@kryd/cli 0.2.0 → 0.3.0

package/dist/index.js

@@ -88,6 +88,69 @@ var PRODUCTION_TLD = "kryd.cloud";
 var PREVIEW_TLD = "kryd.dev";
 var TENANT_SLUG_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_TENANT_SLUG - 2}}[a-z0-9])?$`);
 
+// ../../packages/shared-types/dist/reserved-slugs.js
+var FORGEJO_RESERVED_USERNAMES = [
+  ".",
+  "..",
+  "-",
+  ".well-known",
+  "api",
+  "metrics",
+  "v2",
+  "assets",
+  "attachments",
+  "avatar",
+  "avatars",
+  "repo-avatars",
+  "captcha",
+  "login",
+  "org",
+  "repo",
+  "user",
+  "admin",
+  "explore",
+  "issues",
+  "pulls",
+  "milestones",
+  "notifications",
+  "report_abuse",
+  "favicon.ico",
+  "manifest.json",
+  "robots.txt",
+  "sitemap.xml",
+  "ssh_info",
+  "swagger.v1.json",
+  "ghost",
+  "gitea-actions",
+  "forgejo-actions"
+];
+var PLATFORM_RESERVED_SLUGS = [
+  "kryd",
+  "krydhq",
+  "www",
+  "api",
+  "app",
+  "ai",
+  "docs",
+  "forge",
+  "admin",
+  "console",
+  "status",
+  "mail",
+  "support",
+  "billing",
+  "account",
+  "accounts",
+  "static",
+  "assets",
+  "cdn",
+  "dashboard"
+];
+var RESERVED = /* @__PURE__ */ new Set([
+  ...FORGEJO_RESERVED_USERNAMES,
+  ...PLATFORM_RESERVED_SLUGS
+]);
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -14637,6 +14700,143 @@ var accountUsageSchema = external_exports.object({
   storageBytes: external_exports.number().int().nonnegative()
 });
 
+// ../../packages/shared-types/dist/env-vars.js
+var MANAGED_ENV_VAR_NAMES = [
+  "AI_GATEWAY_TOKEN",
+  "AI_GATEWAY_URL",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_ENDPOINT_URL_S3",
+  "AWS_REGION",
+  "AWS_SECRET_ACCESS_KEY",
+  "BUCKET_NAME",
+  "DATABASE_URL",
+  "DEPLOY_TOKEN",
+  "FORGE_PASSWORD",
+  "PUSH_TOKEN",
+  "WEBHOOK_SECRET"
+];
+var PLATFORM_ENV_VAR_NAMES = ["PATH", "PORT"];
+var RESERVED_ENV_VAR_NAMES = [
+  ...MANAGED_ENV_VAR_NAMES,
+  ...PLATFORM_ENV_VAR_NAMES
+];
+var RESERVED_ENV_VAR_PREFIX = "KRYD_";
+var ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ENV_VAR_NAME_MAX_LENGTH = 128;
+var ENV_VAR_VALUE_MAX_BYTES = 16 * 1024;
+function validateEnvVarName(name) {
+  if (name.length === 0)
+    return "An environment variable name is required.";
+  if (name.length > ENV_VAR_NAME_MAX_LENGTH) {
+    return `Environment variable names may be at most ${ENV_VAR_NAME_MAX_LENGTH} characters.`;
+  }
+  if (!ENV_VAR_NAME_PATTERN.test(name)) {
+    return "Environment variable names must match ^[A-Za-z_][A-Za-z0-9_]*$ \u2014 a letter or underscore, then letters, digits or underscores.";
+  }
+  if (isReservedEnvVarName(name)) {
+    return `"${name}" is reserved by Kryd and is set for you when you attach the matching resource \u2014 choose another name.`;
+  }
+  return null;
+}
+function isReservedEnvVarName(name) {
+  const upper = name.toUpperCase();
+  return RESERVED_ENV_VAR_NAMES.includes(upper) || upper.startsWith(RESERVED_ENV_VAR_PREFIX);
+}
+function validateEnvVarValue(value) {
+  if (value.length === 0) {
+    return "An environment variable value is required (an empty value cannot be stored).";
+  }
+  if (value.trim().length === 0) {
+    return "An environment variable value cannot be only whitespace.";
+  }
+  if (value.includes("\0")) {
+    return "Environment variable values may not contain NUL bytes.";
+  }
+  const bytes = new TextEncoder().encode(value).length;
+  if (bytes > ENV_VAR_VALUE_MAX_BYTES) {
+    return `Environment variable values may be at most ${ENV_VAR_VALUE_MAX_BYTES} bytes (got ${bytes}).`;
+  }
+  return null;
+}
+
+// ../../packages/shared-types/dist/build-env-vars.js
+var PUBLIC_BUILD_ENV_PREFIXES = [
+  "ASTRO_PUBLIC_",
+  "EXPO_PUBLIC_",
+  "GATSBY_",
+  "NEXT_PUBLIC_",
+  "NUXT_PUBLIC_",
+  "PUBLIC_",
+  "REACT_APP_",
+  "VITE_"
+];
+var SECRET_NAME_WORDS = [
+  "SECRET",
+  "PASSWORD",
+  "PASSWD",
+  "PASSPHRASE",
+  "PRIVATE_KEY",
+  "PRIVATEKEY",
+  "CREDENTIAL"
+];
+var SECRET_VALUE_SHAPES = [
+  { prefix: "sk_live_", label: "a Stripe secret key" },
+  { prefix: "sk_test_", label: "a Stripe test secret key" },
+  { prefix: "rk_live_", label: "a Stripe restricted key" },
+  { prefix: "rk_test_", label: "a Stripe restricted test key" },
+  { prefix: "ghp_", label: "a GitHub personal access token" },
+  { prefix: "gho_", label: "a GitHub OAuth token" },
+  { prefix: "ghs_", label: "a GitHub app token" },
+  { prefix: "github_pat_", label: "a GitHub fine-grained token" },
+  { prefix: "xoxb-", label: "a Slack bot token" },
+  { prefix: "xoxp-", label: "a Slack user token" },
+  { prefix: "xoxs-", label: "a Slack app token" }
+];
+var PEM_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+var URL_WITH_CREDENTIALS_PATTERN = /[a-z][a-z0-9+.-]*:\/\/[^/@\s:]*:[^/@\s]+@/i;
+var NEWLINE_PATTERN = /[\n\r]/;
+var BUILD_ENV_VAR_VALUE_MAX_BYTES = 4 * 1024;
+function hasPublicBuildPrefix(name) {
+  return PUBLIC_BUILD_ENV_PREFIXES.some((p) => name.startsWith(p));
+}
+function publicBuildPrefixList() {
+  return PUBLIC_BUILD_ENV_PREFIXES.join(", ");
+}
+function validateBuildEnvVarName(name) {
+  if (!hasPublicBuildPrefix(name)) {
+    return `Build-time variables are compiled into your app's public bundle, so their names must start with one of: ${publicBuildPrefixList()} \u2014 the prefixes bundlers use for values they will expose to the browser. "${name}" has none of them. If it is a secret, set it as a runtime variable instead (drop --build); if it really is public, rename it (e.g. VITE_${name}).`;
+  }
+  const upper = name.toUpperCase();
+  const word = SECRET_NAME_WORDS.find((w) => upper.includes(w));
+  if (word) {
+    return `"${name}" contains "${word}", and a build-time value is compiled into your public bundle where anyone can read it. Set it as a runtime variable instead (drop --build) \u2014 runtime values are stored in Scaleway Secret Manager and injected into the container, never into the bundle.`;
+  }
+  return null;
+}
+function validateBuildEnvVarValue(value) {
+  const bytes = new TextEncoder().encode(value).length;
+  if (bytes > BUILD_ENV_VAR_VALUE_MAX_BYTES) {
+    return `Build-time values may be at most ${BUILD_ENV_VAR_VALUE_MAX_BYTES} bytes (got ${bytes}) \u2014 they are passed to the build host as command-line arguments. A value this large is almost certainly a key or a certificate, which must not be compiled into a public bundle: set it as a runtime variable instead (drop --build).`;
+  }
+  const trimmed = value.trim();
+  const shape = SECRET_VALUE_SHAPES.find((s) => trimmed.includes(s.prefix));
+  if (shape) {
+    return `That value looks like ${shape.label}. Build-time values are compiled into your app's public bundle \u2014 publishing it would mean rotating it immediately. Set it as a runtime variable instead (drop --build).`;
+  }
+  if (PEM_PRIVATE_KEY_PATTERN.test(value)) {
+    return "That value contains a PEM private key. Build-time values are compiled into your app's public bundle, so it would be published to every visitor. Set it as a runtime variable instead (drop --build).";
+  }
+  if (URL_WITH_CREDENTIALS_PATTERN.test(value)) {
+    return "That value is a URL with a username and password in it (for example a database connection string). Build-time values are compiled into your app's public bundle, so those credentials would be published to every visitor. Set it as a runtime variable instead (drop --build), or use a URL without embedded credentials.";
+  }
+  if (NEWLINE_PATTERN.test(value)) {
+    return "Build-time values cannot contain line breaks: they are passed to the build as a single command-line argument, and the builder reads only the first line \u2014 the rest would be dropped silently and your app would receive a truncated value. Remove the line break if it is a stray one (a trailing newline from a paste or a file is the usual cause), or set it as a runtime variable instead (drop --build) \u2014 runtime values take a different route (Scaleway Secret Manager \u2192 the container's environment) and keep line breaks intact.";
+  }
+  return null;
+}
+var BUILD_ENV_PUBLIC_WARNING = "\u26A0 Build-time values are compiled into your app's public bundle \u2014 anyone who loads your site can read them. Never put a secret here.";
+var BUILD_ENV_REBUILD_NOTE = "This takes effect at your next BUILD, not your next deploy \u2014 the value is compiled into the image, so redeploying the existing image keeps the old value. Push a commit (`kryd push`) to rebuild.";
+
 // ../../packages/shared-types/dist/index.js
 var TERMINAL_DEPLOY_STATES = [
   "live",
@@ -14658,6 +14858,10 @@ function isTerminalResourceStatus(status) {
   return status === "ready" || status === "failed";
 }
 
+// src/index.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+
 // src/config.ts
 import {
   appendFileSync,
@@ -14665,6 +14869,7 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  rmSync,
   writeFileSync
 } from "node:fs";
 import { homedir } from "node:os";
@@ -14759,19 +14964,39 @@ function saveProjectLink(cwd, link) {
   writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
   return path;
 }
-function ensureKrydIgnored(cwd) {
+function ensureIgnored(cwd, entry, aliases = []) {
   const path = join(cwd, ".gitignore");
-  const entry = `${PROJECT_LINK_DIR}/`;
   let current = "";
   try {
     current = readFileSync(path, "utf8");
   } catch {
   }
-  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || l === PROJECT_LINK_DIR);
-  if (present) return;
+  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
+  if (present) return false;
   const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
   appendFileSync(path, `${prefix}${entry}
 `);
+  return true;
+}
+function ensureKrydIgnored(cwd) {
+  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
+}
+function writeSecretFile(path, contents) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, contents, { mode: 384 });
+  chmodSync(path, 384);
+}
+function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return false;
+  const link = loadProjectLink(cwd);
+  if (link?.projectId !== projectId) return false;
+  try {
+    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
+    return true;
+  } catch {
+    return false;
+  }
 }
 function resolveProjectId(explicit, cwd = process.cwd()) {
   if (explicit) return explicit;
@@ -14796,7 +15021,7 @@ function browserLogin(dashboardUrl, opts = {}) {
   const state = randomUUID();
   const timeoutMs = opts.timeoutMs ?? 12e4;
   const shouldOpen = opts.open ?? true;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let settled = false;
     const settle = (fn) => {
       if (settled) return;
@@ -14826,7 +15051,7 @@ function browserLogin(dashboardUrl, opts = {}) {
       res.end(SUCCESS_HTML);
       settle(() => {
         server.close();
-        resolve({ token, ...apiUrl ? { apiUrl } : {} });
+        resolve2({ token, ...apiUrl ? { apiUrl } : {} });
       });
     });
     server.on("error", (err) => settle(() => reject(err)));
@@ -15092,6 +15317,49 @@ async function detachDatabase(apiUrl, token, projectId) {
     );
   }
 }
+async function getProject(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new ApiError(`Reading the project failed (${res.status})`, await parseEnvelope(res));
+  }
+  return await res.json();
+}
+async function deleteProject(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res));
+  }
+  return await res.json();
+}
+async function pollProjectDeleted(read, opts) {
+  const intervalMs = opts?.intervalMs ?? 2e3;
+  const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
+  const maxConsecutiveErrors = opts?.maxConsecutiveErrors ?? 5;
+  const sleep = opts?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const started = Date.now();
+  let consecutiveErrors = 0;
+  let last = null;
+  for (; ; ) {
+    try {
+      const project2 = await read();
+      consecutiveErrors = 0;
+      if (project2 === null) return { gone: true, status: null };
+      last = project2.status;
+      opts?.onTick?.(project2.status);
+      if (project2.status === "delete_failed") return { gone: false, status: last };
+    } catch (err) {
+      if (++consecutiveErrors >= maxConsecutiveErrors) throw err;
+    }
+    if (Date.now() - started >= timeoutMs) return { gone: false, status: last };
+    await sleep(intervalMs);
+  }
+}
 async function detachStorage(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/storage/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
@@ -15104,6 +15372,158 @@ async function detachStorage(apiUrl, token, projectId) {
     );
   }
 }
+async function listEnvVars(apiUrl, token, projectId, include = "all") {
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env?scope=${encodeURIComponent(include)}`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Listing environment variables failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || !Array.isArray(parsed.vars)) {
+    throw new ApiError("The API returned an unexpected environment response.");
+  }
+  return parsed.vars.map((raw) => {
+    if (typeof raw !== "object" || raw === null) {
+      throw new ApiError("The API returned an unexpected environment response.");
+    }
+    const entry = raw;
+    if (typeof entry.key !== "string" || entry.key.length === 0 || typeof entry.source !== "string") {
+      throw new ApiError("The API returned an unexpected environment response.");
+    }
+    return {
+      key: entry.key,
+      // Which environments hold an explicit value (KRYD-159). An api older than KRYD-159 omits it, and
+      // the renderer reads a missing/empty list as "one value, all environments" — the correct reading
+      // of its absence. Kept as strings without rejecting an unknown one, same tolerance as `source`.
+      ...Array.isArray(entry.environments) ? {
+        environments: entry.environments.filter(
+          (e) => e === "production" || e === "preview"
+        )
+      } : {},
+      // Deliberately NOT rejected when it is outside `SECRET_SOURCES`. `SecretSource` is branded
+      // plain text precisely so the value set can grow without a migration, and the CLI is published
+      // to npm — so an installed copy is routinely older than the api. Rejecting an unrecognised
+      // source would make one new row break `kryd env list` entirely, including for the variables
+      // the user set themselves. The renderer groups anything it does not recognise instead. The
+      // malformed-body guard still holds: a proxy error page has no `vars` array at all.
+      source: entry.source,
+      // Same tolerance, same reason (KRYD-156): an api older than this CLI omits `scope` entirely,
+      // and every row such an api can return IS a runtime var — so the absent field has one correct
+      // reading. An unrecognised NEW scope is passed through rather than rejected, and the renderer
+      // groups it under "other" instead of dropping the variable from the listing.
+      scope: typeof entry.scope === "string" ? entry.scope : "runtime",
+      // The contract types `updatedAt` as nullable precisely so a missing timestamp is rendered
+      // rather than assumed — normalise anything non-string to `null` instead of failing.
+      updatedAt: typeof entry.updatedAt === "string" ? entry.updatedAt : null
+    };
+  });
+}
+async function pullEnvValues(apiUrl, token, projectId, environment = "production") {
+  const query = environment === "production" ? "" : `?environment=${encodeURIComponent(environment)}`;
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/values${query}`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Pulling environment values failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.values !== "object" || parsed.values === null || Array.isArray(parsed.values)) {
+    throw new ApiError("The API returned an unexpected environment-values response.");
+  }
+  const values = {};
+  for (const [key, value] of Object.entries(
+    parsed.values
+  )) {
+    if (typeof value !== "string") {
+      throw new ApiError("The API returned an unexpected environment-values response.");
+    }
+    values[key] = value;
+  }
+  return {
+    environment: parsed.environment === "preview" ? "preview" : "production",
+    values
+  };
+}
+async function setEnvVar(apiUrl, token, projectId, key, value, scope = "runtime", environment = "production") {
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env`,
+    {
+      method: "PUT",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${token}`
+      },
+      // `scope`/`environment` are sent only when NOT their defaults. An api older than KRYD-156/159
+      // ignores unknown body fields, so this is belt-and-braces — but it keeps a plain runtime
+      // production request byte-identical to the one KRYD-157 shipped.
+      body: JSON.stringify({
+        key,
+        value,
+        ...scope === "runtime" ? {} : { scope },
+        ...environment === "production" ? {} : { environment }
+      })
+    }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Setting ${key} failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  const expected = scope === "build" ? "appliesAtNextBuild" : "appliesAtNextDeploy";
+  if (!parsed || typeof parsed.key !== "string" || typeof parsed.created !== "boolean" || parsed[expected] !== true) {
+    throw new ApiError(
+      scope === "build" ? `The API returned an unexpected environment response \u2014 it may be an older version that does not support build-time variables. If so it has stored "${key}" as a RUNTIME variable instead: check with \`kryd env list\` and remove it with \`kryd env rm ${key}\` if you did not want that.` : "The API returned an unexpected environment response."
+    );
+  }
+  return {
+    key: parsed.key,
+    created: parsed.created,
+    appliesAtNextDeploy: scope !== "build",
+    appliesAtNextBuild: scope === "build"
+  };
+}
+async function removeEnvVar(apiUrl, token, projectId, key, scope = "runtime", environment = "production") {
+  const params = new URLSearchParams();
+  if (scope !== "runtime") params.set("scope", scope);
+  if (environment !== "production") params.set("environment", environment);
+  const query = params.toString() ? `?${params.toString()}` : "";
+  const res = await fetch(
+    `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(key)}${query}`,
+    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Removing ${key} failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (scope === "build" && parsed?.appliesAtNextBuild !== true) {
+    throw new ApiError(
+      `Could not confirm that the build-time variable "${key}" was removed. The API may be an older version that does not support build-time variables \u2014 in which case it has removed the RUNTIME variable "${key}" instead. Run \`kryd env list\` to see what is actually set.`
+    );
+  }
+  return {
+    key: typeof parsed?.key === "string" ? parsed.key : key,
+    appliesAtNextDeploy: scope !== "build",
+    appliesAtNextBuild: scope === "build"
+  };
+}
 async function triggerDeploy(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/deployments`, {
     method: "POST",
@@ -15135,6 +15555,20 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
   }
   return await res.json();
 }
+async function redeployProject(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/deployments/redeploy`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ projectId })
+  });
+  if (!res.ok) {
+    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res));
+  }
+  return await res.json();
+}
 async function listDeployments(apiUrl, token, projectId) {
   const url2 = new URL(`${apiUrl}/deployments`);
   if (projectId) url2.searchParams.set("projectId", projectId);
@@ -15196,14 +15630,14 @@ async function* readSseFrames(body) {
 }
 function abortableSleep(ms, signal) {
   if (signal?.aborted) return Promise.resolve();
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const onAbort = () => {
       clearTimeout(timer);
-      resolve();
+      resolve2();
     };
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -15246,13 +15680,14 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
   }
   return terminal;
 }
-async function streamRuntime(apiUrl, token, projectId, handlers, opts = {}) {
+async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
+  const basePath = opts.resource === "deployment" ? "deployments" : "projects";
   const doFetch = opts.fetchImpl ?? fetch;
   const reconnectMs = opts.reconnectMs ?? 1e3;
   let afterNs;
   while (!opts.signal?.aborted) {
     try {
-      const url2 = new URL(`${apiUrl}/projects/${projectId}/runtime-logs`);
+      const url2 = new URL(`${apiUrl}/${basePath}/${id}/runtime-logs`);
       if (afterNs) url2.searchParams.set("after", afterNs);
       else if (opts.since) url2.searchParams.set("since", opts.since);
       const res = await doFetch(url2, {
@@ -15286,7 +15721,12 @@ async function streamRuntime(apiUrl, token, projectId, handlers, opts = {}) {
 // src/framework.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { basename, join as join2 } from "node:path";
-var FRAMEWORKS = ["react-router", "nextjs", "vite-spa"];
+var FRAMEWORKS = [
+  "react-router",
+  "nextjs",
+  "vite-spa",
+  "node"
+];
 function isFramework(value) {
   return FRAMEWORKS.includes(value);
 }
@@ -15300,6 +15740,7 @@ var VITE_META_FRAMEWORKS = [
   "@builder.io/qwik-city",
   "vike"
 ];
+var SERVER_FRAMEWORKS = ["hono", "express", "fastify", "koa"];
 function readPackageJson(cwd) {
   try {
     return JSON.parse(readFileSync2(join2(cwd, "package.json"), "utf8"));
@@ -15315,6 +15756,7 @@ function frameworkFrom(pkg, cwd) {
     return "react-router";
   }
   if (VITE_META_FRAMEWORKS.some(has)) return null;
+  if (SERVER_FRAMEWORKS.some(has)) return "node";
   if (has("vite")) return "vite-spa";
   return null;
 }
@@ -15326,6 +15768,94 @@ function inspectProject(cwd) {
   return { framework: frameworkFrom(pkg, cwd), name: nameFrom(pkg, cwd) };
 }
 
+// src/input.ts
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+function defaultPromptIO() {
+  return {
+    input: process.stdin,
+    output: process.stderr,
+    isTTY: Boolean(process.stdin.isTTY) && Boolean(process.stderr.isTTY)
+  };
+}
+function isInteractive(io) {
+  if (io.isTTY !== void 0) return io.isTTY;
+  const output = io.output;
+  return Boolean(io.input.isTTY) && Boolean(output.isTTY);
+}
+async function readAll(input, maxBytes) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of input) {
+    const buf = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+    bytes += buf.length;
+    if (maxBytes !== void 0 && bytes > maxBytes) return { tooLarge: true };
+    chunks.push(buf);
+  }
+  return { value: Buffer.concat(chunks).toString("utf8") };
+}
+function stripOneTrailingNewline(value) {
+  if (value.endsWith("\r\n")) return value.slice(0, -2);
+  if (value.endsWith("\n")) return value.slice(0, -1);
+  return value;
+}
+async function promptHidden(question, io) {
+  io.output.write(question);
+  const restore = () => {
+    const tty = io.input;
+    if (tty.isTTY) tty.setRawMode?.(false);
+  };
+  process.once("SIGTERM", restore);
+  process.once("SIGHUP", restore);
+  const sink = new Writable({
+    write(_chunk, _encoding, callback) {
+      callback();
+    }
+  });
+  const rl = createInterface({
+    input: io.input,
+    output: sink,
+    terminal: true
+  });
+  try {
+    return await new Promise((resolve2) => {
+      rl.once("SIGINT", () => resolve2(null));
+      rl.once("close", () => resolve2(null));
+      rl.question("", (answer) => resolve2(answer));
+    });
+  } finally {
+    rl.close();
+    process.off("SIGTERM", restore);
+    process.off("SIGHUP", restore);
+    io.output.write("\n");
+  }
+}
+async function promptLine(question, io) {
+  const rl = createInterface({ input: io.input, output: io.output });
+  try {
+    return await new Promise((resolve2) => {
+      rl.once("SIGINT", () => resolve2(null));
+      rl.once("close", () => resolve2(null));
+      rl.question(question, (answer) => resolve2(answer));
+    });
+  } finally {
+    rl.close();
+  }
+}
+async function promptConfirm(question, io) {
+  const rl = createInterface({ input: io.input, output: io.output });
+  try {
+    const answer = await new Promise((resolve2) => {
+      rl.once("SIGINT", () => resolve2(null));
+      rl.once("close", () => resolve2(null));
+      rl.question(`${question} [y/N] `, (a) => resolve2(a));
+    });
+    return answer !== null && /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+
 // src/git.ts
 import { execFileSync, spawnSync } from "node:child_process";
 function authenticatedRemoteUrl(cloneUrl, username, token) {
@@ -15467,7 +15997,7 @@ async function runInit(opts) {
   if (opts.framework) {
     if (!isFramework(opts.framework)) {
       process.stderr.write(
-        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, or vite-spa.
+        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, vite-spa, or node.
 `
       );
       process.exitCode = 1;
@@ -15477,7 +16007,7 @@ async function runInit(opts) {
   } else {
     if (!detected.framework) {
       process.stderr.write(
-        "Could not detect a supported framework (React Router, Next.js, or a Vite SPA). Pass --framework <react-router|nextjs|vite-spa>.\n"
+        "Could not detect a supported framework (React Router, Next.js, a Vite SPA, or a Node service). Pass --framework <react-router|nextjs|vite-spa|node>.\n"
       );
       process.exitCode = 1;
       return;
@@ -15486,7 +16016,7 @@ async function runInit(opts) {
   }
   const name = opts.name ?? detected.name;
   try {
-    const { project, repo, pushToken } = await linkProject(apiUrl, token, {
+    const { project: project2, repo, pushToken } = await linkProject(apiUrl, token, {
       name,
       framework,
       // First `kryd init` for the account claims the tenant slug (the vanity routing key in
@@ -15496,7 +16026,7 @@ async function runInit(opts) {
     });
     let linkNote = "";
     try {
-      saveProjectLink(cwd, { projectId: project.id });
+      saveProjectLink(cwd, { projectId: project2.id });
       linkNote = "Linked this folder \u2192 .kryd/project.json \u2014 `kryd deploy` / `kryd logs` now work here with no id.\n";
       try {
         ensureKrydIgnored(cwd);
@@ -15508,7 +16038,7 @@ async function runInit(opts) {
       }
     } catch (linkErr) {
       process.stderr.write(
-        `warning: could not write .kryd/project.json (${linkErr instanceof Error ? linkErr.message : String(linkErr)}) \u2014 pass the project id explicitly, e.g. \`kryd deploy ${project.id}\`.
+        `warning: could not write .kryd/project.json (${linkErr instanceof Error ? linkErr.message : String(linkErr)}) \u2014 pass the project id explicitly, e.g. \`kryd deploy ${project2.id}\`.
 `
       );
     }
@@ -15541,9 +16071,9 @@ Install git (https://git-scm.com/downloads), then re-run \`kryd init\` here.
         break;
     }
     process.stdout.write(
-      `Linked "${name}" (${project.framework}) \u2192 ${repo.htmlUrl}
-Production URL: https://${project.subdomain}.${PRODUCTION_TLD}
-Preview branches deploy to https://<branch>-<hash>-${project.subdomain}.${PREVIEW_TLD}
+      `Linked "${name}" (${project2.framework}) \u2192 ${repo.htmlUrl}
+Production URL: https://${project2.subdomain}.${PRODUCTION_TLD}
+Preview branches deploy to https://<branch>-<hash>-${project2.subdomain}.${PREVIEW_TLD}
 ${linkNote}
 ${nextStep}`
     );
@@ -15612,8 +16142,9 @@ async function runRuntimeLogs(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const isDeployment = opts.project?.startsWith("dpl_") ?? false;
+  const target = isDeployment ? opts.project : resolveProjectId(opts.project, opts.cwd);
+  if (!target) {
     reportNotLinked("kryd logs <projectId> --runtime");
     return;
   }
@@ -15632,7 +16163,7 @@ async function runRuntimeLogs(opts) {
     await streamRuntime(
       apiUrl,
       token,
-      project,
+      target,
       {
         onLine: ({ stream, line }) => {
           const out = stream === "stderr" ? process.stderr : process.stdout;
@@ -15640,7 +16171,11 @@ async function runRuntimeLogs(opts) {
 `);
         }
       },
-      { ...opts.since ? { since: opts.since } : {}, signal: controller.signal }
+      {
+        ...opts.since ? { since: opts.since } : {},
+        signal: controller.signal,
+        ...isDeployment ? { resource: "deployment" } : {}
+      }
     );
   } catch (err) {
     reportError(err);
@@ -15656,13 +16191,13 @@ async function runDeploy(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd deploy <projectId>");
     return;
   }
   try {
-    const deploymentId = await triggerDeploy(apiUrl, token, project);
+    const deploymentId = await triggerDeploy(apiUrl, token, project2);
     process.stdout.write(`Triggered deploy ${deploymentId}
 `);
     await followDeploy(apiUrl, token, deploymentId);
@@ -15807,8 +16342,8 @@ async function runRollback(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd rollback <projectId> [deployment]");
     return;
   }
@@ -15816,7 +16351,7 @@ async function runRollback(opts) {
     const { deploymentId, rolledBackTo, note } = await rollbackDeploy(
       apiUrl,
       token,
-      project,
+      project2,
       opts.deployment
     );
     process.stdout.write(
@@ -15829,6 +16364,35 @@ async function runRollback(opts) {
     reportError(err);
   }
 }
+async function runRedeploy(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd redeploy <projectId>");
+    return;
+  }
+  try {
+    const { deploymentId, redeployedCommit, note } = await redeployProject(
+      apiUrl,
+      token,
+      project2
+    );
+    process.stdout.write(
+      `Redeploying ${redeployedCommit.slice(0, 7)} \u2192 ${deploymentId}
+${note}
+`
+    );
+    await followDeploy(apiUrl, token, deploymentId);
+  } catch (err) {
+    reportError(err);
+  }
+}
 async function runDbCreate(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -15837,8 +16401,8 @@ async function runDbCreate(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd db create <projectId>");
     return;
   }
@@ -15866,29 +16430,29 @@ async function runDbCreate(opts) {
   }
   try {
     const db2 = await attachDatabase(apiUrl, token, {
-      projectId: project,
+      projectId: project2,
       mode,
       ...connectionString ? { connectionString } : {}
     });
     if (db2.status === "ready") {
       process.stdout.write(
-        `Attached ${db2.mode} database ${db2.id} to ${project}.
+        `Attached ${db2.mode} database ${db2.id} to ${project2}.
 The connection string will be injected as DATABASE_URL on your next deploy.
 `
       );
       return;
     }
-    process.stdout.write(`Provisioning a shared database for ${project}\u2026
+    process.stdout.write(`Provisioning a shared database for ${project2}\u2026
 `);
     const result = await pollResourceUntilTerminal(
-      () => getDatabaseStatus(apiUrl, token, project)
+      () => getDatabaseStatus(apiUrl, token, project2)
     );
     reportSettleResult(result, {
-      readyMsg: `Attached shared database ${db2.id} to ${project}.
+      readyMsg: `Attached shared database ${db2.id} to ${project2}.
 The connection string will be injected as DATABASE_URL on your next deploy.
 `,
       failedLabel: "Database provisioning",
-      retryCmd: `kryd db create ${project}`
+      retryCmd: `kryd db create ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -15918,24 +16482,24 @@ async function runStorageCreate(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd storage create <projectId>");
     return;
   }
   try {
-    const bucket = await createStorage(apiUrl, token, { projectId: project });
-    process.stdout.write(`Provisioning object storage for ${project}\u2026
+    const bucket = await createStorage(apiUrl, token, { projectId: project2 });
+    process.stdout.write(`Provisioning object storage for ${project2}\u2026
 `);
     const result = await pollResourceUntilTerminal(
-      () => getStorageStatus(apiUrl, token, project)
+      () => getStorageStatus(apiUrl, token, project2)
     );
     reportSettleResult(result, {
-      readyMsg: `Created object storage ${bucket.id} for ${project}.
+      readyMsg: `Created object storage ${bucket.id} for ${project2}.
 Its S3 credentials will be injected on your next deploy.
 `,
       failedLabel: "Storage provisioning",
-      retryCmd: `kryd storage create ${project}`
+      retryCmd: `kryd storage create ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -15958,6 +16522,113 @@ function reportDetachResult(result, opts) {
     process.exitCode = 1;
   }
 }
+async function runProjectRemove(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const projectId = resolveProjectId(opts.project, opts.cwd);
+  if (!projectId) {
+    reportNotLinked("kryd project rm <projectId>");
+    return;
+  }
+  let project2;
+  let resources;
+  try {
+    project2 = await getProject(apiUrl, token, projectId);
+    if (!project2) {
+      process.stderr.write(`No project ${projectId} on this account.
+`);
+      process.exitCode = 1;
+      return;
+    }
+    if (project2.status === "deleting") {
+      process.stdout.write(`${project2.name} is already being deleted \u2014 following it.
+`);
+      return followProjectDeletion(apiUrl, token, projectId, project2.name, opts);
+    }
+    resources = project2.status === "delete_failed" ? ["whatever the previous attempt did not manage to remove"] : await describeProjectResources(apiUrl, token, projectId);
+  } catch (err) {
+    reportError(err);
+    return;
+  }
+  if (!opts.yes) {
+    const io = opts.io ?? defaultPromptIO();
+    if (!isInteractive(io)) {
+      process.stderr.write(
+        `Refusing to delete ${project2.name} without confirmation. Re-run with --yes to confirm non-interactively.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    io.output.write(
+      `This permanently deletes ${project2.name} and:
+` + resources.map((r) => `  \u2022 ${r}
+`).join("") + "This cannot be undone.\n"
+    );
+    const typed = await promptLine(
+      `Type ${project2.name} to confirm: `,
+      io
+    );
+    if (typed !== project2.name) {
+      process.stdout.write(`Left ${project2.name} in place.
+`);
+      return;
+    }
+  }
+  try {
+    const accepted = await deleteProject(apiUrl, token, projectId);
+    process.stdout.write(
+      accepted.alreadyInProgress ? `${project2.name} was already being deleted \u2014 following it.
+` : `Deleting ${project2.name}\u2026
+`
+    );
+    await followProjectDeletion(apiUrl, token, projectId, project2.name, opts);
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function followProjectDeletion(apiUrl, token, projectId, name, opts) {
+  const result = await pollProjectDeleted(
+    () => getProject(apiUrl, token, projectId),
+    opts.pollOpts
+  );
+  if (result.gone) {
+    const cleared = clearProjectLinkIfMatches(projectId, opts.cwd);
+    process.stdout.write(
+      `Deleted ${name}.
+` + (cleared ? "Removed the local .kryd/project.json link.\n" : "")
+    );
+    return;
+  }
+  if (result.status === "delete_failed") {
+    process.stderr.write(
+      `Deleting ${name} failed part-way. Your project is still listed, but some of its resources may already be gone \u2014 the teardown removes them in order and stops where it failed.
+Re-run \`kryd project rm ${projectId}\` to resume from where it stopped.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  process.stderr.write(
+    `Could not confirm that ${name} is gone \u2014 it is still being deleted (or the worker stalled). Re-run \`kryd project rm ${projectId}\` to check.
+`
+  );
+  process.exitCode = 1;
+}
+async function describeProjectResources(apiUrl, token, projectId) {
+  const out = ["its deployed app, its containers and its built images"];
+  const db2 = await getDatabaseStatus(apiUrl, token, projectId).catch(() => null);
+  if (db2) out.push("its Postgres database \u2014 and all the data in it");
+  const storage2 = await getStorageStatus(apiUrl, token, projectId).catch(() => null);
+  if (storage2) out.push("its object-storage bucket \u2014 and every object in it");
+  out.push("its Git repository on the forge, and its push token");
+  return out;
+}
 async function runDbDetach(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -15966,23 +16637,23 @@ async function runDbDetach(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd db detach <projectId>");
     return;
   }
   try {
-    await detachDatabase(apiUrl, token, project);
-    process.stdout.write(`Detaching the database from ${project}\u2026
+    await detachDatabase(apiUrl, token, project2);
+    process.stdout.write(`Detaching the database from ${project2}\u2026
 `);
     const result = await pollResourceDetached(
-      () => getDatabaseStatus(apiUrl, token, project)
+      () => getDatabaseStatus(apiUrl, token, project2)
     );
     reportDetachResult(result, {
-      goneMsg: `Detached the database from ${project}.
+      goneMsg: `Detached the database from ${project2}.
 `,
       failedLabel: "Database detach",
-      retryCmd: `kryd db detach ${project}`
+      retryCmd: `kryd db detach ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -15996,15 +16667,15 @@ async function runAiEnable(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd ai enable <projectId>");
     return;
   }
   try {
-    const status = await enableAi(apiUrl, token, { projectId: project });
+    const status = await enableAi(apiUrl, token, { projectId: project2 });
     process.stdout.write(
-      `AI enabled for ${project}.
+      `AI enabled for ${project2}.
 ` + (status.url ? `Endpoint: ${status.url} (OpenAI-compatible base URL \u2014 use it as-is)
 ` : "") + `AI_GATEWAY_URL + AI_GATEWAY_TOKEN will be injected on your next deploy (kryd deploy).
 `
@@ -16021,29 +16692,442 @@ async function runStorageDetach(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd storage detach <projectId>");
     return;
   }
   try {
-    await detachStorage(apiUrl, token, project);
-    process.stdout.write(`Detaching object storage from ${project}\u2026
+    await detachStorage(apiUrl, token, project2);
+    process.stdout.write(`Detaching object storage from ${project2}\u2026
 `);
     const result = await pollResourceDetached(
-      () => getStorageStatus(apiUrl, token, project)
+      () => getStorageStatus(apiUrl, token, project2)
     );
     reportDetachResult(result, {
-      goneMsg: `Detached object storage from ${project}.
+      goneMsg: `Detached object storage from ${project2}.
 `,
       failedLabel: "Storage detach",
-      retryCmd: `kryd storage detach ${project}`
+      retryCmd: `kryd storage detach ${project2}`
     });
   } catch (err) {
     reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.2.0" : "0.0.0-dev";
+function splitKeyValue(spec) {
+  const eq = spec.indexOf("=");
+  if (eq === -1) return { key: spec };
+  return { key: spec.slice(0, eq), value: spec.slice(eq + 1) };
+}
+var NEXT_DEPLOY_NOTE = "This takes effect on your next deploy \u2014 run `kryd redeploy` to apply it now (no rebuild), or it lands on your next `kryd push`.\n";
+var NEXT_BUILD_NOTE = `${BUILD_ENV_REBUILD_NOTE}
+`;
+var ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T/;
+function isoDate(value) {
+  if (!value || !ISO_TIMESTAMP.test(value)) return null;
+  const date5 = new Date(value);
+  if (Number.isNaN(date5.getTime())) return null;
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${date5.getFullYear()}-${pad(date5.getMonth() + 1)}-${pad(date5.getDate())}`;
+}
+function envAnnotation(environments) {
+  if (!environments || environments.length === 0) return "";
+  const prod = environments.includes("production");
+  const preview = environments.includes("preview");
+  if (prod && preview) return "  \u2192 preview override";
+  if (preview && !prod) return "  \u2192 preview only";
+  return "";
+}
+function renderEnvGroup(heading, vars, opts) {
+  const width = vars.reduce((max, v) => Math.max(max, v.key.length), 0);
+  const dates = opts.showUpdated ? vars.map((v) => isoDate(v.updatedAt)) : [];
+  const anyDate = dates.some((d) => d !== null);
+  const rows = vars.map((v, i) => {
+    const envNote = opts.showEnvironments ? envAnnotation(v.environments) : "";
+    if (!anyDate) return `  ${v.key}${envNote}
+`;
+    const updated = dates[i];
+    return `  ${v.key.padEnd(width)}  ${updated ? `updated ${updated}` : ""}${envNote}
+`.trimEnd() + "\n";
+  }).join("");
+  return `${heading}
+${rows}`;
+}
+async function runEnvList(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd env list <projectId>");
+    return;
+  }
+  try {
+    const vars = await listEnvVars(apiUrl, token, project2);
+    if (vars.length === 0) {
+      process.stdout.write(
+        `No environment variables for ${project2} yet.
+Set one with \`kryd env set KEY --stdin\`, or attach a database, storage or the AI gateway.
+`
+      );
+      return;
+    }
+    const byKey = (a, b) => a.key.localeCompare(b.key);
+    const buildVars = vars.filter((v) => v.scope === "build").sort(byKey);
+    const runtimeVars = vars.filter((v) => v.scope !== "build");
+    const mine = runtimeVars.filter((v) => v.source === "customer").sort(byKey);
+    const managed = runtimeVars.filter((v) => v.source === "managed").sort(byKey);
+    const other = runtimeVars.filter((v) => v.source !== "customer" && v.source !== "managed").sort(byKey);
+    let out = "";
+    if (mine.length > 0) {
+      out += renderEnvGroup(`Set by you (${mine.length})`, mine, {
+        showUpdated: true,
+        // Your customer vars can carry a preview override (runtime KRYD-159, build KRYD-215); annotate
+        // which ones do.
+        showEnvironments: true
+      });
+    }
+    if (managed.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Managed by Kryd (${managed.length}) \u2014 set when you attach a resource; not editable`,
+        managed,
+        // A managed row's timestamp is Kryd's own bookkeeping, not something the user did; showing
+        // it invites "why did my DATABASE_URL change today?".
+        { showUpdated: false }
+      );
+    }
+    if (other.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Other (${other.length}) \u2014 set by a newer version of Kryd; upgrade the CLI (\`npm install -g @kryd/cli\`) to see what they are`,
+        other,
+        { showUpdated: false }
+      );
+    }
+    if (buildVars.length > 0) {
+      if (out) out += "\n";
+      out += renderEnvGroup(
+        `Build-time (${buildVars.length}) \u2014 compiled into your public bundle`,
+        buildVars,
+        // Build vars are per-environment too now (KRYD-215) — annotate a preview override / preview-only
+        // build var, exactly as the runtime group does.
+        { showUpdated: true, showEnvironments: true }
+      );
+      out += `${BUILD_ENV_PUBLIC_WARNING}
+`;
+    }
+    out += "\nValues are never shown. This is the stored set \u2014 runtime changes reach your container at its next deploy (run `kryd redeploy` to apply them now)" + (buildVars.length > 0 ? ", and build-time changes at its next build.\n" : ".\n");
+    process.stdout.write(out);
+  } catch (err) {
+    reportError(err);
+  }
+}
+function toDotenvLine(key, value) {
+  const hasNewline = /[\n\r]/.test(value);
+  const needsQuote = hasNewline || value === "" || value !== value.trim() || value.includes("#") || /^["'`]/.test(value);
+  if (!needsQuote) return `${key}=${value}`;
+  if (!hasNewline && !value.includes("'")) return `${key}='${value}'`;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+  return `${key}="${escaped}"`;
+}
+async function runEnvPull(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd env pull <projectId>");
+    return;
+  }
+  const environment = opts.preview ? "preview" : "production";
+  const cwd = opts.cwd ?? process.cwd();
+  const root = findProjectLinkDir(cwd) ?? cwd;
+  const outRel = opts.out ?? ".env.kryd";
+  const outPath = resolve(root, outRel);
+  if (opts.out !== void 0 && existsSync3(outPath) && !opts.force) {
+    process.stderr.write(
+      `Refusing to overwrite ${outRel} \u2014 pass --force to replace it (or omit --out to write .env.kryd).
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const { values } = await pullEnvValues(apiUrl, token, project2, environment);
+    const entries = Object.entries(values).sort(
+      ([a], [b]) => a.localeCompare(b)
+    );
+    const header = `# Written by \`kryd env pull\` \u2014 your customer-set variables for ${project2} (${environment}).
+# Regenerate with \`kryd env pull\`. Do not commit this file.
+`;
+    const body = entries.map(([k, v]) => toDotenvLine(k, v)).join("\n");
+    const rel = relative(root, outPath);
+    const insideRoot = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    const added = insideRoot ? ensureIgnored(root, rel) : false;
+    writeSecretFile(outPath, body.length > 0 ? `${header}
+${body}
+` : header);
+    const count = entries.length;
+    process.stdout.write(
+      count === 0 ? `No customer environment variables for ${project2} (${environment}) \u2014 wrote an empty ${outRel}.
+` : `Wrote ${count} variable${count === 1 ? "" : "s"} to ${outRel} (${environment}), mode 0600.
+`
+    );
+    if (added) process.stdout.write(`Added ${rel} to .gitignore.
+`);
+    if (!insideRoot)
+      process.stderr.write(
+        `Warning: ${outRel} is outside the project root \u2014 NOT added to .gitignore. Make sure you don't commit it.
+`
+      );
+    process.stdout.write(
+      "These are your own values, read back from Kryd. Managed values (DATABASE_URL, storage, the AI gateway) are never pulled.\n"
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function resolveEnvValue(inline, opts) {
+  if (opts.stdin && inline !== void 0) {
+    return {
+      error: "Pass the value with --stdin OR as KEY=VALUE, not both \u2014 it is ambiguous which one you meant."
+    };
+  }
+  if (opts.stdin) {
+    if (isInteractive(opts.io)) {
+      return {
+        error: `--stdin expects a value on standard input, but nothing is piped in (e.g. \`\u2026 | kryd env set ${opts.key} --stdin\`). To type it instead, run \`kryd env set ${opts.key}\` \u2014 you will be prompted, and nothing is echoed.`
+      };
+    }
+    const read = await readAll(opts.io.input, ENV_VAR_VALUE_MAX_BYTES + 1);
+    if ("tooLarge" in read) {
+      return {
+        error: `That value is larger than the ${ENV_VAR_VALUE_MAX_BYTES}-byte limit for an environment variable.`
+      };
+    }
+    return { value: stripOneTrailingNewline(read.value) };
+  }
+  if (inline !== void 0) {
+    if (inline.length > 0) {
+      process.stderr.write(
+        `tip: a value in \`KEY=VALUE\` is visible in \`ps\` and is saved to your shell history. For a secret, pipe it (\`kryd env set ${opts.key} --stdin\`) or omit the value to be prompted.
+`
+      );
+    }
+    return { value: inline };
+  }
+  if (!isInteractive(opts.io)) {
+    return {
+      error: `No value given for ${opts.key}, and there is no terminal to prompt on. Pipe it with \`kryd env set ${opts.key} --stdin\`.`
+    };
+  }
+  const typed = await promptHidden(`Value for ${opts.key} (not echoed): `, opts.io);
+  if (typed === null) return { aborted: true };
+  return { value: typed };
+}
+async function runEnvSet(opts) {
+  const scope = opts.build ? "build" : "runtime";
+  const environment = opts.preview ? "preview" : "production";
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd env set KEY=VALUE <projectId>");
+    return;
+  }
+  if (!opts.spec) {
+    process.stderr.write(
+      "Which variable? e.g. `kryd env set MY_API_KEY --stdin` or `kryd env set FEATURE_X=on`.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const { key, value: inline } = splitKeyValue(opts.spec);
+  const nameError = validateEnvVarName(key);
+  if (nameError) {
+    process.stderr.write(`${nameError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    const buildNameError = validateBuildEnvVarName(key);
+    if (buildNameError) {
+      process.stderr.write(`${buildNameError}
+`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const io = opts.io ?? defaultPromptIO();
+  const resolved = await resolveEnvValue(inline, {
+    ...opts.stdin !== void 0 ? { stdin: opts.stdin } : {},
+    io,
+    key
+  });
+  if ("aborted" in resolved) {
+    process.stderr.write(`Aborted \u2014 ${key} was not set.
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if ("error" in resolved) {
+    process.stderr.write(`${resolved.error}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  const valueError = validateEnvVarValue(resolved.value);
+  if (valueError) {
+    process.stderr.write(`${valueError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    const buildValueError = validateBuildEnvVarValue(resolved.value);
+    if (buildValueError) {
+      process.stderr.write(`${buildValueError}
+`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+  try {
+    const written = await setEnvVar(
+      apiUrl,
+      token,
+      project2,
+      key,
+      resolved.value,
+      scope,
+      environment
+    );
+    const envTag = environment === "preview" ? " (preview)" : "";
+    process.stdout.write(
+      `${written.created ? "Set" : "Updated"} ${written.key}${scope === "build" ? " (build-time)" : envTag} for ${project2}.
+` + // The public-bundle warning comes FIRST, before the applies-when note. Someone who reads one
+      // line of output should read the consequential one.
+      (scope === "build" ? `${BUILD_ENV_PUBLIC_WARNING}
+${NEXT_BUILD_NOTE}` : NEXT_DEPLOY_NOTE)
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runEnvRemove(opts) {
+  const scope = opts.build ? "build" : "runtime";
+  const environment = opts.preview ? "preview" : "production";
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd env rm KEY <projectId>");
+    return;
+  }
+  const key = opts.key;
+  if (!key) {
+    process.stderr.write("Which variable? e.g. `kryd env rm MY_API_KEY`.\n");
+    process.exitCode = 1;
+    return;
+  }
+  if (!ENV_VAR_NAME_PATTERN.test(key)) {
+    process.stderr.write(
+      "Environment variable names must match ^[A-Za-z_][A-Za-z0-9_]*$ \u2014 a letter or underscore, then letters, digits or underscores.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (isReservedEnvVarName(key)) {
+    process.stderr.write(
+      `${key} is reserved by Kryd and cannot be removed here.
+If it comes from a resource you attached, detach that instead (\`kryd db detach\`, \`kryd storage detach\`).
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const nameError = validateEnvVarName(key);
+  if (nameError) {
+    process.stderr.write(`${nameError}
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (scope === "build") {
+    try {
+      const vars = await listEnvVars(apiUrl, token, project2, "build");
+      if (!vars.some((v) => v.key === key && v.scope === "build")) {
+        process.stderr.write(
+          `${key} is not set as a build-time variable on ${project2}.
+Run \`kryd env list\` to see what is set. (If you meant the runtime variable of that name, drop --build.)
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+    } catch (err) {
+      reportError(err);
+      return;
+    }
+  }
+  if (!opts.yes) {
+    const io = opts.io ?? defaultPromptIO();
+    if (!isInteractive(io)) {
+      process.stderr.write(
+        `Refusing to remove ${key} without confirmation. Re-run with --yes to confirm non-interactively.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const confirmed = await promptConfirm(
+      scope === "build" ? `Remove the build-time variable ${key} from ${project2}? Your next build will not have it (the current image still does).` : environment === "preview" ? `Remove the preview override for ${key} on ${project2}? Previews will revert to inheriting the production value.` : `Remove ${key} from ${project2}? Its stored value (production and any preview override) is deleted and cannot be recovered.`,
+      io
+    );
+    if (!confirmed) {
+      process.stdout.write(`Left ${key} in place.
+`);
+      return;
+    }
+  }
+  try {
+    const removed = await removeEnvVar(apiUrl, token, project2, key, scope, environment);
+    const envTag = environment === "preview" ? " (preview override)" : "";
+    process.stdout.write(
+      `Removed ${removed.key}${scope === "build" ? " (build-time)" : envTag} from ${project2}.
+` + // The build-scope warning is deliberately bleaker than the runtime one, because the truth is.
+      // A runtime value is gone from the container at the next deploy. A build-time value is
+      // COMPILED INTO the live image and into every bundle already downloaded from it — removing
+      // it stops future builds baking it in and does nothing else. Someone removing a value they
+      // now realise was sensitive must not read "removed" as "contained".
+      (scope === "build" ? "\u26A0 This does not un-publish it. The value is already compiled into the live image and into every bundle served from it \u2014 rotate it at the provider, then push a commit to rebuild without it.\n" : `\u26A0 Your running container still has the old value until your next deploy \u2014 run \`kryd redeploy\` to apply the removal now (no rebuild), or it lands on your next \`kryd push\`.
+`)
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+var CLI_VERSION = true ? "0.3.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
@@ -16054,16 +17138,19 @@ program.command("whoami").description("Show the current account").option("--api-
 program.command("logout").description("Clear the stored token").action(() => runLogout());
 program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
-  "react-router | nextjs | vite-spa (auto-detected if omitted)"
+  "react-router | nextjs | vite-spa | node (auto-detected if omitted)"
 ).option(
   "--tenant <slug>",
-  "your tenant slug (claimed once on first init \u2014 appears in every deploy URL)"
+  // KRYD-265 / KRYD-188: this used to say "claimed once on first init", which was false — signup
+  // has always assigned a slug, so the flag could only agree with it or 409. It now changes the
+  // slug, and only while nothing derives from it.
+  "your tenant slug \u2014 appears in every deploy URL; changeable until your first project"
 ).option("--api-url <url>", "control-plane API base URL").action((opts) => runInit(opts));
 program.command("logs [target]").description(
-  "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: the project's live-app runtime logs ([target]=project id)."
+  "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: a container's stdout/stderr \u2014 [target]=a project id tails its live app, a deployment id (dpl_\u2026) tails THAT deploy's container (incl. a failed one, to see why it crashed)."
 ).option(
   "--runtime",
-  "stream the live container's runtime stdout/stderr (the running app) instead of build/deploy logs"
+  "stream a container's runtime stdout/stderr instead of build/deploy logs \u2014 the live app (project id) or one deploy's container (dpl_ id)"
 ).option(
   "--since <dur>",
   "with --runtime: backfill this window before going live (e.g. 30m, 2h, 1d; max 7d)"
@@ -16075,21 +17162,58 @@ program.command("push [branch]").description(
 ).option("--api-url <url>", "control-plane API base URL").action(
   (branch, opts, cmd) => runPush({ ...opts, branch, gitArgs: cmd.args.slice(1) })
 );
-program.command("deploy [project]").description("Trigger a deploy of the project's production branch and follow it live").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runDeploy({ ...opts, project }));
+program.command("deploy [project]").description("Trigger a deploy of the project's production branch and follow it live").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDeploy({ ...opts, project: project2 }));
 program.command("rollback [project] [deployment]").description("Roll back to a previous successful deploy (no rebuild) and follow it live").option("--api-url <url>", "control-plane API base URL").action(
-  (project, deployment, opts) => runRollback({ ...opts, project, deployment })
+  (project2, deployment, opts) => runRollback({ ...opts, project: project2, deployment })
 );
+program.command("redeploy [project]").description(
+  "Redeploy the current live commit (no rebuild) to apply config/env changes, and follow it live"
+).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runRedeploy({ ...opts, project: project2 }));
+var project = program.command("project").description("Manage your projects");
+project.command("rm [project]").description(
+  "Permanently delete a project and everything Kryd created for it (asks you to type its name)"
+).option("--yes", "skip the confirmation (for non-interactive use)").option("--api-url <url>", "control-plane API base URL").action((projectArg, opts) => runProjectRemove({ ...opts, project: projectArg }));
 var db = program.command("db").description("Manage project databases");
 db.command("create [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
   "--connection-string <url>",
   "attach an existing database (BYO) by pasting its connection string"
-).option("--api-url <url>", "control-plane API base URL").action((project, opts) => runDbCreate({ ...opts, project }));
-db.command("detach [project]").description("Tear down the project's database and reclaim its credential").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runDbDetach({ ...opts, project }));
+).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbCreate({ ...opts, project: project2 }));
+db.command("detach [project]").description("Tear down the project's database and reclaim its credential").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbDetach({ ...opts, project: project2 }));
 var storage = program.command("storage").description("Manage project object storage");
-storage.command("create [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runStorageCreate({ ...opts, project }));
-storage.command("detach [project]").description("Tear down the project's object storage and reclaim its credentials").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runStorageDetach({ ...opts, project }));
+storage.command("create [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageCreate({ ...opts, project: project2 }));
+storage.command("detach [project]").description("Tear down the project's object storage and reclaim its credentials").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageDetach({ ...opts, project: project2 }));
+var env = program.command("env").description("Manage your app's environment variables");
+env.command("list [project]").description("List the project's environment variables (names and origin \u2014 never values)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runEnvList({ ...opts, project: project2 }));
+env.command("set <key> [project]").description(
+  "Set one of your environment variables \u2014 `KEY=VALUE`, or `KEY` with --stdin / a prompt"
+).option(
+  "--stdin",
+  "read the value from a pipe instead of the argument (a value in `KEY=VALUE` is visible in `ps` and saved to your shell history); one trailing newline is stripped, and this is the only way to set a multi-line value"
+).option(
+  "--build",
+  "set it as a BUILD-TIME variable, for `import.meta.env` / `process.env` while your bundler runs (VITE_*, NEXT_PUBLIC_*, PUBLIC_*, \u2026). The value is compiled into your public bundle, so it must not be a secret, and it takes effect at your next build rather than your next deploy"
+).option(
+  "--preview",
+  "set the value for PREVIEW deploys only \u2014 an override that shadows production for previews (without it, a set targets production, which previews inherit)"
+).option("--api-url <url>", "control-plane API base URL").action((key, project2, opts) => runEnvSet({ ...opts, spec: key, project: project2 }));
+env.command("rm <key> [project]").description("Remove one of your environment variables (asks for confirmation)").option("--yes", "skip the confirmation prompt (required when there is no terminal)").option(
+  "--build",
+  "remove the build-time variable of this name rather than the runtime one (the same name can exist as both)"
+).option(
+  "--preview",
+  "remove only the PREVIEW override, reverting previews to inheriting production (without it, the whole key is removed \u2014 production and any preview override)"
+).option("--api-url <url>", "control-plane API base URL").action((key, project2, opts) => runEnvRemove({ ...opts, key, project: project2 }));
+env.command("pull [project]").description(
+  "Write your customer-set environment variables (values included) to a local .env file for development"
+).option(
+  "--preview",
+  "pull the values a PREVIEW deploy would see (preview overrides plus inherited production), instead of production"
+).option(
+  "--out <path>",
+  "file to write, relative to the project root (default: .env.kryd \u2014 never your hand-maintained .env)"
+).option("--force", "overwrite the --out file if it already exists").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runEnvPull({ ...opts, project: project2 }));
 var ai = program.command("ai").description("Manage the app's EU AI gateway");
-ai.command("enable [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runAiEnable({ ...opts, project }));
+ai.command("enable [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiEnable({ ...opts, project: project2 }));
 if (import.meta.url === `file://${process.argv[1]}`) {
   program.parseAsync().catch((err) => {
     process.stderr.write(
@@ -16105,14 +17229,21 @@ export {
   runDbCreate,
   runDbDetach,
   runDeploy,
+  runEnvList,
+  runEnvPull,
+  runEnvRemove,
+  runEnvSet,
   runInit,
   runLogin,
   runLogout,
   runLogs,
+  runProjectRemove,
   runPush,
+  runRedeploy,
   runRollback,
   runRuntimeLogs,
   runStorageCreate,
   runStorageDetach,
-  runWhoami
+  runWhoami,
+  splitKeyValue
 };