@velaro/cli 0.5.0 → 1.2.0

package/lib/commands/index.js

@@ -0,0 +1,212 @@
+import { get, post, getCredentials } from '../api.js';
+
+// ── helpers ──────────────────────────────────────────────────────────────────
+
+function isVelaroAdmin(creds) {
+  return creds.siteId === 1032;
+}
+
+function mb(n) {
+  if (n >= 1024) return `${(n / 1024).toFixed(1)} GB`;
+  return `${n} MB`;
+}
+
+function bar(used, total, width = 20) {
+  if (!total) return '[          ] n/a';
+  const pct = Math.min(used / total, 1);
+  const filled = Math.round(pct * width);
+  const color = pct >= 0.9 ? '\x1b[31m' : pct >= 0.7 ? '\x1b[33m' : '\x1b[32m';
+  return `${color}[${'█'.repeat(filled)}${' '.repeat(width - filled)}]\x1b[0m ${(pct * 100).toFixed(0)}%`;
+}
+
+// ── list ─────────────────────────────────────────────────────────────────────
+
+const listCommand = {
+  command:  'list',
+  describe: 'List indexes. Velaro admins see all physical indexes; customers see their virtual indexes + quota.',
+  builder:  (y) =>
+    y.option('site', { type: 'number', describe: 'Site ID (Velaro staff only)' }),
+  handler: async (argv) => {
+    const creds = await getCredentials();
+
+    if (isVelaroAdmin(creds)) {
+      // ── Velaro admin: show all physical indexes with storage health ─────────
+      const stats = await get('/DatabaseTool/SearchIndexStats');
+
+      console.log('\n\x1b[1mPhysical Indexes\x1b[0m');
+      console.log(`  Shared: ${stats.sharedIndexes.length}  Dedicated: ${stats.dedicatedIndexes.length}  Total: ${stats.totalSlots}`);
+
+      const LIMIT_MB = 160 * 1024;
+
+      console.log('\n\x1b[1mShared Indexes\x1b[0m');
+      for (const idx of stats.sharedIndexes) {
+        console.log(`\n  \x1b[36m${idx.indexName}\x1b[0m  ${idx.sites?.length ?? 0} sites  ${idx.totalDocuments.toLocaleString()} docs`);
+        console.log(`  Storage: ${bar(idx.storageMb, LIMIT_MB)}  ${mb(idx.storageMb)} / ${mb(LIMIT_MB)}`);
+        if (idx.sites?.length) {
+          for (const s of idx.sites.slice(0, 10)) {
+            const badge = s.assignmentType === 'legacy-fallback' ? '\x1b[33m[legacy]\x1b[0m' :
+                          s.assignmentType === 'dedicated'        ? '\x1b[35m[dedicated]\x1b[0m' :
+                                                                    '\x1b[34m[shared]\x1b[0m';
+            console.log(`    Site ${s.siteId.toString().padEnd(8)} ${badge}  ${s.documentCount.toLocaleString()} docs`);
+          }
+          if (idx.sites.length > 10) console.log(`    ... and ${idx.sites.length - 10} more`);
+        }
+      }
+
+      if (stats.dedicatedIndexes.length) {
+        console.log('\n\x1b[1mDedicated Indexes\x1b[0m');
+        for (const idx of stats.dedicatedIndexes) {
+          console.log(`  \x1b[35m${idx.indexName}\x1b[0m  Site ${idx.siteId}  ${idx.documentCount.toLocaleString()} docs`);
+          console.log(`  Storage: ${bar(idx.storageMb, LIMIT_MB)}  ${mb(idx.storageMb)} / ${mb(LIMIT_MB)}`);
+        }
+      }
+
+      const legacy = stats.sharedIndexes.flatMap(s => s.sites ?? []).filter(s => s.assignmentType === 'legacy-fallback').length;
+      if (legacy > 0) {
+        console.log(`\n\x1b[33m⚠ ${legacy} legacy site(s) have no index assignment (fallback to velaro-shared-index)\x1b[0m`);
+      }
+    } else {
+      // ── Customer: show their virtual indexes + quota ────────────────────────
+      const siteId = argv.site ?? creds.siteId;
+      const [indexes, breakdown] = await Promise.all([
+        get('/AzureIndexes/List'),
+        get(`/DatabaseTool/SearchIndexSite?siteId=${siteId}`).catch(() => null),
+      ]);
+
+      // Quota from subscription
+      const sub = await get('/Subscription/Get').catch(() => null);
+      const chunkCap = sub?.maxIndexedChunkTotal ?? 0;
+      const usedChunks = indexes.reduce((s, i) => s + (i.documentCount ?? 0), 0);
+
+      console.log('\n\x1b[1mYour Search Indexes\x1b[0m');
+
+      if (chunkCap > 0) {
+        console.log(`\nQuota: ${bar(usedChunks, chunkCap)}  ${usedChunks.toLocaleString()} / ${chunkCap.toLocaleString()} chunks used`);
+        const remaining = chunkCap - usedChunks;
+        if (remaining <= 0) {
+          console.log('\x1b[31m✗ Quota full — new content will not be indexed until you upgrade or remove content.\x1b[0m');
+        } else if (remaining < chunkCap * 0.1) {
+          console.log(`\x1b[33m⚠ Only ${remaining.toLocaleString()} chunks remaining. Consider upgrading your plan.\x1b[0m`);
+        }
+      }
+
+      if (breakdown) {
+        const typeLabel = breakdown.assignmentType === 'dedicated' ? '\x1b[35m[dedicated index]\x1b[0m' :
+                          breakdown.assignmentType === 'shared'    ? '\x1b[34m[shared index]\x1b[0m' :
+                                                                     '\x1b[33m[legacy]\x1b[0m';
+        console.log(`\nPhysical index: \x1b[36m${breakdown.physicalIndex}\x1b[0m  ${typeLabel}`);
+      }
+
+      console.log('');
+      for (const idx of indexes) {
+        const docs = idx.documentCount != null ? `${idx.documentCount.toLocaleString()} docs` : '';
+        console.log(`  \x1b[36m${idx.name}\x1b[0m  (id: ${idx.id})  ${docs}`);
+        if (idx.description) console.log(`    ${idx.description}`);
+      }
+
+      if (!indexes.length) console.log('  No indexes found. Create one in your bot settings.');
+    }
+    console.log('');
+  },
+};
+
+// ── site (Velaro staff only) ──────────────────────────────────────────────────
+
+const siteCommand = {
+  command:  'site <siteId>',
+  describe: 'Show index breakdown for a specific site (Velaro staff only)',
+  handler: async (argv) => {
+    const creds = await getCredentials();
+    if (!isVelaroAdmin(creds)) {
+      console.error('This command is only available to Velaro staff.');
+      process.exit(1);
+    }
+    const data = await get(`/DatabaseTool/SearchIndexSite?siteId=${argv.siteId}`);
+    console.log(`\nSite ${argv.siteId}  →  \x1b[36m${data.physicalIndex}\x1b[0m  [${data.assignmentType}]`);
+    console.log(`Total docs: ${data.totalDocuments.toLocaleString()}\n`);
+    for (const t of data.indexTypes) {
+      console.log(`  ${t.indexName.padEnd(40)} ${t.count.toLocaleString()} docs`);
+    }
+    console.log('');
+  },
+};
+
+// ── provision (Velaro staff only) ─────────────────────────────────────────────
+
+const provisionCommand = {
+  command:  'provision <siteId>',
+  describe: 'Provision a dedicated physical index for a site (Velaro staff only)',
+  handler: async (argv) => {
+    const creds = await getCredentials();
+    if (!isVelaroAdmin(creds)) {
+      console.error('This command is only available to Velaro staff.');
+      process.exit(1);
+    }
+    console.log(`Provisioning dedicated index for site ${argv.siteId}...`);
+    const result = await post('/DatabaseTool/ProvisionDedicatedIndex', { SiteId: argv.siteId });
+    console.log(`\x1b[32m✓ ${result.message}\x1b[0m`);
+    console.log(`  Index: \x1b[36m${result.indexName}\x1b[0m`);
+    console.log('\nNote: Re-ingest content to populate the new index.');
+  },
+};
+
+// ── reingest (customer-facing, credit-gated) ──────────────────────────────────
+
+const reingestCommand = {
+  command:  'reingest',
+  describe: 'Re-ingest all content sources for your site (requires available index quota)',
+  builder:  (y) =>
+    y
+      .option('source', {
+        type:     'string',
+        describe: 'Specific source to reingest: kb | shopify | bigcommerce | scraper',
+      })
+      .option('site', {
+        type:     'number',
+        describe: 'Site ID (Velaro staff only)',
+      }),
+  handler: async (argv) => {
+    const creds = await getCredentials();
+
+    // Check quota before allowing reingest
+    const sub = await get('/Subscription/Get').catch(() => null);
+    if (!isVelaroAdmin(creds) && sub?.maxIndexedChunkTotal > 0) {
+      const indexes = await get('/AzureIndexes/List').catch(() => []);
+      const usedChunks = indexes.reduce((s, i) => s + (i.documentCount ?? 0), 0);
+      if (usedChunks >= sub.maxIndexedChunkTotal) {
+        console.error(`\x1b[31m✗ Index quota full (${usedChunks.toLocaleString()} / ${sub.maxIndexedChunkTotal.toLocaleString()} chunks).\x1b[0m`);
+        console.error('  Upgrade your plan or remove content before reingesting.');
+        process.exit(1);
+      }
+    }
+
+    const sources = argv.source ? [argv.source] : ['kb', 'shopify', 'bigcommerce', 'scraper'];
+    const siteParam = isVelaroAdmin(creds) && argv.site ? `?siteId=${argv.site}` : '';
+
+    for (const source of sources) {
+      try {
+        console.log(`  Syncing ${source}...`);
+        await post(`/AzureIndexes/SyncIntegration${siteParam}`, { source, forceAll: true });
+        console.log(`  \x1b[32m✓ ${source} queued\x1b[0m`);
+      } catch (e) {
+        console.log(`  \x1b[33m⚠ ${source} skipped: ${e.message}\x1b[0m`);
+      }
+    }
+    console.log('\nReingest queued. Run `velaro index list` to monitor progress.');
+  },
+};
+
+// ── export ────────────────────────────────────────────────────────────────────
+
+export const indexCommand = {
+  command:  'index <subcommand>',
+  describe: 'Manage search indexes — view quota, physical index health, and reingest content',
+  builder:  (yargs) =>
+    yargs
+      .command(listCommand)
+      .command(siteCommand)
+      .command(provisionCommand)
+      .command(reingestCommand)
+      .demandCommand(1, 'Specify a subcommand: list, site, provision, reingest'),
+  handler: () => {},
+};

package/lib/commands/ingest.js

@@ -1,31 +1,31 @@
-import { getCredentials, post } from '../api.js';
-import { runCommand }           from '../run.js';
-
-export const ingestCommand = {
-  command:  'ingest',
-  describe: 'Trigger knowledge base ingestion for a completed scraper job',
-  builder:  (y) =>
-    y.option('job-id', {
-      describe:     'Scraper job ID to ingest',
-      type:         'string',
-      demandOption: true,
-    }),
-
-  handler: runCommand(async (argv) => {
-    // Single credential resolution — avoids double readConfig() from calling readConfig()
-    // here and again inside post() → getCredentials().
-    const creds = await getCredentials();
-
-    console.log(`Triggering ingestion for job ${argv['job-id']} on site ${creds.siteId}...`);
-
-    const result = await post('/AzureIndexes/IngestJobDirect', {
-      siteId: creds.siteId,
-      jobId:  argv['job-id'],
-    });
-
-    console.log('Ingestion started.');
-    console.log(`  Job ID: ${result.jobId}`);
-    console.log(`  Index:  ${result.physicalIndex}`);
-    console.log('\nEmbedding runs in the background. Check logs for completion.');
-  }),
-};
+import { getCredentials, post } from '../api.js';
+import { runCommand }           from '../run.js';
+
+export const ingestCommand = {
+  command:  'ingest',
+  describe: 'Trigger knowledge base ingestion for a completed scraper job',
+  builder:  (y) =>
+    y.option('job-id', {
+      describe:     'Scraper job ID to ingest',
+      type:         'string',
+      demandOption: true,
+    }),
+
+  handler: runCommand(async (argv) => {
+    // Single credential resolution — avoids double readConfig() from calling readConfig()
+    // here and again inside post() → getCredentials().
+    const creds = await getCredentials();
+
+    console.log(`Triggering ingestion for job ${argv['job-id']} on site ${creds.siteId}...`);
+
+    const result = await post('/AzureIndexes/IngestJobDirect', {
+      siteId: creds.siteId,
+      jobId:  argv['job-id'],
+    });
+
+    console.log('Ingestion started.');
+    console.log(`  Job ID: ${result.jobId}`);
+    console.log(`  Index:  ${result.physicalIndex}`);
+    console.log('\nEmbedding runs in the background. Check logs for completion.');
+  }),
+};

package/lib/commands/kb.js

@@ -25,7 +25,7 @@ export const kbCommand = {
 
 const reindexCommand = {
   command:  'reindex',
-  describe: 'Re-embed all KB articles into the vector index (use after embedding model upgrade)',
+  describe: 'Re-embed KB articles or scraper/ingestion content (use after embedding model upgrade)',
   builder:  (y) =>
     y
       .option('all', {
@@ -36,15 +36,38 @@ const reindexCommand = {
       .option('site', {
         type:     'number',
         describe: 'Reindex a specific site by ID (Velaro staff only)',
+      })
+      .option('ingestion', {
+        type:     'boolean',
+        describe: 'Reindex scraper/ingestion Azure Search indexers instead of KB articles',
+        default:  false,
       }),
   handler: runCommand(async (argv) => {
-    if (argv.all) {
-      console.log('Starting bulk reindex for all sites — this runs in the background.');
+    if (argv.ingestion) {
+      if (argv.all) {
+        console.log('Starting bulk ingestion reindex for all sites — runs in background.');
+        console.log('Watch server logs ([ReindexAllIngestion]) for progress.\n');
+        const result = await post('/DatabaseTool/ReindexAllIngestionIndexes', {});
+        console.log(result.message ?? 'Queued.');
+      } else if (argv.site) {
+        console.log(`Reindexing scraper/ingestion index for site ${argv.site}…`);
+        const result = await post(`/DatabaseTool/ReindexIngestionIndex/${argv.site}`, {});
+        if (result.success) {
+          console.log(`✅ Triggered ${result.indexersRun} indexer(s) — re-processing in background.`);
+        } else {
+          console.error(`❌ Failed: ${result.message}`);
+        }
+      } else {
+        console.error('--ingestion requires --site <id> or --all (Velaro staff only)');
+        process.exit(1);
+      }
+    } else if (argv.all) {
+      console.log('Starting bulk KB reindex for all sites — this runs in the background.');
       console.log('Watch server logs ([ReindexAllKb]) for progress.\n');
       const result = await post('/DatabaseTool/ReindexAllKb', {});
       console.log(result.message ?? 'Queued.');
     } else if (argv.site) {
-      console.log(`Reindexing site ${argv.site}…`);
+      console.log(`Reindexing KB articles for site ${argv.site}…`);
       const result = await post(`/DatabaseTool/ReindexKb/${argv.site}`, {});
       if (result.success) {
         console.log(`✅ Done — ${result.articles} articles reindexed.`);

package/lib/commands/login.js

@@ -1,86 +1,86 @@
-import { requestDeviceCode, pollForToken, exchangeForVelaroToken } from '../oauth.js';
-import { readConfig, writeConfig, setEnvCredentials, getActiveEnv, ENVS } from '../config.js';
-import { runCommand } from '../run.js';
-
-export const loginCommand = {
-  command:  'login',
-  describe: 'Authenticate with Velaro (saves credentials for the chosen environment)',
-  builder:  (y) =>
-    y
-      .option('staging', {
-        describe: 'Log in to the staging environment',
-        type:     'boolean',
-        default:  false,
-      })
-      .option('api', {
-        describe: 'Override the admin API base URL (advanced)',
-        type:     'string',
-      }),
-
-  handler: runCommand(async (argv) => {
-    const env = argv.staging || argv.api?.includes('staging') ? 'staging' : 'prod';
-    const adminApiBase = argv.api || ENVS[env].adminApiBase;
-
-    console.log(`Starting Velaro login (${env})...\n`);
-
-    const deviceData = await requestDeviceCode();
-
-    console.log(`  Open:  ${deviceData.verification_uri}`);
-    console.log(`  Enter: ${deviceData.user_code}\n`);
-    console.log('Waiting for you to complete login in your browser...');
-
-    const entraTokens  = await pollForToken(deviceData.device_code, deviceData.interval ?? 5);
-    const velaroResult = await exchangeForVelaroToken(entraTokens.access_token, adminApiBase);
-
-    setEnvCredentials(env, {
-      adminApiBase,
-      velaroToken:       velaroResult.token.token,
-      velaroExpires:     velaroResult.token.expires,
-      entraRefreshToken: entraTokens.refresh_token,
-      siteId:            velaroResult.profile?.SiteId,
-      userName:          velaroResult.profile?.Name,
-    });
-
-    // Set as active if it's the only env logged in, or if explicitly chosen
-    const cfg = readConfig();
-    if (!cfg.activeEnv || Object.keys(cfg.envs || {}).length === 1) {
-      cfg.activeEnv = env;
-      writeConfig(cfg);
-    }
-
-    console.log(`\n✅ Logged in to ${env} as ${velaroResult.profile?.Name ?? velaroResult.profile?.UserName}`);
-    console.log(`   Site ID: ${velaroResult.profile?.SiteId}`);
-    console.log(`   API: ${adminApiBase}`);
-    console.log('\nCredentials saved. Run "velaro env" to see all environments.');
-  }),
-};
-
-export const logoutCommand = {
-  command:  'logout',
-  describe: 'Clear stored credentials',
-  builder:  (y) =>
-    y.option('staging', { describe: 'Log out of staging only', type: 'boolean', default: false })
-     .option('all',     { describe: 'Log out of all environments', type: 'boolean', default: false }),
-
-  handler: runCommand(async (argv) => {
-    const { readConfig, writeConfig, clearConfig } = await import('../config.js');
-    if (argv.all) {
-      clearConfig();
-      console.log('Logged out of all environments.');
-      return;
-    }
-    const env = argv.staging ? 'staging' : getActiveEnv();
-    const cfg = readConfig();
-    if (cfg.envs?.[env]) {
-      delete cfg.envs[env];
-      if (cfg.activeEnv === env) {
-        const remaining = Object.keys(cfg.envs || {});
-        cfg.activeEnv = remaining[0] || 'prod';
-      }
-      writeConfig(cfg);
-      console.log(`Logged out of ${env}.`);
-    } else {
-      console.log(`Not logged in to ${env}.`);
-    }
-  }),
-};
+import { requestDeviceCode, pollForToken, exchangeForVelaroToken } from '../oauth.js';
+import { readConfig, writeConfig, setEnvCredentials, getActiveEnv, ENVS } from '../config.js';
+import { runCommand } from '../run.js';
+
+export const loginCommand = {
+  command:  'login',
+  describe: 'Authenticate with Velaro (saves credentials for the chosen environment)',
+  builder:  (y) =>
+    y
+      .option('staging', {
+        describe: 'Log in to the staging environment',
+        type:     'boolean',
+        default:  false,
+      })
+      .option('api', {
+        describe: 'Override the admin API base URL (advanced)',
+        type:     'string',
+      }),
+
+  handler: runCommand(async (argv) => {
+    const env = argv.staging || argv.api?.includes('staging') ? 'staging' : 'prod';
+    const adminApiBase = argv.api || ENVS[env].adminApiBase;
+
+    console.log(`Starting Velaro login (${env})...\n`);
+
+    const deviceData = await requestDeviceCode();
+
+    console.log(`  Open:  ${deviceData.verification_uri}`);
+    console.log(`  Enter: ${deviceData.user_code}\n`);
+    console.log('Waiting for you to complete login in your browser...');
+
+    const entraTokens  = await pollForToken(deviceData.device_code, deviceData.interval ?? 5);
+    const velaroResult = await exchangeForVelaroToken(entraTokens.access_token, adminApiBase);
+
+    setEnvCredentials(env, {
+      adminApiBase,
+      velaroToken:       velaroResult.token.token,
+      velaroExpires:     velaroResult.token.expires,
+      entraRefreshToken: entraTokens.refresh_token,
+      siteId:            velaroResult.profile?.SiteId,
+      userName:          velaroResult.profile?.Name,
+    });
+
+    // Set as active if it's the only env logged in, or if explicitly chosen
+    const cfg = readConfig();
+    if (!cfg.activeEnv || Object.keys(cfg.envs || {}).length === 1) {
+      cfg.activeEnv = env;
+      writeConfig(cfg);
+    }
+
+    console.log(`\n✅ Logged in to ${env} as ${velaroResult.profile?.Name ?? velaroResult.profile?.UserName}`);
+    console.log(`   Site ID: ${velaroResult.profile?.SiteId}`);
+    console.log(`   API: ${adminApiBase}`);
+    console.log('\nCredentials saved. Run "velaro env" to see all environments.');
+  }),
+};
+
+export const logoutCommand = {
+  command:  'logout',
+  describe: 'Clear stored credentials',
+  builder:  (y) =>
+    y.option('staging', { describe: 'Log out of staging only', type: 'boolean', default: false })
+     .option('all',     { describe: 'Log out of all environments', type: 'boolean', default: false }),
+
+  handler: runCommand(async (argv) => {
+    const { readConfig, writeConfig, clearConfig } = await import('../config.js');
+    if (argv.all) {
+      clearConfig();
+      console.log('Logged out of all environments.');
+      return;
+    }
+    const env = argv.staging ? 'staging' : getActiveEnv();
+    const cfg = readConfig();
+    if (cfg.envs?.[env]) {
+      delete cfg.envs[env];
+      if (cfg.activeEnv === env) {
+        const remaining = Object.keys(cfg.envs || {});
+        cfg.activeEnv = remaining[0] || 'prod';
+      }
+      writeConfig(cfg);
+      console.log(`Logged out of ${env}.`);
+    } else {
+      console.log(`Not logged in to ${env}.`);
+    }
+  }),
+};

package/lib/commands/ops.js

@@ -0,0 +1,173 @@
+import { get, getCredentials } from '../api.js';
+import { readConfig, ENVS }   from '../config.js';
+
+// ── helpers ──────────────────────────────────────────────────────────────────
+
+function ago(dateStr) {
+  if (!dateStr) return 'unknown';
+  const diffMs = Date.now() - new Date(dateStr).getTime();
+  const mins  = Math.round(diffMs / 60000);
+  if (mins < 2)   return 'just now';
+  if (mins < 60)  return `${mins}m ago`;
+  const hrs = Math.round(mins / 60);
+  if (hrs < 24)   return `${hrs}h ago`;
+  return `${Math.round(hrs / 24)}d ago`;
+}
+
+function utcLabel(dateStr) {
+  if (!dateStr) return '';
+  const d = new Date(dateStr);
+  return d.toISOString().replace('T', ' ').slice(0, 16) + ' UTC';
+}
+
+const OK    = '\x1b[32m✓\x1b[0m';
+const WARN  = '\x1b[33m⚠\x1b[0m';
+const ERR   = '\x1b[31m✗\x1b[0m';
+const HIGH  = '\x1b[31m[high]\x1b[0m  ';
+const MED   = '\x1b[33m[med]\x1b[0m   ';
+const LOW   = '\x1b[36m[low]\x1b[0m   ';
+
+function severityPrefix(s) {
+  if (s === 'high')   return HIGH;
+  if (s === 'medium') return MED;
+  return LOW;
+}
+
+async function pingVersion(label, base) {
+  try {
+    const res = await fetch(`${base}/Version`, { signal: AbortSignal.timeout(6000) });
+    if (!res.ok) return { label, ok: false, status: res.status };
+    const data = await res.json();
+    return { label, ok: true, version: data.version, deployedAt: data.deployedAt };
+  } catch (e) {
+    return { label, ok: false, err: e.message };
+  }
+}
+
+async function pingHealth(label, url) {
+  try {
+    const res = await fetch(url, { signal: AbortSignal.timeout(6000) });
+    return { label, ok: res.ok, status: res.status };
+  } catch (e) {
+    return { label, ok: false, err: e.message };
+  }
+}
+
+// ── ops command ───────────────────────────────────────────────────────────────
+
+export const opsCommand = {
+  command:  'ops',
+  describe: 'System health: deploy times, Hangfire, API status, and active alerts (Velaro staff only)',
+  handler:  async () => {
+    const creds = await getCredentials();
+    const isAdmin = creds.siteId === 1032;
+
+    if (!isAdmin) {
+      console.error('velaro ops is only available to Velaro staff.');
+      process.exit(1);
+    }
+
+    const cfg = readConfig();
+
+    // ── 1. Deploy versions (anonymous — both envs in parallel) ───────────────
+    const prodBase    = cfg.envs?.prod?.adminApiBase    ?? ENVS.prod.adminApiBase;
+    const stagingBase = cfg.envs?.staging?.adminApiBase ?? ENVS.staging.adminApiBase;
+
+    const [prodVer, stagingVer] = await Promise.all([
+      pingVersion('prod',    prodBase),
+      pingVersion('staging', stagingBase),
+    ]);
+
+    console.log('\n\x1b[1m── Deploy ──────────────────────────────────────────────────\x1b[0m');
+    for (const v of [prodVer, stagingVer]) {
+      if (v.ok) {
+        const sym  = OK;
+        const ver  = `\x1b[36m${v.version}\x1b[0m`;
+        const time = `${ago(v.deployedAt).padEnd(12)} (${utcLabel(v.deployedAt)})`;
+        console.log(`  ${sym}  ${v.label.padEnd(8)}  ${ver.padEnd(30)}  deployed ${time}`);
+      } else {
+        const detail = v.err ?? `HTTP ${v.status}`;
+        console.log(`  ${ERR}  ${v.label.padEnd(8)}  UNREACHABLE — ${detail}`);
+      }
+    }
+
+    // ── 2. API health (admin + messaging, both envs) ──────────────────────────
+    const prodMsgBase    = cfg.envs?.prod?.messagingApiBase    ?? ENVS.prod.messagingApiBase;
+    const stagingMsgBase = cfg.envs?.staging?.messagingApiBase ?? ENVS.staging.messagingApiBase;
+
+    const [adminProdHealth, adminStagingHealth, msgProdHealth, msgStagingHealth] = await Promise.all([
+      pingHealth('admin/prod',    `${prodBase}/Status`),
+      pingHealth('admin/staging', `${stagingBase}/Status`),
+      pingHealth('msg/prod',      `${prodMsgBase}/api/health`),
+      pingHealth('msg/staging',   `${stagingMsgBase}/api/health`),
+    ]);
+
+    console.log('\n\x1b[1m── API Health ──────────────────────────────────────────────\x1b[0m');
+    for (const h of [adminProdHealth, adminStagingHealth, msgProdHealth, msgStagingHealth]) {
+      if (h.ok) {
+        console.log(`  ${OK}  ${h.label}`);
+      } else {
+        const detail = h.err ?? `HTTP ${h.status}`;
+        console.log(`  ${ERR}  ${h.label.padEnd(20)}  ${detail}`);
+      }
+    }
+
+    // ── 3. Hangfire failed jobs ───────────────────────────────────────────────
+    console.log('\n\x1b[1m── Hangfire ────────────────────────────────────────────────\x1b[0m');
+    try {
+      const jobs = await get('/DatabaseTool/FailedJobs');
+      if (!jobs?.length) {
+        console.log(`  ${OK}  0 failed jobs`);
+      } else {
+        const sym = jobs.length >= 20 ? ERR : jobs.length >= 5 ? WARN : WARN;
+        console.log(`  ${sym}  ${jobs.length} failed job(s)`);
+        for (const j of jobs.slice(0, 5)) {
+          const when = j.failedAt ? ago(j.failedAt) : '?';
+          const name = [j.typeName, j.methodName].filter(Boolean).join('.');
+          const msg  = j.exceptionMessage?.split('\n')[0]?.slice(0, 80) ?? j.reason?.slice(0, 80) ?? '';
+          console.log(`    ${WARN}  ${name.padEnd(35)} ${when.padEnd(10)}  ${msg}`);
+        }
+        if (jobs.length > 5) console.log(`    ... and ${jobs.length - 5} more`);
+        console.log('  Open /hangfire to inspect and retry.');
+      }
+    } catch (e) {
+      console.log(`  ${WARN}  Could not load Hangfire jobs: ${e.message}`);
+    }
+
+    // ── 4. Active alerts (needs-attention via messaging API) ──────────────────
+    console.log('\n\x1b[1m── Alerts ──────────────────────────────────────────────────\x1b[0m');
+    try {
+      const res = await fetch(`${prodMsgBase}/SuperAdmin/needs-attention`, {
+        headers: {
+          Authorization:      `Bearer ${creds.velaroToken}`,
+          'X-Internal-SiteId': String(creds.siteId),
+          'Content-Type':     'application/json',
+        },
+        signal: AbortSignal.timeout(15000),
+      });
+
+      if (!res.ok) {
+        console.log(`  ${WARN}  Could not reach alerts endpoint (HTTP ${res.status})`);
+      } else {
+        const items = await res.json();
+        const alertItems = Array.isArray(items)
+          ? items.filter(i => i.type !== 'hangfire_failed') // shown above
+          : [];
+        if (!alertItems.length) {
+          console.log(`  ${OK}  Nothing needs attention`);
+        } else {
+          for (const item of alertItems) {
+            console.log(`  ${severityPrefix(item.severity)}${item.title}`);
+            if (item.recommendedFix) {
+              console.log(`         \x1b[2m${item.recommendedFix.slice(0, 100)}\x1b[0m`);
+            }
+          }
+        }
+      }
+    } catch (e) {
+      console.log(`  ${WARN}  Alerts unavailable: ${e.message}`);
+    }
+
+    console.log('\n──────────────────────────────────────────────────────────────\n');
+  },
+};