@wervt/cli 0.2.15 → 0.2.17

package/dist/index.mjs

@@ -8,7 +8,7 @@ import { defineCommand, runMain } from "citty";
 import { detectPackageManager } from "nypm";
 import { x } from "tinyexec";
 import { packTar } from "modern-tar";
-//#region src/bundle.ts
+// src/bundle.ts
 /** Files under `dir`. Follows symlinks: Nitro can leave traced dependencies in
 * server/node_modules as links into the local pnpm store, which won't exist on the server. */
 async function walk(dir) {
@@ -51,8 +51,7 @@ async function createBundle(appDir) {
 		files: files.length
 	};
 }
-//#endregion
-//#region src/config.ts
+// src/config.ts
 const file = join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "wervt", "config.json");
 /** Flags > WERVT_URL / WERVT_TOKEN > ~/.config/wervt/config.json. */
 async function resolveConfig(flags) {
@@ -74,8 +73,7 @@ async function saveConfig(config) {
 	await writeFile(file, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
 	return file;
 }
-//#endregion
-//#region src/format.ts
+// src/format.ts
 function formatBytes(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
 	const units = [
@@ -123,12 +121,45 @@ function auditSummary(entry) {
 		].filter(Boolean).join("; ");
 		case "token.create":
 		case "token.revoke": return text(d.name) || text(d.id);
+		case "client.create":
+		case "client.link":
+		case "client.delete": return text(d.name) || text(d.clientId);
 		case "app.delete": return `database ${text(d.database)}`;
+		case "domains.add":
+		case "domains.remove":
+		case "domains.primary": return text(d.domain);
 		default: return entry.account ?? "";
 	}
 }
-//#endregion
-//#region src/source.ts
+/** A saved query's alert in a few words: `alert at 5 in 5m, firing (7)`. */
+function alertSummary(query) {
+	const { alert, state } = query;
+	if (!alert) return "no alert";
+	const rule = `alert at ${alert.threshold} in ${alert.window}`;
+	if (!alert.enabled) return `${rule}, off`;
+	if (state?.error) return `${rule}, failing: ${state.error.split("\n")[0]}`;
+	if (state?.firing) return `${rule}, firing (${state.lastCount ?? "?"})`;
+	return state?.lastFiredAt ? `${rule}, last fired ${state.lastFiredAt.slice(0, 16)}` : rule;
+}
+/** `GET /api/x 500  12ms  3 entries, 1 error` for a request. */
+function requestSummary(group) {
+	const what = group.method && group.path ? [
+		group.method,
+		group.path,
+		group.status
+	].filter(Boolean).join(" ") : group.message ?? "(no request event)";
+	const counts = [
+		`${group.entries} ${group.entries === 1 ? "entry" : "entries"}`,
+		group.errors && `${group.errors} ${group.errors === 1 ? "error" : "errors"}`,
+		group.warnings && `${group.warnings} ${group.warnings === 1 ? "warning" : "warnings"}`
+	].filter(Boolean);
+	return [
+		what,
+		group.duration,
+		counts.join(", ")
+	].filter(Boolean).join("  ");
+}
+// src/source.ts
 async function git(dir, ...args) {
 	try {
 		const result = await x("git", args, {
@@ -173,8 +204,7 @@ async function deploySource(dir) {
 		actor: await git(dir, "config", "user.name")
 	};
 }
-//#endregion
-//#region src/index.ts
+// src/index.ts
 const interactive = process.stdout.isTTY === true && !process.env.CI;
 function progress() {
 	if (interactive) return p.spinner();
@@ -278,7 +308,11 @@ const deploy = defineCommand({
 			if ((await x(pm, ["run", "build"], {
 				nodeOptions: {
 					cwd: dir,
-					stdio: "inherit"
+					stdio: "inherit",
+					env: {
+						...process.env,
+						WERVT_APP: name
+					}
 				},
 				throwOnError: false
 			})).exitCode !== 0) throw new Error("Build failed");
@@ -597,6 +631,63 @@ const access = defineCommand({
 		}
 	}
 });
+const domains = defineCommand({
+	meta: {
+		name: "domains",
+		description: "Show or change an app's own domains (e.g. example.com); <app>.<base domain> then forwards to the primary one"
+	},
+	args: {
+		app: {
+			type: "positional",
+			required: true,
+			description: "App name"
+		},
+		add: {
+			type: "string",
+			description: "Add a domain; it serves the app once its DNS points here"
+		},
+		remove: {
+			type: "string",
+			description: "Remove a domain"
+		},
+		primary: {
+			type: "string",
+			description: "Make a verified domain the app's main address"
+		},
+		verify: {
+			type: "string",
+			description: "Check a pending domain's DNS now"
+		},
+		...connection
+	},
+	async run({ args }) {
+		const changes = [
+			"add",
+			"remove",
+			"primary",
+			"verify"
+		].filter((key) => args[key]);
+		if (changes.length > 1) throw new Error("Pass one of --add, --remove, --primary or --verify");
+		const change = changes[0];
+		const result = await (change ? await api(`/v1/apps/${args.app}/domains`, args, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ [change]: args[change] })
+		}) : await api(`/v1/apps/${args.app}/domains`, args)).json();
+		if (!result.configured) console.log("This server doesn't support custom domains.");
+		if (!result.domains.length) return console.log(`${args.app} has no domains of its own.`);
+		for (const d of result.domains) {
+			const label = d.status === "active" ? styleText("green", d.primary ? "active, primary" : "active") : styleText("yellow", "pending");
+			console.log(`${d.domain}  ${label}${d.error ? `  ${styleText("dim", d.error)}` : ""}`);
+		}
+		const pending = result.domains.filter((d) => d.status === "pending");
+		if (!pending.length || !result.target) return;
+		console.log(`\nPoint each pending domain at ${result.target}: a CNAME (subdomains), or an A record with its addresses (a bare domain).`);
+		console.log("Behind a proxy of your own (Cloudflare), add a TXT record instead, the proxy has to send the traffic on:");
+		for (const d of pending) console.log(`  ${d.txt.name}  TXT  ${d.txt.value}`);
+		console.log("Pending domains are checked every few minutes, or now with --verify <domain>.");
+	}
+});
 const members = defineCommand({
 	meta: {
 		name: "members",
@@ -729,9 +820,36 @@ const accounts = defineCommand({
 			type: "string",
 			description: "Space all releases of their apps may take, e.g. 2GB. \"none\", \"default\""
 		},
+		into: {
+			type: "string",
+			description: "Merge the account into this one (same person, two sign-ups): its logins, apps and access move over, apps move their data, then it is deleted"
+		},
 		...connection
 	},
 	async run({ args }) {
+		if (args.email && args.into) {
+			const result = await (await api("/v1/accounts/merge", args, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					from: args.email,
+					into: args.into
+				})
+			})).json();
+			console.log(`${result.from.email} merged into ${result.into.email}`);
+			console.log(`  logins moved: ${result.logins.join(", ") || "none"}`);
+			if (result.owners.length) console.log(`  owner or member of: ${result.owners.join(", ")}`);
+			if (result.access.length) console.log(`  allowed in: ${result.access.join(", ")}`);
+			const payload = JSON.stringify({
+				from: result.from,
+				into: result.into
+			});
+			for (const [app, run] of Object.entries(result.apps)) {
+				console.log(`  ${app}: ${run.status}${run.error ? ` (${run.error})` : ""}`);
+				if (run.status !== "ok") console.log(styleText("dim", `    retry: wervt tasks ${app} --run wervt:account-merged --payload '${payload}'`));
+			}
+			return;
+		}
 		if (args.email) {
 			const change = {};
 			if (args.apps) change.apps = args.apps === "none" ? null : args.apps === "default" ? "default" : Number(args.apps);
@@ -805,6 +923,120 @@ const tokens = defineCommand({
 		}
 	}
 });
+const appArg = {
+	type: "positional",
+	required: true,
+	description: "App name"
+};
+const clients = defineCommand({
+	meta: {
+		name: "clients",
+		description: "Manage the OAuth clients of an app's native apps (sign-in with wervt)"
+	},
+	subCommands: {
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List the app's native app clients"
+			},
+			args: {
+				app: appArg,
+				...connection
+			},
+			async run({ args }) {
+				const list = await (await api(`/v1/apps/${args.app}/clients`, args)).json();
+				if (!list.length) return console.log(`No native app clients for ${args.app}.`);
+				for (const client of list) {
+					const used = client.lastUsedAt ? `used ${client.lastUsedAt.slice(0, 10)}` : "never used";
+					console.log(`${client.clientId}  ${client.name}  created ${client.createdAt.slice(0, 10)}  ${used}`);
+					for (const uri of client.redirectUris) console.log(styleText("dim", `  ${uri}`));
+				}
+			}
+		}),
+		create: defineCommand({
+			meta: {
+				name: "create",
+				description: "Register a native app for sign-in, e.g. --redirect dev.example.app:/auth"
+			},
+			args: {
+				app: appArg,
+				name: {
+					type: "string",
+					required: true,
+					description: "Shown on the consent page"
+				},
+				redirect: {
+					type: "string",
+					required: true,
+					description: "Redirect URI; comma-separated for several"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const client = await (await api(`/v1/apps/${args.app}/clients`, args, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({
+						name: args.name,
+						redirectUris: toList(args.redirect)
+					})
+				})).json();
+				console.error(`Client "${client.name}" for ${args.app}:`);
+				console.log(client.clientId);
+				console.error(styleText("dim", "A public client (PKCE, no secret): put the id in the app config."));
+			}
+		}),
+		delete: defineCommand({
+			meta: {
+				name: "delete",
+				description: "Delete a client; everyone signed in through it is signed out"
+			},
+			args: {
+				app: appArg,
+				clientId: {
+					type: "positional",
+					required: true,
+					description: "Client id"
+				},
+				yes: {
+					type: "boolean",
+					description: "Skip the confirmation"
+				},
+				...connection
+			},
+			async run({ args }) {
+				if (!args.yes) {
+					const ok = await p.confirm({
+						message: `Delete ${args.clientId}? Every install signed in through it is signed out.`,
+						initialValue: false
+					});
+					if (p.isCancel(ok) || !ok) return p.cancel("Cancelled");
+				}
+				await api(`/v1/apps/${args.app}/clients/${args.clientId}`, args, { method: "DELETE" });
+				console.log(`Deleted ${args.clientId}`);
+			}
+		}),
+		link: defineCommand({
+			meta: {
+				name: "link",
+				description: "Admins: assign a client that registered itself to the app"
+			},
+			args: {
+				app: appArg,
+				clientId: {
+					type: "positional",
+					required: true,
+					description: "Client id"
+				},
+				...connection
+			},
+			async run({ args }) {
+				await api(`/v1/apps/${args.app}/clients/${args.clientId}/link`, args, { method: "POST" });
+				console.log(`${args.clientId} belongs to ${args.app} now`);
+			}
+		})
+	}
+});
 const token = defineCommand({
 	meta: {
 		name: "token",
@@ -1001,7 +1233,7 @@ const remove = defineCommand({
 		const dropDb = Boolean(args["drop-database"]);
 		if (!args.yes) {
 			const ok = await p.confirm({
-				message: `Delete ${args.app}${dropDb ? " and ALL its data" : " (database is kept)"}?`,
+				message: `Delete ${args.app}${dropDb ? " and ALL its data" : " (data is kept, the name stays yours)"}?`,
 				initialValue: false
 			});
 			if (p.isCancel(ok) || !ok) return p.cancel("Cancelled");
@@ -1059,6 +1291,14 @@ const logs = defineCommand({
 			alias: "f",
 			description: "Keep printing new entries"
 		},
+		requests: {
+			type: "boolean",
+			description: "One line per request (requestId): what it was and how much it logged"
+		},
+		saved: {
+			type: "string",
+			description: "Use a saved query by name (see `wervt queries`)"
+		},
 		json: {
 			type: "boolean",
 			description: "One JSON object per line, with every field"
@@ -1067,7 +1307,31 @@ const logs = defineCommand({
 	},
 	async run({ args }) {
 		const params = new URLSearchParams();
-		if (args.query) params.set("query", args.query);
+		if (args.saved) {
+			if (args.query) throw new Error("Give either a query or --saved, not both");
+			const saved = await findSavedQuery(args.app, args.saved, args);
+			params.set("query", saved.query);
+			if (saved.levels?.length) params.set("levels", saved.levels.join(","));
+		} else if (args.query) params.set("query", args.query);
+		if (args.requests) {
+			if (args.follow) throw new Error("--requests and --follow do not go together");
+			params.set("start", args.since);
+			if (args.until) params.set("end", args.until);
+			params.set("limit", args.limit);
+			const groups = await (await api(`/v1/apps/${args.app}/logs/requests?${params.toString()}`, args)).json();
+			if (!groups.length && !args.json) return console.error(`No requests with a requestId in the last ${args.since}.`);
+			for (const group of groups.reverse()) {
+				if (args.json) {
+					console.log(JSON.stringify(group));
+					continue;
+				}
+				const time = new Date(group.last).toISOString().slice(11, 23);
+				const color = group.errors ? "red" : group.warnings ? "yellow" : "white";
+				console.log(`${styleText("dim", time)} ${styleText(color, requestSummary(group))}  ${styleText("dim", group.requestId)}`);
+			}
+			if (!args.json) console.error(styleText("dim", `\nOne request: wervt logs ${args.app} 'requestId:=<id>' --since ${args.since}`));
+			return;
+		}
 		if (args.follow) {
 			params.set("since", args.since);
 			const res = await api(`/v1/apps/${args.app}/logs/tail?${params.toString()}`, args);
@@ -1087,6 +1351,111 @@ const logs = defineCommand({
 		for (const entry of entries.reverse()) printLog(entry, Boolean(args.json));
 	}
 });
+/** `/v1/apps/<app>/logs/queries`, or across apps (admins) without an app. */
+const queriesPath = (app) => app ? `/v1/apps/${app}/logs/queries` : "/v1/logs/queries";
+async function findSavedQuery(app, name, flags) {
+	const list = await (await api(queriesPath(app), flags)).json();
+	const found = list.find((query) => query.id === name || query.name.toLowerCase() === name.toLowerCase());
+	if (!found) throw new Error(`No saved query "${name}"${list.length ? `. Saved: ${list.map((q) => q.name).join(", ")}` : ""}`);
+	return found;
+}
+const queries = defineCommand({
+	meta: {
+		name: "queries",
+		description: "List, save or delete saved log queries and the alerts on them"
+	},
+	args: {
+		app: {
+			type: "positional",
+			required: false,
+			description: "App name (default: queries across all apps, admins only)"
+		},
+		save: {
+			type: "string",
+			description: "Save a query under this name, or change the one that has it"
+		},
+		query: {
+			type: "string",
+			description: "LogsQL for --save, e.g. 'level:error'"
+		},
+		levels: {
+			type: "string",
+			description: "Only these levels for --save, e.g. error,warn"
+		},
+		alert: {
+			type: "string",
+			description: "on or off: mail the app owner and members when the query matches"
+		},
+		threshold: {
+			type: "string",
+			description: "Alert when at least this many entries match"
+		},
+		window: {
+			type: "string",
+			description: "Alert window, e.g. 5m (1m to 24h)"
+		},
+		cooldown: {
+			type: "string",
+			description: "Quiet time after an alert, e.g. 1h (5m to 7d)"
+		},
+		delete: {
+			type: "string",
+			description: "Delete the saved query with this name"
+		},
+		json: {
+			type: "boolean",
+			description: "Print JSON"
+		},
+		...connection
+	},
+	async run({ args }) {
+		const path = queriesPath(args.app);
+		const json = { "content-type": "application/json" };
+		if (args.delete) {
+			const found = await findSavedQuery(args.app, args.delete, args);
+			await api(`${path}/${found.id}`, args, { method: "DELETE" });
+			return console.log(`Deleted ${found.name}`);
+		}
+		if (args.save) {
+			if (args.alert !== void 0 && !["on", "off"].includes(args.alert)) throw new Error("--alert is on or off");
+			const alertFields = {
+				...args.threshold ? { threshold: Number(args.threshold) } : {},
+				...args.window ? { window: args.window } : {},
+				...args.cooldown ? { cooldown: args.cooldown } : {}
+			};
+			const alert = args.alert === "off" ? null : args.alert === "on" || Object.keys(alertFields).length ? {
+				enabled: true,
+				...alertFields
+			} : void 0;
+			const body = {
+				name: args.save,
+				...args.query !== void 0 ? { query: args.query } : {},
+				...args.levels !== void 0 ? { levels: args.levels } : {},
+				...alert !== void 0 ? { alert } : {}
+			};
+			const existing = (await (await api(path, args)).json()).find((q) => q.name.toLowerCase() === args.save.toLowerCase());
+			const saved = await (await api(existing ? `${path}/${existing.id}` : path, args, {
+				method: existing ? "PATCH" : "POST",
+				headers: json,
+				body: JSON.stringify(body)
+			})).json();
+			if (args.json) return console.log(JSON.stringify(saved));
+			return console.log(`${existing ? "Changed" : "Saved"} ${saved.name}: ${saved.query}  ${styleText("dim", alertSummary(saved))}`);
+		}
+		const list = await (await api(path, args)).json();
+		if (args.json) return console.log(JSON.stringify(list));
+		if (!list.length) {
+			const target = args.app ? ` ${args.app}` : "";
+			return console.log(`No saved queries. Save one: wervt queries${target} --save Errors --query 'level:error' --alert on`);
+		}
+		for (const query of list) {
+			const levels = query.levels?.length ? styleText("dim", ` [${query.levels.join(",")}]`) : "";
+			const color = query.state?.error ? "red" : query.alert?.enabled && query.state?.firing ? "yellow" : "dim";
+			console.log(`${styleText("bold", query.name)}  ${query.query}${levels}  ${styleText(color, alertSummary(query))}`);
+		}
+		if (args.app) console.log(styleText("dim", `\nRun one: wervt logs ${args.app} --saved '${list[0].name}'`));
+	}
+});
 const SPARKS = "▁▂▃▄▅▆▇█";
 const stats = defineCommand({
 	meta: {
@@ -1311,15 +1680,18 @@ runMain(defineCommand({
 		releases,
 		audit,
 		logs,
+		queries,
 		activate,
 		rollback,
 		reprovision,
 		access,
+		domains,
 		members,
 		accounts,
 		env,
 		tokens,
 		token,
+		clients,
 		identity,
 		tasks,
 		stats,
@@ -1329,5 +1701,4 @@ runMain(defineCommand({
 		skill
 	}
 }));
-//#endregion
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/cli",
-  "version": "0.2.15",
+  "version": "0.2.17",
   "description": "Deploy and manage apps on wervt.",
   "keywords": [
     "agents",
@@ -31,7 +31,7 @@
     "@clack/prompts": "^1.8.1",
     "citty": "^0.2.2",
     "modern-tar": "^0.8.6",
-    "nypm": "^0.6.10",
+    "nypm": "^0.6.12",
     "tinyexec": "^1.3.1"
   },
   "scripts": {

package/skill/SKILL.md

@@ -42,6 +42,8 @@ existing app, work in its repository instead.
 
 ## 3. Build
 
+<!-- build.wervt.app: from here to the end marker, also the MCP server's instructions -->
+
 - Keep the app small and complete: data in Postgres through `useDb()`, writes through API routes,
   lists through `useShape` so every open tab stays live. Ask only when the request is genuinely
   ambiguous; otherwise choose sensible defaults and say what you chose.
@@ -54,10 +56,13 @@ existing app, work in its repository instead.
   MCP clients at `https://<app>.wervt.app/mcp`, signed in through wervt. Details in the app's
   `AGENTS.md`.
 - After changing `server/db/schema.ts`: `pnpm db:generate`, and commit the migration.
+- Finish with `pnpm exec vp check --fix` passing.
+
+<!-- end -->
+
 - `pnpm dev` runs against a local wervt stack, which the user may not have. When it isn't running,
   don't set one up: `pnpm build` plus `pnpm exec vp check --fix` are the checks, and the
   deployed app is the test.
-- Finish with `pnpm exec vp check --fix` passing.
 
 ## 4. Ship
 
@@ -69,8 +74,12 @@ pnpm exec wervt access <name> --invite            # private, and people with acc
 pnpm exec wervt access <name> --invite-by owners  # only owner, members and admins may invite
 pnpm exec wervt members <name> --add a@x.com      # who may deploy and manage it (the first deploy owns it)
 pnpm exec wervt env <name> --set NUXT_API_KEY=…   # runtimeConfig.apiKey, applied from the next request
+pnpm exec wervt domains <name> --add example.com  # its own domain; prints the DNS records to set
+pnpm exec wervt deploy --name <other>             # the same code as another app (own data, env, domains)
 ```
 
+<!-- build.wervt.app -->
+
 - Ask before making an app public if it shows personal or private data. "Ship it" alone doesn't
   decide that. Private, with the user's email allowed, is the safe default.
 - App configuration and secrets go through Nuxt's `runtimeConfig`, never `process.env` in app
@@ -78,6 +87,9 @@ pnpm exec wervt env <name> --set NUXT_API_KEY=…   # runtimeConfig.apiKey, appl
   it with `useRuntimeConfig()` and set it as `NUXT_` + the key in SCREAMING_SNAKE_CASE
   (`apiKey` → `NUXT_API_KEY`, `public.mapStyle` → `NUXT_PUBLIC_MAP_STYLE`). Keys missing from
   `runtimeConfig` are ignored.
+
+<!-- end -->
+
 - Secrets for `wervt env` (API keys) come from the user. Ask them to run the command themselves
   (`! pnpm exec wervt env <name> --set NUXT_API_KEY=…`) instead of pasting the value to you.
 - `wervt deploy` requests `/` once the release started and fails (exit 1, with the first logged
@@ -122,6 +134,8 @@ pnpm exec wervt apps                           # every app, active release, URL
 pnpm exec wervt releases <name>                # newest first, with commit, author, failed deploys
 pnpm exec wervt audit <name>                   # who deployed, rolled back, changed env or access
 pnpm exec wervt logs <name> 'status:>=500' --since 1d --json
+pnpm exec wervt logs <name> --requests --since 1h  # one line per request
+pnpm exec wervt queries <name>                 # saved queries and their alerts
 pnpm exec wervt tasks <name>                   # tasks, schedules, next runs
 pnpm exec wervt tasks <name> --run <task>      # run one now
 pnpm exec wervt rollback <name>                # the previous release (migrations stay)