ninedeploy 0.10.5 → 0.16.0

package/dist/index.js

@@ -8,22 +8,28 @@ import { loginAction } from './commands/login.js';
 import { setupAction } from './commands/setup.js';
 import { servicesCompose, servicesCreate, servicesDelete, servicesDeploy, servicesExport, servicesGet, servicesInspect, servicesLifecycle, servicesList, servicesLogs, servicesStickyAction, } from './commands/services.js';
 import { dbCreate, dbList, deploysCancel, deploysList, deploysQueue, deploysRemove, deploysRollback, systemDashboard, systemInfo, systemRotateKeys, systemUpdateCheck, tplDeploy, tplList, tokenCreate, tokenList, } from './commands/misc.js';
-import { activityList, alertsCreate, alertsList, alertsRemove, backupsCreate, backupsDrill, backupsDrills, backupsList, backupsRestore, deploysWatch, domainsAcceptTransfer, domainsAdd, domainsCancelTransfer, domainsList, domainsPreviewTransfer, domainsRemove, domainsTransfer, envList, envRemove, envSet, networksCreate, networksList, networksRemove, sessionsList, sessionsRevoke, systemExport, systemImport, usersList, usersResetLink, volumesList, volumesRemove, } from './commands/manage.js';
+import { activityList, alertsCreate, alertsList, alertsRemove, backupsCreate, backupsDrill, backupsDrills, backupsList, backupsRestore, deploysWatch, domainsAcceptTransfer, domainsAdd, domainsCancelTransfer, domainsList, domainsPreviewTransfer, domainsRemove, domainsTransfer, domainsVerify, envList, envRemove, envSet, networksCreate, networksList, networksRemove, sessionsList, sessionsRevoke, systemExport, systemImport, usersList, usersResetLink, volumesList, volumesRemove, } from './commands/manage.js';
 import { notificationsCreateFcm as _notifCreateFcm, notificationsCreateWebhook as _notifCreateWebhook, notificationsList as _notifList, notificationsRemove as _notifRemove, notificationsTest as _notifTest, } from './commands/notifications.js';
 import { databasePgbouncer } from './commands/pgbouncer.js';
+import { backupPolicyGet, backupPolicySet } from './commands/backupPolicy.js';
 import { logsSearch } from './commands/logs.js';
 import { emailTemplatesList, emailTemplatesPreview, emailTemplatesReset, emailTemplatesSet, } from './commands/emailTemplates.js';
-import { certificatesExpiring, certificatesList, } from './commands/certificates.js';
+import { certificatesCustomDelete, certificatesCustomList, certificatesCustomReplace, certificatesCustomUpload, certificatesExpiring, certificatesList, } from './commands/certificates.js';
+import { databaseImport, databaseImports, databasePublicAccess, } from './commands/databaseAccess.js';
+import { proxyConfigClear, proxyConfigGet, proxyConfigSet, proxyConfigValidate } from './commands/proxyConfig.js';
+import { secretProvidersDelete, secretProvidersList, secretProvidersSetAws, secretProvidersSetVault, secretProvidersTest, } from './commands/secretProviders.js';
+import { accessGrantsAdd, accessGrantsList, accessGrantsRemove, accessGrantsUpdate, accessMe, terminalOpen, terminalsKill, terminalsList, terminalsShow, trafficService, trafficSettings, trafficSummary, } from './commands/operations.js';
 import { communityTemplatesImport, communityTemplatesList, communityTemplatesRemove, } from './commands/communityTemplates.js';
 import { pluginsList, pluginsMarketplace, pluginsMarketplaceRefresh, pluginsInstall, pluginsEnable, pluginsDisable, pluginsUninstall, pluginsInspect, pluginsReload, } from './commands/plugins.js';
 import { configCenterList, configCenterGet, configCenterSet, configCenterDelete, } from './commands/configCenter.js';
 import { demoSeed } from './commands/demo.js';
 import { workspacesList, workspacesGet, workspacesCreate, workspacesDelete, } from './commands/workspaces.js';
-import { housekeepingPrune, imagesList, imagesPrune } from './commands/housekeeping.js';
+import { housekeepingPrune, imagesList, imagesPrune, positiveIntOption } from './commands/housekeeping.js';
 import { serverStartAction, serverStopAction, serverStatusAction, serverLogsAction, } from './commands/server.js';
 import { doctorAction } from './commands/doctor.js';
 import { firewallStatus, firewallToggle, firewallAddRule, firewallDeleteRule, firewallApplyRecommended, } from './commands/firewall.js';
 import { sourcesAdd, sourcesKeygen, sourcesList, sourcesRemove, sourcesShow, sourcesTest, } from './commands/sources.js';
+import { githubAppAddManual, githubAppList, githubAppRemove, githubAppRotateKey, githubAppShow, githubAppSync, serviceGithub, } from './commands/githubApps.js';
 import { webhooksAdd, webhooksList, webhooksRemove, webhooksShow, } from './commands/webhooks.js';
 import { deployFromGithub } from './commands/deploy.js';
 import { manifestApply, manifestInit, manifestShow, manifestValidate } from './commands/manifest.js';
@@ -35,6 +41,10 @@ import { buildCacheStatsAction, } from './commands/buildCache.js';
 import { brandingGetAction, brandingSetAction, } from './commands/branding.js';
 import { egressClearAction, egressListAction, egressSetAction, } from './commands/egress.js';
 import { ssoAddAction, ssoListAction, ssoRemoveAction, } from './commands/sso.js';
+import { panelBackupDecryptAction, panelBackupListAction, panelBackupNowAction, panelBackupSetAction, panelBackupStatusAction, } from './commands/panelBackup.js';
+// ── 0.16 T8 surfaces ──
+import { serversList, serversRoles, servicesPlacement, servicesSwarm, servicesTransfers, sourcesAllowOnNodes, sourcesHostKeys, sourcesPinHostKeys, sourcesResetHostKeys, swarmInit, swarmJoin, swarmLeave, swarmSetEnabled, swarmStatus, volumesCreate, } from './commands/multiNode.js';
+// ── end 0.16 T8 ──
 const program = new Command();
 program
     .name('ninedeploy')
@@ -46,27 +56,51 @@ program
 program
     .command('init')
     .description('Initialize local instance and setup admin user (alias for setup)')
-    .action(() => setupAction());
+    .option('--setup-token <token>', 'One-time setup token printed by the installer (or NINEDEPLOY_SETUP_TOKEN)')
+    .action((opts) => setupAction(opts));
 program
     .command('setup')
     .description('Create the first admin user on a fresh instance')
-    .action(() => setupAction());
+    .option('--setup-token <token>', 'One-time setup token printed by the installer (or NINEDEPLOY_SETUP_TOKEN)')
+    .action((opts) => setupAction(opts));
 program
     .command('login')
     .description('Authenticate against a NineDeploy server')
     .action(() => loginAction());
 program
     .command('logout')
-    .description('Clear stored credentials')
+    .description('Revoke this CLI session and clear stored credentials')
     .action(async () => {
     const cfg = loadConfig();
-    // Best-effort server-side revoke of the token before dropping it — a
-    // network failure must not block the local sign-out.
-    if (cfg.token) {
-        await getClient().auth.logout().catch(() => undefined);
+    // r551: revoke ONLY this CLI's session. `POST /auth/logout` bumps the
+    // user's tokenVersion and revokes every session — signing out of the CLI
+    // used to sign the user out of every browser too. It is also on the
+    // no-refresh list, so with an expired access token it failed silently and
+    // the long-lived refresh token stayed live server-side. The sessions list
+    // is refresh-aware and flags the caller's own row (`current`), which
+    // `DELETE /auth/sessions/:id` then revokes. Best-effort: local credentials
+    // are always cleared, and the outcome is printed either way.
+    let outcome = 'No stored credentials — nothing to revoke on the server.';
+    if (cfg.token || cfg.refreshToken) {
+        try {
+            const client = getClient();
+            const current = (await client.auth.sessions.list()).find((s) => s.current);
+            if (current) {
+                await client.auth.sessions.revoke(current.id);
+                outcome = `Revoked this CLI session (#${current.id}) on ${cfg.baseUrl}; other sessions stay signed in.`;
+            }
+            else {
+                outcome = 'The stored credential is not a login session (API token?) — nothing was revoked server-side; delete the token from the dashboard if it should stop working.';
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            outcome = `Could not revoke the session on the server (${msg}). Revoke it from the dashboard or \`ninedeploy sessions revoke <id>\` after logging in again.`;
+        }
     }
     saveConfig({ baseUrl: cfg.baseUrl });
-    console.log('  ✓ Signed out.');
+    console.log('  ✓ Signed out (local credentials cleared).');
+    console.log(`  ${outcome}`);
 });
 program
     .command('whoami')
@@ -112,7 +146,7 @@ program
     }
 });
 // ── Services ──────────────────────────────────────────────────────────────
-const services = program.command('services').description('Manage services');
+const services = program.command('services').alias('service').description('Manage services');
 services.command('list').description('List all services').action(() => servicesList(getClient()));
 services.command('create').description('Create a service (interactive wizard)').action(() => servicesCreate(getClient()));
 services.command('get <id>').description('Show service details').action((id) => servicesGet(getClient(), id));
@@ -130,16 +164,97 @@ services.command('sticky <id>')
     .option('--enable', 'Route every request to the same backend container')
     .option('--disable', 'Remove the sticky-cookie middleware')
     .action((id, opts) => servicesStickyAction(getClient(), id, opts));
+// 0.13: the service's GitHub App link (show, feedback, migrate/finalize/revert).
+services.command('github <id>')
+    .description('Show or change the GitHub App link (commit statuses, PR comments, migrate, finalize, unlink)')
+    .option('--status <onOff>', 'Commit statuses for deploys: on | off')
+    .option('--pr-comment <onOff>', 'PR preview comments: on | off')
+    .option('--migrate <sourceId>', 'Link to the GitHub App installation behind this gh-app source')
+    .option('--finalize', 'Detach the previous source and switch the per-service webhooks off')
+    .option('--unlink', 'Revert: restore the previous source and webhooks, remove the link')
+    .action((id, opts) => serviceGithub(getClient(), id, opts));
+// ── 0.16 T8: build placement, image transfers and Swarm tasks (multi-node) ──
+/* v8 ignore start -- the FakeCommand in test/index.test.ts records but never invokes the action;
+ * the implementations are exercised by test/multiNode.test.ts. */
+services.command('placement <id>')
+    .description('Show or (operator) change where the image is built and which orchestrator runs it')
+    .option('--build-on <where>', 'target (where it runs) | panel | server')
+    .option('--build-server <id>', 'The build server for --build-on server (none clears it)')
+    .option('--push-registry <sourceId>', 'Ship the image through this registry credential (none = stream relay)')
+    .option('--push-repo <repo>', 'Repository for --push-registry, e.g. team/app')
+    .option('--orchestrator <name>', 'container | swarm')
+    .action((id, opts) => servicesPlacement(getClient(), id, opts));
+services.command('transfers <id>')
+    .description('Image transfers of a service, newest first')
+    .option('--limit <n>', 'How many (1-100, default 20)')
+    .action((id, opts) => servicesTransfers(getClient(), id, opts));
+services.command('swarm <id>').description('Swarm tasks of a service').action((id) => servicesSwarm(getClient(), id));
+/* v8 ignore stop */
 // ── Databases ────────────────────────────────────────────────────────────
 const databases = program.command('databases').description('Manage databases');
 databases.command('list').description('List all databases').action(() => dbList(getClient()));
-databases.command('create').description('Create a database (interactive)').action(() => dbCreate(getClient()));
+databases.command('create')
+    .description('Create a database (interactive)')
+    .option('--server <id>', 'Run it on this node (operator; fixed for its life)')
+    .action((opts) => dbCreate(getClient(), opts));
 // ── PgBouncer sidecar (G-32) ─────────────────────────────────────────────
 databases
     .command('pgbouncer <dbId> <action>')
     .description('Manage the PgBouncer sidecar: enable | disable | status (postgres only)')
     .option('--port <port>', 'Override the listen port (enable only)', (v) => Number(v))
     .action((dbId, action, opts) => databasePgbouncer(getClient(), dbId, action, opts));
+// ── Per-database backup policy (0.12) ────────────────────────────────────
+const backupPolicyCmd = databases
+    .command('backup-policy')
+    .description('Per-database backup schedule, retention and destination');
+backupPolicyCmd
+    .command('get <dbId>')
+    .description('Show the backup policy (or the built-in daily schedule)')
+    .action((dbId) => backupPolicyGet(getClient(), dbId));
+backupPolicyCmd
+    .command('set <dbId>')
+    .description('Save the backup policy; unset flags keep their current value')
+    .option('--cron <expr>', '5-field cron (minute hour day month weekday), server local time')
+    .option('--preset <name>', 'daily | 6h | weekly')
+    .option('--keep <n>', 'Scheduled dumps kept locally (1-365)')
+    .option('--keep-remote <n>', 'Remote copies kept (1-365; default: same as --keep)')
+    .option('--destination <dest>', 'Backup destination id, "active" or "local"')
+    .option('--enable', 'Turn scheduled backups on')
+    .option('--disable', 'Turn scheduled backups off for this database')
+    .action((dbId, opts) => backupPolicySet(getClient(), dbId, opts));
+// ── Public access and dump import (0.14) ────────────────────────────────
+/* v8 ignore start -- the FakeCommand in test/index.test.ts records but never invokes the action;
+ * the implementations are exercised by test/databaseAccess.test.ts. */
+databases
+    .command('public-access <id>')
+    .description('Show, enable/update (--enable) or disable (--disable) public access through a TCP sidecar (operator)')
+    .option('--enable', 'Enable or update public access; unset flags keep their current value')
+    .option('--disable', 'Remove the sidecar (the settings are kept)')
+    .option('--port <port>', 'Host port, 1024-65535')
+    .option('--allow <cidr...>', 'Allowed source addresses or CIDRs (replaces the allow-list)')
+    .option('--tls <mode>', 'none | terminate (not for mysql/mariadb)')
+    .option('--tls-host <host>', 'Hostname clients connect to (and the TLS name in terminate mode)')
+    .action((id, opts) => databasePublicAccess(getClient(), id, opts));
+databases
+    .command('import <id>')
+    .description('Import a dump from a local file (chunked, resumable) or a backup destination object (operator)')
+    .option('--file <path>', 'Dump file to upload')
+    .option('--from-s3 <destinationId>', 'Backup destination to read the object from (operator)')
+    .option('--key <key>', 'Object key inside the destination prefix (with --from-s3)')
+    .option('--clean', 'postgres custom format: drop objects before recreating them')
+    .option('--no-single-transaction', 'postgres: do not wrap the restore in one transaction')
+    .option('--drop', 'mongo: drop each collection before restoring it')
+    .option('--confirm-replace', 'redis/valkey/keydb/dragonfly: required, the RDB replaces the whole dataset')
+    .option('--no-safety-backup', 'Skip the pre-import backup (operator, or a database created in the last 10 minutes)')
+    .option('--resume <importId>', 'Continue an interrupted upload of the same file')
+    .option('--no-wait', 'Return once the import has started')
+    .action((id, opts) => databaseImport(getClient(), id, opts));
+databases
+    .command('imports <id>')
+    .description('List a database\'s imports')
+    .option('--watch', 'Keep polling until no import is uploading, pending or running')
+    .action((id, opts) => databaseImports(getClient(), id, opts));
+/* v8 ignore stop */
 // ── Templates ─────────────────────────────────────────────────────────────
 const templates = program.command('templates').description('Browse the template hub and scaffold starter manifests from it');
 templates.command('list').description('List all templates').action(() => tplList(getClient()));
@@ -188,12 +303,21 @@ system.command('rotate-keys')
     .action(() => systemRotateKeys(getClient()));
 // ── Env vars ──────────────────────────────────────────────────────────────
 const envCmd = program.command('env').description('Manage service environment variables');
-envCmd.command('list <serviceId>').description('List a service\'s env vars').action((id) => envList(getClient(), id));
+// 0.12 `--preview`: the service's preview-only set — injected ONLY into its
+// PR previews (overriding the parent's non-secret values there), never into
+// the service itself. Previews still never receive the service's secrets.
+const PREVIEW_FLAG = 'Target the preview-only set: values only this service\'s PR previews receive';
+envCmd.command('list <serviceId>').description('List a service\'s env vars')
+    .option('--preview', PREVIEW_FLAG)
+    .action((id, opts) => envList(getClient(), id, opts));
 envCmd.command('set <serviceId> <key> <value>')
     .description('Create or update an env var (secret by default)')
     .option('--public', 'Store as a plain (non-secret) value')
+    .option('--preview', PREVIEW_FLAG)
     .action((id, key, value, opts) => envSet(getClient(), id, key, value, opts));
-envCmd.command('rm <serviceId> <key>').description('Remove an env var by key').action((id, key) => envRemove(getClient(), id, key));
+envCmd.command('rm <serviceId> <key>').description('Remove an env var by key')
+    .option('--preview', PREVIEW_FLAG)
+    .action((id, key, opts) => envRemove(getClient(), id, key, opts));
 // ── Domains ────────────────────────────────────────────────────────────────
 const domainsCmd = program.command('domains').description('Manage domains & routing');
 domainsCmd.command('list').description('List all domains').action(() => domainsList(getClient()));
@@ -203,6 +327,9 @@ domainsCmd.command('add <serviceId> <host>')
     .option('--no-ssl', 'Serve over plain HTTP (no TLS)')
     .action((id, host, opts) => domainsAdd(getClient(), id, host, opts));
 domainsCmd.command('rm <serviceId> <domainId>').description('Remove a domain').action((svcId, domId) => domainsRemove(getClient(), svcId, domId));
+domainsCmd.command('verify <serviceId> <domainId>')
+    .description('Check a pending domain TXT ownership challenge and bring it live')
+    .action((svcId, domId) => domainsVerify(getClient(), svcId, domId));
 // Domain transfer (G-29) — start / preview / accept / cancel.
 domainsCmd
     .command('transfer <domainId>')
@@ -347,8 +474,20 @@ ssoCmd
 ssoCmd.command('remove <id>').description('Remove a provider by id').action((id) => ssoRemoveAction(getClient(), id));
 // ── Volumes ────────────────────────────────────────────────────────────────
 const volumesCmd = program.command('volumes').description('Manage Docker volumes');
-volumesCmd.command('list').description('List all volumes').action(() => volumesList(getClient()));
-volumesCmd.command('rm <name>').description('Delete a volume (with confirmation)').action((name) => volumesRemove(getClient(), name));
+volumesCmd.command('list')
+    .description('List all volumes')
+    .option('--server <id>', 'A node\'s volumes instead of the panel host\'s')
+    .action((opts) => volumesList(getClient(), opts));
+volumesCmd.command('rm <name>')
+    .description('Delete a volume (with confirmation)')
+    .option('--server <id>', 'Delete it on this node')
+    .action((name, opts) => volumesRemove(getClient(), name, opts));
+/* v8 ignore start -- exercised by test/multiNode.test.ts. */
+volumesCmd.command('create <name>')
+    .description('Create a managed volume (nd-svc-* / nd-db-*) on the panel host or a node')
+    .option('--server <id>', 'Create it on this node')
+    .action((name, opts) => volumesCreate(getClient(), name, opts));
+/* v8 ignore stop */
 // ── Networks ───────────────────────────────────────────────────────────────
 const networksCmd = program.command('networks').description('Manage Docker networks');
 networksCmd.command('list').description('List user-defined networks').action(() => networksList(getClient()));
@@ -375,7 +514,7 @@ backupsCmd
 const alertsCmd = program.command('alerts').description('Manage alert rules');
 alertsCmd.command('list').description('List alert rules').action(() => alertsList(getClient()));
 alertsCmd.command('create <name> <metric> <operator> <threshold>')
-    .description('Create an alert rule (metric: cpu|memory|cert-expiry, operator: > or <)')
+    .description('Create an alert rule (metric: cpu|memory|cert-expiry|disk|server_offline, operator: > or <)')
     .option('-w, --windows <n>', 'Consecutive 30s samples before firing', '1')
     .option('-s, --service <id>', 'Scope to a service (default: host-wide)')
     .action((name, metric, op, threshold, opts) => alertsCreate(getClient(), name, metric, op, threshold, opts));
@@ -410,8 +549,10 @@ plugins.command('list').description('List all installed plugins').action(() => p
 plugins.command('marketplace').description('Browse verified marketplace extensions').action(() => pluginsMarketplace(getClient()));
 plugins.command('marketplace-refresh').description('Bypass the cache and re-fetch the live signed marketplace index').action(() => pluginsMarketplaceRefresh(getClient()));
 plugins.command('inspect <id>').description('Inspect plugin manifest and runtime telemetry').action((id) => pluginsInspect(getClient(), id));
-plugins.command('install <target>').description('Install a plugin (marketplace, npm, git, local)')
-    .option('-s, --source <source>', 'Source type (marketplace, npm, git, local)', 'marketplace')
+plugins.command('install <target>').description('Install a plugin (marketplace, sandbox)')
+    // r440: only what the server can actually load — npm/git/local were
+    // advertised here and always answered 400 UnsupportedPluginSourceError.
+    .option('-s, --source <source>', 'Source type (marketplace, sandbox)', 'marketplace')
     .option('-n, --name <name>', 'Custom display name')
     .option('-v, --version <version>', 'Custom version')
     .option('-d, --desc <description>', 'Description')
@@ -454,8 +595,10 @@ images
 images
     .command('prune')
     .description('Prune images. Refuses to run with no filter; pass --dry-run first.')
-    .option('--keep-last <n>', 'Keep the newest N images per repo:tag (rest are candidates)', (v) => Number(v))
-    .option('--older-than <hours>', 'Only prune images older than N hours', (v) => Number(v))
+    // r554: validated whole numbers (the server's bounds) — `Number(v)` let
+    // `1.5` / `abc` through to an opaque 422.
+    .option('--keep-last <n>', 'Keep the newest N images per repo:tag (rest are candidates)', positiveIntOption(1000))
+    .option('--older-than <hours>', 'Only prune images older than N hours', positiveIntOption(8760))
     .option('--dangling', 'Only prune dangling images (repo/tag both <none>)')
     .option('--dry-run', 'Report what would be deleted without actually deleting')
     .action((opts) => imagesPrune(getClient(), {
@@ -523,6 +666,33 @@ emailTemplatesCmd
 // ── System export/import + deploy log streaming ────────────────────────────
 system.command('export [file]').description('Export the full system state as JSON').action((file) => systemExport(file));
 system.command('import <file>').description('Import a system bundle (destructive)').action((file) => systemImport(file));
+// ── Panel self-backup (0.12) ────────────────────────────────────────────────
+const panelBackupCmd = system.command('panel-backup').description("Scheduled, passphrase-sealed backups of the panel's own state");
+panelBackupCmd.command('status').description('Show the schedule, destination, retention and the last run').action(() => panelBackupStatusAction(getClient()));
+panelBackupCmd
+    .command('set')
+    .description('Change the panel backup settings (omitted options keep their value)')
+    .option('--enable', 'Turn scheduled panel backups on')
+    .option('--disable', 'Turn scheduled panel backups off')
+    .option('--cron <expr>', '5-field cron expression, e.g. "0 3 * * *"')
+    .option('--destination <id>', 'Backup destination id (see Settings → Integrations)')
+    .option('--retain <n>', 'How many panel backups to keep in the destination')
+    .option('--passphrase', 'Prompt for a new recovery passphrase (keep it off this server)')
+    .action((opts) => panelBackupSetAction(getClient(), opts));
+panelBackupCmd
+    .command('now')
+    .description('Back up the panel now')
+    .option('--wait', 'Wait for the run to finish and report its outcome')
+    .action((opts) => panelBackupNowAction(getClient(), opts));
+panelBackupCmd
+    .command('list')
+    .description('List the panel backups in the destination, newest first')
+    .option('--destination <id>', 'Destination to list (default: the configured one)')
+    .action((opts) => panelBackupListAction(getClient(), opts));
+panelBackupCmd
+    .command('decrypt <file> [out]')
+    .description('Offline: open a downloaded .ndpb with the recovery passphrase into a .tar.gz for `system import`')
+    .action((file, out) => panelBackupDecryptAction(file, out));
 // ── Certificates (G-15) ─────────────────────────────────────────────────────
 const certificates = program.command('certificates').description('Traefik certificate inventory and renewal status');
 certificates
@@ -535,6 +705,201 @@ certificates
     .description('Focused list of certificates expiring within N days')
     .option('--days <days>', 'Window in days (default 30)')
     .action((opts) => certificatesExpiring(getClient(), opts));
+// 0.14: uploaded certificates (operator).
+const customCerts = certificates.command('custom').description('Uploaded TLS certificates (operator)');
+/* v8 ignore start -- exercised by test/certificates.test.ts. */
+customCerts.command('list').description('List uploaded certificates, their hostnames, expiry and covered domains')
+    .action(() => certificatesCustomList(getClient()));
+customCerts.command('upload')
+    .description('Upload a certificate chain and its unencrypted private key')
+    .option('--name <name>', 'Display name')
+    .option('--cert <path>', 'PEM certificate chain, leaf first')
+    .option('--key <path>', 'PEM private key (unencrypted)')
+    .action((opts) => certificatesCustomUpload(getClient(), opts));
+customCerts.command('replace <id>')
+    .description('Replace a certificate (e.g. after renewal)')
+    .option('--name <name>', 'New display name')
+    .option('--cert <path>', 'PEM certificate chain, leaf first')
+    .option('--key <path>', 'PEM private key (unencrypted)')
+    .action((id, opts) => certificatesCustomReplace(getClient(), id, opts));
+customCerts.command('delete <id>')
+    .description('Delete a certificate (covered domains fall back to ACME)')
+    .alias('rm')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .action((id, opts) => certificatesCustomDelete(getClient(), id, opts));
+/* v8 ignore stop */
+// ── Proxy custom config (0.14) ──────────────────────────────────────────────
+const proxyCmd = program.command('proxy').description('Traefik proxy management (operator)');
+const proxyConfigCmd = proxyCmd.command('config').description('Custom Traefik dynamic config (custom.yml)');
+/* v8 ignore start -- exercised by test/proxyConfig.test.ts. */
+proxyConfigCmd.command('get').description('Show the custom config, its status and the last error').action(() => proxyConfigGet(getClient()));
+proxyConfigCmd.command('validate')
+    .description('Validate a YAML file without applying it')
+    .option('--file <path>', 'YAML file')
+    .action((opts) => proxyConfigValidate(getClient(), opts));
+proxyConfigCmd.command('set')
+    .description('Validate and apply a YAML file')
+    .option('--file <path>', 'YAML file')
+    .action((opts) => proxyConfigSet(getClient(), opts));
+proxyConfigCmd.command('clear')
+    .description('Remove the custom config')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .action((opts) => proxyConfigClear(getClient(), opts));
+/* v8 ignore stop */
+// ── Secret managers (0.14) ──────────────────────────────────────────────────
+const secretsCmd = program.command('secrets').description('Deploy-time secret references');
+const providersCmd = secretsCmd.command('providers').description('HashiCorp Vault / OpenBao and AWS Secrets Manager (operator)');
+/* v8 ignore start -- exercised by test/secretProviders.test.ts. */
+providersCmd.command('list').description('List the secret managers and their last test').action(() => secretProvidersList(getClient()));
+providersCmd.command('set-vault')
+    .description('Configure Vault / OpenBao (KV v2); token from --token-file or NINEDEPLOY_VAULT_TOKEN')
+    .option('--address <url>', 'Vault address (https)')
+    .option('--namespace <ns>', 'Vault Enterprise / OpenBao namespace')
+    .option('--mount <path>', 'KV v2 mount (default secret)')
+    .option('--auth <method>', 'token | approle (default token)')
+    .option('--approle-mount <path>', 'AppRole auth mount (default approle)')
+    .option('--token-file <path>', 'File holding the token (or NINEDEPLOY_VAULT_TOKEN)')
+    .option('--role-id-file <path>', 'File holding the AppRole role id (or NINEDEPLOY_VAULT_ROLE_ID)')
+    .option('--secret-id-file <path>', 'File holding the AppRole secret id (or NINEDEPLOY_VAULT_SECRET_ID)')
+    .option('--enable', 'Enable the provider')
+    .option('--disable', 'Disable the provider (references stay literal)')
+    .action((opts) => secretProvidersSetVault(getClient(), opts));
+providersCmd.command('set-aws')
+    .description('Configure AWS Secrets Manager; secret key from --secret-access-key-file or NINEDEPLOY_AWS_SECRET_ACCESS_KEY')
+    .option('--region <region>', 'AWS region, e.g. eu-west-1')
+    .option('--endpoint <url>', 'VPC endpoint or compatible service (https)')
+    .option('--role-arn <arn>', 'IAM role to assume')
+    .option('--external-id <id>', 'External id for the role (with --role-arn)')
+    .option('--role-session-name <name>', 'Session name (default ninedeploy)')
+    .option('--access-key-id <id>', 'Access key id (or NINEDEPLOY_AWS_ACCESS_KEY_ID)')
+    .option('--secret-access-key-file <path>', 'File holding the secret access key (or NINEDEPLOY_AWS_SECRET_ACCESS_KEY)')
+    .option('--session-token-file <path>', 'File holding a session token (or NINEDEPLOY_AWS_SESSION_TOKEN)')
+    .option('--enable', 'Enable the provider')
+    .option('--disable', 'Disable the provider (references stay literal)')
+    .action((opts) => secretProvidersSetAws(getClient(), opts));
+providersCmd.command('test <kind>')
+    .description('Test a provider (vault | aws), optionally reading one secret')
+    .option('--probe-path <path>', 'vault: also read this path (relative to the mount)')
+    .option('--probe-secret-id <id>', 'aws: also read this secret')
+    .action((kind, opts) => secretProvidersTest(getClient(), kind, opts));
+providersCmd.command('delete <kind>')
+    .description('Remove a provider (vault | aws); its references stay literal at deploy')
+    .alias('rm')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .action((kind, opts) => secretProvidersDelete(getClient(), kind, opts));
+/* v8 ignore stop */
+// ── 0.15: terminals, traffic analytics, access grants ────────────────────
+const terminalsCmd = program.command('terminals').description('Terminal session history and termination (operator)');
+/* v8 ignore start -- exercised by test/operations.test.ts. */
+terminalsCmd.command('list')
+    .description('List terminal sessions, newest first (metadata only)')
+    .option('--status <status>', 'pending | active | ended | failed | expired')
+    .option('--target <kind>', 'service | database | container | host')
+    .option('--limit <n>', 'Page size (1-200, default 50)')
+    .option('--before <id>', 'Page back from this session id')
+    .action((opts) => terminalsList(getClient(), opts));
+terminalsCmd.command('show <id>').description('Show one terminal session').action((id) => terminalsShow(getClient(), id));
+terminalsCmd.command('kill <id>')
+    .description('Terminate a live session (or revoke a pending one)')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .action((id, opts) => terminalsKill(getClient(), id, opts));
+/* v8 ignore stop */
+const terminalCmd = program.command('terminal').alias('shell').description('Open an interactive shell (operator; needs a TTY)');
+/* v8 ignore start -- exercised by test/operations.test.ts. */
+terminalCmd.command('service <id>')
+    .description('Shell into the container of a service')
+    .option('--replica <n>', 'Replica number (1-based)')
+    .option('--node <serverId>', 'A node the service runs on (fan-out target)')
+    .action((id, opts) => terminalOpen(getClient(), 'service', id, opts));
+terminalCmd.command('db <id>')
+    .description('Shell into the container of a database')
+    .option('--client', 'Open the engine client (psql, mysql, redis-cli) with the stored credentials')
+    .action((id, opts) => terminalOpen(getClient(), 'db', id, opts));
+terminalCmd.command('container <name>')
+    .description('Shell into a managed container on the panel host')
+    .action((name) => terminalOpen(getClient(), 'container', name));
+terminalCmd.command('host [serverId]')
+    .description('Root shell on the panel host or a node (off by default; asks for your password)')
+    .action((serverId) => terminalOpen(getClient(), 'host', serverId));
+/* v8 ignore stop */
+const trafficCmd = program.command('traffic').description('Traffic analytics (opt-in)');
+/* v8 ignore start -- exercised by test/operations.test.ts. */
+trafficCmd.command('settings')
+    .description('Show or change traffic analytics (enabling or disabling recreates Traefik once)')
+    .option('--enable', 'Turn analytics on')
+    .option('--disable', 'Turn analytics off')
+    .option('--retention <days>', 'Keep hourly rows this many days (1-400)')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .action((opts) => trafficSettings(getClient(), opts));
+trafficCmd.command('summary')
+    .description('Instance traffic: totals, percentiles and top domains (operator)')
+    .option('--range <range>', '1h | 24h | 7d | 30d (default 24h)')
+    .option('--top <n>', 'Top domains (1-50, default 10)')
+    .action((opts) => trafficSummary(getClient(), opts));
+trafficCmd.command('service <id>')
+    .description('Traffic of one service, by domain')
+    .option('--range <range>', '1h | 24h | 7d | 30d (default 24h)')
+    .action((id, opts) => trafficService(getClient(), id, opts));
+/* v8 ignore stop */
+const accessCmd = program.command('access').description('Project and environment access grants');
+const grantsCmd = accessCmd.command('grants').description('Manage access grants in a workspace (workspace admin)');
+/* v8 ignore start -- exercised by test/operations.test.ts. */
+grantsCmd.command('list')
+    .description('List the grants in a workspace')
+    .option('--workspace <id>', 'Workspace id')
+    .option('--user <id>', 'Only this user')
+    .option('--project <id>', 'Only this project')
+    .option('--environment <id>', 'Only this environment')
+    .action((opts) => accessGrantsList(getClient(), opts));
+grantsCmd.command('add')
+    .description('Grant a role on a project, an environment, or both')
+    .option('--workspace <id>', 'Workspace id')
+    .option('--email <email>', 'The user, by email')
+    .option('--user <id>', 'The user, by id')
+    .option('--project <id>', 'Project id')
+    .option('--environment <id>', 'Environment id')
+    .option('--role <role>', 'viewer | member | admin')
+    .action((opts) => accessGrantsAdd(getClient(), opts));
+grantsCmd.command('update <grantId>')
+    .description('Change the role of a grant, or suspend or reinstate it')
+    .option('--workspace <id>', 'Workspace id')
+    .option('--role <role>', 'viewer | member | admin')
+    .option('--suspend', 'Keep the grant but stop it giving access')
+    .option('--reinstate', 'Make a suspended grant give access again')
+    .action((grantId, opts) => accessGrantsUpdate(getClient(), grantId, opts));
+grantsCmd.command('remove <grantId>')
+    .alias('rm')
+    .description('Revoke a grant')
+    .option('--workspace <id>', 'Workspace id')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .action((grantId, opts) => accessGrantsRemove(getClient(), grantId, opts));
+accessCmd.command('me').description('Your own grants and guest workspaces').action(() => accessMe(getClient()));
+/* v8 ignore stop */
+// ── 0.16 T8: remote nodes and Swarm (operator) ───────────────────────────
+const serversCmd = program.command('servers').description('Remote nodes: agent capabilities, build-server role (operator)');
+/* v8 ignore start -- exercised by test/multiNode.test.ts. */
+serversCmd.command('list').description('List nodes with their agent version, build role, databases and Swarm membership').action(() => serversList(getClient()));
+serversCmd.command('roles <id>')
+    .description('Set the build-server role of a node')
+    .option('--build-server <onOff>', 'on | off')
+    .option('--build-concurrency <n>', 'Builds at once on this node (1-8)')
+    .action((id, opts) => serversRoles(getClient(), id, opts));
+/* v8 ignore stop */
+const swarmCmd = program.command('swarm').description('Docker Swarm on the panel host (operator, opt-in per service)');
+/* v8 ignore start -- exercised by test/multiNode.test.ts. */
+swarmCmd.command('status').description('Swarm state, the join address and the nodes').action(() => swarmStatus(getClient()));
+swarmCmd.command('init')
+    .description('Initialise Swarm on the panel host (asks for your password)')
+    .option('--advertise-addr <ip>', 'The address nodes reach the panel host on')
+    .action((opts) => swarmInit(getClient(), opts));
+swarmCmd.command('enable').description('Allow Swarm deploys (asks for your password)').action(() => swarmSetEnabled(getClient(), true));
+swarmCmd.command('disable').description('Refuse new Swarm deploys; running stacks keep running').action(() => swarmSetEnabled(getClient(), false));
+swarmCmd.command('join <serverId>').description('Join a node to the swarm as a worker').action((serverId) => swarmJoin(getClient(), serverId));
+swarmCmd.command('leave <serverId>')
+    .description('Drain a node and take it out of the swarm')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .action((serverId, opts) => swarmLeave(getClient(), serverId, opts));
+/* v8 ignore stop */
 deploys.command('watch <serviceId> <deployId>').description('Stream a deployment\'s build logs live').action((svcId, depId) => deploysWatch(svcId, depId));
 // ── Diagnostics ───────────────────────────────────────────────────────────
 program
@@ -548,10 +913,49 @@ const sources = program.command('sources').alias('creds').description('Manage pr
  * the implementation is exercised end-to-end by test/sources.test.ts. */
 sources.command('list').description('List configured sources').action(() => sourcesList(getClient()));
 sources.command('show <id>').description('Show one source in detail').action((id) => sourcesShow(getClient(), id));
-sources.command('add [name]').description('Add a new source (interactive; PAT/SSH key from env or masked prompt)').action((name) => sourcesAdd(getClient(), name));
+sources.command('add [name]')
+    .description('Add a new source (interactive; PAT/SSH key from env or masked prompt)')
+    .option('--base-url <url>', 'Gitea base URL, e.g. https://git.example.com (enables the live test and repo list)')
+    .action((name, opts) => sourcesAdd(getClient(), name, opts));
 sources.command('test [id]').description('Verify that a stored source token still authenticates').action((id) => sourcesTest(getClient(), id));
 sources.command('keygen [id]').description('Generate an ed25519 deploy-key pair on the panel and print the public key').action((id) => sourcesKeygen(getClient(), id));
 sources.command('remove [id]').description('Remove a source (with confirmation)').alias('rm').action((id) => sourcesRemove(getClient(), id));
+// 0.16 T8 (multi-node): send this PAT or deploy key to nodes for clones there.
+sources.command('allow-on-nodes <id> <onOff>')
+    .description('Allow (on, asks for your password) or stop (off) sending this credential to nodes for clones')
+    .action((id, onOff) => sourcesAllowOnNodes(getClient(), id, onOff));
+// 0.15.8: pin the git host's SSH keys for deploy-key clones the panel makes.
+sources.command('pin-host-keys <id> <onOff>')
+    .description('Pin (on) or stop pinning (off, asks for your password) the git host SSH keys of a deploy-key source')
+    .action((id, onOff) => sourcesPinHostKeys(getClient(), id, onOff));
+sources.command('reset-host-keys <id>')
+    .description('Forget the pinned git host keys so the next clone learns them again (asks for your password)')
+    .action((id) => sourcesResetHostKeys(getClient(), id));
+sources.command('host-keys <id>').description('Show the git host key fingerprints a source has pinned').action((id) => sourcesHostKeys(getClient(), id));
+/* v8 ignore stop */
+// ── GitHub Apps (0.13) ─────────────────────────────────────────────────────
+const githubApp = program.command('github-app').description('Manage GitHub Apps (one-click setup runs in the panel: Sources → GitHub Apps)');
+/* v8 ignore start -- see sources.ts note above; exercised by test/githubApps.test.ts. */
+githubApp.command('list').description('List registered GitHub Apps').action(() => githubAppList(getClient()));
+githubApp.command('show <id>').description('Show a GitHub App and its installations').action((id) => githubAppShow(getClient(), id));
+githubApp.command('add-manual')
+    .description('Register an existing GitHub App or one on GitHub Enterprise Server (key from --key-file or NINEDEPLOY_GITHUB_APP_KEY)')
+    .option('--name <name>', 'Display name')
+    .option('--app-id <id>', 'GitHub App ID')
+    .option('--key-file <path>', 'Path to the App private key (.pem)')
+    .option('--web-base-url <url>', 'GHES web URL, e.g. https://github.example.com (with --api-base-url)')
+    .option('--api-base-url <url>', 'GHES API URL, e.g. https://github.example.com/api/v3 (with --web-base-url)')
+    .action((opts) => githubAppAddManual(getClient(), opts));
+githubApp.command('sync <id>').description('Sync installations from GitHub (creates their gh-app sources)').action((id) => githubAppSync(getClient(), id));
+githubApp.command('rotate-key <id>')
+    .description('Replace the App private key (verified with GitHub first)')
+    .option('--key-file <path>', 'Path to the new private key (.pem)')
+    .action((id, opts) => githubAppRotateKey(getClient(), id, opts));
+githubApp.command('remove <id>')
+    .description('Forget a GitHub App (its installation sources stay)')
+    .alias('rm')
+    .option('-y, --yes', 'Skip the confirmation prompt')
+    .action((id, opts) => githubAppRemove(getClient(), id, opts));
 /* v8 ignore stop */
 // ── Deploy (one-shot private GitHub deploy) ────────────────────────────────
 const deploy = program.command('deploy').description('End-to-end deploy helpers');