@tinycloud-ai/tinycloud-cli 0.1.0

package/dist/main.js

@@ -0,0 +1,1943 @@
+#!/usr/bin/env node
+
+// ../cli/src/main.ts
+import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { basename, join as join5, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+
+// ../../packages/domain/src/ids.ts
+var lastRandom = new Uint8Array(10);
+
+// ../../packages/domain/src/errors.ts
+var ERROR_CODES = {
+  // Request/auth
+  UNAUTHENTICATED: 401,
+  AUTH_PROVIDER_REQUIRED: 501,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  CONFLICT: 409,
+  PRECONDITION_FAILED: 412,
+  VALIDATION_FAILED: 422,
+  PAYLOAD_TOO_LARGE: 413,
+  RATE_LIMITED: 429,
+  INTERNAL: 500,
+  // Manifest
+  MANIFEST_PARSE_FAILED: 422,
+  MANIFEST_SCHEMA_INVALID: 422,
+  MANIFEST_POLICY_VIOLATION: 422,
+  MANIFEST_UNSUPPORTED_API_VERSION: 422,
+  // Planning / provider
+  TARGET_INCOMPATIBLE: 422,
+  APPROVAL_REQUIRED: 409,
+  PLAN_EXPIRED: 409,
+  PLAN_STALE: 409,
+  PROVIDER_UNAVAILABLE: 503,
+  BUILD_FAILED: 422,
+  HEALTHCHECK_FAILED: 422,
+  // State
+  MIGRATION_CHECKSUM_CHANGED: 422,
+  MIGRATION_FAILED: 422,
+  MIGRATION_LOCKED: 409,
+  RESOURCE_LIMIT_EXCEEDED: 422,
+  // Lifecycle
+  APP_ARCHIVED: 409,
+  APP_SUSPENDED: 409,
+  DELETE_CONFIRMATION_REQUIRED: 412,
+  // Capabilities
+  CAPABILITY_NOT_GRANTED: 403,
+  CAPABILITY_CONSTRAINT_VIOLATED: 403,
+  CAPABILITY_INPUT_INVALID: 422,
+  EGRESS_DENIED: 403,
+  // CLI/agent
+  INTERACTION_REQUIRED: 412
+};
+var TinyError = class extends Error {
+  code;
+  remediation;
+  retryable;
+  details;
+  requestId;
+  constructor(code, message, options = {}) {
+    super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "TinyError";
+    this.code = code;
+    this.remediation = options.remediation ?? DEFAULT_REMEDIATION[code] ?? "No automatic remediation is available.";
+    this.retryable = options.retryable ?? RETRYABLE.has(code);
+    this.details = options.details ?? {};
+    if (options.requestId) this.requestId = options.requestId;
+  }
+  get httpStatus() {
+    return ERROR_CODES[this.code];
+  }
+  toJSON() {
+    const body = {
+      code: this.code,
+      message: this.message,
+      remediation: this.remediation,
+      retryable: this.retryable
+    };
+    if (this.requestId) body.requestId = this.requestId;
+    if (Object.keys(this.details).length > 0) body.details = this.details;
+    return { error: body };
+  }
+};
+var RETRYABLE = /* @__PURE__ */ new Set([
+  "RATE_LIMITED",
+  "INTERNAL",
+  "PROVIDER_UNAVAILABLE",
+  "MIGRATION_LOCKED"
+]);
+var DEFAULT_REMEDIATION = {
+  UNAUTHENTICATED: "Run `tiny login` and retry.",
+  AUTH_PROVIDER_REQUIRED: "Configure a trusted OIDC provider for this gateway.",
+  FORBIDDEN: "Ask an organization admin for the required role.",
+  APPROVAL_REQUIRED: "Ask an organization admin to approve the plan, then deploy again with the approved plan ID.",
+  PLAN_STALE: "Run `tiny plan` again; the manifest or policy changed since this plan was produced.",
+  MIGRATION_CHECKSUM_CHANGED: "Restore the original migration file and add a new migration instead.",
+  INTERACTION_REQUIRED: "Re-run interactively, or pass the flag named in details.missingInput.",
+  MANIFEST_SCHEMA_INVALID: "Fix the fields listed in details.issues and re-run `tiny validate`.",
+  TARGET_INCOMPATIBLE: "Choose a runtime target that supports the manifest, or lower the requested resources.",
+  DELETE_CONFIRMATION_REQUIRED: "Re-run with the exact app slug as confirmation."
+};
+function isTinyError(value) {
+  return value instanceof TinyError;
+}
+
+// ../../packages/domain/src/duration.ts
+var UNIT_MS = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
+var PATTERN = /^([1-9][0-9]*)(s|m|h|d)$/;
+function parseDuration(value) {
+  const match = PATTERN.exec(value);
+  if (!match) {
+    throw new TinyError("VALIDATION_FAILED", `Invalid duration "${value}".`, {
+      remediation: "Use a positive integer followed by s, m, h, or d (for example 60m or 90d).",
+      details: { value }
+    });
+  }
+  return Number(match[1]) * UNIT_MS[match[2]];
+}
+
+// ../../packages/domain/src/entities.ts
+var DEFAULT_ORGANIZATION_POLICY = {
+  allowPublicApps: false,
+  allowRawSecrets: true,
+  requireApprovalForCapabilities: true,
+  requireApprovalForRawSecrets: true,
+  maxAppsPerOrg: 500,
+  maxPreviewTtlHours: 168,
+  maxMemoryMiB: 2048,
+  maxMonthlyRequests: 1e5,
+  maxMonthlyRequestsPerApp: 0,
+  anonymousRequestsPerMinute: 600,
+  maxMonthlyCapabilityCalls: 1e4,
+  maxMonthlyEstimatedCostCents: 5e3,
+  reservedSlugs: ["api", "app", "apps", "admin", "dashboard", "gateway", "tiny", "www"]
+};
+
+// ../../packages/manifest-schema/src/index.ts
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// ../../packages/manifest-schema/src/jsonschema.ts
+var SUPPORTED = /* @__PURE__ */ new Set([
+  "$schema",
+  "$id",
+  "$ref",
+  "$defs",
+  "title",
+  "description",
+  "examples",
+  "default",
+  "type",
+  "const",
+  "enum",
+  "required",
+  "properties",
+  "additionalProperties",
+  "items",
+  "minItems",
+  "maxItems",
+  "uniqueItems",
+  "minimum",
+  "maximum",
+  "exclusiveMinimum",
+  "exclusiveMaximum",
+  "multipleOf",
+  "minLength",
+  "maxLength",
+  "pattern",
+  "format",
+  "minProperties",
+  "maxProperties",
+  "propertyNames",
+  "oneOf",
+  "anyOf",
+  "allOf",
+  "not"
+]);
+var FORMATS = {
+  email: /^[^\s@]+@[^\s@.]+(\.[^\s@.]+)+$/,
+  hostname: /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i,
+  date: /^\d{4}-\d{2}-\d{2}$/,
+  "date-time": /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/,
+  uri: /^[a-z][a-z0-9+.-]*:\S+$/i
+};
+function typeOf(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  if (Number.isInteger(value)) return "integer";
+  return typeof value;
+}
+function matchesType(value, type) {
+  const actual = typeOf(value);
+  if (type === "number") return actual === "number" || actual === "integer";
+  if (type === "integer") return actual === "integer";
+  return actual === type;
+}
+function deepEqual(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function escapePointer(token) {
+  return token.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+var SchemaValidator = class {
+  root;
+  constructor(root) {
+    this.root = root;
+    this.assertSupported(root, "#");
+  }
+  assertSupported(schema, at) {
+    if (typeof schema !== "object" || schema === null || Array.isArray(schema)) return;
+    for (const [key, value] of Object.entries(schema)) {
+      if (!SUPPORTED.has(key)) {
+        throw new Error(`Unsupported JSON Schema keyword "${key}" at ${at}.`);
+      }
+      if (key === "properties" || key === "$defs") {
+        for (const [name, sub] of Object.entries(value)) this.assertSupported(sub, `${at}/${key}/${name}`);
+      } else if (key === "oneOf" || key === "anyOf" || key === "allOf") {
+        value.forEach((sub, i) => this.assertSupported(sub, `${at}/${key}/${i}`));
+      } else if (key === "items" || key === "not" || key === "propertyNames" || key === "additionalProperties") {
+        this.assertSupported(value, `${at}/${key}`);
+      }
+    }
+  }
+  resolve(ref) {
+    if (!ref.startsWith("#/")) throw new Error(`Only local $ref is supported, got "${ref}".`);
+    let node = this.root;
+    for (const token of ref.slice(2).split("/")) {
+      node = node?.[token.replace(/~1/g, "/").replace(/~0/g, "~")];
+      if (node === void 0) throw new Error(`Unresolved $ref "${ref}".`);
+    }
+    return node;
+  }
+  validate(instance, schema = this.root, path = "") {
+    const issues = [];
+    this.check(instance, schema, path, issues);
+    return issues;
+  }
+  check(value, schema, path, issues) {
+    if (typeof schema.$ref === "string") {
+      this.check(value, this.resolve(schema.$ref), path, issues);
+      return;
+    }
+    if (schema.type !== void 0) {
+      const types = Array.isArray(schema.type) ? schema.type : [schema.type];
+      if (!types.some((t) => matchesType(value, t))) {
+        issues.push({ path, keyword: "type", message: `expected ${types.join(" or ")} but got ${typeOf(value)}` });
+        return;
+      }
+    }
+    if (schema.const !== void 0 && !deepEqual(value, schema.const)) {
+      issues.push({ path, keyword: "const", message: `must be ${JSON.stringify(schema.const)}` });
+    }
+    if (Array.isArray(schema.enum) && !schema.enum.some((option) => deepEqual(option, value))) {
+      issues.push({ path, keyword: "enum", message: `must be one of ${schema.enum.map((o) => JSON.stringify(o)).join(", ")}` });
+    }
+    if (typeof value === "string") this.checkString(value, schema, path, issues);
+    if (typeof value === "number") this.checkNumber(value, schema, path, issues);
+    if (Array.isArray(value)) this.checkArray(value, schema, path, issues);
+    else if (typeof value === "object" && value !== null) this.checkObject(value, schema, path, issues);
+    this.checkCombinators(value, schema, path, issues);
+  }
+  checkString(value, schema, path, issues) {
+    if (typeof schema.minLength === "number" && value.length < schema.minLength) {
+      issues.push({ path, keyword: "minLength", message: `must be at least ${schema.minLength} characters` });
+    }
+    if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
+      issues.push({ path, keyword: "maxLength", message: `must be at most ${schema.maxLength} characters` });
+    }
+    if (typeof schema.pattern === "string" && !new RegExp(schema.pattern, "u").test(value)) {
+      issues.push({ path, keyword: "pattern", message: `must match ${schema.pattern}` });
+    }
+    if (typeof schema.format === "string") {
+      const rule = FORMATS[schema.format];
+      if (rule && !rule.test(value)) {
+        issues.push({ path, keyword: "format", message: `must be a valid ${schema.format}` });
+      }
+    }
+  }
+  checkNumber(value, schema, path, issues) {
+    if (typeof schema.minimum === "number" && value < schema.minimum) {
+      issues.push({ path, keyword: "minimum", message: `must be >= ${schema.minimum}` });
+    }
+    if (typeof schema.maximum === "number" && value > schema.maximum) {
+      issues.push({ path, keyword: "maximum", message: `must be <= ${schema.maximum}` });
+    }
+    if (typeof schema.exclusiveMinimum === "number" && value <= schema.exclusiveMinimum) {
+      issues.push({ path, keyword: "exclusiveMinimum", message: `must be > ${schema.exclusiveMinimum}` });
+    }
+    if (typeof schema.exclusiveMaximum === "number" && value >= schema.exclusiveMaximum) {
+      issues.push({ path, keyword: "exclusiveMaximum", message: `must be < ${schema.exclusiveMaximum}` });
+    }
+    if (typeof schema.multipleOf === "number" && value % schema.multipleOf !== 0) {
+      issues.push({ path, keyword: "multipleOf", message: `must be a multiple of ${schema.multipleOf}` });
+    }
+  }
+  checkArray(value, schema, path, issues) {
+    if (typeof schema.minItems === "number" && value.length < schema.minItems) {
+      issues.push({ path, keyword: "minItems", message: `must contain at least ${schema.minItems} items` });
+    }
+    if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
+      issues.push({ path, keyword: "maxItems", message: `must contain at most ${schema.maxItems} items` });
+    }
+    if (schema.uniqueItems === true) {
+      const seen = new Set(value.map((item) => JSON.stringify(item)));
+      if (seen.size !== value.length) issues.push({ path, keyword: "uniqueItems", message: "must not contain duplicates" });
+    }
+    if (schema.items) {
+      value.forEach((item, i) => this.check(item, schema.items, `${path}/${i}`, issues));
+    }
+  }
+  checkObject(value, schema, path, issues) {
+    const keys = Object.keys(value);
+    if (Array.isArray(schema.required)) {
+      for (const key of schema.required) {
+        if (!(key in value)) issues.push({ path: `${path}/${escapePointer(key)}`, keyword: "required", message: "is required" });
+      }
+    }
+    if (typeof schema.maxProperties === "number" && keys.length > schema.maxProperties) {
+      issues.push({ path, keyword: "maxProperties", message: `must have at most ${schema.maxProperties} properties` });
+    }
+    if (typeof schema.minProperties === "number" && keys.length < schema.minProperties) {
+      issues.push({ path, keyword: "minProperties", message: `must have at least ${schema.minProperties} properties` });
+    }
+    const properties = schema.properties ?? {};
+    for (const key of keys) {
+      const childPath = `${path}/${escapePointer(key)}`;
+      if (schema.propertyNames) this.check(key, schema.propertyNames, childPath, issues);
+      const child = properties[key];
+      if (child) {
+        this.check(value[key], child, childPath, issues);
+      } else if (schema.additionalProperties === false) {
+        issues.push({ path: childPath, keyword: "additionalProperties", message: "is not a recognized field" });
+      } else if (typeof schema.additionalProperties === "object" && schema.additionalProperties !== null) {
+        this.check(value[key], schema.additionalProperties, childPath, issues);
+      }
+    }
+  }
+  checkCombinators(value, schema, path, issues) {
+    if (Array.isArray(schema.allOf)) {
+      for (const sub of schema.allOf) this.check(value, sub, path, issues);
+    }
+    if (Array.isArray(schema.anyOf)) {
+      const branches = schema.anyOf.map((sub) => this.validate(value, sub, path));
+      if (branches.every((b) => b.length > 0)) {
+        issues.push({ path, keyword: "anyOf", message: `did not match any allowed shape: ${branches.flat().map((i) => i.message).join("; ")}` });
+      }
+    }
+    if (Array.isArray(schema.oneOf)) {
+      const matches2 = schema.oneOf.filter((sub) => this.validate(value, sub, path).length === 0);
+      if (matches2.length !== 1) {
+        issues.push({ path, keyword: "oneOf", message: `must match exactly one allowed shape (matched ${matches2.length})` });
+      }
+    }
+    if (schema.not && this.validate(value, schema.not, path).length === 0) {
+      issues.push({ path, keyword: "not", message: "matched a forbidden shape" });
+    }
+  }
+};
+
+// ../../packages/manifest-schema/src/types.ts
+var MANIFEST_API_VERSION = "tinycloud.dev/v1alpha1";
+
+// ../../packages/manifest-schema/src/normalize.ts
+var MANIFEST_DEFAULTS = {
+  // The guest runs a full Node binary from a virtio disk. Below roughly
+  // 256Mi its text pages no longer fit in the guest page cache, and the
+  // guest kernel spends every scheduling slice re-reading them instead of
+  // running the app; 512Mi leaves headroom above that cliff. Firecracker
+  // faults guest memory in lazily, so the unused part of the ceiling is free.
+  memory: "512Mi",
+  cpuMillis: 50,
+  requestTimeout: "15s",
+  concurrency: 20,
+  packageManager: "npm",
+  buildOutput: "dist",
+  databaseName: "app",
+  migrationsDir: "migrations",
+  retention: "30d",
+  storageMaxSize: "1Gi",
+  previewTtl: "72h",
+  logRetention: "7d",
+  sampleRate: 0.05,
+  storageClass: "object"
+};
+function parseSize(value) {
+  const match = /^([1-9][0-9]*)(Mi|Gi)$/.exec(value);
+  if (!match) return 0;
+  return Number(match[1]) * (match[2] === "Gi" ? 1024 ** 3 : 1024 ** 2);
+}
+function memoryMiB(value) {
+  return Math.round(parseSize(value) / 1024 ** 2);
+}
+function inferLanguage(manifest) {
+  if (manifest.runtime.language) return manifest.runtime.language;
+  return manifest.runtime.entrypoint.endsWith(".py") ? "python" : "typescript";
+}
+function normalizeSubjects(manifest) {
+  const subjects = (manifest.access.subjects ?? []).map((subject) => {
+    const type = subject.user ? "user" : subject.group ? "group" : "serviceAccount";
+    const value = subject.user ?? subject.group ?? subject.serviceAccount;
+    return { type, value: type === "user" ? value.toLowerCase() : value, role: subject.role ?? "user" };
+  });
+  const owner = manifest.metadata.owner.toLowerCase();
+  if (!subjects.some((s) => s.type === "user" && s.value === owner)) {
+    subjects.unshift({ type: "user", value: owner, role: "admin" });
+  }
+  return subjects;
+}
+function normalizeManifest(manifest) {
+  const runtimeResources = manifest.runtime.resources ?? {};
+  const database = manifest.resources?.database ?? null;
+  const egress = manifest.network?.egress ?? {};
+  return {
+    apiVersion: MANIFEST_API_VERSION,
+    kind: "App",
+    metadata: {
+      name: manifest.metadata.name,
+      displayName: manifest.metadata.displayName ?? manifest.metadata.name,
+      description: manifest.metadata.description ?? null,
+      owner: manifest.metadata.owner.toLowerCase(),
+      labels: manifest.metadata.labels ?? {}
+    },
+    runtime: {
+      type: manifest.runtime.type,
+      language: inferLanguage(manifest),
+      entrypoint: manifest.runtime.entrypoint,
+      compatibilityDate: manifest.runtime.compatibilityDate ?? null,
+      resources: {
+        memoryMiB: memoryMiB(runtimeResources.memory ?? MANIFEST_DEFAULTS.memory),
+        cpuMillis: runtimeResources.cpuMillis ?? MANIFEST_DEFAULTS.cpuMillis,
+        requestTimeoutMs: parseDuration(runtimeResources.requestTimeout ?? MANIFEST_DEFAULTS.requestTimeout),
+        concurrency: runtimeResources.concurrency ?? MANIFEST_DEFAULTS.concurrency
+      }
+    },
+    build: {
+      command: manifest.build?.command ?? null,
+      output: manifest.build?.output ?? null,
+      packageManager: manifest.build?.packageManager ?? MANIFEST_DEFAULTS.packageManager,
+      // Production deploys require a lockfile unless explicitly opted out.
+      lockfileRequired: manifest.build?.lockfileRequired ?? true
+    },
+    access: {
+      visibility: manifest.access.visibility,
+      requireLogin: manifest.access.requireLogin ?? true,
+      subjects: normalizeSubjects(manifest)
+    },
+    resources: {
+      database: database ? {
+        engine: database.engine,
+        name: database.name ?? MANIFEST_DEFAULTS.databaseName,
+        migrations: database.migrations ?? MANIFEST_DEFAULTS.migrationsDir,
+        retentionMs: parseDuration(database.retention ?? MANIFEST_DEFAULTS.retention)
+      } : null,
+      storage: (manifest.resources?.storage ?? []).map((store) => ({
+        name: store.name,
+        class: store.class ?? MANIFEST_DEFAULTS.storageClass,
+        maxSizeBytes: parseSize(store.maxSize ?? MANIFEST_DEFAULTS.storageMaxSize),
+        retentionMs: parseDuration(store.retention ?? MANIFEST_DEFAULTS.retention)
+      }))
+    },
+    capabilities: (manifest.capabilities ?? []).map((capability) => ({
+      name: capability.name,
+      connection: capability.connection,
+      // Manifests may use concise names (`payments.read`) while the catalog
+      // and runtime use globally-qualified IDs (`stripe.payments.read`).
+      allow: capability.allow.map((operation) => operation.startsWith(`${capability.name}.`) ? operation : `${capability.name}.${operation}`).sort(),
+      constraints: capability.constraints ?? {}
+    })),
+    network: {
+      egress: {
+        // Default deny: an app gets no outbound network unless it asks (§10, §27).
+        mode: egress.mode ?? "deny",
+        allow: (egress.allow ?? []).map((rule) => ({
+          host: rule.host.toLowerCase(),
+          ports: rule.ports ?? [443]
+        }))
+      }
+    },
+    secrets: (manifest.secrets ?? []).map((secret) => ({
+      name: secret.name,
+      from: secret.from,
+      version: secret.version ?? "latest"
+    })),
+    lifecycle: {
+      sleepAfterMs: manifest.lifecycle.sleepAfter ? parseDuration(manifest.lifecycle.sleepAfter) : null,
+      archiveAfterUnusedMs: manifest.lifecycle.archiveAfterUnused ? parseDuration(manifest.lifecycle.archiveAfterUnused) : null,
+      deleteAfterArchivedMs: manifest.lifecycle.deleteAfterArchived ? parseDuration(manifest.lifecycle.deleteAfterArchived) : null,
+      previewTtlMs: parseDuration(manifest.lifecycle.previewTtl ?? MANIFEST_DEFAULTS.previewTtl)
+    },
+    observability: {
+      logLevel: manifest.observability?.logLevel ?? "info",
+      retentionMs: parseDuration(manifest.observability?.retention ?? MANIFEST_DEFAULTS.logRetention),
+      traces: { sampleRate: manifest.observability?.traces?.sampleRate ?? MANIFEST_DEFAULTS.sampleRate },
+      alerts: manifest.observability?.alerts ?? []
+    }
+  };
+}
+function canonicalize(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`).join(",")}}`;
+}
+
+// ../../packages/manifest-schema/src/semantic.ts
+var RESERVED_ENV_NAMES = /* @__PURE__ */ new Set([
+  "TINY_APP_ID",
+  "TINY_APP_SLUG",
+  "TINY_DEPLOYMENT_ID",
+  "TINY_ENVIRONMENT",
+  "TINY_ORG_ID",
+  "TINY_REQUEST_ID",
+  "TINY_TOKEN",
+  "TINY_API_URL",
+  "TINY_DATABASE_URL",
+  "TINY_STORAGE_ROOT",
+  "TINY_BROKER_URL"
+]);
+function validateSemantics(manifest, context = {}) {
+  const policy = context.policy ?? DEFAULT_ORGANIZATION_POLICY;
+  const issues = [];
+  const add = (path, message, keyword = "semantic") => issues.push({ path, message, keyword });
+  if (manifest.runtime.type === "worker" && manifest.runtime.language === "python") {
+    add("/runtime/language", "worker runtime supports only typescript and javascript");
+  }
+  if (manifest.runtime.resources.memoryMiB > policy.maxMemoryMiB) {
+    add("/runtime/resources/memory", `exceeds the organization limit of ${policy.maxMemoryMiB}Mi`);
+  }
+  if (manifest.access.visibility === "public" && !policy.allowPublicApps) {
+    add("/access/visibility", "public apps are not permitted by organization policy");
+  }
+  if (manifest.access.visibility !== "public" && !manifest.access.requireLogin) {
+    add("/access/requireLogin", "non-public apps must require login");
+  }
+  const seenSubjects = /* @__PURE__ */ new Set();
+  manifest.access.subjects.forEach((subject, index) => {
+    const key = `${subject.type}:${subject.value}`;
+    if (seenSubjects.has(key)) add(`/access/subjects/${index}`, `duplicate subject ${key}`);
+    seenSubjects.add(key);
+  });
+  if (policy.reservedSlugs.includes(manifest.metadata.name)) {
+    add("/metadata/name", `"${manifest.metadata.name}" is a reserved name`);
+  }
+  manifest.secrets.forEach((secret, index) => {
+    if (RESERVED_ENV_NAMES.has(secret.name)) {
+      add(`/secrets/${index}/name`, `"${secret.name}" collides with a reserved platform variable`);
+    }
+  });
+  const secretNames = /* @__PURE__ */ new Set();
+  manifest.secrets.forEach((secret, index) => {
+    if (secretNames.has(secret.name)) add(`/secrets/${index}/name`, `duplicate secret name "${secret.name}"`);
+    secretNames.add(secret.name);
+  });
+  if (manifest.secrets.length > 0 && !policy.allowRawSecrets) {
+    add("/secrets", "raw secret injection is disabled by organization policy");
+  }
+  const { sleepAfterMs, archiveAfterUnusedMs, deleteAfterArchivedMs, previewTtlMs } = manifest.lifecycle;
+  if (sleepAfterMs !== null && archiveAfterUnusedMs !== null && archiveAfterUnusedMs <= sleepAfterMs) {
+    add("/lifecycle/archiveAfterUnused", "must be longer than lifecycle.sleepAfter");
+  }
+  if (deleteAfterArchivedMs !== null && archiveAfterUnusedMs === null) {
+    add("/lifecycle/deleteAfterArchived", "requires lifecycle.archiveAfterUnused to be set");
+  }
+  if (previewTtlMs > policy.maxPreviewTtlHours * 36e5) {
+    add("/lifecycle/previewTtl", `exceeds the organization maximum of ${policy.maxPreviewTtlHours}h`);
+  }
+  const storageNames = /* @__PURE__ */ new Set();
+  manifest.resources.storage.forEach((store, index) => {
+    if (storageNames.has(store.name)) add(`/resources/storage/${index}/name`, `duplicate storage name "${store.name}"`);
+    storageNames.add(store.name);
+  });
+  const capabilityNames = /* @__PURE__ */ new Set();
+  manifest.capabilities.forEach((capability, index) => {
+    if (capabilityNames.has(capability.name)) {
+      add(`/capabilities/${index}/name`, `duplicate capability name "${capability.name}"`);
+    }
+    capabilityNames.add(capability.name);
+    for (const operation of capability.allow) {
+      if (operation.endsWith(".*") || operation.includes("request") && operation.includes("raw")) {
+        add(`/capabilities/${index}/allow`, `"${operation}" is too broad; grant named operations only`);
+      }
+    }
+  });
+  if (manifest.network.egress.mode === "deny" && manifest.network.egress.allow.length > 0) {
+    add("/network/egress/mode", 'set mode to "allowlist" to use network.egress.allow');
+  }
+  if (manifest.network.egress.mode === "allowlist" && manifest.network.egress.allow.length === 0) {
+    add("/network/egress/allow", "allowlist mode requires at least one allowed host");
+  }
+  if (context.sourceFiles) {
+    if (!manifest.build.command && !context.sourceFiles.includes(manifest.runtime.entrypoint)) {
+      add("/runtime/entrypoint", `"${manifest.runtime.entrypoint}" was not found in the uploaded source`);
+    }
+    const migrations = manifest.resources.database?.migrations;
+    if (migrations && !context.sourceFiles.some((file) => file.startsWith(`${migrations}/`))) {
+      add("/resources/database/migrations", `no migration files found under "${migrations}/"`);
+    }
+  }
+  return issues;
+}
+function manifestWarnings(manifest) {
+  const warnings = [];
+  if (manifest.secrets.length > 0) {
+    warnings.push(`This app receives ${manifest.secrets.length} raw secret(s). Prefer a capability grant where one exists.`);
+  }
+  if (manifest.lifecycle.archiveAfterUnusedMs === null) {
+    warnings.push("No lifecycle.archiveAfterUnused set; this app will never be recommended for archive.");
+  }
+  if (manifest.access.visibility === "organization" && manifest.access.subjects.length <= 1) {
+    warnings.push('Visibility is "organization": every member can open this app.');
+  }
+  if (manifest.build.command && !manifest.build.output) {
+    warnings.push("build.command is set without build.output; the whole source tree, including node_modules, will be deployed.");
+  }
+  if (manifest.build.command && !manifest.build.lockfileRequired) {
+    warnings.push("build.lockfileRequired is false; two deploys of the same source may install different dependencies.");
+  }
+  if (manifest.network.egress.mode === "allowlist") {
+    warnings.push(
+      `Direct egress to ${manifest.network.egress.allow.map((rule) => rule.host).join(", ")} bypasses the capability broker; the app holds any credential it needs for those hosts itself.`
+    );
+  }
+  return warnings;
+}
+
+// ../../packages/manifest-schema/src/yaml.ts
+function fail(message, line, remediation = "Fix the manifest and re-run `tiny validate`.") {
+  throw new TinyError("MANIFEST_PARSE_FAILED", `${message} (line ${line})`, {
+    remediation,
+    details: { line }
+  });
+}
+function stripComment(text) {
+  let quote = null;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === "\\" && quote === '"') i++;
+      else if (ch === quote) quote = null;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+    } else if (ch === "#" && (i === 0 || /\s/.test(text[i - 1]))) {
+      return text.slice(0, i);
+    }
+  }
+  return text;
+}
+function scan(source) {
+  const out = [];
+  const raw = source.split(/\r?\n/);
+  for (let i = 0; i < raw.length; i++) {
+    const original = raw[i];
+    if (original.includes("	")) {
+      fail("Tabs are not allowed for indentation", i + 1, "Indent with spaces only.");
+    }
+    const text = stripComment(original).trimEnd();
+    if (text.trim() === "") continue;
+    if (text.trim() === "---") continue;
+    if (text.trim() === "...") break;
+    out.push({ indent: original.length - original.trimStart().length, text: text.trim(), number: i + 1 });
+  }
+  return out;
+}
+function parseFlowScalar(token, line) {
+  const text = token.trim();
+  if (text === "") return null;
+  if (text.startsWith('"')) {
+    if (!text.endsWith('"') || text.length < 2) fail("Unterminated double-quoted string", line);
+    return JSON.parse(text);
+  }
+  if (text.startsWith("'")) {
+    if (!text.endsWith("'") || text.length < 2) fail("Unterminated single-quoted string", line);
+    return text.slice(1, -1).replaceAll("''", "'");
+  }
+  if (text.startsWith("[") || text.startsWith("{")) return parseFlowCollection(text, line);
+  if (text === "null" || text === "~") return null;
+  if (text === "true") return true;
+  if (text === "false") return false;
+  if (/^-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?$/.test(text)) return Number(text);
+  if (text.startsWith("*") || text.startsWith("&") || text.startsWith("!")) {
+    fail("Anchors, aliases, and tags are not supported in tiny.yaml", line, "Write the value inline.");
+  }
+  return text;
+}
+function splitFlow(body, line) {
+  const parts = [];
+  let depth = 0;
+  let quote = null;
+  let current = "";
+  for (let i = 0; i < body.length; i++) {
+    const ch = body[i];
+    if (quote) {
+      current += ch;
+      if (ch === "\\" && quote === '"') {
+        current += body[++i] ?? "";
+        continue;
+      }
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    if (ch === "[" || ch === "{") depth++;
+    if (ch === "]" || ch === "}") depth--;
+    if (ch === "," && depth === 0) {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (quote) fail("Unterminated string in flow collection", line);
+  if (depth !== 0) fail("Unbalanced brackets in flow collection", line);
+  if (current.trim() !== "") parts.push(current);
+  return parts;
+}
+function parseFlowCollection(text, line) {
+  if (text.startsWith("[")) {
+    if (!text.endsWith("]")) fail("Unterminated flow sequence", line);
+    return splitFlow(text.slice(1, -1), line).map((part) => parseFlowScalar(part, line));
+  }
+  if (!text.endsWith("}")) fail("Unterminated flow mapping", line);
+  const out = {};
+  for (const part of splitFlow(text.slice(1, -1), line)) {
+    const idx = part.indexOf(":");
+    if (idx === -1) fail('Flow mapping entry is missing ":"', line);
+    const key = String(parseFlowScalar(part.slice(0, idx), line));
+    if (key in out) fail(`Duplicate key "${key}"`, line);
+    out[key] = parseFlowScalar(part.slice(idx + 1), line);
+  }
+  return out;
+}
+function keySeparator(text) {
+  let quote = null;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === "\\" && quote === '"') i++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "[" || ch === "{") return -1;
+    if (ch === ":" && (i === text.length - 1 || text[i + 1] === " ")) return i;
+  }
+  return -1;
+}
+var Parser = class {
+  index = 0;
+  lines;
+  constructor(lines) {
+    this.lines = lines;
+  }
+  peek() {
+    return this.lines[this.index];
+  }
+  parseValue(indent) {
+    const line = this.peek();
+    if (!line || line.indent < indent) return null;
+    if (line.text.startsWith("- ") || line.text === "-") return this.parseSequence(line.indent);
+    return this.parseMapping(line.indent);
+  }
+  parseSequence(indent) {
+    const items = [];
+    for (; ; ) {
+      const line = this.peek();
+      if (!line || line.indent !== indent || !(line.text === "-" || line.text.startsWith("- "))) break;
+      const rest = line.text === "-" ? "" : line.text.slice(2).trim();
+      this.index++;
+      if (rest === "") {
+        items.push(this.parseValue(indent + 1));
+        continue;
+      }
+      const sep2 = keySeparator(rest);
+      if (sep2 !== -1) {
+        items.push(this.parseInlineMapping(line, rest, sep2, indent));
+      } else {
+        items.push(this.parseScalarOrBlock(rest, line));
+      }
+    }
+    return items;
+  }
+  parseInlineMapping(line, rest, sep2, indent) {
+    const map = {};
+    const key = String(parseFlowScalar(rest.slice(0, sep2), line.number));
+    const inlineValue = rest.slice(sep2 + 1).trim();
+    const childIndent = indent + 2;
+    if (inlineValue === "") {
+      map[key] = this.hasChildAt(childIndent) ? this.parseValue(childIndent) : null;
+    } else {
+      map[key] = this.parseScalarOrBlock(inlineValue, line);
+    }
+    const tail = this.parseMappingEntries(childIndent);
+    for (const [k, v] of Object.entries(tail)) {
+      if (k in map) fail(`Duplicate key "${k}"`, line.number);
+      map[k] = v;
+    }
+    return map;
+  }
+  hasChildAt(indent) {
+    const next = this.peek();
+    return next !== void 0 && next.indent >= indent;
+  }
+  parseMapping(indent) {
+    return this.parseMappingEntries(indent);
+  }
+  parseMappingEntries(indent) {
+    const map = {};
+    for (; ; ) {
+      const line = this.peek();
+      if (!line || line.indent < indent) break;
+      if (line.indent > indent) fail("Unexpected indentation", line.number, "Align keys of the same mapping to the same column.");
+      if (line.text.startsWith("- ")) break;
+      const sep2 = keySeparator(line.text);
+      if (sep2 === -1) fail(`Expected "key: value" but found "${line.text}"`, line.number);
+      const key = String(parseFlowScalar(line.text.slice(0, sep2), line.number));
+      if (key in map) fail(`Duplicate key "${key}"`, line.number, "Remove the repeated key.");
+      const inline = line.text.slice(sep2 + 1).trim();
+      this.index++;
+      if (inline === "") {
+        const next = this.peek();
+        map[key] = next && next.indent > indent ? this.parseValue(next.indent) : next && next.indent === indent && next.text.startsWith("- ") ? this.parseSequence(indent) : null;
+      } else {
+        map[key] = this.parseScalarOrBlock(inline, line);
+      }
+    }
+    return map;
+  }
+  /** Handle `|`/`>` block scalars; everything else is a flow scalar. */
+  parseScalarOrBlock(text, line) {
+    if (text !== "|" && text !== ">" && text !== "|-" && text !== ">-") {
+      return parseFlowScalar(text, line.number);
+    }
+    const folded = text.startsWith(">");
+    const chomp = text.endsWith("-");
+    const parts = [];
+    const baseIndent = this.peek()?.indent ?? 0;
+    while (this.peek() && this.peek().indent >= baseIndent && baseIndent > line.indent) {
+      parts.push(this.lines[this.index].text);
+      this.index++;
+    }
+    const body = folded ? parts.join(" ") : parts.join("\n");
+    return chomp ? body : body + (folded ? "" : "\n");
+  }
+  atEnd() {
+    return this.index >= this.lines.length;
+  }
+  currentLine() {
+    return this.peek()?.number ?? 0;
+  }
+};
+function parseYaml(source) {
+  const lines = scan(source);
+  if (lines.length === 0) {
+    throw new TinyError("MANIFEST_PARSE_FAILED", "The manifest is empty.", {
+      remediation: "Run `tiny init` to generate a starter tiny.yaml."
+    });
+  }
+  const parser = new Parser(lines);
+  const value = parser.parseValue(lines[0].indent);
+  if (!parser.atEnd()) fail("Trailing content after the document", parser.currentLine());
+  return value;
+}
+
+// ../../packages/manifest-schema/src/index.ts
+var SCHEMA_PATH = join(dirname(fileURLToPath(import.meta.url)), "..", "schema", "tiny.v1alpha1.json");
+var manifestSchema = JSON.parse(readFileSync(SCHEMA_PATH, "utf8"));
+var validator = null;
+function schemaValidator() {
+  validator ??= new SchemaValidator(manifestSchema);
+  return validator;
+}
+function formatIssues(issues) {
+  return issues.slice(0, 10).map((issue) => `${issue.path === "" ? "(root)" : issue.path} ${issue.message}`).join("; ");
+}
+function parseManifest(source, context = {}) {
+  const document = parseYaml(source);
+  if (typeof document !== "object" || document === null || Array.isArray(document)) {
+    throw new TinyError("MANIFEST_PARSE_FAILED", "tiny.yaml must contain a mapping at the top level.", {
+      remediation: "Run `tiny init` to generate a starter manifest."
+    });
+  }
+  const apiVersion = document.apiVersion;
+  if (apiVersion !== MANIFEST_API_VERSION) {
+    throw new TinyError("MANIFEST_UNSUPPORTED_API_VERSION", `Unsupported apiVersion ${JSON.stringify(apiVersion)}.`, {
+      remediation: `Set apiVersion to "${MANIFEST_API_VERSION}", or run \`tiny manifest upgrade\`.`,
+      details: { supported: [MANIFEST_API_VERSION], found: apiVersion ?? null }
+    });
+  }
+  const schemaIssues = schemaValidator().validate(document);
+  if (schemaIssues.length > 0) {
+    throw new TinyError("MANIFEST_SCHEMA_INVALID", `tiny.yaml failed schema validation: ${formatIssues(schemaIssues)}`, {
+      details: { issues: schemaIssues }
+    });
+  }
+  const manifest = document;
+  const normalized = normalizeManifest(manifest);
+  const semanticIssues = validateSemantics(normalized, context);
+  if (semanticIssues.length > 0) {
+    throw new TinyError("MANIFEST_POLICY_VIOLATION", `tiny.yaml violates platform or organization rules: ${formatIssues(semanticIssues)}`, {
+      remediation: "Fix the fields listed in details.issues, or ask an admin to change organization policy.",
+      details: { issues: semanticIssues }
+    });
+  }
+  return {
+    source,
+    manifest,
+    normalized,
+    sha256: manifestSha256(normalized),
+    warnings: manifestWarnings(normalized)
+  };
+}
+function manifestSha256(normalized) {
+  return createHash("sha256").update(canonicalize(normalized)).digest("hex");
+}
+function starterManifest(name, owner) {
+  return `apiVersion: ${MANIFEST_API_VERSION}
+kind: App
+
+metadata:
+  name: ${name}
+  owner: ${owner}
+
+runtime:
+  type: worker
+  language: typescript
+  entrypoint: src/index.ts
+
+access:
+  visibility: private
+  requireLogin: true
+
+lifecycle:
+  sleepAfter: 60m
+  archiveAfterUnused: 30d
+`;
+}
+
+// ../../packages/orchestrator/src/artifacts.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, readFileSync as readFileSync2, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname as dirname2, join as join2, normalize, relative, sep } from "node:path";
+var DEFAULT_IGNORES = [
+  ".git",
+  "node_modules",
+  ".tiny",
+  ".output",
+  "dist/.cache",
+  ".DS_Store",
+  ".env",
+  ".env.local",
+  ".env.production",
+  "*.pem",
+  "*.key",
+  "id_rsa",
+  ".venv",
+  "__pycache__",
+  ".pytest_cache",
+  ".turbo",
+  "coverage"
+];
+var SECRET_LOOKING = /(^|\/)(\.env(\..+)?|.*\.pem|.*\.key|id_rsa|credentials\.json|service-account.*\.json)$/i;
+var DEFAULT_LIMITS = {
+  maxFiles: 5e3,
+  maxTotalBytes: 50 * 1024 * 1024,
+  maxFileBytes: 10 * 1024 * 1024
+};
+function loadIgnores(root) {
+  const patterns = [...DEFAULT_IGNORES];
+  const file = join2(root, ".tinyignore");
+  if (existsSync(file)) {
+    for (const line of readFileSync2(file, "utf8").split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed && !trimmed.startsWith("#")) patterns.push(trimmed);
+    }
+  }
+  return patterns;
+}
+function matches(pattern, path) {
+  if (pattern.includes("*")) {
+    const rule = new RegExp(`^${pattern.split("*").map(escapeRegExp).join("[^/]*")}$`);
+    return path.split("/").some((segment) => rule.test(segment)) || rule.test(path);
+  }
+  return path === pattern || path.startsWith(`${pattern}/`) || path.split("/").includes(pattern);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function packSource(root, limits = DEFAULT_LIMITS) {
+  const ignores = loadIgnores(root);
+  const files = [];
+  const skippedSecrets = [];
+  let sizeBytes = 0;
+  const walk = (directory) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : 1)) {
+      const absolute = join2(directory, entry.name);
+      const path = relative(root, absolute).split(sep).join("/");
+      if (SECRET_LOOKING.test(path)) {
+        skippedSecrets.push(path);
+        continue;
+      }
+      if (ignores.some((pattern) => matches(pattern, path))) {
+        continue;
+      }
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        walk(absolute);
+        continue;
+      }
+      const size = statSync(absolute).size;
+      if (size > limits.maxFileBytes) {
+        throw new TinyError("RESOURCE_LIMIT_EXCEEDED", `File ${path} is larger than the ${limits.maxFileBytes} byte limit.`, {
+          remediation: "Add the file to .tinyignore, or store large assets in object storage instead.",
+          details: { path, size }
+        });
+      }
+      files.push(path);
+      sizeBytes += size;
+      if (files.length > limits.maxFiles || sizeBytes > limits.maxTotalBytes) {
+        throw new TinyError("RESOURCE_LIMIT_EXCEEDED", "Source upload exceeds the size limits for an app.", {
+          remediation: "Add build output and vendored dependencies to .tinyignore.",
+          details: { files: files.length, sizeBytes, limits }
+        });
+      }
+    }
+  };
+  walk(root);
+  const hash = createHash2("sha256");
+  for (const path of files) {
+    hash.update(path);
+    hash.update(readFileSync2(join2(root, path)));
+  }
+  return { files, sizeBytes, sha256: hash.digest("hex"), skippedSecrets };
+}
+function createArtifactUpload(sourceRoot, packed = packSource(sourceRoot)) {
+  return {
+    sha256: packed.sha256,
+    files: packed.files.map((path) => ({ path, content: readFileSync2(join2(sourceRoot, path)).toString("base64") }))
+  };
+}
+
+// ../../packages/resource-sqlite/src/index.ts
+import { DatabaseSync } from "node:sqlite";
+
+// ../../packages/runtime-provider/src/contract.ts
+import test from "node:test";
+
+// ../../packages/orchestrator/src/planner.ts
+var PLAN_TTL_MS = 15 * 60 * 1e3;
+
+// ../../packages/auth/src/tokens.ts
+var TOKEN_TTL = {
+  session: 60 * 60 * 12,
+  appUser: 60 * 4,
+  appWorkload: 60 * 10,
+  runtimeAgent: 60 * 15,
+  cli: 60 * 60 * 24 * 30
+};
+
+// ../../packages/orchestrator/src/data.ts
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+var DATA_LIMITS = {
+  maxSqlBytes: 1e5,
+  maxParameters: 256,
+  maxRows: 1e4,
+  maxResultBytes: 8 * 1024 * 1024,
+  transactionTtlMs: 15e3,
+  /**
+   * Postgres serves concurrent transactions from its pool. SQLite has exactly
+   * one writer per database, and pretending otherwise would just move the
+   * failure to a lock timeout in the middle of someone's request.
+   */
+  maxOpenTransactionsPerEnvironment: 4,
+  maxOpenTransactionsPerSqliteEnvironment: 1,
+  maxConcurrentStatementsPerEnvironment: 16
+};
+
+// ../../packages/orchestrator/src/storage.ts
+var STORAGE_LIMITS = {
+  maxObjectBytes: 32 * 1024 * 1024,
+  maxKeyBytes: 1024,
+  /** One listing page. A namespace may hold more; the reply says so. */
+  maxListKeys: 1e3,
+  maxConcurrentOperationsPerEnvironment: 16
+};
+
+// ../../packages/db/src/store.ts
+import { dirname as dirname3, join as join3 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// ../../packages/db/src/sqlite.ts
+import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+
+// ../../packages/db/src/store.ts
+var MIGRATIONS_DIR = join3(dirname3(fileURLToPath2(import.meta.url)), "..", "migrations");
+
+// ../cli/src/client.ts
+var ApiClient = class {
+  apiUrl;
+  token;
+  timeoutMs;
+  constructor(options) {
+    this.apiUrl = options.apiUrl.replace(/\/$/, "");
+    this.token = options.token;
+    this.timeoutMs = options.timeoutMs ?? 12e4;
+  }
+  async request(method, path, options = {}) {
+    const url = new URL(this.apiUrl + path);
+    for (const [key, value] of Object.entries(options.query ?? {})) {
+      if (value !== void 0) url.searchParams.set(key, String(value));
+    }
+    const headers = { accept: "application/json" };
+    if (this.token) headers.authorization = `Bearer ${this.token}`;
+    if (options.body !== void 0) headers["content-type"] = "application/json";
+    if (options.idempotencyKey) headers["idempotency-key"] = options.idempotencyKey;
+    let response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers,
+        ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch (error) {
+      throw new TinyError("PROVIDER_UNAVAILABLE", `Could not reach the control plane at ${this.apiUrl}.`, {
+        remediation: "Check that the API is running and that `tiny login --api` points at it.",
+        retryable: true,
+        cause: error
+      });
+    }
+    if (response.status === 204) return void 0;
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const error = payload.error;
+      throw new TinyError(error?.code ?? "INTERNAL", error?.message ?? `Request failed with ${response.status}.`, {
+        ...error?.remediation ? { remediation: error.remediation } : {},
+        ...error?.retryable !== void 0 ? { retryable: error.retryable } : {},
+        ...error?.details ? { details: error.details } : {},
+        ...response.headers.get("x-request-id") ? { requestId: response.headers.get("x-request-id") } : {}
+      });
+    }
+    return payload;
+  }
+  get(path, query) {
+    return this.request("GET", path, query ? { query } : {});
+  }
+  post(path, body, idempotencyKey) {
+    return this.request("POST", path, {
+      ...body !== void 0 ? { body } : {},
+      ...idempotencyKey ? { idempotencyKey } : {}
+    });
+  }
+  put(path, body) {
+    return this.request("PUT", path, body !== void 0 ? { body } : {});
+  }
+  del(path, query) {
+    return this.request("DELETE", path, query ? { query } : {});
+  }
+  uploadDirectory(directory) {
+    return this.post("/v1/artifacts", createArtifactUpload(directory));
+  }
+};
+
+// ../cli/src/config.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { dirname as dirname4, join as join4 } from "node:path";
+var EMPTY = { version: 1, current: null, profiles: {} };
+function configPath() {
+  return process.env.TINY_CONFIG ?? join4(homedir(), ".tiny", "credentials.json");
+}
+function loadConfig() {
+  const path = configPath();
+  if (!existsSync2(path)) return { ...EMPTY, profiles: {} };
+  try {
+    return JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    return { ...EMPTY, profiles: {} };
+  }
+}
+function saveConfig(config) {
+  const path = configPath();
+  mkdirSync2(dirname4(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+function currentProfile() {
+  const config = loadConfig();
+  if (!config.current) return null;
+  return config.profiles[config.current] ?? null;
+}
+function setProfile(name, credentials) {
+  const config = loadConfig();
+  config.profiles[name] = credentials;
+  config.current = name;
+  saveConfig(config);
+}
+function clearProfile(name) {
+  const config = loadConfig();
+  const target = name ?? config.current;
+  if (target) delete config.profiles[target];
+  if (config.current === target) config.current = Object.keys(config.profiles)[0] ?? null;
+  saveConfig(config);
+}
+
+// ../cli/src/deployments.ts
+var TERMINAL_STATUSES = ["ready", "failed", "superseded", "rolled_back"];
+var DEFAULT_WAIT_MS = 3e5;
+async function awaitDeployment(fetchDeployment, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_WAIT_MS;
+  const pollMs = options.pollMs ?? 500;
+  const deadline = Date.now() + timeoutMs;
+  let reported = "";
+  for (; ; ) {
+    const record = await fetchDeployment();
+    if (record.status !== reported) {
+      reported = record.status;
+      options.onStatus?.(record.status);
+    }
+    if (TERMINAL_STATUSES.includes(record.status)) return record;
+    if (Date.now() >= deadline) return null;
+    await new Promise((resolve2) => setTimeout(resolve2, pollMs));
+  }
+}
+function buildSummary(providerState) {
+  if (!providerState || typeof providerState.builtArtifactUri !== "string") return void 0;
+  return {
+    artifactUri: providerState.builtArtifactUri,
+    cached: providerState.buildCached === true,
+    durationMs: Number(providerState.buildMs ?? 0)
+  };
+}
+function describeBuild(summary) {
+  if (!summary) return null;
+  return summary.cached ? `Reused a cached build (${summary.artifactUri})` : `Built in ${(summary.durationMs / 1e3).toFixed(1)}s (${summary.artifactUri})`;
+}
+function describeFailure(record) {
+  const message = record?.errorDetail?.message;
+  if (typeof message === "string" && message !== "") return message;
+  return record?.errorCode ?? "no reason was recorded";
+}
+function failureRemediation(record) {
+  const remediation = record?.errorDetail?.remediation;
+  return typeof remediation === "string" && remediation !== "" ? remediation : "Read `tiny logs` for the failure, fix it, and deploy again.";
+}
+
+// ../cli/src/output.ts
+var CLI_API_VERSION = "cli.tinycloud.dev/v1";
+var EXIT = {
+  ok: 0,
+  error: 1,
+  usage: 2,
+  auth: 3,
+  validation: 4,
+  policy: 5,
+  notFound: 6,
+  interactionRequired: 7,
+  conflict: 8,
+  unavailable: 9
+};
+var EXIT_BY_CODE = {
+  UNAUTHENTICATED: EXIT.auth,
+  FORBIDDEN: EXIT.policy,
+  NOT_FOUND: EXIT.notFound,
+  CONFLICT: EXIT.conflict,
+  VALIDATION_FAILED: EXIT.validation,
+  MANIFEST_PARSE_FAILED: EXIT.validation,
+  MANIFEST_SCHEMA_INVALID: EXIT.validation,
+  MANIFEST_POLICY_VIOLATION: EXIT.policy,
+  MANIFEST_UNSUPPORTED_API_VERSION: EXIT.validation,
+  APPROVAL_REQUIRED: EXIT.policy,
+  PLAN_STALE: EXIT.conflict,
+  PLAN_EXPIRED: EXIT.conflict,
+  TARGET_INCOMPATIBLE: EXIT.validation,
+  INTERACTION_REQUIRED: EXIT.interactionRequired,
+  PROVIDER_UNAVAILABLE: EXIT.unavailable,
+  RATE_LIMITED: EXIT.unavailable,
+  DELETE_CONFIRMATION_REQUIRED: EXIT.interactionRequired
+};
+var Output = class {
+  json;
+  constructor(options) {
+    this.json = options.json;
+  }
+  /** Human-readable progress. Never written to stdout in JSON mode. */
+  progress(message) {
+    process.stderr.write(`${message}
+`);
+  }
+  step(ok, message) {
+    process.stderr.write(`${ok ? "\u2713" : "\u2717"} ${message}
+`);
+  }
+  warn(message) {
+    process.stderr.write(`! ${message}
+`);
+  }
+  /** Terminal success output. Exactly one JSON object in `--json` mode. */
+  result(payload, human) {
+    if (this.json) {
+      process.stdout.write(`${JSON.stringify({ apiVersion: CLI_API_VERSION, ok: true, ...payload }, null, 2)}
+`);
+      return;
+    }
+    human();
+  }
+  fail(error) {
+    if (isTinyError(error)) {
+      const body = {
+        apiVersion: CLI_API_VERSION,
+        ok: false,
+        error: {
+          code: error.code,
+          message: error.message,
+          remediation: error.remediation,
+          retryable: error.retryable,
+          details: error.details
+        }
+      };
+      if (this.json) process.stdout.write(`${JSON.stringify(body, null, 2)}
+`);
+      else {
+        process.stderr.write(`
+\u2717 ${error.code}: ${error.message}
+`);
+        process.stderr.write(`  \u2192 ${error.remediation}
+`);
+        const next = error.details.nextActions;
+        if (Array.isArray(next)) for (const action of next) process.stderr.write(`  \u2192 ${String(action)}
+`);
+      }
+      process.exit(EXIT_BY_CODE[error.code] ?? EXIT.error);
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    if (this.json) process.stdout.write(`${JSON.stringify({ apiVersion: CLI_API_VERSION, ok: false, error: { code: "INTERNAL", message } }, null, 2)}
+`);
+    else process.stderr.write(`
+\u2717 ${message}
+`);
+    process.exit(EXIT.error);
+  }
+};
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+
+// ../cli/src/main.ts
+function parseArgs(argv) {
+  const positional = [];
+  const flags = {};
+  for (let index = 0; index < argv.length; index++) {
+    const token = argv[index];
+    if (token.startsWith("--")) {
+      const [name, inline] = token.slice(2).split("=");
+      if (inline !== void 0) flags[name] = inline;
+      else if (argv[index + 1] && !argv[index + 1].startsWith("-")) flags[name] = argv[++index];
+      else flags[name] = true;
+    } else {
+      positional.push(token);
+    }
+  }
+  const [command = "help", ...rest] = positional;
+  const grouped = /* @__PURE__ */ new Set(["access", "secrets", "capabilities", "preview", "org"]);
+  return {
+    command,
+    subcommand: grouped.has(command) ? rest[0] ?? null : null,
+    positional: grouped.has(command) ? rest.slice(1) : rest,
+    flags
+  };
+}
+var USAGE = `tiny \u2014 governed runtime for small internal apps
+
+  tiny login --api <url> [--token <token>]   Store credentials for a control plane
+  tiny logout                                Remove stored credentials
+  tiny whoami                                Show the current identity
+  tiny org create --slug <slug> --owner <email>
+                                             Bootstrap an organization (returns an API token)
+
+  tiny init [name]                           Write a starter tiny.yaml
+  tiny validate                              Parse and check tiny.yaml
+  tiny plan [--env production]               Show what a deploy would do (never mutates)
+  tiny deploy [--env production] [--yes]     Deploy and watch it finish
+             [--no-wait] [--wait <seconds>]
+  tiny status                                Show apps and their lifecycle status
+  tiny logs [app] [--since 1h] [--limit 100] Read bounded logs
+  tiny open [app]                            Print the app URL
+  tiny rollback <deployment>                 Repoint traffic at a previous deployment
+
+  tiny access list|grant|revoke <subject> [--role user]
+  tiny secrets set <name>|list
+  tiny capabilities list|request <operation> --connection <name>
+  tiny preview create [--ttl 72h]|delete <environment>
+
+  tiny archive [app]                         Snapshot and deactivate
+  tiny restore [app]                         Reactivate an archived app
+  tiny delete [app] --confirm <slug>         Schedule deletion
+  tiny doctor                                Check auth, manifest files, and target reachability
+
+Global flags: --json  --api <url>  --token <token>  --cwd <path>  --idempotency-key <key>
+
+Exit codes: 0 ok, 2 usage, 3 auth, 4 validation, 5 policy, 6 not found,
+            7 interaction required, 8 conflict, 9 unavailable.
+`;
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const output = new Output({ json: args.flags.json === true || args.flags.json === "true" });
+  try {
+    await dispatch(args, output);
+  } catch (error) {
+    output.fail(error);
+  }
+}
+function cwdOf(args) {
+  return resolve(typeof args.flags.cwd === "string" ? args.flags.cwd : process.cwd());
+}
+function readManifest(cwd) {
+  const path = join5(cwd, "tiny.yaml");
+  if (!existsSync3(path)) {
+    throw new TinyError("NOT_FOUND", "No tiny.yaml in this directory.", {
+      remediation: "Run `tiny init` to create one, or pass --cwd with the app directory.",
+      details: { expected: path }
+    });
+  }
+  return { source: readFileSync4(path, "utf8"), path };
+}
+function clientFor(args) {
+  const profile = currentProfile();
+  const apiUrl = (typeof args.flags.api === "string" ? args.flags.api : void 0) ?? process.env.TINY_API_URL ?? profile?.apiUrl;
+  const token = (typeof args.flags.token === "string" ? args.flags.token : void 0) ?? process.env.TINY_TOKEN ?? profile?.token;
+  if (!apiUrl) {
+    throw new TinyError("INTERACTION_REQUIRED", "No control plane configured.", {
+      remediation: "Run `tiny login --api <url> --token <token>`, or pass --api.",
+      details: { missingInput: "--api" }
+    });
+  }
+  if (!token) {
+    throw new TinyError("UNAUTHENTICATED", "No credentials for this control plane.", {
+      remediation: "Run `tiny login --api <url> --token <token>`.",
+      details: { missingInput: "--token" }
+    });
+  }
+  return new ApiClient({ apiUrl, token });
+}
+async function promptSecret(label, missingInput) {
+  if (!isInteractive()) {
+    if (!process.stdin.isTTY) {
+      const piped = readFileSync4(0, "utf8").trim();
+      if (piped) return piped;
+    }
+    throw new TinyError("INTERACTION_REQUIRED", `${label} is required and stdin is not a terminal.`, {
+      remediation: `Pipe the value on stdin, or pass ${missingInput}.`,
+      details: { missingInput }
+    });
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return (await rl.question(`${label}: `)).trim();
+  } finally {
+    rl.close();
+  }
+}
+function waitTimeoutMs(args) {
+  const flag = args.flags.wait;
+  if (typeof flag !== "string") return DEFAULT_WAIT_MS;
+  const seconds = Number(flag);
+  if (!Number.isFinite(seconds) || seconds <= 0) throw usageError("tiny deploy --wait <seconds>");
+  return seconds * 1e3;
+}
+async function dispatch(args, output) {
+  const cwd = cwdOf(args);
+  switch (args.command) {
+    case "help":
+    case "--help":
+      process.stderr.write(USAGE);
+      process.exit(args.command === "help" ? EXIT.ok : EXIT.usage);
+      return;
+    // ------------------------------------------------------------- auth
+    case "login": {
+      const apiUrl = typeof args.flags.api === "string" ? args.flags.api : process.env.TINY_API_URL;
+      if (!apiUrl) {
+        throw new TinyError("INTERACTION_REQUIRED", "A control plane URL is required.", {
+          remediation: "Pass --api <url>.",
+          details: { missingInput: "--api" }
+        });
+      }
+      const token = typeof args.flags.token === "string" ? args.flags.token : await promptSecret("API token", "--token");
+      const profile = typeof args.flags.profile === "string" ? args.flags.profile : "default";
+      setProfile(profile, { apiUrl, token });
+      output.result({ profile, apiUrl }, () => output.step(true, `Credentials stored for ${apiUrl} (profile "${profile}").`));
+      return;
+    }
+    case "logout": {
+      clearProfile(typeof args.flags.profile === "string" ? args.flags.profile : void 0);
+      output.result({ loggedOut: true }, () => output.step(true, "Credentials removed."));
+      return;
+    }
+    case "whoami": {
+      const profile = currentProfile();
+      if (!profile) {
+        throw new TinyError("UNAUTHENTICATED", "Not logged in.", { remediation: "Run `tiny login --api <url>`." });
+      }
+      const capabilities = await clientFor(args).get("/v1/platform/capabilities");
+      output.result({ apiUrl: profile.apiUrl, platform: capabilities }, () => {
+        output.step(true, `Control plane: ${profile.apiUrl}`);
+      });
+      return;
+    }
+    case "org": {
+      if (args.subcommand !== "create") throw usageError("tiny org create --slug <slug> --owner <email>");
+      const slug = String(args.flags.slug ?? "");
+      const owner = String(args.flags.owner ?? "");
+      if (!slug || !owner) throw usageError("tiny org create --slug <slug> --owner <email>");
+      const apiUrl = (typeof args.flags.api === "string" ? args.flags.api : void 0) ?? process.env.TINY_API_URL;
+      if (!apiUrl) throw usageError("tiny org create --api <url> --slug <slug> --owner <email>");
+      const created = await new ApiClient({ apiUrl }).post(
+        "/v1/organizations",
+        { slug, displayName: String(args.flags.name ?? slug), ownerEmail: owner }
+      );
+      setProfile("default", { apiUrl, token: created.sessionToken, organizationSlug: slug, email: owner });
+      output.result(
+        { organizationId: created.organization.id, slug: created.organization.slug, apiToken: created.apiToken },
+        () => {
+          output.step(true, `Organization ${created.organization.slug} created.`);
+          output.step(true, "Credentials stored for this shell.");
+          output.progress(`
+Service account token (shown once): ${created.apiToken}`);
+        }
+      );
+      return;
+    }
+    // --------------------------------------------------------- manifest
+    case "init": {
+      const name = args.positional[0] ?? basename(cwd);
+      const owner = String(args.flags.owner ?? currentProfile()?.email ?? "you@example.com");
+      const path = join5(cwd, "tiny.yaml");
+      if (existsSync3(path) && args.flags.force !== true) {
+        throw new TinyError("CONFLICT", "tiny.yaml already exists.", {
+          remediation: "Pass --force to overwrite it.",
+          details: { path }
+        });
+      }
+      writeFileSync3(path, starterManifest(name, owner));
+      output.result({ path, name }, () => output.step(true, `Wrote ${path}`));
+      return;
+    }
+    case "validate": {
+      const { source } = readManifest(cwd);
+      const parsed = parseManifest(source);
+      output.result(
+        { name: parsed.normalized.metadata.name, manifestSha256: parsed.sha256, warnings: parsed.warnings },
+        () => {
+          output.step(true, `tiny.yaml is valid (${parsed.normalized.metadata.name}).`);
+          for (const warning of parsed.warnings) output.warn(warning);
+        }
+      );
+      return;
+    }
+    case "doctor": {
+      const checks = [];
+      const profile = currentProfile();
+      checks.push({ name: "credentials", ok: Boolean(profile), detail: profile ? `stored for ${profile.apiUrl}` : "run `tiny login`" });
+      let manifestOk = false;
+      let detail = "no tiny.yaml in this directory";
+      try {
+        const parsed = parseManifest(readManifest(cwd).source);
+        manifestOk = true;
+        detail = `${parsed.normalized.metadata.name} (${parsed.normalized.runtime.type}/${parsed.normalized.runtime.language})`;
+        const entry = join5(cwd, parsed.normalized.runtime.entrypoint);
+        checks.push({ name: "entrypoint", ok: existsSync3(entry), detail: parsed.normalized.runtime.entrypoint });
+        if (parsed.normalized.resources.database) {
+          const migrations = join5(cwd, parsed.normalized.resources.database.migrations);
+          checks.push({ name: "migrations", ok: existsSync3(migrations), detail: parsed.normalized.resources.database.migrations });
+        }
+      } catch (error) {
+        detail = error instanceof Error ? error.message : String(error);
+      }
+      checks.unshift({ name: "manifest", ok: manifestOk, detail });
+      for (const risky of [".env", ".env.local", "credentials.json"]) {
+        if (existsSync3(join5(cwd, risky))) {
+          checks.push({ name: `ignored:${risky}`, ok: true, detail: "present locally, excluded from uploads" });
+        }
+      }
+      if (profile) {
+        try {
+          await clientFor(args).get("/v1/platform/capabilities");
+          checks.push({ name: "control plane", ok: true, detail: profile.apiUrl });
+        } catch (error) {
+          checks.push({ name: "control plane", ok: false, detail: error.message });
+        }
+      }
+      const ok = checks.every((check) => check.ok);
+      output.result({ checks, healthy: ok }, () => {
+        for (const check of checks) output.step(check.ok, `${check.name}: ${check.detail}`);
+      });
+      if (!ok) process.exit(EXIT.validation);
+      return;
+    }
+    // ------------------------------------------------------ plan/deploy
+    case "plan": {
+      const { source } = readManifest(cwd);
+      const client = clientFor(args);
+      const artifact = await client.uploadDirectory(cwd);
+      const response = await client.post("/v1/apps:plan", {
+        artifactUri: artifact.artifactUri,
+        manifest: source,
+        environment: typeof args.flags.env === "string" ? args.flags.env : void 0
+      });
+      output.result({ plan: response.plan, warnings: response.warnings }, () => printPlan(output, response.plan, response.warnings));
+      return;
+    }
+    case "deploy": {
+      const { source } = readManifest(cwd);
+      const client = clientFor(args);
+      output.progress("Planning\u2026");
+      const artifact = await client.uploadDirectory(cwd);
+      const planned = await client.post("/v1/apps:plan", {
+        artifactUri: artifact.artifactUri,
+        manifest: source,
+        environment: typeof args.flags.env === "string" ? args.flags.env : void 0
+      });
+      if (args.flags.json !== true) printPlan(output, planned.plan, planned.warnings);
+      if (planned.plan.approvals.length > 0 && args.flags.yes !== true && !isInteractive()) {
+        throw new TinyError("APPROVAL_REQUIRED", "This deployment needs approval and no terminal is attached.", {
+          details: { approvals: planned.plan.approvals, planId: planned.plan.planId, nextActions: [
+            "Ask an organization admin to approve the plan.",
+            "Re-run `tiny deploy --yes` once approved."
+          ] }
+        });
+      }
+      output.progress("Deploying\u2026");
+      const result = await client.post("/v1/apps:deploy", {
+        artifactUri: artifact.artifactUri,
+        manifest: source,
+        environment: typeof args.flags.env === "string" ? args.flags.env : void 0,
+        planId: planned.plan.planId,
+        approve: args.flags.yes === true
+      }, typeof args.flags["idempotency-key"] === "string" ? args.flags["idempotency-key"] : void 0);
+      const settled = args.flags["no-wait"] === true ? null : await awaitDeployment(
+        () => client.get(`/v1/deployments/${result.deploymentId}`),
+        { timeoutMs: waitTimeoutMs(args), onStatus: (status2) => output.progress(`  ${status2}\u2026`) }
+      );
+      const status = settled?.status ?? result.status;
+      const build = buildSummary(settled?.providerState);
+      output.result(
+        {
+          appId: result.appId,
+          deploymentId: result.deploymentId,
+          status,
+          url: result.url,
+          warnings: result.warnings,
+          ...build ? { build } : {}
+        },
+        () => {
+          output.progress("");
+          const built = describeBuild(build);
+          if (built) output.step(true, built);
+          if (settled === null) {
+            output.progress(args.flags["no-wait"] === true ? `\u2192 Deployment ${result.deploymentId} is ${status}. Follow it with \`tiny logs\`.` : `\u2192 Deployment ${result.deploymentId} is still running after ${Math.round(waitTimeoutMs(args) / 1e3)}s. Follow it with \`tiny logs\`.`);
+          } else {
+            output.step(status === "ready", `Deployment ${result.deploymentId} is ${status}`);
+            if (settled.errorCode) output.warn(`${settled.errorCode}: ${describeFailure(settled)}`);
+          }
+          output.step(true, `URL: ${result.url}`);
+          for (const warning of result.warnings) output.warn(warning);
+        }
+      );
+      if (status === "failed") {
+        throw new TinyError("PROVIDER_UNAVAILABLE", `Deployment ${result.deploymentId} failed: ${describeFailure(settled)}`, {
+          // The deployer recorded why and what to do about it; repeating its
+          // own remediation beats a generic pointer at the logs.
+          remediation: failureRemediation(settled),
+          details: {
+            deploymentId: result.deploymentId,
+            ...settled?.errorCode ? { errorCode: settled.errorCode } : {},
+            ...settled?.errorDetail ? { errorDetail: settled.errorDetail } : {}
+          }
+        });
+      }
+      return;
+    }
+    case "rollback": {
+      const deploymentId = args.positional[0];
+      if (!deploymentId) throw usageError("tiny rollback <deployment>");
+      const result = await clientFor(args).post(
+        `/v1/deployments/${deploymentId}/rollback`
+      );
+      output.result({ deploymentId: result.deployment.id, status: result.deployment.status, schemaWarning: result.schemaWarning }, () => {
+        output.step(true, `Traffic now served by ${result.deployment.id}`);
+        if (result.schemaWarning) output.warn(result.schemaWarning);
+      });
+      return;
+    }
+    // --------------------------------------------------------- inspect
+    case "status": {
+      const client = clientFor(args);
+      const apps = await client.get("/v1/organizations/self/apps");
+      output.result({ apps: apps.items }, () => {
+        if (apps.items.length === 0) {
+          output.progress("No apps yet. Run `tiny deploy`.");
+          return;
+        }
+        for (const app of apps.items) {
+          output.progress(`${app.slug.padEnd(28)} ${app.status.padEnd(14)} risk=${app.riskTier} last-used=${app.lastAccessedAt ?? "never"}`);
+        }
+      });
+      return;
+    }
+    case "logs": {
+      const client = clientFor(args);
+      const appRef = args.positional[0] ?? parseManifest(readManifest(cwd).source).normalized.metadata.name;
+      const app = await resolveApp(client, appRef);
+      const deployments = await client.get(`/v1/apps/${app.id}/deployments`, { limit: 1 });
+      const deployment = deployments.items[0];
+      if (!deployment) throw new TinyError("NOT_FOUND", `App ${appRef} has no deployments yet.`);
+      const logs = await client.get(
+        `/v1/deployments/${deployment.id}/logs`,
+        {
+          limit: Number(args.flags.limit ?? 100),
+          since: typeof args.flags.since === "string" ? sinceToIso(args.flags.since) : void 0
+        }
+      );
+      output.result({ appId: app.id, deploymentId: deployment.id, logs: logs.items }, () => {
+        for (const event of logs.items) {
+          process.stdout.write(`${event.timestamp} ${event.level.padEnd(5)} ${event.message}
+`);
+        }
+      });
+      return;
+    }
+    case "open": {
+      const client = clientFor(args);
+      const appRef = args.positional[0] ?? parseManifest(readManifest(cwd).source).normalized.metadata.name;
+      const app = await resolveApp(client, appRef);
+      const environments = await client.get(`/v1/apps/${app.id}/environments`);
+      const environment = environments.items.find((entry) => entry.name === (args.flags.env ?? "production")) ?? environments.items[0];
+      if (!environment) throw new TinyError("NOT_FOUND", `App ${app.slug} has no environments yet.`);
+      const url = `https://${environment.hostname}`;
+      output.result({ appId: app.id, url, environment: environment.name }, () => process.stdout.write(`${url}
+`));
+      return;
+    }
+    // ---------------------------------------------------------- access
+    case "access": {
+      const client = clientFor(args);
+      const appRef = typeof args.flags.app === "string" ? args.flags.app : parseManifest(readManifest(cwd).source).normalized.metadata.name;
+      const app = await resolveApp(client, appRef);
+      if (args.subcommand === "list" || args.subcommand === null) {
+        const bindings = await client.get(`/v1/apps/${app.id}/access`);
+        output.result({ appId: app.id, bindings: bindings.items }, () => {
+          for (const binding of bindings.items) output.progress(`${binding.subject.padEnd(36)} ${binding.role} (${binding.subjectType})`);
+        });
+        return;
+      }
+      if (args.subcommand === "grant") {
+        const subject = args.positional[0];
+        if (!subject) throw usageError("tiny access grant <subject> [--role user]");
+        const binding = await client.put(
+          `/v1/apps/${app.id}/access/${encodeURIComponent(subject)}`,
+          { role: typeof args.flags.role === "string" ? args.flags.role : "user" }
+        );
+        output.result(
+          { appId: app.id, subject: binding.subject, role: binding.role },
+          () => output.step(true, `${binding.subject} granted ${binding.role}`)
+        );
+        return;
+      }
+      if (args.subcommand === "revoke") {
+        const subject = args.positional[0];
+        if (!subject) throw usageError("tiny access revoke <subject>");
+        await client.del(`/v1/apps/${app.id}/access/${encodeURIComponent(subject)}`);
+        output.result({ appId: app.id, subject, revoked: true }, () => output.step(true, `${subject} revoked`));
+        return;
+      }
+      throw usageError("tiny access list|grant|revoke");
+    }
+    // --------------------------------------------------------- secrets
+    case "secrets": {
+      const client = clientFor(args);
+      if (args.subcommand === "list") {
+        const secrets = await client.get("/v1/organizations/self/secrets");
+        output.result({ secrets: secrets.items }, () => {
+          for (const secret of secrets.items) output.progress(`${secret.name.padEnd(32)} ${secret.createdAt}`);
+        });
+        return;
+      }
+      if (args.subcommand === "set") {
+        const name = args.positional[0];
+        if (!name) throw usageError("tiny secrets set <name>");
+        const value = await promptSecret(`Value for ${name}`, "--stdin");
+        const result = await client.post("/v1/organizations/self/secrets", { name, value });
+        output.result({ name, version: result.version }, () => output.step(true, `Secret ${name} stored as version ${result.version}`));
+        return;
+      }
+      throw usageError("tiny secrets set|list");
+    }
+    // ---------------------------------------------------- capabilities
+    case "capabilities": {
+      const client = clientFor(args);
+      if (args.subcommand === "list" || args.subcommand === null) {
+        const catalog = await client.get("/v1/capabilities");
+        output.result({ capabilities: catalog.items }, () => {
+          for (const operation of catalog.items) output.progress(`${operation.id.padEnd(30)} ${operation.risk.padEnd(12)} ${operation.version}`);
+        });
+        return;
+      }
+      if (args.subcommand === "request") {
+        const operation = args.positional[0];
+        const connection = typeof args.flags.connection === "string" ? args.flags.connection : null;
+        if (!operation || !connection) throw usageError("tiny capabilities request <operation> --connection <name>");
+        const appRef = typeof args.flags.app === "string" ? args.flags.app : parseManifest(readManifest(cwd).source).normalized.metadata.name;
+        const app = await resolveApp(client, appRef);
+        const grant = await client.post(`/v1/apps/${app.id}/capability-grants`, {
+          connection,
+          operations: [operation]
+        });
+        output.result({ grantId: grant.id, status: grant.status, operation }, () => {
+          output.step(grant.status === "approved", `Grant ${grant.id} is ${grant.status}`);
+          if (grant.status === "pending") output.progress("An organization admin must approve it before the app can call the operation.");
+        });
+        return;
+      }
+      throw usageError("tiny capabilities list|request");
+    }
+    // --------------------------------------------------------- preview
+    case "preview": {
+      const client = clientFor(args);
+      if (args.subcommand === "create") {
+        const { source } = readManifest(cwd);
+        const artifact = await client.uploadDirectory(cwd);
+        const result = await client.post("/v1/apps:preview", {
+          artifactUri: artifact.artifactUri,
+          manifest: source,
+          name: typeof args.flags.name === "string" ? args.flags.name : void 0,
+          ttlHours: args.flags.ttl ? hoursFrom(String(args.flags.ttl)) : void 0
+        });
+        output.result(result, () => output.step(true, `Preview ready at ${result.url}`));
+        return;
+      }
+      if (args.subcommand === "delete") {
+        const environmentId = args.positional[0];
+        if (!environmentId) throw usageError("tiny preview delete <environment>");
+        await client.del(`/v1/environments/${environmentId}`);
+        output.result({ environmentId, deleted: true }, () => output.step(true, `Preview ${environmentId} deleted`));
+        return;
+      }
+      throw usageError("tiny preview create|delete");
+    }
+    // ------------------------------------------------------- lifecycle
+    case "archive":
+    case "restore":
+    case "delete": {
+      const client = clientFor(args);
+      const appRef = args.positional[0] ?? parseManifest(readManifest(cwd).source).normalized.metadata.name;
+      const app = await resolveApp(client, appRef);
+      if (args.command === "archive") {
+        const result = await client.post(`/v1/apps/${app.id}/archive`);
+        output.result(
+          { appId: app.id, ...result },
+          () => output.step(true, `${app.slug} archived with ${result.snapshots} snapshot(s).`)
+        );
+        return;
+      }
+      if (args.command === "restore") {
+        const restored = await client.post(`/v1/apps/${app.id}/restore`);
+        output.result(
+          { appId: app.id, status: restored.status },
+          () => output.step(true, `${app.slug} restored. Deploy again to bring it back online.`)
+        );
+        return;
+      }
+      const confirm = typeof args.flags.confirm === "string" ? args.flags.confirm : null;
+      if (!confirm) {
+        throw new TinyError("DELETE_CONFIRMATION_REQUIRED", `Deleting "${app.slug}" requires confirmation.`, {
+          remediation: `Re-run with --confirm ${app.slug}.`,
+          details: { missingInput: "--confirm", expected: app.slug }
+        });
+      }
+      const scheduled = await client.del(`/v1/apps/${app.id}`, { confirm });
+      output.result(
+        { appId: app.id, deleteAfter: scheduled.deleteAfter },
+        () => output.step(true, `${app.slug} will be deleted after ${scheduled.deleteAfter}.`)
+      );
+      return;
+    }
+    default:
+      process.stderr.write(`Unknown command "${args.command}".
+
+${USAGE}`);
+      process.exit(EXIT.usage);
+  }
+}
+async function resolveApp(client, reference) {
+  if (reference.startsWith("app_")) return client.get(`/v1/apps/${reference}`);
+  const apps = await client.get("/v1/organizations/self/apps");
+  const app = apps.items.find((entry) => entry.slug === reference);
+  if (!app) {
+    throw new TinyError("NOT_FOUND", `No app "${reference}" in this organization.`, {
+      remediation: "Run `tiny status` to list apps."
+    });
+  }
+  return app;
+}
+function printPlan(output, plan, warnings) {
+  output.progress("");
+  for (const step of plan.steps) output.progress(`  ${step.kind.padEnd(7)} ${step.resource.padEnd(34)} ${step.detail}`);
+  if (plan.migrations.pending.length > 0) {
+    output.progress(`  migrations: ${plan.migrations.pending.join(", ")}`);
+    for (const destructive of plan.migrations.destructive) output.warn(`${destructive} contains destructive statements.`);
+  }
+  for (const capability of plan.capabilities) {
+    output.progress(`  capability ${capability.operation} \u2192 ${capability.status}`);
+  }
+  output.progress(`  risk: ${plan.riskTier}${plan.estimatedMonthlyCents === null ? "" : `   estimate: $${(plan.estimatedMonthlyCents / 100).toFixed(2)}/mo`}`);
+  for (const warning of [...warnings, ...plan.warnings]) output.warn(warning);
+  for (const problem of plan.incompatibilities) output.warn(`incompatible: ${problem}`);
+  for (const approval of plan.approvals) output.warn(`approval required \u2014 ${approval.code}: ${approval.detail}`);
+  output.progress("");
+}
+function usageError(usage) {
+  return new TinyError("VALIDATION_FAILED", `Usage: ${usage}`, { remediation: `Run: ${usage}` });
+}
+function sinceToIso(value) {
+  const match = /^(\d+)([smhd])$/.exec(value);
+  if (!match) return value;
+  const unit = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 }[match[2]];
+  return new Date(Date.now() - Number(match[1]) * unit).toISOString();
+}
+function hoursFrom(value) {
+  const match = /^(\d+)([hd])$/.exec(value);
+  if (!match) return Number(value);
+  return Number(match[1]) * (match[2] === "d" ? 24 : 1);
+}
+await main();
+//# sourceMappingURL=main.js.map