fundaia 0.52.1

mod api;
mod changelog;
mod commands;
mod config;
mod exit;
mod output;
mod render;
mod update;

use anyhow::{Context, Result};
use clap::{Args, CommandFactory, Parser, Subcommand};
use owo_colors::OwoColorize;

use api::client::ApiClient;
use config::Config;
use output::Format;
use render::theme;

/// The command line for the Fundaia deployment platform.
///
/// Shaped around the two questions a deployment platform actually gets asked —
/// *what is the state of things* and *make this change* — rather than around
/// the REST endpoints underneath. `status` answers the first for the whole
/// instance in one screen; `deploy` answers the second and then stays to show
/// the pipeline, which is the one thing a terminal does better than a browser
/// tab you have to keep switching to.
#[derive(Parser)]
#[command(
    name = "fundaia",
    version,
    about = "Proyectos, servicios, variables, despliegues, logs y métricas",
    long_about = None,
    propagate_version = true
)]
struct Cli {
    /// Which configured instance to talk to.
    #[arg(long, short, global = true, env = "FUNDAIA_PROFILE")]
    profile: Option<String>,

    /// Override the address, without saving it. Useful in CI.
    #[arg(long, global = true, env = "FUNDAIA_URL")]
    url: Option<String>,

    /// Override the token, without saving it. Useful in CI.
    #[arg(long, global = true, env = "FUNDAIA_TOKEN", hide_env_values = true)]
    token: Option<String>,

    /// Never colour the output, whatever the terminal says.
    #[arg(long, global = true)]
    no_color: bool,

    /// Answer in JSON: one compact value, or one object per line on a stream.
    /// For scripts and AI agents; `FUNDAIA_JSON=1` says the same thing.
    #[arg(long, global = true)]
    json: bool,

    /// Which environment of the project to work in, by name or slug. Every
    /// command that names a project or a service reads and changes that one;
    /// without it, the project's default environment (production).
    #[arg(
        long = "env",
        global = true,
        env = "FUNDAIA_ENV",
        value_name = "ENTORNO"
    )]
    environment: Option<String>,

    #[command(subcommand)]
    command: Command,
}

#[derive(Subcommand)]
enum Command {
    /// Authorise this terminal through the browser.
    Login {
        /// The instance to sign in to.
        #[arg(long, default_value = "https://infrastructure.fundaia.com")]
        url: String,

        /// The name to save it under.
        #[arg(long, default_value = "default")]
        as_profile: String,

        /// Print the address instead of opening it.
        #[arg(long)]
        no_browser: bool,
    },

    /// Forget a profile on this machine.
    Logout {
        #[arg(long)]
        profile: Option<String>,
    },

    /// Replace this binary with the newest published release.
    ///
    /// Rarely needed: every command already checks once a day and installs what
    /// it finds. This is the same work without waiting for that, and the way to
    /// see what happened when the automatic one stayed quiet.
    Upgrade {
        /// Only say whether there is a newer one.
        #[arg(long)]
        check: bool,
    },

    /// What each version brought, and which ones this machine has run.
    ///
    /// The file travels inside the binary, so this answers with no instance, no
    /// token and no network. With no arguments it tells what the version you
    /// are running brought — which is the question the self-update leaves
    /// behind when it replaces the binary halfway through an afternoon.
    Changelog {
        /// One version, with or without its `v`. The running one by default.
        ///
        /// Positional, and named `release` in the code, because `--version` is
        /// clap's and `propagate_version` hands it to every subcommand: an
        /// argument called `version` collides with it before the parser is even
        /// built. The word somebody types is still a version.
        #[arg(value_name = "VERSION")]
        release: Option<String>,

        /// Every version, newest first.
        #[arg(long)]
        all: bool,

        /// What was published after a version: everything an upgrade brought.
        #[arg(long)]
        since: Option<String>,

        /// How many to show.
        #[arg(short = 'n', long)]
        count: Option<usize>,

        /// Which versions have run here, and since when.
        ///
        /// A different question from the changelog: that one says what was
        /// published, this says what was on this machine.
        #[arg(long)]
        history: bool,
    },

    /// Who this terminal is signed in as.
    Whoami,

    /// The completion script for a shell, on stdout.
    ///
    /// `fundaia completions zsh > "${fpath[1]}/_fundaia"`, or the bash and
    /// fish equivalents. Generated from the real argument definitions, so it
    /// can never disagree with what the parser accepts.
    Completions { shell: clap_complete::Shell },

    /// Every command, every argument and every exit code, as JSON.
    ///
    /// `completions` for a reader that is not a shell. An agent working out
    /// what it may do here had `--help` on sixty commands — prose, written for
    /// a person — or a guess; this is the parser describing itself, so it
    /// cannot disagree with what the parser accepts. Each command carries what
    /// it does to the platform (`reads`, `writes`, `starts`, `destroys`,
    /// `local`), which is the one thing to know before running it.
    ///
    /// No instance, no token and no network.
    Schema,

    /// What is true about this platform, in one page.
    ///
    /// The orientation under the commands: that creating a service deploys it,
    /// that a connection is a reference and never a copy, what each exit code
    /// means. `schema` is the surface, this is the briefing — the same words
    /// the instance serves at `/agent.md` and hands to an MCP client on
    /// connect.
    ///
    /// Travels inside the binary, so it answers with no instance and no token:
    /// a caller working out what it may do has not signed in yet.
    Guide,

    /// The Claude Code skill for this CLI, generated from its own commands.
    ///
    /// `fundaia skill` prints it; `fundaia skill install` writes it to
    /// `~/.claude/skills/fundaia/SKILL.md` (or `.claude/skills/` in this directory with
    /// `--project`). Run install again after an upgrade to pick up new commands.
    Skill {
        #[command(subcommand)]
        command: Option<SkillCommand>,
    },

    /// Everything, in one screen.
    Status,

    /// Projects on this instance.
    Projects,

    /// Make one, rename one, delete one, or hand one to another space.
    Project {
        #[command(subcommand)]
        command: ProjectCommand,
    },

    /// The environments of a project: production, staging…
    ///
    /// The default one first, each with its services counted. `--env <name>`
    /// on any other command works in one of them.
    Envs { project: String },

    /// Make an environment, rename one, delete one, or copy a service into one.
    Env {
        #[command(subcommand)]
        command: EnvCommand,
    },

    /// Where a project announces its deployments, crashes and failed workflows:
    /// Slack, Discord or any HTTPS endpoint.
    Webhooks { project: String },

    /// Add a webhook, change one, remove one, or send it a test.
    Webhook {
        #[command(subcommand)]
        command: WebhookCommand,
    },

    /// Services in a project.
    Services { project: String },

    /// One service in detail.
    Service { project: String, service: String },

    /// The picture of a project: where each service sits, and how to move it.
    Canvas {
        #[command(subcommand)]
        command: CanvasCommand,
    },

    /// Create a service.
    New(NewArgs),

    /// What a Claude Code component runs on, and changing it.
    ///
    /// With no option it prints the model, the effort and whether a token is
    /// configured — never the token. Each option changes one thing and only
    /// that; the container restarts to pick it up.
    Agent {
        project: String,
        service: String,

        /// A model from `fundaia templates`.
        #[arg(long)]
        model: Option<String>,

        /// low, medium, high, xhigh or max.
        #[arg(long)]
        effort: Option<String>,

        /// A new token from `claude setup-token`. Replaces the one it has.
        #[arg(long = "setup-token")]
        setup_token: Option<String>,
    },

    /// Rename a service.
    ///
    /// A contract change rather than a label: the expressions that name it and
    /// the internal addresses that call it are rewritten with it, and its public
    /// hostname follows on the next deployment.
    Rename {
        project: String,
        service: String,
        name: String,
    },

    /// The components on offer: databases, storage and Claude Code.
    ///
    /// What it lists is what *this account* may add. An instance offers some
    /// components to its owner only, and they are absent rather than shown and
    /// refused.
    Templates,

    /// Send the code in a directory and deploy it.
    ///
    /// For a service created with `--upload`: there is no repository to read, so
    /// this *is* the push. The directory is packed honouring `.gitignore` and
    /// `.fundaiaignore`, with `.git` and `node_modules` always left out.
    Up {
        project: String,
        service: String,

        /// Which directory to send. Default: the current one.
        #[arg(long, default_value = ".")]
        path: String,

        /// Store the code without deploying it.
        #[arg(long = "no-deploy")]
        no_deploy: bool,

        /// Send it and return, without watching the pipeline.
        #[arg(long)]
        detach: bool,
    },

    /// What has been uploaded to a service, newest first.
    Uploads { project: String, service: String },

    /// Deploy a service, and watch the pipeline.
    Deploy {
        project: String,
        service: String,

        /// Reuse the current image instead of building.
        #[arg(long)]
        restart: bool,

        /// Start it and return, without watching.
        #[arg(long)]
        detach: bool,
    },

    /// Build one deployment's own commit again, with today's variables.
    ///
    /// Between `deploy`, which reads the branch and ships whatever landed on it
    /// since, and `rollback`, which reuses the image and never builds.
    Redeploy {
        project: String,
        service: String,
        /// The number shown by `history`.
        number: u32,
    },

    /// Put a previous deployment back, by its number.
    Rollback {
        project: String,
        service: String,
        /// The number shown by `history`.
        number: u32,
    },

    /// Stop a deployment that has not finished.
    ///
    /// The one in flight, unless `--deployment` names another. Whatever was
    /// serving before it keeps serving; a deployment that already went live
    /// cannot be cancelled, and `rollback` is the verb for that.
    Cancel {
        project: String,
        service: String,

        /// Which deployment, by the number `history` shows. The one in flight
        /// by default.
        #[arg(long)]
        deployment: Option<u32>,
    },

    /// Put a service to sleep. The next request wakes it.
    Stop { project: String, service: String },

    /// The deployments of a service, newest first.
    History {
        project: String,
        service: String,

        #[arg(long, default_value_t = 15)]
        limit: usize,

        /// Only the deployments of one commit: the build, a retry, a rollback
        /// back to it. A hash, or its first seven characters.
        #[arg(long)]
        commit: Option<String>,
    },

    /// The code one commit changed, file by file.
    ///
    /// Without a hash, the commit the newest deployment shipped — which is what
    /// answers "what went out". `--stat` stops before the patches when the list
    /// of files is all you wanted, and `--file` prints one of them.
    #[command(alias = "show")]
    Commit {
        project: String,
        service: String,

        /// The commit hash, abbreviated or whole.
        commit: Option<String>,

        /// One file, by the path the list reports.
        #[arg(long)]
        file: Option<String>,

        /// The list of files and nothing else.
        #[arg(long)]
        stat: bool,
    },

    /// What has been done in a project, newest first.
    ///
    /// Deployments, variables, domains and who read which logs — manual and
    /// through this tool alike, because both go through the same services.
    Activity {
        project: String,

        #[arg(long, default_value_t = 30)]
        limit: usize,
    },

    /// Who has been getting into your account, and from where.
    ///
    /// The failed attempts are in the list on purpose: a successful sign-in
    /// nobody recognises is normally preceded by attempts nobody recognises.
    /// Always your own account — the token decides whose, and there is nowhere
    /// else to point it.
    #[command(alias = "logins")]
    SignIns {
        #[arg(long, short = 'n', default_value_t = 50)]
        limit: usize,
    },

    /// The sessions open right now, and closing one.
    ///
    /// A different question from `sign-ins`, which is history: this is the
    /// present tense, and the only one of the two with anything to press.
    Sessions {
        #[command(subcommand)]
        command: Option<SessionCommand>,
    },

    /// Follow what the platform is doing, live.
    ///
    /// The terminal half of the notices the web interface shows: a deployment
    /// somebody else started, a push that deployed on its own, a variable that
    /// changed under you. With no arguments it is everything this account can
    /// reach; name a project — or a project and a service — to narrow it.
    Watch {
        project: Option<String>,
        service: Option<String>,
    },

    /// A service's log.
    Logs(LogsArgs),

    /// Everything that is not fine, across every project you reach, worst first.
    ///
    /// Each item says what to call next, arguments filled in.
    #[command(alias = "inbox")]
    Attention,

    /// One verdict for a project, and one line per service.
    Health { project: String },

    /// What is wrong with one service, and what to run next.
    Diagnose { project: String, service: String },

    /// Log lines containing a text, in any service of a project, newest first.
    ///
    /// For an error message whose service you do not know. A sibling of `logs`
    /// rather than a subcommand of it: `logs <project> <service>` is positional.
    Grep(GrepArgs),

    /// What a service reads from, what reads from it, and what to redeploy after it changes.
    #[command(alias = "dependencies")]
    Deps { project: String, service: String },

    /// The whole project as one JSON manifest. Secrets are named, never valued.
    Export {
        project: String,

        /// Write it to a file instead of standard output.
        #[arg(long = "output", short = 'o', value_name = "FILE")]
        file: Option<String>,
    },

    /// A project made from a manifest `export` wrote, here or on another
    /// instance. Secrets come back empty and are listed with the command that
    /// sets each; nothing deploys unless `--deploy`.
    Import {
        file: String,

        /// Another name, when the original's is taken here.
        #[arg(long)]
        name: Option<String>,

        /// Which shared space it belongs to. Yours, if you say nothing.
        #[arg(long)]
        workspace: Option<String>,

        /// Deploy every service once written.
        #[arg(long)]
        deploy: bool,
    },

    /// Two deployments of a service side by side: code, variables, configuration.
    ///
    /// Without numbers, the newest against the one before it.
    Compare {
        project: String,
        service: String,
        /// The older one, by the number `history` shows.
        from: Option<u32>,
        /// The newer one. The newest by default.
        to: Option<u32>,
    },

    /// A GET to the service's own container: status, latency, content type, body.
    ///
    /// Never wakes a sleeping service and never leaves the machine.
    Probe {
        project: String,
        service: String,
        /// Path and query.
        #[arg(default_value = "/")]
        path: String,
    },

    /// Start a sleeping or crashed service now, and wait for its health check.
    Wake { project: String, service: String },

    /// Dependency audits by Claude Code, and the pull request that fixes them.
    Security {
        #[command(subcommand)]
        command: SecurityCommand,
    },

    /// Open a GitHub issue about an incident, a failed deployment or a security scan.
    ///
    /// Asking twice about the same thing answers the first issue.
    Issue {
        #[arg(value_parser = ["incident", "deployment", "security-scan"])]
        kind: String,
        /// The incident, deployment or scan id.
        id: String,
    },

    /// The pipelines of a project: `.fundaia/workflows/*.yml`, run here.
    ///
    /// GitHub Actions' file format without GitHub Actions: a push, a schedule
    /// or `workflows run` makes a run, each job is one container of the image
    /// it names, and the log is read back per step.
    Workflows {
        #[command(subcommand)]
        command: WorkflowCommand,
    },

    /// What a service keeps getting wrong, folded and counted.
    Incidents {
        project: String,
        service: String,

        /// Include the ones already resolved or ignored.
        #[arg(long)]
        decided: bool,
    },

    /// Commits waiting for somebody to say they may deploy.
    ///
    /// A push from outside the workspace is held rather than deployed, the way
    /// Railway holds one from outside the team. Whoever pushed is not a member
    /// here — or GitHub matched no account to their commit at all, which is
    /// almost always a `git config user.email` nobody added to their account.
    Approvals {
        project: String,

        /// One service. Omit for everything waiting in the project.
        service: Option<String>,
    },

    /// Approve a held commit and deploy it.
    Approve {
        /// The id `approvals` prints.
        id: String,
    },

    /// Refuse a held commit. It is never offered again.
    Reject {
        /// The id `approvals` prints.
        id: String,
    },

    /// Ask the platform to fix an incident now, or a failed deployment.
    ///
    /// `fix <id>` for an incident; `fix deployment <project> <service> [N]` for
    /// a deployment.
    #[command(args_conflicts_with_subcommands = true, subcommand_negates_reqs = true)]
    Fix {
        /// The id `incidents` prints.
        #[arg(required = true)]
        id: Option<String>,

        #[command(subcommand)]
        command: Option<FixCommand>,
    },

    /// Record what you concluded about an incident.
    Incident {
        /// The id `incidents` prints.
        id: String,

        /// `resolved` if it is fixed, `ignored` to stop hearing about it, or
        /// `open` to put it back in play.
        #[arg(value_parser = ["resolved", "ignored", "open"])]
        status: String,
    },

    /// What the platform has tried to fix on its own, and how it is configured.
    Autofix(AutofixArgs),

    /// CPU and memory, now and over a window.
    Metrics {
        project: String,
        service: String,

        #[arg(long, default_value_t = 60)]
        minutes: u32,
    },

    /// Tokens and dollars an agent component has spent.
    #[command(alias = "usage")]
    Consumption {
        project: String,
        service: String,

        /// The window: 24h, 7d, 30d or 90d.
        #[arg(long, default_value = "7d")]
        range: String,
    },

    /// Every prompt an agent has been asked, and what it is doing now.
    ///
    /// `prompts` is the alias because that is what somebody types when they
    /// want this and `activity` is already the project history.
    #[command(name = "agent-activity", alias = "prompts")]
    AgentActivity {
        project: String,
        service: String,

        /// The window: 24h, 7d, 30d or 90d.
        #[arg(long, default_value = "24h")]
        range: String,

        /// Narrows the list: answered, failed or rejected. The counts do not move.
        #[arg(long)]
        outcome: Option<String>,
    },

    /// A service's environment variables.
    #[command(alias = "vars")]
    Variables {
        #[command(subcommand)]
        command: VariableCommand,
    },

    /// Variables written once that every service of a project receives. A
    /// service's own key of the same name wins; `--env` picks the environment.
    Shared {
        #[command(subcommand)]
        command: SharedCommand,
    },

    /// The rows inside a database component: its tables, a query, a change.
    ///
    /// PostgreSQL, MySQL, SQLite and ClickHouse components take SQL; MongoDB
    /// takes a JSON command document (`{"find": "users", "filter": {…}}`). `query` is
    /// read-only and the database itself refuses any write; `run` is the one
    /// path that writes, and `--preview` runs the statement and undoes it so
    /// the count says what a real run would touch, or says the engine cannot.
    #[command(alias = "sql")]
    Data {
        #[command(subcommand)]
        command: DataCommand,
    },

    /// Read access to a service's repository, when its owner is somebody else.
    ///
    /// A private repository belonging to another account is invisible to this
    /// platform until that account grants it, and GitHub reports the refusal as a
    /// 403 about *write* access on a command that asked to read. Only the owner
    /// can grant it, so `access request` emails them a link that does it — and the
    /// service redeploys itself the moment the permission lands.
    Access {
        #[command(subcommand)]
        command: AccessCommand,
    },

    /// Copies of a service's volume, and putting one back.
    #[command(alias = "backup")]
    Backups {
        #[command(subcommand)]
        command: BackupCommand,
    },

    /// Hostnames a service answers on.
    Domains {
        #[command(subcommand)]
        command: DomainCommand,
    },

    /// Wire one service to another.
    Connect {
        project: String,
        /// The service that will read the variables.
        service: String,
        /// The service it should be able to reach.
        provider: String,
    },

    /// Undo a connection: the consumer stops reading the provider's variables.
    Disconnect {
        project: String,
        /// The service that was reading the variables.
        service: String,
        /// The one it was reading them from.
        provider: String,
    },

    /// What a service could be connected to.
    Connectable { project: String, service: String },

    /// Directories that outlive the container.
    Volumes {
        #[command(subcommand)]
        command: VolumeCommand,
    },

    /// The Containerfile a service builds with.
    Recipe {
        #[command(subcommand)]
        command: RecipeCommand,
    },

    /// The routes a load balancer or an API gateway serves.
    Config {
        #[command(subcommand)]
        command: ConfigCommand,
    },

    /// What a service turned out to offer: framework, port, endpoints.
    #[command(alias = "offers")]
    Capabilities { project: String, service: String },

    /// The shared spaces this account belongs to.
    #[command(alias = "workspaces")]
    Workspace {
        #[command(subcommand)]
        command: WorkspaceCommand,
    },

    /// How much of the machine is left.
    Capacity,

    /// Change a service's settings. Only what you pass is touched.
    Settings(SettingsArgs),

    /// Publish a service on the internet, or take it off.
    ///
    /// Every service is always reachable inside its project by name; this is
    /// only about the hostname on top. A database behind an API wants none.
    Expose {
        project: String,
        service: String,

        /// Take it off the internet. Its domains are removed.
        #[arg(long)]
        off: bool,
    },

    /// Preview environments: each pull request opened on a repository the
    /// project builds gets `pr-<number>`, deleted when it closes. `on` or
    /// `off` turns them on or off; nothing prints where they stand.
    Previews {
        project: String,

        #[arg(value_parser = ["on", "off"])]
        switch: Option<String>,
    },

    /// Commands a service runs on a schedule (cron, UTC) in its running
    /// container, and how each run went.
    Tasks {
        #[command(subcommand)]
        command: TasksCommand,
    },

    /// The files in a service's volumes, read from its running container.
    Files {
        #[command(subcommand)]
        command: FilesCommand,
    },

    /// Ask the registry for a newer image behind a service's tag now, and
    /// deploy it if there is one. For a registry image or a catalogue component.
    Pull { project: String, service: String },

    /// Run one command in a service's running container and print what it
    /// printed. `fundaia exec tienda api -- ls -la /app`. Secrets come back
    /// masked; 60 seconds at most.
    Exec {
        project: String,
        service: String,

        /// The command, after `--` so its own flags are not read as ours.
        #[arg(trailing_var_arg = true, allow_hyphen_values = true, required = true)]
        command: Vec<String>,
    },

    /// Show visitors a maintenance page instead of the service, which keeps
    /// running. Nothing restarts; `--off` serves it again.
    Maintenance {
        project: String,
        service: String,

        /// Serve the service again.
        #[arg(long)]
        off: bool,

        /// What visitors read, up to 500 characters.
        #[arg(long)]
        message: Option<String>,
    },

    /// Ask every visitor for a username and password before anything reaches
    /// the service. The service never sees the credential.
    Protect {
        project: String,
        service: String,

        /// The username visitors type.
        #[arg(long)]
        user: String,

        /// 8 to 72 characters. Asked at the keyboard, or read from a pipe,
        /// when not given here.
        #[arg(long, env = "FUNDAIA_SERVICE_PASSWORD", hide_env_values = true)]
        password: Option<String>,
    },

    /// Remove the password: anybody with the address reaches it again.
    Unprotect { project: String, service: String },

    /// Encryption at rest for a storage service's buckets.
    Encrypt {
        project: String,
        service: String,

        /// Turn it off instead. What is already encrypted stays encrypted.
        #[arg(long)]
        off: bool,
    },

    /// Remove a service and everything under it, in every environment.
    ///
    /// The name belongs to the project, so the deletion does too. To be rid of
    /// one environment's copy only, `env rm` that environment.
    Delete {
        project: String,
        service: String,

        /// The service's own name, typed back.
        #[arg(long)]
        confirm: Option<String>,
    },
}

/// Sharing a space, from a terminal.
///
/// The workspace is optional everywhere: most people are in one, and making
/// them name it on every call would be ceremony. Given, it takes an id, a slug
/// or the name shown on screen, the same as a project does.

#[derive(Subcommand)]
enum SkillCommand {
    /// Print the skill.
    Show,
    /// Write it where Claude Code finds it.
    Install {
        /// Into `.claude/skills/` of the current directory instead of your home.
        #[arg(long)]
        project: bool,
    },
    /// Where `install` would write it.
    Path {
        #[arg(long)]
        project: bool,
    },
}
#[derive(Subcommand)]
enum WorkspaceCommand {
    /// The spaces you are in.
    List,

    /// Who shares a space, and who has been invited to.
    #[command(alias = "who")]
    Members { workspace: Option<String> },

    /// The prepaid credit the agents of a space run on.
    #[command(alias = "saldo")]
    Credits { workspace: Option<String> },

    /// Invite somebody by email.
    Invite {
        email: String,

        #[arg(long)]
        workspace: Option<String>,

        /// Let them invite others too.
        #[arg(long)]
        admin: bool,
    },

    /// Withdraw an invitation that has not been accepted.
    Revoke {
        /// The id shown by `members`.
        invitation_id: String,

        #[arg(long)]
        workspace: Option<String>,
    },

    /// Remove somebody from the space.
    Remove {
        /// The user id shown by `members`.
        user_id: String,

        #[arg(long)]
        workspace: Option<String>,
    },

    /// Require a second factor of every member (`on`) or stop (`off`).
    ///
    /// Members without a passkey or a TOTP reach none of the space's projects
    /// until they add one; `members` shows who has one. Admins only.
    #[command(name = "2fa")]
    SecondFactor {
        #[arg(value_parser = ["on", "off"])]
        switch: String,

        #[arg(long)]
        workspace: Option<String>,
    },
}

/// A project is where everything else hangs from, so this is the first command
/// somebody runs on a new instance and was the one thing the tool could not do.
#[derive(Subcommand)]
enum ProjectCommand {
    /// Create one.
    New {
        name: String,

        #[arg(long)]
        description: Option<String>,

        /// Which shared space it belongs to. Yours, if you say nothing.
        #[arg(long)]
        workspace: Option<String>,
    },

    /// Change its name, its description, or both.
    Rename {
        project: String,
        /// The new name. Leave it out to only change the description.
        name: Option<String>,

        #[arg(long)]
        description: Option<String>,
    },

    /// Delete it, with everything under it. There is no archive.
    Delete {
        project: String,

        /// The project's own name, typed back.
        #[arg(long)]
        confirm: Option<String>,
    },

    /// Hand it to another shared space, which is the whole of sharing it.
    Move { project: String, workspace: String },

    /// Star it: it comes first in your lists, and only in yours.
    Star { project: String },

    /// Take the star away.
    Unstar { project: String },
}

/// A project's outgoing webhooks: Slack, Discord or any HTTPS endpoint.
#[derive(Subcommand)]
enum WebhookCommand {
    /// Post a project's events to a URL.
    ///
    /// Slack and Discord are recognised from the URL; any other address gets
    /// JSON signed with HMAC-SHA256 in `X-Fundaia-Signature`, and the secret is
    /// printed once. Every event unless `--events` narrows it.
    Add {
        project: String,
        url: String,

        /// What to call it. Slack, Discord or the host, unless said.
        #[arg(long)]
        name: Option<String>,

        /// slack, discord or json. Guessed from the URL, unless said.
        #[arg(long)]
        format: Option<String>,

        /// Which events, comma-separated: deployment-succeeded,
        /// deployment-failed, service-crashed, service-recovered,
        /// workflow-failed, task-failed.
        #[arg(long, value_delimiter = ',')]
        events: Vec<String>,
    },

    /// Rename it, change its events, or pause and resume it.
    Set {
        project: String,
        webhook: String,

        #[arg(long)]
        name: Option<String>,

        /// The events it announces from now on, comma-separated.
        #[arg(long, value_delimiter = ',')]
        events: Option<Vec<String>>,

        /// Stop posting without forgetting it.
        #[arg(long, conflicts_with = "resume")]
        pause: bool,

        #[arg(long)]
        resume: bool,
    },

    /// Stop posting to it and forget its URL and secret.
    Rm { project: String, webhook: String },

    /// Send a sample message now and say whether it arrived.
    Test { project: String, webhook: String },
}

/// A project's environments. The rest of the commands reach them through `--env`.
#[derive(Subcommand)]
enum EnvCommand {
    /// Create one, as a copy of another environment or empty.
    ///
    /// A copy carries every service with its settings, its source, its
    /// variables (secrets encrypted again, references pointed at the copies,
    /// databases with new passwords) and volumes at the same paths — never the
    /// data in them, and no hostname: a public service gets a new one with the
    /// environment in it. The copies deploy, providers first.
    New {
        project: String,
        name: String,

        /// The environment to copy. The default one, unless said.
        #[arg(long, conflicts_with = "empty")]
        from: Option<String>,

        /// Create it with nothing in it.
        #[arg(long)]
        empty: bool,

        /// Copy the services without deploying them.
        #[arg(long = "no-deploy")]
        no_deploy: bool,
    },

    /// Change its name. Its slug, and every address in it, stays.
    Rename {
        project: String,
        environment: String,
        name: String,
    },

    /// Delete it, with everything in it: services, containers, volumes and
    /// their data, backups and hostnames. The default one cannot be deleted.
    Rm {
        project: String,
        environment: String,

        /// The environment's name or slug, typed back.
        #[arg(long)]
        confirm: Option<String>,
    },

    /// Copy one service into an environment that does not have it yet.
    Copy {
        project: String,
        service: String,

        /// Where it is copied from. `--env`, or the default one, unless said.
        #[arg(long)]
        from: Option<String>,

        /// Where it is copied to.
        #[arg(long)]
        to: String,

        /// Copy it without deploying it.
        #[arg(long = "no-deploy")]
        no_deploy: bool,
    },
}

#[derive(Subcommand)]
enum CanvasCommand {
    /// Where every service sits, with its coordinates.
    ///
    /// The coordinates are what `move` takes back, so this is the command to
    /// run before arranging anything by hand.
    Show {
        project: String,

        /// Draw it as well as list it.
        #[arg(long)]
        map: bool,
    },

    /// Put one service somewhere, in canvas units.
    ///
    /// x runs to the right and y downwards, the first column sits at 80, and a
    /// node is 208 wide by 76 tall — so 300 apart horizontally and 130
    /// vertically is what the automatic arrangements leave between two of them.
    /// Positions are snapped to the same 8-unit grid a drag snaps to.
    Move {
        project: String,
        service: String,

        #[arg(long, allow_negative_numbers = true)]
        x: i64,

        #[arg(long, allow_negative_numbers = true)]
        y: i64,
    },

    /// Lay the whole project out again, overwriting every position in it.
    ///
    /// `layered` reads the arrows and puts what a service depends on to its
    /// left, which is how the picture is meant to be read. `grid` ignores them
    /// and lines everything up in creation order, for a canvas that has been
    /// dragged into a heap.
    Arrange {
        project: String,

        #[arg(long, default_value = "layered", value_parser = ["layered", "grid"])]
        layout: String,
    },
}

#[derive(Subcommand)]
enum FixCommand {
    /// A failed deployment: Claude Code reads its log, fixes it and opens a pull request.
    Deployment {
        project: String,
        service: String,
        /// The number `history` shows. The newest by default.
        number: Option<u32>,
    },
}

#[derive(Subcommand)]
enum SecurityCommand {
    /// Audit a service's dependencies. Answers at once unless `--wait`.
    Scan {
        project: String,
        service: String,

        /// Also upgrade to the smallest safe versions and open a pull request.
        #[arg(long)]
        fix: bool,

        /// Stay until the scan ends.
        #[arg(long)]
        wait: bool,
    },

    /// One scan, by the id `scan` or `list` prints.
    Show { scan_id: String },

    /// The recent scans of a service.
    List { project: String, service: String },
}

#[derive(Subcommand)]
enum WorkflowCommand {
    /// The workflow files found in the project's repositories, per branch.
    List {
        project: String,
        /// Look at every branch again first. Slow: one fetch per repository.
        #[arg(long)]
        refresh: bool,
    },

    /// Recent runs, newest first.
    Runs {
        project: String,
        /// Only the runs of one file, e.g. `.fundaia/workflows/ci.yml`.
        #[arg(long)]
        path: Option<String>,
        /// Only the runs of one commit. A short sha works.
        #[arg(long)]
        commit: Option<String>,
        /// How many, 30 by default.
        #[arg(long, default_value_t = 30)]
        limit: u32,
    },

    /// Start a workflow by hand at the current head of its branch, and return at once.
    Run {
        project: String,
        /// The workflow file, as `list` shows it.
        path: String,
        /// Which branch, when the file exists on several the project follows.
        #[arg(long)]
        branch: Option<String>,
        /// A `workflow_dispatch` input, as NAME=value. Repeat for several.
        #[arg(long = "input")]
        inputs: Vec<String>,
    },

    /// One run with its jobs, by the id `runs` shows.
    Show { run_id: String },

    /// What one job printed, by the id `show` shows.
    Logs { job_id: String },

    /// Stop a run that is queued or running.
    Cancel { run_id: String },

    /// The same commit, file and inputs again, as a new run.
    Rerun { run_id: String },

    /// Per workflow: runs, success rate, durations, failing streak and flakiness.
    Stats {
        project: String,
        /// How many recent runs to read.
        #[arg(long, default_value_t = 100)]
        limit: u32,
    },

    /// Wait for a run to end. Non-zero when it did not succeed.
    Wait {
        run_id: String,
        /// Give up after this many seconds.
        #[arg(long, value_name = "SECS", default_value_t = 600)]
        timeout: u64,
    },

    /// Download the artifact archive a job kept, as a .tar.gz.
    Artifact {
        job_id: String,
        /// Where to write it; `<job id>.tar.gz` in this directory by default.
        #[arg(long)]
        into: Option<String>,
    },
}

#[derive(Subcommand)]
enum VolumeCommand {
    List {
        project: String,
        service: String,
    },

    /// Attach one. Nothing is deployed: it is inside the container from the
    /// next deployment on.
    Add {
        project: String,
        service: String,
        /// Where it is mounted, as an absolute path: `/data`.
        mount_path: String,
    },

    /// Change how much disk it may hold, by the id `list` shows.
    ///
    /// Nothing is deployed: the size is what the plan reserves, not a mount
    /// option. It is refused when the plan has no room left and when the volume
    /// already holds more than the new size.
    Resize {
        volume_id: String,
        /// The new size in whole gigabytes.
        #[arg(long)]
        gb: u64,
    },

    /// Take one off, by the id `list` shows.
    Remove {
        volume_id: String,
    },
}

#[derive(Subcommand)]
enum RecipeCommand {
    /// Print it, with what generated it.
    Show {
        project: String,
        service: String,

        /// Only the Containerfile, so it can be redirected into one.
        #[arg(long)]
        plain: bool,
    },

    /// Replace it. From then on it is never regenerated.
    Edit {
        project: String,
        service: String,

        /// The file to send, or `-` for standard input.
        #[arg(long, default_value = "-")]
        file: String,
    },
}

#[derive(Subcommand)]
enum ConfigCommand {
    /// Print it, with where the container reads it.
    Show {
        project: String,
        service: String,

        /// Only the file, so it can be redirected into one.
        #[arg(long)]
        plain: bool,
    },

    /// Replace it. From then on the form never overwrites it again.
    Edit {
        project: String,
        service: String,

        /// The file to send, or `-` for standard input.
        #[arg(long, default_value = "-")]
        file: String,
    },
}

#[derive(Subcommand)]
enum DataCommand {
    /// The tables and views (or collections), with an estimated row count.
    Tables { project: String, service: String },

    /// One read-only statement, first rows back. Two statements are refused.
    Query {
        project: String,
        service: String,
        /// `SELECT …`, or for MongoDB `{"find": "users"}`. Quote it for the
        /// shell; `-` reads it from stdin.
        sql: String,

        /// Rows to print, at most 200.
        #[arg(long, short = 'n')]
        limit: Option<u64>,
    },

    /// One statement that changes data — UPDATE, INSERT, DELETE, ALTER, or a
    /// MongoDB command — committed.
    ///
    /// Run it with `--preview` first: the statement executes and is undone,
    /// and the count printed is exactly what the real run would touch. MongoDB,
    /// ClickHouse and MySQL schema changes cannot be undone, so their preview
    /// runs nothing and says so. The real run needs `--confirm <service>` and is
    /// written in the project's history with the statement. There is no undo.
    Run {
        project: String,
        service: String,
        /// The statement. Quote it for the shell; `-` reads it from stdin.
        sql: String,

        /// Execute and undo, printing what would have happened.
        #[arg(long)]
        preview: bool,

        /// The service's name or slug, repeated. Required unless --preview.
        #[arg(long)]
        confirm: Option<String>,
    },
}

#[derive(Subcommand)]
enum VariableCommand {
    /// List them.
    List {
        project: String,
        service: String,

        /// Decrypt the secrets. Each one is recorded on the server.
        #[arg(long)]
        reveal: bool,
    },

    /// Set one.
    Set {
        project: String,
        service: String,
        key: String,
        value: String,

        /// Store it encrypted, and never show it again.
        #[arg(long)]
        secret: bool,

        /// Seal it on the way in: unreadable and unchangeable from the start.
        #[arg(long)]
        sealed: bool,
    },

    /// Seal one: the container keeps receiving it, nobody can read or change it.
    Seal {
        project: String,
        service: String,
        key: String,

        /// The key again. Sealing cannot be undone.
        #[arg(long)]
        confirm: Option<String>,
    },

    /// Remove one.
    Unset {
        project: String,
        service: String,
        key: String,
    },

    /// Every `${{ … }}` in a project that will not resolve, with the nearest name that exists.
    Audit { project: String },

    /// Read a `.env` and set every variable in it, in one request.
    Import {
        project: String,
        service: String,

        /// The file to read, or `-` for standard input.
        file: String,

        /// Store them all encrypted.
        #[arg(long)]
        secret: bool,
    },
}

/// What `settings` changes. Its own struct, like every large command's, so clap builds its flags in a
/// function of their own: inline in `Command`, they made the parser's one generated function outgrow
/// a test thread's stack.
#[derive(Args)]
struct SettingsArgs {
    project: String,
    service: String,

    /// The repository this service builds from, as `owner/name`. Only for
    /// a service created from GitHub; the way to follow a repository that
    /// was renamed there. Read by the next deployment.
    #[arg(long)]
    repo: Option<String>,

    /// The branch to watch and build. Only for a service created from
    /// GitHub. Read by the next deployment.
    #[arg(long)]
    branch: Option<String>,

    /// Memory ceiling, in MB.
    #[arg(long)]
    memory: Option<u32>,

    /// How many containers to run behind the one hostname.
    #[arg(long)]
    replicas: Option<u32>,

    /// Which directory of the repository this service is, in a monorepo.
    #[arg(long)]
    root: Option<String>,

    /// What to run instead of the image's own entrypoint.
    #[arg(long = "start-command")]
    start_command: Option<String>,

    /// Deploy on tags instead of branch pushes: a glob such as `v*` deploys
    /// the newest matching tag, by version. An empty value follows the
    /// branch again.
    #[arg(long = "deploy-tags")]
    deploy_tags: Option<String>,

    /// Run once with the new image before it replaces the running one,
    /// e.g. `npx prisma migrate deploy`. A failure keeps the old version
    /// serving. An empty value clears it.
    #[arg(long = "pre-deploy")]
    pre_deploy: Option<String>,

    /// The path a deployment is considered live once it answers. Setting
    /// one is also how a service is moved onto HTTP checks.
    #[arg(long = "health-path")]
    health_path: Option<String>,

    /// What to ask: `auto`, `http`, `tcp`, or `none` for a worker that
    /// serves nothing. `tcp` is what a database brought in as a plain
    /// image needs — asking it for HTTP burns the whole budget.
    #[arg(long = "health-probe")]
    health_probe: Option<String>,

    /// The whole wait, in seconds, before the deployment is called failed.
    #[arg(long = "health-timeout")]
    health_timeout_seconds: Option<u32>,

    /// How often it is asked again, in seconds.
    #[arg(long = "health-interval")]
    health_interval_seconds: Option<u32>,

    /// How long no answer is believed. A server can open its port before
    /// it has a database connection, and pass its check broken.
    #[arg(long = "health-grace")]
    health_grace_seconds: Option<u32>,

    /// Exactly this status. Unset accepts anything under 500, including a
    /// 404 on the health path itself.
    #[arg(long = "health-status")]
    health_expected_status: Option<u32>,

    /// `always`, `on-failure` or `no`.
    #[arg(long = "restart")]
    restart_policy: Option<String>,

    /// How many times the platform tries to bring it back after a crash,
    /// each attempt further apart than the last. Ten by default.
    #[arg(long = "restart-retries")]
    restart_max_retries: Option<u32>,

    /// Sleep when no traffic arrives, and wake on the next request.
    #[arg(long)]
    sleep: Option<bool>,

    /// How many minutes without a request before it sleeps. Eight hours
    /// (480) unless set; the next request pays the wake. Changing it does
    /// not restart the container.
    #[arg(long = "sleep-after")]
    sleep_after_minutes: Option<u32>,

    /// Deploy on its own when the branch moves.
    #[arg(long = "auto-deploy")]
    auto_deploy: Option<bool>,

    /// For a registry image or a catalogue component: deploy on its own
    /// when a newer image appears behind its tag (checked every six hours).
    #[arg(long = "auto-update")]
    image_auto_update: Option<bool>,

    /// Let the gateway hold this service's answers.
    #[arg(long = "cache")]
    cache_enabled: Option<bool>,

    /// How long a cached answer stays fresh, in seconds.
    #[arg(long = "cache-ttl")]
    cache_ttl_seconds: Option<u32>,
}

#[derive(Args)]
struct NewArgs {
    project: String,
    name: String,

    /// A GitHub repository, as `owner/name`.
    #[arg(long)]
    repo: Option<String>,

    /// A container image.
    #[arg(long)]
    image: Option<String>,

    /// A component from the catalogue: a database, a bucket or Claude Code.
    /// `fundaia templates` lists the ones this account may add.
    #[arg(long)]
    template: Option<String>,

    /// Build from code you upload, with no repository anywhere.
    ///
    /// The service is created empty and waits: `fundaia up` from the
    /// project's directory sends the code and deploys it.
    #[arg(long)]
    upload: bool,

    #[arg(long, default_value = "main")]
    branch: String,

    /// Services it should be able to talk to, by name.
    #[arg(long = "connect-to", value_delimiter = ',')]
    connect_to: Vec<String>,

    /// Create it without starting it.
    ///
    /// Creating a service deploys it — that is what adding one asks for.
    /// This is for the service that cannot start until somebody types a
    /// variable it has no way to guess, where deploying on sight buys a
    /// failed build instead of an empty node.
    #[arg(long = "no-deploy")]
    no_deploy: bool,

    /// For `--template claude-code`: the token `claude setup-token` prints.
    ///
    /// The component spends the subscription behind it, and cannot be
    /// created without one. Left out, it is asked for at the keyboard
    /// (with the echo off; a pipe or --json gets an error naming this
    /// flag) — except by whoever administers the instance, whose
    /// components run on the server's own token and who is never asked.
    /// `fundaia agent` changes it later.
    #[arg(long = "setup-token")]
    setup_token: Option<String>,

    /// For `--template claude-code`: which model. `fundaia templates`
    /// lists them; default claude-sonnet-5.
    #[arg(long)]
    model: Option<String>,

    /// For `--template claude-code`: how hard it thinks — low, medium,
    /// high, xhigh or max. Default high.
    #[arg(long)]
    effort: Option<String>,
}

#[derive(Args)]
struct LogsArgs {
    project: String,
    service: String,

    /// Follow the live output.
    #[arg(long, short)]
    follow: bool,

    #[arg(long, short = 'n', default_value_t = 200)]
    tail: usize,

    /// Only one stream: build, deploy, runtime or system.
    #[arg(long)]
    stream: Option<String>,

    /// Only one step of the deployment: queue, checkout, build, start,
    /// health or live — the same six the pipeline draws.
    #[arg(long)]
    step: Option<String>,

    /// Which deployment, by the number `history` shows. The newest by default.
    #[arg(long)]
    deployment: Option<u32>,

    /// Prefix each line with the time the platform recorded it.
    #[arg(long, short = 't')]
    timestamps: bool,

    /// Only one request, by its trace id. The lines print theirs in the
    /// gutter, so this is what you paste after reading one.
    #[arg(long)]
    trace: Option<String>,
}

#[derive(Args)]
struct GrepArgs {
    project: String,

    /// What the line contains, 2 to 200 characters. Case-insensitive.
    text: String,

    /// Only one service.
    #[arg(long)]
    service: Option<String>,

    #[arg(long, value_parser = ["debug", "info", "warn", "error"])]
    level: Option<String>,

    #[arg(long, value_parser = ["build", "deploy", "runtime", "system"])]
    stream: Option<String>,

    /// How far back, 24 by default and 168 at most.
    #[arg(long)]
    hours: Option<u32>,

    /// How many lines, 100 by default and 500 at most.
    #[arg(long, short = 'n')]
    limit: Option<u32>,
}

#[derive(Args)]
struct AutofixArgs {
    project: String,
    service: String,

    /// `off`, `diagnose` or `pullRequest`.
    #[arg(long, value_parser = ["off", "diagnose", "pullRequest"])]
    mode: Option<String>,

    /// The Claude Code component that does the work, by id.
    #[arg(long)]
    agent: Option<String>,

    /// Which model it runs on.
    #[arg(long)]
    model: Option<String>,

    /// How many times a failure has to happen before it is worth an agent.
    #[arg(long)]
    min_occurrences: Option<u32>,

    /// Runs per day, per service.
    #[arg(long)]
    daily_limit: Option<u32>,
}

#[derive(Subcommand)]
enum TasksCommand {
    /// Every task of a service: when it runs, when it goes next, how it last went.
    List { project: String, service: String },

    /// Schedule a command: `fundaia tasks add tienda api limpiar "0 3 * * *" -- node cleanup.js`.
    ///
    /// Five-field cron in UTC. It runs with `sh -c` in the running container,
    /// fifteen minutes at most; a sleeping service is woken for it.
    Add {
        project: String,
        service: String,
        name: String,
        schedule: String,

        /// What to run, after `--`.
        #[arg(last = true, required = true)]
        command: Vec<String>,

        /// Create it paused: nothing runs until `tasks edit --resume`.
        #[arg(long)]
        paused: bool,
    },

    /// Change its name, schedule or command, or pause and resume it.
    Edit {
        project: String,
        service: String,
        task: String,

        #[arg(long)]
        name: Option<String>,

        #[arg(long)]
        schedule: Option<String>,

        /// A new command, after `--`.
        #[arg(last = true)]
        command: Vec<String>,

        #[arg(long, conflicts_with = "resume")]
        pause: bool,

        #[arg(long)]
        resume: bool,
    },

    /// Remove it and the record of its runs.
    Rm {
        project: String,
        service: String,
        task: String,
    },

    /// Run it now and follow it to the end, printing its output.
    Run {
        project: String,
        service: String,
        task: String,

        /// Answer as soon as it starts.
        #[arg(long)]
        no_wait: bool,
    },

    /// Its last twenty runs, and the output of the newest.
    Runs {
        project: String,
        service: String,
        task: String,
    },
}

#[derive(Subcommand)]
enum FilesCommand {
    /// List a directory, directories first. The first volume's root by default.
    Ls {
        project: String,
        service: String,
        path: Option<String>,
    },

    /// Print a text file: its first 256 KB, with the service's secrets masked.
    Cat {
        project: String,
        service: String,
        path: String,
    },

    /// Download a file as it is, up to 20 MB.
    Get {
        project: String,
        service: String,
        path: String,

        /// Where to write it. The file's own name, here, unless said.
        #[arg(long, short)]
        output: Option<String>,
    },
}

#[derive(Subcommand)]
enum SharedCommand {
    /// Every environment's, and `--env`'s own.
    List { project: String },

    /// Share one. Every environment gets it unless `--env-only`.
    Set {
        project: String,
        key: String,
        value: String,

        /// Store it encrypted, and never show it again.
        #[arg(long)]
        secret: bool,

        /// Only `--env`'s environment (or the default one) gets it.
        #[arg(long = "env-only")]
        env_only: bool,
    },

    /// Stop sharing one.
    Unset {
        project: String,
        key: String,

        /// Remove the environment's own, not every environment's.
        #[arg(long = "env-only")]
        env_only: bool,
    },
}

#[derive(Subcommand)]
enum AccessCommand {
    /// Whether the repository can be read, and who is being asked.
    Status { project: String, service: String },

    /// Email the owner a link that grants read access.
    Request {
        project: String,
        service: String,

        /// The owner's address. Omit to reuse one this space has already used.
        ///
        /// GitHub publishes an address for almost no account, so this is usually
        /// the one thing that has to be typed: the platform can find out whose
        /// repository it is and never how to reach them.
        #[arg(long)]
        email: Option<String>,
    },
}

#[derive(Subcommand)]
enum BackupCommand {
    /// List them, with the schedule and when the next one lands.
    List { project: String, service: String },

    /// Take one now. Waits for it.
    New { project: String, service: String },

    /// Which schedules run: daily, weekly, monthly. With none, it stops copying.
    Schedule {
        project: String,
        service: String,

        /// Any of `daily`, `weekly`, `monthly`, comma separated.
        #[arg(value_delimiter = ',')]
        schedules: Vec<String>,
    },

    /// Put one back. Overwrites the volume; the server copies it first.
    Restore {
        /// The id `backups list` shows.
        backup_id: String,

        /// The id again. This overwrites data.
        #[arg(long)]
        confirm: Option<String>,
    },

    /// Keep one past its retention.
    Keep { backup_id: String },

    /// Let retention have it again.
    Unkeep { backup_id: String },

    /// Delete one now.
    Remove { backup_id: String },
}

/// What can be done to a session other than look at it.
#[derive(Subcommand)]
enum SessionCommand {
    /// Sign one out, by the id `fundaia sessions` printed.
    ///
    /// The id is the session token's digest rather than the token: holding it
    /// opens nothing, which is what makes it safe to print in a table.
    Revoke { session_id: String },
}

#[derive(Subcommand)]
enum DomainCommand {
    List {
        project: String,
        service: String,
    },

    /// Add one. With no host, generates one under the platform's domain.
    Add {
        project: String,
        service: String,
        host: Option<String>,
    },

    /// Check a custom domain now: its DNS record and its certificate.
    Verify {
        domain_id: String,
    },

    Remove {
        domain_id: String,
    },
}

fn main() {
    let cli = Cli::parse();
    let format = output::chosen(cli.json);

    // JSON is for a parser, and a parser has no use for colour — an escape
    // inside a value it did not expect is exactly the kind of bug `--json`
    // exists to prevent.
    if cli.no_color || format.is_json() {
        // Both, and they are not the same switch: the override governs
        // `if_supports_color`, which is what the progress bars ask, and
        // `theme::silence` governs the styles every screen applies directly.
        owo_colors::set_override(false);
        theme::silence();
    }

    // What is running, noted before the command rather than when an upgrade
    // installs one: a binary arrives three ways — `cargo install`, `install.sh`
    // and the self-update — and only the third passes through the installer.
    // Skipped for `completions` for the reason the update check is.
    if !matches!(cli.command, Command::Completions { .. }) {
        changelog::history::record(env!("CARGO_PKG_VERSION"));
    }

    // The three commands that reach nothing are also the three that need no
    // runtime: `--help`, `--version` and a parse error have already exited
    // above, so none of them pays for worker threads it never uses. The runtime
    // lives until `main` returns, as `#[tokio::main]`'s did.
    let runtime;
    let outcome = if asks_the_registry(&cli.command) {
        runtime = tokio::runtime::Builder::new_multi_thread()
            .enable_all()
            .build()
            .expect("the async runtime starts");

        runtime.block_on(async {
            // Started before the command and collected after it, so asking
            // crates.io overlaps the work rather than being added to it.
            let update = update::UpdateCheck::start(env!("CARGO_PKG_VERSION"), format.is_json());
            let outcome = run(cli, format).await;
            update.finish().await;
            outcome
        })
    } else {
        run_offline(&cli.command, format)
    };

    if let Err(error) = outcome {
        // The class decides the exit code, so `$?` says what kind of failure it
        // was before anything has been read. See `exit.rs`: the numbers are a
        // contract and never move.
        let status = exit::classify(&error);

        if format.is_json() {
            // The same failure as one object on stderr, so an agent branches
            // on `error.code` instead of parsing a sentence meant for a person.
            output::emit_error(&error, exit::hint(status));
            std::process::exit(status.code());
        }

        // One line, on stderr, so a failure never lands in a pipe as data.
        eprintln!();
        eprintln!("  {} {error}", theme::CROSS.style(theme::danger()));

        // The chain is where the useful part usually is: "could not reach X"
        // over "connection refused" says both what was attempted and why not.
        for cause in error.chain().skip(1) {
            eprintln!("    {}", cause.style(theme::muted()));
        }

        if let Some(hint) = exit::hint(status) {
            eprintln!("    {}", hint.style(theme::muted()));
        }

        eprintln!();
        std::process::exit(status.code());
    }
}

/// Whether this invocation should spend a round trip on crates.io.
///
/// Three commands should not. `completions` runs from shell start-up files, and
/// a network check — let alone an install — behind every new terminal stopped
/// being a courtesy. `schema` and `guide` are the two an agent runs *first*,
/// before it has a profile or a token, and both promise to answer with no
/// instance and no network; the check is started before the command and
/// collected after it, so a promise that did not cover the machinery would be a
/// promise the invocation still waited on.
///
/// A function rather than a `match` inside `main` so the list can be asserted:
/// what is worth pinning is which commands reach nothing, and a test that had
/// to time a subprocess would be measuring the network instead.
fn asks_the_registry(command: &Command) -> bool {
    !matches!(
        command,
        Command::Completions { .. } | Command::Schema | Command::Guide | Command::Skill { .. }
    )
}

/// The parser, built.
///
/// `Cli::command()` and nothing more would leave the propagated arguments off
/// the subcommands, which matters here because three things read this: the
/// completion scripts, `fundaia schema`, and the tests that check every command
/// is annotated. One definition, so none of the three can describe a different
/// tool from the other two.
fn built() -> clap::Command {
    let mut command = Cli::command();
    command.build();
    command
}

/// The commands that read the parser or a file inside the binary, and nothing else.
fn run_offline(command: &Command, format: Format) -> Result<()> {
    match command {
        Command::Completions { shell } => {
            clap_complete::generate(*shell, &mut built(), "fundaia", &mut std::io::stdout());
            Ok(())
        }
        Command::Schema => commands::schema::run(&built(), format),
        Command::Guide => commands::guide::run(format),
        Command::Skill { command } => match command {
            None | Some(SkillCommand::Show) => commands::skill::show(&built(), format),
            Some(SkillCommand::Install { project }) => {
                commands::skill::install(&built(), *project, format)
            }
            Some(SkillCommand::Path { project }) => commands::skill::print_path(*project, format),
        },
        _ => unreachable!("only the commands that reach nothing are answered offline"),
    }
}

async fn run(cli: Cli, format: Format) -> Result<()> {
    match &cli.command {
        Command::Login {
            url,
            as_profile,
            no_browser,
        } => return commands::login::run(url, as_profile, !no_browser).await,
        Command::Logout { profile } => return commands::login::logout(profile.as_deref()),
        // Nothing here needs an instance, a profile or a token: the registry
        // and the release are the only two things it talks to.
        Command::Upgrade { check } => {
            return update::upgrade(env!("CARGO_PKG_VERSION"), *check).await
        }
        // The changelog is compiled into this binary and the history is a file
        // beside the profiles, so neither of them has an instance to reach.
        Command::Changelog {
            release,
            all,
            since,
            count,
            history,
        } => {
            return if *history {
                commands::changelog::show_history(format)
            } else {
                commands::changelog::show(
                    &commands::changelog::Query {
                        all: *all,
                        version: release.clone(),
                        since: since.clone(),
                        count: *count,
                    },
                    format,
                )
            }
        }
        Command::Completions { .. } | Command::Schema | Command::Guide | Command::Skill { .. } => {
            return run_offline(&cli.command, format)
        }
        _ => {}
    }

    // The environment travels with the client, so every lookup and project read is about that one.
    let client = connect(&cli)?.with_environment(cli.environment.as_deref());

    match cli.command {
        Command::Login { .. }
        | Command::Logout { .. }
        | Command::Upgrade { .. }
        | Command::Changelog { .. }
        | Command::Completions { .. }
        | Command::Schema
        | Command::Guide
        | Command::Skill { .. } => {
            unreachable!("handled above")
        }

        Command::Whoami => commands::login::whoami(&client, format).await,

        Command::Status => commands::read::status(&client, format).await,
        Command::Projects => commands::read::projects(&client, format).await,

        Command::Project { command } => match command {
            ProjectCommand::New {
                name,
                description,
                workspace,
            } => {
                commands::write::create_project(
                    &client,
                    &name,
                    description.as_deref(),
                    workspace.as_deref(),
                )
                .await
            }
            ProjectCommand::Rename {
                project,
                name,
                description,
            } => {
                commands::manage::rename_project(
                    &client,
                    &project,
                    name.as_deref(),
                    description.as_deref(),
                )
                .await
            }
            ProjectCommand::Delete { project, confirm } => {
                commands::manage::delete_project(&client, &project, confirm.as_deref()).await
            }
            ProjectCommand::Move { project, workspace } => {
                commands::manage::move_project(&client, &project, &workspace).await
            }
            ProjectCommand::Star { project } => {
                commands::manage::favorite_project(&client, &project, true, format).await
            }
            ProjectCommand::Unstar { project } => {
                commands::manage::favorite_project(&client, &project, false, format).await
            }
        },
        Command::Envs { project } => commands::environments::list(&client, &project, format).await,
        Command::Webhooks { project } => commands::webhooks::list(&client, &project, format).await,
        Command::Webhook { command } => match command {
            WebhookCommand::Add {
                project,
                url,
                name,
                format: webhook_format,
                events,
            } => {
                commands::webhooks::add(
                    &client,
                    commands::webhooks::AddRequest {
                        project: &project,
                        url: &url,
                        name: name.as_deref(),
                        format: webhook_format.as_deref(),
                        events: &events,
                    },
                    format,
                )
                .await
            }
            WebhookCommand::Set {
                project,
                webhook,
                name,
                events,
                pause,
                resume,
            } => {
                commands::webhooks::set(
                    &client,
                    commands::webhooks::SetRequest {
                        project: &project,
                        webhook: &webhook,
                        name: name.as_deref(),
                        events: events.as_deref(),
                        enabled: if pause {
                            Some(false)
                        } else if resume {
                            Some(true)
                        } else {
                            None
                        },
                    },
                    format,
                )
                .await
            }
            WebhookCommand::Rm { project, webhook } => {
                commands::webhooks::remove(&client, &project, &webhook, format).await
            }
            WebhookCommand::Test { project, webhook } => {
                commands::webhooks::test(&client, &project, &webhook, format).await
            }
        },
        Command::Env { command } => match command {
            EnvCommand::New {
                project,
                name,
                from,
                empty,
                no_deploy,
            } => {
                commands::environments::create(
                    &client,
                    commands::environments::EnvironmentRequest {
                        project: &project,
                        name: &name,
                        from: from.as_deref(),
                        empty,
                        no_deploy,
                    },
                    format,
                )
                .await
            }
            EnvCommand::Rename {
                project,
                environment,
                name,
            } => {
                commands::environments::rename(&client, &project, &environment, &name, format).await
            }
            EnvCommand::Rm {
                project,
                environment,
                confirm,
            } => {
                commands::environments::remove(
                    &client,
                    &project,
                    &environment,
                    confirm.as_deref(),
                    format,
                )
                .await
            }
            EnvCommand::Copy {
                project,
                service,
                from,
                to,
                no_deploy,
            } => {
                commands::environments::copy(
                    &client,
                    commands::environments::CopyRequest {
                        project: &project,
                        service: &service,
                        from: from.as_deref(),
                        to: &to,
                        no_deploy,
                    },
                    format,
                )
                .await
            }
        },
        Command::Services { project } => commands::read::services(&client, &project, format).await,
        Command::Service { project, service } => {
            commands::read::service(&client, &project, &service, format).await
        }
        Command::Canvas { command } => match command {
            CanvasCommand::Show { project, map } => {
                commands::read::canvas(&client, &project, map, format).await
            }
            CanvasCommand::Move {
                project,
                service,
                x,
                y,
            } => commands::write::move_on_canvas(&client, &project, &service, x, y, format).await,
            CanvasCommand::Arrange { project, layout } => {
                commands::write::arrange_canvas(&client, &project, &layout, format).await
            }
        },

        Command::Templates => commands::write::templates(&client, format).await,

        Command::New(NewArgs {
            project,
            name,
            repo,
            image,
            template,
            upload,
            branch,
            connect_to,
            no_deploy,
            setup_token,
            model,
            effort,
        }) => {
            commands::write::create_service(
                &client,
                commands::write::ServiceRequest {
                    project: &project,
                    name: &name,
                    repo: repo.as_deref(),
                    image: image.as_deref(),
                    template: template.as_deref(),
                    upload,
                    branch: &branch,
                    connect_to: &connect_to,
                    no_deploy,
                    setup_token: setup_token.as_deref(),
                    model: model.as_deref(),
                    effort: effort.as_deref(),
                },
                format,
            )
            .await
        }

        Command::Agent {
            project,
            service,
            model,
            effort,
            setup_token,
        } => {
            commands::write::agent(
                &client,
                &project,
                &service,
                api::models::AgentSetupPatch {
                    model,
                    effort,
                    setup_token,
                },
                format,
            )
            .await
        }

        Command::Rename {
            project,
            service,
            name,
        } => commands::manage::rename_service(&client, &project, &service, &name).await,

        Command::Up {
            project,
            service,
            path,
            no_deploy,
            detach,
        } => {
            commands::upload::run(
                &client,
                &project,
                &service,
                std::path::Path::new(&path),
                !no_deploy,
                !detach,
                format,
            )
            .await
        }

        Command::Uploads { project, service } => {
            commands::upload::list(&client, &project, &service, format).await
        }

        Command::Deploy {
            project,
            service,
            restart,
            detach,
        } => commands::deploy::run(&client, &project, &service, restart, !detach, format).await,

        Command::Redeploy {
            project,
            service,
            number,
        } => commands::deploy::redeploy(&client, &project, &service, number, format).await,

        Command::Rollback {
            project,
            service,
            number,
        } => commands::deploy::rollback(&client, &project, &service, number, format).await,

        Command::Cancel {
            project,
            service,
            deployment,
        } => commands::deploy::cancel(&client, &project, &service, deployment, format).await,

        Command::Stop { project, service } => {
            commands::write::stop(&client, &project, &service).await
        }

        Command::History {
            project,
            service,
            limit,
            commit,
        } => {
            commands::read::history(
                &client,
                &project,
                &service,
                limit,
                commit.as_deref(),
                format,
            )
            .await
        }

        Command::Commit {
            project,
            service,
            commit,
            file,
            stat,
        } => commands::read::commit(&client, &project, &service, commit, file, stat, format).await,

        Command::Watch { project, service } => {
            commands::watch::run(&client, project.as_deref(), service.as_deref(), format).await
        }

        Command::Logs(LogsArgs {
            project,
            service,
            follow,
            tail,
            stream,
            step,
            deployment,
            timestamps,
            trace,
        }) => {
            commands::logs::run(
                &client,
                &project,
                &service,
                commands::logs::LogQuery {
                    follow,
                    tail,
                    stream_filter: stream.as_deref(),
                    stage: step.as_deref(),
                    number: deployment,
                    timestamps,
                    trace: trace.as_deref(),
                },
                format,
            )
            .await
        }

        Command::Incidents {
            project,
            service,
            decided,
        } => commands::read::incidents(&client, &project, &service, decided, format).await,

        Command::Workflows { command } => match command {
            WorkflowCommand::List { project, refresh } => {
                commands::workflows::list(&client, &project, refresh, format).await
            }
            WorkflowCommand::Runs {
                project,
                path,
                commit,
                limit,
            } => {
                commands::workflows::runs(
                    &client,
                    &project,
                    path.as_deref(),
                    commit.as_deref(),
                    limit,
                    format,
                )
                .await
            }
            WorkflowCommand::Run {
                project,
                path,
                branch,
                inputs,
            } => {
                commands::workflows::run(
                    &client,
                    &project,
                    &path,
                    branch.as_deref(),
                    &inputs,
                    format,
                )
                .await
            }
            WorkflowCommand::Show { run_id } => {
                commands::workflows::show(&client, &run_id, format).await
            }
            WorkflowCommand::Logs { job_id } => {
                commands::workflows::logs(&client, &job_id, format).await
            }
            WorkflowCommand::Cancel { run_id } => {
                commands::workflows::cancel(&client, &run_id, format).await
            }
            WorkflowCommand::Rerun { run_id } => {
                commands::workflows::rerun(&client, &run_id, format).await
            }
            WorkflowCommand::Stats { project, limit } => {
                commands::workflows::stats(&client, &project, limit, format).await
            }
            WorkflowCommand::Wait { run_id, timeout } => {
                commands::workflows::wait(&client, &run_id, timeout, format).await
            }
            WorkflowCommand::Artifact { job_id, into } => {
                commands::workflows::artifact(&client, &job_id, into.as_deref(), format).await
            }
        },

        Command::Approvals { project, service } => {
            commands::read::approvals(&client, &project, service.as_deref(), format).await
        }

        Command::Approve { id } => commands::write::approve_deployment(&client, &id, format).await,

        Command::Reject { id } => commands::write::reject_deployment(&client, &id, format).await,

        Command::Autofix(AutofixArgs {
            project,
            service,
            mode,
            agent,
            model,
            min_occurrences,
            daily_limit,
        }) => {
            commands::read::autofix(
                &client,
                &project,
                &service,
                api::models::AutofixPatch {
                    mode,
                    agent_service_environment_id: agent,
                    model,
                    minimum_occurrences: min_occurrences,
                    daily_limit,
                },
                format,
            )
            .await
        }

        Command::Fix { id, command } => match (command, id) {
            (
                Some(FixCommand::Deployment {
                    project,
                    service,
                    number,
                }),
                _,
            ) => {
                commands::repair::fix_deployment(&client, &project, &service, number, format).await
            }
            (None, Some(id)) => commands::write::fix_incident(&client, &id, format).await,
            (None, None) => unreachable!("clap requires the id when there is no subcommand"),
        },

        Command::Attention => commands::insights::attention(&client, format).await,
        Command::Health { project } => commands::insights::health(&client, &project, format).await,
        Command::Diagnose { project, service } => {
            commands::insights::diagnose(&client, &project, &service, format).await
        }
        Command::Grep(GrepArgs {
            project,
            text,
            service,
            level,
            stream,
            hours,
            limit,
        }) => {
            commands::insights::grep(
                &client,
                &project,
                commands::insights::GrepQuery {
                    text: &text,
                    service: service.as_deref(),
                    level: level.as_deref(),
                    stream: stream.as_deref(),
                    hours,
                    limit,
                },
                format,
            )
            .await
        }
        Command::Deps { project, service } => {
            commands::insights::dependencies(&client, &project, &service, format).await
        }
        Command::Import {
            file,
            name,
            workspace,
            deploy,
        } => {
            commands::insights::import(
                &client,
                &file,
                name.as_deref(),
                workspace.as_deref(),
                deploy,
                format,
            )
            .await
        }
        Command::Export { project, file } => {
            commands::insights::export(&client, &project, file.as_deref(), format).await
        }
        Command::Compare {
            project,
            service,
            from,
            to,
        } => commands::insights::compare(&client, &project, &service, from, to, format).await,
        Command::Probe {
            project,
            service,
            path,
        } => commands::insights::probe(&client, &project, &service, &path, format).await,
        Command::Wake { project, service } => {
            commands::insights::wake(&client, &project, &service, format).await
        }
        Command::Security { command } => match command {
            SecurityCommand::Scan {
                project,
                service,
                fix,
                wait,
            } => commands::repair::scan(&client, &project, &service, fix, wait, format).await,
            SecurityCommand::Show { scan_id } => {
                commands::repair::show(&client, &scan_id, format).await
            }
            SecurityCommand::List { project, service } => {
                commands::repair::list(&client, &project, &service, format).await
            }
        },
        Command::Issue { kind, id } => commands::repair::issue(&client, &kind, &id, format).await,

        Command::Incident { id, status } => {
            commands::write::decide_incident(&client, &id, &status, format).await
        }

        Command::SignIns { limit } => commands::read::sign_ins(&client, limit, format).await,

        Command::Sessions { command } => match command {
            None => commands::read::auth_sessions(&client, format).await,
            Some(SessionCommand::Revoke { session_id }) => {
                commands::login::revoke_session(&client, &session_id).await
            }
        },

        Command::Activity { project, limit } => {
            commands::read::activity(&client, &project, limit, format).await
        }

        Command::Metrics {
            project,
            service,
            minutes,
        } => commands::read::metrics(&client, &project, &service, minutes, format).await,

        Command::Consumption {
            project,
            service,
            range,
        } => commands::read::consumption(&client, &project, &service, &range, format).await,

        Command::AgentActivity {
            project,
            service,
            range,
            outcome,
        } => {
            commands::read::agent_activity(
                &client,
                &project,
                &service,
                &range,
                outcome.as_deref(),
                format,
            )
            .await
        }

        Command::Data { command } => match command {
            DataCommand::Tables { project, service } => {
                commands::data::tables(&client, &project, &service, format).await
            }
            DataCommand::Query {
                project,
                service,
                sql,
                limit,
            } => commands::data::query(&client, &project, &service, &sql, limit, format).await,
            DataCommand::Run {
                project,
                service,
                sql,
                preview,
                confirm,
            } => {
                commands::data::run(
                    &client,
                    &project,
                    &service,
                    &sql,
                    preview,
                    confirm.as_deref(),
                    format,
                )
                .await
            }
        },

        Command::Shared { command } => match command {
            SharedCommand::List { project } => {
                commands::shared::list(&client, &project, format).await
            }
            SharedCommand::Set {
                project,
                key,
                value,
                secret,
                env_only,
            } => {
                commands::shared::set(
                    &client,
                    commands::shared::SetRequest {
                        project: &project,
                        key: &key,
                        value: &value,
                        secret,
                        environment_only: env_only,
                    },
                    format,
                )
                .await
            }
            SharedCommand::Unset {
                project,
                key,
                env_only,
            } => commands::shared::unset(&client, &project, &key, env_only, format).await,
        },
        Command::Variables { command } => match command {
            VariableCommand::List {
                project,
                service,
                reveal,
            } => commands::read::variables(&client, &project, &service, reveal, format).await,
            VariableCommand::Set {
                project,
                service,
                key,
                value,
                secret,
                sealed,
            } => {
                commands::write::set_variable(
                    &client, &project, &service, &key, &value, secret, sealed,
                )
                .await
            }
            VariableCommand::Seal {
                project,
                service,
                key,
                confirm,
            } => {
                commands::write::seal_variable(
                    &client,
                    &project,
                    &service,
                    &key,
                    confirm.as_deref(),
                )
                .await
            }
            VariableCommand::Unset {
                project,
                service,
                key,
            } => commands::write::unset_variable(&client, &project, &service, &key).await,
            VariableCommand::Audit { project } => {
                commands::insights::audit_variables(&client, &project, format).await
            }
            VariableCommand::Import {
                project,
                service,
                file,
                secret,
            } => {
                commands::write::import_variables(&client, &project, &service, &file, secret).await
            }
        },

        Command::Access { command } => match command {
            AccessCommand::Status { project, service } => {
                commands::read::repository_access(&client, &project, &service, format).await
            }
            AccessCommand::Request {
                project,
                service,
                email,
            } => {
                commands::write::request_repository_access(
                    &client,
                    &project,
                    &service,
                    email.as_deref(),
                    format,
                )
                .await
            }
        },

        Command::Backups { command } => match command {
            BackupCommand::List { project, service } => {
                commands::read::backups(&client, &project, &service, format).await
            }
            BackupCommand::New { project, service } => {
                commands::write::take_backup(&client, &project, &service).await
            }
            BackupCommand::Schedule {
                project,
                service,
                schedules,
            } => commands::write::schedule_backups(&client, &project, &service, &schedules).await,
            BackupCommand::Restore { backup_id, confirm } => {
                commands::write::restore_backup(&client, &backup_id, confirm.as_deref()).await
            }
            BackupCommand::Keep { backup_id } => {
                commands::write::lock_backup(&client, &backup_id, true).await
            }
            BackupCommand::Unkeep { backup_id } => {
                commands::write::lock_backup(&client, &backup_id, false).await
            }
            BackupCommand::Remove { backup_id } => {
                commands::write::delete_backup(&client, &backup_id).await
            }
        },

        Command::Domains { command } => match command {
            DomainCommand::List { project, service } => {
                commands::read::domains(&client, &project, &service, format).await
            }
            DomainCommand::Add {
                project,
                service,
                host,
            } => commands::write::add_domain(&client, &project, &service, host.as_deref()).await,
            DomainCommand::Verify { domain_id } => {
                commands::read::verify_domain(&client, &domain_id, format).await
            }
            DomainCommand::Remove { domain_id } => {
                commands::write::remove_domain(&client, &domain_id).await
            }
        },

        Command::Connect {
            project,
            service,
            provider,
        } => commands::write::connect(&client, &project, &service, &provider).await,

        Command::Disconnect {
            project,
            service,
            provider,
        } => commands::manage::disconnect(&client, &project, &service, &provider).await,

        Command::Connectable { project, service } => {
            commands::write::candidates(&client, &project, &service, format).await
        }

        Command::Volumes { command } => match command {
            VolumeCommand::List { project, service } => {
                commands::read::volumes(&client, &project, &service, format).await
            }
            VolumeCommand::Add {
                project,
                service,
                mount_path,
            } => commands::write::attach_volume(&client, &project, &service, &mount_path).await,
            VolumeCommand::Resize { volume_id, gb } => {
                commands::write::resize_volume(&client, &volume_id, gb).await
            }
            VolumeCommand::Remove { volume_id } => {
                commands::manage::detach_volume(&client, &volume_id).await
            }
        },

        Command::Recipe { command } => match command {
            RecipeCommand::Show {
                project,
                service,
                plain,
            } => commands::read::recipe(&client, &project, &service, plain, format).await,
            RecipeCommand::Edit {
                project,
                service,
                file,
            } => commands::write::edit_recipe(&client, &project, &service, &file).await,
        },

        Command::Config { command } => match command {
            ConfigCommand::Show {
                project,
                service,
                plain,
            } => commands::read::service_config(&client, &project, &service, plain, format).await,
            ConfigCommand::Edit {
                project,
                service,
                file,
            } => commands::write::edit_service_config(&client, &project, &service, &file).await,
        },

        Command::Capabilities { project, service } => {
            commands::read::capabilities(&client, &project, &service, format).await
        }

        Command::Capacity => commands::manage::capacity(&client, format).await,

        Command::Settings(SettingsArgs {
            project,
            service,
            repo,
            branch,
            memory,
            replicas,
            root,
            start_command,
            deploy_tags,
            pre_deploy,
            health_path,
            health_probe,
            health_timeout_seconds,
            health_interval_seconds,
            health_grace_seconds,
            health_expected_status,
            restart_policy,
            restart_max_retries,
            sleep,
            sleep_after_minutes,
            auto_deploy,
            image_auto_update,
            cache_enabled,
            cache_ttl_seconds,
        }) => {
            commands::manage::set_settings(
                &client,
                &project,
                &service,
                api::models::SettingsPatch {
                    repo_full_name: repo,
                    branch,
                    memory_mb: memory,
                    replicas,
                    root_directory: root,
                    start_command,
                    pre_deploy_command: pre_deploy,
                    deploy_tag_pattern: deploy_tags,
                    health_path,
                    health_probe,
                    health_timeout_seconds,
                    health_interval_seconds,
                    health_grace_seconds,
                    health_expected_status,
                    restart_policy,
                    restart_max_retries,
                    sleep_enabled: sleep,
                    sleep_after_minutes,
                    auto_deploy,
                    image_auto_update,
                    cache_enabled,
                    cache_ttl_seconds,
                },
            )
            .await
        }

        Command::Expose {
            project,
            service,
            off,
        } => commands::manage::expose(&client, &project, &service, !off).await,

        Command::Previews { project, switch } => {
            commands::previews::run(
                &client,
                &project,
                switch.as_deref().map(|word| word == "on"),
                format,
            )
            .await
        }

        Command::Pull { project, service } => {
            commands::console::pull(&client, &project, &service, format).await
        }

        Command::Tasks { command } => match command {
            TasksCommand::List { project, service } => {
                commands::tasks::list(&client, &project, &service, format).await
            }
            TasksCommand::Add {
                project,
                service,
                name,
                schedule,
                command,
                paused,
            } => {
                commands::tasks::add(
                    &client,
                    commands::tasks::AddRequest {
                        project: &project,
                        service: &service,
                        name: &name,
                        schedule: &schedule,
                        command: &command,
                        paused,
                    },
                    format,
                )
                .await
            }
            TasksCommand::Edit {
                project,
                service,
                task,
                name,
                schedule,
                command,
                pause,
                resume,
            } => {
                commands::tasks::edit(
                    &client,
                    commands::tasks::EditRequest {
                        project: &project,
                        service: &service,
                        task: &task,
                        name: name.as_deref(),
                        schedule: schedule.as_deref(),
                        command: &command,
                        enabled: if pause {
                            Some(false)
                        } else if resume {
                            Some(true)
                        } else {
                            None
                        },
                    },
                    format,
                )
                .await
            }
            TasksCommand::Rm {
                project,
                service,
                task,
            } => commands::tasks::remove(&client, &project, &service, &task, format).await,
            TasksCommand::Run {
                project,
                service,
                task,
                no_wait,
            } => commands::tasks::run(&client, &project, &service, &task, !no_wait, format).await,
            TasksCommand::Runs {
                project,
                service,
                task,
            } => commands::tasks::runs(&client, &project, &service, &task, format).await,
        },

        Command::Files { command } => match command {
            FilesCommand::Ls {
                project,
                service,
                path,
            } => commands::files::list(&client, &project, &service, path.as_deref(), format).await,
            FilesCommand::Cat {
                project,
                service,
                path,
            } => commands::files::cat(&client, &project, &service, &path, format).await,
            FilesCommand::Get {
                project,
                service,
                path,
                output,
            } => {
                commands::files::get(
                    &client,
                    &project,
                    &service,
                    &path,
                    output.as_deref(),
                    format,
                )
                .await
            }
        },

        Command::Exec {
            project,
            service,
            command,
        } => commands::console::exec(&client, &project, &service, &command, format).await,

        Command::Maintenance {
            project,
            service,
            off,
            message,
        } => {
            commands::edge::maintenance(
                &client,
                &project,
                &service,
                !off,
                message.as_deref(),
                format,
            )
            .await
        }

        Command::Protect {
            project,
            service,
            user,
            password,
        } => {
            commands::edge::protect(
                &client,
                &project,
                &service,
                &user,
                password.as_deref(),
                format,
            )
            .await
        }

        Command::Unprotect { project, service } => {
            commands::edge::unprotect(&client, &project, &service, format).await
        }

        Command::Encrypt {
            project,
            service,
            off,
        } => commands::manage::encryption(&client, &project, &service, !off).await,

        Command::Delete {
            project,
            service,
            confirm,
        } => commands::manage::delete(&client, &project, &service, confirm.as_deref()).await,

        Command::Workspace { command } => match command {
            WorkspaceCommand::List => commands::workspace::list(&client, format).await,
            WorkspaceCommand::SecondFactor { switch, workspace } => {
                commands::workspace::require_second_factor(
                    &client,
                    workspace.as_deref(),
                    switch == "on",
                    format,
                )
                .await
            }
            WorkspaceCommand::Members { workspace } => {
                commands::workspace::members(&client, workspace.as_deref(), format).await
            }
            WorkspaceCommand::Credits { workspace } => {
                commands::workspace::credits(&client, workspace.as_deref(), format).await
            }
            WorkspaceCommand::Invite {
                email,
                workspace,
                admin,
            } => commands::workspace::invite(&client, workspace.as_deref(), &email, admin).await,
            WorkspaceCommand::Revoke {
                invitation_id,
                workspace,
            } => commands::workspace::revoke(&client, workspace.as_deref(), &invitation_id).await,
            WorkspaceCommand::Remove { user_id, workspace } => {
                commands::workspace::remove(&client, workspace.as_deref(), &user_id).await
            }
        },
    }
}

/// The client for this invocation.
///
/// Flags beat the environment beats the saved profile, which is the order every
/// tool of this shape uses and the order that makes a one-off `--url` work
/// without disturbing what is saved.
fn connect(cli: &Cli) -> Result<ApiClient> {
    if let (Some(url), Some(token)) = (&cli.url, &cli.token) {
        return ApiClient::new(url, Some(token.clone()));
    }

    let config = Config::load().context("could not read the configuration")?;
    let (name, profile) = config.profile(cli.profile.as_deref())?;
    let url = cli.url.as_deref().unwrap_or(&profile.url);

    /*
     * The saved token goes to the host it was saved for and nowhere else.
     *
     * `--url` is also `FUNDAIA_URL`, and an environment variable is set by a
     * `.envrc`, a Makefile or a CI job as easily as by the person typing — so
     * "override the address but keep the profile's token" was a way to send
     * the token, which is the whole account, to any host that variable named.
     * Another instance is another profile, or a `--token` given alongside.
     */
    if cli.token.is_none() && !config::same_host(url, &profile.url) {
        return Err(exit::Refused::invalid(format!(
            "--url points at {} but the profile \"{name}\" was saved for {}: pass --token (or FUNDAIA_TOKEN) as well, or log in to that instance as its own profile",
            config::host_of(url),
            config::host_of(&profile.url)
        ))
        .into());
    }

    ApiClient::new(
        url,
        Some(cli.token.clone().unwrap_or_else(|| profile.token.clone())),
    )
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn it_should_ask_the_registry_before_a_command_that_talks_to_an_instance() {
        assert!(asks_the_registry(&Command::Status));
    }

    /// From a shell start-up file, so every new terminal would pay for it.
    #[test]
    fn it_should_not_ask_the_registry_to_write_a_completion_script() {
        assert!(!asks_the_registry(&Command::Completions {
            shell: clap_complete::Shell::Bash,
        }));
    }

    /// The command an agent runs before it has signed in. "No network" has to
    /// mean the whole invocation, not just the part that answers.
    #[test]
    fn it_should_not_ask_the_registry_to_describe_itself() {
        assert!(!asks_the_registry(&Command::Schema));
    }

    #[test]
    fn it_should_read_fix_with_one_id_as_an_incident() {
        let cli = Cli::try_parse_from(["fundaia", "fix", "inc_1"]).unwrap();
        assert!(matches!(
            cli.command,
            Command::Fix { id: Some(id), command: None } if id == "inc_1"
        ));
    }

    #[test]
    fn it_should_read_fix_deployment_as_a_deployment() {
        let cli =
            Cli::try_parse_from(["fundaia", "fix", "deployment", "tienda", "api", "42"]).unwrap();
        assert!(matches!(
            cli.command,
            Command::Fix {
                command: Some(FixCommand::Deployment {
                    number: Some(42),
                    ..
                }),
                ..
            }
        ));
    }

    #[test]
    fn it_should_refuse_fix_with_nothing_to_fix() {
        assert!(Cli::try_parse_from(["fundaia", "fix"]).is_err());
    }

    #[test]
    fn it_should_still_read_logs_with_a_project_and_a_service() {
        assert!(Cli::try_parse_from(["fundaia", "logs", "tienda", "api", "-n", "50"]).is_ok());
    }

    #[test]
    fn it_should_read_the_environment_to_work_in_before_any_command() {
        let cli =
            Cli::try_parse_from(["fundaia", "--env", "staging", "services", "tienda"]).unwrap();
        assert_eq!(cli.environment.as_deref(), Some("staging"));
    }

    #[test]
    fn it_should_read_the_environment_to_work_in_after_the_command_too() {
        let cli = Cli::try_parse_from(["fundaia", "deploy", "tienda", "api", "--env", "staging"])
            .unwrap();
        assert_eq!(cli.environment.as_deref(), Some("staging"));
    }

    #[test]
    fn it_should_refuse_an_environment_both_copied_and_empty() {
        assert!(Cli::try_parse_from([
            "fundaia", "env", "new", "tienda", "staging", "--from", "qa", "--empty"
        ])
        .is_err());
    }

    #[test]
    fn it_should_read_where_a_service_is_copied_to() {
        let cli =
            Cli::try_parse_from(["fundaia", "env", "copy", "tienda", "api", "--to", "staging"])
                .unwrap();
        assert!(matches!(
            cli.command,
            Command::Env { command: EnvCommand::Copy { to, .. } } if to == "staging"
        ));
    }

    #[test]
    fn it_should_not_ask_the_registry_to_hand_over_the_guide() {
        assert!(!asks_the_registry(&Command::Guide));
    }
}