lapsed 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dan Laskarzewski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,98 @@
-# Temporary Holding Version
+# lapsed
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Command-line client for [Lapsed](https://lapsed.dev), SSL certificate and domain expiry monitoring.
+
+Each command calls the public API, which the dashboard also uses. Everything available in the dashboard is available here, and everything here is available through the API.
+
+## Install
+
+Requires Node.js 22 or later. `npx` downloads the CLI on first use:
+
+```
+npx lapsed login
+```
+
+To install it globally, run `npm install -g lapsed`, then use `lapsed …`.
+
+## Quickstart
+
+```
+npx lapsed login
+npx lapsed add example.com api.example.com
+npx lapsed channels add https://hooks.slack.com/services/…
+npx lapsed channels test
+```
+
+1. **`login`** prints a code and opens a browser. After you approve the code in the browser, the CLI stores an API key in the config directory:
+   - `~/.config/lapsed/config.json` on Linux;
+   - `~/Library/Application Support/lapsed/` on macOS;
+   - `%APPDATA%\lapsed\` on Windows.
+
+   The file is readable only by your user.
+2. **`add`** checks each hostname immediately and prints the result.
+3. **`channels test`** sends a test alert to every channel.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `login` | Log in through your browser |
+| `logout` | Revoke the key from `login` and forget it |
+| `whoami` | Your account, balance and watch count |
+| `add <input...> [--kind host\|domain]` | Watch hostnames (`host`: certificate and domain expiry) or domains (`domain`: registration expiry only) |
+| `remove <watch...>` | Stop watching (by input or watch id) |
+| `list` | Your watches |
+| `status [watch]` | Open problems, for every watch or for one in detail |
+| `pin <watch>` / `unpin <watch>` | Choose which watches are your free ones |
+| `optin <watch> <event...>` / `optout …` | Turn on events that are off by default (e.g. `cert.changed`) |
+| `channels add <email or URL>` | Add an email address, webhook, Slack or Discord URL. Webhooks show their signing secret once |
+| `channels list` / `channels remove <id>` | List or remove channels |
+| `channels test [id]` | Send a test alert to one channel, or to all of them |
+| `channels rotate-secret <id>` | Replace a webhook's signing secret |
+| `events [--limit N] [--cursor C]` | Recent events across your watches |
+| `deliveries [id] [--failed] [--limit N] [--cursor C]` | The delivery log, or one delivery with every attempt |
+| `resend <delivery-id>` | Send a delivery again |
+| `balance` | Balance, refundable credit and recent activity |
+| `refund [--yes]` | Refund unused paid credit to the original payment method, with no fee |
+| `topup [5\|20]` | Opens a checkout for a $5 (default) or $20 credit pack |
+| `keys create <name>` / `keys list` / `keys revoke <id>` | API keys for scripts and CI |
+| `account delete [--confirm <email>] [--forfeit-refund]` | Delete the account. Shows what happens to the balance first; unused paid credit is refunded |
+
+Run `lapsed <command> --help` for a command's usage.
+
+## Scripts and CI
+
+- **`LAPSED_API_KEY`:** a key from `lapsed keys create`. It is used instead of the stored login.
+- **`LAPSED_API_URL`:** overrides the API address (default `https://lapsed.dev`).
+- **`--json`:** stdout carries exactly one JSON document. Errors go to stderr as `{"error":{"code":"…","message":"…"}}`.
+
+`--json` output is stable and follows the same versioning policy as webhooks. It is the API's response body, unchanged, except for these commands:
+
+| Command | `--json` output |
+|---|---|
+| `add` | `{"data":[{"input","ok":true,"created":bool,"watch":{…}} \| {"input","ok":false,"error":{"code","message"}} \| {"input","ok":false,"skipped":true}]}` |
+| `remove` | `{"removed":["wch_…"]}` |
+| `channels remove` | `{"removed":"chn_…"}` |
+| `channels test` (no id) | `{"data":[{"channelId","deliveryId"}]}` |
+| `keys revoke` | `{"revoked":"key_…"}` |
+| `login` | `{"accountId","email"}` (the code and URL go to stderr) |
+| `logout` | `{"loggedOut":true,"keyRevoked":bool}` |
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| 0 | Success |
+| 1 | Error: network, server error, or an unexpected response (check `LAPSED_API_URL`) |
+| 2 | Usage: bad arguments, or the API refused the input (`400`) |
+| 3 | Not logged in or not allowed (`401`, `403`), or the login was denied or expired |
+| 4 | Not found (`404`), or no watch matches what you typed |
+| 5 | Needs a top-up (`402`) or a higher watch limit (`403 watch_limit`) |
+| 6 | Rate limited (`429`); the message says when to retry |
+| 7 | `status --fail-on-problem` was given and a watch has an open problem |
+
+`add` with several inputs continues past an invalid one and exits with the first failure's code. A `402`, `403` or `429` stops it, and the remaining inputs are reported as `skipped`.
+
+## Documentation
+
+The [CLI reference](https://lapsed.dev/docs/cli/) lists every command and option. The [API reference](https://lapsed.dev/docs/) covers the API the CLI calls.

package/dist/lapsed.js

@@ -0,0 +1,1137 @@
+#!/usr/bin/env node
+
+// src/main.ts
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { homedir, hostname } from "node:os";
+import { createInterface } from "node:readline/promises";
+
+// ../../../packages/core-cli/src/errors.ts
+var EXIT = { ok: 0, error: 1, usage: 2, auth: 3, notFound: 4, payment: 5, rateLimited: 6, problem: 7 };
+var CliError = class extends Error {
+  exitCode;
+  code;
+  constructor(exitCode, code, message) {
+    super(message);
+    this.exitCode = exitCode;
+    this.code = code;
+    this.name = "CliError";
+  }
+};
+function exitCodeFor(status2, code) {
+  if (status2 === 400) return EXIT.usage;
+  if (status2 === 401) return EXIT.auth;
+  if (status2 === 403) return code === "watch_limit" ? EXIT.payment : EXIT.auth;
+  if (status2 === 402) return EXIT.payment;
+  if (status2 === 404) return EXIT.notFound;
+  if (status2 === 429) return EXIT.rateLimited;
+  return EXIT.error;
+}
+
+// ../../../packages/core-cli/src/money.ts
+var WHOLE = /^\$?(\d+)(?:\.(\d{1,6}))?$/;
+var FRACTION_ONLY = /^\$?\.(\d{1,6})$/;
+function parseUsd(input, opts = {}) {
+  const bad = () => new CliError(EXIT.usage, "bad_amount", `"${input}" is not a valid dollar amount. Use a value such as 5 or 4.50 (at most 6 decimal places).`);
+  const w = WHOLE.exec(input);
+  const f = w ? null : FRACTION_ONLY.exec(input);
+  if (!w && !f) throw bad();
+  const [whole, frac] = w ? [w[1], w[2] ?? ""] : ["0", f[1]];
+  const micros = Number(whole) * 1e6 + Number(frac.padEnd(6, "0"));
+  if (!Number.isSafeInteger(micros) || whole.length > 9) throw bad();
+  if (opts.positive && micros <= 0) throw new CliError(EXIT.usage, "bad_amount", "The amount must be more than $0.");
+  return micros;
+}
+function formatUsd(m) {
+  const cents = Math.trunc(Math.abs(m) / 1e4);
+  const sign = m < 0 && cents > 0 ? "-" : "";
+  return `${sign}$${Math.floor(cents / 100)}.${String(cents % 100).padStart(2, "0")}`;
+}
+
+// ../../../packages/core-cli/src/config.ts
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { posix, win32 } from "node:path";
+function configDir(name, env, platform, home) {
+  if (platform === "win32") return win32.join(env.APPDATA || win32.join(home, "AppData", "Roaming"), name);
+  if (platform === "darwin") return posix.join(home, "Library", "Application Support", name);
+  return posix.join(env.XDG_CONFIG_HOME || posix.join(home, ".config"), name);
+}
+var ConfigStore = class {
+  file;
+  dir;
+  warn;
+  constructor(dir, warn = () => {
+  }) {
+    this.dir = dir;
+    this.warn = warn;
+    this.file = `${dir}/config.json`;
+  }
+  read() {
+    let text;
+    try {
+      text = readFileSync(this.file, "utf8");
+    } catch (e) {
+      if (e.code === "ENOENT") return {};
+      this.warn(`Could not read ${this.file}: ${e.message}`);
+      return {};
+    }
+    try {
+      const raw = JSON.parse(text);
+      if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("not an object");
+      const key = raw.key;
+      return typeof key === "string" && key ? { key } : {};
+    } catch {
+      this.warn(`${this.file} is damaged; treating you as logged out. Run login again.`);
+      return {};
+    }
+  }
+  write(c) {
+    mkdirSync(this.dir, { recursive: true, mode: 448 });
+    chmodSync(this.dir, 448);
+    writeFileSync(this.file, `${JSON.stringify(c, null, 2)}
+`, { mode: 384 });
+    chmodSync(this.file, 384);
+  }
+  clear() {
+    rmSync(this.file, { force: true });
+  }
+};
+
+// ../../../packages/core-cli/src/client.ts
+var NEVER_SENT = /* @__PURE__ */ new Set(["UND_ERR_CONNECT_TIMEOUT", "ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN", "ENETUNREACH", "EHOSTUNREACH"]);
+var ApiClient = class {
+  baseUrl;
+  o;
+  constructor(o) {
+    this.o = o;
+    this.baseUrl = o.baseUrl.replace(/\/+$/, "");
+  }
+  async request(method, path, opts = {}) {
+    const url = new URL(this.baseUrl + path);
+    for (const [k, v] of Object.entries(opts.query ?? {})) if (v !== void 0) url.searchParams.set(k, v);
+    const headers = { "user-agent": this.o.userAgent, accept: "application/json", ...opts.headers };
+    const auth = opts.auth ?? "key";
+    if (auth === "key" && this.o.key) headers.authorization = `Bearer ${this.o.key}`;
+    if (auth === "admin" && this.o.adminKey) headers["x-admin-key"] = this.o.adminKey;
+    if (opts.body !== void 0) headers["content-type"] = "application/json";
+    const init = { method, headers, ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {} };
+    let res;
+    try {
+      res = await this.o.fetch(url.toString(), init).catch((e) => {
+        if (NEVER_SENT.has(String(e.cause?.code))) return this.o.fetch(url.toString(), init);
+        throw e;
+      });
+    } catch (e) {
+      const cause = e.cause?.message ?? e.message;
+      throw new CliError(EXIT.error, "network", `Could not reach ${this.baseUrl}: ${cause}`);
+    }
+    const text = await res.text();
+    let body;
+    let parsed = true;
+    try {
+      body = text ? JSON.parse(text) : void 0;
+    } catch {
+      parsed = false;
+    }
+    const notApi = () => new CliError(EXIT.error, "bad_response", `HTTP ${res.status} from ${url.toString()}: not an API response. Check ${this.o.apiUrlEnv}.`);
+    if (res.ok) {
+      if (!parsed) throw notApi();
+      return { status: res.status, body };
+    }
+    const error = parsed ? body?.error : void 0;
+    if (!error || typeof error.code !== "string" || typeof error.message !== "string") throw notApi();
+    const retry = res.status === 429 ? res.headers.get("retry-after") : null;
+    throw new CliError(exitCodeFor(res.status, error.code), error.code, retry ? `${error.message} (retry in ${retry}s)` : error.message);
+  }
+};
+
+// ../../../packages/core-cli/src/output.ts
+function table(rows) {
+  const widths = [];
+  for (const row of rows) row.forEach((cell, i) => {
+    widths[i] = Math.max(widths[i] ?? 0, cell.length);
+  });
+  return rows.map((row) => row.map((cell, i) => i === row.length - 1 ? cell : cell.padEnd(widths[i])).join("  ").trimEnd()).join("\n");
+}
+function balanceBanner(product, status2, balanceMicros) {
+  if (status2 === "low") return `Balance is low (${formatUsd(balanceMicros)}). Top up: ${product.name} topup`;
+  if (status2 === "paused") return `Paid watches are paused until you top up: ${product.name} topup`;
+  return null;
+}
+function when(iso) {
+  return iso ? `${iso.slice(0, 10)} ${iso.slice(11, 16)} UTC` : "never";
+}
+
+// ../../../packages/core-cli/src/cli.ts
+import { parseArgs } from "node:util";
+var GLOBAL_HELP = ["  --json         Machine-readable output (stable; see README)", "  -h, --help     Help for a command", "  -v, --version  Print the version"];
+function defineCli(product, commands) {
+  const P = product.envPrefix;
+  commands = commands.map((c) => ({ ...c, usage: c.usage.replaceAll("<name>", product.name) }));
+  const byName = new Map(commands.map((c) => [c.name, c]));
+  const listing = (cmds) => {
+    const width = Math.max(...cmds.map((c) => c.name.length));
+    return cmds.map((c) => `  ${c.name.padEnd(width)}  ${c.summary}`).join("\n");
+  };
+  const mainHelp = () => [
+    `${product.displayName} CLI ${product.version}`,
+    "",
+    `Usage: ${product.name} <command> [options]`,
+    "",
+    "Commands:",
+    listing(commands.filter((c) => !c.hidden)),
+    "",
+    "Options:",
+    ...GLOBAL_HELP,
+    "",
+    `Environment: ${P}_API_KEY (use this key instead of login), ${P}_API_URL (default ${product.defaultApiUrl})`,
+    "",
+    "Examples:",
+    ...product.examples.map((e) => `  ${e}`)
+  ].join("\n");
+  return async (argv, ctx2) => {
+    const io = ctx2.io;
+    const dashdash = argv.indexOf("--");
+    const head = dashdash === -1 ? argv : argv.slice(0, dashdash);
+    const tail = dashdash === -1 ? [] : argv.slice(dashdash);
+    const json = head.includes("--json");
+    const help = head.includes("--help") || head.includes("-h");
+    const args = [...head.filter((a) => a !== "--json" && a !== "--help" && a !== "-h"), ...tail];
+    const fail = (e) => {
+      if (e instanceof CliError) {
+        io.err(json ? JSON.stringify({ error: { code: e.code, message: e.message } }) : e.message);
+        return e.exitCode;
+      }
+      const message = e instanceof Error ? e.message : String(e);
+      io.err(json ? JSON.stringify({ error: { code: "unexpected", message } }) : `Unexpected error: ${message}`);
+      return EXIT.error;
+    };
+    try {
+      if (args[0] === "--version" || args[0] === "-v") {
+        io.out(product.version);
+        return EXIT.ok;
+      }
+      if (args.length === 0 || args[0] === "help") {
+        const target = args[1] && (byName.get(`${args[1]} ${args[2] ?? ""}`.trim()) ?? byName.get(args[1]));
+        io.out(target ? `${target.summary}
+
+Usage: ${target.usage}` : mainHelp());
+        return args.length === 0 && !help ? EXIT.usage : EXIT.ok;
+      }
+      let cmd;
+      let words = Math.min(3, args.length);
+      for (; words > 0 && !cmd; words--) cmd = byName.get(args.slice(0, words).join(" "));
+      const rest = args.slice(words + 1);
+      if (!cmd) {
+        const group = commands.filter((c) => c.name.startsWith(`${args[0]} `));
+        if (group.length > 0) {
+          io.out(`Usage: ${product.name} ${args[0]} <command>
+
+Commands:
+${listing(group)}`);
+          return help ? EXIT.ok : EXIT.usage;
+        }
+        throw new CliError(EXIT.usage, "usage", `Unknown command "${args[0]}". See: ${product.name} help`);
+      }
+      if (help) {
+        io.out(`${cmd.summary}
+
+Usage: ${cmd.usage}`);
+        return EXIT.ok;
+      }
+      let parsed;
+      try {
+        parsed = parseArgs({ args: rest, options: cmd.options ?? {}, allowPositionals: true, strict: true });
+      } catch (e) {
+        throw new CliError(EXIT.usage, "usage", `${e.message}
+Usage: ${cmd.usage}`);
+      }
+      const config = new ConfigStore(configDir(product.name, ctx2.env, ctx2.platform, ctx2.homedir), (m) => io.err(m));
+      const envKey = ctx2.env[`${P}_API_KEY`];
+      const stored = config.read().key;
+      const key = envKey ? { value: envKey, source: "env" } : stored ? { value: stored, source: "config" } : null;
+      const apiUrl = (ctx2.env[`${P}_API_URL`] || product.defaultApiUrl).replace(/\/+$/, "");
+      if (!/^https?:\/\/[^/]+/.test(apiUrl)) throw new CliError(EXIT.usage, "usage", `${P}_API_URL must be an http(s) URL.`);
+      const base = { baseUrl: apiUrl, fetch: ctx2.fetch, userAgent: `${product.name}-cli/${product.version} node/${process.versions.node}`, apiUrlEnv: `${P}_API_URL` };
+      const rc = {
+        ...ctx2,
+        product,
+        json,
+        config,
+        apiUrl,
+        key,
+        client: (o = {}) => {
+          const k = o.key ?? key?.value;
+          if (!k && !o.anonymous) throw new CliError(EXIT.auth, "not_logged_in", `Not logged in. Run: ${product.name} login (or set ${P}_API_KEY).`);
+          return new ApiClient({ ...base, ...k ? { key: k } : {} });
+        },
+        adminClient: async () => {
+          let adminKey = ctx2.env[`${P}_ADMIN_KEY`];
+          if (!adminKey && io.isTty && !json) adminKey = (await ctx2.prompt("Admin key: ", { hidden: true })).trim();
+          if (!adminKey) throw new CliError(EXIT.usage, "no_admin_key", `Set ${P}_ADMIN_KEY.`);
+          return new ApiClient({ ...base, adminKey });
+        }
+      };
+      return await cmd.run(rc, parsed);
+    } catch (e) {
+      return fail(e);
+    }
+  };
+}
+
+// ../../../packages/core-cli/src/commands/auth.ts
+var SLOW_DOWN_MS = 5e3;
+async function login(c) {
+  const P = c.product.envPrefix;
+  const anon = c.client({ anonymous: true });
+  const { body: s } = await anon.request("POST", "/api/auth/device", { auth: "none", body: { label: c.hostname.slice(0, 40) || "unnamed device" } });
+  const say = (line) => c.json ? c.io.err(line) : c.io.out(line);
+  say(`Your code: ${s.user_code}`);
+  say(`Approve it at ${s.verification_uri}`);
+  if (c.io.isTty && !c.json) await c.openUrl(s.verification_uri);
+  say("Waiting for approval\u2026");
+  const deadline = c.now().getTime() + s.expires_in * 1e3;
+  let interval = s.interval * 1e3;
+  let networkErrors = 0;
+  let key = null;
+  while (key === null) {
+    if (c.now().getTime() + interval > deadline) throw new CliError(EXIT.auth, "expired_token", `The login request expired. Run: ${c.product.name} login`);
+    await c.sleep(interval);
+    try {
+      key = (await anon.request("POST", "/api/auth/device/token", { auth: "none", body: { device_code: s.device_code } })).body.key;
+      networkErrors = 0;
+    } catch (e) {
+      if (!(e instanceof CliError)) throw e;
+      if (e.code === "network" && ++networkErrors < 2) continue;
+      networkErrors = 0;
+      if (e.code === "authorization_pending") continue;
+      if (e.code === "slow_down") {
+        interval += SLOW_DOWN_MS;
+        continue;
+      }
+      if (e.code === "access_denied" || e.code === "expired_token") throw new CliError(EXIT.auth, e.code, e.message);
+      throw e;
+    }
+  }
+  c.config.write({ key });
+  if (c.env[`${P}_API_KEY`]) c.io.err(`${P}_API_KEY is set and will be used instead of this login.`);
+  const { body: me } = await c.client({ key }).request("GET", "/api/me");
+  if (c.json) c.io.out(JSON.stringify({ accountId: me.accountId, email: me.email }, null, 2));
+  else c.io.out(`Logged in as ${me.email ?? me.accountId}`);
+  return EXIT.ok;
+}
+async function logout(c) {
+  const P = c.product.envPrefix;
+  const envNote = () => {
+    if (c.env[`${P}_API_KEY`]) c.io.err(`${P}_API_KEY is still set; logout does not revoke or unset it.`);
+  };
+  const stored = c.config.read().key;
+  if (!stored) {
+    if (c.json) c.io.out(JSON.stringify({ loggedOut: true, keyRevoked: false }, null, 2));
+    else c.io.out("Not logged in.");
+    envNote();
+    return EXIT.ok;
+  }
+  const client = c.client({ key: stored });
+  let failure = null;
+  let revoked = false;
+  try {
+    const { body: me } = await client.request("GET", "/api/me");
+    if (me.keyId) {
+      await client.request("DELETE", `/api/keys/${encodeURIComponent(me.keyId)}`);
+      revoked = true;
+    }
+  } catch (e) {
+    if (!(e instanceof CliError)) throw e;
+    if (e.exitCode !== EXIT.auth) failure = e;
+  }
+  c.config.clear();
+  envNote();
+  if (failure) {
+    c.io.err(`Could not revoke the key on the server: ${failure.message} It was removed locally; revoke it with: ${c.product.name} keys revoke`);
+    if (c.json) c.io.out(JSON.stringify({ loggedOut: true, keyRevoked: false }, null, 2));
+    return EXIT.error;
+  }
+  if (c.json) c.io.out(JSON.stringify({ loggedOut: true, keyRevoked: revoked }, null, 2));
+  else c.io.out(revoked ? "Logged out. The key was revoked." : "Logged out.");
+  return EXIT.ok;
+}
+async function whoami(c) {
+  const { body: me } = await c.client().request("GET", "/api/me");
+  if (c.json) {
+    c.io.out(JSON.stringify(me, null, 2));
+    return EXIT.ok;
+  }
+  const lines = [
+    `${me.email ?? "(no email)"} (${me.accountId})`,
+    `Balance: ${formatUsd(me.balanceMicros)}${me.status === "ok" ? "" : ` (${me.status})`}`,
+    `Watches: ${me.watches.count} of ${me.watches.max} (${me.watches.free} free)`,
+    `Using: ${c.key?.source === "env" ? `${c.product.envPrefix}_API_KEY` : "the key from login"}`
+  ];
+  const banner = balanceBanner(c.product, me.status, me.balanceMicros);
+  if (banner) lines.push("", banner);
+  c.io.out(lines.join("\n"));
+  return EXIT.ok;
+}
+var authCommands = [
+  { name: "login", summary: "Log in through your browser", usage: "<name> login", run: login },
+  { name: "logout", summary: "Revoke and forget the key from login", usage: "<name> logout", run: logout },
+  { name: "whoami", summary: "Show your account, balance and watch count", usage: "<name> whoami", run: whoami }
+];
+
+// ../../../packages/core-cli/src/commands/watches.ts
+function resolveWatch(watches, arg, product) {
+  const byId = watches.find((w) => w.id === arg);
+  if (byId) return byId;
+  const matches = watches.filter((w) => w.input.toLowerCase() === arg.toLowerCase());
+  if (matches.length === 0) throw new CliError(EXIT.notFound, "not_found", `No watch matches "${arg}". See: ${product.name} list`);
+  if (matches.length > 1) {
+    throw new CliError(EXIT.usage, "ambiguous", `"${arg}" is watched more than once. Use its id: ${matches.map((w) => `${w.id} (${w.kind})`).join(", ")}`);
+  }
+  return matches[0];
+}
+var listWatches = async (c) => (await c.client().request("GET", "/api/watches")).body;
+var MARK = { critical: "!!", warning: "!", info: "\xB7", resolved: "\u2713" };
+function details(w, withMessages) {
+  const lines = [];
+  for (const p of w.problems) {
+    lines.push(`  ${MARK[p.severity] ?? "!"} ${p.title}`);
+    if (withMessages) lines.push(`    ${p.message}`);
+  }
+  if (withMessages) for (const n of w.notices) lines.push(`  \xB7 ${n.message}`);
+  return lines;
+}
+async function add(c, a) {
+  const kind = a.values.kind;
+  if (kind !== void 0 && !c.product.watchKinds.includes(kind)) {
+    throw new CliError(EXIT.usage, "usage", `--kind must be one of: ${c.product.watchKinds.join(", ")}.`);
+  }
+  if (a.positionals.length === 0) throw new CliError(EXIT.usage, "usage", `Usage: ${c.product.name} add <input...> [--kind ${c.product.watchKinds.join("|")}]`);
+  const client = c.client();
+  const results = [];
+  let exit = EXIT.ok;
+  let stopped = false;
+  for (const input of a.positionals) {
+    if (stopped) {
+      results.push({ input, ok: false, skipped: true });
+      continue;
+    }
+    try {
+      const r = await client.request("POST", "/api/watches", { body: kind ? { input, kind } : { input } });
+      results.push({ input, ok: true, created: r.status === 201, watch: r.body });
+    } catch (e) {
+      if (!(e instanceof CliError)) throw e;
+      results.push({ input, ok: false, error: { code: e.code, message: e.message } });
+      if (exit === EXIT.ok) exit = e.exitCode;
+      if (e.exitCode === EXIT.payment || e.exitCode === EXIT.rateLimited || e.code === "network") stopped = true;
+    }
+  }
+  if (c.json) {
+    c.io.out(JSON.stringify({ data: results }, null, 2));
+    return exit;
+  }
+  const lines = [];
+  for (const r of results) {
+    if (r.ok) lines.push(`${r.input}: ${r.created ? "added" : "already watched"} (${r.watch.status}, ${r.watch.billing})`, ...details(r.watch, true));
+    else if ("skipped" in r) lines.push(`${r.input}: skipped`);
+    else lines.push(`${r.input}: ${r.error.message}`);
+  }
+  c.io.out(lines.join("\n"));
+  return exit;
+}
+async function remove(c, a) {
+  if (a.positionals.length === 0) throw new CliError(EXIT.usage, "usage", `Usage: ${c.product.name} remove <watch...>`);
+  const { data } = await listWatches(c);
+  const targets = a.positionals.map((arg) => resolveWatch(data, arg, c.product));
+  const client = c.client();
+  for (const w of targets) await client.request("DELETE", `/api/watches/${encodeURIComponent(w.id)}`);
+  if (c.json) c.io.out(JSON.stringify({ removed: targets.map((w) => w.id) }, null, 2));
+  else c.io.out(targets.map((w) => `Removed ${w.input}`).join("\n"));
+  return EXIT.ok;
+}
+async function list(c) {
+  const client = c.client();
+  const [body, me] = await Promise.all([
+    client.request("GET", "/api/watches").then((r) => r.body),
+    client.request("GET", "/api/me").then((r) => r.body)
+  ]);
+  if (c.json) {
+    c.io.out(JSON.stringify(body, null, 2));
+    return EXIT.ok;
+  }
+  const lines = body.data.length === 0 ? [`No watches yet. Add one: ${c.product.name} add ${c.product.watchKinds[0] === "host" ? "example.com" : "<input>"}`] : [table([["WATCH", "KIND", "STATUS", "BILLING", "LAST CHECKED"], ...body.data.map((w) => [w.input, w.kind, w.status, w.billing + (w.pinnedFree ? " (pinned)" : ""), when(w.lastCheckedAt)])])];
+  const banner = balanceBanner(c.product, me.status, me.balanceMicros);
+  if (banner) lines.push("", banner);
+  c.io.out(lines.join("\n"));
+  return EXIT.ok;
+}
+async function status(c, a) {
+  const body = await listWatches(c);
+  const exit = (ws) => a.values["fail-on-problem"] && ws.some((w2) => w2.status === "problem") ? EXIT.problem : EXIT.ok;
+  if (!a.positionals[0]) {
+    if (c.json) {
+      c.io.out(JSON.stringify(body, null, 2));
+      return exit(body.data);
+    }
+    const lines = body.data.flatMap((w2) => [`${w2.input}  ${w2.status}`, ...details(w2, false)]);
+    c.io.out(lines.length ? lines.join("\n") : "No watches yet.");
+    return exit(body.data);
+  }
+  const found = resolveWatch(body.data, a.positionals[0], c.product);
+  const { body: w } = await c.client().request("GET", `/api/watches/${encodeURIComponent(found.id)}`);
+  if (c.json) {
+    c.io.out(JSON.stringify(w, null, 2));
+    return exit([w]);
+  }
+  c.io.out([
+    `${w.input} (${w.kind}, ${w.id})`,
+    `Status: ${w.status}   Billing: ${w.billing}${w.pinnedFree ? " (pinned)" : ""}   Last checked: ${when(w.lastCheckedAt)}`,
+    ...w.optionalEvents.length ? [`Optional events: ${w.optionalEvents.join(", ")}`] : [],
+    ...details(w, true)
+  ].join("\n"));
+  return exit([w]);
+}
+async function patch(c, arg, change, done) {
+  if (!arg) throw new CliError(EXIT.usage, "usage", "Specify a watch by its input or id.");
+  const { data } = await listWatches(c);
+  const w = resolveWatch(data, arg, c.product);
+  const { body } = await c.client().request("PATCH", `/api/watches/${encodeURIComponent(w.id)}`, { body: change(w) });
+  c.io.out(c.json ? JSON.stringify(body, null, 2) : done(body));
+  return EXIT.ok;
+}
+var events = (a, verb) => {
+  const list2 = a.positionals.slice(1);
+  if (list2.length === 0) throw new CliError(EXIT.usage, "usage", `Name at least one event to ${verb}.`);
+  return list2;
+};
+var watchCommands = [
+  { name: "add", summary: "Watch one or more targets (each is checked immediately)", usage: "<name> add <input...> [--kind <kind>]", options: { kind: { type: "string" } }, run: add },
+  { name: "remove", summary: "Stop watching", usage: "<name> remove <watch...>", run: remove },
+  { name: "list", summary: "List your watches", usage: "<name> list", run: list },
+  { name: "status", summary: "Open problems, for all watches or one", usage: "<name> status [watch] [--fail-on-problem]", options: { "fail-on-problem": { type: "boolean" } }, run: status },
+  { name: "pin", summary: "Count a watch as one of your free watches", usage: "<name> pin <watch>", run: (c, a) => patch(c, a.positionals[0], () => ({ pinnedFree: true }), (w) => `Pinned ${w.input} (${w.billing}).`) },
+  { name: "unpin", summary: "Unpin a watch", usage: "<name> unpin <watch>", run: (c, a) => patch(c, a.positionals[0], () => ({ pinnedFree: false }), (w) => `Unpinned ${w.input} (${w.billing}).`) },
+  {
+    name: "optin",
+    summary: "Turn on events that are off by default",
+    usage: "<name> optin <watch> <event...>",
+    run: (c, a) => {
+      const add2 = events(a, "turn on");
+      return patch(c, a.positionals[0], (w) => ({ optionalEvents: [.../* @__PURE__ */ new Set([...w.optionalEvents, ...add2])] }), (w) => `${w.input}: optional events ${w.optionalEvents.join(", ") || "none"}.`);
+    }
+  },
+  {
+    name: "optout",
+    summary: "Turn off optional events",
+    usage: "<name> optout <watch> <event...>",
+    run: (c, a) => {
+      const drop = new Set(events(a, "turn off"));
+      return patch(c, a.positionals[0], (w) => ({ optionalEvents: w.optionalEvents.filter((e) => !drop.has(e)) }), (w) => `${w.input}: optional events ${w.optionalEvents.join(", ") || "none"}.`);
+    }
+  }
+];
+
+// ../../../packages/core-cli/src/args.ts
+function limitArg(values, fallback = 20) {
+  const raw = values.limit;
+  if (raw === void 0) return String(fallback);
+  const n = Number(raw);
+  if (typeof raw !== "string" || !/^\d+$/.test(raw) || n < 1 || n > 100) throw new CliError(EXIT.usage, "usage", "--limit must be a whole number from 1 to 100.");
+  return raw;
+}
+function required(positionals, what, usage) {
+  const v = positionals[0];
+  if (!v) throw new CliError(EXIT.usage, "usage", `Missing ${what}.
+Usage: ${usage}`);
+  return v;
+}
+var pageOptions = { limit: { type: "string" }, cursor: { type: "string" } };
+
+// ../../../packages/core-cli/src/commands/channels.ts
+var enc = encodeURIComponent;
+var SAVE_SECRET = "This secret is shown only once. Use it to verify webhook signatures (Standard Webhooks).";
+function showWithSecret(c, ch, verb) {
+  if (c.json) {
+    c.io.out(JSON.stringify(ch, null, 2));
+    return EXIT.ok;
+  }
+  const lines = [`${verb} ${ch.kind} channel ${ch.id} \u2192 ${ch.target} (${ch.status})`];
+  if (ch.secret) lines.push(`Signing secret: ${ch.secret}`, SAVE_SECRET);
+  if (ch.status === "pending") lines.push(`Confirmation sent to ${ch.target}. The channel receives alerts after the link in that email is opened.`);
+  c.io.out(lines.join("\n"));
+  return EXIT.ok;
+}
+async function test(c, id) {
+  const client = c.client();
+  const name = c.product.name;
+  if (id) {
+    const { body: body2 } = await client.request("POST", `/api/channels/${enc(id)}/test`);
+    c.io.out(c.json ? JSON.stringify(body2, null, 2) : `Test sent to ${id}. View it with: ${name} deliveries ${body2.deliveryId}`);
+    return EXIT.ok;
+  }
+  const { body } = await client.request("GET", "/api/channels");
+  const targets = body.data.filter((ch) => ch.status === "active" || ch.status === "failing");
+  if (targets.length === 0) throw new CliError(EXIT.notFound, "not_found", `No channels to test. Add one: ${name} channels add <email or URL>`);
+  const sent = [];
+  for (const ch of targets) {
+    const r = await client.request("POST", `/api/channels/${enc(ch.id)}/test`);
+    sent.push({ channelId: ch.id, deliveryId: r.body.deliveryId });
+  }
+  if (c.json) c.io.out(JSON.stringify({ data: sent }, null, 2));
+  else c.io.out([...sent.map((s) => `Test sent to ${s.channelId}: ${name} deliveries ${s.deliveryId}`), `View them with: ${name} deliveries`].join("\n"));
+  return EXIT.ok;
+}
+var channelCommands = [
+  {
+    name: "channels add",
+    summary: "Add an email address, webhook, Slack or Discord URL",
+    usage: "<name> channels add <email or https URL>",
+    run: async (c, a) => {
+      const target = required(a.positionals, "the email address or URL", `${c.product.name} channels add <email or https URL>`);
+      const { body } = await c.client().request("POST", "/api/channels", { body: { target } });
+      return showWithSecret(c, body, "Added");
+    }
+  },
+  {
+    name: "channels list",
+    summary: "List your channels",
+    usage: "<name> channels list",
+    run: async (c) => {
+      const { body } = await c.client().request("GET", "/api/channels");
+      if (c.json) c.io.out(JSON.stringify(body, null, 2));
+      else c.io.out(body.data.length ? table([["ID", "KIND", "TARGET", "STATUS"], ...body.data.map((ch) => [ch.id, ch.kind, ch.target, ch.status === "disabled" && ch.disabledReason ? `disabled (${ch.disabledReason})` : ch.status])]) : `No channels yet. Add one: ${c.product.name} channels add <email or URL>`);
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "channels remove",
+    summary: "Remove a channel",
+    usage: "<name> channels remove <channel-id>",
+    run: async (c, a) => {
+      const id = required(a.positionals, "the channel id", `${c.product.name} channels remove <channel-id>`);
+      await c.client().request("DELETE", `/api/channels/${enc(id)}`);
+      c.io.out(c.json ? JSON.stringify({ removed: id }, null, 2) : `Removed ${id}`);
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "channels resend",
+    summary: "Resend the confirmation email for a pending email channel",
+    usage: "<name> channels resend <channel-id>",
+    run: async (c, a) => {
+      const id = required(a.positionals, "the channel id", `${c.product.name} channels resend <channel-id>`);
+      const { body } = await c.client().request("POST", `/api/channels/${enc(id)}/resend-confirmation`);
+      c.io.out(c.json ? JSON.stringify(body, null, 2) : "Confirmation sent.");
+      return EXIT.ok;
+    }
+  },
+  { name: "channels test", summary: "Send a test alert (to one channel, or all)", usage: "<name> channels test [channel-id]", run: (c, a) => test(c, a.positionals[0]) },
+  {
+    name: "channels rotate-secret",
+    summary: "Replace a webhook's signing secret",
+    usage: "<name> channels rotate-secret <channel-id>",
+    run: async (c, a) => {
+      const id = required(a.positionals, "the channel id", `${c.product.name} channels rotate-secret <channel-id>`);
+      const { body } = await c.client().request("POST", `/api/channels/${enc(id)}/rotate-secret`);
+      return showWithSecret(c, body, "Rotated");
+    }
+  }
+];
+
+// ../../../packages/core-cli/src/commands/activity.ts
+var enc2 = encodeURIComponent;
+var oneLine = (s, max = 120) => {
+  const t = s.replace(/\s+/g, " ").trim();
+  return t.length > max ? `${t.slice(0, max - 1)}\u2026` : t;
+};
+function printPage(c, page, rows, empty, more) {
+  if (c.json) {
+    c.io.out(JSON.stringify(page, null, 2));
+    return EXIT.ok;
+  }
+  const lines = page.data.length ? [table(rows())] : [empty];
+  if (page.nextCursor) lines.push("", `More: ${more(page.nextCursor)}`);
+  c.io.out(lines.join("\n"));
+  return EXIT.ok;
+}
+async function deliveryDetail(c, id) {
+  const { body: d } = await c.client().request("GET", `/api/deliveries/${enc2(id)}`);
+  if (c.json) {
+    c.io.out(JSON.stringify(d, null, 2));
+    return EXIT.ok;
+  }
+  const lines = [
+    `${d.id}: ${d.eventType} \u2192 ${d.channelId}`,
+    `State: ${d.state}, ${d.attempts} attempt${d.attempts === 1 ? "" : "s"}${d.nextAttemptAt ? `, next ${when(d.nextAttemptAt)}` : ""}`,
+    ...d.attemptLog.map((a) => `  #${a.attempt} ${when(a.at)}  ${a.status ?? a.error ?? "no response"}  ${a.latencyMs}ms${a.responseSnippet ? `  ${oneLine(a.responseSnippet)}` : ""}`)
+  ];
+  if (d.state === "failed") lines.push("", `Resend it with: ${c.product.name} resend ${d.id}`);
+  c.io.out(lines.join("\n"));
+  return EXIT.ok;
+}
+var activityCommands = [
+  {
+    name: "events",
+    summary: "Recent events (state changes) across your watches",
+    usage: "<name> events [--limit N] [--cursor C]",
+    options: pageOptions,
+    run: async (c, a) => {
+      const { body } = await c.client().request("GET", "/api/events", { query: { limit: limitArg(a.values), cursor: a.values.cursor } });
+      return printPage(
+        c,
+        body,
+        () => [["WHEN", "EVENT", "TARGET"], ...body.data.map((e) => [when(e.createdAt), e.type + (e.alreadyOpen ? " (catch-up)" : ""), e.target])],
+        "No events yet.",
+        (cur) => `${c.product.name} events --cursor ${cur}`
+      );
+    }
+  },
+  {
+    name: "deliveries",
+    summary: "The delivery log (or one delivery with its attempts)",
+    usage: "<name> deliveries [delivery-id] [--failed] [--limit N] [--cursor C]",
+    options: { ...pageOptions, failed: { type: "boolean" } },
+    run: async (c, a) => {
+      if (a.positionals[0]) return deliveryDetail(c, a.positionals[0]);
+      const failed = a.values.failed === true;
+      const { body } = await c.client().request("GET", "/api/deliveries", {
+        query: { limit: limitArg(a.values), cursor: a.values.cursor, failed: failed ? "true" : void 0 }
+      });
+      return printPage(
+        c,
+        body,
+        () => [["WHEN", "EVENT", "CHANNEL", "STATE", "ATTEMPTS", "ID"], ...body.data.map((d) => [when(d.createdAt), d.eventType, d.channelId, d.state, String(d.attempts), d.id])],
+        failed ? "No failed deliveries." : "No deliveries yet.",
+        (cur) => `${c.product.name} deliveries${failed ? " --failed" : ""} --cursor ${cur}`
+      );
+    }
+  },
+  {
+    name: "resend",
+    summary: "Send a delivery again",
+    usage: "<name> resend <delivery-id>",
+    run: async (c, a) => {
+      const id = required(a.positionals, "the delivery id", `${c.product.name} resend <delivery-id>`);
+      const { body } = await c.client().request("POST", `/api/deliveries/${enc2(id)}/resend`);
+      c.io.out(c.json ? JSON.stringify(body, null, 2) : `Queued. View it with: ${c.product.name} deliveries ${body.deliveryId}`);
+      return EXIT.ok;
+    }
+  }
+];
+
+// ../../../packages/core-cli/src/commands/account.ts
+var count = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+var same = (a, b) => a.trim().toLowerCase() === b.trim().toLowerCase();
+function money(p) {
+  if (p.balanceMicros < 0) return [`Your balance of ${formatUsd(p.balanceMicros)} will be written off.`];
+  if (p.balanceMicros === 0) return [];
+  const balance = `Your balance is ${formatUsd(p.balanceMicros)}.`;
+  if (p.refundableMicros <= 0) return [`${balance} It is not refundable and will be forfeited.`];
+  if (p.refundMode === "review") {
+    return [balance, `Refunds for this email address are reviewed by support. Request a refund with "refund" before deleting the account; otherwise ${formatUsd(p.forfeitedMicros)} is forfeited.`];
+  }
+  return [
+    balance,
+    `${formatUsd(p.refundableMicros)} of unused paid credit will be refunded to your original payment method.`,
+    ...p.forfeitedMicros >= 1e4 ? [`The other ${formatUsd(p.forfeitedMicros)} is not refundable and will be forfeited.`] : []
+  ];
+}
+async function confirmation(c, p, given) {
+  const fail = () => new CliError(EXIT.usage, "usage", "The confirmation text does not match. The account was not deleted.");
+  if (typeof given === "string") {
+    if (!same(given, p.confirm)) throw fail();
+    return given.trim();
+  }
+  if (!c.io.isTty || c.json) throw new CliError(EXIT.usage, "usage", `Add --confirm ${p.confirm} to delete without a prompt.`);
+  const typed = await c.prompt(`Type ${p.confirm} to delete this account: `);
+  if (!same(typed, p.confirm)) throw fail();
+  return p.confirm;
+}
+var accountCommands = [
+  {
+    name: "account delete",
+    summary: "Delete your account (shows what happens to your balance first)",
+    usage: "<name> account delete [--confirm <email>] [--forfeit-refund]",
+    options: { confirm: { type: "string" }, "forfeit-refund": { type: "boolean" } },
+    run: async (c, a) => {
+      const client = c.client();
+      const { body: p } = await client.request("GET", "/api/account/deletion");
+      if (!c.json) {
+        c.io.out([
+          `${count(p.watches, "watch", "watches")}, ${count(p.channels, "channel")}, ${count(p.keys, "API key")}, and your delivery history will be removed. Alerts stop immediately. This cannot be undone.`,
+          ...money(p)
+        ].join("\n"));
+      }
+      const forfeit = a.values["forfeit-refund"] === true;
+      if (p.refundMode === "review" && p.refundableMicros > 0 && !forfeit) {
+        throw new CliError(EXIT.usage, "refund_needs_review", `Request a refund first with: ${c.product.name} refund. To delete and forfeit the refundable credit, add --forfeit-refund.`);
+      }
+      const confirm = await confirmation(c, p, a.values.confirm);
+      const { body } = await client.request("POST", "/api/account/delete", { body: forfeit ? { confirm, forfeitRefund: true } : { confirm } });
+      if (c.key?.source === "config") c.config.clear();
+      if (c.json) {
+        c.io.out(JSON.stringify(body, null, 2));
+      } else {
+        c.io.out(["Account deleted.", ...body.refundedMicros > 0 ? [`${formatUsd(body.refundedMicros)} is being refunded to your original payment method.`] : []].join(" "));
+      }
+      const P = c.product.envPrefix;
+      if (c.env[`${P}_API_KEY`]) c.io.err(`${P}_API_KEY no longer works and can be unset.`);
+      return EXIT.ok;
+    }
+  }
+];
+
+// ../../../packages/core-cli/src/commands/keys.ts
+var keyCommands = [
+  {
+    name: "keys create",
+    summary: "Create an API key for scripts and CI",
+    usage: "<name> keys create <name>",
+    run: async (c, a) => {
+      const name = a.positionals.join(" ").trim();
+      if (!name) throw new CliError(EXIT.usage, "usage", `Missing the key's name.
+Usage: ${c.product.name} keys create <name>`);
+      const { body } = await c.client().request("POST", "/api/keys", { body: { name } });
+      if (c.json) c.io.out(JSON.stringify(body, null, 2));
+      else c.io.out([`Created key ${body.keyId} (${body.name}):`, `  ${body.key}`, `This key is shown only once. Set it as ${c.product.envPrefix}_API_KEY.`].join("\n"));
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "keys list",
+    summary: "List your API keys (never their secrets)",
+    usage: "<name> keys list",
+    run: async (c) => {
+      const { body } = await c.client().request("GET", "/api/keys");
+      if (c.json) c.io.out(JSON.stringify(body, null, 2));
+      else c.io.out(body.data.length ? table([["ID", "NAME", "KEY", "CREATED"], ...body.data.map((k) => [k.keyId, k.name, k.display, when(k.createdAt)])]) : "No API keys.");
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "keys revoke",
+    summary: "Revoke an API key",
+    usage: "<name> keys revoke <key-id>",
+    run: async (c, a) => {
+      const id = required(a.positionals, "the key id", `${c.product.name} keys revoke <key-id>`);
+      await c.client().request("DELETE", `/api/keys/${encodeURIComponent(id)}`);
+      c.io.out(c.json ? JSON.stringify({ revoked: id }, null, 2) : `Revoked ${id}`);
+      return EXIT.ok;
+    }
+  }
+];
+
+// ../../../packages/core-cli/src/commands/billing.ts
+var PACKS = ["5", "20"];
+var SHOWN_ENTRIES = 10;
+var billingCommands = [
+  {
+    name: "balance",
+    summary: "Balance, refundable credit and recent activity",
+    usage: "<name> balance",
+    run: async (c) => {
+      const { body: b } = await c.client().request("GET", "/api/billing");
+      if (c.json) {
+        c.io.out(JSON.stringify(b, null, 2));
+        return EXIT.ok;
+      }
+      const lines = [
+        `Balance: ${formatUsd(b.balanceMicros)}${b.status === "ok" ? "" : ` (${b.status})`}`,
+        `Refundable: ${formatUsd(b.refundableMicros)} (unused paid credit)`,
+        ...b.refundMode === "review" ? ["Refunds: reviewed by support"] : [],
+        `Automatic top-up: ${b.autoTopUp === "coming_soon" ? "not yet available" : b.autoTopUp}`
+      ];
+      if (b.entries.length) {
+        lines.push("", "Recent activity:", table([["WHEN", "TYPE", "AMOUNT", "REASON"], ...b.entries.slice(0, SHOWN_ENTRIES).map((e) => [when(e.createdAt), e.type, formatUsd(e.amountMicros), e.reason ?? ""])]));
+      }
+      const banner = balanceBanner(c.product, b.status, b.balanceMicros);
+      if (banner) lines.push("", banner);
+      c.io.out(lines.join("\n"));
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "refund",
+    summary: "Refund unused paid credit to your payment method",
+    usage: "<name> refund [--yes]",
+    options: { yes: { type: "boolean" } },
+    run: async (c, a) => {
+      const client = c.client();
+      const { body: b } = await client.request("GET", "/api/billing");
+      if (b.refundableMicros <= 0) throw new CliError(EXIT.notFound, "nothing_refundable", "No credit is refundable. Unused paid credit is refundable; used credit and granted credit are not.");
+      if (a.values.yes !== true) {
+        if (!c.io.isTty || c.json) throw new CliError(EXIT.usage, "usage", "Add --yes to refund without a prompt.");
+        const question = b.refundMode === "review" ? `Refunds for this email address are reviewed by support. Request a review of a ${formatUsd(b.refundableMicros)} refund? [y/N] ` : `Refund ${formatUsd(b.refundableMicros)} to your original payment method? [y/N] `;
+        const answer = (await c.prompt(question)).trim().toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+          c.io.out("Cancelled.");
+          return EXIT.ok;
+        }
+      }
+      const { body } = await client.request("POST", "/api/billing/refund", { body: {} });
+      if (c.json) {
+        c.io.out(JSON.stringify(body, null, 2));
+        return EXIT.ok;
+      }
+      c.io.out(body.status === "refunded" ? `Refunded ${formatUsd(body.refundedMicros)} to your original payment method. Refunds can take a few days to appear.` : "Refund request recorded. Refunds for this email address are reviewed by support; the result is sent by email.");
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "topup",
+    summary: "Buy credit: opens a checkout ($5 or $20)",
+    usage: "<name> topup [5|20]",
+    run: async (c, a) => {
+      const pack = a.positionals[0] ?? "5";
+      if (!PACKS.includes(pack)) throw new CliError(EXIT.usage, "usage", `Choose a pack: ${PACKS.join(" or ")} (dollars).`);
+      const { body } = await c.client().request("POST", "/api/billing/checkout", { body: { pack } });
+      if (c.json) {
+        c.io.out(JSON.stringify(body, null, 2));
+        return EXIT.ok;
+      }
+      c.io.out(`Checkout for the $${pack} pack: ${body.url}`);
+      if (c.io.isTty) await c.openUrl(body.url);
+      return EXIT.ok;
+    }
+  }
+];
+
+// ../../../packages/core-cli/src/commands/admin.ts
+var enc3 = encodeURIComponent;
+var GRANT_ATTEMPTS = 3;
+var adminCommands = [
+  {
+    name: "admin grant",
+    summary: "Give an account free credit",
+    usage: "<name> admin grant <account> <amount> <reason...> [--idempotency-key K]",
+    hidden: true,
+    options: { "idempotency-key": { type: "string" } },
+    run: async (c, a) => {
+      const [account, amount, ...words] = a.positionals;
+      const reason = words.join(" ").trim();
+      if (!account || !amount || !reason) throw new CliError(EXIT.usage, "usage", `Usage: ${c.product.name} admin grant <account> <amount> <reason...>`);
+      const amountMicros = parseUsd(amount, { positive: true });
+      const client = await c.adminClient();
+      const key = a.values["idempotency-key"] ?? `grant-${c.randomId()}`;
+      let r;
+      for (let attempt = 1; !r; attempt++) {
+        try {
+          r = await client.request("POST", `/api/admin/accounts/${enc3(account)}/grant`, { auth: "admin", headers: { "idempotency-key": key }, body: { amountMicros, reason } });
+        } catch (e) {
+          if (!(e instanceof CliError) || e.exitCode !== EXIT.error || attempt >= GRANT_ATTEMPTS) throw e;
+          await c.sleep(1e3 * attempt);
+        }
+      }
+      if (c.json) c.io.out(JSON.stringify(r.body, null, 2));
+      else c.io.out(`Granted ${formatUsd(amountMicros)} to ${account}. Balance: ${formatUsd(r.body.balanceMicros)}${r.body.replayed ? " (already applied)" : ""}`);
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "admin refund",
+    summary: "Refund an account's unused paid credit (no self-serve limit)",
+    usage: "<name> admin refund <account> [amount] [--yes]",
+    hidden: true,
+    options: { yes: { type: "boolean" } },
+    run: async (c, a) => {
+      const [account, amount] = a.positionals;
+      if (!account) throw new CliError(EXIT.usage, "usage", `Usage: ${c.product.name} admin refund <account> [amount] [--yes]`);
+      const client = await c.adminClient();
+      const path = `/api/admin/accounts/${enc3(account)}/refund`;
+      const { body: preview } = await client.request("GET", path, { auth: "admin" });
+      if (preview.refundableMicros <= 0) {
+        c.io.out(c.json ? JSON.stringify(preview, null, 2) : `Nothing to refund for ${account}.`);
+        return EXIT.ok;
+      }
+      const want = amount === void 0 ? preview.refundableMicros : parseUsd(amount, { positive: true });
+      if (want > preview.refundableMicros) throw new CliError(EXIT.usage, "too_much", `At most ${formatUsd(preview.refundableMicros)} is refundable.`);
+      if (!c.json) c.io.out(`Refundable: ${formatUsd(preview.refundableMicros)}`);
+      if (a.values.yes !== true) {
+        if (!c.io.isTty || c.json) throw new CliError(EXIT.usage, "usage", "Add --yes to refund without a prompt.");
+        const answer = (await c.prompt(`Refund ${formatUsd(want)} to ${account}? [y/N] `)).trim().toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+          c.io.out("Cancelled.");
+          return EXIT.ok;
+        }
+      }
+      const { body } = await client.request("POST", path, { auth: "admin", body: amount === void 0 ? {} : { amountMicros: want } });
+      if (c.json) {
+        c.io.out(JSON.stringify(body, null, 2));
+        return EXIT.ok;
+      }
+      c.io.out([
+        `Refunded ${formatUsd(body.refundedMicros)} to ${account} (${body.refunds.map((r) => `${r.refundId} for ${r.orderId}`).join(", ") || "no refunds"}).`,
+        ...body.refusedMicros > 0 ? [`Polar refused ${formatUsd(body.refusedMicros)}; it stays on the account as credit.`] : []
+      ].join("\n"));
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "admin refunds pending",
+    summary: "Refund requests waiting for review",
+    usage: "<name> admin refunds pending",
+    hidden: true,
+    run: async (c) => {
+      const client = await c.adminClient();
+      const { body } = await client.request("GET", "/api/admin/refund-reviews", { auth: "admin" });
+      if (c.json) {
+        c.io.out(JSON.stringify(body, null, 2));
+        return EXIT.ok;
+      }
+      c.io.out(body.data.length ? table([["ACCOUNT", "EMAIL", "REFUNDABLE", "REQUESTED"], ...body.data.map((r) => [r.accountId, r.email, formatUsd(r.refundableMicros), r.requestedAt])]) : "No refund requests are waiting for review.");
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "admin cap",
+    summary: "Set an account's watch limit",
+    usage: "<name> admin cap <account> <n>",
+    hidden: true,
+    run: async (c, a) => {
+      const [account, n] = a.positionals;
+      if (!account || !n || !/^\d+$/.test(n) || Number(n) < 1) throw new CliError(EXIT.usage, "usage", `Usage: ${c.product.name} admin cap <account> <n> (n a whole number, at least 1)`);
+      const client = await c.adminClient();
+      const { body } = await client.request("POST", `/api/admin/accounts/${enc3(account)}/cap`, { auth: "admin", body: { maxWatches: Number(n) } });
+      c.io.out(c.json ? JSON.stringify(body, null, 2) : `${account} can now have ${body.maxWatches} watches.`);
+      return EXIT.ok;
+    }
+  },
+  {
+    name: "admin account show",
+    summary: "Look up an account by email",
+    usage: "<name> admin account show <email>",
+    hidden: true,
+    run: async (c, a) => {
+      const email = a.positionals[0];
+      if (!email) throw new CliError(EXIT.usage, "usage", `Usage: ${c.product.name} admin account show <email>`);
+      const client = await c.adminClient();
+      const { body: s } = await client.request(
+        "GET",
+        "/api/admin/accounts",
+        { auth: "admin", query: { email } }
+      );
+      if (c.json) {
+        c.io.out(JSON.stringify(s, null, 2));
+        return EXIT.ok;
+      }
+      c.io.out([
+        `${s.email} (${s.accountId})`,
+        `Balance: ${formatUsd(s.balanceMicros)} (${s.status})`,
+        `Watches: ${s.watches.count} of ${s.watches.max} (${s.watches.free} free)`,
+        `API keys: ${s.keys}`
+      ].join("\n"));
+      return EXIT.ok;
+    }
+  }
+];
+
+// ../../../packages/core-cli/src/index.ts
+var allCommands = [
+  ...authCommands,
+  ...watchCommands,
+  ...channelCommands,
+  ...activityCommands,
+  ...keyCommands,
+  ...accountCommands,
+  ...billingCommands,
+  ...adminCommands
+];
+
+// src/product.ts
+var lapsedCli = {
+  name: "lapsed",
+  displayName: "Lapsed",
+  envPrefix: "LAPSED",
+  defaultApiUrl: "https://lapsed.dev",
+  version: true ? "0.1.0" : "0.0.0-dev",
+  watchKinds: ["host", "domain"],
+  examples: [
+    "lapsed login",
+    "lapsed add example.com api.example.com",
+    "lapsed channels add https://hooks.slack.com/services/\u2026",
+    "lapsed channels test"
+  ]
+};
+
+// src/main.ts
+function openUrl(url) {
+  if (!/^https?:\/\//.test(url)) return Promise.resolve(false);
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  return new Promise((resolve) => {
+    try {
+      const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+      child.once("error", () => resolve(false));
+      child.once("spawn", () => {
+        child.unref();
+        resolve(true);
+      });
+    } catch {
+      resolve(false);
+    }
+  });
+}
+async function prompt(question, opts = {}) {
+  const stdin = process.stdin;
+  if (!opts.hidden || !stdin.isTTY) {
+    const rl = createInterface({ input: stdin, output: process.stderr });
+    try {
+      return await rl.question(question);
+    } finally {
+      rl.close();
+    }
+  }
+  process.stderr.write(question);
+  stdin.setRawMode(true);
+  stdin.resume();
+  stdin.setEncoding("utf8");
+  return new Promise((resolve) => {
+    let value = "";
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === "\r" || ch === "\n") {
+          done();
+          return;
+        }
+        if (ch === "") {
+          process.stderr.write("\n");
+          process.exit(130);
+        }
+        if (ch === "\x7F" || ch === "\b") value = value.slice(0, -1);
+        else value += ch;
+      }
+    };
+    const done = () => {
+      stdin.off("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+      process.stderr.write("\n");
+      resolve(value);
+    };
+    stdin.on("data", onData);
+  });
+}
+var ctx = {
+  env: process.env,
+  io: {
+    out: (s) => {
+      process.stdout.write(`${s}
+`);
+    },
+    err: (s) => {
+      process.stderr.write(`${s}
+`);
+    },
+    isTty: Boolean(process.stdout.isTTY && process.stdin.isTTY),
+    color: Boolean(process.stdout.isTTY) && !process.env.NO_COLOR
+  },
+  fetch: globalThis.fetch,
+  platform: process.platform,
+  homedir: homedir(),
+  hostname: hostname(),
+  openUrl,
+  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  now: () => /* @__PURE__ */ new Date(),
+  prompt,
+  randomId: () => randomUUID()
+};
+process.exitCode = await defineCli(lapsedCli, allCommands)(process.argv.slice(2), ctx);

package/package.json

@@ -1,6 +1,35 @@
 {
   "name": "lapsed",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Know before your SSL certificates and domains lapse. The Lapsed CLI.",
+  "license": "MIT",
+  "homepage": "https://lapsed.dev",
+  "keywords": [
+    "ssl",
+    "tls",
+    "certificate",
+    "domain",
+    "expiry",
+    "monitoring",
+    "cli"
+  ],
+  "type": "module",
+  "bin": {
+    "lapsed": "dist/lapsed.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "node scripts/build.ts",
+    "typecheck": "tsc --noEmit -p ."
+  },
+  "devDependencies": {
+    "@mw/core-cli": "workspace:*"
+  }
+}