@videan/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,2114 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command as Command17 } from "commander";
+
+// src/commands/login.ts
+import { Command } from "commander";
+import inquirer from "inquirer";
+import chalk from "chalk";
+import ora from "ora";
+import os from "node:os";
+
+// ../sdk/dist/index.js
+var DEFAULT_API_URL = "https://api.videan.xyz/v1";
+var APP_DOMAIN = process.env.CLOUD_APP_DOMAIN || "videan.xyz";
+var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
+var FARGATE_SIZES = {
+  256: { min: 512, max: 2048, step: 512 },
+  512: { min: 1024, max: 4096, step: 1024 },
+  1024: { min: 2048, max: 8192, step: 1024 },
+  2048: { min: 4096, max: 16384, step: 1024 },
+  4096: { min: 8192, max: 30720, step: 1024 },
+  8192: { min: 16384, max: 61440, step: 4096 },
+  16384: { min: 32768, max: 122880, step: 8192 }
+};
+var FARGATE_CPUS = Object.keys(FARGATE_SIZES).map(Number).sort((a, b) => a - b);
+var PLANS = {
+  free: {
+    id: "free",
+    name: "Free",
+    baseCents: 0,
+    includedUsageCents: 300,
+    maxApps: 3,
+    maxInstancesPerApp: 1,
+    // One app at this size, running all month, is inside the included usage.
+    maxCpu: 512,
+    maxMemory: 1024,
+    maxStorageMb: 1024,
+    postgres: true,
+    customDomains: false
+  },
+  pro: {
+    id: "pro",
+    name: "Pro",
+    baseCents: 2e3,
+    includedUsageCents: 2e3,
+    maxApps: 50,
+    maxInstancesPerApp: 4,
+    maxCpu: 4096,
+    maxMemory: 8192,
+    maxStorageMb: 100 * 1024,
+    postgres: true,
+    customDomains: true
+  },
+  scale: {
+    id: "scale",
+    name: "Scale",
+    baseCents: 2e4,
+    includedUsageCents: 2e4,
+    maxApps: 500,
+    maxInstancesPerApp: 10,
+    maxCpu: 16384,
+    maxMemory: 122880,
+    maxStorageMb: 1024 * 1024,
+    postgres: true,
+    customDomains: true
+  }
+};
+var SNAKE_KEY = /^[a-z0-9]+(_[a-z0-9]+)+$/;
+var OPAQUE_KEYS = /* @__PURE__ */ new Set(["payload", "files", "metadata"]);
+function camelizeDeep(value) {
+  if (Array.isArray(value)) return value.map(camelizeDeep);
+  if (value === null || typeof value !== "object") return value;
+  const out = {};
+  for (const [key, v] of Object.entries(value)) {
+    const camel = SNAKE_KEY.test(key) ? key.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase()) : key;
+    out[camel] = OPAQUE_KEYS.has(camel) ? v : camelizeDeep(v);
+  }
+  return out;
+}
+var CloudError = class extends Error {
+  code;
+  status;
+  details;
+  constructor(message, code, status, details) {
+    super(message);
+    this.name = "CloudError";
+    this.code = code;
+    this.status = status;
+    this.details = details;
+  }
+};
+var CloudClient = class {
+  apiKey;
+  baseUrl;
+  apps;
+  secrets;
+  orgs;
+  apiKeys;
+  storage;
+  email;
+  jobs;
+  constructor(options) {
+    this.apiKey = options.apiKey;
+    this.baseUrl = (options.baseUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
+    this.apps = new AppsNamespace(this);
+    this.secrets = new SecretsNamespace(this);
+    this.orgs = new OrgsNamespace(this);
+    this.apiKeys = new ApiKeysNamespace(this);
+    this.storage = new StorageNamespace(this);
+    this.email = new EmailNamespace(this);
+    this.jobs = new JobsNamespace(this);
+  }
+  /**
+   * The plan catalogue. Unauthenticated on the API, so this works with any key --
+   * including a placeholder one -- and can be called before an account exists to
+   * show what an upgrade would allow.
+   */
+  async plans() {
+    const res = await this.request("GET", "/plans");
+    return res.data;
+  }
+  async request(method, path4, body) {
+    const url = `${this.baseUrl}${path4}`;
+    const headers = {
+      "Authorization": `Bearer ${this.apiKey}`,
+      "Content-Type": "application/json"
+    };
+    let response;
+    try {
+      response = await fetch(url, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : void 0
+      });
+    } catch (e) {
+      const cause = e?.cause?.code || e?.cause?.message || e?.message || "unknown error";
+      throw new CloudError(
+        `Could not reach ${url} (${cause}).`,
+        "network_error",
+        0
+      );
+    }
+    if (!response.ok) {
+      const errorBody = await response.json().catch(() => ({}));
+      const err = errorBody.error;
+      throw new CloudError(
+        err?.message ?? `Request failed with status ${response.status}`,
+        err?.code ?? "unknown_error",
+        response.status,
+        err?.details
+      );
+    }
+    if (response.status === 204) {
+      return void 0;
+    }
+    return camelizeDeep(await response.json());
+  }
+};
+var AppsNamespace = class {
+  constructor(client4) {
+    this.client = client4;
+  }
+  client;
+  async create(opts) {
+    const body = {
+      name: opts.name,
+      org_id: opts.orgId,
+      postgres_enabled: opts.postgres,
+      storage_enabled: opts.storage,
+      email_enabled: opts.email,
+      auth_required: opts.authRequired,
+      visibility: opts.visibility
+    };
+    const res = await this.client.request("POST", "/apps", body);
+    return res.data;
+  }
+  /**
+   * Changes an app's settings.
+   *
+   * `restartRequired` is true when the change only takes effect on a new
+   * container -- size, scale and postgres. The API reports it rather than
+   * restarting on its own: a restart is a brief interruption, and doing it as a
+   * side effect of a settings write is not the caller's decision to discover
+   * afterwards. Follow with `restart()` when it comes back true.
+   */
+  async update(appId, changes) {
+    const body = {};
+    if (changes.name !== void 0) body.name = changes.name;
+    if (changes.authRequired !== void 0) body.auth_required = changes.authRequired;
+    if (changes.visibility !== void 0) body.visibility = changes.visibility;
+    if (changes.status !== void 0) body.status = changes.status;
+    if (changes.cpu !== void 0) body.cpu = changes.cpu;
+    if (changes.memory !== void 0) body.memory = changes.memory;
+    if (changes.instances !== void 0) body.instances = changes.instances;
+    if (changes.rateLimitPerMinute !== void 0) {
+      body.rate_limit_per_minute = changes.rateLimitPerMinute;
+    }
+    if (changes.postgres !== void 0) body.postgres_enabled = changes.postgres;
+    if (changes.storage !== void 0) body.storage_enabled = changes.storage;
+    if (changes.email !== void 0) body.email_enabled = changes.email;
+    const res = await this.client.request(
+      "PATCH",
+      `/apps/${appId}`,
+      body
+    );
+    return res.data;
+  }
+  async list(orgId) {
+    const res = await this.client.request(
+      "GET",
+      `/apps?org_id=${encodeURIComponent(orgId)}`
+    );
+    return res.data;
+  }
+  async get(id) {
+    const res = await this.client.request("GET", `/apps/${id}`);
+    return res.data;
+  }
+  /**
+   * Deletes the app and tears down its AWS resources.
+   *
+   * Teardown is fault-isolated per resource, so a partial failure still deletes
+   * the app and reports what leaked in `warnings` (HTTP 207) rather than
+   * aborting. An empty array means everything was released.
+   */
+  async delete(id) {
+    const res = await this.client.request("DELETE", `/apps/${id}`);
+    return { warnings: res?.warnings ?? [] };
+  }
+  /**
+   * Pushes a snapshot.
+   *
+   * `files` carries text. Anything that is not valid UTF-8 — an image, a
+   * favicon, a compiled binary — must go in `binaryFiles` as base64, because
+   * JSON cannot carry arbitrary bytes in a string and a value that is silently
+   * re-encoded arrives corrupted. The two are separate maps rather than one
+   * with a flag: base64 is not detectable (`"data"` is valid base64 and valid
+   * text), so the encoding has to be stated by the caller.
+   */
+  async push(appId, files, message, binaryFiles) {
+    const res = await this.client.request("POST", `/apps/${appId}/push`, {
+      files,
+      message,
+      // Request bodies are not camelized — only responses are — so the wire
+      // name has to be written out here.
+      ...binaryFiles && Object.keys(binaryFiles).length > 0 ? { binary_files: binaryFiles } : {}
+    });
+    return res.data;
+  }
+  async deploy(appId, snapshotId, environment) {
+    const res = await this.client.request("POST", `/apps/${appId}/deploy`, {
+      snapshot_id: snapshotId,
+      environment
+    });
+    return res.data;
+  }
+  async promote(deploymentId) {
+    const res = await this.client.request("POST", `/deployments/${deploymentId}/promote`, {});
+    return res.data;
+  }
+  async rollback(appId) {
+    const res = await this.client.request("POST", `/apps/${appId}/rollback`, {});
+    return res.data;
+  }
+  async checkDeployment(deploymentId) {
+    const res = await this.client.request("POST", `/deployments/${deploymentId}/status`, {});
+    return res.data;
+  }
+  /**
+   * A page of the app's logs, newest last.
+   *
+   * Returns a page rather than a bare array of entries, which is what this used to
+   * be: an array cannot say whether there is more to fetch, and the endpoint
+   * behind it silently answered with the newest few log streams as though they
+   * were the whole app. To page, pass the previous response's `nextToken`; to
+   * follow, pass the last event's `timestamp` as `since`.
+   *
+   * `since`/`until` accept an ISO timestamp, epoch millis, or an offset like
+   * `15m`. `q` is a literal substring; `pattern` is CloudWatch filter syntax --
+   * pass one or the other, not both.
+   */
+  async logs(appId, opts) {
+    const params = new URLSearchParams();
+    if (opts?.limit) params.set("limit", String(opts.limit));
+    if (opts?.since) params.set("since", opts.since);
+    if (opts?.until) params.set("until", opts.until);
+    if (opts?.q) params.set("q", opts.q);
+    if (opts?.pattern) params.set("pattern", opts.pattern);
+    if (opts?.instance) params.set("instance", opts.instance);
+    if (opts?.nextToken) params.set("next_token", opts.nextToken);
+    const query = params.toString();
+    const path4 = `/apps/${appId}/logs${query ? `?${query}` : ""}`;
+    const res = await this.client.request("GET", path4);
+    return res.data;
+  }
+  /**
+   * Follows the app's logs, yielding each line as it appears.
+   *
+   * Polling rather than the API's SSE tail: an async generator works in node
+   * without `EventSource`, and it carries the bearer token the same way as every
+   * other call. The cursor is the last event's timestamp and the window is
+   * reopened *at* it rather than after it -- several lines share a millisecond, so
+   * advancing past it would drop the rest of them -- with the boundary
+   * millisecond's lines remembered to suppress the repeat.
+   */
+  async *followLogs(appId, opts) {
+    const interval = opts?.intervalMs ?? 2e3;
+    let since = opts?.since ?? "60s";
+    let seenAtCursor = /* @__PURE__ */ new Set();
+    while (true) {
+      const page = await this.logs(appId, {
+        since,
+        limit: 500,
+        q: opts?.q,
+        pattern: opts?.pattern,
+        instance: opts?.instance
+      });
+      for (const event of page.events) {
+        const key = `${event.stream || ""} ${event.message}`;
+        if (event.timestamp === since) {
+          if (seenAtCursor.has(key)) continue;
+          seenAtCursor.add(key);
+        } else {
+          since = event.timestamp;
+          seenAtCursor = /* @__PURE__ */ new Set([key]);
+        }
+        yield event;
+      }
+      await new Promise((r) => setTimeout(r, interval));
+    }
+  }
+  /**
+   * Traffic, latency and resource use over a window.
+   *
+   * `since`/`until` take the same values as `logs`, deliberately: an owner who
+   * spots a spike here reads the logs for the same period next.
+   *
+   * Note the series keys arrive camelized like every other field on this client,
+   * so the API's `client_errors` is `clientErrors` and `latency_p95` is
+   * `latencyP95`.
+   */
+  async metrics(appId, opts) {
+    const params = new URLSearchParams();
+    if (opts?.since) params.set("since", opts.since);
+    if (opts?.until) params.set("until", opts.until);
+    const query = params.toString();
+    const res = await this.client.request(
+      "GET",
+      `/apps/${appId}/metrics${query ? `?${query}` : ""}`
+    );
+    return res.data;
+  }
+  /**
+   * Live runtime state, including the container's exit code when it has crashed.
+   * A deployment stays "running" in the database after the task dies, so this is
+   * the only way to tell a healthy app from a crash loop.
+   */
+  /**
+   * What this app cost in a month (`YYYY-MM`, default the month in progress),
+   * priced at list rates with no allowance applied -- the plan's included usage
+   * belongs to the org, so per-app figures would otherwise sum past the invoice.
+   */
+  async usage(appId, period2) {
+    const query = period2 ? `?period=${encodeURIComponent(period2)}` : "";
+    const res = await this.client.request(
+      "GET",
+      `/apps/${appId}/usage${query}`
+    );
+    return res.data;
+  }
+  async health(appId) {
+    const res = await this.client.request("GET", `/apps/${appId}/health`);
+    return res.data;
+  }
+  /**
+   * Build output for a deployment. Poll with the previous response's `next_token`
+   * to stream a build as it runs.
+   */
+  async buildLogs(deploymentId, nextToken) {
+    const query = nextToken ? `?next_token=${encodeURIComponent(nextToken)}` : "";
+    const res = await this.client.request(
+      "GET",
+      `/deployments/${deploymentId}/build-logs${query}`
+    );
+    return res.data;
+  }
+};
+var ApiKeysNamespace = class {
+  constructor(client4) {
+    this.client = client4;
+  }
+  client;
+  /**
+   * Creates a key. The plaintext `key` is present on this response only -- the
+   * server stores a hash and cannot return it again.
+   */
+  async create(opts) {
+    const res = await this.client.request("POST", "/api-keys", {
+      name: opts.name,
+      org_id: opts.orgId,
+      expires_in_days: opts.expiresInDays,
+      app_id: opts.appId
+    });
+    return res.data;
+  }
+  async list(orgId) {
+    const res = await this.client.request(
+      "GET",
+      `/api-keys?org_id=${encodeURIComponent(orgId)}`
+    );
+    return res.data;
+  }
+  async revoke(id) {
+    await this.client.request("DELETE", `/api-keys/${id}`);
+  }
+};
+var SecretsNamespace = class {
+  constructor(client4) {
+    this.client = client4;
+  }
+  client;
+  async set(appId, key, value) {
+    const res = await this.client.request("POST", `/apps/${appId}/secrets`, {
+      key,
+      value
+    });
+    return res.data;
+  }
+  async list(appId) {
+    const res = await this.client.request("GET", `/apps/${appId}/secrets`);
+    return res.data;
+  }
+  async delete(appId, key) {
+    await this.client.request("DELETE", `/apps/${appId}/secrets/${key}`);
+  }
+};
+var StorageNamespace = class {
+  constructor(client4) {
+    this.client = client4;
+  }
+  client;
+  async list(appId, opts = {}) {
+    const q = new URLSearchParams();
+    if (opts.prefix) q.set("prefix", opts.prefix);
+    if (opts.limit) q.set("limit", String(opts.limit));
+    if (opts.cursor) q.set("cursor", opts.cursor);
+    const query = q.toString() ? `?${q}` : "";
+    const res = await this.client.request("GET", `/apps/${appId}/storage/objects${query}`);
+    return res.data;
+  }
+  /** Every object under the prefix, paged through for you. */
+  async listAll(appId, prefix) {
+    const all = [];
+    let cursor;
+    do {
+      const page = await this.list(appId, { prefix, cursor, limit: 1e3 });
+      all.push(...page.objects);
+      cursor = page.nextCursor ?? void 0;
+    } while (cursor);
+    return all;
+  }
+  async usage(appId) {
+    const res = await this.client.request(
+      "GET",
+      `/apps/${appId}/storage/usage`
+    );
+    return res.data;
+  }
+  /** Metadata for one object, or null when it is not there. */
+  async head(appId, key) {
+    try {
+      const res = await this.client.request(
+        "GET",
+        `/apps/${appId}/storage/object?key=${encodeURIComponent(key)}`
+      );
+      return res.data;
+    } catch (e) {
+      if (e instanceof CloudError && e.status === 404) return null;
+      throw e;
+    }
+  }
+  async delete(appId, key) {
+    await this.client.request(
+      "DELETE",
+      `/apps/${appId}/storage/object?key=${encodeURIComponent(key)}`
+    );
+  }
+  /**
+   * A short-lived URL for one key and one method. Hand a `put` URL to a browser to
+   * upload without the bytes touching the app, or a `get` URL to share a private
+   * object for a few minutes. Treat it as a credential: anyone holding it has that
+   * access until it expires.
+   */
+  async presign(appId, key, opts = {}) {
+    const res = await this.client.request("POST", `/apps/${appId}/storage/presign`, {
+      key,
+      method: opts.method ?? "get",
+      expires_in: opts.expiresIn,
+      content_type: opts.contentType,
+      download: opts.download
+    });
+    return res.data;
+  }
+  /**
+   * Presigns and uploads in one call.
+   *
+   * `contentType` is signed into the URL, so it is sent on the PUT as well --
+   * omitting it there would make S3 reject the signature with an opaque 403.
+   */
+  async upload(appId, key, body, opts = {}) {
+    const signed = await this.presign(appId, key, {
+      method: "put",
+      contentType: opts.contentType
+    });
+    const res = await fetch(signed.url, {
+      method: "PUT",
+      headers: opts.contentType ? { "Content-Type": opts.contentType } : void 0,
+      body
+    });
+    if (!res.ok) {
+      throw new CloudError(
+        `Upload failed with status ${res.status}: ${(await res.text()).slice(0, 300)}`,
+        "upload_failed",
+        res.status
+      );
+    }
+    return { key, size: 0, lastModified: null, etag: res.headers.get("etag") };
+  }
+  /** Presigns and fetches. Returns the raw bytes; decode as the caller sees fit. */
+  async download(appId, key) {
+    const signed = await this.presign(appId, key, { method: "get" });
+    const res = await fetch(signed.url);
+    if (!res.ok) {
+      throw new CloudError(
+        `Download failed with status ${res.status}`,
+        res.status === 404 ? "not_found" : "download_failed",
+        res.status
+      );
+    }
+    return new Uint8Array(await res.arrayBuffer());
+  }
+};
+var EmailNamespace = class {
+  constructor(client4) {
+    this.client = client4;
+  }
+  client;
+  /**
+   * Sends one message, to up to 50 recipients, as a single all-or-nothing send.
+   *
+   * Throws `CloudError` with status 429 once the app's daily quota is used up, and
+   * 502 when the provider rejected the message -- the message text carries the
+   * reason, which while the sending account is sandboxed is usually that the
+   * recipient address is not verified.
+   */
+  async send(appId, message) {
+    const res = await this.client.request(
+      "POST",
+      `/apps/${appId}/email`,
+      {
+        to: message.to,
+        subject: message.subject,
+        text: message.text,
+        html: message.html,
+        reply_to: message.replyTo
+      }
+    );
+    return res.data;
+  }
+  /** Sends used today and what is left. Resets at UTC midnight. */
+  async quota(appId) {
+    const res = await this.client.request(
+      "GET",
+      `/apps/${appId}/email/quota`
+    );
+    return res.data;
+  }
+};
+var JobsNamespace = class {
+  constructor(client4) {
+    this.client = client4;
+  }
+  client;
+  /**
+   * Enqueues a job.
+   *
+   * Pass `idempotencyKey` when the caller may retry this enqueue: a repeat returns
+   * the job already queued, with `deduplicated: true`, instead of a second copy of
+   * the work.
+   */
+  async enqueue(appId, options = {}) {
+    const res = await this.client.request("POST", `/apps/${appId}/jobs`, {
+      queue: options.queue,
+      path: options.path,
+      method: options.method,
+      payload: options.payload,
+      max_attempts: options.maxAttempts,
+      timeout_seconds: options.timeoutSeconds,
+      delay_seconds: options.delaySeconds,
+      idempotency_key: options.idempotencyKey
+    });
+    return res.data;
+  }
+  /** A page of jobs, newest first, with the queue depth per status alongside. */
+  async list(appId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.status) params.set("status", options.status);
+    if (options.queue) params.set("queue", options.queue);
+    if (options.limit) params.set("limit", String(options.limit));
+    const query = params.toString();
+    const res = await this.client.request(
+      "GET",
+      `/apps/${appId}/jobs${query ? `?${query}` : ""}`
+    );
+    return res.data;
+  }
+  async get(appId, jobId) {
+    const res = await this.client.request("GET", `/apps/${appId}/jobs/${jobId}`);
+    return res.data;
+  }
+  /** Runs a dead job again, from a clean attempt count. */
+  async retry(appId, jobId) {
+    const res = await this.client.request(
+      "POST",
+      `/apps/${appId}/jobs/${jobId}/retry`
+    );
+    return res.data;
+  }
+  /** Cancels a job that has not started. Throws 409 once it is running. */
+  async cancel(appId, jobId) {
+    const res = await this.client.request(
+      "POST",
+      `/apps/${appId}/jobs/${jobId}/cancel`
+    );
+    return res.data;
+  }
+};
+var OrgsNamespace = class {
+  constructor(client4) {
+    this.client = client4;
+  }
+  client;
+  async list() {
+    const res = await this.client.request("GET", "/orgs");
+    return res.data;
+  }
+  async create(name) {
+    const res = await this.client.request("POST", "/orgs", { name });
+    return res.data;
+  }
+  async get(id) {
+    const res = await this.client.request("GET", `/orgs/${id}`);
+    return res.data;
+  }
+  async members(id) {
+    const res = await this.client.request("GET", `/orgs/${id}/members`);
+    return res.data;
+  }
+  async invite(id, email, role = "member") {
+    await this.client.request("POST", `/orgs/${id}/members`, { email, role });
+  }
+  async removeMember(id, userId) {
+    await this.client.request("DELETE", `/orgs/${id}/members/${userId}`);
+  }
+  /**
+   * Metered usage and the priced invoice for a month (`YYYY-MM`, default the month
+   * in progress). Read-only: nothing in the SDK changes a plan or takes a payment.
+   */
+  async usage(id, period2) {
+    const query = period2 ? `?period=${encodeURIComponent(period2)}` : "";
+    const res = await this.client.request(
+      "GET",
+      `/orgs/${id}/usage${query}`
+    );
+    return res.data;
+  }
+};
+
+// ../shared/src/constants.ts
+var SUPPORTED_RUNTIMES = [
+  "node-20",
+  "node-22",
+  "python-3.11",
+  "python-3.12",
+  "bun-1",
+  "deno-2"
+];
+var DEFAULT_API_URL2 = "https://api.videan.xyz/v1";
+var APP_DOMAIN2 = process.env.CLOUD_APP_DOMAIN || "videan.xyz";
+function appUrl(slug) {
+  return `https://${slug}.${APP_DOMAIN2}`;
+}
+var CONFIG_FILE_NAME = "cloud.yaml";
+var MAX_FILE_SIZE_BYTES2 = 50 * 1024 * 1024;
+
+// ../shared/src/sizing.ts
+var FARGATE_SIZES2 = {
+  256: { min: 512, max: 2048, step: 512 },
+  512: { min: 1024, max: 4096, step: 1024 },
+  1024: { min: 2048, max: 8192, step: 1024 },
+  2048: { min: 4096, max: 16384, step: 1024 },
+  4096: { min: 8192, max: 30720, step: 1024 },
+  8192: { min: 16384, max: 61440, step: 4096 },
+  16384: { min: 32768, max: 122880, step: 8192 }
+};
+var FARGATE_CPUS2 = Object.keys(FARGATE_SIZES2).map(Number).sort((a, b) => a - b);
+
+// ../shared/src/pricing.ts
+var PLANS2 = {
+  free: {
+    id: "free",
+    name: "Free",
+    baseCents: 0,
+    includedUsageCents: 300,
+    maxApps: 3,
+    maxInstancesPerApp: 1,
+    // One app at this size, running all month, is inside the included usage.
+    maxCpu: 512,
+    maxMemory: 1024,
+    maxStorageMb: 1024,
+    postgres: true,
+    customDomains: false
+  },
+  pro: {
+    id: "pro",
+    name: "Pro",
+    baseCents: 2e3,
+    includedUsageCents: 2e3,
+    maxApps: 50,
+    maxInstancesPerApp: 4,
+    maxCpu: 4096,
+    maxMemory: 8192,
+    maxStorageMb: 100 * 1024,
+    postgres: true,
+    customDomains: true
+  },
+  scale: {
+    id: "scale",
+    name: "Scale",
+    baseCents: 2e4,
+    includedUsageCents: 2e4,
+    maxApps: 500,
+    maxInstancesPerApp: 10,
+    maxCpu: 16384,
+    maxMemory: 122880,
+    maxStorageMb: 1024 * 1024,
+    postgres: true,
+    customDomains: true
+  }
+};
+
+// ../shared/src/visibility.ts
+var VISIBILITIES = ["private", "org", "authenticated", "public"];
+var DEFAULT_VISIBILITY = "org";
+function isVisibility(value) {
+  return typeof value === "string" && VISIBILITIES.includes(value);
+}
+function visibilityOf(value) {
+  return isVisibility(value) ? value : "private";
+}
+var VISIBILITY_LABELS = {
+  private: "Only people with access",
+  org: "Anyone in the organization",
+  authenticated: "Anyone signed in to Videan",
+  public: "Anyone with the link"
+};
+
+// src/config.ts
+import Conf from "conf";
+var config = new Conf({
+  projectName: "cloud-cli",
+  schema: {
+    apiKey: { type: "string" },
+    defaultOrg: { type: "string" },
+    currentApp: { type: "string" },
+    baseUrl: { type: "string" }
+  }
+});
+function fromEnv(name) {
+  const value = process.env[`VIDEAN_${name}`] || process.env[`CLOUD_${name}`];
+  return value ? value : void 0;
+}
+function getApiKey() {
+  return fromEnv("API_KEY") || config.get("apiKey");
+}
+function setApiKey(key) {
+  config.set("apiKey", key);
+}
+function getDefaultOrg() {
+  return fromEnv("ORG") || config.get("defaultOrg");
+}
+function setDefaultOrg(org) {
+  config.set("defaultOrg", org);
+}
+function getCurrentApp() {
+  return fromEnv("APP") || config.get("currentApp");
+}
+function setCurrentApp(appId) {
+  config.set("currentApp", appId);
+}
+function getBaseUrl() {
+  return fromEnv("API_URL") || config.get("baseUrl");
+}
+function setBaseUrl(url) {
+  config.set("baseUrl", url);
+}
+function configPath() {
+  return config.path;
+}
+function clearConfig() {
+  config.clear();
+}
+
+// src/commands/login.ts
+var loginCommand = new Command("login").description("Log in to Cloud").option("-e, --email <email>", "Email (skips the prompt)").option("-p, --password <password>", "Password (skips the prompt; prefer VIDEAN_PASSWORD)").option("-o, --org <id>", "Organization to scope the key to (skips the picker)").option("--api-url <url>", "API base URL to use and remember (default: the public API)").action(async (opts) => {
+  const password = opts.password || process.env.VIDEAN_PASSWORD || process.env.CLOUD_PASSWORD;
+  if ((!opts.email || !password) && !process.stdin.isTTY) {
+    console.error(
+      chalk.red(
+        "login needs a terminal to prompt. Non-interactively, pass --email and --password (or VIDEAN_PASSWORD), or skip login entirely by setting VIDEAN_API_KEY."
+      )
+    );
+    process.exit(1);
+  }
+  const prompts = [
+    ...opts.email ? [] : [{ type: "input", name: "email", message: "Email:" }],
+    ...password ? [] : [{ type: "password", name: "password", message: "Password:" }]
+  ];
+  const answers = {
+    email: opts.email,
+    password,
+    ...prompts.length ? await inquirer.prompt(prompts) : {}
+  };
+  if (opts.apiUrl) setBaseUrl(opts.apiUrl.replace(/\/$/, ""));
+  const baseUrl = (getBaseUrl() || DEFAULT_API_URL2).replace(/\/$/, "");
+  const spinner = ora("Logging in...").start();
+  let token;
+  try {
+    const response = await fetch(`${baseUrl}/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: answers.email, password: answers.password })
+    });
+    if (!response.ok) {
+      if (response.status === 401) {
+        spinner.fail("Login failed. Check your credentials.");
+      } else {
+        spinner.fail(`Login failed: ${response.status} from ${baseUrl}/auth/login`);
+        console.error(
+          chalk.gray("  Wrong API URL? Re-run with --api-url <url>, or `videan logout` to reset.")
+        );
+      }
+      process.exit(1);
+    }
+    const data = await response.json();
+    token = data.data.token;
+  } catch (e) {
+    spinner.fail(`Login failed: could not reach ${baseUrl} (${e?.message || e})`);
+    process.exit(1);
+  }
+  const session = new CloudClient({ apiKey: token, baseUrl });
+  let orgId;
+  try {
+    const orgs = await session.orgs.list();
+    if (opts.org) {
+      const match = orgs.find((o) => o.id === opts.org || o.name === opts.org);
+      if (!match) {
+        spinner.fail(`No organization ${opts.org} for this account.`);
+        process.exit(1);
+      }
+      orgId = match.id;
+    } else if (orgs.length > 1 && !process.stdin.isTTY) {
+      spinner.fail(
+        `Several organizations (${orgs.map((o) => o.id).join(", ")}). Pass --org <id>.`
+      );
+      process.exit(1);
+    } else if (orgs.length > 1) {
+      spinner.stop();
+      const pick = await inquirer.prompt([
+        {
+          type: "list",
+          name: "orgId",
+          message: "Organization:",
+          choices: orgs.map((o) => ({ name: `${o.name} (${o.id})`, value: o.id }))
+        }
+      ]);
+      orgId = pick.orgId;
+      spinner.start("Creating CLI key...");
+    } else {
+      orgId = orgs[0]?.id;
+    }
+  } catch (e) {
+    spinner.fail(`Logged in, but could not list organizations: ${e?.message}`);
+    process.exit(1);
+  }
+  if (!orgId) {
+    setApiKey(token);
+    spinner.warn(
+      chalk.yellow("Logged in, but you have no organization yet. Run `videan orgs create <name>`.")
+    );
+    return;
+  }
+  try {
+    const key = await session.apiKeys.create({
+      name: `cli@${os.hostname()}`,
+      orgId
+    });
+    setApiKey(key.key);
+    setDefaultOrg(orgId);
+    spinner.succeed(chalk.green("Logged in."));
+    console.log(chalk.gray(`  Org:  ${orgId}`));
+    console.log(chalk.gray(`  Key:  ${key.keyPrefix}\u2026 (revoke with \`videan keys revoke ${key.id}\`)`));
+  } catch (e) {
+    setApiKey(token);
+    setDefaultOrg(orgId);
+    spinner.warn(
+      chalk.yellow(`Logged in with a temporary session (key creation failed: ${e?.message}).`)
+    );
+  }
+});
+
+// src/commands/logout.ts
+import { Command as Command2 } from "commander";
+import chalk2 from "chalk";
+var logoutCommand = new Command2("logout").description("Forget the saved key, org, app and API URL").action(() => {
+  const where = configPath();
+  clearConfig();
+  console.log(chalk2.green("Logged out."));
+  console.log(chalk2.gray(`  Cleared ${where}`));
+});
+
+// src/commands/init.ts
+import { Command as Command3 } from "commander";
+import inquirer2 from "inquirer";
+import chalk3 from "chalk";
+import fs from "fs-extra";
+import path from "node:path";
+var initCommand = new Command3("init").description("Initialize a new Cloud app in the current directory").action(async () => {
+  const configPath2 = path.join(process.cwd(), CONFIG_FILE_NAME);
+  if (await fs.pathExists(configPath2)) {
+    console.log(chalk3.yellow(`${CONFIG_FILE_NAME} already exists in this directory.`));
+    const { overwrite } = await inquirer2.prompt([
+      { type: "confirm", name: "overwrite", message: "Overwrite?", default: false }
+    ]);
+    if (!overwrite) return;
+  }
+  const answers = await inquirer2.prompt([
+    { type: "input", name: "name", message: "App name:", default: path.basename(process.cwd()) },
+    {
+      type: "list",
+      name: "runtime",
+      message: "Runtime:",
+      choices: SUPPORTED_RUNTIMES
+    },
+    { type: "input", name: "entrypoint", message: "Entrypoint:", default: "index.ts" }
+  ]);
+  const config2 = [
+    `name: ${answers.name}`,
+    `runtime: ${answers.runtime}`,
+    `entrypoint: ${answers.entrypoint}`,
+    ""
+  ].join("\n");
+  await fs.writeFile(configPath2, config2, "utf-8");
+  console.log(chalk3.green(`Created ${CONFIG_FILE_NAME}`));
+});
+
+// src/commands/deploy.ts
+import { Command as Command4 } from "commander";
+import chalk5 from "chalk";
+import ora2 from "ora";
+
+// src/util.ts
+import fs2 from "fs-extra";
+import path2 from "node:path";
+import ignore from "ignore";
+import chalk4 from "chalk";
+var MAX_FILE_BYTES = 10 * 1024 * 1024;
+async function collectFiles(dir) {
+  const ig = ignore();
+  ig.add([
+    ".git",
+    "node_modules",
+    ".env",
+    ".env.*",
+    ".next",
+    ".turbo",
+    "coverage",
+    ".DS_Store",
+    "*.log"
+  ]);
+  const gitignorePath = path2.join(dir, ".gitignore");
+  if (await fs2.pathExists(gitignorePath)) {
+    const content = await fs2.readFile(gitignorePath, "utf-8");
+    ig.add(content);
+  }
+  const cloudignorePath = path2.join(dir, ".cloudignore");
+  if (await fs2.pathExists(cloudignorePath)) {
+    const content = await fs2.readFile(cloudignorePath, "utf-8");
+    ig.add(content);
+  }
+  const files = {};
+  const binaryFiles = {};
+  const skipped = [];
+  async function walk(currentDir) {
+    const entries = await fs2.readdir(currentDir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = path2.join(currentDir, entry.name);
+      const relativePath = path2.relative(dir, fullPath);
+      const ignorePath = entry.isDirectory() ? `${relativePath}/` : relativePath;
+      if (ig.ignores(ignorePath)) continue;
+      if (entry.isDirectory()) {
+        await walk(fullPath);
+      } else if (entry.isFile()) {
+        const buffer = await fs2.readFile(fullPath);
+        if (buffer.byteLength > MAX_FILE_BYTES) {
+          skipped.push({
+            path: relativePath,
+            reason: `${Math.round(buffer.byteLength / 1024 / 1024)}MB, over the ${MAX_FILE_BYTES / 1024 / 1024}MB limit`
+          });
+          continue;
+        }
+        const text = buffer.toString("utf-8");
+        if (Buffer.from(text, "utf-8").equals(buffer)) {
+          files[relativePath] = text;
+        } else {
+          binaryFiles[relativePath] = buffer.toString("base64");
+        }
+      }
+    }
+  }
+  await walk(dir);
+  return { files, binaryFiles, skipped };
+}
+function formatStatus(status) {
+  switch (status) {
+    case "running":
+      return chalk4.green(status);
+    case "building":
+    case "deploying":
+      return chalk4.yellow(status);
+    case "failed":
+    case "crashed":
+      return chalk4.red(status);
+    case "stopped":
+      return chalk4.gray(status);
+    default:
+      return status;
+  }
+}
+function formatRow(columns, widths) {
+  return columns.map((col, i) => col.padEnd(widths[i] || 20)).join("  ");
+}
+function requireApiKey(apiKey) {
+  if (!apiKey) {
+    console.error(chalk4.red("Not logged in. Run `videan login` first."));
+    process.exit(1);
+  }
+}
+function requireOrg(orgId) {
+  if (!orgId) {
+    console.error(chalk4.red("No organization. Pass --org <id> or run `videan login` again."));
+    process.exit(1);
+  }
+  return orgId;
+}
+
+// src/commands/deploy.ts
+var deployCommand = new Command4("deploy").description("Deploy the current directory").option("-a, --app <id>", "App ID to deploy to").option("-m, --message <msg>", "Deployment message").option("--env <environment>", "preview or production (default: production)").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const appId = opts.app || getCurrentApp();
+  if (!appId) {
+    console.error(chalk5.red("No app specified. Use --app or run `videan init` first."));
+    process.exit(1);
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const spinner = ora2("Collecting files...").start();
+  const { files, binaryFiles, skipped } = await collectFiles(process.cwd());
+  const binaryCount = Object.keys(binaryFiles).length;
+  const fileCount = Object.keys(files).length + binaryCount;
+  if (!fileCount) {
+    spinner.fail(chalk5.red(`Nothing to deploy: no files under ${process.cwd()}.`));
+    process.exit(1);
+  }
+  if (skipped.length) {
+    spinner.warn(chalk5.yellow(`Skipped ${skipped.length} file(s):`));
+    for (const file of skipped) console.log(chalk5.gray(`    ${file.path} \u2014 ${file.reason}`));
+    spinner.start();
+  }
+  spinner.text = `Pushing ${fileCount} files${binaryCount ? ` (${binaryCount} binary)` : ""}...`;
+  const snapshot = await client4.apps.push(appId, files, opts.message, binaryFiles);
+  spinner.text = "Triggering deployment...";
+  if (opts.env && opts.env !== "preview" && opts.env !== "production") {
+    spinner.fail(chalk5.red(`--env must be preview or production, not ${opts.env}`));
+    process.exit(1);
+  }
+  const deployment = await client4.apps.deploy(appId, snapshot.id, opts.env);
+  spinner.text = `Deploying (${deployment.status})...`;
+  let current = deployment;
+  let consecutiveErrors = 0;
+  let lastError = "";
+  while (current.status === "building" || current.status === "deploying") {
+    await new Promise((r) => setTimeout(r, 5e3));
+    const elapsed = Math.round((Date.now() - Date.parse(current.createdAt)) / 1e3);
+    spinner.text = `${current.status === "building" ? "Building" : "Starting"}... (${elapsed}s)`;
+    try {
+      current = await client4.apps.checkDeployment(deployment.id);
+      consecutiveErrors = 0;
+    } catch (e) {
+      lastError = e?.message || String(e);
+      if (++consecutiveErrors >= 5) {
+        spinner.fail(chalk5.red(`Lost track of the deployment: ${lastError}`));
+        console.log(chalk5.gray(`  It may still finish. Check with \`videan status\`.`));
+        process.exit(1);
+      }
+    }
+  }
+  if (current.status === "running") {
+    spinner.succeed(chalk5.green(`Deployed successfully!`));
+    if (current.url) {
+      const url = /^https?:\/\//.test(current.url) ? current.url : `https://${current.url}`;
+      console.log(chalk5.cyan(`  URL: ${url}`));
+    }
+    if (current.previewUrl) {
+      console.log(chalk5.gray(`  This version: ${current.previewUrl}`));
+    }
+  } else if (current.status === "failed" || current.status === "crashed") {
+    spinner.fail(chalk5.red(`Deployment ${current.status}: ${current.error || "unknown error"}`));
+    console.log(chalk5.gray(`  Logs: videan logs --app ${appId}`));
+    process.exit(1);
+  } else {
+    spinner.info(`Deployment status: ${formatStatus(current.status)}`);
+    process.exit(1);
+  }
+});
+
+// src/commands/logs.ts
+import { Command as Command5 } from "commander";
+import chalk6 from "chalk";
+var logsCommand = new Command5("logs").description("View app logs").option("-a, --app <id>", "App ID").option("-f, --follow", "Follow log output").option("-n, --lines <n>", "Number of lines to show", "50").option("-s, --since <when>", "Start of the window: ISO timestamp or an offset like 15m, 2h, 7d", "1h").option("--until <when>", "End of the window (same formats as --since)").option("-q, --search <text>", "Only lines containing this text").option("--pattern <pattern>", "CloudWatch filter pattern, for the real syntax").option("--instance <prefix>", "Only one instance, by log stream prefix").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const appId = opts.app || getCurrentApp();
+  if (!appId) {
+    console.error(chalk6.red("No app specified. Use --app or link an app."));
+    process.exit(1);
+  }
+  if (opts.search && opts.pattern) {
+    console.error(chalk6.red("Use either --search or --pattern, not both."));
+    process.exit(1);
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const filters = {
+    q: opts.search,
+    pattern: opts.pattern,
+    instance: opts.instance
+  };
+  if (opts.follow) {
+    for await (const entry of client4.apps.followLogs(appId, { since: opts.since, ...filters })) {
+      print(entry);
+    }
+    return;
+  }
+  const page = await client4.apps.logs(appId, {
+    limit: parseInt(opts.lines, 10),
+    since: opts.since,
+    until: opts.until,
+    ...filters
+  });
+  for (const entry of page.events) print(entry);
+  if (page.events.length === 0) {
+    console.log(chalk6.gray(`No log lines since ${page.start}.`));
+  }
+  if (page.truncated) {
+    console.log(
+      chalk6.yellow(
+        "\nThis is part of the window -- there are more lines than one request reads. Narrow --since or add --search."
+      )
+    );
+  }
+});
+function print(entry) {
+  console.log(`${chalk6.gray(entry.timestamp)} ${formatLevel(entry.level)} ${entry.message}`);
+}
+function formatLevel(level) {
+  switch (level) {
+    case "error":
+      return chalk6.red("[ERR]");
+    case "warn":
+      return chalk6.yellow("[WRN]");
+    case "info":
+      return chalk6.blue("[INF]");
+    case "debug":
+      return chalk6.gray("[DBG]");
+    default:
+      return chalk6.gray("[LOG]");
+  }
+}
+
+// src/commands/metrics.ts
+import { Command as Command6 } from "commander";
+import chalk7 from "chalk";
+var metricsCommand = new Command6("metrics").description("Traffic, latency and resource use for an app").option("-a, --app <id>", "App ID").option("-s, --since <when>", "Start of the window: ISO timestamp or an offset like 15m, 2h, 7d", "1h").option("--until <when>", "End of the window (same formats as --since)").option("--series", "Print each bucket instead of just the summary").option("--json", "Print the raw response").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const appId = opts.app || getCurrentApp();
+  if (!appId) {
+    console.error(chalk7.red("No app specified. Use --app or link an app."));
+    process.exit(1);
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const metrics = await client4.apps.metrics(appId, { since: opts.since, until: opts.until });
+  if (opts.json) {
+    console.log(JSON.stringify(metrics, null, 2));
+    return;
+  }
+  const t = metrics.totals;
+  console.log(
+    chalk7.dim(`${metrics.start} \u2192 ${metrics.end}  (${metrics.period}s buckets)`)
+  );
+  console.log();
+  console.log(`  ${label("Requests")} ${t.requests}`);
+  console.log(`  ${label("4xx")} ${count(t.clientErrors)}`);
+  console.log(`  ${label("5xx")} ${count(t.serverErrors, true)}`);
+  console.log(`  ${label("Gate denied")} ${count(t.gateDenied)}`);
+  console.log(`  ${label("Latency avg")} ${ms(t.latencyAvgMs)}`);
+  console.log(`  ${label("Latency p95")} ${ms(t.latencyP95Ms)} ${chalk7.dim("(sampled)")}`);
+  console.log(`  ${label("CPU avg")} ${units(t.cpuAvg)}`);
+  console.log(`  ${label("Memory avg")} ${mb(t.memoryAvgMb)}`);
+  if (t.requests === 0) {
+    console.log();
+    console.log(chalk7.dim("No requests recorded in this window."));
+  }
+  if (opts.series) {
+    console.log();
+    for (const [name, points] of Object.entries(metrics.series)) {
+      if (points.length === 0) continue;
+      console.log(chalk7.bold(name));
+      for (const p of points) console.log(`  ${chalk7.dim(p.t)}  ${p.v}`);
+    }
+  }
+});
+function label(text) {
+  return chalk7.dim(text.padEnd(13));
+}
+function count(n, severe = false) {
+  if (n === 0) return chalk7.dim("0");
+  return severe ? chalk7.red(String(n)) : chalk7.yellow(String(n));
+}
+function ms(v) {
+  return v === null ? chalk7.dim("\u2014") : `${v} ms`;
+}
+function mb(v) {
+  return v === null ? chalk7.dim("\u2014") : `${v} MB`;
+}
+function units(v) {
+  return v === null ? chalk7.dim("\u2014") : `${v} CPU units`;
+}
+
+// src/commands/rollback.ts
+import { Command as Command7 } from "commander";
+import chalk8 from "chalk";
+import ora3 from "ora";
+var rollbackCommand = new Command7("rollback").description("Rollback to the previous production deployment").option("-a, --app <id>", "App ID").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const appId = opts.app || getCurrentApp();
+  if (!appId) {
+    console.error(chalk8.red("No app specified. Use --app or link an app."));
+    process.exit(1);
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const spinner = ora3("Rolling back...").start();
+  try {
+    const deployment = await client4.apps.rollback(appId);
+    spinner.succeed(chalk8.green("Rollback successful!"));
+    if (deployment.url) {
+      console.log(chalk8.cyan(`  URL: ${deployment.url}`));
+    }
+  } catch (error) {
+    spinner.fail(chalk8.red(`Rollback failed: ${error.message}`));
+    process.exit(1);
+  }
+});
+
+// src/commands/secrets.ts
+import { Command as Command8 } from "commander";
+import chalk9 from "chalk";
+import inquirer3 from "inquirer";
+var secretsCommand = new Command8("secrets").description("Manage app secrets");
+secretsCommand.command("set <key> [value]").description("Set a secret").option("-a, --app <id>", "App ID").action(async (key, value, opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const appId = opts.app || getCurrentApp();
+  if (!appId) {
+    console.error(chalk9.red("No app specified."));
+    process.exit(1);
+  }
+  if (!value) {
+    const answers = await inquirer3.prompt([
+      { type: "password", name: "value", message: `Value for ${key}:` }
+    ]);
+    value = answers.value;
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  await client4.secrets.set(appId, key, value);
+  console.log(chalk9.green(`Secret "${key}" set successfully.`));
+});
+secretsCommand.command("list").description("List all secrets").option("-a, --app <id>", "App ID").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const appId = opts.app || getCurrentApp();
+  if (!appId) {
+    console.error(chalk9.red("No app specified."));
+    process.exit(1);
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const secrets = await client4.secrets.list(appId);
+  if (secrets.length === 0) {
+    console.log(chalk9.gray("No secrets configured."));
+    return;
+  }
+  console.log(formatRow(["KEY", "UPDATED"], [30, 24]));
+  for (const secret of secrets) {
+    console.log(formatRow([secret.key, secret.updatedAt], [30, 24]));
+  }
+});
+secretsCommand.command("remove <key>").description("Remove a secret").option("-a, --app <id>", "App ID").action(async (key, opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const appId = opts.app || getCurrentApp();
+  if (!appId) {
+    console.error(chalk9.red("No app specified."));
+    process.exit(1);
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  await client4.secrets.delete(appId, key);
+  console.log(chalk9.green(`Secret "${key}" removed.`));
+});
+
+// src/commands/apps.ts
+import { Command as Command9 } from "commander";
+import chalk10 from "chalk";
+import inquirer4 from "inquirer";
+var appsCommand = new Command9("apps").description("Manage apps");
+function accessOption(value) {
+  if (value === void 0) return void 0;
+  const tier = value.trim().toLowerCase();
+  if (!isVisibility(tier)) {
+    console.error(chalk10.red(`Unknown --access value "${value}". Use one of: ${VISIBILITIES.join(", ")}`));
+    process.exit(1);
+  }
+  return tier;
+}
+function describeAccess(app) {
+  const tier = app.visibility ? visibilityOf(app.visibility) : app.authRequired ? "org" : "public";
+  return `${tier} \u2014 ${VISIBILITY_LABELS[tier].toLowerCase()}`;
+}
+appsCommand.command("list").description("List all apps").option("-o, --org <id>", "Organization ID").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const orgId = requireOrg(opts.org || getDefaultOrg());
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const apps = await client4.apps.list(orgId);
+  if (apps.length === 0) {
+    console.log(chalk10.gray("No apps yet. Create one with `videan apps create`."));
+    return;
+  }
+  const widths = [20, 24, 10, 44];
+  console.log(formatRow(["NAME", "ID", "STATUS", "URL"], widths));
+  for (const app of apps) {
+    console.log(formatRow([app.name, app.id, app.status, appUrl(app.slug)], widths));
+  }
+});
+appsCommand.command("create").description("Create a new app").option("-n, --name <name>", "App name").option("-o, --org <id>", "Organization ID").option("--postgres", "Provision a managed Postgres database").option("--storage", "Give the app an object-storage prefix").option("--email", "Let the app send mail through the platform").option("--public", "Serve the app without the platform login gate (same as --access public)").option("--access <tier>", `Who may open the app: ${VISIBILITIES.join(" | ")} (default: ${DEFAULT_VISIBILITY})`).action(
+  async (opts) => {
+    const apiKey = getApiKey();
+    requireApiKey(apiKey);
+    const orgId = requireOrg(opts.org || getDefaultOrg());
+    let name = opts.name;
+    if (!name) {
+      const answers = await inquirer4.prompt([
+        { type: "input", name: "name", message: "App name:" }
+      ]);
+      name = answers.name;
+    }
+    if (!name) {
+      console.error(chalk10.red("An app name is required."));
+      process.exit(1);
+    }
+    const visibility = accessOption(opts.access) ?? (opts.public ? "public" : void 0);
+    const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+    const app = await client4.apps.create({
+      name,
+      orgId,
+      postgres: opts.postgres ?? false,
+      storage: opts.storage ?? false,
+      email: opts.email ?? false,
+      visibility
+    });
+    setCurrentApp(app.id);
+    console.log(chalk10.green(`App "${app.name}" created (${app.id})`));
+    console.log(chalk10.gray(`  Access: ${describeAccess(app)}`));
+    console.log(chalk10.gray(`  URL after first deploy: ${appUrl(app.slug)}`));
+    console.log(chalk10.gray("  Push code with `videan deploy` \u2014 the runtime is auto-detected."));
+  }
+);
+appsCommand.command("set").description("Change an app's settings (scale, rate limit, gate, capabilities)").option("-a, --app <id>", "App ID").option("-n, --name <name>", "Rename the app (the URL keeps its original slug)").option("--cpu <units>", "CPU units per instance (256 = 0.25 vCPU)").option("--memory <mib>", "Memory per instance, in MiB").option("--instances <n>", "Number of instances to run").option("--rate-limit <rpm>", "Requests per minute per client").option("--no-rate-limit", "Remove the rate limit").option("--access <tier>", `Who may open the app: ${VISIBILITIES.join(" | ")}`).option("--public", "Serve without the platform login gate (same as --access public)").option("--private", "Require platform login (leaves the tier alone if it is already gated)").option("--postgres", "Provision a managed Postgres database").option("--storage", "Give the app an object-storage prefix").option("--email", "Let the app send mail through the platform").option("--json", "Print the raw response").action(
+  async (opts) => {
+    const apiKey = getApiKey();
+    requireApiKey(apiKey);
+    const appId = opts.app || getCurrentApp();
+    if (!appId) {
+      console.error(chalk10.red("No app specified. Use --app or link an app."));
+      process.exit(1);
+    }
+    if (opts.public && opts.private) {
+      console.error(chalk10.red("--public and --private contradict each other."));
+      process.exit(1);
+    }
+    const access = accessOption(opts.access);
+    if (access && (opts.public || opts.private)) {
+      console.error(chalk10.red("--access already says who may open the app; drop --public/--private."));
+      process.exit(1);
+    }
+    const changes = {};
+    if (opts.name) changes.name = opts.name;
+    if (opts.cpu !== void 0) changes.cpu = intOption("--cpu", opts.cpu);
+    if (opts.memory !== void 0) changes.memory = intOption("--memory", opts.memory);
+    if (opts.instances !== void 0) {
+      changes.instances = intOption("--instances", opts.instances);
+    }
+    if (opts.rateLimit === false) changes.rateLimitPerMinute = null;
+    else if (typeof opts.rateLimit === "string") {
+      changes.rateLimitPerMinute = intOption("--rate-limit", opts.rateLimit);
+    }
+    if (access) changes.visibility = access;
+    if (opts.public) changes.authRequired = false;
+    if (opts.private) changes.authRequired = true;
+    if (opts.postgres) changes.postgres = true;
+    if (opts.storage) changes.storage = true;
+    if (opts.email) changes.email = true;
+    if (Object.keys(changes).length === 0) {
+      console.error(chalk10.red("Nothing to change. Pass at least one option."));
+      process.exit(1);
+    }
+    const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+    const app = await client4.apps.update(appId, changes);
+    if (opts.json) {
+      console.log(JSON.stringify(app, null, 2));
+      return;
+    }
+    console.log(chalk10.green(`Updated ${app.name} (${app.id})`));
+    console.log(`  Access:      ${describeAccess(app)}`);
+    console.log(`  Scale:       ${app.cpu ?? "default"} CPU / ${app.memory ?? "default"} MiB`);
+    console.log(
+      `  Rate limit:  ${app.rateLimitPerMinute ? `${app.rateLimitPerMinute}/min per client` : "none"}`
+    );
+    if (app.restartRequired) {
+      console.log(
+        chalk10.yellow("\n  These settings apply to the next deploy. Run `videan deploy` to pick them up.")
+      );
+    }
+  }
+);
+function intOption(flag, raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n <= 0) {
+    console.error(chalk10.red(`${flag} expects a positive whole number, got "${raw}".`));
+    process.exit(1);
+  }
+  return n;
+}
+appsCommand.command("delete <id>").description("Delete an app and all its resources").action(async (id) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const { confirm } = await inquirer4.prompt([
+    {
+      type: "confirm",
+      name: "confirm",
+      message: `Delete app ${id}? This stops the app and destroys its database, secrets and snapshots.`,
+      default: false
+    }
+  ]);
+  if (!confirm) return;
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const { warnings } = await client4.apps.delete(id);
+  console.log(chalk10.green("App deleted."));
+  if (warnings.length > 0) {
+    console.log(chalk10.yellow("\nSome resources could not be released:"));
+    for (const w of warnings) {
+      console.log(chalk10.yellow(`  ${w.step}: ${w.error || "unknown error"}`));
+    }
+  }
+});
+
+// src/commands/status.ts
+import { Command as Command10 } from "commander";
+import chalk11 from "chalk";
+function accessLine(app) {
+  const tier = app.visibility ? visibilityOf(app.visibility) : app.authRequired ? "org" : "public";
+  return `${tier} \u2014 ${VISIBILITY_LABELS[tier].toLowerCase()}`;
+}
+var statusCommand = new Command10("status").description("Show current app status").option("-a, --app <id>", "App ID").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const appId = opts.app || getCurrentApp();
+  if (!appId) {
+    console.error(chalk11.red("No app specified. Use --app or link an app."));
+    process.exit(1);
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const app = await client4.apps.get(appId);
+  const health = await client4.apps.health(appId);
+  console.log(chalk11.bold(app.name));
+  console.log(`  ID:        ${app.id}`);
+  console.log(`  Created:   ${app.createdAt}`);
+  console.log(`  Postgres:  ${app.postgresEnabled ? "enabled" : "disabled"}`);
+  console.log(`  Access:    ${accessLine(app)}`);
+  console.log(`  State:     ${formatStatus(health.state)}`);
+  console.log(`  Healthy:   ${health.healthy ? chalk11.green("yes") : chalk11.red("no")}`);
+  console.log(`  URL:       ${chalk11.cyan(health.url || appUrl(app.slug))}`);
+  const task = health.task;
+  if (task) {
+    if (task.exit_code !== void 0 && task.exit_code !== null) {
+      const code = String(task.exit_code);
+      console.log(`  Exit code: ${task.exit_code === 0 ? code : chalk11.red(code)}`);
+    }
+    if (task.stopped_reason) {
+      console.log(`  Stopped:   ${chalk11.yellow(task.stopped_reason)}`);
+    }
+    if (task.container_reason) {
+      console.log(`  Detail:    ${chalk11.yellow(task.container_reason)}`);
+    }
+  }
+  if (!health.healthy) {
+    console.log(chalk11.gray("\nRun `videan logs` to see why."));
+  }
+});
+
+// src/commands/keys.ts
+import { Command as Command11 } from "commander";
+import chalk12 from "chalk";
+import inquirer5 from "inquirer";
+var keysCommand = new Command11("keys").description("Manage API keys for programmatic access");
+keysCommand.command("create <name>").description("Create an API key").option("-o, --org <id>", "Organization ID").option("-e, --expires <days>", "Expire the key after N days").option(
+  "--app <id>",
+  "Pin the key to one app (a service token, for code running inside it)"
+).action(async (name, opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const orgId = requireOrg(opts.org || getDefaultOrg());
+  let expiresInDays;
+  if (opts.expires !== void 0) {
+    expiresInDays = Number(opts.expires);
+    if (!Number.isInteger(expiresInDays) || expiresInDays < 1) {
+      console.error(chalk12.red("--expires must be a whole number of days, at least 1."));
+      process.exit(1);
+    }
+  }
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const key = await client4.apiKeys.create({
+    name,
+    orgId,
+    expiresInDays,
+    appId: opts.app
+  });
+  console.log(chalk12.green(`Created key "${key.name}" (${key.id})`));
+  console.log(`
+  ${chalk12.bold(key.key)}
+`);
+  console.log(chalk12.yellow("Copy it now. It cannot be shown again."));
+  if (key.appId) {
+    console.log(
+      chalk12.gray(`Service token, scoped to app ${key.appId}. It cannot reach anything else.`)
+    );
+  } else {
+    console.log(
+      chalk12.gray("Acts as you across every app in the org -- do not deploy it inside an app.")
+    );
+  }
+  if (key.expiresAt) {
+    console.log(chalk12.gray(`Expires ${key.expiresAt}`));
+  }
+});
+keysCommand.command("list").description("List API keys").option("-o, --org <id>", "Organization ID").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const orgId = requireOrg(opts.org || getDefaultOrg());
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const keys = await client4.apiKeys.list(orgId);
+  if (keys.length === 0) {
+    console.log(chalk12.gray("No API keys. Create one with `videan keys create <name>`."));
+    return;
+  }
+  const widths = [24, 24, 16, 22, 12, 24];
+  console.log(formatRow(["NAME", "ID", "PREFIX", "LAST USED", "STATE", "SCOPE"], widths));
+  for (const key of keys) {
+    const state = key.revokedAt ? chalk12.red("revoked") : key.expiresAt && new Date(key.expiresAt) < /* @__PURE__ */ new Date() ? chalk12.yellow("expired") : chalk12.green("active");
+    console.log(formatRow(
+      [
+        key.name,
+        key.id,
+        `${key.keyPrefix}\u2026`,
+        key.lastUsedAt || "never",
+        state,
+        key.appId ? `app ${key.appId}` : "org-wide"
+      ],
+      widths
+    ));
+  }
+});
+keysCommand.command("revoke <id>").description("Revoke an API key").action(async (id) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const { confirm } = await inquirer5.prompt([
+    { type: "confirm", name: "confirm", message: `Revoke key ${id}?`, default: false }
+  ]);
+  if (!confirm) return;
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  await client4.apiKeys.revoke(id);
+  console.log(chalk12.green("Key revoked."));
+});
+
+// src/commands/orgs.ts
+import { Command as Command12 } from "commander";
+import chalk13 from "chalk";
+var orgsCommand = new Command12("orgs").description("Manage organizations");
+orgsCommand.command("list").description("List your organizations").action(async () => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const orgs = await client4.orgs.list();
+  const current = getDefaultOrg();
+  if (orgs.length === 0) {
+    console.log(chalk13.gray("No organizations. Create one with `videan orgs create <name>`."));
+    return;
+  }
+  const widths = [24, 24, 10, 8];
+  console.log(formatRow(["NAME", "ID", "PLAN", ""], widths));
+  for (const org of orgs) {
+    console.log(formatRow(
+      [org.name, org.id, org.plan, org.id === current ? chalk13.green("default") : ""],
+      widths
+    ));
+  }
+});
+orgsCommand.command("create <name>").description("Create an organization").action(async (name) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const org = await client4.orgs.create(name);
+  if (!getDefaultOrg()) setDefaultOrg(org.id);
+  console.log(chalk13.green(`Organization "${org.name}" created (${org.id})`));
+});
+orgsCommand.command("use <id>").description("Set the default organization for this machine").action(async (id) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const org = await client4.orgs.get(id);
+  setDefaultOrg(org.id);
+  console.log(chalk13.green(`Default organization set to "${org.name}".`));
+});
+orgsCommand.command("members").description("List organization members").option("-o, --org <id>", "Organization ID").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const orgId = requireOrg(opts.org || getDefaultOrg());
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  const members = await client4.orgs.members(orgId);
+  const widths = [32, 24, 10];
+  console.log(formatRow(["EMAIL", "NAME", "ROLE"], widths));
+  for (const member of members) {
+    console.log(formatRow(
+      [member.email || member.user_id, member.name || "-", member.role],
+      widths
+    ));
+  }
+});
+orgsCommand.command("invite <email>").description("Invite a member by email").option("-o, --org <id>", "Organization ID").action(async (email, opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const orgId = requireOrg(opts.org || getDefaultOrg());
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  await client4.orgs.invite(orgId, email);
+  console.log(chalk13.green(`Invited ${email}.`));
+});
+
+// src/commands/storage.ts
+import { Command as Command13 } from "commander";
+import chalk14 from "chalk";
+import fs3 from "fs-extra";
+import path3 from "node:path";
+var storageCommand = new Command13("storage").description("Store files for an app");
+function client() {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  return new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+}
+function requireApp(opt) {
+  const appId = opt || getCurrentApp();
+  if (!appId) {
+    console.error(chalk14.red("No app specified. Use --app or link an app."));
+    process.exit(1);
+  }
+  return appId;
+}
+function human(bytes) {
+  const units2 = ["B", "KB", "MB", "GB", "TB"];
+  let n = bytes;
+  let i = 0;
+  while (n >= 1024 && i < units2.length - 1) {
+    n /= 1024;
+    i++;
+  }
+  return `${i === 0 ? n : n.toFixed(1)} ${units2[i]}`;
+}
+storageCommand.command("ls [prefix]").description("List stored objects").option("-a, --app <id>", "App ID").option("--json", "Print the raw response").action(async (prefix, opts) => {
+  const appId = requireApp(opts.app);
+  const objects = await client().storage.listAll(appId, prefix);
+  if (opts.json) {
+    console.log(JSON.stringify(objects, null, 2));
+    return;
+  }
+  if (objects.length === 0) {
+    console.log(chalk14.gray("No objects stored. Upload one with `videan storage put <file>`."));
+    return;
+  }
+  const widths = [52, 12, 24];
+  console.log(formatRow(["KEY", "SIZE", "MODIFIED"], widths));
+  for (const o of objects) {
+    console.log(formatRow([o.key, human(o.size), o.lastModified || "-"], widths));
+  }
+  const total = objects.reduce((sum, o) => sum + o.size, 0);
+  console.log(chalk14.dim(`
+${objects.length} object(s), ${human(total)}`));
+});
+storageCommand.command("put <file> [key]").description("Upload a file (key defaults to the file's name)").option("-a, --app <id>", "App ID").option("-t, --type <mime>", "Content type").action(async (file, key, opts) => {
+  const appId = requireApp(opts.app);
+  if (!await fs3.pathExists(file)) {
+    console.error(chalk14.red(`No such file: ${file}`));
+    process.exit(1);
+  }
+  const body = await fs3.readFile(file);
+  const objectKey = key || path3.basename(file);
+  const stored = await client().storage.upload(appId, objectKey, body, {
+    contentType: opts.type
+  });
+  console.log(
+    chalk14.green(`Uploaded ${objectKey}`) + chalk14.dim(` (${human(body.length)})`)
+  );
+  if (stored.etag) console.log(chalk14.dim(`etag ${stored.etag}`));
+});
+storageCommand.command("get <key> [file]").description("Download an object (defaults to the key's basename)").option("-a, --app <id>", "App ID").action(async (key, file, opts) => {
+  const appId = requireApp(opts.app);
+  const bytes = await client().storage.download(appId, key);
+  const dest = file || path3.basename(key);
+  await fs3.writeFile(dest, bytes);
+  console.log(chalk14.green(`Wrote ${dest}`) + chalk14.dim(` (${human(bytes.length)})`));
+});
+storageCommand.command("rm <key>").description("Delete an object").option("-a, --app <id>", "App ID").action(async (key, opts) => {
+  const appId = requireApp(opts.app);
+  await client().storage.delete(appId, key);
+  console.log(chalk14.green(`Deleted ${key}`));
+});
+storageCommand.command("url <key>").description("Print a temporary link to an object").option("-a, --app <id>", "App ID").option("-e, --expires <seconds>", "Lifetime in seconds (30-3600)", "900").option("--upload", "Sign an upload (PUT) URL instead of a download").option("-d, --download <filename>", "Serve as a download with this filename").action(async (key, opts) => {
+  const appId = requireApp(opts.app);
+  const expiresIn = Number(opts.expires);
+  if (!Number.isInteger(expiresIn) || expiresIn < 30 || expiresIn > 3600) {
+    console.error(chalk14.red("--expires must be a whole number of seconds between 30 and 3600."));
+    process.exit(1);
+  }
+  const signed = await client().storage.presign(appId, key, {
+    method: opts.upload ? "put" : "get",
+    expiresIn,
+    download: opts.download
+  });
+  console.log(signed.url);
+  console.error(
+    chalk14.yellow(
+      `This ${signed.method} link works for ${expiresIn}s for anyone who has it.`
+    )
+  );
+});
+storageCommand.command("usage").description("Total objects and bytes stored").option("-a, --app <id>", "App ID").action(async (opts) => {
+  const appId = requireApp(opts.app);
+  const { objects, bytes } = await client().storage.usage(appId);
+  console.log(`${objects} object(s), ${human(bytes)}`);
+});
+
+// src/commands/email.ts
+import { Command as Command14 } from "commander";
+import chalk15 from "chalk";
+import fs4 from "fs-extra";
+var emailCommand = new Command14("email").description("Send email from an app");
+function client2() {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  return new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+}
+function requireApp2(opt) {
+  const appId = opt || getCurrentApp();
+  if (!appId) {
+    console.error(chalk15.red("No app specified. Use --app or link an app."));
+    process.exit(1);
+  }
+  return appId;
+}
+emailCommand.command("send").description("Send an email").requiredOption("-t, --to <address...>", "Recipient address (repeatable)").requiredOption("-s, --subject <subject>", "Subject line").option("--text <body>", "Plain-text body").option("--html <body>", "HTML body").option("--body-file <path>", "Read the body from a file").option("--reply-to <address>", "Where replies should go").option("-a, --app <id>", "App ID").option("--json", "Print the raw response").action(
+  async (opts) => {
+    const appId = requireApp2(opts.app);
+    let text = opts.text;
+    let html = opts.html;
+    if (opts.bodyFile) {
+      const contents = await fs4.readFile(opts.bodyFile, "utf-8");
+      if (/\.html?$/i.test(opts.bodyFile)) html = contents;
+      else text = contents;
+    }
+    if (!text && !html) {
+      console.error(chalk15.red("Nothing to send. Pass --text, --html or --body-file."));
+      process.exit(1);
+    }
+    const sent = await client2().email.send(appId, {
+      to: opts.to,
+      subject: opts.subject,
+      text,
+      html,
+      replyTo: opts.replyTo
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(sent, null, 2));
+      return;
+    }
+    console.log(chalk15.green("Sent"));
+    console.log(`  From:    ${sent.from}`);
+    console.log(`  To:      ${sent.to.join(", ")}`);
+    console.log(`  Message: ${sent.messageId ?? "(no id returned)"}`);
+    console.log(
+      chalk15.dim(
+        `  Quota:   ${sent.quota.sent}/${sent.quota.quota} today, resets ${sent.quota.resetsAt}`
+      )
+    );
+  }
+);
+emailCommand.command("quota").description("Show today's sending allowance").option("-a, --app <id>", "App ID").option("--json", "Print the raw response").action(async (opts) => {
+  const quota = await client2().email.quota(requireApp2(opts.app));
+  if (opts.json) {
+    console.log(JSON.stringify(quota, null, 2));
+    return;
+  }
+  console.log(`Sent today:  ${quota.sent}`);
+  console.log(`Daily quota: ${quota.quota}`);
+  console.log(`Remaining:   ${quota.remaining}`);
+  console.log(chalk15.dim(`Resets at:   ${quota.resetsAt}`));
+});
+
+// src/commands/jobs.ts
+import { Command as Command15 } from "commander";
+import chalk16 from "chalk";
+import fs5 from "fs-extra";
+var jobsCommand = new Command15("jobs").description("Enqueue and inspect background jobs");
+function client3() {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  return new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+}
+function requireApp3(opt) {
+  const appId = opt || getCurrentApp();
+  if (!appId) {
+    console.error(chalk16.red("No app specified. Use --app or run `videan init` first."));
+    process.exit(1);
+  }
+  return appId;
+}
+function intOption2(flag, raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 0) {
+    console.error(chalk16.red(`${flag} expects a whole number, got "${raw}".`));
+    process.exit(1);
+  }
+  return n;
+}
+var STATUS_COLOR = {
+  queued: chalk16.yellow,
+  running: chalk16.cyan,
+  succeeded: chalk16.green,
+  dead: chalk16.red,
+  cancelled: chalk16.gray
+};
+function statusLabel(status) {
+  return (STATUS_COLOR[status] ?? chalk16.white)(status);
+}
+jobsCommand.command("enqueue").description("Queue a job for the app to run").option("-a, --app <id>", "App ID").option("-q, --queue <name>", "Queue name (default: default)").option("-p, --path <path>", "Path on the app to POST to (default: /jobs)").option("-d, --data <json>", "JSON payload").option("-f, --file <path>", "Read the JSON payload from a file").option("--delay <seconds>", "Run no earlier than this many seconds from now").option("--attempts <n>", "Attempts before the job is given up on (default: 3)").option("--timeout <seconds>", "How long the handler gets per attempt (default: 60)").option("--key <key>", "Idempotency key -- a repeat returns the same job").option("--json", "Print the raw response").action(async (opts) => {
+  const appId = requireApp3(opts.app);
+  let payload;
+  const raw = opts.file ? await fs5.readFile(opts.file, "utf-8") : opts.data;
+  if (raw !== void 0) {
+    try {
+      payload = JSON.parse(raw);
+    } catch (e) {
+      console.error(chalk16.red(`--${opts.file ? "file" : "data"} is not valid JSON: ${e.message}`));
+      process.exit(1);
+    }
+  }
+  const job = await client3().jobs.enqueue(appId, {
+    queue: opts.queue,
+    path: opts.path,
+    payload,
+    delaySeconds: opts.delay !== void 0 ? intOption2("--delay", opts.delay) : void 0,
+    maxAttempts: opts.attempts !== void 0 ? intOption2("--attempts", opts.attempts) : void 0,
+    timeoutSeconds: opts.timeout !== void 0 ? intOption2("--timeout", opts.timeout) : void 0,
+    idempotencyKey: opts.key
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(job, null, 2));
+    return;
+  }
+  if (job.deduplicated) {
+    console.log(chalk16.yellow(`Already queued as ${job.id} (idempotency key "${opts.key}")`));
+  } else {
+    console.log(chalk16.green(`Queued ${job.id}`));
+  }
+  console.log(chalk16.gray(`  ${job.method} ${job.path} on queue "${job.queue}"`));
+  if (job.runAt && Date.parse(job.runAt) > Date.now() + 1e3) {
+    console.log(chalk16.gray(`  Runs at ${new Date(job.runAt).toLocaleString()}`));
+  }
+});
+jobsCommand.command("list").description("List jobs, newest first").option("-a, --app <id>", "App ID").option("-s, --status <status>", "queued, running, succeeded, dead or cancelled").option("-q, --queue <name>", "Only this queue").option("-n, --limit <n>", "How many to show (default: 20)").option("--json", "Print the raw response").action(async (opts) => {
+  const appId = requireApp3(opts.app);
+  const { jobs, counts } = await client3().jobs.list(appId, {
+    status: opts.status,
+    queue: opts.queue,
+    limit: opts.limit !== void 0 ? intOption2("--limit", opts.limit) : 20
+  });
+  if (opts.json) {
+    console.log(JSON.stringify({ jobs, counts }, null, 2));
+    return;
+  }
+  const depth = Object.entries(counts).map(([status, n]) => `${statusLabel(status)} ${n}`).join("  ");
+  console.log(depth || chalk16.gray("No jobs yet."));
+  if (jobs.length === 0) return;
+  console.log();
+  for (const job of jobs) {
+    const attempts = job.attempts > 0 ? chalk16.gray(` ${job.attempts}/${job.maxAttempts}`) : "";
+    console.log(
+      `${statusLabel(job.status).padEnd(20)} ${chalk16.white(job.id)}  ${chalk16.gray(
+        `${job.queue} ${job.path}`
+      )}${attempts}`
+    );
+    if (job.error) console.log(chalk16.red(`    ${job.error}`));
+  }
+});
+jobsCommand.command("get <job-id>").description("Show one job in full").option("-a, --app <id>", "App ID").option("--json", "Print the raw response").action(async (jobId, opts) => {
+  const job = await client3().jobs.get(requireApp3(opts.app), jobId);
+  if (opts.json) {
+    console.log(JSON.stringify(job, null, 2));
+    return;
+  }
+  console.log(`${chalk16.white(job.id)}  ${statusLabel(job.status)}`);
+  console.log(chalk16.gray(`  ${job.method} ${job.path} on queue "${job.queue}"`));
+  console.log(chalk16.gray(`  Attempts: ${job.attempts}/${job.maxAttempts}`));
+  if (job.statusCode) console.log(chalk16.gray(`  Last response: HTTP ${job.statusCode}`));
+  if (job.durationMs) console.log(chalk16.gray(`  Took: ${job.durationMs}ms`));
+  if (job.error) console.log(chalk16.red(`  Error: ${job.error}`));
+  if (job.status === "queued" && job.attempts > 0) {
+    console.log(chalk16.yellow(`  Retrying at ${new Date(job.runAt).toLocaleString()}`));
+  }
+  if (job.payload !== null && job.payload !== void 0) {
+    console.log(chalk16.gray("  Payload:"));
+    console.log(
+      JSON.stringify(job.payload, null, 2).split("\n").map((l) => `    ${l}`).join("\n")
+    );
+  }
+});
+jobsCommand.command("retry <job-id>").description("Run a dead job again, from a clean attempt count").option("-a, --app <id>", "App ID").action(async (jobId, opts) => {
+  const job = await client3().jobs.retry(requireApp3(opts.app), jobId);
+  console.log(chalk16.green(`Requeued ${job.id}`));
+});
+jobsCommand.command("cancel <job-id>").description("Cancel a job that has not started yet").option("-a, --app <id>", "App ID").action(async (jobId, opts) => {
+  const job = await client3().jobs.cancel(requireApp3(opts.app), jobId);
+  console.log(chalk16.green(`Cancelled ${job.id}`));
+});
+
+// src/commands/usage.ts
+import { Command as Command16 } from "commander";
+import chalk17 from "chalk";
+var usageCommand = new Command16("usage").description("Metered usage and cost for the current month").option("-o, --org <id>", "Organization ID").option("-a, --app <id>", "Show one app's share instead of the whole org").option("-p, --period <YYYY-MM>", "Month to report on (default: the month in progress)").option("--json", "Print the raw response").action(async (opts) => {
+  const apiKey = getApiKey();
+  requireApiKey(apiKey);
+  const client4 = new CloudClient({ apiKey, baseUrl: getBaseUrl() });
+  if (opts.app || !opts.org && getCurrentApp() && !getDefaultOrg()) {
+    const appId = opts.app || getCurrentApp();
+    const report2 = await client4.apps.usage(appId, opts.period);
+    if (opts.json) return void console.log(JSON.stringify(report2, null, 2));
+    console.log(chalk17.dim(`${period(report2.periodStart, report2.periodEnd)}  app ${appId}`));
+    console.log();
+    printMetrics(report2.metrics);
+    console.log();
+    for (const line of report2.lines) {
+      console.log(`  ${chalk17.dim(line.label.padEnd(22))} ${money(line.cents)}`);
+    }
+    console.log(`  ${chalk17.bold("Share of the bill".padEnd(22))} ${chalk17.bold(report2.cost)}`);
+    console.log();
+    console.log(
+      chalk17.dim("At list price, with no plan allowance applied \u2014 see `videan usage` for the org total.")
+    );
+    return;
+  }
+  const orgId = opts.org || getDefaultOrg();
+  if (!orgId) {
+    console.error(chalk17.red("No org specified. Use --org, or --app for a single app."));
+    process.exit(1);
+  }
+  const report = await client4.orgs.usage(orgId, opts.period);
+  if (opts.json) return void console.log(JSON.stringify(report, null, 2));
+  const inv = report.invoice;
+  console.log(
+    chalk17.dim(`${period(report.periodStart, report.periodEnd)}  org ${orgId}  plan ${report.plan}`)
+  );
+  console.log();
+  printMetrics(report.metrics);
+  if (report.apps.length > 0) {
+    console.log();
+    console.log(chalk17.bold("By app"));
+    for (const app of [...report.apps].sort((a, b) => b.cents - a.cents)) {
+      const name = app.slug || app.name || app.appId || "(deleted apps)";
+      console.log(`  ${chalk17.dim(String(name).padEnd(24))} ${money(app.cents)}`);
+    }
+  }
+  console.log();
+  for (const line of inv.lines) {
+    console.log(
+      `  ${chalk17.dim(line.label.padEnd(22))} ${money(line.cents)} ${chalk17.dim(
+        `(${line.quantity} \xD7 ${line.unitPriceCents}\xA2)`
+      )}`
+    );
+  }
+  console.log(`  ${chalk17.dim("Usage".padEnd(22))} ${money(inv.usageCents)}`);
+  if (inv.includedUsageCents > 0) {
+    console.log(
+      `  ${chalk17.dim("Included".padEnd(22))} ${chalk17.green(`-${money(Math.min(inv.usageCents, inv.includedUsageCents))}`)}`
+    );
+  }
+  if (inv.baseCents > 0) {
+    console.log(`  ${chalk17.dim("Plan".padEnd(22))} ${money(inv.baseCents)}`);
+  }
+  console.log(`  ${chalk17.bold("Total".padEnd(22))} ${chalk17.bold(report.total)}`);
+  console.log();
+  console.log(chalk17.dim("Usage to date. The period is priced as it stands right now."));
+});
+usageCommand.command("plans").description("The plan catalogue and what each one allows").option("--json", "Print the raw response").action(async (opts) => {
+  const client4 = new CloudClient({ apiKey: getApiKey() || "", baseUrl: getBaseUrl() });
+  const plans = await client4.plans();
+  if (opts.json) return void console.log(JSON.stringify(plans, null, 2));
+  for (const plan of plans) {
+    console.log(
+      `${chalk17.bold(plan.name)} ${chalk17.dim(`(${plan.id})`)}  ${plan.base}/mo` + (plan.includedUsageCents > 0 ? chalk17.dim(`, ${plan.includedUsage} usage included`) : "")
+    );
+    const l = plan.limits;
+    console.log(
+      chalk17.dim(
+        `  ${l.apps} apps \xB7 ${l.instancesPerApp} instances/app \xB7 up to ${l.maxCpu} CPU / ${l.maxMemory} MB \xB7 ${l.maxStorageMb} MB storage${l.postgres ? " \xB7 postgres" : ""}${l.customDomains ? " \xB7 custom domains" : ""}`
+      )
+    );
+    console.log();
+  }
+});
+function printMetrics(metrics) {
+  if (metrics.length === 0) {
+    console.log(chalk17.dim("  Nothing metered in this period yet."));
+    return;
+  }
+  for (const m of metrics) {
+    console.log(`  ${chalk17.dim(m.metric.padEnd(22))} ${round(m.quantity)}`);
+  }
+}
+function round(n) {
+  const v = Math.round(n * 100) / 100;
+  return Number.isInteger(v) ? String(v) : v.toFixed(2);
+}
+function money(cents) {
+  return `$${(cents / 100).toFixed(2)}`;
+}
+function period(start, end) {
+  return `${start.slice(0, 10)} \u2192 ${end.slice(0, 10)}`;
+}
+
+// src/index.ts
+var program = new Command17();
+program.name("videan").description("Videan CLI \u2014 deploy apps in seconds").version("0.1.0");
+program.addCommand(loginCommand);
+program.addCommand(logoutCommand);
+program.addCommand(initCommand);
+program.addCommand(deployCommand);
+program.addCommand(logsCommand);
+program.addCommand(metricsCommand);
+program.addCommand(rollbackCommand);
+program.addCommand(secretsCommand);
+program.addCommand(appsCommand);
+program.addCommand(statusCommand);
+program.addCommand(keysCommand);
+program.addCommand(orgsCommand);
+program.addCommand(storageCommand);
+program.addCommand(emailCommand);
+program.addCommand(jobsCommand);
+program.addCommand(usageCommand);
+function die(e) {
+  console.error(`Error: ${e?.message || e}`);
+  if (process.env.VIDEAN_DEBUG && e?.stack) console.error(e.stack);
+  process.exit(1);
+}
+process.on("unhandledRejection", die);
+program.parseAsync().catch(die);
+//# sourceMappingURL=index.js.map