@newly/cli 0.1.0 → 0.1.1

package/README.md

@@ -18,6 +18,8 @@ newly pull <project-id>  # download project code + link this directory
 # edit code…
 newly deploy             # deploy to dev
 newly deploy --env prod  # ship to prod
+newly services list      # inspect backend services
+newly email status       # inspect Newly Email setup
 ```
 
 ## Auth
@@ -47,7 +49,7 @@ Most commands target the project linked to the current directory, so you don't p
 
 Prod actions prompt for confirmation. Pass `--yes` to skip it in scripts.
 
-> Only **newly-backend-stack** projects (Python api-service + Node auth-service) are CLI-deployable. Run `newly stack` to check. Specular-stack projects must be deployed from the Newly web app.
+> Only projects on the Newly backend stack are CLI-deployable. Run `newly stack` to check. Other projects must be deployed from the Newly web app.
 
 ## Commands
 
@@ -73,19 +75,20 @@ Show dev and prod status, service URLs, deployed SHA, and last error.
 Show which backend stack the project uses and whether it's CLI-deployable.
 - `--project <id>`
 
-### `newly up`
-Provision the backend (if not already) and deploy.
-- `--env <dev|prod>` (default `dev`)
-- `--region <region>` — region for dev provisioning (default `us-central1`)
-- `--project <id>`
-- `--yes` — skip the prod confirmation prompt
-
 ### `newly deploy`
-Deploy the backend.
+Provision the backend if needed, then deploy.
 - `--env <dev|prod>` (default `dev`)
+- `--region <region>` — region for first-time dev provisioning (default `auto`)
 - `--project <id>`
+- `--service <names>` — comma-separated service names from `backend/newly.services.json`
+- `--git-sha <sha>` — prod git revision to deploy (default `HEAD`)
 - `--yes` — skip the prod confirmation prompt
 
+### `newly services list`
+List backend services from `backend/newly.services.json`.
+- `--env <dev|prod>` (default `dev`) — used for rendered public URLs
+- `--project <id>` — include expected public URLs for this project
+
 ### `newly logs`
 Tail backend service logs. **Dev only.**
 - `--service <api|auth>` (default `api`)
@@ -105,10 +108,66 @@ Set a backend secret. **Dev only.** Redeploy to apply.
 - `--project <id>`
 
 ### `newly db url`
-Print a readonly Postgres URL for the backend database. **Dev only.**
+Print a readonly URL for the Newly DB. **Dev only.**
+- `--project <id>`
+
+### `newly email status`
+Show Newly Email configuration for the API service. **Dev only.**
 - `--project <id>`
 
+### `newly email test`
+Send a test email through the deployed API service. **Dev only.**
+- `--to <email>` — recipient address
+- `--from <email>` — optional sender; defaults to the backend sender setting
+- `--subject <subject>`
+- `--text <text>`
+- `--html <html>`
+- `--project <id>`
+
+## Dev mode
+
+`newly-dev` is a convenience wrapper that points credentials at `~/.newly-dev` so dev and prod credentials never collide. The prod `newly` binary still defaults to `https://newly.app` and `~/.newly/credentials`, untouched.
+
+### Headless login
+
+For CI and dev modal-backend deploys where no web app is running to mint a CLI token, skip the browser entirely:
+
+```bash
+newly-dev login \
+  --api-url https://your-dev-modal.modal.run/api \
+  --token <jwt> \
+  --expires-in 86400
+```
+
+`--expires-in` is seconds. The same flags work on the prod `newly` binary.
+
+### Env vars
+
+| Var | Effect |
+|---|---|
+| `NEWLY_HOME` | Credentials directory. Explicit value always wins. |
+| `NEWLY_DEV_HOME` | Credentials directory used by `newly-dev` (default: `~/.newly-dev`). |
+| `NEWLY_APP_URL` | Default for `--app-url` at module load. |
+| `NEWLY_DEV_APP_URL` | When set, `newly-dev` surfaces this as `NEWLY_APP_URL`. |
+
+### Typical dev workflow
+
+```bash
+# 1. Deploy a personal dev modal-backend.
+cd modal-backend
+uv run ./deploy.sh --terminate
+
+# 2. Grab the deployed URL, then log the dev CLI in headlessly.
+newly-dev login --api-url https://your-dev-modal.modal.run/api --token <jwt>
+
+# 3. Use newly-dev the same way as newly.
+newly-dev create my-test
+newly-dev status
+newly-dev deploy
+```
+
 ## Files
 
 - `~/.newly/credentials` — session token (mode `600`). Override the directory with `NEWLY_HOME`.
+- `~/.newly-dev/credentials` — `newly-dev` session token. Override the directory with `NEWLY_DEV_HOME`.
 - `.newly/project.json` — per-directory project link.

package/dist/api.js

@@ -41,6 +41,12 @@ export class ApiClient {
     post(path, body) {
         return this.request('POST', path, body);
     }
+    patch(path, body) {
+        return this.request('PATCH', path, body);
+    }
+    delete(path, body) {
+        return this.request('DELETE', path, body);
+    }
     async upload(path, body, contentType) {
         const res = await fetch(`${this.baseUrl}${path}`, {
             method: 'POST',
@@ -62,6 +68,26 @@ export class ApiClient {
         const contentType_ = res.headers.get('content-type') ?? '';
         return contentType_.includes('application/json') ? res.json() : res;
     }
+    async uploadForm(path, form) {
+        const res = await fetch(`${this.baseUrl}${path}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.token}`,
+            },
+            body: form,
+        });
+        if (!res.ok) {
+            let detail = await res.text();
+            try {
+                detail = JSON.parse(detail).detail ?? detail;
+            }
+            catch {
+            }
+            throw new ApiError(res.status, detail);
+        }
+        const contentType = res.headers.get('content-type') ?? '';
+        return contentType.includes('application/json') ? res.json() : res;
+    }
     async getBinary(path) {
         const res = await fetch(`${this.baseUrl}${path}`, {
             method: 'GET',

package/dist/commands/build.js

@@ -0,0 +1,12 @@
+export function buildPlaceholderMessage(platform) {
+    return (`In-house ${platform} builds are coming in an upcoming release.\n` +
+        'Set up iOS signing first with `newly creds apple` (check readiness with `newly creds apple status`).');
+}
+export function registerBuild(program) {
+    program
+        .command('build [platform]')
+        .description('Build the mobile app (coming soon)')
+        .action((platform = 'ios') => {
+        console.log(buildPlaceholderMessage(platform));
+    });
+}

package/dist/commands/create.js

@@ -30,7 +30,7 @@ export async function runCreate(client, dir, opts) {
     }
     else {
         console.log(`Created backend project ${project_id} and scaffolded backend/ here ` +
-            `(not provisioned — run \`newly up\` when ready). Edit, then \`newly deploy\`.`);
+            `(not provisioned — run \`newly deploy\` when ready).`);
     }
     return project_id;
 }

package/dist/commands/creds.js

@@ -0,0 +1,103 @@
+import { readFileSync } from 'node:fs';
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials, resolveProject } from '../config.js';
+const TEAM_BUNDLE_CMD = 'newly creds apple --team-id <TEAM_ID> --bundle-id <BUNDLE_ID>';
+const ASC_KEY_CMD = 'newly creds apple --asc-key <key.p8> --key-id <KEY_ID> --issuer-id <ISSUER_ID>';
+export function buildReadiness(s) {
+    const missing = [];
+    const remediations = [];
+    if (!s.team_id)
+        missing.push('team id');
+    if (!s.bundle_id)
+        missing.push('bundle id');
+    if (!s.team_id || !s.bundle_id)
+        remediations.push(TEAM_BUNDLE_CMD);
+    if (!s.asc_api_key?.has_private_key) {
+        missing.push('ASC API key');
+        remediations.push(ASC_KEY_CMD);
+    }
+    return { ready: missing.length === 0, missing, remediations };
+}
+export function renderAppleStatus(s) {
+    const r = buildReadiness(s);
+    const lines = [
+        `team id:     ${s.team_id ?? '— not set'}`,
+        `bundle id:   ${s.bundle_id ?? '— not set'}`,
+        `ASC API key: ${s.asc_api_key?.has_private_key ? 'configured' : '— not set'}`,
+    ];
+    if (r.ready) {
+        lines.push('', '✓ iOS build-ready.');
+    }
+    else {
+        lines.push('', `Missing: ${r.missing.join(', ')}. To fix:`);
+        for (const cmd of r.remediations)
+            lines.push(`  ${cmd}`);
+    }
+    return lines.join('\n');
+}
+export function planAppleCreds(opts) {
+    const setTeamInfo = Boolean(opts.teamId || opts.bundleId);
+    if (setTeamInfo && !(opts.teamId && opts.bundleId)) {
+        throw new Error('--team-id and --bundle-id must be provided together.');
+    }
+    const uploadAscKey = Boolean(opts.ascKey);
+    if (uploadAscKey && !opts.keyId) {
+        throw new Error('--asc-key requires --key-id.');
+    }
+    if (!setTeamInfo && !uploadAscKey) {
+        throw new Error('Nothing to do. Pass --team-id/--bundle-id and/or --asc-key. See `newly creds apple status`.');
+    }
+    return { setTeamInfo, uploadAscKey };
+}
+export async function runAppleCreds(opts, client, projectId, log = console.log) {
+    const plan = planAppleCreds(opts);
+    if (plan.setTeamInfo) {
+        await client.post(`/newly_backend/apple/team_info/${projectId}`, {
+            team_id: opts.teamId,
+            bundle_id: opts.bundleId,
+        });
+        log(`Set team id ${opts.teamId} and bundle id ${opts.bundleId}.`);
+    }
+    if (plan.uploadAscKey) {
+        const privateKeyBase64 = readFileSync(opts.ascKey).toString('base64');
+        await client.post(`/newly_backend/apple/asc_key/${projectId}`, {
+            key_id: opts.keyId,
+            issuer_id: opts.issuerId ?? '',
+            private_key_base64: privateKeyBase64,
+        });
+        log('Uploaded ASC API key.');
+    }
+}
+export function registerCreds(program) {
+    const creds = program.command('creds').description('Manage project credentials');
+    const apple = creds
+        .command('apple')
+        .argument('[action]', 'use "status" to show Apple credential readiness')
+        .description('Set Apple iOS build credentials (project owner only)')
+        .option('--team-id <id>', 'Apple Developer team ID')
+        .option('--bundle-id <id>', 'iOS bundle identifier')
+        .option('--asc-key <file>', 'path to an App Store Connect API key (.p8)')
+        .option('--key-id <id>', 'ASC API key ID (required with --asc-key)')
+        .option('--issuer-id <id>', 'ASC API issuer ID')
+        .option('--project <id>', 'project id (defaults to the linked directory)');
+    apple.action(async (action, opts) => {
+        try {
+            const creds = requireCredentials();
+            const projectId = resolveProject(process.cwd(), opts.project);
+            const client = new ApiClient(creds.apiUrl, creds.token);
+            if (action === 'status') {
+                const status = await client.get(`/newly_backend/apple/status/${projectId}`);
+                console.log(renderAppleStatus(status));
+                return;
+            }
+            if (action) {
+                throw new Error(`Unknown creds apple action "${action}". Use "status" or pass credential options.`);
+            }
+            await runAppleCreds(opts, client, projectId);
+        }
+        catch (e) {
+            console.error(friendlyApiError(e));
+            process.exitCode = 1;
+        }
+    });
+}

package/dist/commands/deploy.js

@@ -4,6 +4,7 @@ import { ApiClient, ApiError, friendlyApiError } from '../api.js';
 import { requireCredentials, resolveProject } from '../config.js';
 import { createSnapshot } from '../archive.js';
 import { parseSseFrames } from '../sse.js';
+import { assertKnownServices, parseServiceFilter, readBackendServices } from '../services-manifest.js';
 const POLL_INTERVAL_MS = 5_000;
 const POLL_TIMEOUT_MS = 20 * 60 * 1000;
 export async function pollRun(client, runId, opts = {}) {
@@ -61,52 +62,90 @@ export function finishOrThrow(run, label) {
         return;
     }
     if (run.failure_reason === 'no_backend_code') {
-        throw new Error('No backend code to deploy (backend/api-service missing).');
+        throw new Error('No backend code to deploy (backend/ missing).');
     }
     throw new Error(`${label} deploy failed (${run.failure_reason ?? 'unknown'}):\n${run.output_tail ?? ''}`);
 }
-export async function runDevDeploy(projectId, client, dir) {
-    if (!existsSync(join(dir, 'backend', 'api-service'))) {
-        throw new Error('No backend/api-service in this directory. Run `newly pull <project-id>` first, ' +
+export async function runDevDeploy(projectId, client, dir, services = []) {
+    if (!existsSync(join(dir, 'backend'))) {
+        throw new Error('No backend/ in this directory. Run `newly pull <project-id>` first, ' +
             'or cd into a pulled project.');
     }
     console.log('Packaging local backend…');
     const snapshot = await createSnapshot(dir);
     const kib = snapshot.length < 1024 ? '<1' : Math.round(snapshot.length / 1024).toString();
     console.log(`Uploading snapshot (${kib} KiB) and deploying server-side…`);
-    const { run_id } = await client.upload(`/newly_backend/deploy/${projectId}?env=dev`, snapshot, 'application/gzip');
+    const params = new URLSearchParams({ env: 'dev' });
+    for (const service of services)
+        params.append('services', service);
+    const { run_id } = await client.upload(`/newly_backend/deploy/${projectId}?${params}`, snapshot, 'application/gzip');
     const run = await streamRun(client, run_id);
     finishOrThrow(run, 'dev');
 }
-export async function runProdDeploy(projectId, client) {
-    console.log('Deploying prod from the canonical project code (repo HEAD)…');
-    const { run_id } = await client.post(`/newly_backend/deploy/${projectId}`, { env: 'prod' });
+export async function runProdDeploy(projectId, client, gitSha = 'HEAD', services = []) {
+    const label = gitSha === 'HEAD' ? 'repo HEAD' : gitSha;
+    console.log(`Deploying prod from the canonical project code (${label})…`);
+    const { run_id } = await client.post(`/newly_backend/deploy/${projectId}`, {
+        env: 'prod',
+        git_sha: gitSha,
+        services,
+    });
     const run = await streamRun(client, run_id);
     finishOrThrow(run, 'prod');
 }
+export async function ensureBackendProvisioned(client, projectId, env, opts = {}) {
+    const print = opts.print ?? console.log;
+    const status = await client.get(`/newly_backend/status/${projectId}`);
+    if (status[env])
+        return;
+    print(`Provisioning ${env} backend…`);
+    if (env === 'dev') {
+        await client.post(`/newly_backend/provision_dev/${projectId}`, {
+            dev_region: opts.region ?? 'auto',
+        });
+    }
+    else {
+        await client.post(`/newly_backend/provision_prod/${projectId}`);
+    }
+    print(`Provisioned ${env} backend.`);
+}
 export function registerDeploy(program) {
     program
         .command('deploy')
-        .description('Deploy the backend server-side from your local code (dev only; prod ships via Promote in the web app)')
-        .option('--env <env>', 'dev (prod is not supported via the CLI yet)', 'dev')
+        .description('Provision if needed, then deploy the backend server-side')
+        .option('--env <env>', 'dev or prod', 'dev')
+        .option('--region <region>', "Newly server region hint for first-time dev provisioning (defaults to 'auto')", 'auto')
         .option('--project <id>', 'project id (defaults to the linked directory)')
+        .option('--service <names>', 'comma-separated service names from backend/newly.services.json')
+        .option('--git-sha <sha>', 'prod git revision to deploy from canonical project code', 'HEAD')
         .option('--yes', 'skip the prod confirmation prompt', false)
         .action(async (opts) => {
         try {
             if (opts.env !== 'dev' && opts.env !== 'prod')
                 throw new Error('--env must be dev or prod');
-            if (opts.env === 'prod') {
-                throw new Error('Prod deploys are not supported via the CLI yet — use Promote in the Newly web app.');
-            }
             const creds = requireCredentials();
             const projectId = resolveProject(process.cwd(), opts.project);
             const client = new ApiClient(creds.apiUrl, creds.token);
+            const services = parseServiceFilter(opts.service);
+            assertKnownServices(readBackendServices(process.cwd()), services);
             const stackInfo = await client.get(`/newly_backend/stack/${projectId}`);
             if (!stackInfo.cli_deployable) {
-                throw new Error('This project is on the Specular stack (a single Node/drizzle backend), which `newly deploy` does not support. ' +
-                    'Only newly-backend-stack projects (Python api-service + Node auth-service) are CLI-deployable.');
+                throw new Error('This project does not support CLI deploys yet. Use the Newly web app to deploy it.');
+            }
+            if (opts.env === 'dev' && !existsSync(join(process.cwd(), 'backend'))) {
+                throw new Error('No backend/ in this directory. Run `newly pull <project-id>` first, ' +
+                    'or cd into a pulled project.');
+            }
+            await ensureBackendProvisioned(client, projectId, opts.env, {
+                region: opts.region,
+                print: console.log,
+            });
+            if (opts.env === 'prod') {
+                await runProdDeploy(projectId, client, opts.gitSha, services);
+            }
+            else {
+                await runDevDeploy(projectId, client, process.cwd(), services);
             }
-            await runDevDeploy(projectId, client, process.cwd());
         }
         catch (e) {
             console.error(e instanceof ApiError ? friendlyApiError(e) : String(e instanceof Error ? e.message : e));

package/dist/commands/dns.js

@@ -0,0 +1,185 @@
+import { stdin as input, stdout as output } from 'node:process';
+import { createInterface } from 'node:readline/promises';
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials, resolveProject } from '../config.js';
+function makeClient(project) {
+    const creds = requireCredentials();
+    return {
+        client: new ApiClient(creds.apiUrl, creds.token),
+        projectId: resolveProject(process.cwd(), project),
+    };
+}
+export async function resolveDomain(client, projectId, domainNameOrId) {
+    const result = (await client.get(`/projects/${projectId}/domains`));
+    const domains = result.domains ?? [];
+    const domain = domains.find((item) => item.id === domainNameOrId ||
+        item.hostname === domainNameOrId ||
+        item.root_domain === domainNameOrId);
+    if (!domain)
+        throw new Error(`Domain ${domainNameOrId} is not connected to this project.`);
+    return domain;
+}
+export function renderRecord(record) {
+    const ttl = record.ttl === undefined ? '' : `  ttl=${record.ttl}`;
+    const proxied = record.proxied === undefined ? '' : `  proxied=${record.proxied}`;
+    const priority = record.priority === undefined ? '' : `  priority=${record.priority}`;
+    return `${record.id}  ${record.type}  ${record.name}  ${record.content}${ttl}${proxied}${priority}`;
+}
+async function confirm(prompt) {
+    const rl = createInterface({ input, output });
+    try {
+        const answer = (await rl.question(`${prompt} Type "yes" to continue: `)).trim().toLowerCase();
+        return answer === 'yes';
+    }
+    finally {
+        rl.close();
+    }
+}
+export function numberOrUndefined(value, optionName = 'number') {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    const parsed = Number(trimmed);
+    if (!trimmed) {
+        throw new Error(`${optionName} must be a finite number.`);
+    }
+    if (!Number.isFinite(parsed)) {
+        throw new Error(`${optionName} must be a finite number.`);
+    }
+    return parsed;
+}
+export async function runDnsList(client, projectId, domainName, log = console.log) {
+    const domain = await resolveDomain(client, projectId, domainName);
+    const result = (await client.get(`/projects/${projectId}/domains/${domain.id}/dns-records`));
+    if (!result.editable) {
+        log(JSON.stringify(result.instructions, null, 2));
+        return;
+    }
+    const records = result.records ?? [];
+    log(records.length ? records.map(renderRecord).join('\n') : 'No DNS records.');
+}
+export async function runDnsAdd(client, projectId, domainName, opts, log = console.log) {
+    const ttl = numberOrUndefined(opts.ttl, 'ttl');
+    const priority = numberOrUndefined(opts.priority, 'priority');
+    const domain = await resolveDomain(client, projectId, domainName);
+    const result = await client.post(`/projects/${projectId}/domains/${domain.id}/dns-records`, {
+        type: opts.type,
+        name: opts.name,
+        content: opts.content,
+        ttl,
+        proxied: opts.proxied,
+        priority,
+        comment: opts.comment,
+    });
+    log(renderRecord(result.record));
+}
+export async function runDnsEdit(client, projectId, domainName, recordId, opts, log = console.log) {
+    const body = {
+        type: opts.type,
+        name: opts.name,
+        content: opts.content,
+        ttl: numberOrUndefined(opts.ttl, 'ttl'),
+        proxied: opts.proxied,
+        priority: numberOrUndefined(opts.priority, 'priority'),
+        comment: opts.comment,
+    };
+    if (Object.values(body).every((value) => value === undefined)) {
+        throw new Error('Nothing to edit. Pass at least one record field.');
+    }
+    const domain = await resolveDomain(client, projectId, domainName);
+    const result = await client.patch(`/projects/${projectId}/domains/${domain.id}/dns-records/${recordId}`, body);
+    log(renderRecord(result.record));
+}
+export async function runDnsDelete(client, projectId, domainName, recordId, opts, log = console.log, confirmDelete = confirm) {
+    const domain = await resolveDomain(client, projectId, domainName);
+    const ok = opts.yes || (await confirmDelete(`Delete DNS record ${recordId} from ${domain.hostname}?`));
+    if (!ok) {
+        log('Cancelled.');
+        return;
+    }
+    await client.delete(`/projects/${projectId}/domains/${domain.id}/dns-records/${recordId}`, {
+        confirm: true,
+    });
+    log(`Deleted ${recordId}.`);
+}
+export function registerDns(program) {
+    const dns = program.command('dns').description('Manage DNS records through Newly backend');
+    dns
+        .command('list')
+        .argument('<domain>')
+        .option('--project <id>', 'project id (defaults to the linked directory)')
+        .description('List DNS records for a managed domain')
+        .action(async (domainName, opts) => {
+        try {
+            const { client, projectId } = makeClient(opts.project);
+            await runDnsList(client, projectId, domainName);
+        }
+        catch (e) {
+            console.error(friendlyApiError(e));
+            process.exitCode = 1;
+        }
+    });
+    dns
+        .command('add')
+        .argument('<domain>')
+        .requiredOption('--type <type>', 'record type')
+        .requiredOption('--name <name>', 'record name, or @ for apex')
+        .requiredOption('--content <content>', 'record content')
+        .option('--ttl <seconds>', 'record TTL', '300')
+        .option('--proxied', 'enable Cloudflare proxying')
+        .option('--priority <n>', 'MX priority')
+        .option('--comment <text>', 'record comment')
+        .option('--project <id>', 'project id (defaults to the linked directory)')
+        .description('Create a DNS record for a managed domain')
+        .action(async (domainName, opts) => {
+        try {
+            const { client, projectId } = makeClient(opts.project);
+            await runDnsAdd(client, projectId, domainName, opts);
+        }
+        catch (e) {
+            console.error(friendlyApiError(e));
+            process.exitCode = 1;
+        }
+    });
+    dns
+        .command('edit')
+        .argument('<domain>')
+        .argument('<record-id>')
+        .option('--type <type>', 'record type')
+        .option('--name <name>', 'record name, or @ for apex')
+        .option('--content <content>', 'record content')
+        .option('--ttl <seconds>', 'record TTL')
+        .option('--proxied', 'enable Cloudflare proxying')
+        .option('--no-proxied', 'disable Cloudflare proxying')
+        .option('--priority <n>', 'MX priority')
+        .option('--comment <text>', 'record comment')
+        .option('--project <id>', 'project id (defaults to the linked directory)')
+        .description('Edit a DNS record for a managed domain')
+        .action(async (domainName, recordId, opts) => {
+        try {
+            const { client, projectId } = makeClient(opts.project);
+            await runDnsEdit(client, projectId, domainName, recordId, opts);
+        }
+        catch (e) {
+            console.error(friendlyApiError(e));
+            process.exitCode = 1;
+        }
+    });
+    dns
+        .command('delete')
+        .argument('<domain>')
+        .argument('<record-id>')
+        .option('--project <id>', 'project id (defaults to the linked directory)')
+        .option('--yes', 'skip confirmation prompt', false)
+        .description('Delete a DNS record for a managed domain')
+        .action(async (domainName, recordId, opts) => {
+        try {
+            const { client, projectId } = makeClient(opts.project);
+            await runDnsDelete(client, projectId, domainName, recordId, opts);
+        }
+        catch (e) {
+            console.error(friendlyApiError(e));
+            process.exitCode = 1;
+        }
+    });
+}