deploro 0.3.4 → 0.5.0

package/dist/index.js

@@ -379,6 +379,24 @@ async function authUsersCommand() {
     }))
   );
 }
+async function authBanCommand(id, opts) {
+  requireConfig();
+  await confirmOrDie(`Ban user ${id}?`, opts.yes);
+  const expiresAt = opts.days ? new Date(Date.now() + Number(opts.days) * 24 * 60 * 60 * 1e3).toISOString() : void 0;
+  await apiRequest(`/api/auth/users/${encodeURIComponent(id)}/ban`, {
+    method: "PATCH",
+    body: JSON.stringify({ banned: true, reason: opts.reason, expiresAt })
+  });
+  console.log(`\u2713 User ${id} banned${opts.days ? ` for ${opts.days} day(s)` : ""}`);
+}
+async function authUnbanCommand(id) {
+  requireConfig();
+  await apiRequest(`/api/auth/users/${encodeURIComponent(id)}/ban`, {
+    method: "PATCH",
+    body: JSON.stringify({ banned: false })
+  });
+  console.log(`\u2713 User ${id} unbanned`);
+}
 async function authInviteCommand(email, opts) {
   requireConfig();
   const role = opts.admin ? "admin" : "member";
@@ -518,7 +536,8 @@ async function authProvidersListCommand() {
     "reddit",
     "dropbox",
     "notion",
-    "apple"
+    "apple",
+    "upwork"
   ];
   const byProvider = new Map(data.providers.map((p) => [p.provider, p]));
   const rows = known.map((provider) => {
@@ -539,6 +558,11 @@ async function authProviderEnableCommand(provider, enabled) {
     { method: "PUT", body: JSON.stringify({ enabled }) }
   );
   console.log(`\u2713 ${provider} ${enabled ? "enabled" : "disabled"}`);
+  if (provider === "email_password" && enabled) {
+    console.log(
+      "  Your app can now call /auth/:slug/email-password/{signup,login,request-reset,reset} directly \u2014\n  see the dashboard's Auth page for the exact copyable URLs."
+    );
+  }
 }
 async function authProviderConfigureCommand(provider, opts) {
   const config = requireProject();
@@ -616,12 +640,355 @@ async function authStatsCommand() {
   }
 }
 
+// src/commands/github.ts
+async function githubStatusCommand() {
+  requireConfig();
+  const data = await apiRequestNoProject("/api/github/status");
+  if (!data.configured) {
+    console.log("GitHub OAuth is not configured on this platform (operator hasn't set GITHUB_APP_CLIENT_ID/SECRET).");
+    return;
+  }
+  console.log(data.connected ? `\u2713 Connected as ${data.login}` : "Not connected. Run: deploro github connect");
+}
+async function githubConnectCommand() {
+  requireConfig();
+  const data = await apiRequestNoProject("/api/github/oauth/start");
+  console.log("Open this URL in a browser to connect your GitHub account:\n");
+  console.log(`  ${data.url}
+`);
+  console.log("After approving, run 'deploro github status' to confirm.");
+}
+async function githubReposCommand() {
+  requireConfig();
+  const data = await apiRequestNoProject(
+    "/api/github/repos"
+  );
+  if (!data.configured) {
+    console.log("GitHub OAuth is not configured on this platform.");
+    return;
+  }
+  if (!data.connected) {
+    console.log("Not connected. Run: deploro github connect");
+    return;
+  }
+  if (data.error) {
+    console.error(data.error);
+    return;
+  }
+  table(
+    data.repos.map((r) => ({
+      repo: r.full_name,
+      branch: r.default_branch,
+      visibility: r.private ? "private" : "public"
+    }))
+  );
+  console.log("\nLink one to the active project with: deploro repo link <owner/repo>");
+}
+async function githubDisconnectCommand(opts) {
+  requireConfig();
+  await confirmOrDie(
+    "Disconnect your GitHub account? Projects with a repo already linked keep deploying \u2014 this only removes your stored OAuth token, so you won't be able to link new repos until you reconnect.",
+    opts.yes
+  );
+  await apiRequestNoProject("/api/github/disconnect", { method: "POST" });
+  console.log("\u2713 GitHub account disconnected");
+}
+async function repoStatusCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/github`
+  );
+  if (!data.connection) {
+    console.log("No repo linked. Run: deploro repo link <owner/repo>");
+    return;
+  }
+  console.log(`Repo   : ${data.connection.github_owner}/${data.connection.github_repo}`);
+  console.log(`Branch : ${data.connection.branch}`);
+  console.log(`Webhook: ${data.connection.webhook_id ? "auto-created on GitHub" : "(not created \u2014 deploys may not trigger)"}`);
+}
+async function repoLinkCommand(ownerRepo, opts) {
+  const config = requireProject();
+  const [owner, repo2] = ownerRepo.split("/");
+  if (!owner || !repo2) {
+    console.error('Expected "owner/repo", e.g. "acme/my-app"');
+    process.exit(1);
+  }
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/github`,
+    { method: "POST", body: JSON.stringify({ owner, repo: repo2, branch: opts.branch }) }
+  );
+  console.log(`\u2713 Linked ${data.connection.owner}/${data.connection.repo} (branch: ${data.connection.branch})`);
+  console.log(
+    data.connection.webhook_created ? "  Webhook created on GitHub \u2014 pushes will now auto-deploy." : "  Webhook already existed on GitHub \u2014 reusing it."
+  );
+}
+async function repoUnlinkCommand(opts) {
+  const config = requireProject();
+  await confirmOrDie("Unlink this project's repo and remove its GitHub webhook?", opts.yes);
+  await apiRequest(`/api/projects/${config.projectId}/github`, { method: "DELETE" });
+  console.log("\u2713 Repo unlinked");
+}
+async function repoAutoDeployCommand(state) {
+  const config = requireProject();
+  const enabled = state === "on" || state === "true" || state === "enable";
+  const disabled = state === "off" || state === "false" || state === "disable";
+  if (!enabled && !disabled) {
+    console.error('Expected "on" or "off"');
+    process.exit(1);
+  }
+  await apiRequest(`/api/projects/${config.projectId}`, {
+    method: "PATCH",
+    body: JSON.stringify({ auto_deploy_enabled: enabled })
+  });
+  console.log(`\u2713 Automatic deployment ${enabled ? "enabled" : "disabled"}`);
+}
+
+// src/commands/domains.ts
+async function domainsListCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/domains`);
+  table(
+    data.domains.map((d) => ({
+      hostname: d.hostname,
+      status: d.status,
+      ssl: d.ssl_status,
+      verified: d.verified_at ? "yes" : "no"
+    }))
+  );
+}
+async function domainsAddCommand(hostname) {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/domains`, {
+    method: "POST",
+    body: JSON.stringify({ hostname })
+  });
+  console.log(`\u2713 Domain added: ${data.domain.hostname} (id: ${data.domain.id})
+`);
+  console.log("Add these DNS records at your registrar/DNS provider, then run 'deploro domains verify " + data.domain.id + "':\n");
+  const { cname, txt } = data.dns_instructions;
+  console.log(`  ${cname.type}  ${cname.name}  \u2192  ${cname.value}`);
+  console.log(`  ${txt.type}  ${txt.name}  \u2192  ${txt.value}`);
+}
+async function domainsVerifyCommand(idOrHostname) {
+  const config = requireProject();
+  const id = await resolveDomainId(config.projectId, idOrHostname);
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/domains/${id}/verify`,
+    { method: "POST" }
+  );
+  console.log(data.verified ? `\u2713 ${data.message}` : `\u2717 ${data.message}`);
+}
+async function domainsStatusCommand(idOrHostname) {
+  const config = requireProject();
+  const id = await resolveDomainId(config.projectId, idOrHostname);
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/domains/${id}/status`
+  );
+  console.log(`Status: ${data.status}`);
+  console.log(`SSL   : ${data.ssl_status}`);
+}
+async function domainsRemoveCommand(idOrHostname, opts) {
+  const config = requireProject();
+  const id = await resolveDomainId(config.projectId, idOrHostname);
+  await confirmOrDie(`Remove domain "${idOrHostname}"? Traffic to it will stop resolving.`, opts.yes);
+  await apiRequest(`/api/projects/${config.projectId}/domains/${id}`, { method: "DELETE" });
+  console.log("\u2713 Domain removed");
+}
+async function resolveDomainId(projectId, idOrHostname) {
+  const data = await apiRequest(`/api/projects/${projectId}/domains`);
+  const match = data.domains.find((d) => d.id === idOrHostname || d.hostname === idOrHostname.toLowerCase());
+  if (!match) {
+    console.error(`No domain matches "${idOrHostname}". Run: deploro domains list`);
+    process.exit(1);
+  }
+  return match.id;
+}
+
+// src/commands/storage.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename } from "path";
+function authHeaders(config) {
+  return { Authorization: `Bearer ${config.accessToken}` };
+}
+async function throwOnError(res) {
+  if (res.ok) return;
+  const body = await res.json().catch(() => ({ error: res.statusText }));
+  throw new Error(`${res.status} ${body.error ?? res.statusText}`);
+}
+async function storageListCommand() {
+  const config = requireProject();
+  const res = await fetch(`${config.baseUrl}/api/projects/${config.projectId}/storage`, {
+    headers: authHeaders(config)
+  });
+  await throwOnError(res);
+  const data = await res.json();
+  table(
+    data.objects.map((o) => ({
+      key: o.key,
+      size: `${(o.size / 1024).toFixed(1)} KB`,
+      type: o.contentType,
+      uploaded: new Date(o.uploaded).toLocaleString()
+    }))
+  );
+  if (data.truncated) console.log("\n(more objects exist \u2014 pagination isn't wired up here yet, use the dashboard for the full list)");
+}
+async function storageUploadCommand(filePath, opts) {
+  const config = requireProject();
+  const bytes = readFileSync2(filePath);
+  const filename = opts.key ?? basename(filePath);
+  const form = new FormData();
+  form.append("file", new Blob([bytes]), filename);
+  const res = await fetch(`${config.baseUrl}/api/projects/${config.projectId}/storage/upload`, {
+    method: "POST",
+    headers: authHeaders(config),
+    body: form
+  });
+  await throwOnError(res);
+  const data = await res.json();
+  console.log(`\u2713 Uploaded as ${data.key} (${data.size} bytes, ${data.contentType})`);
+}
+async function storageDownloadCommand(key, opts) {
+  const config = requireProject();
+  const res = await fetch(
+    `${config.baseUrl}/api/projects/${config.projectId}/storage/download?key=${encodeURIComponent(key)}`,
+    { headers: authHeaders(config) }
+  );
+  await throwOnError(res);
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  const outPath = opts.out ?? basename(key);
+  writeFileSync2(outPath, bytes);
+  console.log(`\u2713 Saved to ${outPath} (${bytes.length} bytes)`);
+}
+async function storageDeleteCommand(key, opts) {
+  const config = requireProject();
+  await confirmOrDie(`Delete "${key}" from storage?`, opts.yes);
+  const res = await fetch(
+    `${config.baseUrl}/api/projects/${config.projectId}/storage?key=${encodeURIComponent(key)}`,
+    { method: "DELETE", headers: authHeaders(config) }
+  );
+  await throwOnError(res);
+  console.log(`\u2713 Deleted ${key}`);
+}
+
+// src/commands/webhooks.ts
+var KNOWN_EVENTS = [
+  "db.row.insert",
+  "db.row.update",
+  "db.row.delete",
+  "deployment.started",
+  "deployment.success",
+  "deployment.failed",
+  "test"
+];
+async function webhooksListCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/webhooks`);
+  table(
+    data.webhooks.map((w) => ({
+      id: w.id,
+      url: w.url,
+      events: w.events.join(","),
+      enabled: w.enabled,
+      deliveries: w.delivery_count,
+      lastStatus: w.last_status_code ?? "-"
+    }))
+  );
+}
+async function webhooksCreateCommand(url, opts) {
+  const config = requireProject();
+  const events = opts.events ? opts.events.split(",").map((e) => e.trim()).filter(Boolean) : ["test"];
+  const data = await apiRequest(`/api/projects/${config.projectId}/webhooks`, {
+    method: "POST",
+    body: JSON.stringify({ url, events, secret: opts.secret })
+  });
+  console.log(`\u2713 Webhook created: ${data.webhook.id}`);
+  console.log(`  Events: ${data.webhook.events.join(", ")}`);
+  if (!opts.events) {
+    console.log(`  (no --events passed \u2014 defaulted to "test". Known events: ${KNOWN_EVENTS.join(", ")})`);
+  }
+}
+async function webhooksUpdateCommand(id, opts) {
+  const config = requireProject();
+  const body = {};
+  if (opts.url) body.url = opts.url;
+  if (opts.events) body.events = opts.events.split(",").map((e) => e.trim()).filter(Boolean);
+  if (opts.secret) body.secret = opts.secret;
+  if (opts.enable) body.enabled = true;
+  if (opts.disable) body.enabled = false;
+  if (Object.keys(body).length === 0) {
+    console.error("Nothing to update \u2014 pass --url, --events, --secret, --enable, or --disable");
+    process.exit(1);
+  }
+  await apiRequest(`/api/projects/${config.projectId}/webhooks/${id}`, {
+    method: "PATCH",
+    body: JSON.stringify(body)
+  });
+  console.log(`\u2713 Webhook ${id} updated`);
+}
+async function webhooksDeleteCommand(id, opts) {
+  const config = requireProject();
+  await confirmOrDie(`Delete webhook ${id}?`, opts.yes);
+  await apiRequest(`/api/projects/${config.projectId}/webhooks/${id}`, { method: "DELETE" });
+  console.log(`\u2713 Webhook ${id} deleted`);
+}
+async function webhooksTestCommand(id) {
+  const config = requireProject();
+  await apiRequest(`/api/projects/${config.projectId}/webhooks/${id}/test`, { method: "POST" });
+  console.log("\u2713 Test payload dispatched \u2014 check 'deploro webhooks deliveries' for the result.");
+}
+async function webhooksDeliveriesCommand(id) {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/webhooks/${id}/deliveries`
+  );
+  table(
+    data.deliveries.map((d) => ({
+      event: d.event,
+      status: d.status_code ?? "-",
+      ms: d.duration_ms ?? "-",
+      error: d.error ?? "",
+      at: new Date(d.delivered_at).toLocaleString()
+    }))
+  );
+}
+
+// src/commands/team.ts
+async function teamListCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/members`);
+  table(
+    data.members.map((m) => ({
+      id: m.id,
+      name: m.name,
+      email: m.email,
+      role: m.role,
+      joined: new Date(m.joined_at).toLocaleDateString()
+    }))
+  );
+}
+async function teamInviteCommand(email, opts) {
+  const config = requireProject();
+  const role = opts.admin ? "admin" : "member";
+  await apiRequest(`/api/projects/${config.projectId}/members`, {
+    method: "POST",
+    body: JSON.stringify({ email, role })
+  });
+  console.log(`\u2713 Added ${email} to the project as ${role}`);
+  console.log("  (they must already have a Deploro account \u2014 use 'deploro auth invite' first if not)");
+}
+async function teamRemoveCommand(memberId, opts) {
+  const config = requireProject();
+  await confirmOrDie(`Remove member ${memberId} from this project?`, opts.yes);
+  await apiRequest(`/api/projects/${config.projectId}/members/${memberId}`, { method: "DELETE" });
+  console.log(`\u2713 Member ${memberId} removed`);
+}
+
 // src/commands/migrate.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 function readSqlOpt(inline, file, label) {
   if (file) {
     try {
-      return readFileSync2(file, "utf-8");
+      return readFileSync3(file, "utf-8");
     } catch (err) {
       console.error(`Could not read --${label}-file "${file}": ${err instanceof Error ? err.message : String(err)}`);
       process.exit(1);
@@ -716,9 +1083,7 @@ async function migrateDeleteCommand(idOrName, opts) {
 // src/commands/hosting.ts
 async function hostingStatusCommand() {
   requireConfig();
-  const data = await apiRequest(
-    "/api/hosting/status"
-  );
+  const data = await apiRequest("/api/hosting/status");
   console.log("\n\u2500\u2500 WORKER \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   if (data.worker) {
     console.log(`  Script        : ${data.worker.name}`);
@@ -748,6 +1113,10 @@ async function hostingStatusCommand() {
   } else {
     console.log("  (no VPS info)");
   }
+  if (data.untrackedContainers && data.untrackedContainers.length > 0) {
+    console.log("\n  \u26A0 Untracked containers (didn't come from a Deployer-issued deploy):");
+    for (const name of data.untrackedContainers) console.log(`    - ${name}`);
+  }
   console.log("");
 }
 async function hostingSetEnvCommand(key, value) {
@@ -893,7 +1262,7 @@ async function deployCommand() {
 async function deployStatusCommand() {
   const config = requireProject();
   const data = await apiRequest(
-    `/api/projects/${config.projectId}/deployments`
+    `/api/projects/${config.projectId}/deployments/all`
   );
   const latest = data.deployments[0];
   if (!latest) {
@@ -903,6 +1272,7 @@ async function deployStatusCommand() {
   console.log(`
 \u2500\u2500 LATEST DEPLOYMENT \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
   console.log(`  ID      : ${latest.id}`);
+  console.log(`  Target  : ${latest.target ?? "worker"}`);
   console.log(`  Status  : ${latest.status}`);
   console.log(`  Branch  : ${latest.git_branch ?? "(none)"}`);
   console.log(`  Started : ${new Date(latest.created_at).toLocaleString()}`);
@@ -914,7 +1284,7 @@ async function deployLogsCommand(deploymentId) {
   let id = deploymentId;
   if (!id) {
     const list = await apiRequest(
-      `/api/projects/${config.projectId}/deployments`
+      `/api/projects/${config.projectId}/deployments/all`
     );
     id = list.deployments[0]?.id;
     if (!id) {
@@ -928,6 +1298,7 @@ async function deployLogsCommand(deploymentId) {
   const d = data.deployment;
   console.log(`
 \u2500\u2500 DEPLOYMENT ${d.id} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
+  console.log(`  Target : ${d.target ?? "worker"}`);
   console.log(`  Status : ${d.status}`);
   console.log(
     `  Commit : ${d.git_branch ?? "(none)"}${d.git_sha ? ` @ ${String(d.git_sha).slice(0, 7)}` : ""}`
@@ -941,6 +1312,215 @@ async function deployLogsCommand(deploymentId) {
   console.log("");
 }
 
+// src/commands/vps.ts
+async function vpsDatabaseCreateCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/database`, { method: "POST" });
+  if (data.already_provisioned) {
+    console.log("Already provisioned. The connection string is only ever shown once (on creation, or after a rotate).");
+    console.log(`  Host : ${data.host ?? "(unknown \u2014 VPS_PUBLIC_HOST not configured on the platform)"}`);
+    console.log(`  Port : ${data.port}`);
+    console.log(`  User : ${data.user}`);
+    console.log(`  DB   : ${data.database}`);
+    return;
+  }
+  console.log("\u2713 Raw Postgres provisioned:");
+  console.log(`  ${data.database_url}`);
+  console.log(`
+${data.note ?? ""}`);
+}
+async function vpsDatabaseInfoCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/database`
+  );
+  if (!data.provisioned) {
+    console.log("Not provisioned. Run: deploro vps database create");
+    return;
+  }
+  console.log("\n\u2500\u2500 RAW POSTGRES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  Host : ${data.host ?? "(unknown \u2014 VPS_PUBLIC_HOST not configured on the platform)"}`);
+  console.log(`  Port : ${data.port}`);
+  console.log(`  User : ${data.user}`);
+  console.log(`  DB   : ${data.database}`);
+  console.log("  (password not stored in plaintext \u2014 run 'deploro vps database rotate' to issue a new one)\n");
+}
+async function vpsDatabaseRotateCommand(opts) {
+  const config = requireProject();
+  await confirmOrDie("Rotate the raw Postgres password? Anything using the old connection string will stop working until redeployed.", opts.yes);
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/database/rotate`,
+    { method: "POST" }
+  );
+  console.log("\u2713 Password rotated:");
+  console.log(`  ${data.database_url}`);
+  console.log(`
+${data.note}`);
+}
+async function vpsRedisCreateCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/redis`, { method: "POST" });
+  if (data.already_provisioned) {
+    console.log("Already provisioned. The connection string is only ever shown once (on creation, or after a rotate).");
+    console.log(`  Host : ${data.host ?? "(unknown \u2014 VPS_PUBLIC_HOST not configured on the platform)"}`);
+    console.log(`  Port : ${data.port}`);
+    return;
+  }
+  console.log("\u2713 Raw Redis provisioned:");
+  console.log(`  ${data.redis_url}`);
+  console.log(`
+${data.note ?? ""}`);
+}
+async function vpsRedisInfoCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/redis`
+  );
+  if (!data.provisioned) {
+    console.log("Not provisioned. Run: deploro vps redis create");
+    return;
+  }
+  console.log("\n\u2500\u2500 RAW REDIS \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  Host : ${data.host ?? "(unknown \u2014 VPS_PUBLIC_HOST not configured on the platform)"}`);
+  console.log(`  Port : ${data.port}`);
+  console.log("  (password not stored in plaintext \u2014 run 'deploro vps redis rotate' to issue a new one)\n");
+}
+async function vpsRedisRotateCommand(opts) {
+  const config = requireProject();
+  await confirmOrDie("Rotate the raw Redis password? This briefly restarts the Redis container. Anything using the old connection string will stop working until redeployed.", opts.yes);
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/redis/rotate`,
+    { method: "POST" }
+  );
+  console.log("\u2713 Password rotated:");
+  console.log(`  ${data.redis_url}`);
+  console.log(`
+${data.note}`);
+}
+async function vpsAllowlistListCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/allowlist`
+  );
+  if (data.entries.length === 0) {
+    console.log("No allowlist entries \u2014 raw Postgres/Redis ports accept no inbound connections until you add one.");
+    return;
+  }
+  table(data.entries.map((e) => ({ id: e.id, cidr: e.cidr, label: e.label ?? "", added: new Date(e.created_at).toLocaleString() })));
+}
+async function vpsAllowlistAddCommand(cidr, opts) {
+  const config = requireProject();
+  await apiRequest(`/api/projects/${config.projectId}/vps/allowlist`, {
+    method: "POST",
+    body: JSON.stringify({ cidr, label: opts.label })
+  });
+  console.log(`\u2713 Allowed ${cidr}${opts.label ? ` (${opts.label})` : ""} to reach this project's raw Postgres/Redis ports`);
+}
+async function vpsAllowlistRemoveCommand(id, opts) {
+  const config = requireProject();
+  await confirmOrDie(`Remove allowlist entry ${id}?`, opts.yes);
+  await apiRequest(`/api/projects/${config.projectId}/vps/allowlist/${encodeURIComponent(id)}`, { method: "DELETE" });
+  console.log(`\u2713 Allowlist entry ${id} removed`);
+}
+async function vpsEnvCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/env`);
+  if (data.vars.length === 0) {
+    console.log("No VPS env vars set on the active project.");
+    return;
+  }
+  console.log("\nVPS-scoped env vars (written into the compute stack's .env; values are never returned by the API):\n");
+  for (const v of data.vars) console.log(`  ${v.key}`);
+  console.log("");
+}
+async function vpsSetEnvCommand(key, value) {
+  const config = requireProject();
+  await apiRequest(`/api/projects/${config.projectId}/vps/env`, {
+    method: "POST",
+    body: JSON.stringify({ key, value })
+  });
+  console.log(`\u2713 VPS env var '${key}' set \u2014 run 'deploro vps deploy' to apply it`);
+}
+async function vpsDeployCommand() {
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/vps/deploy`,
+    { method: "POST" }
+  );
+  console.log(`\u2713 VPS deploy triggered: ${data.deployment.id}`);
+  console.log("  Run 'deploro vps deployments' to see history, or 'deploro vps logs' once containers are up.");
+}
+async function vpsDeploymentsCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/deployments`);
+  if (data.deployments.length === 0) {
+    console.log("No VPS deployments yet. Run: deploro vps deploy");
+    return;
+  }
+  table(data.deployments.map((d) => ({
+    id: d.id,
+    status: d.status,
+    branch: d.git_branch ?? "",
+    started: new Date(d.created_at).toLocaleString(),
+    finished: d.finished_at ? new Date(d.finished_at).toLocaleString() : "(in progress)"
+  })));
+}
+async function vpsDeployStatusCommand(deploymentId) {
+  const config = requireProject();
+  let id = deploymentId;
+  if (!id) {
+    const list = await apiRequest(`/api/projects/${config.projectId}/vps/deployments`);
+    id = list.deployments[0]?.id;
+    if (!id) {
+      console.log("No VPS deployments yet.");
+      return;
+    }
+  }
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/deployments/${id}`);
+  const d = data.deployment;
+  console.log(`
+\u2500\u2500 VPS DEPLOYMENT ${d.id} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
+  console.log(`  Status : ${d.status}`);
+  console.log(`  Branch : ${d.git_branch ?? "(none)"}`);
+  if (d.agent_error) console.log(`  Agent error: ${d.agent_error}`);
+  console.log(`
+\u2500\u2500 LOGS \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
+  console.log(typeof d.logs === "string" && d.logs.trim().length > 0 ? d.logs : "(no logs)");
+  console.log("");
+}
+async function vpsStatusCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/status`);
+  console.log("\n\u2500\u2500 COMPUTE SERVICES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  if (data.servicesError) {
+    console.log(`  ${data.servicesError}`);
+  } else if (data.services.length === 0) {
+    console.log("  (none deployed \u2014 run: deploro vps deploy)");
+  } else {
+    for (const s of data.services) {
+      const running = (s.State ?? "").toLowerCase().includes("running");
+      console.log(`  ${running ? "\u25CF" : "\u25CB"} ${s.Service ?? "?"}  ${s.Status ?? s.State ?? ""}`);
+    }
+  }
+  console.log("\n\u2500\u2500 RAW POSTGRES \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(data.postgres ? `  ${data.postgres.running ? "\u25CF" : "\u25CB"} ${data.postgres.status}` : "  (not provisioned)");
+  console.log("\n\u2500\u2500 RAW REDIS \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(data.redis ? `  ${data.redis.running ? "\u25CF" : "\u25CB"} ${data.redis.status}` : "  (not provisioned)");
+  console.log("\n\u2500\u2500 WEB \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(
+    data.web_url ? `  ${data.web_url}  (nginx proxy on the VPS, TLS via Let's Encrypt)` : "  (none detected \u2014 compose must publish an HTTP port, then redeploy)"
+  );
+  console.log("");
+}
+async function vpsLogsCommand(service, opts) {
+  const config = requireProject();
+  const tail = Math.min(Math.max(parseInt(opts.tail ?? "200", 10) || 200, 1), 5e3);
+  const qs = new URLSearchParams({ tail: String(tail) });
+  if (service) qs.set("service", service);
+  const data = await apiRequest(`/api/projects/${config.projectId}/vps/logs?${qs.toString()}`);
+  console.log(data.logs.trim().length > 0 ? data.logs : "(no logs)");
+}
+
 // src/index.ts
 var pkg = createRequire(import.meta.url)("../package.json");
 var program = new Command();
@@ -948,7 +1528,7 @@ program.name("deploro").description("Deploro developer platform CLI").version(pk
 program.command("login").description("Log in to Deploro").option("--url <url>", "Worker base URL").option("--token <token>", "Personal access token from the Deploro dashboard").action(loginCommand);
 program.command("logout").description("Log out and clear local credentials").action(logoutCommand);
 program.command("projects").description("List projects").action(projectsListCommand);
-program.command("create <name>").description("Create a new project (and set it active)").option("--slug <slug>", "Project slug (derived from name if omitted)").option("--repo <url>", "GitHub repo URL to link for deployments").option("--branch <branch>", "Git branch to deploy from").action(projectsCreateCommand);
+program.command("create <name>").description("Create a new project (and set it active)").option("--slug <slug>", "Project slug (derived from name if omitted)").option("--repo <url>", "Public repo URL to link for deployments (no embedded tokens/credentials \u2014 for a private repo or auto-deploy on push, use 'deploro github connect' + 'deploro repo link' instead)").option("--branch <branch>", "Git branch to deploy from").action(projectsCreateCommand);
 program.command("use <project>").description("Set the active project (accepts id, slug, or name)").action(useProjectCommand);
 program.command("delete <project>").description("Delete a project and its database (accepts id, slug, or name)").option("-y, --yes", "Skip confirmation prompt").action(projectsDeleteCommand);
 var db = program.command("db").description("Database commands");
@@ -972,6 +1552,8 @@ var auth = program.command("auth").description("Auth management commands");
 auth.command("whoami").description("Show the current identity, and \u2014 for a token login \u2014 exactly what it's scoped to").action(authWhoamiCommand);
 auth.command("users").description("List platform users").action(authUsersCommand);
 auth.command("invite <email>").description("Invite a user by email").option("--admin", "Grant admin role").action(authInviteCommand);
+auth.command("ban <id>").description("Ban a platform user (blocks sign-in immediately, no session revocation needed)").option("--reason <text>", "Ban reason").option("--days <n>", "Expire the ban after n days (omit for indefinite)").option("-y, --yes", "Skip confirmation prompt").action(authBanCommand);
+auth.command("unban <id>").description("Lift a ban").action(authUnbanCommand);
 auth.command("site-url [url]").description("Get or set the active project's Auth Site URL (where end-user confirmation-email links redirect back to)").option("--clear", "Clear the Site URL \u2014 confirmation links fall back to the project's own deployment URL").action(authSiteUrlCommand);
 auth.command("stats").description("Show Auth-as-a-Service stats for the active project's end users").action(authStatsCommand);
 var authProviders = auth.command("providers").description("Manage the active project's end-user sign-in providers");
@@ -996,6 +1578,58 @@ var deploy = program.command("deploy").description("Deployment commands");
 deploy.command("trigger").description("Trigger a manual deployment").action(deployCommand);
 deploy.command("status").description("Show latest deployment status").action(deployStatusCommand);
 deploy.command("logs [deployment-id]").description("Show logs for a deployment (defaults to latest)").action(deployLogsCommand);
+var vps = program.command("vps").description("VPS compute hosting commands (raw Postgres/Redis, custom docker-compose deploys)");
+var vpsDatabase = vps.command("database").description("Raw Postgres (dedicated container, real connection string \u2014 for drizzle-kit, transactions, etc.)");
+vpsDatabase.command("create").description("Provision raw Postgres (idempotent; connection string shown once)").action(vpsDatabaseCreateCommand);
+vpsDatabase.command("info").description("Show raw Postgres connection info (no password)").action(vpsDatabaseInfoCommand);
+vpsDatabase.command("rotate").description("Rotate the raw Postgres password").option("--yes", "Skip confirmation prompt").action(vpsDatabaseRotateCommand);
+var vpsRedis = vps.command("redis").description("Raw Redis (dedicated container \u2014 for BullMQ, ioredis, Lua EVAL scripts)");
+vpsRedis.command("create").description("Provision raw Redis (idempotent; connection string shown once)").action(vpsRedisCreateCommand);
+vpsRedis.command("info").description("Show raw Redis connection info (no password)").action(vpsRedisInfoCommand);
+vpsRedis.command("rotate").description("Rotate the raw Redis password").option("--yes", "Skip confirmation prompt").action(vpsRedisRotateCommand);
+var vpsAllowlist = vps.command("allowlist").description("IP allowlist gating access to raw Postgres/Redis ports");
+vpsAllowlist.command("list").description("List allowlist entries").action(vpsAllowlistListCommand);
+vpsAllowlist.command("add <cidr>").description("Allow an IP or CIDR block (e.g. 203.0.113.4 or 203.0.113.0/24)").option("--label <label>", "Human-readable label").action(vpsAllowlistAddCommand);
+vpsAllowlist.command("remove <id>").description("Remove an allowlist entry").option("--yes", "Skip confirmation prompt").action(vpsAllowlistRemoveCommand);
+vps.command("env").description("List VPS-scoped env var names set on the active project (values are never returned)").action(vpsEnvCommand);
+vps.command("set-env <key> <value>").description("Set a VPS-scoped env var (e.g. JWT_SECRET) \u2014 distinct from 'hosting set-env', which sets Worker secrets").action(vpsSetEnvCommand);
+vps.command("deploy").description("Build and start the active project's docker-compose stack on the VPS").action(vpsDeployCommand);
+vps.command("deployments").description("List VPS deploy history").action(vpsDeploymentsCommand);
+vps.command("deploy-status [deployment-id]").description("Show a VPS deployment's status and logs (defaults to latest)").action(vpsDeployStatusCommand);
+vps.command("status").description("Show running compute services + raw Postgres/Redis container status").action(vpsStatusCommand);
+vps.command("logs [service]").description("Tail logs for a compute service (or 'postgres'/'redis')").option("--tail <n>", "Number of lines", "200").action(vpsLogsCommand);
+var github = program.command("github").description("GitHub account connection (OAuth)");
+github.command("status").description("Show whether your GitHub account is connected").action(githubStatusCommand);
+github.command("connect").description("Print the URL to open in a browser to connect GitHub").action(githubConnectCommand);
+github.command("repos").description("List repos your connected GitHub account can access").action(githubReposCommand);
+github.command("disconnect").description("Remove your stored GitHub OAuth token").option("-y, --yes", "Skip confirmation prompt").action(githubDisconnectCommand);
+var repo = program.command("repo").description("Active project's connected repo (auto-deploy from GitHub)");
+repo.command("status").description("Show the active project's linked repo").action(repoStatusCommand);
+repo.command("link <owner/repo>").description("Link a repo (requires 'deploro github connect' first)").option("--branch <branch>", "Branch to deploy from (default: main)").action(repoLinkCommand);
+repo.command("unlink").description("Unlink the repo and remove its GitHub webhook").option("-y, --yes", "Skip confirmation prompt").action(repoUnlinkCommand);
+repo.command("auto-deploy <on|off>").description("Toggle automatic deployment on push").action(repoAutoDeployCommand);
+var domains = program.command("domains").description("Custom domains for the active project");
+domains.command("list").description("List custom domains").action(domainsListCommand);
+domains.command("add <hostname>").description("Add a domain \u2014 prints the CNAME + TXT records to create").action(domainsAddCommand);
+domains.command("verify <id-or-hostname>").description("Verify DNS ownership and register SSL").action(domainsVerifyCommand);
+domains.command("status <id-or-hostname>").description("Poll domain verification/SSL status").action(domainsStatusCommand);
+domains.command("remove <id-or-hostname>").description("Remove a domain").option("-y, --yes", "Skip confirmation prompt").action(domainsRemoveCommand);
+var storage = program.command("storage").description("R2 file storage for the active project");
+storage.command("list").description("List stored files").action(storageListCommand);
+storage.command("upload <file>").description("Upload a local file").option("--key <name>", "Stored file name (defaults to the local file's name)").action(storageUploadCommand);
+storage.command("download <key>").description("Download a stored file").option("--out <path>", "Local path to save to (defaults to the file's name)").action(storageDownloadCommand);
+storage.command("delete <key>").description("Delete a stored file").option("-y, --yes", "Skip confirmation prompt").action(storageDeleteCommand);
+var webhooks = program.command("webhooks").description("Outbound webhooks for the active project");
+webhooks.command("list").description("List webhooks").action(webhooksListCommand);
+webhooks.command("create <url>").description("Create a webhook").option("--events <list>", "Comma-separated event names (default: test)").option("--secret <secret>", "HMAC signing secret").action(webhooksCreateCommand);
+webhooks.command("update <id>").description("Update a webhook").option("--url <url>").option("--events <list>", "Comma-separated event names").option("--secret <secret>").option("--enable").option("--disable").action(webhooksUpdateCommand);
+webhooks.command("delete <id>").description("Delete a webhook").option("-y, --yes", "Skip confirmation prompt").action(webhooksDeleteCommand);
+webhooks.command("test <id>").description("Fire a test payload").action(webhooksTestCommand);
+webhooks.command("deliveries <id>").description("Show the last 30 delivery attempts").action(webhooksDeliveriesCommand);
+var team = program.command("team").description("Manage the active project's team members");
+team.command("list").description("List project members").action(teamListCommand);
+team.command("invite <email>").description("Add an existing Deploro user to this project").option("--admin", "Grant project admin role").action(teamInviteCommand);
+team.command("remove <member-id>").description("Remove a member from this project").option("-y, --yes", "Skip confirmation prompt").action(teamRemoveCommand);
 program.parseAsync().catch((err) => {
   console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploro",
-  "version": "0.3.4",
+  "version": "0.5.0",
   "description": "Command-line interface for the Deploro developer platform — manage projects, databases, deployments, and hosting from your terminal.",
   "type": "module",
   "bin": {