@kryd/cli 0.2.0 → 0.2.1

package/README.md

@@ -1,6 +1,6 @@
 # @kryd/cli
 
-The command-line client for **[Kryd](https://kryd.eu)** — the effortless **EU-sovereign** deploy stack on Scaleway. Push a React / Vite / Next.js app and seconds later it's live on a real URL with SSL, one-click managed Postgres and object storage, and an EU-hosted AI gateway already wired in. The same instant `git push → live` loop you know from Vercel/Netlify, on infrastructure that is genuinely European — code **and** AI inference stay inside the EU.
+The command-line client for **[Kryd](https://kryd.eu)** — the **European cloud for your AI**. Push a React / Vite / Next.js app and seconds later it's live on a real URL with SSL, one-click managed Postgres and object storage, and an EU-hosted AI gateway already wired in. The same instant `git push → live` loop you know from Vercel/Netlify, on infrastructure that is genuinely European — code **and** AI inference stay inside the EU.
 
 ## Install
 
@@ -36,13 +36,14 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 | `kryd rollback [project] [deployment]` | Roll back to a previous successful deploy — no rebuild. |
 | `kryd db create \| detach [project]` | Attach / tear down managed Postgres (shared or bring-your-own). |
 | `kryd storage create \| detach [project]` | Attach / tear down S3-compatible object storage. |
+| `kryd env list \| set \| rm [project]` | Manage your own environment variables. `set KEY --stdin` (or a prompt) keeps a secret out of `ps` and your shell history; values are never printed back. Add `--build` for build-time variables (`VITE_*`, `NEXT_PUBLIC_*`) — these are compiled into your public bundle, so they must never be secrets, and they take effect at your next build rather than your next deploy. |
 | `kryd ai enable [project]` | Give the project an authenticated EU AI-gateway endpoint (injected on the next deploy). |
 
 Run `kryd <command> --help` for options. Every project-scoped command accepts an explicit `<project>` id, or resolves it from the `.kryd` link (walking up from the current directory, git-style).
 
 ## Sovereignty
 
-Your application code runs on Scaleway (EU), and the AI gateway routes **only** to Scaleway's EU-hosted models — the wedge is that both your code and your model inference stay inside genuinely European infrastructure. This CLI is the open client; the token you store is a credential and is never printed or bundled into any artifact.
+Your application code runs in the EU, and the AI gateway routes **only** to EU-hosted models — the destination is a compile-time constant, so there is no setting that changes it. The wedge is that both your code and your model inference stay inside genuinely European infrastructure. We name our infrastructure provider on the sub-processor list rather than in the product copy: what we promise is the **jurisdiction** and the **absence of a non-EU code path**, not a particular supplier. This CLI is the open client; the token you store is a credential and is never printed or bundled into any artifact.
 
 ## Links
 

package/dist/index.js

@@ -14637,6 +14637,143 @@ var accountUsageSchema = external_exports.object({
   storageBytes: external_exports.number().int().nonnegative()
 });
 
+// ../../packages/shared-types/dist/env-vars.js
+var MANAGED_ENV_VAR_NAMES = [
+  "AI_GATEWAY_TOKEN",
+  "AI_GATEWAY_URL",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_ENDPOINT_URL_S3",
+  "AWS_REGION",
+  "AWS_SECRET_ACCESS_KEY",
+  "BUCKET_NAME",
+  "DATABASE_URL",
+  "DEPLOY_TOKEN",
+  "FORGE_PASSWORD",
+  "PUSH_TOKEN",
+  "WEBHOOK_SECRET"
+];
+var PLATFORM_ENV_VAR_NAMES = ["PATH", "PORT"];
+var RESERVED_ENV_VAR_NAMES = [
+  ...MANAGED_ENV_VAR_NAMES,
+  ...PLATFORM_ENV_VAR_NAMES
+];
+var RESERVED_ENV_VAR_PREFIX = "KRYD_";
+var ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ENV_VAR_NAME_MAX_LENGTH = 128;
+var ENV_VAR_VALUE_MAX_BYTES = 16 * 1024;
+function validateEnvVarName(name) {
+  if (name.length === 0)
+    return "An environment variable name is required.";
+  if (name.length > ENV_VAR_NAME_MAX_LENGTH) {
+    return `Environment variable names may be at most ${ENV_VAR_NAME_MAX_LENGTH} characters.`;
+  }
+  if (!ENV_VAR_NAME_PATTERN.test(name)) {
+    return "Environment variable names must match ^[A-Za-z_][A-Za-z0-9_]*$ \u2014 a letter or underscore, then letters, digits or underscores.";
+  }
+  if (isReservedEnvVarName(name)) {
+    return `"${name}" is reserved by Kryd and is set for you when you attach the matching resource \u2014 choose another name.`;
+  }
+  return null;
+}
+function isReservedEnvVarName(name) {
+  const upper = name.toUpperCase();
+  return RESERVED_ENV_VAR_NAMES.includes(upper) || upper.startsWith(RESERVED_ENV_VAR_PREFIX);
+}
+function validateEnvVarValue(value) {
+  if (value.length === 0) {
+    return "An environment variable value is required (an empty value cannot be stored).";
+  }
+  if (value.trim().length === 0) {
+    return "An environment variable value cannot be only whitespace.";
+  }
+  if (value.includes("\0")) {
+    return "Environment variable values may not contain NUL bytes.";
+  }
+  const bytes = new TextEncoder().encode(value).length;
+  if (bytes > ENV_VAR_VALUE_MAX_BYTES) {
+    return `Environment variable values may be at most ${ENV_VAR_VALUE_MAX_BYTES} bytes (got ${bytes}).`;
+  }
+  return null;
+}
+
+// ../../packages/shared-types/dist/build-env-vars.js
+var PUBLIC_BUILD_ENV_PREFIXES = [
+  "ASTRO_PUBLIC_",
+  "EXPO_PUBLIC_",
+  "GATSBY_",
+  "NEXT_PUBLIC_",
+  "NUXT_PUBLIC_",
+  "PUBLIC_",
+  "REACT_APP_",
+  "VITE_"
+];
+var SECRET_NAME_WORDS = [
+  "SECRET",
+  "PASSWORD",
+  "PASSWD",
+  "PASSPHRASE",
+  "PRIVATE_KEY",
+  "PRIVATEKEY",
+  "CREDENTIAL"
+];
+var SECRET_VALUE_SHAPES = [
+  { prefix: "sk_live_", label: "a Stripe secret key" },
+  { prefix: "sk_test_", label: "a Stripe test secret key" },
+  { prefix: "rk_live_", label: "a Stripe restricted key" },
+  { prefix: "rk_test_", label: "a Stripe restricted test key" },
+  { prefix: "ghp_", label: "a GitHub personal access token" },
+  { prefix: "gho_", label: "a GitHub OAuth token" },
+  { prefix: "ghs_", label: "a GitHub app token" },
+  { prefix: "github_pat_", label: "a GitHub fine-grained token" },
+  { prefix: "xoxb-", label: "a Slack bot token" },
+  { prefix: "xoxp-", label: "a Slack user token" },
+  { prefix: "xoxs-", label: "a Slack app token" }
+];
+var PEM_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+var URL_WITH_CREDENTIALS_PATTERN = /[a-z][a-z0-9+.-]*:\/\/[^/@\s:]*:[^/@\s]+@/i;
+var NEWLINE_PATTERN = /[\n\r]/;
+var BUILD_ENV_VAR_VALUE_MAX_BYTES = 4 * 1024;
+function hasPublicBuildPrefix(name) {
+  return PUBLIC_BUILD_ENV_PREFIXES.some((p) => name.startsWith(p));
+}
+function publicBuildPrefixList() {
+  return PUBLIC_BUILD_ENV_PREFIXES.join(", ");
+}
+function validateBuildEnvVarName(name) {
+  if (!hasPublicBuildPrefix(name)) {
+    return `Build-time variables are compiled into your app's public bundle, so their names must start with one of: ${publicBuildPrefixList()} \u2014 the prefixes bundlers use for values they will expose to the browser. "${name}" has none of them. If it is a secret, set it as a runtime variable instead (drop --build); if it really is public, rename it (e.g. VITE_${name}).`;
+  }
+  const upper = name.toUpperCase();
+  const word = SECRET_NAME_WORDS.find((w) => upper.includes(w));
+  if (word) {
+    return `"${name}" contains "${word}", and a build-time value is compiled into your public bundle where anyone can read it. Set it as a runtime variable instead (drop --build) \u2014 runtime values are stored in Scaleway Secret Manager and injected into the container, never into the bundle.`;
+  }
+  return null;
+}
+function validateBuildEnvVarValue(value) {
+  const bytes = new TextEncoder().encode(value).length;
+  if (bytes > BUILD_ENV_VAR_VALUE_MAX_BYTES) {
+    return `Build-time values may be at most ${BUILD_ENV_VAR_VALUE_MAX_BYTES} bytes (got ${bytes}) \u2014 they are passed to the build host as command-line arguments. A value this large is almost certainly a key or a certificate, which must not be compiled into a public bundle: set it as a runtime variable instead (drop --build).`;
+  }
+  const trimmed = value.trim();
+  const shape = SECRET_VALUE_SHAPES.find((s) => trimmed.includes(s.prefix));
+  if (shape) {
+    return `That value looks like ${shape.label}. Build-time values are compiled into your app's public bundle \u2014 publishing it would mean rotating it immediately. Set it as a runtime variable instead (drop --build).`;
+  }
+  if (PEM_PRIVATE_KEY_PATTERN.test(value)) {
+    return "That value contains a PEM private key. Build-time values are compiled into your app's public bundle, so it would be published to every visitor. Set it as a runtime variable instead (drop --build).";
+  }
+  if (URL_WITH_CREDENTIALS_PATTERN.test(value)) {
+    return "That value is a URL with a username and password in it (for example a database connection string). Build-time values are compiled into your app's public bundle, so those credentials would be published to every visitor. Set it as a runtime variable instead (drop --build), or use a URL without embedded credentials.";
+  }
+  if (NEWLINE_PATTERN.test(value)) {
+    return "Build-time values cannot contain line breaks: they are passed to the build as a single command-line argument, and the builder reads only the first line \u2014 the rest would be dropped silently and your app would receive a truncated value. Remove the line break if it is a stray one (a trailing newline from a paste or a file is the usual cause), or set it as a runtime variable instead (drop --build) \u2014 runtime values take a different route (Scaleway Secret Manager \u2192 the container's environment) and keep line breaks intact.";
+  }
+  return null;
+}
+var BUILD_ENV_PUBLIC_WARNING = "\u26A0 Build-time values are compiled into your app's public bundle \u2014 anyone who loads your site can read them. Never put a secret here.";
+var BUILD_ENV_REBUILD_NOTE = "This takes effect at your next BUILD, not your next deploy \u2014 the value is compiled into the image, so redeploying the existing image keeps the old value. Push a commit (`kryd push`) to rebuild.";
+
 // ../../packages/shared-types/dist/index.js
 var TERMINAL_DEPLOY_STATES = [
   "live",
@@ -14658,6 +14795,10 @@ function isTerminalResourceStatus(status) {
   return status === "ready" || status === "failed";
 }
 
+// src/index.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+
 // src/config.ts
 import {
   appendFileSync,
@@ -14759,19 +14900,27 @@ function saveProjectLink(cwd, link) {
   writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
   return path;
 }
-function ensureKrydIgnored(cwd) {
+function ensureIgnored(cwd, entry, aliases = []) {
   const path = join(cwd, ".gitignore");
-  const entry = `${PROJECT_LINK_DIR}/`;
   let current = "";
   try {
     current = readFileSync(path, "utf8");
   } catch {
   }
-  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || l === PROJECT_LINK_DIR);
-  if (present) return;
+  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
+  if (present) return false;
   const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
   appendFileSync(path, `${prefix}${entry}
 `);
+  return true;
+}
+function ensureKrydIgnored(cwd) {
+  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
+}
+function writeSecretFile(path, contents) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, contents, { mode: 384 });
+  chmodSync(path, 384);
 }
 function resolveProjectId(explicit, cwd = process.cwd()) {
   if (explicit) return explicit;
@@ -14796,7 +14945,7 @@ function browserLogin(dashboardUrl, opts = {}) {
   const state = randomUUID();
   const timeoutMs = opts.timeoutMs ?? 12e4;
   const shouldOpen = opts.open ?? true;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const settle = (fn) => {
       if (settled) return;
@@ -14826,7 +14975,7 @@ function browserLogin(dashboardUrl, opts = {}) {
       res.end(SUCCESS_HTML);
       settle(() => {
         server.close();
-        resolve({ token, ...apiUrl ? { apiUrl } : {} });
+        resolve2({ token, ...apiUrl ? { apiUrl } : {} });
       });
     });
     server.on("error", (err) => settle(() => reject(err)));
@@ -15104,6 +15253,158 @@ async function detachStorage(apiUrl, token, projectId) {
     );
   }
 }
+async function listEnvVars(apiUrl, token, projectId, include = "all") {
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env?scope=${encodeURIComponent(include)}`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Listing environment variables failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || !Array.isArray(parsed.vars)) {
+    throw new ApiError("The API returned an unexpected environment response.");
+  }
+  return parsed.vars.map((raw) => {
+    if (typeof raw !== "object" || raw === null) {
+      throw new ApiError("The API returned an unexpected environment response.");
+    }
+    const entry = raw;
+    if (typeof entry.key !== "string" || entry.key.length === 0 || typeof entry.source !== "string") {
+      throw new ApiError("The API returned an unexpected environment response.");
+    }
+    return {
+      key: entry.key,
+      // Which environments hold an explicit value (KRYD-159). An api older than KRYD-159 omits it, and
+      // the renderer reads a missing/empty list as "one value, all environments" — the correct reading
+      // of its absence. Kept as strings without rejecting an unknown one, same tolerance as `source`.
+      ...Array.isArray(entry.environments) ? {
+        environments: entry.environments.filter(
+          (e) => e === "production" || e === "preview"
+        )
+      } : {},
+      // Deliberately NOT rejected when it is outside `SECRET_SOURCES`. `SecretSource` is branded
+      // plain text precisely so the value set can grow without a migration, and the CLI is published
+      // to npm — so an installed copy is routinely older than the api. Rejecting an unrecognised
+      // source would make one new row break `kryd env list` entirely, including for the variables
+      // the user set themselves. The renderer groups anything it does not recognise instead. The
+      // malformed-body guard still holds: a proxy error page has no `vars` array at all.
+      source: entry.source,
+      // Same tolerance, same reason (KRYD-156): an api older than this CLI omits `scope` entirely,
+      // and every row such an api can return IS a runtime var — so the absent field has one correct
+      // reading. An unrecognised NEW scope is passed through rather than rejected, and the renderer
+      // groups it under "other" instead of dropping the variable from the listing.
+      scope: typeof entry.scope === "string" ? entry.scope : "runtime",
+      // The contract types `updatedAt` as nullable precisely so a missing timestamp is rendered
+      // rather than assumed — normalise anything non-string to `null` instead of failing.
+      updatedAt: typeof entry.updatedAt === "string" ? entry.updatedAt : null
+    };
+  });
+}
+async function pullEnvValues(apiUrl, token, projectId, environment = "production") {
+  const query = environment === "production" ? "" : `?environment=${encodeURIComponent(environment)}`;
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/values${query}`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Pulling environment values failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.values !== "object" || parsed.values === null || Array.isArray(parsed.values)) {
+    throw new ApiError("The API returned an unexpected environment-values response.");
+  }
+  const values = {};
+  for (const [key, value] of Object.entries(
+    parsed.values
+  )) {
+    if (typeof value !== "string") {
+      throw new ApiError("The API returned an unexpected environment-values response.");
+    }
+    values[key] = value;
+  }
+  return {
+    environment: parsed.environment === "preview" ? "preview" : "production",
+    values
+  };
+}
+async function setEnvVar(apiUrl, token, projectId, key, value, scope = "runtime", environment = "production") {
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env`,
+    {
+      method: "PUT",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${token}`
+      },
+      // `scope`/`environment` are sent only when NOT their defaults. An api older than KRYD-156/159
+      // ignores unknown body fields, so this is belt-and-braces — but it keeps a plain runtime
+      // production request byte-identical to the one KRYD-157 shipped.
+      body: JSON.stringify({
+        key,
+        value,
+        ...scope === "runtime" ? {} : { scope },
+        ...environment === "production" ? {} : { environment }
+      })
+    }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Setting ${key} failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  const expected = scope === "build" ? "appliesAtNextBuild" : "appliesAtNextDeploy";
+  if (!parsed || typeof parsed.key !== "string" || typeof parsed.created !== "boolean" || parsed[expected] !== true) {
+    throw new ApiError(
+      scope === "build" ? `The API returned an unexpected environment response \u2014 it may be an older version that does not support build-time variables. If so it has stored "${key}" as a RUNTIME variable instead: check with \`kryd env list\` and remove it with \`kryd env rm ${key}\` if you did not want that.` : "The API returned an unexpected environment response."
+    );
+  }
+  return {
+    key: parsed.key,
+    created: parsed.created,
+    appliesAtNextDeploy: scope !== "build",
+    appliesAtNextBuild: scope === "build"
+  };
+}
+async function removeEnvVar(apiUrl, token, projectId, key, scope = "runtime", environment = "production") {
+  const params = new URLSearchParams();
+  if (scope !== "runtime") params.set("scope", scope);
+  if (environment !== "production") params.set("environment", environment);
+  const query = params.toString() ? `?${params.toString()}` : "";
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(key)}${query}`,
+    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Removing ${key} failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (scope === "build" && parsed?.appliesAtNextBuild !== true) {
+    throw new ApiError(
+      `Could not confirm that the build-time variable "${key}" was removed. The API may be an older version that does not support build-time variables \u2014 in which case it has removed the RUNTIME variable "${key}" instead. Run \`kryd env list\` to see what is actually set.`
+    );
+  }
+  return {
+    key: typeof parsed?.key === "string" ? parsed.key : key,
+    appliesAtNextDeploy: scope !== "build",
+    appliesAtNextBuild: scope === "build"
+  };
+}
 async function triggerDeploy(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/deployments`, {
     method: "POST",
@@ -15135,6 +15436,20 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
   }
   return await res.json();
 }
+async function redeployProject(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/deployments/redeploy`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ projectId })
+  });
+  if (!res.ok) {
+    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res));
+  }
+  return await res.json();
+}
 async function listDeployments(apiUrl, token, projectId) {
   const url2 = new URL(`${apiUrl}/deployments`);
   if (projectId) url2.searchParams.set("projectId", projectId);
@@ -15196,14 +15511,14 @@ async function* readSseFrames(body) {
 }
 function abortableSleep(ms, signal) {
   if (signal?.aborted) return Promise.resolve();
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const onAbort = () => {
       clearTimeout(timer);
-      resolve();
+      resolve2();
     };
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -15246,13 +15561,14 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
   }
   return terminal;
 }
-async function streamRuntime(apiUrl, token, projectId, handlers, opts = {}) {
+async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
+  const basePath = opts.resource === "deployment" ? "deployments" : "projects";
   const doFetch = opts.fetchImpl ?? fetch;
   const reconnectMs = opts.reconnectMs ?? 1e3;
   let afterNs;
   while (!opts.signal?.aborted) {
     try {
-      const url2 = new URL(`${apiUrl}/projects/${projectId}/runtime-logs`);
+      const url2 = new URL(`${apiUrl}/${basePath}/${id}/runtime-logs`);
       if (afterNs) url2.searchParams.set("after", afterNs);
       else if (opts.since) url2.searchParams.set("since", opts.since);
       const res = await doFetch(url2, {
@@ -15286,7 +15602,12 @@ async function streamRuntime(apiUrl, token, projectId, handlers, opts = {}) {
 // src/framework.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { basename, join as join2 } from "node:path";
-var FRAMEWORKS = ["react-router", "nextjs", "vite-spa"];
+var FRAMEWORKS = [
+  "react-router",
+  "nextjs",
+  "vite-spa",
+  "node"
+];
 function isFramework(value) {
   return FRAMEWORKS.includes(value);
 }
@@ -15300,6 +15621,7 @@ var VITE_META_FRAMEWORKS = [
   "@builder.io/qwik-city",
   "vike"
 ];
+var SERVER_FRAMEWORKS = ["hono", "express", "fastify", "koa"];
 function readPackageJson(cwd) {
   try {
     return JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
@@ -15315,6 +15637,7 @@ function frameworkFrom(pkg, cwd) {
     return "react-router";
   }
   if (VITE_META_FRAMEWORKS.some(has)) return null;
+  if (SERVER_FRAMEWORKS.some(has)) return "node";
   if (has("vite")) return "vite-spa";
   return null;
 }
@@ -15326,6 +15649,82 @@ function inspectProject(cwd) {
   return { framework: frameworkFrom(pkg, cwd), name: nameFrom(pkg, cwd) };
 }
 
+// src/input.ts
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+function defaultPromptIO() {
+  return {
+    input: process.stdin,
+    output: process.stderr,
+    isTTY: Boolean(process.stdin.isTTY) && Boolean(process.stderr.isTTY)
+  };
+}
+function isInteractive(io) {
+  if (io.isTTY !== void 0) return io.isTTY;
+  const output = io.output;
+  return Boolean(io.input.isTTY) && Boolean(output.isTTY);
+}
+async function readAll(input, maxBytes) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of input) {
+    const buf = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+    bytes += buf.length;
+    if (maxBytes !== void 0 && bytes > maxBytes) return { tooLarge: true };
+    chunks.push(buf);
+  }
+  return { value: Buffer.concat(chunks).toString("utf8") };
+}
+function stripOneTrailingNewline(value) {
+  if (value.endsWith("\r\n")) return value.slice(0, -2);
+  if (value.endsWith("\n")) return value.slice(0, -1);
+  return value;
+}
+async function promptHidden(question, io) {
+  io.output.write(question);
+  const restore = () => {
+    const tty = io.input;
+    if (tty.isTTY) tty.setRawMode?.(false);
+  };
+  process.once("SIGTERM", restore);
+  process.once("SIGHUP", restore);
+  const sink = new Writable({
+    write(_chunk, _encoding, callback) {
+      callback();
+    }
+  });
+  const rl = createInterface({
+    input: io.input,
+    output: sink,
+    terminal: true
+  });
+  try {
+    return await new Promise((resolve2) => {
+      rl.once("SIGINT", () => resolve2(null));
+      rl.once("close", () => resolve2(null));
+      rl.question("", (answer) => resolve2(answer));
+    });
+  } finally {
+    rl.close();
+    process.off("SIGTERM", restore);
+    process.off("SIGHUP", restore);
+    io.output.write("\n");
+  }
+}
+async function promptConfirm(question, io) {
+  const rl = createInterface({ input: io.input, output: io.output });
+  try {
+    const answer = await new Promise((resolve2) => {
+      rl.once("SIGINT", () => resolve2(null));
+      rl.once("close", () => resolve2(null));
+      rl.question(`${question} [y/N] `, (a) => resolve2(a));
+    });
+    return answer !== null && /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
 // src/git.ts
 import { execFileSync, spawnSync } from "node:child_process";
 function authenticatedRemoteUrl(cloneUrl, username, token) {
@@ -15467,7 +15866,7 @@ async function runInit(opts) {
   if (opts.framework) {
     if (!isFramework(opts.framework)) {
       process.stderr.write(
-        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, or vite-spa.
+        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, vite-spa, or node.
 `
       );
       process.exitCode = 1;
@@ -15477,7 +15876,7 @@ async function runInit(opts) {
   } else {
     if (!detected.framework) {
       process.stderr.write(
-        "Could not detect a supported framework (React Router, Next.js, or a Vite SPA). Pass --framework <react-router|nextjs|vite-spa>.\n"
+        "Could not detect a supported framework (React Router, Next.js, a Vite SPA, or a Node service). Pass --framework <react-router|nextjs|vite-spa|node>.\n"
       );
       process.exitCode = 1;
       return;
@@ -15612,8 +16011,9 @@ async function runRuntimeLogs(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const isDeployment = opts.project?.startsWith("dpl_") ?? false;
+  const target = isDeployment ? opts.project : resolveProjectId(opts.project, opts.cwd);
+  if (!target) {
     reportNotLinked("kryd logs <projectId> --runtime");
     return;
   }
@@ -15632,7 +16032,7 @@ async function runRuntimeLogs(opts) {
     await streamRuntime(
       apiUrl,
       token,
-      project,
+      target,
       {
         onLine: ({ stream, line }) => {
           const out = stream === "stderr" ? process.stderr : process.stdout;
@@ -15640,7 +16040,11 @@ async function runRuntimeLogs(opts) {
 `);
         }
       },
-      { ...opts.since ? { since: opts.since } : {}, signal: controller.signal }
+      {
+        ...opts.since ? { since: opts.since } : {},
+        signal: controller.signal,
+        ...isDeployment ? { resource: "deployment" } : {}
+      }
     );
   } catch (err) {
     reportError(err);
@@ -15829,6 +16233,35 @@ async function runRollback(opts) {
     reportError(err);
   }
 }
+async function runRedeploy(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd redeploy <projectId>");
+    return;
+  }
+  try {
+    const { deploymentId, redeployedCommit, note } = await redeployProject(
+      apiUrl,
+      token,
+      project
+    );
+    process.stdout.write(
+      `Redeploying ${redeployedCommit.slice(0, 7)} \u2192 ${deploymentId}
+${note}
+`
+    );
+    await followDeploy(apiUrl, token, deploymentId);
+  } catch (err) {
+    reportError(err);
+  }
+}
 async function runDbCreate(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -16043,7 +16476,420 @@ async function runStorageDetach(opts) {
     reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.2.0" : "0.0.0-dev";
+function splitKeyValue(spec) {
+  const eq = spec.indexOf("=");
+  if (eq === -1) return { key: spec };
+  return { key: spec.slice(0, eq), value: spec.slice(eq + 1) };
+}
+var NEXT_DEPLOY_NOTE = "This takes effect on your next deploy \u2014 run `kryd redeploy` to apply it now (no rebuild), or it lands on your next `kryd push`.\n";
+var NEXT_BUILD_NOTE = `${BUILD_ENV_REBUILD_NOTE}
+`;
+var ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T/;
+function isoDate(value) {
+  if (!value || !ISO_TIMESTAMP.test(value)) return null;
+  const date5 = new Date(value);
+  if (Number.isNaN(date5.getTime())) return null;
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${date5.getFullYear()}-${pad(date5.getMonth() + 1)}-${pad(date5.getDate())}`;
+}
+function envAnnotation(environments) {
+  if (!environments || environments.length === 0) return "";
+  const prod = environments.includes("production");
+  const preview = environments.includes("preview");
+  if (prod && preview) return "  \u2192 preview override";
+  if (preview && !prod) return "  \u2192 preview only";
+  return "";
+}
+function renderEnvGroup(heading, vars, opts) {
+  const width = vars.reduce((max, v) => Math.max(max, v.key.length), 0);
+  const dates = opts.showUpdated ? vars.map((v) => isoDate(v.updatedAt)) : [];
+  const anyDate = dates.some((d) => d !== null);
+  const rows = vars.map((v, i) => {
+    const envNote = opts.showEnvironments ? envAnnotation(v.environments) : "";
+    if (!anyDate) return `  ${v.key}${envNote}
+`;
+    const updated = dates[i];
+    return `  ${v.key.padEnd(width)}  ${updated ? `updated ${updated}` : ""}${envNote}
+`.trimEnd() + "\n";
+  }).join("");
+  return `${heading}
+${rows}`;
+}
+async function runEnvList(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd env list <projectId>");
+    return;
+  }
+  try {
+    const vars = await listEnvVars(apiUrl, token, project);
+    if (vars.length === 0) {
+      process.stdout.write(
+        `No environment variables for ${project} yet.
+Set one with \`kryd env set KEY --stdin\`, or attach a database, storage or the AI gateway.
+`
+      );
+      return;
+    }
+    const byKey = (a, b) => a.key.localeCompare(b.key);
+    const buildVars = vars.filter((v) => v.scope === "build").sort(byKey);
+    const runtimeVars = vars.filter((v) => v.scope !== "build");
+    const mine = runtimeVars.filter((v) => v.source === "customer").sort(byKey);
+    const managed = runtimeVars.filter((v) => v.source === "managed").sort(byKey);
+    const other = runtimeVars.filter((v) => v.source !== "customer" && v.source !== "managed").sort(byKey);
+    let out = "";
+    if (mine.length > 0) {
+      out += renderEnvGroup(`Set by you (${mine.length})`, mine, {
+        showUpdated: true,
+        // Your customer vars can carry a preview override (runtime KRYD-159, build KRYD-215); annotate
+        // which ones do.
+        showEnvironments: true
+      });
+    }
+    if (managed.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Managed by Kryd (${managed.length}) \u2014 set when you attach a resource; not editable`,
+        managed,
+        // A managed row's timestamp is Kryd's own bookkeeping, not something the user did; showing
+        // it invites "why did my DATABASE_URL change today?".
+        { showUpdated: false }
+      );
+    }
+    if (other.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Other (${other.length}) \u2014 set by a newer version of Kryd; upgrade the CLI (\`npm install -g @kryd/cli\`) to see what they are`,
+        other,
+        { showUpdated: false }
+      );
+    }
+    if (buildVars.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Build-time (${buildVars.length}) \u2014 compiled into your public bundle`,
+        buildVars,
+        // Build vars are per-environment too now (KRYD-215) — annotate a preview override / preview-only
+        // build var, exactly as the runtime group does.
+        { showUpdated: true, showEnvironments: true }
+      );
+      out += `${BUILD_ENV_PUBLIC_WARNING}
+`;
+    }
+    out += "\nValues are never shown. This is the stored set \u2014 runtime changes reach your container at its next deploy (run `kryd redeploy` to apply them now)" + (buildVars.length > 0 ? ", and build-time changes at its next build.\n" : ".\n");
+    process.stdout.write(out);
+  } catch (err) {
+    reportError(err);
+  }
+}
+function toDotenvLine(key, value) {
+  const hasNewline = /[\n\r]/.test(value);
+  const needsQuote = hasNewline || value === "" || value !== value.trim() || value.includes("#") || /^["'`]/.test(value);
+  if (!needsQuote) return `${key}=${value}`;
+  if (!hasNewline && !value.includes("'")) return `${key}='${value}'`;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+  return `${key}="${escaped}"`;
+}
+async function runEnvPull(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd env pull <projectId>");
+    return;
+  }
+  const environment = opts.preview ? "preview" : "production";
+  const cwd = opts.cwd ?? process.cwd();
+  const root = findProjectLinkDir(cwd) ?? cwd;
+  const outRel = opts.out ?? ".env.kryd";
+  const outPath = resolve(root, outRel);
+  if (opts.out !== void 0 && existsSync3(outPath) && !opts.force) {
+    process.stderr.write(
+      `Refusing to overwrite ${outRel} \u2014 pass --force to replace it (or omit --out to write .env.kryd).
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const { values } = await pullEnvValues(apiUrl, token, project, environment);
+    const entries = Object.entries(values).sort(
+      ([a], [b]) => a.localeCompare(b)
+    );
+    const header = `# Written by \`kryd env pull\` \u2014 your customer-set variables for ${project} (${environment}).
+# Regenerate with \`kryd env pull\`. Do not commit this file.
+`;
+    const body = entries.map(([k, v]) => toDotenvLine(k, v)).join("\n");
+    const rel = relative(root, outPath);
+    const insideRoot = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    const added = insideRoot ? ensureIgnored(root, rel) : false;
+    writeSecretFile(outPath, body.length > 0 ? `${header}
+${body}
+` : header);
+    const count = entries.length;
+    process.stdout.write(
+      count === 0 ? `No customer environment variables for ${project} (${environment}) \u2014 wrote an empty ${outRel}.
+` : `Wrote ${count} variable${count === 1 ? "" : "s"} to ${outRel} (${environment}), mode 0600.
+`
+    );
+    if (added) process.stdout.write(`Added ${rel} to .gitignore.
+`);
+    if (!insideRoot)
+      process.stderr.write(
+        `Warning: ${outRel} is outside the project root \u2014 NOT added to .gitignore. Make sure you don't commit it.
+`
+      );
+    process.stdout.write(
+      "These are your own values, read back from Kryd. Managed values (DATABASE_URL, storage, the AI gateway) are never pulled.\n"
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function resolveEnvValue(inline, opts) {
+  if (opts.stdin && inline !== void 0) {
+    return {
+      error: "Pass the value with --stdin OR as KEY=VALUE, not both \u2014 it is ambiguous which one you meant."
+    };
+  }
+  if (opts.stdin) {
+    if (isInteractive(opts.io)) {
+      return {
+        error: `--stdin expects a value on standard input, but nothing is piped in (e.g. \`\u2026 | kryd env set ${opts.key} --stdin\`). To type it instead, run \`kryd env set ${opts.key}\` \u2014 you will be prompted, and nothing is echoed.`
+      };
+    }
+    const read = await readAll(opts.io.input, ENV_VAR_VALUE_MAX_BYTES + 1);
+    if ("tooLarge" in read) {
+      return {
+        error: `That value is larger than the ${ENV_VAR_VALUE_MAX_BYTES}-byte limit for an environment variable.`
+      };
+    }
+    return { value: stripOneTrailingNewline(read.value) };
+  }
+  if (inline !== void 0) {
+    if (inline.length > 0) {
+      process.stderr.write(
+        `tip: a value in \`KEY=VALUE\` is visible in \`ps\` and is saved to your shell history. For a secret, pipe it (\`kryd env set ${opts.key} --stdin\`) or omit the value to be prompted.
+`
+      );
+    }
+    return { value: inline };
+  }
+  if (!isInteractive(opts.io)) {
+    return {
+      error: `No value given for ${opts.key}, and there is no terminal to prompt on. Pipe it with \`kryd env set ${opts.key} --stdin\`.`
+    };
+  }
+  const typed = await promptHidden(`Value for ${opts.key} (not echoed): `, opts.io);
+  if (typed === null) return { aborted: true };
+  return { value: typed };
+}
+async function runEnvSet(opts) {
+  const scope = opts.build ? "build" : "runtime";
+  const environment = opts.preview ? "preview" : "production";
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd env set KEY=VALUE <projectId>");
+    return;
+  }
+  if (!opts.spec) {
+    process.stderr.write(
+      "Which variable? e.g. `kryd env set MY_API_KEY --stdin` or `kryd env set FEATURE_X=on`.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const { key, value: inline } = splitKeyValue(opts.spec);
+  const nameError = validateEnvVarName(key);
+  if (nameError) {
+    process.stderr.write(`${nameError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    const buildNameError = validateBuildEnvVarName(key);
+    if (buildNameError) {
+      process.stderr.write(`${buildNameError}
+`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const io = opts.io ?? defaultPromptIO();
+  const resolved = await resolveEnvValue(inline, {
+    ...opts.stdin !== void 0 ? { stdin: opts.stdin } : {},
+    io,
+    key
+  });
+  if ("aborted" in resolved) {
+    process.stderr.write(`Aborted \u2014 ${key} was not set.
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if ("error" in resolved) {
+    process.stderr.write(`${resolved.error}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  const valueError = validateEnvVarValue(resolved.value);
+  if (valueError) {
+    process.stderr.write(`${valueError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    const buildValueError = validateBuildEnvVarValue(resolved.value);
+    if (buildValueError) {
+      process.stderr.write(`${buildValueError}
+`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  try {
+    const written = await setEnvVar(
+      apiUrl,
+      token,
+      project,
+      key,
+      resolved.value,
+      scope,
+      environment
+    );
+    const envTag = environment === "preview" ? " (preview)" : "";
+    process.stdout.write(
+      `${written.created ? "Set" : "Updated"} ${written.key}${scope === "build" ? " (build-time)" : envTag} for ${project}.
+` + // The public-bundle warning comes FIRST, before the applies-when note. Someone who reads one
+      // line of output should read the consequential one.
+      (scope === "build" ? `${BUILD_ENV_PUBLIC_WARNING}
+${NEXT_BUILD_NOTE}` : NEXT_DEPLOY_NOTE)
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runEnvRemove(opts) {
+  const scope = opts.build ? "build" : "runtime";
+  const environment = opts.preview ? "preview" : "production";
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project = resolveProjectId(opts.project, opts.cwd);
+  if (!project) {
+    reportNotLinked("kryd env rm KEY <projectId>");
+    return;
+  }
+  const key = opts.key;
+  if (!key) {
+    process.stderr.write("Which variable? e.g. `kryd env rm MY_API_KEY`.\n");
+    process.exitCode = 1;
+    return;
+  }
+  if (!ENV_VAR_NAME_PATTERN.test(key)) {
+    process.stderr.write(
+      "Environment variable names must match ^[A-Za-z_][A-Za-z0-9_]*$ \u2014 a letter or underscore, then letters, digits or underscores.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (isReservedEnvVarName(key)) {
+    process.stderr.write(
+      `${key} is reserved by Kryd and cannot be removed here.
+If it comes from a resource you attached, detach that instead (\`kryd db detach\`, \`kryd storage detach\`).
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const nameError = validateEnvVarName(key);
+  if (nameError) {
+    process.stderr.write(`${nameError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    try {
+      const vars = await listEnvVars(apiUrl, token, project, "build");
+      if (!vars.some((v) => v.key === key && v.scope === "build")) {
+        process.stderr.write(
+          `${key} is not set as a build-time variable on ${project}.
+Run \`kryd env list\` to see what is set. (If you meant the runtime variable of that name, drop --build.)
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+    } catch (err) {
+      reportError(err);
+      return;
+    }
+  }
+  if (!opts.yes) {
+    const io = opts.io ?? defaultPromptIO();
+    if (!isInteractive(io)) {
+      process.stderr.write(
+        `Refusing to remove ${key} without confirmation. Re-run with --yes to confirm non-interactively.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const confirmed = await promptConfirm(
+      scope === "build" ? `Remove the build-time variable ${key} from ${project}? Your next build will not have it (the current image still does).` : environment === "preview" ? `Remove the preview override for ${key} on ${project}? Previews will revert to inheriting the production value.` : `Remove ${key} from ${project}? Its stored value (production and any preview override) is deleted and cannot be recovered.`,
+      io
+    );
+    if (!confirmed) {
+      process.stdout.write(`Left ${key} in place.
+`);
+      return;
+    }
+  }
+  try {
+    const removed = await removeEnvVar(apiUrl, token, project, key, scope, environment);
+    const envTag = environment === "preview" ? " (preview override)" : "";
+    process.stdout.write(
+      `Removed ${removed.key}${scope === "build" ? " (build-time)" : envTag} from ${project}.
+` + // The build-scope warning is deliberately bleaker than the runtime one, because the truth is.
+      // A runtime value is gone from the container at the next deploy. A build-time value is
+      // COMPILED INTO the live image and into every bundle already downloaded from it — removing
+      // it stops future builds baking it in and does nothing else. Someone removing a value they
+      // now realise was sensitive must not read "removed" as "contained".
+      (scope === "build" ? "\u26A0 This does not un-publish it. The value is already compiled into the live image and into every bundle served from it \u2014 rotate it at the provider, then push a commit to rebuild without it.\n" : `\u26A0 Your running container still has the old value until your next deploy \u2014 run \`kryd redeploy\` to apply the removal now (no rebuild), or it lands on your next \`kryd push\`.
+`)
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+var CLI_VERSION = true ? "0.2.1" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
@@ -16054,16 +16900,16 @@ program.command("whoami").description("Show the current account").option("--api-
 program.command("logout").description("Clear the stored token").action(() => runLogout());
 program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
-  "react-router | nextjs | vite-spa (auto-detected if omitted)"
+  "react-router | nextjs | vite-spa | node (auto-detected if omitted)"
 ).option(
   "--tenant <slug>",
   "your tenant slug (claimed once on first init \u2014 appears in every deploy URL)"
 ).option("--api-url <url>", "control-plane API base URL").action((opts) => runInit(opts));
 program.command("logs [target]").description(
-  "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: the project's live-app runtime logs ([target]=project id)."
+  "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: a container's stdout/stderr \u2014 [target]=a project id tails its live app, a deployment id (dpl_\u2026) tails THAT deploy's container (incl. a failed one, to see why it crashed)."
 ).option(
   "--runtime",
-  "stream the live container's runtime stdout/stderr (the running app) instead of build/deploy logs"
+  "stream a container's runtime stdout/stderr instead of build/deploy logs \u2014 the live app (project id) or one deploy's container (dpl_ id)"
 ).option(
   "--since <dur>",
   "with --runtime: backfill this window before going live (e.g. 30m, 2h, 1d; max 7d)"
@@ -16079,6 +16925,9 @@ program.command("deploy [project]").description("Trigger a deploy of the project
 program.command("rollback [project] [deployment]").description("Roll back to a previous successful deploy (no rebuild) and follow it live").option("--api-url <url>", "control-plane API base URL").action(
   (project, deployment, opts) => runRollback({ ...opts, project, deployment })
 );
+program.command("redeploy [project]").description(
+  "Redeploy the current live commit (no rebuild) to apply config/env changes, and follow it live"
+).option("--api-url <url>", "control-plane API base URL").action((project, opts) => runRedeploy({ ...opts, project }));
 var db = program.command("db").description("Manage project databases");
 db.command("create [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
   "--connection-string <url>",
@@ -16088,6 +16937,36 @@ db.command("detach [project]").description("Tear down the project's database and
 var storage = program.command("storage").description("Manage project object storage");
 storage.command("create [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runStorageCreate({ ...opts, project }));
 storage.command("detach [project]").description("Tear down the project's object storage and reclaim its credentials").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runStorageDetach({ ...opts, project }));
+var env = program.command("env").description("Manage your app's environment variables");
+env.command("list [project]").description("List the project's environment variables (names and origin \u2014 never values)").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runEnvList({ ...opts, project }));
+env.command("set <key> [project]").description(
+  "Set one of your environment variables \u2014 `KEY=VALUE`, or `KEY` with --stdin / a prompt"
+).option(
+  "--stdin",
+  "read the value from a pipe instead of the argument (a value in `KEY=VALUE` is visible in `ps` and saved to your shell history); one trailing newline is stripped, and this is the only way to set a multi-line value"
+).option(
+  "--build",
+  "set it as a BUILD-TIME variable, for `import.meta.env` / `process.env` while your bundler runs (VITE_*, NEXT_PUBLIC_*, PUBLIC_*, \u2026). The value is compiled into your public bundle, so it must not be a secret, and it takes effect at your next build rather than your next deploy"
+).option(
+  "--preview",
+  "set the value for PREVIEW deploys only \u2014 an override that shadows production for previews (without it, a set targets production, which previews inherit)"
+).option("--api-url <url>", "control-plane API base URL").action((key, project, opts) => runEnvSet({ ...opts, spec: key, project }));
+env.command("rm <key> [project]").description("Remove one of your environment variables (asks for confirmation)").option("--yes", "skip the confirmation prompt (required when there is no terminal)").option(
+  "--build",
+  "remove the build-time variable of this name rather than the runtime one (the same name can exist as both)"
+).option(
+  "--preview",
+  "remove only the PREVIEW override, reverting previews to inheriting production (without it, the whole key is removed \u2014 production and any preview override)"
+).option("--api-url <url>", "control-plane API base URL").action((key, project, opts) => runEnvRemove({ ...opts, key, project }));
+env.command("pull [project]").description(
+  "Write your customer-set environment variables (values included) to a local .env file for development"
+).option(
+  "--preview",
+  "pull the values a PREVIEW deploy would see (preview overrides plus inherited production), instead of production"
+).option(
+  "--out <path>",
+  "file to write, relative to the project root (default: .env.kryd \u2014 never your hand-maintained .env)"
+).option("--force", "overwrite the --out file if it already exists").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runEnvPull({ ...opts, project }));
 var ai = program.command("ai").description("Manage the app's EU AI gateway");
 ai.command("enable [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runAiEnable({ ...opts, project }));
 if (import.meta.url === `file://${process.argv[1]}`) {
@@ -16105,14 +16984,20 @@ export {
   runDbCreate,
   runDbDetach,
   runDeploy,
+  runEnvList,
+  runEnvPull,
+  runEnvRemove,
+  runEnvSet,
   runInit,
   runLogin,
   runLogout,
   runLogs,
   runPush,
+  runRedeploy,
   runRollback,
   runRuntimeLogs,
   runStorageCreate,
   runStorageDetach,
-  runWhoami
+  runWhoami,
+  splitKeyValue
 };

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "@kryd/cli",
-  "version": "0.2.0",
-  "description": "Kryd CLI — push a React / Vite / Next.js app to the effortless EU-sovereign deploy stack on Scaleway: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in.",
+  "version": "0.2.1",
+  "description": "Kryd CLI — push a React / Vite / Next.js app to the European cloud for your AI: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in. Your code and your model calls stay in the EU.",
   "keywords": [
     "kryd",
     "deploy",
-    "scaleway",
     "eu-sovereign",
     "paas",
     "cli",