@synteq/cli 0.2.0 → 1.1.1

package/dist/apps-support/paid-app.js

@@ -0,0 +1,195 @@
+import { ApiError } from "../api/errors.js";
+import { planCapReason } from "./plans.js";
+import { waitFor } from "../ui/wait.js";
+import { withSpinner } from "../ui/spinner.js";
+import { confirmAction, describePaymentMethod, pickFromCatalog, readBalance } from "../ui/wizard.js";
+import { ensurePaymentMethod } from "../ui/payment-gate.js";
+import { dim, ok } from "../ui/glyphs.js";
+/**
+ * Creating a PAID app is an order: the first month is quoted (tax
+ * included), a card is chosen, the charge is confirmed, and provisioning runs
+ * off the settled order. This mirrors the web's NewAppPayModal step for
+ * step; POST /apps only ever creates free-tier apps (the backend refuses a
+ * paid tier there with 402).
+ */
+/** The tiers a team can still create an app on — a tier at its per-team
+ *  cap is not offered at all (not greyed out: there is nothing to do with
+ *  it). Empty means every tier is full for this team. */
+export function pickablePlans(plans) {
+    return plans.filter((p) => planCapReason(p) === undefined);
+}
+/** The price, shown BEFORE any question about credits or cards (owner,
+ *  2026-09-23): the customer sees what the first month costs, then decides
+ *  how to pay it. `degraded` = the tax engine did not answer, so the total
+ *  is the plan's anchor and tax lands on the invoice. */
+export function priceLine(q) {
+    const money = (n) => `$${n.toFixed(2)}${q.currency && q.currency !== "USD" ? ` ${q.currency}` : ""}`;
+    const tax = q.degraded
+        ? " + tax (estimate unavailable; the final total is on the invoice)"
+        : q.taxTotal > 0
+            ? ` (incl. ${money(q.taxTotal)} ${q.taxLabel})`
+            : "";
+    return `First month of ${q.slug} on ${q.planName}: ${money(q.total)}${tax}`;
+}
+/** The one line the customer confirms before being charged: the price first,
+ *  then exactly where the money comes from. "Charge $0.00 … from your credit
+ *  balance" read as nonsense (Ben, 2026-10-06), so a credit-covered month
+ *  says what is used and that no card is touched. */
+export function chargeLine(q) {
+    const money = (n) => `$${n.toFixed(2)}${q.currency && q.currency !== "USD" ? ` ${q.currency}` : ""}`;
+    const tax = q.taxTotal > 0 ? ` (incl. ${money(q.taxTotal)} ${q.taxLabel})` : "";
+    const price = `First month of ${q.slug} on ${q.planName}: ${money(q.total)}${tax}.`;
+    const credit = Math.min(Math.max(0, q.creditsApplied), q.total);
+    const due = q.total - credit;
+    const card = q.method ? describePaymentMethod(q.method) : "your payment method";
+    if (due <= 0)
+        return `${price} Use ${money(credit)} of your credit balance — nothing is charged to a card?`;
+    if (credit > 0)
+        return `${price} Use ${money(credit)} credit and charge the remaining ${money(due)} to ${card}?`;
+    return `${price} Charge ${money(due)} to ${card}?`;
+}
+export class PaidAppOrderError extends Error {
+}
+export async function orderPaidApp(clients, input, opts) {
+    const { api } = clients;
+    const spec = { slug: input.slug, plan_tier: input.plan.name, region: input.region, project_id: input.projectId };
+    // 1. The first-month quote, tax included. A preview failure (tax engine
+    //    down, rate limit) must not block ordering: fall back to the tier's
+    //    anchor price and say the tax is not in it. A preview the API REFUSED
+    //    (4xx with a reason — the plan can't be ordered, the slug is taken,
+    //    the location is full) is not a degraded quote: surface it and stop,
+    //    or the customer is walked to a charge prompt for an order that will
+    //    be refused the same way (staging, 2026-09-23: a dedicated tier's 422
+    //    read as "Tax estimate unavailable" and the flow went on).
+    let total = Number(input.plan.monthlyAnchorUsd ?? 0);
+    let taxTotal = 0;
+    let taxLabel = "tax";
+    let currency = "USD";
+    let degraded = false;
+    try {
+        const q = await withSpinner("Pricing the first month", () => api.orders.preview({ kind: "app", spec }));
+        total = Number(q.total);
+        taxTotal = Number(q.tax_total ?? 0);
+        taxLabel = q.tax_label ?? "tax";
+        currency = q.currency ?? currency;
+        degraded = Boolean(q.estimate_degraded);
+    }
+    catch (e) {
+        if (e instanceof ApiError && e.status >= 400 && e.status < 500 && e.status !== 429) {
+            throw new Error(`Can't order ${input.plan.displayName ?? input.plan.name}: ${e.detail}`);
+        }
+        degraded = true;
+    }
+    // The price comes first, on its own line, before the credit and card
+    // questions — the questions are about how to pay an amount the customer
+    // has already seen, not the other way round.
+    opts.log(priceLine({
+        total, taxTotal, taxLabel, currency, degraded,
+        slug: input.slug, planName: input.plan.displayName ?? input.plan.name,
+    }));
+    // 2. Credits first, when the team has some and asked (or is asked).
+    const balance = await api.billing.balance().catch(() => ({}));
+    const credit = readBalance(balance.credit);
+    let applyCredits = Boolean(opts.applyCredits);
+    if (!applyCredits && credit > 0 && opts.interactive && !opts.yes) {
+        applyCredits = await confirmAction(`Apply your credit balance ($${credit.toFixed(2)}) first?`, true);
+    }
+    const creditsApplied = applyCredits ? Math.min(credit, total) : 0;
+    const coveredByCredit = applyCredits && credit >= total && total > 0;
+    // 3. A card the app_order touchpoint may charge — unless credit covers it.
+    let method;
+    if (!coveredByCredit) {
+        let rows = await api.payments.methodsForTouchpoint("app_order").catch(() => []);
+        let eligible = rows.filter((m) => m.eligible);
+        if (eligible.length === 0) {
+            // Same hand-off as the free tier: open the portal, wait, re-check.
+            await ensurePaymentMethod({
+                api,
+                apiBaseUrl: clients.config.get().api_base_url,
+                interactive: opts.interactive,
+                log: opts.log,
+                action: `charge the first month of ${input.slug}`,
+            });
+            rows = await api.payments.methodsForTouchpoint("app_order").catch(() => []);
+            eligible = rows.filter((m) => m.eligible);
+            if (eligible.length === 0) {
+                const why = rows.map((m) => m.ineligible_reason).filter(Boolean)[0];
+                throw new PaidAppOrderError(`No saved payment method can be charged for an app${why ? ` (${why})` : ""}. Add a card in the portal, then try again.`);
+            }
+        }
+        if (opts.paymentMethodId) {
+            method = rows.find((m) => m.id === opts.paymentMethodId);
+            if (!method)
+                throw new PaidAppOrderError(`Payment method ${opts.paymentMethodId} is not on this team.`);
+            if (!method.eligible) {
+                throw new PaidAppOrderError(`Payment method ${opts.paymentMethodId} can't be charged for an app${method.ineligible_reason ? `: ${method.ineligible_reason}` : "."}`);
+            }
+        }
+        else if (!opts.interactive || opts.yes) {
+            method = eligible.find((m) => m.is_default) ?? eligible[0];
+        }
+        else {
+            const id = await pickFromCatalog("Charge which payment method?", rows.map((m) => ({
+                value: m.id,
+                name: describePaymentMethod(m),
+                disabled: m.eligible ? undefined : (m.ineligible_reason ?? "not allowed for apps"),
+            })), { defaultValue: (eligible.find((m) => m.is_default) ?? eligible[0]).id });
+            method = rows.find((m) => m.id === id);
+        }
+    }
+    // 4. Confirm the charge. Scripts pass --yes; a non-interactive run
+    //    without it must not charge silently.
+    const line = chargeLine({
+        total,
+        taxTotal,
+        taxLabel,
+        currency,
+        slug: input.slug,
+        planName: input.plan.displayName ?? input.plan.name,
+        method,
+        creditsApplied,
+    });
+    if (!opts.yes) {
+        if (!opts.interactive) {
+            throw new PaidAppOrderError(`${line.replace(/\?$/, ".")}\nRe-run with --yes to confirm the charge.`);
+        }
+        if (!(await confirmAction(line, true)))
+            throw new PaidAppOrderError("Not charged; no app created.");
+    }
+    else {
+        opts.log(dim(line.replace(/\?$/, ".")));
+    }
+    // 5. Order → settle → provision. The app row lands off the settled order.
+    const payment = coveredByCredit
+        ? { method: "credit_only" }
+        : { method: "saved", payment_method_id: method.id, apply_credits: applyCredits && credit > 0 };
+    const result = await withSpinner(`Charging and creating ${input.slug}`, () => api.orders.createApp(spec, payment));
+    if (result.checkout_url) {
+        throw new PaidAppOrderError(`This order needs hosted checkout: ${result.checkout_url}`);
+    }
+    if (result.status === "failed")
+        throw new PaidAppOrderError("The charge did not go through; no app created.");
+    const wait = await waitFor({
+        timeoutSeconds: opts.timeoutSeconds ?? 120,
+        poll: () => api.orders.status(result.order_id),
+        classify: (o) => {
+            const s = (o.status ?? "").toLowerCase();
+            if ((s === "complete" || s === "provisioned") && o.resource_id)
+                return { state: "success", label: `order ${s}` };
+            if (s === "failed" || s === "cancelled") {
+                return { state: "failure", label: `order ${s}`, reason: `Order ${s}: ${o.error_detail ?? "no detail from server"}` };
+            }
+            return { state: "pending", label: `order ${s || "pending"}` };
+        },
+        onStatus: (l) => opts.log(dim(`  ${l}`)),
+    });
+    if (wait.outcome === "timeout") {
+        throw new PaidAppOrderError(`Charged, but the app is still being created (order ${result.order_id}). It will appear in \`synteq app list\` shortly.`);
+    }
+    if (wait.outcome === "failure")
+        throw new PaidAppOrderError(wait.reason);
+    const app = await api.apps.get(wait.value.resource_id);
+    opts.log(ok(`Charged ${creditsApplied >= total && total > 0 ? "credit" : describePaymentMethod(method)} for the first month.`));
+    return app;
+}
+//# sourceMappingURL=paid-app.js.map

package/dist/apps-support/paid-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paid-app.js","sourceRoot":"","sources":["../../src/apps-support/paid-app.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;GAMG;AAEH;;yDAEyD;AACzD,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED;;;yDAGyD;AACzD,MAAM,UAAU,SAAS,CAAC,CAQzB;IACC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7G,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ;QACpB,CAAC,CAAC,kEAAkE;QACpE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC;YACd,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG;YAC/C,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;AAC9E,CAAC;AAED;;;qDAGqD;AACrD,MAAM,UAAU,UAAU,CAAC,CAS1B;IACC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7G,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAChF,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,GAAG,KAAK,QAAQ,KAAK,CAAC,MAAM,CAAC,yDAAyD,CAAC;IAC5G,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,QAAQ,KAAK,CAAC,MAAM,CAAC,oCAAoC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;IACjH,OAAO,GAAG,KAAK,WAAW,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,KAA0E,EAC1E,IAUC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACxB,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAEjH,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;IACrD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxG,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;QACpC,QAAQ,GAAG,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAChC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAClC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,qEAAqE;IACrE,wEAAwE;IACxE,6CAA6C;IAC7C,IAAI,CAAC,GAAG,CACN,SAAS,CAAC;QACR,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC7C,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI;KACtE,CAAC,CACH,CAAC;IAEF,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAA4B,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,WAAW,CAAE,OAAgC,CAAC,MAAM,CAAC,CAAC;IACrE,IAAI,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACjE,YAAY,GAAG,MAAM,aAAa,CAAC,+BAA+B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,YAAY,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC;IAErE,2EAA2E;IAC3E,IAAI,MAA4C,CAAC;IACjD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAgC,CAAC,CAAC;QAC9G,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,mEAAmE;YACnE,MAAM,mBAAmB,CAAC;gBACxB,GAAG;gBACH,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY;gBAC7C,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,6BAA6B,KAAK,CAAC,IAAI,EAAE;aAClD,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAgC,CAAC,CAAC;YAC1G,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,MAAM,IAAI,iBAAiB,CACzB,oDAAoD,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,6CAA6C,CACxH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,IAAI,CAAC,eAAe,uBAAuB,CAAC,CAAC;YACxG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,IAAI,CAAC,eAAe,+BAA+B,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CACxI,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACzC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,MAAM,eAAe,CAC9B,8BAA8B,EAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACf,KAAK,EAAE,CAAC,CAAC,EAAE;gBACX,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;gBAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,sBAAsB,CAAC;aACnF,CAAC,CAAC,EACH,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACzE,CAAC;YACF,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,0CAA0C;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC;QACtB,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI;QACnD,MAAM;QACN,cAAc;KACf,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,4CAA4C,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,0EAA0E;IAC1E,MAAM,OAAO,GAAqB,eAAe;QAC/C,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE;QAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAO,CAAC,EAAE,EAAE,aAAa,EAAE,YAAY,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,yBAAyB,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnH,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,gDAAgD,CAAC,CAAC;IAE9G,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,GAAG;QAC1C,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;YACjH,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,YAAY,IAAI,uBAAuB,EAAE,EAAE,CAAC;YACvH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,SAAS,EAAE,EAAE,CAAC;QAChE,CAAC;QACD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAiB,CACzB,sDAAsD,MAAM,CAAC,QAAQ,mDAAmD,CACzH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAY,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,cAAc,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjI,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/apps-support/plans.d.ts

@@ -0,0 +1,44 @@
+import type { AppLocation } from "../api/types.js";
+/**
+ * Plan and location helpers shared by the one-shot commands (`link`,
+ * `deploy`, `apps create`) and the TUI Deploy walkthrough — the TUI must
+ * not import from `commands/`.
+ */
+/** One-line plan description for the picker: resources + price (or "free")
+ *  + how much of the per-team cap is used. */
+export declare function planLine(p: {
+    isFree?: boolean;
+    cpuMillicores?: number;
+    memoryMib?: number;
+    monthlyAnchorUsd?: string | number;
+    maxAppsPerTeam?: number | null;
+    teamAppsOnTier?: number;
+}): string;
+/** A tier is unpickable when the team is at its per-team cap on it. Returns
+ *  the reason the picker shows in parens, or undefined when it can be chosen. */
+export declare function planCapReason(p: {
+    name?: string;
+    isFree?: boolean;
+    maxAppsPerTeam?: number | null;
+    teamAppsOnTier?: number;
+    /** Pro boxes (2026-09-23): a dedicated tier with no capacity right now. */
+    available?: boolean;
+    unavailableReason?: string | null;
+}): string | undefined;
+/** A paid tier is an ORDER (quote, card, charge); only a free tier is a bare
+ *  POST /apps. */
+export declare function isPaidPlan(p: {
+    name?: string;
+    isFree?: boolean;
+}): boolean;
+/** A location the picker offers; `region` is the value POSTed as the app's
+ *  region. Built from GET /apps/locations — the placeable clusters of THIS
+ *  environment — exactly like the web onboarding (NewAppSlideOver's
+ *  toLocationOptions): several clusters can share a datacenter, so dedupe on
+ *  the Location code; a cluster with no linked Location is not offerable. */
+export interface LocationOption {
+    code: string;
+    city: string;
+    region: string;
+}
+export declare function toLocationOptions(rows: AppLocation[]): LocationOption[];

package/dist/apps-support/plans.js

@@ -0,0 +1,43 @@
+/**
+ * Plan and location helpers shared by the one-shot commands (`link`,
+ * `deploy`, `apps create`) and the TUI Deploy walkthrough — the TUI must
+ * not import from `commands/`.
+ */
+/** One-line plan description for the picker: resources + price (or "free")
+ *  + how much of the per-team cap is used. */
+export function planLine(p) {
+    const cpu = p.cpuMillicores ? `${(p.cpuMillicores / 1000).toFixed(p.cpuMillicores % 1000 ? 1 : 0)} vCPU` : "";
+    const mem = p.memoryMib ? `${Math.round(p.memoryMib / 1024 * 10) / 10} GB` : "";
+    const price = p.isFree ? "free" : p.monthlyAnchorUsd != null ? `$${p.monthlyAnchorUsd}/mo` : "";
+    const cap = p.maxAppsPerTeam != null ? `${p.teamAppsOnTier ?? 0}/${p.maxAppsPerTeam} used` : "";
+    return [cpu, mem, price, cap].filter(Boolean).join(" · ");
+}
+/** A tier is unpickable when the team is at its per-team cap on it. Returns
+ *  the reason the picker shows in parens, or undefined when it can be chosen. */
+export function planCapReason(p) {
+    if (p.available === false)
+        return p.unavailableReason ?? "No capacity right now";
+    if (p.maxAppsPerTeam == null)
+        return undefined;
+    if ((p.teamAppsOnTier ?? 0) < p.maxAppsPerTeam)
+        return undefined;
+    return p.isFree || p.name === "free" ? "max free" : "max used";
+}
+/** A paid tier is an ORDER (quote, card, charge); only a free tier is a bare
+ *  POST /apps. */
+export function isPaidPlan(p) {
+    return !p.isFree && p.name !== "free";
+}
+export function toLocationOptions(rows) {
+    const out = [];
+    const seen = new Set();
+    for (const r of rows) {
+        const code = (r.code ?? "").trim();
+        if (!code || seen.has(code))
+            continue;
+        seen.add(code);
+        out.push({ code, city: (r.city ?? "").trim() || r.name, region: r.region });
+    }
+    return out;
+}
+//# sourceMappingURL=plans.js.map

package/dist/apps-support/plans.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plans.js","sourceRoot":"","sources":["../../src/apps-support/plans.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH;8CAC8C;AAC9C,MAAM,UAAU,QAAQ,CAAC,CAOxB;IACC,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,MAAM,GAAG,GACP,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,aAAa,CAAC,CAQ7B;IACC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC,iBAAiB,IAAI,uBAAuB,CAAC;IACjF,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AACjE,CAAC;AAED;kBACkB;AAClB,MAAM,UAAU,UAAU,CAAC,CAAsC;IAC/D,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;AACxC,CAAC;AAaD,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/apps-support/resolve.d.ts

@@ -0,0 +1,10 @@
+import { type ApiClient } from "../api/client.js";
+import type { App } from "../api/types.js";
+export declare function resolveApp(api: ApiClient, ref: string, projectId?: string): Promise<App>;
+/** The lists print the first 8 characters of an id; accept that (or any
+ *  unambiguous hex prefix of the id, dashes ignored) as a target. */
+export declare function isIdPrefix(ref: string): boolean;
+export declare function idPrefixMatches<T extends {
+    id: string;
+    slug: string;
+}>(rows: T[], ref: string, kind: string): T[];

package/dist/apps-support/resolve.js

@@ -0,0 +1,53 @@
+import { pageThrough } from "../api/client.js";
+/**
+ * Resolve an app reference (slug OR uuid) to a full App row for the active
+ * project. Commands take a friendly `<app>` slug; the API keys everything by
+ * uuid.
+ *
+ * A raw uuid is looked up directly via GET /apps/{id} (cheaper, and works for
+ * an app the active-project list wouldn't include). Anything else is asked
+ * of the server as `q=<slug>` (name / slug / hostname search, portal #419)
+ * and exact-matched here — GET /apps is paged (50 by default, 200 at most),
+ * so scanning one page read the 201st app as "not found". An id prefix is
+ * not something `q` searches, so that walks every page.
+ *
+ * Throws a plain Error whose message the command surfaces via `this.error`
+ * (exit 1) — resolution failure is a user error, not a network fault.
+ */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export async function resolveApp(api, ref, projectId) {
+    if (UUID_RE.test(ref)) {
+        // Direct lookup — the API 404s (→ ApiError) if it isn't ours.
+        return api.apps.get(ref);
+    }
+    const bySlug = await pageThrough((page) => api.apps.listPage(projectId, { q: ref, page }), (page) => page.items.some((a) => a.slug === ref));
+    let matches = bySlug.filter((a) => a.slug === ref);
+    if (matches.length === 0 && isIdPrefix(ref)) {
+        const all = await pageThrough((page) => api.apps.listPage(projectId, { page }));
+        matches = idPrefixMatches(all, ref, "app");
+    }
+    if (matches.length === 0) {
+        throw new Error(`No app named "${ref}" in the active project. Run \`synteq apps list\` to see available apps.`);
+    }
+    if (matches.length > 1) {
+        // Slugs are unique per active project so this is defensive; prefer newest.
+        matches.sort((a, b) => b.id.localeCompare(a.id));
+    }
+    return matches[0];
+}
+/** The lists print the first 8 characters of an id; accept that (or any
+ *  unambiguous hex prefix of the id, dashes ignored) as a target. */
+export function isIdPrefix(ref) {
+    return /^[0-9a-f]{6,31}$/i.test(ref);
+}
+export function idPrefixMatches(rows, ref, kind) {
+    if (!isIdPrefix(ref))
+        return [];
+    const want = ref.toLowerCase();
+    const hits = rows.filter((r) => r.id.replace(/-/g, "").toLowerCase().startsWith(want));
+    if (hits.length > 1) {
+        throw new Error(`"${ref}" matches ${hits.length} ${kind}s (${hits.map((r) => r.slug).join(", ")}); use the slug or a longer id.`);
+    }
+    return hits;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/apps-support/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/apps-support/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,kBAAkB,CAAC;AAG/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAc,EACd,GAAW,EACX,SAAkB;IAElB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,8DAA8D;QAC9D,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EACxD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CACjD,CAAC;IACF,IAAI,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,iBAAiB,GAAG,0EAA0E,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,2EAA2E;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,eAAe,CAAyC,IAAS,EAAE,GAAW,EAAE,IAAY;IAC1G,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,IAAI,GAAG,aAAa,IAAI,CAAC,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/apps-support/time.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Time bounds for `--from` / `--until` (and the TUI's log timeframe filter).
+ *
+ * A bound is either an ISO-8601 instant ("2026-09-12T16:00:00Z",
+ * "2026-09-12 16:00", a date alone = midnight UTC) or a relative age
+ * ("90m", "2h", "3d", "1w") meaning that long before now. Relative ages
+ * are what people actually type at a prompt; ISO is what scripts pass.
+ */
+/** Parse one bound. Returns null when the text is neither shape. */
+export declare function parseTimeBound(raw: string, now?: Date): Date | null;
+/** Both bounds at once, validated: from < until. Throws a plain Error with
+ *  the message a CLI or a prompt can show verbatim. */
+export declare function parseTimeframe(from: string | undefined, until: string | undefined, now?: Date): {
+    from?: string;
+    until?: string;
+};
+/** "16:04:09" in the viewer's zone, for a log line. */
+export declare function fmtClock(iso: string | undefined): string;
+/** "Sep 12 16:04" in the viewer's zone, for a release row. */
+export declare function fmtWhen(iso: string | undefined | null): string;

package/dist/apps-support/time.js

@@ -0,0 +1,82 @@
+/**
+ * Time bounds for `--from` / `--until` (and the TUI's log timeframe filter).
+ *
+ * A bound is either an ISO-8601 instant ("2026-09-12T16:00:00Z",
+ * "2026-09-12 16:00", a date alone = midnight UTC) or a relative age
+ * ("90m", "2h", "3d", "1w") meaning that long before now. Relative ages
+ * are what people actually type at a prompt; ISO is what scripts pass.
+ */
+const RELATIVE = /^(\d+(?:\.\d+)?)\s*([smhdw])$/i;
+const UNIT_MS = {
+    s: 1_000,
+    m: 60_000,
+    h: 3_600_000,
+    d: 86_400_000,
+    w: 604_800_000,
+};
+/** Parse one bound. Returns null when the text is neither shape. */
+export function parseTimeBound(raw, now = new Date()) {
+    const text = raw.trim();
+    if (!text)
+        return null;
+    const rel = RELATIVE.exec(text);
+    if (rel) {
+        const n = Number(rel[1]);
+        const unit = rel[2].toLowerCase();
+        if (!Number.isFinite(n) || n < 0)
+            return null;
+        return new Date(now.getTime() - n * UNIT_MS[unit]);
+    }
+    // "2026-09-12 16:00" → ISO's "T"; a bare date is midnight UTC, and a
+    // timestamp with no zone is read as UTC (the API's own rule for naive
+    // values), so what the user typed and what the server filtered on agree.
+    let iso = text.replace(" ", "T");
+    if (/^\d{4}-\d{2}-\d{2}$/.test(iso))
+        iso += "T00:00:00Z";
+    else if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/.test(iso))
+        iso += "Z";
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? null : d;
+}
+/** Both bounds at once, validated: from < until. Throws a plain Error with
+ *  the message a CLI or a prompt can show verbatim. */
+export function parseTimeframe(from, until, now = new Date()) {
+    const out = {};
+    let fromDate = null;
+    let untilDate = null;
+    if (from !== undefined) {
+        fromDate = parseTimeBound(from, now);
+        if (!fromDate)
+            throw new Error(`--from: "${from}" is not a timestamp (2026-09-12T16:00:00Z) or an age (90m, 2h, 3d).`);
+        out.from = fromDate.toISOString();
+    }
+    if (until !== undefined) {
+        untilDate = parseTimeBound(until, now);
+        if (!untilDate)
+            throw new Error(`--until: "${until}" is not a timestamp (2026-09-12T17:00:00Z) or an age (30m, 1h).`);
+        out.until = untilDate.toISOString();
+    }
+    if (fromDate && untilDate && untilDate <= fromDate) {
+        throw new Error("--until must be after --from.");
+    }
+    return out;
+}
+/** "16:04:09" in the viewer's zone, for a log line. */
+export function fmtClock(iso) {
+    if (!iso)
+        return "";
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime()))
+        return iso;
+    return d.toLocaleTimeString(undefined, { hour12: false });
+}
+/** "Sep 12 16:04" in the viewer's zone, for a release row. */
+export function fmtWhen(iso) {
+    if (!iso)
+        return "";
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime()))
+        return iso;
+    return d.toLocaleString(undefined, { month: "short", day: "numeric", hour: "2-digit", minute: "2-digit", hour12: false });
+}
+//# sourceMappingURL=time.js.map

package/dist/apps-support/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../src/apps-support/time.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,MAAM,OAAO,GAA2B;IACtC,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,WAAW;CACf,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAY,IAAI,IAAI,EAAE;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,qEAAqE;IACrE,sEAAsE;IACtE,yEAAyE;IACzE,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,IAAI,YAAY,CAAC;SACpD,IAAI,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,IAAI,GAAG,CAAC;IAClF,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,cAAc,CAC5B,IAAwB,EACxB,KAAyB,EACzB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,IAAI,QAAQ,GAAgB,IAAI,CAAC;IACjC,IAAI,SAAS,GAAgB,IAAI,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,sEAAsE,CAAC,CAAC;QACvH,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,kEAAkE,CAAC,CAAC;QACtH,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,QAAQ,IAAI,SAAS,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,QAAQ,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,OAAO,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,GAA8B;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,OAAO,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5H,CAAC"}

package/dist/auth/scope.js

@@ -30,6 +30,10 @@ export function scopeAllowsCommand(cmdScope, granted) {
     // Fail-closed: no label ⇒ treat as session-only.
     if (cmdScope === undefined || cmdScope === "none")
         return "deny-session-only";
+    // "any": the command has no scope of its own (`synteq api`, `synteq agents`)
+    // — any key may run it and the backend enforces scope per endpoint.
+    if (cmdScope === "any")
+        return "allow";
     if (granted === null)
         return "allow-unknown";
     return granted.has(cmdScope) ? "allow" : "deny-missing-scope";

package/dist/auth/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/auth/scope.ts"],"names":[],"mappings":"AAKA;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD;;;;;;;qEAOqE;AACrE,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjF,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;+EAE+E;AAC/E,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,OAAiB;IAEjB,iDAAiD;IACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,mBAAmB,CAAC;IAC9E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAiD,EACjD,IAAc,EACd,OAAiB;IAEjB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/C,yEAAyE;QACzE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,KAAa,EACb,QAAgB,EAChB,OAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC;QAC7B,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,CACL,GAAG,OAAO,IAAI,KAAK,oBAAoB,QAAQ,qCAAqC;QACpF,mBAAmB,IAAI,UAAU,OAAO,6CAA6C,CACtF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,KAAa;IACrE,OAAO,CACL,GAAG,OAAO,IAAI,KAAK,gEAAgE;QACnF,QAAQ,OAAO,8BAA8B,OAAO,6CAA6C,CAClG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,CACL,0FAA0F;QAC1F,QAAQ,OAAO,8BAA8B,OAAO,6CAA6C,CAClG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/auth/scope.ts"],"names":[],"mappings":"AAKA;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD;;;;;;;qEAOqE;AACrE,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjF,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED;;+EAE+E;AAC/E,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,OAAiB;IAEjB,iDAAiD;IACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,mBAAmB,CAAC;IAC9E,6EAA6E;IAC7E,oEAAoE;IACpE,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAiD,EACjD,IAAc,EACd,OAAiB;IAEjB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/C,yEAAyE;QACzE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,KAAa,EACb,QAAgB,EAChB,OAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC;QAC7B,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,CACL,GAAG,OAAO,IAAI,KAAK,oBAAoB,QAAQ,qCAAqC;QACpF,mBAAmB,IAAI,UAAU,OAAO,6CAA6C,CACtF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,KAAa;IACrE,OAAO,CACL,GAAG,OAAO,IAAI,KAAK,gEAAgE;QACnF,QAAQ,OAAO,8BAA8B,OAAO,6CAA6C,CAClG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,CACL,0FAA0F;QAC1F,QAAQ,OAAO,8BAA8B,OAAO,6CAA6C,CAClG,CAAC;AACJ,CAAC"}

package/dist/auth/tokens.d.ts

@@ -8,10 +8,13 @@ export interface Tokens {
 export interface TokenStoreOpts {
     filePath?: string;
     useKeychain?: boolean;
+    /** Named profile these credentials belong to; scopes the file + keychain slot. */
+    profile?: string;
 }
 export declare class TokenStore {
     private filePath;
     private useKeychain;
+    private account;
     constructor(opts?: TokenStoreOpts);
     read(): Promise<Tokens | null>;
     write(tokens: Tokens): Promise<void>;

package/dist/auth/tokens.js

@@ -6,14 +6,16 @@ const KEYCHAIN_ACCOUNT = "tokens";
 export class TokenStore {
     filePath;
     useKeychain;
+    account;
     constructor(opts = {}) {
-        this.filePath = opts.filePath ?? tokensFile();
+        this.filePath = opts.filePath ?? tokensFile(opts.profile);
+        this.account = opts.profile ? `${KEYCHAIN_ACCOUNT}-${opts.profile}` : KEYCHAIN_ACCOUNT;
         const envOptOut = process.env.SYNTEQ_NO_KEYCHAIN === "1";
         this.useKeychain = opts.useKeychain ?? !envOptOut;
     }
     async read() {
         if (this.useKeychain) {
-            const raw = await keychainGet(KEYCHAIN_ACCOUNT);
+            const raw = await keychainGet(this.account);
             if (raw) {
                 try {
                     return JSON.parse(raw);
@@ -33,7 +35,7 @@ export class TokenStore {
     }
     async write(tokens) {
         const payload = JSON.stringify(tokens);
-        if (this.useKeychain && (await keychainSet(KEYCHAIN_ACCOUNT, payload))) {
+        if (this.useKeychain && (await keychainSet(this.account, payload))) {
             rmSync(this.filePath, { force: true });
             return;
         }
@@ -44,7 +46,7 @@ export class TokenStore {
     async clear() {
         if (this.useKeychain) {
             try {
-                await keychainDelete(KEYCHAIN_ACCOUNT);
+                await keychainDelete(this.account);
             }
             catch {
             }

package/dist/auth/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzE,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAelC,MAAM,OAAO,UAAU;IACb,QAAQ,CAAS;IACjB,WAAW,CAAU;IAE7B,YAAY,OAAuB,EAAE;QACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;gBACnC,CAAC;gBAAC,MAAM,CAAC;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAW,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAc;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,WAAW,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;YACT,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;CACF"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzE,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAiBlC,MAAM,OAAO,UAAU;IACb,QAAQ,CAAS;IACjB,WAAW,CAAU;IACrB,OAAO,CAAS;IAExB,YAAY,OAAuB,EAAE;QACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACvF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;gBACnC,CAAC;gBAAC,MAAM,CAAC;gBACT,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAW,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAc;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;YACT,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/base/command.d.ts

@@ -1,5 +1,10 @@
 import { Command } from "@oclif/core";
 import { type Clients } from "../api/factory.js";
+/** Positional app target shared by the `app …` commands that act on one app. */
+export declare const appTargetArg: {
+    target: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+};
+import type { App } from "../api/types.js";
 export declare abstract class BaseCommand extends Command {
     static baseFlags: {
         output: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -9,9 +14,39 @@ export declare abstract class BaseCommand extends Command {
     protected outputFormat: "table" | "json";
     protected initClients(): Promise<void>;
     protected emit(data: unknown, renderTable: () => void): void;
+    /** An informational line. stdout in table mode; stderr in JSON mode, where
+     *  stdout carries the JSON document only (piped / `-o json` output must
+     *  parse). */
+    protected info(line: string): void;
+    /**
+     * The app-resolution dance every `app *` command shares: take an explicit
+     * `--app <slug|uuid>` or fall back to this directory's `synteq link`,
+     * rescope the client to the linked team, and resolve to a full App.
+     * Rescopes `this.clients` as a side effect (same as the inline blocks it
+     * replaces). A bad slug is a user error (exit 1); an API fault propagates
+     * to `this.fail`.
+     */
+    /**
+     * Commands with one required positional (a release ref, an env key, a
+     * hostname, a tier) also take the app as an optional LEADING positional:
+     * `app deployment show rackmap 1` and `app deployment show 1` both work.
+     * Returns [target, value]; errors when the value is missing.
+     */
+    protected positional(first: string | undefined, second: string | undefined, name: string): [string | undefined, string];
+    protected resolveLinkedApp(flags: {
+        app?: string;
+        team?: string;
+        insecure?: boolean;
+    }, target?: string): Promise<App>;
     protected failWith(detail: string, exit: number, status?: number, requestId?: string): never;
     protected catch(err: Error & {
         exitCode?: number;
     }): Promise<unknown>;
+    /** A finished command gives the shell back. Interactive prompts (inquirer,
+     *  clack) attach to stdin, and a TTY stdin that is left flowing or ref'd
+     *  keeps Node's event loop — and so the process — alive after the last line
+     *  of output, which reads as the CLI hanging. `run()` has resolved or thrown
+     *  by the time oclif calls this, so nothing still needs the keyboard. */
+    protected finally(err: Error | undefined): Promise<unknown>;
     protected fail(err: unknown): never;
 }