.exit(signal ? 128 + (constants.signals[signal] ?? 0) : code);
+}
+
+// src/search.ts
+var searchUsage = `  search enable <project>        Turn on web search (SearXNG) for apps and agents
+  search disable <project> [--yes]  Turn it off, clearing cached searches and pages`;
+var servicePath = (project) => `/projects/${encodeURIComponent(project)}/services/search`;
+async function search(sub, args) {
+  const { positional, flags } = parseArgs(args);
+  const [project] = positional;
+  switch (sub) {
+    case "enable": {
+      const p = need(project, "project name");
+      await api(servicePath(p), { method: "PUT" });
+      const searchUrl = `${API_URL}/search/${p}`;
+      print({ enabled: "search", project: p, searchUrl, fetchUrl: `${searchUrl}/fetch` }, () => {
+        console.log(`Web search enabled for "${p}"
+`);
+        console.log(`  search URL  ${searchUrl}?q=\u2026`);
+        console.log(`  fetch URL   ${searchUrl}/fetch?url=\u2026
+`);
+        console.log("In your app (@mybase-dev/sdk), with an API key that has search:read for this project:");
+        console.log(`  mybase token create ${p}-agent --project ${p} --perm search:read
+`);
+        console.log(`  const web = createSearchClient({ apiUrl: "${API_URL}", project: "${p}", apiKey: process.env.MYBASE_API_KEY! })`);
+        console.log(`  const { results } = await web.search("\u2026")   // or searchTools(web) for an LLM agent`);
+      });
+      return true;
+    }
+    case "disable": {
+      const p = need(project, "project name");
+      confirm(flags.has("yes"), `This turns off web search for "${p}" and clears its cached searches and pages.`, p, "the project name");
+      await api(servicePath(p), { method: "DELETE" });
+      print({ disabled: "search", project: p }, () => console.log(`Web search disabled for "${p}"`));
+      return true;
+    }
+    default:
+      return false;
+  }
+}
+
+// ../../node_modules/.bun/@clack+core@1.5.1/node_modules/@clack/core/dist/index.mjs
+import { styleText } from "util";
+import { stdout, stdin } from "process";
+import * as l from "readline";
+import l__default from "readline";
+
+// ../../node_modules/.bun/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
+var getCodePointsLength = (() => {
+  const SURROGATE_PAIR_RE = /[\uD800-\uDBFF][\uDC00-\uDFFF]/g;
+  return (input) => {
+    let surrogatePairsNr = 0;
+    SURROGATE_PAIR_RE.lastIndex = 0;
+    while (SURROGATE_PAIR_RE.test(input)) {
+      surrogatePairsNr += 1;
+    }
+    return input.length - surrogatePairsNr;
+  };
+})();
+var isFullWidth = (x) => {
+  return x === 12288 || x >= 65281 && x <= 65376 || x >= 65504 && x <= 65510;
+};
+var isWideNotCJKTNotEmoji = (x) => {
+  return x === 8987 || x === 9001 || x >= 12272 && x <= 12287 || x >= 12289 && x <= 12350 || x >= 12441 && x <= 12543 || x >= 12549 && x <= 12591 || x >= 12593 && x <= 12686 || x >= 12688 && x <= 12771 || x >= 12783 && x <= 12830 || x >= 12832 && x <= 12871 || x >= 12880 && x <= 19903 || x >= 65040 && x <= 65049 || x >= 65072 && x <= 65106 || x >= 65108 && x <= 65126 || x >= 65128 && x <= 65131 || x >= 127488 && x <= 127490 || x >= 127504 && x <= 127547 || x >= 127552 && x <= 127560 || x >= 131072 && x <= 196605 || x >= 196608 && x <= 262141;
+};
+
+// ../../node_modules/.bun/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/index.js
+var ANSI_RE = /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y;
+var CONTROL_RE = /[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y;
+var CJKT_WIDE_RE = /(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu;
+var TAB_RE = /\t{1,1000}/y;
+var EMOJI_RE = /[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F\u20E3?))*/yu;
+var LATIN_RE = /(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y;
+var MODIFIER_RE = /\p{M}+/gu;
+var NO_TRUNCATION = { limit: Infinity, ellipsis: "" };
+var getStringTruncatedWidth = (input, truncationOptions = {}, widthOptions = {}) => {
+  const LIMIT = truncationOptions.limit ?? Infinity;
+  const ELLIPSIS = truncationOptions.ellipsis ?? "";
+  const ELLIPSIS_WIDTH = truncationOptions?.ellipsisWidth ?? (ELLIPSIS ? getStringTruncatedWidth(ELLIPSIS, NO_TRUNCATION, widthOptions).width : 0);
+  const ANSI_WIDTH = 0;
+  const CONTROL_WIDTH = widthOptions.controlWidth ?? 0;
+  const TAB_WIDTH = widthOptions.tabWidth ?? 8;
+  const EMOJI_WIDTH = widthOptions.emojiWidth ?? 2;
+  const FULL_WIDTH_WIDTH = 2;
+  const REGULAR_WIDTH = widthOptions.regularWidth ?? 1;
+  const WIDE_WIDTH = widthOptions.wideWidth ?? FULL_WIDTH_WIDTH;
+  const PARSE_BLOCKS = [
+    [LATIN_RE, REGULAR_WIDTH],
+    [ANSI_RE, ANSI_WIDTH],
+    [CONTROL_RE, CONTROL_WIDTH],
+    [TAB_RE, TAB_WIDTH],
+    [EMOJI_RE, EMOJI_WIDTH],
+    [CJKT_WIDE_RE, WIDE_WIDTH]
+  ];
+  let indexPrev = 0;
+  let index = 0;
+  let length = input.length;
+  let lengthExtra = 0;
+  let truncationEnabled = false;
+  let truncationIndex = length;
+  let truncationLimit = Math.max(0, LIMIT - ELLIPSIS_WIDTH);
+  let unmatchedStart = 0;
+  let unmatchedEnd = 0;
+  let width = 0;
+  let widthExtra = 0;
+  outer:
+    while (true) {
+      if (unmatchedEnd > unmatchedStart || index >= length && index > indexPrev) {
+        const unmatched = input.slice(unmatchedStart, unmatchedEnd) || input.slice(indexPrev, index);
+        lengthExtra = 0;
+        for (const char of unmatched.replaceAll(MODIFIER_RE, "")) {
+          const codePoint = char.codePointAt(0) || 0;
+          if (isFullWidth(codePoint)) {
+            widthExtra = FULL_WIDTH_WIDTH;
+          } else if (isWideNotCJKTNotEmoji(codePoint)) {
+            widthExtra = WIDE_WIDTH;
+          } else {
+            widthExtra = REGULAR_WIDTH;
+          }
+          if (width + widthExtra > truncationLimit) {
+            truncationIndex = Math.min(truncationIndex, Math.max(unmatchedStart, indexPrev) + lengthExtra);
+          }
+          if (width + widthExtra > LIMIT) {
+            truncationEnabled = true;
+            break outer;
+          }
+          lengthExtra += char.length;
+          width += widthExtra;
+        }
+        unmatchedStart = unmatchedEnd = 0;
+      }
+      if (index >= length) {
+        break outer;
+      }
+      for (let i = 0, l = PARSE_BLOCKS.length;i < l; i++) {
+        const [BLOCK_RE, BLOCK_WIDTH] = PARSE_BLOCKS[i];
+        BLOCK_RE.lastIndex = index;
+        if (BLOCK_RE.test(input)) {
+          lengthExtra = BLOCK_RE === CJKT_WIDE_RE ? getCodePointsLength(input.slice(index, BLOCK_RE.lastIndex)) : BLOCK_RE === EMOJI_RE ? 1 : BLOCK_RE.lastIndex - index;
+          widthExtra = lengthExtra * BLOCK_WIDTH;
+          if (width + widthExtra > truncationLimit) {
+            truncationIndex = Math.min(truncationIndex, index + Math.floor((truncationLimit - width) / BLOCK_WIDTH));
+          }
+          if (width + widthExtra > LIMIT) {
+            truncationEnabled = true;
+            break outer;
+          }
+          width += widthExtra;
+          unmatchedStart = indexPrev;
+          unmatchedEnd = index;
+          index = indexPrev = BLOCK_RE.lastIndex;
+          continue outer;
+        }
+      }
+      index += 1;
+    }
+  return {
+    width: truncationEnabled ? truncationLimit : width,
+    index: truncationEnabled ? truncationIndex : length,
+    truncated: truncationEnabled,
+    ellipsed: truncationEnabled && LIMIT >= ELLIPSIS_WIDTH
+  };
+};
+var dist_default = getStringTruncatedWidth;
+
+// ../../node_modules/.bun/fast-string-width@3.0.2/node_modules/fast-string-width/dist/index.js
+var NO_TRUNCATION2 = {
+  limit: Infinity,
+  ellipsis: "",
+  ellipsisWidth: 0
+};
+var fastStringWidth = (input, options = {}) => {
+  return dist_default(input, NO_TRUNCATION2, options).width;
+};
+var dist_default2 = fastStringWidth;
+
+// ../../node_modules/.bun/fast-wrap-ansi@0.2.2/node_modules/fast-wrap-ansi/lib/main.js
+var ESC = "\x1B";
+var CSI = "\x9B";
+var END_CODE = 39;
+var ANSI_ESCAPE_BELL = "\x07";
+var ANSI_CSI = "[";
+var ANSI_OSC = "]";
+var ANSI_SGR_TERMINATOR = "m";
+var ANSI_ESCAPE_LINK = `${ANSI_OSC}8;;`;
+var GROUP_REGEX = new RegExp(`(?:\\${ANSI_CSI}(?<code>\\d+)m|\\${ANSI_ESCAPE_LINK}(?<uri>.*)${ANSI_ESCAPE_BELL})`, "y");
+var getClosingCode = (openingCode) => {
+  if (openingCode >= 30 && openingCode <= 37)
+    return 39;
+  if (openingCode >= 90 && openingCode <= 97)
+    return 39;
+  if (openingCode >= 40 && openingCode <= 47)
+    return 49;
+  if (openingCode >= 100 && openingCode <= 107)
+    return 49;
+  if (openingCode === 1 || openingCode === 2)
+    return 22;
+  if (openingCode === 3)
+    return 23;
+  if (openingCode === 4)
+    return 24;
+  if (openingCode === 7)
+    return 27;
+  if (openingCode === 8)
+    return 28;
+  if (openingCode === 9)
+    return 29;
+  if (openingCode === 0)
+    return 0;
+  return;
+};
+var wrapAnsiCode = (code) => `${ESC}${ANSI_CSI}${code}${ANSI_SGR_TERMINATOR}`;
+var wrapAnsiHyperlink = (url) => `${ESC}${ANSI_ESCAPE_LINK}${url}${ANSI_ESCAPE_BELL}`;
+var wrapWord = (rows, word, columns) => {
+  const characters = word[Symbol.iterator]();
+  let isInsideEscape = false;
+  let isInsideLinkEscape = false;
+  let lastRow = rows.at(-1);
+  let visible = lastRow === undefined ? 0 : dist_default2(lastRow);
+  let currentCharacter = characters.next();
+  let nextCharacter = characters.next();
+  let rawCharacterIndex = 0;
+  while (!currentCharacter.done) {
+    const character = currentCharacter.value;
+    const characterLength = dist_default2(character);
+    if (visible + characterLength <= columns) {
+      rows[rows.length - 1] += character;
+    } else {
+      rows.push(character);
+      visible = 0;
+    }
+    if (character === ESC || character === CSI) {
+      isInsideEscape = true;
+      isInsideLinkEscape = word.startsWith(ANSI_ESCAPE_LINK, rawCharacterIndex + 1);
+    }
+    if (isInsideEscape) {
+      if (isInsideLinkEscape) {
+        if (character === ANSI_ESCAPE_BELL) {
+          isInsideEscape = false;
+          isInsideLinkEscape = false;
+        }
+      } else if (character === ANSI_SGR_TERMINATOR) {
+        isInsideEscape = false;
+      }
+    } else {
+      visible += characterLength;
+      if (visible === columns && !nextCharacter.done) {
+        rows.push("");
+        visible = 0;
+      }
+    }
+    currentCharacter = nextCharacter;
+    nextCharacter = characters.next();
+    rawCharacterIndex += character.length;
+  }
+  lastRow = rows.at(-1);
+  if (!visible && lastRow !== undefined && lastRow.length && rows.length > 1) {
+    rows[rows.length - 2] += rows.pop();
+  }
+};
+var stringVisibleTrimSpacesRight = (string) => {
+  const words = string.split(" ");
+  let last = words.length;
+  while (last) {
+    if (dist_default2(words[last - 1])) {
+      break;
+    }
+    last--;
+  }
+  if (last === words.length) {
+    return string;
+  }
+  return words.slice(0, last).join(" ") + words.slice(last).join("");
+};
+var exec = (string, columns, options = {}) => {
+  if (options.trim !== false && string.trim() === "") {
+    return "";
+  }
+  let returnValue = "";
+  let escapeCode;
+  let escapeUrl;
+  const words = string.split(" ");
+  let rows = [""];
+  let rowLength = 0;
+  for (let index = 0;index < words.length; index++) {
+    const word = words[index];
+    if (options.trim !== false) {
+      const row = rows.at(-1) ?? "";
+      const trimmed = row.trimStart();
+      if (row.length !== trimmed.length) {
+        rows[rows.length - 1] = trimmed;
+        rowLength = dist_default2(trimmed);
+      }
+    }
+    if (index !== 0) {
+      if (rowLength >= columns && (options.wordWrap === false || options.trim === false)) {
+        rows.push("");
+        rowLength = 0;
+      }
+      if (rowLength || options.trim === false) {
+        rows[rows.length - 1] += " ";
+        rowLength++;
+      }
+    }
+    const wordLength = dist_default2(word);
+    if (options.hard && wordLength > columns) {
+      const remainingColumns = columns - rowLength;
+      const breaksStartingThisLine = 1 + Math.floor((wordLength - remainingColumns - 1) / columns);
+      const breaksStartingNextLine = Math.floor((wordLength - 1) / columns);
+      if (breaksStartingNextLine < breaksStartingThisLine) {
+        rows.push("");
+      }
+      wrapWord(rows, word, columns);
+      rowLength = dist_default2(rows.at(-1) ?? "");
+      continue;
+    }
+    if (rowLength + wordLength > columns && rowLength && wordLength) {
+      if (options.wordWrap === false && rowLength < columns) {
+        wrapWord(rows, word, columns);
+        rowLength = dist_default2(rows.at(-1) ?? "");
+        continue;
+      }
+      rows.push("");
+      rowLength = 0;
+    }
+    if (rowLength + wordLength > columns && options.wordWrap === false) {
+      wrapWord(rows, word, columns);
+      rowLength = dist_default2(rows.at(-1) ?? "");
+      continue;
+    }
+    rows[rows.length - 1] += word;
+    rowLength += wordLength;
+  }
+  if (options.trim !== false) {
+    rows = rows.map((row) => stringVisibleTrimSpacesRight(row));
+  }
+  const preString = rows.join(`
+`);
+  let inSurrogate = false;
+  for (let i = 0;i < preString.length; i++) {
+    const character = preString[i];
+    returnValue += character;
+    if (!inSurrogate) {
+      inSurrogate = character >= "\uD800" && character <= "\uDBFF";
+      if (inSurrogate) {
+        continue;
+      }
+    } else {
+      inSurrogate = false;
+    }
+    if (character === ESC || character === CSI) {
+      GROUP_REGEX.lastIndex = i + 1;
+      const groupsResult = GROUP_REGEX.exec(preString);
+      const groups = groupsResult?.groups;
+      if (groups?.code !== undefined) {
+        const code = Number.parseFloat(groups.code);
+        escapeCode = code === END_CODE ? undefined : code;
+      } else if (groups?.uri !== undefined) {
+        escapeUrl = groups.uri.length === 0 ? undefined : groups.uri;
+      }
+    }
+    if (preString[i + 1] === `
+`) {
+      if (escapeUrl) {
+        returnValue += wrapAnsiHyperlink("");
+      }
+      const closingCode = escapeCode ? getClosingCode(escapeCode) : undefined;
+      if (escapeCode && closingCode) {
+        returnValue += wrapAnsiCode(closingCode);
+      }
+    } else if (character === `
+`) {
+      if (escapeCode && getClosingCode(escapeCode)) {
+        returnValue += wrapAnsiCode(escapeCode);
+      }
+      if (escapeUrl) {
+        returnValue += wrapAnsiHyperlink(escapeUrl);
+      }
+    }
+  }
+  return returnValue;
+};
+var CRLF_OR_LF = /\r?\n/;
+function wrapAnsi(string, columns, options) {
+  return String(string).normalize().split(CRLF_OR_LF).map((line) => exec(line, columns, options)).join(`
+`);
+}
+
+// ../../node_modules/.bun/@clack+core@1.5.1/node_modules/@clack/core/dist/index.mjs
+var import_sisteransi = __toESM(require_src(), 1);
+import { ReadStream } from "tty";
+function findCursor(s, o, l) {
+  if (!l.some((r) => !r.disabled))
+    return s;
+  const t = s + o, n = Math.max(l.length - 1, 0), e = t < 0 ? n : t > n ? 0 : t;
+  return l[e]?.disabled ? findCursor(e, o < 0 ? -1 : 1, l) : e;
+}
+var a$1 = ["up", "down", "left", "right", "space", "enter", "cancel"];
+var t = [
+  "January",
+  "February",
+  "March",
+  "April",
+  "May",
+  "June",
+  "July",
+  "August",
+  "September",
+  "October",
+  "November",
+  "December"
+];
+var settings = {
+  actions: new Set(a$1),
+  aliases: /* @__PURE__ */ new Map([
+    ["k", "up"],
+    ["j", "down"],
+    ["h", "left"],
+    ["l", "right"],
+    ["\x03", "cancel"],
+    ["escape", "cancel"]
+  ]),
+  messages: {
+    cancel: "Canceled",
+    error: "Something went wrong"
+  },
+  withGuide: true,
+  accessible: undefined,
+  date: {
+    monthNames: [...t],
+    messages: {
+      required: "Please enter a valid date",
+      invalidMonth: "There are only 12 months in a year",
+      invalidDay: (n, e) => `There are only ${n} days in ${e}`,
+      afterMin: (n) => `Date must be on or after ${n.toISOString().slice(0, 10)}`,
+      beforeMax: (n) => `Date must be on or before ${n.toISOString().slice(0, 10)}`
+    }
+  }
+};
+function isAccessible(n) {
+  if (n !== undefined)
+    return n;
+  if (settings.accessible !== undefined)
+    return settings.accessible;
+  const e = process.env.ACCESSIBLE;
+  return e !== undefined && e !== "" && e !== "0" && e !== "false";
+}
+function isActionKey(n, e) {
+  if (typeof n == "string")
+    return settings.aliases.get(n) === e;
+  for (const s of n)
+    if (s !== undefined && isActionKey(s, e))
+      return true;
+  return false;
+}
+function diffLines(i, s) {
+  if (i === s)
+    return;
+  const e = i.split(`
+`), t = s.split(`
+`), r = Math.max(e.length, t.length), f = [];
+  for (let n = 0;n < r; n++)
+    e[n] !== t[n] && f.push(n);
+  return {
+    lines: f,
+    numLinesBefore: e.length,
+    numLinesAfter: t.length,
+    numLines: r
+  };
+}
+var R = globalThis.process.platform.startsWith("win");
+var CANCEL_SYMBOL = Symbol("clack:cancel");
+function isCancel(e) {
+  return e === CANCEL_SYMBOL;
+}
+function setRawMode(e, r) {
+  const o = e;
+  o.isTTY && o.setRawMode(r);
+}
+function block({
+  input: e = stdin,
+  output: r = stdout,
+  overwrite: o = true,
+  hideCursor: n = true
+} = {}) {
+  const s = l.createInterface({
+    input: e,
+    output: r,
+    prompt: "",
+    tabSize: 1
+  });
+  l.emitKeypressEvents(e, s), e instanceof ReadStream && e.isTTY && e.setRawMode(true);
+  const t = (f, { name: a, sequence: w }) => {
+    const c = String(f);
+    if (isActionKey([c, a, w], "cancel")) {
+      n && r.write(import_sisteransi.cursor.show), process.exit(0);
+      return;
+    }
+    if (!o)
+      return;
+    const i = a === "return" ? 0 : -1, m = a === "return" ? -1 : 0;
+    l.moveCursor(r, i, m, () => {
+      l.clearLine(r, 1, () => {
+        e.once("keypress", t);
+      });
+    });
+  };
+  return n && r.write(import_sisteransi.cursor.hide), e.once("keypress", t), () => {
+    e.off("keypress", t), n && r.write(import_sisteransi.cursor.show), e instanceof ReadStream && e.isTTY && !R && e.setRawMode(false), s.terminal = false, s.close();
+  };
+}
+var getColumns = (e) => ("columns" in e) && typeof e.columns == "number" ? e.columns : 80;
+var getRows = (e) => ("rows" in e) && typeof e.rows == "number" ? e.rows : 20;
+function wrapTextWithPrefix(e, r, o, n = o, s = o, t) {
+  const f = getColumns(e ?? stdout);
+  return wrapAnsi(r, f - o.length, {
+    hard: true,
+    trim: false
+  }).split(`
+`).map((c, i, m) => {
+    const d = t ? t(c, i) : c;
+    return i === 0 ? `${n}${d}` : i === m.length - 1 ? `${s}${d}` : `${o}${d}`;
+  }).join(`
+`);
+}
+function runValidation(e, a) {
+  if ("~standard" in e) {
+    const n = e["~standard"].validate(a);
+    return n instanceof Promise ? n.then((r) => r.issues?.at(0)?.message) : n.issues?.at(0)?.message;
+  }
+  return e(a);
+}
+
+class y {
+  input;
+  output;
+  _abortSignal;
+  rl;
+  opts;
+  _render;
+  _track = false;
+  _prevFrame = "";
+  _subscribers = /* @__PURE__ */ new Map;
+  _cursor = 0;
+  state = "initial";
+  error = "";
+  value;
+  userInput = "";
+  get accessible() {
+    return isAccessible(this.opts.accessible);
+  }
+  constructor(t, e = true) {
+    const { input: i = stdin, output: s = stdout, render: r, signal: n, ...o } = t;
+    this.opts = o, this.onKeypress = this.onKeypress.bind(this), this.close = this.close.bind(this), this.render = this.render.bind(this), this._render = r.bind(this), this._track = e, this._abortSignal = n, this.input = i, this.output = s;
+  }
+  unsubscribe() {
+    this._subscribers.clear();
+  }
+  setSubscriber(t, e) {
+    const i = this._subscribers.get(t) ?? [];
+    i.push(e), this._subscribers.set(t, i);
+  }
+  on(t, e) {
+    this.setSubscriber(t, { cb: e });
+  }
+  once(t, e) {
+    this.setSubscriber(t, { cb: e, once: true });
+  }
+  emit(t, ...e) {
+    const i = this._subscribers.get(t) ?? [], s = [];
+    for (const r of i)
+      r.cb(...e), r.once && s.push(() => i.splice(i.indexOf(r), 1));
+    for (const r of s)
+      r();
+  }
+  prompt() {
+    return new Promise((t) => {
+      if (this._abortSignal) {
+        if (this._abortSignal.aborted)
+          return this.state = "cancel", this.close(), t(CANCEL_SYMBOL);
+        this._abortSignal.addEventListener("abort", () => {
+          this.state = "cancel", this.close();
+        }, { once: true });
+      }
+      this.rl = l__default.createInterface({
+        input: this.input,
+        tabSize: 2,
+        prompt: "",
+        escapeCodeTimeout: 50,
+        terminal: true
+      }), this.rl.prompt(), this.opts.initialUserInput !== undefined && this._setUserInput(this.opts.initialUserInput, true), this.input.on("keypress", this.onKeypress), setRawMode(this.input, true), this.output.on("resize", this.render), this.render(), this.once("submit", () => {
+        this.output.write(import_sisteransi.cursor.show), this.output.off("resize", this.render), setRawMode(this.input, false), t(this.value);
+      }), this.once("cancel", () => {
+        this.output.write(import_sisteransi.cursor.show), this.output.off("resize", this.render), setRawMode(this.input, false), t(CANCEL_SYMBOL);
+      });
+    });
+  }
+  _isActionKey(t, e) {
+    return t === "\t";
+  }
+  _shouldSubmit(t, e) {
+    return true;
+  }
+  _setValue(t) {
+    this.value = t, this.emit("value", this.value);
+  }
+  _setUserInput(t, e) {
+    this.userInput = t ?? "", this.emit("userInput", this.userInput), e && this._track && this.rl && (this.rl.write(this.userInput), this._cursor = this.rl.cursor);
+  }
+  _clearUserInput() {
+    this.rl?.write(null, { ctrl: true, name: "u" }), this._setUserInput("");
+  }
+  async onKeypress(t, e) {
+    if (this.state !== "validating") {
+      if (this._track && e.name !== "return" && (e.name && this._isActionKey(t, e) && this.rl?.write(null, { ctrl: true, name: "h" }), this._cursor = this.rl?.cursor ?? 0, this._setUserInput(this.rl?.line)), this.state === "error" && (this.state = "active"), e?.name && (!this._track && settings.aliases.has(e.name) && this.emit("cursor", settings.aliases.get(e.name)), settings.actions.has(e.name) && this.emit("cursor", e.name)), t && (t.toLowerCase() === "y" || t.toLowerCase() === "n") && this.emit("confirm", t.toLowerCase() === "y"), this.emit("key", t, e), e?.name === "return" && this._shouldSubmit(t, e)) {
+        if (this.opts.validate) {
+          const i = runValidation(this.opts.validate, this.value);
+          let s;
+          i instanceof Promise ? (this.state = "validating", this.render(), s = await i) : s = i, s && (this.error = s instanceof Error ? s.message : s, this.state = "error", this.rl?.write(this.userInput));
+        }
+        this.state !== "error" && (this.state = "submit");
+      }
+      isActionKey([t, e?.name, e?.sequence], "cancel") && (this.state = "cancel"), (this.state === "submit" || this.state === "cancel") && this.emit("finalize"), this.render(), (this.state === "submit" || this.state === "cancel") && this.close();
+    }
+  }
+  close() {
+    this.input.unpipe(), this.input.removeListener("keypress", this.onKeypress), this.output.write(`
+`), setRawMode(this.input, false), this.rl?.close(), this.rl = undefined, this.emit(`${this.state}`, this.value), this.unsubscribe();
+  }
+  restoreCursor() {
+    const t = wrapAnsi(this._prevFrame, process.stdout.columns, { hard: true, trim: false }).split(`
+`).length - 1;
+    this.output.write(import_sisteransi.cursor.move(-999, t * -1));
+  }
+  render() {
+    const t = wrapAnsi(this._render(this) ?? "", process.stdout.columns, {
+      hard: true,
+      trim: false
+    });
+    if (t !== this._prevFrame) {
+      if (this.state === "initial")
+        this.output.write(import_sisteransi.cursor.hide);
+      else {
+        const e = diffLines(this._prevFrame, t), i = getRows(this.output);
+        if (this.restoreCursor(), e) {
+          const s = Math.max(0, e.numLinesAfter - i), r = Math.max(0, e.numLinesBefore - i);
+          let n = e.lines.find((o) => o >= s);
+          if (n === undefined) {
+            this._prevFrame = t;
+            return;
+          }
+          if (e.lines.length === 1) {
+            this.output.write(import_sisteransi.cursor.move(0, n - r)), this.output.write(import_sisteransi.erase.lines(1));
+            const o = t.split(`
+`);
+            this.output.write(o[n]), this._prevFrame = t, this.output.write(import_sisteransi.cursor.move(0, o.length - n - 1));
+            return;
+          } else if (e.lines.length > 1) {
+            if (s < r)
+              n = s;
+            else {
+              const h = n - r;
+              h > 0 && this.output.write(import_sisteransi.cursor.move(0, h));
+            }
+            this.output.write(import_sisteransi.erase.down());
+            const f = t.split(`
+`).slice(n);
+            this.output.write(f.join(`
+`)), this._prevFrame = t;
+            return;
+          }
+        }
+        this.output.write(import_sisteransi.erase.down());
+      }
+      this.output.write(t), this.state === "initial" && (this.state = "active"), this._prevFrame = t;
+    }
+  }
+}
+class r extends y {
+  get cursor() {
+    return this.value ? 0 : 1;
+  }
+  get _value() {
+    return this.cursor === 0;
+  }
+  constructor(t) {
+    super(t, false), this.value = !!t.initialValue, this.on("userInput", () => {
+      this.value = this._value;
+    }), this.on("confirm", (i) => {
+      this.output.write(import_sisteransi.cursor.move(0, -1)), this.value = i, this.state = "submit", this.close();
+    }), this.on("cursor", () => {
+      this.value = !this.value;
+    });
+  }
+}
+class a extends y {
+  options;
+  cursor = 0;
+  get _value() {
+    return this.options[this.cursor]?.value;
+  }
+  get _enabledOptions() {
+    return this.options.filter((e) => e.disabled !== true);
+  }
+  toggleAll() {
+    const e = this._enabledOptions, i = this.value !== undefined && this.value.length === e.length;
+    this.value = i ? [] : e.map((t) => t.value);
+  }
+  toggleInvert() {
+    const e = this.value;
+    if (!e)
+      return;
+    const i = this._enabledOptions.filter((t) => !e.includes(t.value));
+    this.value = i.map((t) => t.value);
+  }
+  toggleValue() {
+    this.value === undefined && (this.value = []);
+    const e = this.value.includes(this._value);
+    this.value = e ? this.value.filter((i) => i !== this._value) : [...this.value, this._value];
+  }
+  constructor(e) {
+    super(e, false), this.options = e.options, this.value = [...e.initialValues ?? []];
+    const i = Math.max(this.options.findIndex(({ value: t }) => t === e.cursorAt), 0);
+    this.cursor = this.options[i]?.disabled ? findCursor(i, 1, this.options) : i, this.on("key", (t, l) => {
+      l.name === "a" && this.toggleAll(), l.name === "i" && this.toggleInvert();
+    }), this.on("cursor", (t) => {
+      switch (t) {
+        case "left":
+        case "up":
+          this.cursor = findCursor(this.cursor, -1, this.options);
+          break;
+        case "down":
+        case "right":
+          this.cursor = findCursor(this.cursor, 1, this.options);
+          break;
+        case "space":
+          this.toggleValue();
+          break;
+      }
+    });
+  }
+}
+var u$1 = class u extends y {
+  _mask = "\u2022";
+  get cursor() {
+    return this._cursor;
+  }
+  get masked() {
+    return this.userInput.replaceAll(/./g, this._mask);
+  }
+  get userInputWithCursor() {
+    if (this.state === "submit" || this.state === "cancel")
+      return this.masked;
+    const t = this.userInput;
+    if (this.cursor >= t.length)
+      return `${this.masked}${styleText(["inverse", "hidden"], "_")}`;
+    const s = this.masked, r = s.slice(0, this.cursor), i = s.slice(this.cursor, this.cursor + 1), o = s.slice(this.cursor + 1);
+    return `${r}${styleText("inverse", i)}${o}`;
+  }
+  clear() {
+    this._clearUserInput();
+  }
+  constructor({ mask: t, ...s }) {
+    super(s), this._mask = t ?? "\u2022", this.on("userInput", (r) => {
+      this._setValue(r);
+    }), this.on("finalize", () => {
+      this.value === undefined && (this.value = "");
+    });
+  }
+};
+var n$1 = class n extends y {
+  options;
+  cursor = 0;
+  get _selectedValue() {
+    return this.options[this.cursor];
+  }
+  changeValue() {
+    const e = this._selectedValue;
+    this.value = e === undefined ? undefined : e.value;
+  }
+  constructor(e) {
+    super(e, false), this.options = e.options;
+    const o = this.options.findIndex(({ value: s }) => s === e.initialValue), t = o === -1 ? 0 : o;
+    this.cursor = this.options[t]?.disabled ? findCursor(t, 1, this.options) : t, this.changeValue(), this.on("cursor", (s) => {
+      switch (s) {
+        case "left":
+        case "up":
+          this.cursor = findCursor(this.cursor, -1, this.options);
+          break;
+        case "down":
+        case "right":
+          this.cursor = findCursor(this.cursor, 1, this.options);
+          break;
+      }
+      this.changeValue();
+    });
+  }
+};
+class n extends y {
+  get userInputWithCursor() {
+    if (this.state === "submit")
+      return this.userInput;
+    const t = this.userInput;
+    if (this.cursor >= t.length)
+      return `${this.userInput}\u2588`;
+    const r = t.slice(0, this.cursor), s = t.slice(this.cursor, this.cursor + 1), e = t.slice(this.cursor + 1);
+    return `${r}${styleText("inverse", s)}${e}`;
+  }
+  get cursor() {
+    return this._cursor;
+  }
+  constructor(t) {
+    super({
+      ...t,
+      initialUserInput: t.initialUserInput ?? t.initialValue
+    }), this.on("userInput", (r) => {
+      this._setValue(r);
+    }), this.on("finalize", () => {
+      this.value || (this.value = t.defaultValue), this.value === undefined && (this.value = "");
+    });
+  }
+}
+
+// ../../node_modules/.bun/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
+import { styleText as styleText2, stripVTControlCharacters } from "util";
+import process$1 from "process";
+var import_sisteransi2 = __toESM(require_src(), 1);
+function isUnicodeSupported() {
+  if (process$1.platform !== "win32") {
+    return process$1.env.TERM !== "linux";
+  }
+  return Boolean(process$1.env.CI) || Boolean(process$1.env.WT_SESSION) || Boolean(process$1.env.TERMINUS_SUBLIME) || process$1.env.ConEmuTask === "{cmd::Cmder}" || process$1.env.TERM_PROGRAM === "Terminus-Sublime" || process$1.env.TERM_PROGRAM === "vscode" || process$1.env.TERM === "xterm-256color" || process$1.env.TERM === "alacritty" || process$1.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
+}
+var unicode = isUnicodeSupported();
+var isCI = () => process.env.CI === "true";
+var unicodeOr = (o, e) => unicode ? o : e;
+var S_STEP_ACTIVE = unicodeOr("\u25C6", "*");
+var S_STEP_CANCEL = unicodeOr("\u25A0", "x");
+var S_STEP_ERROR = unicodeOr("\u25B2", "x");
+var S_STEP_SUBMIT = unicodeOr("\u25C7", "o");
+var S_BAR_START = unicodeOr("\u250C", "T");
+var S_BAR = unicodeOr("\u2502", "|");
+var S_BAR_END = unicodeOr("\u2514", "\u2014");
+var S_BAR_START_RIGHT = unicodeOr("\u2510", "T");
+var S_BAR_END_RIGHT = unicodeOr("\u2518", "\u2014");
+var S_RADIO_ACTIVE = unicodeOr("\u25CF", ">");
+var S_RADIO_INACTIVE = unicodeOr("\u25CB", " ");
+var S_CHECKBOX_ACTIVE = unicodeOr("\u25FB", "[\u2022]");
+var S_CHECKBOX_SELECTED = unicodeOr("\u25FC", "[+]");
+var S_CHECKBOX_INACTIVE = unicodeOr("\u25FB", "[ ]");
+var S_PASSWORD_MASK = unicodeOr("\u25AA", "\u2022");
+var S_BAR_H = unicodeOr("\u2500", "-");
+var S_CORNER_TOP_RIGHT = unicodeOr("\u256E", "+");
+var S_CONNECT_LEFT = unicodeOr("\u251C", "+");
+var S_CORNER_BOTTOM_RIGHT = unicodeOr("\u256F", "+");
+var S_CORNER_BOTTOM_LEFT = unicodeOr("\u2570", "+");
+var S_CORNER_TOP_LEFT = unicodeOr("\u256D", "+");
+var S_INFO = unicodeOr("\u25CF", "\u2022");
+var S_SUCCESS = unicodeOr("\u25C6", "*");
+var S_WARN = unicodeOr("\u25B2", "!");
+var S_ERROR = unicodeOr("\u25A0", "x");
+var symbol = (o) => {
+  switch (o) {
+    case "initial":
+    case "active":
+      return styleText2("cyan", S_STEP_ACTIVE);
+    case "cancel":
+      return styleText2("red", S_STEP_CANCEL);
+    case "error":
+      return styleText2("yellow", S_STEP_ERROR);
+    case "submit":
+      return styleText2("green", S_STEP_SUBMIT);
+    case "validating":
+      return styleText2("dim", S_STEP_ACTIVE);
+  }
+};
+var symbolBar = (o) => {
+  switch (o) {
+    case "initial":
+    case "active":
+      return styleText2("cyan", S_BAR);
+    case "cancel":
+      return styleText2("red", S_BAR);
+    case "error":
+      return styleText2("yellow", S_BAR);
+    case "submit":
+      return styleText2("green", S_BAR);
+  }
+};
+function formatInstructionFooter(o, e) {
+  const r = [`${e ? `${styleText2("cyan", S_BAR)}  ` : ""}${o.join(" \u2022 ")}`];
+  return e && r.push(styleText2("cyan", S_BAR_END)), r;
+}
+var I = (l, e, w, p, b, C = false) => {
+  let r = e, O = 0;
+  if (C)
+    for (let i = p - 1;i >= w; i--) {
+      const m = l[i];
+      if (m && (r -= m.length), O++, r <= b)
+        break;
+    }
+  else
+    for (let i = w;i < p; i++) {
+      const m = l[i];
+      if (m && (r -= m.length), O++, r <= b)
+        break;
+    }
+  return { lineCount: r, removals: O };
+};
+var limitOptions = ({
+  cursor: l,
+  options: e,
+  style: w,
+  output: p = process.stdout,
+  maxItems: b = Number.POSITIVE_INFINITY,
+  columnPadding: C = 0,
+  rowPadding: r = 4
+}) => {
+  const i = getColumns(p) - C, m = getRows(p), M = styleText2("dim", "..."), v = Math.max(m - r, 0), a = Math.max(Math.min(b, v), 5);
+  let f = 0;
+  l >= a - 3 && (f = Math.max(Math.min(l - a + 3, e.length - a), 0));
+  let d = a < e.length && f > 0, c = a < e.length && f + a < e.length;
+  const W = Math.min(f + a, e.length), s = [];
+  let g = 0;
+  d && g++, c && g++;
+  const T = f + (d ? 1 : 0), y = W - (c ? 1 : 0);
+  for (let t = T;t < y; t++) {
+    const n = e[t], o = n ? w(n, t === l) : "", h = wrapAnsi(o, i, {
+      hard: true,
+      trim: false
+    }).split(`
+`);
+    s.push(h), g += h.length;
+  }
+  if (g > v) {
+    let t = 0, n = 0, o = g;
+    const h = l - T;
+    let u = v;
+    const L = () => I(s, o, 0, h, u), E = () => I(s, o, h + 1, s.length, u, true);
+    d ? ({ lineCount: o, removals: t } = L(), o > u && (c || (u -= 1), { lineCount: o, removals: n } = E())) : (c || (u -= 1), { lineCount: o, removals: n } = E(), o > u && (u -= 1, { lineCount: o, removals: t } = L())), t > 0 && (d = true, s.splice(0, t)), n > 0 && (c = true, s.splice(s.length - n, n));
+  }
+  const x = [];
+  d && x.push(M);
+  for (const t of s)
+    for (const n of t)
+      x.push(n);
+  return c && x.push(M), x;
+};
+var confirm2 = (e) => {
+  const a = e.active ?? "Yes", o = e.inactive ?? "No";
+  return new r({
+    active: a,
+    inactive: o,
+    signal: e.signal,
+    input: e.input,
+    output: e.output,
+    initialValue: e.initialValue ?? true,
+    render() {
+      const i = e.withGuide ?? settings.withGuide, u = `${symbol(this.state)}  `, l = i ? `${styleText2("gray", S_BAR)}  ` : "", f = wrapTextWithPrefix(e.output, e.message, l, u), s = `${i ? `${styleText2("gray", S_BAR)}
+` : ""}${f}
+`, c = this.value ? a : o;
+      switch (this.state) {
+        case "submit": {
+          const r = i ? `${styleText2("gray", S_BAR)}  ` : "";
+          return `${s}${r}${styleText2("dim", c)}`;
+        }
+        case "cancel": {
+          const r = i ? `${styleText2("gray", S_BAR)}  ` : "";
+          return `${s}${r}${styleText2(["strikethrough", "dim"], c)}${i ? `
+${styleText2("gray", S_BAR)}` : ""}`;
+        }
+        default: {
+          const r = i ? `${styleText2("cyan", S_BAR)}  ` : "", g = i ? styleText2("cyan", S_BAR_END) : "";
+          return `${s}${r}${this.value ? `${styleText2("green", S_RADIO_ACTIVE)} ${a}` : `${styleText2("dim", S_RADIO_INACTIVE)} ${styleText2("dim", a)}`}${e.vertical ? i ? `
+${styleText2("cyan", S_BAR)}  ` : `
+` : ` ${styleText2("dim", "/")} `}${this.value ? `${styleText2("dim", S_RADIO_INACTIVE)} ${styleText2("dim", o)}` : `${styleText2("green", S_RADIO_ACTIVE)} ${o}`}
+${g}
+`;
+        }
+      }
+    }
+  }).prompt();
+};
+var MULTISELECT_INSTRUCTIONS = [
+  `${styleText2("dim", "\u2191/\u2193")} to navigate`,
+  `${styleText2("dim", "Space:")} select`,
+  `${styleText2("dim", "Enter:")} confirm`
+];
+var m = (i, u) => i.split(`
+`).map((d) => u(d)).join(`
+`);
+var multiselect = (i) => {
+  const u = (t, a) => {
+    const r = t.label ?? String(t.value);
+    return a === "disabled" ? `${styleText2("gray", S_CHECKBOX_INACTIVE)} ${m(r, (o) => styleText2(["strikethrough", "gray"], o))}${t.hint ? ` ${styleText2("dim", `(${t.hint ?? "disabled"})`)}` : ""}` : a === "active" ? `${styleText2("cyan", S_CHECKBOX_ACTIVE)} ${r}${t.hint ? ` ${styleText2("dim", `(${t.hint})`)}` : ""}` : a === "selected" ? `${styleText2("green", S_CHECKBOX_SELECTED)} ${m(r, (o) => styleText2("dim", o))}${t.hint ? ` ${styleText2("dim", `(${t.hint})`)}` : ""}` : a === "cancelled" ? `${m(r, (o) => styleText2(["strikethrough", "dim"], o))}` : a === "active-selected" ? `${styleText2("green", S_CHECKBOX_SELECTED)} ${r}${t.hint ? ` ${styleText2("dim", `(${t.hint})`)}` : ""}` : a === "submitted" ? `${m(r, (o) => styleText2("dim", o))}` : `${styleText2("dim", S_CHECKBOX_INACTIVE)} ${m(r, (o) => styleText2("dim", o))}`;
+  }, d = i.required ?? true, x = i.showInstructions ?? true;
+  return new a({
+    options: i.options,
+    signal: i.signal,
+    input: i.input,
+    output: i.output,
+    initialValues: i.initialValues,
+    required: d,
+    cursorAt: i.cursorAt,
+    validate(t) {
+      if (d && (t === undefined || t.length === 0))
+        return `Please select at least one option.
+${styleText2("reset", styleText2("dim", `Press ${styleText2(["gray", "bgWhite", "inverse"], " space ")} to select, ${styleText2("gray", styleText2("bgWhite", styleText2("inverse", " enter ")))} to submit`))}`;
+    },
+    render() {
+      const t = i.withGuide ?? settings.withGuide, a = wrapTextWithPrefix(i.output, i.message, t ? `${symbolBar(this.state)}  ` : "", `${symbol(this.state)}  `), r = `${t ? `${styleText2("gray", S_BAR)}
+` : ""}${a}
+`, o = this.value ?? [], g = (n, l) => {
+        if (n.disabled)
+          return u(n, "disabled");
+        const s = o.includes(n.value);
+        return l && s ? u(n, "active-selected") : s ? u(n, "selected") : u(n, l ? "active" : "inactive");
+      };
+      switch (this.state) {
+        case "submit": {
+          const n = this.options.filter(({ value: s }) => o.includes(s)).map((s) => u(s, "submitted")).join(styleText2("dim", ", ")) || styleText2("dim", "none"), l = wrapTextWithPrefix(i.output, n, t ? `${styleText2("gray", S_BAR)}  ` : "");
+          return `${r}${l}`;
+        }
+        case "cancel": {
+          const n = this.options.filter(({ value: s }) => o.includes(s)).map((s) => u(s, "cancelled")).join(styleText2("dim", ", "));
+          if (n.trim() === "")
+            return `${r}${styleText2("gray", S_BAR)}`;
+          const l = wrapTextWithPrefix(i.output, n, t ? `${styleText2("gray", S_BAR)}  ` : "");
+          return `${r}${l}${t ? `
+${styleText2("gray", S_BAR)}` : ""}`;
+        }
+        case "error": {
+          const n = t ? `${styleText2("yellow", S_BAR)}  ` : "", l = this.error.split(`
+`).map(($, v) => v === 0 ? `${t ? `${styleText2("yellow", S_BAR_END)}  ` : ""}${styleText2("yellow", $)}` : `   ${$}`).join(`
+`), s = r.split(`
+`).length, h = l.split(`
+`).length + 1;
+          return `${r}${n}${limitOptions({
+            output: i.output,
+            options: this.options,
+            cursor: this.cursor,
+            maxItems: i.maxItems,
+            columnPadding: n.length,
+            rowPadding: s + h,
+            style: g
+          }).join(`
+${n}`)}
+${l}
+`;
+        }
+        default: {
+          const n = t ? `${styleText2("cyan", S_BAR)}  ` : "", l = r.split(`
+`).length, s = x ? formatInstructionFooter(MULTISELECT_INSTRUCTIONS, t) : t ? [styleText2("cyan", S_BAR_END)] : [], h = s.join(`
+`), $ = s.length + 1;
+          return `${r}${n}${limitOptions({
+            output: i.output,
+            options: this.options,
+            cursor: this.cursor,
+            maxItems: i.maxItems,
+            columnPadding: n.length,
+            rowPadding: l + $,
+            style: g
+          }).join(`
+${n}`)}
+${h}
+`;
+        }
+      }
+    }
+  }).prompt();
+};
+var log = {
+  message: (s = [], {
+    symbol: e = styleText2("gray", S_BAR),
+    secondarySymbol: r = styleText2("gray", S_BAR),
+    output: m = process.stdout,
+    spacing: l = 1,
+    withGuide: c
+  } = {}) => {
+    const t = [], o = c ?? settings.withGuide, f = o ? r : "", O = o ? `${e}  ` : "", u = o ? `${r}  ` : "";
+    for (let i = 0;i < l; i++)
+      t.push(f);
+    const g = Array.isArray(s) ? s : s.split(`
+`);
+    if (g.length > 0) {
+      const [i, ...y] = g;
+      i.length > 0 ? t.push(`${O}${i}`) : t.push(o ? e : "");
+      for (const p of y)
+        p.length > 0 ? t.push(`${u}${p}`) : t.push(o ? r : "");
+    }
+    m.write(`${t.join(`
+`)}
+`);
+  },
+  info: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("blue", S_INFO) });
+  },
+  success: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("green", S_SUCCESS) });
+  },
+  step: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("green", S_STEP_SUBMIT) });
+  },
+  warn: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("yellow", S_WARN) });
+  },
+  warning: (s, e) => {
+    log.warn(s, e);
+  },
+  error: (s, e) => {
+    log.message(s, { ...e, symbol: styleText2("red", S_ERROR) });
+  }
+};
+var cancel = (o = "", t) => {
+  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText2("gray", S_BAR_END)}  ` : "";
+  i.write(`${e}${styleText2("red", o)}
+
+`);
+};
+var intro = (o = "", t) => {
+  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText2("gray", S_BAR_START)}  ` : "";
+  i.write(`${e}${o}
+`);
+};
+var outro = (o = "", t) => {
+  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText2("gray", S_BAR)}
+${styleText2("gray", S_BAR_END)}  ` : "";
+  i.write(`${e}${o}
+
+`);
+};
+var W$1 = (o) => o;
+var C = (o, e, s) => {
+  const a = {
+    hard: true,
+    trim: false
+  }, i = wrapAnsi(o, e, a).split(`
+`), c = i.reduce((n, t) => Math.max(dist_default2(t), n), 0), u = i.map(s).reduce((n, t) => Math.max(dist_default2(t), n), 0), g = e - (u - c);
+  return wrapAnsi(o, g, a);
+};
+var note = (o = "", e = "", s) => {
+  const a = s?.output ?? process$1.stdout, i = s?.withGuide ?? settings.withGuide, c = s?.format ?? W$1, g = ["", ...C(o, getColumns(a) - 6, c).split(`
+`).map(c), ""], n = dist_default2(e), t = Math.max(g.reduce((m, F) => {
+    const O = dist_default2(F);
+    return O > m ? O : m;
+  }, 0), n) + 2, h = g.map((m) => `${styleText2("gray", S_BAR)}  ${m}${" ".repeat(t - dist_default2(m))}${styleText2("gray", S_BAR)}`).join(`
+`), T = i ? `${styleText2("gray", S_BAR)}
+` : "", l$1 = i ? S_CONNECT_LEFT : S_CORNER_BOTTOM_LEFT;
+  a.write(`${T}${styleText2("green", S_STEP_SUBMIT)}  ${styleText2("reset", e)} ${styleText2("gray", S_BAR_H.repeat(Math.max(t - n - 1, 1)) + S_CORNER_TOP_RIGHT)}
+${h}
+${styleText2("gray", l$1 + S_BAR_H.repeat(t + 2) + S_CORNER_BOTTOM_RIGHT)}
+`);
+};
+var password = (e) => new u$1({
+  validate: e.validate,
+  mask: e.mask ?? S_PASSWORD_MASK,
+  signal: e.signal,
+  input: e.input,
+  output: e.output,
+  render() {
+    const r = e.withGuide ?? settings.withGuide, o = `${r ? `${styleText2("gray", S_BAR)}
+` : ""}${symbol(this.state)}  ${e.message}
+`, m = this.userInputWithCursor, i = this.masked;
+    switch (this.state) {
+      case "error": {
+        const s = r ? `${styleText2("yellow", S_BAR)}  ` : "", n = r ? `${styleText2("yellow", S_BAR_END)}  ` : "", d = i ?? "";
+        return e.clearOnError && this.clear(), `${o.trim()}
+${s}${d}
+${n}${styleText2("yellow", this.error)}
+`;
+      }
+      case "submit": {
+        const s = r ? `${styleText2("gray", S_BAR)}  ` : "", n = i ? styleText2("dim", i) : "";
+        return `${o}${s}${n}`;
+      }
+      case "cancel": {
+        const s = r ? `${styleText2("gray", S_BAR)}  ` : "", n = i ? styleText2(["strikethrough", "dim"], i) : "";
+        return `${o}${s}${n}${i && r ? `
+${styleText2("gray", S_BAR)}` : ""}`;
+      }
+      default: {
+        const s = r ? `${styleText2("cyan", S_BAR)}  ` : "", n = r ? styleText2("cyan", S_BAR_END) : "";
+        return `${o}${s}${m}
+${n}
+`;
+      }
+    }
+  }
+}).prompt();
+var W = (l) => styleText2("magenta", l);
+var spinner = ({
+  indicator: l = "dots",
+  onCancel: h,
+  output: n = process.stdout,
+  cancelMessage: G,
+  errorMessage: O,
+  frames: E = unicode ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"],
+  delay: F = unicode ? 80 : 120,
+  signal: m,
+  ...I
+} = {}) => {
+  const u = isCI();
+  let M, T, d = false, S = false, s = "", p, w = performance.now();
+  const x = getColumns(n), k = I?.styleFrame ?? W, g = (e) => {
+    const r = e > 1 ? O ?? settings.messages.error : G ?? settings.messages.cancel;
+    S = e === 1, d && (a(r, e), S && typeof h == "function" && h());
+  }, f = () => g(2), i = () => g(1), A = () => {
+    process.on("uncaughtExceptionMonitor", f), process.on("unhandledRejection", f), process.on("SIGINT", i), process.on("SIGTERM", i), process.on("exit", g), m && m.addEventListener("abort", i);
+  }, H = () => {
+    process.removeListener("uncaughtExceptionMonitor", f), process.removeListener("unhandledRejection", f), process.removeListener("SIGINT", i), process.removeListener("SIGTERM", i), process.removeListener("exit", g), m && m.removeEventListener("abort", i);
+  }, y = () => {
+    if (p === undefined)
+      return;
+    u && n.write(`
+`);
+    const r = wrapAnsi(p, x, {
+      hard: true,
+      trim: false
+    }).split(`
+`);
+    r.length > 1 && n.write(import_sisteransi2.cursor.up(r.length - 1)), n.write(import_sisteransi2.cursor.to(0)), n.write(import_sisteransi2.erase.down());
+  }, C = (e) => e.replace(/\.+$/, ""), _ = (e) => {
+    const r = (performance.now() - e) / 1000, t = Math.floor(r / 60), o = Math.floor(r % 60);
+    return t > 0 ? `[${t}m ${o}s]` : `[${o}s]`;
+  }, N = I.withGuide ?? settings.withGuide, P = (e = "") => {
+    d = true, M = block({ output: n }), s = C(e), w = performance.now(), N && n.write(`${styleText2("gray", S_BAR)}
+`);
+    let r = 0, t = 0;
+    A(), T = setInterval(() => {
+      if (u && s === p)
+        return;
+      y(), p = s;
+      const o = k(E[r]);
+      let v;
+      if (u)
+        v = `${o}  ${s}...`;
+      else if (l === "timer")
+        v = `${o}  ${s} ${_(w)}`;
+      else {
+        const B = ".".repeat(Math.floor(t)).slice(0, 3);
+        v = `${o}  ${s}${B}`;
+      }
+      const j = wrapAnsi(v, x, {
+        hard: true,
+        trim: false
+      });
+      n.write(j), r = r + 1 < E.length ? r + 1 : 0, t = t < 4 ? t + 0.125 : 0;
+    }, F);
+  }, a = (e = "", r = 0, t = false) => {
+    if (!d)
+      return;
+    d = false, clearInterval(T), y();
+    const o = r === 0 ? styleText2("green", S_STEP_SUBMIT) : r === 1 ? styleText2("red", S_STEP_CANCEL) : styleText2("red", S_STEP_ERROR);
+    s = e ?? s, t || (l === "timer" ? n.write(`${o}  ${s} ${_(w)}
+`) : n.write(`${o}  ${s}
+`)), H(), M();
+  };
+  return {
+    start: P,
+    stop: (e = "") => a(e, 0),
+    message: (e = "") => {
+      s = C(e ?? s);
+    },
+    cancel: (e = "") => a(e, 1),
+    error: (e = "") => a(e, 2),
+    clear: () => a("", 0, true),
+    get isCancelled() {
+      return S;
+    }
+  };
+};
+var u2 = {
+  light: unicodeOr("\u2500", "-"),
+  heavy: unicodeOr("\u2501", "="),
+  block: unicodeOr("\u2588", "#")
+};
+var SELECT_INSTRUCTIONS = [
+  `${styleText2("dim", "\u2191/\u2193")} to navigate`,
+  `${styleText2("dim", "Enter:")} confirm`
+];
+var c = (t, o) => t.includes(`
+`) ? t.split(`
+`).map((d) => o(d)).join(`
+`) : o(t);
+var select = (t) => {
+  const o = (n, m) => {
+    if (n === undefined)
+      return "";
+    const s = n.label ?? String(n.value);
+    switch (m) {
+      case "disabled":
+        return `${styleText2("gray", S_RADIO_INACTIVE)} ${c(s, (i) => styleText2("gray", i))}${n.hint ? ` ${styleText2("dim", `(${n.hint ?? "disabled"})`)}` : ""}`;
+      case "selected":
+        return `${c(s, (i) => styleText2("dim", i))}`;
+      case "active":
+        return `${styleText2("green", S_RADIO_ACTIVE)} ${s}${n.hint ? ` ${styleText2("dim", `(${n.hint})`)}` : ""}`;
+      case "cancelled":
+        return `${c(s, (i) => styleText2(["strikethrough", "dim"], i))}`;
+      default:
+        return `${styleText2("dim", S_RADIO_INACTIVE)} ${c(s, (i) => styleText2("dim", i))}`;
+    }
+  }, d = t.showInstructions ?? true;
+  return new n$1({
+    options: t.options,
+    signal: t.signal,
+    input: t.input,
+    output: t.output,
+    initialValue: t.initialValue,
+    render() {
+      const n = t.withGuide ?? settings.withGuide, m = `${symbol(this.state)}  `, s = `${symbolBar(this.state)}  `, i = wrapTextWithPrefix(t.output, t.message, s, m), u = `${n ? `${styleText2("gray", S_BAR)}
+` : ""}${i}
+`;
+      switch (this.state) {
+        case "submit": {
+          const r = n ? `${styleText2("gray", S_BAR)}  ` : "", a = wrapTextWithPrefix(t.output, o(this.options[this.cursor], "selected"), r);
+          return `${u}${a}`;
+        }
+        case "cancel": {
+          const r = n ? `${styleText2("gray", S_BAR)}  ` : "", a = wrapTextWithPrefix(t.output, o(this.options[this.cursor], "cancelled"), r);
+          return `${u}${a}${n ? `
+${styleText2("gray", S_BAR)}` : ""}`;
+        }
+        default: {
+          const r = n ? `${styleText2("cyan", S_BAR)}  ` : "", a = u.split(`
+`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS, n) : n ? [styleText2("cyan", S_BAR_END)] : [], f = p.join(`
+`), b = p.length + 1;
+          return `${u}${r}${limitOptions({
+            output: t.output,
+            cursor: this.cursor,
+            options: this.options,
+            maxItems: t.maxItems,
+            columnPadding: r.length,
+            rowPadding: a + b,
+            style: (g, x) => o(g, g.disabled ? "disabled" : x ? "active" : "inactive")
+          }).join(`
+${r}`)}
+${f}
+`;
+        }
+      }
+    }
+  }).prompt();
+};
+var i = `${styleText2("gray", S_BAR)}  `;
+var text = (t) => new n({
+  validate: t.validate,
+  placeholder: t.placeholder,
+  defaultValue: t.defaultValue,
+  initialValue: t.initialValue,
+  output: t.output,
+  signal: t.signal,
+  input: t.input,
+  render() {
+    const r = t?.withGuide ?? settings.withGuide, l = `${`${r ? `${styleText2("gray", S_BAR)}
+` : ""}${symbol(this.state)}  `}${t.message}
+`, d = t.placeholder && t.placeholder.length > 0 ? styleText2("inverse", t.placeholder[0]) + styleText2("dim", t.placeholder.slice(1)) : styleText2(["inverse", "hidden"], "_"), o = this.userInput ? this.userInputWithCursor : d, s = this.value ?? "";
+    switch (this.state) {
+      case "validating": {
+        const n = r ? `${styleText2("cyan", S_BAR)}  ` : "", i = r ? styleText2("cyan", S_BAR_END) : "", c = styleText2("dim", o), $ = styleText2("dim", "Validating...");
+        return `${l}${n}${c}
+${i}  ${$}
+`;
+      }
+      case "error": {
+        const n = this.error ? `  ${styleText2("yellow", this.error)}` : "", i = r ? `${styleText2("yellow", S_BAR)}  ` : "", c = r ? styleText2("yellow", S_BAR_END) : "";
+        return `${l.trim()}
+${i}${o}
+${c}${n}
+`;
+      }
+      case "submit": {
+        const n = s ? `${r ? "  " : ""}${styleText2("dim", s)}` : "", i = r ? styleText2("gray", S_BAR) : "";
+        return `${l}${i}${n}`;
+      }
+      case "cancel": {
+        const n = s ? `  ${styleText2(["strikethrough", "dim"], s)}` : "", i = r ? styleText2("gray", S_BAR) : "";
+        return `${l}${i}${n}${s.trim() ? `
+${i}` : ""}`;
+      }
+      default: {
+        const n = r ? `${styleText2("cyan", S_BAR)}  ` : "", i = r ? styleText2("cyan", S_BAR_END) : "";
+        return `${l}${n}${o}
+${i}
+`;
+      }
+    }
+  }
+}).prompt();
+
+// src/server.ts
+import { join as join4 } from "path";
+import { styleText as styleText4 } from "util";
+
+// src/server-docker.ts
+import { existsSync, readFileSync } from "fs";
+import { statfs } from "fs/promises";
+import { freemem, hostname as hostname2, networkInterfaces, totalmem } from "os";
+
+// ../../docker/compose.yml
+var compose_default = `# Runs mybase: the control plane (API + dashboard), the shared Postgres server, Garage
+# (S3-compatible storage), Valkey (Redis-compatible cache), and SearXNG (web search). All images are multi-arch (arm64 + amd64).
+# Needs Docker Compose 2.23.1 or newer (for the inline Garage config below).
+#
+# Easiest: \`mybase server setup\` writes this file and its .env for you (keys, network, tunnel, start on boot):
+#   curl -fsSL https://raw.githubusercontent.com/LandonHarter/mybase/master/scripts/install.sh | sh -s -- --setup
+#
+# By hand:
+#   curl -fsSLO https://raw.githubusercontent.com/LandonHarter/mybase/master/docker/compose.yml
+#   echo "POSTGRES_PASSWORD=$(openssl rand -hex 24)" > .env
+#   echo "GARAGE_RPC_SECRET=$(openssl rand -hex 32)" >> .env
+#   echo "GARAGE_ADMIN_TOKEN=$(openssl rand -hex 32)" >> .env
+#   echo "VALKEY_PASSWORD=$(openssl rand -hex 32)" >> .env
+#   echo "SEARXNG_SECRET=$(openssl rand -hex 32)" >> .env
+#   echo "MYBASE_SECRETS_KEY=$(openssl rand -base64 32)" >> .env   # secrets service; back it up!
+#   docker compose up -d
+#
+# Then open http://localhost:4000 (or set MYBASE_PORT in .env) and create the admin account.
+# First-run setup only works from this machine or your LAN; or set MYBASE_ADMIN_PASSWORD in .env.
+# Apps on other machines: set MYBASE_PUBLIC_HOST in .env to this machine's LAN/Tailscale name.
+# Every service restarts with Docker (on boot, after crashes); MYBASE_RESTART=no turns that off.
+#
+# Public access (Cloudflare Tunnel, no router changes; the machine only needs outbound internet).
+# \`mybase server tunnel\` does all of this, automatically with a Cloudflare API token. By hand:
+#   1. Add your domain to Cloudflare (free plan) and switch its nameservers at your registrar.
+#   2. Cloudflare Zero Trust \u2192 Networks \u2192 Tunnels \u2192 Create a tunnel (cloudflared). Copy its token.
+#   3. In the tunnel's public hostnames, add:
+#        mybase.<domain> \u2192 http://mybase:4000   (dashboard, API, public files, Postgres over WebSocket)
+#        s3.<domain>     \u2192 http://garage:3900   (S3 for apps)
+#   4. In .env:
+#        COMPOSE_PROFILES=tunnel
+#        CLOUDFLARE_TUNNEL_TOKEN=<token>
+#        MYBASE_PUBLIC_URL=https://mybase.<domain>
+#        MYBASE_S3_PUBLIC_URL=https://s3.<domain>
+#        MYBASE_TRUST_PROXY=cloudflare
+#      Optionally POSTGRES_BIND=127.0.0.1, GARAGE_S3_BIND=127.0.0.1, and VALKEY_BIND=127.0.0.1 to stop exposing those ports on the LAN.
+#   5. docker compose up -d
+# Apps on serverless hosts reach Postgres at wss://mybase.<domain>/db with @neondatabase/serverless,
+# and the cache at https://mybase.<domain>/cache/<project> (@mybase-dev/sdk/cache or @upstash/redis).
+# Cloudflare's free plan caps request bodies at 100 MB: bigger dashboard uploads only work on the LAN.
+name: mybase
+
+services:
+  mybase:
+    image: \${MYBASE_IMAGE:-ghcr.io/landonharter/mybase:latest}
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      # Garage's image has no shell for a healthcheck; the API waits for it on startup.
+      garage:
+        condition: service_started
+      valkey:
+        condition: service_healthy
+      searxng:
+        condition: service_started
+    environment:
+      POSTGRES_HOST: postgres
+      POSTGRES_PORT: 5432
+      POSTGRES_USER: \${POSTGRES_USER:-mybase}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+      # Where apps reach Postgres. Shown in each project's connection string.
+      MYBASE_DB_PUBLIC_HOST: \${MYBASE_DB_PUBLIC_HOST:-\${MYBASE_PUBLIC_HOST:-localhost}}
+      MYBASE_DB_PUBLIC_PORT: \${POSTGRES_PORT:-5432}
+      GARAGE_ADMIN_URL: http://garage:3903
+      GARAGE_ADMIN_TOKEN: \${GARAGE_ADMIN_TOKEN:?set GARAGE_ADMIN_TOKEN in .env}
+      GARAGE_S3_URL: http://garage:3900
+      GARAGE_CAPACITY: \${GARAGE_CAPACITY:-100G}
+      # Where apps reach storage (S3 endpoint) and public files (served by this API).
+      MYBASE_S3_PUBLIC_URL: \${MYBASE_S3_PUBLIC_URL:-http://\${MYBASE_PUBLIC_HOST:-localhost}:\${GARAGE_S3_PORT:-3900}}
+      MYBASE_PUBLIC_URL: \${MYBASE_PUBLIC_URL:-http://\${MYBASE_PUBLIC_HOST:-localhost}:\${MYBASE_PORT:-4000}}
+      # Postgres over WebSocket, for apps that can't reach the Postgres port. Defaults to <MYBASE_PUBLIC_URL>/db.
+      MYBASE_DB_WS_URL: \${MYBASE_DB_WS_URL:-}
+      MYBASE_MAX_UPLOAD: \${MYBASE_MAX_UPLOAD:-1073741824}
+      VALKEY_HOST: valkey
+      VALKEY_PORT: 6379
+      VALKEY_PASSWORD: \${VALKEY_PASSWORD:?set VALKEY_PASSWORD in .env}
+      # Where apps reach the cache over TCP. Shown in each project's redis:// URL.
+      MYBASE_CACHE_PUBLIC_HOST: \${MYBASE_CACHE_PUBLIC_HOST:-\${MYBASE_PUBLIC_HOST:-localhost}}
+      MYBASE_CACHE_PUBLIC_PORT: \${VALKEY_PORT:-6379}
+      SEARXNG_URL: http://searxng:8080
+      # Encrypts stored secrets (secrets service; it answers 503 without it). Keep a copy outside
+      # this machine: if it's lost, stored secrets can't be recovered. To change it, move the old
+      # one to MYBASE_SECRETS_KEY_OLD for one restart.
+      MYBASE_SECRETS_KEY: \${MYBASE_SECRETS_KEY:-}
+      MYBASE_SECRETS_KEY_OLD: \${MYBASE_SECRETS_KEY_OLD:-}
+      # \`cloudflare\` when behind the tunnel: trusts CF-Connecting-IP for client IPs (login throttling).
+      MYBASE_TRUST_PROXY: \${MYBASE_TRUST_PROXY:-}
+      # Creates the admin account on first boot instead of the setup page. Ignored once it exists.
+      MYBASE_ADMIN_USERNAME: \${MYBASE_ADMIN_USERNAME:-admin}
+      MYBASE_ADMIN_PASSWORD: \${MYBASE_ADMIN_PASSWORD:-}
+      # 1 for one restart turns the admin's 2FA off (lost phone and recovery codes).
+      MYBASE_ADMIN_RESET_MFA: \${MYBASE_ADMIN_RESET_MFA:-}
+      LOG_LEVEL: \${LOG_LEVEL:-info}
+    ports:
+      - "\${MYBASE_BIND:-0.0.0.0}:\${MYBASE_PORT:-4000}:4000"
+
+  # Official Postgres plus extensions projects can enable (see postgres.Dockerfile).
+  # Upgrading from postgres:17-alpine: the data volume is compatible, but text sort order
+  # changes (musl \u2192 glibc), so rebuild text indexes once, for each database:
+  #   docker compose exec postgres psql -U mybase -d <db> -c 'reindex database <db>'
+  postgres:
+    image: \${MYBASE_POSTGRES_IMAGE:-ghcr.io/landonharter/mybase-postgres:17}
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    environment:
+      POSTGRES_USER: \${POSTGRES_USER:-mybase}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
+    # Apps connect to their project databases directly on this port.
+    ports:
+      - "\${POSTGRES_BIND:-0.0.0.0}:\${POSTGRES_PORT:-5432}:5432"
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $\${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # S3-compatible object storage: one bucket + key per project.
+  garage:
+    image: dxflrs/garage:v2.4.1
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    environment:
+      GARAGE_RPC_SECRET: \${GARAGE_RPC_SECRET:?set GARAGE_RPC_SECRET in .env}
+      GARAGE_ADMIN_TOKEN: \${GARAGE_ADMIN_TOKEN:?set GARAGE_ADMIN_TOKEN in .env}
+    configs:
+      - source: garage
+        target: /etc/garage.toml
+    # Apps use their bucket directly on this port. The admin API (3903) stays internal.
+    ports:
+      - "\${GARAGE_S3_BIND:-0.0.0.0}:\${GARAGE_S3_PORT:-3900}:3900"
+    volumes:
+      - garage-meta:/var/lib/garage/meta
+      - garage-data:/var/lib/garage/data
+
+  # Redis-compatible cache: an ACL user per project (cache service), plus rate limit counters.
+  # RAM only up to CACHE_MAXMEMORY, least recently used keys evicted first. Snapshots to disk at
+  # most every 15 minutes (and on shutdown), to spare SD cards.
+  valkey:
+    image: valkey/valkey:8.1-alpine
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    environment:
+      VALKEY_PASSWORD: \${VALKEY_PASSWORD:?set VALKEY_PASSWORD in .env}
+    command: >-
+      valkey-server --requirepass \${VALKEY_PASSWORD:?set VALKEY_PASSWORD in .env} --maxmemory \${CACHE_MAXMEMORY:-64mb}
+      --maxmemory-policy allkeys-lru --save "900 1" --appendonly no
+    # Apps use the cache directly on this port (over the LAN/Tailscale), as their project's user.
+    ports:
+      - "\${VALKEY_BIND:-0.0.0.0}:\${VALKEY_PORT:-6379}:6379"
+    volumes:
+      - valkey-data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "REDISCLI_AUTH=$$VALKEY_PASSWORD valkey-cli ping | grep -q PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # Web search (search service): metasearch over Bing, Mojeek, Yahoo, DuckDuckGo, Brave, and a few
+  # topic engines. Queries go out from this machine's IP; engines that rate-limit it are suspended
+  # for a while and the rest keep answering. Only the API talks to it.
+  searxng:
+    image: searxng/searxng:2026.10.11-ad46ebd7d
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    environment:
+      SEARXNG_SECRET: \${SEARXNG_SECRET:?set SEARXNG_SECRET in .env}
+      GRANIAN_WORKERS: 1
+      GRANIAN_BLOCKING_THREADS: 4
+    configs:
+      - source: searxng
+        target: /etc/searxng/settings.yml
+
+  # Cloudflare Tunnel: public HTTPS without opening router ports. Off unless COMPOSE_PROFILES=tunnel.
+  # Hostnames are set up in the Cloudflare dashboard (see the top of this file).
+  cloudflared:
+    image: cloudflare/cloudflared:2026.10.4
+    profiles: [tunnel]
+    restart: \${MYBASE_RESTART:-unless-stopped}
+    command: tunnel --no-autoupdate run
+    environment:
+      TUNNEL_TOKEN: \${CLOUDFLARE_TUNNEL_TOKEN:-}
+    depends_on:
+      - mybase
+
+configs:
+  garage:
+    content: |
+      metadata_dir = "/var/lib/garage/meta"
+      data_dir = "/var/lib/garage/data"
+      db_engine = "lmdb"
+      replication_factor = 1
+      rpc_bind_addr = "[::]:3901"
+      rpc_public_addr = "127.0.0.1:3901"
+
+      [s3_api]
+      s3_region = "garage"
+      api_bind_addr = "[::]:3900"
+
+      [admin]
+      api_bind_addr = "[::]:3903"
+
+  searxng:
+    content: |
+      use_default_settings:
+        engines:
+          keep_only: [bing, mojeek, yahoo, duckduckgo, brave, wikipedia, github, stackoverflow, duckduckgo news, bing news]
+      search:
+        formats: [html, json]
+      server:
+        limiter: false
+        image_proxy: false
+      outgoing:
+        request_timeout: 3.0
+        max_request_timeout: 6.0
+      engines:
+        - name: bing
+          disabled: false
+        - name: mojeek
+          inactive: false
+        - name: yahoo
+          disabled: false
+
+volumes:
+  postgres-data:
+  garage-meta:
+  garage-data:
+  valkey-data:
+`;
+
+// src/server-env.ts
+var SECRET_KEYS = {
+  POSTGRES_PASSWORD: { bytes: 24, encoding: "hex" },
+  GARAGE_RPC_SECRET: { bytes: 32, encoding: "hex" },
+  GARAGE_ADMIN_TOKEN: { bytes: 32, encoding: "hex" },
+  VALKEY_PASSWORD: { bytes: 32, encoding: "hex" },
+  SEARXNG_SECRET: { bytes: 32, encoding: "hex" },
+  MYBASE_SECRETS_KEY: { bytes: 32, encoding: "base64" }
+};
+var SECTIONS = [
+  {
+    title: "Secrets (generated by `mybase server setup`). Changing one breaks the data it protects.\n# Back up MYBASE_SECRETS_KEY somewhere other than this machine: without it, stored secrets are lost.",
+    keys: Object.keys(SECRET_KEYS)
+  },
+  {
+    title: "Access: where apps and the dashboard reach this machine",
+    keys: ["MYBASE_PORT", "MYBASE_PUBLIC_HOST", "MYBASE_PUBLIC_URL", "MYBASE_S3_PUBLIC_URL", "MYBASE_TRUST_PROXY", "POSTGRES_PORT", "GARAGE_S3_PORT", "VALKEY_PORT", "POSTGRES_BIND", "GARAGE_S3_BIND", "VALKEY_BIND"]
+  },
+  { title: "Cloudflare Tunnel (public HTTPS without opening router ports)", keys: ["COMPOSE_PROFILES", "CLOUDFLARE_TUNNEL_TOKEN"] },
+  { title: "Startup: `no` keeps mybase from starting again after a reboot or crash", keys: ["MYBASE_RESTART"] },
+  { title: "Tuning", keys: ["CACHE_MAXMEMORY", "GARAGE_CAPACITY", "MYBASE_MAX_UPLOAD", "LOG_LEVEL"] }
+];
+var LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/;
+function unquote(raw) {
+  const value = raw.trim();
+  const quote = value[0];
+  if ((quote === '"' || quote === "'") && value.endsWith(quote) && value.length >= 2)
+    return value.slice(1, -1);
+  return value.replace(/\s+#.*$/, "");
+}
+function quote(value) {
+  return /^[A-Za-z0-9_./:+=@,-]*$/.test(value) ? value : `'${value.replaceAll("'", "")}'`;
+}
+function parseEnv(text) {
+  const values = {};
+  for (const line of text.split(/\r?\n/)) {
+    const match = LINE.exec(line);
+    if (match)
+      values[match[1]] = unquote(match[2]);
+  }
+  return values;
+}
+function renderEnv(values) {
+  const blocks = [];
+  const listed = new Set(SECTIONS.flatMap((s) => s.keys));
+  const sections = [...SECTIONS, { title: "Other", keys: Object.keys(values).filter((k) => !listed.has(k)) }];
+  for (const { title, keys } of sections) {
+    const lines = keys.filter((k) => values[k] !== undefined).map((k) => `${k}=${quote(values[k])}`);
+    if (lines.length)
+      blocks.push(`# ${title}
+${lines.join(`
+`)}`);
+  }
+  return `# mybase server settings, read by compose.yml. Change with \`mybase server setup\` or by hand,
+# then run \`docker compose up -d\`.
+
+${blocks.join(`
+
+`)}
+`;
+}
+function mergeEnv(text, updates) {
+  const pending = new Map(Object.entries(updates));
+  const lines = [];
+  for (const line of text.replace(/\n+$/, "").split(/\r?\n/)) {
+    const key = LINE.exec(line)?.[1];
+    if (!key || !pending.has(key)) {
+      lines.push(line);
+      continue;
+    }
+    const value = pending.get(key);
+    pending.delete(key);
+    if (value !== null && value !== undefined)
+      lines.push(`${key}=${quote(value)}`);
+  }
+  const added = [...pending].filter((entry) => entry[1] !== null);
+  if (added.length)
+    lines.push("", "# Added by `mybase server setup`", ...added.map(([k, v]) => `${k}=${quote(v)}`));
+  return `${lines.join(`
+`)}
+`;
+}
+function generateSecrets(existing = {}) {
+  const out = {};
+  for (const [key, { bytes, encoding }] of Object.entries(SECRET_KEYS)) {
+    if (existing[key])
+      continue;
+    out[key] = Buffer.from(crypto.getRandomValues(new Uint8Array(bytes))).toString(encoding);
+  }
+  return out;
+}
+var isSecretKey = (key) => (key in SECRET_KEYS) || key === "CLOUDFLARE_TUNNEL_TOKEN";
+function maskSecret(value) {
+  return value.length <= 8 ? "\u2022\u2022\u2022\u2022" : `${value.slice(0, 4)}\u2026${value.slice(-4)}`;
+}
+function tunnelIdFromToken(token) {
+  try {
+    const parsed = JSON.parse(Buffer.from(token.trim(), "base64").toString("utf8"));
+    return typeof parsed.t === "string" && typeof parsed.a === "string" && typeof parsed.s === "string" ? parsed.t : null;
+  } catch {
+    return null;
+  }
+}
+function tunnelEnv(token, apiHost, s3Host) {
+  return {
+    COMPOSE_PROFILES: "tunnel",
+    CLOUDFLARE_TUNNEL_TOKEN: token,
+    MYBASE_PUBLIC_URL: `https://${apiHost}`,
+    MYBASE_S3_PUBLIC_URL: `https://${s3Host}`,
+    MYBASE_TRUST_PROXY: "cloudflare"
+  };
+}
+function versionAtLeast(version, min) {
+  const parts = (v) => v.replace(/^v/, "").split(/[.-]/).slice(0, 3).map((n) => Number.parseInt(n, 10) || 0);
+  const a = parts(version);
+  const b = parts(min);
+  for (let i = 0;i < 3; i++)
+    if ((a[i] ?? 0) !== (b[i] ?? 0))
+      return (a[i] ?? 0) > (b[i] ?? 0);
+  return true;
+}
+
+// src/server-docker.ts
+var MIN_COMPOSE = "2.23.1";
+var DOCKER_INSTALL_URL = "https://docs.docker.com/engine/install/";
+function run2(cmd, cwd) {
+  try {
+    const proc = Bun.spawnSync(cmd, { cwd, stdout: "pipe", stderr: "pipe", env: process.env });
+    return { ok: proc.exitCode === 0, stdout: proc.stdout.toString().trim(), stderr: proc.stderr.toString().trim() };
+  } catch {
+    return { ok: false, stdout: "", stderr: `${cmd[0]} not found` };
+  }
+}
+function composeEnv() {
+  const env = { ...process.env };
+  for (const [, name] of compose_default.matchAll(/\$\{([A-Z0-9_]+)/g))
+    delete env[name];
+  for (const name of Object.keys(env))
+    if (name.startsWith("COMPOSE_"))
+      delete env[name];
+  return env;
+}
+function checkDocker() {
+  const client = run2(["docker", "--version"]);
+  if (!client.ok)
+    return { ok: false, problem: `Docker isn't installed. Install it first: ${DOCKER_INSTALL_URL}` };
+  const server = run2(["docker", "version", "--format", "{{.Server.Version}}"]);
+  if (!server.ok) {
+    const denied = /permission denied/i.test(server.stderr);
+    return {
+      ok: false,
+      problem: denied ? "Docker is installed, but this user can't use it. Run `sudo usermod -aG docker $USER`, log out and back in, then try again." : "Docker is installed, but its daemon isn't running. Start it (`sudo systemctl start docker`) and try again."
+    };
+  }
+  const compose = run2(["docker", "compose", "version", "--short"]);
+  if (!compose.ok)
+    return { ok: false, docker: server.stdout, problem: "Docker Compose v2 is missing. Install the docker-compose-plugin package." };
+  if (!versionAtLeast(compose.stdout, MIN_COMPOSE)) {
+    return { ok: false, docker: server.stdout, compose: compose.stdout, problem: `Docker Compose ${compose.stdout} is too old: mybase needs ${MIN_COMPOSE} or newer.` };
+  }
+  return { ok: true, docker: server.stdout, compose: compose.stdout.replace(/^v/, "") };
+}
+async function compose(dir, args) {
+  const proc = Bun.spawn(["docker", "compose", ...args], { cwd: dir, stdout: "pipe", stderr: "pipe", env: composeEnv() });
+  const [stdout, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
+  return { ok: code === 0, stdout: stdout.trim(), stderr: stderr.trim() };
+}
+async function stackExists(dir) {
+  if (!existsSync(`${dir}/compose.yml`))
+    return false;
+  const ps = await compose(dir, ["ps", "-a", "-q"]);
+  return ps.ok && ps.stdout.length > 0;
+}
+function otherInstall(dir) {
+  const ls = run2(["docker", "compose", "ls", "--all", "--format", "json"]);
+  if (!ls.ok)
+    return null;
+  try {
+    const projects = JSON.parse(ls.stdout);
+    const mine = projects.find((p) => p.Name === "mybase");
+    if (!mine)
+      return null;
+    const file = mine.ConfigFiles.split(",")[0] ?? "";
+    return file.startsWith(`${dir}/`) ? null : file.replace(/\/[^/]+$/, "");
+  } catch {
+    return null;
+  }
+}
+function portFree(port) {
+  try {
+    const server = Bun.listen({ hostname: "0.0.0.0", port, socket: { data() {} } });
+    server.stop(true);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function waitHealthy(url, timeoutMs = 180000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(`${url}/health`, { signal: AbortSignal.timeout(3000) });
+      if (res.ok)
+        return (await res.json()).version ?? "unknown";
+    } catch {}
+    await Bun.sleep(2000);
+  }
+  return null;
+}
+function machine() {
+  let pi = null;
+  try {
+    const model = readFileSync("/proc/device-tree/model", "utf8").replace(/\0/g, "").trim();
+    if (model.includes("Raspberry Pi"))
+      pi = model;
+  } catch {}
+  return { hostname: hostname2(), arch: process.arch, pi, totalMemGb: totalmem() / 2 ** 30, freeMemGb: freemem() / 2 ** 30 };
+}
+async function freeDiskGb(dir) {
+  for (let d = dir;; d = d.replace(/\/[^/]*$/, "") || "/") {
+    if (existsSync(d)) {
+      try {
+        const s = await statfs(d);
+        return s.bavail * s.bsize / 2 ** 30;
+      } catch {
+        return null;
+      }
+    }
+    if (d === "/")
+      return null;
+  }
+}
+function addresses() {
+  const out = [];
+  const ts = run2(["tailscale", "status", "--json"]);
+  if (ts.ok) {
+    try {
+      const self = JSON.parse(ts.stdout).Self;
+      const dns = self?.DNSName?.replace(/\.$/, "");
+      if (dns)
+        out.push({ value: dns, label: "Tailscale (MagicDNS)" });
+      const ip = self?.TailscaleIPs?.find((a) => a.includes("."));
+      if (ip)
+        out.push({ value: ip, label: "Tailscale IP" });
+    } catch {}
+  }
+  const host = hostname2();
+  out.push({ value: `${host}.local`, label: "mDNS name (most home networks)" });
+  for (const [name, list] of Object.entries(networkInterfaces())) {
+    if (/^(docker|br-|veth|virbr|tailscale|lo|cni|flannel)/.test(name))
+      continue;
+    for (const a of list ?? []) {
+      if (a.family === "IPv4" && !a.internal)
+        out.push({ value: a.address, label: `LAN IP (${name})` });
+    }
+  }
+  return out;
+}
+function dockerOnBoot() {
+  if (process.platform === "darwin" || process.platform === "win32")
+    return "desktop";
+  const state = run2(["systemctl", "is-enabled", "docker.service"]);
+  if (state.stdout === "enabled")
+    return "enabled";
+  if (state.stdout === "disabled" || state.stdout === "masked")
+    return "disabled";
+  return "unknown";
+}
+async function enableDockerOnBoot() {
+  const cmd = process.getuid?.() === 0 ? ["systemctl", "enable", "docker.service", "containerd.service"] : ["sudo", "systemctl", "enable", "docker.service", "containerd.service"];
+  try {
+    const proc = Bun.spawn(cmd, { stdio: ["inherit", "inherit", "inherit"] });
+    return await proc.exited === 0;
+  } catch {
+    return false;
+  }
+}
+
+// src/server-setup.ts
+import { chmod as chmod2, mkdir as mkdir3 } from "fs/promises";
+import { homedir as homedir2, hostname as hostname3 } from "os";
+import { join as join3, resolve as resolve4 } from "path";
+import { styleText as styleText3 } from "util";
+
+// src/cloudflare.ts
+var API = "https://api.cloudflare.com/client/v4";
+var TOKEN_PERMISSIONS = ["Account \u203A Cloudflare Tunnel \u203A Edit", "Zone \u203A DNS \u203A Edit", "Zone \u203A Zone \u203A Read"];
+var TOKEN_URL = "https://dash.cloudflare.com/profile/api-tokens";
+
+class CloudflareError extends Error {
+}
+function cloudflare(token, fetcher = fetch) {
+  async function call(method, path, body) {
+    const res = await fetcher(`${API}${path}`, {
+      method,
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: body === undefined ? undefined : JSON.stringify(body)
+    }).catch(() => {
+      throw new CloudflareError("can't reach api.cloudflare.com");
+    });
+    const data = await res.json().catch(() => null);
+    if (!res.ok || !data?.success) {
+      const message = data?.errors?.map((e) => e.message).join("; ") || res.statusText;
+      if (res.status === 401 || res.status === 403)
+        throw new CloudflareError(`Cloudflare refused the token (${message}). It needs: ${TOKEN_PERMISSIONS.join(", ")}.`);
+      throw new CloudflareError(`Cloudflare: ${message}`);
+    }
+    return data.result;
+  }
+  return {
+    listAccounts: () => call("GET", "/accounts?per_page=50"),
+    listZones: () => call("GET", "/zones?per_page=50&status=active"),
+    async ensureTunnel(accountId, name) {
+      const existing = await call("GET", `/accounts/${accountId}/cfd_tunnel?name=${encodeURIComponent(name)}&is_deleted=false`);
+      if (existing[0])
+        return { id: existing[0].id, name: existing[0].name, created: false };
+      const tunnel = await call("POST", `/accounts/${accountId}/cfd_tunnel`, { name, config_src: "cloudflare" });
+      return { id: tunnel.id, name: tunnel.name, created: true };
+    },
+    putIngress: (accountId, tunnelId, rules) => call("PUT", `/accounts/${accountId}/cfd_tunnel/${tunnelId}/configurations`, {
+      config: { ingress: [...rules, { service: "http_status:404" }] }
+    }),
+    async findRecord(zoneId, name) {
+      const records = await call("GET", `/zones/${zoneId}/dns_records?name=${encodeURIComponent(name)}`);
+      return records[0] ?? null;
+    },
+    async upsertCname(zoneId, name, tunnelId) {
+      const record = { type: "CNAME", name, content: `${tunnelId}.cfargotunnel.com`, proxied: true, comment: "mybase tunnel" };
+      const existing = await call("GET", `/zones/${zoneId}/dns_records?name=${encodeURIComponent(name)}`);
+      if (existing[0])
+        await call("PUT", `/zones/${zoneId}/dns_records/${existing[0].id}`, record);
+      else
+        await call("POST", `/zones/${zoneId}/dns_records`, record);
+    },
+    tunnelToken: (accountId, tunnelId) => call("GET", `/accounts/${accountId}/cfd_tunnel/${tunnelId}/token`)
+  };
+}
+var pointsAtTunnel = (record, tunnelId) => record.content === `${tunnelId}.cfargotunnel.com`;
+
+// src/server-setup.ts
+var DEFAULT_DIR = join3(homedir2(), "mybase");
+var USERNAME_PATTERN = /^[a-zA-Z0-9_.@-]{1,64}$/;
+var HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/i;
+var TUNNEL_KEYS = ["COMPOSE_PROFILES", "CLOUDFLARE_TUNNEL_TOKEN", "MYBASE_PUBLIC_URL", "MYBASE_S3_PUBLIC_URL", "MYBASE_TRUST_PROXY"];
+var BIND_KEYS = ["POSTGRES_BIND", "GARAGE_S3_BIND", "VALKEY_BIND"];
+var bold = (s) => styleText3("bold", s);
+var dim = (s) => styleText3("dim", s);
+var cyan = (s) => styleText3("cyan", s);
+var yellow = (s) => styleText3("yellow", s);
+var tilde = (path) => path.replace(homedir2(), "~");
+function flag(args, name) {
+  const i = args.indexOf(name);
+  if (i === -1)
+    return;
+  const value = args[i + 1];
+  if (!value || value.startsWith("--"))
+    throw usageError(`${name} needs a value`);
+  return value;
+}
+async function serverDir(args) {
+  const given = flag(args, "--dir");
+  if (given)
+    return resolve4(given.replace(/^~(?=$|\/)/, homedir2()));
+  return (await loadConfig()).server ?? DEFAULT_DIR;
+}
+var localUrl = (env) => `http://localhost:${env.MYBASE_PORT || "4000"}`;
+var ui = {
+  info: (m) => !jsonMode && log.info(m),
+  success: (m) => !jsonMode && log.success(m),
+  warn: (m) => !jsonMode && log.warn(m),
+  error: (m) => !jsonMode && log.error(m),
+  step: (m) => !jsonMode && log.step(m),
+  note: (m, title) => !jsonMode && note(m, title),
+  spinner() {
+    return jsonMode ? { start() {}, stop() {}, error() {}, message() {} } : spinner();
+  }
+};
+async function ask(answer) {
+  const value = await answer;
+  if (isCancel(value)) {
+    cancel("Cancelled. Nothing was changed.");
+    process.exit(0);
+  }
+  return value;
+}
+var validPort = (v) => /^\d+$/.test(v ?? "") && Number(v) >= 1 && Number(v) <= 65535 ? undefined : "a port number, 1\u201365535";
+var tail = (text, n = 25) => text.split(`
+`).slice(-n).join(`
+`);
+async function preflight(dir) {
+  const s = ui.spinner();
+  s.start("Checking this machine");
+  const docker = checkDocker();
+  const m = machine();
+  const disk = await freeDiskGb(dir);
+  if (!docker.ok) {
+    s.error("This machine isn't ready");
+    throw new CliError(docker.problem);
+  }
+  s.stop("This machine is ready");
+  const ok = styleText3("green", "\u2714");
+  const warn = yellow("\u25B2");
+  const lines = [
+    `${ok} Docker ${docker.docker}, Compose ${docker.compose}`,
+    `${ok} ${m.pi ?? m.hostname} (${m.arch})`,
+    `${m.totalMemGb < 1.5 ? warn : ok} ${m.totalMemGb.toFixed(1)} GB memory${m.totalMemGb < 1.5 ? dim("  mybase uses ~600 MB; 2 GB+ recommended") : ""}`
+  ];
+  if (disk !== null)
+    lines.push(`${disk < 5 ? warn : ok} ${disk.toFixed(0)} GB free disk${disk < 5 ? dim("  images + data need a few GB") : ""}`);
+  if (m.pi)
+    lines.push(`${warn} ${dim("Raspberry Pi: put Docker's data on an SSD if you can. SD cards are slow and wear out.")}`);
+  ui.note(lines.join(`
+`), "This machine");
+}
+async function chooseDir(args, interactive) {
+  let dir = await serverDir(args);
+  if (interactive && !args.includes("--dir")) {
+    const answer = await ask(text({
+      message: "Where should mybase keep its files?",
+      placeholder: tilde(dir),
+      defaultValue: dir,
+      validate: (v) => v && !v.trim().startsWith("/") && !v.trim().startsWith("~") ? "use an absolute path (or ~/\u2026)" : undefined
+    }));
+    dir = resolve4(answer.trim().replace(/^~(?=$|\/)/, homedir2()));
+  }
+  const other = otherInstall(dir);
+  if (other) {
+    throw new CliError(`mybase is already installed in ${other}. Run \`mybase server setup --dir ${other}\` to change it, or stop it first (\`docker compose down\` there).`);
+  }
+  return dir;
+}
+async function chooseHost(current) {
+  const found = addresses();
+  const options = found.map((a) => ({ value: a.value, label: a.value, hint: a.label }));
+  if (current && !found.some((a) => a.value === current))
+    options.unshift({ value: current, label: current, hint: "current" });
+  options.push({ value: "", label: "Something else\u2026", hint: "type a name or IP" });
+  const picked = await ask(select({ message: "Which address should apps on your network use?", options, initialValue: current ?? options[0]?.value }));
+  if (picked)
+    return picked;
+  return (await ask(text({ message: "Address (hostname or IP)", validate: (v) => v?.trim() ? undefined : "required" }))).trim();
+}
+var validHost = (v) => HOST_PATTERN.test(v?.trim() ?? "") ? undefined : "a full hostname, like mybase.example.com";
+async function tunnelStep() {
+  const mode = await ask(select({
+    message: "How do you want to set up the tunnel?",
+    options: [
+      { value: "auto", label: "Automatically", hint: "paste a Cloudflare API token; mybase creates the tunnel + DNS" },
+      { value: "manual", label: "By hand", hint: "follow the steps in the Cloudflare dashboard, then paste the tunnel token" }
+    ]
+  }));
+  return mode === "auto" ? autoTunnel() : manualTunnel();
+}
+async function autoTunnel() {
+  ui.note([
+    `1. Your domain has to be on Cloudflare (free plan is fine).`,
+    `2. Create a token at ${cyan(TOKEN_URL)}`,
+    `   ${dim("Create Token \u2192 Custom token, with these permissions:")}`,
+    ...TOKEN_PERMISSIONS.map((perm) => `     \u2022 ${perm}`),
+    ``,
+    dim("The token is only used now, to create the tunnel and DNS records. It isn't saved.")
+  ].join(`
+`), "Cloudflare API token");
+  for (;; ) {
+    const token = await ask(password({ message: "Cloudflare API token", validate: (v) => v?.trim() ? undefined : "required" }));
+    const cf = cloudflare(token.trim());
+    const s = ui.spinner();
+    s.start("Looking up your domains");
+    let zones;
+    try {
+      zones = await cf.listZones();
+    } catch (err) {
+      s.error(err.message);
+      if (await ask(confirm2({ message: "Try another token?" })))
+        continue;
+      return manualTunnel();
+    }
+    if (zones.length === 0) {
+      s.error("No active domains on this token");
+      ui.info("Add your domain at https://dash.cloudflare.com (Add a site), wait until it's active, then try again.");
+      if (await ask(confirm2({ message: "Try another token?" })))
+        continue;
+      return manualTunnel();
+    }
+    s.stop(`Found ${zones.length} domain${zones.length === 1 ? "" : "s"}`);
+    const zoneId = zones.length === 1 ? zones[0].id : await ask(select({ message: "Which domain?", options: zones.map((z) => ({ value: z.id, label: z.name })) }));
+    const zone = zones.find((z) => z.id === zoneId);
+    const tunnelName = `mybase-${hostname3()}`;
+    s.start(`Creating tunnel ${tunnelName}`);
+    let tunnel;
+    try {
+      tunnel = await cf.ensureTunnel(zone.account.id, tunnelName);
+    } catch (err) {
+      s.error(err.message);
+      if (await ask(confirm2({ message: "Try another token?" })))
+        continue;
+      return manualTunnel();
+    }
+    s.stop(tunnel.created ? `Created tunnel ${tunnelName}` : `Reusing tunnel ${tunnelName}`);
+    let apiHost = "";
+    let s3Host = "";
+    for (;; ) {
+      const apiSub = await ask(text({ message: "Subdomain for the dashboard + API", placeholder: "mybase", defaultValue: "mybase" }));
+      const s3Sub = await ask(text({ message: "Subdomain for S3 storage", placeholder: "s3", defaultValue: "s3" }));
+      apiHost = `${apiSub.trim()}.${zone.name}`;
+      s3Host = `${s3Sub.trim()}.${zone.name}`;
+      if (validHost(apiHost) || validHost(s3Host) || apiHost === s3Host) {
+        ui.warn("Use two different, valid subdomains.");
+        continue;
+      }
+      const taken = [];
+      for (const host of [apiHost, s3Host]) {
+        const record = await cf.findRecord(zone.id, host).catch(() => null);
+        if (record && !pointsAtTunnel(record, tunnel.id))
+          taken.push(`${host} (${record.type} \u2192 ${record.content})`);
+      }
+      if (taken.length === 0)
+        break;
+      const replace = await ask(confirm2({ message: `Already in use: ${taken.join(", ")}. Replace ${taken.length === 1 ? "it" : "them"}?`, initialValue: false }));
+      if (replace)
+        break;
+    }
+    s.start("Routing hostnames to the tunnel");
+    try {
+      await cf.putIngress(zone.account.id, tunnel.id, [
+        { hostname: apiHost, service: "http://mybase:4000" },
+        { hostname: s3Host, service: "http://garage:3900" }
+      ]);
+      await cf.upsertCname(zone.id, apiHost, tunnel.id);
+      await cf.upsertCname(zone.id, s3Host, tunnel.id);
+      const tunnelToken = await cf.tunnelToken(zone.account.id, tunnel.id);
+      s.stop(`${apiHost} and ${s3Host} \u2192 this machine`);
+      return { env: tunnelEnv(tunnelToken, apiHost, s3Host), apiHost, s3Host };
+    } catch (err) {
+      s.error(err instanceof CloudflareError ? err.message : `Cloudflare: ${err.message}`);
+      if (await ask(confirm2({ message: "Try another token?" })))
+        continue;
+      return manualTunnel();
+    }
+  }
+}
+async function manualTunnel() {
+  ui.note([
+    `1. Add your domain to Cloudflare (free plan) and switch its nameservers at your registrar.`,
+    `2. Open ${cyan("https://one.dash.cloudflare.com")} \u2192 Networks \u2192 Tunnels \u2192 ${bold("Create a tunnel")}`,
+    `   \u2192 Cloudflared. Name it ${bold("mybase")}.`,
+    `3. Skip installing a connector (mybase runs it in Docker). Copy the token: the long`,
+    `   string after ${bold("--token")} in any of the install commands.`,
+    `4. Add two ${bold("public hostnames")} (Type: HTTP):`,
+    `     mybase.<your domain>  \u2192  ${cyan("mybase:4000")}   ${dim("dashboard, API, Postgres over WebSocket")}`,
+    `     s3.<your domain>      \u2192  ${cyan("garage:3900")}   ${dim("S3 for your apps")}`
+  ].join(`
+`), "Cloudflare Tunnel, by hand");
+  const token = await ask(password({ message: "Tunnel token", validate: (v) => tunnelIdFromToken(v ?? "") ? undefined : "that isn't a tunnel token (copy the part after --token)" }));
+  const apiHost = (await ask(text({ message: "Hostname for the dashboard + API", placeholder: "mybase.example.com", validate: validHost }))).trim();
+  const defaultS3 = apiHost.replace(/^[^.]+/, "s3");
+  const s3Host = (await ask(text({ message: "Hostname for S3", placeholder: defaultS3, defaultValue: defaultS3, validate: (v) => validHost(v || defaultS3) }))).trim();
+  return { env: tunnelEnv(token.trim(), apiHost, s3Host), apiHost, s3Host };
+}
+async function bindStep(lan, existing) {
+  const locked = existing.POSTGRES_BIND === "127.0.0.1";
+  const lock = await ask(confirm2({
+    message: "Close the Postgres, S3, and cache ports to your network? (apps then connect through the tunnel only)",
+    initialValue: lan ? locked : true
+  }));
+  return Object.fromEntries(BIND_KEYS.map((k) => [k, lock ? "127.0.0.1" : null]));
+}
+async function adminStep() {
+  const when = await ask(select({
+    message: "Create the admin account now?",
+    options: [
+      { value: "now", label: "Yes", hint: "and sign this CLI in" },
+      { value: "later", label: "Later, in the browser", hint: "from this machine or your network" }
+    ]
+  }));
+  if (when === "later")
+    return null;
+  const username = (await ask(text({ message: "Admin username", placeholder: "admin", defaultValue: "admin", validate: (v) => !v || USERNAME_PATTERN.test(v) ? undefined : "letters, digits, or . _ @ -" }))).trim();
+  for (;; ) {
+    const password2 = await ask(password({ message: `Password (at least ${ADMIN_PASSWORD_MIN} characters)`, validate: (v) => (v?.length ?? 0) >= ADMIN_PASSWORD_MIN ? undefined : `at least ${ADMIN_PASSWORD_MIN} characters` }));
+    const again = await ask(password({ message: "Same password again" }));
+    if (again === password2)
+      return { username, password: password2 };
+    ui.warn("The passwords didn't match.");
+  }
+}
+async function bootStep(existing, interactive, args) {
+  const docker = dockerOnBoot();
+  if (!interactive) {
+    const always = !args.includes("--no-autostart");
+    if (always && docker === "disabled")
+      ui.warn("Docker doesn't start at boot, so mybase won't either. Run `sudo systemctl enable docker`.");
+    return { always, enableDocker: false };
+  }
+  const always = await ask(confirm2({
+    message: `Start mybase automatically when this machine turns on? ${dim("(and restart it if it crashes)")}`,
+    initialValue: existing.MYBASE_RESTART !== "no"
+  }));
+  if (!always)
+    return { always, enableDocker: false };
+  if (docker === "enabled")
+    return { always, enableDocker: false };
+  if (docker === "desktop") {
+    ui.info(`Docker Desktop: turn on ${bold("Settings \u2192 General \u2192 Start Docker Desktop when you sign in")} too.`);
+    return { always, enableDocker: false };
+  }
+  if (docker === "unknown") {
+    ui.warn("Couldn't tell whether Docker starts at boot here (no systemd?). Make sure it does, or mybase won't either.");
+    return { always, enableDocker: false };
+  }
+  const enableDocker = await ask(confirm2({ message: `Docker doesn't start at boot yet. Turn that on? ${dim("(sudo systemctl enable docker)")}` }));
+  if (!enableDocker)
+    ui.warn("Then mybase only comes back after a reboot once you start Docker yourself.");
+  return { always, enableDocker };
+}
+async function turnOnDockerAtBoot() {
+  ui.step("Turning on Docker at boot (sudo may ask for your password)");
+  if (await enableDockerOnBoot())
+    ui.success("Docker starts at boot");
+  else
+    ui.warn("Couldn't enable it. Run `sudo systemctl enable docker` yourself.");
+}
+async function advancedStep(env) {
+  const out = {};
+  const set = (key, value, fallback) => {
+    if (value !== fallback)
+      out[key] = value;
+    else if (env[key] !== undefined)
+      out[key] = null;
+  };
+  const port = (key, label, fallback) => ask(text({ message: `${label} port`, placeholder: env[key] ?? fallback, defaultValue: env[key] ?? fallback, validate: (v) => v ? validPort(v) : undefined })).then((v) => set(key, v.trim(), fallback));
+  await port("MYBASE_PORT", "Dashboard + API", "4000");
+  await port("POSTGRES_PORT", "Postgres", "5432");
+  await port("GARAGE_S3_PORT", "S3", "3900");
+  await port("VALKEY_PORT", "Cache", "6379");
+  const memory = await ask(select({
+    message: "Cache memory (shared by every project; least recently used keys go first)",
+    initialValue: env.CACHE_MAXMEMORY ?? "64mb",
+    options: ["64mb", "128mb", "256mb", "512mb", "1gb"].map((v) => ({ value: v, label: v, hint: v === "64mb" ? "default, fine for a Pi" : undefined }))
+  }));
+  set("CACHE_MAXMEMORY", memory, "64mb");
+  const capacity = await ask(text({ message: "Storage capacity Garage advertises", placeholder: env.GARAGE_CAPACITY ?? "100G", defaultValue: env.GARAGE_CAPACITY ?? "100G", validate: (v) => !v || /^\d+[KMGT]?$/i.test(v) ? undefined : "like 100G or 2T" }));
+  set("GARAGE_CAPACITY", capacity.trim(), "100G");
+  const level = await ask(select({ message: "Log level", initialValue: env.LOG_LEVEL ?? "info", options: ["debug", "info", "warn", "error"].map((v) => ({ value: v, label: v })) }));
+  set("LOG_LEVEL", level, "info");
+  return out;
+}
+async function portStep(env, interactive) {
+  const ports = [
+    ["MYBASE_PORT", "dashboard + API", "4000"],
+    ["POSTGRES_PORT", "Postgres", "5432"],
+    ["GARAGE_S3_PORT", "S3", "3900"],
+    ["VALKEY_PORT", "cache", "6379"]
+  ];
+  const out = {};
+  for (const [key, label, fallback] of ports) {
+    const current = env[key] ?? fallback;
+    if (portFree(Number(current)))
+      continue;
+    if (!interactive)
+      throw new CliError(`port ${current} (${label}) is already in use. Free it, or set ${key} in the .env.`);
+    let next = Number(current) + 1;
+    while (!portFree(next) && next < 65535)
+      next++;
+    const answer = await ask(text({ message: `Port ${current} (${label}) is in use by something else. Use which port?`, placeholder: String(next), defaultValue: String(next), validate: (v) => v ? validPort(v) : undefined }));
+    out[key] = answer.trim();
+  }
+  return out;
+}
+async function writeFiles(dir, envText, interactive, replaceCompose = interactive) {
+  await mkdir3(dir, { recursive: true });
+  const envPath = join3(dir, ".env");
+  await Bun.write(envPath, envText);
+  await chmod2(envPath, 384);
+  await writeCompose(dir, interactive, replaceCompose);
+}
+async function writeCompose(dir, interactive, replace) {
+  const file = Bun.file(join3(dir, "compose.yml"));
+  if (await file.exists()) {
+    const current = await file.text();
+    if (current === compose_default)
+      return false;
+    const ok = interactive ? await ask(confirm2({ message: `${tilde(join3(dir, "compose.yml"))} differs from this CLI's (${CLI_VERSION}). Replace it? (the old one is kept as compose.yml.bak)` })) : replace;
+    if (!ok)
+      return false;
+    await Bun.write(join3(dir, "compose.yml.bak"), current);
+  }
+  await Bun.write(file, compose_default);
+  return true;
+}
+async function missingImages(dir) {
+  const images = await compose(dir, ["config", "--images"]);
+  const missing = [];
+  for (const image of images.stdout.split(`
+`).filter(Boolean)) {
+    if (!imageExists(image))
+      missing.push(image);
+  }
+  return missing;
+}
+var imageExists = (image) => Bun.spawnSync(["docker", "image", "inspect", image], { stdout: "ignore", stderr: "ignore" }).exitCode === 0;
+async function startStack(dir, env, pull = true) {
+  const s = ui.spinner();
+  if (pull) {
+    s.start("Downloading images (the first time takes a few minutes, longer on a Pi)");
+    const pulled = await compose(dir, ["pull", "--quiet"]);
+    if (!pulled.ok) {
+      const missing = await missingImages(dir);
+      if (missing.length) {
+        s.error("Couldn't download the images");
+        throw new CliError(`couldn't download ${missing.join(", ")}:
+${tail(pulled.stderr || pulled.stdout)}`);
+      }
+      s.stop("Using the images already on this machine (couldn't download newer ones)");
+    } else
+      s.stop("Images downloaded");
+  }
+  s.start("Starting containers");
+  const up = await compose(dir, ["up", "-d", "--remove-orphans"]);
+  if (!up.ok) {
+    s.error("Couldn't start the containers");
+    throw new CliError(`docker compose up failed:
+${tail(up.stderr || up.stdout)}`);
+  }
+  s.message("Waiting for mybase to answer");
+  const version = await waitHealthy(localUrl(env));
+  if (!version) {
+    s.error("mybase didn't come up");
+    const logs = await compose(dir, ["logs", "--tail", "30", "mybase"]);
+    throw new CliError(`mybase didn't answer at ${localUrl(env)}/health within 3 minutes. Its last log lines:
+${logs.stdout || logs.stderr}
+
+Fix the problem, then run \`mybase server setup --dir ${dir}\` again (keys are kept).`);
+  }
+  s.stop(`mybase ${version} is running`);
+  return version;
+}
+async function createAdmin(url, admin) {
+  const post = async (path, body) => {
+    const res = await fetch(`${url}${path}`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok)
+      throw new CliError(data.error ?? res.statusText);
+    return data;
+  };
+  await post("/auth/setup", admin);
+  const login = await post("/auth/login", { ...admin, tokenName: `cli on ${hostname3()}` });
+  if (!login.token)
+    throw new CliError("the server didn't return a token");
+  const previous = await loadConfig();
+  await saveConfig({ url, token: login.token });
+  if (previous.token && previous.url)
+    await api("/auth/logout", { method: "POST", url: previous.url, token: previous.token }).catch(() => {});
+  return login.username;
+}
+async function setupNeeded(url) {
+  const res = await fetch(`${url}/auth/me`).catch(() => null);
+  if (!res?.ok)
+    return true;
+  return (await res.json()).setupNeeded !== false;
+}
+async function setup(args) {
+  const yes = args.includes("--yes");
+  const interactive = !yes && !jsonMode && process.stdin.isTTY === true;
+  if (!interactive && !yes)
+    throw usageError("refusing without --yes (no terminal to ask on). Pass --yes with flags: see `mybase help server`.");
+  if (!jsonMode)
+    intro(`${bold(" mybase ")} ${dim(`server setup \xB7 ${CLI_VERSION}`)}`);
+  if (interactive)
+    ui.info(`This sets up mybase on ${bold(hostname3())}: Postgres, storage, cache, and the dashboard, in Docker.
+${dim("Nothing is changed until you confirm at the end. Ctrl-C leaves at any time.")}`);
+  const dir = await chooseDir(args, interactive);
+  await preflight(dir);
+  const envFile = Bun.file(join3(dir, ".env"));
+  const envText = await envFile.exists() ? await envFile.text() : null;
+  const existing = envText ? parseEnv(envText) : {};
+  const running = await stackExists(dir);
+  if (envText) {
+    if (interactive) {
+      const action = await ask(select({
+        message: `mybase is already set up in ${tilde(dir)}.`,
+        options: [
+          { value: "reconfigure", label: "Change its settings", hint: "keys and data are kept" },
+          { value: "cancel", label: "Leave it as it is" }
+        ]
+      }));
+      if (action === "cancel") {
+        outro("Nothing changed.");
+        return;
+      }
+    } else
+      ui.info(`Updating the existing setup in ${dir} (keys are kept).`);
+  }
+  const updates = {};
+  const secrets = generateSecrets(existing);
+  Object.assign(updates, secrets);
+  ui.note(Object.keys(SECRET_KEYS).map((key) => {
+    const value = secrets[key] ?? existing[key];
+    return `${key.padEnd(20)} ${dim(maskSecret(value))}  ${secrets[key] ? styleText3("green", "new") : dim("kept")}`;
+  }).join(`
+`), "Keys");
+  let lan = Boolean(existing.MYBASE_PUBLIC_HOST);
+  let tunnel = existing.CLOUDFLARE_TUNNEL_TOKEN ? { apiHost: (existing.MYBASE_PUBLIC_URL ?? "").replace(/^https?:\/\//, ""), s3Host: (existing.MYBASE_S3_PUBLIC_URL ?? "").replace(/^https?:\/\//, "") } : null;
+  const tunnelToken = flag(args, "--tunnel-token");
+  const publicHost = flag(args, "--public-host");
+  if (interactive) {
+    const port = existing.MYBASE_PORT || "4000";
+    const reach = await ask(multiselect({
+      message: `Who should reach mybase? ${dim(`(this machine always can, at localhost:${port})`)}`,
+      required: false,
+      initialValues: [...lan ? ["lan"] : [], ...tunnel ? ["tunnel"] : []],
+      options: [
+        { value: "lan", label: "Devices on my network or Tailscale", hint: "apps on other machines at home" },
+        { value: "tunnel", label: "The internet, through a Cloudflare Tunnel", hint: "HTTPS on your domain, no router ports, home IP hidden" }
+      ]
+    }));
+    lan = reach.includes("lan");
+    updates.MYBASE_PUBLIC_HOST = lan ? await chooseHost(existing.MYBASE_PUBLIC_HOST) : null;
+    if (reach.includes("tunnel")) {
+      const keep = tunnel && await ask(select({
+        message: `A tunnel is set up for ${tunnel.apiHost}.`,
+        options: [
+          { value: true, label: "Keep it" },
+          { value: false, label: "Set it up again" }
+        ]
+      }));
+      if (!keep) {
+        const result = await tunnelStep();
+        Object.assign(updates, result.env);
+        tunnel = result;
+      }
+      Object.assign(updates, await bindStep(lan, existing));
+    } else if (tunnel) {
+      for (const key of [...TUNNEL_KEYS, ...BIND_KEYS])
+        updates[key] = null;
+      tunnel = null;
+    }
+  } else {
+    if (publicHost) {
+      updates.MYBASE_PUBLIC_HOST = publicHost;
+      lan = true;
+    }
+    if (tunnelToken) {
+      const domain = flag(args, "--domain");
+      if (!tunnelIdFromToken(tunnelToken))
+        throw usageError("--tunnel-token isn't a Cloudflare tunnel token");
+      if (!domain)
+        throw usageError("--tunnel-token needs --domain (serves mybase.<domain> and s3.<domain>)");
+      tunnel = { apiHost: `mybase.${domain}`, s3Host: `s3.${domain}` };
+      Object.assign(updates, tunnelEnv(tunnelToken, tunnel.apiHost, tunnel.s3Host));
+    }
+  }
+  const env = () => ({ ...existing, ...Object.fromEntries(Object.entries(updates).filter(([, v]) => v !== null)) });
+  const needsAdmin = !running || await setupNeeded(localUrl(env()));
+  let admin = null;
+  if (needsAdmin && interactive)
+    admin = await adminStep();
+  else if (needsAdmin && args.includes("--admin-password-stdin")) {
+    const password = (await Bun.stdin.text()).replace(/\r?\n$/, "");
+    if (password.length < ADMIN_PASSWORD_MIN)
+      throw usageError(`the admin password must be at least ${ADMIN_PASSWORD_MIN} characters`);
+    admin = { username: flag(args, "--admin-user") ?? "admin", password };
+  }
+  const boot = await bootStep(existing, interactive, args);
+  updates.MYBASE_RESTART = boot.always ? null : "no";
+  if (interactive) {
+    const advanced = await ask(confirm2({ message: `Change advanced settings? ${dim("(ports, cache memory, storage size, log level)")}`, initialValue: false }));
+    if (advanced)
+      Object.assign(updates, await advancedStep(env()));
+  } else {
+    const port = flag(args, "--port");
+    if (port) {
+      if (validPort(port))
+        throw usageError("--port needs a port number");
+      updates.MYBASE_PORT = port;
+    }
+  }
+  if (!running)
+    Object.assign(updates, await portStep(env(), interactive));
+  const final = envText ? mergeEnv(envText, updates) : renderEnv(env());
+  const values = parseEnv(final);
+  ui.note([
+    ...Object.entries(values).map(([k, v]) => `${k.padEnd(24)} ${isSecretKey(k) ? dim(maskSecret(v)) : v}`),
+    "",
+    dim(`Writes ${tilde(join3(dir, ".env"))} (only you can read it) and ${tilde(join3(dir, "compose.yml"))}`)
+  ].join(`
+`), "Settings");
+  if (interactive && !await ask(confirm2({ message: running ? "Save and restart mybase?" : "Save and start mybase?" }))) {
+    outro("Nothing changed.");
+    return;
+  }
+  await writeFiles(dir, final, interactive, yes);
+  await saveServerDir(dir);
+  ui.success(`Saved ${tilde(dir)}`);
+  if (boot.enableDocker)
+    await turnOnDockerAtBoot();
+  const version = await startStack(dir, values);
+  const url = localUrl(values);
+  let signedIn = null;
+  if (admin) {
+    const s = ui.spinner();
+    s.start("Creating the admin account");
+    signedIn = await createAdmin(url, admin);
+    s.stop(`Admin ${signedIn} created, and this CLI is signed in`);
+  }
+  const port = values.MYBASE_PORT || "4000";
+  const urls = {
+    local: url,
+    network: values.MYBASE_PUBLIC_HOST ? `http://${values.MYBASE_PUBLIC_HOST}:${port}` : null,
+    public: tunnel ? `https://${tunnel.apiHost}` : null,
+    s3: values.MYBASE_S3_PUBLIC_URL ?? (values.MYBASE_PUBLIC_HOST ? `http://${values.MYBASE_PUBLIC_HOST}:${values.GARAGE_S3_PORT || "3900"}` : null)
+  };
+  if (jsonMode) {
+    return print({ dir, version, urls, autostart: boot.always, adminCreated: Boolean(signedIn), signedIn: Boolean(signedIn), secretsKeyGenerated: Boolean(secrets.MYBASE_SECRETS_KEY) }, () => {});
+  }
+  ui.note([
+    `${"Dashboard".padEnd(16)} ${cyan(url)}`,
+    ...urls.network ? [`${"On your network".padEnd(16)} ${cyan(urls.network)}`] : [],
+    ...urls.public ? [`${"On the internet".padEnd(16)} ${cyan(urls.public)}  ${dim(`(S3: ${urls.s3})`)}`] : [],
+    `${"Starts on boot".padEnd(16)} ${boot.always ? dockerOnBoot() === "disabled" ? yellow("no: Docker doesn't start at boot") : "yes" : "no"}`,
+    `${"CLI".padEnd(16)} ${signedIn ? `signed in as ${signedIn}` : `run ${bold(`mybase login --url ${url}`)} after creating the admin`}`,
+    "",
+    bold("Next"),
+    ...signedIn ? [] : [`  Open ${cyan(url)} and create the admin account`],
+    `  ${bold("mybase project create my-app")}   a database + bucket + credentials`,
+    `  ${bold("mybase agent init")}              teach your coding agent about it`,
+    `  Turn on two-factor sign-in in Settings${tunnel ? yellow("  (do this before sharing the public URL)") : ""}`,
+    `  ${bold("mybase server status")} \xB7 ${bold("mybase server update")}`
+  ].join(`
+`), "mybase is running");
+  if (secrets.MYBASE_SECRETS_KEY) {
+    ui.warn(`${bold("Back up MYBASE_SECRETS_KEY")} (in ${tilde(join3(dir, ".env"))}) somewhere other than this machine,
+like a password manager. If it's lost, every stored secret is lost with it.`);
+    if (interactive && await ask(confirm2({ message: "Show it now so you can copy it?", initialValue: false }))) {
+      log.message(secrets.MYBASE_SECRETS_KEY);
+    }
+  }
+  outro(`Done. Config for this CLI: ${dim(tilde(configPath))}`);
+}
+
+// src/server.ts
+var serverUsage = `  server setup [--dir <dir>]     Install mybase on this machine: checks Docker, generates keys, sets up
+                                 LAN/Tailscale access, a Cloudflare Tunnel, start on boot, and the admin
+    [--yes] [--public-host <h>] [--tunnel-token <t> --domain <d>] [--port <n>] [--no-autostart]
+    [--admin-user <u> --admin-password-stdin]   Without a terminal: defaults plus these flags
+  server status [--dir <dir>]    Containers, health, and whether mybase starts on boot
+  server update [--dir <dir>]    Download new images and restart (also refreshes compose.yml)
+  server tunnel [--dir <dir>]    Add or replace the Cloudflare Tunnel [--tunnel-token <t> --domain <d>] | --off
+  server autostart on|off        Start mybase when this machine boots (and restart it after crashes)
+  Default dir: the last one setup used, else ~/mybase`;
+var dim2 = (s) => styleText4("dim", s);
+var green = (s) => styleText4("green", s);
+var red = (s) => styleText4("red", s);
+async function loadEnv(dir) {
+  const file = Bun.file(join4(dir, ".env"));
+  if (!await file.exists() || !await Bun.file(join4(dir, "compose.yml")).exists()) {
+    throw new CliError(`no mybase server in ${dir}. Run \`mybase server setup\` (or pass --dir).`, 4);
+  }
+  const text = await file.text();
+  return { text, values: parseEnv(text) };
+}
+async function saveEnv(dir, text) {
+  await Bun.write(join4(dir, ".env"), text);
+}
+async function status(args) {
+  const dir = await serverDir(args);
+  const { values } = await loadEnv(dir);
+  const ps = await compose(dir, ["ps", "-a", "--format", "json"]);
+  if (!ps.ok)
+    throw new CliError(`docker compose ps failed: ${ps.stderr}`);
+  const containers = ps.stdout.startsWith("[") ? JSON.parse(ps.stdout) : ps.stdout.split(`
+`).filter(Boolean).map((l) => JSON.parse(l));
+  const url = localUrl(values);
+  const health = await fetch(`${url}/health`, { signal: AbortSignal.timeout(3000) }).then(async (r) => r.ok ? (await r.json()).version ?? "unknown" : null).catch(() => null);
+  const autostart = values.MYBASE_RESTART !== "no";
+  const docker = dockerOnBoot();
+  const data = {
+    dir,
+    url,
+    healthy: health !== null,
+    version: health,
+    autostart: autostart && docker !== "disabled",
+    dockerOnBoot: docker,
+    publicUrl: values.CLOUDFLARE_TUNNEL_TOKEN ? values.MYBASE_PUBLIC_URL ?? null : null,
+    containers: containers.map((c) => ({ service: c.Service, state: c.State, health: c.Health || null }))
+  };
+  print(data, () => {
+    console.log(`mybase in ${dir}`);
+    console.log(`  ${health ? green("\u25CF") : red("\u25CF")} ${url}  ${health ? `version ${health}` : "not answering"}`);
+    if (data.publicUrl)
+      console.log(`  ${dim2("public")}  ${data.publicUrl}`);
+    console.log(`  ${dim2("starts on boot")}  ${!autostart ? "no (mybase server autostart on)" : docker === "disabled" ? "no: Docker doesn't start at boot (sudo systemctl enable docker)" : "yes"}`);
+    console.log("");
+    if (containers.length === 0)
+      console.log("  No containers. Start them: mybase server update");
+    for (const c of data.containers) {
+      const up = c.state === "running" && (c.health === null || c.health === "healthy");
+      console.log(`  ${up ? green("\u25CF") : red("\u25CF")} ${c.service.padEnd(12)} ${c.state}${c.health ? ` (${c.health})` : ""}`);
+    }
+  });
+  if (!health)
+    process.exitCode = 1;
+}
+async function update(args) {
+  const dir = await serverDir(args);
+  const { values } = await loadEnv(dir);
+  const interactive = !jsonMode && process.stdin.isTTY === true && !args.includes("--yes");
+  if (!jsonMode)
+    intro(`${styleText4("bold", " mybase ")} ${dim2("server update")}`);
+  const replaced = await writeCompose(dir, interactive, true);
+  if (replaced)
+    ui.success(`compose.yml updated to this CLI's (${CLI_VERSION})`);
+  const version = await startStack(dir, values);
+  const minor = (v) => v.split(".").slice(0, 2).join(".");
+  if (minor(version) !== minor(CLI_VERSION)) {
+    ui.warn(`The server is ${version}, this CLI ${CLI_VERSION}. Update the CLI: curl -fsSL https://raw.githubusercontent.com/LandonHarter/mybase/master/scripts/install.sh | sh`);
+  }
+  if (jsonMode)
+    return print({ dir, version, composeUpdated: replaced }, () => {});
+  outro(`mybase ${version} is running at ${localUrl(values)}`);
+}
+async function tunnel(args) {
+  const dir = await serverDir(args);
+  const { text, values } = await loadEnv(dir);
+  const interactive = !jsonMode && process.stdin.isTTY === true;
+  if (!jsonMode)
+    intro(`${styleText4("bold", " mybase ")} ${dim2("server tunnel")}`);
+  let updates;
+  let host = null;
+  if (args.includes("--off")) {
+    updates = Object.fromEntries(["COMPOSE_PROFILES", "CLOUDFLARE_TUNNEL_TOKEN", "MYBASE_PUBLIC_URL", "MYBASE_S3_PUBLIC_URL", "MYBASE_TRUST_PROXY", "POSTGRES_BIND", "GARAGE_S3_BIND", "VALKEY_BIND"].map((k) => [k, null]));
+  } else if (flag(args, "--tunnel-token")) {
+    const token = flag(args, "--tunnel-token");
+    const domain = flag(args, "--domain");
+    if (!tunnelIdFromToken(token))
+      throw usageError("--tunnel-token isn't a Cloudflare tunnel token");
+    if (!domain)
+      throw usageError("--tunnel-token needs --domain (serves mybase.<domain> and s3.<domain>)");
+    host = `mybase.${domain}`;
+    updates = tunnelEnv(token, host, `s3.${domain}`);
+  } else if (interactive) {
+    const result = await tunnelStep();
+    host = result.apiHost;
+    updates = result.env;
+  } else
+    throw usageError("without a terminal, pass --tunnel-token <t> --domain <d>, or --off");
+  await saveEnv(dir, mergeEnv(text, updates));
+  if (args.includes("--off"))
+    await compose(dir, ["--profile", "tunnel", "rm", "-sf", "cloudflared"]);
+  const version = await startStack(dir, { ...values }, !args.includes("--off"));
+  if (jsonMode)
+    return print({ dir, version, publicUrl: host ? `https://${host}` : null }, () => {});
+  outro(host ? `Public at https://${host}. Turn on two-factor sign-in in Settings if you haven't.` : "Tunnel off. mybase is reachable on this machine and your network only.");
+}
+async function autostart(args) {
+  const mode = args[0];
+  if (mode !== "on" && mode !== "off")
+    throw usageError("usage: mybase server autostart on|off");
+  const dir = await serverDir(args);
+  const { text, values } = await loadEnv(dir);
+  await saveEnv(dir, mergeEnv(text, { MYBASE_RESTART: mode === "on" ? null : "no" }));
+  if (mode === "on" && dockerOnBoot() === "disabled") {
+    if (!jsonMode && process.stdin.isTTY)
+      await turnOnDockerAtBoot();
+    else
+      ui.warn("Docker doesn't start at boot, so mybase won't either. Run `sudo systemctl enable docker`.");
+  }
+  const up = await compose(dir, ["up", "-d"]);
+  if (!up.ok)
+    throw new CliError(`docker compose up failed:
+${up.stderr}`);
+  if (!await waitHealthy(localUrl(values), 60000))
+    ui.warn("mybase didn't answer yet; check `mybase server status`.");
+  print({ dir, autostart: mode === "on", dockerOnBoot: dockerOnBoot() }, () => console.log(mode === "on" ? "mybase now starts when this machine boots, and restarts if it crashes." : "mybase won't start on its own after a reboot. Start it with `mybase server update`."));
+}
+async function server(command, args) {
+  if (command === "setup")
+    await setup(args);
+  else if (command === "status")
+    await status(args);
+  else if (command === "update")
+    await update(args);
+  else if (command === "tunnel")
+    await tunnel(args);
+  else if (command === "autostart")
+    await autostart(args);
+  else
+    return false;
+  return true;
+}
+
+// src/users.ts
+var usersUsage = `  users enable <project>         Turn on users: an auth schema for Better Auth, plus setup steps
+  users init <project> [--env <secrets env>]  Print an auth.ts for Better Auth; --env stores a new BETTER_AUTH_SECRET there
+  users list <project> [--search <text>]  The app's users, newest first
+  users show <project> <user-id>  One user: sign-in methods and active sessions
+  users revoke <project> <user-id> [<session-id>]  Sign a user out (one session, or everywhere)
+  users delete <project> <user-id> [--yes]  Delete a user and their sessions
+  users disable <project> [--yes]  Turn it off, deleting every user account`;
+var base8 = (project) => `/projects/${encodeURIComponent(project)}/users`;
+function authSnippet(project, apiUrl) {
+  return `// auth.ts: npm i better-auth pg @mybase-dev/sdk
+import { betterAuth } from "better-auth";
+import { Pool } from "pg";
+import { createCache } from "@mybase-dev/sdk/cache";
+import { authDatabaseUrl, mybaseAuth, mybaseSecondaryStorage } from "@mybase-dev/sdk/better-auth";
+
+const mybase = { apiUrl: "${apiUrl}", project: "${project}", apiKey: process.env.MYBASE_API_KEY! };
+
+export const auth = betterAuth({
+  // Better Auth's tables go in the "auth" schema of the project's database.
+  database: new Pool({ connectionString: authDatabaseUrl(process.env.DATABASE_URL!) }),
+  // Sessions and rate limits in the mybase cache (turn on the cache service first).
+  secondaryStorage: mybaseSecondaryStorage(createCache(mybase)),
+  // Keep a copy in Postgres too, so the dashboard can list and revoke sessions.
+  session: { storeSessionInDatabase: true },
+  emailAndPassword: { enabled: true },
+  // Sign-ups and sign-ins in the mybase audit log.
+  plugins: [mybaseAuth(mybase)],
+});
+
+// Then create the tables: npx @better-auth/cli migrate`;
+}
+async function users(sub, args) {
+  const { positional, flags } = parseArgs(args);
+  const [project, userId, sessionId] = positional;
+  switch (sub) {
+    case "enable": {
+      const p = need(project, "project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/users`, { method: "PUT" });
+      const o = await api(base8(p));
+      print({ enabled: "users", project: p, ...o }, () => {
+        console.log(`Users enabled for "${p}". Better Auth's tables go in the "${o.schema}" schema.
+`);
+        console.log("Next:");
+        console.log(`  1. An API key for the app: mybase token create ${p}-auth --project ${p} --perm users:write,cache:write`);
+        console.log(`  2. The cache, for sessions: mybase cache enable ${p}`);
+        console.log(`  3. An auth.ts to start from: mybase users init ${p}`);
+      });
+      return true;
+    }
+    case "init": {
+      const p = need(project, "project name");
+      const o = await api(base8(p));
+      const env = flagString(flags, "env");
+      let stored = null;
+      if (env) {
+        const secret = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("base64");
+        await api(`/projects/${encodeURIComponent(p)}/secrets/envs/${encodeURIComponent(env)}/secrets`, {
+          method: "PATCH",
+          body: JSON.stringify({ set: { BETTER_AUTH_SECRET: secret }, message: "mybase users init" })
+        });
+        stored = env;
+      }
+      const snippet = authSnippet(p, o.setup.apiUrl);
+      print({ project: p, snippet, storedSecretIn: stored }, () => {
+        console.log(snippet);
+        console.log(stored ? `
+Stored a new BETTER_AUTH_SECRET in secrets env "${stored}". Run your app with: mybase run -e ${stored} -- <command>` : `
+Set BETTER_AUTH_SECRET to 32+ random bytes (openssl rand -base64 32), or rerun with --env <secrets env> to store one.`);
+      });
+      return true;
+    }
+    case "list": {
+      const p = need(project, "project name");
+      const search = flagString(flags, "search");
+      const list = await api(`${base8(p)}/accounts?limit=100${search ? `&search=${encodeURIComponent(search)}` : ""}`);
+      print(list, () => {
+        if (list.users.length === 0)
+          console.log(search ? "No users match." : "No users yet.");
+        for (const u of list.users)
+          console.log(`${u.id}	${u.email ?? "-"}	${u.name ?? "-"}	${u.createdAt ?? ""}${u.banned ? "\tbanned" : ""}`);
+        if (list.total > list.users.length)
+          console.log(`\u2026 and ${list.total - list.users.length} more (narrow it with --search)`);
+      });
+      return true;
+    }
+    case "show": {
+      const p = need(project, "project name");
+      const u = await api(`${base8(p)}/accounts/${encodeURIComponent(need(userId, "user id"))}`);
+      print(u, () => {
+        console.log(`${u.email ?? u.id}${u.name ? ` (${u.name})` : ""}${u.banned ? "  BANNED" : ""}`);
+        console.log(`  id          ${u.id}`);
+        console.log(`  created     ${u.createdAt ?? "-"}`);
+        console.log(`  verified    ${u.emailVerified ?? "-"}`);
+        console.log(`  sign-in     ${u.providers.join(", ") || "-"}`);
+        console.log(`
+Active sessions (${u.sessions.length}):`);
+        for (const s of u.sessions)
+          console.log(`  ${s.id}  since ${s.createdAt ?? "?"}  ${s.ipAddress ?? ""}  ${s.userAgent ?? ""}`);
+      });
+      return true;
+    }
+    case "revoke": {
+      const p = need(project, "project name");
+      const id = encodeURIComponent(need(userId, "user id"));
+      if (sessionId) {
+        await api(`${base8(p)}/accounts/${id}/sessions/${encodeURIComponent(sessionId)}`, { method: "DELETE" });
+        print({ revoked: 1 }, () => console.log("Signed out that session."));
+      } else {
+        const r = await api(`${base8(p)}/accounts/${id}/sessions`, { method: "DELETE" });
+        print(r, () => console.log(`Signed out ${r.revoked} session(s).`));
+      }
+      return true;
+    }
+    case "delete": {
+      const p = need(project, "project name");
+      const id = need(userId, "user id");
+      confirm(args.includes("--yes"), `This deletes user ${id} of "${p}" and signs them out.`, id, "the user id");
+      await api(`${base8(p)}/accounts/${encodeURIComponent(id)}`, { method: "DELETE" });
+      print({ deleted: id }, () => console.log(`Deleted user ${id}`));
+      return true;
+    }
+    case "disable": {
+      const p = need(project, "project name");
+      confirm(args.includes("--yes"), `This deletes every user account, session, and sign-in method of "${p}" (the auth schema).`, p, "the project name");
+      await api(`/projects/${encodeURIComponent(p)}/services/users`, { method: "DELETE" });
+      print({ disabled: "users", project: p }, () => console.log(`Users disabled for "${p}"`));
+      return true;
+    }
+  }
+  return false;
+}
+
+// src/index.ts
+var projectUsage = `  project create <name>          Create a new project (database + storage bucket)
+  project list                   List projects
+  project delete <name> [--yes]  Delete a project, its database, and all its files`;
+var USAGE = {
+  auth: authUsage,
+  server: serverUsage,
+  token: tokenUsage,
+  project: projectUsage,
+  context: contextUsage,
+  doctor: doctorUsage,
+  audit: auditUsage,
+  alerts: alertsUsage,
+  docs: docsUsage,
+  mcp: mcpUsage,
+  agent: agentUsage,
+  cron: cronUsage,
+  analytics: analyticsUsage,
+  cache: cacheUsage,
+  ratelimit: ratelimitUsage,
+  queue: queueUsage,
+  search: searchUsage,
+  secrets: secretsUsage,
+  vector: vectorUsage,
+  users: usersUsage,
+  captcha: captchaUsage,
+  run: runUsage
+};
+var GLOBAL_FLAGS = `  --json                         Print results as JSON (errors too, on stderr)
+  --yes                          Skip confirmations (required without a terminal)
+  MYBASE_API_URL, MYBASE_TOKEN   Override the saved server and token
+  Exit codes: 0 ok, 1 failure, 2 usage, 3 not signed in / bad token, 4 not found`;
+var usage = `Usage: mybase <command> [--json]
+
+Commands:
+${Object.values(USAGE).join(`
+`)}
+  help [<command>]               Show this message, or one command's
+
+Flags:
+${GLOBAL_FLAGS}`;
+async function main(args) {
+  const [command, sub, ...rest] = args;
+  if (command === "help" && sub) {
+    const key = ["login", "logout", "whoami", "version"].includes(sub) ? "auth" : sub;
+    if (USAGE[key])
+      return console.log(USAGE[key]);
+  }
+  if (command && await auth(command, args.slice(1)))
+    return;
+  if (command === "docs" && await docs(args.slice(1)))
+    return;
+  if (command === "context" && await context(args.slice(1)))
+    return;
+  if (command === "mcp" && await mcp(args.slice(1)))
+    return;
+  if (command === "agent" && sub && await agent(sub, rest))
+    return;
+  if (command === "run")
+    return run(args.slice(1));
+  if (command === "doctor")
+    return doctor(args.slice(1));
+  if (command === "audit")
+    return audit(args.slice(1));
+  if (command === "alerts")
+    return alerts(args.slice(1));
+  if (command === "project" && sub === "create") {
+    const name = need(rest[0], "project name");
+    const project = await api("/projects", {
+      method: "POST",
+      body: JSON.stringify({ name })
+    });
+    const { database, storage } = project.credentials;
+    if (jsonMode)
+      return print(project, () => {});
+    console.log(`Created project "${project.name}"
+`);
+    console.log(`Postgres:
+  ${database.url}
+`);
+    console.log("Storage (S3):");
+    console.log(`  endpoint           ${storage.endpoint}`);
+    console.log(`  region             ${storage.region}`);
+    console.log(`  bucket             ${storage.bucket}`);
+    console.log(`  access key id      ${storage.accessKeyId}`);
     console.log(`  secret access key  ${storage.secretAccessKey}`);
     console.log(`  public URL         ${storage.publicUrl}<key>  (objects under public/ only)
 `);
@@ -1521,6 +5246,10 @@ async function main(args) {
     print({ deleted: name }, () => console.log(`Deleted project "${name}"`));
     return;
   }
+  if (command === "server" && sub) {
+    if (await server(sub, rest))
+      return;
+  }
   if (command === "token" && sub) {
     if (await token(sub, rest))
       return;
@@ -1545,6 +5274,26 @@ async function main(args) {
     if (await queue(sub, rest))
       return;
   }
+  if (command === "search" && sub) {
+    if (await search(sub, rest))
+      return;
+  }
+  if (command === "secrets" && sub) {
+    if (await secrets(sub, rest))
+      return;
+  }
+  if (command === "vector" && sub) {
+    if (await vector(sub, rest))
+      return;
+  }
+  if (command === "users" && sub) {
+    if (await users(sub, rest))
+      return;
+  }
+  if (command === "captcha" && sub) {
+    if (await captcha(sub, rest))
+      return;
+  }
   if (command && command !== "help")
     throw usageError(`unknown command: mybase ${args.filter((a) => !a.startsWith("-")).slice(0, 2).join(" ")}
 
@@ -1552,7 +5301,9 @@ ${usage}`);
   console.log(usage);
 }
 if (import.meta.main) {
-  main(Bun.argv.slice(2).filter((a) => a !== "--json")).catch((err) => {
+  const args = Bun.argv.slice(2);
+  const own = ownArgs(args);
+  main([...own.filter((a) => a !== "--json"), ...args.slice(own.length)]).catch((err) => {
     const code = err instanceof CliError ? err.exitCode : 1;
     if (jsonMode)
       console.error(JSON.stringify({ error: err.message.split(`