oche-cli 0.1.2 → 0.3.0

package/README.md

@@ -24,6 +24,28 @@ oche repos
 
 Commit messages are written by your Oche server with the model it's configured for (OpenRouter), so the CLI needs no AI key. Your staged diff goes to your server and on to OpenRouter. Pass `-m "message"` to skip AI.
 
+## Deployments: Coolify from the terminal
+
+When the repo is linked to a Coolify instance, these read and drive it through your Oche server, which holds the Coolify token.
+
+```sh
+oche logs --stage prod            # the running container's log: why it's crash-looping
+oche logs --stage prod --failures # just the errors and the tail
+oche logs --app api --build       # the build log of the latest deployment instead
+oche deployments                  # recent deployments per app: status, commit, how long, when
+oche envs                         # which stages define each variable (names only)
+oche envs --stage prod --key DATABASE_URL
+oche deploy --stage staging       # redeploy (--force rebuilds without the cache); asks first
+oche rollback --app api           # the images Coolify can go back to
+oche rollback --app api --to a1b2c3d
+oche explain --stage prod         # ask your server's AI what broke the last failed deployment
+oche preflight --to prod          # missing variables, and whether staging is healthy
+```
+
+Each one picks the app with `--app <name>` (or the start of its uuid) or `--stage prod|staging|dev`; with one app it needs neither, and with several it says which ones there are. `oche deploy` and `oche rollback` ask before they act unless you pass `-y`.
+
+`oche envs` never prints values. The server compares names, and whether staging and production hold the same value, and sends only that. Log lines Coolify marks as holding secrets are left out too.
+
 ## Without a server: `oche pr`
 
 `oche pr` works from your machine alone. It talks to OpenRouter for the commit message and to GitHub with your own token, so it needs no Oche login.

package/dist/index.js

@@ -3371,7 +3371,7 @@ var program = new Command();
 // package.json
 var package_default = {
   name: "oche-cli",
-  version: "0.1.2",
+  version: "0.3.0",
   description: "Command-line client for Oche: promote dev \u2192 staging \u2192 main from your terminal.",
   license: "MIT",
   repository: {
@@ -3503,6 +3503,18 @@ var Client = class {
   preflight(r, to) {
     return this.request("GET", `${repoPath(r)}/preflight?to=${to}`);
   }
+  /* ---- npm publishing ---- */
+  npmStatus(r) {
+    return this.request("GET", `${repoPath(r)}/npm`);
+  }
+  /** Opens (or updates) the PR that adds the publish workflow. */
+  npmSetup(r, body) {
+    return this.request("POST", `${repoPath(r)}/npm`, body);
+  }
+  /** Records that npm now trusts the workflow; npm has no API the server could check. */
+  npmTrust(r, body) {
+    return this.request("POST", `${repoPath(r)}/npm/trust`, body);
+  }
   events(repo, limit) {
     const q = new URLSearchParams({ limit: String(limit) });
     if (repo) q.set("repo", `${repo.owner}/${repo.repo}`);
@@ -3563,6 +3575,449 @@ function networkError(e, baseUrl, timeoutMs = TIMEOUT_MS) {
   return new CliError(`Couldn't reach ${baseUrl} (${reason}).`);
 }
 
+// src/git.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var slug = (r) => `${r.owner}/${r.repo}`;
+var GITHUB_HOST = /^(?:www\.|ssh\.)?github\.com(?:-[\w.-]+)?$/i;
+var OWNER = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+var REPO = /^[A-Za-z0-9._-]{1,100}$/;
+var URL_SCHEMES = /* @__PURE__ */ new Set(["https:", "http:", "ssh:", "git:", "git+ssh:", "ssh+git:"]);
+function toSlug(path2) {
+  const parts = path2.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2) return null;
+  const [owner, repo] = parts;
+  if (!OWNER.test(owner) || !REPO.test(repo) || repo === "." || repo === "..") return null;
+  return { owner, repo };
+}
+function parseGitHubRemote(remote) {
+  const s = remote.trim();
+  let host;
+  let path2;
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) {
+    let u;
+    try {
+      u = new URL(s);
+    } catch {
+      return null;
+    }
+    if (!URL_SCHEMES.has(u.protocol)) return null;
+    host = u.hostname;
+    path2 = decodeURIComponent(u.pathname);
+  } else {
+    const m = /^(?:[^@\s/]+@)?([^:\s/]+):(.+)$/.exec(s);
+    if (!m) return null;
+    host = m[1];
+    path2 = m[2];
+  }
+  if (!GITHUB_HOST.test(host)) return null;
+  return toSlug(path2);
+}
+function parseRepoArg(arg) {
+  const s = arg.trim();
+  const found = /^[^/\s:@]+\/[^/\s:@]+$/.test(s) ? toSlug(s) : parseGitHubRemote(s);
+  if (!found) throw new CliError(`Expected owner/repo, got "${arg}".`);
+  return found;
+}
+var run = promisify(execFile);
+async function inferRepo(cwd = process.cwd()) {
+  let url;
+  try {
+    const { stdout } = await run("git", ["remote", "get-url", "origin"], { cwd });
+    url = stdout.trim();
+  } catch (e) {
+    if (e.code === "ENOENT") {
+      throw new CliError("git isn't installed, so the repo can't be inferred. Pass owner/repo.");
+    }
+    throw new CliError('No repo given and no git remote "origin" here. Pass owner/repo.');
+  }
+  const found = parseGitHubRemote(url);
+  if (!found) throw new CliError(`origin (${url}) isn't a GitHub repo. Pass owner/repo.`);
+  return found;
+}
+async function resolveRepo(arg) {
+  return arg ? parseRepoArg(arg) : inferRepo();
+}
+
+// src/ui.ts
+import { createInterface } from "readline";
+import { styleText } from "util";
+function paint(format, text, stream = process.stdout) {
+  if (process.env.NO_COLOR) return text;
+  return styleText(format, text, { stream, validateStream: true });
+}
+var c = {
+  bold: (s) => paint("bold", s),
+  dim: (s) => paint("dim", s),
+  green: (s) => paint("green", s),
+  red: (s) => paint("red", s),
+  yellow: (s) => paint("yellow", s),
+  cyan: (s) => paint("cyan", s)
+};
+var print = (line = "") => void process.stdout.write(`${line}
+`);
+var printJson = (data) => print(JSON.stringify(data, null, 2));
+var ok = (msg) => print(`${c.green("\u2713")} ${msg}`);
+var warn = (msg) => process.stderr.write(`${paint("yellow", "!", process.stderr)} ${msg}
+`);
+var fail = (msg) => process.stderr.write(`${paint("red", "\u2717", process.stderr)} ${msg}
+`);
+function relativeTime(iso, now = Date.now()) {
+  if (!iso) return "";
+  const then = Date.parse(iso);
+  if (Number.isNaN(then)) return "";
+  const s = Math.max(0, Math.round((now - then) / 1e3));
+  if (s < 45) return "just now";
+  const m = Math.round(s / 60);
+  if (m < 60) return `${m}m ago`;
+  const h = Math.round(m / 60);
+  if (h < 24) return `${h}h ago`;
+  const d = Math.round(h / 24);
+  if (d < 30) return `${d}d ago`;
+  return new Date(then).toISOString().slice(0, 10);
+}
+function duration(from, to) {
+  if (!from || !to) return "";
+  const ms = Date.parse(to) - Date.parse(from);
+  if (Number.isNaN(ms) || ms < 0) return "";
+  const s = Math.round(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m ${s % 60}s`;
+  return `${Math.floor(m / 60)}h ${m % 60}m`;
+}
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
+}
+var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+function columns(rows, indent = "  ") {
+  const plainOf = (cell) => typeof cell === "string" ? cell : cell[0];
+  const styledOf = (cell) => typeof cell === "string" ? cell : cell[1];
+  const widths = [];
+  for (const row of rows) row.forEach((cell, i) => widths[i] = Math.max(widths[i] ?? 0, plainOf(cell).length));
+  return rows.map(
+    (row) => indent + row.map((cell, i) => i === row.length - 1 ? styledOf(cell) : styledOf(cell) + " ".repeat((widths[i] ?? 0) - plainOf(cell).length)).join("  ").trimEnd()
+  );
+}
+var isInteractive = () => Boolean(process.stdin.isTTY);
+var reader = null;
+async function readLine() {
+  if (!reader) {
+    const rl = createInterface({ input: process.stdin, crlfDelay: Infinity, terminal: false });
+    reader = { rl, lines: rl[Symbol.asyncIterator]() };
+  }
+  const next = await reader.lines.next();
+  if (next.done) throw new CliError("No input: stdin was closed.");
+  return next.value;
+}
+function closeReader() {
+  reader?.rl.close();
+  reader = null;
+}
+async function ask(question, fallback) {
+  process.stderr.write(fallback ? `${question} ${paint("dim", `(${fallback})`, process.stderr)}: ` : `${question}: `);
+  const answer = (await readLine()).trim();
+  if (isInteractive()) closeReader();
+  else process.stderr.write("\n");
+  return answer || fallback || "";
+}
+async function askHidden(question) {
+  process.stderr.write(`${question}: `);
+  if (!isInteractive()) {
+    const line = (await readLine()).trim();
+    process.stderr.write("\n");
+    return line;
+  }
+  closeReader();
+  const stdin = process.stdin;
+  return new Promise((resolve, reject) => {
+    let buf = "";
+    const finish = (err) => {
+      stdin.off("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+      process.stderr.write("\n");
+      if (err) reject(err);
+      else resolve(buf.trim());
+    };
+    const onData = (chunk) => {
+      const text = chunk.toString().replace(/\x1b\[[0-9;]*[A-Za-z~]/g, "");
+      for (const ch of text) {
+        if (ch === "\r" || ch === "\n") return finish();
+        if (ch === "") return finish(new CliError("Cancelled.", 130));
+        if (ch === "") return buf ? finish() : finish(new CliError("Cancelled.", 130));
+        if (ch === "\x7F" || ch === "\b") buf = buf.slice(0, -1);
+        else if (ch === "") buf = "";
+        else if (ch >= " ") buf += ch;
+      }
+    };
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on("data", onData);
+  });
+}
+async function confirm(question, defaultYes = false) {
+  if (!isInteractive()) throw new CliError(`${question} Needs confirmation; pass --yes to run without a prompt.`);
+  const hint = defaultYes ? "Y/n" : "y/N";
+  process.stderr.write(`${question} ${paint("dim", `[${hint}]`, process.stderr)} `);
+  const answer = (await readLine()).trim().toLowerCase();
+  closeReader();
+  if (!answer) return defaultYes;
+  return answer === "y" || answer === "yes";
+}
+
+// src/coolify.ts
+var STAGES = ["dev", "staging", "prod"];
+var STAGE_LABEL = { dev: "dev", staging: "staging", prod: "production" };
+var appLabel = (a) => `${a.name} (${a.stage})`;
+var visible = (lines) => lines.filter((l) => !l.hidden);
+var note = (text) => void process.stderr.write(`${paint("dim", text, process.stderr)}
+`);
+function stateText(app) {
+  const text = app.health ? `${app.state}:${app.health}` : app.state;
+  if (app.state === "running") return app.health === "unhealthy" ? c.yellow(text) : c.green(text);
+  if (app.state === "unknown") return c.dim(text);
+  return c.red(text);
+}
+function statusText(status2) {
+  if (status2 === "finished") return c.green(status2);
+  if (status2 === "failed") return c.red(status2);
+  if (status2 === "queued" || status2 === "in_progress") return c.yellow(status2);
+  return c.dim(status2);
+}
+async function coolifyApps(api, repo) {
+  const data = await api.deployments(repo);
+  if (!data.instance) {
+    throw new CliError(`${slug(repo)} isn't linked to a Coolify instance. Link one in the dashboard, under the repo's Coolify panel.`);
+  }
+  if (!data.apps.length) {
+    const others = [...data.otherBranches.map((a) => `${a.name} (${a.branch ?? "?"})`), ...data.sameName.map((a) => `${a.name} (${a.repo ?? "?"})`)];
+    throw new CliError(
+      others.length ? `No Coolify app builds ${slug(repo)} from its dev, staging or main branch. Coolify has: ${others.join(", ")}.` : `No Coolify app builds ${slug(repo)}. Set one up in the dashboard, under the repo's Coolify panel.`
+    );
+  }
+  return data;
+}
+function matching(apps, opts) {
+  const wanted = opts.app?.trim().toLowerCase();
+  return apps.filter(
+    (a) => (!opts.stage || a.stage === opts.stage) && (!wanted || a.name.toLowerCase() === wanted || a.uuid === wanted || a.uuid.startsWith(wanted))
+  );
+}
+var appList = (apps) => apps.map(appLabel).join(", ");
+function pickApp(data, opts) {
+  const found = matching(data.apps, opts);
+  if (found.length === 1) return found[0];
+  if (!found.length) {
+    const asked = [opts.app ? `--app ${opts.app}` : "", opts.stage ? `--stage ${opts.stage}` : ""].filter(Boolean).join(" ");
+    throw new CliError(`Nothing matches ${asked}. This repo has: ${appList(data.apps)}.`);
+  }
+  throw new CliError(`Several apps match: ${appList(found)}. Pick one with --app <name> or --stage <prod|staging|dev>.`);
+}
+var MAX_TAIL = 2e3;
+async function logsCommand(getClient, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const api = await getClient();
+  const app = pickApp(await coolifyApps(api, repo), opts);
+  const tail = opts.lines === 0 ? MAX_TAIL : opts.lines;
+  if (!opts.build && !opts.deployment) {
+    const logs = await api.appLogs(repo, app.uuid, tail);
+    const lines2 = visible(logs.lines);
+    if (opts.json) return printJson({ ...logs, lines: lines2 });
+    note(`${appLabel(app)} \xB7 container log \xB7 ${stateText(logs.app)}${app.fqdn ? ` \xB7 ${app.fqdn}` : ""}`);
+    if (!lines2.length) note("Coolify returned no container log. The app may never have started; try --build.");
+    return printLines(opts.failures ? logs.excerpt : lines2.map((l) => l.output), opts.failures ? 0 : tail);
+  }
+  const deploymentUuid = opts.deployment ?? app.deployments[0]?.uuid;
+  if (!deploymentUuid) throw new CliError(`${appLabel(app)} has no deployments on Coolify yet. Start one with \`oche deploy --app ${app.name}\`.`);
+  const detail = await api.deployment(repo, app.uuid, deploymentUuid);
+  const lines = visible(detail.lines);
+  if (opts.json) return printJson({ ...detail, lines });
+  const d = detail.deployment;
+  note(`${appLabel(app)} \xB7 build log \xB7 ${d.status} \xB7 ${d.commit?.slice(0, 7) ?? "?"} \xB7 ${relativeTime(d.updatedAt)} \xB7 ${deploymentUuid}`);
+  if (!lines.length) {
+    note("Coolify returned no build log for this deployment. Check the Coolify API token has read:sensitive, or try a more recent deployment.");
+    return;
+  }
+  printLines(opts.failures ? detail.excerpt : lines.map((l) => l.output), opts.failures ? 0 : opts.lines);
+}
+function printLines(lines, tail) {
+  const shown = tail > 0 && lines.length > tail ? lines.slice(-tail) : lines;
+  if (shown.length < lines.length) note(`\u2026showing the last ${plural(shown.length, "line")} of ${lines.length}; -n 0 for all.`);
+  for (const line of shown) print(line);
+}
+async function deploymentsCommand(getClient, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const data = await coolifyApps(await getClient(), repo);
+  const apps = matching(data.apps, opts);
+  if (!apps.length) throw new CliError(`Nothing matches. This repo has: ${appList(data.apps)}.`);
+  if (opts.json) return printJson({ ...data, apps: apps.map((a) => ({ ...a, deployments: a.deployments.slice(0, opts.limit) })) });
+  apps.forEach((app, i) => {
+    if (i) print();
+    const where = app.fqdn ?? (app.branch ? `${app.branch} branch` : "");
+    print(`${c.bold(app.name)}  ${STAGE_LABEL[app.stage]}  ${stateText(app)}${where ? `  ${c.dim(where)}` : ""}`);
+    const recent = app.deployments.slice(0, opts.limit);
+    if (!recent.length) return print(c.dim("  never deployed"));
+    columns(
+      recent.map((d) => {
+        const sha = d.commit?.slice(0, 7) ?? "";
+        const took = duration(d.createdAt, d.updatedAt);
+        const when = relativeTime(d.updatedAt);
+        return [
+          [d.status, statusText(d.status)],
+          [sha, c.dim(sha)],
+          [took, c.dim(took)],
+          [when, c.dim(when)],
+          [d.trigger, c.dim(d.trigger)],
+          truncate((d.commitMessage ?? "").split("\n")[0] ?? "", 56)
+        ];
+      })
+    ).forEach((l) => print(l));
+  });
+  print(c.dim(`
+${data.instance.url}`));
+}
+var ISSUE_LABEL = {
+  "missing-in-prod": "missing in production",
+  "missing-in-staging": "missing in staging",
+  "same-secret": "same value in staging and production"
+};
+var issueText = (issue) => issue === null ? "" : issue === "missing-in-prod" ? c.red(ISSUE_LABEL[issue]) : c.yellow(ISSUE_LABEL[issue]);
+async function envsCommand(getClient, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const { groups } = await (await getClient()).envs(repo);
+  const key = opts.key?.trim().toLowerCase();
+  const kept = groups.filter((g) => !opts.stage || g.apps[opts.stage]).map((g) => ({ ...g, rows: key ? g.rows.filter((r) => r.key.toLowerCase().includes(key)) : g.rows }));
+  if (opts.json) return printJson({ groups: kept });
+  if (!kept.some((g) => g.rows.length)) {
+    const where = opts.stage ? ` on ${STAGE_LABEL[opts.stage]}` : "";
+    print(key ? `No variable matching "${opts.key}"${where} on ${slug(repo)}.` : `No environment variables${where} on ${slug(repo)}'s Coolify apps.`);
+    return;
+  }
+  kept.forEach((g, i) => {
+    if (i) print();
+    printGroup(g, opts.stage, !key);
+  });
+  print(c.dim("\nOche compares names, and whether staging and production hold the same value. It never shows values."));
+}
+function printGroup(group, only, totals) {
+  const stages = STAGES.filter((s) => group.apps[s] && (!only || s === only));
+  const where = stages.map((s) => `${s}: ${group.apps[s].name}`).join(" \xB7 ");
+  print(`${c.bold(group.label)}  ${c.dim(where)}`);
+  const header = [["VARIABLE", c.dim("VARIABLE")], ...stages.map((s) => [s, c.dim(s)]), ""];
+  const rows = group.rows.map((r) => [
+    r.key,
+    ...stages.map((s) => {
+      if (r.present[s] === void 0) return ["-", c.dim("-")];
+      return r.present[s] ? ["\u2713", c.green("\u2713")] : ["\xB7", c.red("\xB7")];
+    }),
+    issueText(r.issue)
+  ]);
+  columns([header, ...rows]).forEach((l) => print(l));
+  if (!totals) return;
+  const { missingInProd, missingInStaging, sameSecret } = group.counts;
+  const issues = [
+    missingInProd ? c.red(`${missingInProd} missing in production`) : "",
+    missingInStaging ? c.yellow(`${missingInStaging} missing in staging`) : "",
+    sameSecret ? c.yellow(`${sameSecret} shared with staging`) : ""
+  ].filter(Boolean);
+  print(issues.length ? `  ${issues.join(c.dim(" \xB7 "))}` : c.dim("  in step across environments"));
+}
+async function deployCommand(getClient, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const api = await getClient();
+  const app = pickApp(await coolifyApps(api, repo), opts);
+  const what = opts.force ? "Rebuild" : "Redeploy";
+  if (!opts.yes && !await confirm(`${what} ${appLabel(app)} on ${slug(repo)}${opts.force ? ", ignoring the build cache" : ""}?`, app.stage !== "prod")) {
+    return print("Cancelled.");
+  }
+  const { deploymentUuid } = await api.deploy(repo, app.uuid, Boolean(opts.force));
+  if (opts.json) return printJson({ app: { uuid: app.uuid, name: app.name, stage: app.stage }, deploymentUuid });
+  ok(`${what === "Rebuild" ? "Rebuilding" : "Redeploying"} ${appLabel(app)}.`);
+  print(c.dim(`  oche logs ${slug(repo)} --app ${app.name}${deploymentUuid ? ` --deployment ${deploymentUuid}` : " --build"}  follows the build`));
+}
+async function rollbackCommand(getClient, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const api = await getClient();
+  const app = pickApp(await coolifyApps(api, repo), opts);
+  const options = await api.rollbackOptions(repo, app.uuid);
+  if (!opts.to) {
+    if (opts.json) return printJson(options);
+    print(`${c.bold(app.name)}  ${STAGE_LABEL[app.stage]}  ${c.dim(`currently ${options.current?.slice(0, 7) ?? "unknown"}`)}`);
+    if (!options.images.length) {
+      print(c.dim("  Coolify has no older images for this app."));
+      return;
+    }
+    columns(
+      options.images.map((i) => {
+        const when = relativeTime(i.deployedAt ?? i.createdAt);
+        return [
+          i.isCurrent ? ["now", c.green("now")] : "",
+          i.tag.slice(0, 7),
+          [when, c.dim(when)],
+          truncate((i.commitMessage ?? "").split("\n")[0] ?? "", 48)
+        ];
+      })
+    ).forEach((l) => print(l));
+    print(c.dim(`
+Roll back with \`oche rollback ${slug(repo)} --app ${app.name} --to <commit>\`.`));
+    return;
+  }
+  const wanted = opts.to.trim().toLowerCase();
+  const target = options.images.find((i) => i.tag.toLowerCase().startsWith(wanted) || wanted.startsWith(i.tag.toLowerCase()));
+  if (!target) {
+    throw new CliError(`Coolify has no image for ${opts.to} on ${appLabel(app)}. It still has: ${options.images.map((i) => i.tag.slice(0, 7)).join(", ") || "none"}.`);
+  }
+  const subject = truncate((target.commitMessage ?? "").split("\n")[0] ?? "", 48);
+  if (!opts.yes && !await confirm(`Roll ${appLabel(app)} on ${slug(repo)} back to ${target.tag.slice(0, 7)}${subject ? ` (${subject})` : ""}?`)) {
+    return print("Cancelled.");
+  }
+  const { deploymentUuid } = await api.rollback(repo, app.uuid, target.tag);
+  if (opts.json) return printJson({ app: options.app, commit: target.tag, deploymentUuid });
+  ok(`Rolling ${appLabel(app)} back to ${target.tag.slice(0, 7)}.`);
+  print(c.dim(`  oche deployments ${slug(repo)} --app ${app.name}  shows how it goes`));
+}
+var worthExplaining = (deployments) => deployments.find((d) => d.status === "failed") ?? deployments[0];
+async function explainCommand(getClient, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const api = await getClient();
+  const app = pickApp(await coolifyApps(api, repo), opts);
+  const chosen = opts.deployment ? null : worthExplaining(app.deployments);
+  const deploymentUuid = opts.deployment ?? chosen?.uuid;
+  if (!deploymentUuid) throw new CliError(`${appLabel(app)} has no deployments on Coolify yet.`);
+  if (chosen && chosen.status !== "failed") note(`The last deployment of ${appLabel(app)} ${chosen.status === "finished" ? "worked" : `is ${chosen.status}`}; explaining it anyway.`);
+  note(`Reading the build log of ${appLabel(app)} and asking the model\u2026`);
+  const { explanation } = await api.explainDeployment(repo, app.uuid, deploymentUuid);
+  if (opts.json) return printJson({ app: { uuid: app.uuid, name: app.name, stage: app.stage }, deployment: deploymentUuid, explanation });
+  print(explanation.trim());
+}
+async function preflightCommand(getClient, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const data = await (await getClient()).preflight(repo, opts.to);
+  if (opts.json) return printJson(data);
+  if (!data.linked) {
+    print(`${slug(repo)} isn't linked to a Coolify instance, so there's nothing to check before promoting.`);
+    return;
+  }
+  print(`${c.bold(`Before promoting to ${STAGE_LABEL[opts.to]}`)}  ${c.dim(slug(repo))}`);
+  print();
+  print(c.bold("Environment variables"));
+  if (!data.envIssues.length) print(c.dim("  in step across environments"));
+  for (const issue of data.envIssues) {
+    if (issue.missing.length) print(`  ${c.red("\xB7")} ${issue.app}: ${plural(issue.missing.length, "variable")} missing \u2014 ${issue.missing.join(", ")}`);
+    if (issue.shared.length) print(`  ${c.yellow("\xB7")} ${issue.app}: shared with staging \u2014 ${issue.shared.join(", ")}`);
+  }
+  const below = data.below;
+  print();
+  print(c.bold(below ? `The ${below.stage} stage` : "The stage below"));
+  if (!below || !below.apps) print(c.dim("  no apps deploying there"));
+  else if (!below.unhealthy.length) print(`  ${c.green("\u2713")} ${plural(below.apps, "app")} healthy`);
+  else for (const a of below.unhealthy) print(`  ${c.red("\xB7")} ${a.name}: ${a.state}${a.status ? ` \xB7 last deployment ${a.status}` : ""}`);
+  const blocking = data.envIssues.some((i) => i.missing.length) || Boolean(below?.unhealthy.length);
+  print();
+  print(blocking ? c.yellow("Sort these out before promoting, or promote knowing about them.") : c.green("Nothing in the way."));
+}
+
 // src/config.ts
 import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
 import { homedir } from "os";
@@ -3642,70 +4097,6 @@ async function deleteConfig(path2 = configPath()) {
   return existed;
 }
 
-// src/git.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var slug = (r) => `${r.owner}/${r.repo}`;
-var GITHUB_HOST = /^(?:www\.|ssh\.)?github\.com(?:-[\w.-]+)?$/i;
-var OWNER = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
-var REPO = /^[A-Za-z0-9._-]{1,100}$/;
-var URL_SCHEMES = /* @__PURE__ */ new Set(["https:", "http:", "ssh:", "git:", "git+ssh:", "ssh+git:"]);
-function toSlug(path2) {
-  const parts = path2.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
-  if (parts.length !== 2) return null;
-  const [owner, repo] = parts;
-  if (!OWNER.test(owner) || !REPO.test(repo) || repo === "." || repo === "..") return null;
-  return { owner, repo };
-}
-function parseGitHubRemote(remote) {
-  const s = remote.trim();
-  let host;
-  let path2;
-  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) {
-    let u;
-    try {
-      u = new URL(s);
-    } catch {
-      return null;
-    }
-    if (!URL_SCHEMES.has(u.protocol)) return null;
-    host = u.hostname;
-    path2 = decodeURIComponent(u.pathname);
-  } else {
-    const m = /^(?:[^@\s/]+@)?([^:\s/]+):(.+)$/.exec(s);
-    if (!m) return null;
-    host = m[1];
-    path2 = m[2];
-  }
-  if (!GITHUB_HOST.test(host)) return null;
-  return toSlug(path2);
-}
-function parseRepoArg(arg) {
-  const s = arg.trim();
-  const found = /^[^/\s:@]+\/[^/\s:@]+$/.test(s) ? toSlug(s) : parseGitHubRemote(s);
-  if (!found) throw new CliError(`Expected owner/repo, got "${arg}".`);
-  return found;
-}
-var run = promisify(execFile);
-async function inferRepo(cwd = process.cwd()) {
-  let url;
-  try {
-    const { stdout } = await run("git", ["remote", "get-url", "origin"], { cwd });
-    url = stdout.trim();
-  } catch (e) {
-    if (e.code === "ENOENT") {
-      throw new CliError("git isn't installed, so the repo can't be inferred. Pass owner/repo.");
-    }
-    throw new CliError('No repo given and no git remote "origin" here. Pass owner/repo.');
-  }
-  const found = parseGitHubRemote(url);
-  if (!found) throw new CliError(`origin (${url}) isn't a GitHub repo. Pass owner/repo.`);
-  return found;
-}
-async function resolveRepo(arg) {
-  return arg ? parseRepoArg(arg) : inferRepo();
-}
-
 // src/promotion.ts
 var DEFAULT_BRANCHES = { prod: "main", staging: "staging", dev: "dev" };
 function toPromotion(target, direct = false) {
@@ -3768,11 +4159,206 @@ function resolveAi(file, env) {
   };
 }
 
-// src/github.ts
-import { execFile as execFile2 } from "child_process";
+// src/npm.ts
+import { execFile as execFile2, spawn } from "child_process";
+import { readFile as readFile3 } from "fs/promises";
 import { promisify as promisify2 } from "util";
+var WORKFLOW_FILE = "oche-publish.yml";
+var exec = promisify2(execFile2);
+async function npmBin() {
+  try {
+    const { stdout } = await exec("npm", ["--version"]);
+    const major = Number(stdout.trim().split(".")[0]);
+    return major >= 12 ? ["npm"] : ["npx", "-y", "npm@12"];
+  } catch {
+    throw new CliError("npm isn't installed.");
+  }
+}
+async function npmOut(bin, args) {
+  try {
+    const { stdout } = await exec(bin[0], [...bin.slice(1), ...args]);
+    return stdout.trim();
+  } catch {
+    return null;
+  }
+}
+async function npmRead(bin, args) {
+  const quiet = await npmOut(bin, args);
+  if (quiet !== null) return quiet;
+  closeReader();
+  return new Promise((resolve) => {
+    const child = spawn(bin[0], [...bin.slice(1), ...args], { stdio: ["inherit", "pipe", "inherit"] });
+    let out = "";
+    child.stdout.on("data", (d) => {
+      out += d.toString();
+      for (const line of d.toString().split("\n")) if (/https?:\/\/|ENTER/.test(line)) process.stderr.write(`${line}
+`);
+    });
+    child.on("error", () => resolve(null));
+    child.on("exit", (code) => resolve(code === 0 ? out : null));
+  });
+}
+function npmLive(bin, args) {
+  closeReader();
+  return new Promise((resolve, reject) => {
+    const child = spawn(bin[0], [...bin.slice(1), ...args], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code) => code === 0 ? resolve() : reject(new CliError(`npm ${args[0]} failed (exit ${code}).`)));
+  });
+}
+async function localPackage() {
+  try {
+    return JSON.parse(await readFile3("package.json", "utf8"));
+  } catch {
+    return null;
+  }
+}
+function parseTrustList(out) {
+  const entries = [];
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  for (let i = 0; i < out.length; i++) {
+    const ch = out[i];
+    if (inString) {
+      if (ch === "\\") i++;
+      else if (ch === '"') inString = false;
+    } else if (ch === '"') inString = true;
+    else if (ch === "{") {
+      if (depth++ === 0) start = i;
+    } else if (ch === "}" && --depth === 0) {
+      try {
+        const v = JSON.parse(out.slice(start, i + 1));
+        if (typeof v.id === "string") entries.push(v);
+      } catch {
+      }
+    }
+  }
+  if (!entries.length) {
+    try {
+      const v = JSON.parse(out);
+      if (Array.isArray(v)) return v.filter((e) => typeof e?.id === "string");
+    } catch {
+    }
+  }
+  return entries;
+}
+function printSteps(st) {
+  for (const s of st.steps) {
+    print(`  ${s.done ? c.green("\u2713") : c.dim("\u25CB")} ${s.label}${!s.done && s.hint ? c.dim(`  ${s.hint}`) : ""}`);
+  }
+}
+async function npmStatusCommand(client2, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const st = await (await client2()).npmStatus(repo);
+  if (opts.json) return printJson(st);
+  const name = st.publishing?.packageName ?? st.detected.name;
+  print(`${c.bold(slug(repo))}${name ? `  ${name}` : ""}`);
+  if (st.blocked && !st.publishing) {
+    print(c.dim(st.blocked));
+    return;
+  }
+  if (st.registry) {
+    print(st.registry.exists ? `  npm: ${c.bold(st.registry.latest ?? "?")}${st.registry.publishedAt ? c.dim(` \xB7 ${relativeTime(st.registry.publishedAt)}`) : ""}` : c.dim("  not on npm yet"));
+  }
+  const run3 = st.publishing?.lastRun;
+  if (run3) {
+    const label = run3.conclusion === "success" ? c.green(run3.conclusion) : run3.conclusion === "failure" ? c.red(run3.conclusion) : run3.conclusion;
+    print(`  last run: ${label}${run3.failedStep ? ` at "${run3.failedStep}"` : ""} ${c.dim(`${relativeTime(run3.at)} \xB7 ${run3.url}`)}`);
+  }
+  if (st.publishing?.outdated) warn("The workflow is out of date. `oche npm setup` opens a PR to update it.");
+  print();
+  printSteps(st);
+  if (!st.publishing) print(c.dim(`
+Run \`oche npm setup ${slug(repo)}\` to start publishing on every release.`));
+}
+async function npmSetupCommand(client2, repoArg, opts) {
+  const repo = await resolveRepo(repoArg);
+  const api = await client2();
+  let st = await api.npmStatus(repo);
+  if (st.blocked) throw new CliError(st.blocked);
+  const name = st.publishing?.packageName ?? st.detected.name;
+  const local = await localPackage();
+  const inRepo = local?.name === name;
+  const ask2 = async (q) => opts.yes || isInteractive() && await confirm(q, true);
+  print(`Setting up npm publishing for ${c.bold(name)} from ${c.bold(slug(repo))}.
+`);
+  const others = st.detected.otherPublishers;
+  let replace = false;
+  if (others.length) {
+    print(`${others.join(", ")} already publishes ${name}.`);
+    replace = !opts.keepExisting && await ask2(`Replace it with Oche's workflow? The PR deletes ${others.join(", ")}.`);
+    if (!replace && !opts.keepExisting) throw new CliError("Stopped. Run again and replace it, or pass --keep-existing to run both.");
+  }
+  const bin = await npmBin();
+  let npmUser = await npmOut(bin, ["whoami"]);
+  if (!npmUser) {
+    if (!await ask2("You're not logged in to npm. Log in now?")) throw new CliError("Log in with `npm login`, then run this again.");
+    await npmLive(bin, ["login"]);
+    npmUser = await npmOut(bin, ["whoami"]);
+    if (!npmUser) throw new CliError("Still not logged in to npm.");
+  }
+  ok(`npm: logged in as ${c.bold(npmUser)}`);
+  if (!st.registry?.exists) {
+    if (!inRepo) throw new CliError(`${name} isn't on npm yet. Run this from the repo's folder so Oche can publish the first version from it.`);
+    print(`${name} isn't on npm yet. The first version has to be published from your machine; Oche takes over after that.`);
+    if (!await ask2(`Build and publish ${name}@${local.version} now?`)) throw new CliError("Publish it once with `npm publish`, then run this again.");
+    await npmLive(bin, ["run", "build", "--if-present"]);
+    await npmLive(bin, ["publish", "--access", "public"]);
+    ok(`Published ${name}@${local.version}`);
+  } else {
+    const owners = await npmOut(bin, ["owner", "ls", name]);
+    if (owners && !owners.split("\n").some((l) => l.split(" ")[0] === npmUser)) {
+      warn(`${npmUser} isn't listed as an owner of ${name}. npm may refuse to change its trust settings.`);
+    }
+  }
+  if (!opts.skipPr && (!st.publishing || st.publishing.outdated || replace)) {
+    try {
+      const res = await api.npmSetup(repo, replace ? { replace: true } : others.length ? { force: true } : {});
+      const what = [res.path, ...res.removes.map((p) => `removes ${p}`)].join(", ");
+      if (res.pr) ok(`${res.pr.merged ? "Merged" : "Opened"} #${res.pr.number}: ${what}  ${c.dim(res.pr.url)}`);
+      else ok(`${res.path} is already on dev.`);
+    } catch (e) {
+      if (e instanceof ApiRequestError && e.status === 403) throw new CliError("Only the Oche owner can add the workflow. Ask them to run `oche npm setup`, then run it yourself for the npm side.");
+      throw e;
+    }
+  }
+  const listed = await npmRead(bin, ["trust", "list", name, "--json"]);
+  if (listed === null) throw new CliError(`Couldn't read npm's trusted publishers for ${name}. Run \`npm trust list ${name}\` to see why.`);
+  const trust = parseTrustList(listed);
+  const sameRepo = (t) => t.type === "github" && t.repository?.toLowerCase() === slug(repo).toLowerCase();
+  if (trust.some((t) => sameRepo(t) && t.file === WORKFLOW_FILE)) {
+    ok(`npm already trusts ${WORKFLOW_FILE} in ${slug(repo)}`);
+  } else {
+    print(`
+npm will trust ${c.bold(`${slug(repo)} \u2192 .github/workflows/${WORKFLOW_FILE}`)} to publish ${name}. npm may ask for 2FA.`);
+    if (!await ask2("Continue?")) throw new CliError("Stopped before changing npm's trust settings.");
+    await npmLive(bin, ["trust", "github", name, "--file", WORKFLOW_FILE, "--repository", slug(repo), "--allow-publish", ...opts.yes ? ["--yes"] : []]);
+    ok("npm trusts the workflow");
+  }
+  for (const t of trust.filter((t2) => sameRepo(t2) && t2.file !== WORKFLOW_FILE)) {
+    print(`
+npm still trusts ${c.bold(t.file ?? "another workflow")} in ${slug(repo)} to publish ${name}.${others.includes(t.file ?? "") ? " Oche's PR removes that file." : ""}`);
+    if (await ask2(`Revoke it? Only ${WORKFLOW_FILE} will be able to publish.`)) {
+      await npmLive(bin, ["trust", "revoke", name, `--id=${t.id}`]);
+      ok(`Revoked ${t.file}`);
+    } else {
+      print(c.dim(`Kept. Revoke it later with: npm trust revoke ${name} --id=${t.id}`));
+    }
+  }
+  st = await api.npmTrust(repo, { packageName: name, npmUser });
+  print();
+  printSteps(st);
+  const next = st.steps.find((s) => !s.done && s.id !== "published");
+  print(next ? c.dim(`
+Next: ${next.hint ?? next.label}`) : c.dim("\nEvery push to production now publishes a new version."));
+}
+
+// src/github.ts
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify3 } from "util";
 var API = "https://api.github.com";
-var run2 = promisify2(execFile2);
+var run2 = promisify3(execFile3);
 async function githubToken(env = process.env) {
   const fromEnv = env.GH_TOKEN?.trim() || env.GITHUB_TOKEN?.trim();
   if (fromEnv) return fromEnv;
@@ -3850,16 +4436,16 @@ var GitHub = class {
 };
 
 // src/localgit.ts
-import { execFile as execFile3, spawn } from "child_process";
+import { execFile as execFile4, spawn as spawn2 } from "child_process";
 import { copyFile, mkdtemp, rm as rm2 } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join3 } from "path";
-import { promisify as promisify3 } from "util";
-var exec = promisify3(execFile3);
+import { promisify as promisify4 } from "util";
+var exec2 = promisify4(execFile4);
 var MAX_BUFFER = 64 * 1024 * 1024;
 async function git(args, env) {
   try {
-    const { stdout } = await exec("git", args, { maxBuffer: MAX_BUFFER, env: env ? { ...process.env, ...env } : process.env });
+    const { stdout } = await exec2("git", args, { maxBuffer: MAX_BUFFER, env: env ? { ...process.env, ...env } : process.env });
     return stdout;
   } catch (e) {
     const err = e;
@@ -3920,7 +4506,7 @@ var addTracked = () => git(["add", "-u"]);
 var commit = (message) => git(["commit", "-m", message]);
 function commitWithEditor(message) {
   return new Promise((resolve, reject) => {
-    const child = spawn("git", ["commit", "-e", "-m", message], { stdio: "inherit" });
+    const child = spawn2("git", ["commit", "-e", "-m", message], { stdio: "inherit" });
     child.on("error", reject);
     child.on("exit", (code) => code === 0 ? resolve() : reject(new CliError("Commit aborted.")));
   });
@@ -3990,123 +4576,6 @@ async function generateCommitMessage(input, opts) {
   return parseMessage(await res.json());
 }
 
-// src/ui.ts
-import { createInterface } from "readline";
-import { styleText } from "util";
-function paint(format, text, stream = process.stdout) {
-  if (process.env.NO_COLOR) return text;
-  return styleText(format, text, { stream, validateStream: true });
-}
-var c = {
-  bold: (s) => paint("bold", s),
-  dim: (s) => paint("dim", s),
-  green: (s) => paint("green", s),
-  red: (s) => paint("red", s),
-  yellow: (s) => paint("yellow", s),
-  cyan: (s) => paint("cyan", s)
-};
-var print = (line = "") => void process.stdout.write(`${line}
-`);
-var printJson = (data) => print(JSON.stringify(data, null, 2));
-var ok = (msg) => print(`${c.green("\u2713")} ${msg}`);
-var warn = (msg) => process.stderr.write(`${paint("yellow", "!", process.stderr)} ${msg}
-`);
-var fail = (msg) => process.stderr.write(`${paint("red", "\u2717", process.stderr)} ${msg}
-`);
-function relativeTime(iso, now = Date.now()) {
-  if (!iso) return "";
-  const then = Date.parse(iso);
-  if (Number.isNaN(then)) return "";
-  const s = Math.max(0, Math.round((now - then) / 1e3));
-  if (s < 45) return "just now";
-  const m = Math.round(s / 60);
-  if (m < 60) return `${m}m ago`;
-  const h = Math.round(m / 60);
-  if (h < 24) return `${h}h ago`;
-  const d = Math.round(h / 24);
-  if (d < 30) return `${d}d ago`;
-  return new Date(then).toISOString().slice(0, 10);
-}
-function truncate(s, max) {
-  return s.length <= max ? s : `${s.slice(0, max - 1)}\u2026`;
-}
-var plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
-function columns(rows, indent = "  ") {
-  const plainOf = (cell) => typeof cell === "string" ? cell : cell[0];
-  const styledOf = (cell) => typeof cell === "string" ? cell : cell[1];
-  const widths = [];
-  for (const row of rows) row.forEach((cell, i) => widths[i] = Math.max(widths[i] ?? 0, plainOf(cell).length));
-  return rows.map(
-    (row) => indent + row.map((cell, i) => i === row.length - 1 ? styledOf(cell) : styledOf(cell) + " ".repeat((widths[i] ?? 0) - plainOf(cell).length)).join("  ").trimEnd()
-  );
-}
-var isInteractive = () => Boolean(process.stdin.isTTY);
-var reader = null;
-async function readLine() {
-  if (!reader) {
-    const rl = createInterface({ input: process.stdin, crlfDelay: Infinity, terminal: false });
-    reader = { rl, lines: rl[Symbol.asyncIterator]() };
-  }
-  const next = await reader.lines.next();
-  if (next.done) throw new CliError("No input: stdin was closed.");
-  return next.value;
-}
-function closeReader() {
-  reader?.rl.close();
-  reader = null;
-}
-async function ask(question, fallback) {
-  process.stderr.write(fallback ? `${question} ${paint("dim", `(${fallback})`, process.stderr)}: ` : `${question}: `);
-  const answer = (await readLine()).trim();
-  if (isInteractive()) closeReader();
-  else process.stderr.write("\n");
-  return answer || fallback || "";
-}
-async function askHidden(question) {
-  process.stderr.write(`${question}: `);
-  if (!isInteractive()) {
-    const line = (await readLine()).trim();
-    process.stderr.write("\n");
-    return line;
-  }
-  closeReader();
-  const stdin = process.stdin;
-  return new Promise((resolve, reject) => {
-    let buf = "";
-    const finish = (err) => {
-      stdin.off("data", onData);
-      stdin.setRawMode(false);
-      stdin.pause();
-      process.stderr.write("\n");
-      if (err) reject(err);
-      else resolve(buf.trim());
-    };
-    const onData = (chunk) => {
-      const text = chunk.toString().replace(/\x1b\[[0-9;]*[A-Za-z~]/g, "");
-      for (const ch of text) {
-        if (ch === "\r" || ch === "\n") return finish();
-        if (ch === "") return finish(new CliError("Cancelled.", 130));
-        if (ch === "") return buf ? finish() : finish(new CliError("Cancelled.", 130));
-        if (ch === "\x7F" || ch === "\b") buf = buf.slice(0, -1);
-        else if (ch === "") buf = "";
-        else if (ch >= " ") buf += ch;
-      }
-    };
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.on("data", onData);
-  });
-}
-async function confirm(question, defaultYes = false) {
-  if (!isInteractive()) throw new CliError(`${question} Needs confirmation; pass --yes to run without a prompt.`);
-  const hint = defaultYes ? "Y/n" : "y/N";
-  process.stderr.write(`${question} ${paint("dim", `[${hint}]`, process.stderr)} `);
-  const answer = (await readLine()).trim().toLowerCase();
-  closeReader();
-  if (!answer) return defaultYes;
-  return answer === "y" || answer === "yes";
-}
-
 // src/ship-run.ts
 var MERGE_HOW = {
   merge: "open a PR and merge",
@@ -4535,8 +5004,8 @@ function nonNegativeInt(value) {
   return n;
 }
 var modeLabel = (repo) => repo.mode === "strict" ? `strict \xB7 ${plural(repo.requiredApprovals, "approval")}` : "fast";
-var BAD_EVENTS = /* @__PURE__ */ new Set(["promotion-conflict", "sync-conflict", "pr-blocked", "direct-push", "deploy-failed", "app-stopped"]);
-var GOOD_EVENTS = /* @__PURE__ */ new Set(["promoted", "synced", "onboarded", "deploy-succeeded"]);
+var BAD_EVENTS = /* @__PURE__ */ new Set(["promotion-conflict", "sync-conflict", "pr-blocked", "direct-push", "deploy-failed", "app-stopped", "publish-failed"]);
+var GOOD_EVENTS = /* @__PURE__ */ new Set(["promoted", "synced", "onboarded", "deploy-succeeded", "published"]);
 var newestFirst = (events) => [...events].sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.id - a.id);
 function eventLines(events, showRepo) {
   return columns(
@@ -4707,8 +5176,8 @@ async function promote(target, repoArg, opts) {
       return;
     case "waiting-review": {
       const a = result.approval;
-      const note = a.changesRequested ? ", changes requested" : "";
-      print(`#${result.pr.number} ${result.pr.head} \u2192 ${result.pr.base} is waiting for review: ${c.yellow(`${a.approvals}/${a.required} approvals`)}${note}`);
+      const note2 = a.changesRequested ? ", changes requested" : "";
+      print(`#${result.pr.number} ${result.pr.head} \u2192 ${result.pr.base} is waiting for review: ${c.yellow(`${a.approvals}/${a.required} approvals`)}${note2}`);
       print(`  \u2192 ${result.pr.url}`);
       return;
     }
@@ -4800,6 +5269,18 @@ function buildProgram() {
   program2.command("commit").description("Write a commit message for what's staged with AI (via your Oche server) and commit").option("-a, --all", "stage changes to tracked files first, like git commit -a").option("-m, --message <message>", "skip AI and use this message").option("--dry-run", "only print the message").option("-y, --yes", "commit without asking").action((opts) => commitCommand(client, opts));
   program2.command("onboard").description("Set up the dev \u2192 staging \u2192 main flow on a repo").argument(repoArg, repoHelp).option("--dry-run", "only show the plan").option("-y, --yes", "don't ask for confirmation").action(onboard);
   program2.command("mode").description("Switch between fast (no review) and strict (approvals required)").argument("<mode>", "fast or strict").argument(repoArg, repoHelp).option("--approvals <n>", "approvals required in strict mode", nonNegativeInt).action(setMode);
+  const stageOption = (description) => new Option("--stage <stage>", description).choices(["prod", "staging", "dev"]);
+  const appOption = new Option("--app <name>", "which Coolify app (its name, or the start of its uuid)");
+  program2.command("logs").description("Container logs for an app, or a deployment's build log with --build").argument(repoArg, repoHelp).addOption(appOption).addOption(stageOption("the app deploying this stage")).option("--deployment <uuid>", "build log of this deployment (implies --build; default: the latest)").option("--build", "the build log of the latest deployment, not the running container").addOption(new Option("-n, --lines <n>", "how many lines from the end; 0 for all").default(200).argParser(nonNegativeInt)).option("--failures", "only the errors and the tail").option("--json", "print raw JSON").action((repo, opts) => logsCommand(client, repo, opts));
+  program2.command("deployments").description("Recent deployments per app, with status, commit and how long each took").argument(repoArg, repoHelp).addOption(appOption).addOption(stageOption("only apps deploying this stage")).addOption(new Option("-n, --limit <n>", "deployments per app").default(5).argParser(positiveInt)).option("--json", "print raw JSON").action((repo, opts) => deploymentsCommand(client, repo, opts));
+  const npm = program2.command("npm").description("Publish this package to npm on every release");
+  npm.command("setup").description("Add the publish workflow and let npm trust it (uses your npm login)").argument(repoArg, repoHelp).option("-y, --yes", "don't ask for confirmation").option("--keep-existing", "keep a workflow that already publishes to npm instead of replacing it").option("--skip-pr", "only do the npm side; don't open the workflow PR").action((repo, opts) => npmSetupCommand(client, repo, opts));
+  npm.command("status", { isDefault: true }).description("Publishing setup, the npm version and the last run").argument(repoArg, repoHelp).option("--json", "print raw JSON").action((repo, opts) => npmStatusCommand(client, repo, opts));
+  program2.command("envs").description("Which stages define each environment variable (names only, never values)").argument(repoArg, repoHelp).addOption(stageOption("only this stage's column")).option("--key <name>", "only variables whose name contains this").option("--json", "print raw JSON").action((repo, opts) => envsCommand(client, repo, opts));
+  program2.command("deploy").description("Redeploy an app on Coolify").argument(repoArg, repoHelp).addOption(appOption).addOption(stageOption("the app deploying this stage")).option("--force", "rebuild without the build cache").option("-y, --yes", "don't ask for confirmation").option("--json", "print raw JSON").action((repo, opts) => deployCommand(client, repo, opts));
+  program2.command("rollback").description("List the images Coolify can roll an app back to, and roll back to one").argument(repoArg, repoHelp).addOption(appOption).addOption(stageOption("the app deploying this stage")).option("--to <commit>", "roll back to this image (a commit SHA from the list)").option("-y, --yes", "don't ask for confirmation").option("--json", "print raw JSON").action((repo, opts) => rollbackCommand(client, repo, opts));
+  program2.command("explain").description("Ask your Oche server's AI what broke a deployment").argument(repoArg, repoHelp).addOption(appOption).addOption(stageOption("the app deploying this stage")).option("--deployment <uuid>", "explain this deployment (default: the latest failed one)").option("--json", "print raw JSON").action((repo, opts) => explainCommand(client, repo, opts));
+  program2.command("preflight").description("What to know before promoting: missing variables and the health of the stage below").argument(repoArg, repoHelp).addOption(new Option("--to <stage>", "the stage being promoted into").choices(["prod", "staging"]).default("prod")).option("--json", "print raw JSON").action((repo, opts) => preflightCommand(client, repo, opts));
   program2.command("log").description("Recent events (all repos when run outside a checkout)").argument(repoArg, repoHelp).addOption(new Option("-n, --limit <n>", "how many events").default(20).argParser(positiveInt)).option("--json", "print raw JSON").action(log);
   return program2;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oche-cli",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "description": "Command-line client for Oche: promote dev → staging → main from your terminal.",
   "license": "MIT",
   "repository": {