@studiometa/forge-cli 0.0.1 → 0.2.0

package/dist/cli.js

@@ -0,0 +1,3567 @@
+#!/usr/bin/env node
+import { a as createContext, c as colors, d as deleteToken, i as runCommand, l as setColorEnabled, m as setToken, n as exitWithValidationError, p as getToken, s as OutputFormatter, u as createConfigStore, v as ValidationError } from "./error-handler-BahHMt6t.js";
+import { activateCertificate, createAuditLogger, createBackupConfig, createCommand, createDatabaseUser, createMonitor, createNginxTemplate, createRedirectRule, createScheduledJob, createSecurityRule, deleteBackupConfig, deleteDatabaseUser, deleteMonitor, deleteNginxTemplate, deleteRedirectRule, deleteScheduledJob, deleteSecurityRule, deploySiteAndWait, getBackupConfig, getCertificate, getCommand, getDaemon, getDatabase, getDatabaseUser, getEnv, getFirewallRule, getMonitor, getNginxConfig, getNginxTemplate, getRecipe, getRedirectRule, getScheduledJob, getSecurityRule, getServer, getSite, getSshKey, getUser, listBackupConfigs, listCertificates, listCommands, listDaemons, listDatabaseUsers, listDatabases, listDeployments, listFirewallRules, listMonitors, listNginxTemplates, listRecipes, listRedirectRules, listScheduledJobs, listSecurityRules, listServers, listSites, listSshKeys, rebootServer, restartDaemon, runRecipe, updateEnv, updateNginxConfig, updateNginxTemplate } from "@studiometa/forge-core";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+* Shared audit logger for CLI write operations.
+* Lazily initialized on first use.
+*/
+var _auditLogger = null;
+function getCliAuditLogger() {
+	if (!_auditLogger) _auditLogger = createAuditLogger("cli");
+	return _auditLogger;
+}
+/**
+* Creates a command router function that dispatches to the appropriate handler.
+*/
+function createCommandRouter(config) {
+	return async function(subcommand, args, options) {
+		const formatter = new OutputFormatter(options.format ?? options.f ?? "human", options["no-color"] === true);
+		const ctx = createContext(options);
+		const handler = config.handlers[subcommand];
+		if (!handler) {
+			formatter.error(`Unknown ${config.resource} subcommand: ${subcommand}`);
+			process.exit(1);
+			return;
+		}
+		if (config.writeSubcommands?.includes(subcommand) ?? false) {
+			const { token: _token, ...safeOptions } = options;
+			try {
+				if (Array.isArray(handler)) await handler[0](args, ctx);
+				else await handler(ctx);
+				getCliAuditLogger().log({
+					source: "cli",
+					resource: config.resource,
+					action: subcommand,
+					args: safeOptions,
+					status: "success"
+				});
+			} catch (err) {
+				const errorMessage = err instanceof Error ? err.message : String(err);
+				getCliAuditLogger().log({
+					source: "cli",
+					resource: config.resource,
+					action: subcommand,
+					args: safeOptions,
+					status: "error",
+					error: errorMessage
+				});
+				throw err;
+			}
+		} else if (Array.isArray(handler)) await handler[0](args, ctx);
+		else await handler(ctx);
+	};
+}
+/**
+* Smart resolution utilities for --server and --site options.
+*
+* Accepts numeric IDs (used as-is) or plain strings (resolved by name/partial match).
+*/
+/**
+* Resolve a --server value to a numeric server ID string.
+*
+* - Numeric string → returned as-is (no API call)
+* - Plain string → fetch all servers, exact match first, then partial match
+*   - 0 matches → ValidationError listing available servers
+*   - 2+ matches → ValidationError listing ambiguous matches
+*/
+async function resolveServerId(value, execCtx) {
+	if (/^\d+$/.test(value)) return value;
+	const servers = (await listServers({}, execCtx)).data;
+	const lower = value.toLowerCase();
+	const exact = servers.filter((s) => s.name.toLowerCase() === lower);
+	if (exact.length === 1) return String(exact[0].id);
+	const partial = servers.filter((s) => s.name.toLowerCase().includes(lower));
+	if (partial.length === 0) {
+		const available = servers.map((s) => `  ${s.name} (${s.id})`).join("\n");
+		throw new ValidationError(`No server found matching "${value}"`, "server", [`Available servers:\n${available}`]);
+	}
+	if (partial.length > 1) {
+		const matches = partial.map((s) => `  ${s.name} (${s.id})`).join("\n");
+		throw new ValidationError(`Ambiguous server name "${value}" — ${partial.length} matches found`, "server", [`Matching servers:\n${matches}`, "Use a more specific name or pass the numeric ID"]);
+	}
+	return String(partial[0].id);
+}
+/**
+* Resolve a --site value to a numeric site ID string.
+*
+* - Numeric string → returned as-is (no API call)
+* - Plain string → fetch all sites for the server, exact domain match first, then partial
+*   - 0 matches → ValidationError listing available sites
+*   - 2+ matches → ValidationError listing ambiguous matches
+*/
+async function resolveSiteId(value, serverId, execCtx) {
+	if (/^\d+$/.test(value)) return value;
+	const sites = (await listSites({ server_id: serverId }, execCtx)).data;
+	const lower = value.toLowerCase();
+	const exact = sites.filter((s) => s.name.toLowerCase() === lower);
+	if (exact.length === 1) return String(exact[0].id);
+	const partial = sites.filter((s) => s.name.toLowerCase().includes(lower));
+	if (partial.length === 0) {
+		const available = sites.map((s) => `  ${s.name} (${s.id})`).join("\n");
+		throw new ValidationError(`No site found matching "${value}" on server ${serverId}`, "site", [`Available sites:\n${available}`]);
+	}
+	if (partial.length > 1) {
+		const matches = partial.map((s) => `  ${s.name} (${s.id})`).join("\n");
+		throw new ValidationError(`Ambiguous site name "${value}" — ${partial.length} matches found`, "site", [`Matching sites:\n${matches}`, "Use a more specific name or pass the numeric ID"]);
+	}
+	return String(partial[0].id);
+}
+async function backupsList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli backups list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listBackupConfigs({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"provider_name",
+			"frequency",
+			"status"
+		], "No backup configurations found.", (b) => `${String(b.id).padEnd(8)} ${b.provider_name.padEnd(20)} ${b.frequency.padEnd(12)} ${b.status}`);
+	}, ctx.formatter);
+}
+async function backupsGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("backup_id", "forge-cli backups get <backup_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli backups get <backup_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getBackupConfig({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"provider",
+			"provider_name",
+			"frequency",
+			"retention",
+			"status",
+			"last_backup_time"
+		]);
+	}, ctx.formatter);
+}
+async function backupsCreate(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const provider = String(ctx.options.provider ?? "");
+	const frequency = String(ctx.options.frequency ?? "");
+	const databasesRaw = ctx.options.databases;
+	const databases = Array.isArray(databasesRaw) ? databasesRaw.map(Number) : databasesRaw ? [Number(databasesRaw)] : [];
+	if (!server) exitWithValidationError("server_id", "forge-cli backups create --server <server_id> --provider <provider> --frequency <frequency>", ctx.formatter);
+	if (!provider) exitWithValidationError("provider", "forge-cli backups create --server <server_id> --provider <provider> --frequency <frequency>", ctx.formatter);
+	if (!frequency) exitWithValidationError("frequency", "forge-cli backups create --server <server_id> --provider <provider> --frequency <frequency>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await createBackupConfig({
+			server_id: await resolveServerId(server, execCtx),
+			provider,
+			frequency,
+			credentials: {},
+			databases
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"provider",
+			"provider_name",
+			"frequency",
+			"retention",
+			"status"
+		]);
+	}, ctx.formatter);
+}
+async function backupsDelete(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("backup_id", "forge-cli backups delete <backup_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli backups delete <backup_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		await deleteBackupConfig({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Backup configuration ${id} deleted.`);
+	}, ctx.formatter);
+}
+const handleBackupsCommand = createCommandRouter({
+	resource: "backups",
+	handlers: {
+		list: backupsList,
+		ls: backupsList,
+		get: [backupsGet, "args"],
+		create: backupsCreate,
+		delete: [backupsDelete, "args"]
+	},
+	writeSubcommands: ["create", "delete"]
+});
+function showBackupsHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli backups list")} - List backup configurations on a server
+
+${colors.bold("USAGE:")}
+  forge-cli backups list --server <server_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli backups get")} - Get backup configuration details
+
+${colors.bold("USAGE:")}
+  forge-cli backups get <backup_id> --server <server_id> [options]
+`);
+	else if (subcommand === "create") console.log(`
+${colors.bold("forge-cli backups create")} - Create a new backup configuration
+
+${colors.bold("USAGE:")}
+  forge-cli backups create --server <server_id> --provider <provider> --frequency <frequency> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --provider <name>     Backup provider (required)
+  --frequency <freq>    Backup frequency (required)
+  --databases <ids>     Comma-separated database IDs to back up (optional)
+  -f, --format <fmt>    Output format: json, human, table
+`);
+	else if (subcommand === "delete") console.log(`
+${colors.bold("forge-cli backups delete")} - Delete a backup configuration
+
+${colors.bold("USAGE:")}
+  forge-cli backups delete <backup_id> --server <server_id> [options]
+`);
+	else console.log(`
+${colors.bold("forge-cli backups")} - Manage backup configurations
+
+${colors.bold("USAGE:")}
+  forge-cli backups <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List backup configurations
+  get <id>            Get backup configuration details
+  create              Create a new backup configuration
+  delete <id>         Delete a backup configuration
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli backups <subcommand> --help")} for details.
+`);
+}
+/**
+* Shell completion installation command
+*/
+var BASH_COMPLETION = `#!/usr/bin/env bash
+
+_forge_cli_completions() {
+  local cur prev commands subcommands options
+
+  COMPREPLY=()
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  prev="\${COMP_WORDS[COMP_CWORD-1]}"
+
+  # Main commands
+  commands="config servers s sites deployments d databases db database-users daemons env nginx certificates certs firewall-rules fw ssh-keys backups commands scheduled-jobs user monitors nginx-templates security-rules redirect-rules recipes completion help"
+
+  # Subcommands for each command
+  local config_cmds="set get delete"
+  local servers_cmds="list ls get reboot"
+  local sites_cmds="list ls get"
+  local deployments_cmds="list ls deploy"
+  local databases_cmds="list ls get"
+  local database_users_cmds="list ls get create delete"
+  local daemons_cmds="list ls get restart"
+  local env_cmds="get update"
+  local nginx_cmds="get update"
+  local certificates_cmds="list ls get activate"
+  local firewall_rules_cmds="list ls get"
+  local ssh_keys_cmds="list ls get"
+  local backups_cmds="list ls get create delete"
+  local commands_cmds="list ls get create"
+  local scheduled_jobs_cmds="list ls get create delete"
+  local user_cmds="get"
+  local monitors_cmds="list ls get create delete"
+  local nginx_templates_cmds="list ls get create update delete"
+  local security_rules_cmds="list ls get create delete"
+  local redirect_rules_cmds="list ls get create delete"
+  local recipes_cmds="list ls get run"
+  local completion_cmds="bash zsh fish"
+
+  # Global options
+  options="--token --server --site -f --format --no-color -h --help -v --version --name --command --content --from --to --provider --frequency --type --operator --threshold --minutes --key --port --ip-address --user --script --servers --domain --password --credential-id --region --size --project-type --directory"
+
+  # Format options
+  local formats="json human table"
+
+  # Completion logic
+  case "\${COMP_CWORD}" in
+    1)
+      # Complete main commands
+      COMPREPLY=( $(compgen -W "\${commands}" -- "\${cur}") )
+      ;;
+    2)
+      # Complete subcommands based on main command
+      case "\${prev}" in
+        config)
+          COMPREPLY=( $(compgen -W "\${config_cmds}" -- "\${cur}") )
+          ;;
+        servers|s)
+          COMPREPLY=( $(compgen -W "\${servers_cmds}" -- "\${cur}") )
+          ;;
+        sites)
+          COMPREPLY=( $(compgen -W "\${sites_cmds}" -- "\${cur}") )
+          ;;
+        deployments|d)
+          COMPREPLY=( $(compgen -W "\${deployments_cmds}" -- "\${cur}") )
+          ;;
+        databases|db)
+          COMPREPLY=( $(compgen -W "\${databases_cmds}" -- "\${cur}") )
+          ;;
+        database-users)
+          COMPREPLY=( $(compgen -W "\${database_users_cmds}" -- "\${cur}") )
+          ;;
+        daemons)
+          COMPREPLY=( $(compgen -W "\${daemons_cmds}" -- "\${cur}") )
+          ;;
+        env)
+          COMPREPLY=( $(compgen -W "\${env_cmds}" -- "\${cur}") )
+          ;;
+        nginx)
+          COMPREPLY=( $(compgen -W "\${nginx_cmds}" -- "\${cur}") )
+          ;;
+        certificates|certs)
+          COMPREPLY=( $(compgen -W "\${certificates_cmds}" -- "\${cur}") )
+          ;;
+        firewall-rules|fw)
+          COMPREPLY=( $(compgen -W "\${firewall_rules_cmds}" -- "\${cur}") )
+          ;;
+        ssh-keys)
+          COMPREPLY=( $(compgen -W "\${ssh_keys_cmds}" -- "\${cur}") )
+          ;;
+        backups)
+          COMPREPLY=( $(compgen -W "\${backups_cmds}" -- "\${cur}") )
+          ;;
+        commands)
+          COMPREPLY=( $(compgen -W "\${commands_cmds}" -- "\${cur}") )
+          ;;
+        scheduled-jobs)
+          COMPREPLY=( $(compgen -W "\${scheduled_jobs_cmds}" -- "\${cur}") )
+          ;;
+        user)
+          COMPREPLY=( $(compgen -W "\${user_cmds}" -- "\${cur}") )
+          ;;
+        monitors)
+          COMPREPLY=( $(compgen -W "\${monitors_cmds}" -- "\${cur}") )
+          ;;
+        nginx-templates)
+          COMPREPLY=( $(compgen -W "\${nginx_templates_cmds}" -- "\${cur}") )
+          ;;
+        security-rules)
+          COMPREPLY=( $(compgen -W "\${security_rules_cmds}" -- "\${cur}") )
+          ;;
+        redirect-rules)
+          COMPREPLY=( $(compgen -W "\${redirect_rules_cmds}" -- "\${cur}") )
+          ;;
+        recipes)
+          COMPREPLY=( $(compgen -W "\${recipes_cmds}" -- "\${cur}") )
+          ;;
+        completion)
+          COMPREPLY=( $(compgen -W "\${completion_cmds}" -- "\${cur}") )
+          ;;
+        *)
+          COMPREPLY=( $(compgen -W "\${options}" -- "\${cur}") )
+          ;;
+      esac
+      ;;
+    *)
+      # Complete options and their values
+      case "\${prev}" in
+        --format|-f)
+          COMPREPLY=( $(compgen -W "\${formats}" -- "\${cur}") )
+          ;;
+        --token|--server|--site|--name|--command|--content|--from|--to|--provider|--frequency|--type|--operator|--threshold|--minutes|--key|--port|--ip-address|--user|--script|--servers|--domain|--password|--credential-id|--region|--size|--project-type|--directory)
+          # No completion for values requiring arguments
+          COMPREPLY=()
+          ;;
+        *)
+          COMPREPLY=( $(compgen -W "\${options}" -- "\${cur}") )
+          ;;
+      esac
+      ;;
+  esac
+
+  return 0
+}
+
+complete -F _forge_cli_completions forge-cli
+`;
+var ZSH_COMPLETION = `#compdef forge-cli
+
+_forge_cli() {
+  local line state
+
+  _arguments -C \\
+    '1: :->command' \\
+    '2: :->subcommand' \\
+    '*: :->args'
+
+  case $state in
+    command)
+      local -a commands
+      commands=(
+        'config:Manage CLI configuration'
+        'servers:Manage servers'
+        's:Manage servers (alias)'
+        'sites:Manage sites'
+        'deployments:Manage deployments'
+        'd:Manage deployments (alias)'
+        'databases:Manage databases'
+        'db:Manage databases (alias)'
+        'database-users:Manage database users'
+        'daemons:Manage daemons'
+        'env:Manage environment variables'
+        'nginx:Manage nginx configuration'
+        'certificates:Manage SSL certificates'
+        'certs:Manage SSL certificates (alias)'
+        'firewall-rules:Manage firewall rules'
+        'fw:Manage firewall rules (alias)'
+        'ssh-keys:Manage SSH keys'
+        'backups:Manage backup configurations'
+        'commands:Manage site commands'
+        'scheduled-jobs:Manage scheduled jobs'
+        'user:Display authenticated user profile'
+        'monitors:Manage server monitors'
+        'nginx-templates:Manage Nginx templates'
+        'security-rules:Manage site security rules'
+        'redirect-rules:Manage site redirect rules'
+        'recipes:Manage recipes'
+        'completion:Generate shell completion script'
+        'help:Show help'
+      )
+      _describe 'command' commands
+      ;;
+    subcommand)
+      case $line[1] in
+        config)
+          local -a config_cmds
+          config_cmds=(
+            'set:Save API token'
+            'get:Show current token'
+            'delete:Delete stored token'
+          )
+          _describe 'config command' config_cmds
+          ;;
+        servers|s)
+          local -a servers_cmds
+          servers_cmds=(
+            'list:List all servers'
+            'ls:List all servers (alias)'
+            'get:Get server details'
+            'reboot:Reboot a server'
+          )
+          _describe 'servers command' servers_cmds
+          ;;
+        sites)
+          local -a sites_cmds
+          sites_cmds=(
+            'list:List sites'
+            'ls:List sites (alias)'
+            'get:Get site details'
+          )
+          _describe 'sites command' sites_cmds
+          ;;
+        deployments|d)
+          local -a deployments_cmds
+          deployments_cmds=(
+            'list:List deployments'
+            'ls:List deployments (alias)'
+            'deploy:Trigger a deployment'
+          )
+          _describe 'deployments command' deployments_cmds
+          ;;
+        databases|db)
+          local -a databases_cmds
+          databases_cmds=(
+            'list:List databases'
+            'ls:List databases (alias)'
+            'get:Get database details'
+          )
+          _describe 'databases command' databases_cmds
+          ;;
+        database-users)
+          local -a database_users_cmds
+          database_users_cmds=(
+            'list:List database users'
+            'ls:List database users (alias)'
+            'get:Get database user details'
+            'create:Create a database user'
+            'delete:Delete a database user'
+          )
+          _describe 'database-users command' database_users_cmds
+          ;;
+        daemons)
+          local -a daemons_cmds
+          daemons_cmds=(
+            'list:List daemons'
+            'ls:List daemons (alias)'
+            'get:Get daemon details'
+            'restart:Restart a daemon'
+          )
+          _describe 'daemons command' daemons_cmds
+          ;;
+        env)
+          local -a env_cmds
+          env_cmds=(
+            'get:Get env variables'
+            'update:Update env variables'
+          )
+          _describe 'env command' env_cmds
+          ;;
+        nginx)
+          local -a nginx_cmds
+          nginx_cmds=(
+            'get:Get nginx config'
+            'update:Update nginx config'
+          )
+          _describe 'nginx command' nginx_cmds
+          ;;
+        certificates|certs)
+          local -a certificates_cmds
+          certificates_cmds=(
+            'list:List certificates'
+            'ls:List certificates (alias)'
+            'get:Get certificate details'
+            'activate:Activate a certificate'
+          )
+          _describe 'certificates command' certificates_cmds
+          ;;
+        firewall-rules|fw)
+          local -a firewall_rules_cmds
+          firewall_rules_cmds=(
+            'list:List firewall rules'
+            'ls:List firewall rules (alias)'
+            'get:Get firewall rule details'
+          )
+          _describe 'firewall-rules command' firewall_rules_cmds
+          ;;
+        ssh-keys)
+          local -a ssh_keys_cmds
+          ssh_keys_cmds=(
+            'list:List SSH keys'
+            'ls:List SSH keys (alias)'
+            'get:Get SSH key details'
+          )
+          _describe 'ssh-keys command' ssh_keys_cmds
+          ;;
+        backups)
+          local -a backups_cmds
+          backups_cmds=(
+            'list:List backup configurations'
+            'ls:List backup configurations (alias)'
+            'get:Get backup configuration details'
+            'create:Create a backup configuration'
+            'delete:Delete a backup configuration'
+          )
+          _describe 'backups command' backups_cmds
+          ;;
+        commands)
+          local -a commands_cmds
+          commands_cmds=(
+            'list:List commands'
+            'ls:List commands (alias)'
+            'get:Get command details'
+            'create:Execute a command'
+          )
+          _describe 'commands command' commands_cmds
+          ;;
+        scheduled-jobs)
+          local -a scheduled_jobs_cmds
+          scheduled_jobs_cmds=(
+            'list:List scheduled jobs'
+            'ls:List scheduled jobs (alias)'
+            'get:Get scheduled job details'
+            'create:Create a scheduled job'
+            'delete:Delete a scheduled job'
+          )
+          _describe 'scheduled-jobs command' scheduled_jobs_cmds
+          ;;
+        user)
+          local -a user_cmds
+          user_cmds=(
+            'get:Get the authenticated user profile'
+          )
+          _describe 'user command' user_cmds
+          ;;
+        monitors)
+          local -a monitors_cmds
+          monitors_cmds=(
+            'list:List monitors'
+            'ls:List monitors (alias)'
+            'get:Get monitor details'
+            'create:Create a monitor'
+            'delete:Delete a monitor'
+          )
+          _describe 'monitors command' monitors_cmds
+          ;;
+        nginx-templates)
+          local -a nginx_templates_cmds
+          nginx_templates_cmds=(
+            'list:List Nginx templates'
+            'ls:List Nginx templates (alias)'
+            'get:Get Nginx template details'
+            'create:Create a Nginx template'
+            'update:Update a Nginx template'
+            'delete:Delete a Nginx template'
+          )
+          _describe 'nginx-templates command' nginx_templates_cmds
+          ;;
+        security-rules)
+          local -a security_rules_cmds
+          security_rules_cmds=(
+            'list:List security rules'
+            'ls:List security rules (alias)'
+            'get:Get security rule details'
+            'create:Create a security rule'
+            'delete:Delete a security rule'
+          )
+          _describe 'security-rules command' security_rules_cmds
+          ;;
+        redirect-rules)
+          local -a redirect_rules_cmds
+          redirect_rules_cmds=(
+            'list:List redirect rules'
+            'ls:List redirect rules (alias)'
+            'get:Get redirect rule details'
+            'create:Create a redirect rule'
+            'delete:Delete a redirect rule'
+          )
+          _describe 'redirect-rules command' redirect_rules_cmds
+          ;;
+        recipes)
+          local -a recipes_cmds
+          recipes_cmds=(
+            'list:List all recipes'
+            'ls:List all recipes (alias)'
+            'get:Get recipe details'
+            'run:Run a recipe'
+          )
+          _describe 'recipes command' recipes_cmds
+          ;;
+        completion)
+          local -a completion_cmds
+          completion_cmds=(
+            'bash:Generate Bash completion script'
+            'zsh:Generate Zsh completion script'
+            'fish:Generate Fish completion script'
+          )
+          _describe 'completion shell' completion_cmds
+          ;;
+      esac
+      ;;
+    args)
+      _arguments \\
+        '--token[API token]:token:' \\
+        '--server[Server ID]:server id:' \\
+        '--site[Site ID]:site id:' \\
+        '(-f --format)'{-f,--format}'[Output format]:format:(json human table)' \\
+        '--no-color[Disable colored output]' \\
+        '(-h --help)'{-h,--help}'[Show help]' \\
+        '(-v --version)'{-v,--version}'[Show version]' \\
+        '--name[Name]:name:' \\
+        '--command[Command]:command:' \\
+        '--content[Content]:content:' \\
+        '--from[From]:from:' \\
+        '--to[To]:to:' \\
+        '--provider[Provider]:provider:' \\
+        '--frequency[Frequency]:frequency:' \\
+        '--type[Type]:type:' \\
+        '--operator[Operator]:operator:' \\
+        '--threshold[Threshold]:threshold:' \\
+        '--minutes[Minutes]:minutes:' \\
+        '--key[Key]:key:' \\
+        '--port[Port]:port:' \\
+        '--ip-address[IP address]:ip address:' \\
+        '--user[User]:user:' \\
+        '--script[Script]:script:' \\
+        '--servers[Servers]:servers:' \\
+        '--domain[Domain]:domain:' \\
+        '--password[Password]:password:' \\
+        '--credential-id[Credential ID]:credential id:' \\
+        '--region[Region]:region:' \\
+        '--size[Size]:size:' \\
+        '--project-type[Project type]:project type:' \\
+        '--directory[Directory]:directory:'
+      ;;
+  esac
+}
+
+_forge_cli "$@"
+`;
+var FISH_COMPLETION = `# Completions for forge-cli
+
+# Main commands
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "config" -d "Manage CLI configuration"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "servers" -d "Manage servers"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "s" -d "Manage servers (alias)"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "sites" -d "Manage sites"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "deployments" -d "Manage deployments"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "d" -d "Manage deployments (alias)"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "databases" -d "Manage databases"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "db" -d "Manage databases (alias)"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "database-users" -d "Manage database users"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "daemons" -d "Manage daemons"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "env" -d "Manage environment variables"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "nginx" -d "Manage nginx configuration"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "certificates" -d "Manage SSL certificates"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "certs" -d "Manage SSL certificates (alias)"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "firewall-rules" -d "Manage firewall rules"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "fw" -d "Manage firewall rules (alias)"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "ssh-keys" -d "Manage SSH keys"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "backups" -d "Manage backup configurations"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "commands" -d "Manage site commands"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "scheduled-jobs" -d "Manage scheduled jobs"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "user" -d "Display authenticated user profile"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "monitors" -d "Manage server monitors"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "nginx-templates" -d "Manage Nginx templates"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "security-rules" -d "Manage site security rules"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "redirect-rules" -d "Manage site redirect rules"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "recipes" -d "Manage recipes"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "completion" -d "Generate shell completion script"
+complete -c forge-cli -f -n "__fish_use_subcommand" -a "help" -d "Show help"
+
+# config subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from config" -a "set" -d "Save API token"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from config" -a "get" -d "Show current token"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from config" -a "delete" -d "Delete stored token"
+
+# servers subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from servers s" -a "list" -d "List all servers"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from servers s" -a "ls" -d "List all servers (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from servers s" -a "get" -d "Get server details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from servers s" -a "reboot" -d "Reboot a server"
+
+# sites subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from sites" -a "list" -d "List sites"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from sites" -a "ls" -d "List sites (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from sites" -a "get" -d "Get site details"
+
+# deployments subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from deployments d" -a "list" -d "List deployments"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from deployments d" -a "ls" -d "List deployments (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from deployments d" -a "deploy" -d "Trigger a deployment"
+
+# databases subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from databases db" -a "list" -d "List databases"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from databases db" -a "ls" -d "List databases (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from databases db" -a "get" -d "Get database details"
+
+# database-users subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from database-users" -a "list" -d "List database users"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from database-users" -a "ls" -d "List database users (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from database-users" -a "get" -d "Get database user details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from database-users" -a "create" -d "Create a database user"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from database-users" -a "delete" -d "Delete a database user"
+
+# daemons subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from daemons" -a "list" -d "List daemons"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from daemons" -a "ls" -d "List daemons (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from daemons" -a "get" -d "Get daemon details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from daemons" -a "restart" -d "Restart a daemon"
+
+# env subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from env" -a "get" -d "Get env variables"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from env" -a "update" -d "Update env variables"
+
+# nginx subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from nginx" -a "get" -d "Get nginx config"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from nginx" -a "update" -d "Update nginx config"
+
+# certificates subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from certificates certs" -a "list" -d "List certificates"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from certificates certs" -a "ls" -d "List certificates (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from certificates certs" -a "get" -d "Get certificate details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from certificates certs" -a "activate" -d "Activate a certificate"
+
+# firewall-rules subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from firewall-rules fw" -a "list" -d "List firewall rules"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from firewall-rules fw" -a "ls" -d "List firewall rules (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from firewall-rules fw" -a "get" -d "Get firewall rule details"
+
+# ssh-keys subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from ssh-keys" -a "list" -d "List SSH keys"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from ssh-keys" -a "ls" -d "List SSH keys (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from ssh-keys" -a "get" -d "Get SSH key details"
+
+# backups subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from backups" -a "list" -d "List backup configurations"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from backups" -a "ls" -d "List backup configurations (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from backups" -a "get" -d "Get backup configuration details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from backups" -a "create" -d "Create a backup configuration"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from backups" -a "delete" -d "Delete a backup configuration"
+
+# commands subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from commands" -a "list" -d "List commands"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from commands" -a "ls" -d "List commands (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from commands" -a "get" -d "Get command details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from commands" -a "create" -d "Execute a command"
+
+# scheduled-jobs subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from scheduled-jobs" -a "list" -d "List scheduled jobs"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from scheduled-jobs" -a "ls" -d "List scheduled jobs (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from scheduled-jobs" -a "get" -d "Get scheduled job details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from scheduled-jobs" -a "create" -d "Create a scheduled job"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from scheduled-jobs" -a "delete" -d "Delete a scheduled job"
+
+# user subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from user" -a "get" -d "Get the authenticated user profile"
+
+# monitors subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from monitors" -a "list" -d "List monitors"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from monitors" -a "ls" -d "List monitors (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from monitors" -a "get" -d "Get monitor details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from monitors" -a "create" -d "Create a monitor"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from monitors" -a "delete" -d "Delete a monitor"
+
+# nginx-templates subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from nginx-templates" -a "list" -d "List Nginx templates"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from nginx-templates" -a "ls" -d "List Nginx templates (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from nginx-templates" -a "get" -d "Get Nginx template details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from nginx-templates" -a "create" -d "Create a Nginx template"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from nginx-templates" -a "update" -d "Update a Nginx template"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from nginx-templates" -a "delete" -d "Delete a Nginx template"
+
+# security-rules subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from security-rules" -a "list" -d "List security rules"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from security-rules" -a "ls" -d "List security rules (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from security-rules" -a "get" -d "Get security rule details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from security-rules" -a "create" -d "Create a security rule"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from security-rules" -a "delete" -d "Delete a security rule"
+
+# redirect-rules subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from redirect-rules" -a "list" -d "List redirect rules"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from redirect-rules" -a "ls" -d "List redirect rules (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from redirect-rules" -a "get" -d "Get redirect rule details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from redirect-rules" -a "create" -d "Create a redirect rule"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from redirect-rules" -a "delete" -d "Delete a redirect rule"
+
+# recipes subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from recipes" -a "list" -d "List all recipes"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from recipes" -a "ls" -d "List all recipes (alias)"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from recipes" -a "get" -d "Get recipe details"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from recipes" -a "run" -d "Run a recipe"
+
+# completion subcommands
+complete -c forge-cli -f -n "__fish_seen_subcommand_from completion" -a "bash" -d "Install Bash completion"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from completion" -a "zsh" -d "Install Zsh completion"
+complete -c forge-cli -f -n "__fish_seen_subcommand_from completion" -a "fish" -d "Install Fish completion"
+
+# Global options
+complete -c forge-cli -l token -d "API token" -r
+complete -c forge-cli -l server -d "Server ID" -r
+complete -c forge-cli -l site -d "Site ID" -r
+complete -c forge-cli -s f -l format -d "Output format" -xa "json human table"
+complete -c forge-cli -l no-color -d "Disable colored output"
+complete -c forge-cli -s h -l help -d "Show help"
+complete -c forge-cli -s v -l version -d "Show version"
+complete -c forge-cli -l name -d "Name" -r
+complete -c forge-cli -l command -d "Command" -r
+complete -c forge-cli -l content -d "Content" -r
+complete -c forge-cli -l from -d "From" -r
+complete -c forge-cli -l to -d "To" -r
+complete -c forge-cli -l provider -d "Provider" -r
+complete -c forge-cli -l frequency -d "Frequency" -r
+complete -c forge-cli -l type -d "Type" -r
+complete -c forge-cli -l operator -d "Operator" -r
+complete -c forge-cli -l threshold -d "Threshold" -r
+complete -c forge-cli -l minutes -d "Minutes" -r
+complete -c forge-cli -l key -d "Key" -r
+complete -c forge-cli -l port -d "Port" -r
+complete -c forge-cli -l ip-address -d "IP address" -r
+complete -c forge-cli -l user -d "User" -r
+complete -c forge-cli -l script -d "Script" -r
+complete -c forge-cli -l servers -d "Servers" -r
+complete -c forge-cli -l domain -d "Domain" -r
+complete -c forge-cli -l password -d "Password" -r
+complete -c forge-cli -l credential-id -d "Credential ID" -r
+complete -c forge-cli -l region -d "Region" -r
+complete -c forge-cli -l size -d "Size" -r
+complete -c forge-cli -l project-type -d "Project type" -r
+complete -c forge-cli -l directory -d "Directory" -r
+`;
+/**
+* Get the appropriate completion file path for the shell
+*/
+function getCompletionPath(shell) {
+	const home = homedir();
+	switch (shell) {
+		case "bash": return join(home, ".local/share/bash-completion/completions/forge-cli");
+		case "zsh": return join(home, ".zfunc/_forge-cli");
+		case "fish": return join(process.env["XDG_CONFIG_HOME"] ?? join(home, ".config"), "fish/completions/forge-cli.fish");
+		default: throw new Error(`Unknown shell: ${shell}`);
+	}
+}
+function showCompletionHelp() {
+	console.log(`
+${colors.bold("forge-cli completion")} - Install shell completion
+
+${colors.bold("USAGE:")}
+  forge-cli completion <shell> [--print]
+
+${colors.bold("SHELLS:")}
+  bash                Install Bash completion
+  zsh                 Install Zsh completion
+  fish                Install Fish completion
+
+${colors.bold("OPTIONS:")}
+  --print             Print completion script instead of installing
+
+${colors.bold("INSTALLATION:")}
+  The completion script is automatically installed to the appropriate
+  standard directory for your shell. After installation, restart your
+  shell to activate completions.
+
+  ${colors.bold("Bash:")}
+    forge-cli completion bash
+    # Installs to: ~/.local/share/bash-completion/completions/forge-cli
+    # Then run: exec bash
+
+  ${colors.bold("Zsh:")}
+    forge-cli completion zsh
+    # Installs to: ~/.zfunc/_forge-cli
+    # Ensure fpath includes ~/.zfunc (add to ~/.zshrc before compinit):
+    #   fpath=(~/.zfunc $fpath)
+    # Then run: exec zsh
+
+  ${colors.bold("Fish:")}
+    forge-cli completion fish
+    # Installs to: ~/.config/fish/completions/forge-cli.fish
+    # Completions are loaded automatically
+
+${colors.bold("PRINT ONLY:")}
+  Use --print to output the script without installing:
+
+  forge-cli completion bash --print > my-completion.sh
+  forge-cli completion zsh --print | less
+`);
+}
+function handleCompletionCommand(shell, options = {}) {
+	const shouldPrint = options["print"] !== void 0;
+	const shellLower = shell.toLowerCase();
+	let script;
+	switch (shellLower) {
+		case "bash":
+			script = BASH_COMPLETION;
+			break;
+		case "zsh":
+			script = ZSH_COMPLETION;
+			break;
+		case "fish":
+			script = FISH_COMPLETION;
+			break;
+		default:
+			console.error(`${colors.red("✗")} Unknown shell: ${shell}. Supported shells: bash, zsh, fish`);
+			console.error(`Run ${colors.cyan("forge-cli completion --help")} for usage information.`);
+			process.exit(1);
+			return;
+	}
+	if (shouldPrint) {
+		process.stdout.write(script);
+		return;
+	}
+	const installPath = getCompletionPath(shellLower);
+	const dir = installPath.substring(0, installPath.lastIndexOf("/"));
+	try {
+		mkdirSync(dir, { recursive: true });
+		writeFileSync(installPath, script, "utf8");
+		console.log(`${colors.green("✓")} Installed ${shell} completion to ${colors.cyan(installPath)}`);
+		console.log();
+		console.log(`${colors.bold("Next steps:")}`);
+		switch (shellLower) {
+			case "bash":
+				console.log(`  1. Restart your shell: ${colors.cyan("exec bash")}`);
+				console.log(`  2. Or source the file: ${colors.cyan(`source ${installPath}`)}`);
+				break;
+			case "zsh":
+				console.log(`  1. Ensure ${colors.cyan("~/.zfunc")} is in your $fpath (add to ~/.zshrc before compinit):`);
+				console.log(`       ${colors.cyan("fpath=(~/.zfunc $fpath)")}`);
+				console.log(`  2. Restart your shell: ${colors.cyan("exec zsh")}`);
+				break;
+			case "fish":
+				console.log(`  Completions are loaded automatically. Restart fish if needed.`);
+				break;
+		}
+	} catch (error) {
+		console.error(`${colors.red("✗")} Failed to install completion: ${error instanceof Error ? error.message : String(error)}`);
+		process.exit(1);
+	}
+}
+function requireServerAndSiteRaw$3(ctx, usage) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	if (!site) exitWithValidationError("site_id", usage, ctx.formatter);
+	return {
+		server,
+		site
+	};
+}
+async function certificatesList(ctx) {
+	const { server, site } = requireServerAndSiteRaw$3(ctx, "forge-cli certificates list --server <server_id> --site <site_id>");
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await listCertificates({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx)
+		}, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"domain",
+			"type",
+			"status",
+			"active"
+		], "No certificates found.", (c) => `${String(c.id).padEnd(8)} ${c.domain.padEnd(40)} ${c.type.padEnd(10)} ${c.status.padEnd(12)} ${c.active ? "active" : "—"}`);
+	}, ctx.formatter);
+}
+async function certificatesGet(args, ctx) {
+	const [id] = args;
+	const usage = "forge-cli certificates get <cert_id> --server <server_id> --site <site_id>";
+	if (!id) exitWithValidationError("certificate_id", usage, ctx.formatter);
+	const { server, site } = requireServerAndSiteRaw$3(ctx, usage);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await getCertificate({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"domain",
+			"type",
+			"status",
+			"request_status",
+			"active",
+			"existing",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function certificatesActivate(args, ctx) {
+	const [id] = args;
+	const usage = "forge-cli certificates activate <cert_id> --server <server_id> --site <site_id>";
+	if (!id) exitWithValidationError("certificate_id", usage, ctx.formatter);
+	const { server, site } = requireServerAndSiteRaw$3(ctx, usage);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		await activateCertificate({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Certificate ${id} activated.`);
+	}, ctx.formatter);
+}
+const handleCertificatesCommand = createCommandRouter({
+	resource: "certificates",
+	handlers: {
+		list: certificatesList,
+		ls: certificatesList,
+		get: [certificatesGet, "args"],
+		activate: [certificatesActivate, "args"]
+	},
+	writeSubcommands: ["activate"]
+});
+function showCertificatesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli certificates list")} - List certificates for a site
+
+${colors.bold("USAGE:")}
+  forge-cli certificates list --server <server_id> --site <site_id> [options]
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli certificates get")} - Get certificate details
+
+${colors.bold("USAGE:")}
+  forge-cli certificates get <cert_id> --server <server_id> --site <site_id>
+`);
+	else if (subcommand === "activate") console.log(`
+${colors.bold("forge-cli certificates activate")} - Activate a certificate
+
+${colors.bold("USAGE:")}
+  forge-cli certificates activate <cert_id> --server <server_id> --site <site_id>
+`);
+	else console.log(`
+${colors.bold("forge-cli certificates")} - Manage SSL certificates
+
+${colors.bold("USAGE:")}
+  forge-cli certificates <subcommand> [options]
+
+${colors.bold("ALIASES:")}
+  forge-cli certs
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List certificates
+  get <id>            Get certificate details
+  activate <id>       Activate a certificate
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli certificates <subcommand> --help")} for details.
+`);
+}
+function requireServerAndSiteRaw$2(ctx, usage) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	if (!site) exitWithValidationError("site_id", usage, ctx.formatter);
+	return {
+		server,
+		site
+	};
+}
+async function commandsList(ctx) {
+	const { server, site } = requireServerAndSiteRaw$2(ctx, "forge-cli commands list --server <server_id> --site <site_id>");
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await listCommands({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx)
+		}, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"command",
+			"status",
+			"created_at"
+		], "No commands found.", (c) => `${String(c.id).padEnd(8)} ${c.command.padEnd(50)} ${c.status.padEnd(12)} ${c.created_at}`);
+	}, ctx.formatter);
+}
+async function commandsGet(args, ctx) {
+	const [id] = args;
+	const usage = "forge-cli commands get <command_id> --server <server_id> --site <site_id>";
+	if (!id) exitWithValidationError("command_id", usage, ctx.formatter);
+	const { server, site } = requireServerAndSiteRaw$2(ctx, usage);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await getCommand({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"command",
+			"status",
+			"user_name",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function commandsCreate(ctx) {
+	const usage = "forge-cli commands create --server <server_id> --site <site_id> --command <command>";
+	const { server, site } = requireServerAndSiteRaw$2(ctx, usage);
+	const command = String(ctx.options.command ?? "");
+	if (!command) exitWithValidationError("command", usage, ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await createCommand({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			command
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"command",
+			"status",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+const handleCommandsCommand = createCommandRouter({
+	resource: "commands",
+	handlers: {
+		list: commandsList,
+		ls: commandsList,
+		get: [commandsGet, "args"],
+		create: commandsCreate
+	},
+	writeSubcommands: ["create"]
+});
+function showCommandsHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli commands list")} - List commands executed on a site
+
+${colors.bold("USAGE:")}
+  forge-cli commands list --server <server_id> --site <site_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli commands get")} - Get command details
+
+${colors.bold("USAGE:")}
+  forge-cli commands get <command_id> --server <server_id> --site <site_id> [options]
+`);
+	else if (subcommand === "create") console.log(`
+${colors.bold("forge-cli commands create")} - Execute a command on a site
+
+${colors.bold("USAGE:")}
+  forge-cli commands create --server <server_id> --site <site_id> --command <command> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --site <id>           Site ID (required)
+  --command <cmd>       Command to execute (required)
+  -f, --format <fmt>    Output format: json, human, table
+`);
+	else console.log(`
+${colors.bold("forge-cli commands")} - Manage site commands
+
+${colors.bold("USAGE:")}
+  forge-cli commands <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List commands
+  get <id>            Get command details
+  create              Execute a command on a site
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli commands <subcommand> --help")} for details.
+`);
+}
+/**
+* Config command — manage forge-cli configuration
+*/
+function showConfigHelp() {
+	console.log(`
+${colors.bold("forge-cli config")} - Manage CLI configuration
+
+${colors.bold("USAGE:")}
+  forge-cli config <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  set <token>         Save API token to config file
+  get                 Show current API token (masked)
+  delete              Delete stored API token
+
+${colors.bold("EXAMPLES:")}
+  forge-cli config set YOUR_FORGE_TOKEN
+  forge-cli config get
+  forge-cli config delete
+`);
+}
+function handleConfigCommand(subcommand, args, options) {
+	const format = String(options.format ?? options.f ?? "human");
+	const formatter = new OutputFormatter(format, options["no-color"] === true);
+	const store = createConfigStore();
+	switch (subcommand) {
+		case "set": {
+			const [token] = args;
+			if (!token) {
+				formatter.error("Token is required. Usage: forge-cli config set <token>");
+				process.exit(1);
+				return;
+			}
+			setToken(token, store);
+			formatter.success("API token saved.");
+			break;
+		}
+		case "get": {
+			const token = getToken(store);
+			if (!token) {
+				formatter.warning("No API token configured.");
+				formatter.info("Run: forge-cli config set <token>");
+			} else {
+				const masked = token.length > 8 ? `${token.slice(0, 4)}${"*".repeat(token.length - 8)}${token.slice(-4)}` : "****";
+				if (format === "json") formatter.output({ apiToken: masked });
+				else console.log(`apiToken: ${masked}`);
+			}
+			break;
+		}
+		case "delete":
+			deleteToken(store);
+			formatter.success("API token deleted.");
+			break;
+		default:
+			showConfigHelp();
+			break;
+	}
+}
+async function daemonsList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli daemons list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listDaemons({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"command",
+			"user",
+			"status"
+		], "No daemons found.", (d) => `${String(d.id).padEnd(8)} ${d.command.padEnd(50)} ${d.user.padEnd(16)} ${d.status}`);
+	}, ctx.formatter);
+}
+async function daemonsGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("daemon_id", "forge-cli daemons get <daemon_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli daemons get <daemon_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getDaemon({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"command",
+			"user",
+			"directory",
+			"processes",
+			"status",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function daemonsRestart(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("daemon_id", "forge-cli daemons restart <daemon_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli daemons restart <daemon_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		await restartDaemon({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Daemon ${id} restarted.`);
+	}, ctx.formatter);
+}
+const handleDaemonsCommand = createCommandRouter({
+	resource: "daemons",
+	handlers: {
+		list: daemonsList,
+		ls: daemonsList,
+		get: [daemonsGet, "args"],
+		restart: [daemonsRestart, "args"]
+	},
+	writeSubcommands: ["restart"]
+});
+function showDaemonsHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli daemons list")} - List daemons on a server
+
+${colors.bold("USAGE:")}
+  forge-cli daemons list --server <server_id> [options]
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli daemons get")} - Get daemon details
+
+${colors.bold("USAGE:")}
+  forge-cli daemons get <daemon_id> --server <server_id>
+`);
+	else if (subcommand === "restart") console.log(`
+${colors.bold("forge-cli daemons restart")} - Restart a daemon
+
+${colors.bold("USAGE:")}
+  forge-cli daemons restart <daemon_id> --server <server_id>
+`);
+	else console.log(`
+${colors.bold("forge-cli daemons")} - Manage daemons
+
+${colors.bold("USAGE:")}
+  forge-cli daemons <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List daemons
+  get <id>            Get daemon details
+  restart <id>        Restart a daemon
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli daemons <subcommand> --help")} for details.
+`);
+}
+async function databasesList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli databases list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listDatabases({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"name",
+			"status"
+		], "No databases found.", (db) => `${String(db.id).padEnd(8)} ${db.name.padEnd(30)} ${db.status}`);
+	}, ctx.formatter);
+}
+async function databasesGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("database_id", "forge-cli databases get <database_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli databases get <database_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getDatabase({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"status",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+const handleDatabasesCommand = createCommandRouter({
+	resource: "databases",
+	handlers: {
+		list: databasesList,
+		ls: databasesList,
+		get: [databasesGet, "args"]
+	}
+});
+function showDatabasesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli databases list")} - List databases on a server
+
+${colors.bold("USAGE:")}
+  forge-cli databases list --server <server_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli databases get")} - Get database details
+
+${colors.bold("USAGE:")}
+  forge-cli databases get <database_id> --server <server_id> [options]
+`);
+	else console.log(`
+${colors.bold("forge-cli databases")} - Manage databases
+
+${colors.bold("USAGE:")}
+  forge-cli databases <subcommand> [options]
+
+${colors.bold("ALIASES:")}
+  forge-cli db
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List databases
+  get <id>            Get database details
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli databases <subcommand> --help")} for details.
+`);
+}
+async function databaseUsersList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli database-users list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listDatabaseUsers({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"name",
+			"status"
+		], "No database users found.", (u) => `${String(u.id).padEnd(8)} ${u.name.padEnd(30)} ${u.status}`);
+	}, ctx.formatter);
+}
+async function databaseUsersGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("user_id", "forge-cli database-users get <user_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli database-users get <user_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getDatabaseUser({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"status",
+			"databases",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function databaseUsersCreate(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const name = String(ctx.options.name ?? "");
+	const password = String(ctx.options.password ?? "");
+	const databasesRaw = ctx.options.databases;
+	const databases = Array.isArray(databasesRaw) ? databasesRaw.map(Number) : databasesRaw ? [Number(databasesRaw)] : void 0;
+	if (!server) exitWithValidationError("server_id", "forge-cli database-users create --server <server_id> --name <name> --password <password>", ctx.formatter);
+	if (!name) exitWithValidationError("name", "forge-cli database-users create --server <server_id> --name <name> --password <password>", ctx.formatter);
+	if (!password) exitWithValidationError("password", "forge-cli database-users create --server <server_id> --name <name> --password <password>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await createDatabaseUser({
+			server_id: await resolveServerId(server, execCtx),
+			name,
+			password,
+			...databases ? { databases } : {}
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"status",
+			"databases",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function databaseUsersDelete(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("user_id", "forge-cli database-users delete <user_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli database-users delete <user_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		await deleteDatabaseUser({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Database user ${id} deleted.`);
+	}, ctx.formatter);
+}
+const handleDatabaseUsersCommand = createCommandRouter({
+	resource: "database-users",
+	handlers: {
+		list: databaseUsersList,
+		ls: databaseUsersList,
+		get: [databaseUsersGet, "args"],
+		create: databaseUsersCreate,
+		delete: [databaseUsersDelete, "args"]
+	},
+	writeSubcommands: ["create", "delete"]
+});
+function showDatabaseUsersHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli database-users list")} - List database users on a server
+
+${colors.bold("USAGE:")}
+  forge-cli database-users list --server <server_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli database-users get")} - Get database user details
+
+${colors.bold("USAGE:")}
+  forge-cli database-users get <user_id> --server <server_id> [options]
+`);
+	else if (subcommand === "create") console.log(`
+${colors.bold("forge-cli database-users create")} - Create a new database user
+
+${colors.bold("USAGE:")}
+  forge-cli database-users create --server <server_id> --name <name> --password <password> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --name <name>       Database user name (required)
+  --password <pass>   User password (required)
+  --databases <ids>   Comma-separated database IDs to grant access to (optional)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "delete") console.log(`
+${colors.bold("forge-cli database-users delete")} - Delete a database user
+
+${colors.bold("USAGE:")}
+  forge-cli database-users delete <user_id> --server <server_id> [options]
+`);
+	else console.log(`
+${colors.bold("forge-cli database-users")} - Manage database users
+
+${colors.bold("USAGE:")}
+  forge-cli database-users <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List database users
+  get <id>            Get database user details
+  create              Create a new database user
+  delete <id>         Delete a database user
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli database-users <subcommand> --help")} for details.
+`);
+}
+async function deploymentsList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli deployments list --server <server_id> --site <site_id>", ctx.formatter);
+	if (!site) exitWithValidationError("site_id", "forge-cli deployments list --server <server_id> --site <site_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await listDeployments({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx)
+		}, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"status",
+			"commit_hash",
+			"started_at"
+		], "No deployments found.", (d) => `${String(d.id).padEnd(8)} ${d.status.padEnd(12)} ${(d.commit_hash ?? "—").padEnd(10)} ${d.started_at}`);
+	}, ctx.formatter);
+}
+async function deploymentsDeploy(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli deployments deploy --server <server_id> --site <site_id>", ctx.formatter);
+	if (!site) exitWithValidationError("site_id", "forge-cli deployments deploy --server <server_id> --site <site_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const site_id = await resolveSiteId(site, server_id, execCtx);
+		const result = await deploySiteAndWait({
+			server_id,
+			site_id,
+			onProgress: ({ status, elapsed_ms }) => {
+				process.stderr.write(`\rDeploying… ${status} (${(elapsed_ms / 1e3).toFixed(1)}s)`);
+			}
+		}, execCtx);
+		process.stderr.write("\n");
+		const elapsedSec = (result.data.elapsed_ms / 1e3).toFixed(1);
+		if (result.data.status === "success") ctx.formatter.success(`Deployment succeeded for site ${site_id} (${elapsedSec}s).`);
+		else ctx.formatter.success(`Deployment failed for site ${site_id} (${elapsedSec}s).`);
+		if (result.data.log) ctx.formatter.output(result.data.log);
+	}, ctx.formatter);
+}
+const handleDeploymentsCommand = createCommandRouter({
+	resource: "deployments",
+	handlers: {
+		list: deploymentsList,
+		ls: deploymentsList,
+		deploy: deploymentsDeploy
+	},
+	writeSubcommands: ["deploy"]
+});
+function showDeploymentsHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli deployments list")} - List deployments for a site
+
+${colors.bold("USAGE:")}
+  forge-cli deployments list --server <server_id> --site <site_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "deploy") console.log(`
+${colors.bold("forge-cli deployments deploy")} - Trigger a deployment
+
+${colors.bold("USAGE:")}
+  forge-cli deployments deploy --server <server_id> --site <site_id>
+`);
+	else console.log(`
+${colors.bold("forge-cli deployments")} - Manage deployments
+
+${colors.bold("USAGE:")}
+  forge-cli deployments <subcommand> [options]
+
+${colors.bold("ALIASES:")}
+  forge-cli d
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List deployments for a site
+  deploy              Trigger a deployment
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli deployments <subcommand> --help")} for details.
+`);
+}
+async function envGet(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli env get --server <server_id> --site <site_id>", ctx.formatter);
+	if (!site) exitWithValidationError("site_id", "forge-cli env get --server <server_id> --site <site_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await getEnv({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx)
+		}, execCtx);
+		if (ctx.formatter.isJson()) console.log(JSON.stringify({ content: result.data }));
+		else console.log(result.data);
+	}, ctx.formatter);
+}
+async function envUpdate(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	const content = String(ctx.options.content ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli env update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
+	if (!site) exitWithValidationError("site_id", "forge-cli env update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
+	if (!content) exitWithValidationError("content", "forge-cli env update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		await updateEnv({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			content
+		}, execCtx);
+		ctx.formatter.success("Environment variables updated.");
+	}, ctx.formatter);
+}
+const handleEnvCommand = createCommandRouter({
+	resource: "env",
+	handlers: {
+		get: envGet,
+		update: envUpdate
+	},
+	writeSubcommands: ["update"]
+});
+function showEnvHelp(subcommand) {
+	if (subcommand === "get") console.log(`
+${colors.bold("forge-cli env get")} - Get environment variables
+
+${colors.bold("USAGE:")}
+  forge-cli env get --server <server_id> --site <site_id>
+`);
+	else if (subcommand === "update") console.log(`
+${colors.bold("forge-cli env update")} - Update environment variables
+
+${colors.bold("USAGE:")}
+  forge-cli env update --server <server_id> --site <site_id> --content <env_content>
+`);
+	else console.log(`
+${colors.bold("forge-cli env")} - Manage environment variables
+
+${colors.bold("USAGE:")}
+  forge-cli env <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  get                 Get environment variables
+  update              Update environment variables
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  --content <str>     New env content (for update)
+  -f, --format <fmt>  Output format: json, human
+
+Run ${colors.cyan("forge-cli env <subcommand> --help")} for details.
+`);
+}
+async function firewallRulesList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli firewall-rules list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listFirewallRules({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"name",
+			"port",
+			"type",
+			"ip_address",
+			"status"
+		], "No firewall rules found.", (r) => `${String(r.id).padEnd(8)} ${r.name.padEnd(20)} ${String(r.port).padEnd(8)} ${r.type.padEnd(8)} ${(r.ip_address ?? "any").padEnd(16)} ${r.status}`);
+	}, ctx.formatter);
+}
+async function firewallRulesGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("firewall_rule_id", "forge-cli firewall-rules get <rule_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli firewall-rules get <rule_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getFirewallRule({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"port",
+			"type",
+			"ip_address",
+			"status",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+const handleFirewallRulesCommand = createCommandRouter({
+	resource: "firewall-rules",
+	handlers: {
+		list: firewallRulesList,
+		ls: firewallRulesList,
+		get: [firewallRulesGet, "args"]
+	}
+});
+function showFirewallRulesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli firewall-rules list")} - List firewall rules on a server
+
+${colors.bold("USAGE:")}
+  forge-cli firewall-rules list --server <server_id> [options]
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli firewall-rules get")} - Get firewall rule details
+
+${colors.bold("USAGE:")}
+  forge-cli firewall-rules get <rule_id> --server <server_id>
+`);
+	else console.log(`
+${colors.bold("forge-cli firewall-rules")} - Manage firewall rules
+
+${colors.bold("USAGE:")}
+  forge-cli firewall-rules <subcommand> [options]
+
+${colors.bold("ALIASES:")}
+  forge-cli fw
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List firewall rules
+  get <id>            Get firewall rule details
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli firewall-rules <subcommand> --help")} for details.
+`);
+}
+async function monitorsList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli monitors list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listMonitors({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"type",
+			"operator",
+			"threshold",
+			"state"
+		], "No monitors found.", (m) => `${String(m.id).padEnd(8)} ${m.type.padEnd(20)} ${m.operator.padEnd(8)} ${String(m.threshold).padEnd(6)} ${m.state}`);
+	}, ctx.formatter);
+}
+async function monitorsGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("monitor_id", "forge-cli monitors get <monitor_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli monitors get <monitor_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getMonitor({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"type",
+			"operator",
+			"threshold",
+			"minutes",
+			"state",
+			"state_changed_at"
+		]);
+	}, ctx.formatter);
+}
+async function monitorsCreate(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const type = String(ctx.options.type ?? "");
+	const operator = String(ctx.options.operator ?? "");
+	const threshold = Number(ctx.options.threshold ?? 0);
+	const minutes = Number(ctx.options.minutes ?? 0);
+	if (!server) exitWithValidationError("server_id", "forge-cli monitors create --server <server_id> --type <type> --operator <operator> --threshold <threshold> --minutes <minutes>", ctx.formatter);
+	if (!type) exitWithValidationError("type", "forge-cli monitors create --server <server_id> --type <type> --operator <operator> --threshold <threshold> --minutes <minutes>", ctx.formatter);
+	if (!operator) exitWithValidationError("operator", "forge-cli monitors create --server <server_id> --type <type> --operator <operator> --threshold <threshold> --minutes <minutes>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await createMonitor({
+			server_id: await resolveServerId(server, execCtx),
+			type,
+			operator,
+			threshold,
+			minutes
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"type",
+			"operator",
+			"threshold",
+			"minutes",
+			"state"
+		]);
+	}, ctx.formatter);
+}
+async function monitorsDelete(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("monitor_id", "forge-cli monitors delete <monitor_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli monitors delete <monitor_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		await deleteMonitor({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Monitor ${id} deleted.`);
+	}, ctx.formatter);
+}
+const handleMonitorsCommand = createCommandRouter({
+	resource: "monitors",
+	handlers: {
+		list: monitorsList,
+		ls: monitorsList,
+		get: [monitorsGet, "args"],
+		create: monitorsCreate,
+		delete: [monitorsDelete, "args"]
+	},
+	writeSubcommands: ["create", "delete"]
+});
+function showMonitorsHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli monitors list")} - List monitors on a server
+
+${colors.bold("USAGE:")}
+  forge-cli monitors list --server <server_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli monitors get")} - Get monitor details
+
+${colors.bold("USAGE:")}
+  forge-cli monitors get <monitor_id> --server <server_id> [options]
+`);
+	else if (subcommand === "create") console.log(`
+${colors.bold("forge-cli monitors create")} - Create a new monitor
+
+${colors.bold("USAGE:")}
+  forge-cli monitors create --server <server_id> --type <type> --operator <operator> --threshold <threshold> --minutes <minutes> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --type <type>         Monitor type (required)
+  --operator <op>       Comparison operator (required)
+  --threshold <num>     Alert threshold value (required)
+  --minutes <num>       Duration in minutes (required)
+  -f, --format <fmt>    Output format: json, human, table
+`);
+	else if (subcommand === "delete") console.log(`
+${colors.bold("forge-cli monitors delete")} - Delete a monitor
+
+${colors.bold("USAGE:")}
+  forge-cli monitors delete <monitor_id> --server <server_id> [options]
+`);
+	else console.log(`
+${colors.bold("forge-cli monitors")} - Manage server monitors
+
+${colors.bold("USAGE:")}
+  forge-cli monitors <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List monitors
+  get <id>            Get monitor details
+  create              Create a new monitor
+  delete <id>         Delete a monitor
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli monitors <subcommand> --help")} for details.
+`);
+}
+async function nginxGet(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli nginx get --server <server_id> --site <site_id>", ctx.formatter);
+	if (!site) exitWithValidationError("site_id", "forge-cli nginx get --server <server_id> --site <site_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await getNginxConfig({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx)
+		}, execCtx);
+		if (ctx.formatter.isJson()) console.log(JSON.stringify({ content: result.data }));
+		else console.log(result.data);
+	}, ctx.formatter);
+}
+async function nginxUpdate(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	const content = String(ctx.options.content ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli nginx update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
+	if (!site) exitWithValidationError("site_id", "forge-cli nginx update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
+	if (!content) exitWithValidationError("content", "forge-cli nginx update --server <server_id> --site <site_id> --content <content>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		await updateNginxConfig({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			content
+		}, execCtx);
+		ctx.formatter.success("Nginx configuration updated.");
+	}, ctx.formatter);
+}
+const handleNginxCommand = createCommandRouter({
+	resource: "nginx",
+	handlers: {
+		get: nginxGet,
+		update: nginxUpdate
+	},
+	writeSubcommands: ["update"]
+});
+function showNginxHelp(subcommand) {
+	if (subcommand === "get") console.log(`
+${colors.bold("forge-cli nginx get")} - Get nginx configuration
+
+${colors.bold("USAGE:")}
+  forge-cli nginx get --server <server_id> --site <site_id>
+`);
+	else if (subcommand === "update") console.log(`
+${colors.bold("forge-cli nginx update")} - Update nginx configuration
+
+${colors.bold("USAGE:")}
+  forge-cli nginx update --server <server_id> --site <site_id> --content <nginx_config>
+`);
+	else console.log(`
+${colors.bold("forge-cli nginx")} - Manage nginx configuration
+
+${colors.bold("USAGE:")}
+  forge-cli nginx <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  get                 Get nginx configuration
+  update              Update nginx configuration
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  --content <str>     New nginx config (for update)
+
+Run ${colors.cyan("forge-cli nginx <subcommand> --help")} for details.
+`);
+}
+async function nginxTemplatesList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli nginx-templates list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listNginxTemplates({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"name",
+			"created_at"
+		], "No Nginx templates found.", (t) => `${String(t.id).padEnd(8)} ${t.name.padEnd(40)} ${t.created_at}`);
+	}, ctx.formatter);
+}
+async function nginxTemplatesGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("template_id", "forge-cli nginx-templates get <template_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli nginx-templates get <template_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getNginxTemplate({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"created_at",
+			"content"
+		]);
+	}, ctx.formatter);
+}
+async function nginxTemplatesCreate(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const name = String(ctx.options.name ?? "");
+	const content = String(ctx.options.content ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli nginx-templates create --server <server_id> --name <name> --content <content>", ctx.formatter);
+	if (!name) exitWithValidationError("name", "forge-cli nginx-templates create --server <server_id> --name <name> --content <content>", ctx.formatter);
+	if (!content) exitWithValidationError("content", "forge-cli nginx-templates create --server <server_id> --name <name> --content <content>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await createNginxTemplate({
+			server_id: await resolveServerId(server, execCtx),
+			name,
+			content
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function nginxTemplatesUpdate(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("template_id", "forge-cli nginx-templates update <template_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli nginx-templates update <template_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await updateNginxTemplate({
+			server_id: await resolveServerId(server, execCtx),
+			id,
+			name: ctx.options.name ? String(ctx.options.name) : void 0,
+			content: ctx.options.content ? String(ctx.options.content) : void 0
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function nginxTemplatesDelete(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("template_id", "forge-cli nginx-templates delete <template_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli nginx-templates delete <template_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		await deleteNginxTemplate({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Nginx template ${id} deleted.`);
+	}, ctx.formatter);
+}
+const handleNginxTemplatesCommand = createCommandRouter({
+	resource: "nginx-templates",
+	handlers: {
+		list: nginxTemplatesList,
+		ls: nginxTemplatesList,
+		get: [nginxTemplatesGet, "args"],
+		create: nginxTemplatesCreate,
+		update: [nginxTemplatesUpdate, "args"],
+		delete: [nginxTemplatesDelete, "args"]
+	},
+	writeSubcommands: [
+		"create",
+		"update",
+		"delete"
+	]
+});
+function showNginxTemplatesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli nginx-templates list")} - List Nginx templates on a server
+
+${colors.bold("USAGE:")}
+  forge-cli nginx-templates list --server <server_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli nginx-templates get")} - Get Nginx template details
+
+${colors.bold("USAGE:")}
+  forge-cli nginx-templates get <template_id> --server <server_id> [options]
+`);
+	else if (subcommand === "create") console.log(`
+${colors.bold("forge-cli nginx-templates create")} - Create a new Nginx template
+
+${colors.bold("USAGE:")}
+  forge-cli nginx-templates create --server <server_id> --name <name> --content <content> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --name <name>         Template name (required)
+  --content <text>      Template content (required)
+  -f, --format <fmt>    Output format: json, human, table
+`);
+	else if (subcommand === "update") console.log(`
+${colors.bold("forge-cli nginx-templates update")} - Update an Nginx template
+
+${colors.bold("USAGE:")}
+  forge-cli nginx-templates update <template_id> --server <server_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --name <name>         New template name (optional)
+  --content <text>      New template content (optional)
+  -f, --format <fmt>    Output format: json, human, table
+`);
+	else if (subcommand === "delete") console.log(`
+${colors.bold("forge-cli nginx-templates delete")} - Delete an Nginx template
+
+${colors.bold("USAGE:")}
+  forge-cli nginx-templates delete <template_id> --server <server_id> [options]
+`);
+	else console.log(`
+${colors.bold("forge-cli nginx-templates")} - Manage Nginx templates
+
+${colors.bold("USAGE:")}
+  forge-cli nginx-templates <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List Nginx templates
+  get <id>            Get Nginx template details
+  create              Create a new Nginx template
+  update <id>         Update an Nginx template
+  delete <id>         Delete an Nginx template
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli nginx-templates <subcommand> --help")} for details.
+`);
+}
+async function recipesList(ctx) {
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const result = await listRecipes({}, ctx.createExecutorContext(token));
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"name",
+			"user",
+			"created_at"
+		], "No recipes found.", (r) => `${String(r.id).padEnd(8)} ${r.name.padEnd(40)} ${r.user.padEnd(16)} ${r.created_at}`);
+	}, ctx.formatter);
+}
+async function recipesGet(args, ctx) {
+	const [id] = args;
+	if (!id) exitWithValidationError("id", "forge-cli recipes get <recipe_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getRecipe({ id }, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"user",
+			"created_at",
+			"script"
+		]);
+	}, ctx.formatter);
+}
+async function recipesRun(args, ctx) {
+	const [id] = args;
+	const serversRaw = String(ctx.options.servers ?? "");
+	if (!id) exitWithValidationError("id", "forge-cli recipes run <recipe_id> --servers <ids>", ctx.formatter);
+	if (!serversRaw) exitWithValidationError("servers", "forge-cli recipes run <recipe_id> --servers <server_id1,server_id2,...>", ctx.formatter);
+	const servers = serversRaw.split(",").map((s) => Number(s.trim())).filter((n) => !isNaN(n));
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		await runRecipe({
+			id,
+			servers
+		}, execCtx);
+		ctx.formatter.success(`Recipe ${id} dispatched to ${servers.length} server(s).`);
+	}, ctx.formatter);
+}
+const handleRecipesCommand = createCommandRouter({
+	resource: "recipes",
+	handlers: {
+		list: recipesList,
+		ls: recipesList,
+		get: [recipesGet, "args"],
+		run: [recipesRun, "args"]
+	},
+	writeSubcommands: ["run"]
+});
+function showRecipesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli recipes list")} - List all recipes
+
+${colors.bold("USAGE:")}
+  forge-cli recipes list [options]
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli recipes get")} - Get recipe details
+
+${colors.bold("USAGE:")}
+  forge-cli recipes get <recipe_id>
+`);
+	else if (subcommand === "run") console.log(`
+${colors.bold("forge-cli recipes run")} - Run a recipe on servers
+
+${colors.bold("USAGE:")}
+  forge-cli recipes run <recipe_id> --servers <server_id1,server_id2,...>
+
+${colors.bold("OPTIONS:")}
+  --servers <ids>     Comma-separated server IDs to run recipe on
+`);
+	else console.log(`
+${colors.bold("forge-cli recipes")} - Manage recipes
+
+${colors.bold("USAGE:")}
+  forge-cli recipes <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List all recipes
+  get <id>            Get recipe details
+  run <id>            Run a recipe on servers
+
+${colors.bold("OPTIONS:")}
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli recipes <subcommand> --help")} for details.
+`);
+}
+function requireServerAndSiteRaw$1(ctx, usage) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	if (!site) exitWithValidationError("site_id", usage, ctx.formatter);
+	return {
+		server,
+		site
+	};
+}
+async function redirectRulesList(ctx) {
+	const { server, site } = requireServerAndSiteRaw$1(ctx, "forge-cli redirect-rules list --server <server_id> --site <site_id>");
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await listRedirectRules({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx)
+		}, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"from",
+			"to",
+			"type"
+		], "No redirect rules found.", (r) => `${String(r.id).padEnd(8)} ${r.from.padEnd(30)} ${r.to.padEnd(30)} ${r.type}`);
+	}, ctx.formatter);
+}
+async function redirectRulesGet(args, ctx) {
+	const [id] = args;
+	const usage = "forge-cli redirect-rules get <rule_id> --server <server_id> --site <site_id>";
+	if (!id) exitWithValidationError("rule_id", usage, ctx.formatter);
+	const { server, site } = requireServerAndSiteRaw$1(ctx, usage);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await getRedirectRule({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"from",
+			"to",
+			"type",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function redirectRulesCreate(ctx) {
+	const usage = "forge-cli redirect-rules create --server <server_id> --site <site_id> --from <from> --to <to>";
+	const { server, site } = requireServerAndSiteRaw$1(ctx, usage);
+	const from = String(ctx.options.from ?? "");
+	const to = String(ctx.options.to ?? "");
+	if (!from) exitWithValidationError("from", usage, ctx.formatter);
+	if (!to) exitWithValidationError("to", usage, ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await createRedirectRule({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			from,
+			to
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"from",
+			"to",
+			"type",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function redirectRulesDelete(args, ctx) {
+	const [id] = args;
+	const usage = "forge-cli redirect-rules delete <rule_id> --server <server_id> --site <site_id>";
+	if (!id) exitWithValidationError("rule_id", usage, ctx.formatter);
+	const { server, site } = requireServerAndSiteRaw$1(ctx, usage);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		await deleteRedirectRule({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Redirect rule ${id} deleted.`);
+	}, ctx.formatter);
+}
+const handleRedirectRulesCommand = createCommandRouter({
+	resource: "redirect-rules",
+	handlers: {
+		list: redirectRulesList,
+		ls: redirectRulesList,
+		get: [redirectRulesGet, "args"],
+		create: redirectRulesCreate,
+		delete: [redirectRulesDelete, "args"]
+	},
+	writeSubcommands: ["create", "delete"]
+});
+function showRedirectRulesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli redirect-rules list")} - List redirect rules for a site
+
+${colors.bold("USAGE:")}
+  forge-cli redirect-rules list --server <server_id> --site <site_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli redirect-rules get")} - Get redirect rule details
+
+${colors.bold("USAGE:")}
+  forge-cli redirect-rules get <rule_id> --server <server_id> --site <site_id> [options]
+`);
+	else if (subcommand === "create") console.log(`
+${colors.bold("forge-cli redirect-rules create")} - Create a new redirect rule
+
+${colors.bold("USAGE:")}
+  forge-cli redirect-rules create --server <server_id> --site <site_id> --from <from> --to <to> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --site <id>           Site ID (required)
+  --from <path>         Source path to redirect from (required)
+  --to <path>           Destination path to redirect to (required)
+  -f, --format <fmt>    Output format: json, human, table
+`);
+	else if (subcommand === "delete") console.log(`
+${colors.bold("forge-cli redirect-rules delete")} - Delete a redirect rule
+
+${colors.bold("USAGE:")}
+  forge-cli redirect-rules delete <rule_id> --server <server_id> --site <site_id> [options]
+`);
+	else console.log(`
+${colors.bold("forge-cli redirect-rules")} - Manage site redirect rules
+
+${colors.bold("USAGE:")}
+  forge-cli redirect-rules <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List redirect rules
+  get <id>            Get redirect rule details
+  create              Create a new redirect rule
+  delete <id>         Delete a redirect rule
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli redirect-rules <subcommand> --help")} for details.
+`);
+}
+async function scheduledJobsList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli scheduled-jobs list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listScheduledJobs({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"command",
+			"frequency",
+			"status"
+		], "No scheduled jobs found.", (j) => `${String(j.id).padEnd(8)} ${j.command.padEnd(50)} ${j.frequency.padEnd(12)} ${j.status}`);
+	}, ctx.formatter);
+}
+async function scheduledJobsGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("job_id", "forge-cli scheduled-jobs get <job_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli scheduled-jobs get <job_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getScheduledJob({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"command",
+			"user",
+			"frequency",
+			"cron",
+			"status",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function scheduledJobsCreate(ctx) {
+	const server = String(ctx.options.server ?? "");
+	const command = String(ctx.options.command ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli scheduled-jobs create --server <server_id> --command <command>", ctx.formatter);
+	if (!command) exitWithValidationError("command", "forge-cli scheduled-jobs create --server <server_id> --command <command>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await createScheduledJob({
+			server_id: await resolveServerId(server, execCtx),
+			command
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"command",
+			"user",
+			"frequency",
+			"cron",
+			"status",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function scheduledJobsDelete(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("job_id", "forge-cli scheduled-jobs delete <job_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli scheduled-jobs delete <job_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		await deleteScheduledJob({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Scheduled job ${id} deleted.`);
+	}, ctx.formatter);
+}
+const handleScheduledJobsCommand = createCommandRouter({
+	resource: "scheduled-jobs",
+	handlers: {
+		list: scheduledJobsList,
+		ls: scheduledJobsList,
+		get: [scheduledJobsGet, "args"],
+		create: scheduledJobsCreate,
+		delete: [scheduledJobsDelete, "args"]
+	},
+	writeSubcommands: ["create", "delete"]
+});
+function showScheduledJobsHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli scheduled-jobs list")} - List scheduled jobs on a server
+
+${colors.bold("USAGE:")}
+  forge-cli scheduled-jobs list --server <server_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli scheduled-jobs get")} - Get scheduled job details
+
+${colors.bold("USAGE:")}
+  forge-cli scheduled-jobs get <job_id> --server <server_id> [options]
+`);
+	else if (subcommand === "create") console.log(`
+${colors.bold("forge-cli scheduled-jobs create")} - Create a new scheduled job
+
+${colors.bold("USAGE:")}
+  forge-cli scheduled-jobs create --server <server_id> --command <command> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --command <cmd>       Command to run (required)
+  -f, --format <fmt>    Output format: json, human, table
+`);
+	else if (subcommand === "delete") console.log(`
+${colors.bold("forge-cli scheduled-jobs delete")} - Delete a scheduled job
+
+${colors.bold("USAGE:")}
+  forge-cli scheduled-jobs delete <job_id> --server <server_id> [options]
+`);
+	else console.log(`
+${colors.bold("forge-cli scheduled-jobs")} - Manage scheduled jobs (cron)
+
+${colors.bold("USAGE:")}
+  forge-cli scheduled-jobs <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List scheduled jobs
+  get <id>            Get scheduled job details
+  create              Create a new scheduled job
+  delete <id>         Delete a scheduled job
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli scheduled-jobs <subcommand> --help")} for details.
+`);
+}
+function requireServerAndSiteRaw(ctx, usage) {
+	const server = String(ctx.options.server ?? "");
+	const site = String(ctx.options.site ?? "");
+	if (!server) exitWithValidationError("server_id", usage, ctx.formatter);
+	if (!site) exitWithValidationError("site_id", usage, ctx.formatter);
+	return {
+		server,
+		site
+	};
+}
+async function securityRulesList(ctx) {
+	const { server, site } = requireServerAndSiteRaw(ctx, "forge-cli security-rules list --server <server_id> --site <site_id>");
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await listSecurityRules({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx)
+		}, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"name",
+			"path"
+		], "No security rules found.", (r) => `${String(r.id).padEnd(8)} ${r.name.padEnd(30)} ${r.path ?? "—"}`);
+	}, ctx.formatter);
+}
+async function securityRulesGet(args, ctx) {
+	const [id] = args;
+	const usage = "forge-cli security-rules get <rule_id> --server <server_id> --site <site_id>";
+	if (!id) exitWithValidationError("rule_id", usage, ctx.formatter);
+	const { server, site } = requireServerAndSiteRaw(ctx, usage);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await getSecurityRule({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"path",
+			"credentials",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function securityRulesCreate(ctx) {
+	const usage = "forge-cli security-rules create --server <server_id> --site <site_id> --name <name>";
+	const { server, site } = requireServerAndSiteRaw(ctx, usage);
+	const name = String(ctx.options.name ?? "");
+	if (!name) exitWithValidationError("name", usage, ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		const result = await createSecurityRule({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			name,
+			credentials: []
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"path",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+async function securityRulesDelete(args, ctx) {
+	const [id] = args;
+	const usage = "forge-cli security-rules delete <rule_id> --server <server_id> --site <site_id>";
+	if (!id) exitWithValidationError("rule_id", usage, ctx.formatter);
+	const { server, site } = requireServerAndSiteRaw(ctx, usage);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		await deleteSecurityRule({
+			server_id,
+			site_id: await resolveSiteId(site, server_id, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.success(`Security rule ${id} deleted.`);
+	}, ctx.formatter);
+}
+const handleSecurityRulesCommand = createCommandRouter({
+	resource: "security-rules",
+	handlers: {
+		list: securityRulesList,
+		ls: securityRulesList,
+		get: [securityRulesGet, "args"],
+		create: securityRulesCreate,
+		delete: [securityRulesDelete, "args"]
+	},
+	writeSubcommands: ["create", "delete"]
+});
+function showSecurityRulesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli security-rules list")} - List security rules for a site
+
+${colors.bold("USAGE:")}
+  forge-cli security-rules list --server <server_id> --site <site_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli security-rules get")} - Get security rule details
+
+${colors.bold("USAGE:")}
+  forge-cli security-rules get <rule_id> --server <server_id> --site <site_id> [options]
+`);
+	else if (subcommand === "create") console.log(`
+${colors.bold("forge-cli security-rules create")} - Create a new security rule
+
+${colors.bold("USAGE:")}
+  forge-cli security-rules create --server <server_id> --site <site_id> --name <name> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>         Server ID (required)
+  --site <id>           Site ID (required)
+  --name <name>         Security rule name (required)
+  -f, --format <fmt>    Output format: json, human, table
+`);
+	else if (subcommand === "delete") console.log(`
+${colors.bold("forge-cli security-rules delete")} - Delete a security rule
+
+${colors.bold("USAGE:")}
+  forge-cli security-rules delete <rule_id> --server <server_id> --site <site_id> [options]
+`);
+	else console.log(`
+${colors.bold("forge-cli security-rules")} - Manage site security rules
+
+${colors.bold("USAGE:")}
+  forge-cli security-rules <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List security rules
+  get <id>            Get security rule details
+  create              Create a new security rule
+  delete <id>         Delete a security rule
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  --site <id>         Site ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli security-rules <subcommand> --help")} for details.
+`);
+}
+/**
+* CLI handlers for servers commands.
+* Delegates all HTTP logic to forge-core executors.
+*/
+/**
+* List all servers.
+*/
+async function serversList(ctx) {
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const result = await listServers({}, ctx.createExecutorContext(token));
+		const format = String(ctx.options.format ?? ctx.options.f ?? "human");
+		if (format === "table" || format === "json") ctx.formatter.output(result.data);
+		else {
+			if (result.data.length === 0) {
+				ctx.formatter.info("No servers found.");
+				return;
+			}
+			for (const server of result.data) console.log(`${String(server.id).padEnd(8)} ${server.name.padEnd(30)} ${server.ip_address.padEnd(16)} ${server.is_ready ? "ready" : "provisioning"}`);
+		}
+	}, ctx.formatter);
+}
+/**
+* Get a single server by ID or name.
+*/
+async function serversGet(args, ctx) {
+	const [server] = args;
+	if (!server) exitWithValidationError("server_id", "forge-cli servers get <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getServer({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.output(result.data);
+	}, ctx.formatter);
+}
+/**
+* Reboot a server by ID or name.
+*/
+async function serversReboot(args, ctx) {
+	const [server] = args;
+	if (!server) exitWithValidationError("server_id", "forge-cli servers reboot <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const server_id = await resolveServerId(server, execCtx);
+		await rebootServer({ server_id }, execCtx);
+		ctx.formatter.success(`Server ${server_id} reboot initiated.`);
+	}, ctx.formatter);
+}
+const handleServersCommand = createCommandRouter({
+	resource: "servers",
+	handlers: {
+		list: serversList,
+		ls: serversList,
+		get: [serversGet, "args"],
+		reboot: [serversReboot, "args"]
+	},
+	writeSubcommands: ["reboot"]
+});
+function showServersHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli servers list")} - List all servers
+
+${colors.bold("USAGE:")}
+  forge-cli servers list [options]
+
+${colors.bold("OPTIONS:")}
+  --token <token>     Forge API token
+  -f, --format <fmt>  Output format: json, human, table (default: human)
+  --no-color          Disable colored output
+  -h, --help          Show this help
+
+${colors.bold("EXAMPLES:")}
+  forge-cli servers list
+  forge-cli servers list --format json
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli servers get")} - Get server details
+
+${colors.bold("USAGE:")}
+  forge-cli servers get <server_id> [options]
+
+${colors.bold("ARGUMENTS:")}
+  <server_id>         Server ID (required)
+
+${colors.bold("OPTIONS:")}
+  -f, --format <fmt>  Output format: json, human, table
+
+${colors.bold("EXAMPLES:")}
+  forge-cli servers get 123
+  forge-cli servers get 123 --format json
+`);
+	else if (subcommand === "reboot") console.log(`
+${colors.bold("forge-cli servers reboot")} - Reboot a server
+
+${colors.bold("USAGE:")}
+  forge-cli servers reboot <server_id> [options]
+
+${colors.bold("ARGUMENTS:")}
+  <server_id>         Server ID (required)
+
+${colors.bold("EXAMPLES:")}
+  forge-cli servers reboot 123
+`);
+	else console.log(`
+${colors.bold("forge-cli servers")} - Manage servers
+
+${colors.bold("USAGE:")}
+  forge-cli servers <subcommand> [options]
+
+${colors.bold("ALIASES:")}
+  forge-cli s
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List all servers
+  get <id>            Get server details
+  reboot <id>         Reboot a server
+
+${colors.bold("OPTIONS:")}
+  -f, --format <fmt>  Output format: json, human, table
+  -h, --help          Show help for a subcommand
+
+${colors.bold("EXAMPLES:")}
+  forge-cli servers list
+  forge-cli servers get 123
+
+Run ${colors.cyan("forge-cli servers <subcommand> --help")} for subcommand details.
+`);
+}
+async function sitesList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli sites list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listSites({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"name",
+			"status",
+			"php_version"
+		], "No sites found.", (s) => `${String(s.id).padEnd(8)} ${s.name.padEnd(40)} ${s.status.padEnd(12)} ${s.php_version}`);
+	}, ctx.formatter);
+}
+async function sitesGet(args, ctx) {
+	const [site_id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!site_id) exitWithValidationError("site_id", "forge-cli sites get <site_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli sites get <site_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getSite({
+			server_id: await resolveServerId(server, execCtx),
+			site_id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"status",
+			"php_version",
+			"project_type",
+			"repository",
+			"repository_branch",
+			"quick_deploy",
+			"deployment_status",
+			"is_secured",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+const handleSitesCommand = createCommandRouter({
+	resource: "sites",
+	handlers: {
+		list: sitesList,
+		ls: sitesList,
+		get: [sitesGet, "args"]
+	}
+});
+function showSitesHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli sites list")} - List sites on a server
+
+${colors.bold("USAGE:")}
+  forge-cli sites list --server <server_id> [options]
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+${colors.bold("EXAMPLES:")}
+  forge-cli sites list --server 123
+  forge-cli sites list --server 123 --format json
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli sites get")} - Get site details
+
+${colors.bold("USAGE:")}
+  forge-cli sites get <site_id> --server <server_id> [options]
+
+${colors.bold("ARGUMENTS:")}
+  <site_id>           Site ID (required)
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else console.log(`
+${colors.bold("forge-cli sites")} - Manage sites
+
+${colors.bold("USAGE:")}
+  forge-cli sites <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List sites on a server
+  get <id>            Get site details
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required for most commands)
+  -f, --format <fmt>  Output format: json, human, table
+  -h, --help          Show help for a subcommand
+
+${colors.bold("EXAMPLES:")}
+  forge-cli sites list --server 123
+  forge-cli sites get 456 --server 123
+
+Run ${colors.cyan("forge-cli sites <subcommand> --help")} for subcommand details.
+`);
+}
+async function sshKeysList(ctx) {
+	const server = String(ctx.options.server ?? "");
+	if (!server) exitWithValidationError("server_id", "forge-cli ssh-keys list --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await listSshKeys({ server_id: await resolveServerId(server, execCtx) }, execCtx);
+		ctx.formatter.outputList(result.data, [
+			"id",
+			"name",
+			"status"
+		], "No SSH keys found.", (k) => `${String(k.id).padEnd(8)} ${k.name.padEnd(30)} ${k.status}`);
+	}, ctx.formatter);
+}
+async function sshKeysGet(args, ctx) {
+	const [id] = args;
+	const server = String(ctx.options.server ?? "");
+	if (!id) exitWithValidationError("ssh_key_id", "forge-cli ssh-keys get <key_id> --server <server_id>", ctx.formatter);
+	if (!server) exitWithValidationError("server_id", "forge-cli ssh-keys get <key_id> --server <server_id>", ctx.formatter);
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const execCtx = ctx.createExecutorContext(token);
+		const result = await getSshKey({
+			server_id: await resolveServerId(server, execCtx),
+			id
+		}, execCtx);
+		ctx.formatter.outputOne(result.data, [
+			"id",
+			"name",
+			"status",
+			"created_at"
+		]);
+	}, ctx.formatter);
+}
+const handleSshKeysCommand = createCommandRouter({
+	resource: "ssh-keys",
+	handlers: {
+		list: sshKeysList,
+		ls: sshKeysList,
+		get: [sshKeysGet, "args"]
+	}
+});
+function showSshKeysHelp(subcommand) {
+	if (subcommand === "list" || subcommand === "ls") console.log(`
+${colors.bold("forge-cli ssh-keys list")} - List SSH keys on a server
+
+${colors.bold("USAGE:")}
+  forge-cli ssh-keys list --server <server_id> [options]
+`);
+	else if (subcommand === "get") console.log(`
+${colors.bold("forge-cli ssh-keys get")} - Get SSH key details
+
+${colors.bold("USAGE:")}
+  forge-cli ssh-keys get <key_id> --server <server_id>
+`);
+	else console.log(`
+${colors.bold("forge-cli ssh-keys")} - Manage SSH keys
+
+${colors.bold("USAGE:")}
+  forge-cli ssh-keys <subcommand> [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  list, ls            List SSH keys
+  get <id>            Get SSH key details
+
+${colors.bold("OPTIONS:")}
+  --server <id>       Server ID (required)
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli ssh-keys <subcommand> --help")} for details.
+`);
+}
+async function userGet(ctx) {
+	await runCommand(async () => {
+		const token = ctx.getToken();
+		const result = await getUser({}, ctx.createExecutorContext(token));
+		ctx.formatter.output(result.data);
+	}, ctx.formatter);
+}
+const handleUserCommand = createCommandRouter({
+	resource: "user",
+	handlers: { get: userGet }
+});
+function showUserHelp(subcommand) {
+	if (subcommand === "get") console.log(`
+${colors.bold("forge-cli user get")} - Get the authenticated user profile
+
+${colors.bold("USAGE:")}
+  forge-cli user get [options]
+
+${colors.bold("OPTIONS:")}
+  -f, --format <fmt>  Output format: json, human, table
+`);
+	else console.log(`
+${colors.bold("forge-cli user")} - Display authenticated user profile
+
+${colors.bold("USAGE:")}
+  forge-cli user [subcommand] [options]
+
+${colors.bold("SUBCOMMANDS:")}
+  get                 Get the authenticated user profile
+
+${colors.bold("OPTIONS:")}
+  -f, --format <fmt>  Output format: json, human, table
+
+Run ${colors.cyan("forge-cli user <subcommand> --help")} for details.
+`);
+}
+function parseArgs(argv = process.argv.slice(2)) {
+	const options = {};
+	const positional = [];
+	const command = [];
+	for (let i = 0; i < argv.length; i++) {
+		const arg = argv[i];
+		if (arg.startsWith("--")) {
+			const equalIndex = arg.indexOf("=");
+			if (equalIndex > -1) {
+				const key = arg.slice(2, equalIndex);
+				options[key] = arg.slice(equalIndex + 1);
+			} else {
+				const key = arg.slice(2);
+				const nextArg = argv[i + 1];
+				if (nextArg !== void 0 && !nextArg.startsWith("-")) {
+					options[key] = nextArg;
+					i++;
+				} else options[key] = true;
+			}
+		} else if (arg.startsWith("-") && arg.length > 1) if (arg.length === 2) {
+			const key = arg[1];
+			const nextArg = argv[i + 1];
+			if (nextArg !== void 0 && !nextArg.startsWith("-")) {
+				options[key] = nextArg;
+				i++;
+			} else options[key] = true;
+		} else for (let j = 1; j < arg.length; j++) options[arg[j]] = true;
+		else if (command.length < 2) command.push(arg);
+		else positional.push(arg);
+	}
+	return {
+		command,
+		options,
+		positional
+	};
+}
+var VERSION = "0.2.0";
+function showHelp() {
+	console.log(`
+${colors.bold("forge-cli")} v${VERSION}
+
+${colors.bold("USAGE:")}
+  forge-cli <command> [subcommand] [options]
+
+${colors.bold("COMMANDS:")}
+  config              Manage CLI configuration
+    set <token>         Save API token
+    get                 Show current token (masked)
+    delete              Delete stored token
+
+  servers, s          Manage servers
+    list, ls            List all servers
+    get <id>            Get server details
+    reboot <id>         Reboot a server
+
+  sites               Manage sites
+    list, ls            List sites (requires --server)
+    get <id>            Get site details (requires --server)
+
+  deployments, d      Manage deployments
+    list, ls            List deployments (requires --server --site)
+    deploy              Trigger a deployment (requires --server --site)
+
+  databases, db       Manage databases
+    list, ls            List databases (requires --server)
+    get <id>            Get database details (requires --server)
+
+  database-users      Manage database users
+    list, ls            List database users (requires --server)
+    get <id>            Get database user details (requires --server)
+    create              Create a database user (requires --server --name --password)
+    delete <id>         Delete a database user (requires --server)
+
+  daemons             Manage daemons
+    list, ls            List daemons (requires --server)
+    get <id>            Get daemon details (requires --server)
+    restart <id>        Restart a daemon (requires --server)
+
+  env                 Manage environment variables
+    get                 Get env variables (requires --server --site)
+    update              Update env variables (requires --server --site --content)
+
+  nginx               Manage nginx configuration
+    get                 Get nginx config (requires --server --site)
+    update              Update nginx config (requires --server --site --content)
+
+  certificates, certs Manage SSL certificates
+    list, ls            List certificates (requires --server --site)
+    get <id>            Get certificate details (requires --server --site)
+    activate <id>       Activate a certificate (requires --server --site)
+
+  firewall-rules, fw  Manage firewall rules
+    list, ls            List firewall rules (requires --server)
+    get <id>            Get firewall rule details (requires --server)
+
+  ssh-keys            Manage SSH keys
+    list, ls            List SSH keys (requires --server)
+    get <id>            Get SSH key details (requires --server)
+
+  backups             Manage backup configurations
+    list, ls            List backup configurations (requires --server)
+    get <id>            Get backup configuration details (requires --server)
+    create              Create a backup configuration (requires --server --provider --frequency)
+    delete <id>         Delete a backup configuration (requires --server)
+
+  commands            Manage site commands
+    list, ls            List commands (requires --server --site)
+    get <id>            Get command details (requires --server --site)
+    create              Execute a command (requires --server --site --command)
+
+  scheduled-jobs      Manage scheduled jobs (cron)
+    list, ls            List scheduled jobs (requires --server)
+    get <id>            Get scheduled job details (requires --server)
+    create              Create a scheduled job (requires --server --command)
+    delete <id>         Delete a scheduled job (requires --server)
+
+  user                Display authenticated user profile
+    get                 Get the authenticated user profile
+
+  monitors            Manage server monitors
+    list, ls            List monitors (requires --server)
+    get <id>            Get monitor details (requires --server)
+    create              Create a monitor (requires --server --type --operator --threshold --minutes)
+    delete <id>         Delete a monitor (requires --server)
+
+  nginx-templates     Manage Nginx templates
+    list, ls            List Nginx templates (requires --server)
+    get <id>            Get Nginx template details (requires --server)
+    create              Create a Nginx template (requires --server --name --content)
+    update <id>         Update a Nginx template (requires --server)
+    delete <id>         Delete a Nginx template (requires --server)
+
+  security-rules      Manage site security rules
+    list, ls            List security rules (requires --server --site)
+    get <id>            Get security rule details (requires --server --site)
+    create              Create a security rule (requires --server --site --name)
+    delete <id>         Delete a security rule (requires --server --site)
+
+  redirect-rules      Manage site redirect rules
+    list, ls            List redirect rules (requires --server --site)
+    get <id>            Get redirect rule details (requires --server --site)
+    create              Create a redirect rule (requires --server --site --from --to)
+    delete <id>         Delete a redirect rule (requires --server --site)
+
+  recipes             Manage recipes
+    list, ls            List all recipes
+    get <id>            Get recipe details
+    run <id>            Run a recipe (requires --servers)
+
+  completion          Generate shell completion script
+    bash                Install Bash completion
+    zsh                 Install Zsh completion
+    fish                Install Fish completion
+
+${colors.bold("OPTIONS:")}
+  --token <token>     Forge API token (overrides config and env)
+  --server <id>       Server ID (required for server-scoped commands)
+  --site <id>         Site ID (required for site-scoped commands)
+  -f, --format <fmt>  Output format: json, human, table (default: human)
+  --no-color          Disable colored output
+  -h, --help          Show help
+  -v, --version       Show version
+
+${colors.bold("EXAMPLES:")}
+  # Configure API token
+  forge-cli config set YOUR_TOKEN
+
+  # Or pass token directly
+  forge-cli servers list --token YOUR_TOKEN
+
+  # List all servers
+  forge-cli servers list
+
+  # List sites on a server
+  forge-cli sites list --server 123
+
+  # Deploy a site
+  forge-cli deployments deploy --server 123 --site 456
+
+  # Get JSON output (for AI agents)
+  forge-cli servers list --format json
+
+${colors.bold("CREDENTIAL PRIORITY:")}
+  1. CLI argument (--token)
+  2. Environment variable (FORGE_API_TOKEN)
+  3. Config file (~/.config/forge-tools/config.json)
+
+${colors.bold("ENVIRONMENT VARIABLES:")}
+  FORGE_API_TOKEN    API token
+  NO_COLOR           Disable colors
+  XDG_CONFIG_HOME    Config directory (respects XDG spec)
+`);
+}
+async function main() {
+	const { command, options, positional } = parseArgs();
+	const [mainCommand, subcommand] = command;
+	const wantsHelp = options.help !== void 0 || options.h !== void 0;
+	if (wantsHelp && !mainCommand) {
+		showHelp();
+		process.exit(0);
+	}
+	if (options.version || options.v) {
+		console.log(VERSION);
+		process.exit(0);
+	}
+	if (options["no-color"]) setColorEnabled(false);
+	if (!mainCommand) {
+		showHelp();
+		process.exit(0);
+	}
+	try {
+		switch (mainCommand) {
+			case "config":
+				if (wantsHelp) {
+					showConfigHelp();
+					process.exit(0);
+				}
+				handleConfigCommand(subcommand ?? "get", positional, options);
+				break;
+			case "servers":
+			case "s":
+				if (wantsHelp) {
+					showServersHelp(subcommand);
+					process.exit(0);
+				}
+				await handleServersCommand(subcommand ?? "list", positional, options);
+				break;
+			case "sites":
+				if (wantsHelp) {
+					showSitesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleSitesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "deployments":
+			case "d":
+				if (wantsHelp) {
+					showDeploymentsHelp(subcommand);
+					process.exit(0);
+				}
+				await handleDeploymentsCommand(subcommand ?? "list", positional, options);
+				break;
+			case "databases":
+			case "db":
+				if (wantsHelp) {
+					showDatabasesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleDatabasesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "database-users":
+				if (wantsHelp) {
+					showDatabaseUsersHelp(subcommand);
+					process.exit(0);
+				}
+				await handleDatabaseUsersCommand(subcommand ?? "list", positional, options);
+				break;
+			case "daemons":
+				if (wantsHelp) {
+					showDaemonsHelp(subcommand);
+					process.exit(0);
+				}
+				await handleDaemonsCommand(subcommand ?? "list", positional, options);
+				break;
+			case "env":
+				if (wantsHelp) {
+					showEnvHelp(subcommand);
+					process.exit(0);
+				}
+				await handleEnvCommand(subcommand ?? "get", positional, options);
+				break;
+			case "nginx":
+				if (wantsHelp) {
+					showNginxHelp(subcommand);
+					process.exit(0);
+				}
+				await handleNginxCommand(subcommand ?? "get", positional, options);
+				break;
+			case "certificates":
+			case "certs":
+				if (wantsHelp) {
+					showCertificatesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleCertificatesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "firewall-rules":
+			case "fw":
+				if (wantsHelp) {
+					showFirewallRulesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleFirewallRulesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "ssh-keys":
+				if (wantsHelp) {
+					showSshKeysHelp(subcommand);
+					process.exit(0);
+				}
+				await handleSshKeysCommand(subcommand ?? "list", positional, options);
+				break;
+			case "backups":
+				if (wantsHelp) {
+					showBackupsHelp(subcommand);
+					process.exit(0);
+				}
+				await handleBackupsCommand(subcommand ?? "list", positional, options);
+				break;
+			case "commands":
+				if (wantsHelp) {
+					showCommandsHelp(subcommand);
+					process.exit(0);
+				}
+				await handleCommandsCommand(subcommand ?? "list", positional, options);
+				break;
+			case "scheduled-jobs":
+				if (wantsHelp) {
+					showScheduledJobsHelp(subcommand);
+					process.exit(0);
+				}
+				await handleScheduledJobsCommand(subcommand ?? "list", positional, options);
+				break;
+			case "user":
+				if (wantsHelp) {
+					showUserHelp(subcommand);
+					process.exit(0);
+				}
+				await handleUserCommand(subcommand ?? "get", positional, options);
+				break;
+			case "monitors":
+				if (wantsHelp) {
+					showMonitorsHelp(subcommand);
+					process.exit(0);
+				}
+				await handleMonitorsCommand(subcommand ?? "list", positional, options);
+				break;
+			case "nginx-templates":
+				if (wantsHelp) {
+					showNginxTemplatesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleNginxTemplatesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "security-rules":
+				if (wantsHelp) {
+					showSecurityRulesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleSecurityRulesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "redirect-rules":
+				if (wantsHelp) {
+					showRedirectRulesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleRedirectRulesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "recipes":
+				if (wantsHelp) {
+					showRecipesHelp(subcommand);
+					process.exit(0);
+				}
+				await handleRecipesCommand(subcommand ?? "list", positional, options);
+				break;
+			case "completion":
+				if (wantsHelp || !subcommand) {
+					showCompletionHelp();
+					process.exit(0);
+				}
+				handleCompletionCommand(subcommand, options);
+				break;
+			default:
+				console.error(colors.red(`Unknown command: ${mainCommand}`));
+				console.log(`Run ${colors.cyan("forge-cli --help")} for usage information`);
+				process.exit(1);
+		}
+	} catch (error) {
+		console.error(colors.red("Fatal error:"), error);
+		process.exit(1);
+	}
+}
+main().catch((error) => {
+	console.error(colors.red("Unhandled error:"), error);
+	process.exit(1);
+});
+
+//# sourceMappingURL=cli.js.map