@kryd/cli 0.1.0 → 0.2.1

package/dist/index.js

@@ -14637,6 +14637,143 @@ var accountUsageSchema = external_exports.object({
   storageBytes: external_exports.number().int().nonnegative()
 });
 
+// ../../packages/shared-types/dist/env-vars.js
+var MANAGED_ENV_VAR_NAMES = [
+  "AI_GATEWAY_TOKEN",
+  "AI_GATEWAY_URL",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_ENDPOINT_URL_S3",
+  "AWS_REGION",
+  "AWS_SECRET_ACCESS_KEY",
+  "BUCKET_NAME",
+  "DATABASE_URL",
+  "DEPLOY_TOKEN",
+  "FORGE_PASSWORD",
+  "PUSH_TOKEN",
+  "WEBHOOK_SECRET"
+];
+var PLATFORM_ENV_VAR_NAMES = ["PATH", "PORT"];
+var RESERVED_ENV_VAR_NAMES = [
+  ...MANAGED_ENV_VAR_NAMES,
+  ...PLATFORM_ENV_VAR_NAMES
+];
+var RESERVED_ENV_VAR_PREFIX = "KRYD_";
+var ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ENV_VAR_NAME_MAX_LENGTH = 128;
+var ENV_VAR_VALUE_MAX_BYTES = 16 * 1024;
+function validateEnvVarName(name) {
+  if (name.length === 0)
+    return "An environment variable name is required.";
+  if (name.length > ENV_VAR_NAME_MAX_LENGTH) {
+    return `Environment variable names may be at most ${ENV_VAR_NAME_MAX_LENGTH} characters.`;
+  }
+  if (!ENV_VAR_NAME_PATTERN.test(name)) {
+    return "Environment variable names must match ^[A-Za-z_][A-Za-z0-9_]*$ \u2014 a letter or underscore, then letters, digits or underscores.";
+  }
+  if (isReservedEnvVarName(name)) {
+    return `"${name}" is reserved by Kryd and is set for you when you attach the matching resource \u2014 choose another name.`;
+  }
+  return null;
+}
+function isReservedEnvVarName(name) {
+  const upper = name.toUpperCase();
+  return RESERVED_ENV_VAR_NAMES.includes(upper) || upper.startsWith(RESERVED_ENV_VAR_PREFIX);
+}
+function validateEnvVarValue(value) {
+  if (value.length === 0) {
+    return "An environment variable value is required (an empty value cannot be stored).";
+  }
+  if (value.trim().length === 0) {
+    return "An environment variable value cannot be only whitespace.";
+  }
+  if (value.includes("\0")) {
+    return "Environment variable values may not contain NUL bytes.";
+  }
+  const bytes = new TextEncoder().encode(value).length;
+  if (bytes > ENV_VAR_VALUE_MAX_BYTES) {
+    return `Environment variable values may be at most ${ENV_VAR_VALUE_MAX_BYTES} bytes (got ${bytes}).`;
+  }
+  return null;
+}
+
+// ../../packages/shared-types/dist/build-env-vars.js
+var PUBLIC_BUILD_ENV_PREFIXES = [
+  "ASTRO_PUBLIC_",
+  "EXPO_PUBLIC_",
+  "GATSBY_",
+  "NEXT_PUBLIC_",
+  "NUXT_PUBLIC_",
+  "PUBLIC_",
+  "REACT_APP_",
+  "VITE_"
+];
+var SECRET_NAME_WORDS = [
+  "SECRET",
+  "PASSWORD",
+  "PASSWD",
+  "PASSPHRASE",
+  "PRIVATE_KEY",
+  "PRIVATEKEY",
+  "CREDENTIAL"
+];
+var SECRET_VALUE_SHAPES = [
+  { prefix: "sk_live_", label: "a Stripe secret key" },
+  { prefix: "sk_test_", label: "a Stripe test secret key" },
+  { prefix: "rk_live_", label: "a Stripe restricted key" },
+  { prefix: "rk_test_", label: "a Stripe restricted test key" },
+  { prefix: "ghp_", label: "a GitHub personal access token" },
+  { prefix: "gho_", label: "a GitHub OAuth token" },
+  { prefix: "ghs_", label: "a GitHub app token" },
+  { prefix: "github_pat_", label: "a GitHub fine-grained token" },
+  { prefix: "xoxb-", label: "a Slack bot token" },
+  { prefix: "xoxp-", label: "a Slack user token" },
+  { prefix: "xoxs-", label: "a Slack app token" }
+];
+var PEM_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+var URL_WITH_CREDENTIALS_PATTERN = /[a-z][a-z0-9+.-]*:\/\/[^/@\s:]*:[^/@\s]+@/i;
+var NEWLINE_PATTERN = /[\n\r]/;
+var BUILD_ENV_VAR_VALUE_MAX_BYTES = 4 * 1024;
+function hasPublicBuildPrefix(name) {
+  return PUBLIC_BUILD_ENV_PREFIXES.some((p) => name.startsWith(p));
+}
+function publicBuildPrefixList() {
+  return PUBLIC_BUILD_ENV_PREFIXES.join(", ");
+}
+function validateBuildEnvVarName(name) {
+  if (!hasPublicBuildPrefix(name)) {
+    return `Build-time variables are compiled into your app's public bundle, so their names must start with one of: ${publicBuildPrefixList()} \u2014 the prefixes bundlers use for values they will expose to the browser. "${name}" has none of them. If it is a secret, set it as a runtime variable instead (drop --build); if it really is public, rename it (e.g. VITE_${name}).`;
+  }
+  const upper = name.toUpperCase();
+  const word = SECRET_NAME_WORDS.find((w) => upper.includes(w));
+  if (word) {
+    return `"${name}" contains "${word}", and a build-time value is compiled into your public bundle where anyone can read it. Set it as a runtime variable instead (drop --build) \u2014 runtime values are stored in Scaleway Secret Manager and injected into the container, never into the bundle.`;
+  }
+  return null;
+}
+function validateBuildEnvVarValue(value) {
+  const bytes = new TextEncoder().encode(value).length;
+  if (bytes > BUILD_ENV_VAR_VALUE_MAX_BYTES) {
+    return `Build-time values may be at most ${BUILD_ENV_VAR_VALUE_MAX_BYTES} bytes (got ${bytes}) \u2014 they are passed to the build host as command-line arguments. A value this large is almost certainly a key or a certificate, which must not be compiled into a public bundle: set it as a runtime variable instead (drop --build).`;
+  }
+  const trimmed = value.trim();
+  const shape = SECRET_VALUE_SHAPES.find((s) => trimmed.includes(s.prefix));
+  if (shape) {
+    return `That value looks like ${shape.label}. Build-time values are compiled into your app's public bundle \u2014 publishing it would mean rotating it immediately. Set it as a runtime variable instead (drop --build).`;
+  }
+  if (PEM_PRIVATE_KEY_PATTERN.test(value)) {
+    return "That value contains a PEM private key. Build-time values are compiled into your app's public bundle, so it would be published to every visitor. Set it as a runtime variable instead (drop --build).";
+  }
+  if (URL_WITH_CREDENTIALS_PATTERN.test(value)) {
+    return "That value is a URL with a username and password in it (for example a database connection string). Build-time values are compiled into your app's public bundle, so those credentials would be published to every visitor. Set it as a runtime variable instead (drop --build), or use a URL without embedded credentials.";
+  }
+  if (NEWLINE_PATTERN.test(value)) {
+    return "Build-time values cannot contain line breaks: they are passed to the build as a single command-line argument, and the builder reads only the first line \u2014 the rest would be dropped silently and your app would receive a truncated value. Remove the line break if it is a stray one (a trailing newline from a paste or a file is the usual cause), or set it as a runtime variable instead (drop --build) \u2014 runtime values take a different route (Scaleway Secret Manager \u2192 the container's environment) and keep line breaks intact.";
+  }
+  return null;
+}
+var BUILD_ENV_PUBLIC_WARNING = "\u26A0 Build-time values are compiled into your app's public bundle \u2014 anyone who loads your site can read them. Never put a secret here.";
+var BUILD_ENV_REBUILD_NOTE = "This takes effect at your next BUILD, not your next deploy \u2014 the value is compiled into the image, so redeploying the existing image keeps the old value. Push a commit (`kryd push`) to rebuild.";
+
 // ../../packages/shared-types/dist/index.js
 var TERMINAL_DEPLOY_STATES = [
   "live",
@@ -14658,6 +14795,10 @@ function isTerminalResourceStatus(status) {
   return status === "ready" || status === "failed";
 }
 
+// src/index.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+
 // src/config.ts
 import {
   appendFileSync,
@@ -14759,19 +14900,27 @@ function saveProjectLink(cwd, link) {
   writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
   return path;
 }
-function ensureKrydIgnored(cwd) {
+function ensureIgnored(cwd, entry, aliases = []) {
   const path = join(cwd, ".gitignore");
-  const entry = `${PROJECT_LINK_DIR}/`;
   let current = "";
   try {
     current = readFileSync(path, "utf8");
   } catch {
   }
-  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || l === PROJECT_LINK_DIR);
-  if (present) return;
+  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
+  if (present) return false;
   const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
   appendFileSync(path, `${prefix}${entry}
 `);
+  return true;
+}
+function ensureKrydIgnored(cwd) {
+  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
+}
+function writeSecretFile(path, contents) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, contents, { mode: 384 });
+  chmodSync(path, 384);
 }
 function resolveProjectId(explicit, cwd = process.cwd()) {
   if (explicit) return explicit;
@@ -14796,7 +14945,7 @@ function browserLogin(dashboardUrl, opts = {}) {
   const state = randomUUID();
   const timeoutMs = opts.timeoutMs ?? 12e4;
   const shouldOpen = opts.open ?? true;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const settle = (fn) => {
       if (settled) return;
@@ -14826,7 +14975,7 @@ function browserLogin(dashboardUrl, opts = {}) {
       res.end(SUCCESS_HTML);
       settle(() => {
         server.close();
-        resolve({ token, ...apiUrl ? { apiUrl } : {} });
+        resolve2({ token, ...apiUrl ? { apiUrl } : {} });
       });
     });
     server.on("error", (err) => settle(() => reject(err)));
@@ -15104,6 +15253,158 @@ async function detachStorage(apiUrl, token, projectId) {
     );
   }
 }
+async function listEnvVars(apiUrl, token, projectId, include = "all") {
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env?scope=${encodeURIComponent(include)}`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Listing environment variables failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || !Array.isArray(parsed.vars)) {
+    throw new ApiError("The API returned an unexpected environment response.");
+  }
+  return parsed.vars.map((raw) => {
+    if (typeof raw !== "object" || raw === null) {
+      throw new ApiError("The API returned an unexpected environment response.");
+    }
+    const entry = raw;
+    if (typeof entry.key !== "string" || entry.key.length === 0 || typeof entry.source !== "string") {
+      throw new ApiError("The API returned an unexpected environment response.");
+    }
+    return {
+      key: entry.key,
+      // Which environments hold an explicit value (KRYD-159). An api older than KRYD-159 omits it, and
+      // the renderer reads a missing/empty list as "one value, all environments" — the correct reading
+      // of its absence. Kept as strings without rejecting an unknown one, same tolerance as `source`.
+      ...Array.isArray(entry.environments) ? {
+        environments: entry.environments.filter(
+          (e) => e === "production" || e === "preview"
+        )
+      } : {},
+      // Deliberately NOT rejected when it is outside `SECRET_SOURCES`. `SecretSource` is branded
+      // plain text precisely so the value set can grow without a migration, and the CLI is published
+      // to npm — so an installed copy is routinely older than the api. Rejecting an unrecognised
+      // source would make one new row break `kryd env list` entirely, including for the variables
+      // the user set themselves. The renderer groups anything it does not recognise instead. The
+      // malformed-body guard still holds: a proxy error page has no `vars` array at all.
+      source: entry.source,
+      // Same tolerance, same reason (KRYD-156): an api older than this CLI omits `scope` entirely,
+      // and every row such an api can return IS a runtime var — so the absent field has one correct
+      // reading. An unrecognised NEW scope is passed through rather than rejected, and the renderer
+      // groups it under "other" instead of dropping the variable from the listing.
+      scope: typeof entry.scope === "string" ? entry.scope : "runtime",
+      // The contract types `updatedAt` as nullable precisely so a missing timestamp is rendered
+      // rather than assumed — normalise anything non-string to `null` instead of failing.
+      updatedAt: typeof entry.updatedAt === "string" ? entry.updatedAt : null
+    };
+  });
+}
+async function pullEnvValues(apiUrl, token, projectId, environment = "production") {
+  const query = environment === "production" ? "" : `?environment=${encodeURIComponent(environment)}`;
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/values${query}`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Pulling environment values failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.values !== "object" || parsed.values === null || Array.isArray(parsed.values)) {
+    throw new ApiError("The API returned an unexpected environment-values response.");
+  }
+  const values = {};
+  for (const [key, value] of Object.entries(
+    parsed.values
+  )) {
+    if (typeof value !== "string") {
+      throw new ApiError("The API returned an unexpected environment-values response.");
+    }
+    values[key] = value;
+  }
+  return {
+    environment: parsed.environment === "preview" ? "preview" : "production",
+    values
+  };
+}
+async function setEnvVar(apiUrl, token, projectId, key, value, scope = "runtime", environment = "production") {
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env`,
+    {
+      method: "PUT",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${token}`
+      },
+      // `scope`/`environment` are sent only when NOT their defaults. An api older than KRYD-156/159
+      // ignores unknown body fields, so this is belt-and-braces — but it keeps a plain runtime
+      // production request byte-identical to the one KRYD-157 shipped.
+      body: JSON.stringify({
+        key,
+        value,
+        ...scope === "runtime" ? {} : { scope },
+        ...environment === "production" ? {} : { environment }
+      })
+    }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Setting ${key} failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  const expected = scope === "build" ? "appliesAtNextBuild" : "appliesAtNextDeploy";
+  if (!parsed || typeof parsed.key !== "string" || typeof parsed.created !== "boolean" || parsed[expected] !== true) {
+    throw new ApiError(
+      scope === "build" ? `The API returned an unexpected environment response \u2014 it may be an older version that does not support build-time variables. If so it has stored "${key}" as a RUNTIME variable instead: check with \`kryd env list\` and remove it with \`kryd env rm ${key}\` if you did not want that.` : "The API returned an unexpected environment response."
+    );
+  }
+  return {
+    key: parsed.key,
+    created: parsed.created,
+    appliesAtNextDeploy: scope !== "build",
+    appliesAtNextBuild: scope === "build"
+  };
+}
+async function removeEnvVar(apiUrl, token, projectId, key, scope = "runtime", environment = "production") {
+  const params = new URLSearchParams();
+  if (scope !== "runtime") params.set("scope", scope);
+  if (environment !== "production") params.set("environment", environment);
+  const query = params.toString() ? `?${params.toString()}` : "";
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(key)}${query}`,
+    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Removing ${key} failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (scope === "build" && parsed?.appliesAtNextBuild !== true) {
+    throw new ApiError(
+      `Could not confirm that the build-time variable "${key}" was removed. The API may be an older version that does not support build-time variables \u2014 in which case it has removed the RUNTIME variable "${key}" instead. Run \`kryd env list\` to see what is actually set.`
+    );
+  }
+  return {
+    key: typeof parsed?.key === "string" ? parsed.key : key,
+    appliesAtNextDeploy: scope !== "build",
+    appliesAtNextBuild: scope === "build"
+  };
+}
 async function triggerDeploy(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/deployments`, {
     method: "POST",
@@ -15135,6 +15436,20 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
   }
   return await res.json();
 }
+async function redeployProject(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/deployments/redeploy`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ projectId })
+  });
+  if (!res.ok) {
+    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res));
+  }
+  return await res.json();
+}
 async function listDeployments(apiUrl, token, projectId) {
   const url2 = new URL(`${apiUrl}/deployments`);
   if (projectId) url2.searchParams.set("projectId", projectId);
@@ -15144,6 +15459,32 @@ async function listDeployments(apiUrl, token, projectId) {
   }
   return (await res.json()).items;
 }
+function findDeploymentsForCommit(deployments, commitSha, branch) {
+  return deployments.filter((d) => d.commitSha === commitSha && d.branch === branch);
+}
+async function pollForNewDeployment(fetchDeployments, match, opts) {
+  const intervalMs = opts?.intervalMs ?? 2e3;
+  const timeoutMs = opts?.timeoutMs ?? 6e4;
+  const maxConsecutiveErrors = opts?.maxConsecutiveErrors ?? 5;
+  const sleep = opts?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const started = Date.now();
+  let consecutiveErrors = 0;
+  for (; ; ) {
+    try {
+      const items = await fetchDeployments();
+      consecutiveErrors = 0;
+      const fresh = findDeploymentsForCommit(items, match.commitSha, match.branch).filter(
+        (d) => !match.knownIds.has(d.id)
+      );
+      const found = fresh[fresh.length - 1];
+      if (found) return found;
+    } catch (err) {
+      if (++consecutiveErrors > maxConsecutiveErrors) throw err;
+    }
+    if (Date.now() - started >= timeoutMs) return null;
+    await sleep(intervalMs);
+  }
+}
 function dataFromFrame(frame) {
   const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).replace(/^ /, "")).join("\n");
   return data.length > 0 ? data : void 0;
@@ -15170,14 +15511,14 @@ async function* readSseFrames(body) {
 }
 function abortableSleep(ms, signal) {
   if (signal?.aborted) return Promise.resolve();
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const onAbort = () => {
       clearTimeout(timer);
-      resolve();
+      resolve2();
     };
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -15220,13 +15561,14 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
   }
   return terminal;
 }
-async function streamRuntime(apiUrl, token, projectId, handlers, opts = {}) {
+async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
+  const basePath = opts.resource === "deployment" ? "deployments" : "projects";
   const doFetch = opts.fetchImpl ?? fetch;
   const reconnectMs = opts.reconnectMs ?? 1e3;
   let afterNs;
   while (!opts.signal?.aborted) {
     try {
-      const url2 = new URL(`${apiUrl}/projects/${projectId}/runtime-logs`);
+      const url2 = new URL(`${apiUrl}/${basePath}/${id}/runtime-logs`);
       if (afterNs) url2.searchParams.set("after", afterNs);
       else if (opts.since) url2.searchParams.set("since", opts.since);
       const res = await doFetch(url2, {
@@ -15260,7 +15602,12 @@ async function streamRuntime(apiUrl, token, projectId, handlers, opts = {}) {
 // src/framework.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { basename, join as join2 } from "node:path";
-var FRAMEWORKS = ["react-router", "nextjs", "vite-spa"];
+var FRAMEWORKS = [
+  "react-router",
+  "nextjs",
+  "vite-spa",
+  "node"
+];
 function isFramework(value) {
   return FRAMEWORKS.includes(value);
 }
@@ -15274,6 +15621,7 @@ var VITE_META_FRAMEWORKS = [
   "@builder.io/qwik-city",
   "vike"
 ];
+var SERVER_FRAMEWORKS = ["hono", "express", "fastify", "koa"];
 function readPackageJson(cwd) {
   try {
     return JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
@@ -15289,6 +15637,7 @@ function frameworkFrom(pkg, cwd) {
     return "react-router";
   }
   if (VITE_META_FRAMEWORKS.some(has)) return null;
+  if (SERVER_FRAMEWORKS.some(has)) return "node";
   if (has("vite")) return "vite-spa";
   return null;
 }
@@ -15300,8 +15649,84 @@ function inspectProject(cwd) {
   return { framework: frameworkFrom(pkg, cwd), name: nameFrom(pkg, cwd) };
 }
 
+// src/input.ts
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+function defaultPromptIO() {
+  return {
+    input: process.stdin,
+    output: process.stderr,
+    isTTY: Boolean(process.stdin.isTTY) && Boolean(process.stderr.isTTY)
+  };
+}
+function isInteractive(io) {
+  if (io.isTTY !== void 0) return io.isTTY;
+  const output = io.output;
+  return Boolean(io.input.isTTY) && Boolean(output.isTTY);
+}
+async function readAll(input, maxBytes) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of input) {
+    const buf = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+    bytes += buf.length;
+    if (maxBytes !== void 0 && bytes > maxBytes) return { tooLarge: true };
+    chunks.push(buf);
+  }
+  return { value: Buffer.concat(chunks).toString("utf8") };
+}
+function stripOneTrailingNewline(value) {
+  if (value.endsWith("\r\n")) return value.slice(0, -2);
+  if (value.endsWith("\n")) return value.slice(0, -1);
+  return value;
+}
+async function promptHidden(question, io) {
+  io.output.write(question);
+  const restore = () => {
+    const tty = io.input;
+    if (tty.isTTY) tty.setRawMode?.(false);
+  };
+  process.once("SIGTERM", restore);
+  process.once("SIGHUP", restore);
+  const sink = new Writable({
+    write(_chunk, _encoding, callback) {
+      callback();
+    }
+  });
+  const rl = createInterface({
+    input: io.input,
+    output: sink,
+    terminal: true
+  });
+  try {
+    return await new Promise((resolve2) => {
+      rl.once("SIGINT", () => resolve2(null));
+      rl.once("close", () => resolve2(null));
+      rl.question("", (answer) => resolve2(answer));
+    });
+  } finally {
+    rl.close();
+    process.off("SIGTERM", restore);
+    process.off("SIGHUP", restore);
+    io.output.write("\n");
+  }
+}
+async function promptConfirm(question, io) {
+  const rl = createInterface({ input: io.input, output: io.output });
+  try {
+    const answer = await new Promise((resolve2) => {
+      rl.once("SIGINT", () => resolve2(null));
+      rl.once("close", () => resolve2(null));
+      rl.question(`${question} [y/N] `, (a) => resolve2(a));
+    });
+    return answer !== null && /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
 // src/git.ts
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 function authenticatedRemoteUrl(cloneUrl, username, token) {
   const prefix = "https://";
   if (!cloneUrl.startsWith(prefix)) return cloneUrl;
@@ -15330,6 +15755,43 @@ function configureGitRemote(cwd, remote, url2) {
     return { status: "unavailable" };
   }
 }
+function probe(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).toString().trim();
+    return { status: "ok", value };
+  } catch (err) {
+    if (err.code === "ENOENT") return { status: "no-git" };
+    return { status: "failed" };
+  }
+}
+function gitAvailable(cwd) {
+  const res = probe(cwd, ["rev-parse", "--is-inside-work-tree"]);
+  if (res.status === "no-git") return res;
+  if (res.status !== "ok" || res.value !== "true") return { status: "not-a-repo" };
+  return { status: "ok" };
+}
+function currentBranch(cwd) {
+  return probe(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
+}
+function headSha(cwd, ref) {
+  return probe(cwd, ["rev-parse", ref]);
+}
+function hasRemote(cwd, remote) {
+  const res = probe(cwd, ["remote"]);
+  if (res.status !== "ok") return res;
+  return { status: "ok", value: res.value.split(/\s+/).filter(Boolean).includes(remote) };
+}
+function pushBranch(cwd, remote, branch, extraArgs) {
+  const res = spawnSync("git", ["push", remote, branch, ...extraArgs], {
+    cwd,
+    stdio: "inherit"
+  });
+  if (res.status === 0) return { status: "ok" };
+  return { status: "failed", code: res.status ?? 1 };
+}
 
 // src/index.ts
 function reportError(err) {
@@ -15404,7 +15866,7 @@ async function runInit(opts) {
   if (opts.framework) {
     if (!isFramework(opts.framework)) {
       process.stderr.write(
-        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, or vite-spa.
+        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, vite-spa, or node.
 `
       );
       process.exitCode = 1;
@@ -15414,7 +15876,7 @@ async function runInit(opts) {
   } else {
     if (!detected.framework) {
       process.stderr.write(
-        "Could not detect a supported framework (React Router, Next.js, or a Vite SPA). Pass --framework <react-router|nextjs|vite-spa>.\n"
+        "Could not detect a supported framework (React Router, Next.js, a Vite SPA, or a Node service). Pass --framework <react-router|nextjs|vite-spa|node>.\n"
       );
       process.exitCode = 1;
       return;
@@ -15458,20 +15920,22 @@ async function runInit(opts) {
       case "added":
       case "updated":
         nextStep = `${remote.status === "added" ? "Added" : "Updated"} git remote "${remote.remote}" (with your push credential).
-Next: git push ${remote.remote} ${branch}   # push to deploy
+Next: kryd push   # push to deploy (same as \`git push ${remote.remote} ${branch}\`)
 `;
         break;
       case "not-a-repo":
         nextStep = `No git repo here yet. To deploy (the URL carries your push token \u2014 keep it private):
   git init && git add -A && git commit -m "init"
   git remote add kryd ${authedUrl}
-  git push kryd ${branch}
+  kryd push
 `;
         break;
       case "unavailable":
-        nextStep = `Add the remote, then push to deploy (the URL carries your push token \u2014 keep it private):
+        nextStep = gitAvailable(cwd).status === "no-git" ? `git is not installed, so the deploy remote could not be configured.
+Install git (https://git-scm.com/downloads), then re-run \`kryd init\` here.
+` : `Add the remote, then push to deploy (the URL carries your push token \u2014 keep it private):
   git remote add kryd ${authedUrl}
-  git push kryd ${branch}
+  kryd push
 `;
         break;
     }
@@ -15547,8 +16011,9 @@ async function runRuntimeLogs(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const isDeployment = opts.project?.startsWith("dpl_") ?? false;
+  const target = isDeployment ? opts.project : resolveProjectId(opts.project, opts.cwd);
+  if (!target) {
     reportNotLinked("kryd logs <projectId> --runtime");
     return;
   }
@@ -15567,7 +16032,7 @@ async function runRuntimeLogs(opts) {
     await streamRuntime(
       apiUrl,
       token,
-      project,
+      target,
       {
         onLine: ({ stream, line }) => {
           const out = stream === "stderr" ? process.stderr : process.stdout;
@@ -15575,7 +16040,11 @@ async function runRuntimeLogs(opts) {
 `);
         }
       },
-      { ...opts.since ? { since: opts.since } : {}, signal: controller.signal }
+      {
+        ...opts.since ? { since: opts.since } : {},
+        signal: controller.signal,
+        ...isDeployment ? { resource: "deployment" } : {}
+      }
     );
   } catch (err) {
     reportError(err);
@@ -15605,6 +16074,135 @@ async function runDeploy(opts) {
     reportError(err);
   }
 }
+async function runPush(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const cwd = opts.cwd ?? process.cwd();
+  const available = gitAvailable(cwd);
+  if (available.status === "no-git") {
+    process.stderr.write(
+      "git is not installed, and `kryd push` needs it to deploy.\nInstall git (https://git-scm.com/downloads), then try again.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (available.status !== "ok") {
+    process.stderr.write(
+      "Not a git repository \u2014 run `kryd push` from the root of your app's repo.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const remote = hasRemote(cwd, "kryd");
+  if (remote.status !== "ok" || !remote.value) {
+    process.stderr.write(
+      'No "kryd" git remote here. Run `kryd init` to link this project and configure it.\n'
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (opts.branch?.startsWith("-")) {
+    process.stderr.write(
+      `"${opts.branch}" is not a branch. Pass the branch before \`--\`, e.g. \`kryd push main -- ${opts.branch}\`.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  let branch = opts.branch;
+  if (!branch) {
+    const current = currentBranch(cwd);
+    if (current.status !== "ok") {
+      process.stderr.write("Could not determine the current branch \u2014 pass one, e.g. `kryd push main`.\n");
+      process.exitCode = 1;
+      return;
+    }
+    if (current.value === "HEAD") {
+      process.stderr.write(
+        "You are on a detached HEAD \u2014 pass the branch to push explicitly, e.g. `kryd push main`.\n"
+      );
+      process.exitCode = 1;
+      return;
+    }
+    branch = current.value;
+  }
+  const gitArgs = opts.gitArgs ?? [];
+  if (branch.includes(":") || branch.startsWith("+")) {
+    const pushed = pushBranch(cwd, "kryd", branch, gitArgs);
+    if (pushed.status === "failed") {
+      process.exitCode = pushed.code;
+      return;
+    }
+    process.stdout.write(
+      "Pushed. `kryd push` does not follow refspec pushes \u2014 use `kryd logs` to watch a deploy.\n"
+    );
+    return;
+  }
+  try {
+    const sha = headSha(cwd, branch);
+    if (sha.status !== "ok") {
+      process.stderr.write(`Unknown branch "${branch}" \u2014 nothing to push.
+`);
+      process.exitCode = 1;
+      return;
+    }
+    const commitSha = sha.value;
+    const projectId = resolveProjectId(void 0, opts.cwd);
+    if (!projectId) {
+      process.stderr.write("tip: run `kryd init` here to scope `kryd push` to this project.\n");
+    }
+    const fetchDeployments = () => listDeployments(apiUrl, token, projectId ?? void 0);
+    let known = null;
+    try {
+      known = findDeploymentsForCommit(await fetchDeployments(), commitSha, branch);
+    } catch {
+      known = null;
+    }
+    const pushed = pushBranch(cwd, "kryd", branch, gitArgs);
+    if (pushed.status === "failed") {
+      process.exitCode = pushed.code;
+      return;
+    }
+    if (known === null) {
+      process.stdout.write(
+        "Pushed. Could not reach the API to follow the deploy \u2014 try `kryd logs`.\n"
+      );
+      return;
+    }
+    process.stdout.write("Waiting for the deploy to start\u2026\n");
+    const deployment = await pollForNewDeployment(
+      fetchDeployments,
+      { commitSha, branch, knownIds: new Set(known.map((d) => d.id)) },
+      {
+        ...opts.sleep ? { sleep: opts.sleep } : {},
+        ...opts.pollTimeoutMs !== void 0 ? { timeoutMs: opts.pollTimeoutMs } : {}
+      }
+    );
+    if (!deployment) {
+      const previous = known[0];
+      if (previous) {
+        const outcome = previous.status === "live" ? "is already deployed" : `has already been deployed once (that deploy ended \`${previous.status}\`)`;
+        process.stdout.write(
+          `Nothing new to push \u2014 ${commitSha.slice(0, 7)} ${outcome} (\`kryd logs ${previous.id}\` to review it).
+`
+        );
+      } else {
+        process.stdout.write(
+          "Pushed, but no deploy has started yet. Follow it with `kryd logs`.\n" + (projectId ? "" : "If this keeps happening, re-run `kryd init` to link this folder.\n")
+        );
+      }
+      return;
+    }
+    await followDeploy(apiUrl, token, deployment.id);
+  } catch (err) {
+    reportError(err);
+  }
+}
 async function runRollback(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -15635,6 +16233,35 @@ async function runRollback(opts) {
     reportError(err);
   }
 }
+async function runRedeploy(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd redeploy <projectId>");
+    return;
+  }
+  try {
+    const { deploymentId, redeployedCommit, note } = await redeployProject(
+      apiUrl,
+      token,
+      project
+    );
+    process.stdout.write(
+      `Redeploying ${redeployedCommit.slice(0, 7)} \u2192 ${deploymentId}
+${note}
+`
+    );
+    await followDeploy(apiUrl, token, deploymentId);
+  } catch (err) {
+    reportError(err);
+  }
+}
 async function runDbCreate(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -15811,7 +16438,7 @@ async function runAiEnable(opts) {
     const status = await enableAi(apiUrl, token, { projectId: project });
     process.stdout.write(
       `AI enabled for ${project}.
-` + (status.url ? `Endpoint: ${status.url}
+` + (status.url ? `Endpoint: ${status.url} (OpenAI-compatible base URL \u2014 use it as-is)
 ` : "") + `AI_GATEWAY_URL + AI_GATEWAY_TOKEN will be injected on your next deploy (kryd deploy).
 `
     );
@@ -15849,7 +16476,420 @@ async function runStorageDetach(opts) {
     reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.1.0" : "0.0.0-dev";
+function splitKeyValue(spec) {
+  const eq = spec.indexOf("=");
+  if (eq === -1) return { key: spec };
+  return { key: spec.slice(0, eq), value: spec.slice(eq + 1) };
+}
+var NEXT_DEPLOY_NOTE = "This takes effect on your next deploy \u2014 run `kryd redeploy` to apply it now (no rebuild), or it lands on your next `kryd push`.\n";
+var NEXT_BUILD_NOTE = `${BUILD_ENV_REBUILD_NOTE}
+`;
+var ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T/;
+function isoDate(value) {
+  if (!value || !ISO_TIMESTAMP.test(value)) return null;
+  const date5 = new Date(value);
+  if (Number.isNaN(date5.getTime())) return null;
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${date5.getFullYear()}-${pad(date5.getMonth() + 1)}-${pad(date5.getDate())}`;
+}
+function envAnnotation(environments) {
+  if (!environments || environments.length === 0) return "";
+  const prod = environments.includes("production");
+  const preview = environments.includes("preview");
+  if (prod && preview) return "  \u2192 preview override";
+  if (preview && !prod) return "  \u2192 preview only";
+  return "";
+}
+function renderEnvGroup(heading, vars, opts) {
+  const width = vars.reduce((max, v) => Math.max(max, v.key.length), 0);
+  const dates = opts.showUpdated ? vars.map((v) => isoDate(v.updatedAt)) : [];
+  const anyDate = dates.some((d) => d !== null);
+  const rows = vars.map((v, i) => {
+    const envNote = opts.showEnvironments ? envAnnotation(v.environments) : "";
+    if (!anyDate) return `  ${v.key}${envNote}
+`;
+    const updated = dates[i];
+    return `  ${v.key.padEnd(width)}  ${updated ? `updated ${updated}` : ""}${envNote}
+`.trimEnd() + "\n";
+  }).join("");
+  return `${heading}
+${rows}`;
+}
+async function runEnvList(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd env list <projectId>");
+    return;
+  }
+  try {
+    const vars = await listEnvVars(apiUrl, token, project);
+    if (vars.length === 0) {
+      process.stdout.write(
+        `No environment variables for ${project} yet.
+Set one with \`kryd env set KEY --stdin\`, or attach a database, storage or the AI gateway.
+`
+      );
+      return;
+    }
+    const byKey = (a, b) => a.key.localeCompare(b.key);
+    const buildVars = vars.filter((v) => v.scope === "build").sort(byKey);
+    const runtimeVars = vars.filter((v) => v.scope !== "build");
+    const mine = runtimeVars.filter((v) => v.source === "customer").sort(byKey);
+    const managed = runtimeVars.filter((v) => v.source === "managed").sort(byKey);
+    const other = runtimeVars.filter((v) => v.source !== "customer" && v.source !== "managed").sort(byKey);
+    let out = "";
+    if (mine.length > 0) {
+      out += renderEnvGroup(`Set by you (${mine.length})`, mine, {
+        showUpdated: true,
+        // Your customer vars can carry a preview override (runtime KRYD-159, build KRYD-215); annotate
+        // which ones do.
+        showEnvironments: true
+      });
+    }
+    if (managed.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Managed by Kryd (${managed.length}) \u2014 set when you attach a resource; not editable`,
+        managed,
+        // A managed row's timestamp is Kryd's own bookkeeping, not something the user did; showing
+        // it invites "why did my DATABASE_URL change today?".
+        { showUpdated: false }
+      );
+    }
+    if (other.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Other (${other.length}) \u2014 set by a newer version of Kryd; upgrade the CLI (\`npm install -g @kryd/cli\`) to see what they are`,
+        other,
+        { showUpdated: false }
+      );
+    }
+    if (buildVars.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Build-time (${buildVars.length}) \u2014 compiled into your public bundle`,
+        buildVars,
+        // Build vars are per-environment too now (KRYD-215) — annotate a preview override / preview-only
+        // build var, exactly as the runtime group does.
+        { showUpdated: true, showEnvironments: true }
+      );
+      out += `${BUILD_ENV_PUBLIC_WARNING}
+`;
+    }
+    out += "\nValues are never shown. This is the stored set \u2014 runtime changes reach your container at its next deploy (run `kryd redeploy` to apply them now)" + (buildVars.length > 0 ? ", and build-time changes at its next build.\n" : ".\n");
+    process.stdout.write(out);
+  } catch (err) {
+    reportError(err);
+  }
+}
+function toDotenvLine(key, value) {
+  const hasNewline = /[\n\r]/.test(value);
+  const needsQuote = hasNewline || value === "" || value !== value.trim() || value.includes("#") || /^["'`]/.test(value);
+  if (!needsQuote) return `${key}=${value}`;
+  if (!hasNewline && !value.includes("'")) return `${key}='${value}'`;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+  return `${key}="${escaped}"`;
+}
+async function runEnvPull(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd env pull <projectId>");
+    return;
+  }
+  const environment = opts.preview ? "preview" : "production";
+  const cwd = opts.cwd ?? process.cwd();
+  const root = findProjectLinkDir(cwd) ?? cwd;
+  const outRel = opts.out ?? ".env.kryd";
+  const outPath = resolve(root, outRel);
+  if (opts.out !== void 0 && existsSync3(outPath) && !opts.force) {
+    process.stderr.write(
+      `Refusing to overwrite ${outRel} \u2014 pass --force to replace it (or omit --out to write .env.kryd).
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const { values } = await pullEnvValues(apiUrl, token, project, environment);
+    const entries = Object.entries(values).sort(
+      ([a], [b]) => a.localeCompare(b)
+    );
+    const header = `# Written by \`kryd env pull\` \u2014 your customer-set variables for ${project} (${environment}).
+# Regenerate with \`kryd env pull\`. Do not commit this file.
+`;
+    const body = entries.map(([k, v]) => toDotenvLine(k, v)).join("\n");
+    const rel = relative(root, outPath);
+    const insideRoot = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    const added = insideRoot ? ensureIgnored(root, rel) : false;
+    writeSecretFile(outPath, body.length > 0 ? `${header}
+${body}
+` : header);
+    const count = entries.length;
+    process.stdout.write(
+      count === 0 ? `No customer environment variables for ${project} (${environment}) \u2014 wrote an empty ${outRel}.
+` : `Wrote ${count} variable${count === 1 ? "" : "s"} to ${outRel} (${environment}), mode 0600.
+`
+    );
+    if (added) process.stdout.write(`Added ${rel} to .gitignore.
+`);
+    if (!insideRoot)
+      process.stderr.write(
+        `Warning: ${outRel} is outside the project root \u2014 NOT added to .gitignore. Make sure you don't commit it.
+`
+      );
+    process.stdout.write(
+      "These are your own values, read back from Kryd. Managed values (DATABASE_URL, storage, the AI gateway) are never pulled.\n"
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function resolveEnvValue(inline, opts) {
+  if (opts.stdin && inline !== void 0) {
+    return {
+      error: "Pass the value with --stdin OR as KEY=VALUE, not both \u2014 it is ambiguous which one you meant."
+    };
+  }
+  if (opts.stdin) {
+    if (isInteractive(opts.io)) {
+      return {
+        error: `--stdin expects a value on standard input, but nothing is piped in (e.g. \`\u2026 | kryd env set ${opts.key} --stdin\`). To type it instead, run \`kryd env set ${opts.key}\` \u2014 you will be prompted, and nothing is echoed.`
+      };
+    }
+    const read = await readAll(opts.io.input, ENV_VAR_VALUE_MAX_BYTES + 1);
+    if ("tooLarge" in read) {
+      return {
+        error: `That value is larger than the ${ENV_VAR_VALUE_MAX_BYTES}-byte limit for an environment variable.`
+      };
+    }
+    return { value: stripOneTrailingNewline(read.value) };
+  }
+  if (inline !== void 0) {
+    if (inline.length > 0) {
+      process.stderr.write(
+        `tip: a value in \`KEY=VALUE\` is visible in \`ps\` and is saved to your shell history. For a secret, pipe it (\`kryd env set ${opts.key} --stdin\`) or omit the value to be prompted.
+`
+      );
+    }
+    return { value: inline };
+  }
+  if (!isInteractive(opts.io)) {
+    return {
+      error: `No value given for ${opts.key}, and there is no terminal to prompt on. Pipe it with \`kryd env set ${opts.key} --stdin\`.`
+    };
+  }
+  const typed = await promptHidden(`Value for ${opts.key} (not echoed): `, opts.io);
+  if (typed === null) return { aborted: true };
+  return { value: typed };
+}
+async function runEnvSet(opts) {
+  const scope = opts.build ? "build" : "runtime";
+  const environment = opts.preview ? "preview" : "production";
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd env set KEY=VALUE <projectId>");
+    return;
+  }
+  if (!opts.spec) {
+    process.stderr.write(
+      "Which variable? e.g. `kryd env set MY_API_KEY --stdin` or `kryd env set FEATURE_X=on`.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const { key, value: inline } = splitKeyValue(opts.spec);
+  const nameError = validateEnvVarName(key);
+  if (nameError) {
+    process.stderr.write(`${nameError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    const buildNameError = validateBuildEnvVarName(key);
+    if (buildNameError) {
+      process.stderr.write(`${buildNameError}
+`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const io = opts.io ?? defaultPromptIO();
+  const resolved = await resolveEnvValue(inline, {
+    ...opts.stdin !== void 0 ? { stdin: opts.stdin } : {},
+    io,
+    key
+  });
+  if ("aborted" in resolved) {
+    process.stderr.write(`Aborted \u2014 ${key} was not set.
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if ("error" in resolved) {
+    process.stderr.write(`${resolved.error}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  const valueError = validateEnvVarValue(resolved.value);
+  if (valueError) {
+    process.stderr.write(`${valueError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    const buildValueError = validateBuildEnvVarValue(resolved.value);
+    if (buildValueError) {
+      process.stderr.write(`${buildValueError}
+`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  try {
+    const written = await setEnvVar(
+      apiUrl,
+      token,
+      project,
+      key,
+      resolved.value,
+      scope,
+      environment
+    );
+    const envTag = environment === "preview" ? " (preview)" : "";
+    process.stdout.write(
+      `${written.created ? "Set" : "Updated"} ${written.key}${scope === "build" ? " (build-time)" : envTag} for ${project}.
+` + // The public-bundle warning comes FIRST, before the applies-when note. Someone who reads one
+      // line of output should read the consequential one.
+      (scope === "build" ? `${BUILD_ENV_PUBLIC_WARNING}
+${NEXT_BUILD_NOTE}` : NEXT_DEPLOY_NOTE)
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runEnvRemove(opts) {
+  const scope = opts.build ? "build" : "runtime";
+  const environment = opts.preview ? "preview" : "production";
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd env rm KEY <projectId>");
+    return;
+  }
+  const key = opts.key;
+  if (!key) {
+    process.stderr.write("Which variable? e.g. `kryd env rm MY_API_KEY`.\n");
+    process.exitCode = 1;
+    return;
+  }
+  if (!ENV_VAR_NAME_PATTERN.test(key)) {
+    process.stderr.write(
+      "Environment variable names must match ^[A-Za-z_][A-Za-z0-9_]*$ \u2014 a letter or underscore, then letters, digits or underscores.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (isReservedEnvVarName(key)) {
+    process.stderr.write(
+      `${key} is reserved by Kryd and cannot be removed here.
+If it comes from a resource you attached, detach that instead (\`kryd db detach\`, \`kryd storage detach\`).
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const nameError = validateEnvVarName(key);
+  if (nameError) {
+    process.stderr.write(`${nameError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    try {
+      const vars = await listEnvVars(apiUrl, token, project, "build");
+      if (!vars.some((v) => v.key === key && v.scope === "build")) {
+        process.stderr.write(
+          `${key} is not set as a build-time variable on ${project}.
+Run \`kryd env list\` to see what is set. (If you meant the runtime variable of that name, drop --build.)
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+    } catch (err) {
+      reportError(err);
+      return;
+    }
+  }
+  if (!opts.yes) {
+    const io = opts.io ?? defaultPromptIO();
+    if (!isInteractive(io)) {
+      process.stderr.write(
+        `Refusing to remove ${key} without confirmation. Re-run with --yes to confirm non-interactively.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const confirmed = await promptConfirm(
+      scope === "build" ? `Remove the build-time variable ${key} from ${project}? Your next build will not have it (the current image still does).` : environment === "preview" ? `Remove the preview override for ${key} on ${project}? Previews will revert to inheriting the production value.` : `Remove ${key} from ${project}? Its stored value (production and any preview override) is deleted and cannot be recovered.`,
+      io
+    );
+    if (!confirmed) {
+      process.stdout.write(`Left ${key} in place.
+`);
+      return;
+    }
+  }
+  try {
+    const removed = await removeEnvVar(apiUrl, token, project, key, scope, environment);
+    const envTag = environment === "preview" ? " (preview override)" : "";
+    process.stdout.write(
+      `Removed ${removed.key}${scope === "build" ? " (build-time)" : envTag} from ${project}.
+` + // The build-scope warning is deliberately bleaker than the runtime one, because the truth is.
+      // A runtime value is gone from the container at the next deploy. A build-time value is
+      // COMPILED INTO the live image and into every bundle already downloaded from it — removing
+      // it stops future builds baking it in and does nothing else. Someone removing a value they
+      // now realise was sensitive must not read "removed" as "contained".
+      (scope === "build" ? "\u26A0 This does not un-publish it. The value is already compiled into the live image and into every bundle served from it \u2014 rotate it at the provider, then push a commit to rebuild without it.\n" : `\u26A0 Your running container still has the old value until your next deploy \u2014 run \`kryd redeploy\` to apply the removal now (no rebuild), or it lands on your next \`kryd push\`.
+`)
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+var CLI_VERSION = true ? "0.2.1" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
@@ -15860,26 +16900,34 @@ program.command("whoami").description("Show the current account").option("--api-
 program.command("logout").description("Clear the stored token").action(() => runLogout());
 program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
-  "react-router | nextjs | vite-spa (auto-detected if omitted)"
+  "react-router | nextjs | vite-spa | node (auto-detected if omitted)"
 ).option(
   "--tenant <slug>",
   "your tenant slug (claimed once on first init \u2014 appears in every deploy URL)"
 ).option("--api-url <url>", "control-plane API base URL").action((opts) => runInit(opts));
 program.command("logs [target]").description(
-  "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: the project's live-app runtime logs ([target]=project id)."
+  "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: a container's stdout/stderr \u2014 [target]=a project id tails its live app, a deployment id (dpl_\u2026) tails THAT deploy's container (incl. a failed one, to see why it crashed)."
 ).option(
   "--runtime",
-  "stream the live container's runtime stdout/stderr (the running app) instead of build/deploy logs"
+  "stream a container's runtime stdout/stderr instead of build/deploy logs \u2014 the live app (project id) or one deploy's container (dpl_ id)"
 ).option(
   "--since <dur>",
   "with --runtime: backfill this window before going live (e.g. 30m, 2h, 1d; max 7d)"
 ).option("--api-url <url>", "control-plane API base URL").action(
   (target, opts) => opts.runtime ? runRuntimeLogs({ project: target, since: opts.since, apiUrl: opts.apiUrl }) : runLogs({ apiUrl: opts.apiUrl, deployment: target })
 );
+program.command("push [branch]").description(
+  "Push to the kryd remote and follow the deploy it triggers (defaults to the current branch)"
+).option("--api-url <url>", "control-plane API base URL").action(
+  (branch, opts, cmd) => runPush({ ...opts, branch, gitArgs: cmd.args.slice(1) })
+);
 program.command("deploy [project]").description("Trigger a deploy of the project's production branch and follow it live").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runDeploy({ ...opts, project }));
 program.command("rollback [project] [deployment]").description("Roll back to a previous successful deploy (no rebuild) and follow it live").option("--api-url <url>", "control-plane API base URL").action(
   (project, deployment, opts) => runRollback({ ...opts, project, deployment })
 );
+program.command("redeploy [project]").description(
+  "Redeploy the current live commit (no rebuild) to apply config/env changes, and follow it live"
+).option("--api-url <url>", "control-plane API base URL").action((project, opts) => runRedeploy({ ...opts, project }));
 var db = program.command("db").description("Manage project databases");
 db.command("create [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
   "--connection-string <url>",
@@ -15889,6 +16937,36 @@ db.command("detach [project]").description("Tear down the project's database and
 var storage = program.command("storage").description("Manage project object storage");
 storage.command("create [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runStorageCreate({ ...opts, project }));
 storage.command("detach [project]").description("Tear down the project's object storage and reclaim its credentials").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runStorageDetach({ ...opts, project }));
+var env = program.command("env").description("Manage your app's environment variables");
+env.command("list [project]").description("List the project's environment variables (names and origin \u2014 never values)").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runEnvList({ ...opts, project }));
+env.command("set <key> [project]").description(
+  "Set one of your environment variables \u2014 `KEY=VALUE`, or `KEY` with --stdin / a prompt"
+).option(
+  "--stdin",
+  "read the value from a pipe instead of the argument (a value in `KEY=VALUE` is visible in `ps` and saved to your shell history); one trailing newline is stripped, and this is the only way to set a multi-line value"
+).option(
+  "--build",
+  "set it as a BUILD-TIME variable, for `import.meta.env` / `process.env` while your bundler runs (VITE_*, NEXT_PUBLIC_*, PUBLIC_*, \u2026). The value is compiled into your public bundle, so it must not be a secret, and it takes effect at your next build rather than your next deploy"
+).option(
+  "--preview",
+  "set the value for PREVIEW deploys only \u2014 an override that shadows production for previews (without it, a set targets production, which previews inherit)"
+).option("--api-url <url>", "control-plane API base URL").action((key, project, opts) => runEnvSet({ ...opts, spec: key, project }));
+env.command("rm <key> [project]").description("Remove one of your environment variables (asks for confirmation)").option("--yes", "skip the confirmation prompt (required when there is no terminal)").option(
+  "--build",
+  "remove the build-time variable of this name rather than the runtime one (the same name can exist as both)"
+).option(
+  "--preview",
+  "remove only the PREVIEW override, reverting previews to inheriting production (without it, the whole key is removed \u2014 production and any preview override)"
+).option("--api-url <url>", "control-plane API base URL").action((key, project, opts) => runEnvRemove({ ...opts, key, project }));
+env.command("pull [project]").description(
+  "Write your customer-set environment variables (values included) to a local .env file for development"
+).option(
+  "--preview",
+  "pull the values a PREVIEW deploy would see (preview overrides plus inherited production), instead of production"
+).option(
+  "--out <path>",
+  "file to write, relative to the project root (default: .env.kryd \u2014 never your hand-maintained .env)"
+).option("--force", "overwrite the --out file if it already exists").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runEnvPull({ ...opts, project }));
 var ai = program.command("ai").description("Manage the app's EU AI gateway");
 ai.command("enable [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runAiEnable({ ...opts, project }));
 if (import.meta.url === `file://${process.argv[1]}`) {
@@ -15906,13 +16984,20 @@ export {
   runDbCreate,
   runDbDetach,
   runDeploy,
+  runEnvList,
+  runEnvPull,
+  runEnvRemove,
+  runEnvSet,
   runInit,
   runLogin,
   runLogout,
   runLogs,
+  runPush,
+  runRedeploy,
   runRollback,
   runRuntimeLogs,
   runStorageCreate,
   runStorageDetach,
-  runWhoami
+  runWhoami,
+  splitKeyValue
 };