@pmate/cli 0.24.25 → 0.24.27

package/dist/index.d.ts

@@ -913,6 +913,7 @@ type ServiceCommandArgs = {
     action: "deploy" | "stop";
     namespace: string;
     name: string;
+    env?: string;
     baseUrl?: string;
     json: boolean;
 } | {
@@ -920,6 +921,7 @@ type ServiceCommandArgs = {
     action: "init";
     namespace: string;
     name: string;
+    env: string;
     cwd?: string;
     baseUrl?: string;
     json: boolean;
@@ -943,6 +945,36 @@ type ServiceCommandArgs = {
     includeSecretValue: boolean;
     baseUrl?: string;
     json: boolean;
+} | {
+    type: Command.Service;
+    action: "service-env-list";
+    appId: string;
+    baseUrl?: string;
+    json: boolean;
+} | {
+    type: Command.Service;
+    action: "service-env-get";
+    appId: string;
+    envName: string;
+    baseUrl?: string;
+    json: boolean;
+} | {
+    type: Command.Service;
+    action: "service-env-add";
+    appId: string;
+    envName: string;
+    baseUrl?: string;
+    json: boolean;
+} | {
+    type: Command.Service;
+    action: "service-env-expose";
+    appId: string;
+    envName: string;
+    exposeType?: "https" | "websocket";
+    off: boolean;
+    domain?: string;
+    baseUrl?: string;
+    json: boolean;
 } | {
     type: Command.Service;
     action: "env-get";
@@ -1000,6 +1032,16 @@ type ServiceCommandArgs = {
     onlyKeys?: string[];
     baseUrl?: string;
     json: boolean;
+} | {
+    type: Command.Service;
+    action: "env-update-scope";
+    appId: string;
+    fromScope: string;
+    toScope: string;
+    overwrite: boolean;
+    onlyKeys?: string[];
+    baseUrl?: string;
+    json: boolean;
 };
 type VercelProjectsCommandArgs = {
     type: Command.Vercel;

package/dist/index.js

@@ -10050,6 +10050,19 @@ var AliyunService = class {
     );
     ui.success(`Created FC custom domain: ${input.domainName}`);
   }
+  static async deleteFcCustomDomain(domainName, region) {
+    const client = await this.createFcClient(region);
+    try {
+      await client.deleteCustomDomain(domainName);
+      ui.success(`Deleted FC custom domain: ${domainName}`);
+    } catch (error) {
+      if (this.isNotFoundError(error)) {
+        ui.warn(`FC custom domain not found: ${domainName}`);
+        return;
+      }
+      throw error;
+    }
+  }
   /** Add a DNS record via Aliyun DNS. */
   static async addRecord(input) {
     const userConfig = loadPmateConfig();
@@ -18110,6 +18123,7 @@ function readNamespaceFromPayload(payload) {
 var import_node_fs20 = require("fs");
 var import_promises6 = require("fs/promises");
 var import_node_path24 = __toESM(require("path"));
+var import_node_child_process11 = require("child_process");
 var import_promises7 = require("readline/promises");
 
 // src/services/ServiceRuntimeRunner.ts
@@ -18198,6 +18212,20 @@ var ServiceRegistryClient = class {
       }
     );
   }
+  async getServiceEnv(serviceId, envName) {
+    const payload = await this.request(
+      "GET",
+      `/services/by-id/${encodeURIComponent(serviceId)}/envs/${encodeURIComponent(envName)}`
+    );
+    return payload.item;
+  }
+  async appendDeployHistory(serviceId, input) {
+    return this.requestWithBody(
+      "POST",
+      `/services/by-id/${encodeURIComponent(serviceId)}/deploy-history`,
+      input
+    );
+  }
   async pullEnv(serviceId, options) {
     const pathname = `/services/by-id/${encodeURIComponent(serviceId)}/env/pull`;
     const response = await fetch(`${this.resolveBaseUrl()}${pathname}`, {
@@ -18313,6 +18341,12 @@ var ServiceRuntimeRunner = class {
   }
   async deploy(service, options = {}) {
     switch (this.getType(service)) {
+      case "node-api":
+        await this.deployNode(service, options);
+        return;
+      case "node-job":
+        await this.deployScriptManaged(service);
+        return;
       case "vite":
         await this.deployVite(service, options);
         return;
@@ -18320,14 +18354,14 @@ var ServiceRuntimeRunner = class {
         await this.deployStatic(service, options);
         return;
       case "node":
-        await this.deployNode(service);
+        await this.deployNode(service, options);
         return;
       case "rust":
       case "python":
         await this.deployScriptManaged(service);
         return;
       case "fc":
-        await this.deployFc(service);
+        await this.deployFc(service, options);
         return;
       case "ios":
       case "android":
@@ -18340,6 +18374,7 @@ var ServiceRuntimeRunner = class {
   }
   async stop(service) {
     switch (this.getType(service)) {
+      case "node-job":
       case "rust":
       case "python":
         await this.stopScriptManaged(service);
@@ -18362,6 +18397,12 @@ var ServiceRuntimeRunner = class {
       case "static":
         await this.initStaticLike(service);
         return;
+      case "node-api":
+        await this.initServerApp(service, options, { ensurePackageJson: true });
+        return;
+      case "node-job":
+        await this.initServerApp(service, options, { ensurePackageJson: false });
+        return;
       case "node":
         await this.initServerApp(service, options, { ensurePackageJson: true });
         return;
@@ -18574,7 +18615,7 @@ var ServiceRuntimeRunner = class {
     }
     await AliyunService.uploadDirectory(srcDir, bucketName);
   }
-  async deployFc(service) {
+  async deployFc(service, options = {}) {
     const fc = this.getFc(service);
     this.validateFcConfig(service, fc);
     const repoRoot = this.resolveRepoRoot(service);
@@ -18592,7 +18633,7 @@ var ServiceRuntimeRunner = class {
     await this.runCommand("pnpm", ["--filter", pkgName, "build"], repoRoot);
     const registry = new ServiceRegistryClient();
     const appId = `${service.namespace}:${service.name}`;
-    const stage = fc.deployStage ?? "prod";
+    const stage = this.envNameToStage(options.envName ?? fc.deployStage ?? "prod");
     const requiredEnv = await this.syncFcRequiredEnv(service, registry, stage);
     const resolved = await registry.resolveEnv(appId, {
       stage,
@@ -18690,7 +18731,7 @@ var ServiceRuntimeRunner = class {
       url: this.buildFcUrl(fc)
     });
   }
-  async deployNode(service) {
+  async deployNode(service, options = {}) {
     const network = this.getNetwork(service);
     const server = network.server?.trim();
     const repository = network.repository?.trim();
@@ -18717,7 +18758,7 @@ var ServiceRuntimeRunner = class {
       `pkg="${appDir}/package.json"`,
       `if [ -f "$pkg" ] && node -e 'const fs=require("node:fs"); const p=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); process.exit(p?.scripts?.build ? 0 : 1);' "$pkg"; then (cd "${appDir}" && pnpm run build); fi`
     ].join("; ");
-    const envSyncCommand = await this.buildNodeEnvSyncCommand(service.id, appDir);
+    const envSyncCommand = await this.buildNodeEnvSyncCommand(service.id, appDir, options.envName);
     const command = [
       `cd "$HOME"`,
       `[ -d "${repoDir}/.git" ] || git clone "${gitUrl}" "${repoDir}"`,
@@ -18735,13 +18776,13 @@ var ServiceRuntimeRunner = class {
     ].join(" && ");
     await this.runRemoteCommand(server, command);
   }
-  async buildNodeEnvSyncCommand(serviceId, appDir) {
+  async buildNodeEnvSyncCommand(serviceId, appDir, envName = "prod") {
     if (!this.envProvider) {
       return void 0;
     }
     let pulled;
     try {
-      pulled = await this.envProvider(serviceId, { stage: "prod", format: "dotenv" });
+      pulled = await this.envProvider(serviceId, { stage: this.envNameToStage(envName), format: "dotenv" });
     } catch (error) {
       if (error instanceof ServiceEnvNotFoundError) {
         ui.warn(`No env found for ${serviceId}; skipping .env.local sync.`);
@@ -18963,6 +19004,12 @@ var ServiceRuntimeRunner = class {
     }
     return payload.data;
   }
+  envNameToStage(envName) {
+    if (envName === "dev" || envName === "preview" || envName === "prod") {
+      return envName;
+    }
+    return "preview";
+  }
   renderPage(page, options = {}) {
     ui.info("Page", {
       page: page.page,
@@ -19443,10 +19490,15 @@ var ServiceRuntimeRunner = class {
       return [];
     }
     const appId = `${service.namespace}:${service.name}`;
-    const items = await registry.listEnvItems(appId, {
+    const scopedItems = await registry.listEnvItems(appId, {
       scope: stage,
       includeSecretMeta: true
     });
+    const allItems = await registry.listEnvItems(appId, {
+      scope: "all",
+      includeSecretMeta: true
+    });
+    const items = [...allItems, ...scopedItems];
     const requiredEnv = Array.from(
       new Set(
         items.map((item) => item.key ?? item.name).filter((key) => typeof key === "string" && key.trim().length > 0).map((key) => key.trim())
@@ -19693,6 +19745,8 @@ var ServiceCommandHandler = class {
         return;
       }
       case "delete": {
+        const service = await registry.getService(args.namespace, args.name);
+        await this.deleteServiceResources(service);
         const record = await this.request(
           baseUrl,
           "DELETE",
@@ -19737,17 +19791,32 @@ var ServiceCommandHandler = class {
       }
       case "deploy": {
         const record = await registry.getService(args.namespace, args.name);
-        await runtime.deploy(record);
+        const service = await this.materializeServiceEnv(registry, record, args.env);
+        try {
+          await runtime.deploy(service, { envName: args.env });
+          await this.appendDeployHistory(registry, record.id, args.env, "success");
+        } catch (error) {
+          await this.appendDeployHistory(
+            registry,
+            record.id,
+            args.env,
+            "failed",
+            error instanceof Error ? error.message : String(error)
+          );
+          throw error;
+        }
         return;
       }
       case "stop": {
         const record = await registry.getService(args.namespace, args.name);
-        await runtime.stop(record);
+        const service = args.env ? await this.materializeServiceEnv(registry, record, args.env) : record;
+        await runtime.stop(service);
         return;
       }
       case "init": {
         const record = await registry.getService(args.namespace, args.name);
-        await runtime.init(record, { cwd: args.cwd });
+        const service = await this.materializeServiceEnv(registry, record, args.env);
+        await runtime.init(service, { cwd: args.cwd });
         return;
       }
       case "log": {
@@ -19863,6 +19932,188 @@ var ServiceCommandHandler = class {
         this.renderJson(payload, args.json);
         return;
       }
+      case "env-update-scope": {
+        const payload = await this.request(
+          baseUrl,
+          "POST",
+          `${this.buildEnvBasePath(args.appId)}/update-scope`,
+          {
+            fromScope: args.fromScope,
+            toScope: args.toScope,
+            ...args.overwrite ? { overwrite: true } : {},
+            ...args.onlyKeys?.length ? { onlyKeys: args.onlyKeys } : {}
+          }
+        );
+        ui.success(`Updated env scope for ${args.appId}: ${args.fromScope} -> ${args.toScope}`);
+        await this.syncFcRequiredEnvFromServiceEnv(registry, args.appId, args.toScope);
+        this.renderJson(payload, args.json);
+        return;
+      }
+      case "service-env-list": {
+        const payload = await this.request(
+          baseUrl,
+          "GET",
+          this.buildServiceEnvBasePath(args.appId)
+        );
+        this.renderJson(payload, true);
+        return;
+      }
+      case "service-env-get": {
+        const payload = await this.request(
+          baseUrl,
+          "GET",
+          `${this.buildServiceEnvBasePath(args.appId)}/${encodeURIComponent(args.envName)}`
+        );
+        this.renderJson(payload, true);
+        return;
+      }
+      case "service-env-add": {
+        const payload = await this.request(
+          baseUrl,
+          "PUT",
+          `${this.buildServiceEnvBasePath(args.appId)}/${encodeURIComponent(args.envName)}`,
+          {
+            name: args.envName
+          }
+        );
+        ui.success(`Updated service env ${args.envName} for ${args.appId}`);
+        this.renderJson(payload, args.json);
+        return;
+      }
+      case "service-env-expose": {
+        const payload = await this.request(
+          baseUrl,
+          "POST",
+          `${this.buildServiceEnvBasePath(args.appId)}/${encodeURIComponent(args.envName)}/expose`,
+          {
+            ...args.exposeType ? { type: args.exposeType } : {},
+            ...args.domain ? { domain: args.domain } : {},
+            ...args.off ? { off: true } : {}
+          }
+        );
+        ui.success(
+          args.off ? `Disabled network for ${args.appId} ${args.envName}` : `Updated network for ${args.appId} ${args.envName}`
+        );
+        this.renderJson(payload, args.json);
+        return;
+      }
+    }
+  }
+  async materializeServiceEnv(registry, service, envName) {
+    if (!envName || !this.isDefinitionStyleService(service)) {
+      return service;
+    }
+    const env = await registry.getServiceEnv(service.id, envName);
+    return this.buildRuntimeServiceRecord(service, env);
+  }
+  isDefinitionStyleService(service) {
+    return "repository" in service || "type" in service && (service.type === "node-api" || service.type === "node-job") || !("site" in service) && !("network" in service) && !("fc" in service) && !("runtimeType" in service);
+  }
+  buildRuntimeServiceRecord(service, env) {
+    if (!("type" in service)) {
+      return service;
+    }
+    const repository = service.repository?.trim();
+    const dir = service.dir?.trim();
+    const runtime = env.runtime;
+    if (!runtime) {
+      throw new Error(`Missing runtime for ${service.id} env ${env.name}`);
+    }
+    if (!repository) {
+      throw new Error(`Missing service.repository for ${service.id}`);
+    }
+    if (!dir) {
+      throw new Error(`Missing service.dir for ${service.id}`);
+    }
+    if (runtime.type === "ali-oss") {
+      const domainParts = splitPrimaryDomain(env.network?.domain);
+      return {
+        id: service.id,
+        namespace: service.namespace,
+        name: service.name,
+        type: service.type === "static" ? "static" : "vite",
+        site: {
+          exposeType: "static-site",
+          repository,
+          dir,
+          bucket: requireString(runtime.bucket, `runtime.bucket for ${service.id} ${env.name}`),
+          domain: domainParts.domain,
+          ...domainParts.subdomain ? { subdomain: domainParts.subdomain } : {}
+        }
+      };
+    }
+    if (runtime.type === "ssh-pm2") {
+      return {
+        id: service.id,
+        namespace: service.namespace,
+        name: runtime.appName?.trim() || service.name,
+        type: service.type === "node-api" ? "node-api" : "node",
+        network: {
+          exposeType: env.network?.type === "websocket" ? "websocket" : env.network ? "rest" : "internal",
+          repository,
+          dir,
+          server: requireString(runtime.server, `runtime.server for ${service.id} ${env.name}`),
+          ...runtime.port !== void 0 ? { port: runtime.port } : {},
+          ...splitPrimaryDomain(env.network?.domain)
+        }
+      };
+    }
+    if (runtime.type === "ssh-script") {
+      return {
+        id: service.id,
+        namespace: service.namespace,
+        name: service.name,
+        type: service.type === "node-job" ? "node-job" : service.type === "rust" ? "rust" : "python",
+        network: {
+          exposeType: env.network?.type === "websocket" ? "websocket" : env.network ? "rest" : "internal",
+          repository,
+          dir: runtime.cwd?.trim() || dir,
+          server: requireString(runtime.server, `runtime.server for ${service.id} ${env.name}`),
+          ...runtime.port !== void 0 ? { port: runtime.port } : {},
+          ...splitPrimaryDomain(env.network?.domain)
+        },
+        runner: {
+          script: requireString(runtime.command, `runtime.command for ${service.id} ${env.name}`)
+        }
+      };
+    }
+    if (runtime.type === "fc") {
+      const domainParts = splitPrimaryDomain(env.network?.domain);
+      return {
+        id: service.id,
+        namespace: service.namespace,
+        name: service.name,
+        type: "fc",
+        fc: {
+          provider: runtime.provider ?? "aliyun",
+          region: requireString(runtime.region, `runtime.region for ${service.id} ${env.name}`),
+          repository,
+          dir,
+          functionName: requireString(runtime.functionName, `runtime.functionName for ${service.id} ${env.name}`),
+          ...runtime.configFile ? { configFile: runtime.configFile } : {},
+          ...runtime.qualifier ? { qualifier: runtime.qualifier } : {},
+          ...domainParts.domain ? { domain: domainParts.domain } : {},
+          ...domainParts.subdomain ? { subdomain: domainParts.subdomain } : {},
+          deployStage: env.name === "prod" || env.name === "preview" || env.name === "dev" ? env.name : "preview"
+        }
+      };
+    }
+    throw new Error(`Unsupported runtime ${runtime.type} for ${service.id} env ${env.name}`);
+  }
+  async appendDeployHistory(registry, serviceId, environment, status, message) {
+    try {
+      await registry.appendDeployHistory(serviceId, {
+        environment,
+        status,
+        ...message ? { message } : {}
+      });
+    } catch (error) {
+      ui.warn("Failed to append deploy history", {
+        serviceId,
+        environment,
+        status,
+        message: error instanceof Error ? error.message : String(error)
+      });
     }
   }
   resolveBaseUrl(baseUrl) {
@@ -19905,6 +20156,9 @@ var ServiceCommandHandler = class {
   buildEnvBasePath(appId) {
     return `/services/by-id/${encodeURIComponent(appId)}/env`;
   }
+  buildServiceEnvBasePath(appId) {
+    return `/services/by-id/${encodeURIComponent(appId)}/envs`;
+  }
   buildEnvPath(appId, query) {
     const params = new URLSearchParams();
     if (query.scope) {
@@ -20014,10 +20268,7 @@ var ServiceCommandHandler = class {
     if (!("type" in service) || service.type !== "fc" || !service.fc) {
       return;
     }
-    const items = await registry.listEnvItems(appId, {
-      scope,
-      includeSecretMeta: true
-    });
+    const items = await this.listEffectiveEnvItems(registry, appId, scope);
     const requiredEnv = Array.from(
       new Set(
         items.map((item) => item.key ?? item.name).filter((key) => typeof key === "string" && key.trim().length > 0).map((key) => key.trim())
@@ -20039,6 +20290,20 @@ var ServiceCommandHandler = class {
     const normalizedRight = [...right].sort();
     return normalizedLeft.every((value, index) => value === normalizedRight[index]);
   }
+  async listEffectiveEnvItems(registry, appId, scope) {
+    const scopedItems = await registry.listEnvItems(appId, {
+      scope,
+      includeSecretMeta: true
+    });
+    if (scope === "all") {
+      return scopedItems;
+    }
+    const allItems = await registry.listEnvItems(appId, {
+      scope: "all",
+      includeSecretMeta: true
+    });
+    return [...allItems, ...scopedItems];
+  }
   renderList(items, asJson) {
     if (asJson) {
       ui.plain(JSON.stringify(items, null, 2));
@@ -20052,6 +20317,206 @@ var ServiceCommandHandler = class {
       ui.info(formatNamespacedDisplayId(item.namespace, item.name), item);
     }
   }
+  async deleteServiceResources(service) {
+    switch (this.getServiceType(service)) {
+      case "vite":
+      case "static":
+        await this.deleteStaticResources(service);
+        return;
+      case "node":
+      case "rust":
+      case "python":
+        await this.deleteServerResources(service);
+        return;
+      case "fc":
+        await this.deleteFcResources(service);
+        return;
+      case "ios":
+      case "android":
+        ui.warn(`Service type "${this.getServiceType(service)}" has no runtime resources to delete`);
+        return;
+      default:
+        throw new Error(`Unsupported service type for delete: ${this.getServiceType(service)}`);
+    }
+  }
+  async deleteStaticResources(service) {
+    const site = this.getStaticSiteConfig(service);
+    const bucketName = site.bucket?.trim();
+    const domainName = site.domain?.trim();
+    if (!bucketName) {
+      throw new Error(`Missing site.bucket for ${service.id}`);
+    }
+    if (!domainName) {
+      throw new Error(`Missing site.domain for ${service.id}`);
+    }
+    const subdomain = site.subdomain?.trim();
+    const rr = subdomain || "@";
+    const cdnDomain = subdomain ? `${subdomain}.${domainName}` : domainName;
+    const cname = await AliyunService.getCdnCname(cdnDomain);
+    if (cname) {
+      this.logDeletedRecords(
+        `Removed CNAME record for ${cdnDomain}`,
+        await AliyunService.deleteDomainRecords({
+          domainName,
+          rr,
+          type: "CNAME",
+          value: cname
+        })
+      );
+    } else {
+      ui.warn(`No CDN CNAME found for ${cdnDomain}; deleting matching CNAME records by host.`);
+      this.logDeletedRecords(
+        `Removed CNAME record for ${cdnDomain}`,
+        await AliyunService.deleteDomainRecords({
+          domainName,
+          rr,
+          type: "CNAME"
+        })
+      );
+    }
+    if (!subdomain) {
+      this.logDeletedRecords(
+        `Removed CNAME record for www.${domainName}`,
+        await AliyunService.deleteDomainRecords({
+          domainName,
+          rr: "www",
+          type: "CNAME",
+          value: domainName
+        })
+      );
+    }
+    await AliyunService.deleteCdnDomain(cdnDomain);
+    await AliyunService.deleteBucketAndContents(bucketName);
+  }
+  async deleteServerResources(service) {
+    const network = this.getNetworkConfig(service);
+    const subdomain = network.subdomain?.trim();
+    if (!subdomain) {
+      ui.warn(`No subdomain configured for ${service.id}; nothing to tear down on DNS/nginx.`);
+      return;
+    }
+    const server = network.server?.trim();
+    if (!server) {
+      throw new Error(`Missing network.server for ${service.id}`);
+    }
+    await this.removeRemoteConfig(server, `/etc/nginx/sites-enabled/${subdomain}.conf`);
+    ui.success(`Removed nginx config for ${subdomain} from ${server}`);
+    await this.reloadNginx(server);
+    ui.success(`Reloaded nginx on ${server}`);
+    const domainName = network.domain?.trim() || "pmate.chat";
+    const serverAddress = await resolveServerAddress(server);
+    this.logDeletedRecords(
+      `Removed A record for ${subdomain}.${domainName}`,
+      await AliyunService.deleteDomainRecords({
+        domainName,
+        rr: subdomain,
+        type: "A",
+        value: serverAddress
+      })
+    );
+  }
+  async deleteFcResources(service) {
+    const fc = this.getFcConfig(service);
+    const domainName = fc.domain?.trim();
+    if (!domainName) {
+      ui.warn(`No fc.domain configured for ${service.id}; nothing to tear down on DNS/FC custom domain.`);
+      return;
+    }
+    const region = fc.region?.trim();
+    if (!region) {
+      throw new Error(`Missing fc.region for ${service.id}`);
+    }
+    const subdomain = fc.subdomain?.trim();
+    const rr = subdomain || "@";
+    const host = subdomain ? `${subdomain}.${domainName}` : domainName;
+    await AliyunService.deleteFcCustomDomain(host, region);
+    const accountId = await AliyunService.getAccountId();
+    this.logDeletedRecords(
+      `Removed CNAME record for ${host}`,
+      await AliyunService.deleteDomainRecords({
+        domainName,
+        rr,
+        type: "CNAME",
+        value: `${accountId}.${region}.fc.aliyuncs.com`
+      })
+    );
+  }
+  getServiceType(service) {
+    return "runtimeType" in service ? service.runtimeType : service.type;
+  }
+  getStaticSiteConfig(service) {
+    if ("runtimeType" in service) {
+      return {
+        bucket: service.deploy?.bucket,
+        domain: service.deploy?.domain,
+        subdomain: service.deploy?.subdomain
+      };
+    }
+    return service.site ?? {};
+  }
+  getNetworkConfig(service) {
+    if ("runtimeType" in service) {
+      return {
+        server: service.deploy?.server,
+        domain: service.deploy?.domain,
+        subdomain: service.deploy?.subdomain
+      };
+    }
+    return service.network ?? {};
+  }
+  getFcConfig(service) {
+    if ("runtimeType" in service) {
+      return {
+        region: void 0,
+        domain: service.deploy?.domain,
+        subdomain: service.deploy?.subdomain
+      };
+    }
+    return service.fc ?? {};
+  }
+  logDeletedRecords(message, deletedCount) {
+    if (deletedCount > 0) {
+      ui.success(message, { deletedCount });
+      return;
+    }
+    ui.warn(`${message} skipped`, { deletedCount });
+  }
+  removeRemoteConfig(server, remotePath) {
+    return new Promise((resolve, reject) => {
+      const target = `pmate@${server}`;
+      const child = (0, import_node_child_process11.spawn)("ssh", [target, "sudo", "rm", "-f", remotePath], {
+        stdio: ["ignore", "inherit", "inherit"]
+      });
+      child.on("error", (error) => {
+        reject(error);
+      });
+      child.on("close", (code) => {
+        if (code === 0) {
+          resolve();
+          return;
+        }
+        reject(new Error(`ssh to ${server} exited with code ${code}`));
+      });
+    });
+  }
+  reloadNginx(server) {
+    return new Promise((resolve, reject) => {
+      const target = `pmate@${server}`;
+      const child = (0, import_node_child_process11.spawn)("ssh", [target, "sudo", "nginx", "-s", "reload"], {
+        stdio: ["ignore", "inherit", "inherit"]
+      });
+      child.on("error", (error) => {
+        reject(error);
+      });
+      child.on("close", (code) => {
+        if (code === 0) {
+          resolve();
+          return;
+        }
+        reject(new Error(`nginx reload on ${server} exited with code ${code}`));
+      });
+    });
+  }
   renderJson(value, asJson) {
     if (!asJson) {
       return;
@@ -20059,11 +20524,31 @@ var ServiceCommandHandler = class {
     ui.plain(JSON.stringify(value, null, 2));
   }
 };
+function requireString(value, field) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`Missing ${field}`);
+  }
+  return value.trim();
+}
+function splitPrimaryDomain(host) {
+  const normalized = host?.trim();
+  if (!normalized) {
+    return { domain: "pmate.chat" };
+  }
+  const parts = normalized.split(".").filter(Boolean);
+  if (parts.length <= 2) {
+    return { domain: normalized };
+  }
+  return {
+    subdomain: parts.slice(0, -2).join("."),
+    domain: parts.slice(-2).join(".")
+  };
+}
 
 // src/commands/VercelCommandHandler.ts
-var import_node_child_process11 = require("child_process");
+var import_node_child_process12 = require("child_process");
 var import_node_util2 = require("util");
-var execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process11.execFile);
+var execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process12.execFile);
 function parseDeploymentTimestamp(deployment) {
   const candidates = [deployment.createdAt, deployment.readyAt, deployment.ready];
   for (const value of candidates) {
@@ -22307,10 +22792,14 @@ init_namespacedRef();
 function parseServiceArgs(tokens) {
   const rest = [...tokens];
   const rawAction = rest.shift();
-  if (rawAction && looksLikeNamespacedRef(rawAction) && rest[0] === "env") {
+  if (rawAction && looksLikeNamespacedRef(rawAction) && rest[0] === "env-vars") {
     rest.shift();
     return parseServiceEnvArgs(rawAction, rest);
   }
+  if (rawAction && looksLikeNamespacedRef(rawAction) && rest[0] === "env") {
+    rest.shift();
+    return parseServiceEnvDefinitionArgs(rawAction, rest);
+  }
   const action = rawAction === "view" ? "view" : rawAction;
   if (!action) {
     throw new Error("Missing service action. Use: service list|get|view|create|update|rename|delete|deploy|stop|init|log");
@@ -22380,6 +22869,7 @@ function parseServiceArgs(tokens) {
     let history = false;
     let search;
     let follow = false;
+    let env;
     while (rest.length > 0) {
       const token = rest.shift();
       switch (token) {
@@ -22392,6 +22882,12 @@ function parseServiceArgs(tokens) {
           }
           cwd = requireValue6(rest, token);
           break;
+        case "--env":
+          if (action !== "deploy" && action !== "init" && action !== "stop") {
+            throw new Error(`Unknown service ${action} option: ${token}`);
+          }
+          env = requireValue6(rest, token);
+          break;
         case "--page":
           page = Number.parseInt(requireValue6(rest, token), 10);
           break;
@@ -22419,10 +22915,16 @@ function parseServiceArgs(tokens) {
       return { type: "service" /* Service */, action, namespace, name, baseUrl, json, page, history, search, follow };
     }
     if (action === "deploy" || action === "stop") {
-      return { type: "service" /* Service */, action, namespace, name, baseUrl, json };
+      if (action === "deploy" && !env) {
+        throw new Error("Missing required option --env for service deploy");
+      }
+      return { type: "service" /* Service */, action, namespace, name, env, baseUrl, json };
     }
     if (action === "init") {
-      return { type: "service" /* Service */, action, namespace, name, cwd, baseUrl, json };
+      if (!env) {
+        throw new Error("Missing required option --env for service init");
+      }
+      return { type: "service" /* Service */, action, namespace, name, env, cwd, baseUrl, json };
     }
     return { type: "service" /* Service */, action, namespace, name, baseUrl, json };
   }
@@ -22590,11 +23092,111 @@ function parseBareRenameId3(value, entityName) {
 function looksLikeNamespacedRef(value) {
   return value.includes(":") && !value.startsWith("-");
 }
+function parseServiceEnvDefinitionArgs(appId, tokens) {
+  const rest = [...tokens];
+  const action = rest.shift();
+  if (!action) {
+    throw new Error("Usage: service <ns:service> env list|get|add|expose");
+  }
+  let baseUrl;
+  let json = false;
+  if (action === "list") {
+    while (rest.length > 0) {
+      const token = rest.shift();
+      switch (token) {
+        case "--base-url":
+          baseUrl = requireValue6(rest, token);
+          break;
+        case "--json":
+          json = true;
+          break;
+        default:
+          throw new Error(`Unknown service env list option: ${token}`);
+      }
+    }
+    return { type: "service" /* Service */, action: "service-env-list", appId, baseUrl, json };
+  }
+  if (action === "get" || action === "add") {
+    const envName = rest.shift();
+    if (!envName || envName.startsWith("-")) {
+      throw new Error(`Usage: service <ns:service> env ${action} <env> [--base-url <url>] [--json]`);
+    }
+    while (rest.length > 0) {
+      const token = rest.shift();
+      switch (token) {
+        case "--base-url":
+          baseUrl = requireValue6(rest, token);
+          break;
+        case "--json":
+          json = true;
+          break;
+        default:
+          throw new Error(`Unknown service env ${action} option: ${token}`);
+      }
+    }
+    return {
+      type: "service" /* Service */,
+      action: action === "get" ? "service-env-get" : "service-env-add",
+      appId,
+      envName,
+      baseUrl,
+      json
+    };
+  }
+  if (action === "expose") {
+    const envName = rest.shift();
+    if (!envName || envName.startsWith("-")) {
+      throw new Error("Usage: service <ns:service> env expose <env> [--type https|websocket] [--domain <domain>] [--off]");
+    }
+    let exposeType;
+    let domain;
+    let off = false;
+    while (rest.length > 0) {
+      const token = rest.shift();
+      switch (token) {
+        case "--type": {
+          const value = requireValue6(rest, token);
+          if (value !== "https" && value !== "websocket") {
+            throw new Error("--type must be https or websocket");
+          }
+          exposeType = value;
+          break;
+        }
+        case "--domain":
+          domain = requireValue6(rest, token);
+          break;
+        case "--off":
+          off = true;
+          break;
+        case "--base-url":
+          baseUrl = requireValue6(rest, token);
+          break;
+        case "--json":
+          json = true;
+          break;
+        default:
+          throw new Error(`Unknown service env expose option: ${token}`);
+      }
+    }
+    return {
+      type: "service" /* Service */,
+      action: "service-env-expose",
+      appId,
+      envName,
+      exposeType,
+      domain,
+      off,
+      baseUrl,
+      json
+    };
+  }
+  throw new Error(`Unknown service env action: ${action}`);
+}
 function parseServiceEnvArgs(appId, tokens) {
   const rest = [...tokens];
   const action = rest.shift();
   if (!action) {
-    throw new Error("Usage: service <ns:app> env list|get|set|unset|resolve|pull|copy-from");
+    throw new Error("Usage: service <ns:app> env list|get|set|unset|resolve|pull|copy-from|update-scope");
   }
   let baseUrl;
   let json = false;
@@ -22606,6 +23208,7 @@ function parseServiceEnvArgs(appId, tokens) {
       const token = rest.shift();
       switch (token) {
         case "--scope":
+        case "--env":
           scope = requireValue6(rest, token);
           break;
         case "--include-secret-meta":
@@ -22637,6 +23240,7 @@ function parseServiceEnvArgs(appId, tokens) {
       const token = rest.shift();
       switch (token) {
         case "--scope":
+        case "--env":
           scope = requireValue6(rest, token);
           break;
         case "--include-secret-value":
@@ -22652,9 +23256,7 @@ function parseServiceEnvArgs(appId, tokens) {
           throw new Error(`Unknown service env get option: ${token}`);
       }
     }
-    if (!scope) {
-      throw new Error("Usage: service <ns:app> env get <key> --scope <scope> [--include-secret-value]");
-    }
+    scope = scope ?? "all";
     return { type: "service" /* Service */, action: "env-get", appId, key, scope, includeSecretValue, baseUrl, json };
   }
   if (action === "set") {
@@ -22673,6 +23275,7 @@ function parseServiceEnvArgs(appId, tokens) {
       const token = rest.shift();
       switch (token) {
         case "--scope":
+        case "--env":
           scope = requireValue6(rest, token);
           break;
         case "--secret":
@@ -22691,9 +23294,7 @@ function parseServiceEnvArgs(appId, tokens) {
           throw new Error(`Unknown service env set option: ${token}`);
       }
     }
-    if (!scope) {
-      throw new Error("Usage: service <ns:app> env set <key> [value] --scope <scope> [--secret] [--prompt]");
-    }
+    scope = scope ?? "all";
     if (!value && !secret && !prompt) {
       throw new Error("Missing env value. Pass a value or use --prompt.");
     }
@@ -22709,6 +23310,7 @@ function parseServiceEnvArgs(appId, tokens) {
       const token = rest.shift();
       switch (token) {
         case "--scope":
+        case "--env":
           scope = requireValue6(rest, token);
           break;
         case "--base-url":
@@ -22721,9 +23323,7 @@ function parseServiceEnvArgs(appId, tokens) {
           throw new Error(`Unknown service env unset option: ${token}`);
       }
     }
-    if (!scope) {
-      throw new Error("Usage: service <ns:app> env unset <key> --scope <scope>");
-    }
+    scope = scope ?? "all";
     return { type: "service" /* Service */, action: "env-unset", appId, key, scope, baseUrl, json };
   }
   if (action === "resolve") {
@@ -22824,6 +23424,53 @@ function parseServiceEnvArgs(appId, tokens) {
     }
     return { type: "service" /* Service */, action: "env-copy-from", targetAppId: appId, sourceAppId, scope, includeSecret, overwrite, onlyKeys, baseUrl, json };
   }
+  if (action === "update-scope") {
+    let fromScope;
+    let toScope;
+    let overwrite = false;
+    let onlyKeys;
+    while (rest.length > 0) {
+      const token = rest.shift();
+      switch (token) {
+        case "--from":
+        case "--from-scope":
+          fromScope = requireValue6(rest, token);
+          break;
+        case "--to":
+        case "--to-scope":
+          toScope = requireValue6(rest, token);
+          break;
+        case "--overwrite":
+          overwrite = true;
+          break;
+        case "--only":
+          onlyKeys = requireValue6(rest, token).split(",").map((item) => item.trim()).filter(Boolean);
+          break;
+        case "--base-url":
+          baseUrl = requireValue6(rest, token);
+          break;
+        case "--json":
+          json = true;
+          break;
+        default:
+          throw new Error(`Unknown service env update-scope option: ${token}`);
+      }
+    }
+    if (!fromScope || !toScope) {
+      throw new Error("Usage: service <ns:app> env update-scope --from <scope> --to <scope> [--overwrite] [--only <key,key>] [--base-url <url>] [--json]");
+    }
+    return {
+      type: "service" /* Service */,
+      action: "env-update-scope",
+      appId,
+      fromScope,
+      toScope,
+      overwrite,
+      onlyKeys,
+      baseUrl,
+      json
+    };
+  }
   throw new Error(`Unknown service env action: ${action}`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmate/cli",
-  "version": "0.24.25",
+  "version": "0.24.27",
   "description": "CLI utilities for the pMate project",
   "license": "MIT",
   "bin": {