@kryd/cli 0.7.0 → 0.8.1

package/dist/index.js

@@ -14855,6 +14855,10 @@ function validateBuildEnvVarValue(value) {
 var BUILD_ENV_PUBLIC_WARNING = "\u26A0 Build-time values are compiled into your app's public bundle \u2014 anyone who loads your site can read them. Never put a secret here.";
 var BUILD_ENV_REBUILD_NOTE = "This takes effect at your next BUILD, not your next deploy \u2014 the value is compiled into the image, so redeploying the existing image keeps the old value. Push a commit (`kryd push`) to rebuild.";
 
+// ../../packages/shared-types/dist/workflow-run.js
+var MAX_WEBHOOK_NAME = 32;
+var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
+
 // ../../packages/shared-types/dist/index.js
 var DEPLOY_STATES = [
   "queued",
@@ -14895,8 +14899,14 @@ function isTerminalResourceStatus(status) {
 }
 
 // src/index.ts
-import { existsSync as existsSync3, realpathSync } from "node:fs";
-import { isAbsolute, relative, resolve } from "node:path";
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  realpathSync,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, relative, resolve as resolve2 } from "node:path";
 import { pathToFileURL } from "node:url";
 
 // src/config.ts
@@ -14950,8 +14960,13 @@ function clearToken() {
   delete config2.token;
   writeConfig(config2);
 }
+var lastApiUrl = null;
 function resolveApiUrl(flag) {
-  return flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  return lastApiUrl;
+}
+function currentApiUrl() {
+  return lastApiUrl ?? resolveApiUrl();
 }
 var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
 function resolveDashboardUrl(flag) {
@@ -15018,6 +15033,11 @@ function ensureIgnored(cwd, entry, aliases = []) {
 function ensureKrydIgnored(cwd) {
   ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
 }
+function directoryIsLinked(cwd) {
+  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  if (!existsSync(path)) return null;
+  return loadProjectLink(cwd);
+}
 function writeSecretFile(path, contents) {
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, contents, { mode: 384 });
@@ -15035,9 +15055,33 @@ function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
     return false;
   }
 }
+function resolvedLink() {
+  return lastLinkResolution;
+}
+var lastLinkResolution = null;
 function resolveProjectId(explicit, cwd = process.cwd()) {
+  lastLinkResolution = null;
   if (explicit) return explicit;
-  return loadProjectLink(cwd)?.projectId ?? null;
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const link = loadProjectLink(cwd);
+  if (!link) return null;
+  lastLinkResolution = { root, link };
+  return link.projectId;
+}
+function rememberLinkAccount(root, account) {
+  if (!account.accountId) return false;
+  const link = directoryIsLinked(root);
+  if (!link) return false;
+  const slug = account.accountSlug ?? link.accountSlug;
+  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
+  saveProjectLink(root, {
+    ...link,
+    accountId: account.accountId,
+    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
+    ...slug ? { accountSlug: slug } : {}
+  });
+  return true;
 }
 
 // src/browser-login.ts
@@ -15058,7 +15102,7 @@ function browserLogin(dashboardUrl, opts = {}) {
   const state = randomUUID();
   const timeoutMs = opts.timeoutMs ?? 12e4;
   const shouldOpen = opts.open ?? true;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let settled = false;
     const settle = (fn) => {
       if (settled) return;
@@ -15090,7 +15134,7 @@ function browserLogin(dashboardUrl, opts = {}) {
       res.end(SUCCESS_HTML, () => {
         settle(() => {
           shutdown();
-          resolve2({ token, ...apiUrl ? { apiUrl } : {} });
+          resolve3({ token, ...apiUrl ? { apiUrl } : {} });
         });
       });
     });
@@ -15125,7 +15169,15 @@ Waiting for approval\u2026
 // src/client.ts
 var ApiError = class extends Error {
   envelope;
-  /** The HTTP status of the failed response, when it came from one (used to detect a 404 = gone). */
+  /**
+   * The HTTP status of the failed response, when it came from one (used to detect a 404 = gone).
+   *
+   * ⚠️ Still optional because an `ApiError` is also thrown for a well-formed response the CLI
+   * cannot use ("the API returned an unexpected …") and for a stream's own error frame — neither
+   * has a status. Every throw that DOES hold a `Response` now passes it (KRYD-481): the 404
+   * diagnosis keys on the status, and a third of them used to omit it, which made the same
+   * failure explainable or unexplainable depending on which verb the customer typed.
+   */
   status;
   constructor(message, envelope, status) {
     super(message);
@@ -15150,7 +15202,8 @@ async function login(apiUrl, creds) {
   if (!res.ok) {
     throw new ApiError(
       `Login failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const token = res.headers.get("set-auth-token");
@@ -15166,7 +15219,8 @@ async function whoami(apiUrl, token) {
   if (!res.ok) {
     throw new ApiError(
       `Request failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   return await res.json();
@@ -15183,7 +15237,8 @@ async function linkProject(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Repo linking failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15211,7 +15266,8 @@ async function attachDatabase(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Database attach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15236,7 +15292,8 @@ async function createStorage(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Storage create failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15438,7 +15495,8 @@ async function detachDatabase(apiUrl, token, projectId) {
   if (!res.ok) {
     throw new ApiError(
       `Database detach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
 }
@@ -15448,7 +15506,7 @@ async function getProject(apiUrl, token, projectId) {
   });
   if (res.status === 404) return null;
   if (!res.ok) {
-    throw new ApiError(`Reading the project failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Reading the project failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15457,7 +15515,7 @@ async function listProjects(apiUrl, token) {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) {
-    throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).items;
 }
@@ -15467,7 +15525,7 @@ async function deleteProject(apiUrl, token, projectId) {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) {
-    throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15502,7 +15560,8 @@ async function detachStorage(apiUrl, token, projectId) {
   if (!res.ok) {
     throw new ApiError(
       `Storage detach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
 }
@@ -15668,7 +15727,7 @@ async function triggerDeploy(apiUrl, token, projectId) {
     body: JSON.stringify({ projectId })
   });
   if (!res.ok) {
-    throw new ApiError(`Deploy trigger failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Deploy trigger failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).deploymentId;
 }
@@ -15685,7 +15744,7 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
     })
   });
   if (!res.ok) {
-    throw new ApiError(`Rollback failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Rollback failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15699,7 +15758,7 @@ async function redeployProject(apiUrl, token, projectId) {
     body: JSON.stringify({ projectId })
   });
   if (!res.ok) {
-    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15708,7 +15767,7 @@ async function listDeployments(apiUrl, token, projectId) {
   if (projectId) url2.searchParams.set("projectId", projectId);
   const res = await fetch(url2, { headers: { authorization: `Bearer ${token}` } });
   if (!res.ok) {
-    throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).items;
 }
@@ -15764,14 +15823,14 @@ async function* readSseFrames(body) {
 }
 function abortableSleep(ms, signal) {
   if (signal?.aborted) return Promise.resolve();
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const onAbort = () => {
       clearTimeout(timer);
-      resolve2();
+      resolve3();
     };
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve2();
+      resolve3();
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -15787,7 +15846,7 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
         headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }
       });
       if (!res.ok) {
-        throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res));
+        throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res), res.status);
       }
       if (!res.body) throw new Error("The log stream returned no body.");
       for await (const data of readSseFrames(res.body)) {
@@ -15831,7 +15890,8 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
       if (!res.ok) {
         throw new ApiError(
           `Runtime log stream failed (${res.status})`,
-          await parseEnvelope(res)
+          await parseEnvelope(res),
+          res.status
         );
       }
       if (!res.body) throw new Error("The runtime log stream returned no body.");
@@ -15860,11 +15920,59 @@ async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
   if (!res.ok) {
     throw new ApiError(
       `Fetching the stored log failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   return (await res.json()).log;
 }
+async function fetchPushCredential(apiUrl, token, projectId) {
+  const res = await fetch(
+    `${apiUrl}/repos/${encodeURIComponent(projectId)}/push-credential`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Could not fetch the push credential (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.username !== "string" || typeof parsed.password !== "string" || parsed.password.length === 0) {
+    throw new ApiError("The API returned an unexpected push-credential response.");
+  }
+  return { username: parsed.username, password: parsed.password };
+}
+
+// src/git-credential.ts
+async function runGitCredential(operation, opts = {}) {
+  if (operation !== "get") return;
+  const input = parseCredentialInput(opts.stdin ?? "");
+  if (input.protocol && input.protocol !== "https") return;
+  const cwd = opts.cwd ?? process.cwd();
+  const token = loadConfig().token;
+  if (!token) return;
+  const projectId = resolveProjectId(void 0, cwd);
+  if (!projectId) return;
+  try {
+    const cred = await fetchPushCredential(resolveApiUrl(opts.apiUrl), token, projectId);
+    process.stdout.write(`username=${cred.username}
+password=${cred.password}
+`);
+  } catch {
+  }
+}
+function parseCredentialInput(raw) {
+  const out = {};
+  for (const line of raw.split("\n")) {
+    if (line === "") continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  return out;
+}
 
 // src/framework.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
@@ -15873,11 +15981,14 @@ var FRAMEWORKS = [
   "react-router",
   "nextjs",
   "vite-spa",
-  "node"
+  "node",
+  "workflow"
 ];
 function isFramework(value) {
   return FRAMEWORKS.includes(value);
 }
+var DECLARATION_FILE = "kryd.json";
+var DECLARATION_KIND_WORKFLOW = "workflow";
 var VITE_META_FRAMEWORKS = [
   "@sveltejs/kit",
   "astro",
@@ -15919,7 +16030,22 @@ function readPackageJson(cwd) {
     return null;
   }
 }
+function declaredKind(cwd) {
+  try {
+    const parsed = JSON.parse(
+      readFileSync2(join2(cwd, DECLARATION_FILE), "utf8")
+    );
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    const kind = parsed.kind;
+    return typeof kind === "string" ? kind : null;
+  } catch {
+    return null;
+  }
+}
 function frameworkFrom(pkg, cwd) {
+  if (declaredKind(cwd) === DECLARATION_KIND_WORKFLOW) return "workflow";
   const deps = { ...pkg?.dependencies, ...pkg?.devDependencies };
   const has = (name) => name in deps;
   if (has("next")) return "nextjs";
@@ -15941,6 +16067,528 @@ function inspectProject(cwd) {
   return { framework: frameworkFrom(pkg, cwd), name: nameFrom(pkg, cwd) };
 }
 
+// src/scaffold/typescript.ts
+var TYPESCRIPT_TEMPLATE = {
+  files: (workerName) => [
+    {
+      path: "package.json",
+      contents: `${JSON.stringify(
+        {
+          name: workerName,
+          private: true,
+          version: "0.1.0",
+          scripts: {
+            build: "tsc",
+            start: "node dist/worker.js"
+          },
+          engines: { node: ">=20" },
+          dependencies: {
+            "@hatchet-dev/typescript-sdk": "^1.33.0"
+          },
+          devDependencies: {
+            "@types/node": "^22.10.2",
+            typescript: "^5.7.2"
+          }
+        },
+        null,
+        2
+      )}
+`
+    },
+    {
+      path: "tsconfig.json",
+      contents: `${JSON.stringify(
+        {
+          compilerOptions: {
+            // CommonJS because the SDK is: it ships no "exports" map and no "type": "module".
+            module: "commonjs",
+            moduleResolution: "node",
+            target: "es2022",
+            lib: ["es2022"],
+            outDir: "dist",
+            rootDir: "src",
+            strict: true,
+            esModuleInterop: true,
+            skipLibCheck: true
+          },
+          include: ["src"]
+        },
+        null,
+        2
+      )}
+`
+    },
+    {
+      path: "src/hatchet.ts",
+      contents: `import { HatchetClient } from "@hatchet-dev/typescript-sdk/v1";
+
+/**
+ * Reads HATCHET_CLIENT_TOKEN from the environment and needs nothing else: the token carries the
+ * engine's addresses. Kryd injects it on every deploy once you have run \`kryd workflow add\`.
+ *
+ * It lives in its own file so tasks and the worker can share one client without importing each
+ * other in a circle.
+ */
+export const hatchet = HatchetClient.init();
+`
+    },
+    {
+      path: "src/tasks.ts",
+      contents: `import { hatchet } from "./hatchet";
+
+/**
+ * One task, to prove the wiring end to end. Add your own beside it and list them in
+ * \`src/worker.ts\` \u2014 everything about how a task runs (retries, timeouts, concurrency, crons,
+ * DAGs) belongs to the engine's SDK, not to Kryd.
+ */
+export const greet = hatchet.task({
+  name: "greet",
+  fn: (input: { name?: string }) => ({
+    greeting: \`Hello, \${input.name ?? "world"}\`,
+  }),
+});
+`
+    },
+    {
+      path: "src/worker.ts",
+      contents: `import { createServer } from "node:http";
+
+const WORKER_NAME = ${JSON.stringify(workerName)};
+
+/*
+ * The health listener, and the one piece of this file that is about Kryd rather than about workflows.
+ *
+ * A worker holds an outbound gRPC session and listens on no port of its own, but Kryd decides a
+ * deploy is live by asking GET / for a 2xx. Without this the deploy is torn down with
+ * "connection refused (nothing listening yet)".
+ *
+ * \u{1F6A8} It answers 503 until the engine has registered the worker, on purpose. Answering 200 straight
+ * away would mark the deploy live a moment before a failed registration crashes the process \u2014 which
+ * is exactly what happened while this was being measured.
+ */
+let registered = false;
+
+createServer((_req, res) => {
+  res.writeHead(registered ? 200 : 503, { "content-type": "application/json" });
+  res.end(
+    JSON.stringify({
+      worker: WORKER_NAME,
+      status: registered ? "registered" : "starting",
+    }),
+  );
+}).listen(Number(process.env.PORT ?? 8080), "0.0.0.0");
+
+async function main(): Promise<void> {
+  // Imported here rather than at the top of the file, and that is deliberate: creating the client
+  // reads and decodes HATCHET_CLIENT_TOKEN, and a token it cannot parse makes it throw during
+  // module evaluation \u2014 before the listener above ever binds. The deploy would then fail with
+  // "connection refused (nothing listening yet)", which is the one message this whole scaffold
+  // exists to stop you seeing. Binding first means a bad token shows up as a 503 plus a readable
+  // error in your deploy log.
+  const { hatchet } = await import("./hatchet");
+  const { greet } = await import("./tasks");
+
+  const worker = await hatchet.worker(WORKER_NAME, { workflows: [greet] });
+
+  // start() resolves when the worker stops, so it is not awaited here; waitUntilReady() flips the
+  // health flag once the engine has the worker. A failed registration rejects \`running\` and the
+  // process exits non-zero, which fails the deploy loudly instead of going live and crash-looping.
+  const running = worker.start();
+  void worker.waitUntilReady().then(
+    () => {
+      registered = true;
+    },
+    () => {
+      // Stays 503. The deploy gate reports it; there is nothing useful to do here.
+    },
+  );
+  await running;
+}
+
+main().catch((err: unknown) => {
+  console.error("[worker] stopped:", err);
+  process.exit(1);
+});
+`
+    },
+    {
+      path: ".gitignore",
+      contents: `node_modules/
+dist/
+.env
+.env.local
+`
+    },
+    {
+      path: "README.md",
+      contents: `# ${workerName}
+
+A Hatchet workflow worker, ready to deploy on Kryd.
+
+- \`src/tasks.ts\` holds your tasks. \`src/worker.ts\` starts the worker and serves the health
+  endpoint Kryd's deploy gate needs \u2014 keep that listener, or your deploys will be torn down.
+- **\`HATCHET_CLIENT_TOKEN\` only exists inside a deployed container.** Kryd never prints it, so you
+  cannot run this worker against your tenant from your laptop today.
+- Deploy it: \`kryd workflow add\` once, then \`kryd push\`.
+
+Full docs: https://docs.kryd.eu/docs/workflows
+`
+    }
+  ]
+};
+
+// src/scaffold/python.ts
+var PYTHON_TEMPLATE = {
+  files: (workerName) => [
+    {
+      path: "requirements.txt",
+      contents: `hatchet-sdk>=1.40.1
+`
+    },
+    {
+      path: "tasks.py",
+      contents: `from hatchet_client import hatchet
+from hatchet_sdk import Context, EmptyModel
+
+
+# One task, to prove the wiring end to end. Add your own beside it and list them in main.py \u2014
+# everything about how a task runs (retries, timeouts, concurrency, crons, DAGs) belongs to the
+# engine's SDK, not to Kryd.
+@hatchet.task(name="greet")
+def greet(input: EmptyModel, ctx: Context) -> dict[str, str]:
+    return {"greeting": "Hello, world"}
+`
+    },
+    {
+      path: "hatchet_client.py",
+      contents: `from hatchet_sdk import Hatchet
+
+# Reads HATCHET_CLIENT_TOKEN from the environment and needs nothing else: the token carries the
+# engine's addresses. Kryd injects it on every deploy once you have run \`kryd workflow add\`.
+#
+# It lives in its own module so tasks and the worker can share one client without importing each
+# other in a circle.
+hatchet = Hatchet()
+`
+    },
+    {
+      path: "main.py",
+      contents: `"""Worker entry point.
+
+\u{1F6A8} This file must stay at the project root and keep this name: Kryd's builder derives the start
+command by finding main.py here. Move it into a package and the deploy has no start command at all.
+"""
+
+import json
+import os
+import threading
+import time
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+WORKER_NAME = ${JSON.stringify(workerName)}
+
+# The health listener, and the one piece of this file that is about Kryd rather than about workflows.
+#
+# A worker holds an outbound gRPC session and listens on no port of its own, but Kryd decides a
+# deploy is live by asking GET / for a 2xx. Without this the deploy is torn down with
+# "connection refused (nothing listening yet)".
+#
+# \u{1F6A8} It answers 503 until the engine has registered the worker, on purpose. Answering 200 straight
+# away would mark the deploy live a moment before a failed registration crashes the process.
+_registered = threading.Event()
+
+
+class _Health(BaseHTTPRequestHandler):
+    def do_GET(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler's spelling
+        ready = _registered.is_set()
+        body = json.dumps(
+            {"worker": WORKER_NAME, "status": "registered" if ready else "starting"}
+        ).encode()
+        self.send_response(200 if ready else 503)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *args: object) -> None:
+        # The default handler writes every request to stderr, which would drown the worker's own
+        # logs: the deploy gate polls this endpoint every two seconds.
+        pass
+
+
+def _serve_health() -> None:
+    port = int(os.environ.get("PORT", "8080"))
+    HTTPServer(("0.0.0.0", port), _Health).serve_forever()
+
+
+def _watch_registration(worker: object) -> None:
+    # worker.start() blocks, so readiness is observed from a thread. The status enum is compared by
+    # name rather than imported: it lives at a private-ish path in the SDK and this keeps the
+    # scaffold working across SDK reshuffles.
+    #
+    # \u{1F6A8} If the SDK ever renames or drops .status, this loop would spin forever, / would answer 503
+    # forever, and the deploy would be failed by the health gate after three minutes with nothing in
+    # the log to explain it. Say so once instead: a deploy that fails is fine, a deploy that fails
+    # silently is not.
+    if not hasattr(worker, "status"):
+        print(
+            "[worker] this SDK build has no 'status' attribute, so readiness cannot be observed; "
+            "the health endpoint will stay 503 and Kryd will fail the deploy.",
+            flush=True,
+        )
+        return
+
+    while not _registered.is_set():
+        if getattr(getattr(worker, "status", None), "name", "") == "HEALTHY":
+            _registered.set()
+            return
+        time.sleep(0.2)
+
+
+def main() -> None:
+    threading.Thread(target=_serve_health, daemon=True).start()
+
+    # Imported here rather than at the top of the file, and that is deliberate: creating the client
+    # reads and decodes HATCHET_CLIENT_TOKEN, and a token it cannot parse raises during import \u2014
+    # before the listener above ever binds. The deploy would then fail with "connection refused
+    # (nothing listening yet)", which is the one message this whole scaffold exists to stop you
+    # seeing. Binding first means a bad token shows up as a 503 plus a readable error in your log.
+    from hatchet_client import hatchet
+    from tasks import greet
+
+    worker = hatchet.worker(WORKER_NAME, workflows=[greet])
+    threading.Thread(target=_watch_registration, args=(worker,), daemon=True).start()
+    worker.start()
+
+
+if __name__ == "__main__":
+    main()
+`
+    },
+    {
+      path: ".gitignore",
+      contents: `__pycache__/
+*.py[cod]
+.venv/
+venv/
+.env
+.env.local
+`
+    },
+    {
+      path: "README.md",
+      contents: `# ${workerName}
+
+A Hatchet workflow worker, ready to deploy on Kryd.
+
+- \`tasks.py\` holds your tasks. \`main.py\` starts the worker and serves the health endpoint Kryd's
+  deploy gate needs \u2014 keep that listener, and keep \`main.py\` at the root under that name, or your
+  deploys will fail.
+- **\`HATCHET_CLIENT_TOKEN\` only exists inside a deployed container.** Kryd never prints it, so you
+  cannot run this worker against your tenant from your laptop today.
+- Deploy it: \`kryd workflow add\` once, then \`kryd push\`.
+
+Full docs: https://docs.kryd.eu/docs/workflows
+`
+    }
+  ]
+};
+
+// src/scaffold/go.ts
+var GO_TEMPLATE = {
+  firstCommand: "go mod tidy",
+  files: (workerName) => [
+    {
+      path: "go.mod",
+      contents: `module kryd.local/${workerName}
+
+go 1.26
+
+toolchain go1.26.0
+
+require github.com/hatchet-dev/hatchet v0.106.10
+`
+    },
+    {
+      path: "tasks.go",
+      contents: `package main
+
+import (
+	hatchet "github.com/hatchet-dev/hatchet/sdks/go"
+)
+
+// GreetInput is what a run is triggered with.
+type GreetInput struct {
+	Name string \`json:"name"\`
+}
+
+// GreetOutput is what the task returns.
+type GreetOutput struct {
+	Greeting string \`json:"greeting"\`
+}
+
+// Greet is one task, to prove the wiring end to end. Add your own beside it and register them in
+// main.go \u2014 everything about how a task runs (retries, timeouts, concurrency, crons, DAGs) belongs
+// to the engine's SDK, not to Kryd.
+func Greet(c *hatchet.Client) *hatchet.StandaloneTask {
+	return c.NewStandaloneTask("greet", func(ctx hatchet.Context, input GreetInput) (GreetOutput, error) {
+		name := input.Name
+		if name == "" {
+			name = "world"
+		}
+		return GreetOutput{Greeting: "Hello, " + name}, nil
+	})
+}
+`
+    },
+    {
+      path: "main.go",
+      contents: `// Worker entry point.
+//
+// \u{1F6A8} This file must stay at the project root: Kryd's builder compiles the root package when one
+// exists, and otherwise picks the first cmd/* directory alphabetically \u2014 which is how a trigger
+// script ends up deployed instead of the worker.
+package main
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"sync/atomic"
+
+	"github.com/hatchet-dev/hatchet/pkg/cmdutils"
+	hatchet "github.com/hatchet-dev/hatchet/sdks/go"
+)
+
+const workerName = ${JSON.stringify(workerName)}
+
+// The health listener, and the one piece of this file that is about Kryd rather than about
+// workflows.
+//
+// A worker holds an outbound gRPC session and listens on no port of its own, but Kryd decides a
+// deploy is live by asking GET / for a 2xx. Without this the deploy is torn down with
+// "connection refused (nothing listening yet)".
+//
+// \u{1F6A8} It answers 503 until the engine has registered the worker, on purpose. Answering 200 straight
+// away would mark the deploy live a moment before a failed registration exits the process.
+var registered atomic.Bool
+
+func health(w http.ResponseWriter, _ *http.Request) {
+	ready := registered.Load()
+	status := "starting"
+	if ready {
+		status = "registered"
+	}
+	w.Header().Set("content-type", "application/json")
+	if ready {
+		w.WriteHeader(http.StatusOK)
+	} else {
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}
+	_ = json.NewEncoder(w).Encode(map[string]string{"worker": workerName, "status": status})
+}
+
+func main() {
+	port := os.Getenv("PORT")
+	if port == "" {
+		port = "8080"
+	}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/", health)
+	// Served before the worker connects, so the gate gets a 503 rather than a refused connection
+	// while registration is still in flight.
+	go func() {
+		if err := http.ListenAndServe(":"+port, mux); err != nil {
+			log.Fatalf("health listener stopped: %v", err)
+		}
+	}()
+
+	// Reads HATCHET_CLIENT_TOKEN from the environment and needs nothing else: the token carries the
+	// engine's addresses. Kryd injects it on every deploy once you have run \`kryd workflow add\`.
+	client, err := hatchet.NewClient()
+	if err != nil {
+		log.Fatalf("could not create the Hatchet client: %v", err)
+	}
+
+	worker, err := client.NewWorker(workerName, hatchet.WithWorkflows(Greet(client)))
+	if err != nil {
+		log.Fatalf("could not create the worker: %v", err)
+	}
+
+	// Start returns once the engine has registered the worker, so the flag flips exactly then.
+	cleanup, err := worker.Start()
+	if err != nil {
+		log.Fatalf("could not start the worker: %v", err)
+	}
+	registered.Store(true)
+
+	ctx, cancel := cmdutils.NewInterruptContext()
+	defer cancel()
+	<-ctx.Done()
+
+	if err := cleanup(); err != nil {
+		log.Fatalf("worker shutdown failed: %v", err)
+	}
+}
+`
+    },
+    {
+      path: ".gitignore",
+      contents: `/${workerName}
+*.exe
+.env
+.env.local
+`
+    },
+    {
+      path: "README.md",
+      contents: `# ${workerName}
+
+A Hatchet workflow worker, ready to deploy on Kryd.
+
+- Run \`go mod tidy\` once before your first push \u2014 no \`go.sum\` ships with the scaffold.
+- \`tasks.go\` holds your tasks. \`main.go\` starts the worker and serves the health endpoint Kryd's
+  deploy gate needs \u2014 keep that listener, and keep \`main.go\` at the root, or your deploys will fail.
+- **\`HATCHET_CLIENT_TOKEN\` only exists inside a deployed container.** Kryd never prints it, so you
+  cannot run this worker against your tenant from your laptop today.
+- Deploy it: \`kryd workflow add\` once, then \`kryd push\`.
+
+Full docs: https://docs.kryd.eu/docs/workflows
+`
+    }
+  ]
+};
+
+// src/scaffold/index.ts
+var SCAFFOLD_LANGUAGES = ["typescript", "python", "go"];
+function isScaffoldLanguage(value) {
+  return SCAFFOLD_LANGUAGES.includes(value);
+}
+var TEMPLATES = {
+  typescript: TYPESCRIPT_TEMPLATE,
+  python: PYTHON_TEMPLATE,
+  go: GO_TEMPLATE
+};
+function declarationFile() {
+  return {
+    path: DECLARATION_FILE,
+    contents: `${JSON.stringify({ kind: DECLARATION_KIND_WORKFLOW }, null, 2)}
+`
+  };
+}
+function scaffoldFiles(language, workerName) {
+  return [...TEMPLATES[language].files(workerName), declarationFile()];
+}
+function firstCommand(language) {
+  return TEMPLATES[language].firstCommand;
+}
+function workerNameFrom(directoryName) {
+  const slug = directoryName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+  return slug || "kryd-worker";
+}
+
 // src/progress.ts
 var STEPS = DEPLOY_STATES.filter(
   (s) => !TERMINAL_DEPLOY_STATES.includes(s)
@@ -16271,10 +16919,10 @@ async function promptHidden(question, io) {
     terminal: true
   });
   try {
-    return await new Promise((resolve2) => {
-      rl.once("SIGINT", () => resolve2(null));
-      rl.once("close", () => resolve2(null));
-      rl.question("", (answer) => resolve2(answer));
+    return await new Promise((resolve3) => {
+      rl.once("SIGINT", () => resolve3(null));
+      rl.once("close", () => resolve3(null));
+      rl.question("", (answer) => resolve3(answer));
     });
   } finally {
     rl.close();
@@ -16286,10 +16934,10 @@ async function promptHidden(question, io) {
 async function promptLine(question, io) {
   const rl = createInterface({ input: io.input, output: io.output });
   try {
-    return await new Promise((resolve2) => {
-      rl.once("SIGINT", () => resolve2(null));
-      rl.once("close", () => resolve2(null));
-      rl.question(question, (answer) => resolve2(answer));
+    return await new Promise((resolve3) => {
+      rl.once("SIGINT", () => resolve3(null));
+      rl.once("close", () => resolve3(null));
+      rl.question(question, (answer) => resolve3(answer));
     });
   } finally {
     rl.close();
@@ -16298,10 +16946,10 @@ async function promptLine(question, io) {
 async function promptConfirm(question, io) {
   const rl = createInterface({ input: io.input, output: io.output });
   try {
-    const answer = await new Promise((resolve2) => {
-      rl.once("SIGINT", () => resolve2(null));
-      rl.once("close", () => resolve2(null));
-      rl.question(`${question} [y/N] `, (a) => resolve2(a));
+    const answer = await new Promise((resolve3) => {
+      rl.once("SIGINT", () => resolve3(null));
+      rl.once("close", () => resolve3(null));
+      rl.question(`${question} [y/N] `, (a) => resolve3(a));
     });
     return answer !== null && /^y(es)?$/i.test(answer.trim());
   } finally {
@@ -16311,12 +16959,7 @@ async function promptConfirm(question, io) {
 
 // src/git.ts
 import { execFileSync, spawnSync } from "node:child_process";
-function authenticatedRemoteUrl(cloneUrl, username, token) {
-  const prefix = "https://";
-  if (!cloneUrl.startsWith(prefix)) return cloneUrl;
-  const creds = `${encodeURIComponent(username)}:${encodeURIComponent(token)}@`;
-  return prefix + creds + cloneUrl.slice(prefix.length);
-}
+import { resolve } from "node:path";
 function configureGitRemote(cwd, remote, url2) {
   const run = (args) => execFileSync("git", args, { cwd, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
   try {
@@ -16375,6 +17018,21 @@ function gitAvailable(cwd) {
   if (res.status !== "ok" || res.value !== "true") return { status: "not-a-repo" };
   return { status: "ok" };
 }
+function initRepo(cwd) {
+  const existing = gitAvailable(cwd);
+  if (existing.status === "no-git") return existing;
+  if (existing.status === "ok") {
+    const top = probe(cwd, ["rev-parse", "--show-toplevel"]);
+    if (top.status === "ok" && resolve(top.value) !== resolve(cwd)) {
+      return { status: "nested", root: resolve(top.value) };
+    }
+    return { status: "already" };
+  }
+  const res = probe(cwd, ["init", "--quiet"]);
+  if (res.status === "no-git") return res;
+  if (res.status !== "ok") return { status: "failed" };
+  return { status: "ok" };
+}
 function currentBranch(cwd) {
   return probe(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
 }
@@ -16394,9 +17052,32 @@ function pushBranch(cwd, remote, branch, extraArgs) {
   if (res.status === 0) return { status: "ok" };
   return { status: "failed", code: res.status ?? 1 };
 }
+function configureCredentialHelper(cwd, cloneUrl) {
+  const origin = originOf(cloneUrl);
+  if (!origin) return "unavailable";
+  const run = (args) => {
+    try {
+      execFileSync("git", args, { cwd, stdio: ["ignore", "ignore", "ignore"] });
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const ok = run(["config", `credential.${origin}.helper`, ""]) && run(["config", "--add", `credential.${origin}.helper`, "!kryd git-credential"]) && run(["config", `credential.${origin}.useHttpPath`, "true"]);
+  return ok ? "set" : "unavailable";
+}
+function originOf(url2) {
+  try {
+    const parsed = new URL(url2);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return null;
+  }
+}
 
 // src/index.ts
-function reportError(err) {
+async function reportError(err) {
   if (err instanceof ApiError && err.envelope) {
     process.stderr.write(
       `${err.envelope.error.code}: ${err.envelope.error.message}
@@ -16407,6 +17088,63 @@ function reportError(err) {
 `);
   }
   process.exitCode = 1;
+  if (err instanceof ApiError) {
+    process.stderr.write(await explainMissingProject(err));
+  }
+}
+async function projectIsVisible(token, projectId) {
+  try {
+    return await getProject(currentApiUrl(), token, projectId) !== null;
+  } catch {
+    return null;
+  }
+}
+function accountLabel(slug, id) {
+  return slug ?? id;
+}
+async function explainMissingProject(err) {
+  if (err.status !== 404) return "";
+  const resolution = resolvedLink();
+  if (!resolution) return "";
+  const token = loadConfig().token;
+  if (!token) return "";
+  if (await projectIsVisible(token, resolution.link.projectId) !== false) return "";
+  let session;
+  try {
+    session = await whoami(currentApiUrl(), token);
+  } catch {
+    return "";
+  }
+  if (!session.accountId) return "";
+  const signedInAs = accountLabel(session.accountSlug, session.accountId);
+  const linkedAccount = resolution.link.accountId;
+  if (!linkedAccount) {
+    return `This folder is linked to project ${resolution.link.projectId}, and you are signed in as ${signedInAs}. That project is not on this account \u2014 if it belongs to another one, switch with \`kryd login\` and run this again.
+`;
+  }
+  if (linkedAccount === session.accountId) {
+    return `This folder is linked to project ${resolution.link.projectId} on ${signedInAs}, which is the account you are signed in as \u2014 so that project no longer exists.
+`;
+  }
+  return `This folder is linked to a project of account ${accountLabel(resolution.link.accountSlug, linkedAccount)}, but you are signed in as ${signedInAs}. Switch with \`kryd login\` and run this again.
+`;
+}
+async function backfillLinkAccount() {
+  if (process.exitCode) return;
+  const resolution = resolvedLink();
+  if (!resolution) return;
+  if (resolution.link.accountId && resolution.link.accountSlug) return;
+  const token = loadConfig().token;
+  if (!token) return;
+  if (await projectIsVisible(token, resolution.link.projectId) !== true) return;
+  try {
+    const session = await whoami(currentApiUrl(), token);
+    rememberLinkAccount(resolution.root, {
+      accountId: session.accountId,
+      accountSlug: session.accountSlug
+    });
+  } catch {
+  }
 }
 function reportNotLinked(example) {
   process.stderr.write(
@@ -16447,7 +17185,7 @@ async function runWhoami(opts = {}) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function runLogout() {
@@ -16463,12 +17201,31 @@ async function runInit(opts) {
     process.exitCode = 1;
     return;
   }
+  const existingLink = directoryIsLinked(cwd);
+  if (existingLink) {
+    const remote = hasRemote(cwd, "kryd");
+    const remoteConfigured = remote.status === "ok" && remote.value;
+    if (remoteConfigured) {
+      process.stderr.write(
+        `This folder is already linked to ${existingLink.projectId} (.kryd/project.json).
+Running \`kryd init\` again would create a SECOND project and leave that one orphaned.
+To deploy it: \`kryd push\`. To start over: \`kryd project rm\` first, or delete .kryd/project.json to unlink this folder.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write(
+      `This folder is linked to ${existingLink.projectId} but has no \`kryd\` remote \u2014 finishing that setup.
+`
+    );
+  }
   const detected = inspectProject(cwd);
   let framework;
   if (opts.framework) {
     if (!isFramework(opts.framework)) {
       process.stderr.write(
-        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, vite-spa, or node.
+        `Unknown framework "${opts.framework}" \u2014 expected react-router, nextjs, vite-spa, node, or workflow.
 `
       );
       process.exitCode = 1;
@@ -16478,7 +17235,7 @@ async function runInit(opts) {
   } else {
     if (!detected.framework) {
       process.stderr.write(
-        "Could not detect a supported framework (React Router, Next.js, a Vite SPA, or a Node service). Pass --framework <react-router|nextjs|vite-spa|node>.\n"
+        "Could not detect a supported framework (React Router, Next.js, a Vite SPA, or a Node service). Pass --framework <react-router|nextjs|vite-spa|node>, or run `kryd workflow init` here to scaffold a workflow worker.\n"
       );
       process.exitCode = 1;
       return;
@@ -16487,7 +17244,7 @@ async function runInit(opts) {
   }
   const name = opts.name ?? detected.name;
   try {
-    const { project: project2, repo, pushToken } = await linkProject(apiUrl, token, {
+    const { project: project2, repo } = await linkProject(apiUrl, token, {
       name,
       framework,
       // First `kryd init` for the account claims the tenant slug (the vanity routing key in
@@ -16501,6 +17258,14 @@ async function runInit(opts) {
     let linkNote = "";
     try {
       saveProjectLink(cwd, { projectId: project2.id });
+      try {
+        const session = await whoami(apiUrl, token);
+        rememberLinkAccount(cwd, {
+          accountId: session.accountId,
+          accountSlug: session.accountSlug
+        });
+      } catch {
+      }
       linkNote = "Linked this folder \u2192 .kryd/project.json \u2014 `kryd deploy` / `kryd logs` now work here with no id.\n";
       try {
         ensureKrydIgnored(cwd);
@@ -16517,44 +17282,49 @@ async function runInit(opts) {
       );
     }
     const branch = repo.defaultBranch;
-    const slug = repo.fullName.split("/")[0] ?? "kryd";
-    const authedUrl = authenticatedRemoteUrl(repo.cloneUrl, slug, pushToken);
-    const remote = configureGitRemote(cwd, "kryd", authedUrl);
+    const remote = configureGitRemote(cwd, "kryd", repo.cloneUrl);
+    const helper = configureCredentialHelper(cwd, repo.cloneUrl);
     let nextStep;
     switch (remote.status) {
       case "added":
       case "updated":
-        nextStep = `${remote.status === "added" ? "Added" : "Updated"} git remote "${remote.remote}" (with your push credential).
-` + (remote.tracking === "set" ? `Tracking set: \`git push\` and \`kryd push\` both deploy this branch.
+        nextStep = `${remote.status === "added" ? "Added" : "Updated"} git remote "${remote.remote}".
+` + (helper === "set" ? "" : `\u26A0\uFE0F Could not register the credential helper, so git will ask for a password on push.
+   Run \`kryd login\` and re-run \`kryd init\` here to fix it.
+`) + (remote.tracking === "set" ? `Tracking set: \`git push\` and \`kryd push\` both deploy this branch.
 ` : remote.tracking === "kept-existing" ? `This branch already tracks another remote, so it was left alone \u2014 deploy with \`kryd push\`.
 ` : "") + `Next: kryd push   # push to deploy (same as \`git push ${remote.remote} ${branch}\`)
 `;
         break;
       case "not-a-repo":
-        nextStep = `No git repo here yet. To deploy (the URL carries your push token \u2014 keep it private):
+        nextStep = `No git repo here yet. To deploy:
   git init && git add -A && git commit -m "init"
-  git remote add kryd ${authedUrl}
+  git remote add kryd ${repo.cloneUrl}
+  kryd init          # again, to register the credential helper
   kryd push
 `;
         break;
       case "unavailable":
         nextStep = gitAvailable(cwd).status === "no-git" ? `git is not installed, so the deploy remote could not be configured.
 Install git (https://git-scm.com/downloads), then re-run \`kryd init\` here.
-` : `Add the remote, then push to deploy (the URL carries your push token \u2014 keep it private):
-  git remote add kryd ${authedUrl}
+` : `Add the remote, then push to deploy:
+  git remote add kryd ${repo.cloneUrl}
   kryd push
 `;
         break;
     }
+    const routing = project2.framework === "workflow" ? `No public URL: a workflow worker dials out to the engine and serves nothing.
+Scheduled and triggered work runs on your production deploy; preview branches build but do not start a worker.
+` : `Production URL: https://${project2.subdomain}.${PRODUCTION_TLD}
+Preview branches deploy to https://<branch>-<hash>-${project2.subdomain}.${PREVIEW_TLD}
+`;
     process.stdout.write(
       `Linked "${name}" (${project2.framework}) \u2192 ${repo.htmlUrl}
-Production URL: https://${project2.subdomain}.${PRODUCTION_TLD}
-Preview branches deploy to https://<branch>-<hash>-${project2.subdomain}.${PREVIEW_TLD}
-${linkNote}
+` + routing + `${linkNote}
 ${nextStep}`
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function formatStatus(event) {
@@ -16670,7 +17440,7 @@ async function runLogs(opts) {
     }
     await followDeploy(apiUrl, token, deploymentId);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRuntimeLogs(opts) {
@@ -16717,7 +17487,7 @@ async function runRuntimeLogs(opts) {
       }
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   } finally {
     process.off("SIGINT", onSigint);
   }
@@ -16741,7 +17511,7 @@ async function runDeploy(opts) {
 `);
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function renderFor(logs) {
@@ -16879,7 +17649,7 @@ async function runPush(opts) {
       estimateFrom: recent
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRollback(opts) {
@@ -16909,7 +17679,7 @@ async function runRollback(opts) {
     );
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRedeploy(opts) {
@@ -16938,7 +17708,7 @@ ${note}
     );
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runDbAdd(opts) {
@@ -17003,7 +17773,7 @@ The connection string will be injected as DATABASE_URL on your next deploy.
       retryCmd: `kryd db status ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function reportSettleResult(result, opts) {
@@ -17050,7 +17820,7 @@ Its S3 credentials will be injected on your next deploy.
       retryCmd: `kryd storage status ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function reportDetachResult(result, opts) {
@@ -17093,7 +17863,7 @@ async function resolveProjectIdByName(apiUrl, token, name) {
   try {
     projects = await listProjects(apiUrl, token);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return null;
   }
   const matches = projects.filter((p) => p.name === name);
@@ -17154,7 +17924,7 @@ async function runProjectRemove(opts) {
     }
     resources = project2.status === "delete_failed" ? ["whatever the previous attempt did not manage to remove"] : await describeProjectResources(apiUrl, token, projectId);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!opts.yes) {
@@ -17191,7 +17961,7 @@ async function runProjectRemove(opts) {
     );
     await followProjectDeletion(apiUrl, token, projectId, project2.name, opts);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function followProjectDeletion(apiUrl, token, projectId, name, opts) {
@@ -17267,7 +18037,7 @@ async function runDbRemove(opts) {
       retryCmd: `kryd db remove ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runAiAdd(opts) {
@@ -17292,7 +18062,7 @@ async function runAiAdd(opts) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runAiRemove(opts) {
@@ -17312,7 +18082,7 @@ async function runAiRemove(opts) {
   try {
     current = await getAiStatus(apiUrl, token, project2);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!current.enabled) {
@@ -17337,7 +18107,7 @@ AI_GATEWAY_URL and AI_GATEWAY_TOKEN stop being injected from your next deploy (k
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function reportResourceStatus(opts) {
@@ -17354,12 +18124,12 @@ Remove it before attaching another.
     process.stdout.write(`${opts.project}: ${opts.noun} ${result.status}.
 `);
   } catch (err) {
-    if (err instanceof ApiError && err.status === 404) {
+    if (err instanceof ApiError && err.status === 404 && await projectIsVisible(opts.token, opts.project) === true) {
       process.stdout.write(`${opts.project}: no ${opts.noun} attached.
 `);
       return;
     }
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runDbStatus(opts) {
@@ -17378,7 +18148,8 @@ async function runDbStatus(opts) {
   await reportResourceStatus({
     read: () => getDatabaseStatus(apiUrl, token, project2),
     noun: "database",
-    project: project2
+    project: project2,
+    token
   });
 }
 async function runStorageStatus(opts) {
@@ -17397,7 +18168,8 @@ async function runStorageStatus(opts) {
   await reportResourceStatus({
     read: () => getStorageStatus(apiUrl, token, project2),
     noun: "object storage",
-    project: project2
+    project: project2,
+    token
   });
 }
 async function runAiStatus(opts) {
@@ -17426,7 +18198,7 @@ async function runAiStatus(opts) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function isoDay(iso) {
@@ -17466,7 +18238,7 @@ HATCHET_CLIENT_TOKEN will be injected on your next deploy (kryd deploy)` + (stat
 ` : ".\n")
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runWorkflowRemove(opts) {
@@ -17486,7 +18258,7 @@ async function runWorkflowRemove(opts) {
   try {
     current = await getWorkflowStatus(apiUrl, token, project2);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!current.enabled) {
@@ -17511,7 +18283,7 @@ Workflow history, crons and schedules stay until the project is deleted.
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runWorkflowStatus(opts) {
@@ -17551,8 +18323,122 @@ async function runWorkflowStatus(opts) {
       );
     }
   } catch (err) {
-    reportError(err);
+    await reportError(err);
+  }
+}
+async function runWorkflowInit(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  if (!opts.language) {
+    process.stderr.write(
+      `Pass --language <${SCAFFOLD_LANGUAGES.join("|")}>.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (!isScaffoldLanguage(opts.language)) {
+    process.stderr.write(
+      `Unknown language "${opts.language}" \u2014 expected ${SCAFFOLD_LANGUAGES.join(", ")}.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const language = opts.language;
+  const target = opts.dir ? resolve2(cwd, opts.dir) : cwd;
+  const workerName = workerNameFrom(opts.name ?? basename2(target));
+  const files = scaffoldFiles(language, workerName);
+  const clashes = files.map((f) => f.path).filter((p) => existsSync3(join3(target, p)));
+  if (clashes.length > 0) {
+    process.stderr.write(
+      `Refusing to overwrite: ${clashes.join(", ")}.
+Nothing was written. Run this in an empty directory, or pass --dir <path>.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const written = [];
+  try {
+    for (const file2 of files) {
+      const full = join3(target, file2.path);
+      mkdirSync2(dirname2(full), { recursive: true });
+      writeFileSync2(full, file2.contents);
+      written.push(full);
+    }
+  } catch (err) {
+    for (const path of written.reverse()) {
+      try {
+        rmSync2(path);
+      } catch {
+      }
+    }
+    process.stderr.write(
+      `Could not write the scaffold (${err instanceof Error ? err.message : String(err)}).
+Nothing was left behind.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const where = opts.dir ? `${opts.dir}/` : "";
+  process.stdout.write(
+    `Scaffolded a ${language} workflow worker${opts.dir ? ` in ${opts.dir}` : ""}:
+` + files.map((f) => `  ${where}${f.path}
+`).join("") + "\n"
+  );
+  const repo = initRepo(target);
+  if (repo.status === "nested") {
+    process.stderr.write(
+      `That directory is inside the git repository at ${repo.root}.
+A worker has to be its own repository: Kryd builds one app per repository, and git would
+write the deploy remote into the enclosing repo, so \`kryd push\` would push that tree instead.
+The files above were written \u2014 move them to a directory of their own, or run this outside that repository.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const next = [];
+  if (opts.dir) next.push(`cd ${opts.dir}`);
+  const first = firstCommand(language);
+  if (first) next.push(first);
+  next.push('git add . && git commit -m "scaffold"');
+  if (opts.link === false) {
+    next.push("kryd init", "kryd workflow add", "kryd push");
+    process.stdout.write(
+      `Next: ${next.map((c) => `\`${c}\``).join(", then ")}.
+HATCHET_CLIENT_TOKEN is injected into your container on deploy; it is never available locally.
+`
+    );
+    return;
+  }
+  if (repo.status === "failed") {
+    process.stderr.write(
+      "Could not run `git init` here, so the project was not linked \u2014 that path would print your\npush credential into this terminal. The files above are fine: fix git, run `git init`,\nthen `kryd init` in that directory.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  process.exitCode = 0;
+  await runInit({
+    cwd: target,
+    ...opts.name ? { name: opts.name } : {},
+    ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
+  });
+  if (process.exitCode) {
+    process.stderr.write(
+      "\nThe files above were written; only the link failed. Fix the problem above and run `kryd init` here.\n"
+    );
+    return;
   }
+  next.push("kryd workflow add", "kryd push");
+  process.stdout.write(
+    `
+Next: ${next.map((c) => `\`${c}\``).join(", then ")}.
+HATCHET_CLIENT_TOKEN is injected into your container on deploy; it is never available locally.
+`
+  );
 }
 async function runStorageRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
@@ -17590,7 +18476,7 @@ async function runStorageRemove(opts) {
       retryCmd: `kryd storage remove ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function splitKeyValue(spec) {
@@ -17629,7 +18515,7 @@ async function runProjectList(opts) {
   try {
     projects = await listProjects(apiUrl, token);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (projects.length === 0) {
@@ -17737,7 +18623,7 @@ Set one with \`kryd env set KEY --stdin\`, or attach a database, storage or the
     out += "\nValues are never shown. This is the stored set \u2014 runtime changes reach your container at its next deploy (run `kryd redeploy` to apply them now)" + (buildVars.length > 0 ? ", and build-time changes at its next build.\n" : ".\n");
     process.stdout.write(out);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function toDotenvLine(key, value) {
@@ -17765,7 +18651,7 @@ async function runEnvPull(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const root = findProjectLinkDir(cwd) ?? cwd;
   const outRel = opts.out ?? ".env.kryd";
-  const outPath = resolve(root, outRel);
+  const outPath = resolve2(root, outRel);
   if (opts.out !== void 0 && existsSync3(outPath) && !opts.force) {
     process.stderr.write(
       `Refusing to overwrite ${outRel} \u2014 pass --force to replace it (or omit --out to write .env.kryd).
@@ -17806,7 +18692,7 @@ ${body}
       "These are your own values, read back from Kryd. Managed values (DATABASE_URL, storage, the AI gateway) are never pulled.\n"
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function resolveEnvValue(inline, opts) {
@@ -17939,7 +18825,7 @@ async function runEnvSet(opts) {
 ${NEXT_BUILD_NOTE}` : NEXT_DEPLOY_NOTE)
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runEnvRemove(opts) {
@@ -17999,7 +18885,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
         return;
       }
     } catch (err) {
-      reportError(err);
+      await reportError(err);
       return;
     }
   }
@@ -18037,21 +18923,32 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
 `)
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.7.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.8.1" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
+program.hook("postAction", async () => {
+  await backfillLinkAccount();
+});
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
   "--token <token>",
   "supply a token instead of the browser flow (prefer $KRYD_TOKEN \u2014 flags are visible in `ps`)"
 ).option("--api-url <url>", "control-plane API base URL").option("--dashboard-url <url>", "dashboard base URL for the browser approve page (default app.kryd.eu)").action((opts) => runLogin(opts));
 program.command("whoami").description("Show the current account").option("--api-url <url>", "control-plane API base URL").action((opts) => runWhoami(opts));
 program.command("logout").description("Clear the stored token").action(() => runLogout());
+program.command("git-credential <operation>", { hidden: true }).description("git credential helper (invoked by git, not by you)").option("--api-url <url>", "control-plane API base URL").action(async (operation, opts) => {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  await runGitCredential(operation, {
+    stdin: Buffer.concat(chunks).toString("utf8"),
+    ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
+  });
+});
 program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
-  "react-router | nextjs | vite-spa | node (auto-detected if omitted)"
+  "react-router | nextjs | vite-spa | node (auto-detected if omitted; `workflow` comes from a committed kryd.json)"
 ).option(
   "--tenant <slug>",
   // KRYD-265 / KRYD-188: this used to say "claimed once on first init", which was false — signup
@@ -18140,6 +19037,12 @@ var workflow = program.command("workflow").description("Manage the project's dur
 workflow.command("add [project]").description("Give the project a workflow tenant and inject HATCHET_CLIENT_TOKEN on next deploy").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowAdd({ ...opts, project: project2 }));
 workflow.command("remove [project]").description("Revoke the project's workflow token and stop injecting it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowRemove({ ...opts, project: project2 }));
 workflow.command("status [project]").description("Show whether the project has workflows, and when its token expires").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowStatus({ ...opts, project: project2 }));
+workflow.command("init").description(
+  "Scaffold a workflow worker here (with the health listener Kryd's deploy gate needs) and link it"
+).requiredOption(
+  "--language <language>",
+  `worker language: ${SCAFFOLD_LANGUAGES.join(" | ")}`
+).option("--dir <path>", "write into this directory instead of the current one").option("--name <name>", "project and worker name (defaults to the directory name)").option("--no-link", "only write the files; do not create a Kryd project").option("--api-url <url>", "control-plane API base URL").action((opts) => runWorkflowInit(opts));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;
@@ -18159,6 +19062,7 @@ if (invokedDirectly()) {
   });
 }
 export {
+  backfillLinkAccount,
   program,
   runAiAdd,
   runAiRemove,
@@ -18186,6 +19090,7 @@ export {
   runStorageStatus,
   runWhoami,
   runWorkflowAdd,
+  runWorkflowInit,
   runWorkflowRemove,
   runWorkflowStatus,
   splitKeyValue