relight-cli 0.1.0 → 0.3.0

package/README.md

@@ -3,10 +3,10 @@
 Deploy Docker containers to your cloud with scale-to-zero. Apps sleep when idle and wake on the next request.
 
 ```
-$ relight deploy myapp . --compute gcp
+$ relight deploy myapp . --cloud gcp
   Building image...
-  Pushing to gcr.io/my-project/myapp:v1...
-  Deploying to Cloud Run (us-east1)...
+  Pushing to us-docker.pkg.dev/my-project/relight/myapp:v1...
+  Deploying to Cloud Run (us-central1)...
 
 --> Live at https://myapp-abc123.run.app
     Sleeps after 30s idle. $0 when sleeping.
@@ -16,15 +16,14 @@ $ relight deploy myapp . --compute gcp
 
 Relight is a CLI that deploys and manages Docker containers across multiple cloud providers. It talks directly to each cloud's API using your own credentials. No vendor infrastructure gets installed in your account.
 
-Supported compute backends:
+Supported backends:
 
-| Cloud | Backend | Scale to zero |
-|---|---|---|
-| GCP | Cloud Run | Yes |
-| AWS | App Runner | Yes |
-| Cloudflare | Containers (Workers + Durable Objects) | Yes |
-
-More backends planned: Azure Container Apps.
+| Cloud | Backend | Scale to zero | Database | DNS |
+|---|---|---|---|---|
+| GCP | Cloud Run | Yes | Cloud SQL (PostgreSQL) | Cloud DNS |
+| AWS | App Runner | Yes | RDS (PostgreSQL) | Route 53 |
+| Cloudflare | Containers (Workers + Durable Objects) | Yes | D1 (SQLite) | Cloudflare DNS |
+| SlicerVM | Self-hosted | Yes | - | - |
 
 ## Install
 
@@ -38,7 +37,7 @@ Requires Node.js 20+ and Docker.
 
 ```sh
 # Authenticate with a cloud provider
-relight auth --compute gcp
+relight auth --cloud gcp
 
 # Deploy from a Dockerfile
 relight deploy myapp .
@@ -51,6 +50,9 @@ relight logs myapp
 
 # Open in browser
 relight open myapp
+
+# Create a database
+relight db create myapp
 ```
 
 The first deploy links the current directory to the app name. After that, `relight deploy` is enough.
@@ -74,7 +76,16 @@ relight scale [name]                 Show or adjust instance count and resources
 relight domains list [name]          List custom domains
 relight domains add [domain]         Add a custom domain with DNS setup
 relight domains remove [domain]      Remove a custom domain
-relight regions [--compute <cloud>]  List available regions for a cloud
+relight db create [name]             Create a managed database
+relight db destroy [name]            Destroy a database
+relight db info [name]               Show database details
+relight db shell [name]              Interactive SQL shell
+relight db query [name] <sql>        Run a SQL query
+relight db import [name] <file>      Import a SQL file
+relight db export [name]             Export database as SQL
+relight db token [name]              Show or rotate DB token
+relight db reset [name]              Drop all tables
+relight regions [--cloud <cloud>]    List available regions for a cloud
 relight cost [name]                  Show estimated costs
 relight doctor                       Check local setup and cloud connectivity
 ```
@@ -83,13 +94,13 @@ Config changes (`config set`, `config unset`, `scale`, `domains`) are applied li
 
 ## How it works
 
-1. `relight auth` stores a scoped API token locally at `~/.relight/config.json`. One token per cloud provider. No cross-account IAM roles, no OAuth flows, no vendor access to your account.
+1. `relight auth` stores credentials locally at `~/.relight/config.json`. One set of credentials per cloud provider. No cross-account IAM roles, no OAuth flows, no vendor access to your account.
 
-2. `relight deploy` builds a Docker image locally, pushes it to the cloud's container registry (GCR, Cloudflare Registry, ECR), and deploys it using the cloud's native container service.
+2. `relight deploy` builds a Docker image locally, pushes it to the cloud's container registry (Artifact Registry, ECR, or Cloudflare Registry), and deploys it using the cloud's native container service.
 
 3. The deployed app sleeps after a configurable idle period (default 30s). The next incoming request wakes it. Cold starts are typically 1-5 seconds depending on the cloud and image size.
 
-4. All app state (config, scaling, domains) lives in the cloud provider's API. The only local files are your auth token and a `.relight` link file in your project directory. You can manage your apps from any machine.
+4. All app state (config, scaling, domains, database bindings) lives in the cloud provider's API. The only local files are your auth credentials and a `.relight.yaml` link file in your project directory. You can manage your apps from any machine.
 
 ## Fleet view
 
@@ -101,18 +112,38 @@ $ relight apps
 NAME         CLOUD    STATUS     INSTANCES  COST/MTD   LAST ACTIVE
 myapi        gcp      sleeping   0/3        $0.12      2h ago
 frontend     cf       active     2/5        $1.84      now
+worker       aws      sleeping   0/1        $0.05      1h ago
 dashboard    gcp      sleeping   0/1        $0.00      3d ago
-───────────────────────────────────────────────────────────────
-                                 TOTAL      $1.96
+-----------------------------------------------------------------
+                                 TOTAL      $2.01
+```
+
+## Databases
+
+Relight manages databases alongside your apps. Each cloud uses its native database service:
+
+```sh
+# Create a database for your app
+relight db create myapp
+
+# Interactive SQL shell
+relight db shell myapp
+
+# Run a query
+relight db query myapp "SELECT * FROM users"
 ```
 
+GCP and AWS use PostgreSQL (Cloud SQL and RDS). Cloudflare uses D1 (SQLite). The connection URL and credentials are automatically injected into your app's environment as `DATABASE_URL` and `DB_TOKEN`.
+
+Cross-cloud databases are supported - you can attach an AWS RDS database to a GCP Cloud Run app by specifying `--db aws`.
+
 ## BYOC model
 
 Relight deploys to cloud accounts you own. You pay the cloud provider directly at their published rates. Relight itself is free for individual use.
 
 What this means in practice:
 
-- **Your credentials stay local.** The API token is stored on your machine. Relight has no backend service that holds your cloud credentials.
+- **Your credentials stay local.** Credentials are stored on your machine. Relight has no backend service that holds your cloud credentials.
 - **Nothing is installed in your account.** No Kubernetes clusters, no CloudFormation stacks, no VPCs, no agent processes. Relight uses the cloud's existing container services.
 - **You can stop using Relight anytime.** Your apps are standard Cloud Run services / App Runner services / CF Workers. They continue running without Relight. There's nothing to uninstall.
 
@@ -140,12 +171,12 @@ Relight does not autoscale. You set the maximum instance count and the cloud pro
 relight domains add myapp.example.com
 
 # Relight creates the DNS record if your domain's DNS is on a supported provider
+# (Cloud DNS, Route 53, or Cloudflare DNS)
 # Otherwise it prints the record for you to create manually
 ```
 
 ## What Relight doesn't do
 
-- **Not a general infrastructure tool.** Relight deploys Docker containers with scale-to-zero. It doesn't manage databases, queues, cron jobs, or other infrastructure. Use Terraform, Pulumi, or cloud consoles for those.
 - **No autoscaling.** You set max instances. The cloud scales between 0 and your max based on traffic. There's no custom autoscaling logic.
 - **No CI/CD.** Relight is a deployment tool, not a build pipeline. Integrate it into your CI by running `relight deploy` in your workflow.
 - **Cold starts.** Sleeping apps take 1-5 seconds to respond to the first request. This is inherent to scale-to-zero and varies by cloud and image size.
@@ -154,24 +185,35 @@ relight domains add myapp.example.com
 
 ### GCP (Cloud Run)
 
-- Requires a GCP project with Cloud Run and Artifact Registry APIs enabled.
-- Token: service account key or `gcloud auth print-access-token`.
-- Regions: any Cloud Run region. Run `relight regions --compute gcp` to list.
+- Requires a GCP project with Cloud Run, Artifact Registry, Cloud SQL Admin, Cloud DNS, Logging, and Monitoring APIs enabled.
+- Credentials: service account key JSON file.
+- Regions: any Cloud Run region. Run `relight regions --cloud gcp` to list.
 - Scale-to-zero is native. Minimum instances can be set to 0.
+- Database: Cloud SQL PostgreSQL 15 (`db-f1-micro` by default).
 
 ### AWS (App Runner)
 
-- Requires an AWS account with App Runner and ECR access.
-- Token: IAM access key with `apprunner:*` and `ecr:*` permissions, or use `aws configure`.
-- Regions: any App Runner region. Run `relight regions --compute aws` to list.
-- Scale-to-zero is native. Services pause when idle and resume on the next request.
+- Requires an AWS account with IAM user credentials.
+- Required IAM policies: `AWSAppRunnerFullAccess`, `AmazonEC2ContainerRegistryFullAccess`, `AmazonRDSFullAccess`, `AmazonRoute53FullAccess`, `AmazonEC2ReadOnlyAccess`, `CloudWatchLogsReadOnlyAccess`, `IAMFullAccess`.
+- Credentials: IAM access key ID and secret access key.
+- Regions: 9 App Runner regions. Run `relight regions --cloud aws` to list.
+- Scale-to-zero: App Runner pauses services when idle. Minimum 1 provisioned instance ($0.007/vCPU-hr when idle).
+- Database: RDS PostgreSQL 15 (`db.t4g.micro` by default). Provisioning takes 5-15 minutes.
+- Registry: ECR. Repositories and IAM access roles are created automatically.
 
 ### Cloudflare (Containers)
 
 - Requires a Cloudflare account with Containers access (paid Workers plan).
-- Token: Cloudflare API token with `workers_scripts:edit` and `containers:edit` permissions.
+- Credentials: Cloudflare API token with Workers and Containers permissions.
 - Each app is a Worker backed by Durable Objects running your container. The CLI bundles and uploads the Worker template automatically.
-- Regions use Durable Object `locationHints` — placement is best-effort, not guaranteed.
+- Regions use Durable Object `locationHints` - placement is best-effort, not guaranteed.
+- Database: D1 (SQLite).
+
+### SlicerVM (Self-hosted)
+
+- Requires a running SlicerVM host.
+- Credentials: API URL + token, or a Unix socket for local development.
+- Images are uploaded directly to the host (no external registry needed).
 
 ## Configuration
 
@@ -180,18 +222,19 @@ Auth config is stored at `~/.relight/config.json`:
 ```json
 {
   "clouds": {
-    "gcp": { "token": "...", "project": "my-project" },
+    "gcp": { "clientEmail": "...", "privateKey": "...", "project": "my-project" },
     "aws": { "accessKeyId": "...", "secretAccessKey": "...", "region": "us-east-1" },
     "cf": { "token": "...", "accountId": "..." }
   },
-  "default_compute": "gcp"
+  "default_cloud": "gcp"
 }
 ```
 
-Per-project app linking is stored in a `.relight` file in your project directory:
+Per-project app linking is stored in a `.relight.yaml` file in your project directory:
 
-```json
-{ "app": "myapp", "compute": "gcp" }
+```yaml
+app: myapp
+cloud: gcp
 ```
 
 ## License

package/package.json

@@ -1,14 +1,19 @@
 {
   "name": "relight-cli",
-  "version": "0.1.0",
-  "description": "Deploy and manage Docker containers across clouds with scale-to-zero",
+  "version": "0.3.0",
+  "description": "Deploy web apps across clouds with scale-to-zero",
   "bin": {
     "relight": "./src/cli.js"
   },
   "type": "module",
+  "exports": {
+    ".": "./src/cli.js",
+    "./worker-template": "./worker-template/src/index.js"
+  },
   "license": "MIT",
   "files": [
-    "src"
+    "src",
+    "worker-template"
   ],
   "keywords": [
     "docker",
@@ -22,6 +27,9 @@
   ],
   "dependencies": {
     "commander": "^13.0.0",
-    "kleur": "^4.1.5"
+    "esbuild": "^0.25.0",
+    "kleur": "^4.1.5",
+    "pg": "^8.13.0",
+    "yaml": "^2.8.2"
   }
 }

package/src/cli.js

@@ -3,13 +3,38 @@
 import { Command } from "commander";
 import { auth } from "./commands/auth.js";
 import { doctor } from "./commands/doctor.js";
+import { deploy } from "./commands/deploy.js";
+import { appsList, appsInfo, appsDestroy } from "./commands/apps.js";
+import {
+  configShow,
+  configSet,
+  configGet,
+  configUnset,
+  configImport,
+} from "./commands/config.js";
+import { scale } from "./commands/scale.js";
+import { domainsList, domainsAdd, domainsRemove } from "./commands/domains.js";
+import { ps } from "./commands/ps.js";
+import { logs } from "./commands/logs.js";
+import { open } from "./commands/open.js";
+import { cost } from "./commands/cost.js";
+import { serviceList, serviceAdd, serviceRemove } from "./commands/service.js";
+import {
+  dbCreate, dbDestroy, dbList, dbInfo, dbAttach, dbDetach,
+  dbShell, dbQuery, dbImport, dbExport, dbToken, dbReset,
+} from "./commands/db.js";
+import { fmt } from "./lib/output.js";
+import { createRequire } from "module";
+
+var require = createRequire(import.meta.url);
+var { version } = require("../package.json");
 
 var program = new Command();
 
 program
   .name("relight")
   .description("Deploy and manage Docker containers across clouds with scale-to-zero")
-  .version("0.1.0");
+  .version(version);
 
 // --- Auth ---
 
@@ -22,6 +47,320 @@ program
   )
   .action(auth);
 
+// --- Service ---
+
+var serviceCmd = program.command("service").description("Manage services (compute, databases, etc.)");
+
+serviceCmd
+  .command("list", { isDefault: true })
+  .description("List registered services")
+  .action(serviceList);
+
+serviceCmd
+  .command("add [name]")
+  .description("Register a service")
+  .action(serviceAdd);
+
+serviceCmd
+  .command("remove <name>")
+  .description("Remove a service")
+  .action(serviceRemove);
+
+// --- Deploy ---
+
+program
+  .command("deploy [name] [path]")
+  .description("Deploy an app from a Dockerfile (name auto-generated if omitted)")
+  .option("-c, --cloud <cloud>", "Cloud provider (cf, gcp, aws)")
+  .option("--compute <name>", "Compute service name")
+  .option("-t, --tag <tag>", "Image tag (default: deploy-<timestamp>)")
+  .option("-e, --env <vars...>", "Set env vars (KEY=VALUE)")
+  .option(
+    "--regions <hints>",
+    "Comma-separated location hints (wnam,enam,sam,weur,eeur,apac,oc,afr,me)"
+  )
+  .option("-i, --instances <n>", "Instances per region", parseInt)
+  .option("--port <port>", "Container port", parseInt)
+  .option("--sleep <duration>", "Sleep after idle (e.g. 5m, 30s, never)", "30s")
+  .option("--instance-type <type>", "Instance type (lite, base, standard, large)")
+  .option("--vcpu <n>", "vCPU allocation (e.g. 0.0625, 0.5, 1, 2)", parseFloat)
+  .option("--memory <mb>", "Memory in MiB (e.g. 256, 512, 1024)", parseInt)
+  .option("--disk <mb>", "Disk in MB (e.g. 2000, 5000)", parseInt)
+  .option("--dns <cloud>", "Cloud provider for DNS records (cross-cloud)")
+  .option("--no-observability", "Disable Workers observability/logs")
+  .option("--json", "Output result as JSON")
+  .option("-y, --yes", "Skip confirmation prompt")
+  .action(deploy);
+
+// --- Apps (topic root = list) ---
+
+var apps = program.command("apps").description("Manage apps");
+
+apps
+  .command("list", { isDefault: true })
+  .description("List all deployed apps")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--json", "Output as JSON")
+  .action(appsList);
+
+apps
+  .command("info [name]")
+  .description("Show detailed app information")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--json", "Output as JSON")
+  .action(appsInfo);
+
+apps
+  .command("destroy [name]")
+  .description("Destroy an app and its resources")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--confirm <name>", "Confirm by providing the app name")
+  .action(appsDestroy);
+
+// --- Config (topic root = show) ---
+
+var configCmd = program
+  .command("config")
+  .description("Manage app config/env vars")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name");
+
+function configOpts(cmd) {
+  var parentOpts = cmd?.parent?.opts() || {};
+  return { cloud: parentOpts.cloud, compute: parentOpts.compute };
+}
+
+configCmd
+  .command("show [name]", { isDefault: true })
+  .description("Show all env vars for an app")
+  .option("--json", "Output as JSON")
+  .action((name, options, cmd) => configShow(name, { ...options, ...configOpts(cmd) }));
+
+configCmd
+  .command("set <args...>")
+  .description("Set env vars ([name] KEY=VALUE ...) - applies live")
+  .option("-s, --secret", "Store values as encrypted secrets (write-only)")
+  .action((args, options, cmd) => configSet(args, { ...options, ...configOpts(cmd) }));
+
+configCmd
+  .command("get <args...>")
+  .description("Get a single env var value ([name] KEY)")
+  .action((args, options, cmd) => configGet(args, { ...options, ...configOpts(cmd) }));
+
+configCmd
+  .command("unset <args...>")
+  .description("Remove env vars ([name] KEY ...) - applies live")
+  .action((args, options, cmd) => configUnset(args, { ...options, ...configOpts(cmd) }));
+
+configCmd
+  .command("import [name]")
+  .description("Import env vars from .env file or stdin")
+  .option("-f, --file <path>", "Path to .env file")
+  .option("-s, --secret", "Store values as encrypted secrets (write-only)")
+  .action((name, options, cmd) => configImport(name, { ...options, ...configOpts(cmd) }));
+
+// --- Scale ---
+
+program
+  .command("scale [name]")
+  .description("Show or adjust app scaling")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option(
+    "-r, --regions <hints>",
+    "Comma-separated location hints (wnam,enam,sam,weur,eeur,apac,oc,afr,me)"
+  )
+  .option("-i, --instances <n>", "Instances per region", parseInt)
+  .option("--instance-type <type>", "Instance type (lite, base, standard, large)")
+  .option("--vcpu <n>", "vCPU allocation (e.g. 0.0625, 0.5, 1, 2)", parseFloat)
+  .option("--memory <mb>", "Memory in MiB (e.g. 256, 512, 1024)", parseInt)
+  .option("--disk <mb>", "Disk in MB (e.g. 2000, 5000)", parseInt)
+  .option("--json", "Output as JSON")
+  .action(scale);
+
+// --- Domains (topic root = list) ---
+
+var domainsCmd = program
+  .command("domains")
+  .description("Manage custom domains")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--dns <cloud>", "Cloud provider for DNS records (cross-cloud)");
+
+domainsCmd
+  .command("list [name]", { isDefault: true })
+  .description("List custom domains for an app")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--json", "Output as JSON")
+  .action(domainsList);
+
+function domainsOpts(cmd) {
+  var parentOpts = cmd?.parent?.opts() || {};
+  return { cloud: parentOpts.cloud, compute: parentOpts.compute, dns: parentOpts.dns };
+}
+
+domainsCmd
+  .command("add [args...]")
+  .description("Add a custom domain (interactive if no domain given)")
+  .action((args, options, cmd) => domainsAdd(args, { ...options, ...domainsOpts(cmd) }));
+
+domainsCmd
+  .command("remove <args...>")
+  .description("Remove a custom domain ([name] domain) - applies live")
+  .action((args, options, cmd) => domainsRemove(args, { ...options, ...domainsOpts(cmd) }));
+
+// --- DB (topic root = list) ---
+
+var dbCmd = program
+  .command("db")
+  .description("Manage databases");
+
+dbCmd
+  .command("list", { isDefault: true })
+  .description("List all databases")
+  .option("--json", "Output as JSON")
+  .action(dbList);
+
+dbCmd
+  .command("create <name>")
+  .description("Create a standalone database")
+  .option("--provider <id>", "Provider: cf, gcp, aws, or service name (e.g. neon)")
+  .option("--location <hint>", "Location hint (wnam, enam, weur, eeur, apac)")
+  .option("--jurisdiction <j>", "Jurisdiction (eu, fedramp)")
+  .option("--json", "Output as JSON")
+  .action(dbCreate);
+
+dbCmd
+  .command("destroy <name>")
+  .description("Destroy a database")
+  .option("--confirm <name>", "Confirm by providing the database name")
+  .action(dbDestroy);
+
+dbCmd
+  .command("info <name>")
+  .description("Show database details")
+  .option("--json", "Output as JSON")
+  .action(dbInfo);
+
+dbCmd
+  .command("attach <name> [app]")
+  .description("Attach database to an app (injects env vars)")
+  .option("-c, --cloud <cloud>", "App cloud")
+  .option("--compute <name>", "App compute service")
+  .action(dbAttach);
+
+dbCmd
+  .command("detach [app]")
+  .description("Detach database from an app (removes env vars)")
+  .option("-c, --cloud <cloud>", "App cloud")
+  .option("--compute <name>", "App compute service")
+  .action(dbDetach);
+
+dbCmd
+  .command("shell <name>")
+  .description("Interactive SQL REPL")
+  .action(dbShell);
+
+dbCmd
+  .command("query <args...>")
+  .description("Run a single SQL query ([name] <sql>)")
+  .option("--json", "Output as JSON")
+  .action(dbQuery);
+
+dbCmd
+  .command("import <args...>")
+  .description("Import a .sql file (<name> <path>)")
+  .action(dbImport);
+
+dbCmd
+  .command("export <name>")
+  .description("Export database as SQL dump")
+  .option("-o, --output <path>", "Write to file instead of stdout")
+  .action(dbExport);
+
+dbCmd
+  .command("token <name>")
+  .description("Show or rotate auth token")
+  .option("--rotate", "Generate a new token")
+  .action(dbToken);
+
+dbCmd
+  .command("reset <name>")
+  .description("Drop all tables (confirmation required)")
+  .option("--confirm <name>", "Confirm by providing the database name")
+  .action(dbReset);
+
+// --- PS ---
+
+program
+  .command("ps [name]")
+  .description("Show app containers and status")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--json", "Output as JSON")
+  .action(ps);
+
+// --- Logs ---
+
+program
+  .command("logs [name]")
+  .description("Stream live logs from an app")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .action(logs);
+
+// --- Open ---
+
+program
+  .command("open [name]")
+  .description("Open app in browser")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .action(open);
+
+// --- Regions ---
+
+program
+  .command("regions")
+  .description("List available deployment regions")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--json", "Output as JSON")
+  .action(async function (options) {
+    var { resolveTarget } = await import("./lib/providers/resolve.js");
+    var target = await resolveTarget(options);
+    var appProvider = await target.provider("app");
+
+    var regions = appProvider.getRegions();
+    if (options.json) {
+      console.log(JSON.stringify(regions, null, 2));
+      return;
+    }
+    console.log("");
+    for (var r of regions) {
+      console.log(`  ${fmt.bold(r.code.padEnd(6))} ${r.name.padEnd(25)} ${fmt.dim(r.location)}`);
+    }
+    console.log("");
+    console.log(fmt.dim("  These are location hints. The cloud provider will attempt to place"));
+    console.log(fmt.dim("  containers near the specified region but exact placement is not guaranteed."));
+    console.log("");
+  });
+
+// --- Cost ---
+
+program
+  .command("cost [name]")
+  .description("Show estimated costs for an app or all apps")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--since <period>", "Date range: Nd (e.g. 7d) or YYYY-MM-DD (default: month to date)")
+  .option("--json", "Output as JSON")
+  .action(cost);
+
 // --- Doctor ---
 
 program
@@ -29,4 +368,14 @@ program
   .description("Check system setup and cloud connectivity")
   .action(doctor);
 
+// --- Top-level aliases ---
+
+program
+  .command("destroy [name]")
+  .description("Destroy an app (alias for apps destroy)")
+  .option("-c, --cloud <cloud>", "Cloud provider")
+  .option("--compute <name>", "Compute service name")
+  .option("--confirm <name>", "Confirm by providing the app name")
+  .action(appsDestroy);
+
 program.parse();