gzero-cli 0.1.0-preview.1

package/README.md

@@ -0,0 +1,114 @@
+# gzero-cli
+
+The GroundZero command line: deploy UIs and APIs, manage env vars, domains, and
+billing from your terminal or an AI agent. Built on [`@gzero/sdk`](../sdk).
+
+## Install
+
+Requires Node.js 20+.
+
+```bash
+npm install -g gzero-cli
+# or run without installing
+npx gzero-cli --help
+```
+
+Works on Linux, macOS, and Windows.
+
+## Sign in
+
+```bash
+gzero login
+```
+
+This runs a device-code login (OAuth 2.0 device authorization):
+
+1. The CLI prints a short code and opens your browser to `/activate`.
+2. Sign in with GitHub (if you aren't already) and confirm the code.
+3. The CLI receives a long-lived API token and saves it locally.
+
+The token is minted only after you approve in the browser, and it is never shown
+in the browser itself.
+
+### Where the token is stored
+
+| OS | Path |
+|----|------|
+| Linux | `$XDG_CONFIG_HOME/gzero/config.json` or `~/.config/gzero/config.json` |
+| macOS | `~/.config/gzero/config.json` |
+| Windows | `%APPDATA%\gzero\config.json` (e.g. `C:\Users\you\AppData\Roaming\gzero\config.json`) |
+
+`gzero login` prints the exact path after saving. The file is written with
+`0600` permissions on Unix.
+
+## Commands
+
+```
+gzero login                     Device-code sign in; saves an API token
+gzero logout                    Revoke the current token and clear local config
+gzero whoami                    Show the signed-in account
+gzero projects (alias: ls)      List your projects
+gzero deploy [project]          Trigger a deploy and follow it to completion
+gzero status [project]          Active deploy, readiness, and env status
+gzero logs [project]            Print the latest deploy's build log
+gzero env list [project]        List env var keys
+gzero env set <project> <k> <v> Set an env var
+gzero domains add <project> <host>  Attach a custom domain
+gzero billing                   Show plan, usage, and available add-ons
+gzero billing upgrade           Open Stripe checkout (subscribe)
+gzero billing addon <id>        Open Stripe checkout for an add-on
+gzero billing portal            Open the Stripe billing portal
+gzero mcp                       Print config to connect an AI agent to the hosted MCP
+```
+
+`[project]` accepts a project id, slug, or name. If omitted, the CLI uses your
+only project or prompts you to pick one.
+
+Payments open a Stripe-hosted URL in your browser; card details are never handled
+by the CLI.
+
+## Configuration
+
+Precedence: command-line flags, then environment variables, then the saved config.
+
+| Setting | Flag | Env var |
+|---------|------|---------|
+| API base URL | `--api-url <url>` | `GZERO_API_URL` |
+| API token | `--token <token>` | `GZERO_TOKEN` |
+
+The default API URL is `https://api.gzer0.app`. For local development against a
+dev server, point it at your local API:
+
+```bash
+GZERO_API_URL=http://localhost:3000 gzero login
+```
+
+`GZERO_TOKEN` is handy for CI and other headless callers.
+
+## Connect an AI agent (MCP)
+
+The MCP server is hosted by GroundZero, so there is nothing extra to install.
+Run:
+
+```bash
+gzero mcp
+```
+
+It prints a ready-to-paste client config pointing at `https://mcp.gzer0.app/mcp`.
+Add it to your AI client (for example Cursor's `~/.cursor/mcp.json`); on first
+use the client opens a browser to sign in with GitHub. See [`@gzero/mcp`](../mcp)
+for details.
+
+## Examples
+
+```bash
+# Deploy a specific branch to production and wait for it to go live
+gzero deploy my-app --branch main --env production
+
+# Set an env var, then redeploy
+gzero env set my-app DATABASE_URL "postgres://..."
+gzero deploy my-app
+
+# Attach a custom domain
+gzero domains add my-app app.example.com
+```

package/dist/index.js

@@ -0,0 +1,601 @@
+#!/usr/bin/env node
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../sdk/dist/index.js
+var require_dist = __commonJS({
+  "../sdk/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.GzeroApiError = exports.DEFAULT_BASE_URL = void 0;
+    exports.createClient = createClient2;
+    exports.DEFAULT_BASE_URL = "https://api.gzer0.app";
+    var GzeroApiError2 = class extends Error {
+      status;
+      code;
+      constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "GzeroApiError";
+      }
+    };
+    exports.GzeroApiError = GzeroApiError2;
+    function normalizeBaseUrl(raw) {
+      const value = (raw ?? exports.DEFAULT_BASE_URL).trim().replace(/\/+$/, "");
+      return value.endsWith("/api") ? value.slice(0, -"/api".length) : value;
+    }
+    function createClient2(options = {}) {
+      const baseUrl = normalizeBaseUrl(options.baseUrl);
+      const doFetch = options.fetch ?? globalThis.fetch;
+      let token = options.token;
+      if (!doFetch) {
+        throw new Error("No fetch implementation available; pass options.fetch on Node < 18.");
+      }
+      async function request(path, init) {
+        const headers = {
+          "Content-Type": "application/json",
+          ...init?.headers
+        };
+        if (token)
+          headers.Authorization = `Bearer ${token}`;
+        const res = await doFetch(`${baseUrl}/api${path}`, { ...init, headers });
+        if (!res.ok) {
+          const body = await res.json().catch(() => ({}));
+          const detail = body.blockers?.map((b) => b.message).join("; ");
+          throw new GzeroApiError2(detail ?? body.error ?? `API ${res.status}: ${path}`, res.status, body.error);
+        }
+        if (res.status === 204)
+          return void 0;
+        return await res.json();
+      }
+      return {
+        /** Set/replace the bearer token used for subsequent requests. */
+        setToken(next) {
+          token = next;
+        },
+        get baseUrl() {
+          return baseUrl;
+        },
+        // --- Device-code login (RFC 8628) ---
+        device: {
+          /**
+           * Begin a device-code login. `client` tags the minted token (cli/mcp/
+           * expressots) so it's identifiable in the operator console.
+           */
+          start: (client2) => request("/auth/device/start", {
+            method: "POST",
+            body: JSON.stringify(client2 ? { client: client2 } : {})
+          }),
+          /** One poll attempt. Resolves the RFC state; never throws on pending/slow_down. */
+          async poll(deviceCode) {
+            const res = await doFetch(`${baseUrl}/api/auth/device/token`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ deviceCode })
+            });
+            const body = await res.json().catch(() => ({}));
+            if (res.ok && body.access_token) {
+              return {
+                status: "success",
+                accessToken: body.access_token,
+                tokenType: body.token_type ?? "Bearer"
+              };
+            }
+            return { status: body.error ?? "invalid_request" };
+          },
+          revoke: () => request("/auth/device/revoke", { method: "POST" })
+        },
+        // --- Identity ---
+        me: () => request("/auth/me"),
+        // --- Repos ---
+        listRepos: (opts) => request(`/github/repos${opts?.refresh ? "?refresh=true" : ""}`),
+        // --- Scanner ---
+        scanRepo: (input) => request("/scanner/scan", {
+          method: "POST",
+          body: JSON.stringify(input)
+        }),
+        // --- Products ---
+        listProducts: () => request("/products?include=services"),
+        getProduct: (productId) => request(`/products/${productId}`),
+        createProduct: (name, description) => request("/products", {
+          method: "POST",
+          body: JSON.stringify({ name, description })
+        }),
+        // --- Projects ---
+        listProjects: () => request("/projects"),
+        getProjectStatus: (projectId) => request(`/projects/${projectId}/status`),
+        getReadiness: (projectId) => request(`/projects/${projectId}/readiness`),
+        listBranches: (projectId) => request(`/projects/${projectId}/branches`),
+        createProject: (input) => request("/projects", {
+          method: "POST",
+          body: JSON.stringify(input)
+        }),
+        deploy: (projectId, opts = {}) => request(`/projects/${projectId}/deploy`, {
+          method: "POST",
+          body: JSON.stringify({
+            acknowledgeWarnings: opts.acknowledgeWarnings ?? false,
+            branch: opts.branch,
+            environment: opts.environment
+          })
+        }),
+        listDeploys: (projectId) => request(`/projects/${projectId}/deploys`),
+        getDeploy: (deployId) => request(`/deploys/${deployId}`),
+        rollback: (projectId, deployId) => request(`/projects/${projectId}/rollback`, {
+          method: "POST",
+          body: JSON.stringify({ deployId })
+        }),
+        promote: (projectId, deployId) => request(`/projects/${projectId}/promote`, {
+          method: "POST",
+          body: JSON.stringify({ deployId })
+        }),
+        // --- Env vars ---
+        listEnvVars: (projectId) => request(`/projects/${projectId}/env-vars`),
+        upsertEnvVar: (projectId, key, value) => request(`/projects/${projectId}/env-vars`, {
+          method: "PUT",
+          body: JSON.stringify({ key, value })
+        }),
+        bulkUpsertEnvVars: (projectId, entries) => request(`/projects/${projectId}/env-vars/bulk`, {
+          method: "PUT",
+          body: JSON.stringify({ entries })
+        }),
+        deleteEnvVar: (projectId, key) => request(`/projects/${projectId}/env-vars/${encodeURIComponent(key)}`, {
+          method: "DELETE"
+        }),
+        // --- Domains ---
+        listDomains: (projectId) => request(`/projects/${projectId}/domains`),
+        addDomain: (projectId, hostname) => request(`/projects/${projectId}/domains`, {
+          method: "POST",
+          body: JSON.stringify({ hostname })
+        }),
+        verifyDomain: (projectId, domainId) => request(`/projects/${projectId}/domains/${domainId}/verify`, {
+          method: "POST"
+        }),
+        removeDomain: (projectId, domainId) => request(`/projects/${projectId}/domains/${domainId}`, { method: "DELETE" }),
+        // --- Billing ---
+        getBillingStatus: () => request("/billing/status"),
+        createCheckout: () => request("/billing/checkout", { method: "POST" }),
+        createAddonCheckout: (addonId, productId) => request("/billing/addons/checkout", {
+          method: "POST",
+          body: JSON.stringify({ addonId, productId })
+        }),
+        createBillingPortal: () => request("/billing/portal", { method: "POST" }),
+        listInvoices: () => request("/billing/invoices")
+      };
+    }
+  }
+});
+
+// src/index.ts
+var import_sdk = __toESM(require_dist(), 1);
+import { spawn } from "child_process";
+import { Command } from "commander";
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+
+// src/config.ts
+import { homedir } from "os";
+import { join } from "path";
+import { mkdir, readFile, rm, writeFile } from "fs/promises";
+function configDir() {
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA?.trim();
+    if (appData) return join(appData, "gzero");
+  }
+  const base = process.env.XDG_CONFIG_HOME?.trim() || join(homedir(), ".config");
+  return join(base, "gzero");
+}
+function configPath() {
+  return join(configDir(), "config.json");
+}
+async function loadConfig() {
+  try {
+    const raw = await readFile(configPath(), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function saveConfig(config) {
+  await mkdir(configDir(), { recursive: true, mode: 448 });
+  await writeFile(configPath(), `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+}
+async function clearConfig() {
+  try {
+    await rm(configPath());
+  } catch {
+  }
+}
+async function resolveSettings(flags2) {
+  const file = await loadConfig();
+  return {
+    baseUrl: flags2.apiUrl ?? process.env.GZERO_API_URL ?? file.baseUrl,
+    token: flags2.token ?? process.env.GZERO_TOKEN ?? file.token,
+    fromFile: file
+  };
+}
+
+// src/index.ts
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
+}
+function die(message) {
+  p.cancel(message);
+  process.exit(1);
+}
+async function client(flags2, requireAuth = true) {
+  const settings = await resolveSettings(flags2);
+  if (requireAuth && !settings.token) {
+    die("Not signed in. Run `gzero login` first.");
+  }
+  return (0, import_sdk.createClient)({ baseUrl: settings.baseUrl, token: settings.token });
+}
+function fail(err) {
+  if (err instanceof import_sdk.GzeroApiError) die(err.message);
+  die(err instanceof Error ? err.message : String(err));
+}
+async function resolveProject(c, ref) {
+  let projects;
+  try {
+    projects = await c.listProjects();
+  } catch (err) {
+    fail(err);
+  }
+  if (projects.length === 0) die("No projects yet. Create one in the dashboard, then deploy.");
+  if (ref) {
+    const match = projects.find(
+      (proj) => proj.id === ref || proj.slug === ref || proj.name === ref
+    );
+    if (!match) die(`No project matching "${ref}".`);
+    return match;
+  }
+  if (projects.length === 1) return projects[0];
+  const picked = await p.select({
+    message: "Select a project",
+    options: projects.map((proj) => ({
+      value: proj.id,
+      label: `${proj.name} ${pc.dim(`(${proj.slug})`)}`
+    }))
+  });
+  if (p.isCancel(picked)) die("Cancelled.");
+  return projects.find((proj) => proj.id === picked);
+}
+var program = new Command();
+program.name("gzero").description("GroundZero: deploy UIs and APIs from the terminal or an AI agent.").version("0.1.0-preview.1").option("--api-url <url>", "API base URL (default: config or GZERO_API_URL)").option("--token <token>", "API token (default: config or GZERO_TOKEN)");
+function flags(command) {
+  return command.optsWithGlobals();
+}
+program.command("login").description("Sign in via the browser (device-code flow) and save an API token.").action(async (_opts, command) => {
+  const gf = flags(command);
+  p.intro(pc.bgCyan(pc.black(" GroundZero login ")));
+  const settings = await resolveSettings(gf);
+  const baseUrl = settings.baseUrl ?? import_sdk.DEFAULT_BASE_URL;
+  const c = (0, import_sdk.createClient)({ baseUrl });
+  const s = p.spinner();
+  s.start("Requesting device code");
+  let start;
+  try {
+    start = await c.device.start("cli");
+  } catch (err) {
+    s.stop("Failed to start login");
+    fail(err);
+  }
+  s.stop("Device code ready");
+  p.note(
+    `${pc.bold("Your code:")} ${pc.cyan(start.user_code)}
+
+Open this URL to authorize:
+${pc.underline(start.verification_uri_complete)}`,
+    "Authorize this device"
+  );
+  openBrowser(start.verification_uri_complete);
+  const waiting = p.spinner();
+  waiting.start("Waiting for authorization in the browser");
+  const deadline = Date.now() + start.expires_in * 1e3;
+  let intervalMs = Math.max(start.interval, 1) * 1e3;
+  let token = null;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, intervalMs));
+    const poll = await c.device.poll(start.device_code);
+    if (poll.status === "success") {
+      token = poll.accessToken;
+      break;
+    }
+    if (poll.status === "slow_down") {
+      intervalMs += 2e3;
+      continue;
+    }
+    if (poll.status === "authorization_pending") continue;
+    waiting.stop("Authorization failed");
+    die(
+      poll.status === "expired_token" ? "The code expired. Run `gzero login` again." : "Authorization was denied."
+    );
+  }
+  if (!token) {
+    waiting.stop("Timed out");
+    die("Login timed out. Run `gzero login` again.");
+  }
+  waiting.stop("Authorized");
+  await saveConfig({ baseUrl, token });
+  c.setToken(token);
+  p.note(pc.dim(configPath()), "Credentials saved to");
+  try {
+    const me = await c.me();
+    p.outro(`Signed in as ${pc.green(me.githubLogin ?? me.name ?? "your account")}.`);
+  } catch {
+    p.outro("Signed in.");
+  }
+});
+program.command("logout").description("Revoke the current token and remove local credentials.").action(async (_opts, command) => {
+  const gf = flags(command);
+  const settings = await resolveSettings(gf);
+  if (settings.token) {
+    const c = (0, import_sdk.createClient)({ baseUrl: settings.baseUrl, token: settings.token });
+    try {
+      await c.device.revoke();
+    } catch {
+    }
+  }
+  await clearConfig();
+  p.outro("Signed out.");
+});
+program.command("whoami").description("Show the signed-in account.").action(async (_opts, command) => {
+  const c = await client(flags(command));
+  try {
+    const me = await c.me();
+    console.log(`${pc.bold(me.githubLogin ?? me.name ?? me.id)}  ${pc.dim(me.email ?? "")}`);
+    console.log(pc.dim(`plan: ${me.plan}${me.isAdmin ? " (admin)" : ""}`));
+  } catch (err) {
+    fail(err);
+  }
+});
+program.command("projects").alias("ls").description("List your projects.").action(async (_opts, command) => {
+  const c = await client(flags(command));
+  try {
+    const projects = await c.listProjects();
+    if (projects.length === 0) {
+      console.log(pc.dim("No projects yet."));
+      return;
+    }
+    for (const proj of projects) {
+      const status = proj.activeDeployStatus ?? "-";
+      const url = proj.activeDeployUrl ?? "";
+      console.log(
+        `${pc.bold(proj.name)} ${pc.dim(`(${proj.slug})`)}  ${statusColor(status)}  ${pc.cyan(url)}`
+      );
+    }
+  } catch (err) {
+    fail(err);
+  }
+});
+function statusColor(status) {
+  if (status === "live") return pc.green(status);
+  if (status === "failed") return pc.red(status);
+  if (status === "building" || status === "deploying" || status === "pending")
+    return pc.yellow(status);
+  return pc.dim(status);
+}
+program.command("deploy").argument("[project]", "project id, slug, or name").option("-b, --branch <branch>", "branch to deploy").option("-e, --env <environment>", "environment (production or preview)").option("-y, --yes", "acknowledge readiness warnings and deploy anyway").option("--no-follow", "return immediately instead of streaming status").description("Trigger a deploy and follow it to completion.").action(async (projectRef, opts, command) => {
+  const c = await client(flags(command));
+  const project = await resolveProject(c, projectRef);
+  const s = p.spinner();
+  s.start(`Deploying ${project.name}`);
+  let deploy;
+  try {
+    deploy = await c.deploy(project.id, {
+      acknowledgeWarnings: Boolean(opts.yes),
+      branch: opts.branch,
+      environment: opts.env
+    });
+  } catch (err) {
+    s.stop("Deploy failed to start");
+    if (err instanceof import_sdk.GzeroApiError) {
+      die(`${err.message}
+${pc.dim("Re-run with --yes to acknowledge warnings.")}`);
+    }
+    fail(err);
+  }
+  if (opts.follow === false) {
+    s.stop(`Deploy queued (${deploy.id}).`);
+    return;
+  }
+  const terminal = /* @__PURE__ */ new Set(["live", "failed", "rolled_back"]);
+  const deadline = Date.now() + 15 * 60 * 1e3;
+  let current = deploy;
+  while (!terminal.has(current.status) && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 3e3));
+    try {
+      current = await c.getDeploy(deploy.id);
+    } catch {
+    }
+    s.message(`${project.name}: ${current.phase ?? current.status}`);
+  }
+  if (current.status === "live") {
+    s.stop(pc.green(`Live: ${current.url ?? project.slug}`));
+  } else if (current.status === "failed") {
+    s.stop(pc.red("Deploy failed"));
+    if (current.buildLog) console.log(pc.dim(current.buildLog.slice(-2e3)));
+    process.exit(1);
+  } else {
+    s.stop(`Deploy status: ${current.status}`);
+  }
+});
+program.command("status").argument("[project]", "project id, slug, or name").description("Show the active deploy and readiness for a project.").action(async (projectRef, _opts, command) => {
+  const c = await client(flags(command));
+  const project = await resolveProject(c, projectRef);
+  try {
+    const status = await c.getProjectStatus(project.id);
+    const active = status.activeDeploy;
+    console.log(pc.bold(project.name) + pc.dim(` (${project.slug})`));
+    console.log(`  status:   ${active ? statusColor(active.status) : pc.dim("no deploys")}`);
+    if (active?.url) console.log(`  url:      ${pc.cyan(active.url)}`);
+    console.log(`  env vars: ${status.envConfigured ? pc.green("configured") : pc.yellow("missing")}`);
+    console.log(`  ready:    ${status.readiness.canDeploy ? pc.green("yes") : pc.red("no")}`);
+  } catch (err) {
+    fail(err);
+  }
+});
+program.command("logs").argument("[project]", "project id, slug, or name").description("Print the build log of the latest deploy.").action(async (projectRef, _opts, command) => {
+  const c = await client(flags(command));
+  const project = await resolveProject(c, projectRef);
+  try {
+    const deploys = await c.listDeploys(project.id);
+    const latest = deploys[0];
+    if (!latest) die("No deploys yet.");
+    const full = await c.getDeploy(latest.id);
+    console.log(pc.dim(`# ${project.name} deploy ${full.id} (${full.status})`));
+    console.log(full.buildLog ?? pc.dim("(no build log)"));
+  } catch (err) {
+    fail(err);
+  }
+});
+var env = program.command("env").description("Manage project environment variables.");
+env.command("list").argument("[project]", "project id, slug, or name").description("List env var keys for a project.").action(async (projectRef, _opts, command) => {
+  const c = await client(flags(command));
+  const project = await resolveProject(c, projectRef);
+  try {
+    const vars = await c.listEnvVars(project.id);
+    if (vars.length === 0) {
+      console.log(pc.dim("No env vars set."));
+      return;
+    }
+    for (const v of vars) {
+      console.log(`${v.key} ${v.configured ? pc.green("set") : pc.yellow("empty")}`);
+    }
+  } catch (err) {
+    fail(err);
+  }
+});
+env.command("set").argument("<project>", "project id, slug, or name").argument("<key>", "variable name").argument("<value>", "variable value").description("Set (or update) an environment variable.").action(async (projectRef, key, value, _opts, command) => {
+  const c = await client(flags(command));
+  const project = await resolveProject(c, projectRef);
+  try {
+    await c.upsertEnvVar(project.id, key, value);
+    p.outro(`Set ${pc.bold(key)} on ${project.name}.`);
+  } catch (err) {
+    fail(err);
+  }
+});
+var domains = program.command("domains").description("Manage custom domains.");
+domains.command("add").argument("<project>", "project id, slug, or name").argument("<hostname>", "custom domain, e.g. app.example.com").description("Attach a custom domain to a project.").action(async (projectRef, hostname, _opts, command) => {
+  const c = await client(flags(command));
+  const project = await resolveProject(c, projectRef);
+  try {
+    const domain = await c.addDomain(project.id, hostname);
+    p.outro(
+      `Added ${pc.bold(hostname)}. Point a CNAME to ${pc.cyan(domain.cnameTarget)}, then verify in the dashboard.`
+    );
+  } catch (err) {
+    fail(err);
+  }
+});
+var billing = program.command("billing").description("View plan and start payments.");
+billing.command("status", { isDefault: true }).description("Show current plan, usage, and available add-ons.").action(async (_opts, command) => {
+  const c = await client(flags(command));
+  try {
+    const status = await c.getBillingStatus();
+    console.log(`${pc.bold("Plan:")} ${status.planDisplayName} ${pc.dim(`(${status.subscriptionStatus})`)}`);
+    console.log(`${pc.bold("Stacks:")} ${status.limits.stacksLabel}`);
+    console.log(`${pc.bold("Traffic:")} ${status.limits.trafficLabel}`);
+    if (status.availableAddons.length > 0) {
+      console.log(pc.bold("\nAvailable add-ons:"));
+      for (const a of status.availableAddons) {
+        console.log(
+          `  ${pc.cyan(a.id)}  ${a.displayName}  ${pc.dim(`$${(a.priceCents / 100).toFixed(2)}/mo`)}`
+        );
+      }
+      console.log(pc.dim("\nRun `gzero billing addon <id>` to purchase."));
+    }
+  } catch (err) {
+    fail(err);
+  }
+});
+billing.command("upgrade").description("Open Stripe checkout to subscribe to the Solo plan.").action(async (_opts, command) => {
+  const c = await client(flags(command));
+  try {
+    const { url } = await c.createCheckout();
+    p.note(pc.underline(url), "Complete payment in your browser");
+    openBrowser(url);
+  } catch (err) {
+    fail(err);
+  }
+});
+billing.command("addon").argument("<addonId>", "add-on id (see `gzero billing`)").option("--product <productId>", "product to attach the add-on to").description("Open Stripe checkout for an add-on.").action(async (addonId, opts, command) => {
+  const c = await client(flags(command));
+  try {
+    const { url } = await c.createAddonCheckout(addonId, opts.product);
+    p.note(pc.underline(url), "Complete payment in your browser");
+    openBrowser(url);
+  } catch (err) {
+    fail(err);
+  }
+});
+billing.command("portal").description("Open the Stripe billing portal to manage your subscription.").action(async (_opts, command) => {
+  const c = await client(flags(command));
+  try {
+    const { url } = await c.createBillingPortal();
+    p.note(pc.underline(url), "Manage billing in your browser");
+    openBrowser(url);
+  } catch (err) {
+    fail(err);
+  }
+});
+function mcpEndpoint(baseUrl) {
+  if (process.env.GZERO_MCP_URL) return process.env.GZERO_MCP_URL;
+  try {
+    const u = new URL(baseUrl);
+    if (u.hostname.startsWith("api.")) u.hostname = `mcp.${u.hostname.slice(4)}`;
+    return `${u.origin}/mcp`;
+  } catch {
+    return `${baseUrl.replace(/\/+$/, "")}/mcp`;
+  }
+}
+program.command("mcp").description("Print config to connect an AI client to the hosted GroundZero MCP server.").action(async (_opts, command) => {
+  const settings = await resolveSettings(flags(command));
+  const url = mcpEndpoint(settings.baseUrl ?? import_sdk.DEFAULT_BASE_URL);
+  const config = JSON.stringify({ mcpServers: { gzero: { url } } }, null, 2);
+  p.intro(pc.bgCyan(pc.black(" GroundZero MCP ")));
+  p.note(
+    `The MCP server is hosted at ${pc.cyan(url)}.
+Add it to your AI client (Cursor: ${pc.dim("~/.cursor/mcp.json")}) and it will
+open a browser to sign in with GitHub the first time. Nothing to install.`,
+    "Hosted MCP"
+  );
+  p.note(config, "Client config");
+  p.outro("Paste the config above, then reload your AI client.");
+});
+program.parseAsync(process.argv).catch((err) => {
+  fail(err);
+});

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "gzero-cli",
+  "version": "0.1.0-preview.1",
+  "description": "GroundZero command-line interface: deploy UIs and APIs, manage env, domains, and billing.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "bin": {
+    "gzero": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "tag": "preview"
+  },
+  "scripts": {
+    "build": "tsup && chmod +x dist/index.js",
+    "dev": "tsup --watch"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@clack/prompts": "^0.11.0",
+    "commander": "^14.0.1",
+    "picocolors": "^1.1.1"
+  },
+  "devDependencies": {
+    "@gzero/sdk": "*",
+    "@types/node": "25.0.3",
+    "tsup": "^8",
+    "typescript": "5.9.3"
+  }
+}