@kryd/cli 0.6.0 → 0.7.0

package/README.md

@@ -38,6 +38,7 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 | `kryd storage add \| remove \| status [project]` | Attach, tear down or inspect S3-compatible object storage. `remove` destroys every object and asks first. |
 | `kryd env list \| set \| rm [project]` | Manage your own environment variables. `set KEY --stdin` (or a prompt) keeps a secret out of `ps` and your shell history; values are never printed back. Add `--build` for build-time variables (`VITE_*`, `NEXT_PUBLIC_*`) — these are compiled into your public bundle, so they must never be secrets, and they take effect at your next build rather than your next deploy. |
 | `kryd ai add \| remove \| status [project]` | Give the project an authenticated EU AI-gateway endpoint (injected on the next deploy), take it away again, or show what it has. |
+| `kryd workflow add \| remove \| status [project]` | Give the project its own durable-workflow tenant — `HATCHET_CLIENT_TOKEN` is injected on the next deploy — revoke that token again, or show whether it has one and when it expires. `remove` keeps the tenant's history, crons and schedules until the project is deleted. |
 
 Run `kryd <command> --help` for options. Every project-scoped command accepts an explicit `<project>` id, or resolves it from the `.kryd` link (walking up from the current directory, git-style).
 

package/dist/index.js

@@ -14729,6 +14729,7 @@ var MANAGED_ENV_VAR_NAMES = [
   "DATABASE_URL",
   "DEPLOY_TOKEN",
   "FORGE_PASSWORD",
+  "HATCHET_CLIENT_TOKEN",
   "PUSH_TOKEN",
   "WEBHOOK_SECRET"
 ];
@@ -15296,6 +15297,57 @@ async function removeAi(apiUrl, token, projectId) {
     );
   }
 }
+function parseWorkflowStatus(body, label) {
+  const parsed = body;
+  if (!parsed || typeof parsed.enabled !== "boolean" || typeof parsed.tokenExpiresAt !== "string" && parsed.tokenExpiresAt !== null) {
+    throw new ApiError(`The API returned an unexpected ${label} response.`);
+  }
+  return { enabled: parsed.enabled, tokenExpiresAt: parsed.tokenExpiresAt };
+}
+async function addWorkflows(apiUrl, token, input) {
+  const res = await fetch(`${apiUrl}/workflows`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ projectId: input.projectId })
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow add failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  return parseWorkflowStatus(await res.json().catch(() => void 0), "workflow-add");
+}
+async function getWorkflowStatus(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow status check failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  return parseWorkflowStatus(await res.json().catch(() => void 0), "workflow-status");
+}
+async function removeWorkflows(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow removal failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+}
 async function fetchResourceStatus(apiUrl, token, path) {
   const res = await fetch(`${apiUrl}${path}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -17377,6 +17429,131 @@ async function runAiStatus(opts) {
     reportError(err);
   }
 }
+function isoDay(iso) {
+  return iso.slice(0, 10);
+}
+function daysUntil(iso) {
+  return Math.floor((new Date(iso).getTime() - Date.now()) / 864e5);
+}
+var TOKEN_EXPIRY_WARNING_DAYS = 30;
+async function runWorkflowAdd(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow add <projectId>");
+    return;
+  }
+  try {
+    const current = await getWorkflowStatus(apiUrl, token, project2);
+    if (current.enabled) {
+      process.stdout.write(
+        `${project2} already has workflows \u2014 HATCHET_CLIENT_TOKEN is injected on deploy` + (current.tokenExpiresAt ? ` and the token expires ${isoDay(current.tokenExpiresAt)}.
+` : ".\n") + `Nothing was changed. To rotate the token, run \`kryd workflow remove\` and then \`kryd workflow add\`.
+`
+      );
+      return;
+    }
+    const status = await addWorkflows(apiUrl, token, { projectId: project2 });
+    process.stdout.write(
+      `Workflows added to ${project2}.
+HATCHET_CLIENT_TOKEN will be injected on your next deploy (kryd deploy)` + (status.tokenExpiresAt ? `; the token expires ${isoDay(status.tokenExpiresAt)}.
+` : ".\n")
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runWorkflowRemove(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow remove <projectId>");
+    return;
+  }
+  let current;
+  try {
+    current = await getWorkflowStatus(apiUrl, token, project2);
+  } catch (err) {
+    reportError(err);
+    return;
+  }
+  if (!current.enabled) {
+    process.stdout.write(`${project2}: no workflow token \u2014 nothing to remove.
+`);
+    return;
+  }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `workflows from ${project2}`,
+    question: `Remove workflows from ${project2}? The token is revoked \u2014 a running worker loses its connection within seconds \u2014 and HATCHET_CLIENT_TOKEN stops being injected from your next deploy. Workflow history, crons and schedules stay until the project is deleted.`,
+    declined: `Left the workflows on ${project2} in place.
+`
+  });
+  if (!proceed) return;
+  try {
+    await removeWorkflows(apiUrl, token, project2);
+    process.stdout.write(
+      `Workflows removed from ${project2}: the token is revoked (the engine refuses it within seconds; the HTTP API within a minute) and HATCHET_CLIENT_TOKEN stops being injected from your next deploy (kryd deploy).
+Workflow history, crons and schedules stay until the project is deleted.
+`
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runWorkflowStatus(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow status <projectId>");
+    return;
+  }
+  try {
+    const status = await getWorkflowStatus(apiUrl, token, project2);
+    if (!status.enabled) {
+      process.stdout.write(`${project2}: no workflows.
+`);
+      return;
+    }
+    if (!status.tokenExpiresAt) {
+      process.stdout.write(`${project2}: workflows enabled.
+`);
+      return;
+    }
+    const days = daysUntil(status.tokenExpiresAt);
+    process.stdout.write(
+      `${project2}: workflows enabled \u2014 the token expires ${isoDay(status.tokenExpiresAt)}.
+`
+    );
+    if (days <= TOKEN_EXPIRY_WARNING_DAYS) {
+      process.stdout.write(
+        (days < 0 ? `\u26A0\uFE0F The token has EXPIRED; your worker cannot connect.` : `\u26A0\uFE0F The token expires in ${days} day${days === 1 ? "" : "s"}.`) + ` Rotate it: \`kryd workflow remove\`, then \`kryd workflow add\`, then deploy.
+`
+      );
+    }
+  } catch (err) {
+    reportError(err);
+  }
+}
 async function runStorageRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -17863,7 +18040,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.6.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.7.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
@@ -17959,6 +18136,10 @@ var ai = program.command("ai").description("Manage the app's EU AI gateway");
 ai.command("add [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiAdd({ ...opts, project: project2 }));
 ai.command("remove [project]").description("Stop injecting the project's AI endpoint (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiRemove({ ...opts, project: project2 }));
 ai.command("status [project]").description("Show whether the project has an AI endpoint, and what it is").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiStatus({ ...opts, project: project2 }));
+var workflow = program.command("workflow").description("Manage the project's durable workflows (its own workflow tenant)");
+workflow.command("add [project]").description("Give the project a workflow tenant and inject HATCHET_CLIENT_TOKEN on next deploy").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowAdd({ ...opts, project: project2 }));
+workflow.command("remove [project]").description("Revoke the project's workflow token and stop injecting it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowRemove({ ...opts, project: project2 }));
+workflow.command("status [project]").description("Show whether the project has workflows, and when its token expires").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowStatus({ ...opts, project: project2 }));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;
@@ -18004,5 +18185,8 @@ export {
   runStorageRemove,
   runStorageStatus,
   runWhoami,
+  runWorkflowAdd,
+  runWorkflowRemove,
+  runWorkflowStatus,
   splitKeyValue
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Kryd CLI — push a React / Vite / Next.js app to the European cloud for your AI: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in. Your code and your model calls stay in the EU.",
   "keywords": [
     "kryd",
@@ -49,8 +49,8 @@
     "tsx": "^4.19.2",
     "typescript": "^5.6.3",
     "vitest": "^2.1.8",
-    "@kryd/config-ts": "0.0.0",
     "@kryd/config-eslint": "0.0.0",
+    "@kryd/config-ts": "0.0.0",
     "@kryd/shared-types": "0.0.0"
   },
   "scripts": {