@kryd/cli 0.5.1 → 0.7.0

package/README.md

@@ -34,10 +34,11 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 | `kryd deploy [project]` | Re-deploy the production-branch HEAD already on the forge — no new commit. |
 | `kryd logs [target]` | Follow a deploy's build/deploy log **in full** — this is where the build output lives (`--runtime` tails the live container instead). |
 | `kryd rollback [project] [deployment]` | Roll back to a previous successful deploy — no rebuild. |
-| `kryd db create \| detach [project]` | Attach / tear down managed Postgres (shared or bring-your-own). |
-| `kryd storage create \| detach [project]` | Attach / tear down S3-compatible object storage. |
+| `kryd db add \| remove \| status [project]` | Attach, tear down or inspect managed Postgres (shared or bring-your-own). `remove` destroys the data and asks first. |
+| `kryd storage add \| remove \| status [project]` | Attach, tear down or inspect S3-compatible object storage. `remove` destroys every object and asks first. |
 | `kryd env list \| set \| rm [project]` | Manage your own environment variables. `set KEY --stdin` (or a prompt) keeps a secret out of `ps` and your shell history; values are never printed back. Add `--build` for build-time variables (`VITE_*`, `NEXT_PUBLIC_*`) — these are compiled into your public bundle, so they must never be secrets, and they take effect at your next build rather than your next deploy. |
-| `kryd ai enable [project]` | Give the project an authenticated EU AI-gateway endpoint (injected on the next deploy). |
+| `kryd ai add \| remove \| status [project]` | Give the project an authenticated EU AI-gateway endpoint (injected on the next deploy), take it away again, or show what it has. |
+| `kryd workflow add \| remove \| status [project]` | Give the project its own durable-workflow tenant — `HATCHET_CLIENT_TOKEN` is injected on the next deploy — revoke that token again, or show whether it has one and when it expires. `remove` keeps the tenant's history, crons and schedules until the project is deleted. |
 
 Run `kryd <command> --help` for options. Every project-scoped command accepts an explicit `<project>` id, or resolves it from the `.kryd` link (walking up from the current directory, git-style).
 

package/dist/index.js

@@ -14729,6 +14729,7 @@ var MANAGED_ENV_VAR_NAMES = [
   "DATABASE_URL",
   "DEPLOY_TOKEN",
   "FORGE_PASSWORD",
+  "HATCHET_CLIENT_TOKEN",
   "PUSH_TOKEN",
   "WEBHOOK_SECRET"
 ];
@@ -15266,6 +15267,87 @@ async function enableAi(apiUrl, token, input) {
   }
   return { enabled: true, url: parsed.url };
 }
+async function getAiStatus(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/ai/${encodeURIComponent(projectId)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `AI status check failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.enabled !== "boolean" || typeof parsed.url !== "string" && parsed.url !== null) {
+    throw new ApiError("The API returned an unexpected AI-status response.");
+  }
+  return { enabled: parsed.enabled, url: parsed.url };
+}
+async function removeAi(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/ai/${encodeURIComponent(projectId)}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `AI removal failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+}
+function parseWorkflowStatus(body, label) {
+  const parsed = body;
+  if (!parsed || typeof parsed.enabled !== "boolean" || typeof parsed.tokenExpiresAt !== "string" && parsed.tokenExpiresAt !== null) {
+    throw new ApiError(`The API returned an unexpected ${label} response.`);
+  }
+  return { enabled: parsed.enabled, tokenExpiresAt: parsed.tokenExpiresAt };
+}
+async function addWorkflows(apiUrl, token, input) {
+  const res = await fetch(`${apiUrl}/workflows`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ projectId: input.projectId })
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow add failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  return parseWorkflowStatus(await res.json().catch(() => void 0), "workflow-add");
+}
+async function getWorkflowStatus(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow status check failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  return parseWorkflowStatus(await res.json().catch(() => void 0), "workflow-status");
+}
+async function removeWorkflows(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow removal failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+}
 async function fetchResourceStatus(apiUrl, token, path) {
   const res = await fetch(`${apiUrl}${path}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -16859,7 +16941,7 @@ ${note}
     reportError(err);
   }
 }
-async function runDbCreate(opts) {
+async function runDbAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
   if (!token) {
@@ -16869,7 +16951,7 @@ async function runDbCreate(opts) {
   }
   const project2 = resolveProjectId(opts.project, opts.cwd);
   if (!project2) {
-    reportNotLinked("kryd db create <projectId>");
+    reportNotLinked("kryd db add <projectId>");
     return;
   }
   if (opts.shared && opts.connectionString !== void 0) {
@@ -16918,7 +17000,7 @@ The connection string will be injected as DATABASE_URL on your next deploy.
 The connection string will be injected as DATABASE_URL on your next deploy.
 `,
       failedLabel: "Database provisioning",
-      retryCmd: `kryd db create ${project2}`
+      retryCmd: `kryd db status ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -16940,7 +17022,7 @@ function reportSettleResult(result, opts) {
     );
   }
 }
-async function runStorageCreate(opts) {
+async function runStorageAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
   if (!token) {
@@ -16950,7 +17032,7 @@ async function runStorageCreate(opts) {
   }
   const project2 = resolveProjectId(opts.project, opts.cwd);
   if (!project2) {
-    reportNotLinked("kryd storage create <projectId>");
+    reportNotLinked("kryd storage add <projectId>");
     return;
   }
   try {
@@ -16965,7 +17047,7 @@ async function runStorageCreate(opts) {
 Its S3 credentials will be injected on your next deploy.
 `,
       failedLabel: "Storage provisioning",
-      retryCmd: `kryd storage create ${project2}`
+      retryCmd: `kryd storage status ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -16982,11 +17064,26 @@ function reportDetachResult(result, opts) {
     process.exitCode = 1;
   } else {
     process.stderr.write(
-      `Could not confirm detach \u2014 still detaching (or the worker stalled). Re-run \`${opts.retryCmd}\` to confirm the resource is gone.
+      `Could not confirm removal \u2014 still tearing down (or the worker stalled). Re-run \`${opts.retryCmd}\` to confirm the resource is gone.
+`
+    );
+    process.exitCode = 1;
+  }
+}
+async function confirmResourceRemoval(opts) {
+  if (opts.yes) return true;
+  const io = opts.io ?? defaultPromptIO();
+  if (!isInteractive(io)) {
+    process.stderr.write(
+      `Refusing to remove ${opts.subject} without confirmation. Re-run with --yes to confirm non-interactively.
 `
     );
     process.exitCode = 1;
+    return false;
   }
+  if (await promptConfirm(opts.question, io)) return true;
+  process.stdout.write(opts.declined);
+  return false;
 }
 function isProjectId(arg) {
   return arg.startsWith("proj_");
@@ -17134,7 +17231,7 @@ async function describeProjectResources(apiUrl, token, projectId) {
   out.push("its Git repository on the forge, and its push token");
   return out;
 }
-async function runDbDetach(opts) {
+async function runDbRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
   if (!token) {
@@ -17144,27 +17241,36 @@ async function runDbDetach(opts) {
   }
   const project2 = resolveProjectId(opts.project, opts.cwd);
   if (!project2) {
-    reportNotLinked("kryd db detach <projectId>");
+    reportNotLinked("kryd db remove <projectId>");
     return;
   }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `the database from ${project2}`,
+    question: `Remove the database from ${project2}? It is torn down and all the data in it is destroyed \u2014 this cannot be undone.`,
+    declined: `Left the database on ${project2} in place.
+`
+  });
+  if (!proceed) return;
   try {
     await detachDatabase(apiUrl, token, project2);
-    process.stdout.write(`Detaching the database from ${project2}\u2026
+    process.stdout.write(`Removing the database from ${project2}\u2026
 `);
     const result = await pollResourceDetached(
       () => getDatabaseStatus(apiUrl, token, project2)
     );
     reportDetachResult(result, {
-      goneMsg: `Detached the database from ${project2}.
+      goneMsg: `Removed the database from ${project2}.
 `,
-      failedLabel: "Database detach",
-      retryCmd: `kryd db detach ${project2}`
+      failedLabel: "Database removal",
+      retryCmd: `kryd db remove ${project2}`
     });
   } catch (err) {
     reportError(err);
   }
 }
-async function runAiEnable(opts) {
+async function runAiAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
   if (!token) {
@@ -17174,13 +17280,13 @@ async function runAiEnable(opts) {
   }
   const project2 = resolveProjectId(opts.project, opts.cwd);
   if (!project2) {
-    reportNotLinked("kryd ai enable <projectId>");
+    reportNotLinked("kryd ai add <projectId>");
     return;
   }
   try {
     const status = await enableAi(apiUrl, token, { projectId: project2 });
     process.stdout.write(
-      `AI enabled for ${project2}.
+      `AI endpoint added to ${project2}.
 ` + (status.url ? `Endpoint: ${status.url} (OpenAI-compatible base URL \u2014 use it as-is)
 ` : "") + `AI_GATEWAY_URL + AI_GATEWAY_TOKEN will be injected on your next deploy (kryd deploy).
 `
@@ -17189,7 +17295,7 @@ async function runAiEnable(opts) {
     reportError(err);
   }
 }
-async function runStorageDetach(opts) {
+async function runAiRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
   if (!token) {
@@ -17199,21 +17305,289 @@ async function runStorageDetach(opts) {
   }
   const project2 = resolveProjectId(opts.project, opts.cwd);
   if (!project2) {
-    reportNotLinked("kryd storage detach <projectId>");
+    reportNotLinked("kryd ai remove <projectId>");
+    return;
+  }
+  let current;
+  try {
+    current = await getAiStatus(apiUrl, token, project2);
+  } catch (err) {
+    reportError(err);
+    return;
+  }
+  if (!current.enabled) {
+    process.stdout.write(`${project2}: no AI endpoint \u2014 nothing to remove.
+`);
     return;
   }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `the AI endpoint from ${project2}`,
+    question: `Remove the AI endpoint from ${project2}? AI_GATEWAY_URL and AI_GATEWAY_TOKEN stop being injected from your next deploy.`,
+    declined: `Left the AI endpoint on ${project2} in place.
+`
+  });
+  if (!proceed) return;
+  try {
+    await removeAi(apiUrl, token, project2);
+    process.stdout.write(
+      `AI endpoint removed from ${project2}.
+AI_GATEWAY_URL and AI_GATEWAY_TOKEN stop being injected from your next deploy (kryd deploy).
+`
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function reportResourceStatus(opts) {
+  try {
+    const result = await opts.read();
+    if (result.status === "failed") {
+      process.stdout.write(
+        `${opts.project}: ${opts.noun} failed \u2014 ${result.failureReason ?? "unknown error"}.
+Remove it before attaching another.
+`
+      );
+      return;
+    }
+    process.stdout.write(`${opts.project}: ${opts.noun} ${result.status}.
+`);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      process.stdout.write(`${opts.project}: no ${opts.noun} attached.
+`);
+      return;
+    }
+    reportError(err);
+  }
+}
+async function runDbStatus(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd db status <projectId>");
+    return;
+  }
+  await reportResourceStatus({
+    read: () => getDatabaseStatus(apiUrl, token, project2),
+    noun: "database",
+    project: project2
+  });
+}
+async function runStorageStatus(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd storage status <projectId>");
+    return;
+  }
+  await reportResourceStatus({
+    read: () => getStorageStatus(apiUrl, token, project2),
+    noun: "object storage",
+    project: project2
+  });
+}
+async function runAiStatus(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd ai status <projectId>");
+    return;
+  }
+  try {
+    const status = await getAiStatus(apiUrl, token, project2);
+    if (!status.enabled) {
+      process.stdout.write(`${project2}: no AI endpoint.
+`);
+      return;
+    }
+    process.stdout.write(
+      status.url ? `${project2}: AI endpoint ${status.url}
+` : `${project2}: AI endpoint enabled, but its URL could not be read back right now.
+`
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+function isoDay(iso) {
+  return iso.slice(0, 10);
+}
+function daysUntil(iso) {
+  return Math.floor((new Date(iso).getTime() - Date.now()) / 864e5);
+}
+var TOKEN_EXPIRY_WARNING_DAYS = 30;
+async function runWorkflowAdd(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow add <projectId>");
+    return;
+  }
+  try {
+    const current = await getWorkflowStatus(apiUrl, token, project2);
+    if (current.enabled) {
+      process.stdout.write(
+        `${project2} already has workflows \u2014 HATCHET_CLIENT_TOKEN is injected on deploy` + (current.tokenExpiresAt ? ` and the token expires ${isoDay(current.tokenExpiresAt)}.
+` : ".\n") + `Nothing was changed. To rotate the token, run \`kryd workflow remove\` and then \`kryd workflow add\`.
+`
+      );
+      return;
+    }
+    const status = await addWorkflows(apiUrl, token, { projectId: project2 });
+    process.stdout.write(
+      `Workflows added to ${project2}.
+HATCHET_CLIENT_TOKEN will be injected on your next deploy (kryd deploy)` + (status.tokenExpiresAt ? `; the token expires ${isoDay(status.tokenExpiresAt)}.
+` : ".\n")
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runWorkflowRemove(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow remove <projectId>");
+    return;
+  }
+  let current;
+  try {
+    current = await getWorkflowStatus(apiUrl, token, project2);
+  } catch (err) {
+    reportError(err);
+    return;
+  }
+  if (!current.enabled) {
+    process.stdout.write(`${project2}: no workflow token \u2014 nothing to remove.
+`);
+    return;
+  }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `workflows from ${project2}`,
+    question: `Remove workflows from ${project2}? The token is revoked \u2014 a running worker loses its connection within seconds \u2014 and HATCHET_CLIENT_TOKEN stops being injected from your next deploy. Workflow history, crons and schedules stay until the project is deleted.`,
+    declined: `Left the workflows on ${project2} in place.
+`
+  });
+  if (!proceed) return;
+  try {
+    await removeWorkflows(apiUrl, token, project2);
+    process.stdout.write(
+      `Workflows removed from ${project2}: the token is revoked (the engine refuses it within seconds; the HTTP API within a minute) and HATCHET_CLIENT_TOKEN stops being injected from your next deploy (kryd deploy).
+Workflow history, crons and schedules stay until the project is deleted.
+`
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runWorkflowStatus(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow status <projectId>");
+    return;
+  }
+  try {
+    const status = await getWorkflowStatus(apiUrl, token, project2);
+    if (!status.enabled) {
+      process.stdout.write(`${project2}: no workflows.
+`);
+      return;
+    }
+    if (!status.tokenExpiresAt) {
+      process.stdout.write(`${project2}: workflows enabled.
+`);
+      return;
+    }
+    const days = daysUntil(status.tokenExpiresAt);
+    process.stdout.write(
+      `${project2}: workflows enabled \u2014 the token expires ${isoDay(status.tokenExpiresAt)}.
+`
+    );
+    if (days <= TOKEN_EXPIRY_WARNING_DAYS) {
+      process.stdout.write(
+        (days < 0 ? `\u26A0\uFE0F The token has EXPIRED; your worker cannot connect.` : `\u26A0\uFE0F The token expires in ${days} day${days === 1 ? "" : "s"}.`) + ` Rotate it: \`kryd workflow remove\`, then \`kryd workflow add\`, then deploy.
+`
+      );
+    }
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runStorageRemove(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd storage remove <projectId>");
+    return;
+  }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `object storage from ${project2}`,
+    question: `Remove object storage from ${project2}? The bucket is torn down and every object in it is destroyed \u2014 this cannot be undone.`,
+    declined: `Left the object storage on ${project2} in place.
+`
+  });
+  if (!proceed) return;
   try {
     await detachStorage(apiUrl, token, project2);
-    process.stdout.write(`Detaching object storage from ${project2}\u2026
+    process.stdout.write(`Removing object storage from ${project2}\u2026
 `);
     const result = await pollResourceDetached(
       () => getStorageStatus(apiUrl, token, project2)
     );
     reportDetachResult(result, {
-      goneMsg: `Detached object storage from ${project2}.
+      goneMsg: `Removed object storage from ${project2}.
 `,
-      failedLabel: "Storage detach",
-      retryCmd: `kryd storage detach ${project2}`
+      failedLabel: "Storage removal",
+      retryCmd: `kryd storage remove ${project2}`
     });
   } catch (err) {
     reportError(err);
@@ -17599,7 +17973,7 @@ async function runEnvRemove(opts) {
   if (isReservedEnvVarName(key)) {
     process.stderr.write(
       `${key} is reserved by Kryd and cannot be removed here.
-If it comes from a resource you attached, detach that instead (\`kryd db detach\`, \`kryd storage detach\`).
+If it comes from a resource you attached, remove that instead (\`kryd db remove\`, \`kryd storage remove\`).
 `
     );
     process.exitCode = 1;
@@ -17666,7 +18040,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.5.1" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.7.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
@@ -17718,14 +18092,16 @@ project.command("rm [project]").description(
   "Permanently delete a project and everything Kryd created for it (by name or id; asks you to type its name)"
 ).option("--yes", "skip the confirmation (for non-interactive use)").option("--api-url <url>", "control-plane API base URL").action((projectArg, opts) => runProjectRemove({ ...opts, project: projectArg }));
 var db = program.command("db").description("Manage project databases");
-db.command("create [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
+db.command("add [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
   "--connection-string <url>",
   "attach an existing database (BYO) by pasting its connection string"
-).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbCreate({ ...opts, project: project2 }));
-db.command("detach [project]").description("Tear down the project's database and reclaim its credential").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbDetach({ ...opts, project: project2 }));
+).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbAdd({ ...opts, project: project2 }));
+db.command("remove [project]").description("Tear down the project's database and everything in it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbRemove({ ...opts, project: project2 }));
+db.command("status [project]").description("Show whether the project has a database, and what state it is in").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbStatus({ ...opts, project: project2 }));
 var storage = program.command("storage").description("Manage project object storage");
-storage.command("create [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageCreate({ ...opts, project: project2 }));
-storage.command("detach [project]").description("Tear down the project's object storage and reclaim its credentials").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageDetach({ ...opts, project: project2 }));
+storage.command("add [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageAdd({ ...opts, project: project2 }));
+storage.command("remove [project]").description("Tear down the project's bucket and every object in it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageRemove({ ...opts, project: project2 }));
+storage.command("status [project]").description("Show whether the project has object storage, and what state it is in").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageStatus({ ...opts, project: project2 }));
 var env = program.command("env").description("Manage your app's environment variables");
 env.command("list [project]").description("List the project's environment variables (names and origin \u2014 never values)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runEnvList({ ...opts, project: project2 }));
 env.command("set <key> [project]").description(
@@ -17757,7 +18133,13 @@ env.command("pull [project]").description(
   "file to write, relative to the project root (default: .env.kryd \u2014 never your hand-maintained .env)"
 ).option("--force", "overwrite the --out file if it already exists").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runEnvPull({ ...opts, project: project2 }));
 var ai = program.command("ai").description("Manage the app's EU AI gateway");
-ai.command("enable [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiEnable({ ...opts, project: project2 }));
+ai.command("add [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiAdd({ ...opts, project: project2 }));
+ai.command("remove [project]").description("Stop injecting the project's AI endpoint (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiRemove({ ...opts, project: project2 }));
+ai.command("status [project]").description("Show whether the project has an AI endpoint, and what it is").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiStatus({ ...opts, project: project2 }));
+var workflow = program.command("workflow").description("Manage the project's durable workflows (its own workflow tenant)");
+workflow.command("add [project]").description("Give the project a workflow tenant and inject HATCHET_CLIENT_TOKEN on next deploy").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowAdd({ ...opts, project: project2 }));
+workflow.command("remove [project]").description("Revoke the project's workflow token and stop injecting it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowRemove({ ...opts, project: project2 }));
+workflow.command("status [project]").description("Show whether the project has workflows, and when its token expires").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowStatus({ ...opts, project: project2 }));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;
@@ -17778,9 +18160,12 @@ if (invokedDirectly()) {
 }
 export {
   program,
-  runAiEnable,
-  runDbCreate,
-  runDbDetach,
+  runAiAdd,
+  runAiRemove,
+  runAiStatus,
+  runDbAdd,
+  runDbRemove,
+  runDbStatus,
   runDeploy,
   runEnvList,
   runEnvPull,
@@ -17796,8 +18181,12 @@ export {
   runRedeploy,
   runRollback,
   runRuntimeLogs,
-  runStorageCreate,
-  runStorageDetach,
+  runStorageAdd,
+  runStorageRemove,
+  runStorageStatus,
   runWhoami,
+  runWorkflowAdd,
+  runWorkflowRemove,
+  runWorkflowStatus,
   splitKeyValue
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "description": "Kryd CLI — push a React / Vite / Next.js app to the European cloud for your AI: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in. Your code and your model calls stay in the EU.",
   "keywords": [
     "kryd",
@@ -49,9 +49,9 @@
     "tsx": "^4.19.2",
     "typescript": "^5.6.3",
     "vitest": "^2.1.8",
-    "@kryd/shared-types": "0.0.0",
+    "@kryd/config-eslint": "0.0.0",
     "@kryd/config-ts": "0.0.0",
-    "@kryd/config-eslint": "0.0.0"
+    "@kryd/shared-types": "0.0.0"
   },
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --define:__KRYD_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/index.js",