@kryd/cli 0.2.1 → 0.4.0

package/dist/index.js

@@ -88,6 +88,69 @@ var PRODUCTION_TLD = "kryd.cloud";
 var PREVIEW_TLD = "kryd.dev";
 var TENANT_SLUG_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_TENANT_SLUG - 2}}[a-z0-9])?$`);
 
+// ../../packages/shared-types/dist/reserved-slugs.js
+var FORGEJO_RESERVED_USERNAMES = [
+  ".",
+  "..",
+  "-",
+  ".well-known",
+  "api",
+  "metrics",
+  "v2",
+  "assets",
+  "attachments",
+  "avatar",
+  "avatars",
+  "repo-avatars",
+  "captcha",
+  "login",
+  "org",
+  "repo",
+  "user",
+  "admin",
+  "explore",
+  "issues",
+  "pulls",
+  "milestones",
+  "notifications",
+  "report_abuse",
+  "favicon.ico",
+  "manifest.json",
+  "robots.txt",
+  "sitemap.xml",
+  "ssh_info",
+  "swagger.v1.json",
+  "ghost",
+  "gitea-actions",
+  "forgejo-actions"
+];
+var PLATFORM_RESERVED_SLUGS = [
+  "kryd",
+  "krydhq",
+  "www",
+  "api",
+  "app",
+  "ai",
+  "docs",
+  "forge",
+  "admin",
+  "console",
+  "status",
+  "mail",
+  "support",
+  "billing",
+  "account",
+  "accounts",
+  "static",
+  "assets",
+  "cdn",
+  "dashboard"
+];
+var RESERVED = /* @__PURE__ */ new Set([
+  ...FORGEJO_RESERVED_USERNAMES,
+  ...PLATFORM_RESERVED_SLUGS
+]);
+
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -14806,6 +14869,7 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  rmSync,
   writeFileSync
 } from "node:fs";
 import { homedir } from "node:os";
@@ -14922,6 +14986,18 @@ function writeSecretFile(path, contents) {
   writeFileSync(path, contents, { mode: 384 });
   chmodSync(path, 384);
 }
+function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return false;
+  const link = loadProjectLink(cwd);
+  if (link?.projectId !== projectId) return false;
+  try {
+    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
+    return true;
+  } catch {
+    return false;
+  }
+}
 function resolveProjectId(explicit, cwd = process.cwd()) {
   if (explicit) return explicit;
   return loadProjectLink(cwd)?.projectId ?? null;
@@ -15241,6 +15317,58 @@ async function detachDatabase(apiUrl, token, projectId) {
     );
   }
 }
+async function getProject(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new ApiError(`Reading the project failed (${res.status})`, await parseEnvelope(res));
+  }
+  return await res.json();
+}
+async function listProjects(apiUrl, token) {
+  const res = await fetch(`${apiUrl}/projects`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res));
+  }
+  return (await res.json()).items;
+}
+async function deleteProject(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res));
+  }
+  return await res.json();
+}
+async function pollProjectDeleted(read, opts) {
+  const intervalMs = opts?.intervalMs ?? 2e3;
+  const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
+  const maxConsecutiveErrors = opts?.maxConsecutiveErrors ?? 5;
+  const sleep = opts?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const started = Date.now();
+  let consecutiveErrors = 0;
+  let last = null;
+  for (; ; ) {
+    try {
+      const project2 = await read();
+      consecutiveErrors = 0;
+      if (project2 === null) return { gone: true, status: null };
+      last = project2.status;
+      opts?.onTick?.(project2.status);
+      if (project2.status === "delete_failed") return { gone: false, status: last };
+    } catch (err) {
+      if (++consecutiveErrors >= maxConsecutiveErrors) throw err;
+    }
+    if (Date.now() - started >= timeoutMs) return { gone: false, status: last };
+    await sleep(intervalMs);
+  }
+}
 async function detachStorage(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/storage/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
@@ -15711,6 +15839,18 @@ async function promptHidden(question, io) {
     io.output.write("\n");
   }
 }
+async function promptLine(question, io) {
+  const rl = createInterface({ input: io.input, output: io.output });
+  try {
+    return await new Promise((resolve2) => {
+      rl.once("SIGINT", () => resolve2(null));
+      rl.once("close", () => resolve2(null));
+      rl.question(question, (answer) => resolve2(answer));
+    });
+  } finally {
+    rl.close();
+  }
+}
 async function promptConfirm(question, io) {
   const rl = createInterface({ input: io.input, output: io.output });
   try {
@@ -15885,17 +16025,20 @@ async function runInit(opts) {
   }
   const name = opts.name ?? detected.name;
   try {
-    const { project, repo, pushToken } = await linkProject(apiUrl, token, {
+    const { project: project2, repo, pushToken } = await linkProject(apiUrl, token, {
       name,
       framework,
       // First `kryd init` for the account claims the tenant slug (the vanity routing key in
       // every deploy URL); later inits omit it (the account already has one). Story 3.8.
       // Built conditionally (exactOptionalPropertyTypes — don't pass an explicit undefined).
-      ...opts.tenant ? { tenantSlug: opts.tenant } : {}
+      ...opts.tenant ? { tenantSlug: opts.tenant } : {},
+      // KRYD-184a: only sent when the flag is present. The API defaults to private and sends
+      // `private` explicitly to the forge on every path, so omitting this is never "public".
+      ...opts.public ? { public: true } : {}
     });
     let linkNote = "";
     try {
-      saveProjectLink(cwd, { projectId: project.id });
+      saveProjectLink(cwd, { projectId: project2.id });
       linkNote = "Linked this folder \u2192 .kryd/project.json \u2014 `kryd deploy` / `kryd logs` now work here with no id.\n";
       try {
         ensureKrydIgnored(cwd);
@@ -15907,7 +16050,7 @@ async function runInit(opts) {
       }
     } catch (linkErr) {
       process.stderr.write(
-        `warning: could not write .kryd/project.json (${linkErr instanceof Error ? linkErr.message : String(linkErr)}) \u2014 pass the project id explicitly, e.g. \`kryd deploy ${project.id}\`.
+        `warning: could not write .kryd/project.json (${linkErr instanceof Error ? linkErr.message : String(linkErr)}) \u2014 pass the project id explicitly, e.g. \`kryd deploy ${project2.id}\`.
 `
       );
     }
@@ -15940,9 +16083,9 @@ Install git (https://git-scm.com/downloads), then re-run \`kryd init\` here.
         break;
     }
     process.stdout.write(
-      `Linked "${name}" (${project.framework}) \u2192 ${repo.htmlUrl}
-Production URL: https://${project.subdomain}.${PRODUCTION_TLD}
-Preview branches deploy to https://<branch>-<hash>-${project.subdomain}.${PREVIEW_TLD}
+      `Linked "${name}" (${project2.framework}) \u2192 ${repo.htmlUrl}
+Production URL: https://${project2.subdomain}.${PRODUCTION_TLD}
+Preview branches deploy to https://<branch>-<hash>-${project2.subdomain}.${PREVIEW_TLD}
 ${linkNote}
 ${nextStep}`
     );
@@ -16060,13 +16203,13 @@ async function runDeploy(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd deploy <projectId>");
     return;
   }
   try {
-    const deploymentId = await triggerDeploy(apiUrl, token, project);
+    const deploymentId = await triggerDeploy(apiUrl, token, project2);
     process.stdout.write(`Triggered deploy ${deploymentId}
 `);
     await followDeploy(apiUrl, token, deploymentId);
@@ -16211,8 +16354,8 @@ async function runRollback(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd rollback <projectId> [deployment]");
     return;
   }
@@ -16220,7 +16363,7 @@ async function runRollback(opts) {
     const { deploymentId, rolledBackTo, note } = await rollbackDeploy(
       apiUrl,
       token,
-      project,
+      project2,
       opts.deployment
     );
     process.stdout.write(
@@ -16241,8 +16384,8 @@ async function runRedeploy(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd redeploy <projectId>");
     return;
   }
@@ -16250,7 +16393,7 @@ async function runRedeploy(opts) {
     const { deploymentId, redeployedCommit, note } = await redeployProject(
       apiUrl,
       token,
-      project
+      project2
     );
     process.stdout.write(
       `Redeploying ${redeployedCommit.slice(0, 7)} \u2192 ${deploymentId}
@@ -16270,8 +16413,8 @@ async function runDbCreate(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd db create <projectId>");
     return;
   }
@@ -16299,29 +16442,29 @@ async function runDbCreate(opts) {
   }
   try {
     const db2 = await attachDatabase(apiUrl, token, {
-      projectId: project,
+      projectId: project2,
       mode,
       ...connectionString ? { connectionString } : {}
     });
     if (db2.status === "ready") {
       process.stdout.write(
-        `Attached ${db2.mode} database ${db2.id} to ${project}.
+        `Attached ${db2.mode} database ${db2.id} to ${project2}.
 The connection string will be injected as DATABASE_URL on your next deploy.
 `
       );
       return;
     }
-    process.stdout.write(`Provisioning a shared database for ${project}\u2026
+    process.stdout.write(`Provisioning a shared database for ${project2}\u2026
 `);
     const result = await pollResourceUntilTerminal(
-      () => getDatabaseStatus(apiUrl, token, project)
+      () => getDatabaseStatus(apiUrl, token, project2)
     );
     reportSettleResult(result, {
-      readyMsg: `Attached shared database ${db2.id} to ${project}.
+      readyMsg: `Attached shared database ${db2.id} to ${project2}.
 The connection string will be injected as DATABASE_URL on your next deploy.
 `,
       failedLabel: "Database provisioning",
-      retryCmd: `kryd db create ${project}`
+      retryCmd: `kryd db create ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -16351,24 +16494,24 @@ async function runStorageCreate(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd storage create <projectId>");
     return;
   }
   try {
-    const bucket = await createStorage(apiUrl, token, { projectId: project });
-    process.stdout.write(`Provisioning object storage for ${project}\u2026
+    const bucket = await createStorage(apiUrl, token, { projectId: project2 });
+    process.stdout.write(`Provisioning object storage for ${project2}\u2026
 `);
     const result = await pollResourceUntilTerminal(
-      () => getStorageStatus(apiUrl, token, project)
+      () => getStorageStatus(apiUrl, token, project2)
     );
     reportSettleResult(result, {
-      readyMsg: `Created object storage ${bucket.id} for ${project}.
+      readyMsg: `Created object storage ${bucket.id} for ${project2}.
 Its S3 credentials will be injected on your next deploy.
 `,
       failedLabel: "Storage provisioning",
-      retryCmd: `kryd storage create ${project}`
+      retryCmd: `kryd storage create ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -16391,6 +16534,152 @@ function reportDetachResult(result, opts) {
     process.exitCode = 1;
   }
 }
+function isProjectId(arg) {
+  return arg.startsWith("proj_");
+}
+async function resolveProjectIdByName(apiUrl, token, name) {
+  let projects;
+  try {
+    projects = await listProjects(apiUrl, token);
+  } catch (err) {
+    reportError(err);
+    return null;
+  }
+  const matches = projects.filter((p) => p.name === name);
+  if (matches.length === 0) {
+    process.stderr.write(
+      `No project named ${name} on this account. Run \`kryd project list\` to see the names.
+`
+    );
+    process.exitCode = 1;
+    return null;
+  }
+  if (matches.length === 1) return matches[0].id;
+  const listed = matches.map((p) => `  ${p.id}  ${p.status}
+`).join("");
+  process.stderr.write(
+    `${matches.length} projects are named ${name}:
+${listed}Re-run \`kryd project rm <id>\` with the one you mean.
+`
+  );
+  process.exitCode = 1;
+  return null;
+}
+async function runProjectRemove(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  let projectId;
+  if (opts.project !== void 0 && !isProjectId(opts.project)) {
+    projectId = await resolveProjectIdByName(apiUrl, token, opts.project);
+    if (!projectId) return;
+  } else {
+    projectId = resolveProjectId(opts.project, opts.cwd);
+  }
+  if (!projectId) {
+    reportNotLinked("kryd project rm <name|id>");
+    return;
+  }
+  let project2;
+  let resources;
+  try {
+    project2 = await getProject(apiUrl, token, projectId);
+    if (!project2) {
+      process.stderr.write(
+        `No project with id ${projectId} on this account. Run \`kryd project list\` to see your projects.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (project2.status === "deleting") {
+      process.stdout.write(`${project2.name} is already being deleted \u2014 following it.
+`);
+      return followProjectDeletion(apiUrl, token, projectId, project2.name, opts);
+    }
+    resources = project2.status === "delete_failed" ? ["whatever the previous attempt did not manage to remove"] : await describeProjectResources(apiUrl, token, projectId);
+  } catch (err) {
+    reportError(err);
+    return;
+  }
+  if (!opts.yes) {
+    const io = opts.io ?? defaultPromptIO();
+    if (!isInteractive(io)) {
+      process.stderr.write(
+        `Refusing to delete ${project2.name} without confirmation. Re-run with --yes to confirm non-interactively.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    io.output.write(
+      `This permanently deletes ${project2.name} and:
+` + resources.map((r) => `  \u2022 ${r}
+`).join("") + "This cannot be undone.\n"
+    );
+    const typed = await promptLine(
+      `Type ${project2.name} to confirm: `,
+      io
+    );
+    if (typed !== project2.name) {
+      process.stdout.write(`Left ${project2.name} in place.
+`);
+      return;
+    }
+  }
+  try {
+    const accepted = await deleteProject(apiUrl, token, projectId);
+    process.stdout.write(
+      accepted.alreadyInProgress ? `${project2.name} was already being deleted \u2014 following it.
+` : `Deleting ${project2.name}\u2026
+`
+    );
+    await followProjectDeletion(apiUrl, token, projectId, project2.name, opts);
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function followProjectDeletion(apiUrl, token, projectId, name, opts) {
+  const result = await pollProjectDeleted(
+    () => getProject(apiUrl, token, projectId),
+    opts.pollOpts
+  );
+  if (result.gone) {
+    const cleared = clearProjectLinkIfMatches(projectId, opts.cwd);
+    process.stdout.write(
+      `Deleted ${name}.
+` + (cleared ? "Removed the local .kryd/project.json link.\n" : "")
+    );
+    return;
+  }
+  if (result.status === "delete_failed") {
+    process.stderr.write(
+      `Deleting ${name} failed part-way. Your project is still listed, but some of its resources may already be gone \u2014 the teardown removes them in order and stops where it failed.
+Re-run \`kryd project rm ${projectId}\` to resume from where it stopped.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  process.stderr.write(
+    `Could not confirm that ${name} is gone \u2014 it is still being deleted (or the worker stalled). Re-run \`kryd project rm ${projectId}\` to check.
+`
+  );
+  process.exitCode = 1;
+}
+async function describeProjectResources(apiUrl, token, projectId) {
+  const out = ["its deployed app, its containers and its built images"];
+  const db2 = await getDatabaseStatus(apiUrl, token, projectId).catch(() => null);
+  if (db2) out.push("its Postgres database \u2014 and all the data in it");
+  const storage2 = await getStorageStatus(apiUrl, token, projectId).catch(() => null);
+  if (storage2) out.push("its object-storage bucket \u2014 and every object in it");
+  out.push("its Git repository on the forge, and its push token");
+  return out;
+}
 async function runDbDetach(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -16399,23 +16688,23 @@ async function runDbDetach(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd db detach <projectId>");
     return;
   }
   try {
-    await detachDatabase(apiUrl, token, project);
-    process.stdout.write(`Detaching the database from ${project}\u2026
+    await detachDatabase(apiUrl, token, project2);
+    process.stdout.write(`Detaching the database from ${project2}\u2026
 `);
     const result = await pollResourceDetached(
-      () => getDatabaseStatus(apiUrl, token, project)
+      () => getDatabaseStatus(apiUrl, token, project2)
     );
     reportDetachResult(result, {
-      goneMsg: `Detached the database from ${project}.
+      goneMsg: `Detached the database from ${project2}.
 `,
       failedLabel: "Database detach",
-      retryCmd: `kryd db detach ${project}`
+      retryCmd: `kryd db detach ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -16429,15 +16718,15 @@ async function runAiEnable(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd ai enable <projectId>");
     return;
   }
   try {
-    const status = await enableAi(apiUrl, token, { projectId: project });
+    const status = await enableAi(apiUrl, token, { projectId: project2 });
     process.stdout.write(
-      `AI enabled for ${project}.
+      `AI enabled for ${project2}.
 ` + (status.url ? `Endpoint: ${status.url} (OpenAI-compatible base URL \u2014 use it as-is)
 ` : "") + `AI_GATEWAY_URL + AI_GATEWAY_TOKEN will be injected on your next deploy (kryd deploy).
 `
@@ -16454,23 +16743,23 @@ async function runStorageDetach(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd storage detach <projectId>");
     return;
   }
   try {
-    await detachStorage(apiUrl, token, project);
-    process.stdout.write(`Detaching object storage from ${project}\u2026
+    await detachStorage(apiUrl, token, project2);
+    process.stdout.write(`Detaching object storage from ${project2}\u2026
 `);
     const result = await pollResourceDetached(
-      () => getStorageStatus(apiUrl, token, project)
+      () => getStorageStatus(apiUrl, token, project2)
     );
     reportDetachResult(result, {
-      goneMsg: `Detached object storage from ${project}.
+      goneMsg: `Detached object storage from ${project2}.
 `,
       failedLabel: "Storage detach",
-      retryCmd: `kryd storage detach ${project}`
+      retryCmd: `kryd storage detach ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -16500,6 +16789,40 @@ function envAnnotation(environments) {
   if (preview && !prod) return "  \u2192 preview only";
   return "";
 }
+async function runProjectList(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  let projects;
+  try {
+    projects = await listProjects(apiUrl, token);
+  } catch (err) {
+    reportError(err);
+    return;
+  }
+  if (projects.length === 0) {
+    process.stdout.write("No projects yet \u2014 run `kryd init` in a project directory.\n");
+    return;
+  }
+  const linkedId = resolveProjectId(void 0, opts.cwd);
+  const nameWidth = projects.reduce((max, p) => Math.max(max, p.name.length), 0);
+  const subWidth = projects.reduce((max, p) => Math.max(max, p.subdomain.length), 0);
+  const statusWidth = projects.reduce((max, p) => Math.max(max, p.status.length), 0);
+  for (const p of projects) {
+    const mark = p.id === linkedId ? "*" : " ";
+    process.stdout.write(
+      `${mark} ${p.name.padEnd(nameWidth)}  ${p.subdomain.padEnd(subWidth)}  ${p.status.padEnd(statusWidth)}  ${p.id}
+`
+    );
+  }
+  if (projects.some((p) => p.id === linkedId)) {
+    process.stdout.write("\n* linked to this directory\n");
+  }
+}
 function renderEnvGroup(heading, vars, opts) {
   const width = vars.reduce((max, v) => Math.max(max, v.key.length), 0);
   const dates = opts.showUpdated ? vars.map((v) => isoDate(v.updatedAt)) : [];
@@ -16523,16 +16846,16 @@ async function runEnvList(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd env list <projectId>");
     return;
   }
   try {
-    const vars = await listEnvVars(apiUrl, token, project);
+    const vars = await listEnvVars(apiUrl, token, project2);
     if (vars.length === 0) {
       process.stdout.write(
-        `No environment variables for ${project} yet.
+        `No environment variables for ${project2} yet.
 Set one with \`kryd env set KEY --stdin\`, or attach a database, storage or the AI gateway.
 `
       );
@@ -16605,8 +16928,8 @@ async function runEnvPull(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd env pull <projectId>");
     return;
   }
@@ -16624,11 +16947,11 @@ async function runEnvPull(opts) {
     return;
   }
   try {
-    const { values } = await pullEnvValues(apiUrl, token, project, environment);
+    const { values } = await pullEnvValues(apiUrl, token, project2, environment);
     const entries = Object.entries(values).sort(
       ([a], [b]) => a.localeCompare(b)
     );
-    const header = `# Written by \`kryd env pull\` \u2014 your customer-set variables for ${project} (${environment}).
+    const header = `# Written by \`kryd env pull\` \u2014 your customer-set variables for ${project2} (${environment}).
 # Regenerate with \`kryd env pull\`. Do not commit this file.
 `;
     const body = entries.map(([k, v]) => toDotenvLine(k, v)).join("\n");
@@ -16640,7 +16963,7 @@ ${body}
 ` : header);
     const count = entries.length;
     process.stdout.write(
-      count === 0 ? `No customer environment variables for ${project} (${environment}) \u2014 wrote an empty ${outRel}.
+      count === 0 ? `No customer environment variables for ${project2} (${environment}) \u2014 wrote an empty ${outRel}.
 ` : `Wrote ${count} variable${count === 1 ? "" : "s"} to ${outRel} (${environment}), mode 0600.
 `
     );
@@ -16706,8 +17029,8 @@ async function runEnvSet(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd env set KEY=VALUE <projectId>");
     return;
   }
@@ -16773,7 +17096,7 @@ async function runEnvSet(opts) {
     const written = await setEnvVar(
       apiUrl,
       token,
-      project,
+      project2,
       key,
       resolved.value,
       scope,
@@ -16781,7 +17104,7 @@ async function runEnvSet(opts) {
     );
     const envTag = environment === "preview" ? " (preview)" : "";
     process.stdout.write(
-      `${written.created ? "Set" : "Updated"} ${written.key}${scope === "build" ? " (build-time)" : envTag} for ${project}.
+      `${written.created ? "Set" : "Updated"} ${written.key}${scope === "build" ? " (build-time)" : envTag} for ${project2}.
 ` + // The public-bundle warning comes FIRST, before the applies-when note. Someone who reads one
       // line of output should read the consequential one.
       (scope === "build" ? `${BUILD_ENV_PUBLIC_WARNING}
@@ -16801,8 +17124,8 @@ async function runEnvRemove(opts) {
     process.exitCode = 1;
     return;
   }
-  const project = resolveProjectId(opts.project, opts.cwd);
-  if (!project) {
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
     reportNotLinked("kryd env rm KEY <projectId>");
     return;
   }
@@ -16837,10 +17160,10 @@ If it comes from a resource you attached, detach that instead (\`kryd db detach\
   }
   if (scope === "build") {
     try {
-      const vars = await listEnvVars(apiUrl, token, project, "build");
+      const vars = await listEnvVars(apiUrl, token, project2, "build");
       if (!vars.some((v) => v.key === key && v.scope === "build")) {
         process.stderr.write(
-          `${key} is not set as a build-time variable on ${project}.
+          `${key} is not set as a build-time variable on ${project2}.
 Run \`kryd env list\` to see what is set. (If you meant the runtime variable of that name, drop --build.)
 `
         );
@@ -16863,7 +17186,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
       return;
     }
     const confirmed = await promptConfirm(
-      scope === "build" ? `Remove the build-time variable ${key} from ${project}? Your next build will not have it (the current image still does).` : environment === "preview" ? `Remove the preview override for ${key} on ${project}? Previews will revert to inheriting the production value.` : `Remove ${key} from ${project}? Its stored value (production and any preview override) is deleted and cannot be recovered.`,
+      scope === "build" ? `Remove the build-time variable ${key} from ${project2}? Your next build will not have it (the current image still does).` : environment === "preview" ? `Remove the preview override for ${key} on ${project2}? Previews will revert to inheriting the production value.` : `Remove ${key} from ${project2}? Its stored value (production and any preview override) is deleted and cannot be recovered.`,
       io
     );
     if (!confirmed) {
@@ -16873,10 +17196,10 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     }
   }
   try {
-    const removed = await removeEnvVar(apiUrl, token, project, key, scope, environment);
+    const removed = await removeEnvVar(apiUrl, token, project2, key, scope, environment);
     const envTag = environment === "preview" ? " (preview override)" : "";
     process.stdout.write(
-      `Removed ${removed.key}${scope === "build" ? " (build-time)" : envTag} from ${project}.
+      `Removed ${removed.key}${scope === "build" ? " (build-time)" : envTag} from ${project2}.
 ` + // The build-scope warning is deliberately bleaker than the runtime one, because the truth is.
       // A runtime value is gone from the container at the next deploy. A build-time value is
       // COMPILED INTO the live image and into every bundle already downloaded from it — removing
@@ -16889,7 +17212,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.2.1" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.4.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
@@ -16903,7 +17226,14 @@ program.command("init").description("Link this project's repo + register its pus
   "react-router | nextjs | vite-spa | node (auto-detected if omitted)"
 ).option(
   "--tenant <slug>",
-  "your tenant slug (claimed once on first init \u2014 appears in every deploy URL)"
+  // KRYD-265 / KRYD-188: this used to say "claimed once on first init", which was false — signup
+  // has always assigned a slug, so the flag could only agree with it or 409. It now changes the
+  // slug, and only while nothing derives from it.
+  "your tenant slug \u2014 appears in every deploy URL; changeable until your first project"
+).option(
+  "--public",
+  // KRYD-184a. Chosen at creation; there is no command to flip it afterwards yet (KRYD-341).
+  "create the repository PUBLIC \u2014 readable by anyone signed in to the forge (default: private). Set at creation only"
 ).option("--api-url <url>", "control-plane API base URL").action((opts) => runInit(opts));
 program.command("logs [target]").description(
   "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: a container's stdout/stderr \u2014 [target]=a project id tails its live app, a deployment id (dpl_\u2026) tails THAT deploy's container (incl. a failed one, to see why it crashed)."
@@ -16921,24 +17251,29 @@ program.command("push [branch]").description(
 ).option("--api-url <url>", "control-plane API base URL").action(
   (branch, opts, cmd) => runPush({ ...opts, branch, gitArgs: cmd.args.slice(1) })
 );
-program.command("deploy [project]").description("Trigger a deploy of the project's production branch and follow it live").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runDeploy({ ...opts, project }));
+program.command("deploy [project]").description("Trigger a deploy of the project's production branch and follow it live").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDeploy({ ...opts, project: project2 }));
 program.command("rollback [project] [deployment]").description("Roll back to a previous successful deploy (no rebuild) and follow it live").option("--api-url <url>", "control-plane API base URL").action(
-  (project, deployment, opts) => runRollback({ ...opts, project, deployment })
+  (project2, deployment, opts) => runRollback({ ...opts, project: project2, deployment })
 );
 program.command("redeploy [project]").description(
   "Redeploy the current live commit (no rebuild) to apply config/env changes, and follow it live"
-).option("--api-url <url>", "control-plane API base URL").action((project, opts) => runRedeploy({ ...opts, project }));
+).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runRedeploy({ ...opts, project: project2 }));
+var project = program.command("project").description("Manage your projects");
+project.command("list").description("List your projects \u2014 name, subdomain, status and id").option("--api-url <url>", "control-plane API base URL").action((opts) => runProjectList(opts));
+project.command("rm [project]").description(
+  "Permanently delete a project and everything Kryd created for it (by name or id; asks you to type its name)"
+).option("--yes", "skip the confirmation (for non-interactive use)").option("--api-url <url>", "control-plane API base URL").action((projectArg, opts) => runProjectRemove({ ...opts, project: projectArg }));
 var db = program.command("db").description("Manage project databases");
 db.command("create [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
   "--connection-string <url>",
   "attach an existing database (BYO) by pasting its connection string"
-).option("--api-url <url>", "control-plane API base URL").action((project, opts) => runDbCreate({ ...opts, project }));
-db.command("detach [project]").description("Tear down the project's database and reclaim its credential").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runDbDetach({ ...opts, project }));
+).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbCreate({ ...opts, project: project2 }));
+db.command("detach [project]").description("Tear down the project's database and reclaim its credential").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbDetach({ ...opts, project: project2 }));
 var storage = program.command("storage").description("Manage project object storage");
-storage.command("create [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runStorageCreate({ ...opts, project }));
-storage.command("detach [project]").description("Tear down the project's object storage and reclaim its credentials").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runStorageDetach({ ...opts, project }));
+storage.command("create [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageCreate({ ...opts, project: project2 }));
+storage.command("detach [project]").description("Tear down the project's object storage and reclaim its credentials").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageDetach({ ...opts, project: project2 }));
 var env = program.command("env").description("Manage your app's environment variables");
-env.command("list [project]").description("List the project's environment variables (names and origin \u2014 never values)").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runEnvList({ ...opts, project }));
+env.command("list [project]").description("List the project's environment variables (names and origin \u2014 never values)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runEnvList({ ...opts, project: project2 }));
 env.command("set <key> [project]").description(
   "Set one of your environment variables \u2014 `KEY=VALUE`, or `KEY` with --stdin / a prompt"
 ).option(
@@ -16950,14 +17285,14 @@ env.command("set <key> [project]").description(
 ).option(
   "--preview",
   "set the value for PREVIEW deploys only \u2014 an override that shadows production for previews (without it, a set targets production, which previews inherit)"
-).option("--api-url <url>", "control-plane API base URL").action((key, project, opts) => runEnvSet({ ...opts, spec: key, project }));
+).option("--api-url <url>", "control-plane API base URL").action((key, project2, opts) => runEnvSet({ ...opts, spec: key, project: project2 }));
 env.command("rm <key> [project]").description("Remove one of your environment variables (asks for confirmation)").option("--yes", "skip the confirmation prompt (required when there is no terminal)").option(
   "--build",
   "remove the build-time variable of this name rather than the runtime one (the same name can exist as both)"
 ).option(
   "--preview",
   "remove only the PREVIEW override, reverting previews to inheriting production (without it, the whole key is removed \u2014 production and any preview override)"
-).option("--api-url <url>", "control-plane API base URL").action((key, project, opts) => runEnvRemove({ ...opts, key, project }));
+).option("--api-url <url>", "control-plane API base URL").action((key, project2, opts) => runEnvRemove({ ...opts, key, project: project2 }));
 env.command("pull [project]").description(
   "Write your customer-set environment variables (values included) to a local .env file for development"
 ).option(
@@ -16966,9 +17301,9 @@ env.command("pull [project]").description(
 ).option(
   "--out <path>",
   "file to write, relative to the project root (default: .env.kryd \u2014 never your hand-maintained .env)"
-).option("--force", "overwrite the --out file if it already exists").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runEnvPull({ ...opts, project }));
+).option("--force", "overwrite the --out file if it already exists").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runEnvPull({ ...opts, project: project2 }));
 var ai = program.command("ai").description("Manage the app's EU AI gateway");
-ai.command("enable [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project, opts) => runAiEnable({ ...opts, project }));
+ai.command("enable [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiEnable({ ...opts, project: project2 }));
 if (import.meta.url === `file://${process.argv[1]}`) {
   program.parseAsync().catch((err) => {
     process.stderr.write(
@@ -16992,6 +17327,8 @@ export {
   runLogin,
   runLogout,
   runLogs,
+  runProjectList,
+  runProjectRemove,
   runPush,
   runRedeploy,
   runRollback,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "Kryd CLI — push a React / Vite / Next.js app to the European cloud for your AI: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in. Your code and your model calls stay in the EU.",
   "keywords": [
     "kryd",
@@ -50,8 +50,8 @@
     "typescript": "^5.6.3",
     "vitest": "^2.1.8",
     "@kryd/shared-types": "0.0.0",
-    "@kryd/config-eslint": "0.0.0",
-    "@kryd/config-ts": "0.0.0"
+    "@kryd/config-ts": "0.0.0",
+    "@kryd/config-eslint": "0.0.0"
   },
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --define:__KRYD_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/index.js",