nimblybase 0.1.0

package/dist/index.js

@@ -0,0 +1,4165 @@
+#!/usr/bin/env node
+
+// src/args.ts
+import { parseArgs } from "node:util";
+
+// src/errors.ts
+var EXIT = {
+  ok: 0,
+  failed: 1,
+  /** Bad arguments - the user's mistake, and the only case that prints usage. */
+  usage: 2,
+  /** No credential, or one that is no longer valid. Run `nimbly login`. */
+  unauthenticated: 3,
+  notFound: 4,
+  forbidden: 5,
+  /** The API could not be reached at all - a network or an outage, not a no. */
+  unreachable: 6
+};
+var CliError = class extends Error {
+  constructor(message, code = EXIT.failed, hint) {
+    super(message);
+    this.code = code;
+    this.hint = hint;
+  }
+};
+
+// src/args.ts
+function parse(argv) {
+  let parsedArgs;
+  try {
+    parsedArgs = parseArgs({
+      args: argv,
+      allowPositionals: true,
+      // --no-wait and --no-link. Without this, parseArgs in strict mode
+      // rejects them as unknown options, which is a confusing way to learn
+      // that a documented flag does not exist.
+      allowNegative: true,
+      // Unknown flags are an ERROR, not something to pass through. A typo'd
+      // --tokn that silently did nothing would leave somebody debugging an
+      // authentication problem that does not exist.
+      strict: true,
+      options: {
+        json: { type: "boolean", default: false },
+        api: { type: "string" },
+        token: { type: "string" },
+        slug: { type: "string" },
+        tier: { type: "string" },
+        type: { type: "string" },
+        project: { type: "string", short: "p" },
+        file: { type: "string", short: "f" },
+        prefix: { type: "string" },
+        table: { type: "string" },
+        role: { type: "string" },
+        name: { type: "string" },
+        value: { type: "string" },
+        output: { type: "string", short: "o" },
+        dir: { type: "string" },
+        spa: { type: "boolean" },
+        build: { type: "boolean" },
+        "token-only": { type: "boolean" },
+        off: { type: "boolean" },
+        using: { type: "string" },
+        check: { type: "string" },
+        "using-file": { type: "string" },
+        "check-file": { type: "string" },
+        as: { type: "string" },
+        "as-user": { type: "string" },
+        where: { type: "string", multiple: true },
+        select: { type: "string" },
+        order: { type: "string" },
+        since: { type: "string" },
+        level: { type: "string" },
+        route: { type: "string" },
+        origin: { type: "string" },
+        search: { type: "string" },
+        user: { type: "string" },
+        id: { type: "string" },
+        cursor: { type: "string" },
+        public: { type: "boolean" },
+        "per-user": { type: "boolean" },
+        adopt: { type: "boolean" },
+        limit: { type: "string" },
+        model: { type: "string" },
+        "max-tokens": { type: "string" },
+        // Repeatable so values stay OUT of the statement. A CLI whose only
+        // option is to paste them in teaches everybody to write injectable
+        // SQL.
+        param: { type: "string", multiple: true },
+        "allow-destructive": { type: "boolean", default: false },
+        wait: { type: "boolean", default: true },
+        link: { type: "boolean", default: true },
+        relink: { type: "boolean", default: false },
+        yes: { type: "boolean", short: "y", default: false },
+        "with-token": { type: "boolean", default: false },
+        help: { type: "boolean", short: "h", default: false },
+        version: { type: "boolean", short: "v", default: false }
+      }
+    });
+  } catch (err) {
+    throw new CliError(
+      err instanceof Error ? err.message : "Could not read those arguments.",
+      EXIT.usage,
+      "Run `nimbly help` to see the commands and their flags."
+    );
+  }
+  const v = parsedArgs.values;
+  return {
+    command: parsedArgs.positionals,
+    flags: {
+      json: v.json === true,
+      api: v.api,
+      token: v.token,
+      slug: v.slug,
+      tier: v.tier,
+      type: v.type,
+      project: v.project,
+      file: v.file,
+      prefix: v.prefix,
+      table: v.table,
+      role: v.role,
+      name: v.name,
+      value: v.value,
+      output: v.output,
+      dir: v.dir,
+      spa: v.spa === true ? true : void 0,
+      build: v.build === true ? true : void 0,
+      tokenOnly: v["token-only"] === true ? true : void 0,
+      off: v.off === true ? true : void 0,
+      using: v.using,
+      check: v.check,
+      usingFile: v["using-file"],
+      checkFile: v["check-file"],
+      as: v.as,
+      asUser: v["as-user"],
+      where: v.where,
+      select: v.select,
+      order: v.order,
+      since: v.since,
+      level: v.level,
+      route: v.route,
+      origin: v.origin,
+      search: v.search,
+      user: v.user,
+      id: v.id,
+      cursor: v.cursor,
+      public: v.public,
+      perUser: v["per-user"],
+      adopt: v.adopt,
+      limit: v.limit === void 0 ? void 0 : Number(v.limit),
+      model: v.model,
+      maxTokens: v["max-tokens"] === void 0 ? void 0 : Number(v["max-tokens"]),
+      params: v.param,
+      allowDestructive: v["allow-destructive"] === true,
+      wait: v.wait,
+      link: v.link,
+      relink: v.relink === true,
+      yes: v.yes === true,
+      withToken: v["with-token"] === true,
+      help: v.help === true,
+      version: v.version === true
+    }
+  };
+}
+var USAGE = `nimblybase - backends for people building with AI
+
+USAGE
+  nimbly <command> [options]
+
+GETTING STARTED
+  login                    Sign in with an access token from the dashboard
+  init [name]              Create or explicitly choose a project for this repo
+  architect [requirements] Inspect this repo and propose a reviewable architecture
+  whoami                   Who you are, where, and which project is linked
+  create <name>            Create a project and link this directory to it
+
+PROJECTS
+  projects                 List the projects in your organization
+  project [ref]            Show one project
+  link [ref]               Point this directory at an existing project
+  pause [ref]              Stop a project answering; data is retained
+  resume [ref]             Start it answering again
+  delete [ref]             Delete a project and everything in it
+
+KEYS
+  keys                     List a project's API keys
+  keys create <name>       Issue a key. Shown once, never again
+  keys revoke <id>         Revoke a key
+
+DATABASE
+  db pull                  Write the live schema to schema.json
+  db status                What db push would change, without changing it
+  db push                  Apply schema.json. Plans and asks first, always
+  db migrations            Schema changes already applied
+  rows <table>             Read a table the way your APP does, with policies
+                           applied. --as anon answers "will my app see this?"
+  sql <statement>          Run one statement. Bypasses policies entirely
+
+POLICIES
+  policies [table]         Who may do what to which rows. A table absent
+                           from this list is closed to anon keys entirely
+  policies allow <table> <select|insert|update|delete>
+                           Open a table to a role
+  policies revoke <id>     Remove a policy
+  logs [project]           Recent requests: what failed, why, and how slow
+  diagnose [project]       Why an app is not working, and what to do about it
+
+FILES
+  files [prefix]           List the project's stored files
+  buckets                  Folders with a policy: who may read and write them
+  buckets create <name>    --public to let anyone read with a URL, --per-user
+                           to give each signed-in user their own space
+  buckets delete <name>    Stop treating it as a bucket. The files stay
+
+YOUR APP'S USERS
+  auth                     Whether people can sign up to YOUR app, and where
+                           (not your NimblyBase account - that is \`login\`)
+  auth enable              Turn on sign-up and sign-in. --origin lists the
+                           origins your app is served from, comma separated
+  auth disable             Stop serving it. Users AND their sessions are kept
+  auth revoke              Sign every user out now and stop the tokens already
+                           issued. Their accounts are untouched
+
+EDGE FUNCTIONS
+  functions                What is deployed, and whether it is live
+  functions deploy <file>  Publish a module to a PUBLIC URL at /fn/<name>
+  functions schedule <name> "<cron>"
+                           Run it on a schedule, UTC. --off to stop
+  functions delete <name>  Remove one
+  secrets                  Environment variables your functions receive
+  secrets set <NAME>       Set one (prompts; the value is never shown again)
+  secrets unset <NAME>     Remove one
+  types [-o file]          Your schema as a TypeScript type, for the SDK
+
+STATIC HOSTING
+  deploy [dir]             Publish a built site. --dir to choose the folder,
+                           --build to run its package script first, --spa if
+                           a client-side router owns the URLs
+  site                     What is deployed
+  site releases            What has been published, and what is live
+  site rollback [id]       Put an earlier release back; no id means the previous one
+  site delete              Stop serving it
+
+MODELS
+  ai <prompt>              Run a model through this project's gateway
+                           --model to choose one, --max-tokens to cap it
+  ai models                What this project can call, and what each is for
+
+CUSTOM DOMAINS
+  domains                  Domains on this project, and the records each needs
+  domains add <domain>     Connect a domain you own. Prints the DNS records
+                           you must create; nothing serves it until you do
+  domains check [domain]   Ask now whether your records have taken effect
+  domains remove <domain>  Disconnect one. Your DNS records are yours to remove
+
+AGENTS
+  mcp [client]             Config for connecting an agent over MCP
+                           claude | cursor | vscode | json
+
+OTHER
+  logout                   Forget the stored token
+  help                     This
+  version                  Print the version
+
+OPTIONS
+  --json                   Machine-readable output on stdout, nothing else
+  --api <url>              Point at a different API
+  -p, --project <ref>      Act on this project instead of the linked one
+  --tier <d1>              Database tier for a new project (default d1; Neon unavailable)
+  --model <name>           Which model the ai command should use (default fast)
+  --max-tokens <n>         Cap the length of a model's answer
+  --type <anon|service>    Key type (default anon)
+  -f, --file <path>        Schema file (default schema.json beside the link)
+  --dir <path>             Repository to inspect, or built directory to publish
+  --param <value>          A value for the next ? in a statement. Repeatable
+  --allow-destructive      Permit a schema change that drops data
+  --prefix <p>, --limit <n>  Narrow a file or log listing
+  --as <anon|authenticated>  Read as this role instead of the service role
+  --as-user <id>           The end-user id, with --as authenticated
+  --where <col>=<op>.<v>   Filter rows. Repeatable. eq, neq, gt, gte, lt,
+                           lte, like, in, is
+  --select <a,b>, --order <col.desc>  Narrow and sort a row listing
+  --role <anon|authenticated>  Who a policy applies to (default anon)
+  --using <expr|true>      Which rows may be seen or touched
+  --check <expr|true>      Which rows may be written
+  --using-file, --check-file <path>  The same, from a file
+  --name <n>               Name the policy (default <role>-<operation>)
+  --since <15m|2h|1d>      How far back to read logs (default 1h, max 7d)
+  --level <info|warn|error>  Only logs at this level or worse
+  --route </v1/sql>        Only logs for one route
+  --no-wait                Do not wait for a new project to finish provisioning
+  --no-link                Do not link the directory after creating a project
+  --relink                 Explicitly replace this repository's project target
+  --with-token             Include the live token in \`mcp\` output
+  -y, --yes                Do not ask for confirmation
+  -h, --help               This
+
+A project can be named by slug or id. Without one, commands use the project
+linked in nimblybase.json - written by \`nimbly link\`, safe to commit, and
+containing no credentials.
+
+ENVIRONMENT
+  NIMBLYBASE_TOKEN         Use this token instead of the stored one (for CI)
+  NIMBLYBASE_API_URL       Default API
+  NIMBLYBASE_NO_KEYCHAIN   Set to 1 to always use the credentials file
+  NO_COLOR                 Disable colour
+`;
+
+// src/output.ts
+import { styleText } from "node:util";
+var jsonMode = false;
+function setJsonMode(on) {
+  jsonMode = on;
+}
+function isJsonMode() {
+  return jsonMode;
+}
+var coloured = () => process.stdout.isTTY === true && !process.env.NO_COLOR && process.env.TERM !== "dumb";
+var paint = (style, text) => coloured() ? styleText(style, text) : text;
+function out(line = "") {
+  if (!jsonMode) process.stdout.write(`${line}
+`);
+}
+function note(line) {
+  process.stderr.write(`${line}
+`);
+}
+function json(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function table(headers, rows2) {
+  if (rows2.length === 0) return;
+  const widths = headers.map((h, i) => Math.max(h.length, ...rows2.map((r) => (r[i] ?? "").length)));
+  const line = (cells) => cells.map((c, i) => i === cells.length - 1 ? c : c.padEnd(widths[i])).join("  ").trimEnd();
+  out(paint("dim", line(headers.map((h) => h.toUpperCase()))));
+  for (const row of rows2) out(line(row));
+}
+function when(iso) {
+  if (!iso) return "-";
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return "-";
+  const days = Math.round((Date.now() - d.getTime()) / 864e5);
+  if (days === 0) return d.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" });
+  if (days === 1) return "yesterday";
+  if (days < 30) return `${days}d ago`;
+  return d.toISOString().slice(0, 10);
+}
+
+// src/api.ts
+var DEFAULT_API_URL = "https://api-uat.nimblybase.com";
+var VERSION = "0.1.0";
+function dashboardUrl(api) {
+  const match = /^https:\/\/api(-[a-z0-9]+)?\.(.+)$/.exec(api);
+  return match ? `https://app${match[1] ?? ""}.${match[2]}` : null;
+}
+function apiUrl(override) {
+  return (override ?? process.env.NIMBLYBASE_API_URL ?? DEFAULT_API_URL).replace(/\/+$/, "");
+}
+async function request(base, token, path, init2 = {}) {
+  let res;
+  try {
+    res = await fetch(`${base}${path}`, {
+      ...init2,
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...init2.body ? { "content-type": "application/json" } : {},
+        // Identifies the CLI in the API's logs. Version included so a bug
+        // report can be tied to a build without asking.
+        "user-agent": `nimblybase-cli/${VERSION} node/${process.versions.node}`,
+        ...init2.headers
+      },
+      signal: AbortSignal.timeout(init2.timeoutMs ?? 3e4)
+    });
+  } catch (err) {
+    throw new CliError(
+      `Could not reach ${base}`,
+      EXIT.unreachable,
+      err instanceof Error && err.name === "TimeoutError" ? `The request timed out after ${Math.round((init2.timeoutMs ?? 3e4) / 1e3)} seconds.` : "Check your connection, or NIMBLYBASE_API_URL if you have set it."
+    );
+  }
+  if (res.status === 204) return void 0;
+  const text = await res.text();
+  const body = text ? safeJson(text) : null;
+  if (!res.ok) throw explain(res.status, body);
+  return body;
+}
+function safeJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+function explain(status4, body) {
+  const message = body?.message ?? body?.error ?? `Request failed (${status4}).`;
+  if (status4 === 401) {
+    return new CliError(message, EXIT.unauthenticated, "Run `nimbly login` to sign in again.");
+  }
+  if (body?.error === "session_required") {
+    return new CliError(
+      message,
+      EXIT.forbidden,
+      "Access tokens deliberately cannot manage access tokens - otherwise a leaked one could mint replacements."
+    );
+  }
+  if (status4 === 403) {
+    return new CliError(message, EXIT.forbidden);
+  }
+  if (status4 === 404) {
+    return new CliError(message, EXIT.notFound);
+  }
+  if (status4 === 503) {
+    return new CliError(
+      message,
+      EXIT.unreachable,
+      "The environment may be asleep. UAT scales to zero outside working hours."
+    );
+  }
+  return new CliError(message, EXIT.failed);
+}
+function createClient(base, token) {
+  const req = (path, init2) => request(base, token, path, init2);
+  return {
+    me: () => req("/v1/me"),
+    organizations: () => req("/v1/organizations"),
+    invitations: () => req("/v1/me/invitations"),
+    projects: () => req("/v1/projects"),
+    project: (id) => req(`/v1/projects/${id}`),
+    createProject: (input) => req("/v1/projects", { method: "POST", body: JSON.stringify(input) }),
+    bootstrap: (input) => req("/v1/bootstrap", { method: "POST", body: JSON.stringify(input) }),
+    deleteProject: (id) => req(`/v1/projects/${id}`, { method: "DELETE" }),
+    pauseProject: (id) => req(`/v1/projects/${id}/pause`, { method: "POST", body: "{}" }),
+    resumeProject: (id) => req(`/v1/projects/${id}/resume`, { method: "POST", body: "{}" }),
+    keys: (projectId) => req(`/v1/projects/${projectId}/keys`),
+    createKey: (projectId, input) => req(
+      `/v1/projects/${projectId}/keys`,
+      { method: "POST", body: JSON.stringify(input) }
+    ),
+    revokeKey: (keyId) => req(`/v1/keys/${keyId}`, { method: "DELETE" }),
+    // --- project data ---------------------------------------------------
+    // Responses are passed through from the project's own API untouched, so
+    // they are typed loosely here on purpose: restating the Worker's shapes
+    // in the CLI would be a second definition that could disagree with the
+    // one that actually produces them.
+    schema: (id) => req(`/v1/projects/${id}/schema`),
+    migrations: (id) => req(`/v1/projects/${id}/migrations`),
+    planSchema: (id, schema, lineage) => req(`/v1/projects/${id}/schema/plan`, {
+      method: "POST",
+      body: JSON.stringify({ schema, ...lineage ? { lineage } : {} })
+    }),
+    applySchema: (id, schema, allowDestructive, lineage, expectedRevision) => req(`/v1/projects/${id}/schema/apply`, {
+      method: "POST",
+      body: JSON.stringify({
+        schema,
+        allowDestructive,
+        ...lineage ? { lineage } : {},
+        ...expectedRevision ? { expectedRevision } : {}
+      })
+    }),
+    sql: (id, sql2, params) => req(`/v1/projects/${id}/sql`, { method: "POST", body: JSON.stringify({ sql: sql2, params }) }),
+    diagnose: (id) => req(`/v1/projects/${id}/diagnose`),
+    buckets: (id) => req(`/v1/projects/${id}/buckets`),
+    putBucket: (id, name, body) => req(
+      `/v1/projects/${id}/buckets/${encodeURIComponent(name)}`,
+      { method: "PUT", body: JSON.stringify(body) }
+    ),
+    deleteBucket: (id, name) => req(
+      `/v1/projects/${id}/buckets/${encodeURIComponent(name)}`,
+      { method: "DELETE" }
+    ),
+    authStatus: (id) => req(`/v1/projects/${id}/auth`),
+    enableAuth: (id, trustedOrigins) => req(`/v1/projects/${id}/auth`, {
+      method: "POST",
+      body: JSON.stringify(trustedOrigins?.length ? { trustedOrigins } : {})
+    }),
+    disableAuth: (id) => req(`/v1/projects/${id}/auth`, { method: "DELETE" }),
+    revokeAuthSessions: (id) => req(
+      `/v1/projects/${id}/auth/revoke`,
+      { method: "POST" }
+    ),
+    authUsers: (id, q = {}) => {
+      const params = new URLSearchParams();
+      if (q.limit !== void 0) params.set("limit", String(q.limit));
+      if (q.cursor) params.set("cursor", q.cursor);
+      if (q.search) params.set("search", q.search);
+      const query2 = params.toString();
+      return req(
+        `/v1/projects/${id}/auth/users${query2 ? `?${query2}` : ""}`
+      );
+    },
+    revokeAuthUser: (id, userId) => req(
+      `/v1/projects/${id}/auth/users/${encodeURIComponent(userId)}/revoke`,
+      { method: "POST" }
+    ),
+    describeProject: (id) => req(`/v1/projects/${id}/describe`),
+    accessTokens: () => req("/v1/me/tokens"),
+    revokeAccessToken: (id) => req(`/v1/me/tokens/${encodeURIComponent(id)}`, { method: "DELETE" }),
+    queryVectors: (id, body) => req(
+      `/v1/projects/${id}/vectors/query`,
+      { method: "POST", body: JSON.stringify(body) }
+    ),
+    upsertVectors: (id, vectors) => req(
+      `/v1/projects/${id}/vectors`,
+      { method: "POST", body: JSON.stringify({ vectors }) }
+    ),
+    functions: (id) => req(`/v1/projects/${id}/functions`),
+    deployFunction: (id, name, source2) => req(
+      `/v1/projects/${id}/functions`,
+      { method: "POST", body: JSON.stringify({ name, source: source2 }) }
+    ),
+    scheduleFunction: (id, name, schedule2) => req(
+      `/v1/projects/${id}/functions/${encodeURIComponent(name)}/schedule`,
+      { method: "POST", body: JSON.stringify({ schedule: schedule2 }) }
+    ),
+    deleteFunction: (id, name) => req(`/v1/projects/${id}/functions/${encodeURIComponent(name)}`, { method: "DELETE" }),
+    aiModels: (id) => req(`/v1/projects/${id}/ai/models`),
+    aiChat: (id, body) => req(`/v1/projects/${id}/ai/chat`, { method: "POST", body: JSON.stringify(body) }),
+    domains: (id) => req(`/v1/projects/${id}/domains`),
+    addDomain: (id, domain) => req(`/v1/projects/${id}/domains`, {
+      method: "POST",
+      body: JSON.stringify({ domain })
+    }),
+    checkDomain: (id, domainId) => req(
+      `/v1/projects/${id}/domains/${encodeURIComponent(domainId)}/check`,
+      { method: "POST" }
+    ),
+    deleteDomain: (id, domainId) => req(
+      `/v1/projects/${id}/domains/${encodeURIComponent(domainId)}`,
+      { method: "DELETE" }
+    ),
+    // No `getSecret`. There is no endpoint behind one, and a method here
+    // would be a standing invitation to add it.
+    site: (id) => req(
+      `/v1/projects/${id}/site`
+    ),
+    planSite: (id, manifest) => req(`/v1/projects/${id}/site/plan`, {
+      method: "POST",
+      body: JSON.stringify(manifest)
+    }),
+    // Raw bytes rather than a base64 JSON envelope: a third smaller, and the
+    // file is not held in memory twice on the way through.
+    putSiteBlob: (id, hash, bytes) => req(
+      `/v1/projects/${id}/site/blob/${encodeURIComponent(hash)}`,
+      {
+        method: "PUT",
+        body: bytes,
+        headers: { "content-type": "application/octet-stream" },
+        // A 25MB file on a hotel connection takes longer than a query.
+        timeoutMs: 12e4
+      }
+    ),
+    commitSite: (id, manifest) => req(`/v1/projects/${id}/site/commit`, {
+      method: "POST",
+      body: JSON.stringify(manifest)
+    }),
+    siteReleases: (id) => req(
+      `/v1/projects/${id}/site/releases`
+    ),
+    rollbackSite: (id, release) => req(
+      `/v1/projects/${id}/site/rollback/${encodeURIComponent(release)}`,
+      { method: "POST", body: "{}" }
+    ),
+    deleteSite: (id) => req(`/v1/projects/${id}/site`, { method: "DELETE" }),
+    secrets: (id) => req(`/v1/projects/${id}/secrets`),
+    setSecret: (id, name, value) => req(`/v1/projects/${id}/secrets`, {
+      method: "POST",
+      body: JSON.stringify({ name, value })
+    }),
+    deleteSecret: (id, name) => req(
+      `/v1/projects/${id}/secrets/${encodeURIComponent(name)}`,
+      { method: "DELETE" }
+    ),
+    rows: (id, table2, query2) => req(`/v1/projects/${id}/rows/${encodeURIComponent(table2)}${query2}`),
+    policies: (id, table2) => req(`/v1/projects/${id}/policies${table2 ? `?table=${encodeURIComponent(table2)}` : ""}`),
+    putPolicy: (id, policy) => req(`/v1/projects/${id}/policies`, { method: "POST", body: JSON.stringify(policy) }),
+    deletePolicy: (id, policyId) => req(`/v1/projects/${id}/policies/${policyId}`, { method: "DELETE" }),
+    logs: (id, query2) => {
+      const search = new URLSearchParams();
+      if (query2.since) search.set("since", String(parseSince(query2.since)));
+      if (query2.level) search.set("level", query2.level);
+      if (query2.route) search.set("route", query2.route);
+      if (query2.limit !== void 0) search.set("limit", String(query2.limit));
+      const suffix = search.toString();
+      return req(`/v1/projects/${id}/logs${suffix ? `?${suffix}` : ""}`);
+    },
+    files: (id, query2) => {
+      const search = new URLSearchParams();
+      if (query2.prefix) search.set("prefix", query2.prefix);
+      if (query2.limit !== void 0) search.set("limit", String(query2.limit));
+      const suffix = search.toString();
+      return req(`/v1/projects/${id}/files${suffix ? `?${suffix}` : ""}`);
+    }
+  };
+}
+function parseSince(value, fallbackMinutes = 60) {
+  const match = /^(\d{1,5})\s*(m|min|h|hr|hour|d|day)s?$/i.exec(value.trim());
+  if (!match) return fallbackMinutes;
+  const n = Number(match[1]);
+  const unit = match[2].toLowerCase()[0];
+  return unit === "m" ? n : unit === "h" ? n * 60 : n * 60 * 24;
+}
+
+// src/oauth.ts
+import { createServer } from "node:http";
+import { randomBytes, createHash } from "node:crypto";
+import { spawn } from "node:child_process";
+var CALLBACK_PATH = "/callback";
+var REGISTERED_REDIRECT = `http://127.0.0.1${CALLBACK_PATH}`;
+var LOGIN_TIMEOUT_MS = 5 * 6e4;
+var b64url = (b) => b.toString("base64url");
+function pkcePair() {
+  const verifier = b64url(randomBytes(32));
+  return { verifier, challenge: b64url(createHash("sha256").update(verifier).digest()) };
+}
+async function discover(issuer, fetchImpl = fetch) {
+  const url = new URL("/.well-known/oauth-authorization-server", issuer).toString();
+  const res = await fetchImpl(url);
+  if (!res.ok) {
+    throw new Error(`${issuer} does not advertise an authorization server (${res.status} from ${url})`);
+  }
+  const doc = await res.json();
+  if (!doc.authorization_endpoint || !doc.token_endpoint) {
+    throw new Error("the authorization server metadata is missing an endpoint this flow needs");
+  }
+  return doc;
+}
+async function registerClient(registrationEndpoint, fetchImpl = fetch) {
+  const res = await fetchImpl(registrationEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: "NimblyBase CLI",
+      redirect_uris: [REGISTERED_REDIRECT],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none"
+    })
+  });
+  const body = await res.json();
+  if (!res.ok || !body.client_id) {
+    throw new Error(`could not register this CLI: ${body.error_description ?? body.error ?? res.status}`);
+  }
+  return body.client_id;
+}
+function listenForCode(state2) {
+  let resolvePort;
+  let resolveAddress;
+  let resolveCode;
+  let rejectCode;
+  const port = new Promise((r) => {
+    resolvePort = r;
+  });
+  const address = new Promise((r) => {
+    resolveAddress = r;
+  });
+  const code = new Promise((r, j) => {
+    resolveCode = r;
+    rejectCode = j;
+  });
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== CALLBACK_PATH) {
+      res.writeHead(404).end("Not found");
+      return;
+    }
+    const say = (title, detail) => {
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(`<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font:16px/1.5 system-ui;max-width:32rem;margin:15vh auto;padding:0 1rem"><h1 style="font-size:1.25rem">${title}</h1><p>${detail}</p>`);
+    };
+    const error = url.searchParams.get("error");
+    if (error) {
+      say("Sign-in cancelled", "Nothing was granted. You can close this tab.");
+      rejectCode(new Error(error === "access_denied" ? "you cancelled the sign-in" : error));
+      return;
+    }
+    if (url.searchParams.get("state") !== state2) {
+      say("Sign-in could not be completed", "That response did not match this sign-in attempt.");
+      rejectCode(new Error("the redirect did not match this sign-in attempt"));
+      return;
+    }
+    const got = url.searchParams.get("code");
+    if (!got) {
+      say("Sign-in could not be completed", "No authorization code came back.");
+      rejectCode(new Error("no authorization code came back"));
+      return;
+    }
+    say("Signed in", "You can close this tab and go back to your terminal.");
+    resolveCode(got);
+  });
+  server.listen(0, "127.0.0.1", () => {
+    const bound = server.address();
+    resolvePort(bound.port);
+    resolveAddress(bound.address);
+  });
+  return { port, address, code, close: () => server.close() };
+}
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+async function exchange(input, fetchImpl = fetch) {
+  const res = await fetchImpl(input.tokenEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: input.clientId,
+      code: input.code,
+      code_verifier: input.verifier,
+      redirect_uri: input.redirectUri
+    }).toString()
+  });
+  const body = await res.json();
+  if (!res.ok) throw new Error(`the sign-in could not be completed (${body.error ?? res.status})`);
+  return {
+    accessToken: String(body.access_token),
+    refreshToken: String(body.refresh_token),
+    // Ours, not theirs: a clock ahead of the server's shortens the
+    // window, which is the direction that fails safe.
+    expiresAt: Date.now() + Number(body.expires_in ?? 900) * 1e3,
+    clientId: input.clientId,
+    scopes: String(body.scope ?? "").split(" ").filter(Boolean)
+  };
+}
+async function refreshGrant(input, fetchImpl = fetch) {
+  const res = await fetchImpl(input.tokenEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: input.clientId,
+      refresh_token: input.refreshToken
+    }).toString()
+  });
+  const body = await res.json();
+  if (!res.ok) throw new Error(String(body.error ?? res.status));
+  return {
+    accessToken: String(body.access_token),
+    refreshToken: String(body.refresh_token),
+    expiresAt: Date.now() + Number(body.expires_in ?? 900) * 1e3,
+    clientId: input.clientId,
+    scopes: String(body.scope ?? "").split(" ").filter(Boolean)
+  };
+}
+async function browserLogin(input) {
+  const doc = await discover(input.issuer);
+  if (!input.clientId && !doc.registration_endpoint) {
+    throw new Error("this server does not offer client registration, so the CLI cannot sign itself in");
+  }
+  const clientId = input.clientId ?? await registerClient(doc.registration_endpoint);
+  const { verifier, challenge } = pkcePair();
+  const state2 = b64url(randomBytes(16));
+  const listener = listenForCode(state2);
+  const port = await listener.port;
+  const redirectUri = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+  const authorize = new URL(doc.authorization_endpoint);
+  for (const [k, v] of Object.entries({
+    response_type: "code",
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state: state2
+  })) authorize.searchParams.set(k, v);
+  input.announce(authorize.toString());
+  input.open(authorize.toString());
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error("timed out waiting for the browser")),
+      input.timeoutMs ?? LOGIN_TIMEOUT_MS
+    );
+    timer.unref?.();
+  });
+  timeout.catch(() => {
+  });
+  try {
+    const code = await Promise.race([listener.code, timeout]);
+    return await exchange({
+      tokenEndpoint: doc.token_endpoint,
+      clientId,
+      code,
+      verifier,
+      redirectUri
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+    listener.close();
+  }
+}
+
+// src/credentials.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { mkdir, readFile, writeFile, chmod, rm, stat } from "node:fs/promises";
+var run = promisify(execFile);
+var SERVICE = "nimblybase-cli";
+var ACCOUNT = "access-token";
+function configDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  return xdg ? join(xdg, "nimblybase") : join(homedir(), ".config", "nimblybase");
+}
+var credentialsPath = () => join(configDir(), "credentials.json");
+function keychainAvailable() {
+  return process.platform === "darwin" && process.env.NIMBLYBASE_NO_KEYCHAIN !== "1";
+}
+async function keychainSet(secret) {
+  if (!keychainAvailable()) return false;
+  try {
+    await run("security", [
+      "add-generic-password",
+      "-U",
+      "-a",
+      ACCOUNT,
+      "-s",
+      SERVICE,
+      "-D",
+      "NimblyBase access token",
+      "-w",
+      secret
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function keychainGet() {
+  if (!keychainAvailable()) return null;
+  try {
+    const { stdout } = await run("security", ["find-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-w"]);
+    const value = stdout.trim();
+    return value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function keychainDelete() {
+  if (!keychainAvailable()) return false;
+  try {
+    await run("security", ["delete-generic-password", "-a", ACCOUNT, "-s", SERVICE]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function encodeSecret(value) {
+  return typeof value === "string" ? value : JSON.stringify(value);
+}
+function decodeSecret(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith("{")) return { token: trimmed };
+  try {
+    const parsed = JSON.parse(trimmed);
+    return parsed.refreshToken ? { grant: parsed } : {};
+  } catch {
+    return {};
+  }
+}
+async function fileRead() {
+  try {
+    return JSON.parse(await readFile(credentialsPath(), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function fileWrite(value) {
+  const path = credentialsPath();
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  const body = typeof value === "string" ? { token: value } : { grant: value };
+  await writeFile(path, `${JSON.stringify(body, null, 2)}
+`, { mode: 384 });
+  await chmod(path, 384);
+}
+var credentials = {
+  async save(token) {
+    if (await keychainSet(token)) return "keychain";
+    await fileWrite(token);
+    return "file";
+  },
+  async saveGrant(grant) {
+    if (await keychainSet(encodeSecret(grant))) return "keychain";
+    await fileWrite(grant);
+    return "file";
+  },
+  async load() {
+    const fromEnv = process.env.NIMBLYBASE_TOKEN?.trim();
+    if (fromEnv) return { token: fromEnv, where: "environment" };
+    const fromKeychain = await keychainGet();
+    if (fromKeychain) {
+      const { token, grant } = decodeSecret(fromKeychain);
+      const value2 = token ?? grant?.accessToken;
+      if (value2) return { token: value2, where: "keychain" };
+    }
+    const fromFile = await fileRead();
+    const value = fromFile?.token ?? fromFile?.grant?.accessToken;
+    return value ? { token: value, where: "file" } : null;
+  },
+  async loadGrant() {
+    const fromKeychain = await keychainGet();
+    if (fromKeychain) {
+      const { grant } = decodeSecret(fromKeychain);
+      if (grant) return { grant, where: "keychain" };
+    }
+    const fromFile = await fileRead();
+    return fromFile?.grant ? { grant: fromFile.grant, where: "file" } : null;
+  },
+  async clear() {
+    const cleared = [];
+    if (await keychainDelete()) cleared.push("keychain");
+    try {
+      await stat(credentialsPath());
+      await rm(credentialsPath());
+      cleared.push("file");
+    } catch {
+    }
+    return cleared;
+  }
+};
+
+// src/prompt.ts
+import { createInterface } from "node:readline";
+async function readPipedInput() {
+  if (process.stdin.isTTY) return null;
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  const value = Buffer.concat(chunks).toString("utf8").trim();
+  return value.length > 0 ? value : null;
+}
+function promptSecret(question) {
+  return new Promise((resolve5, reject) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
+    let promptShown = false;
+    const output = rl;
+    const write = output.output.write.bind(output.output);
+    output.output.write = (chunk) => {
+      if (!promptShown) {
+        promptShown = true;
+        return write(chunk);
+      }
+      return true;
+    };
+    rl.question(question, (answer) => {
+      ;
+      output.output.write = write;
+      process.stderr.write("\n");
+      rl.close();
+      resolve5(answer.trim());
+    });
+    rl.on("SIGINT", () => {
+      rl.close();
+      reject(new Error("cancelled"));
+    });
+  });
+}
+async function confirmExact(question, expected) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((r) => rl.question(`${question}
+Type "${expected}" to confirm: `, r));
+    return answer.trim() === expected;
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await new Promise((r) => rl.question(`${question} [y/N] `, r));
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
+// src/link.ts
+import { readFile as readFile2, rename, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { dirname as dirname2, join as join2, parse as parse2, resolve } from "node:path";
+var LINK_FILE = "nimblybase.json";
+var BOOTSTRAP_FILE = ".nimblybase.bootstrap.json";
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isMissing = (err) => isObject(err) && err.code === "ENOENT";
+async function readDocument(path) {
+  let source2;
+  try {
+    source2 = await readFile2(path, "utf8");
+  } catch (err) {
+    if (isMissing(err)) return null;
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(source2);
+  } catch {
+    throw new CliError(
+      `${path} is not valid JSON.`,
+      EXIT.usage,
+      "Repair or remove it before running another project command."
+    );
+  }
+  if (!isObject(parsed)) {
+    throw new CliError(`${path} must contain a JSON object.`, EXIT.usage);
+  }
+  if (typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
+    throw new CliError(
+      `${path} has no "projectId".`,
+      EXIT.usage,
+      "Repair or remove it before running another project command."
+    );
+  }
+  return parsed;
+}
+async function findLink(from = process.cwd()) {
+  let dir = resolve(from);
+  const { root } = parse2(dir);
+  for (; ; ) {
+    const path = join2(dir, LINK_FILE);
+    const parsed = await readDocument(path);
+    if (parsed) {
+      return {
+        projectId: parsed.projectId,
+        slug: typeof parsed.slug === "string" ? parsed.slug : "",
+        apiUrl: typeof parsed.apiUrl === "string" ? parsed.apiUrl : void 0,
+        path
+      };
+    }
+    const parent = dirname2(dir);
+    if (parent === dir || dir === root) return null;
+    dir = parent;
+  }
+}
+async function assertMayCreateLink(dir, options = {}) {
+  const existing = await findLink(dir);
+  if (existing && !options.relink) {
+    throw new CliError(
+      `This repository is already linked to ${existing.slug || existing.projectId}.`,
+      EXIT.usage,
+      "Use --no-link to keep it, or --relink to explicitly replace the target."
+    );
+  }
+}
+async function writeLink(dir, link2, options = {}) {
+  const existing = await findLink(dir);
+  if (existing && existing.projectId !== link2.projectId && !options.relink) {
+    throw new CliError(
+      `This repository is linked to ${existing.slug || existing.projectId}, not ${link2.slug || link2.projectId}.`,
+      EXIT.usage,
+      "Run the command again with --relink to explicitly replace the target."
+    );
+  }
+  const path = existing?.path ?? join2(dir, LINK_FILE);
+  const document = existing ? await readDocument(path) ?? {} : {};
+  const next = {
+    ...document,
+    projectId: link2.projectId,
+    slug: link2.slug
+  };
+  if (link2.apiUrl !== void 0) next.apiUrl = link2.apiUrl;
+  const temporary = join2(dirname2(path), `.${LINK_FILE}.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    await writeFile2(temporary, `${JSON.stringify(next, null, 2)}
+`, { flag: "wx" });
+    await rename(temporary, path);
+  } catch (err) {
+    await rm2(temporary, { force: true });
+    throw err;
+  }
+  return path;
+}
+async function pendingBootstrap(dir, input) {
+  const path = join2(dir, BOOTSTRAP_FILE);
+  try {
+    const saved = JSON.parse(await readFile2(path, "utf8"));
+    if (saved.name === input.name && saved.slug === input.slug && typeof saved.requestId === "string") {
+      return { requestId: saved.requestId, name: saved.name, ...saved.slug ? { slug: saved.slug } : {} };
+    }
+  } catch {
+  }
+  const pending = { requestId: randomUUID(), name: input.name, ...input.slug ? { slug: input.slug } : {} };
+  await writeFile2(path, `${JSON.stringify(pending, null, 2)}
+`);
+  return pending;
+}
+async function clearPendingBootstrap(dir) {
+  await rm2(join2(dir, BOOTSTRAP_FILE), { force: true });
+}
+
+// src/context.ts
+async function context(apiOverride) {
+  const link2 = await findLink();
+  const base = apiUrl(apiOverride ?? process.env.NIMBLYBASE_API_URL ?? link2?.apiUrl);
+  const held = await credentials.loadGrant();
+  if (held && held.grant.expiresAt - Date.now() < 6e4) {
+    try {
+      const fresh = await refreshGrant({
+        tokenEndpoint: new URL("/oauth/token", held.grant.issuer).toString(),
+        clientId: held.grant.clientId,
+        refreshToken: held.grant.refreshToken
+      });
+      await credentials.saveGrant({ ...fresh, issuer: held.grant.issuer });
+    } catch {
+    }
+  }
+  const stored = await credentials.load();
+  if (!stored) {
+    throw new CliError(
+      "Not signed in.",
+      EXIT.unauthenticated,
+      "Run `nimbly login`. Create a token in the dashboard under Access tokens."
+    );
+  }
+  return {
+    client: createClient(base, stored.token),
+    base,
+    tokenFrom: stored.where,
+    isCurrentToken: (prefix) => prefix.length > 0 && stored.token.startsWith(prefix),
+    link: link2
+  };
+}
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolveProject(ctx, ref) {
+  const wanted = ref ?? ctx.link?.projectId;
+  if (!wanted) {
+    throw new CliError(
+      "No project specified and this directory is not linked to one.",
+      EXIT.usage,
+      "Pass a project, or run `nimbly link` here once."
+    );
+  }
+  if (UUID.test(wanted)) {
+    return (await ctx.client.project(wanted)).project;
+  }
+  const { projects } = await ctx.client.projects();
+  const found = projects.find((p) => p.slug === wanted || p.name === wanted);
+  if (!found) {
+    throw new CliError(
+      `No project "${wanted}" in this organization.`,
+      EXIT.notFound,
+      "Run `nimbly projects` to see what exists."
+    );
+  }
+  return found;
+}
+
+// src/commands/auth.ts
+function source(base) {
+  const app = dashboardUrl(base);
+  return app ? `Paste an access token from ${app} \u2192 Access tokens
+(input is hidden): ` : "Paste an access token (Access tokens in the dashboard)\n(input is hidden): ";
+}
+var WHERE_SAID = {
+  keychain: "your login keychain",
+  file: `${credentialsPath()} (permissions 0600)`,
+  environment: "the NIMBLYBASE_TOKEN environment variable"
+};
+async function login(flags) {
+  const base = apiUrl(flags.api);
+  const given = flags.token ?? await readPipedInput();
+  if (!given && !flags.tokenOnly) {
+    const grant = await browserLogin({
+      issuer: base,
+      announce: (url) => {
+        out("Opening your browser to sign in.");
+        note(`If it did not open, go to:
+  ${url}`);
+      },
+      open: openBrowser
+    });
+    const where2 = await credentials.saveGrant({ ...grant, issuer: base });
+    const me2 = await createClient(base, grant.accessToken).me();
+    if (isJsonMode()) {
+      json({ ok: true, storedIn: where2, organization: me2.organization, api: base, scopes: grant.scopes });
+      return;
+    }
+    out(`${paint("green", "\u2713")} Signed in as ${paint("bold", me2.organization?.name ?? "your account")}${me2.organization ? ` (${me2.organization.role})` : ""}`);
+    note(`Granted: ${grant.scopes.join(", ") || "no scopes"}.`);
+    note(`Stored in ${WHERE_SAID[where2]}. It refreshes itself; run \`nimbly logout\` to end it.`);
+    return;
+  }
+  const token = given ?? await promptSecret(source(base));
+  if (!token) throw new CliError("No token given.", EXIT.usage);
+  if (!token.startsWith("nb_pat_")) {
+    throw new CliError(
+      "That does not look like a NimblyBase access token.",
+      EXIT.usage,
+      "Tokens begin with nb_pat_. Create one in the dashboard under Access tokens, or run `nimbly login` with no arguments to sign in through your browser."
+    );
+  }
+  const me = await createClient(base, token).me();
+  const where = await credentials.save(token);
+  if (isJsonMode()) {
+    json({ ok: true, storedIn: where, organization: me.organization, api: base });
+    return;
+  }
+  out(`${paint("green", "\u2713")} Signed in as ${paint("bold", me.organization?.name ?? "your account")}${me.organization ? ` (${me.organization.role})` : ""}`);
+  note(`Token stored in ${WHERE_SAID[where]}.`);
+  if (where === "file" && process.platform === "darwin") {
+    note("The keychain was not available, so a file was used instead.");
+  }
+}
+async function logout() {
+  const cleared = await credentials.clear();
+  if (isJsonMode()) {
+    json({ ok: true, cleared });
+    return;
+  }
+  if (cleared.length === 0) out("Nothing stored - already signed out.");
+  else out(`${paint("green", "\u2713")} Signed out (cleared: ${cleared.join(", ")}).`);
+  if (process.env.NIMBLYBASE_TOKEN) {
+    note("NIMBLYBASE_TOKEN is still set in this shell and takes precedence - unset it too.");
+  }
+}
+async function whoami(flags) {
+  const ctx = await context(flags.api);
+  const me = await ctx.client.me();
+  if (isJsonMode()) {
+    json({ ...me, api: ctx.base, tokenFrom: ctx.tokenFrom, link: ctx.link });
+    return;
+  }
+  table(["", ""], [
+    ["user", me.user.id],
+    ["organization", me.organization ? `${me.organization.name} (${me.organization.slug})` : "-"],
+    ["role", me.organization?.role ?? "-"],
+    ["api", ctx.base],
+    ["token from", ctx.tokenFrom],
+    ["linked project", ctx.link ? `${ctx.link.slug || ctx.link.projectId} \xB7 ${ctx.link.path}` : "none"]
+  ]);
+  out();
+  out(paint("dim", `permissions: ${me.permissions.join(", ") || "none"}`));
+}
+
+// src/boundaries.ts
+var AFTER_CREATE = [
+  "A project is one database, one user pool and one set of keys.",
+  "Clients of the same app share one; a different app needs its own."
+];
+
+// src/commands/projects.ts
+var WAIT_TIMEOUT_MS = 18e4;
+var FIRST_POLL_MS = 500;
+var POLL_GROWTH = 1.5;
+var MAX_POLL_MS = 5e3;
+var statusPaint = (status4) => status4 === "active" ? paint("green", status4) : status4 === "provisioning" ? paint("yellow", status4) : status4 === "failed" ? paint("red", status4) : status4;
+async function list(flags) {
+  const ctx = await context(flags.api);
+  const { projects } = await ctx.client.projects();
+  if (isJsonMode()) {
+    json({ projects });
+    return;
+  }
+  if (projects.length === 0) {
+    out("No projects yet.");
+    note("Create one with `nimbly create <name>`.");
+    return;
+  }
+  table(
+    ["slug", "status", "tier", "created", "url"],
+    projects.map((p) => [
+      p.slug,
+      statusPaint(p.status),
+      p.databaseTier,
+      when(p.createdAt),
+      p.dataPlaneUrl ?? "-"
+    ])
+  );
+}
+async function show(flags, ref) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, ref);
+  if (isJsonMode()) {
+    json({ project });
+    return;
+  }
+  table(["", ""], [
+    ["name", project.name],
+    ["slug", project.slug],
+    ["id", project.id],
+    ["status", statusPaint(project.status)],
+    ["database", project.databaseTier],
+    ["region", project.region],
+    ["created", when(project.createdAt)],
+    ["url", project.dataPlaneUrl ?? "-"]
+  ]);
+}
+async function create(flags, name) {
+  if (!name) throw new CliError("A name is required.", EXIT.usage, 'nimbly create "My App"');
+  const tier = flags.tier ?? "d1";
+  if (tier !== "d1") {
+    throw new CliError(
+      tier === "neon" ? "Neon Postgres is not available yet." : `Unknown database tier "${tier}".`,
+      EXIT.usage,
+      "Use --tier d1."
+    );
+  }
+  const ctx = await context(flags.api);
+  if (flags.link !== false) {
+    await assertMayCreateLink(process.cwd(), { relink: flags.relink });
+  }
+  note(`Creating ${name}\u2026`);
+  const { project } = await ctx.client.createProject({ name, slug: flags.slug, databaseTier: tier });
+  const final = flags.wait === false ? project : await waitForActive(ctx, project);
+  let linkedTo = null;
+  if (flags.link !== false) {
+    linkedTo = await writeLink(process.cwd(), {
+      projectId: final.id,
+      slug: final.slug,
+      ...flags.api ? { apiUrl: flags.api } : {}
+    }, { relink: flags.relink });
+  }
+  if (isJsonMode()) {
+    json({ project: final, linkedTo });
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${final.slug} is ${statusPaint(final.status)}`);
+  if (final.dataPlaneUrl) out(`  ${final.dataPlaneUrl}`);
+  if (linkedTo) note(`Linked this directory (${linkedTo}).`);
+  if (final.status === "active") {
+    note('Next: `nimbly keys create "local dev"` for a key your app can use.');
+  }
+  for (const line of AFTER_CREATE) note(paint("dim", `  ${line}`));
+}
+async function init(flags, name) {
+  if (name && flags.project) {
+    throw new CliError(
+      "Choose an existing project or name a new one, not both.",
+      EXIT.usage,
+      'Use `nimbly init --project <slug>` or `nimbly init "Application name"`.'
+    );
+  }
+  if (flags.slug && !name) {
+    throw new CliError(
+      "--slug is only valid when creating a named project.",
+      EXIT.usage,
+      'Use `nimbly init "Application name" --slug application-name`.'
+    );
+  }
+  if (flags.tier && flags.tier !== "d1") {
+    throw new CliError(
+      flags.tier === "neon" ? "Neon Postgres is not available yet." : `Unknown database tier "${flags.tier}".`,
+      EXIT.usage,
+      "Use --tier d1."
+    );
+  }
+  const ctx = await context(flags.api);
+  const explicitProject = flags.project;
+  const linkedProject = !name && !explicitProject ? ctx.link?.projectId : void 0;
+  if (name && flags.link !== false) {
+    await assertMayCreateLink(process.cwd(), { relink: flags.relink });
+  }
+  const pending = name ? await pendingBootstrap(process.cwd(), {
+    name,
+    ...flags.slug ? { slug: flags.slug } : {}
+  }) : void 0;
+  const request2 = {
+    ...explicitProject || linkedProject ? { project: explicitProject ?? linkedProject } : {},
+    ...name ? { name } : {},
+    ...flags.slug ? { slug: flags.slug } : {},
+    ...pending ? { requestId: pending.requestId } : {}
+  };
+  let result = await ctx.client.bootstrap(request2);
+  if (result.status === "choice_required") {
+    if (isJsonMode()) {
+      json(result);
+      return;
+    }
+    if (result.projects.length === 0) {
+      out("No project exists in this workspace yet.");
+    } else {
+      out("Choose the project that belongs to this repository:");
+      table(
+        ["slug", "name", "status"],
+        result.projects.map((project) => [project.slug, project.name, statusPaint(project.status)])
+      );
+    }
+    for (const action of result.nextActions) note(action.command);
+    return;
+  }
+  if (result.status === "recovering" && flags.wait !== false) {
+    note("The request is recorded; waiting for a recovery worker\u2026");
+    const deadline = Date.now() + WAIT_TIMEOUT_MS;
+    let wait = FIRST_POLL_MS;
+    while (result.status === "recovering" && Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, wait));
+      wait = Math.min(Math.round(wait * POLL_GROWTH), MAX_POLL_MS);
+      result = await ctx.client.bootstrap(request2);
+    }
+    if (result.status === "recovering") {
+      throw new CliError(
+        `The bootstrap request is still recovering after ${WAIT_TIMEOUT_MS / 1e3}s.`,
+        EXIT.failed,
+        "Run the same command again. It will join this request and will not create a duplicate."
+      );
+    }
+  }
+  if (result.status === "recovering") {
+    if (isJsonMode()) {
+      json(result);
+      return;
+    }
+    out("The project request is safely recorded and waiting for recovery.");
+    for (const action of result.nextActions) note(action.description);
+    return;
+  }
+  if (result.status === "choice_required") {
+    throw new CliError("The bootstrap request unexpectedly lost its project choice.", EXIT.failed);
+  }
+  if (result.status === "provisioning" && flags.wait !== false) {
+    await waitForActive(ctx, result.project);
+    result = await ctx.client.bootstrap({ project: result.project.id });
+    if (result.status === "choice_required" || result.status === "recovering") {
+      throw new CliError("The project could not be selected after provisioning.", EXIT.failed);
+    }
+  }
+  const linkedTo = flags.link === false ? null : await writeLink(process.cwd(), {
+    projectId: result.project.id,
+    slug: result.project.slug,
+    ...flags.api ? { apiUrl: flags.api } : {}
+  }, { relink: flags.relink });
+  if (pending) await clearPendingBootstrap(process.cwd());
+  if (isJsonMode()) {
+    json({ ...result, linkedTo });
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${result.project.slug} is ${statusPaint(result.project.status)}`);
+  if (result.project.dataPlaneUrl) out(`  ${result.project.dataPlaneUrl}`);
+  if (linkedTo) note(`Linked this directory (${linkedTo}).`);
+  for (const action of result.nextActions) note(`Next: ${action.command} \u2014 ${action.description}`);
+}
+async function waitForActive(ctx, project) {
+  if (project.status !== "provisioning") return project;
+  note("Provisioning (database, storage, cache, vectors, Worker)\u2026");
+  const deadline = Date.now() + WAIT_TIMEOUT_MS;
+  let current = project;
+  let wait = FIRST_POLL_MS;
+  while (current.status === "provisioning" && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, wait));
+    wait = Math.min(Math.round(wait * POLL_GROWTH), MAX_POLL_MS);
+    current = (await ctx.client.project(project.id)).project;
+  }
+  if (current.status === "provisioning") {
+    throw new CliError(
+      `${current.slug} is still provisioning after ${WAIT_TIMEOUT_MS / 1e3}s.`,
+      EXIT.failed,
+      `It is probably still working. Check with \`nimbly project ${current.slug}\`.`
+    );
+  }
+  if (current.status === "failed") {
+    throw new CliError(
+      `${current.slug} failed to provision.`,
+      EXIT.failed,
+      "Nothing was left half-made - provisioning rolls back. Try again, or check the dashboard."
+    );
+  }
+  return current;
+}
+async function link(flags, ref) {
+  const ctx = await context(flags.api);
+  const { id, slug } = await resolveProject(ctx, ref);
+  const path = await writeLink(process.cwd(), {
+    projectId: id,
+    slug,
+    ...flags.api ? { apiUrl: flags.api } : {}
+  }, { relink: flags.relink });
+  if (isJsonMode()) {
+    json({ ok: true, projectId: id, slug, path });
+    return;
+  }
+  out(`${paint("green", "\u2713")} Linked this directory to ${paint("bold", slug)}`);
+  note(`Written to ${path}. It holds no credentials - commit it.`);
+}
+async function pause(flags, ref) {
+  const ctx = await context(flags.api);
+  const { id, slug } = await resolveProject(ctx, ref);
+  const { project } = await ctx.client.pauseProject(id);
+  if (isJsonMode()) {
+    json({ project });
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${slug} is ${project.status}`);
+  note("Data is retained; storage still costs. Resume with `nimbly resume`.");
+}
+async function resume(flags, ref) {
+  const ctx = await context(flags.api);
+  const { id, slug } = await resolveProject(ctx, ref);
+  const { project } = await ctx.client.resumeProject(id);
+  if (isJsonMode()) {
+    json({ project });
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${slug} is ${project.status}`);
+}
+async function destroy(flags, ref) {
+  const ctx = await context(flags.api);
+  const { id, slug } = await resolveProject(ctx, ref);
+  if (!flags.yes) {
+    const ok = await confirmExact(
+      `Delete ${paint("bold", slug)} and everything in it? This cannot be undone.`,
+      slug
+    );
+    if (!ok) {
+      note("Not deleted.");
+      return;
+    }
+  }
+  await ctx.client.deleteProject(id);
+  if (isJsonMode()) {
+    json({ ok: true, deleted: slug });
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${slug} deleted.`);
+}
+
+// src/commands/keys.ts
+async function list2(flags, ref) {
+  const ctx = await context(flags.api);
+  const { id } = await resolveProject(ctx, ref ?? flags.project);
+  const { keys } = await ctx.client.keys(id);
+  if (isJsonMode()) {
+    json({ keys });
+    return;
+  }
+  if (keys.length === 0) {
+    out("No keys yet.");
+    note('Create one with `nimbly keys create "local dev"`.');
+    return;
+  }
+  table(
+    ["prefix", "type", "name", "created", "last used"],
+    keys.map((k) => [
+      k.keyPrefix,
+      k.type === "service" ? paint("yellow", k.type) : k.type,
+      k.name,
+      when(k.createdAt),
+      when(k.lastUsedAt)
+    ])
+  );
+}
+async function create2(flags, name) {
+  if (!name) throw new CliError("A name is required.", EXIT.usage, 'nimbly keys create "local dev"');
+  const ctx = await context(flags.api);
+  const { id, slug } = await resolveProject(ctx, flags.project);
+  const type = flags.type ?? "anon";
+  if (type !== "anon" && type !== "service") {
+    throw new CliError(`Unknown key type "${type}".`, EXIT.usage, "Use --type anon or --type service.");
+  }
+  const { key } = await ctx.client.createKey(id, { name, type });
+  if (isJsonMode()) {
+    json({ key });
+    return;
+  }
+  out(paint("bold", key.plaintext));
+  out();
+  note(`${paint("yellow", "!")} Shown once. It is stored hashed and cannot be shown again.`);
+  note(`  ${type} key for ${slug}. ` + (type === "service" ? "A service key can do everything, including run SQL - keep it on a server." : "An anon key is the one that may ship in a browser or a mobile app."));
+}
+async function revoke(flags, keyId) {
+  if (!keyId) throw new CliError("A key id is required.", EXIT.usage, "Find it with `nimbly keys --json`.");
+  const ctx = await context(flags.api);
+  await ctx.client.revokeKey(keyId);
+  if (isJsonMode()) {
+    json({ ok: true, revoked: keyId });
+    return;
+  }
+  out(`${paint("green", "\u2713")} Revoked. It stops working at the edge within seconds.`);
+}
+
+// src/commands/mcp.ts
+var CLIENTS = {
+  claude: "Claude Code / Claude Desktop",
+  cursor: "Cursor",
+  vscode: "VS Code",
+  json: "Raw MCP configuration"
+};
+async function mcp(flags, which) {
+  const client = which ?? "json";
+  if (!(client in CLIENTS)) {
+    throw new CliError(
+      `Unknown client "${which}".`,
+      EXIT.usage,
+      `Try one of: ${Object.keys(CLIENTS).join(", ")}.`
+    );
+  }
+  const ctx = await context(flags.api);
+  const url = `${ctx.base}/mcp`;
+  let token = "<your access token>";
+  if (flags.withToken) {
+    const stored = await credentials.load();
+    if (!stored) throw new CliError("Not signed in.", EXIT.unauthenticated, "Run `nimbly login` first.");
+    token = stored.token;
+  }
+  const config = {
+    mcpServers: {
+      nimblybase: {
+        type: "http",
+        url,
+        headers: { Authorization: `Bearer ${token}` }
+      }
+    }
+  };
+  if (isJsonMode()) {
+    json(config);
+    return;
+  }
+  if (client === "claude") {
+    out(`claude mcp add --transport http nimblybase ${url} --header "Authorization: Bearer ${token}"`);
+  } else {
+    out(JSON.stringify(config, null, 2));
+  }
+  out();
+  note(`For ${CLIENTS[client]}. The server is ${url}.`);
+  if (!flags.withToken) {
+    note("Replace the placeholder with a token from the dashboard, or re-run with --with-token.");
+  } else {
+    note(`${paint("yellow", "!")} This output contains a live credential. Do not paste it into an issue.`);
+  }
+}
+
+// src/commands/db.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3, isAbsolute, join as join3, resolve as resolve2 } from "node:path";
+var DEFAULT_SCHEMA_FILE = "schema.json";
+function schemaPath(ctx, flag) {
+  if (flag) return isAbsolute(flag) ? flag : resolve2(process.cwd(), flag);
+  const base = ctx.link ? dirname3(ctx.link.path) : process.cwd();
+  return join3(base, DEFAULT_SCHEMA_FILE);
+}
+async function readSchema(path) {
+  let text;
+  try {
+    text = await readFile3(path, "utf8");
+  } catch {
+    throw new CliError(
+      `No schema file at ${path}.`,
+      EXIT.notFound,
+      "Write one, or start from the live database with `nimbly db pull`."
+    );
+  }
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new CliError(`${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`, EXIT.usage);
+  }
+}
+var unwrapSchema = (parsed) => parsed?.schema ?? parsed;
+var lineageOf = (parsed) => {
+  const raw = parsed?.lineage;
+  return typeof raw === "string" && raw.trim() !== "" ? raw.trim() : void 0;
+};
+var newLineage = () => `cli-${randomUUID2()}`;
+async function ensureLineage(path, parsed) {
+  const existing = lineageOf(parsed);
+  if (existing) return existing;
+  const lineage = newLineage();
+  const withLineage = { lineage, ...parsed };
+  await writeFile3(path, `${JSON.stringify(withLineage, null, 2)}
+`);
+  return lineage;
+}
+async function pull(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { schema } = await ctx.client.schema(project.id);
+  const path = schemaPath(ctx, flags.file);
+  if (isJsonMode()) {
+    json({ schema, writtenTo: path });
+    return;
+  }
+  const previous = await readFile3(path, "utf8").then((t) => lineageOf(JSON.parse(t))).catch(() => void 0);
+  const out_ = previous ? { lineage: previous, ...schema } : schema;
+  await writeFile3(path, `${JSON.stringify(out_, null, 2)}
+`);
+  const tables = schema?.tables?.length ?? 0;
+  out(`${paint("green", "\u2713")} Wrote ${tables} table${tables === 1 ? "" : "s"} from ${project.slug} to ${path}`);
+  note("Edit it and run `nimbly db push` to apply the difference.");
+}
+async function status(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const path = schemaPath(ctx, flags.file);
+  const parsed = await readSchema(path);
+  const plan = await ctx.client.planSchema(project.id, unwrapSchema(parsed), lineageOf(parsed));
+  if (isJsonMode()) {
+    json({ plan, project: project.slug, file: path });
+    return;
+  }
+  describePlan(plan, project.slug, path);
+}
+async function push(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const path = schemaPath(ctx, flags.file);
+  const parsed = await readSchema(path);
+  const schema = unwrapSchema(parsed);
+  const lineage = await ensureLineage(path, parsed);
+  const plan = await ctx.client.planSchema(project.id, schema, lineage);
+  if (plan.upToDate) {
+    if (isJsonMode()) {
+      json({ plan, applied: 0, upToDate: true });
+      return;
+    }
+    out(`${paint("green", "\u2713")} ${project.slug} already matches ${path}.`);
+    return;
+  }
+  if (plan.unsupported.length > 0) {
+    throw new CliError(
+      `Part of this change cannot be made in place: ${plan.unsupported.map((u) => u.reason).join("; ")}`,
+      EXIT.failed,
+      "Nothing was applied. Split the change, or migrate the data explicitly."
+    );
+  }
+  if (!isJsonMode()) describePlan(plan, project.slug, path);
+  if (plan.destructive && !flags.allowDestructive) {
+    throw new CliError(
+      "This change drops tables or columns, and would lose their data.",
+      EXIT.usage,
+      "Re-run with --allow-destructive if that is what you want. Nothing has been applied."
+    );
+  }
+  if (!flags.yes && !isJsonMode()) {
+    if (!await confirm(`Apply ${plan.operations.length} change${plan.operations.length === 1 ? "" : "s"} to ${paint("bold", project.slug)}?`)) {
+      note("Nothing applied.");
+      return;
+    }
+  } else if (!flags.yes && isJsonMode()) {
+    throw new CliError(
+      "Refusing to apply without confirmation.",
+      EXIT.usage,
+      "Pass --yes when running with --json; there is nobody to ask."
+    );
+  }
+  const applied = await ctx.client.applySchema(
+    project.id,
+    schema,
+    flags.allowDestructive === true,
+    lineage,
+    plan.revision
+  );
+  if (isJsonMode()) {
+    json({ plan, applied });
+    return;
+  }
+  out(`${paint("green", "\u2713")} Applied ${applied.applied} statement${applied.applied === 1 ? "" : "s"} to ${project.slug}.`);
+}
+async function migrations(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { migrations: rows2 } = await ctx.client.migrations(project.id);
+  if (isJsonMode()) {
+    json({ migrations: rows2 });
+    return;
+  }
+  if (rows2.length === 0) {
+    out("No schema changes applied yet.");
+    return;
+  }
+  table(["id", "applied", "statements"], rows2.map((m) => [String(m.id), when(m.appliedAt), String(m.statements)]));
+}
+function describePlan(plan, slug, path) {
+  if (plan.upToDate) {
+    out(`${paint("green", "\u2713")} ${slug} matches ${path}.`);
+    return;
+  }
+  out(`${plan.operations.length} change${plan.operations.length === 1 ? "" : "s"} between ${path} and ${slug}:`);
+  out();
+  for (const op of plan.operations) out(`  ${describe(op)}`);
+  out();
+  if (plan.unsupported.length > 0) {
+    for (const u of plan.unsupported) note(`${paint("yellow", "cannot apply")} ${u.reason}`);
+  }
+  if (plan.destructive) {
+    note(`${paint("red", "!")} Some of these DROP a table or column and lose its data.`);
+  }
+}
+function describe(op) {
+  const marker = op.destructive ? paint("red", "-") : paint("green", "+");
+  return `${marker} ${op.sql}`;
+}
+
+// src/commands/sql.ts
+var MAX_SHOWN = 200;
+async function sql(flags, statement) {
+  if (!statement) {
+    throw new CliError(
+      "A statement is required.",
+      EXIT.usage,
+      'nimbly sql "select * from notes where id = ?" --param 7'
+    );
+  }
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const result = await ctx.client.sql(project.id, statement, flags.params ?? []);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  const rows2 = result.results ?? [];
+  if (rows2.length === 0) {
+    const changes = result.meta?.changes ?? 0;
+    out(changes > 0 ? `${paint("green", "\u2713")} ${changes} row${changes === 1 ? "" : "s"} changed.` : `${paint("green", "\u2713")} Done. No rows returned.`);
+    return;
+  }
+  const columns = [...new Set(rows2.flatMap((r) => Object.keys(r)))];
+  const shown = rows2.slice(0, MAX_SHOWN);
+  table(columns, shown.map((r) => columns.map((c) => render(r[c]))));
+  if (rows2.length > shown.length) {
+    note(`\u2026 ${rows2.length - shown.length} more row${rows2.length - shown.length === 1 ? "" : "s"}. Use --json for all of them.`);
+  }
+  note(paint("dim", `${rows2.length} row${rows2.length === 1 ? "" : "s"} in ${result.meta?.durationMs ?? "?"}ms`));
+}
+function render(value) {
+  if (value === null || value === void 0) return paint("dim", "NULL");
+  if (typeof value === "object") return JSON.stringify(value);
+  return String(value);
+}
+
+// src/commands/files.ts
+var humanSize = (bytes) => {
+  const units = ["B", "KB", "MB", "GB"];
+  let n = bytes;
+  let unit = 0;
+  while (n >= 1024 && unit < units.length - 1) {
+    n /= 1024;
+    unit += 1;
+  }
+  return `${unit === 0 ? n : n.toFixed(1)}${units[unit]}`;
+};
+async function files(flags, prefix) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const page = await ctx.client.files(project.id, {
+    prefix: prefix ?? flags.prefix,
+    limit: flags.limit
+  });
+  if (isJsonMode()) {
+    json(page);
+    return;
+  }
+  if (page.objects.length === 0) {
+    out("No files.");
+    return;
+  }
+  table(
+    ["key", "size", "type", "uploaded"],
+    page.objects.map((o) => [o.key, humanSize(o.size), o.contentType ?? "-", when(o.uploaded)])
+  );
+  if (page.truncated) note("More to come - narrow with a prefix, or raise --limit.");
+}
+
+// src/commands/logs.ts
+async function logs(flags, ref) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, ref ?? flags.project);
+  const level = flags.level;
+  if (level && !["info", "warn", "error"].includes(level)) {
+    throw new CliError(`Unknown level "${level}".`, EXIT.usage, "Use --level info, warn or error.");
+  }
+  const page = await ctx.client.logs(project.id, {
+    since: flags.since ?? "1h",
+    level,
+    route: flags.route,
+    limit: flags.limit
+  });
+  if (isJsonMode()) {
+    json(page);
+    return;
+  }
+  if (page.unavailable) {
+    throw new CliError(`Logs are unavailable: ${page.unavailable.reason}`, EXIT.unreachable);
+  }
+  if (page.entries.length === 0) {
+    out(`No requests to ${project.slug} in the last ${flags.since ?? "1h"}.`);
+    note("Logs appear within a few seconds of a request. Widen with --since 24h.");
+    return;
+  }
+  for (const entry of [...page.entries].reverse()) render2(entry);
+  const sampled = page.entries.filter((e) => e.sampleInterval > 1).length;
+  if (sampled > 0) {
+    note(`${sampled} of these rows are sampled and stand for more requests than are shown.`);
+  }
+}
+function render2(e) {
+  const colour2 = e.level === "error" ? "red" : e.level === "warn" ? "yellow" : "dim";
+  const time = new Date(e.timestamp).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", second: "2-digit" });
+  const parts = [
+    paint("dim", time),
+    paint(colour2, String(e.status).padEnd(3)),
+    e.method.padEnd(6),
+    e.route,
+    paint("dim", `${e.durationMs}ms`)
+  ];
+  if (e.rowsRead > 0) parts.push(paint("dim", `${e.rowsRead} rows read`));
+  if (e.credential && e.credential !== "none") parts.push(paint("dim", e.credential));
+  out(parts.join(" "));
+  if (e.message) out(`      ${paint(colour2, e.outcome)} ${e.message}`);
+  if (e.statement) out(`      ${paint("cyan", e.statement)}`);
+}
+
+// src/commands/policies.ts
+import { readFile as readFile4 } from "node:fs/promises";
+var ROLES = ["anon", "authenticated"];
+var OPERATIONS = ["select", "insert", "update", "delete"];
+async function list3(flags, tableName) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { policies } = await ctx.client.policies(project.id, tableName ?? flags.table);
+  if (isJsonMode()) {
+    json({ policies });
+    return;
+  }
+  if (policies.length === 0) {
+    out("No policies.");
+    note("Every table is closed to anon and authenticated keys until one exists.");
+    note(`Open one with: nimbly policies allow <table> select --using '{"col":"published","eq":true}'`);
+    return;
+  }
+  table(
+    ["id", "table", "role", "op", "name", "expression"],
+    policies.map((p) => [
+      String(p.id),
+      p.table,
+      p.role,
+      p.operation,
+      p.name,
+      describe2(p)
+    ])
+  );
+  note(paint("dim", "A table absent from this list is closed to anon keys entirely."));
+}
+function describe2(p) {
+  const expr = p.operation === "insert" ? p.check : p.using;
+  const label = p.operation === "insert" ? "check" : "using";
+  const text = expr === true ? "every row" : JSON.stringify(expr);
+  const extra = p.operation === "update" && p.check !== void 0 && p.check !== null ? `  check ${p.check === true ? "any row" : JSON.stringify(p.check)}` : "";
+  return `${label} ${text}${extra}`;
+}
+async function allow(flags, tableName, operation) {
+  if (!tableName || !operation) {
+    throw new CliError(
+      "A table and an operation are required.",
+      EXIT.usage,
+      `nimbly policies allow posts select --using '{"col":"published","eq":true}'`
+    );
+  }
+  if (!OPERATIONS.includes(operation)) {
+    throw new CliError(`Unknown operation "${operation}".`, EXIT.usage, `One of: ${OPERATIONS.join(", ")}.`);
+  }
+  const role = flags.role ?? "anon";
+  if (!ROLES.includes(role)) {
+    throw new CliError(`Unknown role "${role}".`, EXIT.usage, `One of: ${ROLES.join(", ")}.`);
+  }
+  const using = await expression(flags.using, flags.usingFile, "using");
+  const check2 = await expression(flags.check, flags.checkFile, "check");
+  const needsUsing = operation !== "insert";
+  const needsCheck = operation === "insert" || operation === "update";
+  if (needsUsing && using === void 0) {
+    throw new CliError(
+      `${operation} needs --using.`,
+      EXIT.usage,
+      "It says which rows may be touched. Use --using true to allow every row."
+    );
+  }
+  if (needsCheck && check2 === void 0) {
+    throw new CliError(
+      `${operation} needs --check.`,
+      EXIT.usage,
+      "It says which rows may be written. Use --check true to allow any row."
+    );
+  }
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { policy } = await ctx.client.putPolicy(project.id, {
+    table: tableName,
+    role,
+    operation,
+    name: flags.name ?? `${role}-${operation}`,
+    ...using === void 0 ? {} : { using },
+    ...check2 === void 0 ? {} : { check: check2 }
+  });
+  if (isJsonMode()) {
+    json({ policy });
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${role} may now ${operation} on ${paint("bold", tableName)} \u2014 ${describe2(policy)}`);
+  note(`Policy ${policy.id}, named "${policy.name}". Writing another with the same name replaces it.`);
+}
+async function expression(inline, file, what = "using") {
+  if (file) {
+    const text = await readFile4(file, "utf8").catch(() => {
+      throw new CliError(`Could not read ${file}.`, EXIT.notFound);
+    });
+    return parse3(text, `--${what}-file`);
+  }
+  if (inline === void 0) return void 0;
+  if (inline === "true") return true;
+  if (inline === "false") return false;
+  return parse3(inline, `--${what}`);
+}
+function parse3(text, where) {
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new CliError(
+      `${where} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+      EXIT.usage,
+      'An expression looks like {"col":"published","eq":true} \u2014 or just true.'
+    );
+  }
+}
+async function revoke2(flags, id) {
+  if (!id) throw new CliError("A policy id is required.", EXIT.usage, "Find it with `nimbly policies`.");
+  const n = Number(id);
+  if (!Number.isInteger(n) || n < 1) throw new CliError(`"${id}" is not a policy id.`, EXIT.usage);
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  if (!flags.yes && !isJsonMode()) {
+    if (!await confirm(`Remove policy ${n}? Anything it allowed stops being allowed.`)) {
+      note("Not removed.");
+      return;
+    }
+  }
+  await ctx.client.deletePolicy(project.id, n);
+  if (isJsonMode()) {
+    json({ deleted: true, id: n });
+    return;
+  }
+  out(`${paint("green", "\u2713")} Policy ${n} removed.`);
+  note("If it was the only one for that role and operation, the table is closed again.");
+}
+
+// src/commands/rows.ts
+var MAX_SHOWN2 = 100;
+async function rows(flags, tableName) {
+  if (!tableName) {
+    throw new CliError("A table is required.", EXIT.usage, "nimbly rows posts --as anon");
+  }
+  const as = flags.as;
+  if (as !== void 0 && as !== "anon" && as !== "authenticated") {
+    throw new CliError(`Unknown role "${as}".`, EXIT.usage, "Use --as anon, or --as authenticated --as-user <id>.");
+  }
+  if (as === "authenticated" && !flags.asUser) {
+    throw new CliError(
+      "--as authenticated needs --as-user.",
+      EXIT.usage,
+      "It is the end-user id your policies compare against."
+    );
+  }
+  const params = new URLSearchParams();
+  for (const w of flags.where ?? []) {
+    const eq = w.indexOf("=");
+    if (eq < 1) {
+      throw new CliError(
+        `--where "${w}" must be <column>=<op>.<value>.`,
+        EXIT.usage,
+        "For example --where published=eq.true or --where views=gte.10"
+      );
+    }
+    params.set(w.slice(0, eq), w.slice(eq + 1));
+  }
+  if (flags.select) params.set("select", flags.select);
+  if (flags.order) params.set("order", flags.order);
+  if (flags.limit !== void 0) params.set("limit", String(flags.limit));
+  if (as) {
+    params.set("as", as);
+    if (flags.asUser) params.set("asUser", flags.asUser);
+  }
+  const query2 = params.toString();
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const result = await ctx.client.rows(project.id, tableName, query2 ? `?${query2}` : "");
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  const who = as ?? "service";
+  if (result.rows.length === 0) {
+    out(`No rows visible to ${who}.`);
+    if (as) note("The policy allows this role, but no row matched. Widen the filter, or check the policy expression.");
+    else note("The table is empty, or the filter matched nothing.");
+    return;
+  }
+  const columns = [...new Set(result.rows.flatMap((r) => Object.keys(r)))];
+  const shown = result.rows.slice(0, MAX_SHOWN2);
+  table(columns, shown.map((r) => columns.map((c) => render3(r[c]))));
+  if (result.rows.length > shown.length) {
+    note(`\u2026 ${result.rows.length - shown.length} more. Use --json for all of them.`);
+  }
+  note(paint("dim", `${result.rows.length} row${result.rows.length === 1 ? "" : "s"} visible to ${who}`));
+}
+function render3(value) {
+  if (value === null || value === void 0) return paint("dim", "NULL");
+  if (typeof value === "object") return JSON.stringify(value);
+  return String(value);
+}
+
+// src/commands/diagnose.ts
+var RANK = { blocking: 0, likely: 1, note: 2 };
+var MARK = { blocking: "\u2717", likely: "!", note: "\xB7" };
+var COLOUR = { blocking: "red", likely: "yellow", note: "dim" };
+async function diagnose(flags, ref) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, ref ?? flags.project);
+  const d = await ctx.client.diagnose(project.id);
+  if (isJsonMode()) {
+    json(d);
+    return;
+  }
+  out(d.summary);
+  out();
+  const sorted = [...d.findings].sort((a, b) => RANK[a.severity] - RANK[b.severity]);
+  for (const f of sorted) render4(f);
+  if (sorted.length === 0) out(paint("dim", "Nothing to report."));
+  note(paint("dim", `checked: ${d.checked.join(" \xB7 ")}`));
+}
+function render4(f) {
+  const colour2 = COLOUR[f.severity];
+  out(`${paint(colour2, MARK[f.severity])} ${f.detail}`);
+  if (f.symptom) out(`  ${paint("dim", f.symptom)}`);
+  if (f.fix) out(`  ${paint("cyan", "\u2192")} ${f.fix}`);
+  out();
+}
+
+// src/commands/functions.ts
+import { readFile as readFile5 } from "node:fs/promises";
+import { basename, dirname as dirname4, extname, resolve as resolve3 } from "node:path";
+import { build as bundle } from "esbuild";
+var NAME = /^[a-z][a-z0-9-]{0,30}$/;
+var MAX_FUNCTION_BYTES = 1e6;
+async function list4(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { functions } = await ctx.client.functions(project.id);
+  if (isJsonMode()) {
+    json({ functions });
+    return;
+  }
+  if (functions.length === 0) {
+    out("No functions deployed.");
+    note("Deploy one with `nimbly functions deploy ./webhook.js`.");
+    return;
+  }
+  table(
+    ["name", "status", "version", "schedule", "updated"],
+    functions.map((f) => [
+      f.name,
+      f.status === "live" ? paint("green", f.status) : f.status === "failed" ? paint("red", f.status) : paint("yellow", f.status),
+      `v${f.version}`,
+      f.schedule ?? "\u2014",
+      when(f.updatedAt)
+    ])
+  );
+  const failed = functions.filter((f) => f.failureMessage);
+  for (const f of failed) {
+    const label = f.status === "live" ? `${f.name} (previous revision still live)` : f.name;
+    note(`${paint("red", label)}: ${f.failureMessage}`);
+  }
+  note(paint("dim", "Every function URL is public. Check authorisation inside your code."));
+}
+async function deploy(flags, file) {
+  if (!file) {
+    throw new CliError("A file is required.", EXIT.usage, "nimbly functions deploy ./webhook.js");
+  }
+  const input = await readFile5(file, "utf8").catch(() => {
+    throw new CliError(`Could not read ${file}.`, EXIT.notFound);
+  });
+  if (input.trim() === "") throw new CliError(`${file} is empty.`, EXIT.usage);
+  const name = flags.name ?? basename(file, extname(file));
+  if (!NAME.test(name)) {
+    throw new CliError(
+      `"${name}" is not a usable function name.`,
+      EXIT.usage,
+      "Lowercase letters, digits and hyphens, starting with a letter. Use --name to choose one."
+    );
+  }
+  const built = await bundleFunction(file);
+  if (!built.exports.includes("default")) {
+    throw new CliError(
+      `${file} has no default export.`,
+      EXIT.usage,
+      "A function is a Worker module: export default { async fetch(request, env) { \u2026 } }"
+    );
+  }
+  if (Buffer.byteLength(built.source, "utf8") > MAX_FUNCTION_BYTES) {
+    throw new CliError(
+      `The bundled function is over the ${human(MAX_FUNCTION_BYTES)} limit.`,
+      EXIT.usage,
+      "Remove unused dependencies or split this function before deploying."
+    );
+  }
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  note(`Deploying ${name} to ${project.slug} (${built.modules} modules, ${human(Buffer.byteLength(built.source, "utf8"))})\u2026`);
+  const result = await ctx.client.deployFunction(project.id, name, built.source);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${name} v${result.function.version} is live`);
+  out(`  ${result.url}`);
+  out();
+  note(`${paint("yellow", "!")} This URL is public \u2014 anyone who knows it can call this function.`);
+  note("  Check a signature or a shared secret inside your code.");
+  note(paint("dim", "  env.DB, env.FILES, env.KV are this project\u2019s own. Nothing else is reachable."));
+}
+async function bundleFunction(file) {
+  const absolute = resolve3(file);
+  try {
+    const result = await bundle({
+      absWorkingDir: dirname4(absolute),
+      entryPoints: [absolute],
+      bundle: true,
+      write: false,
+      format: "esm",
+      platform: "browser",
+      target: "es2022",
+      conditions: ["worker", "browser", "import", "default"],
+      mainFields: ["browser", "module", "main"],
+      metafile: true,
+      legalComments: "none",
+      sourcemap: false,
+      logLevel: "silent"
+    });
+    const output = result.outputFiles[0];
+    if (!output) throw new Error("the bundler produced no module");
+    const metadata = Object.values(result.metafile.outputs)[0];
+    return {
+      source: output.text,
+      exports: metadata?.exports ?? [],
+      modules: Object.keys(result.metafile.inputs).length
+    };
+  } catch (err) {
+    const errors = err.errors;
+    const detail = errors?.map((e) => {
+      const where = e.location?.file ? `${e.location.file}${e.location.line ? `:${e.location.line}` : ""}: ` : "";
+      return where + (e.text ?? "build error");
+    }).join("; ");
+    throw new CliError(
+      `Could not bundle ${file}.`,
+      EXIT.usage,
+      detail || (err instanceof Error ? err.message : String(err))
+    );
+  }
+}
+function human(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${Math.round(bytes / 1024)} KB`;
+  return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+}
+async function schedule(flags, name, expression2) {
+  if (!name) {
+    throw new CliError(
+      "A function name is required.",
+      EXIT.usage,
+      'nimbly functions schedule nightly "30 2 * * *"'
+    );
+  }
+  const off = flags.off === true;
+  if (!off && !expression2) {
+    throw new CliError(
+      "A schedule is required.",
+      EXIT.usage,
+      'Five fields in UTC, like "30 2 * * *". Use --off to stop scheduling it.'
+    );
+  }
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const result = await ctx.client.scheduleFunction(project.id, name, off ? null : expression2);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  if (off) {
+    out(`${paint("green", "\u2713")} ${name} is no longer scheduled.`);
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${name} runs ${result.describes ?? expression2}`);
+  note(paint("dim", "  Times are UTC. Your function receives a POST with x-nimblybase-scheduled: true."));
+  note(paint("dim", "  A missed run is not retried \u2014 use a queue for work that must not be skipped."));
+}
+async function remove(flags, name) {
+  if (!name) throw new CliError("A function name is required.", EXIT.usage, "nimbly functions delete webhook");
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  if (!flags.yes && !isJsonMode()) {
+    if (!await confirm(`Delete "${name}"? Its URL stops answering immediately.`)) {
+      note("Not deleted.");
+      return;
+    }
+  }
+  await ctx.client.deleteFunction(project.id, name);
+  if (isJsonMode()) {
+    json({ deleted: true, name });
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${name} deleted.`);
+}
+
+// src/commands/domains.ts
+function explain2(d) {
+  switch (d.state) {
+    case "pending":
+      return "not started";
+    case "connecting":
+      return "waiting for your DNS records";
+    case "dns_applied":
+      return "waiting for DNS to take effect";
+    case "verified":
+      return "DNS is correct";
+    case "issuing_ssl":
+      return "issuing the HTTPS certificate";
+    case "active":
+      return "live";
+    case "failed":
+      return d.failureReason ?? "failed";
+    case "deleted":
+      return "removed";
+    default:
+      return d.state;
+  }
+}
+var colour = (d) => d.state === "active" ? paint("green", "live") : d.state === "failed" ? paint("red", "failed") : paint("yellow", d.state);
+function printRecords(d) {
+  if (d.instructions.records.length === 0) return;
+  out();
+  out(`Create these records at your DNS provider for ${paint("bold", d.domain)}:`);
+  table(
+    ["type", "name", "value"],
+    d.instructions.records.map((r) => [r.type, r.name, r.value])
+  );
+  for (const r of d.instructions.records) note(paint("dim", `  ${r.name} \u2014 ${r.purpose}`));
+  for (const w of d.instructions.warnings) {
+    out();
+    note(`${paint("yellow", "!")} ${w}`);
+  }
+}
+async function list5(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { domains, available } = await ctx.client.domains(project.id);
+  if (isJsonMode()) {
+    json({ domains, available });
+    return;
+  }
+  if (!available) {
+    out("Custom domains are not available in this environment.");
+    return;
+  }
+  if (domains.length === 0) {
+    out("No custom domains.");
+    note("Connect one with `nimbly domains add app.example.com`.");
+    return;
+  }
+  table(
+    ["domain", "status", "detail", "since"],
+    domains.map((d) => [d.domain, colour(d), explain2(d), when(d.enteredAt)])
+  );
+  for (const d of domains) {
+    if (d.stuck) {
+      note(`${paint("yellow", "!")} ${d.domain} has been ${d.state} for a while. Check the records below, then \`nimbly domains check\`.`);
+    }
+    if (d.state !== "active" && d.state !== "deleted") printRecords(d);
+  }
+}
+async function add(flags, domain) {
+  if (!domain) {
+    throw new CliError("A domain is required.", EXIT.usage, "nimbly domains add app.example.com");
+  }
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const created = await ctx.client.addDomain(project.id, domain);
+  if (isJsonMode()) {
+    json(created);
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${created.domain} is registered with this project.`);
+  printRecords(created);
+  out();
+  note("Nothing serves this domain until those records exist and propagate.");
+  note("Run `nimbly domains check` once you have created them.");
+}
+async function check(flags, domain) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { domains } = await ctx.client.domains(project.id);
+  const targets = domain ? domains.filter((d) => d.domain === domain.toLowerCase().replace(/\.$/, "")) : domains.filter((d) => d.state !== "active");
+  if (targets.length === 0) {
+    if (isJsonMode()) {
+      json({ checked: [] });
+      return;
+    }
+    out(domain ? `${domain} is not connected to this project.` : "Nothing to check.");
+    return;
+  }
+  const results = [];
+  for (const t of targets) results.push(await ctx.client.checkDomain(project.id, t.id));
+  if (isJsonMode()) {
+    json({ checked: results });
+    return;
+  }
+  for (const d of results) {
+    out(`${d.domain}: ${colour(d)} \u2014 ${explain2(d)}`);
+    if (d.state !== "active") printRecords(d);
+  }
+}
+async function remove2(flags, domain) {
+  if (!domain) {
+    throw new CliError("A domain is required.", EXIT.usage, "nimbly domains remove app.example.com");
+  }
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { domains } = await ctx.client.domains(project.id);
+  const target = domains.find((d) => d.domain === domain.toLowerCase().replace(/\.$/, ""));
+  if (!target) throw new CliError(`${domain} is not connected to this project.`, EXIT.notFound);
+  if (!flags.yes && !isJsonMode()) {
+    if (!await confirm(`Disconnect ${target.domain}? It stops serving immediately.`)) {
+      note("Not disconnected.");
+      return;
+    }
+  }
+  const result = await ctx.client.deleteDomain(project.id, target.id);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${result.domain} disconnected.`);
+  note(paint("dim", "  The DNS records at your provider are yours to remove."));
+}
+
+// src/commands/ai.ts
+async function models(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { models: list10, available } = await ctx.client.aiModels(project.id);
+  if (isJsonMode()) {
+    json({ models: list10, available });
+    return;
+  }
+  if (!available) {
+    out("The model gateway is not available on this project.");
+    note("Projects provisioned before it exists have no AI binding.");
+    return;
+  }
+  table(
+    ["name", "also", "context", "max out"],
+    list10.map((m) => [
+      m.name,
+      (m.aliases ?? []).join(", ") || "\u2014",
+      String(m.contextTokens),
+      String(m.maxOutputTokens)
+    ])
+  );
+  for (const m of list10) note(paint("dim", `  ${(m.aliases ?? [])[0] ?? m.name} \u2014 ${m.describes}`));
+}
+async function run2(flags, ...argv) {
+  const words = argv.filter((w) => w !== void 0 && w !== "");
+  if (words.length === 0) return models(flags);
+  if (words.length === 1 && words[0] === "models") return models(flags);
+  return chat(flags, ...words);
+}
+async function chat(flags, ...words) {
+  const prompt = words.join(" ").trim();
+  if (prompt === "") {
+    throw new CliError(
+      "A prompt is required.",
+      EXIT.usage,
+      'nimbly ai "summarise what this project does"'
+    );
+  }
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const result = await ctx.client.aiChat(project.id, {
+    messages: [{ role: "user", content: prompt }],
+    ...flags.model ? { model: flags.model } : {},
+    ...flags.maxTokens === void 0 ? {} : { maxTokens: flags.maxTokens }
+  });
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(result.content);
+  const u = result.usage;
+  note(paint(
+    "dim",
+    `  ${result.model} \xB7 ${u.promptTokens} in, ${u.completionTokens} out, ${u.totalTokens} tokens \xB7 ${result.durationMs}ms`
+  ));
+  if (u.estimated) {
+    note(paint("yellow", "  ! the model reported no token counts; these are estimated from length"));
+  }
+  if (result.finishReason === "length") {
+    note(paint("yellow", "  ! the answer hit the token limit. Raise it with --max-tokens"));
+  }
+}
+
+// src/commands/secrets.ts
+var NAME2 = /^[A-Z][A-Z0-9_]{0,63}$/;
+async function list6(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { secrets } = await ctx.client.secrets(project.id);
+  if (isJsonMode()) {
+    json({ secrets });
+    return;
+  }
+  if (secrets.length === 0) {
+    out("No secrets set.");
+    note("Set one with `nimbly secrets set STRIPE_SECRET_KEY`.");
+    return;
+  }
+  table(
+    ["name", "value", "updated"],
+    secrets.map((s) => [s.name, paint("dim", s.hint), when(s.updatedAt)])
+  );
+  note(paint("dim", "Values cannot be read back \u2014 only replaced. Your functions read them as env.NAME."));
+}
+async function set(flags, name) {
+  if (!name) {
+    throw new CliError("A name is required.", EXIT.usage, "nimbly secrets set STRIPE_SECRET_KEY");
+  }
+  if (!NAME2.test(name)) {
+    throw new CliError(
+      `"${name}" is not a usable name.`,
+      EXIT.usage,
+      "A-Z, 0-9 and underscores, starting with a letter \u2014 like STRIPE_SECRET_KEY."
+    );
+  }
+  const value = await readValue(name, flags);
+  if (value === "") throw new CliError("The value is empty.", EXIT.usage);
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const result = await ctx.client.setSecret(project.id, name, value);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${name} set on ${project.slug}`);
+  reportRedeploy(result.redeployed, result.stale);
+  note(paint("dim", "It cannot be read back. Your functions read it as env." + name + "."));
+}
+async function unset(flags, name) {
+  if (!name) throw new CliError("A name is required.", EXIT.usage, "nimbly secrets unset STRIPE_SECRET_KEY");
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  if (!flags.yes && !isJsonMode()) {
+    if (!await confirm(`Remove ${name} from ${project.slug}? It cannot be recovered.`)) {
+      note("Not removed.");
+      return;
+    }
+  }
+  const result = await ctx.client.deleteSecret(project.id, name);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${name} removed.`);
+  reportRedeploy(result.redeployed, result.stale);
+}
+async function readValue(name, flags) {
+  if (flags.value !== void 0) {
+    note(paint("yellow", "!") + " --value puts the secret in your shell history.");
+    note(paint("dim", `  Next time: nimbly secrets set ${name}   (prompts, nothing echoed)`));
+    return flags.value.trim();
+  }
+  const piped = await readPipedInput();
+  if (piped !== null) return piped;
+  if (!process.stdin.isTTY) {
+    throw new CliError(
+      "No value given and nothing to read.",
+      EXIT.usage,
+      `echo -n "$KEY" | nimbly secrets set ${name}`
+    );
+  }
+  return promptSecret(`Value for ${name} (not shown): `);
+}
+function reportRedeploy(redeployed, stale) {
+  if (redeployed.length > 0) {
+    note(paint("dim", `  redeployed: ${redeployed.join(", ")}`));
+  }
+  if (stale.length === 0) return;
+  out();
+  out(`${paint("red", "!")} ${stale.length} function(s) still running the PREVIOUS value:`);
+  for (const s of stale) out(`  ${paint("red", s.name)}: ${s.message}`);
+  note("Fix the error and redeploy, or they will keep using what was there before.");
+}
+
+// src/commands/types.ts
+import { writeFile as writeFile4 } from "node:fs/promises";
+var TS_TYPE = {
+  text: "string",
+  integer: "number",
+  real: "number",
+  boolean: "boolean",
+  timestamp: "string",
+  uuid: "string",
+  json: "unknown",
+  blob: "string"
+};
+async function types(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { schema } = await ctx.client.schema(project.id);
+  const tables = (schema?.tables ?? []).slice().sort((a, b) => a.name.localeCompare(b.name));
+  if (tables.length === 0) {
+    throw new CliError(
+      `${project.slug} has no tables yet.`,
+      EXIT.notFound,
+      "Apply a schema first: `nimbly db push`."
+    );
+  }
+  const source2 = render5(tables, project.slug);
+  if (isJsonMode()) {
+    json({ types: source2, tables: tables.length });
+    return;
+  }
+  if (flags.output) {
+    await writeFile4(flags.output, source2, "utf8");
+    out(`${paint("green", "\u2713")} ${tables.length} table${tables.length === 1 ? "" : "s"} \u2192 ${flags.output}`);
+    note("Use it: createClient<DB>({ url, key })");
+    return;
+  }
+  out(source2);
+  note(paint("dim", "Write it to a file with --output src/db.ts, or redirect stdout."));
+}
+function render5(tables, slug) {
+  const lines = [
+    "// Generated by `nimbly types` from the live schema of " + slug + ".",
+    "// Re-run it after a migration; do not edit by hand.",
+    ""
+  ];
+  for (const table2 of tables) {
+    lines.push(`export type ${typeName(table2.name)} = {`);
+    for (const column of table2.columns) {
+      const base = TS_TYPE[column.type] ?? "unknown";
+      const nullable = column.notNull !== true && column.primaryKey !== true;
+      lines.push(`  ${propertyName(column.name)}: ${base}${nullable ? " | null" : ""}`);
+    }
+    lines.push("}", "");
+  }
+  lines.push("/** Pass this to createClient to type every query against it. */");
+  lines.push("export type DB = {");
+  for (const table2 of tables) lines.push(`  ${propertyName(table2.name)}: ${typeName(table2.name)}`);
+  lines.push("}", "");
+  return lines.join("\n");
+}
+function typeName(table2) {
+  return table2.split(/[_\-\s]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("") || "Row";
+}
+function propertyName(name) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
+}
+
+// src/commands/deploy.ts
+import { readdir, readFile as readFile6, stat as stat2 } from "node:fs/promises";
+import { createHash as createHash2 } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { join as join4, relative, sep } from "node:path";
+
+// ../../packages/frameworks/dist/architecture.js
+var FEATURE_SERVICE = {
+  auth: "auth",
+  storage: "storage",
+  realtime: "realtime",
+  vectors: "vectors",
+  functions: "functions",
+  schedules: "schedules",
+  ai: "ai",
+  cache: "cache",
+  jobs: "jobs",
+  crawler: "crawler"
+};
+var FEATURE_ACTIONS = {
+  auth: [
+    "Define the app-user sign-up, sign-in and session flow.",
+    "Enable auth only for the exact deployed origins.",
+    "Keep NimblyBase account identity separate from the application user pool."
+  ],
+  storage: [
+    "Define buckets by trust boundary, not by screen or component.",
+    "Choose public, authenticated or owner-scoped access for every bucket."
+  ],
+  realtime: [
+    "Name channels from stable domain identifiers.",
+    "Issue browser tickets server-side and reconnect with bounded backoff."
+  ],
+  vectors: [
+    "Choose stable vector ids and metadata filters before indexing.",
+    "Record the source content revision so changed documents can be re-embedded."
+  ],
+  functions: [
+    "Keep handlers Worker-module compatible and validate every webhook signature.",
+    "Put secrets in NimblyBase secret storage; never in source or the link manifest."
+  ],
+  schedules: [
+    "Make scheduled handlers idempotent and safe to retry.",
+    "Use UTC cron expressions and record the intended timezone in application docs."
+  ],
+  ai: [
+    "Select a listed model and set an explicit output-token ceiling.",
+    "Keep model calls behind a server-side function when prompts contain private data."
+  ],
+  cache: [
+    "Use cache keys with project and schema versions and define expiry behavior.",
+    "Treat cache as disposable; the database remains authoritative."
+  ],
+  jobs: [
+    "A durable background queue is unavailable in V1. Do not model a schedule as a queue."
+  ],
+  crawler: [
+    "Managed browser crawling is unavailable in V1. Keep crawling outside NimblyBase."
+  ]
+};
+function proposeArchitecture(repository, capabilities) {
+  const byId = new Map(capabilities.map((service) => [service.id, service]));
+  const blockers = [];
+  const questions = [];
+  let status4 = "compatible";
+  if (repository.runtime.kind === "external-server") {
+    status4 = "unsupported";
+    blockers.push(`${repository.runtime.label} cannot be hosted by NimblyBase V1. It may consume NimblyBase over HTTP from infrastructure hosted elsewhere.`);
+  } else if (repository.runtime.kind === "unknown" || repository.detection.warnings.length > 0) {
+    status4 = "review-required";
+  }
+  const requestedFeatures = [...repository.features];
+  if (repository.runtime.kind === "worker" && !requestedFeatures.some((feature) => feature.id === "functions")) {
+    requestedFeatures.push({ id: "functions", evidence: ["Worker module entry point detected"] });
+  }
+  const wanted = new Set(requestedFeatures.map((feature) => feature.id));
+  const services = [];
+  for (const featureId of Object.keys(FEATURE_SERVICE)) {
+    const feature = requestedFeatures.find((item) => item.id === featureId);
+    const serviceId = FEATURE_SERVICE[featureId];
+    if (!feature) {
+      services.push({
+        id: serviceId,
+        decision: "not-needed",
+        reason: "No requirement was detected in the supplied product requirements or inspected source.",
+        actions: []
+      });
+      continue;
+    }
+    const capability = byId.get(serviceId);
+    if (!capability?.available) {
+      services.push({
+        id: serviceId,
+        decision: "unavailable",
+        reason: capability?.reason ?? `${serviceId} was not reported by capability discovery.`,
+        actions: FEATURE_ACTIONS[featureId]
+      });
+      blockers.push(`${serviceId}: ${capability?.reason ?? "not reported by this project"}`);
+      status4 = "unsupported";
+      continue;
+    }
+    services.push({
+      id: serviceId,
+      decision: repository.runtime.kind === "external-server" && feature.id === "functions" ? "external" : "use",
+      reason: `${feature.evidence.join("; ")}. ${capability.reason}`,
+      actions: FEATURE_ACTIONS[featureId]
+    });
+  }
+  for (const core of ["database", "policies"]) {
+    const capability = byId.get(core);
+    if (services.some((service) => service.id === core))
+      continue;
+    if (!capability?.available) {
+      blockers.push(`${core}: ${capability?.reason ?? "not reported by this project"}`);
+      status4 = "unsupported";
+    }
+    services.unshift({
+      id: core,
+      decision: capability?.available ? "use" : "unavailable",
+      reason: capability?.reason ?? `${core} was not reported by capability discovery.`,
+      actions: core === "database" ? ["Map domain entities to tables.", "Derive indexes from actual filters, joins and sort order.", "Run a schema plan before applying changes."] : ["Start closed.", "Add the smallest role and ownership rules needed by each application journey."]
+    });
+  }
+  const hosting = byId.get("hosting");
+  const hasHostedFrontend = repository.runtime.kind !== "external-server" && repository.runtime.kind !== "worker";
+  services.push({
+    id: "hosting",
+    decision: hasHostedFrontend && hosting?.available ? "use" : hasHostedFrontend ? "unavailable" : repository.runtime.kind === "worker" ? "not-needed" : "external",
+    reason: hasHostedFrontend ? hosting?.reason ?? "Frontend hosting was not reported by capability discovery." : repository.runtime.kind === "worker" ? "No static frontend was detected; deploy the Worker module as an edge function." : "The detected server runtime must remain on external infrastructure.",
+    actions: ["Build with the repository\u2019s own build command.", "Review the detected output directory before publishing.", "Smoke-test the immutable release before declaring it live."]
+  });
+  if (hasHostedFrontend && !hosting?.available) {
+    blockers.push(`hosting: ${hosting?.reason ?? "not reported by this project"}`);
+    status4 = "unsupported";
+  }
+  const tables = repository.entities;
+  if (tables.length === 0) {
+    questions.push("Which domain entities and ownership boundaries should become tables?");
+  }
+  if (!wanted.has("auth")) {
+    questions.push("Does the application need its own end-user accounts, or is every route public/server-only?");
+  }
+  const indexes = tables.flatMap((table2) => [
+    `${table2}: index columns used by list filters and stable sort order`,
+    ...wanted.has("auth") ? [`${table2}: index the owner/tenant key used by row policies`] : []
+  ]);
+  const frontend = repository.runtime.kind === "external-server" ? "Not hosted in V1; deploy the server application elsewhere." : repository.runtime.kind === "worker" ? "No static frontend detected." : repository.detection.buildCommand ? `${repository.detection.buildCommand}; publish ${repository.detection.outputDir}/ with nimbly deploy.` : `Review ${repository.detection.outputDir}/, then publish it with nimbly deploy.`;
+  return {
+    schemaVersion: 1,
+    status: status4,
+    summary: status4 === "unsupported" ? "The requested shape cannot run completely on NimblyBase V1. Resolve every blocker before provisioning or deployment." : status4 === "review-required" ? "The backend fits V1, but the detected build/runtime assumptions need review before deployment." : "The inspected repository and requested services fit the V1 runtime contract.",
+    repository,
+    deployment: {
+      frontend,
+      functions: wanted.has("functions") ? "Move bounded HTTP/webhook handlers to Worker-module functions; keep long-running work external." : "No edge function requirement detected.",
+      backend: "Use the project data/auth/function endpoints returned by capability discovery; do not hard-code provider endpoints."
+    },
+    dataModel: {
+      tables,
+      indexes,
+      note: tables.length > 0 ? "Names come from source declarations. Columns, constraints and indexes still require review against real query paths." : "No table declaration was found. The agent must derive tables from product requirements before planning schema changes."
+    },
+    services,
+    routineChanges: [
+      "Read current schema, policies and service configuration.",
+      "Create additive tables, indexes and least-privilege policies after showing the plan.",
+      "Create named buckets and deploy reviewed Worker/static artifacts within existing limits.",
+      "Run application-level smoke tests and inspect logs."
+    ],
+    requiresExplicitApproval: {
+      destructive: [
+        "Drop or rename tables/columns, delete data or a project.",
+        "Weaken row policies, widen public access or replace an existing repository link.",
+        "Replace/unset a secret, disconnect a domain or revoke user sessions."
+      ],
+      spending: [
+        "Enable or increase model, vector, storage, request or custom-domain usage beyond the current allowance.",
+        "Add a paid provider, plan or quota."
+      ]
+    },
+    blockers: [...new Set(blockers)],
+    questions,
+    nextActions: status4 === "unsupported" ? ["Keep the unsupported runtime external or redesign it as static output plus bounded edge functions.", "Run nimbly architect again after the runtime decision."] : [
+      "Review this proposal against the product journeys and source evidence.",
+      "Read the live schema and policies before proposing changes.",
+      "Plan schema and policy changes; show destructive effects separately.",
+      "Apply only reviewed changes, deploy, then verify with a real application journey."
+    ]
+  };
+}
+
+// ../../packages/frameworks/dist/index.js
+var RULES = [
+  {
+    framework: "next",
+    label: "Next.js",
+    configs: ["next.config.js", "next.config.mjs", "next.config.ts"],
+    packages: ["next"],
+    outputDir: "out",
+    buildScript: "build",
+    singlePageApp: false,
+    warn: () => [
+      'Next.js must be set to static export (`output: "export"`) to be hosted here. Server components, API routes and ISR need a Node server, which static hosting is not.'
+    ]
+  },
+  {
+    framework: "nuxt",
+    label: "Nuxt",
+    configs: ["nuxt.config.js", "nuxt.config.ts"],
+    packages: ["nuxt"],
+    outputDir: ".output/public",
+    buildScript: "generate",
+    singlePageApp: false,
+    warn: () => ["Nuxt needs `nuxt generate` for a static site; `nuxt build` produces a server."]
+  },
+  {
+    framework: "astro",
+    label: "Astro",
+    configs: ["astro.config.mjs", "astro.config.js", "astro.config.ts"],
+    packages: ["astro"],
+    outputDir: "dist",
+    buildScript: "build",
+    singlePageApp: false
+  },
+  {
+    framework: "sveltekit",
+    label: "SvelteKit",
+    configs: ["svelte.config.js"],
+    packages: ["@sveltejs/kit"],
+    outputDir: "build",
+    buildScript: "build",
+    singlePageApp: false,
+    warn: () => ["SvelteKit needs adapter-static to produce files rather than a server."]
+  },
+  {
+    framework: "remix",
+    label: "Remix",
+    packages: ["@remix-run/react"],
+    outputDir: "build/client",
+    buildScript: "build",
+    singlePageApp: false,
+    warn: () => ["Remix is a server framework; only a fully static build can be hosted here."]
+  },
+  {
+    framework: "gatsby",
+    label: "Gatsby",
+    configs: ["gatsby-config.js", "gatsby-config.ts"],
+    packages: ["gatsby"],
+    outputDir: "public",
+    buildScript: "build",
+    singlePageApp: false
+  },
+  {
+    framework: "angular",
+    label: "Angular",
+    configs: ["angular.json"],
+    packages: ["@angular/core"],
+    outputDir: "dist",
+    buildScript: "build",
+    singlePageApp: true,
+    warn: () => ["Angular writes into dist/<project-name>; point --dir at that folder if this is wrong."]
+  },
+  {
+    framework: "create-react-app",
+    label: "Create React App",
+    packages: ["react-scripts"],
+    outputDir: "build",
+    buildScript: "build",
+    singlePageApp: true
+  },
+  {
+    framework: "eleventy",
+    label: "Eleventy",
+    configs: [".eleventy.js", "eleventy.config.js"],
+    packages: ["@11ty/eleventy"],
+    outputDir: "_site",
+    buildScript: "build",
+    singlePageApp: false
+  },
+  {
+    framework: "hugo",
+    label: "Hugo",
+    configs: ["hugo.toml", "hugo.yaml", "config.toml"],
+    outputDir: "public",
+    buildScript: null,
+    singlePageApp: false,
+    warn: () => ["Hugo is not a Node tool, so nothing is run for you. Run `hugo` first, then deploy."]
+  },
+  {
+    framework: "jekyll",
+    label: "Jekyll",
+    configs: ["_config.yml"],
+    outputDir: "_site",
+    buildScript: null,
+    singlePageApp: false,
+    warn: () => ["Jekyll is not a Node tool, so nothing is run for you. Run `jekyll build` first."]
+  },
+  // Last of the real frameworks: everything above also uses Vite.
+  {
+    framework: "vite",
+    label: "Vite",
+    configs: ["vite.config.js", "vite.config.ts", "vite.config.mjs"],
+    packages: ["vite"],
+    outputDir: "dist",
+    buildScript: "build",
+    singlePageApp: true
+  }
+];
+function detect(input) {
+  const pkg = input.packageJson;
+  const deps = { ...pkg?.dependencies, ...pkg?.devDependencies };
+  const entries = new Set(input.entries);
+  for (const rule of RULES) {
+    const config = rule.configs?.find((c) => entries.has(c));
+    const dependency = rule.packages?.find((p) => p in deps);
+    if (!config && !dependency)
+      continue;
+    const script = rule.buildScript;
+    const hasScript = script !== null && pkg?.scripts?.[script] !== void 0;
+    return {
+      framework: rule.framework,
+      label: rule.label,
+      buildCommand: script === null ? null : hasScript ? `npm run ${script}` : null,
+      buildScript: script === null ? null : hasScript ? script : null,
+      outputDir: rule.outputDir,
+      confidence: config ? "certain" : "likely",
+      because: config ? `found ${config}` : `${dependency} is in package.json`,
+      singlePageApp: rule.singlePageApp,
+      warnings: [
+        ...rule.warn?.(input) ?? [],
+        ...script !== null && !hasScript ? [`No "${script}" script in package.json, so nothing will be built - deploy an already-built directory, or add the script.`] : []
+      ]
+    };
+  }
+  return staticSite(entries);
+}
+function staticSite(entries) {
+  if (entries.has("index.html")) {
+    return {
+      framework: "static",
+      label: "a static site",
+      buildCommand: null,
+      outputDir: ".",
+      confidence: "likely",
+      buildScript: null,
+      because: "found index.html",
+      singlePageApp: false,
+      warnings: []
+    };
+  }
+  const built = ["dist", "build", "public", "out", "_site"].find((d) => entries.has(d));
+  if (built) {
+    return {
+      framework: "static",
+      label: "a static site",
+      buildCommand: null,
+      outputDir: built,
+      confidence: "fallback",
+      buildScript: null,
+      because: `no framework recognised, but there is a ${built}/ folder`,
+      singlePageApp: false,
+      warnings: [`Guessing ${built}/ holds the site. Use --dir to say otherwise.`]
+    };
+  }
+  return {
+    framework: "static",
+    label: "a static site",
+    buildCommand: null,
+    outputDir: ".",
+    confidence: "fallback",
+    buildScript: null,
+    because: "nothing recognisable was found",
+    singlePageApp: false,
+    warnings: ["No framework and no index.html. Point --dir at the folder holding your site."]
+  };
+}
+
+// src/commands/deploy.ts
+var SKIP = /* @__PURE__ */ new Set([".git", "node_modules", ".DS_Store", ".env", ".env.local", "Thumbs.db"]);
+var MAX_FILES = 2e4;
+var MAX_FILE_BYTES = 25 * 1024 * 1024;
+var MAX_SITE_BYTES = 100 * 1024 * 1024;
+async function deploy2(flags, dir) {
+  const root = dir ?? ".";
+  const detection = await detectIn(root);
+  const source2 = flags.dir ?? join4(root, detection.outputDir);
+  if (!isJsonMode()) {
+    note(`${detection.label} \u2014 ${detection.because}`);
+    for (const warning of detection.warnings) note(`${paint("yellow", "!")} ${warning}`);
+  }
+  if (flags.build) await buildSite(root, detection.buildScript ?? null, detection.buildCommand);
+  const files2 = await collect(source2);
+  if (files2.length === 0) {
+    throw new CliError(
+      `${source2} has nothing to publish.`,
+      EXIT.notFound,
+      detection.buildCommand ? `Build it first: ${detection.buildCommand}` : "Point --dir at the folder holding your built site."
+    );
+  }
+  const index = files2.find((f) => f.path === "/index.html");
+  if (!index && !flags.yes && !isJsonMode()) {
+    note(`${paint("yellow", "!")} No index.html in ${source2}; nothing will answer at /.`);
+    if (!await confirm("Publish anyway?")) {
+      note("Not published.");
+      return;
+    }
+  }
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const singlePageApp = flags.spa ?? detection.singlePageApp;
+  const manifest = {
+    singlePageApp,
+    files: Object.fromEntries(files2.map((f) => [f.path, { hash: f.hash, size: f.size }]))
+  };
+  const { missing } = await ctx.client.planSite(project.id, manifest);
+  const bytes = files2.filter((f) => missing.includes(f.hash)).reduce((sum, f) => sum + f.size, 0);
+  if (!isJsonMode()) {
+    out(`${files2.length} file${files2.length === 1 ? "" : "s"}, ${missing.length} to upload${missing.length > 0 ? ` (${human2(bytes)})` : " \u2014 everything is already there"}`);
+  }
+  let done = 0;
+  for (const hash of missing) {
+    const file = files2.find((f) => f.hash === hash);
+    await ctx.client.putSiteBlob(project.id, hash, await readFile6(file.absolute));
+    done += 1;
+    if (!isJsonMode()) note(`  ${done}/${missing.length} ${file.path}`);
+  }
+  const result = await ctx.client.commitSite(project.id, manifest);
+  if (isJsonMode()) {
+    json({ ...result, url: siteUrl(project), uploaded: missing.length });
+    return;
+  }
+  out();
+  out(`${paint("green", "\u2713")} published ${result.files} file${result.files === 1 ? "" : "s"}`);
+  out(`  ${siteUrl(project)}`);
+  out(`  release ${result.release}`);
+  if (singlePageApp) {
+    note(paint("dim", "  Unknown paths serve index.html \u2014 your router owns them."));
+  } else {
+    note(paint("dim", "  Unknown paths are 404. Use --spa if a client-side router owns them."));
+  }
+}
+async function remove3(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  if (!flags.yes && !isJsonMode()) {
+    if (!await confirm(`Stop serving the site at ${siteUrl(project)}?`)) {
+      note("Left alone.");
+      return;
+    }
+  }
+  const result = await ctx.client.deleteSite(project.id);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} the site is no longer served. Your API is unaffected.`);
+}
+async function status2(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const site = await ctx.client.site(project.id);
+  if (isJsonMode()) {
+    json(site);
+    return;
+  }
+  if (!site.deployed) {
+    out("No site deployed.");
+    note("Publish one with `nimbly deploy`.");
+    return;
+  }
+  out(`${site.files} file${site.files === 1 ? "" : "s"}, deployed ${site.deployedAt}`);
+  out(`  ${siteUrl(project)}`);
+  note(paint("dim", site.singlePageApp ? "  Unknown paths serve index.html." : "  Unknown paths are 404."));
+}
+async function releases(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { releases: list10 } = await ctx.client.siteReleases(project.id);
+  if (isJsonMode()) {
+    json({ releases: list10 });
+    return;
+  }
+  if (list10.length === 0) {
+    out("Nothing published yet.");
+    note("Publish with `nimbly deploy ./dist`.");
+    return;
+  }
+  for (const r of list10) {
+    const marker = r.current ? paint("green", "\u25CF") : " ";
+    out(`${marker} ${r.id}  ${String(r.files).padStart(4)} files  ${when(r.deployedAt)}`);
+  }
+  note(paint("dim", "Put one back with `nimbly site rollback <id>`. It moves no files."));
+}
+async function rollback(flags, id) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  let release = id;
+  if (!release) {
+    const { releases: list10 } = await ctx.client.siteReleases(project.id);
+    const currentAt = list10.findIndex((r) => r.current);
+    const previous = list10[currentAt + 1];
+    if (!previous) {
+      throw new CliError(
+        "There is no earlier release to go back to.",
+        EXIT.notFound,
+        "See what exists with `nimbly site releases`."
+      );
+    }
+    release = previous.id;
+    if (!flags.yes && !isJsonMode()) {
+      if (!await confirm(`Roll back to ${release}?`)) {
+        note("Left alone.");
+        return;
+      }
+    }
+  }
+  const result = await ctx.client.rollbackSite(project.id, release);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  if (!result.rolledBack) {
+    out(`${paint("dim", "\xB7")} ${result.message ?? "nothing changed"}`);
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${release} is live again`);
+  note(paint("dim", "  No files were uploaded \u2014 they were never deleted."));
+}
+async function detectIn(root) {
+  const entries = await readdir(root).catch(() => {
+    throw new CliError(`Cannot read ${root}.`, EXIT.notFound);
+  });
+  const packageJson = await readFile6(join4(root, "package.json"), "utf8").then((t) => JSON.parse(t)).catch(() => void 0);
+  return detect({ entries, packageJson });
+}
+async function buildSite(root, script, display) {
+  if (!script) {
+    throw new CliError(
+      "No runnable package.json build script was detected.",
+      EXIT.usage,
+      "Build this project with its own tool, then run `nimbly deploy`, or add a supported build script."
+    );
+  }
+  const entries = await readdir(root);
+  const runner = packageRunner(entries);
+  if (!isJsonMode()) note(`Running ${runner.label} run ${script}\u2026`);
+  const code = await new Promise((resolve5, reject) => {
+    const child = spawn2(runner.command, [...runner.args, "run", script], {
+      cwd: root,
+      stdio: "inherit",
+      // Node cannot execute .cmd shims directly on Windows. The command and
+      // every argument here come from our fixed framework/runner tables, so
+      // the Windows command shell receives no repository-controlled text.
+      shell: process.platform === "win32"
+    });
+    child.once("error", reject);
+    child.once("close", (status4) => resolve5(status4 ?? 1));
+  }).catch((err) => {
+    throw new CliError(
+      `Could not start ${display ?? `${runner.label} run ${script}`}.`,
+      EXIT.failed,
+      err instanceof Error ? err.message : String(err)
+    );
+  });
+  if (code !== 0) {
+    throw new CliError(
+      `Build failed with exit code ${code}; nothing was published.`,
+      EXIT.failed,
+      "Fix the build locally, then retry. The currently live release was not changed."
+    );
+  }
+}
+function packageRunner(entries) {
+  const names = new Set(entries);
+  const win = process.platform === "win32";
+  if (names.has("pnpm-lock.yaml")) {
+    return { command: win ? "corepack.cmd" : "corepack", args: ["pnpm"], label: "pnpm" };
+  }
+  if (names.has("yarn.lock")) {
+    return { command: win ? "corepack.cmd" : "corepack", args: ["yarn"], label: "yarn" };
+  }
+  if (names.has("bun.lock") || names.has("bun.lockb")) {
+    return { command: win ? "bun.exe" : "bun", args: [], label: "bun" };
+  }
+  return { command: win ? "npm.cmd" : "npm", args: [], label: "npm" };
+}
+async function collect(dir) {
+  const root = await stat2(dir).catch(() => null);
+  if (!root?.isDirectory()) return [];
+  const found = [];
+  async function walk(current) {
+    for (const entry of await readdir(current, { withFileTypes: true })) {
+      if (SKIP.has(entry.name)) continue;
+      const absolute = join4(current, entry.name);
+      if (entry.isDirectory()) {
+        await walk(absolute);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const info = await stat2(absolute);
+      if (info.size > MAX_FILE_BYTES) {
+        throw new CliError(
+          `${relative(dir, absolute)} is ${human2(info.size)}, over the ${human2(MAX_FILE_BYTES)} limit.`,
+          EXIT.usage
+        );
+      }
+      if (found.length >= MAX_FILES) {
+        throw new CliError(
+          `More than ${MAX_FILES} files.`,
+          EXIT.usage,
+          "Static hosting is for a built site, not a source tree."
+        );
+      }
+      found.push({
+        path: toUrlPath(relative(dir, absolute)),
+        absolute,
+        hash: createHash2("sha256").update(await readFile6(absolute)).digest("hex"),
+        size: info.size
+      });
+    }
+  }
+  await walk(dir);
+  assertSiteSize(found.map((file) => file.size));
+  return found.sort((a, b) => a.path.localeCompare(b.path));
+}
+function assertSiteSize(sizes) {
+  const total = sizes.reduce((sum, size) => sum + size, 0);
+  if (total > MAX_SITE_BYTES) {
+    throw new CliError(
+      `The built site is ${human2(total)}, over the ${human2(MAX_SITE_BYTES)} total limit.`,
+      EXIT.usage,
+      "Remove build caches or large downloads from the output directory and build again."
+    );
+  }
+}
+function toUrlPath(relativePath) {
+  return `/${relativePath.split(sep).join("/").split("\\").join("/")}`;
+}
+function siteUrl(project) {
+  return project.dataPlaneUrl ?? `https://${project.id.replace(/-/g, "")}.<your data plane host>`;
+}
+function human2(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${Math.round(bytes / 1024)} KB`;
+  return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+}
+
+// src/commands/end-user-auth.ts
+async function status3(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const auth = await ctx.client.authStatus(project.id);
+  if (isJsonMode()) {
+    json({ auth, project: project.slug });
+    return;
+  }
+  if (!auth.enabled) {
+    out(`End-user auth is off for ${paint("bold", project.slug)}.`);
+    note("Turn it on with `nimbly auth enable`. These are your app\u2019s users, not your NimblyBase account.");
+    return;
+  }
+  table(["", ""], [
+    ["enabled", "yes"],
+    ["url", auth.url ?? "-"],
+    ["providers", (auth.providers ?? []).join(", ") || "-"]
+  ]);
+}
+async function enable(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const origins = (flags.origin ?? "").split(",").map((o) => o.trim()).filter(Boolean);
+  const auth = await ctx.client.enableAuth(project.id, origins);
+  if (isJsonMode()) {
+    json({ auth, project: project.slug });
+    return;
+  }
+  out(`${paint("green", "\u2713")} End-user auth is on for ${paint("bold", project.slug)}.`);
+  if (auth.url) note(`Sign-up and sign-in live at ${auth.url}.`);
+  if (origins.length === 0) {
+    note("No trusted origins are set, so a browser app on another origin cannot sign in yet. Add them with `nimbly auth enable --origin https://app.example.com`.");
+  }
+}
+async function disable(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  if (!flags.yes && !isJsonMode()) {
+    if (!await confirm(`Stop serving auth for ${paint("bold", project.slug)}?`)) {
+      note("Nothing changed.");
+      return;
+    }
+  }
+  const result = await ctx.client.disableAuth(project.id);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} End-user auth is off for ${project.slug}.`);
+  note("Your users and their sessions are kept, so turning auth back on signs them all back in. To end every session now, run `nimbly auth revoke`.");
+}
+async function revoke3(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  if (!flags.yes && !isJsonMode()) {
+    out(`This signs out every user of ${paint("bold", project.slug)} and stops every token already issued.`);
+    note("Their accounts and passwords are untouched.");
+    if (!await confirm("End every session?")) {
+      note("Nothing changed.");
+      return;
+    }
+  } else if (!flags.yes && isJsonMode()) {
+    throw new CliError(
+      "Refusing to sign everybody out without confirmation.",
+      EXIT.usage,
+      "Pass --yes when running with --json; there is nobody to ask."
+    );
+  }
+  const result = await ctx.client.revokeAuthSessions(project.id);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} Ended ${result.sessions} session${result.sessions === 1 ? "" : "s"} for ${project.slug}.`);
+  note(result.message);
+}
+async function users(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const search = flags.search?.trim();
+  const page = await ctx.client.authUsers(project.id, {
+    ...search ? { search } : {},
+    ...flags.cursor ? { cursor: flags.cursor } : {},
+    ...flags.limit ? { limit: Number(flags.limit) } : {}
+  });
+  if (isJsonMode()) {
+    json({ ...page, project: project.slug });
+    return;
+  }
+  if (page.users.length === 0) {
+    if (search) {
+      out(`No user of ${paint("bold", project.slug)} matches \u201C${search}\u201D.`);
+      note("This project does have users. Drop --search to see them.");
+    } else {
+      out(`Nobody has signed up to ${paint("bold", project.slug)} yet.`);
+      note("These are your app\u2019s users, in your own database \u2014 not your NimblyBase team, which is `nimbly members`.");
+    }
+    return;
+  }
+  table(
+    ["email", "signs in with", "signed in", "joined", "id"],
+    page.users.map((u) => [
+      u.email,
+      u.providers.map((p) => p === "credential" ? "password" : p).join(", ") || "-",
+      u.liveSessions === 0 ? "no" : `${u.liveSessions} device${u.liveSessions === 1 ? "" : "s"}`,
+      u.createdAt.slice(0, 10),
+      u.id
+    ])
+  );
+  note(`${page.users.length} of ${page.total}.`);
+  if (page.nextCursor) note(`More: nimbly auth users --cursor ${page.nextCursor}`);
+}
+async function signOutUser(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const userId = flags.user;
+  if (!userId) {
+    throw new CliError(
+      "Which user?",
+      EXIT.usage,
+      "Pass the id from `nimbly auth users`, e.g. `nimbly auth signout --user <id>`."
+    );
+  }
+  if (!flags.yes && !isJsonMode()) {
+    out(`This signs that person out of ${paint("bold", project.slug)} on every device.`);
+    note("Their account and password are untouched, and they can sign straight back in. A data token they already hold keeps working for up to 15 more minutes.");
+    if (!await confirm("Sign them out?")) {
+      note("Nothing changed.");
+      return;
+    }
+  } else if (!flags.yes && isJsonMode()) {
+    throw new CliError(
+      "Refusing to sign somebody out without confirmation.",
+      EXIT.usage,
+      "Pass --yes when running with --json; there is nobody to ask."
+    );
+  }
+  const result = await ctx.client.revokeAuthUser(project.id, userId);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} Ended ${result.sessions} session${result.sessions === 1 ? "" : "s"}.`);
+  note(result.message);
+}
+
+// src/commands/vectors.ts
+import { readFile as readFile7 } from "node:fs/promises";
+async function query(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const text = flags.value ?? flags.search;
+  if (!text) {
+    throw new CliError(
+      "What should I search for?",
+      EXIT.usage,
+      'Pass the query text, e.g. `nimbly vectors query --value "how do refunds work"`.'
+    );
+  }
+  const result = await ctx.client.queryVectors(project.id, {
+    text,
+    ...flags.limit ? { topK: Number(flags.limit) } : {}
+  });
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  const matches = result.matches ?? [];
+  if (matches.length === 0) {
+    out(`Nothing in ${paint("bold", project.slug)}\u2019s index matches that.`);
+    note("An empty index answers the same way. `nimbly vectors add` puts something in it.");
+    return;
+  }
+  table(
+    ["score", "id", "metadata"],
+    matches.map((m) => [
+      m.score === void 0 ? "-" : m.score.toFixed(4),
+      m.id,
+      m.metadata ? JSON.stringify(m.metadata) : "-"
+    ])
+  );
+}
+async function add2(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  let vectors;
+  if (flags.file) {
+    const parsed = JSON.parse(await readFile7(flags.file, "utf8"));
+    vectors = Array.isArray(parsed) ? parsed : [parsed];
+  } else {
+    if (!flags.name || !flags.value) {
+      throw new CliError(
+        "What should I add?",
+        EXIT.usage,
+        'Either `--name <id> --value "the text"`, or `--file vectors.json` with entries of { id, text | values, metadata? }.'
+      );
+    }
+    vectors = [{ id: flags.name, text: flags.value }];
+  }
+  const result = await ctx.client.upsertVectors(project.id, vectors);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  out(`${paint("green", "\u2713")} Added ${vectors.length} vector${vectors.length === 1 ? "" : "s"} to ${project.slug}.`);
+  note("Indexing is not instant \u2014 a query in the next moment may not see them yet.");
+}
+
+// src/commands/tokens.ts
+function state(token, current) {
+  if (token.revokedAt) return "revoked";
+  if (token.expiresAt && new Date(token.expiresAt).getTime() < Date.now()) return "expired";
+  return current ? "in use here" : "active";
+}
+async function list7(flags) {
+  const ctx = await context(flags.api);
+  const { tokens } = await ctx.client.accessTokens();
+  if (isJsonMode()) {
+    json({ tokens });
+    return;
+  }
+  if (tokens.length === 0) {
+    out("You have no access tokens.");
+    note("Create one in the dashboard \u2014 the plaintext is shown once and never again, which is why this command cannot make them.");
+    return;
+  }
+  const inUse = tokens.find((t) => ctx.isCurrentToken(t.tokenPrefix));
+  table(
+    ["name", "prefix", "state", "last used", "id"],
+    tokens.map((t) => [
+      t.name,
+      t.tokenPrefix,
+      state(t, t.id === inUse?.id),
+      t.lastUsedAt ? t.lastUsedAt.slice(0, 10) : "never",
+      t.id
+    ])
+  );
+}
+async function revoke4(flags) {
+  const ctx = await context(flags.api);
+  const id = flags.id ?? flags.name;
+  if (!id) {
+    throw new CliError(
+      "Which token?",
+      EXIT.usage,
+      "Pass the id from `nimbly tokens`, e.g. `nimbly tokens revoke --id <id>`."
+    );
+  }
+  const { tokens } = await ctx.client.accessTokens();
+  const target = tokens.find((t) => t.id === id || t.name === id);
+  if (!target) {
+    throw new CliError(`No token "${id}".`, EXIT.usage, "Run `nimbly tokens` to see them.");
+  }
+  if (target.revokedAt) {
+    out(`${paint("bold", target.name)} was already revoked.`);
+    return;
+  }
+  const current = ctx.isCurrentToken(target.tokenPrefix);
+  if (!flags.yes && !isJsonMode()) {
+    out(`This revokes ${paint("bold", target.name)} (${target.tokenPrefix}\u2026).`);
+    note("It stops working on its next use. Anything running with it \u2014 CI, an agent, another machine \u2014 starts failing to authenticate.");
+    if (current) note(paint("yellow", "This is the token you are using right now. You will need a new one before the next command."));
+    if (!await confirm("Revoke it?")) {
+      note("Nothing changed.");
+      return;
+    }
+  } else if (!flags.yes && isJsonMode()) {
+    throw new CliError(
+      "Refusing to revoke a token without confirmation.",
+      EXIT.usage,
+      "Pass --yes when running with --json; there is nobody to ask."
+    );
+  }
+  await ctx.client.revokeAccessToken(target.id);
+  if (isJsonMode()) {
+    json({ revoked: true, id: target.id, name: target.name, current });
+    return;
+  }
+  out(`${paint("green", "\u2713")} Revoked ${target.name}.`);
+  if (current) note("That was this session\u2019s token. `nimbly login` or a new token to carry on.");
+}
+
+// src/commands/describe.ts
+async function describe3(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const d = await ctx.client.describeProject(project.id);
+  if (isJsonMode()) {
+    json(d);
+    return;
+  }
+  out(`${paint("bold", d.project.slug)} \u2014 ${d.project.status}`);
+  if ("data" in d.endpoints) {
+    out("");
+    table(["", ""], [
+      ["data", d.endpoints.data],
+      ...d.endpoints.auth ? [["auth", d.endpoints.auth]] : [],
+      ...d.endpoints.functions ? [["functions", d.endpoints.functions]] : []
+    ]);
+  } else {
+    note(d.endpoints.note);
+  }
+  out("");
+  table(
+    ["service", "configuration", "how"],
+    d.services.map((s) => [s.name, s.state ?? (s.available ? "configured" : "unavailable"), s.how])
+  );
+  if (d.assessment) note(d.assessment.note);
+  for (const s of d.services) {
+    if (s.reason || s.note) out(`${s.name}: ${s.note ?? s.reason}`);
+  }
+  out("");
+  out(paint("bold", "Worth knowing before you start"));
+  for (const line of d.surprises) out(`  \u2022 ${line}`);
+  out("");
+  note(d.credentials);
+}
+
+// src/commands/orgs.ts
+async function list8(flags) {
+  const ctx = await context(flags.api);
+  const [{ organizations }, me] = await Promise.all([ctx.client.organizations(), ctx.client.me()]);
+  const active = me.organization?.id;
+  if (isJsonMode()) {
+    json({ organizations, activeOrgId: active ?? null });
+    return;
+  }
+  if (organizations.length === 0) {
+    out("You do not belong to any organisation.");
+    note("That should not be possible with a working token \u2014 `nimbly whoami` says what this one is.");
+    return;
+  }
+  table(
+    ["", "organisation", "role", "kind"],
+    organizations.map((o) => [
+      o.id === active ? paint("green", "\u2192") : " ",
+      `${o.name} (${o.slug})`,
+      o.role,
+      o.isPersonal ? "personal" : "team"
+    ])
+  );
+  if (organizations.length > 1) {
+    note("Your token acts in the one marked \u2192. Projects in the others are invisible to it; create a token there to reach them.");
+  }
+  if (active !== void 0 && !organizations.some((o) => o.id === active)) {
+    note(paint("yellow", "This token acts in an organisation you are no longer a member of. You will need a new one."));
+  }
+}
+
+// src/commands/buckets.ts
+var describe4 = (b) => [b.visibility, b.ownerScoped ? "per-user" : null].filter(Boolean).join(", ");
+async function list9(flags) {
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const { buckets } = await ctx.client.buckets(project.id);
+  if (isJsonMode()) {
+    json({ buckets });
+    return;
+  }
+  if (buckets.length === 0) {
+    out("No buckets.");
+    note("Every file needs a service key or a signed URL until you create one:");
+    note("  nimbly buckets create avatars --public");
+    return;
+  }
+  table(
+    ["name", "who may read", "created"],
+    buckets.map((b) => [b.name, describe4(b), when(b.createdAt)])
+  );
+  note("A service key still reads and writes all of these, and everything outside them.");
+}
+async function create3(flags, name) {
+  if (!name) throw new CliError("Which bucket?", EXIT.usage, "nimbly buckets create <name> [--public] [--per-user]");
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const visibility = flags.public === true ? "public" : "private";
+  const ownerScoped = flags.perUser === true;
+  try {
+    const result = await ctx.client.putBucket(project.id, name, {
+      visibility,
+      ownerScoped,
+      ...flags.adopt === true ? { adopt: true } : {}
+    });
+    if (isJsonMode()) {
+      json(result);
+      return;
+    }
+    out(`${paint("green", "\u2713")} ${name}: ${describe4(result.bucket)}`);
+    if (result.adopted) {
+      note("Files already under this prefix are now covered by that policy. Nothing was moved.");
+    }
+    if (visibility === "public") {
+      note("Anyone with a URL can read these files. They cannot list them, and cannot write.");
+    }
+    if (ownerScoped) {
+      note(`A signed-in user may read and write ${name}/<their user id>/\u2026 and nothing else.`);
+    }
+    if (visibility === "private" && !ownerScoped) {
+      note("Private and not per-user: this still needs a service key or a signed URL. Add --public or --per-user to let an app reach it directly.");
+    }
+  } catch (err) {
+    if (err instanceof Error && /prefix_in_use|already exist/i.test(err.message)) {
+      throw new CliError(
+        err.message,
+        EXIT.usage,
+        `Re-run with --adopt to apply this policy to the files already under ${name}/. Nothing is moved or deleted either way.`
+      );
+    }
+    throw err;
+  }
+}
+async function remove4(flags, name) {
+  if (!name) throw new CliError("Which bucket?", EXIT.usage, "nimbly buckets delete <name>");
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  if (!flags.yes && !isJsonMode()) {
+    out(`Removing '${name}' does NOT delete its files.`);
+    note("They go back to needing a service key or a signed URL, so anything reading them with an anon key stops working.");
+    if (!await confirm(`Remove the bucket '${name}'?`)) {
+      note("Nothing changed.");
+      return;
+    }
+  }
+  const result = await ctx.client.deleteBucket(project.id, name);
+  if (isJsonMode()) {
+    json(result);
+    return;
+  }
+  if (!result.removed) {
+    out(`No bucket called ${name}.`);
+    return;
+  }
+  out(`${paint("green", "\u2713")} ${name} is no longer a bucket.`);
+  note(result.note);
+}
+
+// src/commands/architect.ts
+import { readdir as readdir2, readFile as readFile8, stat as stat3 } from "node:fs/promises";
+import { extname as extname2, join as join5, relative as relative2, resolve as resolve4 } from "node:path";
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".svelte-kit",
+  ".turbo",
+  ".venv",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+  "out",
+  "target",
+  "vendor"
+]);
+var SKIP_FILES = /(^|\/)(?:\.env(?:\..*)?|.*\.(?:pem|key|p12|pfx|crt|cer))$/i;
+var TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".cjs",
+  ".cs",
+  ".go",
+  ".java",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".py",
+  ".rb",
+  ".sql",
+  ".ts",
+  ".tsx",
+  ".vue",
+  ".svelte",
+  ".json",
+  ".toml",
+  ".txt",
+  ".xml",
+  ".yaml",
+  ".yml"
+]);
+var MAX_FILES2 = 2e3;
+var MAX_READ_BYTES = 256 * 1024;
+var MAX_TOTAL_READ_BYTES = 4 * 1024 * 1024;
+var FEATURE_PATTERNS = {
+  auth: /\b(auth|login|log-in|signin|sign-in|signup|sign-up|session|passport|clerk|auth0)\b/i,
+  storage: /\b(upload|attachment|bucket|object storage|s3|r2|multer|media)\b/i,
+  realtime: /\b(realtime|real-time|websocket|socket\.io|chat room|live update)\b/i,
+  vectors: /\b(vector|embedding|semantic search|rag|retrieval augmented)\b/i,
+  functions: /\b(webhook|edge function|api route|http handler|express|fastify|hono)\b/i,
+  schedules: /\b(cron|schedule|scheduled|periodic)\b/i,
+  ai: /\b(openai|anthropic|workers ai|language model|llm|chatbot|ai sdk)\b/i,
+  cache: /\b(redis|cache|memoiz)\w*/i,
+  jobs: /\b(queue|background job|worker job|bullmq|celery|sidekiq)\b/i,
+  crawler: /\b(crawl|crawler|scrape|playwright|puppeteer|browser automation)\b/i
+};
+async function architect(flags, ...words) {
+  const root = resolve4(flags.dir ?? ".");
+  const requirements = words.filter((word) => Boolean(word)).join(" ").trim();
+  const inspection = await inspectRepository(root, requirements || void 0);
+  const ctx = await context(flags.api);
+  const project = await resolveProject(ctx, flags.project);
+  const backend = await ctx.client.describeProject(project.id);
+  const proposal = proposeArchitecture(inspection, backend.services);
+  if (isJsonMode()) {
+    json(proposal);
+    return;
+  }
+  render6(proposal);
+}
+async function inspectRepository(root, requirements) {
+  const rootStat = await stat3(root).catch(() => null);
+  if (!rootStat?.isDirectory()) {
+    throw new CliError(`Cannot inspect ${root}.`, EXIT.notFound, "Pass --dir with a readable repository directory.");
+  }
+  const entries = await readdir2(root);
+  const packageJson = await readPackage(root);
+  const facts = await sourceFacts(root);
+  const detection = detect({ entries, packageJson });
+  const combined = [
+    requirements ?? "",
+    facts.searchable,
+    ...Object.keys(packageJson?.dependencies ?? {}),
+    ...Object.keys(packageJson?.devDependencies ?? {})
+  ].join("\n");
+  const runtime = inspectRuntime(entries, packageJson, combined, detection.framework);
+  const features = Object.entries(FEATURE_PATTERNS).filter(([, pattern]) => pattern.test(combined)).map(([id, pattern]) => ({ id, evidence: evidenceFor(id, pattern, requirements, facts.paths, packageJson) }));
+  return {
+    mode: isNewRepository(entries, facts.paths) ? "new-app" : "existing-repository",
+    root: ".",
+    detection,
+    runtime,
+    filesInspected: facts.paths.length,
+    evidence: [
+      `${detection.label}: ${detection.because}`,
+      ...detection.warnings,
+      ...runtime.evidence,
+      ...facts.entities.length > 0 ? [`table declarations: ${facts.entities.join(", ")}`] : []
+    ],
+    entities: facts.entities,
+    features,
+    ...requirements ? { requirements } : {}
+  };
+}
+async function readPackage(root) {
+  try {
+    const parsed = JSON.parse(await readFile8(join5(root, "package.json"), "utf8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function sourceFacts(root) {
+  const paths = [];
+  const snippets = [];
+  const entities = /* @__PURE__ */ new Set();
+  let bytesRead = 0;
+  async function walk(dir) {
+    for (const entry of await readdir2(dir, { withFileTypes: true })) {
+      if (paths.length >= MAX_FILES2) return;
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) await walk(join5(dir, entry.name));
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const absolute = join5(dir, entry.name);
+      const path = relative2(root, absolute).split("\\").join("/");
+      if (SKIP_FILES.test(path)) continue;
+      paths.push(path);
+      if (!TEXT_EXTENSIONS.has(extname2(entry.name).toLowerCase()) && entry.name !== "Gemfile") continue;
+      const info = await stat3(absolute);
+      if (info.size > MAX_READ_BYTES || bytesRead + info.size > MAX_TOTAL_READ_BYTES) continue;
+      const source2 = await readFile8(absolute, "utf8").catch(() => "");
+      bytesRead += Buffer.byteLength(source2);
+      snippets.push(`${path}
+${source2}`);
+      findEntities(source2, entities);
+    }
+  }
+  await walk(root);
+  return { paths: paths.sort(), searchable: snippets.join("\n"), entities: [...entities].sort() };
+}
+function findEntities(source2, entities) {
+  const patterns = [
+    /\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`]?([A-Za-z][\w-]*)/gi,
+    /\b(?:sqliteTable|pgTable)\s*\(\s*["'`]([A-Za-z][\w-]*)/g,
+    /^\s*model\s+([A-Za-z][\w]*)\s*\{/gm,
+    /\b__tablename__\s*=\s*["']([A-Za-z][\w-]*)["']/g
+  ];
+  for (const pattern of patterns) {
+    for (const match of source2.matchAll(pattern)) entities.add(match[1].toLowerCase());
+  }
+}
+function inspectRuntime(entries, pkg, searchable, framework) {
+  const dependencies = /* @__PURE__ */ new Set([
+    ...Object.keys(pkg?.dependencies ?? {}),
+    ...Object.keys(pkg?.devDependencies ?? {})
+  ]);
+  const evidence = [];
+  const has = (name) => entries.includes(name);
+  if (has("pom.xml") || has("build.gradle") || has("build.gradle.kts")) evidence.push("Java build manifest");
+  if (entries.some((entry) => entry.endsWith(".csproj") || entry.endsWith(".sln"))) evidence.push(".NET project file");
+  if (has("Gemfile") && /\brails\b/i.test(searchable)) evidence.push("Rails dependency");
+  if (has("go.mod")) evidence.push("Go module");
+  if ((has("pyproject.toml") || has("requirements.txt")) && /\b(django|flask|fastapi|celery)\b/i.test(searchable)) {
+    evidence.push("Python server framework");
+  }
+  for (const dependency of ["express", "fastify", "@nestjs/core", "koa"]) {
+    if (dependencies.has(dependency)) evidence.push(`${dependency} server dependency`);
+  }
+  if (evidence.length > 0) return { kind: "external-server", label: evidence[0], evidence };
+  if (has("wrangler.toml") || has("wrangler.json") || has("wrangler.jsonc")) {
+    return { kind: "worker", label: "Worker module", evidence: ["Cloudflare Worker configuration"] };
+  }
+  if (entries.length === 0 || entries.length === 1 && has("nimblybase.json")) {
+    return { kind: "new-app", label: "new application", evidence: ["no application source found yet"] };
+  }
+  if (framework !== "static" || has("index.html")) {
+    return { kind: "static-frontend", label: `${framework} static frontend`, evidence: [`${framework} frontend detected`] };
+  }
+  return { kind: "unknown", label: "unrecognised runtime", evidence: ["no supported runtime entry point identified"] };
+}
+function evidenceFor(id, pattern, requirements, paths, pkg) {
+  const evidence = [];
+  if (requirements && pattern.test(requirements)) evidence.push(`requested: ${id}`);
+  const path = paths.find((value) => pattern.test(value.replace(/[-_/]/g, " ")));
+  if (path) evidence.push(`source path: ${path}`);
+  const dependency = [
+    ...Object.keys(pkg?.dependencies ?? {}),
+    ...Object.keys(pkg?.devDependencies ?? {})
+  ].find((value) => pattern.test(value));
+  if (dependency) evidence.push(`dependency: ${dependency}`);
+  if (evidence.length === 0) evidence.push(`source contains ${id} behavior`);
+  return evidence;
+}
+function isNewRepository(entries, paths) {
+  const meaningfulEntries = entries.filter((entry) => ![".git", "nimblybase.json"].includes(entry));
+  return meaningfulEntries.length === 0 || paths.length === 0;
+}
+function render6(proposal) {
+  const colour2 = proposal.status === "compatible" ? "green" : proposal.status === "unsupported" ? "red" : "yellow";
+  out(`${paint(colour2, proposal.status.toUpperCase())} \u2014 ${proposal.summary}`);
+  out(`Repository: ${proposal.repository.mode}; ${proposal.repository.runtime.label}; ${proposal.repository.filesInspected} files inspected`);
+  for (const evidence of proposal.repository.evidence) note(`  ${evidence}`);
+  out("\nDeployment");
+  out(`  frontend: ${proposal.deployment.frontend}`);
+  out(`  functions: ${proposal.deployment.functions}`);
+  out(`  backend: ${proposal.deployment.backend}`);
+  out("\nData model");
+  out(`  tables: ${proposal.dataModel.tables.length > 0 ? proposal.dataModel.tables.join(", ") : "to be derived from product requirements"}`);
+  for (const index of proposal.dataModel.indexes) out(`  index: ${index}`);
+  note(`  ${proposal.dataModel.note}`);
+  out("\nServices");
+  for (const service of proposal.services) {
+    out(`  ${service.id}: ${service.decision} \u2014 ${service.reason}`);
+    for (const action of service.actions) note(`    \u2022 ${action}`);
+  }
+  if (proposal.blockers.length > 0) {
+    out("\nBlockers");
+    for (const blocker of proposal.blockers) out(`  \u2022 ${blocker}`);
+  }
+  if (proposal.questions.length > 0) {
+    out("\nQuestions the source cannot answer");
+    for (const question of proposal.questions) out(`  \u2022 ${question}`);
+  }
+  out("\nRoutine, within current authorization");
+  for (const change of proposal.routineChanges) out(`  \u2022 ${change}`);
+  out("\nRequires explicit approval");
+  for (const change of proposal.requiresExplicitApproval.destructive) out(`  destructive: ${change}`);
+  for (const change of proposal.requiresExplicitApproval.spending) out(`  spending: ${change}`);
+  out("\nNext");
+  for (const action of proposal.nextActions) out(`  \u2022 ${action}`);
+}
+
+// src/run.ts
+var COMMANDS = {
+  login,
+  logout,
+  whoami,
+  // Which organisations you belong to, and which one this token acts in.
+  // "My project isn't listed" is usually the second half of that.
+  orgs: list8,
+  projects: list,
+  // Singular and plural both work. Guessing which one a person will type is
+  // a game nobody wins, and an alias costs one line.
+  project: show,
+  create,
+  init,
+  types,
+  deploy: deploy2,
+  link,
+  pause,
+  resume,
+  delete: destroy,
+  mcp,
+  sql,
+  rows,
+  files,
+  logs,
+  diagnose,
+  // What this project can do, as opposed to why it is broken.
+  describe: describe3,
+  architect,
+  // NOT a group. A group's second word is its sub-command, and `ai
+  // "summarise this"` would be looked up as one and refused. So `ai` takes
+  // its own words and decides; see commands/ai.ts.
+  ai: run2
+};
+var GROUPS = {
+  keys: { "": list2, list: list2, create: create2, revoke },
+  // No `create`. The plaintext appears in one response and never again, and
+  // a command that prints it puts it in shell history - so making one stays
+  // in the dashboard while revoking one, which is the urgent half, does not.
+  tokens: { "": list7, list: list7, revoke: revoke4 },
+  // `db` alone is `db status`: the read-only one. A bare group name must
+  // never be the command that changes something.
+  // Bare `policies` lists. A group name must never be the command that
+  // changes something.
+  functions: {
+    "": list4,
+    list: list4,
+    deploy,
+    schedule,
+    delete: remove
+  },
+  // Bare `domains` lists. A group name must never be the command that
+  // changes something.
+  domains: {
+    "": list5,
+    list: list5,
+    add,
+    check,
+    remove: remove2,
+    // `delete` is what somebody types who has just used `functions delete`.
+    delete: remove2
+  },
+  // The customer's OWN end users. `login` is this person signing in to
+  // NimblyBase; these are the people who sign in to the app they built.
+  // Bare `auth` reports, because a group name must never be the command
+  // that changes something.
+  auth: {
+    "": status3,
+    status: status3,
+    enable,
+    disable,
+    revoke: revoke3,
+    users,
+    signout: signOutUser
+  },
+  // Bare `buckets` lists. A group name must never be the command that
+  // changes something.
+  buckets: {
+    "": list9,
+    list: list9,
+    create: create3,
+    delete: remove4,
+    remove: remove4
+  },
+  site: {
+    "": status2,
+    status: status2,
+    releases,
+    rollback,
+    delete: remove3
+  },
+  secrets: {
+    "": list6,
+    list: list6,
+    set,
+    unset,
+    // `delete` is what someone types who has just used `functions delete`.
+    delete: unset
+  },
+  // Bare `vectors` searches, because the read is the safe one. `add` is
+  // the verb that changes something and has to be asked for.
+  vectors: {
+    "": query,
+    query,
+    add: add2
+  },
+  policies: {
+    "": list3,
+    list: list3,
+    allow,
+    revoke: revoke2
+  },
+  db: {
+    "": status,
+    status,
+    pull,
+    push,
+    migrations
+  }
+};
+async function run3(argv) {
+  let parsed;
+  try {
+    parsed = parse(argv);
+  } catch (err) {
+    return report(err);
+  }
+  const { command, flags } = parsed;
+  setJsonMode(flags.json);
+  const name = command[0];
+  if (flags.version || name === "version") {
+    if (isJsonMode()) json({ version: VERSION });
+    else out(VERSION);
+    return EXIT.ok;
+  }
+  if (!name || name === "help" || flags.help) {
+    if (!name || name === "help" || flags.help) process.stdout.write(USAGE);
+    return name || flags.help ? EXIT.ok : EXIT.usage;
+  }
+  try {
+    const group = GROUPS[name];
+    if (group) {
+      const sub = command[1] ?? "";
+      const handler2 = group[sub];
+      if (!handler2) {
+        throw new CliError(
+          `Unknown ${name} command "${sub}".`,
+          EXIT.usage,
+          `Try: ${Object.keys(group).filter(Boolean).map((k) => `${name} ${k}`).join(", ")}.`
+        );
+      }
+      await handler2(flags, ...command.slice(sub ? 2 : 1));
+      return EXIT.ok;
+    }
+    const handler = COMMANDS[name];
+    if (!handler) {
+      throw new CliError(`Unknown command "${name}".`, EXIT.usage, "Run `nimbly help`.");
+    }
+    await handler(flags, ...command.slice(1));
+    return EXIT.ok;
+  } catch (err) {
+    return report(err);
+  }
+}
+function report(err) {
+  if (err instanceof CliError) {
+    if (isJsonMode()) {
+      process.stderr.write(`${JSON.stringify({ error: err.message, hint: err.hint, exitCode: err.code })}
+`);
+    } else {
+      note(`${paint("red", "Error:")} ${err.message}`);
+      if (err.hint) note(`  ${paint("dim", err.hint)}`);
+    }
+    return err.code;
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  if (isJsonMode()) {
+    process.stderr.write(`${JSON.stringify({ error: message, exitCode: EXIT.failed })}
+`);
+  } else {
+    note(`${paint("red", "Error:")} ${message}`);
+  }
+  return EXIT.failed;
+}
+
+// src/index.ts
+process.exitCode = await run3(process.argv.slice(2));