@kryd/cli 0.8.0 → 0.9.0

package/README.md

@@ -20,6 +20,7 @@ kryd init                     # link this folder to a Kryd project (+ a `kryd` g
 kryd push                     # push the current branch → build → deploy → live, with live progress
 kryd logs                     # the full build log of the latest deploy (kryd push shows progress, not log lines)
 kryd logs <project> --runtime # tail the live app's stdout/stderr
+kryd logs <project> --worker  # tail the workflow worker's stdout/stderr
 ```
 
 Once you've run `kryd init` in a directory, the commands below work **arg-less** there — the folder is linked via `.kryd/project.json` (git-ignored, no secret).
@@ -32,7 +33,7 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 | `kryd init` | Link the current repo to a Kryd project + register the deploy webhook + add a `kryd` git remote. |
 | `kryd push [branch]` | Push to the `kryd` remote and follow the deploy it triggers (defaults to the current branch). Shows which step the deploy is on, how long it has taken and a progress bar; `--logs` streams the full build log instead. |
 | `kryd deploy [project]` | Re-deploy the production-branch HEAD already on the forge — no new commit. |
-| `kryd logs [target]` | Follow a deploy's build/deploy log **in full** — this is where the build output lives (`--runtime` tails the live container instead). |
+| `kryd logs [target]` | Follow a deploy's build/deploy log **in full** — this is where the build output lives (`--runtime` tails the live container instead; `--worker` tails the project's workflow worker, also when it has a web app). |
 | `kryd rollback [project] [deployment]` | Roll back to a previous successful deploy — no rebuild. |
 | `kryd db add \| remove \| status [project]` | Attach, tear down or inspect managed Postgres (shared or bring-your-own). `remove` destroys the data and asks first. |
 | `kryd storage add \| remove \| status [project]` | Attach, tear down or inspect S3-compatible object storage. `remove` destroys every object and asks first. |

package/dist/index.js

@@ -56,6 +56,7 @@ function parseDeployEvent(payload) {
 }
 
 // ../../packages/shared-types/dist/runtime-log.js
+var RUNTIME_REFUSAL_CODES = ["no-runtime", "pending"];
 function parseRuntimeStreamFrame(payload) {
   let parsed;
   try {
@@ -67,7 +68,8 @@ function parseRuntimeStreamFrame(payload) {
     return null;
   const e = parsed;
   if (e.kind === "error" && typeof e.message === "string") {
-    return { kind: "error", message: e.message };
+    const code = RUNTIME_REFUSAL_CODES.includes(e.code) ? e.code : void 0;
+    return code ? { kind: "error", message: e.message, code } : { kind: "error", message: e.message };
   }
   if (e.kind !== "runtime" || e.stream !== "stdout" && e.stream !== "stderr" || typeof e.line !== "string") {
     return null;
@@ -14855,6 +14857,10 @@ function validateBuildEnvVarValue(value) {
 var BUILD_ENV_PUBLIC_WARNING = "\u26A0 Build-time values are compiled into your app's public bundle \u2014 anyone who loads your site can read them. Never put a secret here.";
 var BUILD_ENV_REBUILD_NOTE = "This takes effect at your next BUILD, not your next deploy \u2014 the value is compiled into the image, so redeploying the existing image keeps the old value. Push a commit (`kryd push`) to rebuild.";
 
+// ../../packages/shared-types/dist/workflow-run.js
+var MAX_WEBHOOK_NAME = 32;
+var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
+
 // ../../packages/shared-types/dist/index.js
 var DEPLOY_STATES = [
   "queued",
@@ -14898,6 +14904,7 @@ function isTerminalResourceStatus(status) {
 import {
   existsSync as existsSync3,
   mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
   realpathSync,
   rmSync as rmSync2,
   writeFileSync as writeFileSync2
@@ -14956,8 +14963,13 @@ function clearToken() {
   delete config2.token;
   writeConfig(config2);
 }
+var lastApiUrl = null;
 function resolveApiUrl(flag) {
-  return flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  return lastApiUrl;
+}
+function currentApiUrl() {
+  return lastApiUrl ?? resolveApiUrl();
 }
 var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
 function resolveDashboardUrl(flag) {
@@ -15046,9 +15058,33 @@ function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
     return false;
   }
 }
+function resolvedLink() {
+  return lastLinkResolution;
+}
+var lastLinkResolution = null;
 function resolveProjectId(explicit, cwd = process.cwd()) {
+  lastLinkResolution = null;
   if (explicit) return explicit;
-  return loadProjectLink(cwd)?.projectId ?? null;
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const link = loadProjectLink(cwd);
+  if (!link) return null;
+  lastLinkResolution = { root, link };
+  return link.projectId;
+}
+function rememberLinkAccount(root, account) {
+  if (!account.accountId) return false;
+  const link = directoryIsLinked(root);
+  if (!link) return false;
+  const slug = account.accountSlug ?? link.accountSlug;
+  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
+  saveProjectLink(root, {
+    ...link,
+    accountId: account.accountId,
+    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
+    ...slug ? { accountSlug: slug } : {}
+  });
+  return true;
 }
 
 // src/browser-login.ts
@@ -15136,7 +15172,15 @@ Waiting for approval\u2026
 // src/client.ts
 var ApiError = class extends Error {
   envelope;
-  /** The HTTP status of the failed response, when it came from one (used to detect a 404 = gone). */
+  /**
+   * The HTTP status of the failed response, when it came from one (used to detect a 404 = gone).
+   *
+   * ⚠️ Still optional because an `ApiError` is also thrown for a well-formed response the CLI
+   * cannot use ("the API returned an unexpected …") and for a stream's own error frame — neither
+   * has a status. Every throw that DOES hold a `Response` now passes it (KRYD-481): the 404
+   * diagnosis keys on the status, and a third of them used to omit it, which made the same
+   * failure explainable or unexplainable depending on which verb the customer typed.
+   */
   status;
   constructor(message, envelope, status) {
     super(message);
@@ -15161,7 +15205,8 @@ async function login(apiUrl, creds) {
   if (!res.ok) {
     throw new ApiError(
       `Login failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const token = res.headers.get("set-auth-token");
@@ -15177,7 +15222,8 @@ async function whoami(apiUrl, token) {
   if (!res.ok) {
     throw new ApiError(
       `Request failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   return await res.json();
@@ -15194,7 +15240,8 @@ async function linkProject(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Repo linking failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15222,7 +15269,8 @@ async function attachDatabase(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Database attach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15247,7 +15295,8 @@ async function createStorage(apiUrl, token, input) {
   if (!res.ok) {
     throw new ApiError(
       `Storage create failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   const parsed = await res.json().catch(() => void 0);
@@ -15449,7 +15498,8 @@ async function detachDatabase(apiUrl, token, projectId) {
   if (!res.ok) {
     throw new ApiError(
       `Database detach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
 }
@@ -15459,7 +15509,7 @@ async function getProject(apiUrl, token, projectId) {
   });
   if (res.status === 404) return null;
   if (!res.ok) {
-    throw new ApiError(`Reading the project failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Reading the project failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15468,7 +15518,7 @@ async function listProjects(apiUrl, token) {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) {
-    throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).items;
 }
@@ -15478,7 +15528,7 @@ async function deleteProject(apiUrl, token, projectId) {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) {
-    throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15513,7 +15563,8 @@ async function detachStorage(apiUrl, token, projectId) {
   if (!res.ok) {
     throw new ApiError(
       `Storage detach failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
 }
@@ -15679,7 +15730,7 @@ async function triggerDeploy(apiUrl, token, projectId) {
     body: JSON.stringify({ projectId })
   });
   if (!res.ok) {
-    throw new ApiError(`Deploy trigger failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Deploy trigger failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).deploymentId;
 }
@@ -15696,7 +15747,7 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
     })
   });
   if (!res.ok) {
-    throw new ApiError(`Rollback failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Rollback failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15710,7 +15761,7 @@ async function redeployProject(apiUrl, token, projectId) {
     body: JSON.stringify({ projectId })
   });
   if (!res.ok) {
-    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return await res.json();
 }
@@ -15719,7 +15770,7 @@ async function listDeployments(apiUrl, token, projectId) {
   if (projectId) url2.searchParams.set("projectId", projectId);
   const res = await fetch(url2, { headers: { authorization: `Bearer ${token}` } });
   if (!res.ok) {
-    throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res));
+    throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res), res.status);
   }
   return (await res.json()).items;
 }
@@ -15798,7 +15849,7 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
         headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }
       });
       if (!res.ok) {
-        throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res));
+        throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res), res.status);
       }
       if (!res.body) throw new Error("The log stream returned no body.");
       for await (const data of readSseFrames(res.body)) {
@@ -15826,13 +15877,13 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
   return terminal;
 }
 async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
-  const basePath = opts.resource === "deployment" ? "deployments" : "projects";
+  const path = opts.resource === "deployment" ? `deployments/${id}/runtime-logs` : opts.resource === "worker" ? `projects/${id}/workflow-logs` : `projects/${id}/runtime-logs`;
   const doFetch = opts.fetchImpl ?? fetch;
   const reconnectMs = opts.reconnectMs ?? 1e3;
   let afterNs;
   while (!opts.signal?.aborted) {
     try {
-      const url2 = new URL(`${apiUrl}/${basePath}/${id}/runtime-logs`);
+      const url2 = new URL(`${apiUrl}/${path}`);
       if (afterNs) url2.searchParams.set("after", afterNs);
       else if (opts.since) url2.searchParams.set("since", opts.since);
       const res = await doFetch(url2, {
@@ -15842,7 +15893,8 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
       if (!res.ok) {
         throw new ApiError(
           `Runtime log stream failed (${res.status})`,
-          await parseEnvelope(res)
+          await parseEnvelope(res),
+          res.status
         );
       }
       if (!res.body) throw new Error("The runtime log stream returned no body.");
@@ -15871,11 +15923,59 @@ async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
   if (!res.ok) {
     throw new ApiError(
       `Fetching the stored log failed (${res.status})`,
-      await parseEnvelope(res)
+      await parseEnvelope(res),
+      res.status
     );
   }
   return (await res.json()).log;
 }
+async function fetchPushCredential(apiUrl, token, projectId) {
+  const res = await fetch(
+    `${apiUrl}/repos/${encodeURIComponent(projectId)}/push-credential`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Could not fetch the push credential (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.username !== "string" || typeof parsed.password !== "string" || parsed.password.length === 0) {
+    throw new ApiError("The API returned an unexpected push-credential response.");
+  }
+  return { username: parsed.username, password: parsed.password };
+}
+
+// src/git-credential.ts
+async function runGitCredential(operation, opts = {}) {
+  if (operation !== "get") return;
+  const input = parseCredentialInput(opts.stdin ?? "");
+  if (input.protocol && input.protocol !== "https") return;
+  const cwd = opts.cwd ?? process.cwd();
+  const token = loadConfig().token;
+  if (!token) return;
+  const projectId = resolveProjectId(void 0, cwd);
+  if (!projectId) return;
+  try {
+    const cred = await fetchPushCredential(resolveApiUrl(opts.apiUrl), token, projectId);
+    process.stdout.write(`username=${cred.username}
+password=${cred.password}
+`);
+  } catch {
+  }
+}
+function parseCredentialInput(raw) {
+  const out = {};
+  for (const line of raw.split("\n")) {
+    if (line === "") continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    out[line.slice(0, eq)] = line.slice(eq + 1);
+  }
+  return out;
+}
 
 // src/framework.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
@@ -15891,7 +15991,13 @@ function isFramework(value) {
   return FRAMEWORKS.includes(value);
 }
 var DECLARATION_FILE = "kryd.json";
-var DECLARATION_KIND_WORKFLOW = "workflow";
+var DEFAULT_WORKFLOWS_PATH = "workflows";
+function declarationJson(decl) {
+  return {
+    ...decl.web ? {} : { web: false },
+    ...decl.workflowsPath !== null ? { workflows: { path: decl.workflowsPath } } : {}
+  };
+}
 var VITE_META_FRAMEWORKS = [
   "@sveltejs/kit",
   "astro",
@@ -15933,22 +16039,26 @@ function readPackageJson(cwd) {
     return null;
   }
 }
-function declaredKind(cwd) {
+function readDeclaration(cwd) {
+  let parsed;
   try {
-    const parsed = JSON.parse(
-      readFileSync2(join2(cwd, DECLARATION_FILE), "utf8")
-    );
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return null;
-    }
-    const kind = parsed.kind;
-    return typeof kind === "string" ? kind : null;
+    parsed = JSON.parse(readFileSync2(join2(cwd, DECLARATION_FILE), "utf8"));
   } catch {
     return null;
   }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  const decl = parsed;
+  const workflows = decl.workflows;
+  const workflowsPath = workflows && typeof workflows === "object" && typeof workflows.path === "string" ? workflows.path : null;
+  return { web: decl.web !== false, workflowsPath };
 }
 function frameworkFrom(pkg, cwd) {
-  if (declaredKind(cwd) === DECLARATION_KIND_WORKFLOW) return "workflow";
+  const declaration = readDeclaration(cwd);
+  if (declaration && !declaration.web && declaration.workflowsPath !== null) {
+    return "workflow";
+  }
   const deps = { ...pkg?.dependencies, ...pkg?.devDependencies };
   const has = (name) => name in deps;
   if (has("next")) return "nextjs";
@@ -16043,6 +16153,10 @@ export const hatchet = HatchetClient.init();
  * One task, to prove the wiring end to end. Add your own beside it and list them in
  * \`src/worker.ts\` \u2014 everything about how a task runs (retries, timeouts, concurrency, crons,
  * DAGs) belongs to the engine's SDK, not to Kryd.
+ *
+ * A task can be cut off by a deploy or a restart: measured, a TypeScript worker stops within seconds
+ * and the engine runs the task again from the start on another worker ~30 s later, even with
+ * \`retries: 0\` \u2014 so write every task so that running it again is safe.
  */
 export const greet = hatchet.task({
   name: "greet",
@@ -16091,7 +16205,15 @@ async function main(): Promise<void> {
   const { hatchet } = await import("./hatchet");
   const { greet } = await import("./tasks");
 
-  const worker = await hatchet.worker(WORKER_NAME, { workflows: [greet] });
+  // Kryd sets KRYD_DEPLOYMENT_ID on a deployed worker, and the label is how its deploy gate tells
+  // THIS deploy's worker from the previous one, which keeps running while it drains. Keep the line:
+  // the gate requires it, and a worker without it never counts as this deploy's, so the deploy
+  // never goes live. Locally the variable is absent, so no label.
+  const deployId = process.env.KRYD_DEPLOYMENT_ID;
+  const worker = await hatchet.worker(WORKER_NAME, {
+    workflows: [greet],
+    labels: deployId ? { "kryd-deploy": deployId } : undefined,
+  });
 
   // start() resolves when the worker stops, so it is not awaited here; waitUntilReady() flips the
   // health flag once the engine has the worker. A failed registration rejects \`running\` and the
@@ -16157,6 +16279,11 @@ from hatchet_sdk import Context, EmptyModel
 # One task, to prove the wiring end to end. Add your own beside it and list them in main.py \u2014
 # everything about how a task runs (retries, timeouts, concurrency, crons, DAGs) belongs to the
 # engine's SDK, not to Kryd.
+#
+# A task can be cut off by a deploy or a restart: a Python worker finishes a running task before it
+# stops (measured with 33 s left), but the stop has a 90 s grace period, and a task still running
+# after it is killed and run again from the start on another worker, even with retries=0 (measured)
+# \u2014 so write every task so that running it again is safe.
 @hatchet.task(name="greet")
 def greet(input: EmptyModel, ctx: Context) -> dict[str, str]:
     return {"greeting": "Hello, world"}
@@ -16333,6 +16460,11 @@ type GreetOutput struct {
 // Greet is one task, to prove the wiring end to end. Add your own beside it and register them in
 // main.go \u2014 everything about how a task runs (retries, timeouts, concurrency, crons, DAGs) belongs
 // to the engine's SDK, not to Kryd.
+//
+// A task can be cut off by a deploy or a restart: measured, a Go worker exits within a second of the
+// stop signal without waiting for running tasks, and the engine runs the task again from the start
+// on another worker ~30 s later, even with retries set to 0 \u2014 so write every task so that running it
+// again is safe.
 func Greet(c *hatchet.Client) *hatchet.StandaloneTask {
 	return c.NewStandaloneTask("greet", func(ctx hatchet.Context, input GreetInput) (GreetOutput, error) {
 		name := input.Name
@@ -16415,7 +16547,15 @@ func main() {
 		log.Fatalf("could not create the Hatchet client: %v", err)
 	}
 
-	worker, err := client.NewWorker(workerName, hatchet.WithWorkflows(Greet(client)))
+	// Kryd sets KRYD_DEPLOYMENT_ID on a deployed worker, and the label is how its deploy gate tells
+	// THIS deploy's worker from the previous one, which keeps running while it drains. Keep it:
+	// the gate requires it, and a worker without it never counts as this deploy's, so the deploy
+	// never goes live. Locally the variable is absent, so no label.
+	opts := []hatchet.WorkerOption{hatchet.WithWorkflows(Greet(client))}
+	if deployID := os.Getenv("KRYD_DEPLOYMENT_ID"); deployID != "" {
+		opts = append(opts, hatchet.WithLabels(map[string]any{"kryd-deploy": deployID}))
+	}
+	worker, err := client.NewWorker(workerName, opts...)
 	if err != nil {
 		log.Fatalf("could not create the worker: %v", err)
 	}
@@ -16474,15 +16614,19 @@ var TEMPLATES = {
   python: PYTHON_TEMPLATE,
   go: GO_TEMPLATE
 };
-function declarationFile() {
+function declarationFile(decl) {
   return {
     path: DECLARATION_FILE,
-    contents: `${JSON.stringify({ kind: DECLARATION_KIND_WORKFLOW }, null, 2)}
+    contents: `${JSON.stringify(declarationJson(decl), null, 2)}
 `
   };
 }
+var WORKER_ONLY = { web: false, workflowsPath: "." };
+function workerFiles(language, workerName) {
+  return TEMPLATES[language].files(workerName);
+}
 function scaffoldFiles(language, workerName) {
-  return [...TEMPLATES[language].files(workerName), declarationFile()];
+  return [...workerFiles(language, workerName), declarationFile(WORKER_ONLY)];
 }
 function firstCommand(language) {
   return TEMPLATES[language].firstCommand;
@@ -16863,12 +17007,6 @@ async function promptConfirm(question, io) {
 // src/git.ts
 import { execFileSync, spawnSync } from "node:child_process";
 import { resolve } from "node:path";
-function authenticatedRemoteUrl(cloneUrl, username, token) {
-  const prefix = "https://";
-  if (!cloneUrl.startsWith(prefix)) return cloneUrl;
-  const creds = `${encodeURIComponent(username)}:${encodeURIComponent(token)}@`;
-  return prefix + creds + cloneUrl.slice(prefix.length);
-}
 function configureGitRemote(cwd, remote, url2) {
   const run = (args) => execFileSync("git", args, { cwd, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
   try {
@@ -16961,9 +17099,32 @@ function pushBranch(cwd, remote, branch, extraArgs) {
   if (res.status === 0) return { status: "ok" };
   return { status: "failed", code: res.status ?? 1 };
 }
+function configureCredentialHelper(cwd, cloneUrl) {
+  const origin = originOf(cloneUrl);
+  if (!origin) return "unavailable";
+  const run = (args) => {
+    try {
+      execFileSync("git", args, { cwd, stdio: ["ignore", "ignore", "ignore"] });
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const ok = run(["config", `credential.${origin}.helper`, ""]) && run(["config", "--add", `credential.${origin}.helper`, "!kryd git-credential"]) && run(["config", `credential.${origin}.useHttpPath`, "true"]);
+  return ok ? "set" : "unavailable";
+}
+function originOf(url2) {
+  try {
+    const parsed = new URL(url2);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return null;
+  }
+}
 
 // src/index.ts
-function reportError(err) {
+async function reportError(err) {
   if (err instanceof ApiError && err.envelope) {
     process.stderr.write(
       `${err.envelope.error.code}: ${err.envelope.error.message}
@@ -16974,6 +17135,63 @@ function reportError(err) {
 `);
   }
   process.exitCode = 1;
+  if (err instanceof ApiError) {
+    process.stderr.write(await explainMissingProject(err));
+  }
+}
+async function projectIsVisible(token, projectId) {
+  try {
+    return await getProject(currentApiUrl(), token, projectId) !== null;
+  } catch {
+    return null;
+  }
+}
+function accountLabel(slug, id) {
+  return slug ?? id;
+}
+async function explainMissingProject(err) {
+  if (err.status !== 404) return "";
+  const resolution = resolvedLink();
+  if (!resolution) return "";
+  const token = loadConfig().token;
+  if (!token) return "";
+  if (await projectIsVisible(token, resolution.link.projectId) !== false) return "";
+  let session;
+  try {
+    session = await whoami(currentApiUrl(), token);
+  } catch {
+    return "";
+  }
+  if (!session.accountId) return "";
+  const signedInAs = accountLabel(session.accountSlug, session.accountId);
+  const linkedAccount = resolution.link.accountId;
+  if (!linkedAccount) {
+    return `This folder is linked to project ${resolution.link.projectId}, and you are signed in as ${signedInAs}. That project is not on this account \u2014 if it belongs to another one, switch with \`kryd login\` and run this again.
+`;
+  }
+  if (linkedAccount === session.accountId) {
+    return `This folder is linked to project ${resolution.link.projectId} on ${signedInAs}, which is the account you are signed in as \u2014 so that project no longer exists.
+`;
+  }
+  return `This folder is linked to a project of account ${accountLabel(resolution.link.accountSlug, linkedAccount)}, but you are signed in as ${signedInAs}. Switch with \`kryd login\` and run this again.
+`;
+}
+async function backfillLinkAccount() {
+  if (process.exitCode) return;
+  const resolution = resolvedLink();
+  if (!resolution) return;
+  if (resolution.link.accountId && resolution.link.accountSlug) return;
+  const token = loadConfig().token;
+  if (!token) return;
+  if (await projectIsVisible(token, resolution.link.projectId) !== true) return;
+  try {
+    const session = await whoami(currentApiUrl(), token);
+    rememberLinkAccount(resolution.root, {
+      accountId: session.accountId,
+      accountSlug: session.accountSlug
+    });
+  } catch {
+  }
 }
 function reportNotLinked(example) {
   process.stderr.write(
@@ -17014,7 +17232,7 @@ async function runWhoami(opts = {}) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function runLogout() {
@@ -17073,7 +17291,7 @@ To deploy it: \`kryd push\`. To start over: \`kryd project rm\` first, or delete
   }
   const name = opts.name ?? detected.name;
   try {
-    const { project: project2, repo, pushToken } = await linkProject(apiUrl, token, {
+    const { project: project2, repo } = await linkProject(apiUrl, token, {
       name,
       framework,
       // First `kryd init` for the account claims the tenant slug (the vanity routing key in
@@ -17087,6 +17305,14 @@ To deploy it: \`kryd push\`. To start over: \`kryd project rm\` first, or delete
     let linkNote = "";
     try {
       saveProjectLink(cwd, { projectId: project2.id });
+      try {
+        const session = await whoami(apiUrl, token);
+        rememberLinkAccount(cwd, {
+          accountId: session.accountId,
+          accountSlug: session.accountSlug
+        });
+      } catch {
+      }
       linkNote = "Linked this folder \u2192 .kryd/project.json \u2014 `kryd deploy` / `kryd logs` now work here with no id.\n";
       try {
         ensureKrydIgnored(cwd);
@@ -17103,44 +17329,52 @@ To deploy it: \`kryd push\`. To start over: \`kryd project rm\` first, or delete
       );
     }
     const branch = repo.defaultBranch;
-    const slug = repo.fullName.split("/")[0] ?? "kryd";
-    const authedUrl = authenticatedRemoteUrl(repo.cloneUrl, slug, pushToken);
-    const remote = configureGitRemote(cwd, "kryd", authedUrl);
+    const remote = configureGitRemote(cwd, "kryd", repo.cloneUrl);
+    const helper = configureCredentialHelper(cwd, repo.cloneUrl);
     let nextStep;
     switch (remote.status) {
       case "added":
       case "updated":
-        nextStep = `${remote.status === "added" ? "Added" : "Updated"} git remote "${remote.remote}" (with your push credential).
-` + (remote.tracking === "set" ? `Tracking set: \`git push\` and \`kryd push\` both deploy this branch.
+        nextStep = `${remote.status === "added" ? "Added" : "Updated"} git remote "${remote.remote}".
+` + (helper === "set" ? "" : `\u26A0\uFE0F Could not register the credential helper, so git will ask for a password on push.
+   Run \`kryd login\` and re-run \`kryd init\` here to fix it.
+`) + (remote.tracking === "set" ? `Tracking set: \`git push\` and \`kryd push\` both deploy this branch.
 ` : remote.tracking === "kept-existing" ? `This branch already tracks another remote, so it was left alone \u2014 deploy with \`kryd push\`.
 ` : "") + `Next: kryd push   # push to deploy (same as \`git push ${remote.remote} ${branch}\`)
 `;
         break;
       case "not-a-repo":
-        nextStep = `No git repo here yet. To deploy (the URL carries your push token \u2014 keep it private):
+        nextStep = `No git repo here yet. To deploy:
   git init && git add -A && git commit -m "init"
-  git remote add kryd ${authedUrl}
+  git remote add kryd ${repo.cloneUrl}
+  kryd init          # again, to register the credential helper
   kryd push
 `;
         break;
       case "unavailable":
         nextStep = gitAvailable(cwd).status === "no-git" ? `git is not installed, so the deploy remote could not be configured.
 Install git (https://git-scm.com/downloads), then re-run \`kryd init\` here.
-` : `Add the remote, then push to deploy (the URL carries your push token \u2014 keep it private):
-  git remote add kryd ${authedUrl}
+` : `Add the remote, then push to deploy:
+  git remote add kryd ${repo.cloneUrl}
   kryd push
 `;
         break;
     }
+    const declaration = readDeclaration(cwd);
+    const workerOnly = declaration !== null ? !declaration.web && declaration.workflowsPath !== null : project2.framework === "workflow";
+    const routing = workerOnly ? `No public URL: a workflow worker dials out to the engine and serves nothing.
+Scheduled and triggered work runs on your production deploy; preview branches build but do not start a worker.
+` : `Production URL: https://${project2.subdomain}.${PRODUCTION_TLD}
+Preview branches deploy to https://<branch>-<hash>-${project2.subdomain}.${PREVIEW_TLD}
+` + (declaration?.workflowsPath ? `Workflows in ${declaration.workflowsPath}/ run as a worker beside it on production deploys; previews run the web app only.
+` : "");
     process.stdout.write(
       `Linked "${name}" (${project2.framework}) \u2192 ${repo.htmlUrl}
-Production URL: https://${project2.subdomain}.${PRODUCTION_TLD}
-Preview branches deploy to https://<branch>-<hash>-${project2.subdomain}.${PREVIEW_TLD}
-${linkNote}
+` + routing + `${linkNote}
 ${nextStep}`
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function formatStatus(event) {
@@ -17256,7 +17490,7 @@ async function runLogs(opts) {
     }
     await followDeploy(apiUrl, token, deploymentId);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRuntimeLogs(opts) {
@@ -17268,9 +17502,16 @@ async function runRuntimeLogs(opts) {
     return;
   }
   const isDeployment = opts.project?.startsWith("dpl_") ?? false;
+  if (opts.worker && isDeployment) {
+    process.stderr.write(
+      "--worker takes a project, not a deployment id: use `kryd logs <project> --worker` to follow the project's worker.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
   const target = isDeployment ? opts.project : resolveProjectId(opts.project, opts.cwd);
   if (!target) {
-    reportNotLinked("kryd logs <projectId> --runtime");
+    reportNotLinked(opts.worker ? "kryd logs <projectId> --worker" : "kryd logs <projectId> --runtime");
     return;
   }
   if (opts.since !== void 0 && !/^\d+(s|m|h|d)$/.test(opts.since.trim())) {
@@ -17299,11 +17540,11 @@ async function runRuntimeLogs(opts) {
       {
         ...opts.since ? { since: opts.since } : {},
         signal: controller.signal,
-        ...isDeployment ? { resource: "deployment" } : {}
+        ...isDeployment ? { resource: "deployment" } : opts.worker ? { resource: "worker" } : {}
       }
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   } finally {
     process.off("SIGINT", onSigint);
   }
@@ -17327,7 +17568,7 @@ async function runDeploy(opts) {
 `);
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function renderFor(logs) {
@@ -17465,7 +17706,7 @@ async function runPush(opts) {
       estimateFrom: recent
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRollback(opts) {
@@ -17495,7 +17736,7 @@ async function runRollback(opts) {
     );
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runRedeploy(opts) {
@@ -17524,7 +17765,7 @@ ${note}
     );
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runDbAdd(opts) {
@@ -17589,7 +17830,7 @@ The connection string will be injected as DATABASE_URL on your next deploy.
       retryCmd: `kryd db status ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function reportSettleResult(result, opts) {
@@ -17636,7 +17877,7 @@ Its S3 credentials will be injected on your next deploy.
       retryCmd: `kryd storage status ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function reportDetachResult(result, opts) {
@@ -17679,7 +17920,7 @@ async function resolveProjectIdByName(apiUrl, token, name) {
   try {
     projects = await listProjects(apiUrl, token);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return null;
   }
   const matches = projects.filter((p) => p.name === name);
@@ -17740,7 +17981,7 @@ async function runProjectRemove(opts) {
     }
     resources = project2.status === "delete_failed" ? ["whatever the previous attempt did not manage to remove"] : await describeProjectResources(apiUrl, token, projectId);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!opts.yes) {
@@ -17777,7 +18018,7 @@ async function runProjectRemove(opts) {
     );
     await followProjectDeletion(apiUrl, token, projectId, project2.name, opts);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function followProjectDeletion(apiUrl, token, projectId, name, opts) {
@@ -17853,7 +18094,7 @@ async function runDbRemove(opts) {
       retryCmd: `kryd db remove ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runAiAdd(opts) {
@@ -17878,7 +18119,7 @@ async function runAiAdd(opts) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runAiRemove(opts) {
@@ -17898,7 +18139,7 @@ async function runAiRemove(opts) {
   try {
     current = await getAiStatus(apiUrl, token, project2);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!current.enabled) {
@@ -17923,7 +18164,7 @@ AI_GATEWAY_URL and AI_GATEWAY_TOKEN stop being injected from your next deploy (k
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function reportResourceStatus(opts) {
@@ -17940,12 +18181,12 @@ Remove it before attaching another.
     process.stdout.write(`${opts.project}: ${opts.noun} ${result.status}.
 `);
   } catch (err) {
-    if (err instanceof ApiError && err.status === 404) {
+    if (err instanceof ApiError && err.status === 404 && await projectIsVisible(opts.token, opts.project) === true) {
       process.stdout.write(`${opts.project}: no ${opts.noun} attached.
 `);
       return;
     }
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runDbStatus(opts) {
@@ -17964,7 +18205,8 @@ async function runDbStatus(opts) {
   await reportResourceStatus({
     read: () => getDatabaseStatus(apiUrl, token, project2),
     noun: "database",
-    project: project2
+    project: project2,
+    token
   });
 }
 async function runStorageStatus(opts) {
@@ -17983,7 +18225,8 @@ async function runStorageStatus(opts) {
   await reportResourceStatus({
     read: () => getStorageStatus(apiUrl, token, project2),
     noun: "object storage",
-    project: project2
+    project: project2,
+    token
   });
 }
 async function runAiStatus(opts) {
@@ -18012,7 +18255,7 @@ async function runAiStatus(opts) {
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function isoDay(iso) {
@@ -18052,7 +18295,7 @@ HATCHET_CLIENT_TOKEN will be injected on your next deploy (kryd deploy)` + (stat
 ` : ".\n")
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runWorkflowRemove(opts) {
@@ -18072,7 +18315,7 @@ async function runWorkflowRemove(opts) {
   try {
     current = await getWorkflowStatus(apiUrl, token, project2);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (!current.enabled) {
@@ -18097,7 +18340,7 @@ Workflow history, crons and schedules stay until the project is deleted.
 `
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runWorkflowStatus(opts) {
@@ -18137,7 +18380,7 @@ async function runWorkflowStatus(opts) {
       );
     }
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runWorkflowInit(opts) {
@@ -18160,6 +18403,22 @@ async function runWorkflowInit(opts) {
   }
   const language = opts.language;
   const target = opts.dir ? resolve2(cwd, opts.dir) : cwd;
+  if (!opts.only) {
+    scaffoldContainedWorker({
+      language,
+      target,
+      ...opts.path !== void 0 ? { path: opts.path } : {},
+      ...opts.name !== void 0 ? { name: opts.name } : {}
+    });
+    return;
+  }
+  if (opts.path !== void 0) {
+    process.stderr.write(
+      "--path is for a worker inside an app; with --only the worker IS the repository root.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
   const workerName = workerNameFrom(opts.name ?? basename2(target));
   const files = scaffoldFiles(language, workerName);
   const clashes = files.map((f) => f.path).filter((p) => existsSync3(join3(target, p)));
@@ -18205,9 +18464,10 @@ Nothing was left behind.
   if (repo.status === "nested") {
     process.stderr.write(
       `That directory is inside the git repository at ${repo.root}.
-A worker has to be its own repository: Kryd builds one app per repository, and git would
-write the deploy remote into the enclosing repo, so \`kryd push\` would push that tree instead.
+A worker-only project (--only) has to be its own repository: git would write the deploy
+remote into the enclosing repo, so \`kryd push\` would push that tree instead.
 The files above were written \u2014 move them to a directory of their own, or run this outside that repository.
+To add a worker to the app in that repository instead, run \`kryd workflow init\` (without --only) at its root.
 `
     );
     process.exitCode = 1;
@@ -18254,6 +18514,131 @@ HATCHET_CLIENT_TOKEN is injected into your container on deploy; it is never avai
 `
   );
 }
+function scaffoldContainedWorker(opts) {
+  const { language, target } = opts;
+  if (!directoryIsLinked(target)) {
+    process.stderr.write(
+      "This directory is not linked to a Kryd project, so there is no app to add a worker to.\nLink your app first (`kryd init`), then run this again \u2014 or pass --only for a project that runs nothing but a worker.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const raw = (opts.path ?? DEFAULT_WORKFLOWS_PATH).trim();
+  const segments = raw.split("/").filter((seg) => seg !== "" && seg !== ".");
+  if (raw.startsWith("/") || raw.includes("\\") || segments.includes("..") || segments.length === 0) {
+    process.stderr.write(
+      `--path must be a folder inside this project (e.g. "${DEFAULT_WORKFLOWS_PATH}"), not "${raw}". For a worker at the repository root, use --only in a directory of its own.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const folder = segments.join("/");
+  const declarationPath = join3(target, DECLARATION_FILE);
+  let existing = {};
+  let existingText = null;
+  if (existsSync3(declarationPath)) {
+    existingText = readFileSync3(declarationPath, "utf8");
+    let parsed;
+    try {
+      parsed = JSON.parse(existingText);
+    } catch {
+      parsed = void 0;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      process.stderr.write(
+        `${DECLARATION_FILE} is not a JSON object, so a worker cannot be added to it. Fix or remove it, then run this again.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    existing = parsed;
+    if ("kind" in existing) {
+      process.stderr.write(
+        `${DECLARATION_FILE} still uses \`{"kind":"workflow"}\`, which is no longer read. A worker-only repository is \`{"web": false, "workflows": {"path": "."}}\`; an app with workflows in a folder is \`{"workflows": {"path": "workflows"}}\`. Update it, then run this again if you still want a worker folder. Nothing was written.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if ("workflows" in existing || existing["web"] === false) {
+      process.stderr.write(
+        `${DECLARATION_FILE} already declares a worker for this project \u2014 a project has one. Nothing was written.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const workerName = workerNameFrom(opts.name ?? basename2(target));
+  const files = workerFiles(language, workerName).map((f) => ({
+    path: `${folder}/${f.path}`,
+    contents: f.contents
+  }));
+  const clashes = files.map((f) => f.path).filter((p) => existsSync3(join3(target, p)));
+  if (clashes.length > 0) {
+    process.stderr.write(
+      `Refusing to overwrite: ${clashes.join(", ")}.
+Nothing was written. Pick another folder with --path <folder>.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const declaration = { ...existing, workflows: { path: folder } };
+  const written = [];
+  try {
+    for (const file2 of files) {
+      const full = join3(target, file2.path);
+      mkdirSync2(dirname2(full), { recursive: true });
+      writeFileSync2(full, file2.contents);
+      written.push(full);
+    }
+    writeFileSync2(declarationPath, `${JSON.stringify(declaration, null, 2)}
+`);
+  } catch (err) {
+    for (const path of written.reverse()) {
+      try {
+        rmSync2(path);
+      } catch {
+      }
+    }
+    try {
+      if (existingText === null) rmSync2(declarationPath, { force: true });
+      else writeFileSync2(declarationPath, existingText);
+    } catch {
+    }
+    process.stderr.write(
+      `Could not write the scaffold (${err instanceof Error ? err.message : String(err)}).
+Nothing was left behind.
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const next = [];
+  const first = firstCommand(language);
+  if (first) next.push(`(cd ${folder} && ${first})`);
+  next.push(
+    "kryd workflow add",
+    `git add ${DECLARATION_FILE} ${folder} && git commit -m "add workflows"`,
+    "kryd push"
+  );
+  process.stdout.write(
+    `Scaffolded a ${language} workflow worker in ${folder}/:
+` + files.map((f) => `  ${f.path}
+`).join("") + `and declared it in ${DECLARATION_FILE}: ${JSON.stringify({ workflows: { path: folder } })}
+
+Every production push now builds your app AND this worker, and goes live only when both are healthy. Previews run the app only.
+Next: ${next.map((c) => `\`${c}\``).join(", then ")}.
+HATCHET_CLIENT_TOKEN is injected into your app and your worker on deploy \u2014 your app triggers tasks with it; it is never available locally.
+` + // The app is still built (and type-checked) from the root, so a tsconfig that includes every
+    // file would compile the worker too — against an SDK the app does not depend on.
+    (existsSync3(join3(target, "tsconfig.json")) ? `Add "${folder}" to the "exclude" of your tsconfig.json, so your app's build does not type-check the worker.
+` : "")
+  );
+}
 async function runStorageRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -18290,7 +18675,7 @@ async function runStorageRemove(opts) {
       retryCmd: `kryd storage remove ${project2}`
     });
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function splitKeyValue(spec) {
@@ -18329,7 +18714,7 @@ async function runProjectList(opts) {
   try {
     projects = await listProjects(apiUrl, token);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
     return;
   }
   if (projects.length === 0) {
@@ -18437,7 +18822,7 @@ Set one with \`kryd env set KEY --stdin\`, or attach a database, storage or the
     out += "\nValues are never shown. This is the stored set \u2014 runtime changes reach your container at its next deploy (run `kryd redeploy` to apply them now)" + (buildVars.length > 0 ? ", and build-time changes at its next build.\n" : ".\n");
     process.stdout.write(out);
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 function toDotenvLine(key, value) {
@@ -18506,7 +18891,7 @@ ${body}
       "These are your own values, read back from Kryd. Managed values (DATABASE_URL, storage, the AI gateway) are never pulled.\n"
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function resolveEnvValue(inline, opts) {
@@ -18639,7 +19024,7 @@ async function runEnvSet(opts) {
 ${NEXT_BUILD_NOTE}` : NEXT_DEPLOY_NOTE)
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
 async function runEnvRemove(opts) {
@@ -18699,7 +19084,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
         return;
       }
     } catch (err) {
-      reportError(err);
+      await reportError(err);
       return;
     }
   }
@@ -18737,21 +19122,32 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
 `)
     );
   } catch (err) {
-    reportError(err);
+    await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.8.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.9.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
+program.hook("postAction", async () => {
+  await backfillLinkAccount();
+});
 program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
   "--token <token>",
   "supply a token instead of the browser flow (prefer $KRYD_TOKEN \u2014 flags are visible in `ps`)"
 ).option("--api-url <url>", "control-plane API base URL").option("--dashboard-url <url>", "dashboard base URL for the browser approve page (default app.kryd.eu)").action((opts) => runLogin(opts));
 program.command("whoami").description("Show the current account").option("--api-url <url>", "control-plane API base URL").action((opts) => runWhoami(opts));
 program.command("logout").description("Clear the stored token").action(() => runLogout());
+program.command("git-credential <operation>", { hidden: true }).description("git credential helper (invoked by git, not by you)").option("--api-url <url>", "control-plane API base URL").action(async (operation, opts) => {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  await runGitCredential(operation, {
+    stdin: Buffer.concat(chunks).toString("utf8"),
+    ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
+  });
+});
 program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
-  "react-router | nextjs | vite-spa | node (auto-detected if omitted; `workflow` comes from a committed kryd.json)"
+  'react-router | nextjs | vite-spa | node (auto-detected if omitted; `workflow` comes from a committed kryd.json with "web": false)'
 ).option(
   "--tenant <slug>",
   // KRYD-265 / KRYD-188: this used to say "claimed once on first init", which was false — signup
@@ -18764,15 +19160,23 @@ program.command("init").description("Link this project's repo + register its pus
   "create the repository PUBLIC \u2014 readable by anyone signed in to the forge (default: private). Set at creation only"
 ).option("--api-url <url>", "control-plane API base URL").action((opts) => runInit(opts));
 program.command("logs [target]").description(
-  "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: a container's stdout/stderr \u2014 [target]=a project id tails its live app, a deployment id (dpl_\u2026) tails THAT deploy's container (incl. a failed one, to see why it crashed)."
+  "Follow logs. Default: a deploy's build/deploy logs ([target]=deployment id, latest if omitted). With --runtime: a container's stdout/stderr \u2014 [target]=a project id tails its live app, a deployment id (dpl_\u2026) tails THAT deploy's container (incl. a failed one, to see why it crashed). With --worker: a project's workflow worker, also when the project has a web app."
 ).option(
   "--runtime",
   "stream a container's runtime stdout/stderr instead of build/deploy logs \u2014 the live app (project id) or one deploy's container (dpl_ id)"
+).option(
+  "--worker",
+  "with a project id: stream its workflow WORKER's stdout/stderr (implies --runtime) \u2014 for a project with a web app too, --runtime shows the web app"
 ).option(
   "--since <dur>",
-  "with --runtime: backfill this window before going live (e.g. 30m, 2h, 1d; max 7d)"
+  "with --runtime/--worker: backfill this window before going live (e.g. 30m, 2h, 1d; max 7d)"
 ).option("--api-url <url>", "control-plane API base URL").action(
-  (target, opts) => opts.runtime ? runRuntimeLogs({ project: target, since: opts.since, apiUrl: opts.apiUrl }) : runLogs({ apiUrl: opts.apiUrl, deployment: target })
+  (target, opts) => opts.runtime || opts.worker ? runRuntimeLogs({
+    project: target,
+    since: opts.since,
+    apiUrl: opts.apiUrl,
+    ...opts.worker ? { worker: true } : {}
+  }) : runLogs({ apiUrl: opts.apiUrl, deployment: target })
 );
 program.command("push [branch]").description(
   "Push to the kryd remote and follow the deploy it triggers (defaults to the current branch)"
@@ -18841,11 +19245,11 @@ workflow.command("add [project]").description("Give the project a workflow tenan
 workflow.command("remove [project]").description("Revoke the project's workflow token and stop injecting it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowRemove({ ...opts, project: project2 }));
 workflow.command("status [project]").description("Show whether the project has workflows, and when its token expires").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runWorkflowStatus({ ...opts, project: project2 }));
 workflow.command("init").description(
-  "Scaffold a workflow worker here (with the health listener Kryd's deploy gate needs) and link it"
+  "Add a workflow worker to the linked app here (in ./workflows, declared in kryd.json); --only scaffolds a worker-only project instead and links it"
 ).requiredOption(
   "--language <language>",
   `worker language: ${SCAFFOLD_LANGUAGES.join(" | ")}`
-).option("--dir <path>", "write into this directory instead of the current one").option("--name <name>", "project and worker name (defaults to the directory name)").option("--no-link", "only write the files; do not create a Kryd project").option("--api-url <url>", "control-plane API base URL").action((opts) => runWorkflowInit(opts));
+).option("--path <folder>", "the worker's folder inside the app (default: workflows)").option("--only", "a project that runs ONLY a worker: scaffold it at the root, git init, and link").option("--dir <path>", "the project directory, instead of the current one").option("--name <name>", "worker name (and, with --only, project name); defaults to the directory name").option("--no-link", "with --only: only write the files; do not create a Kryd project").option("--api-url <url>", "control-plane API base URL").action((opts) => runWorkflowInit(opts));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;
@@ -18865,6 +19269,7 @@ if (invokedDirectly()) {
   });
 }
 export {
+  backfillLinkAccount,
   program,
   runAiAdd,
   runAiRemove,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Kryd CLI — push a React / Vite / Next.js app to the European cloud for your AI: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in. Your code and your model calls stay in the EU.",
   "keywords": [
     "kryd",