@kryd/cli 0.6.0 → 0.8.0

package/README.md

@@ -38,6 +38,8 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 | `kryd storage add \| remove \| status [project]` | Attach, tear down or inspect S3-compatible object storage. `remove` destroys every object and asks first. |
 | `kryd env list \| set \| rm [project]` | Manage your own environment variables. `set KEY --stdin` (or a prompt) keeps a secret out of `ps` and your shell history; values are never printed back. Add `--build` for build-time variables (`VITE_*`, `NEXT_PUBLIC_*`) — these are compiled into your public bundle, so they must never be secrets, and they take effect at your next build rather than your next deploy. |
 | `kryd ai add \| remove \| status [project]` | Give the project an authenticated EU AI-gateway endpoint (injected on the next deploy), take it away again, or show what it has. |
+| `kryd workflow add \| remove \| status [project]` | Give the project its own durable-workflow tenant — `HATCHET_CLIENT_TOKEN` is injected on the next deploy — revoke that token again, or show whether it has one and when it expires. `remove` keeps the tenant's history, crons and schedules until the project is deleted. |
+| `kryd workflow init --language <typescript\|python\|go>` | Scaffold a workflow worker here and link it as a new project. The worker ships with the small HTTP health listener Kryd's deploy gate needs — without it a deploy is torn down with "nothing listening yet" — plus a `kryd.json` that tells `kryd init` what this project is. `--no-link` writes the files only. |
 
 Run `kryd <command> --help` for options. Every project-scoped command accepts an explicit `<project>` id, or resolves it from the `.kryd` link (walking up from the current directory, git-style).
 

package/dist/index.js

@@ -14729,6 +14729,7 @@ var MANAGED_ENV_VAR_NAMES = [
   "DATABASE_URL",
   "DEPLOY_TOKEN",
   "FORGE_PASSWORD",
+  "HATCHET_CLIENT_TOKEN",
   "PUSH_TOKEN",
   "WEBHOOK_SECRET"
 ];
@@ -14894,8 +14895,14 @@ function isTerminalResourceStatus(status) {
 }
 
 // src/index.ts
-import { existsSync as existsSync3, realpathSync } from "node:fs";
-import { isAbsolute, relative, resolve } from "node:path";
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  realpathSync,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, relative, resolve as resolve2 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/config.ts
@@ -15017,6 +15024,11 @@ function ensureIgnored(cwd, entry, aliases = []) {
 function ensureKrydIgnored(cwd) {
   ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
 }
+function directoryIsLinked(cwd) {
+  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  if (!existsSync(path)) return null;
+  return loadProjectLink(cwd);
+}
 function writeSecretFile(path, contents) {
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, contents, { mode: 384 });
@@ -15057,7 +15069,7 @@ function browserLogin(dashboardUrl, opts = {}) {
   const state = randomUUID();
   const timeoutMs = opts.timeoutMs ?? 12e4;
   const shouldOpen = opts.open ?? true;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const settle = (fn) => {
       if (settled) return;
@@ -15089,7 +15101,7 @@ function browserLogin(dashboardUrl, opts = {}) {
       res.end(SUCCESS_HTML, () => {
         settle(() => {
           shutdown();
-          resolve2({ token, ...apiUrl ? { apiUrl } : {} });
+          resolve3({ token, ...apiUrl ? { apiUrl } : {} });
         });
       });
     });
@@ -15296,6 +15308,57 @@ async function removeAi(apiUrl, token, projectId) {
     );
   }
 }
+function parseWorkflowStatus(body, label) {
+  const parsed = body;
+  if (!parsed || typeof parsed.enabled !== "boolean" || typeof parsed.tokenExpiresAt !== "string" && parsed.tokenExpiresAt !== null) {
+    throw new ApiError(`The API returned an unexpected ${label} response.`);
+  }
+  return { enabled: parsed.enabled, tokenExpiresAt: parsed.tokenExpiresAt };
+}
+async function addWorkflows(apiUrl, token, input) {
+  const res = await fetch(`${apiUrl}/workflows`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ projectId: input.projectId })
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow add failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  return parseWorkflowStatus(await res.json().catch(() => void 0), "workflow-add");
+}
+async function getWorkflowStatus(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow status check failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  return parseWorkflowStatus(await res.json().catch(() => void 0), "workflow-status");
+}
+async function removeWorkflows(apiUrl, token, projectId) {
+  const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Workflow removal failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+}
 async function fetchResourceStatus(apiUrl, token, path) {
   const res = await fetch(`${apiUrl}${path}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -15712,14 +15775,14 @@ async function* readSseFrames(body) {
 }
 function abortableSleep(ms, signal) {
   if (signal?.aborted) return Promise.resolve();
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const onAbort = () => {
       clearTimeout(timer);
-      resolve2();
+      resolve3();
     };
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve2();
+      resolve3();
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -15821,11 +15884,14 @@ var FRAMEWORKS = [
   "react-router",
   "nextjs",
   "vite-spa",
-  "node"
+  "node",
+  "workflow"
 ];
 function isFramework(value) {
   return FRAMEWORKS.includes(value);
 }
+var DECLARATION_FILE = "kryd.json";
+var DECLARATION_KIND_WORKFLOW = "workflow";
 var VITE_META_FRAMEWORKS = [
   "@sveltejs/kit",
   "astro",
@@ -15867,7 +15933,22 @@ function readPackageJson(cwd) {
     return null;
   }
 }
+function declaredKind(cwd) {
+  try {
+    const parsed = JSON.parse(
+      readFileSync2(join2(cwd, DECLARATION_FILE), "utf8")
+    );
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const kind = parsed.kind;
+    return typeof kind === "string" ? kind : null;
+  } catch {
+    return null;
+  }
+}
 function frameworkFrom(pkg, cwd) {
+  if (declaredKind(cwd) === DECLARATION_KIND_WORKFLOW) return "workflow";
   const deps = { ...pkg?.dependencies, ...pkg?.devDependencies };
   const has = (name) => name in deps;
   if (has("next")) return "nextjs";
@@ -15889,6 +15970,528 @@ function inspectProject(cwd) {
   return { framework: frameworkFrom(pkg, cwd), name: nameFrom(pkg, cwd) };
 }
 
+// src/scaffold/typescript.ts
+var TYPESCRIPT_TEMPLATE = {
+  files: (workerName) => [
+    {
+      path: "package.json",
+      contents: `${JSON.stringify(
+        {
+          name: workerName,
+          private: true,
+          version: "0.1.0",
+          scripts: {
+            build: "tsc",
+            start: "node dist/worker.js"
+          },
+          engines: { node: ">=20" },
+          dependencies: {
+            "@hatchet-dev/typescript-sdk": "^1.33.0"
+          },
+          devDependencies: {
+            "@types/node": "^22.10.2",
+            typescript: "^5.7.2"
+          }
+        },
+        null,
+        2
+      )}
+`
+    },
+    {
+      path: "tsconfig.json",
+      contents: `${JSON.stringify(
+        {
+          compilerOptions: {
+            // CommonJS because the SDK is: it ships no "exports" map and no "type": "module".
+            module: "commonjs",
+            moduleResolution: "node",
+            target: "es2022",
+            lib: ["es2022"],
+            outDir: "dist",
+            rootDir: "src",
+            strict: true,
+            esModuleInterop: true,
+            skipLibCheck: true
+          },
+          include: ["src"]
+        },
+        null,
+        2
+      )}
+`
+    },
+    {
+      path: "src/hatchet.ts",
+      contents: `import { HatchetClient } from "@hatchet-dev/typescript-sdk/v1";
+
+/**
+ * Reads HATCHET_CLIENT_TOKEN from the environment and needs nothing else: the token carries the
+ * engine's addresses. Kryd injects it on every deploy once you have run \`kryd workflow add\`.
+ *
+ * It lives in its own file so tasks and the worker can share one client without importing each
+ * other in a circle.
+ */
+export const hatchet = HatchetClient.init();
+`
+    },
+    {
+      path: "src/tasks.ts",
+      contents: `import { hatchet } from "./hatchet";
+
+/**
+ * One task, to prove the wiring end to end. Add your own beside it and list them in
+ * \`src/worker.ts\` \u2014 everything about how a task runs (retries, timeouts, concurrency, crons,
+ * DAGs) belongs to the engine's SDK, not to Kryd.
+ */
+export const greet = hatchet.task({
+  name: "greet",
+  fn: (input: { name?: string }) => ({
+    greeting: \`Hello, \${input.name ?? "world"}\`,
+  }),
+});
+`
+    },
+    {
+      path: "src/worker.ts",
+      contents: `import { createServer } from "node:http";
+
+const WORKER_NAME = ${JSON.stringify(workerName)};
+
+/*
+ * The health listener, and the one piece of this file that is about Kryd rather than about workflows.
+ *
+ * A worker holds an outbound gRPC session and listens on no port of its own, but Kryd decides a
+ * deploy is live by asking GET / for a 2xx. Without this the deploy is torn down with
+ * "connection refused (nothing listening yet)".
+ *
+ * \u{1F6A8} It answers 503 until the engine has registered the worker, on purpose. Answering 200 straight
+ * away would mark the deploy live a moment before a failed registration crashes the process \u2014 which
+ * is exactly what happened while this was being measured.
+ */
+let registered = false;
+
+createServer((_req, res) => {
+  res.writeHead(registered ? 200 : 503, { "content-type": "application/json" });
+  res.end(
+    JSON.stringify({
+      worker: WORKER_NAME,
+      status: registered ? "registered" : "starting",
+    }),
+  );
+}).listen(Number(process.env.PORT ?? 8080), "0.0.0.0");
+
+async function main(): Promise<void> {
+  // Imported here rather than at the top of the file, and that is deliberate: creating the client
+  // reads and decodes HATCHET_CLIENT_TOKEN, and a token it cannot parse makes it throw during
+  // module evaluation \u2014 before the listener above ever binds. The deploy would then fail with
+  // "connection refused (nothing listening yet)", which is the one message this whole scaffold
+  // exists to stop you seeing. Binding first means a bad token shows up as a 503 plus a readable
+  // error in your deploy log.
+  const { hatchet } = await import("./hatchet");
+  const { greet } = await import("./tasks");
+
+  const worker = await hatchet.worker(WORKER_NAME, { workflows: [greet] });
+
+  // start() resolves when the worker stops, so it is not awaited here; waitUntilReady() flips the
+  // health flag once the engine has the worker. A failed registration rejects \`running\` and the
+  // process exits non-zero, which fails the deploy loudly instead of going live and crash-looping.
+  const running = worker.start();
+  void worker.waitUntilReady().then(
+    () => {
+      registered = true;
+    },
+    () => {
+      // Stays 503. The deploy gate reports it; there is nothing useful to do here.
+    },
+  );
+  await running;
+}
+
+main().catch((err: unknown) => {
+  console.error("[worker] stopped:", err);
+  process.exit(1);
+});
+`
+    },
+    {
+      path: ".gitignore",
+      contents: `node_modules/
+dist/
+.env
+.env.local
+`
+    },
+    {
+      path: "README.md",
+      contents: `# ${workerName}
+
+A Hatchet workflow worker, ready to deploy on Kryd.
+
+- \`src/tasks.ts\` holds your tasks. \`src/worker.ts\` starts the worker and serves the health
+  endpoint Kryd's deploy gate needs \u2014 keep that listener, or your deploys will be torn down.
+- **\`HATCHET_CLIENT_TOKEN\` only exists inside a deployed container.** Kryd never prints it, so you
+  cannot run this worker against your tenant from your laptop today.
+- Deploy it: \`kryd workflow add\` once, then \`kryd push\`.
+
+Full docs: https://docs.kryd.eu/docs/workflows
+`
+    }
+  ]
+};
+
+// src/scaffold/python.ts
+var PYTHON_TEMPLATE = {
+  files: (workerName) => [
+    {
+      path: "requirements.txt",
+      contents: `hatchet-sdk>=1.40.1
+`
+    },
+    {
+      path: "tasks.py",
+      contents: `from hatchet_client import hatchet
+from hatchet_sdk import Context, EmptyModel
+
+
+# One task, to prove the wiring end to end. Add your own beside it and list them in main.py \u2014
+# everything about how a task runs (retries, timeouts, concurrency, crons, DAGs) belongs to the
+# engine's SDK, not to Kryd.
+@hatchet.task(name="greet")
+def greet(input: EmptyModel, ctx: Context) -> dict[str, str]:
+    return {"greeting": "Hello, world"}
+`
+    },
+    {
+      path: "hatchet_client.py",
+      contents: `from hatchet_sdk import Hatchet
+
+# Reads HATCHET_CLIENT_TOKEN from the environment and needs nothing else: the token carries the
+# engine's addresses. Kryd injects it on every deploy once you have run \`kryd workflow add\`.
+#
+# It lives in its own module so tasks and the worker can share one client without importing each
+# other in a circle.
+hatchet = Hatchet()
+`
+    },
+    {
+      path: "main.py",
+      contents: `"""Worker entry point.
+
+\u{1F6A8} This file must stay at the project root and keep this name: Kryd's builder derives the start
+command by finding main.py here. Move it into a package and the deploy has no start command at all.
+"""
+
+import json
+import os
+import threading
+import time
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+WORKER_NAME = ${JSON.stringify(workerName)}
+
+# The health listener, and the one piece of this file that is about Kryd rather than about workflows.
+#
+# A worker holds an outbound gRPC session and listens on no port of its own, but Kryd decides a
+# deploy is live by asking GET / for a 2xx. Without this the deploy is torn down with
+# "connection refused (nothing listening yet)".
+#
+# \u{1F6A8} It answers 503 until the engine has registered the worker, on purpose. Answering 200 straight
+# away would mark the deploy live a moment before a failed registration crashes the process.
+_registered = threading.Event()
+
+
+class _Health(BaseHTTPRequestHandler):
+    def do_GET(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler's spelling
+        ready = _registered.is_set()
+        body = json.dumps(
+            {"worker": WORKER_NAME, "status": "registered" if ready else "starting"}
+        ).encode()
+        self.send_response(200 if ready else 503)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *args: object) -> None:
+        # The default handler writes every request to stderr, which would drown the worker's own
+        # logs: the deploy gate polls this endpoint every two seconds.
+        pass
+
+
+def _serve_health() -> None:
+    port = int(os.environ.get("PORT", "8080"))
+    HTTPServer(("0.0.0.0", port), _Health).serve_forever()
+
+
+def _watch_registration(worker: object) -> None:
+    # worker.start() blocks, so readiness is observed from a thread. The status enum is compared by
+    # name rather than imported: it lives at a private-ish path in the SDK and this keeps the
+    # scaffold working across SDK reshuffles.
+    #
+    # \u{1F6A8} If the SDK ever renames or drops .status, this loop would spin forever, / would answer 503
+    # forever, and the deploy would be failed by the health gate after three minutes with nothing in
+    # the log to explain it. Say so once instead: a deploy that fails is fine, a deploy that fails
+    # silently is not.
+    if not hasattr(worker, "status"):
+        print(
+            "[worker] this SDK build has no 'status' attribute, so readiness cannot be observed; "
+            "the health endpoint will stay 503 and Kryd will fail the deploy.",
+            flush=True,
+        )
+        return
+
+    while not _registered.is_set():
+        if getattr(getattr(worker, "status", None), "name", "") == "HEALTHY":
+            _registered.set()
+            return
+        time.sleep(0.2)
+
+
+def main() -> None:
+    threading.Thread(target=_serve_health, daemon=True).start()
+
+    # Imported here rather than at the top of the file, and that is deliberate: creating the client
+    # reads and decodes HATCHET_CLIENT_TOKEN, and a token it cannot parse raises during import \u2014
+    # before the listener above ever binds. The deploy would then fail with "connection refused
+    # (nothing listening yet)", which is the one message this whole scaffold exists to stop you
+    # seeing. Binding first means a bad token shows up as a 503 plus a readable error in your log.
+    from hatchet_client import hatchet
+    from tasks import greet
+
+    worker = hatchet.worker(WORKER_NAME, workflows=[greet])
+    threading.Thread(target=_watch_registration, args=(worker,), daemon=True).start()
+    worker.start()
+
+
+if __name__ == "__main__":
+    main()
+`
+    },
+    {
+      path: ".gitignore",
+      contents: `__pycache__/
+*.py[cod]
+.venv/
+venv/
+.env
+.env.local
+`
+    },
+    {
+      path: "README.md",
+      contents: `# ${workerName}
+
+A Hatchet workflow worker, ready to deploy on Kryd.
+
+- \`tasks.py\` holds your tasks. \`main.py\` starts the worker and serves the health endpoint Kryd's
+  deploy gate needs \u2014 keep that listener, and keep \`main.py\` at the root under that name, or your
+  deploys will fail.
+- **\`HATCHET_CLIENT_TOKEN\` only exists inside a deployed container.** Kryd never prints it, so you
+  cannot run this worker against your tenant from your laptop today.
+- Deploy it: \`kryd workflow add\` once, then \`kryd push\`.
+
+Full docs: https://docs.kryd.eu/docs/workflows
+`
+    }
+  ]
+};
+
+// src/scaffold/go.ts
+var GO_TEMPLATE = {
+  firstCommand: "go mod tidy",
+  files: (workerName) => [
+    {
+      path: "go.mod",
+      contents: `module kryd.local/${workerName}
+
+go 1.26
+
+toolchain go1.26.0
+
+require github.com/hatchet-dev/hatchet v0.106.10
+`
+    },
+    {
+      path: "tasks.go",
+      contents: `package main
+
+import (
+	hatchet "github.com/hatchet-dev/hatchet/sdks/go"
+)
+
+// GreetInput is what a run is triggered with.
+type GreetInput struct {
+	Name string \`json:"name"\`
+}
+
+// GreetOutput is what the task returns.
+type GreetOutput struct {
+	Greeting string \`json:"greeting"\`
+}
+
+// Greet is one task, to prove the wiring end to end. Add your own beside it and register them in
+// main.go \u2014 everything about how a task runs (retries, timeouts, concurrency, crons, DAGs) belongs
+// to the engine's SDK, not to Kryd.
+func Greet(c *hatchet.Client) *hatchet.StandaloneTask {
+	return c.NewStandaloneTask("greet", func(ctx hatchet.Context, input GreetInput) (GreetOutput, error) {
+		name := input.Name
+		if name == "" {
+			name = "world"
+		}
+		return GreetOutput{Greeting: "Hello, " + name}, nil
+	})
+}
+`
+    },
+    {
+      path: "main.go",
+      contents: `// Worker entry point.
+//
+// \u{1F6A8} This file must stay at the project root: Kryd's builder compiles the root package when one
+// exists, and otherwise picks the first cmd/* directory alphabetically \u2014 which is how a trigger
+// script ends up deployed instead of the worker.
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"sync/atomic"
+
+	"github.com/hatchet-dev/hatchet/pkg/cmdutils"
+	hatchet "github.com/hatchet-dev/hatchet/sdks/go"
+)
+
+const workerName = ${JSON.stringify(workerName)}
+
+// The health listener, and the one piece of this file that is about Kryd rather than about
+// workflows.
+//
+// A worker holds an outbound gRPC session and listens on no port of its own, but Kryd decides a
+// deploy is live by asking GET / for a 2xx. Without this the deploy is torn down with
+// "connection refused (nothing listening yet)".
+//
+// \u{1F6A8} It answers 503 until the engine has registered the worker, on purpose. Answering 200 straight
+// away would mark the deploy live a moment before a failed registration exits the process.
+var registered atomic.Bool
+
+func health(w http.ResponseWriter, _ *http.Request) {
+	ready := registered.Load()
+	status := "starting"
+	if ready {
+		status = "registered"
+	}
+	w.Header().Set("content-type", "application/json")
+	if ready {
+		w.WriteHeader(http.StatusOK)
+	} else {
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}
+	_ = json.NewEncoder(w).Encode(map[string]string{"worker": workerName, "status": status})
+}
+
+func main() {
+	port := os.Getenv("PORT")
+	if port == "" {
+		port = "8080"
+	}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/", health)
+	// Served before the worker connects, so the gate gets a 503 rather than a refused connection
+	// while registration is still in flight.
+	go func() {
+		if err := http.ListenAndServe(":"+port, mux); err != nil {
+			log.Fatalf("health listener stopped: %v", err)
+		}
+	}()
+
+	// Reads HATCHET_CLIENT_TOKEN from the environment and needs nothing else: the token carries the
+	// engine's addresses. Kryd injects it on every deploy once you have run \`kryd workflow add\`.
+	client, err := hatchet.NewClient()
+	if err != nil {
+		log.Fatalf("could not create the Hatchet client: %v", err)
+	}
+
+	worker, err := client.NewWorker(workerName, hatchet.WithWorkflows(Greet(client)))
+	if err != nil {
+		log.Fatalf("could not create the worker: %v", err)
+	}
+
+	// Start returns once the engine has registered the worker, so the flag flips exactly then.
+	cleanup, err := worker.Start()
+	if err != nil {
+		log.Fatalf("could not start the worker: %v", err)
+	}
+	registered.Store(true)
+
+	ctx, cancel := cmdutils.NewInterruptContext()
+	defer cancel()
+	<-ctx.Done()
+
+	if err := cleanup(); err != nil {
+		log.Fatalf("worker shutdown failed: %v", err)
+	}
+}
+`
+    },
+    {
+      path: ".gitignore",
+      contents: `/${workerName}
+*.exe
+.env
+.env.local
+`
+    },
+    {
+      path: "README.md",
+      contents: `# ${workerName}
+
+A Hatchet workflow worker, ready to deploy on Kryd.
+
+- Run \`go mod tidy\` once before your first push \u2014 no \`go.sum\` ships with the scaffold.
+- \`tasks.go\` holds your tasks. \`main.go\` starts the worker and serves the health endpoint Kryd's
+  deploy gate needs \u2014 keep that listener, and keep \`main.go\` at the root, or your deploys will fail.
+- **\`HATCHET_CLIENT_TOKEN\` only exists inside a deployed container.** Kryd never prints it, so you
+  cannot run this worker against your tenant from your laptop today.
+- Deploy it: \`kryd workflow add\` once, then \`kryd push\`.
+
+Full docs: https://docs.kryd.eu/docs/workflows
+`
+    }
+  ]
+};
+
+// src/scaffold/index.ts
+var SCAFFOLD_LANGUAGES = ["typescript", "python", "go"];
+function isScaffoldLanguage(value) {
+  return SCAFFOLD_LANGUAGES.includes(value);
+}
+var TEMPLATES = {
+  typescript: TYPESCRIPT_TEMPLATE,
+  python: PYTHON_TEMPLATE,
+  go: GO_TEMPLATE
+};
+function declarationFile() {
+  return {
+    path: DECLARATION_FILE,
+    contents: `${JSON.stringify({ kind: DECLARATION_KIND_WORKFLOW }, null, 2)}
+`
+  };
+}
+function scaffoldFiles(language, workerName) {
+  return [...TEMPLATES[language].files(workerName), declarationFile()];
+}
+function firstCommand(language) {
+  return TEMPLATES[language].firstCommand;
+}
+function workerNameFrom(directoryName) {
+  const slug = directoryName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+  return slug || "kryd-worker";
+}
+
 // src/progress.ts
 var STEPS = DEPLOY_STATES.filter(
   (s) => !TERMINAL_DEPLOY_STATES.includes(s)
@@ -16219,10 +16822,10 @@ async function promptHidden(question, io) {
     terminal: true
   });
   try {
-    return await new Promise((resolve2) => {
-      rl.once("SIGINT", () => resolve2(null));
-      rl.once("close", () => resolve2(null));
-      rl.question("", (answer) => resolve2(answer));
+    return await new Promise((resolve3) => {
+      rl.once("SIGINT", () => resolve3(null));
+      rl.once("close", () => resolve3(null));
+      rl.question("", (answer) => resolve3(answer));
     });
   } finally {
     rl.close();
@@ -16234,10 +16837,10 @@ async function promptHidden(question, io) {
 async function promptLine(question, io) {
   const rl = createInterface({ input: io.input, output: io.output });
   try {
-    return await new Promise((resolve2) => {
-      rl.once("SIGINT", () => resolve2(null));
-      rl.once("close", () => resolve2(null));
-      rl.question(question, (answer) => resolve2(answer));
+    return await new Promise((resolve3) => {
+      rl.once("SIGINT", () => resolve3(null));
+      rl.once("close", () => resolve3(null));
+      rl.question(question, (answer) => resolve3(answer));
     });
   } finally {
     rl.close();
@@ -16246,10 +16849,10 @@ async function promptLine(question, io) {
 async function promptConfirm(question, io) {
   const rl = createInterface({ input: io.input, output: io.output });
   try {
-    const answer = await new Promise((resolve2) => {
-      rl.once("SIGINT", () => resolve2(null));
-      rl.once("close", () => resolve2(null));
-      rl.question(`${question} [y/N] `, (a) => resolve2(a));
+    const answer = await new Promise((resolve3) => {
+      rl.once("SIGINT", () => resolve3(null));
+      rl.once("close", () => resolve3(null));
+      rl.question(`${question} [y/N] `, (a) => resolve3(a));
     });
     return answer !== null && /^y(es)?$/i.test(answer.trim());
   } finally {
@@ -16259,6 +16862,7 @@ async function promptConfirm(question, io) {
 
 // src/git.ts
 import { execFileSync, spawnSync } from "node:child_process";
+import { resolve } from "node:path";
 function authenticatedRemoteUrl(cloneUrl, username, token) {
   const prefix = "https://";
   if (!cloneUrl.startsWith(prefix)) return cloneUrl;
@@ -16323,6 +16927,21 @@ function gitAvailable(cwd) {
   if (res.status !== "ok" || res.value !== "true") return { status: "not-a-repo" };
   return { status: "ok" };
 }
+function initRepo(cwd) {
+  const existing = gitAvailable(cwd);
+  if (existing.status === "no-git") return existing;
+  if (existing.status === "ok") {
+    const top = probe(cwd, ["rev-parse", "--show-toplevel"]);
+    if (top.status === "ok" && resolve(top.value) !== resolve(cwd)) {
+      return { status: "nested", root: resolve(top.value) };
+    }
+    return { status: "already" };
+  }
+  const res = probe(cwd, ["init", "--quiet"]);
+  if (res.status === "no-git") return res;
+  if (res.status !== "ok") return { status: "failed" };
+  return { status: "ok" };
+}
 function currentBranch(cwd) {
   return probe(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
 }
@@ -16411,12 +17030,31 @@ async function runInit(opts) {
     process.exitCode = 1;
     return;
   }
+  const existingLink = directoryIsLinked(cwd);
+  if (existingLink) {
+    const remote = hasRemote(cwd, "kryd");
+    const remoteConfigured = remote.status === "ok" && remote.value;
+    if (remoteConfigured) {
+      process.stderr.write(
+        `This folder is already linked to ${existingLink.projectId} (.kryd/project.json).
+Running \`kryd init\` again would create a SECOND project and leave that one orphaned.
+To deploy it: \`kryd push\`. To start over: \`kryd project rm\` first, or delete .kryd/project.json to unlink this folder.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write(
+      `This folder is linked to ${existingLink.projectId} but has no \`kryd\` remote \u2014 finishing that setup.
+`
+    );
+  }
   const detected = inspectProject(cwd);
   let framework;
   if (opts.framework) {
     if (!isFramework(opts.framework)) {
       process.stderr.write(
-        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, vite-spa, or node.
+        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, vite-spa, node, or workflow.
 `
       );
       process.exitCode = 1;
@@ -16426,7 +17064,7 @@ async function runInit(opts) {
   } else {
     if (!detected.framework) {
       process.stderr.write(
-        "Could not detect a supported framework (React Router, Next.js, a Vite SPA, or a Node service). Pass --framework <react-router|nextjs|vite-spa|node>.\n"
+        "Could not detect a supported framework (React Router, Next.js, a Vite SPA, or a Node service). Pass --framework <react-router|nextjs|vite-spa|node>, or run `kryd workflow init` here to scaffold a workflow worker.\n"
       );
       process.exitCode = 1;
       return;
@@ -17377,6 +18015,245 @@ async function runAiStatus(opts) {
     reportError(err);
   }
 }
+function isoDay(iso) {
+  return iso.slice(0, 10);
+}
+function daysUntil(iso) {
+  return Math.floor((new Date(iso).getTime() - Date.now()) / 864e5);
+}
+var TOKEN_EXPIRY_WARNING_DAYS = 30;
+async function runWorkflowAdd(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow add <projectId>");
+    return;
+  }
+  try {
+    const current = await getWorkflowStatus(apiUrl, token, project2);
+    if (current.enabled) {
+      process.stdout.write(
+        `${project2} already has workflows \u2014 HATCHET_CLIENT_TOKEN is injected on deploy` + (current.tokenExpiresAt ? ` and the token expires ${isoDay(current.tokenExpiresAt)}.
+` : ".\n") + `Nothing was changed. To rotate the token, run \`kryd workflow remove\` and then \`kryd workflow add\`.
+`
+      );
+      return;
+    }
+    const status = await addWorkflows(apiUrl, token, { projectId: project2 });
+    process.stdout.write(
+      `Workflows added to ${project2}.
+HATCHET_CLIENT_TOKEN will be injected on your next deploy (kryd deploy)` + (status.tokenExpiresAt ? `; the token expires ${isoDay(status.tokenExpiresAt)}.
+` : ".\n")
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runWorkflowRemove(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow remove <projectId>");
+    return;
+  }
+  let current;
+  try {
+    current = await getWorkflowStatus(apiUrl, token, project2);
+  } catch (err) {
+    reportError(err);
+    return;
+  }
+  if (!current.enabled) {
+    process.stdout.write(`${project2}: no workflow token \u2014 nothing to remove.
+`);
+    return;
+  }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `workflows from ${project2}`,
+    question: `Remove workflows from ${project2}? The token is revoked \u2014 a running worker loses its connection within seconds \u2014 and HATCHET_CLIENT_TOKEN stops being injected from your next deploy. Workflow history, crons and schedules stay until the project is deleted.`,
+    declined: `Left the workflows on ${project2} in place.
+`
+  });
+  if (!proceed) return;
+  try {
+    await removeWorkflows(apiUrl, token, project2);
+    process.stdout.write(
+      `Workflows removed from ${project2}: the token is revoked (the engine refuses it within seconds; the HTTP API within a minute) and HATCHET_CLIENT_TOKEN stops being injected from your next deploy (kryd deploy).
+Workflow history, crons and schedules stay until the project is deleted.
+`
+    );
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runWorkflowStatus(opts) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd workflow status <projectId>");
+    return;
+  }
+  try {
+    const status = await getWorkflowStatus(apiUrl, token, project2);
+    if (!status.enabled) {
+      process.stdout.write(`${project2}: no workflows.
+`);
+      return;
+    }
+    if (!status.tokenExpiresAt) {
+      process.stdout.write(`${project2}: workflows enabled.
+`);
+      return;
+    }
+    const days = daysUntil(status.tokenExpiresAt);
+    process.stdout.write(
+      `${project2}: workflows enabled \u2014 the token expires ${isoDay(status.tokenExpiresAt)}.
+`
+    );
+    if (days <= TOKEN_EXPIRY_WARNING_DAYS) {
+      process.stdout.write(
+        (days < 0 ? `\u26A0\uFE0F The token has EXPIRED; your worker cannot connect.` : `\u26A0\uFE0F The token expires in ${days} day${days === 1 ? "" : "s"}.`) + ` Rotate it: \`kryd workflow remove\`, then \`kryd workflow add\`, then deploy.
+`
+      );
+    }
+  } catch (err) {
+    reportError(err);
+  }
+}
+async function runWorkflowInit(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (!opts.language) {
+    process.stderr.write(
+      `Pass --language <${SCAFFOLD_LANGUAGES.join("|")}>.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (!isScaffoldLanguage(opts.language)) {
+    process.stderr.write(
+      `Unknown language "${opts.language}" \u2014 expected ${SCAFFOLD_LANGUAGES.join(", ")}.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const language = opts.language;
+  const target = opts.dir ? resolve2(cwd, opts.dir) : cwd;
+  const workerName = workerNameFrom(opts.name ?? basename2(target));
+  const files = scaffoldFiles(language, workerName);
+  const clashes = files.map((f) => f.path).filter((p) => existsSync3(join3(target, p)));
+  if (clashes.length > 0) {
+    process.stderr.write(
+      `Refusing to overwrite: ${clashes.join(", ")}.
+Nothing was written. Run this in an empty directory, or pass --dir <path>.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const written = [];
+  try {
+    for (const file2 of files) {
+      const full = join3(target, file2.path);
+      mkdirSync2(dirname2(full), { recursive: true });
+      writeFileSync2(full, file2.contents);
+      written.push(full);
+    }
+  } catch (err) {
+    for (const path of written.reverse()) {
+      try {
+        rmSync2(path);
+      } catch {
+      }
+    }
+    process.stderr.write(
+      `Could not write the scaffold (${err instanceof Error ? err.message : String(err)}).
+Nothing was left behind.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const where = opts.dir ? `${opts.dir}/` : "";
+  process.stdout.write(
+    `Scaffolded a ${language} workflow worker${opts.dir ? ` in ${opts.dir}` : ""}:
+` + files.map((f) => `  ${where}${f.path}
+`).join("") + "\n"
+  );
+  const repo = initRepo(target);
+  if (repo.status === "nested") {
+    process.stderr.write(
+      `That directory is inside the git repository at ${repo.root}.
+A worker has to be its own repository: Kryd builds one app per repository, and git would
+write the deploy remote into the enclosing repo, so \`kryd push\` would push that tree instead.
+The files above were written \u2014 move them to a directory of their own, or run this outside that repository.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const next = [];
+  if (opts.dir) next.push(`cd ${opts.dir}`);
+  const first = firstCommand(language);
+  if (first) next.push(first);
+  next.push('git add . && git commit -m "scaffold"');
+  if (opts.link === false) {
+    next.push("kryd init", "kryd workflow add", "kryd push");
+    process.stdout.write(
+      `Next: ${next.map((c) => `\`${c}\``).join(", then ")}.
+HATCHET_CLIENT_TOKEN is injected into your container on deploy; it is never available locally.
+`
+    );
+    return;
+  }
+  if (repo.status === "failed") {
+    process.stderr.write(
+      "Could not run `git init` here, so the project was not linked \u2014 that path would print your\npush credential into this terminal. The files above are fine: fix git, run `git init`,\nthen `kryd init` in that directory.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  process.exitCode = 0;
+  await runInit({
+    cwd: target,
+    ...opts.name ? { name: opts.name } : {},
+    ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
+  });
+  if (process.exitCode) {
+    process.stderr.write(
+      "\nThe files above were written; only the link failed. Fix the problem above and run `kryd init` here.\n"
+    );
+    return;
+  }
+  next.push("kryd workflow add", "kryd push");
+  process.stdout.write(
+    `
+Next: ${next.map((c) => `\`${c}\``).join(", then ")}.
+HATCHET_CLIENT_TOKEN is injected into your container on deploy; it is never available locally.
+`
+  );
+}
 async function runStorageRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -17588,7 +18465,7 @@ async function runEnvPull(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const root = findProjectLinkDir(cwd) ?? cwd;
   const outRel = opts.out ?? ".env.kryd";
-  const outPath = resolve(root, outRel);
+  const outPath = resolve2(root, outRel);
   if (opts.out !== void 0 && existsSync3(outPath) && !opts.force) {
     process.stderr.write(
       `Refusing to overwrite ${outRel} \u2014 pass --force to replace it (or omit --out to write .env.kryd).
@@ -17863,7 +18740,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.6.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.8.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
@@ -17874,7 +18751,7 @@ program.command("whoami").description("Show the current account").option("--api-
 program.command("logout").description("Clear the stored token").action(() => runLogout());
 program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
-  "react-router | nextjs | vite-spa | node (auto-detected if omitted)"
+  "react-router | nextjs | vite-spa | node (auto-detected if omitted; `workflow` comes from a committed kryd.json)"
 ).option(
   "--tenant <slug>",
   // KRYD-265 / KRYD-188: this used to say "claimed once on first init", which was false — signup
@@ -17959,6 +18836,16 @@ var ai = program.command("ai").description("Manage the app's EU AI gateway");
 ai.command("add [project]").description("Give the project an authenticated EU AI endpoint (injects on next deploy)").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiAdd({ ...opts, project: project2 }));
 ai.command("remove [project]").description("Stop injecting the project's AI endpoint (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiRemove({ ...opts, project: project2 }));
 ai.command("status [project]").description("Show whether the project has an AI endpoint, and what it is").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runAiStatus({ ...opts, project: project2 }));
+var workflow = program.command("workflow").description("Manage the project's durable workflows (its own workflow tenant)");
+workflow.command("add [project]").description("Give the project a workflow tenant and inject HATCHET_CLIENT_TOKEN on next deploy").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowAdd({ ...opts, project: project2 }));
+workflow.command("remove [project]").description("Revoke the project's workflow token and stop injecting it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowRemove({ ...opts, project: project2 }));
+workflow.command("status [project]").description("Show whether the project has workflows, and when its token expires").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowStatus({ ...opts, project: project2 }));
+workflow.command("init").description(
+  "Scaffold a workflow worker here (with the health listener Kryd's deploy gate needs) and link it"
+).requiredOption(
+  "--language <language>",
+  `worker language: ${SCAFFOLD_LANGUAGES.join(" | ")}`
+).option("--dir <path>", "write into this directory instead of the current one").option("--name <name>", "project and worker name (defaults to the directory name)").option("--no-link", "only write the files; do not create a Kryd project").option("--api-url <url>", "control-plane API base URL").action((opts) => runWorkflowInit(opts));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;
@@ -18004,5 +18891,9 @@ export {
   runStorageRemove,
   runStorageStatus,
   runWhoami,
+  runWorkflowAdd,
+  runWorkflowInit,
+  runWorkflowRemove,
+  runWorkflowStatus,
   splitKeyValue
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Kryd CLI — push a React / Vite / Next.js app to the European cloud for your AI: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in. Your code and your model calls stay in the EU.",
   "keywords": [
     "kryd",
@@ -49,9 +49,9 @@
     "tsx": "^4.19.2",
     "typescript": "^5.6.3",
     "vitest": "^2.1.8",
-    "@kryd/config-ts": "0.0.0",
+    "@kryd/shared-types": "0.0.0",
     "@kryd/config-eslint": "0.0.0",
-    "@kryd/shared-types": "0.0.0"
+    "@kryd/config-ts": "0.0.0"
   },
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --define:__KRYD_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/index.js",