@kryd/cli 0.16.0 → 0.17.0

package/README.md

@@ -17,8 +17,7 @@ Requires Node.js ≥ 22 and git (the CLI shells out to git for `kryd init` and `
 ## Quickstart
 
 ```sh
-kryd login                    # sign in via the browser
-kryd init                     # link this folder to a Kryd project (+ a `kryd` git remote)
+kryd init                     # link this folder to a Kryd project (+ a `kryd` git remote); not signed in? it asks, then signs you in via the browser
 kryd push                     # push the current branch → build → deploy → live, with live progress
 kryd logs                     # the full build log of the latest deploy (kryd push shows progress, not log lines)
 kryd logs <project> --runtime # tail the live app's stdout/stderr
@@ -33,7 +32,7 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 |---|---|
 | `kryd login` / `logout` / `whoami` | Authenticate the CLI (browser flow); the token is stored in `~/.kryd`. `whoami` shows the account commands run in, your role there, and your other accounts. |
 | `kryd account list \| use <slug>` | You can belong to several accounts (your own, a customer's as a member). `list` shows them with your role in each, `*` marking the current one; `use` makes every following command run in that account. |
-| `kryd init` | Link the current repo to a Kryd project + register the deploy webhook + add a `kryd` git remote. |
+| `kryd init` | Link the current repo to a Kryd project + register the deploy webhook + add a `kryd` git remote. Not logged in and at a terminal? It asks, then runs the same browser login as `kryd login`; without a terminal it refuses (a deploy token, `KRYD_TOKEN`, cannot create a project). |
 | `kryd push [branch]` | Push to the `kryd` remote and follow the deploy it triggers (defaults to the current branch). Shows which step the deploy is on, how long it has taken and a progress bar; `--logs` streams the full build log instead. |
 | `kryd deploy [project]` | Re-deploy the production-branch HEAD already on the forge — no new commit. |
 | `kryd logs [target]` | Follow a deploy's build/deploy log **in full** — this is where the build output lives (`--runtime` tails the live container instead; `--worker` tails the project's workflow worker, also when it has a web app). |

package/dist/index.js

@@ -21,7 +21,11 @@ var ERROR_CODES = {
   // KRYD-516b: a request that names no account while the caller is in several (400), and a member
   // whose role lacks the route's permission (403, `details.permission` names it).
   accountRequired: "account.required",
-  permissionRequired: "auth.permission_required"
+  permissionRequired: "auth.permission_required",
+  // KRYD-592: the analytics store (Umami's database) is unconfigured, down or too slow — a 503 the
+  // Analytics tab shows as its own error band while the rest of the dashboard carries on. (The spec
+  // wrote `analytics_unavailable`; dotted like every code here, which `api.test.ts` enforces.)
+  analyticsUnavailable: "analytics.unavailable"
 };
 
 // ../../packages/shared-types/dist/db-url.js
@@ -14737,6 +14741,12 @@ var accountUsageSchema = external_exports.object({
   storageBytes: external_exports.number().int().nonnegative()
 });
 
+// ../../packages/shared-types/dist/resource.js
+var BUCKET_UPLOAD_MAX_BYTES = 50 * 1024 * 1024;
+var BUCKET_UPLOAD_MAX_SIZE_LABEL = `${BUCKET_UPLOAD_MAX_BYTES / (1024 * 1024)} MB`;
+var BUCKET_UPLOAD_MAX_TOTAL_BYTES = 100 * 1024 * 1024;
+var BUCKET_UPLOAD_TOTAL_REFUSAL = `Je kunt maximaal ${BUCKET_UPLOAD_MAX_TOTAL_BYTES / (1024 * 1024)} MB per upload versturen.`;
+
 // ../../packages/shared-types/dist/env-vars.js
 var MANAGED_ENV_VAR_NAMES = [
   "AI_GATEWAY_TOKEN",
@@ -14928,6 +14938,7 @@ var ROLES = {
 var ACCOUNT_HEADER = "Kryd-Account";
 
 // ../../packages/shared-types/dist/workflow-run.js
+var WORKFLOW_RUN_PAYLOAD_MAX_BYTES = 64 * 1024;
 var MAX_WEBHOOK_NAME = 32;
 var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
 
@@ -15255,6 +15266,9 @@ async function linkProject(apiUrl, token, input) {
   }
   return parsed;
 }
+function environmentQuery(environment) {
+  return environment === "preview" ? "?environment=preview" : "";
+}
 async function attachDatabase(apiUrl, token, input) {
   const res = await fetch(`${apiUrl}/databases`, {
     method: "POST",
@@ -15266,7 +15280,9 @@ async function attachDatabase(apiUrl, token, input) {
       projectId: input.projectId,
       mode: input.mode,
       // Conditional (exactOptionalPropertyTypes) — only BYO carries a connection string.
-      ...input.connectionString ? { connectionString: input.connectionString } : {}
+      ...input.connectionString ? { connectionString: input.connectionString } : {},
+      // Only sent for preview, so a production attach is byte-identical to what older CLIs send.
+      ...input.environment === "preview" ? { environment: "preview" } : {}
     })
   });
   if (!res.ok) {
@@ -15283,7 +15299,8 @@ async function attachDatabase(apiUrl, token, input) {
   return {
     id: parsed.id,
     mode: parsed.mode,
-    status: parsed.status
+    status: parsed.status,
+    ...parsed.environment === "production" || parsed.environment === "preview" ? { environment: parsed.environment } : {}
   };
 }
 async function createStorage(apiUrl, token, input) {
@@ -15534,14 +15551,15 @@ async function fetchResourceStatus(apiUrl, token, path) {
   }
   return {
     status: parsed.status,
-    failureReason: typeof parsed.failureReason === "string" ? parsed.failureReason : null
+    failureReason: typeof parsed.failureReason === "string" ? parsed.failureReason : null,
+    ...parsed.environment === "production" || parsed.environment === "preview" ? { environment: parsed.environment } : {}
   };
 }
-function getDatabaseStatus(apiUrl, token, projectId) {
+function getDatabaseStatus(apiUrl, token, projectId, environment) {
   return fetchResourceStatus(
     apiUrl,
     token,
-    `/databases/${encodeURIComponent(projectId)}`
+    `/databases/${encodeURIComponent(projectId)}${environmentQuery(environment)}`
   );
 }
 function getStorageStatus(apiUrl, token, projectId) {
@@ -15599,9 +15617,9 @@ async function pollResourceDetached(fetchStatus, opts) {
     await sleep(intervalMs);
   }
 }
-async function detachDatabase(apiUrl, token, projectId) {
+async function detachDatabase(apiUrl, token, projectId, environment) {
   const res = await fetch(
-    `${apiUrl}/databases/${encodeURIComponent(projectId)}`,
+    `${apiUrl}/databases/${encodeURIComponent(projectId)}${environmentQuery(environment)}`,
     { method: "DELETE", headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
@@ -15612,6 +15630,19 @@ async function detachDatabase(apiUrl, token, projectId) {
     );
   }
 }
+async function resetPreviewDatabase(apiUrl, token, projectId) {
+  const res = await fetch(
+    `${apiUrl}/databases/${encodeURIComponent(projectId)}/reset?environment=preview`,
+    { method: "POST", headers: { ...authHeaders(token) } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Database reset failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+}
 async function getProject(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
     headers: { ...authHeaders(token) }
@@ -18010,11 +18041,14 @@ async function runLogin(opts) {
     warnIfEnvTokenOverrides();
     return;
   }
-  const { token, apiUrl: learnedApiUrl } = await browserLogin(resolveDashboardUrl(opts.dashboardUrl));
+  await browserLoginAndSave(apiUrl, opts.dashboardUrl);
+  warnIfEnvTokenOverrides();
+}
+async function browserLoginAndSave(apiUrl, dashboardUrl) {
+  const { token, apiUrl: learnedApiUrl } = await browserLogin(resolveDashboardUrl(dashboardUrl));
   saveToken(token, learnedApiUrl ?? apiUrl);
   process.stdout.write("Logged in.\n");
   await settleAccountAfterLogin(learnedApiUrl ?? apiUrl, token);
-  warnIfEnvTokenOverrides();
 }
 async function runWhoami(opts = {}) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
@@ -18049,13 +18083,46 @@ function runLogout() {
   warnIfEnvTokenOverrides();
 }
 async function runInit(opts) {
-  const apiUrl = resolveApiUrl(opts.apiUrl);
+  let apiUrl = resolveApiUrl(opts.apiUrl);
   const cwd = opts.cwd ?? process.cwd();
-  const token = resolveToken();
+  let token = resolveToken();
   if (!token) {
-    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
-    process.exitCode = 1;
-    return;
+    const refusal = "Not logged in \u2014 run `kryd login` first.\n";
+    const io = opts.io ?? defaultPromptIO();
+    if (opts.offerLogin === false) {
+      process.stderr.write(refusal);
+      process.exitCode = 1;
+      return;
+    }
+    if (!isInteractive(io)) {
+      process.stderr.write(
+        refusal + // KRYD-385 iteration 1: no KRYD_TOKEN advice — `POST /repos` refuses a deploy token (KRYD-578).
+        "No terminal to log in from: ask the user to run `kryd init` (or `kryd login`) in their own terminal. A deploy token (KRYD_TOKEN) cannot create a project.\n"
+      );
+      process.exitCode = 1;
+      return;
+    }
+    io.output.write("You are not logged in to Kryd; `kryd init` can log you in through your browser first.\n");
+    if (!await promptConfirm("Log in now in your browser?", io)) {
+      process.stderr.write(refusal);
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      await browserLoginAndSave(apiUrl);
+    } catch (err) {
+      process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    token = resolveToken();
+    if (!token) {
+      process.stderr.write(refusal);
+      process.exitCode = 1;
+      return;
+    }
+    if (!opts.apiUrl) apiUrl = resolveApiUrl();
   }
   const existingLink = directoryIsLinked(cwd);
   if (existingLink) {
@@ -18650,6 +18717,17 @@ async function runDbAdd(opts) {
     process.exitCode = 1;
     return;
   }
+  if (opts.preview && opts.connectionString !== void 0) {
+    process.stderr.write(
+      "A preview database is always managed by Kryd \u2014 --preview cannot take a --connection-string.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (opts.preview) {
+    await addPreviewDatabase(apiUrl, token, project2);
+    return;
+  }
   let mode;
   let connectionString;
   if (opts.connectionString !== void 0) {
@@ -18695,6 +18773,46 @@ The connection string will be injected as DATABASE_URL on your next deploy.
     await reportError(err);
   }
 }
+async function addPreviewDatabase(apiUrl, token, project2) {
+  try {
+    const db2 = await attachDatabase(apiUrl, token, {
+      projectId: project2,
+      mode: "shared",
+      environment: "preview"
+    });
+    if (db2.environment !== "preview") {
+      process.stderr.write(
+        `The Kryd API did not create a preview database (it does not support them yet) \u2014 run \`kryd db status ${project2}\` to see what is attached.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write(`Provisioning a preview database for ${project2}\u2026
+`);
+    const result = await pollResourceUntilTerminal(
+      () => getDatabaseStatus(apiUrl, token, project2, "preview")
+    );
+    reportSettleResult(result, {
+      readyMsg: `Attached preview database ${db2.id} to ${project2}. It starts empty.
+Every preview deploy gets it as DATABASE_URL from its next deploy; production keeps its own.
+`,
+      failedLabel: "Preview database provisioning",
+      retryCmd: `kryd db status ${project2}`
+    });
+  } catch (err) {
+    await reportError(err);
+  }
+}
+async function readPreviewDatabase(apiUrl, token, project2) {
+  try {
+    const row = await getDatabaseStatus(apiUrl, token, project2, "preview");
+    return row.environment === "preview" ? row : null;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) return null;
+    throw err;
+  }
+}
 function reportSettleResult(result, opts) {
   if (result.status === "ready") {
     process.stdout.write(opts.readyMsg);
@@ -18915,6 +19033,8 @@ async function describeProjectResources(apiUrl, token, projectId) {
   const out = ["its deployed app, its containers and its built images"];
   const db2 = await getDatabaseStatus(apiUrl, token, projectId).catch(() => null);
   if (db2) out.push("its Postgres database \u2014 and all the data in it");
+  const preview = db2 ? await readPreviewDatabase(apiUrl, token, projectId).catch(() => null) : null;
+  if (preview) out.push("its preview database \u2014 and all the data in it");
   const storage2 = await getStorageStatus(apiUrl, token, projectId).catch(() => null);
   if (storage2) out.push("its object-storage bucket \u2014 and every object in it");
   out.push("its Git repository on the forge, and its push token");
@@ -18933,6 +19053,23 @@ async function runDbRemove(opts) {
     reportNotLinked("kryd db remove <projectId>");
     return;
   }
+  if (opts.preview) {
+    await removePreviewDatabase(apiUrl, token, project2, opts);
+    return;
+  }
+  try {
+    if (await readPreviewDatabase(apiUrl, token, project2)) {
+      process.stderr.write(
+        `${project2} has a preview database \u2014 remove the preview first (\`kryd db remove --preview\`).
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+  } catch (err) {
+    await reportError(err);
+    return;
+  }
   const proceed = await confirmResourceRemoval({
     yes: opts.yes,
     io: opts.io,
@@ -18959,6 +19096,105 @@ async function runDbRemove(opts) {
     await reportError(err);
   }
 }
+async function removePreviewDatabase(apiUrl, token, project2, opts) {
+  try {
+    if (!await readPreviewDatabase(apiUrl, token, project2)) {
+      process.stderr.write(`${project2} has no preview database.
+`);
+      process.exitCode = 1;
+      return;
+    }
+  } catch (err) {
+    await reportError(err);
+    return;
+  }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `the preview database from ${project2}`,
+    question: `Remove the preview database from ${project2}? It is torn down and all the data in it is destroyed \u2014 this cannot be undone. Production is not touched; preview deploys use the production database again from their next deploy.`,
+    declined: `Left the preview database on ${project2} in place.
+`
+  });
+  if (!proceed) return;
+  try {
+    await detachDatabase(apiUrl, token, project2, "preview");
+    process.stdout.write(`Removing the preview database from ${project2}\u2026
+`);
+    const result = await pollResourceDetached(
+      () => getDatabaseStatus(apiUrl, token, project2, "preview")
+    );
+    reportDetachResult(result, {
+      goneMsg: `Removed the preview database from ${project2}.
+Preview deploys use the production database again from their next deploy.
+`,
+      failedLabel: "Preview database removal",
+      retryCmd: `kryd db remove --preview ${project2}`
+    });
+  } catch (err) {
+    await reportError(err);
+  }
+}
+async function runDbReset(opts) {
+  if (!opts.preview) {
+    process.stderr.write(
+      "Only the preview database can be reset \u2014 run `kryd db reset --preview`. Production is never emptied.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = resolveToken();
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd db reset --preview <projectId>");
+    return;
+  }
+  try {
+    if (!await readPreviewDatabase(apiUrl, token, project2)) {
+      process.stderr.write(
+        `${project2} has no preview database \u2014 add one with \`kryd db add --preview ${project2}\`.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+  } catch (err) {
+    await reportError(err);
+    return;
+  }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `everything in the preview database of ${project2}`,
+    question: `Empty the preview database of ${project2}? Every table and all the data in it is dropped \u2014 this cannot be undone. Production is not touched.`,
+    declined: `Left the preview database of ${project2} as it is.
+`
+  });
+  if (!proceed) return;
+  try {
+    await resetPreviewDatabase(apiUrl, token, project2);
+    process.stdout.write(`Emptying the preview database of ${project2}\u2026
+`);
+    const result = await pollResourceUntilTerminal(
+      () => getDatabaseStatus(apiUrl, token, project2, "preview")
+    );
+    reportSettleResult(result, {
+      readyMsg: `The preview database of ${project2} is empty again.
+Its credentials did not change, so no deploy is needed.
+`,
+      failedLabel: "Preview database reset",
+      retryCmd: `kryd db status ${project2}`
+    });
+  } catch (err) {
+    await reportError(err);
+  }
+}
 async function runAiAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = resolveToken();
@@ -19064,12 +19300,45 @@ async function runDbStatus(opts) {
     reportNotLinked("kryd db status <projectId>");
     return;
   }
+  let productionAttached = false;
   await reportResourceStatus({
-    read: () => getDatabaseStatus(apiUrl, token, project2),
+    read: async () => {
+      const row = await getDatabaseStatus(apiUrl, token, project2);
+      productionAttached = true;
+      return row;
+    },
     noun: "database",
     project: project2,
     token
   });
+  if (!productionAttached) return;
+  try {
+    const preview = await readPreviewDatabase(apiUrl, token, project2);
+    if (!preview) {
+      process.stdout.write(
+        `${project2}: no preview database \u2014 preview deploys use the production database.
+`
+      );
+    } else if (preview.status === "failed") {
+      process.stdout.write(
+        `${project2}: preview database failed \u2014 ${preview.failureReason ?? "unknown error"}.
+Remove it with \`kryd db remove --preview\` and add it again.
+`
+      );
+    } else if (preview.status === "ready") {
+      process.stdout.write(
+        `${project2}: preview database ready \u2014 preview deploys get it as DATABASE_URL.
+`
+      );
+    } else {
+      process.stdout.write(
+        `${project2}: preview database ${preview.status} \u2014 preview deploys use the production database until it is ready.
+`
+      );
+    }
+  } catch (err) {
+    await reportError(err);
+  }
 }
 async function runStorageStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
@@ -19529,6 +19798,7 @@ HATCHET_CLIENT_TOKEN is injected into your container on production deploys (prev
   process.exitCode = 0;
   await runInit({
     cwd: target,
+    offerLogin: false,
     ...opts.name ? { name: opts.name } : {},
     ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
   });
@@ -20159,7 +20429,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.16.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.17.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.hook("postAction", async () => {
@@ -20182,7 +20452,9 @@ program.command("git-credential <operation>", { hidden: true }).description("git
     ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
   });
 });
-program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
+program.command("init").description(
+  "Link this project's repo + register its push webhook; not logged in \u2192 offers the browser login first (terminal only)"
+).option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
   'react-router | nextjs | vite-spa | node (auto-detected if omitted; `workflow` comes from a committed kryd.json with "web": false)'
 ).option(
@@ -20243,9 +20515,13 @@ var db = program.command("db").description("Manage project databases");
 db.command("add [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
   "--connection-string <url>",
   "attach an existing database (BYO) by pasting its connection string"
+).option(
+  "--preview",
+  "attach an empty preview database that every preview deploy gets instead of production's"
 ).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbAdd({ ...opts, project: project2 }));
-db.command("remove [project]").description("Tear down the project's database and everything in it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbRemove({ ...opts, project: project2 }));
-db.command("status [project]").description("Show whether the project has a database, and what state it is in").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbStatus({ ...opts, project: project2 }));
+db.command("remove [project]").description("Tear down the project's database and everything in it (asks for confirmation)").option("--preview", "remove the preview database; production is not touched").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbRemove({ ...opts, project: project2 }));
+db.command("reset [project]").description("Empty the preview database: every table dropped, credentials kept (asks for confirmation)").option("--preview", "required \u2014 only the preview database can be reset").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbReset({ ...opts, project: project2 }));
+db.command("status [project]").description("Show the project's database and preview database, and what state they are in").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbStatus({ ...opts, project: project2 }));
 var storage = program.command("storage").description("Manage project object storage");
 storage.command("add [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageAdd({ ...opts, project: project2 }));
 storage.command("remove [project]").description("Tear down the project's bucket and every object in it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageRemove({ ...opts, project: project2 }));
@@ -20340,6 +20616,7 @@ export {
   runAiStatus,
   runDbAdd,
   runDbRemove,
+  runDbReset,
   runDbStatus,
   runDeploy,
   runDeployHookCreate,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Kryd CLI — git push → live on the European cloud for your AI: SSL, managed Postgres & object storage, and an EU-hosted AI gateway. Your code and model calls stay in the EU. Beta: sign up at https://kryd.eu/beta",
   "keywords": [
     "kryd",
@@ -42,8 +42,8 @@
     "typescript": "^5.6.3",
     "vitest": "^2.1.8",
     "@kryd/shared-types": "0.0.0",
-    "@kryd/config-ts": "0.0.0",
-    "@kryd/config-eslint": "0.0.0"
+    "@kryd/config-eslint": "0.0.0",
+    "@kryd/config-ts": "0.0.0"
   },
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --define:__KRYD_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/index.js",