@newly/cli 0.1.131 → 0.1.137

package/README.md

@@ -33,7 +33,6 @@ newly env use checkout-fix # select it for this working directory
 newly deploy             # deploy all declared services to the selected environment
 newly deploy api         # deploy only the api service
 newly services list      # inspect backend services
-newly email status       # inspect Newly Email setup
 ```
 
 ## Auth
@@ -46,8 +45,8 @@ newly whoami          # show the stored credential: account, API, expiry, file
 newly logout          # revoke the credential and delete it locally
 ```
 
-Sign-in goes through Better Auth on the Newly control plane (`https://api.newly.app`).
-`--email` finishes entirely in the terminal, so it works over SSH and in
+Sign-in goes through Better Auth on the Newly control plane (`https://api.newly.app`),
+and every command goes to that same host. `--email` finishes entirely in the terminal, so it works over SSH and in
 containers. Google and GitHub use the device flow: the CLI prints a short code,
 you confirm it at `newly.app/cli-auth`, and the credential is minted server-side —
 it never passes through the browser and nothing is posted to localhost.
@@ -65,16 +64,14 @@ non-zero when there is none or it has expired:
 
 ```
 Account     you@example.com
-API         https://your-backend.modal.run/api
-Issued by   https://api.newly.app
+API         https://api.newly.app
 Expires     never
 Credential  ~/.newly/credentials
 ```
 
-`API` is where commands go; `Issued by` is where the credential came from, and
-only appears when the two differ — which they do for Newly, because sign-in lives
-on the control plane and the commands do not. `logout` revokes against the
-issuer.
+`API` is where commands go and where the credential came from. A credential
+file written by an older CLI names the legacy backend as its API and the control
+plane as `authApiUrl`; it is read as the control plane, so no re-login is needed.
 
 It reports whatever would actually be sent, including a credential supplied
 through `NEWLY_API_TOKEN`, which takes precedence over the saved file. The
@@ -89,15 +86,13 @@ Most commands target the project linked to the current directory, so you don't p
 - `newly link <project-id>` links a directory without downloading anything.
 - Pass `--project <id>` to any command to override the link.
 
-## Selected-environment deploys
+## Deploys
 
-`newly deploy` always uses the environment selected by `newly env use <name>`.
-It never falls back to dev or production and has no `--env` option. Deployments
-use local backend code and are immutable attempts; a failed attempt leaves the
-previous active deployment and route untouched.
-
-Service names are positional. With no names, every service in
-`backend/newly.services.json` is deployed.
+`newly deploy --env dev|prod` (default `dev`) deploys the local `backend/` code.
+`newly env use` does not change which environment it targets. A deploy is an
+immutable attempt; a failed one leaves the previous active deployment and route
+untouched. With no `--service`, every service in `backend/newly.services.json`
+is deployed.
 
 ## Commands
 
@@ -132,9 +127,11 @@ Show which backend stack the project uses and whether it's CLI-deployable.
 - `--project <id>`
 
 ### `newly deploy`
-Deploy local backend services to the selected environment.
+Deploy local backend services to dev or prod, provisioning the environment first if needed.
+- `--env <env>` — `dev` (default) or `prod`
+- `--service <names>` — comma-separated service names from `backend/newly.services.json`
 - `--project <id>`
-- `[services...]` — optional service names from `backend/newly.services.json`
+- `--yes` — skip the prod confirmation prompt
 
 ### `newly services list`
 List backend services from `backend/newly.services.json`.
@@ -163,18 +160,9 @@ Set a backend secret. **Dev only.** Redeploy to apply.
 Print a readonly URL for the Newly DB. **Dev only.**
 - `--project <id>`
 
-### `newly email status`
-Show Newly Email configuration for the API service. **Dev only.**
-- `--project <id>`
-
-### `newly email test`
-Send a test email through the deployed API service. **Dev only.**
-- `--to <email>` — recipient address
-- `--from <email>` — optional sender; defaults to the backend sender setting
-- `--subject <subject>`
-- `--text <text>`
-- `--html <html>`
-- `--project <id>`
+### `newly email`
+Retired. It never had a server to talk to; send mail from your API service with
+your own provider. Running it prints that and exits non-zero.
 
 ## Dev mode
 
@@ -182,12 +170,13 @@ Send a test email through the deployed API service. **Dev only.**
 
 ### Headless login
 
-For CI and dev modal-backend deploys where no web app is running to mint a CLI token, skip the browser entirely:
+For CI, or a dev control plane where no browser is at hand, skip it entirely
+(`newly token create` mints a portable credential):
 
 ```bash
 newly-dev login \
-  --api-url https://your-dev-modal.modal.run/api \
-  --token <jwt> \
+  --api-url https://cp-api-dev-97683904813.us-east4.run.app \
+  --token <nl_live_…> \
   --expires-in 86400
 ```
 
@@ -201,19 +190,15 @@ newly-dev login \
 | `NEWLY_DEV_HOME` | Credentials directory used by `newly-dev` (default: `~/.newly-dev`). |
 | `NEWLY_APP_URL` | Default for `--app-url` at module load. |
 | `NEWLY_DEV_APP_URL` | When set, `newly-dev` surfaces this as `NEWLY_APP_URL`. |
-| `NEWLY_AUTH_API_URL` | Control plane to sign in against (default `https://api.newly.app`). Point it at a dev control plane to log in there. Note this is the issuer, not the API — `--api-url` still names the API. |
+| `NEWLY_AUTH_API_URL` | Control plane to sign in against and send commands to (default `https://api.newly.app`). Point it at a dev control plane to log in there. |
 
 ### Typical dev workflow
 
 ```bash
-# 1. Deploy a personal dev modal-backend.
-cd modal-backend
-uv run ./deploy.sh --terminate
-
-# 2. Grab the deployed URL, then log the dev CLI in headlessly.
-newly-dev login --api-url https://your-dev-modal.modal.run/api --token <jwt>
+# 1. Log the dev CLI in against the dev control plane.
+NEWLY_AUTH_API_URL=https://cp-api-dev-97683904813.us-east4.run.app newly-dev login --email
 
-# 3. Use newly-dev the same way as newly.
+# 2. Use newly-dev the same way as newly.
 newly-dev create my-test
 newly-dev status
 newly-dev deploy

package/dist/api.js

@@ -257,8 +257,9 @@ function headline(err) {
             return `Session expired or invalid — run \`${command}\`.`;
         }
         if (err.status === 403) {
-            if (err.detail)
+            if (err.detail && !/^forbidden\.?$/i.test(err.detail.trim())) {
                 return `Forbidden: ${err.detail}`;
+            }
             const where = err.path ? ` on ${err.path}` : '';
             return (`Forbidden, and the API did not say why. Either the credential was not accepted ` +
                 `(run \`${loginCommandName()}\`), or it is valid but not allowed${where}.`);

package/dist/commands/deploy.js

@@ -4,7 +4,8 @@ import { ApiClient, ApiError, friendlyApiError } from '../api.js';
 import { requireCredentials, resolveProject } from '../config.js';
 import { createSnapshot } from '../archive.js';
 import { parseSseFrames } from '../sse.js';
-import { assertKnownServices, parseServiceFilter, readBackendServices } from '../services-manifest.js';
+import { assertKnownServices, parseServiceFilter, readBackendServices, } from '../services-manifest.js';
+import { buildDeployBundle, spawnRun, NEWLY_BACKEND_DEPLOY_BUNDLE_CONTENT_TYPE, NEWLY_BACKEND_DEPLOY_MODE_BUNDLE, } from '../deploy-bundle.js';
 const POLL_INTERVAL_MS = 5_000;
 const POLL_TIMEOUT_MS = 20 * 60 * 1000;
 export async function pollRun(client, runId, opts = {}) {
@@ -93,10 +94,36 @@ export async function runProdDeploy(projectId, client, gitSha = 'HEAD', services
     const run = await streamRun(client, run_id);
     finishOrThrow(run, 'prod');
 }
+export function isBundleDeployMode(stackInfo) {
+    return stackInfo.deploy_mode === NEWLY_BACKEND_DEPLOY_MODE_BUNDLE;
+}
+export async function runBundleDeploy(projectId, client, dir, env, allServices, selected = [], runCmd = spawnRun) {
+    const targets = selected.length ? allServices.filter((s) => selected.includes(s.name)) : allServices;
+    const bundleServices = targets.map((s) => ({
+        name: s.name,
+        path: s.path,
+        schema: s.schema ?? undefined,
+        secrets: s.secrets,
+    }));
+    const bundle = await buildDeployBundle({
+        projectDir: dir,
+        services: bundleServices,
+        run: runCmd,
+        log: (line) => console.log(line),
+    });
+    const kib = Math.max(1, Math.round(bundle.length / 1024));
+    console.log(`Uploading deploy bundle (${kib} KiB)…`);
+    const params = new URLSearchParams({ env });
+    for (const service of selected)
+        params.append('services', service);
+    const { run_id } = await client.upload(`/newly_backend/deploy/${projectId}?${params}`, bundle, NEWLY_BACKEND_DEPLOY_BUNDLE_CONTENT_TYPE);
+    const run = await streamRun(client, run_id);
+    finishOrThrow(run, env);
+}
 export async function ensureBackendProvisioned(client, projectId, env, opts = {}) {
     const print = opts.print ?? console.log;
     const status = await client.get(`/newly_backend/status/${projectId}`);
-    if (status[env])
+    if (status[env] && status[env].status !== 'failed')
         return;
     print(`Provisioning ${env} backend…`);
     if (env === 'dev') {
@@ -127,12 +154,14 @@ export function registerDeploy(program) {
             const projectId = resolveProject(process.cwd(), opts.project);
             const client = new ApiClient(creds.apiUrl, creds.token);
             const services = parseServiceFilter(opts.service);
-            assertKnownServices(readBackendServices(process.cwd()), services);
-            const stackInfo = await client.get(`/newly_backend/stack/${projectId}`);
+            const manifestServices = readBackendServices(process.cwd());
+            assertKnownServices(manifestServices, services);
+            const stackInfo = (await client.get(`/newly_backend/stack/${projectId}`));
             if (!stackInfo.cli_deployable) {
                 throw new Error('This project does not support CLI deploys yet. Use the Newly web app to deploy it.');
             }
-            if (opts.env === 'dev' && !existsSync(join(process.cwd(), 'backend'))) {
+            const bundleMode = isBundleDeployMode(stackInfo);
+            if ((opts.env === 'dev' || bundleMode) && !existsSync(join(process.cwd(), 'backend'))) {
                 throw new Error('No backend/ in this directory. Run `newly pull <project-id>` first, ' +
                     'or cd into a pulled project.');
             }
@@ -140,7 +169,12 @@ export function registerDeploy(program) {
                 region: opts.region,
                 print: console.log,
             });
-            if (opts.env === 'prod') {
+            if (bundleMode) {
+                if (opts.gitSha !== 'HEAD')
+                    console.log('Note: --git-sha is ignored; this project deploys the local backend code.');
+                await runBundleDeploy(projectId, client, process.cwd(), opts.env, manifestServices, services);
+            }
+            else if (opts.env === 'prod') {
                 await runProdDeploy(projectId, client, opts.gitSha, services);
             }
             else {

package/dist/commands/email.js

@@ -1,86 +1,13 @@
-import { ApiClient, friendlyApiError } from '../api.js';
-import { requireCredentials, resolveProject } from '../config.js';
-import { assertDevOnly } from './misc.js';
-function makeClient(project) {
-    const creds = requireCredentials();
-    return {
-        client: new ApiClient(creds.apiUrl, creds.token),
-        projectId: resolveProject(process.cwd(), project),
-    };
-}
-export async function getEmailStatus(client, projectId, env) {
-    return await client.get(`/newly_backend/email/status?project_id=${encodeURIComponent(projectId)}&env=${env}`);
-}
-export function formatEmailStatus(status) {
-    const lines = [
-        `email: ${status.configured ? 'configured' : 'not configured'}`,
-        `from: ${status.from ?? '(not set)'}`,
-    ];
-    if (status.requires_deploy)
-        lines.push('requires deploy: yes');
-    if (status.notes)
-        lines.push(`notes: ${status.notes}`);
-    return lines.join('\n');
-}
-export async function sendTestEmail(client, opts) {
-    return await client.post('/newly_backend/email/test', {
-        project_id: opts.projectId,
-        env: opts.env,
-        to: opts.to,
-        from: opts.from,
-        subject: opts.subject,
-        text: opts.text,
-        html: opts.html,
-    });
-}
+export const EMAIL_RETIRED_MESSAGE = '`newly email` was retired: it never had a server to talk to. ' +
+    'There is no CLI replacement; send mail from your API service with your own provider.';
 export function registerEmail(program) {
-    const email = program.command('email').description('Manage Newly Email');
-    email
-        .command('status')
-        .description('Show Newly Email configuration for this backend')
-        .option('--env <env>', 'dev or prod', 'dev')
-        .option('--project <id>', 'project id')
-        .action(async (opts) => {
-        try {
-            assertDevOnly(opts.env, 'email status');
-            const { client, projectId } = makeClient(opts.project);
-            console.log(formatEmailStatus(await getEmailStatus(client, projectId, opts.env)));
-        }
-        catch (e) {
-            console.error(friendlyApiError(e));
-            process.exitCode = 1;
-        }
-    });
-    email
-        .command('test')
-        .description('Send a test email through the deployed API service')
-        .requiredOption('--to <email>', 'recipient email address')
-        .option('--from <email>', 'sender email address; defaults to the backend sender setting')
-        .option('--subject <subject>', 'email subject', 'Newly email test')
-        .option('--text <text>', 'plain-text body', 'This is a test email from your Newly backend.')
-        .option('--html <html>', 'optional HTML body')
-        .option('--env <env>', 'dev or prod', 'dev')
-        .option('--project <id>', 'project id')
-        .action(async (opts) => {
-        try {
-            assertDevOnly(opts.env, 'email test');
-            const { client, projectId } = makeClient(opts.project);
-            const result = await sendTestEmail(client, {
-                projectId,
-                env: opts.env,
-                to: opts.to,
-                from: opts.from,
-                subject: opts.subject,
-                text: opts.text,
-                html: opts.html,
-            });
-            console.log(result.message_id
-                ? `Email sent. message_id=${result.message_id}`
-                : 'Email sent.');
-        }
-        catch (e) {
-            console.error(friendlyApiError(e));
-            process.exitCode = 1;
-        }
+    program
+        .command('email')
+        .description('Retired: send mail from your API service instead')
+        .allowUnknownOption()
+        .allowExcessArguments()
+        .action(() => {
+        console.error(EMAIL_RETIRED_MESSAGE);
+        process.exitCode = 1;
     });
 }

package/dist/commands/environment.js

@@ -1,12 +1,12 @@
 import { createInterface } from 'node:readline/promises';
 import { ApiClient, friendlyApiError } from '../api.js';
 import { runEnvironmentDatabaseShell } from '../shellSession.js';
-import { clearEnvironmentSelection, readEnvironmentSelection, controlPlaneUrl, requireCredentials, requireEnvironmentSelection, resolveProject, writeEnvironmentSelection, } from '../config.js';
+import { clearEnvironmentSelection, readEnvironmentSelection, requireCredentials, requireEnvironmentSelection, resolveProject, writeEnvironmentSelection, } from '../config.js';
 const POLL_INTERVAL_MS = 2_000;
 const POLL_TIMEOUT_MS = 10 * 60 * 1_000;
 function client() {
     const credentials = requireCredentials();
-    return new ApiClient(controlPlaneUrl(credentials), credentials.token);
+    return new ApiClient(credentials.apiUrl, credentials.token);
 }
 async function projectEnvironments(api, projectId) {
     const response = await api.get(`/projects/${encodeURIComponent(projectId)}/environments`);
@@ -248,7 +248,7 @@ export function registerEnvironment(program) {
             const projectId = resolveProject(process.cwd(), opts.project);
             const selected = requireEnvironmentSelection(process.cwd(), projectId);
             const credentials = requireCredentials();
-            const environment = await new ApiClient(controlPlaneUrl(credentials), credentials.token).get(`/environments/${encodeURIComponent(selected.id)}`);
+            const environment = await new ApiClient(credentials.apiUrl, credentials.token).get(`/environments/${encodeURIComponent(selected.id)}`);
             const resource = resolveNamedResource(environment.databases, value, 'database');
             if (resource.status !== 'ready')
                 throw new Error(`Database is not ready (${resource.status}).`);

package/dist/commands/login.js

@@ -49,9 +49,8 @@ export function openBrowser(url) {
     });
     child.unref();
 }
-export function commandApiUrls(apiUrl, authApiUrl) {
-    const same = normalizeApiUrl(apiUrl) === normalizeApiUrl(authApiUrl);
-    return { apiUrl, ...(same ? {} : { authApiUrl }) };
+export function commandApiUrl(isRunCloud, authApiUrl, offered) {
+    return isRunCloud && offered ? offered : authApiUrl;
 }
 export async function emailLogin(apiUrl, presetEmail, io) {
     const email = presetEmail?.trim()
@@ -135,7 +134,6 @@ export function whoamiReport(creds) {
     const rows = [
         ['Account', creds.account ?? 'not recorded (browser sign-in never sees an address)'],
         ['API', creds.apiUrl],
-        ...(creds.authApiUrl ? [['Issued by', creds.authApiUrl]] : []),
         ['Expires', expiresAtLabel(creds) ?? 'never'],
         ['Credential', credentialsDisplayPath()],
     ];
@@ -223,10 +221,8 @@ export function registerLogin(program) {
                 let method = methodFromFlags(opts);
                 const terminal = method === 'email' || !method ? acquirePromptIO() : null;
                 try {
-                    let providers = null;
                     if (!method && terminal) {
-                        providers = await fetchProviders(authApiUrl);
-                        const choices = loginChoices(providers);
+                        const choices = loginChoices(await fetchProviders(authApiUrl));
                         if (choices.length === 0) {
                             throw new Error(`${authApiUrl} has no sign-in methods enabled.`);
                         }
@@ -234,15 +230,14 @@ export function registerLogin(program) {
                     }
                     if (method === 'email') {
                         const preset = typeof opts.email === 'string' ? opts.email : undefined;
-                        providers ??= await fetchProviders(authApiUrl);
                         const { email, token } = await emailLogin(authApiUrl, preset, terminal?.io);
                         saveCredentials({
                             token,
+                            apiUrl: authApiUrl,
                             appUrl: opts.appUrl,
                             expiresAt: Number.MAX_SAFE_INTEGER,
                             revocable: true,
                             account: email,
-                            ...commandApiUrls(providers.cliApiUrl ?? authApiUrl, authApiUrl),
                         });
                         console.log(`\n  Signed in as ${email}`);
                         console.log(`  Credential saved to ${credentialsDisplayPath()}\n`);
@@ -274,11 +269,11 @@ export function registerLogin(program) {
             await verifyRunCloudCredential(authApiUrl, payload.token);
             saveCredentials({
                 token: payload.token,
+                apiUrl: commandApiUrl(isRunCloud, authApiUrl, payload.apiUrl),
                 appUrl: opts.appUrl,
                 expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
                 revocable: true,
                 ...(payload.account ? { account: payload.account } : {}),
-                ...commandApiUrls(payload.apiUrl, authApiUrl),
             });
             console.log(`Logged in${payload.account ? ` as ${payload.account}` : ''}. ` +
                 `Credentials saved to ${credentialsDisplayPath()}`);
@@ -313,7 +308,7 @@ export function registerLogin(program) {
         .action(async () => {
         const creds = loadCredentials();
         if (creds?.revocable) {
-            console.log(await revokeRunCloudCredential(creds.authApiUrl ?? creds.apiUrl, creds.token));
+            console.log(await revokeRunCloudCredential(creds.apiUrl, creds.token));
         }
         clearCredentials();
         console.log('Logged out.');

package/dist/commands/token.js

@@ -1,6 +1,6 @@
 import { acquirePromptIO, select, PromptAbortedError } from '../prompt.js';
 import { fetchProviders } from '../runCloudAuth.js';
-import { authApiUrlFor, commandApiUrls, emailLogin, loginChoices, methodFromFlags, openBrowser, verifyRunCloudCredential, } from './login.js';
+import { authApiUrlFor, commandApiUrl, emailLogin, loginChoices, methodFromFlags, openBrowser, verifyRunCloudCredential, } from './login.js';
 export function tokenReport(isRunCloud, minted) {
     const bin = isRunCloud ? 'runcloud' : 'newly';
     const tokenVar = isRunCloud ? 'RUN_CLOUD_API_TOKEN' : 'NEWLY_API_TOKEN';
@@ -49,10 +49,8 @@ export function registerToken(program) {
                 let method = methodFromFlags(opts);
                 const terminal = method === 'email' || !method ? acquirePromptIO() : null;
                 try {
-                    let providers = null;
                     if (!method && terminal) {
-                        providers = await fetchProviders(authApiUrl);
-                        const choices = loginChoices(providers);
+                        const choices = loginChoices(await fetchProviders(authApiUrl));
                         if (choices.length === 0) {
                             throw new Error(`${authApiUrl} has no sign-in methods enabled.`);
                         }
@@ -60,11 +58,9 @@ export function registerToken(program) {
                     }
                     if (method === 'email') {
                         const preset = typeof opts.email === 'string' ? opts.email : undefined;
-                        providers ??= await fetchProviders(authApiUrl);
                         const { email, token: minted } = await emailLogin(authApiUrl, preset, terminal?.io);
                         await verifyRunCloudCredential(authApiUrl, minted);
-                        const urls = commandApiUrls(providers.cliApiUrl ?? authApiUrl, authApiUrl);
-                        console.log(tokenReport(isRunCloud, { token: minted, apiUrl: urls.apiUrl, account: email }));
+                        console.log(tokenReport(isRunCloud, { token: minted, apiUrl: authApiUrl, account: email }));
                         return;
                     }
                 }
@@ -82,10 +78,9 @@ export function registerToken(program) {
                 openBrowser,
             });
             await verifyRunCloudCredential(authApiUrl, payload.token);
-            const urls = commandApiUrls(payload.apiUrl, authApiUrl);
             console.log(tokenReport(isRunCloud, {
                 token: payload.token,
-                apiUrl: urls.apiUrl,
+                apiUrl: commandApiUrl(isRunCloud, authApiUrl, payload.apiUrl),
                 ...(payload.account ? { account: payload.account } : {}),
             }));
         }

package/dist/commands/website.js

@@ -4,6 +4,7 @@ import { create as tarCreate } from 'tar';
 import { ApiClient, friendlyApiError } from '../api.js';
 import { createSnapshot } from '../archive.js';
 import { requireCredentials, resolveProject } from '../config.js';
+import { isBundleDeployMode } from './deploy.js';
 function makeClient(project) {
     const creds = requireCredentials();
     return {
@@ -12,6 +13,8 @@ function makeClient(project) {
     };
 }
 const BUILD_ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const PUBLISH_POLL_INTERVAL_MS = 3_000;
+const PUBLISH_POLL_TIMEOUT_MS = 10 * 60 * 1000;
 export function renderDeployment(d) {
     const at = d.published_at ?? d.created_at ?? '';
     const suffix = d.error_message ? ` (${d.error_message})` : '';
@@ -100,8 +103,39 @@ export async function createStaticSiteArchive(dir) {
     }
     return Buffer.concat(chunks);
 }
-export async function runWebsitePublish(client, projectId, opts = {}, log = console.log) {
-    let result;
+function assertBundleModeExport(dir) {
+    if (!existsSync(`${resolve(dir)}/index.html`)) {
+        throw new Error(`No static export at ${dir}. Build it first, then run \`newly website publish ${dir}\`.`);
+    }
+}
+async function finishPublish(client, projectId, result, log, pollOpts = {}) {
+    if (result.deployment.status !== 'building') {
+        log(`Published ${result.deployment.id}`);
+        log(`URL: ${result.default_url}`);
+        return;
+    }
+    const intervalMs = pollOpts.intervalMs ?? PUBLISH_POLL_INTERVAL_MS;
+    const timeoutMs = pollOpts.timeoutMs ?? PUBLISH_POLL_TIMEOUT_MS;
+    log(`Publishing ${result.deployment.id}...`);
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const { deployments = [] } = (await client.get(`/projects/${projectId}/website/deployments`));
+        const match = deployments.find((d) => d.id === result.deployment.id);
+        if (match?.status === 'active') {
+            log(`Published ${match.id}`);
+            log(`URL: ${result.default_url}`);
+            return;
+        }
+        if (match?.status === 'failed') {
+            throw new Error(match.error_message ?? `Publish ${result.deployment.id} failed.`);
+        }
+        if (Date.now() > deadline) {
+            throw new Error(`Publish ${result.deployment.id} timed out after ${timeoutMs / 1000}s`);
+        }
+        await new Promise((r) => setTimeout(r, intervalMs));
+    }
+}
+export async function runWebsitePublish(client, projectId, opts = {}, log = console.log, pollOpts = {}) {
     if (opts.remoteBuild) {
         const sourceDir = opts.localPath ?? '.';
         assertDirectory(sourceDir, 'Website source directory');
@@ -115,19 +149,33 @@ export async function runWebsitePublish(client, projectId, opts = {}, log = cons
             output_dir: opts.outputDir,
         }));
         form.set('source', new Blob([new Uint8Array(archive)], { type: 'application/gzip' }), 'source.tar.gz');
-        result = (await client.uploadForm(`/projects/${projectId}/website/build-upload`, form));
+        const result = (await client.uploadForm(`/projects/${projectId}/website/build-upload`, form));
+        log(`Published ${result.deployment.id}`);
+        log(`URL: ${result.default_url}`);
+        return;
     }
-    else if (opts.localPath) {
+    if (opts.localPath) {
         log('Packaging static site...');
         const archive = await createStaticSiteArchive(opts.localPath);
         log(`Uploading static site (${archiveKib(archive.length)} KiB)...`);
-        result = (await client.upload(`/projects/${projectId}/website/publish-upload`, archive, 'application/gzip'));
+        const result = (await client.upload(`/projects/${projectId}/website/publish-upload`, archive, 'application/gzip'));
+        await finishPublish(client, projectId, result, log, pollOpts);
+        return;
     }
-    else {
-        result = (await client.post(`/projects/${projectId}/website/publish`, {
-            source_path: opts.sourcePath ?? 'website/out',
-        }));
+    const stackInfo = (await client.get(`/newly_backend/stack/${projectId}`));
+    if (isBundleDeployMode(stackInfo)) {
+        const dir = opts.sourcePath ?? 'website/out';
+        assertBundleModeExport(dir);
+        log('Packaging static site...');
+        const archive = await createStaticSiteArchive(dir);
+        log(`Uploading static site (${archiveKib(archive.length)} KiB)...`);
+        const result = (await client.upload(`/projects/${projectId}/website/publish-upload`, archive, 'application/gzip'));
+        await finishPublish(client, projectId, result, log, pollOpts);
+        return;
     }
+    const result = (await client.post(`/projects/${projectId}/website/publish`, {
+        source_path: opts.sourcePath ?? 'website/out',
+    }));
     log(`Published ${result.deployment.id}`);
     log(`URL: ${result.default_url}`);
 }

package/dist/config.js

@@ -36,9 +36,6 @@ export function loginCommandName() {
 export function normalizeApiUrl(url) {
     return url.replace(/\/+$/, '');
 }
-export function controlPlaneUrl(creds) {
-    return normalizeApiUrl(creds.authApiUrl ?? creds.apiUrl);
-}
 export function saveCredentials(creds) {
     mkdirSync(credentialsHome(), { recursive: true, mode: 0o700 });
     const normalized = { ...creds, apiUrl: normalizeApiUrl(creds.apiUrl) };
@@ -67,10 +64,10 @@ export function loadCredentials() {
     if (!existsSync(credentialsPath()))
         return null;
     try {
-        const creds = JSON.parse(readFileSync(credentialsPath(), 'utf8'));
+        const { authApiUrl, ...creds } = JSON.parse(readFileSync(credentialsPath(), 'utf8'));
         if (!creds.token || creds.expiresAt < Date.now() / 1000)
             return null;
-        return { ...creds, apiUrl: normalizeApiUrl(creds.apiUrl) };
+        return { ...creds, apiUrl: normalizeApiUrl(authApiUrl ?? creds.apiUrl) };
     }
     catch {
         return null;

package/dist/deploy-bundle.js

@@ -0,0 +1,148 @@
+import { spawn } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Buffer } from 'node:buffer';
+import { create as tarCreate } from 'tar';
+export const NEWLY_BACKEND_DEPLOY_BUNDLE_CONTENT_TYPE = 'application/vnd.newly.deploy-bundle+gzip';
+export const NEWLY_BACKEND_DEPLOY_MODE_BUNDLE = 'bundle';
+const MANIFEST_PATH = 'newly-deploy.json';
+const MAX_BUNDLE_BYTES = 25 * 1024 * 1024;
+const REPLACE_TOKEN = /REPLACE_[A-Z_]+/g;
+const OUTPUT_CAP_BYTES = 64 * 1024;
+export class DeployBuildError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'DeployBuildError';
+    }
+}
+export async function buildDeployBundle(options) {
+    const { projectDir, services, run, log } = options;
+    const bunVersion = await run('bun', ['--version'], projectDir);
+    if (bunVersion.code !== 0) {
+        throw new DeployBuildError('newly deploy needs bun on your PATH (https://bun.sh)');
+    }
+    const bundleDir = mkdtempSync(join(tmpdir(), 'newly-deploy-bundle-'));
+    const servicesDir = join(bundleDir, 'services');
+    mkdirSync(servicesDir, { recursive: true });
+    try {
+        const manifestServices = [];
+        for (const service of services) {
+            manifestServices.push(await buildService(service, projectDir, servicesDir, run, log));
+        }
+        const gitSha = await resolveGitSha(run, projectDir);
+        const manifest = { version: 1, git_sha: gitSha, services: manifestServices };
+        writeFileSync(join(bundleDir, MANIFEST_PATH), JSON.stringify(manifest, null, 2));
+        const bundle = await tarBundle(bundleDir);
+        if (bundle.length > MAX_BUNDLE_BYTES) {
+            const mib = (bundle.length / (1024 * 1024)).toFixed(1);
+            throw new DeployBuildError(`Deploy bundle is too large (${mib} MiB, max 25 MiB).`);
+        }
+        return bundle;
+    }
+    finally {
+        rmSync(bundleDir, { recursive: true, force: true });
+    }
+}
+async function buildService(service, projectDir, servicesDir, run, log) {
+    const dir = join(projectDir, 'backend', service.path);
+    if (!existsSync(dir)) {
+        throw new DeployBuildError(`No backend code to deploy (backend/${service.path} missing)`);
+    }
+    const configPath = join(dir, 'wrangler.toml');
+    if (!existsSync(configPath)) {
+        throw new DeployBuildError(`No wrangler.toml in backend/${service.path}`);
+    }
+    log(`Building ${service.name} (bun install, wrangler bundle)…`);
+    const install = await run('bun', ['install', '--ignore-scripts'], dir);
+    if (install.code !== 0) {
+        throw new DeployBuildError(`bun install failed for ${service.name}:\n${install.output}`);
+    }
+    const originalConfig = readFileSync(configPath, 'utf8');
+    const script = await wranglerBundle(service, dir, originalConfig, run);
+    const serviceDir = join(servicesDir, service.name);
+    mkdirSync(serviceDir, { recursive: true });
+    writeFileSync(join(serviceDir, 'index.js'), script);
+    writeFileSync(join(serviceDir, 'wrangler.toml'), originalConfig);
+    const migrations = stageMigrations(dir, serviceDir, service.name);
+    return {
+        name: service.name,
+        schema: service.schema ?? null,
+        secrets: service.secrets ?? null,
+        script: `services/${service.name}/index.js`,
+        config: `services/${service.name}/wrangler.toml`,
+        migrations,
+    };
+}
+async function wranglerBundle(service, dir, originalConfig, run) {
+    const deployConfigName = 'wrangler.newly-deploy.toml';
+    const deployConfigPath = join(dir, deployConfigName);
+    const outDir = mkdtempSync(join(tmpdir(), 'newly-deploy-wrangler-'));
+    try {
+        writeFileSync(deployConfigPath, originalConfig.replace(REPLACE_TOKEN, 'newly-placeholder'));
+        const dryRun = await run('bunx', ['wrangler', 'deploy', '--dry-run', '--outdir', outDir, '--config', deployConfigName], dir);
+        if (dryRun.code !== 0) {
+            throw new DeployBuildError(`wrangler bundle failed for ${service.name}:\n${dryRun.output}`);
+        }
+        const jsFiles = readdirSync(outDir).filter((f) => f.endsWith('.js'));
+        if (jsFiles.length !== 1) {
+            throw new DeployBuildError(`wrangler produced ${jsFiles.length} script file(s) for ${service.name}, expected exactly one`);
+        }
+        return readFileSync(join(outDir, jsFiles[0]));
+    }
+    finally {
+        rmSync(deployConfigPath, { force: true });
+        rmSync(outDir, { recursive: true, force: true });
+    }
+}
+function stageMigrations(dir, serviceDir, name) {
+    const drizzleDir = join(dir, 'drizzle');
+    const journalPath = join(drizzleDir, 'meta', '_journal.json');
+    if (!existsSync(journalPath))
+        return null;
+    const outMetaDir = join(serviceDir, 'drizzle', 'meta');
+    mkdirSync(outMetaDir, { recursive: true });
+    writeFileSync(join(outMetaDir, '_journal.json'), readFileSync(journalPath));
+    for (const entry of readdirSync(drizzleDir)) {
+        if (entry.endsWith('.sql')) {
+            writeFileSync(join(serviceDir, 'drizzle', entry), readFileSync(join(drizzleDir, entry)));
+        }
+    }
+    return `services/${name}/drizzle`;
+}
+async function resolveGitSha(run, projectDir) {
+    const result = await run('git', ['rev-parse', 'HEAD'], projectDir);
+    if (result.code !== 0)
+        return null;
+    const sha = result.output.trim();
+    return sha || null;
+}
+async function tarBundle(bundleDir) {
+    const chunks = [];
+    const stream = tarCreate({ gzip: true, cwd: bundleDir, portable: true }, [MANIFEST_PATH, 'services']);
+    for await (const chunk of stream) {
+        chunks.push(Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks);
+}
+export function spawnRun(command, args, cwd) {
+    const shell = process.platform === 'win32';
+    const argv = shell ? args.map((arg) => (/[\s"]/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg)) : args;
+    return new Promise((resolve) => {
+        const child = spawn(command, argv, {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            shell,
+        });
+        let output = '';
+        const append = (chunk) => {
+            output += chunk.toString('utf8');
+            if (output.length > OUTPUT_CAP_BYTES)
+                output = output.slice(-OUTPUT_CAP_BYTES);
+        };
+        child.stdout?.on('data', append);
+        child.stderr?.on('data', append);
+        child.on('error', (error) => resolve({ code: 127, output: error.message }));
+        child.on('close', (code) => resolve({ code: code ?? 1, output }));
+    });
+}

package/dist/runCloudAuth.js

@@ -41,13 +41,11 @@ export async function fetchProviders(apiUrl) {
     if (!response.ok)
         throw new AuthError(await readError(response), response.status);
     const payload = (await response.json());
-    const cliApiUrl = typeof payload.cliApiUrl === 'string' ? payload.cliApiUrl.trim() : '';
     return {
         emailOtp: payload.emailOtp === true,
         google: payload.google === true,
         github: payload.github === true,
         apple: payload.apple === true,
-        ...(cliApiUrl ? { cliApiUrl } : {}),
     };
 }
 export async function sendEmailCode(apiUrl, email) {

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.131';
+export const CLI_VERSION = '0.1.137';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newly/cli",
-  "version": "0.1.131",
+  "version": "0.1.137",
   "description": "Develop, provision, and deploy Newly backends from your terminal",
   "license": "UNLICENSED",
   "type": "module",