@kryd/cli 0.8.0 → 0.8.1

package/dist/index.js

@@ -14855,6 +14855,10 @@ function validateBuildEnvVarValue(value) {
 var BUILD_ENV_PUBLIC_WARNING = "\u26A0 Build-time values are compiled into your app's public bundle \u2014 anyone who loads your site can read them. Never put a secret here.";
 var BUILD_ENV_REBUILD_NOTE = "This takes effect at your next BUILD, not your next deploy \u2014 the value is compiled into the image, so redeploying the existing image keeps the old value. Push a commit (`kryd push`) to rebuild.";
 
+// ../../packages/shared-types/dist/workflow-run.js
+var MAX_WEBHOOK_NAME = 32;
+var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
+
 // ../../packages/shared-types/dist/index.js
 var DEPLOY_STATES = [
   "queued",
@@ -14956,8 +14960,13 @@ function clearToken() {
   delete config2.token;
   writeConfig(config2);
 }
+var lastApiUrl = null;
 function resolveApiUrl(flag) {
-  return flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  return lastApiUrl;
+}
+function currentApiUrl() {
+  return lastApiUrl ?? resolveApiUrl();
 }
 var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
 function resolveDashboardUrl(flag) {
@@ -15046,9 +15055,33 @@ function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
     return false;
   }
 }
+function resolvedLink() {
+  return lastLinkResolution;
+}
+var lastLinkResolution = null;
 function resolveProjectId(explicit, cwd = process.cwd()) {
+  lastLinkResolution = null;
   if (explicit) return explicit;
-  return loadProjectLink(cwd)?.projectId ?? null;
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const link = loadProjectLink(cwd);
+  if (!link) return null;
+  lastLinkResolution = { root, link };
+  return link.projectId;
+}
+function rememberLinkAccount(root, account) {
+  if (!account.accountId) return false;
+  const link = directoryIsLinked(root);
+  if (!link) return false;
+  const slug = account.accountSlug ?? link.accountSlug;
+  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
+  saveProjectLink(root, {
+    ...link,
+    accountId: account.accountId,
+    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
+    ...slug ? { accountSlug: slug } : {}
+  });
+  return true;
 }
 
 // src/browser-login.ts
@@ -15136,7 +15169,15 @@ Waiting for approval\u2026
 // src/client.ts
 var ApiError = class extends Error {
   envelope;
-  /** The HTTP status of the failed response, when it came from one (used to detect a 404 = gone). */
+  /**
+   * The HTTP status of the failed response, when it came from one (used to detect a 404 = gone).
+   *
+   * ⚠️ Still optional because an `ApiError` is also thrown for a well-formed response the CLI
+   * cannot use ("the API returned an unexpected …") and for a stream's own error frame — neither
+   * has a status. Every throw that DOES hold a `Response` now passes it (KRYD-481): the 404
+   * diagnosis keys on the status, and a third of them used to omit it, which made the same
+   * failure explainable or unexplainable depending on which verb the customer typed.
+   */
   status;
   constructor(message, envelope, status) {
     super(message);
@@ -15161,7 +15202,8 @@ async function login(apiUrl, creds) {
   if (!res.ok) {
     throw new ApiError(
       `Login failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const token = res.headers.get("set-auth-token");
@@ -15177,7 +15219,8 @@ async function whoami(apiUrl, token) {
   if (!res.ok) {
     throw new ApiError(
       `Request failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   return await res.json();
@@ -15194,7 +15237,8 @@ async function linkProject(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Repo linking failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15222,7 +15266,8 @@ async function attachDatabase(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Database attach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15247,7 +15292,8 @@ async function createStorage(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Storage create failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15449,7 +15495,8 @@ async function detachDatabase(apiUrl, token, projectId) {
   if (!res.ok) {
     throw new ApiError(
       `Database detach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
 }
@@ -15459,7 +15506,7 @@ async function getProject(apiUrl, token, projectId) {
   });
   if (res.status === 404) return null;
   if (!res.ok) {
-    throw new ApiError(`Reading the project failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Reading the project failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15468,7 +15515,7 @@ async function listProjects(apiUrl, token) {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) {
-    throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).items;
 }
@@ -15478,7 +15525,7 @@ async function deleteProject(apiUrl, token, projectId) {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) {
-    throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15513,7 +15560,8 @@ async function detachStorage(apiUrl, token, projectId) {
   if (!res.ok) {
     throw new ApiError(
       `Storage detach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
 }
@@ -15679,7 +15727,7 @@ async function triggerDeploy(apiUrl, token, projectId) {
     body: JSON.stringify({ projectId })
   });
   if (!res.ok) {
-    throw new ApiError(`Deploy trigger failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Deploy trigger failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).deploymentId;
 }
@@ -15696,7 +15744,7 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
     })
   });
   if (!res.ok) {
-    throw new ApiError(`Rollback failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Rollback failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15710,7 +15758,7 @@ async function redeployProject(apiUrl, token, projectId) {
     body: JSON.stringify({ projectId })
   });
   if (!res.ok) {
-    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15719,7 +15767,7 @@ async function listDeployments(apiUrl, token, projectId) {
   if (projectId) url2.searchParams.set("projectId", projectId);
   const res = await fetch(url2, { headers: { authorization: `Bearer ${token}` } });
   if (!res.ok) {
-    throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).items;
 }
@@ -15798,7 +15846,7 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
         headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }
       });
       if (!res.ok) {
-        throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res));
+        throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res), res.status);
       }
       if (!res.body) throw new Error("The log stream returned no body.");
       for await (const data of readSseFrames(res.body)) {
@@ -15842,7 +15890,8 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
       if (!res.ok) {
         throw new ApiError(
           `Runtime log stream failed (${res.status})`,
-          await parseEnvelope(res)
+          await parseEnvelope(res),
+          res.status
         );
       }
       if (!res.body) throw new Error("The runtime log stream returned no body.");
@@ -15871,11 +15920,59 @@ async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
   if (!res.ok) {
     throw new ApiError(
       `Fetching the stored log failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   return (await res.json()).log;
 }
+async function fetchPushCredential(apiUrl, token, projectId) {
+  const res = await fetch(
+    `${apiUrl}/repos/${encodeURIComponent(projectId)}/push-credential`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Could not fetch the push credential (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.username !== "string" || typeof parsed.password !== "string" || parsed.password.length === 0) {
+    throw new ApiError("The API returned an unexpected push-credential response.");
+  }
+  return { username: parsed.username, password: parsed.password };
+}
+
+// src/git-credential.ts
+async function runGitCredential(operation, opts = {}) {
+  if (operation !== "get") return;
+  const input = parseCredentialInput(opts.stdin ?? "");
+  if (input.protocol && input.protocol !== "https") return;
+  const cwd = opts.cwd ?? process.cwd();
+  const token = loadConfig().token;
+  if (!token) return;
+  const projectId = resolveProjectId(void 0, cwd);
+  if (!projectId) return;
+  try {
+    const cred = await fetchPushCredential(resolveApiUrl(opts.apiUrl), token, projectId);
+    process.stdout.write(`username=${cred.username}
+password=${cred.password}
+`);
+  } catch {
+  }
+}
+function parseCredentialInput(raw) {
+  const out = {};
+  for (const line of raw.split("\n")) {
+    if (line === "") continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  return out;
+}
 
 // src/framework.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
@@ -16863,12 +16960,6 @@ async function promptConfirm(question, io) {
 // src/git.ts
 import { execFileSync, spawnSync } from "node:child_process";
 import { resolve } from "node:path";
-function authenticatedRemoteUrl(cloneUrl, username, token) {
-  const prefix = "https://";
-  if (!cloneUrl.startsWith(prefix)) return cloneUrl;
-  const creds = `${encodeURIComponent(username)}:${encodeURIComponent(token)}@`;
-  return prefix + creds + cloneUrl.slice(prefix.length);
-}
 function configureGitRemote(cwd, remote, url2) {
   const run = (args) => execFileSync("git", args, { cwd, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
   try {
@@ -16961,9 +17052,32 @@ function pushBranch(cwd, remote, branch, extraArgs) {
   if (res.status === 0) return { status: "ok" };
   return { status: "failed", code: res.status ?? 1 };
 }
+function configureCredentialHelper(cwd, cloneUrl) {
+  const origin = originOf(cloneUrl);
+  if (!origin) return "unavailable";
+  const run = (args) => {
+    try {
+      execFileSync("git", args, { cwd, stdio: ["ignore", "ignore", "ignore"] });
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const ok = run(["config", `credential.${origin}.helper`, ""]) && run(["config", "--add", `credential.${origin}.helper`, "!kryd git-credential"]) && run(["config", `credential.${origin}.useHttpPath`, "true"]);
+  return ok ? "set" : "unavailable";
+}
+function originOf(url2) {
+  try {
+    const parsed = new URL(url2);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return null;
+  }
+}
 
 // src/index.ts
-function reportError(err) {
+async function reportError(err) {
   if (err instanceof ApiError && err.envelope) {
     process.stderr.write(
       `${err.envelope.error.code}: ${err.envelope.error.message}
@@ -16974,6 +17088,63 @@ function reportError(err) {
 `);
   }
   process.exitCode = 1;
+  if (err instanceof ApiError) {
+    process.stderr.write(await explainMissingProject(err));
+  }
+}
+async function projectIsVisible(token, projectId) {
+  try {
+    return await getProject(currentApiUrl(), token, projectId) !== null;
+  } catch {
+    return null;
+  }
+}
+function accountLabel(slug, id) {
+  return slug ?? id;
+}
+async function explainMissingProject(err) {
+  if (err.status !== 404) return "";
+  const resolution = resolvedLink();
+  if (!resolution) return "";
+  const token = loadConfig().token;
+  if (!token) return "";
+  if (await projectIsVisible(token, resolution.link.projectId) !== false) return "";
+  let session;
+  try {
+    session = await whoami(currentApiUrl(), token);
+  } catch {
+    return "";
+  }
+  if (!session.accountId) return "";
+  const signedInAs = accountLabel(session.accountSlug, session.accountId);
+  const linkedAccount = resolution.link.accountId;
+  if (!linkedAccount) {
+    return `This folder is linked to project ${resolution.link.projectId}, and you are signed in as ${signedInAs}. That project is not on this account \u2014 if it belongs to another one, switch with \`kryd login\` and run this again.
+`;
+  }
+  if (linkedAccount === session.accountId) {
+    return `This folder is linked to project ${resolution.link.projectId} on ${signedInAs}, which is the account you are signed in as \u2014 so that project no longer exists.
+`;
+  }
+  return `This folder is linked to a project of account ${accountLabel(resolution.link.accountSlug, linkedAccount)}, but you are signed in as ${signedInAs}. Switch with \`kryd login\` and run this again.
+`;
+}
+async function backfillLinkAccount() {
+  if (process.exitCode) return;
+  const resolution = resolvedLink();
+  if (!resolution) return;
+  if (resolution.link.accountId && resolution.link.accountSlug) return;
+  const token = loadConfig().token;
+  if (!token) return;
+  if (await projectIsVisible(token, resolution.link.projectId) !== true) return;
+  try {
+    const session = await whoami(currentApiUrl(), token);
+    rememberLinkAccount(resolution.root, {
+      accountId: session.accountId,
+      accountSlug: session.accountSlug
+    });
+  } catch {
+  }
 }
 function reportNotLinked(example) {
   process.stderr.write(
@@ -17014,7 +17185,7 @@ async function runWhoami(opts = {}) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function runLogout() {
@@ -17073,7 +17244,7 @@ To deploy it: \`kryd push\`. To start over: \`kryd project rm\` first, or delete
   }
   const name = opts.name ?? detected.name;
   try {
-    const { project: project2, repo, pushToken } = await linkProject(apiUrl, token, {
+    const { project: project2, repo } = await linkProject(apiUrl, token, {
       name,
       framework,
       // First `kryd init` for the account claims the tenant slug (the vanity routing key in
@@ -17087,6 +17258,14 @@ To deploy it: \`kryd push\`. To start over: \`kryd project rm\` first, or delete
     let linkNote = "";
     try {
       saveProjectLink(cwd, { projectId: project2.id });
+      try {
+        const session = await whoami(apiUrl, token);
+        rememberLinkAccount(cwd, {
+          accountId: session.accountId,
+          accountSlug: session.accountSlug
+        });
+      } catch {
+      }
       linkNote = "Linked this folder \u2192 .kryd/project.json \u2014 `kryd deploy` / `kryd logs` now work here with no id.\n";
       try {
         ensureKrydIgnored(cwd);
@@ -17103,44 +17282,49 @@ To deploy it: \`kryd push\`. To start over: \`kryd project rm\` first, or delete
       );
     }
     const branch = repo.defaultBranch;
-    const slug = repo.fullName.split("/")[0] ?? "kryd";
-    const authedUrl = authenticatedRemoteUrl(repo.cloneUrl, slug, pushToken);
-    const remote = configureGitRemote(cwd, "kryd", authedUrl);
+    const remote = configureGitRemote(cwd, "kryd", repo.cloneUrl);
+    const helper = configureCredentialHelper(cwd, repo.cloneUrl);
     let nextStep;
     switch (remote.status) {
       case "added":
       case "updated":
-        nextStep = `${remote.status === "added" ? "Added" : "Updated"} git remote "${remote.remote}" (with your push credential).
-` + (remote.tracking === "set" ? `Tracking set: \`git push\` and \`kryd push\` both deploy this branch.
+        nextStep = `${remote.status === "added" ? "Added" : "Updated"} git remote "${remote.remote}".
+` + (helper === "set" ? "" : `\u26A0\uFE0F Could not register the credential helper, so git will ask for a password on push.
+   Run \`kryd login\` and re-run \`kryd init\` here to fix it.
+`) + (remote.tracking === "set" ? `Tracking set: \`git push\` and \`kryd push\` both deploy this branch.
 ` : remote.tracking === "kept-existing" ? `This branch already tracks another remote, so it was left alone \u2014 deploy with \`kryd push\`.
 ` : "") + `Next: kryd push   # push to deploy (same as \`git push ${remote.remote} ${branch}\`)
 `;
         break;
       case "not-a-repo":
-        nextStep = `No git repo here yet. To deploy (the URL carries your push token \u2014 keep it private):
+        nextStep = `No git repo here yet. To deploy:
   git init && git add -A && git commit -m "init"
-  git remote add kryd ${authedUrl}
+  git remote add kryd ${repo.cloneUrl}
+  kryd init          # again, to register the credential helper
   kryd push
 `;
         break;
       case "unavailable":
         nextStep = gitAvailable(cwd).status === "no-git" ? `git is not installed, so the deploy remote could not be configured.
 Install git (https://git-scm.com/downloads), then re-run \`kryd init\` here.
-` : `Add the remote, then push to deploy (the URL carries your push token \u2014 keep it private):
-  git remote add kryd ${authedUrl}
+` : `Add the remote, then push to deploy:
+  git remote add kryd ${repo.cloneUrl}
   kryd push
 `;
         break;
     }
+    const routing = project2.framework === "workflow" ? `No public URL: a workflow worker dials out to the engine and serves nothing.
+Scheduled and triggered work runs on your production deploy; preview branches build but do not start a worker.
+` : `Production URL: https://${project2.subdomain}.${PRODUCTION_TLD}
+Preview branches deploy to https://<branch>-<hash>-${project2.subdomain}.${PREVIEW_TLD}
+`;
     process.stdout.write(
       `Linked "${name}" (${project2.framework}) \u2192 ${repo.htmlUrl}
-Production URL: https://${project2.subdomain}.${PRODUCTION_TLD}
-Preview branches deploy to https://<branch>-<hash>-${project2.subdomain}.${PREVIEW_TLD}
-${linkNote}
+` + routing + `${linkNote}
 ${nextStep}`
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function formatStatus(event) {
@@ -17256,7 +17440,7 @@ async function runLogs(opts) {
     }
     await followDeploy(apiUrl, token, deploymentId);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRuntimeLogs(opts) {
@@ -17303,7 +17487,7 @@ async function runRuntimeLogs(opts) {
       }
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   } finally {
     process.off("SIGINT", onSigint);
   }
@@ -17327,7 +17511,7 @@ async function runDeploy(opts) {
 `);
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function renderFor(logs) {
@@ -17465,7 +17649,7 @@ async function runPush(opts) {
       estimateFrom: recent
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRollback(opts) {
@@ -17495,7 +17679,7 @@ async function runRollback(opts) {
     );
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRedeploy(opts) {
@@ -17524,7 +17708,7 @@ ${note}
     );
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runDbAdd(opts) {
@@ -17589,7 +17773,7 @@ The connection string will be injected as DATABASE_URL on your next deploy.
       retryCmd: `kryd db status ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function reportSettleResult(result, opts) {
@@ -17636,7 +17820,7 @@ Its S3 credentials will be injected on your next deploy.
       retryCmd: `kryd storage status ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function reportDetachResult(result, opts) {
@@ -17679,7 +17863,7 @@ async function resolveProjectIdByName(apiUrl, token, name) {
   try {
     projects = await listProjects(apiUrl, token);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return null;
   }
   const matches = projects.filter((p) => p.name === name);
@@ -17740,7 +17924,7 @@ async function runProjectRemove(opts) {
     }
     resources = project2.status === "delete_failed" ? ["whatever the previous attempt did not manage to remove"] : await describeProjectResources(apiUrl, token, projectId);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!opts.yes) {
@@ -17777,7 +17961,7 @@ async function runProjectRemove(opts) {
     );
     await followProjectDeletion(apiUrl, token, projectId, project2.name, opts);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function followProjectDeletion(apiUrl, token, projectId, name, opts) {
@@ -17853,7 +18037,7 @@ async function runDbRemove(opts) {
       retryCmd: `kryd db remove ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runAiAdd(opts) {
@@ -17878,7 +18062,7 @@ async function runAiAdd(opts) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runAiRemove(opts) {
@@ -17898,7 +18082,7 @@ async function runAiRemove(opts) {
   try {
     current = await getAiStatus(apiUrl, token, project2);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!current.enabled) {
@@ -17923,7 +18107,7 @@ AI_GATEWAY_URL and AI_GATEWAY_TOKEN stop being injected from your next deploy (k
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function reportResourceStatus(opts) {
@@ -17940,12 +18124,12 @@ Remove it before attaching another.
     process.stdout.write(`${opts.project}: ${opts.noun} ${result.status}.
 `);
   } catch (err) {
-    if (err instanceof ApiError && err.status === 404) {
+    if (err instanceof ApiError && err.status === 404 && await projectIsVisible(opts.token, opts.project) === true) {
       process.stdout.write(`${opts.project}: no ${opts.noun} attached.
 `);
       return;
     }
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runDbStatus(opts) {
@@ -17964,7 +18148,8 @@ async function runDbStatus(opts) {
   await reportResourceStatus({
     read: () => getDatabaseStatus(apiUrl, token, project2),
     noun: "database",
-    project: project2
+    project: project2,
+    token
   });
 }
 async function runStorageStatus(opts) {
@@ -17983,7 +18168,8 @@ async function runStorageStatus(opts) {
   await reportResourceStatus({
     read: () => getStorageStatus(apiUrl, token, project2),
     noun: "object storage",
-    project: project2
+    project: project2,
+    token
   });
 }
 async function runAiStatus(opts) {
@@ -18012,7 +18198,7 @@ async function runAiStatus(opts) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function isoDay(iso) {
@@ -18052,7 +18238,7 @@ HATCHET_CLIENT_TOKEN will be injected on your next deploy (kryd deploy)` + (stat
 ` : ".\n")
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runWorkflowRemove(opts) {
@@ -18072,7 +18258,7 @@ async function runWorkflowRemove(opts) {
   try {
     current = await getWorkflowStatus(apiUrl, token, project2);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!current.enabled) {
@@ -18097,7 +18283,7 @@ Workflow history, crons and schedules stay until the project is deleted.
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runWorkflowStatus(opts) {
@@ -18137,7 +18323,7 @@ async function runWorkflowStatus(opts) {
       );
     }
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runWorkflowInit(opts) {
@@ -18290,7 +18476,7 @@ async function runStorageRemove(opts) {
       retryCmd: `kryd storage remove ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function splitKeyValue(spec) {
@@ -18329,7 +18515,7 @@ async function runProjectList(opts) {
   try {
     projects = await listProjects(apiUrl, token);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (projects.length === 0) {
@@ -18437,7 +18623,7 @@ Set one with \`kryd env set KEY --stdin\`, or attach a database, storage or the
     out += "\nValues are never shown. This is the stored set \u2014 runtime changes reach your container at its next deploy (run `kryd redeploy` to apply them now)" + (buildVars.length > 0 ? ", and build-time changes at its next build.\n" : ".\n");
     process.stdout.write(out);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function toDotenvLine(key, value) {
@@ -18506,7 +18692,7 @@ ${body}
       "These are your own values, read back from Kryd. Managed values (DATABASE_URL, storage, the AI gateway) are never pulled.\n"
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function resolveEnvValue(inline, opts) {
@@ -18639,7 +18825,7 @@ async function runEnvSet(opts) {
 ${NEXT_BUILD_NOTE}` : NEXT_DEPLOY_NOTE)
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runEnvRemove(opts) {
@@ -18699,7 +18885,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
         return;
       }
     } catch (err) {
-      reportError(err);
+      await reportError(err);
       return;
     }
   }
@@ -18737,18 +18923,29 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
 `)
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.8.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.8.1" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
+program.hook("postAction", async () => {
+  await backfillLinkAccount();
+});
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
   "--token <token>",
   "supply a token instead of the browser flow (prefer $KRYD_TOKEN \u2014 flags are visible in `ps`)"
 ).option("--api-url <url>", "control-plane API base URL").option("--dashboard-url <url>", "dashboard base URL for the browser approve page (default app.kryd.eu)").action((opts) => runLogin(opts));
 program.command("whoami").description("Show the current account").option("--api-url <url>", "control-plane API base URL").action((opts) => runWhoami(opts));
 program.command("logout").description("Clear the stored token").action(() => runLogout());
+program.command("git-credential <operation>", { hidden: true }).description("git credential helper (invoked by git, not by you)").option("--api-url <url>", "control-plane API base URL").action(async (operation, opts) => {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  await runGitCredential(operation, {
+    stdin: Buffer.concat(chunks).toString("utf8"),
+    ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
+  });
+});
 program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
   "react-router | nextjs | vite-spa | node (auto-detected if omitted; `workflow` comes from a committed kryd.json)"
@@ -18865,6 +19062,7 @@ if (invokedDirectly()) {
   });
 }
 export {
+  backfillLinkAccount,
   program,
   runAiAdd,
   runAiRemove,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Kryd CLI — push a React / Vite / Next.js app to the European cloud for your AI: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in. Your code and your model calls stay in the EU.",
   "keywords": [
     "kryd",
@@ -50,8 +50,8 @@
     "typescript": "^5.6.3",
     "vitest": "^2.1.8",
     "@kryd/shared-types": "0.0.0",
-    "@kryd/config-eslint": "0.0.0",
-    "@kryd/config-ts": "0.0.0"
+    "@kryd/config-ts": "0.0.0",
+    "@kryd/config-eslint": "0.0.0"
   },
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --define:__KRYD_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/index.js",