@synteq/cli 0.2.0 → 1.1.1

package/dist/commands/app/domain/add.js

@@ -0,0 +1,59 @@
+import { Args, Flags } from "@oclif/core";
+import { BaseCommand } from "../../../base/command.js";
+import { withSpinner } from "../../../ui/spinner.js";
+import { panel } from "../../../ui/wizard.js";
+import { ok, dim, statusColor } from "../../../ui/glyphs.js";
+import { ApiError } from "../../../api/errors.js";
+/** `synteq app domain add <hostname>` — attach a custom domain (returns the
+ *  DNS records to add). */
+export default class DomainAdd extends BaseCommand {
+    static apiKeyScope = "none";
+    static description = "Attach a custom domain to an app and print the DNS records to add for verification.";
+    static examples = [
+        "<%= config.bin %> app domain add api.example.com",
+        "<%= config.bin %> app domain add api.example.com --app my-api -o json",
+    ];
+    static args = {
+        target: Args.string({ required: false, description: "App slug or id (optional; default: the directory's linked app or --app)." }),
+        hostname: Args.string({ required: false, description: "The hostname to attach (e.g. api.example.com)." }),
+    };
+    static flags = {
+        app: Flags.string({ description: "App slug (or uuid) (default: the directory's linked app)." }),
+        "accept-fee": Flags.boolean({
+            default: false,
+            description: "Accept the plan's monthly custom-domain fee (required once, for the first custom domain on a plan that charges for them).",
+        }),
+    };
+    async run() {
+        await this.initClients();
+        const { args, flags } = await this.parse(DomainAdd);
+        const [target, hostname] = this.positional(args.target, args.hostname, "hostname");
+        try {
+            const app = await this.resolveLinkedApp(flags, target);
+            const d = await withSpinner("Attaching domain", () => this.clients.api.apps.addDomain(app.id, hostname, { acceptFee: flags["accept-fee"] })).catch((err) => {
+                // 402 = the first custom domain on a priced plan needs consent; the
+                // API's message names the fee. Point at the flag rather than dead-end.
+                if (err instanceof ApiError && err.status === 402) {
+                    this.error(`${err.detail}\n\nRe-run with --accept-fee to confirm.`, { exit: 1 });
+                }
+                throw err;
+            });
+            this.emit(d, () => {
+                this.log(ok(`Attached ${d.domain} to ${app.slug}.`));
+                this.log(panel("Verification", [["TLS", statusColor(d.tlsStatus)]]));
+                const records = d.dnsRecords ?? (d.routingRecord ? [d.routingRecord] : []);
+                if (records.length) {
+                    this.log(dim("\nAdd these DNS records at your registrar:"));
+                    for (const r of records) {
+                        this.log(`  ${(r.type ?? "").padEnd(6)} ${(r.name ?? "").padEnd(28)} ${r.value ?? ""}`);
+                    }
+                    this.log(dim(`\nThen: synteq app domain verify ${d.id} --app ${app.slug}`));
+                }
+            });
+        }
+        catch (err) {
+            this.fail(err);
+        }
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/commands/app/domain/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../../src/commands/app/domain/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD;2BAC2B;AAC3B,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,qFAAqF,CAAC;IAC3G,MAAM,CAAC,QAAQ,GAAG;QAChB,kDAAkD;QAClD,uEAAuE;KACxE,CAAC;IACF,MAAM,CAAC,IAAI,GAAG;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;QACjI,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;KAC1G,CAAC;IACF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;QAC/F,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;YAC1B,OAAO,EAAE,KAAK;YACd,WAAW,EACT,2HAA2H;SAC9H,CAAC;KACH,CAAC;IACF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,kBAAkB,EAAE,GAAG,EAAE,CACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CACtF,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACvB,oEAAoE;gBACpE,uEAAuE;gBACvE,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAClD,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,0CAA0C,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnF,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE;gBAChB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,MAAM,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrE,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC;oBAC5D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;wBACxB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC1F,CAAC;oBACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC"}

package/dist/commands/app/domain/list.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from "../../../base/command.js";
+/** `synteq app domain list` — custom + default domains attached to an app. */
+export default class DomainList extends BaseCommand {
+    static apiKeyScope: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        app: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/app/domain/list.js

@@ -0,0 +1,42 @@
+import { Flags } from "@oclif/core";
+import { BaseCommand, appTargetArg } from "../../../base/command.js";
+import { withSpinner } from "../../../ui/spinner.js";
+import { renderTable } from "../../../ui/table.js";
+import { statusColor, dim } from "../../../ui/glyphs.js";
+/** `synteq app domain list` — custom + default domains attached to an app. */
+export default class DomainList extends BaseCommand {
+    static apiKeyScope = "none";
+    static description = "List the domains attached to an app (default and custom), with TLS status.";
+    static examples = [
+        "<%= config.bin %> app domain list                # bare: linked app",
+        "<%= config.bin %> app domain list --app my-api",
+        "<%= config.bin %> app domain list --app my-api -o json",
+    ];
+    static args = { ...appTargetArg };
+    static flags = {
+        app: Flags.string({ description: "App slug (or uuid) (default: the directory's linked app)." }),
+    };
+    async run() {
+        await this.initClients();
+        const { args, flags } = await this.parse(DomainList);
+        try {
+            const app = await this.resolveLinkedApp(flags, args.target);
+            const domains = await withSpinner("Loading domains", () => this.clients.api.apps.domains(app.id));
+            this.emit(domains, () => {
+                if (domains.length === 0) {
+                    this.log("No domains.");
+                    return;
+                }
+                this.log(renderTable(["Domain", "TLS", "Role"], domains.map((d) => [
+                    d.domain,
+                    statusColor(d.tlsStatus),
+                    d.isPrimary ? "primary" : d.isDefault ? "default" : dim("custom"),
+                ])));
+            });
+        }
+        catch (err) {
+            this.fail(err);
+        }
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/app/domain/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/commands/app/domain/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAEzD,8EAA8E;AAC9E,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,4EAA4E,CAAC;IAClG,MAAM,CAAC,QAAQ,GAAG;QAChB,qEAAqE;QACrE,gDAAgD;QAChD,wDAAwD;KACzD,CAAC;IACF,MAAM,CAAC,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;IAClC,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;KAChG,CAAC;IACF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CACtC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,CACN,WAAW,CACT,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,EACzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACjB,CAAC,CAAC,MAAM;oBACR,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;oBACxB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;iBAClE,CAAC,CACH,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC"}

package/dist/commands/app/domain/remove.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from "../../../base/command.js";
+/** `synteq app domain remove <domain-id>` — detach a custom domain. */
+export default class DomainRemove extends BaseCommand {
+    static apiKeyScope: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        domainId: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        app: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/app/domain/remove.js

@@ -0,0 +1,51 @@
+import { Args, Flags } from "@oclif/core";
+import { BaseCommand } from "../../../base/command.js";
+import { withSpinner } from "../../../ui/spinner.js";
+import { ok } from "../../../ui/glyphs.js";
+import { isInteractive, confirmAction } from "../../../ui/wizard.js";
+/** `synteq app domain remove <domain-id>` — detach a custom domain. */
+export default class DomainRemove extends BaseCommand {
+    static apiKeyScope = "none";
+    static description = "Detach a custom domain from an app.";
+    static examples = [
+        "<%= config.bin %> app domain remove 01a05963...",
+        "<%= config.bin %> app domain remove 01a05963... --app my-api --yes      # no prompt (required when piped)",
+    ];
+    static args = {
+        target: Args.string({ required: false, description: "App slug or id (optional; default: the directory's linked app or --app)." }),
+        domainId: Args.string({ required: false, description: "Domain id (from `app domain list`)." }),
+    };
+    static flags = {
+        app: Flags.string({ description: "App slug (or uuid) (default: the directory's linked app)." }),
+        yes: Flags.boolean({
+            char: "y",
+            description: "Skip the confirmation prompt (required for non-interactive use).",
+        }),
+    };
+    async run() {
+        await this.initClients();
+        const { args, flags } = await this.parse(DomainRemove);
+        const [target, domainId] = this.positional(args.target, args.domainId, "domainId");
+        try {
+            const app = await this.resolveLinkedApp(flags, target);
+            if (!flags.yes) {
+                if (!(isInteractive() && this.outputFormat === "table")) {
+                    this.error("Refusing to detach a domain without --yes in a non-interactive session.", { exit: 1 });
+                }
+                const go = await confirmAction(`Detach domain ${domainId} from ${app.slug}?`);
+                if (!go) {
+                    this.log("Aborted.");
+                    return;
+                }
+            }
+            await withSpinner("Removing domain", () => this.clients.api.apps.removeDomain(app.id, domainId));
+            this.emit({ appId: app.id, domainId: domainId, removed: true }, () => {
+                this.log(ok(`Removed domain ${domainId} from ${app.slug}.`));
+            });
+        }
+        catch (err) {
+            this.fail(err);
+        }
+    }
+}
+//# sourceMappingURL=remove.js.map

package/dist/commands/app/domain/remove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove.js","sourceRoot":"","sources":["../../../../src/commands/app/domain/remove.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAErE,uEAAuE;AACvE,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,WAAW;IACnD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,qCAAqC,CAAC;IAC3D,MAAM,CAAC,QAAQ,GAAG;QAChB,iDAAiD;QACjD,2GAA2G;KAC5G,CAAC;IACF,MAAM,CAAC,IAAI,GAAG;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;QACjI,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;KAC/F,CAAC;IACF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;QAC/F,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;YACjB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kEAAkE;SAChF,CAAC;KACH,CAAC;IACF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,CAAC;oBACxD,IAAI,CAAC,KAAK,CAAC,yEAAyE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACrG,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,iBAAiB,QAAQ,SAAS,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC9E,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,WAAW,CAAC,iBAAiB,EAAE,GAAG,EAAE,CACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CACrD,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE;gBACnE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,QAAQ,SAAS,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC"}

package/dist/commands/app/domain/verify.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from "../../../base/command.js";
+/** `synteq app domain verify <domain-id>` — re-check a custom domain's DNS. */
+export default class DomainVerify extends BaseCommand {
+    static apiKeyScope: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        domainId: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        app: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/app/domain/verify.js

@@ -0,0 +1,39 @@
+import { Args, Flags } from "@oclif/core";
+import { BaseCommand } from "../../../base/command.js";
+import { withSpinner } from "../../../ui/spinner.js";
+import { ok, yellow, statusColor } from "../../../ui/glyphs.js";
+/** `synteq app domain verify <domain-id>` — re-check a custom domain's DNS. */
+export default class DomainVerify extends BaseCommand {
+    static apiKeyScope = "none";
+    static description = "Re-check DNS/TLS for a custom domain after adding the required records.";
+    static examples = [
+        "<%= config.bin %> app domain verify 01a05963...",
+        "<%= config.bin %> app domain verify 01a05963... --app my-api -o json",
+    ];
+    static args = {
+        target: Args.string({ required: false, description: "App slug or id (optional; default: the directory's linked app or --app)." }),
+        domainId: Args.string({ required: false, description: "Domain id (from `app domain list`)." }),
+    };
+    static flags = {
+        app: Flags.string({ description: "App slug (or uuid) (default: the directory's linked app)." }),
+    };
+    async run() {
+        await this.initClients();
+        const { args, flags } = await this.parse(DomainVerify);
+        const [target, domainId] = this.positional(args.target, args.domainId, "domainId");
+        try {
+            const app = await this.resolveLinkedApp(flags, target);
+            const d = await withSpinner("Verifying domain", () => this.clients.api.apps.verifyDomain(app.id, domainId));
+            this.emit(d, () => {
+                const good = d.tlsStatus === "active" || d.tlsStatus === "issued" || d.tlsStatus === "ready";
+                this.log(good
+                    ? ok(`${d.domain} verified — TLS ${statusColor(d.tlsStatus)}.`)
+                    : yellow(`${d.domain} not verified yet — TLS ${statusColor(d.tlsStatus)}${d.failureReason ? ` (${d.failureReason})` : ""}.`));
+            });
+        }
+        catch (err) {
+            this.fail(err);
+        }
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/commands/app/domain/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/commands/app/domain/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,WAAW;IACnD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,yEAAyE,CAAC;IAC/F,MAAM,CAAC,QAAQ,GAAG;QAChB,iDAAiD;QACjD,sEAAsE;KACvE,CAAC;IACF,MAAM,CAAC,IAAI,GAAG;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;QACjI,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;KAC/F,CAAC;IACF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;KAChG,CAAC;IACF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,kBAAkB,EAAE,GAAG,EAAE,CACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CACrD,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE;gBAChB,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC;gBAC7F,IAAI,CAAC,GAAG,CACN,IAAI;oBACF,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,mBAAmB,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC;oBAC/D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,2BAA2B,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAC/H,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC"}

package/dist/commands/app/env/add.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from "../../../base/command.js";
+/** `synteq app env add KEY=VALUE` — set an env var on an app. Value is
+ *  write-only (encrypted at rest, never returned). */
+export default class AppEnvAdd extends BaseCommand {
+    static apiKeyScope: string;
+    /** `synteq env set` lived at the root until 2026-10-06; `app env set` reads naturally too. */
+    static hiddenAliases: string[];
+    static description: string;
+    static examples: string[];
+    static args: {
+        target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        assignment: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        app: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        scope: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        kind: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        note: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        rollout: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/app/env/add.js

@@ -0,0 +1,103 @@
+import { Args, Flags } from "@oclif/core";
+import { BaseCommand } from "../../../base/command.js";
+import { ok, dim } from "../../../ui/glyphs.js";
+import { isInteractive, promptString, promptSecret } from "../../../ui/wizard.js";
+import { autoRollout, pickRollout, rolloutFlag, rolloutNote } from "../../../apps-support/env-rollout.js";
+/** `synteq app env add KEY=VALUE` — set an env var on an app. Value is
+ *  write-only (encrypted at rest, never returned). */
+export default class AppEnvAdd extends BaseCommand {
+    static apiKeyScope = "none";
+    /** `synteq env set` lived at the root until 2026-10-06; `app env set` reads naturally too. */
+    static hiddenAliases = ["app:env:set", "env:set"];
+    static description = [
+        "Set an environment variable on an app (value is write-only; use `env rm` to remove one).",
+        "",
+        "Run bare on a terminal to be asked for the key, the value and what to roll out.",
+        "Otherwise the change rolls out automatically after a ~2 min quiet window;",
+        "--rollout now / deploy / none overrides that.",
+    ].join("\n");
+    static examples = [
+        "<%= config.bin %> app env add                          # interactive: key, value, rollout",
+        "<%= config.bin %> app env add PORT=8080                # bare: linked app, auto rollout",
+        "<%= config.bin %> app env add PORT=8080 --rollout now  # replace running instances right away",
+        "<%= config.bin %> app env add NODE_ENV=production --scope build --rollout deploy   # build-time var: new build from this directory",
+        "<%= config.bin %> app env add PUBLIC_URL=https://example.com --kind config        # config: reveal shows it in full",
+        '<%= config.bin %> app env add "API_KEY=sk-abc" --app my-api --rollout none   # batch several, then `synteq deploy`',
+        "<%= config.bin %> app env add LOG_LEVEL=debug --app my-api -o json",
+    ];
+    static args = {
+        target: Args.string({ required: false, description: "App slug or id (optional; default: the directory's linked app or --app)." }),
+        assignment: Args.string({
+            required: false,
+            description: "KEY=VALUE pair. Quote the whole thing if VALUE has spaces or special chars.",
+        }),
+    };
+    static flags = {
+        app: Flags.string({ description: "App slug (or uuid) (default: the directory's linked app)." }),
+        scope: Flags.string({
+            options: ["runtime", "build", "both"],
+            description: "When the var applies: runtime, build, or both (default: runtime).",
+        }),
+        kind: Flags.string({
+            options: ["secret", "config"],
+            description: "secret (reveal is masked to the last 4 characters; a build-scoped one is mounted as a build secret) or config (reveal shows it in full; a build-scoped one is a plain build argument). Default: secret.",
+        }),
+        note: Flags.string({ description: "Optional note recorded alongside the var (max 500 chars)." }),
+        rollout: rolloutFlag,
+    };
+    async run() {
+        await this.initClients();
+        const { args, flags } = await this.parse(AppEnvAdd);
+        const prompt = args.target === undefined && isInteractive() && this.outputFormat === "table";
+        const [target, assignment] = prompt
+            ? [undefined, ""]
+            : this.positional(args.target, args.assignment, "KEY=VALUE (e.g. `synteq app env add PORT=8080`)");
+        try {
+            // Resolve first so a bad link fails before the user types anything.
+            const app = await this.resolveLinkedApp(flags, target);
+            // A build from cwd only builds this app when cwd is linked to it.
+            const canDeploy = this.clients.config.linkFor(process.cwd())?.app_id === app.id;
+            if (flags.rollout === "deploy" && !canDeploy) {
+                this.error(`--rollout deploy builds the current directory, which isn't linked to ${app.slug}. Run it from the app's directory.`, { exit: 1 });
+            }
+            let key;
+            let value;
+            if (prompt) {
+                key = (await promptString(`Variable name (${app.slug})`, {
+                    validate: (s) => (s.includes("=") ? "No '=' in the name." : true),
+                })).trim();
+                value = await promptSecret(`Value for ${key}`);
+            }
+            else {
+                const eq = assignment.indexOf("=");
+                if (eq <= 0)
+                    this.error("Provide KEY=VALUE (e.g. `app env add PORT=8080`).", { exit: 1 });
+                key = assignment.slice(0, eq).trim();
+                value = assignment.slice(eq + 1);
+                if (!key)
+                    this.error("Empty key. Provide KEY=VALUE.", { exit: 1 });
+            }
+            const mode = flags.rollout ?? (prompt ? await pickRollout(flags.scope ?? "runtime", canDeploy) : "auto");
+            const result = await this.clients.api.apps.setEnv(app.id, {
+                key,
+                value,
+                scope: flags.scope,
+                kind: flags.kind,
+                note: flags.note,
+                rollout: autoRollout(mode),
+            });
+            if (mode === "now")
+                await this.clients.api.apps.rolloutEnv(app.id);
+            this.emit({ ...result, rollout: mode }, () => {
+                this.log(ok(`Set ${result.key} (${result.scope}, ${result.kind ?? flags.kind ?? "secret"}) on ${app.slug}.`));
+                this.log(dim(`  ${rolloutNote(mode, "synteq deploy")}`));
+            });
+            if (mode === "deploy")
+                await this.config.runCommand("deploy", ["--app", app.slug, ...(this.outputFormat === "json" ? ["-o", "json"] : [])]);
+        }
+        catch (err) {
+            this.fail(err);
+        }
+    }
+}
+//# sourceMappingURL=add.js.map

package/dist/commands/app/env/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../../../src/commands/app/env/add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAoB,MAAM,sCAAsC,CAAC;AAE5H;sDACsD;AACtD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,8FAA8F;IAC9F,MAAM,CAAC,aAAa,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,WAAW,GAAG;QACnB,0FAA0F;QAC1F,EAAE;QACF,iFAAiF;QACjF,2EAA2E;QAC3E,+CAA+C;KAChD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,CAAC,QAAQ,GAAG;QAChB,2FAA2F;QAC3F,yFAAyF;QACzF,+FAA+F;QAC/F,oIAAoI;QACpI,qHAAqH;QACrH,oHAAoH;QACpH,oEAAoE;KACrE,CAAC;IACF,MAAM,CAAC,IAAI,GAAG;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;QACjI,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,6EAA6E;SAC3F,CAAC;KACH,CAAC;IACF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;QAC/F,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC;YACrC,WAAW,EAAE,mEAAmE;SACjF,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAC7B,WAAW,EACT,yMAAyM;SAC5M,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;QAChG,OAAO,EAAE,WAAW;KACrB,CAAC;IACF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,aAAa,EAAE,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC;QAC7F,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM;YACjC,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,iDAAiD,CAAC,CAAC;QACrG,IAAI,CAAC;YACH,oEAAoE;YACpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvD,kEAAkE;YAClE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAChF,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,wEAAwE,GAAG,CAAC,IAAI,oCAAoC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAChJ,CAAC;YACD,IAAI,GAAW,CAAC;YAChB,IAAI,KAAa,CAAC;YAClB,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC,kBAAkB,GAAG,CAAC,IAAI,GAAG,EAAE;oBACvD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACX,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,EAAE,IAAI,CAAC;oBAAE,IAAI,CAAC,KAAK,CAAC,mDAAmD,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1F,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACjC,IAAI,CAAC,GAAG;oBAAE,IAAI,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,IAAI,GAAI,KAAK,CAAC,OAAmC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACtI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBACxD,GAAG;gBACH,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE;gBAC3C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,QAAQ,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBAC9G,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9I,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC"}

package/dist/commands/app/env/list.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from "../../../base/command.js";
+/** `synteq app env list` — env vars on an app (keys + scope; values are
+ *  write-only and never returned). */
+export default class AppEnvList extends BaseCommand {
+    static apiKeyScope: string;
+    /** `synteq env list` lived at the root until 2026-10-06; kept as a hidden alias. */
+    static hiddenAliases: string[];
+    static description: string;
+    static examples: string[];
+    static args: {
+        target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        app: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/app/env/list.js

@@ -0,0 +1,40 @@
+import { Flags } from "@oclif/core";
+import { BaseCommand, appTargetArg } from "../../../base/command.js";
+import { withSpinner } from "../../../ui/spinner.js";
+import { renderTable } from "../../../ui/table.js";
+import { dim } from "../../../ui/glyphs.js";
+/** `synteq app env list` — env vars on an app (keys + scope; values are
+ *  write-only and never returned). */
+export default class AppEnvList extends BaseCommand {
+    static apiKeyScope = "none";
+    /** `synteq env list` lived at the root until 2026-10-06; kept as a hidden alias. */
+    static hiddenAliases = ["env:list"];
+    static description = "List an app's environment variables (keys and scope only — values are write-only).";
+    static examples = [
+        "<%= config.bin %> app env list                # bare: linked app",
+        "<%= config.bin %> app env list --app my-api -o json",
+    ];
+    static args = { ...appTargetArg };
+    static flags = {
+        app: Flags.string({ description: "App slug (or uuid) (default: the directory's linked app)." }),
+    };
+    async run() {
+        await this.initClients();
+        const { args, flags } = await this.parse(AppEnvList);
+        try {
+            const app = await this.resolveLinkedApp(flags, args.target);
+            const vars = await withSpinner("Loading env", () => this.clients.api.apps.env(app.id));
+            this.emit(vars, () => {
+                if (vars.length === 0) {
+                    this.log("No environment variables.");
+                    return;
+                }
+                this.log(renderTable(["Key", "Scope", "Value", "Note"], vars.map((v) => [v.key, v.scope, v.hasValue ? dim("set") : dim("(empty)"), v.note ?? ""])));
+            });
+        }
+        catch (err) {
+            this.fail(err);
+        }
+    }
+}
+//# sourceMappingURL=list.js.map

package/dist/commands/app/env/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/commands/app/env/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAE5C;sCACsC;AACtC,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,oFAAoF;IACpF,MAAM,CAAC,aAAa,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,CAAC,WAAW,GAAG,oFAAoF,CAAC;IAC1G,MAAM,CAAC,QAAQ,GAAG;QAChB,kEAAkE;QAClE,qDAAqD;KACtD,CAAC;IACF,MAAM,CAAC,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;IAClC,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;KAChG,CAAC;IACF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBACnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;oBACtC,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,CACN,WAAW,CACT,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EACjC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAC1F,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC"}

package/dist/commands/app/env/reveal.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from "../../../base/command.js";
+/** `synteq app env reveal KEY` — read one env var's stored value. A
+ *  `config` var comes back in full; a `secret` var comes back masked with
+ *  its tail visible (the server never returns a secret in plaintext). */
+export default class AppEnvReveal extends BaseCommand {
+    static apiKeyScope: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        key: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        app: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/app/env/reveal.js

@@ -0,0 +1,40 @@
+import { Args, Flags } from "@oclif/core";
+import { BaseCommand } from "../../../base/command.js";
+import { dim } from "../../../ui/glyphs.js";
+/** `synteq app env reveal KEY` — read one env var's stored value. A
+ *  `config` var comes back in full; a `secret` var comes back masked with
+ *  its tail visible (the server never returns a secret in plaintext). */
+export default class AppEnvReveal extends BaseCommand {
+    static apiKeyScope = "none";
+    static description = "Reveal an app environment variable's value (config vars in full; secrets masked to their tail).";
+    static examples = [
+        "<%= config.bin %> app env reveal DATABASE_URL              # bare: linked app",
+        "<%= config.bin %> app env reveal LOG_LEVEL --app my-api",
+        "<%= config.bin %> app env reveal LOG_LEVEL --app my-api -o json",
+    ];
+    static args = {
+        target: Args.string({ required: false, description: "App slug or id (optional; default: the directory's linked app or --app)." }),
+        key: Args.string({ required: false, description: "The variable's name, exactly as `app env list` shows it." }),
+    };
+    static flags = {
+        app: Flags.string({ description: "App slug (or uuid) (default: the directory's linked app)." }),
+    };
+    async run() {
+        await this.initClients();
+        const { args, flags } = await this.parse(AppEnvReveal);
+        const [target, key] = this.positional(args.target, args.key, "key");
+        try {
+            const app = await this.resolveLinkedApp(flags, target);
+            const result = await this.clients.api.apps.revealEnv(app.id, key);
+            this.emit(result, () => {
+                this.log(`${result.key}=${result.value}`);
+                if (/^\*+/.test(result.value))
+                    this.log(dim("Masked: this is a secret. Set it again to change it."));
+            });
+        }
+        catch (err) {
+            this.fail(err);
+        }
+    }
+}
+//# sourceMappingURL=reveal.js.map

package/dist/commands/app/env/reveal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reveal.js","sourceRoot":"","sources":["../../../../src/commands/app/env/reveal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAE5C;;yEAEyE;AACzE,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,WAAW;IACnD,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,iGAAiG,CAAC;IACvH,MAAM,CAAC,QAAQ,GAAG;QAChB,+EAA+E;QAC/E,yDAAyD;QACzD,iEAAiE;KAClE,CAAC;IACF,MAAM,CAAC,IAAI,GAAG;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;QACjI,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;KAC/G,CAAC;IACF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;KAChG,CAAC;IACF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBACrB,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACvG,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC"}

package/dist/commands/app/env/rm.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from "../../../base/command.js";
+/** `synteq app env rm KEY` — delete an env var from an app. */
+export default class AppEnvRm extends BaseCommand {
+    static apiKeyScope: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+        key: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        app: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/app/env/rm.js

@@ -0,0 +1,48 @@
+import { Args, Flags } from "@oclif/core";
+import { BaseCommand } from "../../../base/command.js";
+import { ok } from "../../../ui/glyphs.js";
+import { isInteractive, confirmAction } from "../../../ui/wizard.js";
+/** `synteq app env rm KEY` — delete an env var from an app. */
+export default class AppEnvRm extends BaseCommand {
+    static apiKeyScope = "none";
+    static description = "Delete an environment variable from an app.";
+    static examples = [
+        "<%= config.bin %> app env rm LOG_LEVEL                       # bare: linked app",
+        "<%= config.bin %> app env rm API_KEY --app my-api --yes      # no prompt (required when piped)",
+    ];
+    static args = {
+        target: Args.string({ required: false, description: "App slug or id (optional; default: the directory's linked app or --app)." }),
+        key: Args.string({ required: false, description: "The env var key to delete." }),
+    };
+    static flags = {
+        app: Flags.string({ description: "App slug (or uuid) (default: the directory's linked app)." }),
+        yes: Flags.boolean({
+            char: "y",
+            description: "Skip the confirmation prompt (required for non-interactive use).",
+        }),
+    };
+    async run() {
+        await this.initClients();
+        const { args, flags } = await this.parse(AppEnvRm);
+        const [target, key] = this.positional(args.target, args.key, "key");
+        try {
+            const app = await this.resolveLinkedApp(flags, target);
+            if (!flags.yes) {
+                if (!(isInteractive() && this.outputFormat === "table")) {
+                    this.error("Refusing to delete a variable without --yes in a non-interactive session.", { exit: 1 });
+                }
+                const go = await confirmAction(`Delete ${key} from ${app.slug}?`, false);
+                if (!go) {
+                    this.log("Aborted.");
+                    return;
+                }
+            }
+            await this.clients.api.apps.deleteEnv(app.id, key);
+            this.emit({ appId: app.id, key: key, removed: true }, () => this.log(ok(`Deleted ${key} from ${app.slug}.`)));
+        }
+        catch (err) {
+            this.fail(err);
+        }
+    }
+}
+//# sourceMappingURL=rm.js.map

package/dist/commands/app/env/rm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rm.js","sourceRoot":"","sources":["../../../../src/commands/app/env/rm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAErE,+DAA+D;AAC/D,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC/C,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,GAAG,6CAA6C,CAAC;IACnE,MAAM,CAAC,QAAQ,GAAG;QAChB,iFAAiF;QACjF,gGAAgG;KACjG,CAAC;IACF,MAAM,CAAC,IAAI,GAAG;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;QACjI,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;KACjF,CAAC;IACF,MAAM,CAAC,KAAK,GAAG;QACb,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;QAC/F,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;YACjB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,kEAAkE;SAChF,CAAC;KACH,CAAC;IACF,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,CAAC;oBACxD,IAAI,CAAC,KAAK,CAAC,2EAA2E,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvG,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,GAAG,SAAS,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;gBACzE,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CACzD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,GAAG,SAAS,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC"}

package/dist/commands/app/health.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from "../../base/command.js";
+/** `synteq app health` — probe the running app's health endpoint. */
+export default class AppHealth extends BaseCommand {
+    static apiKeyScope: string;
+    static description: string;
+    static examples: string[];
+    static args: {
+        target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        app: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}