deploro 0.6.2 → 0.8.0

package/dist/index.js

@@ -230,6 +230,10 @@ Downloading ${keys.length} file(s) to ${opts.storage} \u2026`);
   }
 }
 
+// src/commands/gen.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname3 } from "path";
+
 // src/lib/api.ts
 function errorMessage(status, body, statusText) {
   const parts = [body.error ?? statusText];
@@ -268,6 +272,237 @@ async function apiRequestNoProject(path, options) {
   return res.json();
 }
 
+// src/lib/gen-types.ts
+var STRING_NUMERIC = /* @__PURE__ */ new Set(["int8", "numeric", "money"]);
+var NUMBER = /* @__PURE__ */ new Set(["int2", "int4", "float4", "float8", "oid", "xid", "cid", "regclass", "regproc", "regtype"]);
+var STRING = /* @__PURE__ */ new Set([
+  "text",
+  "varchar",
+  "bpchar",
+  "char",
+  "name",
+  "citext",
+  "uuid",
+  "inet",
+  "cidr",
+  "macaddr",
+  "macaddr8",
+  "date",
+  "time",
+  "timetz",
+  "timestamp",
+  "timestamptz",
+  "interval",
+  "xml",
+  "tsvector",
+  "tsquery",
+  "bit",
+  "varbit",
+  "point",
+  "line",
+  "lseg",
+  "box",
+  "path",
+  "polygon",
+  "circle",
+  "ltree"
+]);
+var DATA_TYPE_TO_UDT = {
+  smallint: "int2",
+  integer: "int4",
+  bigint: "int8",
+  real: "float4",
+  "double precision": "float8",
+  numeric: "numeric",
+  money: "money",
+  boolean: "bool",
+  text: "text",
+  "character varying": "varchar",
+  character: "bpchar",
+  uuid: "uuid",
+  json: "json",
+  jsonb: "jsonb",
+  date: "date",
+  bytea: "bytea",
+  "timestamp without time zone": "timestamp",
+  "timestamp with time zone": "timestamptz",
+  "time without time zone": "time",
+  "time with time zone": "timetz",
+  interval: "interval"
+};
+var IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+function key(name) {
+  return IDENT_RE.test(name) ? name : JSON.stringify(name);
+}
+function literal(value) {
+  return JSON.stringify(value);
+}
+function udtOf(prop) {
+  if (prop["x-pg-type"]) return prop["x-pg-type"];
+  const dataType = prop.description?.replace(/ NOT NULL$/, "");
+  return dataType ? DATA_TYPE_TO_UDT[dataType] ?? null : null;
+}
+function tsType(udt, enums, write, prop) {
+  if (udt?.startsWith("_")) {
+    const inner = tsType(udt.slice(1), enums, write);
+    return /[|\s]/.test(inner) ? `(${inner})[]` : `${inner}[]`;
+  }
+  if (udt && enums[udt]) return `Database["public"]["Enums"][${literal(udt)}]`;
+  if (udt === "bool") return "boolean";
+  if (udt === "json" || udt === "jsonb") return "Json";
+  if (udt && NUMBER.has(udt)) return "number";
+  if (udt && STRING_NUMERIC.has(udt)) return write ? "number | string" : "string";
+  if (udt && STRING.has(udt)) return "string";
+  if (udt === "void") return "undefined";
+  if (prop?.enum?.length) return prop.enum.map(literal).join(" | ");
+  const t = Array.isArray(prop?.type) ? null : prop?.type;
+  if (t === "number" || t === "integer") return "number";
+  if (t === "boolean") return "boolean";
+  if (t === "string") return "string";
+  if (t === "array") return "unknown[]";
+  return "unknown";
+}
+function generateTypes(spec) {
+  const schemas = spec.components?.schemas ?? {};
+  const enums = spec.components?.["x-pg-enums"] ?? {};
+  const tableNames = Object.keys(schemas).sort();
+  let legacySpec = false;
+  const tableBlocks = [];
+  for (const table2 of tableNames) {
+    const schema = schemas[table2];
+    const required = new Set(schema.required ?? []);
+    const row = [];
+    const insert = [];
+    const update = [];
+    for (const [col, prop] of Object.entries(schema.properties ?? {})) {
+      if (!("x-pg-type" in prop)) legacySpec = true;
+      const nullable = prop.nullable === true || !required.has(col);
+      const udt = udtOf(prop);
+      const readType = tsType(udt, enums, false, prop) + (nullable ? " | null" : "");
+      const writeType = tsType(udt, enums, true, prop) + (nullable ? " | null" : "");
+      const neverWritten = prop["x-pg-generated"] === true || prop["x-pg-identity"] === "always";
+      const optionalOnInsert = nullable || prop["x-pg-has-default"] === true;
+      row.push(`          ${key(col)}: ${readType}`);
+      if (neverWritten) {
+        insert.push(`          ${key(col)}?: never`);
+        update.push(`          ${key(col)}?: never`);
+      } else {
+        insert.push(`          ${key(col)}${optionalOnInsert ? "?" : ""}: ${writeType}`);
+        update.push(`          ${key(col)}?: ${writeType}`);
+      }
+    }
+    const body = (lines) => lines.length ? `{
+${lines.join("\n")}
+        }` : "Record<string, never>";
+    tableBlocks.push(
+      `      ${key(table2)}: {
+        Row: ${body(row)}
+        Insert: ${body(insert)}
+        Update: ${body(update)}
+      }`
+    );
+  }
+  const functionBlocks = [];
+  const fnEntries = Object.entries(spec.paths ?? {}).map(([path, ops]) => ({ name: path.match(/\/studio\/rpc\/([^/]+)$/)?.[1], op: ops.post })).filter((f) => !!f.name && !!f.op).filter((f) => !["trigger", "event_trigger"].includes(f.op["x-pg-returns"]?.type ?? "")).sort((a, b) => a.name.localeCompare(b.name));
+  for (const { name, op } of fnEntries) {
+    const props = op.requestBody?.content?.["application/json"]?.schema?.properties ?? {};
+    const args = Object.entries(props).map(([arg, prop]) => {
+      const optional = prop["x-pg-has-default"] === true;
+      return `          ${key(arg)}${optional ? "?" : ""}: ${tsType(udtOf(prop), enums, true, prop)}`;
+    });
+    const ret = op["x-pg-returns"];
+    let returns;
+    if (!ret) {
+      legacySpec = true;
+      returns = "unknown";
+    } else {
+      let single;
+      if (ret.columns?.length) {
+        single = `{
+${ret.columns.map((c) => `            ${key(c.name)}: ${tsType(c.type, enums, false)} | null`).join("\n")}
+          }`;
+      } else if (ret.type && schemas[ret.type]) {
+        single = `Database["public"]["Tables"][${literal(ret.type)}]["Row"]`;
+      } else {
+        single = tsType(ret.type, enums, false);
+      }
+      returns = ret.set ? /[|\s]/.test(single) && !single.startsWith("{") ? `(${single})[]` : `${single}[]` : single;
+    }
+    functionBlocks.push(
+      `      ${key(name)}: {
+        Args: ${args.length ? `{
+${args.join("\n")}
+        }` : "Record<PropertyKey, never>"}
+        Returns: ${returns}
+      }`
+    );
+  }
+  const enumBlocks = Object.keys(enums).sort().map(
+    (name) => `      ${key(name)}: ${enums[name].length ? enums[name].map(literal).join(" | ") : "never"}`
+  );
+  const section = (blocks) => blocks.length ? `{
+${blocks.join("\n")}
+    }` : "{\n      [_ in never]: never\n    }";
+  const source = `// Generated by \`deploro gen types\`. Do not edit by hand; re-run after each migration.
+//
+// bigint, numeric and money columns are strings in Row: Deploro returns them as
+// strings so large values keep their precision. Insert and Update accept either.
+
+export type Json =
+  | string
+  | number
+  | boolean
+  | null
+  | { [key: string]: Json | undefined }
+  | Json[]
+
+export type Database = {
+  public: {
+    Tables: ${section(tableBlocks)}
+    Functions: ${section(functionBlocks)}
+    Enums: ${section(enumBlocks)}
+  }
+}
+
+type PublicSchema = Database["public"]
+
+export type Tables<T extends keyof PublicSchema["Tables"]> = PublicSchema["Tables"][T]["Row"]
+export type TablesInsert<T extends keyof PublicSchema["Tables"]> = PublicSchema["Tables"][T]["Insert"]
+export type TablesUpdate<T extends keyof PublicSchema["Tables"]> = PublicSchema["Tables"][T]["Update"]
+export type Enums<T extends keyof PublicSchema["Enums"]> = PublicSchema["Enums"][T]
+export type FunctionArgs<T extends keyof PublicSchema["Functions"]> = PublicSchema["Functions"][T]["Args"]
+export type FunctionReturns<T extends keyof PublicSchema["Functions"]> = PublicSchema["Functions"][T]["Returns"]
+`;
+  return {
+    source,
+    tables: tableNames.length,
+    functions: fnEntries.length,
+    enums: enumBlocks.length,
+    legacySpec
+  };
+}
+
+// src/commands/gen.ts
+async function genTypesCommand(opts) {
+  const config = requireProject();
+  const spec = await apiRequest(`/api/projects/${config.projectId}/studio/spec`);
+  const result = generateTypes(spec);
+  if (opts.out) {
+    mkdirSync3(dirname3(opts.out) || ".", { recursive: true });
+    writeFileSync3(opts.out, result.source, "utf8");
+    console.error(
+      `Wrote ${opts.out}: ${result.tables} table(s), ${result.functions} function(s), ${result.enums} enum(s)`
+    );
+  } else {
+    process.stdout.write(result.source);
+  }
+  if (result.legacySpec) {
+    console.error(
+      "Warning: this server's spec has no column defaults or function return types, so every NOT NULL column is required in Insert and function Returns are `unknown`. They'll be exact once the server is updated."
+    );
+  }
+}
+
 // src/lib/confirm.ts
 import { createInterface as createInterface2 } from "readline";
 async function confirmOrDie(question, yes) {
@@ -359,9 +594,10 @@ async function dbTablesCommand() {
 }
 async function dbQueryCommand(sql, opts) {
   requireProject();
+  const params = opts.param?.length ? opts.param : void 0;
   const data = await apiRequest(
     "/api/db/query",
-    { method: "POST", body: JSON.stringify({ sql }) }
+    { method: "POST", body: JSON.stringify({ sql, params }) }
   );
   if (opts.json) {
     json(data.rows);
@@ -593,6 +829,23 @@ async function tokenRevokeCommand(id, opts) {
   await apiRequestNoProject(`/api/auth/tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
   console.log(`\u2713 Token ${id} revoked`);
 }
+async function tokenRotateCommand(id, opts) {
+  const config = requireConfig();
+  requireSessionAuth(config);
+  const graceHours = Number(opts.graceHours ?? 0);
+  const body = { graceHours };
+  if (opts.days !== void 0) body.expiresInDays = Number(opts.days);
+  const data = await apiRequestNoProject(
+    `/api/auth/tokens/${encodeURIComponent(id)}/rotate`,
+    { method: "POST", body: JSON.stringify(body) }
+  );
+  console.log("\u2713 Token rotated. Copy the new one now, it will not be shown again:");
+  console.log(`
+  ${data.token}
+`);
+  console.log(`  Expires : in ${data.expiresInDays} days`);
+  console.log(data.oldTokenValidForHours ? `  The old token keeps working for ${data.oldTokenValidForHours} hour(s).` : "  The old token no longer works.");
+}
 function isEmailProvider(provider) {
   return provider === "email" || provider === "email_password";
 }
@@ -886,8 +1139,273 @@ async function resolveDomainId(projectId, idOrHostname) {
   return match.id;
 }
 
+// src/commands/zones.ts
+import { writeFileSync as writeFileSync4 } from "fs";
+function zonesPath() {
+  return `/api/projects/${requireProject().projectId}/zones`;
+}
+async function findZone(name) {
+  const { zones: zones2 } = await apiRequest(zonesPath());
+  const n = name.trim().toLowerCase();
+  const match = zones2.filter((z) => n === z.name || n.endsWith(`.${z.name}`)).sort((a, b) => b.name.length - a.name.length)[0];
+  if (!match) {
+    console.error(`This project has no managed domain matching "${name}". Run: deploro zones list`);
+    process.exit(1);
+  }
+  return match;
+}
+function printNameservers(z) {
+  console.log(`
+At your registrar, replace every nameserver for ${z.name} with:
+`);
+  for (const ns of z.name_servers) console.log(`  ${ns}`);
+  if (z.original_name_servers.length) console.log(`
+(currently: ${z.original_name_servers.join(", ")})`);
+  console.log(`
+Then run: deploro zones check ${z.name}`);
+}
+async function zonesListCommand() {
+  const { zones: zones2 } = await apiRequest(zonesPath());
+  if (!zones2.length) {
+    console.log("This project has no managed domains. Add one with: deploro zones add <domain>");
+    return;
+  }
+  table(zones2.map((z) => ({ domain: z.name, status: z.status, serving: z.hostname_count ?? 0 })));
+}
+async function zonesAddCommand(domain) {
+  const data = await apiRequest(zonesPath(), { method: "POST", body: JSON.stringify({ name: domain }) });
+  console.log(`\u2713 ${data.zone.name} added.
+`);
+  console.log(`Copied ${data.imported_records.length} existing record(s) \u2014 check nothing you use is missing:`);
+  for (const r of data.imported_records) console.log(`  ${r.type.padEnd(6)} ${r.name}  \u2192  ${r.priority ?? ""} ${r.content}`);
+  for (const f of data.import_failed ?? []) console.log(`  \u2717 ${f.record.type} ${f.record.name}: ${f.error}`);
+  console.log("DNS can't list every name a domain has \u2014 add anything else with 'deploro zones records add' before switching.");
+  if (data.legacy_hostnames.length) {
+    console.log(`
+Already connected via CNAME: ${data.legacy_hostnames.join(", ")} \u2014 move them over with 'deploro zones attach' once live.`);
+  }
+  printNameservers(data.zone);
+}
+async function zonesStatusCommand(domain) {
+  const z = await findZone(domain);
+  const { zone } = await apiRequest(`${zonesPath()}/${z.id}`);
+  console.log(`${zone.name}: ${zone.status}`);
+  if (zone.status !== "active") printNameservers(zone);
+}
+async function zonesCheckCommand(domain) {
+  const z = await findZone(domain);
+  const { zone } = await apiRequest(`${zonesPath()}/${z.id}/check`, { method: "POST" });
+  if (zone.status === "active") console.log(`\u2713 ${zone.name} is live on Deploro`);
+  else console.log(`Not switched yet \u2014 nameserver changes can take a few hours. Deploro keeps checking and emails you when it's live.`);
+}
+async function zonesRemoveCommand(domain, opts) {
+  const z = await findZone(domain);
+  await confirmOrDie(
+    `Remove ${z.name}? If its nameservers still point at Deploro, its website AND email stop resolving immediately.`,
+    opts.yes
+  );
+  const data = await apiRequest(`${zonesPath()}/${z.id}`, {
+    method: "DELETE",
+    body: JSON.stringify({ confirm: z.name })
+  });
+  if (data.zone_file) {
+    const file = `${z.name}.zone.txt`;
+    writeFileSync4(file, data.zone_file);
+    console.log(`Saved its records to ${file}`);
+  }
+  console.log(`\u2713 ${z.name} removed`);
+}
+async function zonesRecordsListCommand(domain) {
+  const z = await findZone(domain);
+  const { records } = await apiRequest(`${zonesPath()}/${z.id}/records`);
+  table(
+    records.map((r) => ({
+      id: r.id,
+      type: r.type,
+      name: r.name,
+      content: r.priority !== null && r.type === "MX" ? `${r.priority} ${r.content}` : r.content,
+      proxied: r.proxied ? "yes" : "",
+      managed: r.managed_by ?? ""
+    }))
+  );
+}
+async function zonesRecordsAddCommand(domain, type, name, content, opts) {
+  const z = await findZone(domain);
+  const { record } = await apiRequest(`${zonesPath()}/${z.id}/records`, {
+    method: "POST",
+    body: JSON.stringify({
+      type,
+      name,
+      content,
+      ...opts.ttl ? { ttl: Number(opts.ttl) } : {},
+      ...opts.priority ? { priority: Number(opts.priority) } : {},
+      ...opts.proxied ? { proxied: true } : {}
+    })
+  });
+  console.log(`\u2713 Added ${record.type} ${record.name} \u2192 ${record.content} (id: ${record.id})`);
+}
+async function zonesRecordsRemoveCommand(domain, recordId, opts) {
+  const z = await findZone(domain);
+  await confirmOrDie(`Delete record ${recordId} from ${z.name}?`, opts.yes);
+  await apiRequest(`${zonesPath()}/${z.id}/records/${recordId}`, { method: "DELETE" });
+  console.log("\u2713 Record deleted");
+}
+async function zonesAttachCommand(hostname, opts) {
+  const z = await findZone(hostname);
+  const h = hostname.trim().toLowerCase();
+  try {
+    const data = await apiRequest(
+      `${zonesPath()}/${z.id}/hostnames`,
+      { method: "POST", body: JSON.stringify({ hostname: h, replace: !!opts.replace }) }
+    );
+    if (data.attached) console.log(`\u2713 https://${data.hostname.hostname} now serves this project`);
+    else console.log(`Saved, but not attached yet: ${data.error}`);
+  } catch (err) {
+    const msg = err.message;
+    if (msg.includes("already points somewhere")) {
+      console.error(`${h} already has DNS records or a CNAME connection. Re-run with --replace to point it at this project instead.`);
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+async function zonesDetachCommand(hostname, opts) {
+  const z = await findZone(hostname);
+  const h = hostname.trim().toLowerCase();
+  const { hostnames } = await apiRequest(`${zonesPath()}/${z.id}/hostnames`);
+  const match = hostnames.find((x) => x.hostname === h);
+  if (!match) {
+    console.error(`${h} isn't serving this project.`);
+    process.exit(1);
+  }
+  await confirmOrDie(`Stop serving this project on ${h}? It stops immediately.`, opts.yes);
+  await apiRequest(`${zonesPath()}/${z.id}/hostnames/${match.id}`, { method: "DELETE" });
+  console.log(`\u2713 ${h} detached`);
+}
+var FORWARDING = "cf_routing";
+async function zonesEmailStatusCommand(domain) {
+  const z = await findZone(domain);
+  const s = await apiRequest(`${zonesPath()}/${z.id}/email`);
+  const names = new Map(s.presets.map((p) => [p.kind, p.name]));
+  const active = s.services.map((x) => x.kind === FORWARDING ? "Forwarding" : names.get(x.kind) ?? x.kind);
+  console.log(`Email on ${z.name}: ${active.length ? active.join(", ") : "nothing set up"}`);
+  if (s.forwarding.enabled) {
+    console.log("\nForwarding:");
+    for (const r of s.forwarding.rules) {
+      console.log(`  ${r.address} \u2192 ${r.destination}${r.enabled ? "" : "  (paused until the inbox confirms)"}`);
+    }
+    const ca = s.forwarding.catch_all;
+    console.log(`  everything else \u2192 ${ca?.enabled ? ca.destination : "rejected"}`);
+  }
+  if (s.destinations.length) {
+    console.log("\nInboxes:");
+    for (const d of s.destinations) {
+      const state = d.usable ? "confirmed" : `waiting for them to click the ${d.waiting_for === "deploro" ? "Deploro" : "Cloudflare"} email`;
+      console.log(`  ${d.email}  ${state}`);
+    }
+  }
+  console.log(`
+Providers: ${s.presets.map((p) => p.kind).join(", ")} \u2014 or 'deploro zones email-forwarding on ${z.name}'`);
+}
+async function zonesEmailSetupCommand(domain, provider, opts) {
+  const z = await findZone(domain);
+  const config = {};
+  for (const kv of opts.set ?? []) {
+    const i = kv.indexOf("=");
+    if (i < 1) {
+      console.error(`--set expects key=value, got "${kv}"`);
+      process.exit(1);
+    }
+    config[kv.slice(0, i)] = kv.slice(i + 1);
+  }
+  try {
+    await apiRequest(`${zonesPath()}/${z.id}/email/presets/${provider}`, {
+      method: "POST",
+      body: JSON.stringify({ config, replace: !!opts.replace })
+    });
+    console.log(`\u2713 ${provider} is set up on ${z.name}`);
+  } catch (err) {
+    if (err.message.includes("replaces existing records")) {
+      console.error(
+        `${z.name} already has mail records this would replace \u2014 see 'deploro zones records list ${z.name}'. Re-run with --replace to replace them.`
+      );
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+async function zonesEmailRemoveCommand(domain, provider, opts) {
+  const z = await findZone(domain);
+  await confirmOrDie(`Remove ${provider} from ${z.name}? Its DNS records are deleted and mail stops arriving there.`, opts.yes);
+  await apiRequest(`${zonesPath()}/${z.id}/email/presets/${provider}`, { method: "DELETE" });
+  console.log(`\u2713 ${provider} removed`);
+}
+async function zonesEmailForwardingCommand(mode, domain, opts) {
+  const z = await findZone(domain);
+  if (mode === "on") {
+    try {
+      await apiRequest(`${zonesPath()}/${z.id}/email/forwarding`, {
+        method: "POST",
+        body: JSON.stringify({ replace: !!opts.replace })
+      });
+    } catch (err) {
+      if (err.message.includes("replaces the domain's existing mail servers")) {
+        console.error(`${z.name} already has MX records. Re-run with --replace to replace them with forwarding.`);
+        process.exit(1);
+      }
+      throw err;
+    }
+    console.log(`\u2713 Forwarding is on for ${z.name}. Next: deploro zones forward hello@${z.name} you@gmail.com`);
+  } else if (mode === "off") {
+    await confirmOrDie(`Turn off forwarding for ${z.name}? Mail to it will bounce.`, opts.yes);
+    await apiRequest(`${zonesPath()}/${z.id}/email/forwarding`, { method: "DELETE" });
+    console.log("\u2713 Forwarding is off");
+  } else {
+    console.error("Use: deploro zones email-forwarding on|off <domain>");
+    process.exit(1);
+  }
+}
+async function zonesForwardCommand(address, inbox) {
+  const [local, domain] = address.toLowerCase().split("@");
+  if (!local || !domain) {
+    console.error("The first argument is the address to forward, like hello@yourdomain.com");
+    process.exit(1);
+  }
+  const z = await findZone(domain);
+  const { projectId } = requireProject();
+  const email = inbox.trim().toLowerCase();
+  let s = await apiRequest(`${zonesPath()}/${z.id}/email`);
+  let dest = s.destinations.find((d) => d.email === email);
+  if (!dest) {
+    await apiRequest(`/api/projects/${projectId}/email-destinations`, { method: "POST", body: JSON.stringify({ email }) });
+    s = await apiRequest(`${zonesPath()}/${z.id}/email`);
+    dest = s.destinations.find((d) => d.email === email);
+  }
+  if (!dest?.usable) {
+    console.log(`${email} has been sent a confirmation email. Once they click it, run this command again.`);
+    return;
+  }
+  await apiRequest(`${zonesPath()}/${z.id}/email/rules`, {
+    method: "POST",
+    body: JSON.stringify({ local, destination_id: dest.id })
+  });
+  console.log(`\u2713 ${local}@${z.name} \u2192 ${email}`);
+}
+async function zonesUnforwardCommand(address) {
+  const domain = address.toLowerCase().split("@")[1] ?? "";
+  const z = await findZone(domain);
+  const s = await apiRequest(`${zonesPath()}/${z.id}/email`);
+  const rule = s.forwarding.rules.find((r) => r.address === address.toLowerCase());
+  if (!rule) {
+    console.error(`${address} isn't forwarded.`);
+    process.exit(1);
+  }
+  await apiRequest(`${zonesPath()}/${z.id}/email/rules/${rule.id}`, { method: "DELETE" });
+  console.log(`\u2713 ${address} no longer forwards`);
+}
+
 // src/commands/storage.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync5 } from "fs";
 import { basename } from "path";
 function authHeaders2(config) {
   return { Authorization: `Bearer ${config.accessToken}` };
@@ -930,27 +1448,27 @@ async function storageUploadCommand(filePath, opts) {
   const data = await res.json();
   console.log(`\u2713 Uploaded as ${data.key} (${data.size} bytes, ${data.contentType})`);
 }
-async function storageDownloadCommand(key, opts) {
+async function storageDownloadCommand(key2, opts) {
   const config = requireProject();
   const res = await fetch(
-    `${config.baseUrl}/api/projects/${config.projectId}/storage/download?key=${encodeURIComponent(key)}`,
+    `${config.baseUrl}/api/projects/${config.projectId}/storage/download?key=${encodeURIComponent(key2)}`,
     { headers: authHeaders2(config) }
   );
   await throwOnError2(res);
   const bytes = new Uint8Array(await res.arrayBuffer());
-  const outPath = opts.out ?? basename(key);
-  writeFileSync3(outPath, bytes);
+  const outPath = opts.out ?? basename(key2);
+  writeFileSync5(outPath, bytes);
   console.log(`\u2713 Saved to ${outPath} (${bytes.length} bytes)`);
 }
-async function storageDeleteCommand(key, opts) {
+async function storageDeleteCommand(key2, opts) {
   const config = requireProject();
-  await confirmOrDie(`Delete "${key}" from storage?`, opts.yes);
+  await confirmOrDie(`Delete "${key2}" from storage?`, opts.yes);
   const res = await fetch(
-    `${config.baseUrl}/api/projects/${config.projectId}/storage?key=${encodeURIComponent(key)}`,
+    `${config.baseUrl}/api/projects/${config.projectId}/storage?key=${encodeURIComponent(key2)}`,
     { method: "DELETE", headers: authHeaders2(config) }
   );
   await throwOnError2(res);
-  console.log(`\u2713 Deleted ${key}`);
+  console.log(`\u2713 Deleted ${key2}`);
 }
 async function storagePublicCommand(mode, opts) {
   const config = requireProject();
@@ -1052,13 +1570,13 @@ function parseDuration(input) {
   const mult = { s: 1, m: 60, h: 3600, d: 86400 }[unit] ?? 1;
   return n * mult;
 }
-async function storageSignCommand(key, opts) {
+async function storageSignCommand(key2, opts) {
   const config = requireProject();
   const expiresIn = opts.expires ? parseDuration(opts.expires) : void 0;
   const res = await fetch(`${config.baseUrl}/api/projects/${config.projectId}/storage/signed-url`, {
     method: "POST",
     headers: { ...authHeaders2(config), "Content-Type": "application/json" },
-    body: JSON.stringify({ key, expiresIn })
+    body: JSON.stringify({ key: key2, expiresIn })
   });
   await throwOnError2(res);
   const data = await res.json();
@@ -1315,13 +1833,13 @@ async function hostingStatusCommand() {
   }
   console.log("");
 }
-async function hostingSetEnvCommand(key, value) {
+async function hostingSetEnvCommand(key2, value) {
   requireConfig();
   await apiRequest("/api/hosting/env", {
     method: "POST",
-    body: JSON.stringify({ key, value })
+    body: JSON.stringify({ key: key2, value })
   });
-  console.log(`\u2713 Secret '${key}' updated`);
+  console.log(`\u2713 Secret '${key2}' updated`);
 }
 async function hostingEnvCommand() {
   requireConfig();
@@ -1659,13 +2177,13 @@ async function vpsEnvCommand() {
   for (const v of data.vars) console.log(`  ${v.key}`);
   console.log("");
 }
-async function vpsSetEnvCommand(key, value) {
+async function vpsSetEnvCommand(key2, value) {
   const config = requireProject();
   await apiRequest(`/api/projects/${config.projectId}/vps/env`, {
     method: "POST",
-    body: JSON.stringify({ key, value })
+    body: JSON.stringify({ key: key2, value })
   });
-  console.log(`\u2713 VPS env var '${key}' set \u2014 run 'deploro vps deploy' to apply it`);
+  console.log(`\u2713 VPS env var '${key2}' set \u2014 run 'deploro vps deploy' to apply it`);
 }
 async function vpsDeployCommand() {
   const config = requireProject();
@@ -1803,12 +2321,14 @@ program.command("create <name>").description("Create a new project (and set it a
 program.command("use <project>").description("Set the active project (accepts id, slug, or name)").action(useProjectCommand);
 program.command("delete <project>").description("Delete a project and its database (accepts id, slug, or name)").option("-y, --yes", "Skip confirmation prompt").action(projectsDeleteCommand);
 program.command("export").description("Export the active project's database and storage manifest (NDJSON)").option("--out <file>", "Where to write the export (default: deploro-export-<date>.ndjson)").option("--storage <dir>", "Also download stored files into this directory").option("--skip-storage", "Skip the object-storage listing entirely").action(exportCommand);
+var gen = program.command("gen").description("Generate code from the active project");
+gen.command("types").description("TypeScript types for the project's tables, functions and enums (prints to stdout)").option("--out <file>", "Write to this file instead of stdout").action(genTypesCommand);
 var db = program.command("db").description("Database commands");
 db.command("create").description("Provision the active project's database (idempotent)").action(dbCreateCommand);
 db.command("info").description("Show database status and how to reach it from a deployed app").action(dbInfoCommand);
 db.command("tables").description("List tables in the active project").action(dbTablesCommand);
 db.command("rows <table>").description("List rows in a table").option("--limit <n>", "Rows per page (max 200)", "20").option("--page <n>", "Page number", "1").option("--json", "Output raw JSON").action(dbRowsCommand);
-db.command("query <sql>").description("Run a SQL query (project admin)").option("--json", "Output raw JSON").action(dbQueryCommand);
+db.command("query <sql>").description("Run a read-only SQL query (project admin)").option("--param <value>", "Bind a value to $1, $2, ... in order (repeatable)", (v, prev) => [...prev, v], []).option("--json", "Output raw JSON").action(dbQueryCommand);
 db.command("schema <table>").description("Show schema for a table").action(dbSchemaCommand);
 db.command("insert <table>").description("Insert a row").requiredOption("--data <json>", "Row data as a JSON object").action(dbInsertCommand);
 db.command("update <table> <id>").description("Update a row by id").requiredOption("--data <json>", "Fields to update as a JSON object").action(dbUpdateCommand);
@@ -1840,6 +2360,7 @@ authEndUsers.command("delete <id>").description("Delete an end user and all thei
 var token = program.command("token").description("Personal access token commands");
 token.command("list").description("List your personal access tokens").action(tokenListCommand);
 token.command("create <name>").description("Create a new project-scoped personal access token").option("--read", "Grant read scope").option("--write", "Grant write scope").option("--project <slugs>", "Comma-separated project slugs/ids/names (defaults to the active project)").option("--days <n>", "Expiry in days (1-365)", "90").action(tokenCreateCommand);
+token.command("rotate <id>").description("Replace a token with a new one (same name, scopes and projects)").option("--grace-hours <n>", "Keep the old token working for this many hours (0-72)", "0").option("--days <n>", "Expiry of the new token in days (1-365, default: the old token's lifetime)").action(tokenRotateCommand);
 token.command("revoke <id>").description("Revoke a personal access token").option("--yes", "Skip confirmation prompt").action(tokenRevokeCommand);
 var hosting = program.command("hosting").description("Hosting commands");
 hosting.command("status").description("Show Worker and VPS health").action(hostingStatusCommand);
@@ -1889,6 +2410,24 @@ domains.command("add <hostname>").description("Add a domain \u2014 prints the CN
 domains.command("verify <id-or-hostname>").description("Verify DNS ownership and register SSL").action(domainsVerifyCommand);
 domains.command("status <id-or-hostname>").description("Poll domain verification/SSL status").action(domainsStatusCommand);
 domains.command("remove <id-or-hostname>").description("Remove a domain").option("-y, --yes", "Skip confirmation prompt").action(domainsRemoveCommand);
+var zones = program.command("zones").description("The active project's domains whose DNS Deploro manages (switch nameservers once, then manage everything)");
+zones.command("list").description("List the project's managed domains").action(zonesListCommand);
+zones.command("add <domain>").description("Add a domain \u2014 copies its current records and prints the nameservers to switch to").action(zonesAddCommand);
+zones.command("status <domain>").description("Show whether the nameserver switch has taken effect").action(zonesStatusCommand);
+zones.command("check <domain>").description("Ask Deploro to re-check the nameservers now").action(zonesCheckCommand);
+zones.command("remove <domain>").description("Remove a domain (saves its records to a zone file first)").option("-y, --yes", "Skip confirmation prompt").action(zonesRemoveCommand);
+var zoneRecords = zones.command("records").description("DNS records of a managed domain");
+zoneRecords.command("list <domain>").description("List records").action(zonesRecordsListCommand);
+zoneRecords.command("add <domain> <type> <name> <content>").description("Add a record (name: @ for the root, or e.g. www)").option("--ttl <seconds>", "TTL (default auto)").option("--priority <n>", "MX priority (default 10)").option("--proxied", "Proxy through Cloudflare (A/AAAA/CNAME only)").action(zonesRecordsAddCommand);
+zoneRecords.command("rm <domain> <record-id>").description("Delete a record").option("-y, --yes", "Skip confirmation prompt").action(zonesRecordsRemoveCommand);
+zones.command("attach <hostname>").description("Serve the active project on a managed domain or subdomain").option("--replace", "Replace records or a CNAME connection already at that hostname").action(zonesAttachCommand);
+zones.command("detach <hostname>").description("Stop serving the active project on that hostname").option("-y, --yes", "Skip confirmation prompt").action(zonesDetachCommand);
+zones.command("email <domain>").description("Show email setup: providers, forwarding, inboxes").action(zonesEmailStatusCommand);
+zones.command("email-setup <domain> <provider>").description("Set up google_workspace | microsoft_365 | zoho | fastmail | resend").option("--set <key=value...>", "Provider values, e.g. --set region=eu dkim_selector=zmail").option("--replace", "Replace existing mail records").action(zonesEmailSetupCommand);
+zones.command("email-remove <domain> <provider>").description("Remove a provider and its records").option("-y, --yes", "Skip confirmation prompt").action(zonesEmailRemoveCommand);
+zones.command("email-forwarding <mode> <domain>").description("Turn free email forwarding on or off (mode: on|off)").option("--replace", "Replace existing MX records").option("-y, --yes", "Skip confirmation prompt").action(zonesEmailForwardingCommand);
+zones.command("forward <address> <inbox>").description("Forward e.g. hello@yourdomain.com to you@gmail.com (the inbox confirms once)").action(zonesForwardCommand);
+zones.command("unforward <address>").description("Stop forwarding an address").action(zonesUnforwardCommand);
 var storage = program.command("storage").description("R2 file storage for the active project");
 storage.command("list").description("List stored files").action(storageListCommand);
 storage.command("upload <file>").description("Upload a local file").option("--key <name>", "Stored file name (defaults to the local file's name)").option("--bucket <name>", "Upload into an existing bucket instead of the project root").action(storageUploadCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploro",
-  "version": "0.6.2",
+  "version": "0.8.0",
   "description": "Command-line interface for the Deploro developer platform — manage projects, databases, deployments, and hosting from your terminal.",
   "type": "module",
   "bin": {