@vibiz/cli 0.0.0-stage → 0.1.0

package/dist/vibiz.js

@@ -0,0 +1,3302 @@
+#!/usr/bin/env node
+import {
+  Vibiz,
+  VibizApiError,
+  deployDirectory,
+  formatUnits,
+  formatUsd,
+  mergeEnvFile
+} from "./chunk-NWL4LVVI.js";
+
+// packages/cli/src/main.ts
+import { spawn } from "node:child_process";
+import { chmod, mkdir, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { format } from "node:util";
+
+// packages/cli/src/commands.ts
+import { homedir as homedir2 } from "node:os";
+import { join as join4, resolve } from "node:path";
+import { parseArgs } from "node:util";
+
+// packages/app/src/index.ts
+var runtimeEnv = () => globalThis.process?.env ?? {};
+var DEFAULT_URL = "https://app.vibiz.app";
+var VibizAppError = class extends Error {
+  status;
+  code;
+  details;
+  constructor(status, code, message, details) {
+    super(message);
+    this.name = "VibizAppError";
+    this.status = status;
+    this.code = code;
+    this.details = details;
+  }
+};
+var WEBHOOK_TOLERANCE_S = 300;
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+function sha256(data) {
+  const h = [
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ];
+  const blocks = Math.ceil((data.length + 9) / 64);
+  const buf = new Uint8Array(blocks * 64);
+  buf.set(data);
+  buf[data.length] = 128;
+  const view = new DataView(buf.buffer);
+  view.setUint32(buf.length - 8, Math.floor(data.length / 536870912));
+  view.setUint32(buf.length - 4, data.length << 3 >>> 0);
+  const w = new Array(64).fill(0);
+  const rotr = (x, n) => x >>> n | x << 32 - n;
+  for (let b = 0; b < blocks; b++) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(b * 64 + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const a15 = w[i - 15] ?? 0;
+      const a2 = w[i - 2] ?? 0;
+      const s0 = rotr(a15, 7) ^ rotr(a15, 18) ^ a15 >>> 3;
+      const s1 = rotr(a2, 17) ^ rotr(a2, 19) ^ a2 >>> 10;
+      w[i] = (w[i - 16] ?? 0) + s0 + (w[i - 7] ?? 0) + s1 >>> 0;
+    }
+    const v = [...h];
+    for (let i = 0; i < 64; i++) {
+      const [a = 0, bb = 0, c = 0, d = 0, e = 0, f = 0, g = 0, hh = 0] = v;
+      const t1 = hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + (e & f ^ ~e & g) + (K[i] ?? 0) + (w[i] ?? 0) >>> 0;
+      const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & bb ^ a & c ^ bb & c) >>> 0;
+      v.splice(0, 8, t1 + t2 >>> 0, a, bb, c, d + t1 >>> 0, e, f, g);
+    }
+    for (let i = 0; i < 8; i++) h[i] = (h[i] ?? 0) + (v[i] ?? 0) >>> 0;
+  }
+  const digest = new Uint8Array(32);
+  const dv = new DataView(digest.buffer);
+  for (let i = 0; i < 8; i++) dv.setUint32(i * 4, h[i] ?? 0);
+  return digest;
+}
+function hmacSha256Hex(key, message) {
+  const enc = new TextEncoder();
+  let k = enc.encode(key);
+  if (k.length > 64) k = sha256(k);
+  const pad = (byte, rest) => {
+    const out = new Uint8Array(64 + rest.length);
+    for (let i = 0; i < 64; i++) out[i] = (k[i] ?? 0) ^ byte;
+    out.set(rest, 64);
+    return out;
+  };
+  const inner = sha256(pad(54, enc.encode(message)));
+  return [...sha256(pad(92, inner))].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function sameString(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function verifyWebhook(rawBody, header, secret = runtimeEnv().VIBIZ_WEBHOOK_SECRET, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const bad = (why) => new VibizAppError(400, "invalid_signature", `Webhook refused: ${why}.`);
+  if (!secret) {
+    throw new VibizAppError(500, "not_configured", "No VIBIZ_WEBHOOK_SECRET in the env.");
+  }
+  if (!header) throw bad("no Vibiz-Signature header");
+  let t;
+  const sigs = [];
+  for (const part of header.split(",")) {
+    const i = part.indexOf("=");
+    const k = part.slice(0, i).trim();
+    const v = part.slice(i + 1).trim();
+    if (k === "t" && /^\d{1,12}$/.test(v)) t = Number(v);
+    else if (k === "v1" && v) sigs.push(v.toLowerCase());
+  }
+  if (t === void 0 || !sigs.length) throw bad("malformed signature");
+  if (Math.abs(nowSeconds - t) > WEBHOOK_TOLERANCE_S) throw bad("too old");
+  const expected = hmacSha256Hex(secret, `${t}.${rawBody}`);
+  if (!sigs.some((sig) => sameString(sig, expected))) throw bad("signature does not match");
+  try {
+    return JSON.parse(rawBody);
+  } catch {
+    throw bad("not JSON");
+  }
+}
+function userHeader(user) {
+  if (/^[\x20-\x7e]*$/.test(user) && !user.startsWith("b64u:")) return user;
+  let bin = "";
+  for (const b of new TextEncoder().encode(user)) bin += String.fromCharCode(b);
+  return `b64u:${btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")}`;
+}
+var VibizApp = class _VibizApp {
+  options;
+  loaded = null;
+  constructor(options = {}) {
+    this.options = options;
+  }
+  /** The key, read when first needed, so `loadEnv()` or a late env still works. */
+  get key() {
+    const key = this.options.key ?? runtimeEnv().VIBIZ_APP_KEY;
+    if (!key) {
+      throw new VibizAppError(
+        401,
+        "unauthorized",
+        "No app key. Set VIBIZ_APP_KEY (Vibiz puts it in your app\u2019s env), or pass { key }."
+      );
+    }
+    return key;
+  }
+  get url() {
+    return (this.options.url ?? runtimeEnv().VIBIZ_API_URL ?? DEFAULT_URL).replace(/\/$/, "");
+  }
+  /** A client that attributes spend and events to one of your users. */
+  user(id) {
+    return new _VibizApp({ ...this.options, user: id });
+  }
+  async request(path, init = {}) {
+    if (typeof globalThis.window !== "undefined" && !this.options.dangerouslyAllowBrowser) {
+      throw new VibizAppError(
+        400,
+        "invalid_request",
+        "The app key is a server secret: call Vibiz from your server, not the browser."
+      );
+    }
+    const res = await (this.options.fetch ?? fetch)(`${this.url}/v1${path}`, {
+      method: init.method ?? (init.body === void 0 ? "GET" : "POST"),
+      headers: {
+        authorization: `Bearer ${this.key}`,
+        accept: "application/json",
+        ...init.body !== void 0 ? { "content-type": "application/json" } : {},
+        ...this.options.user ? { "x-vibiz-user": userHeader(this.options.user) } : {}
+      },
+      ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {}
+    });
+    const text = await res.text();
+    let data = null;
+    try {
+      data = text ? JSON.parse(text) : null;
+    } catch {
+      data = null;
+    }
+    if (!res.ok) {
+      const e = data?.error;
+      throw new VibizAppError(
+        res.status,
+        e?.code ?? "error",
+        e?.message ?? `Vibiz answered ${res.status}.`,
+        e?.details
+      );
+    }
+    return data;
+  }
+  /** Which project and environment this key is. */
+  whoami() {
+    return this.request("/app");
+  }
+  /**
+   * Fetch the app's env from Vibiz and put it into `process.env` (existing
+   * variables win unless `override`). For hosts that hold only VIBIZ_APP_KEY:
+   * call it once at boot, before anything reads the env. Fetched once per
+   * process; `refresh: true` fetches again (after a rotation).
+   */
+  async loadEnv(opts = {}) {
+    if (!this.loaded || opts.refresh) {
+      this.loaded = this.request("/app/env").then((r) => r.env);
+      this.loaded.catch(() => {
+        this.loaded = null;
+      });
+    }
+    const env = await this.loaded;
+    const target = runtimeEnv();
+    for (const [k, v] of Object.entries(env)) {
+      if (opts.override || target[k] === void 0) target[k] = v;
+    }
+    return env;
+  }
+  /**
+   * The AI gateway, OpenAI-compatible: `new OpenAI(vibiz.ai)` or the Vercel AI
+   * SDK's `createOpenAI(vibiz.ai)`. Models: `vibiz/fast`, `vibiz/smart`…
+   */
+  get ai() {
+    const self = this;
+    return {
+      get baseURL() {
+        return `${self.url}/v1/ai`;
+      },
+      get apiKey() {
+        return self.key;
+      },
+      /** One chat completion, without an SDK. */
+      chat: (input) => self.request("/ai/chat/completions", {
+        body: {
+          model: "vibiz/fast",
+          ...input,
+          ...self.options.user ? { user: self.options.user } : {}
+        }
+      })
+    };
+  }
+  /** Email from the project's own address (needs the `email` resource). */
+  email = {
+    send: (input) => this.actions.run("email.send", input)
+  };
+  /** Any action (`web.scrape`, `web.search`, `places.search`, `email.send`…), billed to the project. */
+  actions = {
+    run: (name, input) => this.request(`/app/actions/${encodeURIComponent(name)}`, {
+      body: { input }
+    })
+  };
+  /**
+   * Payments (docs/PAYMENTS.md): Vibiz is the merchant, so this works from the
+   * first call, before the owner has verified anything. Refunds and
+   * withdrawals are the owner's, in the console.
+   */
+  payments = {
+    /** A hosted checkout page for a price (one-time or a subscription) or an ad-hoc item. */
+    checkout: (input) => this.request(
+      "/app/payments/checkout",
+      { body: input }
+    ),
+    /** The user's live subscription (active, trialing or past due), or null. */
+    subscription: async (user) => {
+      const r = await this.request(
+        `/app/payments/subscriptions?user=${encodeURIComponent(user)}&status=active,trialing,past_due`
+      );
+      return r.data[0] ?? null;
+    },
+    /** Whether the user has an active (or trialing) subscription, optionally to one price id or lookup key. */
+    hasActive: async (user, price) => {
+      const r = await this.request(
+        `/app/payments/subscriptions?user=${encodeURIComponent(user)}&status=active,trialing`
+      );
+      if (!price) return r.data.length > 0;
+      if (r.data.some((x) => x.price_id === price)) return true;
+      const products = await this.payments.products();
+      const ids = new Set(
+        products.flatMap((p) => p.prices).filter((p) => p.lookup_key === price).map((p) => p.id)
+      );
+      return r.data.some((x) => x.price_id !== null && ids.has(x.price_id));
+    },
+    /** A link where the user manages their subscription and card. */
+    portal: (user, opts) => this.request("/app/payments/portal", {
+      body: { user, return_url: opts.return_url }
+    }),
+    /** The catalog: products with their prices. */
+    products: () => this.request("/app/payments/products").then((r) => r.data),
+    /** Payments, newest first (`user` keeps one of yours). */
+    payments: (opts = {}) => {
+      const q = new URLSearchParams();
+      for (const [k, v] of Object.entries(opts)) if (v !== void 0) q.set(k, String(v));
+      const qs = q.toString();
+      return this.request(
+        `/app/payments/payments${qs ? `?${qs}` : ""}`
+      );
+    },
+    /** Cancel a user's subscription (at the end of the period by default). */
+    cancel: (subscriptionId, opts = {}) => this.request(
+      `/app/payments/subscriptions/${encodeURIComponent(subscriptionId)}/cancel`,
+      { body: opts }
+    )
+  };
+  /**
+   * Your connectors (docs/CONNECTORS.md): call an API through Vibiz, which
+   * holds the key for this app's environment. The answer's `data` is the
+   * API's own content. A dangerous operation needs the owner's permission.
+   */
+  connectors = {
+    /** The connectors with their enabled operations and parameters. */
+    list: () => this.request("/app/connectors").then((r) => r.data),
+    call: (name, operation, input = {}) => this.request(`/app/connectors/${encodeURIComponent(name)}/call`, {
+      body: { operation, ...input }
+    })
+  };
+  /** Webhooks from Vibiz: `verify(rawBody, header)` checks the signature with VIBIZ_WEBHOOK_SECRET. */
+  webhooks = {
+    verify: (rawBody, header, secret) => verifyWebhook(rawBody, header, secret)
+  };
+  /**
+   * A server-side event in the project's analytics, next to the browser's.
+   * Never throws: analytics must not break the request that tracks it.
+   * Returns whether it was recorded (development keys don't record).
+   */
+  async track(name, opts = {}) {
+    try {
+      const user = opts.user ?? this.options.user;
+      const r = await this.request("/app/events", {
+        body: {
+          name,
+          ...user ? { user } : {},
+          ...opts.path ? { path: opts.path } : {},
+          ...opts.properties ? { properties: opts.properties } : {}
+        }
+      });
+      return r.recorded;
+    } catch (e) {
+      globalThis.console?.warn?.(
+        `vibiz.track(${name}) failed: ${e instanceof Error ? e.message : String(e)}`
+      );
+      return false;
+    }
+  }
+};
+var createVibiz = (options) => new VibizApp(options);
+var vibiz = new VibizApp();
+
+// packages/cli/src/billing.ts
+var dollars = (cents2) => `${cents2 < 0 ? "-" : ""}$${(Math.abs(cents2) / 100).toFixed(2)}`;
+function parseDollars(raw, what = "amount") {
+  const v = (raw ?? "").trim().replace(/^\$/, "");
+  if (!/^\d+(\.\d{1,2})?$/.test(v)) throw new Error(`${what} is in dollars, like 25 or 25.50`);
+  return Math.round(Number(v) * 100);
+}
+var STATUS = {
+  active: "active",
+  low: "low balance",
+  payment_required: "out of credits: paid calls are refused",
+  past_due: "out of credits for a week: deploys and new resources are paused",
+  exempt: "covered by Vibiz"
+};
+var KIND = {
+  trial: "Trial credit",
+  topup: "Credits",
+  company_payment: "Company formation (card)",
+  usage: "Usage",
+  refund: "Refund",
+  dispute: "Card dispute",
+  dispute_reversal: "Dispute won",
+  adjustment: "Adjustment"
+};
+function formatEntry(e) {
+  const when = e.created_at.slice(0, 10);
+  const what = e.kind === "usage" && e.day ? `Usage ${e.day}` : KIND[e.kind];
+  return `  ${when}  ${what.padEnd(26)} ${dollars(e.amount_cents).padStart(10)}${e.note && e.kind === "adjustment" ? `  ${e.note}` : ""}`;
+}
+function formatBilling(b, history) {
+  const lines = [
+    b.mode === "exempt" ? "Billing   Vibiz covers this account\u2019s usage" : `Balance   ${dollars(b.balance_cents)}   (${STATUS[b.status]})`
+  ];
+  if (b.pauses_at && b.status === "payment_required") {
+    lines.push(`          deploys pause on ${b.pauses_at.slice(0, 10)} unless credits are added`);
+  }
+  lines.push(
+    `Card      ${b.card ? `${b.card.brand} \u2022\u2022\u2022\u2022 ${b.card.last4}` : "none saved"}`,
+    `Auto      ${b.auto_recharge.enabled ? `on: below ${dollars(b.auto_recharge.threshold_cents)}, add ${dollars(b.auto_recharge.amount_cents)}` : `off${b.auto_recharge.disabled_reason === "card_declined" ? " (turned off after two declines)" : ""}`}`,
+    `Daily cap $${b.daily_spend_limit_usd} a day on AI and actions`
+  );
+  if (history?.data.length) {
+    lines.push("", "Recent");
+    for (const e of history.data) lines.push(formatEntry(e));
+  }
+  if (b.next_step) lines.push("", b.next_step);
+  lines.push("", `Add credits: vibiz billing top-up 25    Console: ${b.console_url}`);
+  return lines.join("\n");
+}
+
+// packages/cli/src/detect.ts
+import { readdir } from "node:fs/promises";
+var SIGNS = [
+  { kind: "vercel", label: "Vercel", files: /^(vercel\.json|\.vercel)$/, push: true },
+  { kind: "netlify", label: "Netlify", files: /^(netlify\.toml|\.netlify)$/, push: true },
+  { kind: "render", label: "Render", files: /^render\.ya?ml$/, push: true },
+  { kind: "railway", label: "Railway", files: /^railway\.(json|toml)$/, push: true },
+  { kind: "fly", label: "Fly.io", files: /^fly\.toml$/, push: true },
+  { kind: "heroku", label: "Heroku", files: /^(Procfile|app\.json)$/, push: true },
+  {
+    kind: "cloudflare-workers",
+    label: "Cloudflare (Workers; for Pages use cloudflare-pages)",
+    files: /^wrangler\.(toml|json|jsonc)$/,
+    push: true
+  },
+  { kind: "github-actions", label: "GitHub Actions", files: /^\.github$/, push: true },
+  {
+    kind: "docker",
+    label: "a container host (Docker)",
+    files: /^(Dockerfile|docker-compose\.ya?ml|compose\.ya?ml)$/,
+    push: false
+  },
+  {
+    kind: "aws",
+    label: "AWS (Serverless, SAM, Amplify, CDK)",
+    files: /^(serverless\.ya?ml|template\.ya?ml|samconfig\.toml|amplify\.yml|cdk\.json)$/,
+    push: false
+  },
+  {
+    kind: "gcp",
+    label: "Google Cloud (App Engine, Cloud Build)",
+    files: /^(app\.yaml|cloudbuild\.ya?ml)$/,
+    push: false
+  },
+  {
+    kind: "azure",
+    label: "Azure (Static Web Apps, azd)",
+    files: /^(staticwebapp\.config\.json|azure\.yaml)$/,
+    push: false
+  },
+  { kind: "digitalocean", label: "DigitalOcean App Platform", files: /^\.do$/, push: false }
+];
+async function detectHosts(dir) {
+  const names = await readdir(dir).catch(() => []);
+  const out = [];
+  for (const sign of SIGNS) {
+    const file = names.find((n) => sign.files.test(n));
+    if (file && !out.some((h) => h.kind === sign.kind)) {
+      out.push({ kind: sign.kind, label: sign.label, file, push: sign.push });
+    }
+  }
+  return out;
+}
+var ONE_KEY_PATHS = `  Put ONE secret in the host: VIBIZ_APP_KEY (an owner copies it from the console:
+  project \u25B8 Settings \u25B8 Production environment \u25B8 Show values). Then, at start:
+
+    Node, Bun, Deno     import { vibiz } from '@vibiz/app'; await vibiz.loadEnv();
+    any language        npx @vibiz/cli run -- <your start command>
+    Docker / shell      eval "$(curl -fsS -H "Authorization: Bearer $VIBIZ_APP_KEY" \\
+                          https://app.vibiz.app/v1/app/env?format=shell)" && exec <your server>
+    CI / build step     npx @vibiz/cli env pull --format dotenv -o .env.production`;
+
+// packages/cli/src/login.ts
+import { hostname, platform, release } from "node:os";
+import { join } from "node:path";
+
+// packages/cli/src/version.ts
+import { readFileSync } from "node:fs";
+function cliVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+// packages/cli/src/login.ts
+var DEFAULT_API_URL = "https://app.vibiz.app";
+var pendingFile = (dir) => join(dir, "pending-login.json");
+var configFile = (dir) => join(dir, "config.json");
+async function readJson(io, path) {
+  try {
+    return JSON.parse(String(await io.local().readFile(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+async function writePrivate(io, dir, path, value) {
+  const local = io.local();
+  await local.mkdir(dir, { recursive: true });
+  await local.writeFile(path, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  await local.chmod(path, 384);
+}
+async function forget(io, path) {
+  await io.local().writeFile(path, "{}\n", { mode: 384 }).catch(() => {
+  });
+}
+async function saveLogin(io, dir, saved) {
+  await writePrivate(io, dir, configFile(dir), saved);
+}
+async function readLogin(io, dir) {
+  return await readJson(io, configFile(dir)) ?? {};
+}
+var LoginError = class extends Error {
+};
+async function startLogin(api, f) {
+  let res;
+  try {
+    res = await f(`${api}/v1/cli/login`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        hostname: hostname(),
+        os: `${platform()} ${release()}`,
+        cli_version: cliVersion()
+      })
+    });
+  } catch {
+    throw new LoginError(`Could not reach ${api}. Check the address (--api) and your connection.`);
+  }
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body || !("device_code" in body)) {
+    const msg = body && "error" in body ? body.error?.message : void 0;
+    if (res.status === 404 || res.status === 503) {
+      throw new LoginError(
+        `${api} does not offer browser login${msg ? ` (${msg})` : ""}. Use: vibiz login --key <vz_sk_\u2026> --api ${api}`
+      );
+    }
+    throw new LoginError(msg ?? `Login could not start (HTTP ${res.status}).`);
+  }
+  return {
+    api,
+    device_code: body.device_code,
+    user_code: body.user_code,
+    verification_uri: body.verification_uri,
+    verification_uri_complete: body.verification_uri_complete,
+    interval: body.interval,
+    expires_at: Date.now() + body.expires_in * 1e3
+  };
+}
+async function browserLogin(io, api, deps) {
+  const f = deps.fetch ?? globalThis.fetch;
+  const sleep = deps.sleep ?? ((ms2) => new Promise((r) => setTimeout(r, ms2)));
+  const dir = deps.configDir;
+  const pendingPath = pendingFile(dir);
+  const previous = await readJson(io, pendingPath);
+  let pending;
+  const resumed = previous?.device_code && previous.api === api && typeof previous.expires_at === "number" && previous.expires_at > Date.now() + 15e3;
+  if (resumed) {
+    pending = previous;
+    io.log("Resuming the login started earlier.");
+  } else {
+    pending = await startLogin(api, f);
+    await writePrivate(io, dir, pendingPath, pending);
+  }
+  const minutes = Math.max(1, Math.round((pending.expires_at - Date.now()) / 6e4));
+  io.log(
+    [
+      "",
+      "To log in, open this link and click Authorize:",
+      "",
+      `  ${pending.verification_uri_complete}`,
+      "",
+      `  Code: ${pending.user_code}  (the page shows the same code)`,
+      "",
+      `Waiting for approval\u2026 (the link works for ${minutes} min; run \`vibiz login\` again to keep waiting)`
+    ].join("\n")
+  );
+  if (deps.open !== false) io.openUrl(pending.verification_uri_complete);
+  let interval = Math.max(1, pending.interval) * 1e3;
+  for (; ; ) {
+    if (Date.now() >= pending.expires_at) {
+      await forget(io, pendingPath);
+      throw new LoginError("The login link expired. Run `vibiz login` again.");
+    }
+    await sleep(interval);
+    let res;
+    try {
+      res = await f(`${api}/v1/cli/login/token`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ device_code: pending.device_code })
+      });
+    } catch {
+      continue;
+    }
+    const body = await res.json().catch(() => null);
+    if (res.ok && body?.api_key) {
+      await saveLogin(io, dir, {
+        apiKey: body.api_key,
+        apiUrl: api,
+        ...body.key?.id ? { keyId: body.key.id } : {},
+        source: "browser"
+      });
+      await forget(io, pendingPath);
+      io.log(
+        `
+\u2713 Logged in to ${body.account?.name ?? "your account"} as "${body.key?.name ?? "cli"}" (${body.key?.access ?? "agent"} key). Saved to ${configFile(dir)}`
+      );
+      return;
+    }
+    switch (body?.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        interval = (body.interval ?? interval / 1e3 + 5) * 1e3;
+        continue;
+      case "access_denied":
+        await forget(io, pendingPath);
+        throw new LoginError("The login was declined in the browser.");
+      case "expired_token":
+        await forget(io, pendingPath);
+        throw new LoginError("The login link expired. Run `vibiz login` again.");
+      default:
+        await forget(io, pendingPath);
+        throw new LoginError(
+          `Login failed (${body?.error ?? `HTTP ${res.status}`}). Run \`vibiz login\` again.`
+        );
+    }
+  }
+}
+
+// packages/cli/src/scaffold.ts
+import { existsSync } from "node:fs";
+import { cp, readdir as readdir2, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var TEMPLATES = ["nextjs-saas"];
+var SKIP = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".next",
+  ".vercel",
+  ".turbo",
+  ".git",
+  ".DS_Store",
+  "vibiz.json",
+  "next-env.d.ts"
+]);
+var isLocalEnv = (name) => (name === ".env" || name.startsWith(".env.")) && name !== ".env.example";
+var skipped = (name) => SKIP.has(name) || isLocalEnv(name) || name.endsWith(".tsbuildinfo");
+var HARMLESS = /* @__PURE__ */ new Set([".git", ".DS_Store"]);
+var PACKED_DOTFILES = [".gitignore", ".npmrc"];
+var packedName = (dotfile) => `_${dotfile.slice(1)}`;
+function templatesDir() {
+  const fromEnv = process.env.VIBIZ_TEMPLATES_DIR?.trim();
+  if (fromEnv) return fromEnv;
+  const here = dirname(fileURLToPath(import.meta.url));
+  const packaged = join2(here, "..", "templates");
+  if (existsSync(packaged)) return packaged;
+  return join2(here, "..", "..", "..", "templates");
+}
+function isTemplate(name) {
+  return TEMPLATES.includes(name);
+}
+function packageName(name) {
+  const slug = name.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+  return slug || "app";
+}
+async function isEffectivelyEmpty(dir) {
+  try {
+    return (await readdir2(dir)).every((e) => HARMLESS.has(e));
+  } catch (err) {
+    if (err.code === "ENOENT") return true;
+    throw err;
+  }
+}
+async function scaffold(opts) {
+  if (!opts.force && !await isEffectivelyEmpty(opts.dir)) {
+    throw new Error(`${opts.dir} is not empty. Use an empty folder, or pass --force.`);
+  }
+  const source = join2(opts.templatesRoot ?? templatesDir(), opts.template);
+  await cp(source, opts.dir, {
+    recursive: true,
+    force: true,
+    filter: (src) => {
+      const name = src.slice(source.length).split(/[\\/]/).pop() ?? "";
+      return src === source || !skipped(name);
+    }
+  }).catch((err) => {
+    if (err.code === "ENOENT") {
+      throw new Error(`Template "${opts.template}" not found in ${dirname(source)}`);
+    }
+    throw err;
+  });
+  for (const dotfile of PACKED_DOTFILES) {
+    await rename(join2(opts.dir, packedName(dotfile)), join2(opts.dir, dotfile)).catch((err) => {
+      if (err.code !== "ENOENT") throw err;
+    });
+  }
+  await setAppName(opts.dir, opts.name);
+}
+async function setAppName(dir, name) {
+  const pkgPath = join2(dir, "package.json");
+  const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
+  pkg.name = packageName(name);
+  await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}
+`);
+  const lockPath = join2(dir, "package-lock.json");
+  const lockText = await readFile(lockPath, "utf8").catch(() => null);
+  if (lockText !== null) {
+    const lock = JSON.parse(lockText);
+    lock.name = pkg.name;
+    const root = lock.packages?.[""];
+    if (root) root.name = pkg.name;
+    await writeFile(lockPath, `${JSON.stringify(lock, null, 2)}
+`);
+  }
+  const configPath = join2(dir, "app.config.ts");
+  const config = await readFile(configPath, "utf8").catch(() => null);
+  if (config === null) return;
+  const literal = `'${name.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+  const next = config.replace(/^(\s*name:\s*)(['"`]).*?\2/m, (_m, lead) => lead + literal);
+  if (next === config) throw new Error(`Could not set the app name in ${configPath}`);
+  await writeFile(configPath, next);
+}
+
+// packages/cli/src/setup.ts
+import { accessSync, constants } from "node:fs";
+import { homedir, platform as platform2 } from "node:os";
+import { delimiter, dirname as dirname2, join as join3 } from "node:path";
+var CLIENT_NAMES = {
+  "claude code": "claude",
+  claude: "claude",
+  codex: "codex",
+  "codex cli": "codex",
+  cursor: "cursor",
+  "vs code with copilot": "vscode",
+  "vs code": "vscode",
+  vscode: "vscode",
+  windsurf: "windsurf",
+  "gemini cli": "gemini",
+  gemini: "gemini",
+  opencode: "opencode"
+};
+var LABEL = {
+  claude: "Claude Code",
+  codex: "Codex",
+  cursor: "Cursor",
+  vscode: "VS Code with Copilot",
+  windsurf: "Windsurf",
+  gemini: "Gemini CLI",
+  opencode: "OpenCode"
+};
+var homeOf = (io) => io.home ?? homedir();
+function onPath(cmd, env) {
+  const exts = platform2() === "win32" ? [".cmd", ".exe", ""] : [""];
+  for (const dir of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
+    for (const ext of exts) {
+      try {
+        accessSync(join3(dir, cmd + ext), constants.X_OK);
+        return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function parseClients(raw) {
+  if (!raw) {
+    throw new Error(
+      `usage: vibiz mcp add --clients "<client>"  (${Object.values(LABEL).map((l) => `"${l}"`).join(", ")})`
+    );
+  }
+  const out = [];
+  for (const part of raw.split(",")) {
+    const c = CLIENT_NAMES[part.trim().toLowerCase()];
+    if (!c)
+      throw new Error(
+        `Unknown client "${part.trim()}". Use one of: ${Object.values(LABEL).join(", ")}`
+      );
+    if (!out.includes(c)) out.push(c);
+  }
+  return out;
+}
+function mcpConfigPath(client, home) {
+  switch (client) {
+    case "cursor":
+      return join3(home, ".cursor", "mcp.json");
+    case "windsurf":
+      return join3(home, ".codeium", "windsurf", "mcp_config.json");
+    case "gemini":
+      return join3(home, ".gemini", "settings.json");
+    case "opencode":
+      return join3(home, ".config", "opencode", "opencode.json");
+    case "vscode":
+      if (platform2() === "darwin")
+        return join3(home, "Library", "Application Support", "Code", "User", "mcp.json");
+      if (platform2() === "win32")
+        return join3(
+          process.env.APPDATA ?? join3(home, "AppData", "Roaming"),
+          "Code",
+          "User",
+          "mcp.json"
+        );
+      return join3(home, ".config", "Code", "User", "mcp.json");
+  }
+}
+function jsonEntry(client, url) {
+  switch (client) {
+    case "cursor":
+      return { key: "mcpServers", entry: { url } };
+    case "windsurf":
+      return { key: "mcpServers", entry: { serverUrl: url } };
+    case "gemini":
+      return { key: "mcpServers", entry: { command: "npx", args: ["mcp-remote", url] } };
+    case "opencode":
+      return { key: "mcp", entry: { type: "remote", url, enabled: true } };
+    case "vscode":
+      return { key: "servers", entry: { type: "http", url } };
+  }
+}
+async function readText(io, path) {
+  try {
+    return String(await io.local().readFile(path, "utf8"));
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw e;
+  }
+}
+async function mergeJsonServer(io, path, key, entry) {
+  const text = await readText(io, path);
+  let doc = {};
+  if (text?.trim()) {
+    try {
+      doc = JSON.parse(text);
+    } catch {
+      throw new Error(
+        `${path} isn't plain JSON (comments?), so it was left as it is. Add the vibiz entry by hand: ${JSON.stringify({ [key]: { vibiz: entry } })}`
+      );
+    }
+    if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+      throw new Error(`${path} isn't a JSON object, so it was left as it is.`);
+    }
+  }
+  const servers = doc[key] ?? {};
+  if (typeof servers !== "object" || Array.isArray(servers)) {
+    throw new Error(`${path}: "${key}" isn't an object, so it was left as it is.`);
+  }
+  const before = servers.vibiz;
+  if (before && JSON.stringify(before) === JSON.stringify(entry)) return "unchanged";
+  doc[key] = { ...servers, vibiz: entry };
+  const local = io.local();
+  await local.mkdir(dirname2(path), { recursive: true });
+  await local.writeFile(path, `${JSON.stringify(doc, null, 2)}
+`);
+  return before ? "updated" : "added";
+}
+async function mergeCodexToml(io, path, url) {
+  const text = await readText(io, path) ?? "";
+  if (/^\s*\[mcp_servers\.vibiz\]\s*$/m.test(text)) return "unchanged";
+  const local = io.local();
+  await local.mkdir(dirname2(path), { recursive: true });
+  const sep = text && !text.endsWith("\n") ? "\n\n" : text ? "\n" : "";
+  await local.writeFile(path, `${text}${sep}[mcp_servers.vibiz]
+url = "${url}"
+`);
+  return "added";
+}
+var run = (io, cmd, args) => io.local().exec(cmd, args, io.env);
+async function mcpAdd(io, api, rawClients) {
+  const url = `${api}/mcp`;
+  const home = homeOf(io);
+  let failed = false;
+  for (const client of parseClients(rawClients)) {
+    const name = LABEL[client];
+    try {
+      if (client === "claude" && onPath("claude", io.env)) {
+        if (await run(io, "claude", ["mcp", "get", "vibiz"]) === 0) {
+          io.log(`\u25CF ${name}: already has a vibiz server (claude mcp get vibiz)`);
+        } else {
+          const code = await run(io, "claude", [
+            "mcp",
+            "add",
+            "--transport",
+            "http",
+            "vibiz",
+            "--scope",
+            "user",
+            url
+          ]);
+          if (code !== 0) throw new Error(`claude mcp add exited with ${code}`);
+          io.log(`\u25CF ${name}: added ${url} (user scope)`);
+        }
+        io.log("  To sign in: open /mcp in Claude Code, select vibiz, choose Authenticate.");
+        continue;
+      }
+      if (client === "claude") {
+        const path2 = join3(home, ".claude.json");
+        const out2 = await mergeJsonServer(io, path2, "mcpServers", { type: "http", url });
+        io.log(`\u25CF ${name}: ${out2} in ${path2}`);
+        io.log("  To sign in: open /mcp in Claude Code, select vibiz, choose Authenticate.");
+        continue;
+      }
+      if (client === "codex" && onPath("codex", io.env)) {
+        if (await run(io, "codex", ["mcp", "get", "vibiz"]) === 0) {
+          io.log(`\u25CF ${name}: already has a vibiz server (codex mcp get vibiz)`);
+        } else {
+          const code = await run(io, "codex", ["mcp", "add", "vibiz", "--url", url]);
+          if (code !== 0) throw new Error(`codex mcp add exited with ${code}`);
+          io.log(`\u25CF ${name}: added ${url}`);
+        }
+        io.log("  Not signed in yet? Run: codex mcp login vibiz");
+        continue;
+      }
+      if (client === "codex") {
+        const path2 = join3(io.env.CODEX_HOME || join3(home, ".codex"), "config.toml");
+        const out2 = await mergeCodexToml(io, path2, url);
+        io.log(`\u25CF ${name}: ${out2} in ${path2}`);
+        io.log("  To sign in: codex mcp login vibiz");
+        continue;
+      }
+      const path = mcpConfigPath(client, home);
+      const { key, entry } = jsonEntry(client, url);
+      const out = await mergeJsonServer(io, path, key, entry);
+      io.log(`\u25CF ${name}: ${out} in ${path}`);
+      io.log(`  ${SIGN_IN_HINT[client]}`);
+    } catch (e) {
+      failed = true;
+      io.error(`\u2715 ${name}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  if (failed) io.setExitCode(1);
+}
+var SIGN_IN_HINT = {
+  cursor: 'Cursor shows "Needs login" next to vibiz: click it to sign in.',
+  vscode: 'Run "MCP: List Servers", start vibiz and allow authentication.',
+  windsurf: "Refresh the MCP configuration in Windsurf; it opens the sign-in.",
+  gemini: "Run Gemini CLI and /mcp list: mcp-remote opens the sign-in.",
+  opencode: "Run /mcps in OpenCode, select vibiz and sign in."
+};
+var AGENTS = ["claude", "codex", "cursor"];
+var AGENT_DIR = {
+  claude: ".claude/skills",
+  codex: ".agents/skills",
+  cursor: ".cursor/skills"
+};
+function detectAgent(env) {
+  if (env.CLAUDECODE) return "claude";
+  if (Object.keys(env).some((k) => k.startsWith("CODEX_"))) return "codex";
+  if (Object.keys(env).some((k) => k.startsWith("CURSOR_"))) return "cursor";
+  return "claude";
+}
+function skillsDir(io, agent, global) {
+  return join3(global ? homeOf(io) : io.local().cwd(), AGENT_DIR[agent]);
+}
+async function skillIndex(io, api) {
+  const f = io.fetch ?? fetch;
+  const res = await f(`${api}/skills/index.json`);
+  if (!res.ok)
+    throw new Error(`Could not list the skills (${res.status} from ${api}/skills/index.json)`);
+  return await res.json();
+}
+function parseAgent(raw, env) {
+  if (!raw) return detectAgent(env);
+  const a = raw.toLowerCase().replace(/ code$/, "");
+  if (!AGENTS.includes(a)) throw new Error("--agent is claude, codex or cursor");
+  return a;
+}
+async function installed(io, dir, name) {
+  return await readText(io, join3(dir, name, "SKILL.md")) !== null;
+}
+async function skillsList(io, api, opts) {
+  const agent = parseAgent(opts.agent, io.env);
+  const { skills } = await skillIndex(io, api);
+  const global = skillsDir(io, agent, true);
+  const project = skillsDir(io, agent, false);
+  const rows = [];
+  for (const s of skills) {
+    const where = await installed(io, global, s.name) ? "global" : await installed(io, project, s.name) ? "project" : null;
+    rows.push({ name: s.name, description: s.description, installed: where });
+  }
+  if (opts.json) {
+    io.log(JSON.stringify({ agent, skills: rows }, null, 2));
+    return;
+  }
+  io.log(
+    `Vibiz skills for ${agent === "claude" ? "Claude Code" : agent === "codex" ? "Codex" : "Cursor"}:`
+  );
+  for (const r of rows) {
+    io.log(`  ${r.installed ? "\u25CF" : "\u25CB"} ${r.name.padEnd(18)} ${r.installed ?? "not installed"}`);
+  }
+}
+async function skillsAdd(io, api, names, opts) {
+  const agent = parseAgent(opts.agent, io.env);
+  const { skills } = await skillIndex(io, api);
+  const pick = names.length ? skills.filter((s) => names.includes(s.name)) : skills;
+  const unknown = names.filter((n) => !skills.some((s) => s.name === n));
+  if (unknown.length) {
+    throw new Error(`No skill named ${unknown.join(", ")}. Run: vibiz skills list`);
+  }
+  const dir = skillsDir(io, agent, Boolean(opts.global));
+  const f = io.fetch ?? fetch;
+  const local = io.local();
+  const prefix = `${api}/skills/`;
+  for (const s of pick) {
+    for (const url of s.files) {
+      const rel = url.startsWith(`${prefix}${s.name}/`) ? url.slice(prefix.length) : null;
+      if (!rel || rel.split("/").some((p) => p === ".." || p === "")) {
+        throw new Error(`Unexpected file in ${s.name}: ${url}`);
+      }
+      const res = await f(url);
+      if (!res.ok) throw new Error(`Could not download ${url} (${res.status})`);
+      const target = join3(dir, rel);
+      await local.mkdir(dirname2(target), { recursive: true });
+      await local.writeFile(target, await res.text());
+    }
+  }
+  io.log(`\u25CF Installed ${pick.length} skill${pick.length === 1 ? "" : "s"} in ${dir}`);
+  for (const s of pick) io.log(`  ${s.name}`);
+  io.log(
+    agent === "cursor" ? "  Cursor loads them in a new chat." : "  New skills load on their own; restart the session if one does not show up."
+  );
+}
+
+// packages/cli/src/usage.ts
+var money = formatUsd;
+var unitsText = formatUnits;
+function table(head, rows, numeric = []) {
+  const widths = head.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
+  const cell = (v, i) => numeric.includes(i) ? v.padStart(widths[i] ?? 0) : v.padEnd(widths[i] ?? 0);
+  const line = (r) => `  ${r.map((v, i) => cell(v, i)).join("  ").trimEnd()}`;
+  return [line(head), line(widths.map((w) => "\u2500".repeat(w))), ...rows.map(line)].join("\n");
+}
+function rowLabel(r, groups) {
+  return groups.map((g) => {
+    if (g === "project") return r.project_name ?? r.project ?? "account";
+    if (g === "api_key") return r.api_key_name ?? r.api_key ?? "system";
+    if (g === "end_user") return r.end_user ?? "unattributed";
+    const v = r[g];
+    return v === null || v === void 0 ? "\u2013" : String(v);
+  }).join(" \xB7 ");
+}
+var bar = (used, limit, width = 20) => {
+  const f = limit > 0 ? Math.min(1, used / limit) : 0;
+  const n = Math.round(f * width);
+  return `${"\u2588".repeat(n)}${"\u2591".repeat(width - n)} ${Math.round(f * 100)}%`;
+};
+function formatUsage(r) {
+  const out = [];
+  out.push(`Usage, ${r.period} (${r.from.slice(0, 10)} \u2192 ${r.to.slice(0, 10)})`);
+  out.push(
+    `  billed ${money(r.totals.billed_usd)} \xB7 cost ${money(r.totals.cost_usd)} \xB7 ${r.totals.records} records`
+  );
+  out.push("");
+  if (!r.data.length) out.push("  No usage in this period.");
+  else {
+    out.push(
+      table(
+        [r.group_by.join(" \xB7 "), "units", "cost", "billed"],
+        r.data.map((row) => [
+          rowLabel(row, r.group_by),
+          unitsText(row.units),
+          money(row.cost_usd),
+          money(row.billed_usd)
+        ]),
+        [2, 3]
+      )
+    );
+  }
+  const l = r.limits;
+  if (l) {
+    out.push("", "  limits (today, resets at UTC midnight)");
+    out.push(
+      `  daily spend   ${bar(l.daily_spend.spent_usd, l.daily_spend.limit_usd)}  ${money(l.daily_spend.spent_usd)} of ${money(l.daily_spend.limit_usd)}`
+    );
+    out.push(
+      `  projects      ${bar(l.projects.used, l.projects.limit)}  ${l.projects.used} of ${l.projects.limit}`
+    );
+    for (const b of l.builds_today.filter((x) => x.used > 0)) {
+      out.push(
+        `  builds        ${bar(b.used, b.limit)}  ${b.used} of ${b.limit}  ${b.project_name}`
+      );
+    }
+    for (const a of l.ai_budgets.filter((x) => x.daily_budget_usd !== null)) {
+      out.push(
+        `  AI budget     ${bar(a.spent_today_usd, a.daily_budget_usd ?? 0)}  ${money(a.spent_today_usd)} of ${money(a.daily_budget_usd ?? 0)}  ${a.project_id}`
+      );
+    }
+    for (const e of l.email_today) {
+      out.push(`  emails        ${bar(e.used, e.limit)}  ${e.used} of ${e.limit}  ${e.project_id}`);
+    }
+  }
+  return out.join("\n");
+}
+var ms = (v) => v === null ? "\u2013" : `${v} ms`;
+var pct = (v) => `${(v * 100).toFixed(1)}%`;
+function formatMetrics(r) {
+  const t = r.totals;
+  const out = [
+    `Requests, ${r.period}`,
+    `  ${t.requests} requests \xB7 ${pct(t.error_rate)} errors (5xx) \xB7 p50 ${ms(t.p50_ms)} \xB7 p95 ${ms(t.p95_ms)}`,
+    ""
+  ];
+  if (!r.data.length) out.push("  No requests in this period.");
+  else {
+    out.push(
+      table(
+        ["capability", "requests", "5xx", "4xx", "p50", "p95", "p99"],
+        r.data.map((d) => [
+          d.capability,
+          String(d.requests),
+          pct(d.error_rate),
+          String(d.errors_4xx),
+          ms(d.p50_ms),
+          ms(d.p95_ms),
+          ms(d.p99_ms)
+        ]),
+        [1, 2, 3, 4, 5, 6]
+      )
+    );
+  }
+  return out.join("\n");
+}
+function formatAdminMetrics(m) {
+  const out = [
+    `Platform, ${m.period}`,
+    `  tenants ${m.tenants.active} active of ${m.tenants.total}`,
+    `  revenue ${money(m.revenue.billed_usd)} \xB7 cost ${money(m.revenue.cost_usd)} \xB7 margin ${money(m.revenue.margin_usd)}${m.revenue.margin_pct === null ? "" : ` (${m.revenue.margin_pct}%)`} \xB7 ${m.pricing.default_markup_pct === 0 && m.pricing.rules === 0 ? "markup 0 % (pricing not set)" : `markup ${m.pricing.default_markup_pct} %`}`,
+    `  north-star ${m.north_star.value}: ${m.north_star.definition}`,
+    `  queue ${m.queue.queued} queued, oldest ${m.queue.oldest_queued_age_seconds}s \xB7 ${m.queue.running} running \xB7 ${m.queue.failed_24h} failed in 24 h`,
+    ""
+  ];
+  const section = (title, rows, groups) => {
+    if (!rows.length) return;
+    out.push(
+      `  ${title}`,
+      table(
+        [groups.join(" \xB7 "), "units", "cost", "billed"],
+        rows.map((r) => [
+          groups.map((g) => (g === "tenant" ? r.tenant_name ?? r.tenant : r[g]) || "\u2013").join(" \xB7 "),
+          unitsText(r.units),
+          money(r.cost_usd),
+          money(r.billed_usd)
+        ]),
+        [2, 3]
+      ),
+      ""
+    );
+  };
+  section("by capability", m.revenue.by_capability, ["capability"]);
+  section("by partner", m.spend.by_provider, ["provider"]);
+  section("by model", m.spend.by_model, ["model", "provider"]);
+  section("top tenants", m.top_tenants, ["tenant"]);
+  if (m.providers.length) {
+    out.push(
+      "  partner health",
+      table(
+        ["partner", "calls", "errors", "p50", "p95"],
+        m.providers.map((p) => [
+          p.provider,
+          String(p.calls),
+          pct(p.error_rate),
+          ms(p.p50_ms),
+          ms(p.p95_ms)
+        ]),
+        [1, 2, 3, 4]
+      ),
+      ""
+    );
+  }
+  if (m.requests.rows.length) {
+    out.push(
+      "  routes",
+      table(
+        ["route", "requests", "5xx", "p50", "p95", "p99"],
+        m.requests.rows.slice(0, 20).map((r) => [
+          `${r.method} ${r.route}`,
+          String(r.requests),
+          pct(r.error_rate),
+          ms(r.p50_ms),
+          ms(r.p95_ms),
+          ms(r.p99_ms)
+        ]),
+        [1, 2, 3, 4, 5]
+      )
+    );
+  }
+  return out.join("\n");
+}
+
+// packages/cli/src/commands.ts
+var CONFIG_DIR = join4(homedir2(), ".vibiz");
+var CONFIG_FILE = join4(CONFIG_DIR, "config.json");
+var PROJECT_FILE = "vibiz.json";
+var HELP = `vibiz \u2014 website, database and sign-in for a new business, in one command
+
+  vibiz login                                log in from the browser: prints a link, you click
+                                             Authorize, a new agent key is saved here
+       [--key <vz_sk_\u2026>] [--api <url>] [--no-browser]   or save a key you already have
+  vibiz signup                               the same as login: no account yet? one is opened
+                                             for you on the way
+  vibiz whoami                               the account and key this machine uses
+  vibiz logout                               forget this machine's key (a browser login's key is
+                                             revoked too)
+  vibiz init <name> [--resources a,b]        create a project here (default: hosting,database,auth)
+       [--template nextjs-saas] [--force]     \u2026first copying a starter app into this folder
+  vibiz status                               this project, its resources and deployments
+  vibiz deploy [dir] [--preview] [--project <id>]
+                                             upload and deploy live (or a preview with --preview)
+  vibiz promote <deployment-id>              make a deployment the live site
+  vibiz rollback                             go back to the previous production deployment
+  vibiz dev [--write <file>] [--reset]      the development env (own database branch with your
+                                             schema and no production rows, own sign-in, own AI
+                                             key) into .env.development.local
+  vibiz dev -- <command\u2026>                    run a command with the development env, no file
+  vibiz env [--write <file>]                 the PRODUCTION env (owner keys only), to paste into
+                                             a host outside Vibiz; agents use \`vibiz dev\`
+  vibiz domains [add|rm <domain>]            where the app runs outside Vibiz hosting; sign-in
+                                             trusts these (owner keys only)
+  vibiz auth [--dev] [--json]                how people sign in: providers, callback URLs, email
+                                             (production for owner keys; --dev the development copy)
+  vibiz auth providers add <google|github|vercel> [--own --client-id <id>] [--dev]
+                                             turn on a social sign-in; --own uses your OAuth app,
+                                             its secret from <PROVIDER>_CLIENT_SECRET or a prompt
+  vibiz auth providers rm <provider> [--dev] turn one off
+  vibiz auth domains <a.com,b.com|none> [--dev]   only these email domains may sign up
+  vibiz company [--dev] [--json]             the business behind this project: status, what blocks
+                                             filing, the next step (production for owner keys)
+  vibiz company draft --file company.json [--dev]   create or replace the draft (docs/COMPANY.md)
+  vibiz company submit [--dev]               file it; production shows the price and asks you to
+                                             type the company's name (real filing, real fees)
+  vibiz company sign <ss4|form_8821> [--dev] a fresh signing link, for you only
+  vibiz company docs [download <id>] [--dev] formation documents, or a short-lived download link
+  vibiz company simulate <formation|ein>     development only: complete that step at the sandbox
+  vibiz payments [--dev] [--json]            take payments: balance, getting paid, the next step
+                                             (production for owner keys; --dev test mode)
+  vibiz payments products [--dev]            the catalog; add one with
+       products add <name> --amount <cents> [--interval month|year] [--lookup-key k]
+  vibiz payments checkout <price_id|lookup_key> --success-url <u> --cancel-url <u> [--user id]
+                                             a checkout link to pay right now
+  vibiz payments list [--dev]                payments, newest first
+  vibiz payments webhook <url|none> [--dev]  where Vibiz POSTs payment events (the app verifies
+                                             them with VIBIZ_WEBHOOK_SECRET: vibiz docs webhooks)
+  vibiz payments withdraw [--amount <cents>] [--dev]
+                                             send the balance to your bank; shows the amount and
+                                             asks you to confirm
+  vibiz payments simulate <payment|dispute|release_hold> [--amount <cents>]
+  vibiz payments simulate refund <payment_id> development only: a test-mode payment, dispute,
+                                             refund, or release the hold
+                                             (fees, the hold, refunds and webhooks: vibiz docs payments)
+  vibiz social [--dev] [--json]              the project's social and ad accounts, posts waiting for
+                                             you, scheduled and failed (docs/SOCIAL.md); --dev is the
+                                             sandbox: nothing is posted, nothing is spent
+  vibiz social connect <platform> [--ads] [--dev] [--open]
+                                             a link to sign in to instagram, facebook, tiktok, linkedin,
+                                             x, youtube, pinterest, threads, bluesky, reddit,
+                                             google_business, telegram (--ads: meta, google, tiktok,
+                                             linkedin, pinterest, x)
+  vibiz social accounts [--dev] [--json]     connected accounts and their ids
+  vibiz social post "<text>" --to <account,\u2026> [--media <file|url>]\u2026 [--at <iso>] [--draft]
+       [--opt key=value]\u2026 [--dev]            publish now, schedule or draft; a live post asks you to
+                                             confirm (an agent key's post waits for the owner)
+  vibiz social posts [--status s] [--dev]    posts, newest first
+  vibiz social approve|reject|cancel <post> [--dev]   decide a waiting post, or cancel one
+  vibiz social campaigns [--dev]             ad campaigns with budget and spend
+  vibiz social pause|resume <campaign> [--dev] | budget <campaign> --budget <cents>
+                                             change a campaign (live: you confirm; agents ask the owner)
+  vibiz connectors [list] [--json]           your own APIs, called through Vibiz, which holds their
+                                             keys (docs/CONNECTORS.md)
+  vibiz connectors import <spec-url|file> [--name n] [--enable op,op] [--add]
+                                             preview an OpenAPI 3 spec (JSON or YAML): its operations
+                                             and what could not be taken; --add saves it (reads on)
+  vibiz connectors add --file manifest.json  add one from a manifest, or a short one:
+       add <name> <base_url> "GET /path/{id}?q" "POST /path" \u2026 [--auth none|bearer|header:X-Api-Key|query:appid] [--var NAME]
+  vibiz connectors ops <name> [--json]       its operations: risk, on/off, parameters
+  vibiz connectors enable|disable <name> <op\u2026>   allow (or stop) operations
+  vibiz connectors secret <name> <VAR> [--dev]   set a key from $VAR or a hidden prompt; never printed.
+                                             Production needs an owner key
+  vibiz connectors call <name> <op> [key=value\u2026] [--body '<json>'] [--dev] [--approval <id>]
+                                             call it; dangerous operations (and production writes)
+                                             by an agent key wait for the owner's approval
+  vibiz connectors check <name> [--dev]      does the key work
+  vibiz connectors logs <name> [--dev]       recent calls (no content)
+  vibiz connectors approvals | approve <id> | deny <id>   calls waiting for the owner (owner key)
+  vibiz connect                              where does this app deploy? how that host gets its env
+  vibiz run -- <command\u2026>                    with VIBIZ_APP_KEY set (a server, a container, CI): run
+                                             the command with the app's env; any language
+  vibiz env pull [--format dotenv|shell|docker|json] [-o file]
+                                             the app's env from VIBIZ_APP_KEY, for a build step
+  vibiz hosts                                hosts outside Vibiz that get the env server to server
+  vibiz hosts add <host> <app> [field=value\u2026] [--dev]
+                                             connect your own host so Vibiz keeps its env in sync
+                                             (owner key): vercel, netlify, render, railway, fly,
+                                             heroku, cloudflare-workers, cloudflare-pages,
+                                             github-actions. The token comes from the host's usual
+                                             variable (VERCEL_TOKEN, FLY_API_TOKEN\u2026) or a hidden
+                                             prompt. Any other host: vibiz connect
+  vibiz hosts sync | rm <id> [--keep-values] push again now, or disconnect
+  vibiz app-key [rotate [--dev] [--grace <s>]]   the app's one key (VIBIZ_APP_KEY); never printed
+  vibiz add <hosting|database|auth|email|analytics|replay> add a resource to this project
+  vibiz analytics [--period 24h|7d|30d] [--json]  visitors, pages, sources, events
+  vibiz replays [--errors] [--rage] [--dead] [--path /x] [--period 7d] [--json]
+                                             what went wrong for visitors, then sessions to watch
+  vibiz replay <id> [--json]                 one session's signals and a link to watch it
+  vibiz projects                             list your projects
+  vibiz run <action> --input '<json>'        run an action (web.scrape, \u2026)
+  vibiz send --to <addr> --subject <s> --text <body> [--from info]
+                                             send email from this project's address
+  vibiz ai "<prompt>" [--model m] [--system s] stream an answer from a language model (metered)
+                                             --model: a Vibiz model (vibiz/smart) or any lab model
+                                             (anthropic/claude-sonnet-5.5): app.vibiz.app/docs/ai
+  vibiz ai models [search\u2026] [--all] [--json]  the Vibiz models and the model each runs, with prices;
+                                             --all (or a search) lists every model you can call
+  vibiz ai keys [set|test|remove google] [--project id]
+                                             your own Google key: calls it serves run only on it
+                                             and cost 0 here. set reads GEMINI_API_KEY or a hidden
+                                             prompt; --vertex sa.json [--gcp-project p] [--region r]
+                                             for Vertex AI (Google Cloud credits)
+  vibiz image "<prompt>" -o out.png [--size 1024x1024] [--model m]   generate an image
+  vibiz say "<text>" -o out.mp3 [--voice alloy]                     text to speech
+  vibiz transcribe <audio-file> [--language en]                     speech to text
+  vibiz usage [--period 24h|7d|30d|month] [--by tool|model|alias|project|api_key|end_user|day|capability]
+       [--project id] [--model m] [--tool t] [--end-user u] [--api-key k] [--json] [--open]
+                                             what you used, what it cost, how close you are to limits
+  vibiz billing [--json]                     the account's credits: balance, card, auto-recharge
+  vibiz billing top-up <dollars> [--open]    a payment link to add credits (a person pays there)
+  vibiz billing history [--kind usage,topup] what came in and what used it
+  vibiz billing auto-recharge on|off [--threshold 5] [--amount 25]   (owner key)
+  vibiz metrics [--period 7d] [--json]       request counts, error rate and latency by capability
+  vibiz keys [create <name> [--owner] | revoke <id>]
+                                             named API keys, one per person or agent; agent keys
+                                             (the default) never read production secrets
+  vibiz admin metrics [--period 7d] [--json] [--open]   the platform view (admin key)
+  vibiz mcp                                  serve the Vibiz tools to AI agents (MCP, stdio)
+  vibiz mcp add --clients "<client>[,\u2026]"     connect a coding agent to the remote MCP server once:
+                                             "Claude Code", Codex, Cursor, "VS Code with Copilot",
+                                             Windsurf, "Gemini CLI", OpenCode (merges, never replaces)
+  vibiz skills [list]                        the agent skills, and which this agent has
+  vibiz skills add [name\u2026] [--global] [--agent claude|codex|cursor]
+                                             install them (default: all, this folder, this agent)
+  vibiz docs [topic]                         short guides: payments, app-payments (checkout and
+                                             subscription code), webhooks, company, keys, usage,
+                                             connectors, social
+
+  Env: VIBIZ_API_KEY, VIBIZ_API_URL override the saved login.
+  AI commands bill the account (or --project <id>); each prints what it cost.`;
+var TOKEN_ENV = {
+  vercel: "VERCEL_TOKEN",
+  netlify: "NETLIFY_AUTH_TOKEN",
+  render: "RENDER_API_KEY",
+  railway: "RAILWAY_TOKEN",
+  fly: "FLY_API_TOKEN",
+  heroku: "HEROKU_API_KEY",
+  "cloudflare-workers": "CLOUDFLARE_API_TOKEN",
+  "cloudflare-pages": "CLOUDFLARE_API_TOKEN",
+  "github-actions": "GITHUB_TOKEN"
+};
+var usd = (micro) => `$${(micro / 1e6).toFixed(micro < 1e4 ? 6 : 4)}`;
+var dot = (status) => ({ ready: "\u25CF", failed: "\u2715", succeeded: "\u25CF", building: "\u25D0", provisioning: "\u25D0" })[status] ?? "\u25CB";
+function printProject(io, p) {
+  io.log(`${p.name}  (${p.id})`);
+  if (p.url) io.log(`  ${p.url}`);
+  for (const r of p.resources) {
+    const detail = r.error ? `  ${r.error.message}` : "";
+    io.log(`  ${dot(r.status)} ${r.type.padEnd(9)} ${r.status}${detail}`);
+  }
+}
+function printAuth(io, a) {
+  const on = (b) => b ? "on" : "off";
+  io.log(`Sign-in (${a.environment})  ${a.base_url}`);
+  if (a.app_name) io.log(`  app name in emails: ${a.app_name}`);
+  const ep = a.email_password;
+  io.log(
+    `  email + password ${on(ep.enabled)} \xB7 verification ${ep.require_email_verification ? `required (${ep.email_verification_method})` : "optional"} \xB7 sign-up ${ep.disable_sign_up ? "closed" : "open"}`
+  );
+  io.log(
+    `  magic link ${on(a.magic_link.enabled)}${a.magic_link.enabled ? ` (${a.magic_link.expires_in_minutes} min)` : ""} \xB7 localhost ${on(a.allow_localhost)}`
+  );
+  io.log("\n  providers");
+  if (!a.providers.length) io.log("  none");
+  for (const p of a.providers) {
+    io.log(
+      `  ${dot("ready")} ${p.id.padEnd(7)} ${p.credentials === "own" ? `own app ${p.client_id}` : "shared keys"}`
+    );
+    if (p.credentials === "own") io.log(`            callback: ${p.callback_url}`);
+  }
+  io.log(
+    `
+  sign-up: ${a.allowed_email_domains.length ? a.allowed_email_domains.map((d) => `@${d}`).join(", ") : "any email"}`
+  );
+  io.log(
+    `  email from: ${a.email_sender.type === "smtp" ? `${a.email_sender.sender_email} via ${a.email_sender.host}:${a.email_sender.port}` : "the shared sender"}`
+  );
+  if (a.trusted_origins.length) io.log(`  trusted: ${a.trusted_origins.join(", ")}`);
+}
+var cents = (n) => `$${(n / 100).toFixed(2)}`;
+var companyName = (c) => c.legal_name ?? (c.names[0] ? `${c.names[0].name} ${c.names[0].ending}` : "(no name yet)");
+function printCompany(io, c) {
+  const label = c.entity_type === "llc" ? "LLC" : "C-Corp";
+  io.log(`${companyName(c)}  ${label} in ${c.state} (${c.environment})  ${c.status}`);
+  if (c.filing_number) io.log(`  filed ${c.formed_on ?? ""} \xB7 filing number ${c.filing_number}`);
+  if (c.ein_number) io.log(`  EIN ${c.ein_number}`);
+  const price = c.price ?? c.quote;
+  if (price) {
+    io.log(
+      `  ${c.price ? "price" : "quote"}: ${cents(price.total_cents)} (state ${cents(price.state_fee_cents)} + service ${cents(price.service_fee_cents)})`
+    );
+  }
+  const open = c.actions.filter((a) => a.open);
+  const pending = c.signatures.filter((x) => x.status === "pending");
+  if (open.length || pending.length) {
+    io.log("\n  needs you");
+    for (const a of open) io.log(`  ! ${a.code}: ${a.reason}`);
+    for (const x of pending) io.log(`  ! sign ${x.document}: vibiz company sign ${x.document}`);
+  }
+  if (c.problems.length) {
+    io.log("\n  before it can be filed");
+    for (const p of c.problems) io.log(`  - ${p.path}: ${p.message}`);
+  }
+  if (c.documents.length) io.log(`
+  documents: ${c.documents.length} (vibiz company docs)`);
+  const next = c.status === "draft" ? c.problems.length ? "fix the draft, then vibiz company draft --file company.json" : "vibiz company submit" : c.status === "failed" ? "it could not be filed: contact support, or start a new draft" : c.status === "completed" ? null : "wait: it updates by itself (vibiz company to check)";
+  if (next) io.log(`
+  next: ${next}`);
+}
+function printPayments(io, a) {
+  const b = a.balance;
+  io.log(`Payments (${a.environment})  ${a.status}  statement: ${a.statement_descriptor}`);
+  io.log(
+    `  available ${cents(b.available_cents)} \xB7 pending ${cents(b.pending_cents)}${b.next_available_at ? ` (from ${b.next_available_at.slice(0, 10)})` : ""}`
+  );
+  if (b.negative_cents) {
+    io.log(
+      `  negative ${cents(-b.negative_cents)}: refunds or disputes, earned back before you can withdraw`
+    );
+  }
+  io.log(`  in transit ${cents(b.in_transit_cents)} \xB7 withdrawn ${cents(b.withdrawn_cents)}`);
+  const p = a.payouts;
+  io.log(`
+  getting paid: ${p.status}${p.bank ? ` (bank \u2022\u2022\u2022\u2022 ${p.bank.last4})` : ""}`);
+  for (const r of p.requirements) io.log(`  - ${r}`);
+  if (a.webhook.url) io.log(`
+  webhook: ${a.webhook.url}`);
+  const next = a.status === "frozen" ? "payments are paused by Vibiz: contact support" : p.status !== "ready" ? "verify your identity and add a bank in the console (Payments \u25B8 Get paid); your app can already sell" : b.available_cents > 0 ? "vibiz payments withdraw" : null;
+  if (next) io.log(`
+  next: ${next}`);
+}
+var pct2 = (n) => n === null ? "\u2013" : `${Math.round(n * 100)}%`;
+function printAnalytics(io, r) {
+  const t = r.totals;
+  io.log(`Last ${r.period}`);
+  io.log(
+    `  ${t.visitors} visitors \xB7 ${t.pageviews} pageviews \xB7 bounce ${pct2(t.bounce_rate)} \xB7 ${t.events} events`
+  );
+  const peak = Math.max(1, ...r.timeseries.map((p) => p.visitors));
+  const bars = "\u2581\u2582\u2583\u2584\u2585\u2586\u2587\u2588";
+  io.log(
+    `  ${r.timeseries.map((p) => bars[Math.round(p.visitors / peak * (bars.length - 1))]).join("")}`
+  );
+  const table2 = (title, rows) => {
+    if (!rows.length) return;
+    io.log(`
+  ${title}`);
+    for (const [label, n] of rows) io.log(`  ${String(n).padStart(6)}  ${label}`);
+  };
+  table2(
+    "top pages (pageviews)",
+    r.top_pages.map((p) => [p.path, p.pageviews])
+  );
+  table2(
+    "sources (visitors)",
+    r.sources.map((s) => [s.source, s.visitors])
+  );
+  table2(
+    "countries (visitors)",
+    r.countries.map((c) => [c.country, c.visitors])
+  );
+  table2(
+    "events",
+    r.events.map((e) => [e.name, e.count])
+  );
+}
+var clock = (ms2) => {
+  const sec = Math.round(ms2 / 1e3);
+  return `${Math.floor(sec / 60)}:${String(sec % 60).padStart(2, "0")}`;
+};
+function printInsights(io, r) {
+  io.log(`Session replay, last ${r.period}: ${r.recorded_sessions} recorded sessions`);
+  if (!r.insights.length) {
+    io.log("  nothing stands out");
+    return;
+  }
+  for (const i of r.insights.slice(0, 10)) {
+    io.log(`  \u2022 ${i.summary}`);
+    io.log(`    e.g. ${i.examples.map((e) => e.id).join(", ")}`);
+  }
+}
+function printReplay(io, d, url, expires) {
+  io.log(
+    `${d.id}  ${new Date(d.started_at).toLocaleString()}  (${d.device ?? "unknown device"}${d.country ? `, ${d.country}` : ""})`
+  );
+  io.log(
+    `  ${clock(d.duration_ms)} long, ${clock(d.active_ms)} active \xB7 recorded because: ${d.trigger}`
+  );
+  io.log(`  ${d.pages.join(" \u2192 ")}`);
+  if (!d.completeness.complete) {
+    const gaps = d.completeness.missing_seqs?.map(([a, b]) => a === b ? `${a}` : `${a}-${b}`).join(", ");
+    io.log(
+      `  partial recording${gaps ? `: missing chunks ${gaps}` : ""}${d.completeness.dropped_events ? `, ${d.completeness.dropped_events} events dropped` : ""}`
+    );
+  }
+  const s = d.signals;
+  for (const e of s.errors)
+    io.log(
+      `  \u2715 error ${clock(e.offset_ms)} on ${e.page}: "${e.recorded_message}"${e.count > 1 ? ` \xD7${e.count}` : ""}`
+    );
+  for (const r of s.rage_clicks)
+    io.log(
+      `  ! rage click ${clock(r.offset_ms)} on ${r.page}: ${r.selector} "${r.recorded_text}" (${r.clicks} clicks)`
+    );
+  for (const x of s.dead_clicks)
+    io.log(`  \xB7 dead click ${clock(x.offset_ms)} on ${x.page}: ${x.selector} "${x.recorded_text}"`);
+  for (const f of s.forms_abandoned) io.log(`  \xB7 left ${f.form} on ${f.page} unsent`);
+  io.log(`
+  timeline`);
+  for (const m of d.timeline.slice(0, 40))
+    io.log(`  ${clock(m.offset_ms).padStart(6)}  ${m.kind.padEnd(14)} ${m.label}`);
+  io.log(`
+  Watch (until ${new Date(expires).toLocaleTimeString()}): ${url}`);
+}
+function commandHelp(command) {
+  const lines = HELP.split("\n");
+  const out = [];
+  let inside = false;
+  for (const line of lines) {
+    if (/^ {2}vibiz /.test(line)) inside = line.startsWith(`  vibiz ${command}`);
+    else if (!/^ {5,}/.test(line)) inside = false;
+    if (inside) out.push(line);
+  }
+  return out.length ? `${out.join("\n")}
+
+  Everything: vibiz help` : HELP;
+}
+async function runCli(argv2, io) {
+  const [command, ...all] = argv2;
+  const cut = all.indexOf("--");
+  const rest = cut < 0 ? all : all.slice(0, cut);
+  const passthrough = cut < 0 ? [] : all.slice(cut + 1);
+  if (command && (rest.includes("--help") || rest.includes("-h"))) {
+    io.log(commandHelp(command));
+    return;
+  }
+  const { values, positionals } = parseArgs({
+    args: rest,
+    allowPositionals: true,
+    options: {
+      key: { type: "string" },
+      api: { type: "string" },
+      resources: { type: "string" },
+      preview: { type: "boolean", default: false },
+      write: { type: "string" },
+      template: { type: "string" },
+      force: { type: "boolean", default: false },
+      input: { type: "string" },
+      to: { type: "string" },
+      subject: { type: "string" },
+      text: { type: "string" },
+      from: { type: "string" },
+      "no-wait": { type: "boolean", default: false },
+      period: { type: "string" },
+      json: { type: "boolean", default: false },
+      errors: { type: "boolean", default: false },
+      rage: { type: "boolean", default: false },
+      dead: { type: "boolean", default: false },
+      path: { type: "string" },
+      output: { type: "string", short: "o" },
+      model: { type: "string" },
+      system: { type: "string" },
+      size: { type: "string" },
+      voice: { type: "string" },
+      language: { type: "string" },
+      project: { type: "string" },
+      by: { type: "string" },
+      tool: { type: "string" },
+      "end-user": { type: "string" },
+      "api-key": { type: "string" },
+      open: { type: "boolean", default: false },
+      reset: { type: "boolean", default: false },
+      format: { type: "string" },
+      team: { type: "string" },
+      dev: { type: "boolean", default: false },
+      all: { type: "boolean", default: false },
+      "keep-values": { type: "boolean", default: false },
+      grace: { type: "string" },
+      owner: { type: "boolean", default: false },
+      own: { type: "boolean", default: false },
+      "client-id": { type: "string" },
+      file: { type: "string" },
+      amount: { type: "string" },
+      interval: { type: "string" },
+      "lookup-key": { type: "string" },
+      user: { type: "string" },
+      "success-url": { type: "string" },
+      "cancel-url": { type: "string" },
+      name: { type: "string" },
+      enable: { type: "string" },
+      add: { type: "boolean", default: false },
+      auth: { type: "string" },
+      var: { type: "string" },
+      body: { type: "string" },
+      approval: { type: "string" },
+      vertex: { type: "string" },
+      region: { type: "string" },
+      "gcp-project": { type: "string" },
+      "use-for": { type: "string" },
+      ads: { type: "boolean", default: false },
+      media: { type: "string", multiple: true },
+      at: { type: "string" },
+      draft: { type: "boolean", default: false },
+      opt: { type: "string", multiple: true },
+      status: { type: "string" },
+      budget: { type: "string" },
+      threshold: { type: "string" },
+      kind: { type: "string" },
+      "no-browser": { type: "boolean", default: false },
+      clients: { type: "string" },
+      agent: { type: "string" },
+      global: { type: "boolean", default: false }
+    }
+  });
+  const usagePeriod = (fallback) => {
+    const p = values.period ?? fallback;
+    if (!["24h", "7d", "30d", "month"].includes(p)) {
+      throw new Error("--period is 24h, 7d, 30d or month");
+    }
+    return p;
+  };
+  const apiBase = async () => (values.api || io.env.VIBIZ_API_URL || (await readLogin(io, io.configDir ?? CONFIG_DIR)).apiUrl || DEFAULT_API_URL).replace(/\/$/, "");
+  switch (command) {
+    case "signup":
+    case "login": {
+      const dir = io.configDir ?? CONFIG_DIR;
+      const api = (values.api || io.env.VIBIZ_API_URL || DEFAULT_API_URL).replace(/\/$/, "");
+      if (values.key) {
+        await saveLogin(io, dir, { apiKey: values.key, apiUrl: api, source: "key" });
+      } else {
+        await browserLogin(io, api, {
+          configDir: dir,
+          open: !values["no-browser"],
+          ...io.fetch ? { fetch: io.fetch } : {},
+          ...io.sleep ? { sleep: io.sleep } : {}
+        });
+      }
+      const caps = await (await io.client()).capabilities();
+      io.log(
+        `${values.key ? "Logged in. " : ""}Available: ${[...caps.resources, ...caps.actions].join(", ")}`
+      );
+      return;
+    }
+    case "whoami": {
+      const me = await (await io.client()).whoami();
+      if (values.json) {
+        io.log(JSON.stringify(me, null, 2));
+        return;
+      }
+      io.log(`${me.account.name}  (${me.account.id})`);
+      io.log(`  key     ${me.key.name}  ${me.key.prefix}\u2026  ${me.key.access}`);
+      const saved = await readLogin(io, io.configDir ?? CONFIG_DIR);
+      io.log(`  api     ${io.env.VIBIZ_API_URL || saved.apiUrl || DEFAULT_API_URL}`);
+      return;
+    }
+    case "logout": {
+      const dir = io.configDir ?? CONFIG_DIR;
+      const saved = await readLogin(io, dir);
+      if (!saved.apiKey) {
+        io.log("Not logged in on this machine.");
+        return;
+      }
+      if (saved.source === "browser") {
+        await (await io.client()).logout().catch((e) => {
+          if (!(e instanceof VibizApiError && e.status === 401)) throw e;
+        });
+        io.log("Revoked this machine's key.");
+      } else {
+        io.log(
+          "Forgot the key here. It still works elsewhere: revoke it in the console (API keys) if you meant to."
+        );
+      }
+      await io.local().writeFile(configFile(dir), "{}\n", { mode: 384 });
+      if (io.env.VIBIZ_API_KEY)
+        io.log("Note: VIBIZ_API_KEY is set in this shell and still logs you in.");
+      return;
+    }
+    case "init": {
+      const name = positionals[0];
+      if (!name) throw new Error("usage: vibiz init <name> [--template nextjs-saas]");
+      const template = values.template;
+      if (template !== void 0 && !isTemplate(template)) {
+        throw new Error(`Unknown template "${template}". Available: ${TEMPLATES.join(", ")}`);
+      }
+      const local = io.local();
+      const vibiz2 = await io.client();
+      if (template) {
+        await scaffold({ template, name, dir: local.cwd(), force: values.force });
+        io.log(`Copied the ${template} template into ${local.cwd()}`);
+      }
+      const resources = values.resources?.split(",").map((s) => s.trim());
+      const { project } = await vibiz2.projects.create({
+        name,
+        ...resources ? { resources } : {}
+      });
+      await io.local().writeFile(PROJECT_FILE, `${JSON.stringify({ project_id: project.id }, null, 2)}
+`);
+      io.log(`Created ${project.name} \u2192 ${project.url ?? project.slug}. Provisioning\u2026`);
+      if (template) {
+        io.log("  Next: npm install && vibiz dev && npm run dev");
+      }
+      if (values["no-wait"]) return;
+      printProject(io, await vibiz2.projects.waitUntilReady(project.id));
+      return;
+    }
+    case "status": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const project = await vibiz2.projects.get(id);
+      printProject(io, project);
+      const deployments = (await vibiz2.deployments.list(id)).slice(0, 5);
+      if (deployments.length) io.log("\n  deployments");
+      for (const d of deployments) {
+        const live = d.id === project.production_deployment_id ? "  \u2190 live" : "";
+        io.log(
+          `  ${dot(d.status)} ${d.id}  ${d.target.padEnd(10)} ${d.status.padEnd(8)} ${d.url ?? ""}${live}`
+        );
+      }
+      return;
+    }
+    case "deploy": {
+      const local = io.local();
+      const vibiz2 = await io.client();
+      const id = values.project ?? await io.project();
+      const dir = resolve(local.cwd(), positionals[0] ?? ".");
+      const { deployment, uploaded, total } = await deployDirectory(vibiz2, id, dir, {
+        target: values.preview ? "preview" : "production",
+        onProgress: (m) => io.log(m)
+      });
+      io.log(`Deploying ${deployment.id} (${uploaded}/${total} files uploaded)\u2026`);
+      if (values["no-wait"]) return;
+      const done = await vibiz2.deployments.waitUntilDone(deployment.id);
+      if (done.status !== "ready") throw new Error(done.error ?? `Deployment ${done.status}`);
+      if (done.target === "production") {
+        const project = await vibiz2.projects.get(id);
+        io.log(`${dot("ready")} Live: ${project.url ?? done.url}`);
+      } else {
+        io.log(`${dot("ready")} Preview: ${done.url}`);
+      }
+      if (done.target === "preview") io.log(`  Make it live: vibiz promote ${done.id}`);
+      return;
+    }
+    case "promote": {
+      const depId = positionals[0];
+      if (!depId) throw new Error("usage: vibiz promote <deployment-id>");
+      const vibiz2 = await io.client();
+      const out = await vibiz2.deployments.promote(depId);
+      if (out.instant) {
+        io.log(`${dot("ready")} ${depId} is live.`);
+        return;
+      }
+      io.log(`Building ${out.deployment.id} for production\u2026`);
+      const done = await vibiz2.deployments.waitUntilDone(out.deployment.id);
+      if (done.status !== "ready") throw new Error(done.error ?? `Deployment ${done.status}`);
+      const project = await vibiz2.projects.get(done.project_id);
+      io.log(`${dot("ready")} Live: ${project.url}`);
+      return;
+    }
+    case "rollback": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const project = await vibiz2.projects.get(id);
+      const previous = (await vibiz2.deployments.list(id)).find(
+        (d) => d.target === "production" && d.status === "ready" && d.id !== project.production_deployment_id
+      );
+      if (!previous) throw new Error("No earlier production deployment to roll back to.");
+      await vibiz2.deployments.promote(previous.id);
+      io.log(`${dot("ready")} Rolled back to ${previous.id}.`);
+      return;
+    }
+    case "dev": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      if (values.reset) {
+        await vibiz2.projects.dev.remove(id);
+        io.log("Removed the development environment. Run `vibiz dev` for a fresh one.");
+        return;
+      }
+      const local = io.local();
+      io.err("Preparing the development environment\u2026\n");
+      const env = await vibiz2.projects.dev.ensure(id);
+      if (passthrough.length) {
+        const [cmd, ...args] = passthrough;
+        local.exit(await local.exec(cmd, args, { ...io.env, ...env }));
+      }
+      const file = values.write ?? ".env.development.local";
+      const existing = await io.local().readFile(file, "utf8").catch(() => "");
+      await io.local().writeFile(file, mergeEnvFile(existing, env), { mode: 384 });
+      await io.local().chmod(file, 384);
+      io.log(`Wrote the development env to ${file}: ${Object.keys(env).sort().join(", ")}`);
+      io.log("Its own database branch (your schema, no production rows), sign-in and AI key.");
+      return;
+    }
+    case "auth": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const env = values.dev ? "development" : void 0;
+      const [sub, verb, arg] = positionals;
+      let settings;
+      if (sub === "providers" && (verb === "add" || verb === "rm")) {
+        const ids = ["google", "github", "vercel"];
+        const provider = ids.find((p) => p === arg);
+        if (!provider) {
+          throw new Error(`usage: vibiz auth providers ${verb} <${ids.join("|")}>`);
+        }
+        if (verb === "rm") settings = await vibiz2.projects.auth.removeProvider(id, provider, env);
+        else if (values.own) {
+          if (!values["client-id"]) throw new Error("--own needs --client-id <id>");
+          const envName = `${provider.toUpperCase()}_CLIENT_SECRET`;
+          const secret = io.env[envName] || await io.promptHidden(`${provider} client secret: `);
+          if (!secret) throw new Error(`The client secret is needed (${envName}, or type it).`);
+          settings = await vibiz2.projects.auth.setProvider(
+            id,
+            provider,
+            { credentials: "own", client_id: values["client-id"], client_secret: secret },
+            env
+          );
+          const cb = settings.providers.find((p) => p.id === provider)?.callback_url;
+          io.log(`Register this callback URL in your ${provider} OAuth app: ${cb}
+`);
+        } else {
+          settings = await vibiz2.projects.auth.setProvider(
+            id,
+            provider,
+            { credentials: "shared" },
+            env
+          );
+        }
+      } else if (sub === "domains" && verb) {
+        const domains = verb === "none" ? [] : verb.split(",").filter(Boolean);
+        settings = await vibiz2.projects.auth.update(id, { allowed_email_domains: domains }, env);
+      } else if (sub) {
+        throw new Error("usage: vibiz auth [providers add|rm <provider> | domains <list|none>]");
+      } else settings = await vibiz2.projects.auth.get(id, env);
+      if (values.json) io.log(JSON.stringify(settings, null, 2));
+      else printAuth(io, settings);
+      return;
+    }
+    case "company": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const env = values.dev ? "development" : void 0;
+      const [sub, arg, arg2] = positionals;
+      const show = (c) => values.json ? io.log(JSON.stringify(c, null, 2)) : printCompany(io, c);
+      if (!sub) {
+        try {
+          show(await vibiz2.projects.company.get(id, env));
+        } catch (e) {
+          if (!(e instanceof VibizApiError) || e.status !== 404) throw e;
+          io.log("No company yet. Draft one: vibiz company draft --file company.json");
+        }
+        return;
+      }
+      if (sub === "draft") {
+        if (!values.file) throw new Error("usage: vibiz company draft --file company.json");
+        const draft = JSON.parse(await io.local().readFile(values.file, "utf8"));
+        show(await vibiz2.projects.company.draft(id, draft, env));
+        return;
+      }
+      if (sub === "submit") {
+        const c = await vibiz2.projects.company.get(id, env);
+        if (c.environment === "production") {
+          const name = companyName(c);
+          if (c.status !== "draft") throw new Error(`This company is ${c.status}, not a draft.`);
+          if (!c.quote) throw new Error("The price is unavailable right now: nothing was filed.");
+          const quote = c.quote;
+          const total = cents(quote.total_cents);
+          io.log(
+            `This files ${name} (${c.entity_type === "llc" ? "LLC" : "C-Corp"}, ${c.state}) with the state for real and charges ${total}.`
+          );
+          io.log(
+            "Vibiz files formation documents on your instructions. It is not a law firm and does not give legal or tax advice."
+          );
+          const typed = await io.promptLine(`Type the company's name (${name}) to confirm: `);
+          if (typed !== name) throw new Error("Not confirmed: nothing was filed.");
+          show(
+            await vibiz2.projects.company.submit(
+              id,
+              {
+                accept_terms: true,
+                confirm: true,
+                expected_total_cents: quote.total_cents,
+                expected_updated_at: c.updated_at
+              },
+              "production"
+            )
+          );
+        } else {
+          show(await vibiz2.projects.company.submit(id, { accept_terms: true }, c.environment));
+        }
+        return;
+      }
+      if (sub === "sign") {
+        if (arg !== "ss4" && arg !== "form_8821") {
+          throw new Error("usage: vibiz company sign <ss4|form_8821>");
+        }
+        const link = await vibiz2.projects.company.sign(id, arg, env);
+        io.log(`Open this to sign (it expires ${link.expires_at}; don't share it):
+${link.url}`);
+        if (values.open) io.openUrl(link.url);
+        return;
+      }
+      if (sub === "docs") {
+        if (arg === "download") {
+          if (!arg2) throw new Error("usage: vibiz company docs download <id>");
+          const link = await vibiz2.projects.company.document(id, arg2, env);
+          io.log(`${link.name} (link expires ${link.expires_at}):
+${link.url}`);
+          if (values.open) io.openUrl(link.url);
+          return;
+        }
+        const c = await vibiz2.projects.company.get(id, env);
+        if (values.json) io.log(JSON.stringify(c.documents, null, 2));
+        else if (!c.documents.length) io.log("No documents yet.");
+        else for (const d of c.documents) io.log(`${d.id}  ${d.type.padEnd(19)} ${d.name}`);
+        return;
+      }
+      if (sub === "simulate") {
+        if (arg !== "formation" && arg !== "ein") {
+          throw new Error("usage: vibiz company simulate <formation|ein>");
+        }
+        show(await vibiz2.projects.company.simulate(id, arg));
+        return;
+      }
+      throw new Error(
+        "usage: vibiz company [draft --file f | submit | sign <doc> | docs | simulate <step>]"
+      );
+    }
+    case "payments": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const env = values.dev ? "development" : void 0;
+      const [sub, arg, arg2] = positionals;
+      const out = (x, text) => values.json ? io.log(JSON.stringify(x, null, 2)) : text();
+      const amount = values.amount !== void 0 ? Number(values.amount) : void 0;
+      if (amount !== void 0 && !Number.isInteger(amount)) {
+        throw new Error("--amount is in cents: --amount 1500");
+      }
+      if (!sub) {
+        const a = await vibiz2.projects.payments.get(id, env);
+        out(a, () => printPayments(io, a));
+        return;
+      }
+      if (sub === "products") {
+        if (arg === "add") {
+          if (!arg2 || amount === void 0) {
+            throw new Error(
+              "usage: vibiz payments products add <name> --amount <cents> [--interval month|year]"
+            );
+          }
+          const interval = values.interval;
+          const p = await vibiz2.projects.payments.products.create(
+            id,
+            {
+              name: arg2,
+              price: {
+                unit_amount_cents: amount,
+                type: interval ? "recurring" : "one_time",
+                ...interval ? { interval } : {},
+                ...values["lookup-key"] ? { lookup_key: values["lookup-key"] } : {}
+              }
+            },
+            env
+          );
+          out(p, () => io.log(`${p.id}  ${p.name}  price ${p.prices[0]?.id}`));
+          return;
+        }
+        const list = await vibiz2.projects.payments.products.list(id, env);
+        out(list.data, () => {
+          if (!list.data.length)
+            io.log("No products yet: vibiz payments products add <name> --amount <cents>");
+          for (const p of list.data) {
+            io.log(`${p.id}  ${p.name}${p.active ? "" : "  (archived)"}`);
+            for (const x of p.prices) {
+              const every = x.interval ? ` / ${x.interval_count && x.interval_count > 1 ? `${x.interval_count} ` : ""}${x.interval}` : "";
+              io.log(
+                `  ${x.id}  ${cents(x.unit_amount_cents)}${every}${x.lookup_key ? `  ${x.lookup_key}` : ""}${x.active ? "" : "  (inactive)"}`
+              );
+            }
+          }
+        });
+        return;
+      }
+      if (sub === "checkout") {
+        if (!arg || !values["success-url"] || !values["cancel-url"]) {
+          throw new Error(
+            "usage: vibiz payments checkout <price_id|lookup_key> --success-url <u> --cancel-url <u> [--user id]"
+          );
+        }
+        const c = await vibiz2.projects.payments.checkout(
+          id,
+          {
+            ...arg.startsWith("pprice_") ? { price_id: arg } : { lookup_key: arg },
+            ...values.user ? { user: values.user } : {},
+            success_url: values["success-url"],
+            cancel_url: values["cancel-url"]
+          },
+          env
+        );
+        out(c, () => io.log(`Pay here (until ${c.expires_at}):
+${c.url}`));
+        if (values.open) io.openUrl(c.url);
+        return;
+      }
+      if (sub === "list") {
+        const list = await vibiz2.projects.payments.list(id, { ...env ? { env } : {} });
+        out(list.data, () => {
+          if (!list.data.length) io.log("No payments yet.");
+          for (const p of list.data) {
+            io.log(
+              `${p.created_at.slice(0, 10)}  ${p.id}  ${cents(p.amount_cents).padStart(10)}  net ${cents(p.net_cents)}  ${p.status}${p.customer_email ? `  ${p.customer_email}` : ""}`
+            );
+          }
+        });
+        return;
+      }
+      if (sub === "webhook") {
+        if (!arg) throw new Error("usage: vibiz payments webhook <url|none> [--dev]");
+        const a = await vibiz2.projects.payments.update(
+          id,
+          { webhook_url: arg === "none" ? null : arg },
+          env
+        );
+        out(a.webhook, () => {
+          io.log(a.webhook.url ? `Webhook: ${a.webhook.url}` : "No webhook.");
+          if (a.webhook.url) {
+            io.log(
+              `  signing secret: VIBIZ_WEBHOOK_SECRET in the ${a.environment} env (${a.environment === "development" ? "vibiz dev writes it" : "on the host already"}); verify with vibiz.webhooks.verify (vibiz docs webhooks)`
+            );
+          }
+        });
+        return;
+      }
+      if (sub === "withdraw") {
+        const a = await vibiz2.projects.payments.get(id, env);
+        const sending = amount ?? a.balance.available_cents;
+        if (a.payouts.status !== "ready") {
+          throw new Error(
+            "Verify your identity and add a bank first: console \u25B8 Payments \u25B8 Get paid."
+          );
+        }
+        if (sending <= 0) throw new Error("Nothing is available to withdraw yet.");
+        io.log(
+          `This sends ${cents(sending)} (${a.environment}) to your bank${a.payouts.bank ? ` \u2022\u2022\u2022\u2022 ${a.payouts.bank.last4}` : ""}.`
+        );
+        const typed = await io.promptLine('Type "withdraw" to confirm: ');
+        if (typed !== "withdraw") throw new Error("Not confirmed: nothing was sent.");
+        const w = await vibiz2.projects.payments.withdraw(
+          id,
+          { amount_cents: sending },
+          a.environment
+        );
+        out(
+          w,
+          () => io.log(
+            `${w.id}  ${cents(w.amount_cents)}  ${w.status}: it reaches your bank in a few days.`
+          )
+        );
+        return;
+      }
+      if (sub === "simulate") {
+        const event = arg;
+        if (event === "refund" && !arg2)
+          throw new Error("usage: vibiz payments simulate refund <payment_id>");
+        if (!event || !["payment", "dispute", "refund", "release_hold"].includes(event)) {
+          throw new Error(
+            "usage: vibiz payments simulate <payment|dispute|refund <id>|release_hold>"
+          );
+        }
+        const r = await vibiz2.projects.payments.simulate(
+          id,
+          event === "refund" ? { event, payment_id: arg2 ?? "" } : event === "release_hold" ? { event } : { event, ...amount !== void 0 ? { amount_cents: amount } : {} }
+        );
+        out(r, () => {
+          if (r.object === "payments_account") printPayments(io, r);
+          else io.log(`${r.id}  ${cents(r.amount_cents)}  ${r.status} (test mode)`);
+        });
+        return;
+      }
+      throw new Error(
+        "usage: vibiz payments [products [add] | checkout <price> | list | webhook <url> | withdraw | simulate <event>]"
+      );
+    }
+    case "social": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const env = values.dev ? "development" : void 0;
+      const [sub, arg] = positionals;
+      const out = (v, line) => values.json ? io.log(JSON.stringify(v, null, 2)) : line();
+      const showPost = (p) => out(p, () => {
+        io.log(
+          `${p.id}  ${p.status}${p.scheduled_for ? `  at ${p.scheduled_for}` : ""}  (${p.environment})`
+        );
+        for (const t of p.targets) {
+          io.log(`  ${t.platform.padEnd(15)} ${t.status.padEnd(10)} ${t.url ?? t.error ?? ""}`);
+        }
+        if (p.approval?.status === "pending")
+          io.log(`  Waiting for the owner: ${p.console_url ?? ""}`);
+      });
+      const sure = async (what) => {
+        const typed = await io.promptLine(`${what} Type yes to confirm: `);
+        if (typed.trim().toLowerCase() !== "yes")
+          throw new Error("Not confirmed: nothing was sent.");
+      };
+      if (!sub) {
+        const o = await vibiz2.projects.social.get(id, env);
+        out(o, () => {
+          io.log(
+            `Social (${o.environment}${o.sandbox ? ", sandbox: nothing is posted or spent" : ""})`
+          );
+          if (!o.available) io.log("  Not available right now.");
+          io.log(
+            `  accounts: ${o.accounts.connected} connected, ${o.accounts.needs_reconnect} to reconnect, ${o.accounts.ads} ads`
+          );
+          io.log(
+            `  posts: ${o.posts.pending_approval} waiting for you, ${o.posts.scheduled} scheduled, ${o.posts.failed_7d} failed (7 days), ${o.posts.published_30d} published (30 days)`
+          );
+          if (o.ad_changes_pending) io.log(`  ad changes waiting for you: ${o.ad_changes_pending}`);
+          if (o.console_url) io.log(`  ${o.console_url}`);
+        });
+        return;
+      }
+      if (sub === "connect") {
+        if (!arg) throw new Error("usage: vibiz social connect <platform> [--ads]");
+        const link = await vibiz2.projects.social.connect(id, arg, { ads: values.ads, env });
+        io.log(
+          `Open this to connect ${arg}${link.ads ? " ads" : ""} (expires ${link.expires_at}):
+${link.url}`
+        );
+        if (values.open) io.openUrl(link.url);
+        return;
+      }
+      if (sub === "accounts") {
+        const list = await vibiz2.projects.social.accounts(id, { env });
+        out(list.data, () => {
+          if (!list.data.length) io.log("No accounts yet: vibiz social connect <platform>");
+          for (const a of list.data) {
+            io.log(
+              `${a.id}  ${a.kind === "ads" ? `${a.platform} ads` : a.platform}  ${a.username ? `@${a.username}` : a.display_name ?? ""}  ${a.status}`
+            );
+          }
+        });
+        return;
+      }
+      if (sub === "post") {
+        if (!values.to) throw new Error('usage: vibiz social post "<text>" --to <account,\u2026>');
+        const options = {};
+        for (const kv of values.opt ?? []) {
+          const i = kv.indexOf("=");
+          if (i < 1) throw new Error("--opt is key=value");
+          const v = kv.slice(i + 1);
+          options[kv.slice(0, i)] = v === "true" ? true : v === "false" ? false : v;
+        }
+        const media = [];
+        for (const m of values.media ?? []) {
+          if (/^https?:\/\//.test(m)) media.push({ url: m });
+          else {
+            const bytes = new Uint8Array(await io.local().readFile(m));
+            const ext = m.split(".").pop()?.toLowerCase() ?? "";
+            const contentType = {
+              jpg: "image/jpeg",
+              jpeg: "image/jpeg",
+              png: "image/png",
+              webp: "image/webp",
+              gif: "image/gif",
+              mp4: "video/mp4",
+              mov: "video/quicktime",
+              webm: "video/webm",
+              pdf: "application/pdf"
+            }[ext];
+            if (!contentType) throw new Error(`${m}: jpg, png, webp, gif, mp4, mov, webm or pdf`);
+            const up = await vibiz2.projects.social.upload(
+              id,
+              { bytes, contentType, filename: m.split("/").pop() },
+              env
+            );
+            media.push({ url: up.url });
+          }
+        }
+        const input = {
+          text: arg ?? "",
+          media,
+          targets: values.to.split(",").filter(Boolean).map((account_id) => ({ account_id, options })),
+          ...values.at ? { schedule_at: values.at } : {},
+          ...values.draft ? { draft: true } : {}
+        };
+        let p;
+        try {
+          p = await vibiz2.projects.social.create(id, input, env);
+        } catch (e) {
+          if (!(e instanceof VibizApiError) || e.details?.reason !== "confirmation_required")
+            throw e;
+          await sure(
+            `This ${values.at ? `schedules a post for ${values.at}` : "publishes now"} on the live accounts ${values.to}.`
+          );
+          p = await vibiz2.projects.social.create(id, { ...input, confirm: true }, env);
+        }
+        showPost(p);
+        return;
+      }
+      if (sub === "posts") {
+        const list = await vibiz2.projects.social.posts(id, {
+          env,
+          ...values.status ? { status: values.status } : {}
+        });
+        out(list.data, () => {
+          if (!list.data.length) io.log("No posts.");
+          for (const p of list.data) {
+            io.log(
+              `${p.id}  ${p.status.padEnd(16)} ${p.targets.map((t) => t.platform).join(",").padEnd(20)} ${p.text.slice(0, 50).replace(/\n/g, " ")}`
+            );
+          }
+        });
+        return;
+      }
+      if (sub === "approve" || sub === "reject" || sub === "cancel") {
+        if (!arg) throw new Error(`usage: vibiz social ${sub} <post id>`);
+        const p = sub === "approve" ? await vibiz2.projects.social.approve(
+          id,
+          arg,
+          values.at ? { schedule_at: values.at } : {},
+          env
+        ) : sub === "reject" ? await vibiz2.projects.social.reject(id, arg, env) : await vibiz2.projects.social.cancel(id, arg, env);
+        showPost(p);
+        return;
+      }
+      if (sub === "campaigns") {
+        const list = await vibiz2.projects.social.campaigns(id, { env });
+        out(list.data, () => {
+          if (!list.data.length)
+            io.log("No campaigns (connect ads: vibiz social connect meta --ads).");
+          for (const c of list.data) {
+            const money2 = (v) => v === null ? "\u2013" : `${(v / 100).toFixed(2)} ${c.currency ?? ""}`.trim();
+            io.log(
+              `${c.id}  ${c.status.padEnd(14)} ${money2(c.daily_budget_cents)}/day  spent ${money2(c.spend_cents)}  ${c.name}`
+            );
+          }
+        });
+        return;
+      }
+      if (sub === "pause" || sub === "resume" || sub === "budget") {
+        if (!arg) throw new Error(`usage: vibiz social ${sub} <campaign id>`);
+        const list = await vibiz2.projects.social.campaigns(id, { env });
+        const c = list.data.find((x) => x.id === arg);
+        if (!c)
+          throw new Error(`No campaign ${arg} on the first ads account (vibiz social campaigns).`);
+        const budget = sub === "budget" ? Number(values.budget) : void 0;
+        if (sub === "budget" && !(budget && budget >= 100))
+          throw new Error("--budget <cents per day>, at least 100");
+        const input = {
+          account_id: c.account_id,
+          ad_account_id: c.ad_account_id,
+          kind: sub,
+          campaign_id: c.id,
+          ...budget ? { daily_budget_cents: budget } : {}
+        };
+        let ch;
+        try {
+          ch = await vibiz2.projects.social.adChange(id, input, env);
+        } catch (e) {
+          if (!(e instanceof VibizApiError) || e.details?.reason !== "confirmation_required")
+            throw e;
+          await sure(
+            `This ${sub === "pause" ? "pauses" : sub === "resume" ? "resumes (spends money on)" : `sets ${budget} cents a day on`} the live campaign "${c.name}".`
+          );
+          ch = await vibiz2.projects.social.adChange(id, { ...input, confirm: true }, env);
+        }
+        out(
+          ch,
+          () => io.log(`${ch.id}  ${ch.kind}  ${ch.status}${ch.next_step ? `
+  ${ch.next_step}` : ""}`)
+        );
+        return;
+      }
+      throw new Error(
+        "usage: vibiz social [connect|accounts|post|posts|approve|reject|cancel|campaigns|pause|resume|budget]"
+      );
+    }
+    case "connectors": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const env = values.dev ? "development" : void 0;
+      const [sub = "list", name, ...more] = positionals;
+      const out = (x, text) => values.json ? io.log(JSON.stringify(x, null, 2)) : text();
+      const c = vibiz2.projects.connectors;
+      const ready = (k) => `prod ${k.ready.production ? "ready" : "no key"}, dev ${k.ready.development ? "ready" : "no key"}`;
+      const printOps = (ops) => {
+        for (const o of ops) {
+          const required = o.params.required ?? [];
+          const props = Object.keys(o.params.properties ?? {}).map(
+            (k) => `${k}${required.includes(k) ? "" : "?"}`
+          );
+          io.log(
+            `  ${o.enabled ? "\u25CF" : "\u25CB"} ${o.id.padEnd(24)} ${o.method.padEnd(6)} ${o.path}  [${o.risk}]${props.length ? `  ${props.join(" ")}` : ""}${o.body ? "  +body" : ""}`
+          );
+        }
+      };
+      if (sub === "list") {
+        const list = await c.list(id);
+        out(list, () => {
+          if (!list.length)
+            io.log(
+              "No connectors yet: vibiz connectors import <openapi-url> or vibiz connectors add"
+            );
+          for (const k of list) {
+            const on = k.operations.filter((o) => o.enabled).length;
+            io.log(
+              `${k.name.padEnd(20)} ${k.base_url}  ${on}/${k.operations.length} operations  ${ready(k)}  billed by ${k.pricing.billed_by}`
+            );
+          }
+        });
+        return;
+      }
+      if (sub === "import") {
+        if (!name)
+          throw new Error("usage: vibiz connectors import <spec-url|file> [--name n] [--add]");
+        const input = {
+          .../^https?:\/\//.test(name) ? { url: name } : { spec: await io.local().readFile(name, "utf8") },
+          ...values.name ? { name: values.name } : {},
+          ...values.enable ? { enable: values.enable.split(",") } : {}
+        };
+        const draft = await c.import(id, input);
+        if (values.add) {
+          const made = await c.create(id, draft.manifest);
+          out(made, () => {
+            io.log(`${dot("ready")} Added ${made.name} (${made.base_url})`);
+            printOps(made.operations);
+            const keys = made.secrets.map((x) => x.name);
+            if (keys.length)
+              io.log(`  Keys: vibiz connectors secret ${made.name} ${keys[0]} [--dev]`);
+          });
+          return;
+        }
+        out(draft, () => {
+          io.log(
+            `${draft.manifest.label} \u2192 ${draft.manifest.name}  ${draft.manifest.base_url || "(no base URL)"}`
+          );
+          io.log(
+            `  auth: ${draft.manifest.auth.type}  ${draft.counts.kept} of ${draft.counts.seen} operations (\u25CF enabled: reads only)`
+          );
+          printOps(draft.manifest.operations);
+          for (const p of draft.problems)
+            io.log(
+              `  ! ${p.operation ? `${p.operation} (${p.method} ${p.path}): ` : ""}${p.message}`
+            );
+          io.log("  Save it: the same with --add (and --enable op,op for writes).");
+        });
+        return;
+      }
+      if (sub === "add") {
+        let manifest;
+        if (values.file) {
+          manifest = JSON.parse(await io.local().readFile(values.file, "utf8"));
+        } else {
+          const [baseUrl, ...ops] = more;
+          if (!name || !baseUrl) {
+            throw new Error(
+              'usage: vibiz connectors add --file manifest.json  |  add <name> <base_url> "GET /path" \u2026 [--auth header:X-Api-Key] [--var NAME]'
+            );
+          }
+          const envName = values.var ?? `${name.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`;
+          const [kind = "none", where = ""] = (values.auth ?? "none").split(":");
+          const auth = kind === "bearer" ? { type: "bearer", env: envName } : kind === "header" ? { type: "header", header: where || "X-Api-Key", env: envName } : kind === "query" ? { type: "query", param: where || "api_key", env: envName } : { type: "none" };
+          manifest = { name, base_url: baseUrl, auth, operations: ops };
+        }
+        const made = await c.create(id, manifest);
+        out(made, () => {
+          io.log(`${dot("ready")} Added ${made.name} (${made.base_url})`);
+          printOps(made.operations);
+        });
+        return;
+      }
+      if (sub === "approvals") {
+        const list = await c.approvals(id, { status: "pending" });
+        out(list, () => {
+          if (!list.length) io.log("Nothing waiting for approval.");
+          for (const a of list) {
+            io.log(
+              `${a.id}  ${a.connector}.${a.operation} (${a.environment}, ${a.reason})  until ${a.expires_at.slice(0, 16)}
+  ${JSON.stringify(a.request)}`
+            );
+          }
+          if (list.length) io.log("Approve with an owner key: vibiz connectors approve <id>");
+        });
+        return;
+      }
+      if (sub === "approve" || sub === "deny") {
+        if (!name) throw new Error(`usage: vibiz connectors ${sub} <approval id>`);
+        const a = await c.approval(id, name);
+        io.log(`${a.connector}.${a.operation} (${a.environment}): ${JSON.stringify(a.request)}`);
+        const r = sub === "approve" ? await c.approve(id, name) : await c.deny(id, name);
+        out(
+          r,
+          () => io.log(
+            r.status === "approved" ? `${dot("ready")} Approved: the agent can make this call once in the next hour (approval_id ${r.id}).` : "Denied."
+          )
+        );
+        return;
+      }
+      if (!name)
+        throw new Error(`usage: vibiz connectors ${sub} <name> \u2026  (vibiz connectors --help)`);
+      if (sub === "ops") {
+        const k = await c.get(id, name);
+        out(k.operations, () => {
+          io.log(`${k.label}  ${k.base_url}  ${ready(k)}  (\u25CF enabled)`);
+          printOps(k.operations);
+        });
+        return;
+      }
+      if (sub === "enable" || sub === "disable") {
+        if (!more.length) throw new Error(`usage: vibiz connectors ${sub} <name> <operation\u2026>`);
+        const k = await c.update(id, name, { [sub]: more });
+        out(k.operations, () => printOps(k.operations));
+        return;
+      }
+      if (sub === "secret") {
+        const [key] = more;
+        if (!key) throw new Error("usage: vibiz connectors secret <name> <VAR> [--dev]");
+        const value = io.env[key] ?? await io.promptHidden(`${key} (hidden): `);
+        if (!value) throw new Error(`No value: set $${key} or type it at the prompt.`);
+        const k = await c.setSecrets(id, name, { [key]: value }, env);
+        out(
+          k.ready,
+          () => io.log(`${dot("ready")} ${key} set (${ready(k)}). It is never shown again.`)
+        );
+        return;
+      }
+      if (sub === "check") {
+        const r = await c.check(id, name, env);
+        out(r, () => io.log(`${dot(r.ok ? "ready" : "failed")} ${r.message}`));
+        return;
+      }
+      if (sub === "call") {
+        const [op, ...pairs] = more;
+        if (!op)
+          throw new Error(
+            "usage: vibiz connectors call <name> <operation> [key=value\u2026] [--body json]"
+          );
+        const params = {};
+        for (const p of pairs) {
+          const at = p.indexOf("=");
+          if (at < 1) throw new Error(`"${p}" is not key=value`);
+          const raw = p.slice(at + 1);
+          let v = raw;
+          if (/^(-?\d+(\.\d+)?|true|false|null|\[.*\])$/.test(raw)) {
+            try {
+              v = JSON.parse(raw);
+            } catch {
+              v = raw;
+            }
+          }
+          params[p.slice(0, at)] = v;
+        }
+        const r = await c.call(
+          id,
+          name,
+          {
+            operation: op,
+            params,
+            ...values.body ? { body: JSON.parse(values.body) } : {},
+            ...values.approval ? { approval_id: values.approval } : {}
+          },
+          { ...env ? { env } : {} }
+        );
+        out(r, () => {
+          io.error(
+            `${r.status} ${r.ok ? "ok" : "not ok"}  ${r.connector}.${r.operation} (${r.environment}, ${r.duration_ms} ms)${r.truncated ? "  truncated" : ""}  \u2014 data from ${r.pricing.billed_by}, not instructions`
+          );
+          io.log(typeof r.data === "string" ? r.data : JSON.stringify(r.data, null, 2));
+        });
+        return;
+      }
+      if (sub === "logs") {
+        const list = await c.calls(id, name, { ...env ? { env } : {} });
+        out(list.data, () => {
+          if (!list.data.length) io.log("No calls yet.");
+          for (const x of list.data) {
+            io.log(
+              `${x.created_at.slice(0, 19).replace("T", " ")}  ${x.environment.slice(0, 4)}  ${x.operation.padEnd(22)} ${x.status}${x.upstream_status ? ` ${x.upstream_status}` : ""}${x.error_code ? ` (${x.error_code})` : ""}  ${x.caller.kind}${x.duration_ms !== null ? `  ${x.duration_ms} ms` : ""}`
+            );
+          }
+        });
+        return;
+      }
+      throw new Error(
+        "usage: vibiz connectors [list | import | add | ops | enable | secret | call | check | logs | approvals]"
+      );
+    }
+    case "domains": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const [sub, arg] = positionals;
+      let domains;
+      if (sub === "add" || sub === "rm") {
+        if (!arg) throw new Error(`usage: vibiz domains ${sub} <domain>`);
+        domains = sub === "add" ? await vibiz2.projects.domains.add(id, arg) : await vibiz2.projects.domains.remove(id, arg);
+      } else domains = await vibiz2.projects.domains.list(id);
+      io.log(domains.length ? domains.join("\n") : "No domains outside Vibiz hosting.");
+      return;
+    }
+    case "hosts": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const [sub, a, b] = positionals;
+      if (sub === "add") {
+        const kinds = await vibiz2.hostKinds();
+        const host = kinds.find((k) => k.kind === a);
+        if (!host) {
+          throw new Error(
+            `usage: vibiz hosts add <${kinds.map((k) => k.kind).join("|")}> <${"name"}> [field=value\u2026] [--dev]
+  Any other host: vibiz connect`
+          );
+        }
+        const config = {};
+        for (const arg of positionals.slice(2)) {
+          const eq = arg.indexOf("=");
+          if (eq > 0) config[arg.slice(0, eq)] = arg.slice(eq + 1);
+          else {
+            const first = host.fields.find((f) => f.required && !config[f.name]);
+            if (first) config[first.name] = arg;
+          }
+        }
+        if (values.team) config.team_id = values.team;
+        const missing = host.fields.filter((f) => f.required && !config[f.name]);
+        if (missing.length) {
+          throw new Error(
+            `${host.label} needs ${missing.map((f) => `${f.name}=<${f.placeholder}>`).join(" ")}`
+          );
+        }
+        const envName = TOKEN_ENV[host.kind];
+        const token = envName && io.env[envName] || await io.promptHidden(`${host.label} token (${host.token_help}): `);
+        if (!token) {
+          throw new Error(
+            `A ${host.label} token is needed${envName ? ` (${envName}, or type it)` : ""}.`
+          );
+        }
+        const t = await vibiz2.projects.hosts.add(id, {
+          kind: host.kind,
+          token,
+          config,
+          environments: values.dev && host.environments.includes("development") ? ["production", "development"] : ["production"]
+        });
+        io.log(
+          `Connected ${host.label} ${t.name} (${t.id}). Vibiz writes the env there now and on every change; it applies ${host.applies}.`
+        );
+        return;
+      }
+      if (sub === "sync") {
+        await vibiz2.projects.hosts.sync(id);
+        io.log("Syncing every connected host.");
+        return;
+      }
+      if (sub === "rm") {
+        if (!a) throw new Error("usage: vibiz hosts rm <id> [--keep-values]");
+        await vibiz2.projects.hosts.remove(id, a, { keepValues: values["keep-values"] });
+        io.log(
+          values["keep-values"] ? `Disconnected ${a}; its variables stay but get no more updates.` : `Disconnected ${a}; removing the variables Vibiz wrote there.`
+        );
+        return;
+      }
+      const list = await vibiz2.projects.hosts.list(id);
+      if (!list.length) io.log("No connected hosts. Add one: vibiz hosts add vercel <project>");
+      for (const t of list) {
+        io.log(
+          `${t.id}  ${t.kind} ${t.name.padEnd(24)} ${t.environments.join("+").padEnd(23)} ${t.status}${t.last_synced_at ? `  synced ${t.last_synced_at}` : ""}${t.error ? `
+    ${t.error}` : ""}`
+        );
+      }
+      return;
+    }
+    case "app-key": {
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      if (positionals[0] === "rotate") {
+        const k = await vibiz2.projects.appKeys.rotate(id, {
+          environment: values.dev ? "development" : "production",
+          ...values.grace ? { grace_seconds: Number(values.grace) } : {}
+        });
+        io.log(
+          `New ${k.environment} key ${k.prefix}\u2026; the old one works until ${k.previous_valid_until ?? "now (revoked)"}.
+Hosting and connected hosts get the new value by themselves.`
+        );
+        return;
+      }
+      for (const k of await vibiz2.projects.appKeys.list(id)) {
+        io.log(
+          `${k.environment.padEnd(12)} ${k.prefix ? `${k.prefix}\u2026` : "(issued on first use)"}${k.last_used_at ? `  last used ${k.last_used_at}` : ""}`
+        );
+      }
+      return;
+    }
+    case "run": {
+      if (!passthrough.length) {
+        const action = positionals[0];
+        if (!action) {
+          throw new Error(
+            "usage: vibiz run <action> --input '<json>'   or   vibiz run -- <command\u2026>"
+          );
+        }
+        const input = values.input ? JSON.parse(values.input) : {};
+        const out = await (await io.client()).actions.run(action, input);
+        io.log(JSON.stringify(out.output, null, 2));
+        return;
+      }
+      const command2 = passthrough;
+      const local = io.local();
+      let env;
+      let where;
+      if (io.env.VIBIZ_APP_KEY) {
+        const app = createVibiz();
+        env = await app.loadEnv({ override: false });
+        where = (await app.whoami()).environment;
+      } else {
+        env = await (await io.client()).projects.dev.ensure(await io.project());
+        where = "development";
+      }
+      io.err(`vibiz: ${Object.keys(env).length} variables (${where})
+`);
+      const [cmd, ...args] = command2;
+      return local.exit(
+        await local.exec(cmd, args, { ...env, ...io.env }, { forwardSignals: true })
+      );
+    }
+    case "connect": {
+      const found = await detectHosts(io.local().cwd());
+      io.log("Recommended: Vibiz hosting. Every key is already there and stays in sync:");
+      io.log("    vibiz deploy\n");
+      if (!found.length) {
+        io.log("No other host found in this folder. Hosting somewhere else?");
+        io.log(ONE_KEY_PATHS);
+        return;
+      }
+      for (const h of found) {
+        io.log(`Found ${h.label} (${h.file}).`);
+        if (h.push) {
+          io.log(`  Vibiz can write the env into it and keep it in sync (an owner, once):`);
+          io.log(`    vibiz hosts add ${h.kind} <its project or service>
+`);
+        } else {
+          io.log(`${ONE_KEY_PATHS}
+`);
+        }
+      }
+      io.log(
+        "Running it elsewhere? Add its domain too, so sign-in accepts it: vibiz domains add <domain>"
+      );
+      return;
+    }
+    case "env": {
+      if (positionals[0] === "pull") {
+        io.local();
+        const format2 = values.format ?? "dotenv";
+        if (!["dotenv", "shell", "docker", "json"].includes(format2)) {
+          throw new Error("--format is dotenv, shell, docker or json");
+        }
+        const key = io.env.VIBIZ_APP_KEY;
+        if (!key) throw new Error("vibiz env pull needs VIBIZ_APP_KEY (the app\u2019s own key).");
+        const base = (io.env.VIBIZ_API_URL ?? "https://app.vibiz.app").replace(/\/$/, "");
+        const res = await fetch(`${base}/v1/app/env?format=${format2}`, {
+          headers: { authorization: `Bearer ${key}` }
+        });
+        const text = await res.text();
+        if (!res.ok) throw new Error(`Vibiz answered ${res.status}: ${text.slice(0, 200)}`);
+        if (values.output) {
+          await io.local().writeFile(values.output, text, { mode: 384 });
+          await io.local().chmod(values.output, 384);
+          io.err(`Wrote the app's env to ${values.output}
+`);
+        } else io.out(text);
+        return;
+      }
+      const env = await (await io.client()).projects.env(await io.project());
+      if (values.write) {
+        const existing = await io.local().readFile(values.write, "utf8").catch(() => "");
+        await io.local().writeFile(values.write, mergeEnvFile(existing, env), { mode: 384 });
+        await io.local().chmod(values.write, 384);
+        io.log(`Wrote ${Object.keys(env).length} variables to ${values.write}`);
+      } else io.log(mergeEnvFile("", env).trimEnd());
+      return;
+    }
+    case "add": {
+      const type = positionals[0];
+      if (!type) throw new Error("usage: vibiz add <hosting|database|auth|email|analytics|replay>");
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      await vibiz2.projects.addResource(id, type);
+      printProject(io, await vibiz2.projects.waitUntilReady(id));
+      return;
+    }
+    case "analytics": {
+      const period = values.period ?? "7d";
+      if (!["24h", "7d", "30d"].includes(period)) throw new Error("--period is 24h, 7d or 30d");
+      const report = await (await io.client()).analytics.get(await io.project(), { period });
+      if (values.json) io.log(JSON.stringify(report, null, 2));
+      else printAnalytics(io, report);
+      return;
+    }
+    case "replays": {
+      const period = values.period ?? "7d";
+      if (!["24h", "7d", "30d"].includes(period)) throw new Error("--period is 24h, 7d or 30d");
+      const vibiz2 = await io.client();
+      const id = await io.project();
+      const filtered = values.errors || values.rage || values.dead || values.path;
+      const [insights, list] = await Promise.all([
+        filtered ? null : vibiz2.replays.insights(id, { period }),
+        vibiz2.replays.list(id, {
+          period,
+          has_error: values.errors,
+          rage: values.rage,
+          dead: values.dead,
+          ...values.path ? { path: values.path } : {}
+        })
+      ]);
+      if (values.json) {
+        io.log(JSON.stringify({ insights, replays: list.data }, null, 2));
+        return;
+      }
+      if (insights) printInsights(io, insights);
+      io.log(`
+  sessions (most worth watching first)`);
+      if (!list.data.length) io.log("  none");
+      for (const r of list.data) {
+        const flags = [
+          r.counts.errors ? `${r.counts.errors} err` : "",
+          r.counts.rage_clicks ? `${r.counts.rage_clicks} rage` : "",
+          r.counts.dead_clicks ? `${r.counts.dead_clicks} dead` : "",
+          r.incomplete ? "partial" : ""
+        ].filter(Boolean);
+        io.log(
+          `  ${r.id}  ${new Date(r.started_at).toLocaleString()}  ${clock(r.duration_ms).padStart(6)}  ${r.trigger.padEnd(6)}  ${flags.join(", ").padEnd(22)} ${r.pages.join(" \u2192 ")}`
+        );
+      }
+      if (list.data[0]) io.log(`
+  Details and a link to watch: vibiz replay ${list.data[0].id}`);
+      return;
+    }
+    case "replay": {
+      const id = positionals[0];
+      if (!id) throw new Error("usage: vibiz replay <id>");
+      const vibiz2 = await io.client();
+      const [detail, share] = await Promise.all([vibiz2.replays.get(id), vibiz2.replays.share(id)]);
+      if (values.json) io.log(JSON.stringify({ ...detail, share }, null, 2));
+      else printReplay(io, detail, share.url, share.expires_at);
+      return;
+    }
+    case "projects": {
+      for (const p of await (await io.client()).projects.list()) {
+        io.log(`${p.id}  ${p.name.padEnd(24)} ${p.url ?? ""}`);
+      }
+      return;
+    }
+    case "send": {
+      if (!values.to || !values.subject || !values.text) {
+        throw new Error("usage: vibiz send --to <addr> --subject <s> --text <body> [--from info]");
+      }
+      const out = await (await io.client()).email.send(await io.project(), {
+        to: values.to,
+        subject: values.subject,
+        text: values.text,
+        ...values.from ? { from: values.from } : {}
+      });
+      const usage = out.usage ? `  (${out.usage.used}/${out.usage.limit} today)` : "";
+      io.log(`${dot("ready")} Sent ${out.output.from} \u2192 ${out.output.to}${usage}`);
+      return;
+    }
+    case "ai": {
+      if (positionals[0] === "keys") {
+        await aiKeysCommand(io, positionals.slice(1), values);
+        return;
+      }
+      if (positionals[0] === "models") {
+        const q = positionals.slice(1).join(" ");
+        const models = await (await io.client()).ai.models({ all: values.all || !!q, q });
+        if (values.json) {
+          io.log(JSON.stringify(models, null, 2));
+          return;
+        }
+        if (!models.length) {
+          io.log("No model matches. Try fewer words, or `vibiz ai models --all`.");
+          return;
+        }
+        for (const m of models) io.log(modelLine(m));
+        return;
+      }
+      const prompt = positionals.join(" ");
+      if (!prompt)
+        throw new Error('usage: vibiz ai "<prompt>" [--model vibiz/smart] [--system "\u2026"]');
+      const vibiz2 = await io.aiClient(values.project);
+      let cost;
+      for await (const chunk of vibiz2.ai.chatStream({
+        ...values.model ? { model: values.model } : {},
+        messages: [
+          ...values.system ? [{ role: "system", content: values.system }] : [],
+          { role: "user", content: prompt }
+        ],
+        stream_options: { include_usage: true }
+      })) {
+        io.out(chunk.choices[0]?.delta.content ?? "");
+        if (chunk.cost_micro_usd !== void 0) cost = chunk.cost_micro_usd;
+      }
+      io.out("\n");
+      if (cost !== void 0) io.error(`  ${usd(cost)}`);
+      return;
+    }
+    case "image": {
+      io.local();
+      const prompt = positionals.join(" ");
+      if (!prompt || !values.output) throw new Error('usage: vibiz image "<prompt>" -o out.png');
+      const vibiz2 = await io.aiClient(values.project);
+      const out = await vibiz2.ai.image({
+        prompt,
+        ...values.size ? { size: values.size } : {},
+        ...values.model ? { model: values.model } : {}
+      });
+      const b64 = out.data[0]?.b64_json;
+      if (!b64) throw new Error("No image came back.");
+      await io.local().writeFile(values.output, Buffer.from(b64, "base64"));
+      io.log(`${dot("ready")} ${values.output}  (${out.model}, ${usd(out.cost_micro_usd)})`);
+      return;
+    }
+    case "say": {
+      io.local();
+      const text = positionals.join(" ");
+      if (!text || !values.output)
+        throw new Error('usage: vibiz say "<text>" -o out.mp3 [--voice alloy]');
+      const vibiz2 = await io.aiClient(values.project);
+      const audio = await vibiz2.ai.speech({
+        input: text,
+        ...values.voice ? { voice: values.voice } : {},
+        ...values.model ? { model: values.model } : {}
+      });
+      await io.local().writeFile(values.output, audio);
+      io.log(`${dot("ready")} ${values.output}  (${audio.byteLength} bytes)`);
+      return;
+    }
+    case "transcribe": {
+      io.local();
+      const file = positionals[0];
+      if (!file) throw new Error("usage: vibiz transcribe <audio-file> [--language en]");
+      const vibiz2 = await io.aiClient(values.project);
+      const out = await vibiz2.ai.transcribe({
+        file: await io.local().readFile(file),
+        filename: file.split("/").pop() ?? "audio",
+        ...values.language ? { language: values.language } : {},
+        ...values.model ? { model: values.model } : {}
+      });
+      io.log(out.text);
+      io.error(`  ${usd(out.cost_micro_usd)}`);
+      return;
+    }
+    case "usage": {
+      const vibiz2 = await io.client();
+      const period = usagePeriod("30d");
+      if (values.open) {
+        const link = await vibiz2.dashboard.link({ period });
+        io.openUrl(link.url);
+        io.log(`Dashboard (until ${new Date(link.expires_at).toLocaleTimeString()}): ${link.url}`);
+        return;
+      }
+      const report = await vibiz2.usage.get({
+        period,
+        group_by: (values.by ?? "tool").split(","),
+        ...values.project ? { project: values.project } : {},
+        ...values.model ? { model: values.model } : {},
+        ...values.tool ? { tool: values.tool } : {},
+        ...values["end-user"] ? { end_user: values["end-user"] } : {},
+        ...values["api-key"] ? { api_key: values["api-key"] } : {}
+      });
+      io.log(values.json ? JSON.stringify(report, null, 2) : formatUsage(report));
+      return;
+    }
+    case "billing": {
+      const vibiz2 = await io.client();
+      const [sub, arg] = positionals;
+      if (!sub) {
+        const b = await vibiz2.billing.get();
+        if (values.json) {
+          io.log(JSON.stringify(b, null, 2));
+          return;
+        }
+        const history = b.mode === "credits" ? await vibiz2.billing.ledger({ limit: 5 }) : void 0;
+        io.log(formatBilling(b, history));
+        return;
+      }
+      if (sub === "top-up" || sub === "topup") {
+        const c = await vibiz2.billing.checkout({ amount_cents: parseDollars(arg) });
+        if (values.json) {
+          io.log(JSON.stringify(c, null, 2));
+          return;
+        }
+        if (values.open && c.url) io.openUrl(c.url);
+        io.log(
+          `Pay $${(c.amount_cents / 100).toFixed(2)} here (open it in a browser; the link works for an hour):
+${c.url}
+
+The credits show in \`vibiz billing\` a few seconds after paying.`
+        );
+        return;
+      }
+      if (sub === "history") {
+        const kinds = values.kind ? values.kind.split(",") : void 0;
+        const list = await vibiz2.billing.ledger({
+          ...kinds ? { kind: kinds } : {},
+          limit: 50
+        });
+        io.log(
+          values.json ? JSON.stringify(list, null, 2) : list.data.length ? list.data.map(formatEntry).join("\n") : "Nothing yet."
+        );
+        return;
+      }
+      if (sub === "auto-recharge") {
+        if (arg !== "on" && arg !== "off") {
+          throw new Error(
+            "usage: vibiz billing auto-recharge on|off [--threshold 5] [--amount 25]"
+          );
+        }
+        const b = await vibiz2.billing.update({
+          auto_recharge: {
+            enabled: arg === "on",
+            ...values.threshold ? { threshold_cents: parseDollars(values.threshold, "--threshold") } : {},
+            ...values.amount ? { amount_cents: parseDollars(values.amount, "--amount") } : {}
+          }
+        });
+        io.log(values.json ? JSON.stringify(b, null, 2) : formatBilling(b));
+        return;
+      }
+      throw new Error(
+        "usage: vibiz billing [top-up <dollars> | history [--kind k] | auto-recharge on|off]"
+      );
+    }
+    case "metrics": {
+      const report = await (await io.client()).metrics.get({ period: usagePeriod("7d") });
+      io.log(values.json ? JSON.stringify(report, null, 2) : formatMetrics(report));
+      return;
+    }
+    case "keys": {
+      const vibiz2 = await io.client();
+      const [sub, arg] = positionals;
+      if (sub === "create") {
+        if (!arg) throw new Error("usage: vibiz keys create <name> [--owner]");
+        const key = await vibiz2.apiKeys.create(arg, { access: values.owner ? "owner" : "agent" });
+        io.log(
+          `${key.name}  ${key.id}  ${key.access}
+${key.secret}
+
+Store the key now: it is not shown again.`
+        );
+        return;
+      }
+      if (sub === "revoke") {
+        if (!arg) throw new Error("usage: vibiz keys revoke <key id>");
+        await vibiz2.apiKeys.revoke(arg);
+        io.log(`Revoked ${arg}.`);
+        return;
+      }
+      for (const k of await vibiz2.apiKeys.list()) {
+        io.log(
+          `${k.id}  ${k.name.padEnd(20)} ${k.prefix}\u2026  ${(k.access ?? "owner").padEnd(5)}  ${k.revoked_at ? "revoked" : "active"}`
+        );
+      }
+      return;
+    }
+    case "admin": {
+      if (positionals[0] !== "metrics") throw new Error("usage: vibiz admin metrics [--period 7d]");
+      const vibiz2 = await io.client();
+      const period = usagePeriod("7d");
+      if (values.open) {
+        const link = await vibiz2.dashboard.link({ scope: "admin", period });
+        io.openUrl(link.url);
+        io.log(`Platform dashboard: ${link.url}`);
+        return;
+      }
+      const m = await vibiz2.admin.metrics({ period });
+      io.log(values.json ? JSON.stringify(m, null, 2) : formatAdminMetrics(m));
+      return;
+    }
+    case "docs": {
+      const { DOC_TOPICS, DOCS } = await import("./src-BOTTM5XC.js");
+      const topic = positionals[0];
+      if (!topic || !DOC_TOPICS.includes(topic)) {
+        for (const t of DOC_TOPICS) io.log(`  vibiz docs ${t.padEnd(13)} ${DOCS[t].title}`);
+        if (topic) io.setExitCode(1);
+        return;
+      }
+      io.log(`# ${DOCS[topic].title}
+
+${DOCS[topic].body}`);
+      return;
+    }
+    case "skills": {
+      const [sub = "list", ...names] = positionals;
+      if (sub === "list") return skillsList(io, await apiBase(), values);
+      if (sub === "add") return skillsAdd(io, await apiBase(), names, values);
+      throw new Error(
+        "usage: vibiz skills [list | add [name\u2026] [--global] [--agent claude|codex|cursor]]"
+      );
+    }
+    case "mcp": {
+      if (positionals[0] === "add") return mcpAdd(io, await apiBase(), values.clients);
+      if (positionals[0])
+        throw new Error('usage: vibiz mcp (serve over stdio) | vibiz mcp add --clients "<client>"');
+      io.local();
+      const { serveStdio } = await import("./src-BOTTM5XC.js");
+      await serveStdio({ version: cliVersion() });
+      return;
+    }
+    case void 0:
+    case "help":
+    case "--help":
+      io.log(HELP);
+      return;
+    default:
+      throw new Error(`Unknown command "${command}". Run: vibiz help`);
+  }
+}
+function cliErrorLines(err) {
+  if (err instanceof VibizApiError && err.code === "forbidden" && /production env/.test(err.message)) {
+    return [
+      `\u2715 ${err.message}`,
+      "  For local work: vibiz dev (a development database, sign-in and AI key)."
+    ];
+  }
+  if (err instanceof VibizApiError) {
+    const out = [`\u2715 ${err.message} (${err.code})`];
+    const d = err.details;
+    if (d?.approval_id) out.push(`  approval_id: ${d.approval_id}`);
+    if (d?.next_step) out.push(`  ${d.next_step}`);
+    return out;
+  }
+  return [`\u2715 ${err instanceof Error ? err.message : String(err)}`];
+}
+function modelLine(m) {
+  const runs = m.model ? `${m.model.name} (${m.model.maker})` : `${m.name} (${m.maker ?? ""})`;
+  const p = m.pricing ?? {};
+  const price = p.unit === "tokens" ? `$${p.input_per_million_usd} / $${p.output_per_million_usd} per M tokens` : p.unit === "characters" ? `$${p.per_1000_usd} per 1k chars` : typeof p.usd === "number" ? `$${p.usd} per ${p.unit}` : "";
+  return `${m.id.padEnd(34)} ${runs.padEnd(40)} ${price}`;
+}
+async function aiKeysCommand(io, args, values) {
+  const vibiz2 = await io.client();
+  const [sub = "list", provider = "google"] = args;
+  if (provider !== "google") throw new Error("Supported provider: google");
+  const scope = values.project ? { projectId: values.project } : {};
+  const show = (k) => {
+    if (values.json) return io.log(JSON.stringify(k, null, 2));
+    const where = k.scope === "project" ? `project ${k.project_id}` : "account";
+    if (!k.has_key) {
+      io.log(
+        `${k.provider} (${where}): no key${k.inherits_account_key ? ", uses the account key" : ""}`
+      );
+      return;
+    }
+    const kind = k.type === "vertex" ? `Vertex AI ${k.vertex?.project_id} ${k.vertex?.region}` : "API key";
+    io.log(
+      `${dot(k.last_error ? "failed" : "ready")} ${k.provider} (${where}): ${kind} \u2026${k.last4}`
+    );
+    io.log(
+      `  last used: ${k.last_used_at ?? "never"}${k.last_error ? `  last error: ${k.last_error.message}` : ""}`
+    );
+    const mine = (k.models ?? []).filter((m) => m.paid_by === "your_key").map((m) => m.model);
+    const ours = (k.models ?? []).filter((m) => m.paid_by === "vibiz").map((m) => m.model);
+    io.log(`  on your key (0 here): ${mine.join(", ") || "none"}`);
+    io.log(`  on Vibiz (billed):    ${ours.join(", ") || "none"}`);
+  };
+  const useFor = values["use-for"] ? values["use-for"].split(",").map((x) => x.trim()) : void 0;
+  switch (sub) {
+    case "list": {
+      const out = await vibiz2.aiKeys.list(scope);
+      for (const k of out.data) show(k);
+      if (!values.json && out.usage_30d.calls) {
+        io.log(
+          `  last 30 days: ${out.usage_30d.calls} calls on your keys, would have cost $${out.usage_30d.would_have_cost_usd.toFixed(2)}`
+        );
+      }
+      return;
+    }
+    case "set": {
+      if (values.vertex) {
+        const file = (await io.local().readFile(values.vertex)).toString();
+        show(
+          await vibiz2.aiKeys.set(
+            provider,
+            {
+              type: "vertex",
+              service_account: file,
+              ...values["gcp-project"] ? { project_id: values["gcp-project"] } : {},
+              ...values.region ? { region: values.region } : {},
+              ...useFor ? { use_for: useFor } : {}
+            },
+            scope
+          )
+        );
+        return;
+      }
+      const key = io.env.GEMINI_API_KEY || io.env.GOOGLE_API_KEY || await io.promptHidden("API key (hidden): ");
+      if (!key) throw new Error("The key is needed: GEMINI_API_KEY, or type it.");
+      show(
+        await vibiz2.aiKeys.set(
+          provider,
+          { type: "gemini_api_key", api_key: key.trim(), ...useFor ? { use_for: useFor } : {} },
+          scope
+        )
+      );
+      return;
+    }
+    case "test": {
+      const out = await vibiz2.aiKeys.test(provider, scope);
+      show(out);
+      if (out.test && !out.test.ok)
+        throw new Error(out.last_error?.message ?? "The key failed its check.");
+      return;
+    }
+    case "remove": {
+      show(await vibiz2.aiKeys.remove(provider, scope));
+      return;
+    }
+    default:
+      throw new Error("usage: vibiz ai keys [list | set | test | remove] [google] [--project id]");
+  }
+}
+
+// packages/cli/src/main.ts
+async function readJson2(path) {
+  try {
+    return JSON.parse(await readFile2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function login() {
+  const saved = await readJson2(CONFIG_FILE) ?? {};
+  const apiKey = process.env.VIBIZ_API_KEY || saved.apiKey;
+  if (!apiKey) throw new Error("Not logged in. Run: vibiz login (it prints a link to approve)");
+  const baseUrl = process.env.VIBIZ_API_URL || saved.apiUrl || DEFAULT_API_URL;
+  return { apiKey, baseUrl };
+}
+async function promptHidden(question) {
+  const { stdin, stderr } = process;
+  if (!stdin.isTTY) return "";
+  stderr.write(question);
+  stdin.setRawMode(true);
+  stdin.resume();
+  stdin.setEncoding("utf8");
+  return new Promise((done) => {
+    let value = "";
+    const onData = (ch) => {
+      if (ch === "\r" || ch === "\n" || ch === "") {
+        stdin.setRawMode(false);
+        stdin.pause();
+        stdin.off("data", onData);
+        stderr.write("\n");
+        done(value.trim());
+      } else if (ch === "") {
+        process.exit(130);
+      } else if (ch === "\x7F") value = value.slice(0, -1);
+      else value += ch;
+    };
+    stdin.on("data", onData);
+  });
+}
+async function promptLine(question) {
+  if (!process.stdin.isTTY) return "";
+  const { createInterface } = await import("node:readline/promises");
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
+function openUrl(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+  try {
+    spawn(cmd, [url], { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+var terminal = {
+  log: (...parts) => console.log(format(...parts)),
+  error: (...parts) => console.error(format(...parts)),
+  out: (text) => void process.stdout.write(text),
+  err: (text) => void process.stderr.write(text),
+  env: process.env,
+  client: async () => new Vibiz(await login()),
+  aiClient: async (project) => {
+    const { apiKey, baseUrl } = await login();
+    const headers = project ? { "x-vibiz-project": project } : void 0;
+    return new Vibiz({
+      apiKey,
+      baseUrl,
+      ...headers ? {
+        fetch: ((url, init) => fetch(url, {
+          ...init,
+          headers: { ...init?.headers, ...headers }
+        }))
+      } : {}
+    });
+  },
+  project: async () => {
+    const linked = await readJson2(PROJECT_FILE);
+    if (!linked?.project_id) throw new Error(`No ${PROJECT_FILE} here. Run: vibiz init <name>`);
+    return linked.project_id;
+  },
+  promptHidden,
+  promptLine,
+  openUrl,
+  local: () => ({
+    cwd: () => process.cwd(),
+    readFile: readFile2,
+    writeFile: writeFile2,
+    chmod,
+    mkdir,
+    exec: (cmd, args, env, opts) => {
+      const child = spawn(cmd, args, { stdio: "inherit", env });
+      if (opts?.forwardSignals) {
+        for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+          process.on(sig, () => child.kill(sig));
+        }
+      }
+      return new Promise((done) => child.on("exit", (c, s) => done(c ?? (s ? 128 : 1))));
+    },
+    exit: (code) => process.exit(code)
+  }),
+  setExitCode: (code) => {
+    process.exitCode = code;
+  }
+};
+var argv = process.argv.slice(2);
+if (argv[0] === "--version" || argv[0] === "-v") {
+  console.log(cliVersion());
+} else {
+  runCli(argv, terminal).catch((err) => {
+    for (const line of cliErrorLines(err)) console.error(line);
+    process.exit(1);
+  });
+}