@wervt/cli 0.2.19 → 0.2.21

package/README.md

@@ -21,4 +21,4 @@ in package.json (any `export default { fetch }` module works too, without `--sta
 
 Without [Vite+](https://viteplus.dev), use `npx @wervt/cli` and `pnpm exec wervt`. `wervt --help`
 lists every command: `apps`, `releases`, `audit`, `rollback`, `activate`, `env`, `tokens`, `token`, `members`,
-`tasks`, `stats`, `delete`, `whoami`, … Docs: [wervt.app](https://wervt.app/getting-started/quickstart).
+`maintenance`, `updates`, `tasks`, `stats`, `delete`, `whoami`, … Docs: [wervt.app](https://wervt.app/getting-started/quickstart).

package/dist/index.mjs

@@ -1,14 +1,37 @@
 import { builtinModules } from "node:module";
 import { existsSync } from "node:fs";
-import { appendFile, cp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
-import { homedir, hostname } from "node:os";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { appendFile, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { homedir, hostname, tmpdir } from "node:os";
+import { delimiter, dirname, join, relative, resolve, sep } from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
 import { defineCommand, runMain } from "citty";
 import { detectPackageManager } from "nypm";
 import { x } from "tinyexec";
 import { packTar } from "modern-tar";
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+// src/admin-flag.ts
+const OTHER_CHANGES = [
+	"into",
+	"apps",
+	"database",
+	"storage",
+	"releases"
+];
+/**
+* What `wervt accounts` should do to the admin role, if anything. Refuses combinations instead of
+* dropping a flag: someone who typed `--apps 5` next to `--admin` would otherwise think it applied.
+*/
+function adminFlag(args) {
+	const revoke = args["revoke-admin"];
+	if (!args.admin && !revoke) return void 0;
+	if (args.admin && revoke) throw new Error("Pass --admin or --revoke-admin, not both");
+	if (!args.email) throw new Error("Name the account: wervt accounts <email> --admin");
+	const other = OTHER_CHANGES.find((flag) => args[flag]);
+	if (other) throw new Error(`Change admin on its own, without --${other}`);
+	return !!args.admin;
+}
 // ../core/src/manifest.ts
 /** The bundle's `wervt-bundle.json`, next to `server/` and `public/`. */
 const BUNDLE_MANIFEST = "wervt-bundle.json";
@@ -235,6 +258,80 @@ async function saveConfig(config) {
 	await writeFile(file, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
 	return file;
 }
+// src/dev.ts
+/** What comes after `--`, untouched, so the command keeps its own flags. */
+const passthrough = (rawArgs) => {
+	const at = rawArgs.indexOf("--");
+	return at === -1 ? [] : rawArgs.slice(at + 1);
+};
+/** Runs the app's command against its local database until the command exits. */
+async function dev$1(options) {
+	const { resetDevDatabase, resolveAppName, setupDev } = await import("@wervt/platform/dev");
+	const rootDir = resolve(options.dir);
+	const app = await resolveAppName(rootDir, options.name);
+	const [command, ...commandArgs] = options.command;
+	const envFile = join(rootDir, ".env");
+	if (existsSync(envFile)) process.loadEnvFile(envFile);
+	if (options.reset) p.log.success(`Dropped \`${await resetDevDatabase(app)}\``);
+	if (!command) return;
+	const { database } = await readBuildConfig(rootDir);
+	let child;
+	let closers = [];
+	const stopChild = async () => {
+		const running = child;
+		child = void 0;
+		if (!running || running.exitCode !== null) return;
+		const exited = new Promise((done) => running.once("exit", done));
+		running.kill("SIGTERM");
+		await exited;
+	};
+	const stopSetup = () => {
+		for (const close of closers) close();
+		closers = [];
+	};
+	const start = async () => {
+		await setupDev({
+			rootDir,
+			onClose: (fn) => closers.push(fn),
+			restart: () => {
+				stopSetup();
+				stopChild().then(start);
+			},
+			logger: {
+				info: (message) => p.log.info(message),
+				success: (message) => p.log.success(message),
+				warn: (message, ...args) => p.log.warn([message, ...args].join(" "))
+			}
+		}, app, {
+			seed: false,
+			database
+		}, { storage: options.storage });
+		const started = spawn(command, commandArgs, {
+			cwd: rootDir,
+			stdio: "inherit",
+			env: {
+				...process.env,
+				PATH: [join(rootDir, "node_modules/.bin"), process.env.PATH].join(delimiter)
+			}
+		});
+		child = started;
+		const finish = (code) => {
+			if (child !== started) return;
+			stopSetup();
+			process.exit(code);
+		};
+		started.once("error", (e) => {
+			p.log.error(`Could not run ${command}: ${e.message}`);
+			finish(1);
+		});
+		started.once("exit", (code, signal) => finish(code ?? (signal ? 0 : 1)));
+	};
+	for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => {
+		stopSetup();
+		stopChild().then(() => process.exit(0));
+	});
+	await start();
+}
 // src/format.ts
 function formatBytes(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
@@ -251,6 +348,16 @@ function formatBytes(bytes) {
 	}
 	return `${value < 10 ? value.toFixed(1) : Math.round(value)} ${units[unit]}`;
 }
+/** Minutes in a duration like `30m`, `2h` or `1d`; a bare number means minutes. */
+function parseMinutes(value) {
+	const match = /^(\d+)(m|h|d)?$/.exec(value.trim());
+	if (!match) throw new Error(`Can't read the duration "${value}", try 30m, 2h or 1d`);
+	return Number(match[1]) * {
+		m: 1,
+		h: 60,
+		d: 1440
+	}[match[2] ?? "m"];
+}
 const list = (value) => Array.isArray(value) ? value.map(String).join(", ") : "";
 const text = (value) => typeof value === "string" ? value : "";
 /** What an audit entry changed, in a few words: `env.update` → `set API_URL, TOKEN`. */
@@ -276,11 +383,26 @@ function auditSummary(entry) {
 			list(d.add) && `add ${list(d.add)}`,
 			list(d.remove) && `remove ${list(d.remove)}`
 		].filter(Boolean).join("; ");
+		case "updates.publish":
+		case "updates.rollback": return [
+			text(d.channel),
+			text(d.platform),
+			text(d.message),
+			d.embedded ? "to the embedded update" : "",
+			text(d.republishOf) && `again from ${text(d.republishOf)}`
+		].filter(Boolean).join("; ");
+		case "maintenance.update": return [
+			text(d.state),
+			text(d.from) && `from ${text(d.from)}`,
+			text(d.until) && `until ${text(d.until)}`,
+			list(d.page) && `page ${list(d.page)}`
+		].filter(Boolean).join("; ");
 		case "owners.update": return [
 			text(d.owner) && `owner ${text(d.owner)}`,
 			list(d.added) && `added ${list(d.added)}`,
 			list(d.removed) && `removed ${list(d.removed)}`
 		].filter(Boolean).join("; ");
+		case "db.query": return `${d.write === true ? "write" : "read"}  ${text(d.command)} ${Number(d.count)}`;
 		case "token.create":
 		case "token.revoke": return text(d.name) || text(d.id);
 		case "client.create":
@@ -321,6 +443,17 @@ function requestSummary(group) {
 		counts.join(", ")
 	].filter(Boolean).join("  ");
 }
+/** A `wervt db sql` result as an aligned table; a null is shown as `NULL`, newlines as spaces. */
+function sqlTable(columns, rows) {
+	const shown = rows.map((row) => row.map((cell) => cell === null ? "NULL" : cell.replace(/\s*\n\s*/g, " ")));
+	const widths = columns.map((column, i) => Math.max(column.length, ...shown.map((row) => row[i].length)));
+	const line = (cells) => cells.map((cell, i) => cell.padEnd(widths[i])).join("  ").trimEnd();
+	return [
+		line(columns),
+		line(widths.map((w) => "-".repeat(w))),
+		...shown.map(line)
+	].join("\n");
+}
 // src/source.ts
 async function git(dir, ...args) {
 	try {
@@ -366,6 +499,81 @@ async function deploySource(dir) {
 		actor: await git(dir, "config", "user.name")
 	};
 }
+// src/updates.ts
+const UPDATE_PLATFORMS = ["ios", "android"];
+const CONTENT_TYPES = {
+	aac: "audio/aac",
+	bmp: "image/bmp",
+	css: "text/css",
+	gif: "image/gif",
+	heic: "image/heic",
+	html: "text/html",
+	jpeg: "image/jpeg",
+	jpg: "image/jpeg",
+	json: "application/json",
+	m4a: "audio/mp4",
+	m4v: "video/mp4",
+	mov: "video/quicktime",
+	mp3: "audio/mpeg",
+	mp4: "video/mp4",
+	oga: "audio/ogg",
+	ogg: "audio/ogg",
+	otf: "font/otf",
+	pdf: "application/pdf",
+	png: "image/png",
+	svg: "image/svg+xml",
+	ttf: "font/ttf",
+	txt: "text/plain",
+	wav: "audio/wav",
+	webm: "video/webm",
+	webp: "image/webp",
+	woff: "font/woff",
+	woff2: "font/woff2",
+	xml: "application/xml"
+};
+async function describe(out, path, type, extension) {
+	const bytes = await readFile(join(out, path));
+	const file = {
+		hash: createHash("sha256").update(bytes).digest("base64url"),
+		key: createHash("md5").update(bytes).digest("hex"),
+		contentType: type,
+		size: bytes.length,
+		path: join(out, path)
+	};
+	return extension ? {
+		...file,
+		fileExtension: extension
+	} : file;
+}
+/** The bundle and assets `expo export` wrote to `out` for one platform. */
+async function readExport(out, platform) {
+	const exported = JSON.parse(await readFile(join(out, "metadata.json"), "utf8")).fileMetadata[platform];
+	if (!exported) throw new Error(`The export has nothing for ${platform}`);
+	return {
+		launchAsset: await describe(out, exported.bundle, "application/javascript"),
+		assets: await Promise.all(exported.assets.map(({ path, ext }) => describe(out, path, CONTENT_TYPES[ext.toLowerCase()] ?? "application/octet-stream", ext ? `.${ext}` : void 0)))
+	};
+}
+/** Each file once, also when both platforms ship it. */
+function uniqueFiles(files) {
+	return [...new Map(files.map((file) => [file.hash, file])).values()];
+}
+/** The file as the control plane records it, without where it lies on this machine. */
+function withoutPath(file) {
+	return {
+		...file,
+		path: void 0
+	};
+}
+/** The name `updates.codeSigningCertificate` points at unless told otherwise. */
+const DEFAULT_CERTIFICATE = "certs/wervt-updates.pem";
+/** The first `limit` at a time, in order; rejects with the first failure. */
+async function forEachLimit(items, limit, run) {
+	let next = 0;
+	await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+		while (next < items.length) await run(items[next++]);
+	}));
+}
 // src/index.ts
 const interactive = process.stdout.isTTY === true && !process.env.CI;
 function progress() {
@@ -503,6 +711,7 @@ const deploy = defineCommand({
 		const query = new URLSearchParams();
 		if (args.check !== void 0) query.set("check", args.check);
 		if (args["rollback-on-fail"]) query.set("rollbackOnFail", "1");
+		if (args.maintenance) query.set("maintenance", "1");
 		const res = await api(`/v1/apps/${name}/deploys${query.size ? `?${query}` : ""}`, args, {
 			method: "POST",
 			headers: {
@@ -513,6 +722,7 @@ const deploy = defineCommand({
 		});
 		const labels = {
 			extract: "Extracting",
+			maintenance: "Turning on maintenance mode",
 			migrate: "Migrating database",
 			storage: "Setting up storage",
 			activate: "Activating",
@@ -745,6 +955,63 @@ const reprovision = defineCommand({
 		if (results.some((r) => r.error)) process.exitCode = 1;
 	}
 });
+const db = defineCommand({
+	meta: {
+		name: "db",
+		description: "Work with an app's database"
+	},
+	subCommands: { sql: defineCommand({
+		meta: {
+			name: "sql",
+			description: "Run one SQL statement as the app's role: read-only unless you pass --write"
+		},
+		args: {
+			app: {
+				type: "positional",
+				required: true,
+				description: "App name"
+			},
+			statement: {
+				type: "positional",
+				required: false,
+				description: "SQL statement"
+			},
+			file: {
+				type: "string",
+				description: "Read the statement from this file"
+			},
+			write: {
+				type: "boolean",
+				description: "Allow changes and commit them"
+			},
+			preview: {
+				type: "string",
+				description: "Run against this preview, like pr-12"
+			},
+			json: {
+				type: "boolean",
+				description: "Print the result as JSON"
+			},
+			...connection
+		},
+		async run({ args }) {
+			if (!args.statement === !args.file) throw new Error("Pass a statement or --file");
+			const sql = args.file ? await readFile(args.file, "utf8") : args.statement;
+			const result = await (await api(`/v1/apps/${previewName(args.app, args.preview)}/db/query`, args, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					sql,
+					write: args.write === true
+				})
+			})).json();
+			if (args.json) return console.log(JSON.stringify(result));
+			if (result.columns.length) console.log(sqlTable(result.columns, result.rows));
+			const limited = result.truncated ? ` (first ${result.rows.length})` : "";
+			console.error(styleText("dim", `${result.command} ${result.count}${limited} in ${result.ms}ms`));
+		}
+	}) }
+});
 const toList = (value) => (Array.isArray(value) ? value : value === void 0 ? [] : [value]).flatMap((v) => String(v).split(","));
 const access = defineCommand({
 	meta: {
@@ -808,6 +1075,87 @@ const access = defineCommand({
 		}
 	}
 });
+const maintenance = defineCommand({
+	meta: {
+		name: "maintenance",
+		description: "Show, plan or end maintenance: visitors get a 503 page, the owner, members and admins still get in"
+	},
+	args: {
+		app: {
+			type: "positional",
+			required: true,
+			description: "App name"
+		},
+		state: {
+			type: "positional",
+			required: false,
+			description: "on or off"
+		},
+		for: {
+			type: "string",
+			description: "End by itself after this long, like 30m, 2h or 1d"
+		},
+		from: {
+			type: "string",
+			description: "Start at this time instead of now, like 2026-12-01T22:00"
+		},
+		until: {
+			type: "string",
+			description: "End by itself at this time"
+		},
+		title: {
+			type: "string",
+			description: "The page's title (empty for the default)"
+		},
+		message: {
+			type: "string",
+			description: "The page's text (empty for the default)"
+		},
+		color: {
+			type: "string",
+			description: "The page's color, like #2f5bff (empty for the brand's)"
+		},
+		link: {
+			type: "string",
+			description: "A contact or status link on the page (empty for none)"
+		},
+		"link-label": {
+			type: "string",
+			description: "The text of that link"
+		},
+		...connection
+	},
+	async run({ args }) {
+		if (args.state !== void 0 && args.state !== "on" && args.state !== "off") throw new Error(`Expected on or off, not "${args.state}"`);
+		const change = {};
+		if (args.state) change.enabled = args.state === "on";
+		if (args.state !== "on" && (args.for ?? args.from ?? args.until) !== void 0) throw new Error("--for, --from and --until plan maintenance: add `on`");
+		if (args.for !== void 0) change.minutes = parseMinutes(args.for);
+		if (args.from !== void 0) change.from = localTime(args.from);
+		if (args.until !== void 0) change.until = localTime(args.until);
+		if (args.title !== void 0) change.title = args.title;
+		if (args.message !== void 0) change.message = args.message;
+		if (args.color !== void 0) change.color = args.color;
+		if (args.link !== void 0) change.linkUrl = args.link;
+		if (args["link-label"] !== void 0) change.linkLabel = args["link-label"];
+		const result = await (Object.keys(change).length ? await api(`/v1/apps/${args.app}/maintenance`, args, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(change)
+		}) : await api(`/v1/apps/${args.app}/maintenance`, args)).json();
+		const when = (iso) => new Date(iso).toLocaleString();
+		if (result.deploying) console.log(`${args.app} is in maintenance for a deploy`);
+		if (result.state === "off" && !result.deploying) console.log(`${args.app} is not in maintenance`);
+		if (result.state === "on") console.log(`${args.app} is in maintenance ${result.until ? `until ${when(result.until)}` : "until you turn it off"}`);
+		if (result.state === "scheduled") console.log(`${args.app} goes into maintenance at ${when(result.from)}${result.until ? `, until ${when(result.until)}` : ""}`);
+	}
+});
+/** A time as ISO, read in this machine's time zone unless it names one. */
+function localTime(value) {
+	const time = new Date(value);
+	if (Number.isNaN(time.getTime())) throw new Error(`Can't read the time "${value}"`);
+	return time.toISOString();
+}
 const domains = defineCommand({
 	meta: {
 		name: "domains",
@@ -1002,6 +1350,14 @@ const accounts = defineCommand({
 			type: "string",
 			description: "Space all releases of their apps may take, e.g. 2GB. \"none\", \"default\""
 		},
+		admin: {
+			type: "boolean",
+			description: "Make the account an admin (only admins from WERVT_ADMIN_EMAILS can)"
+		},
+		"revoke-admin": {
+			type: "boolean",
+			description: "Take admin away from the account"
+		},
 		into: {
 			type: "string",
 			description: "Merge the account into this one (same person, two sign-ups): its logins, apps and access move over, apps move their data, then it is deleted"
@@ -1009,6 +1365,15 @@ const accounts = defineCommand({
 		...connection
 	},
 	async run({ args }) {
+		const admin = adminFlag(args);
+		if (admin !== void 0) {
+			const result = await (await api(`/v1/accounts/${encodeURIComponent(args.email ?? "")}`, args, {
+				method: "PATCH",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ admin })
+			})).json();
+			return console.log(`${result.email} ${result.admin ? "is now an admin" : "is no admin now"}`);
+		}
 		if (args.email && args.into) {
 			const result = await (await api("/v1/accounts/merge", args, {
 				method: "POST",
@@ -1036,7 +1401,7 @@ const accounts = defineCommand({
 			const change = {};
 			if (args.apps) change.apps = args.apps === "none" ? null : args.apps === "default" ? "default" : Number(args.apps);
 			for (const flag of SIZE_FLAGS) if (args[flag]) change[flag] = args[flag] === "none" ? null : args[flag];
-			if (!Object.keys(change).length) throw new Error("Pass --apps, --database, --storage or --releases (a value, none or default)");
+			if (!Object.keys(change).length) throw new Error("Pass --apps, --database, --storage or --releases (a value, none or default), or --admin or --revoke-admin");
 			const result = await (await api(`/v1/accounts/${encodeURIComponent(args.email)}`, args, {
 				method: "PATCH",
 				headers: { "content-type": "application/json" },
@@ -1219,6 +1584,262 @@ const clients = defineCommand({
 		})
 	}
 });
+const updatePlatforms = (value) => {
+	const list = toList(value ?? UPDATE_PLATFORMS.join(","));
+	for (const platform of list) if (!UPDATE_PLATFORMS.includes(platform)) throw new Error(`--platform must be ios or android, not ${platform}`);
+	return list;
+};
+/** Runs a tool of the Expo project and returns what it printed. */
+async function expoTool(dir, args) {
+	const result = await x("npx", args, {
+		nodeOptions: { cwd: dir },
+		throwOnError: false
+	});
+	if (result.exitCode !== 0) throw new Error(`npx ${args.join(" ")} failed:\n${result.stderr || result.stdout}`);
+	return result.stdout;
+}
+const gitLine = async (dir, args) => {
+	const result = await x("git", args, {
+		nodeOptions: { cwd: dir },
+		throwOnError: false
+	});
+	return result.exitCode === 0 ? result.stdout.trim() : void 0;
+};
+const UPLOADS_AT_ONCE = 8;
+const updates = defineCommand({
+	meta: {
+		name: "updates",
+		description: "Publish over-the-air updates for the Expo app that goes with an app"
+	},
+	subCommands: {
+		publish: defineCommand({
+			meta: {
+				name: "publish",
+				description: "Export the Expo project and publish it to the app's devices"
+			},
+			args: {
+				app: appArg,
+				channel: {
+					type: "string",
+					default: "production",
+					description: "Channel of the builds"
+				},
+				message: {
+					type: "string",
+					description: "Default: the last commit subject"
+				},
+				platform: {
+					type: "string",
+					description: "ios, android or both (default: both)"
+				},
+				dir: {
+					type: "string",
+					default: ".",
+					description: "The Expo project (default: .)"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const dir = resolve(args.dir);
+				const platforms = updatePlatforms(args.platform);
+				p.intro(`wervt updates publish ${args.app}`);
+				const out = await mkdtemp(join(tmpdir(), "wervt-update-"));
+				try {
+					p.log.step("expo export");
+					if ((await x("npx", [
+						"expo",
+						"export",
+						...platforms.flatMap((platform) => ["--platform", platform]),
+						"--output-dir",
+						out
+					], {
+						nodeOptions: {
+							cwd: dir,
+							stdio: "inherit"
+						},
+						throwOnError: false
+					})).exitCode !== 0) throw new Error("expo export failed");
+					const config = JSON.parse(await expoTool(dir, [
+						"expo",
+						"config",
+						"--json",
+						"--type",
+						"public"
+					]));
+					const commit = await gitLine(dir, [
+						"rev-parse",
+						"--short=12",
+						"HEAD"
+					]);
+					const message = args.message ?? await gitLine(dir, [
+						"log",
+						"-1",
+						"--format=%s"
+					]);
+					const prepared = await Promise.all(platforms.map(async (platform) => {
+						const { runtimeVersion } = JSON.parse(await expoTool(dir, [
+							"expo-updates",
+							"runtimeversion:resolve",
+							"--platform",
+							platform
+						]));
+						if (!runtimeVersion) throw new Error(`No runtimeVersion for ${platform}, set it in the app config`);
+						return {
+							platform,
+							runtimeVersion,
+							...await readExport(out, platform)
+						};
+					}));
+					const files = uniqueFiles(prepared.flatMap((u) => [u.launchAsset, ...u.assets]));
+					const { missing } = await (await api(`/v1/apps/${args.app}/updates/missing`, args, {
+						method: "POST",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({ hashes: files.map((file) => file.hash) })
+					})).json();
+					const wanted = new Set(missing);
+					const uploads = files.filter((file) => wanted.has(file.hash));
+					const spin = progress();
+					spin.start(`Uploading ${uploads.length} of ${files.length} files`);
+					await forEachLimit(uploads, UPLOADS_AT_ONCE, async (file) => {
+						await api(`/v1/apps/${args.app}/updates/assets/${file.hash}`, args, {
+							method: "PUT",
+							headers: { "content-type": file.contentType },
+							body: await readFile(file.path)
+						});
+					});
+					spin.stop(`Uploaded ${uploads.length} of ${files.length} files`);
+					for (const { platform, runtimeVersion, launchAsset, assets } of prepared) {
+						const created = await (await api(`/v1/apps/${args.app}/updates`, args, {
+							method: "POST",
+							headers: { "content-type": "application/json" },
+							body: JSON.stringify({
+								channel: args.channel,
+								platform,
+								runtimeVersion,
+								launchAsset: withoutPath(launchAsset),
+								assets: assets.map(withoutPath),
+								extra: { expoClient: config },
+								message,
+								commit
+							})
+						})).json();
+						p.log.success(`${platform}: ${created[0].id} (runtime ${runtimeVersion})`);
+					}
+					outro(`Published to ${args.channel}`);
+				} finally {
+					await rm(out, {
+						recursive: true,
+						force: true
+					});
+				}
+			}
+		}),
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List published updates, newest first"
+			},
+			args: {
+				app: appArg,
+				channel: {
+					type: "string",
+					description: "Only this channel"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const shown = (await (await api(`/v1/apps/${args.app}/updates`, args)).json()).filter((u) => !args.channel || u.channel === args.channel);
+				if (!shown.length) return console.log(`No updates for ${args.app}.`);
+				for (const update of shown) {
+					const what = update.rollBackToEmbedded ? "back to the embedded update" : `${update.files} files, ${formatBytes(update.bytes)}`;
+					console.log(`${update.createdAt.slice(0, 16).replace("T", " ")}  ${update.channel}  ${update.platform}  ${update.id}  ${what}`);
+					const note = [
+						update.message,
+						update.commit,
+						`runtime ${update.runtimeVersion.slice(0, 12)}`,
+						update.republishOf && `again from ${update.republishOf}`
+					];
+					console.log(styleText("dim", `  ${note.filter(Boolean).join(" · ")}`));
+				}
+			}
+		}),
+		rollback: defineCommand({
+			meta: {
+				name: "rollback",
+				description: "Send a channel back to the previous update, or the one built into the app"
+			},
+			args: {
+				app: appArg,
+				channel: {
+					type: "string",
+					default: "production",
+					description: "Channel to roll back"
+				},
+				platform: {
+					type: "string",
+					description: "ios or android (default: both)"
+				},
+				runtime: {
+					type: "string",
+					description: "A runtime version (default: each platform's newest)"
+				},
+				embedded: {
+					type: "boolean",
+					description: "Go back to the update built into the app"
+				},
+				yes: {
+					type: "boolean",
+					description: "Skip the confirmation"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const platforms = args.platform ? updatePlatforms(args.platform) : [];
+				if (platforms.length > 1) throw new Error("--platform takes one platform");
+				if (!args.yes) {
+					const ok = await p.confirm({
+						message: `Roll back ${args.channel} of ${args.app}? Devices take this on their next start.`,
+						initialValue: false
+					});
+					if (p.isCancel(ok) || !ok) return p.cancel("Cancelled");
+				}
+				const created = await (await api(`/v1/apps/${args.app}/updates/rollback`, args, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({
+						channel: args.channel,
+						platform: platforms[0],
+						runtimeVersion: args.runtime,
+						embedded: args.embedded
+					})
+				})).json();
+				for (const update of created) console.log(`${update.platform}: ${update.rollBackToEmbedded ? "back to the embedded update" : `back to ${update.republishOf}`}`);
+			}
+		}),
+		certificate: defineCommand({
+			meta: {
+				name: "certificate",
+				description: "Save the code signing certificate that goes into the build"
+			},
+			args: {
+				app: appArg,
+				out: {
+					type: "string",
+					default: DEFAULT_CERTIFICATE,
+					description: "Where to save it"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const { certificate } = await (await api(`/v1/apps/${args.app}/updates/certificate`, args, { method: "POST" })).json();
+				await mkdir(dirname(resolve(args.out)), { recursive: true });
+				await writeFile(args.out, certificate);
+				console.log(args.out);
+				console.error(styleText("dim", "Public: commit it. Builds with it only take updates signed for this app."));
+			}
+		})
+	}
+});
 const token = defineCommand({
 	meta: {
 		name: "token",
@@ -1857,6 +2478,37 @@ const login = defineCommand({
 		outro(`Signed in to ${url} (saved to ${file})`);
 	}
 });
+const dev = defineCommand({
+	meta: {
+		name: "dev",
+		description: "Run an app's dev server against its local database: wervt dev -- <command>"
+	},
+	args: {
+		name: {
+			type: "string",
+			description: "App name (default: from package.json)"
+		},
+		storage: {
+			type: "boolean",
+			description: "Set up the app's local bucket too"
+		},
+		reset: {
+			type: "boolean",
+			description: "Drop the app's local database first; without a command, only that"
+		}
+	},
+	async run({ args, rawArgs }) {
+		const command = passthrough(rawArgs);
+		if (!command.length && !args.reset) throw new Error("Pass a command: wervt dev -- <command>");
+		await dev$1({
+			dir: ".",
+			command,
+			name: args.name,
+			storage: args.storage,
+			reset: args.reset
+		});
+	}
+});
 const build = defineCommand({
 	meta: {
 		name: "build",
@@ -1905,6 +2557,7 @@ runMain(defineCommand({
 	},
 	subCommands: {
 		deploy,
+		dev,
 		build,
 		apps,
 		releases,
@@ -1914,7 +2567,9 @@ runMain(defineCommand({
 		activate,
 		rollback,
 		reprovision,
+		db,
 		access,
+		maintenance,
 		domains,
 		members,
 		accounts,
@@ -1922,6 +2577,7 @@ runMain(defineCommand({
 		tokens,
 		token,
 		clients,
+		updates,
 		identity,
 		tasks,
 		stats,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/cli",
-  "version": "0.2.19",
+  "version": "0.2.21",
   "description": "Deploy and manage apps on wervt.",
   "keywords": [
     "agents",
@@ -29,14 +29,16 @@
   "type": "module",
   "dependencies": {
     "@clack/prompts": "^1.8.1",
+    "@wervt/platform": "^0.0.4",
     "citty": "^0.2.2",
+    "drizzle-orm": "1.0.0-rc.5",
     "modern-tar": "^0.8.6",
     "nypm": "^0.6.12",
     "rolldown": "^1.2.16",
     "tinyexec": "^1.3.1"
   },
   "devDependencies": {
-    "@wervt/core": "0.0.2"
+    "@wervt/core": "0.0.3"
   },
   "scripts": {
     "build": "vp pack"

package/skill/SKILL.md

@@ -23,6 +23,17 @@ approve it in the dashboard (CLI page) and the machine gets its own admin sessio
 login for them, never look for tokens in files, env or keychains, and never print or ask to paste
 one into the chat.
 
+Where the user can't run the login (a cloud sandbox like Claude Code on the web), use wervt's MCP
+servers instead, if they're connected. They act as the user:
+
+- The dashboard's (`whoami`, `apps.list`, `logs.query`, `env.update`, …) manages deployed apps:
+  everything below except building and deploying.
+- build's (`create-app`, `edit-file`, `run`, `deploy`, …) builds and deploys apps in a cloud
+  sandbox, without this machine.
+
+Not connected: ask the user to add `https://dashboard.<domain>/mcp` (and, to build,
+`https://build.<domain>/mcp`) as MCP servers.
+
 ## 2. Scaffold
 
 ```bash
@@ -141,6 +152,7 @@ pnpm exec wervt queries <name>                 # saved queries and their alerts
 pnpm exec wervt tasks <name>                   # tasks, schedules, next runs
 pnpm exec wervt tasks <name> --run <task>      # run one now
 pnpm exec wervt rollback <name>                # the previous release (migrations stay)
+pnpm exec wervt db sql <name> "select …"       # one read-only statement as the app's role
 ```
 
 For debugging, use the app's `wervt-logs` skill (logs live 14 days; queries are LogsQL).
@@ -148,6 +160,6 @@ For debugging, use the app's `wervt-logs` skill (logs live 14 days; queries are
 ## Never without asking
 
 `wervt delete` (never with `--drop-database` unless the user says so explicitly), `rollback`,
-`activate`, revoking tokens, making a private app public, or deploying over an app you didn't
+`activate`, `wervt db sql --write`, revoking tokens, making a private app public, or deploying over an app you didn't
 create in this conversation. Outside an app directory, `pnpm exec wervt` isn't installed: use
 `npx -y @wervt/cli <command>`.