@kryd/cli 0.9.1 → 0.11.0

package/README.md

@@ -52,7 +52,6 @@ Your application code runs in the EU, and the AI gateway routes **only** to EU-h
 
 - Website: <https://kryd.eu>
 - Dashboard: <https://app.kryd.eu>
-- Issues: <https://github.com/24BEEPS/kryd/issues>
 
 ## License
 

package/dist/index.js

@@ -89,6 +89,8 @@ var MAX_TENANT_SLUG = 20;
 var PRODUCTION_TLD = "kryd.cloud";
 var PREVIEW_TLD = "kryd.dev";
 var TENANT_SLUG_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_TENANT_SLUG - 2}}[a-z0-9])?$`);
+var MAX_APP_NAME = 20;
+var APP_NAME_RE = new RegExp(`^[a-z](?:[a-z0-9-]{0,${MAX_APP_NAME - 2}}[a-z0-9])?$`);
 
 // ../../packages/shared-types/dist/reserved-slugs.js
 var FORGEJO_RESERVED_USERNAMES = [
@@ -14861,6 +14863,12 @@ var BUILD_ENV_REBUILD_NOTE = "This takes effect at your next BUILD, not your nex
 var MAX_WEBHOOK_NAME = 32;
 var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
 
+// ../../packages/shared-types/dist/domain.js
+var DOMAIN_STATUSES = ["pending", "verified", "active", "failed"];
+function normalizeDomainHost(input) {
+  return input.trim().toLowerCase().replace(/\.$/, "");
+}
+
 // ../../packages/shared-types/dist/index.js
 var DEPLOY_STATES = [
   "queued",
@@ -15408,6 +15416,110 @@ async function removeWorkflows(apiUrl, token, projectId) {
     );
   }
 }
+var RECORD_TYPES = ["TXT", "CNAME", "A"];
+function parseDomainRecord(body) {
+  const r = body;
+  if (!r || typeof r.type !== "string" || !RECORD_TYPES.includes(r.type) || typeof r.name !== "string" || typeof r.value !== "string" || r.purpose !== "ownership" && r.purpose !== "routing" || r.note !== void 0 && typeof r.note !== "string") {
+    return null;
+  }
+  return {
+    type: r.type,
+    name: r.name,
+    value: r.value,
+    purpose: r.purpose,
+    ...r.note !== void 0 ? { note: r.note } : {}
+  };
+}
+function parseProjectDomain(body, label) {
+  const d = body;
+  const bad = () => new ApiError(`The API returned an unexpected ${label} response.`);
+  if (!d || typeof d.id !== "string" || typeof d.host !== "string" || typeof d.status !== "string" || !DOMAIN_STATUSES.includes(d.status) || typeof d.detail !== "string" && d.detail !== null || typeof d.checkedAt !== "string" && d.checkedAt !== null || typeof d.createdAt !== "string" || !Array.isArray(d.records)) {
+    throw bad();
+  }
+  const records = d.records.map(parseDomainRecord);
+  if (records.some((r) => r === null)) throw bad();
+  return {
+    id: d.id,
+    host: d.host,
+    // KRYD-381a — absent from an older API: then it is `web`, the only app there was.
+    ...typeof d.app === "string" ? { app: d.app } : {},
+    status: d.status,
+    detail: d.detail,
+    checkedAt: d.checkedAt,
+    createdAt: d.createdAt,
+    records
+  };
+}
+function domainsUrl(apiUrl, projectId) {
+  return `${apiUrl}/projects/${encodeURIComponent(projectId)}/domains`;
+}
+async function listDomains(apiUrl, token, projectId) {
+  const res = await fetch(domainsUrl(apiUrl, projectId), {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(`Domain listing failed (${res.status})`, await parseEnvelope(res), res.status);
+  }
+  const body = await res.json().catch(() => void 0);
+  if (!body || typeof body.projectHost !== "string" && body.projectHost !== null || !Array.isArray(body.domains)) {
+    throw new ApiError("The API returned an unexpected domain-list response.");
+  }
+  return {
+    projectHost: body.projectHost,
+    domains: body.domains.map((d) => parseProjectDomain(d, "domain-list"))
+  };
+}
+async function addDomain(apiUrl, token, projectId, host, app) {
+  const res = await fetch(domainsUrl(apiUrl, projectId), {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+    body: JSON.stringify({ host, ...app ? { app } : {} })
+  });
+  if (!res.ok) {
+    throw new ApiError(`Domain add failed (${res.status})`, await parseEnvelope(res), res.status);
+  }
+  return parseProjectDomain(await res.json().catch(() => void 0), "domain-add");
+}
+async function removeDomain(apiUrl, token, projectId, host) {
+  const res = await fetch(`${domainsUrl(apiUrl, projectId)}/${encodeURIComponent(host)}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(`Domain removal failed (${res.status})`, await parseEnvelope(res), res.status);
+  }
+}
+function deployHookUrl(apiUrl, projectId) {
+  return `${apiUrl}/projects/${encodeURIComponent(projectId)}/deploy-hook`;
+}
+async function createDeployHook(apiUrl, token, projectId) {
+  const res = await fetch(deployHookUrl(apiUrl, projectId), {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(`Deploy hook creation failed (${res.status})`, await parseEnvelope(res), res.status);
+  }
+  const body = await res.json().catch(() => void 0);
+  if (typeof body?.url !== "string" || typeof body.replaced !== "boolean") {
+    throw new Error("Unexpected response from the API (deploy-hook create).");
+  }
+  return { url: body.url, replaced: body.replaced };
+}
+async function removeDeployHook(apiUrl, token, projectId) {
+  const res = await fetch(deployHookUrl(apiUrl, projectId), {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(`Deploy hook removal failed (${res.status})`, await parseEnvelope(res), res.status);
+  }
+  const body = await res.json().catch(() => void 0);
+  if (typeof body?.removed !== "boolean") {
+    throw new Error("Unexpected response from the API (deploy-hook rm).");
+  }
+  return { removed: body.removed };
+}
 async function fetchResourceStatus(apiUrl, token, path) {
   const res = await fetch(`${apiUrl}${path}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -15732,9 +15844,13 @@ async function triggerDeploy(apiUrl, token, projectId) {
   if (!res.ok) {
     throw new ApiError(`Deploy trigger failed (${res.status})`, await parseEnvelope(res), res.status);
   }
-  return (await res.json()).deploymentId;
+  const body = await res.json();
+  return {
+    deploymentId: body.deploymentId,
+    ...Array.isArray(body.apps) ? { apps: body.apps } : {}
+  };
 }
-async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
+async function rollbackDeploy(apiUrl, token, projectId, deploymentId, app) {
   const res = await fetch(`${apiUrl}/deployments/rollback`, {
     method: "POST",
     headers: {
@@ -15743,7 +15859,8 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
     },
     body: JSON.stringify({
       projectId,
-      ...deploymentId ? { deploymentId } : {}
+      ...deploymentId ? { deploymentId } : {},
+      ...app ? { app } : {}
     })
   });
   if (!res.ok) {
@@ -15751,14 +15868,14 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId) {
   }
   return await res.json();
 }
-async function redeployProject(apiUrl, token, projectId) {
+async function redeployProject(apiUrl, token, projectId, app) {
   const res = await fetch(`${apiUrl}/deployments/redeploy`, {
     method: "POST",
     headers: {
       "content-type": "application/json",
       authorization: `Bearer ${token}`
     },
-    body: JSON.stringify({ projectId })
+    body: JSON.stringify({ projectId, ...app ? { app } : {} })
   });
   if (!res.ok) {
     throw new ApiError(`Redeploy failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15800,6 +15917,32 @@ async function pollForNewDeployment(fetchDeployments, match, opts) {
     await sleep(intervalMs);
   }
 }
+async function pollForNewDeployments(fetchDeployments, match, opts) {
+  const expected = opts?.expectedCount ?? null;
+  if (expected === null || expected <= 1) {
+    const first = await pollForNewDeployment(fetchDeployments, match, opts);
+    return first ? [first] : [];
+  }
+  const intervalMs = opts?.intervalMs ?? 2e3;
+  const timeoutMs = opts?.timeoutMs ?? 6e4;
+  const maxConsecutiveErrors = opts?.maxConsecutiveErrors ?? 5;
+  const sleep = opts?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const started = Date.now();
+  let consecutiveErrors = 0;
+  let fresh = [];
+  for (; ; ) {
+    try {
+      const items = await fetchDeployments();
+      consecutiveErrors = 0;
+      fresh = findDeploymentsForCommit(items, match.commitSha, match.branch).filter((d) => !match.knownIds.has(d.id)).reverse();
+      if (fresh.length >= expected) return fresh;
+    } catch (err) {
+      if (++consecutiveErrors > maxConsecutiveErrors) throw err;
+    }
+    if (Date.now() - started >= timeoutMs) return fresh;
+    await sleep(intervalMs);
+  }
+}
 function dataFromFrame(frame) {
   const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).replace(/^ /, "")).join("\n");
   return data.length > 0 ? data : void 0;
@@ -15884,6 +16027,7 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
   while (!opts.signal?.aborted) {
     try {
       const url2 = new URL(`${apiUrl}/${path}`);
+      if (opts.app && (opts.resource ?? "project") === "project") url2.searchParams.set("app", opts.app);
       if (afterNs) url2.searchParams.set("after", afterNs);
       else if (opts.since) url2.searchParams.set("since", opts.since);
       const res = await doFetch(url2, {
@@ -17086,6 +17230,18 @@ function currentBranch(cwd) {
 function headSha(cwd, ref) {
   return probe(cwd, ["rev-parse", ref]);
 }
+function declaredAppCount(cwd, sha) {
+  const res = probe(cwd, ["show", `${sha}:kryd.json`]);
+  if (res.status !== "ok") return null;
+  try {
+    const apps = JSON.parse(res.value).apps;
+    if (apps === null || typeof apps !== "object" || Array.isArray(apps)) return null;
+    const n = Object.keys(apps).length;
+    return n > 0 ? n : null;
+  } catch {
+    return null;
+  }
+}
 function hasRemote(cwd, remote) {
   const res = probe(cwd, ["remote"]);
   if (res.status !== "ok") return res;
@@ -17471,11 +17627,33 @@ async function runLogs(opts) {
     process.exitCode = 1;
     return;
   }
+  if (opts.app && opts.deployment) {
+    process.stderr.write(
+      "--app picks the latest deploy of an app; a deployment id already names one deploy \u2014 pass one or the other.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (opts.app && !resolveProjectId(void 0, opts.cwd)) {
+    process.stderr.write(
+      "--app needs a linked project: run it in a folder linked with `kryd init`, or pass a deployment id instead.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
   try {
     let deploymentId = opts.deployment;
     if (!deploymentId) {
       const linkedProjectId = resolveProjectId(void 0, opts.cwd);
-      const deploys = await listDeployments(apiUrl, token, linkedProjectId ?? void 0);
+      const deploys = (await listDeployments(apiUrl, token, linkedProjectId ?? void 0)).filter(
+        (d) => !opts.app || (d.app ?? "web") === opts.app
+      );
+      if (deploys.length === 0 && opts.app) {
+        process.stderr.write(`No deploys of app "${opts.app}" found.
+`);
+        process.exitCode = 1;
+        return;
+      }
       if (deploys.length === 0) {
         process.stderr.write(
           linkedProjectId ? "The linked project has no deploys yet \u2014 run `kryd deploy` first.\n" : "No deploys found for your account.\n"
@@ -17539,6 +17717,7 @@ async function runRuntimeLogs(opts) {
       },
       {
         ...opts.since ? { since: opts.since } : {},
+        ...opts.app ? { app: opts.app } : {},
         signal: controller.signal,
         ...isDeployment ? { resource: "deployment" } : opts.worker ? { resource: "worker" } : {}
       }
@@ -17563,7 +17742,17 @@ async function runDeploy(opts) {
     return;
   }
   try {
-    const deploymentId = await triggerDeploy(apiUrl, token, project2);
+    const { deploymentId, apps } = await triggerDeploy(apiUrl, token, project2);
+    if (apps && apps.length > 1) {
+      await followApps(
+        apiUrl,
+        token,
+        apps.map((a) => ({ id: a.deploymentId, app: a.app })),
+        renderFor(opts.logs),
+        []
+      );
+      return;
+    }
     process.stdout.write(`Triggered deploy ${deploymentId}
 `);
     await followDeploy(apiUrl, token, deploymentId, { render: renderFor(opts.logs) });
@@ -17678,14 +17867,17 @@ async function runPush(opts) {
       return;
     }
     process.stdout.write("Waiting for the deploy to start\u2026\n");
-    const deployment = await pollForNewDeployment(
+    const started = await pollForNewDeployments(
       fetchDeployments,
       { commitSha, branch, knownIds: new Set(known.map((d) => d.id)) },
       {
         ...opts.sleep ? { sleep: opts.sleep } : {},
-        ...opts.pollTimeoutMs !== void 0 ? { timeoutMs: opts.pollTimeoutMs } : {}
+        ...opts.pollTimeoutMs !== void 0 ? { timeoutMs: opts.pollTimeoutMs } : {},
+        // The commit's own count of apps, so the follow waits for every row the fan-out creates.
+        expectedCount: declaredAppCount(cwd, commitSha)
       }
     );
+    const deployment = started[0];
     if (!deployment) {
       const previous = known[0];
       if (previous) {
@@ -17701,14 +17893,29 @@ async function runPush(opts) {
       }
       return;
     }
-    await followDeploy(apiUrl, token, deployment.id, {
-      render: renderFor(opts.logs),
-      estimateFrom: recent
-    });
+    if (started.length === 1) {
+      await followDeploy(apiUrl, token, deployment.id, {
+        render: renderFor(opts.logs),
+        estimateFrom: recent
+      });
+      return;
+    }
+    await followApps(apiUrl, token, started, renderFor(opts.logs), recent);
   } catch (err) {
     await reportError(err);
   }
 }
+async function followApps(apiUrl, token, deployments, render, estimateFrom) {
+  process.stdout.write(
+    `This push deploys ${deployments.length} apps: ` + deployments.map((d) => `${d.app ?? "web"} (${d.id})`).join(", ") + ".\n"
+  );
+  for (const d of deployments) {
+    process.stdout.write(`
+\u2500\u2500 ${d.app ?? "web"} \u2500\u2500
+`);
+    await followDeploy(apiUrl, token, d.id, { render, estimateFrom });
+  }
+}
 async function runRollback(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
@@ -17727,7 +17934,8 @@ async function runRollback(opts) {
       apiUrl,
       token,
       project2,
-      opts.deployment
+      opts.deployment,
+      opts.app
     );
     process.stdout.write(
       `Rolling back to ${rolledBackTo} \u2192 ${deploymentId}
@@ -17756,7 +17964,8 @@ async function runRedeploy(opts) {
     const { deploymentId, redeployedCommit, note } = await redeployProject(
       apiUrl,
       token,
-      project2
+      project2,
+      opts.app
     );
     process.stdout.write(
       `Redeploying ${redeployedCommit.slice(0, 7)} \u2192 ${deploymentId}
@@ -18383,6 +18592,171 @@ async function runWorkflowStatus(opts) {
     await reportError(err);
   }
 }
+var DOMAIN_STATUS_TEXT = {
+  pending: "pending \u2014 waiting for the DNS records",
+  verified: "verified \u2014 DNS is right, the certificate is being issued",
+  active: "active \u2014 served over HTTPS",
+  failed: "failed \u2014 certificate issuance is failing; Kryd retries automatically"
+};
+function formatDomainRecords(records) {
+  const line = (r) => `    ${r.type.padEnd(5)} ${r.name}  \u2192  ${r.value}
+`;
+  const ownership = records.filter((r) => r.purpose === "ownership");
+  const routing = records.filter((r) => r.purpose === "routing");
+  let out = "  1. Prove you own it:\n" + ownership.map(line).join("");
+  out += "  2. Point it at Kryd \u2014 exactly ONE of these:\n";
+  for (const r of routing) {
+    out += line(r) + (r.note ? `         (${r.note})
+` : "");
+  }
+  return out;
+}
+function domainContext(opts, usage) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = loadConfig().token;
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return null;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked(usage);
+    return null;
+  }
+  return { apiUrl, token, project: project2 };
+}
+async function runDomainAdd(opts) {
+  const ctx = domainContext(opts, "kryd domain add <host> --project <projectId>");
+  if (!ctx) return;
+  try {
+    const [domain3, list] = await Promise.all([
+      addDomain(ctx.apiUrl, ctx.token, ctx.project, opts.host, opts.app),
+      listDomains(ctx.apiUrl, ctx.token, ctx.project).catch(() => null)
+    ]);
+    if (domain3.status !== "pending") {
+      process.stdout.write(
+        `${domain3.host} is already on ${ctx.project}${appSuffix(domain3.app)}: ${DOMAIN_STATUS_TEXT[domain3.status]}.
+`
+      );
+      return;
+    }
+    process.stdout.write(
+      `${domain3.host} added to ${ctx.project}${appSuffix(domain3.app)} \u2014 pending until its DNS records exist.
+
+Create these records at your DNS provider:
+` + formatDomainRecords(domain3.records) + `
+Kryd checks every minute; once they are right it issues a certificate and serves ${domain3.host} from ${domain3.app && domain3.app !== "web" ? `app ${domain3.app}'s` : "your"} production deploy. Follow it with \`kryd domain status ${domain3.host}\`.
+` + (list?.projectHost ? `${ctx.project} keeps its own host, ${list.projectHost}.
+` : "")
+    );
+  } catch (err) {
+    await reportError(err);
+  }
+}
+async function runDeployHookCreate(opts) {
+  const ctx = domainContext(opts, "kryd project deploy-hook create --project <projectId>");
+  if (!ctx) return;
+  try {
+    const { url: url2, replaced } = await createDeployHook(ctx.apiUrl, ctx.token, ctx.project);
+    process.stdout.write(
+      `Deploy hook for ${ctx.project}${replaced ? " \u2014 replaces the previous one, which no longer works" : ""}:
+
+  ${url2}
+
+A POST to this URL rebuilds production from the latest commit, without cache. It is shown only now: anyone with it can start a rebuild, so keep it secret. Lost or leaked? Run this command again to replace it, or \`kryd project deploy-hook rm\` to remove it.
+`
+    );
+  } catch (err) {
+    await reportError(err);
+  }
+}
+async function runDeployHookRemove(opts) {
+  const ctx = domainContext(opts, "kryd project deploy-hook rm --project <projectId>");
+  if (!ctx) return;
+  try {
+    const { removed } = await removeDeployHook(ctx.apiUrl, ctx.token, ctx.project);
+    process.stdout.write(
+      removed ? `Deploy hook of ${ctx.project} removed \u2014 its URL no longer works.
+` : `${ctx.project} has no deploy hook \u2014 nothing to remove.
+`
+    );
+  } catch (err) {
+    await reportError(err);
+  }
+}
+function appSuffix(app) {
+  return app && app !== "web" ? ` (app ${app})` : "";
+}
+async function runDomainRemove(opts) {
+  const ctx = domainContext(opts, "kryd domain remove <host> --project <projectId>");
+  if (!ctx) return;
+  const host = normalizeDomainHost(opts.host);
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `${host} from ${ctx.project}`,
+    question: `Remove ${host} from ${ctx.project}? Its route and certificate go within a minute and it then answers 404. The project's own kryd.cloud host keeps working.`,
+    declined: `Left ${host} on ${ctx.project}.
+`
+  });
+  if (!proceed) return;
+  try {
+    await removeDomain(ctx.apiUrl, ctx.token, ctx.project, host);
+    process.stdout.write(
+      `${host} removed from ${ctx.project}: its route and certificate go within a minute, then it answers 404. The project's own kryd.cloud host keeps working.
+`
+    );
+  } catch (err) {
+    await reportError(err);
+  }
+}
+async function runDomainStatus(opts) {
+  const ctx = domainContext(opts, "kryd domain status [host] --project <projectId>");
+  if (!ctx) return;
+  try {
+    const list = await listDomains(ctx.apiUrl, ctx.token, ctx.project);
+    const own = list.projectHost ? `${ctx.project} is always served at ${list.projectHost}.
+` : "";
+    if (!opts.host) {
+      if (list.domains.length === 0) {
+        process.stdout.write(`${ctx.project}: no custom domains.
+${own}`);
+        return;
+      }
+      let out2 = `${ctx.project}: ${list.domains.length} custom domain${list.domains.length === 1 ? "" : "s"}.
+`;
+      for (const d2 of list.domains) {
+        out2 += `  ${d2.host}  ${DOMAIN_STATUS_TEXT[d2.status]}
+`;
+        if (d2.detail) out2 += `      ${d2.detail}
+`;
+      }
+      process.stdout.write(out2 + own);
+      return;
+    }
+    const wanted = normalizeDomainHost(opts.host);
+    const d = list.domains.find((x) => x.host === wanted);
+    if (!d) {
+      process.stderr.write(`${wanted} is not a custom domain of ${ctx.project}. Add it with \`kryd domain add ${wanted}\`.
+`);
+      process.exitCode = 1;
+      return;
+    }
+    let out = `${d.host}: ${DOMAIN_STATUS_TEXT[d.status]}.
+`;
+    if (d.detail) out += `  ${d.detail}
+`;
+    if (d.status === "pending") {
+      out += `
+The records to create:
+` + formatDomainRecords(d.records);
+    }
+    process.stdout.write(out + own);
+  } catch (err) {
+    await reportError(err);
+  }
+}
 async function runWorkflowInit(opts) {
   const cwd = opts.cwd ?? process.cwd();
   if (!opts.language) {
@@ -19125,7 +19499,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.9.1" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.11.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.hook("postAction", async () => {
@@ -19170,13 +19544,17 @@ program.command("logs [target]").description(
 ).option(
   "--since <dur>",
   "with --runtime/--worker: backfill this window before going live (e.g. 30m, 2h, 1d; max 7d)"
+).option(
+  "--app <name>",
+  "a project with several web apps (kryd.json \u2192 apps): which app \u2014 its latest deploy, or with --runtime its live container"
 ).option("--api-url <url>", "control-plane API base URL").action(
   (target, opts) => opts.runtime || opts.worker ? runRuntimeLogs({
     project: target,
     since: opts.since,
     apiUrl: opts.apiUrl,
+    ...opts.app ? { app: opts.app } : {},
     ...opts.worker ? { worker: true } : {}
-  }) : runLogs({ apiUrl: opts.apiUrl, deployment: target })
+  }) : runLogs({ apiUrl: opts.apiUrl, deployment: target, ...opts.app ? { app: opts.app } : {} })
 );
 program.command("push [branch]").description(
   "Push to the kryd remote and follow the deploy it triggers (defaults to the current branch)"
@@ -19184,17 +19562,20 @@ program.command("push [branch]").description(
   (branch, opts, cmd) => runPush({ ...opts, branch, gitArgs: cmd.args.slice(1) })
 );
 program.command("deploy [project]").description("Trigger a deploy of the project's production branch and follow it live").option("--logs", LOGS_FLAG_HELP).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDeploy({ ...opts, project: project2 }));
-program.command("rollback [project] [deployment]").description("Roll back to a previous successful deploy (no rebuild) and follow it live").option("--logs", LOGS_FLAG_HELP).option("--api-url <url>", "control-plane API base URL").action(
+program.command("rollback [project] [deployment]").description("Roll back to a previous successful deploy (no rebuild) and follow it live").option("--app <name>", "a project with several web apps: which app to roll back").option("--logs", LOGS_FLAG_HELP).option("--api-url <url>", "control-plane API base URL").action(
   (project2, deployment, opts) => runRollback({ ...opts, project: project2, deployment })
 );
 program.command("redeploy [project]").description(
   "Redeploy the current live commit (no rebuild) to apply config/env changes, and follow it live"
-).option("--logs", LOGS_FLAG_HELP).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runRedeploy({ ...opts, project: project2 }));
+).option("--app <name>", "a project with several web apps: which app to redeploy").option("--logs", LOGS_FLAG_HELP).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runRedeploy({ ...opts, project: project2 }));
 var project = program.command("project").description("Manage your projects");
 project.command("list").description("List your projects \u2014 name, subdomain, status and id").option("--api-url <url>", "control-plane API base URL").action((opts) => runProjectList(opts));
 project.command("rm [project]").description(
   "Permanently delete a project and everything Kryd created for it (by name or id; asks you to type its name)"
 ).option("--yes", "skip the confirmation (for non-interactive use)").option("--api-url <url>", "control-plane API base URL").action((projectArg, opts) => runProjectRemove({ ...opts, project: projectArg }));
+var deployHook = project.command("deploy-hook").description("A secret URL that rebuilds production on a POST \u2014 for a CMS webhook (e.g. Sanity on publish)");
+deployHook.command("create").description("Create the deploy hook and print its URL once (replaces an existing one)").option("--project <projectId>", "the project (default: the one linked here)").option("--api-url <url>", "control-plane API base URL").action((opts) => runDeployHookCreate(opts));
+deployHook.command("rm").description("Remove the deploy hook \u2014 its URL stops working").option("--project <projectId>", "the project (default: the one linked here)").option("--api-url <url>", "control-plane API base URL").action((opts) => runDeployHookRemove(opts));
 var db = program.command("db").description("Manage project databases");
 db.command("add [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
   "--connection-string <url>",
@@ -19250,6 +19631,10 @@ workflow.command("init").description(
   "--language <language>",
   `worker language: ${SCAFFOLD_LANGUAGES.join(" | ")}`
 ).option("--path <folder>", "the worker's folder inside the app (default: workflows)").option("--only", "a project that runs ONLY a worker: scaffold it at the root, git init, and link").option("--dir <path>", "the project directory, instead of the current one").option("--name <name>", "worker name (and, with --only, project name); defaults to the directory name").option("--no-link", "with --only: only write the files; do not create a Kryd project").option("--api-url <url>", "control-plane API base URL").action((opts) => runWorkflowInit(opts));
+var domain2 = program.command("domain").description("Serve the project on your own hostname (custom domains)");
+domain2.command("add <host>").description("Add a custom domain and print the DNS records to create").option("--project <projectId>", "the project (default: the one linked here)").option("--app <name>", "a project with several web apps: the app the domain serves (default: web)").option("--api-url <url>", "control-plane API base URL").action((host, opts) => runDomainAdd({ ...opts, host }));
+domain2.command("remove <host>").description("Remove a custom domain \u2014 its route and certificate go (asks for confirmation)").option("--project <projectId>", "the project (default: the one linked here)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((host, opts) => runDomainRemove({ ...opts, host }));
+domain2.command("status [host]").description("Show the project's custom domains, or one in detail with what is missing").option("--project <projectId>", "the project (default: the one linked here)").option("--api-url <url>", "control-plane API base URL").action((host, opts) => runDomainStatus({ ...opts, host }));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;
@@ -19278,6 +19663,11 @@ export {
   runDbRemove,
   runDbStatus,
   runDeploy,
+  runDeployHookCreate,
+  runDeployHookRemove,
+  runDomainAdd,
+  runDomainRemove,
+  runDomainStatus,
   runEnvList,
   runEnvPull,
   runEnvRemove,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "Kryd CLI — push a React / Vite / Next.js app to the European cloud for your AI: git push → live with SSL, one-click managed Postgres & object storage, and an EU-hosted AI gateway already wired in. Your code and your model calls stay in the EU.",
   "keywords": [
     "kryd",
@@ -14,14 +14,6 @@
     "ai-gateway"
   ],
   "homepage": "https://kryd.eu",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/24BEEPS/kryd.git",
-    "directory": "apps/cli"
-  },
-  "bugs": {
-    "url": "https://github.com/24BEEPS/kryd/issues"
-  },
   "license": "Apache-2.0",
   "author": "Kryd <boris@beep24.nl>",
   "type": "module",
@@ -50,8 +42,8 @@
     "typescript": "^5.6.3",
     "vitest": "^2.1.8",
     "@kryd/shared-types": "0.0.0",
-    "@kryd/config-eslint": "0.0.0",
-    "@kryd/config-ts": "0.0.0"
+    "@kryd/config-ts": "0.0.0",
+    "@kryd/config-eslint": "0.0.0"
   },
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --define:__KRYD_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/index.js",