@wervt/cli 0.2.20 → 0.2.21

package/README.md

@@ -21,4 +21,4 @@ in package.json (any `export default { fetch }` module works too, without `--sta
 
 Without [Vite+](https://viteplus.dev), use `npx @wervt/cli` and `pnpm exec wervt`. `wervt --help`
 lists every command: `apps`, `releases`, `audit`, `rollback`, `activate`, `env`, `tokens`, `token`, `members`,
-`tasks`, `stats`, `delete`, `whoami`, … Docs: [wervt.app](https://wervt.app/getting-started/quickstart).
+`maintenance`, `updates`, `tasks`, `stats`, `delete`, `whoami`, … Docs: [wervt.app](https://wervt.app/getting-started/quickstart).

package/dist/index.mjs

@@ -1,14 +1,37 @@
 import { builtinModules } from "node:module";
 import { existsSync } from "node:fs";
-import { appendFile, cp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
-import { homedir, hostname } from "node:os";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { appendFile, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { homedir, hostname, tmpdir } from "node:os";
+import { delimiter, dirname, join, relative, resolve, sep } from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
 import { defineCommand, runMain } from "citty";
 import { detectPackageManager } from "nypm";
 import { x } from "tinyexec";
 import { packTar } from "modern-tar";
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+// src/admin-flag.ts
+const OTHER_CHANGES = [
+	"into",
+	"apps",
+	"database",
+	"storage",
+	"releases"
+];
+/**
+* What `wervt accounts` should do to the admin role, if anything. Refuses combinations instead of
+* dropping a flag: someone who typed `--apps 5` next to `--admin` would otherwise think it applied.
+*/
+function adminFlag(args) {
+	const revoke = args["revoke-admin"];
+	if (!args.admin && !revoke) return void 0;
+	if (args.admin && revoke) throw new Error("Pass --admin or --revoke-admin, not both");
+	if (!args.email) throw new Error("Name the account: wervt accounts <email> --admin");
+	const other = OTHER_CHANGES.find((flag) => args[flag]);
+	if (other) throw new Error(`Change admin on its own, without --${other}`);
+	return !!args.admin;
+}
 // ../core/src/manifest.ts
 /** The bundle's `wervt-bundle.json`, next to `server/` and `public/`. */
 const BUNDLE_MANIFEST = "wervt-bundle.json";
@@ -235,6 +258,80 @@ async function saveConfig(config) {
 	await writeFile(file, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
 	return file;
 }
+// src/dev.ts
+/** What comes after `--`, untouched, so the command keeps its own flags. */
+const passthrough = (rawArgs) => {
+	const at = rawArgs.indexOf("--");
+	return at === -1 ? [] : rawArgs.slice(at + 1);
+};
+/** Runs the app's command against its local database until the command exits. */
+async function dev$1(options) {
+	const { resetDevDatabase, resolveAppName, setupDev } = await import("@wervt/platform/dev");
+	const rootDir = resolve(options.dir);
+	const app = await resolveAppName(rootDir, options.name);
+	const [command, ...commandArgs] = options.command;
+	const envFile = join(rootDir, ".env");
+	if (existsSync(envFile)) process.loadEnvFile(envFile);
+	if (options.reset) p.log.success(`Dropped \`${await resetDevDatabase(app)}\``);
+	if (!command) return;
+	const { database } = await readBuildConfig(rootDir);
+	let child;
+	let closers = [];
+	const stopChild = async () => {
+		const running = child;
+		child = void 0;
+		if (!running || running.exitCode !== null) return;
+		const exited = new Promise((done) => running.once("exit", done));
+		running.kill("SIGTERM");
+		await exited;
+	};
+	const stopSetup = () => {
+		for (const close of closers) close();
+		closers = [];
+	};
+	const start = async () => {
+		await setupDev({
+			rootDir,
+			onClose: (fn) => closers.push(fn),
+			restart: () => {
+				stopSetup();
+				stopChild().then(start);
+			},
+			logger: {
+				info: (message) => p.log.info(message),
+				success: (message) => p.log.success(message),
+				warn: (message, ...args) => p.log.warn([message, ...args].join(" "))
+			}
+		}, app, {
+			seed: false,
+			database
+		}, { storage: options.storage });
+		const started = spawn(command, commandArgs, {
+			cwd: rootDir,
+			stdio: "inherit",
+			env: {
+				...process.env,
+				PATH: [join(rootDir, "node_modules/.bin"), process.env.PATH].join(delimiter)
+			}
+		});
+		child = started;
+		const finish = (code) => {
+			if (child !== started) return;
+			stopSetup();
+			process.exit(code);
+		};
+		started.once("error", (e) => {
+			p.log.error(`Could not run ${command}: ${e.message}`);
+			finish(1);
+		});
+		started.once("exit", (code, signal) => finish(code ?? (signal ? 0 : 1)));
+	};
+	for (const signal of ["SIGINT", "SIGTERM"]) process.once(signal, () => {
+		stopSetup();
+		stopChild().then(() => process.exit(0));
+	});
+	await start();
+}
 // src/format.ts
 function formatBytes(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
@@ -251,6 +348,16 @@ function formatBytes(bytes) {
 	}
 	return `${value < 10 ? value.toFixed(1) : Math.round(value)} ${units[unit]}`;
 }
+/** Minutes in a duration like `30m`, `2h` or `1d`; a bare number means minutes. */
+function parseMinutes(value) {
+	const match = /^(\d+)(m|h|d)?$/.exec(value.trim());
+	if (!match) throw new Error(`Can't read the duration "${value}", try 30m, 2h or 1d`);
+	return Number(match[1]) * {
+		m: 1,
+		h: 60,
+		d: 1440
+	}[match[2] ?? "m"];
+}
 const list = (value) => Array.isArray(value) ? value.map(String).join(", ") : "";
 const text = (value) => typeof value === "string" ? value : "";
 /** What an audit entry changed, in a few words: `env.update` → `set API_URL, TOKEN`. */
@@ -276,11 +383,26 @@ function auditSummary(entry) {
 			list(d.add) && `add ${list(d.add)}`,
 			list(d.remove) && `remove ${list(d.remove)}`
 		].filter(Boolean).join("; ");
+		case "updates.publish":
+		case "updates.rollback": return [
+			text(d.channel),
+			text(d.platform),
+			text(d.message),
+			d.embedded ? "to the embedded update" : "",
+			text(d.republishOf) && `again from ${text(d.republishOf)}`
+		].filter(Boolean).join("; ");
+		case "maintenance.update": return [
+			text(d.state),
+			text(d.from) && `from ${text(d.from)}`,
+			text(d.until) && `until ${text(d.until)}`,
+			list(d.page) && `page ${list(d.page)}`
+		].filter(Boolean).join("; ");
 		case "owners.update": return [
 			text(d.owner) && `owner ${text(d.owner)}`,
 			list(d.added) && `added ${list(d.added)}`,
 			list(d.removed) && `removed ${list(d.removed)}`
 		].filter(Boolean).join("; ");
+		case "db.query": return `${d.write === true ? "write" : "read"}  ${text(d.command)} ${Number(d.count)}`;
 		case "token.create":
 		case "token.revoke": return text(d.name) || text(d.id);
 		case "client.create":
@@ -321,6 +443,17 @@ function requestSummary(group) {
 		counts.join(", ")
 	].filter(Boolean).join("  ");
 }
+/** A `wervt db sql` result as an aligned table; a null is shown as `NULL`, newlines as spaces. */
+function sqlTable(columns, rows) {
+	const shown = rows.map((row) => row.map((cell) => cell === null ? "NULL" : cell.replace(/\s*\n\s*/g, " ")));
+	const widths = columns.map((column, i) => Math.max(column.length, ...shown.map((row) => row[i].length)));
+	const line = (cells) => cells.map((cell, i) => cell.padEnd(widths[i])).join("  ").trimEnd();
+	return [
+		line(columns),
+		line(widths.map((w) => "-".repeat(w))),
+		...shown.map(line)
+	].join("\n");
+}
 // src/source.ts
 async function git(dir, ...args) {
 	try {
@@ -366,6 +499,81 @@ async function deploySource(dir) {
 		actor: await git(dir, "config", "user.name")
 	};
 }
+// src/updates.ts
+const UPDATE_PLATFORMS = ["ios", "android"];
+const CONTENT_TYPES = {
+	aac: "audio/aac",
+	bmp: "image/bmp",
+	css: "text/css",
+	gif: "image/gif",
+	heic: "image/heic",
+	html: "text/html",
+	jpeg: "image/jpeg",
+	jpg: "image/jpeg",
+	json: "application/json",
+	m4a: "audio/mp4",
+	m4v: "video/mp4",
+	mov: "video/quicktime",
+	mp3: "audio/mpeg",
+	mp4: "video/mp4",
+	oga: "audio/ogg",
+	ogg: "audio/ogg",
+	otf: "font/otf",
+	pdf: "application/pdf",
+	png: "image/png",
+	svg: "image/svg+xml",
+	ttf: "font/ttf",
+	txt: "text/plain",
+	wav: "audio/wav",
+	webm: "video/webm",
+	webp: "image/webp",
+	woff: "font/woff",
+	woff2: "font/woff2",
+	xml: "application/xml"
+};
+async function describe(out, path, type, extension) {
+	const bytes = await readFile(join(out, path));
+	const file = {
+		hash: createHash("sha256").update(bytes).digest("base64url"),
+		key: createHash("md5").update(bytes).digest("hex"),
+		contentType: type,
+		size: bytes.length,
+		path: join(out, path)
+	};
+	return extension ? {
+		...file,
+		fileExtension: extension
+	} : file;
+}
+/** The bundle and assets `expo export` wrote to `out` for one platform. */
+async function readExport(out, platform) {
+	const exported = JSON.parse(await readFile(join(out, "metadata.json"), "utf8")).fileMetadata[platform];
+	if (!exported) throw new Error(`The export has nothing for ${platform}`);
+	return {
+		launchAsset: await describe(out, exported.bundle, "application/javascript"),
+		assets: await Promise.all(exported.assets.map(({ path, ext }) => describe(out, path, CONTENT_TYPES[ext.toLowerCase()] ?? "application/octet-stream", ext ? `.${ext}` : void 0)))
+	};
+}
+/** Each file once, also when both platforms ship it. */
+function uniqueFiles(files) {
+	return [...new Map(files.map((file) => [file.hash, file])).values()];
+}
+/** The file as the control plane records it, without where it lies on this machine. */
+function withoutPath(file) {
+	return {
+		...file,
+		path: void 0
+	};
+}
+/** The name `updates.codeSigningCertificate` points at unless told otherwise. */
+const DEFAULT_CERTIFICATE = "certs/wervt-updates.pem";
+/** The first `limit` at a time, in order; rejects with the first failure. */
+async function forEachLimit(items, limit, run) {
+	let next = 0;
+	await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+		while (next < items.length) await run(items[next++]);
+	}));
+}
 // src/index.ts
 const interactive = process.stdout.isTTY === true && !process.env.CI;
 function progress() {
@@ -503,6 +711,7 @@ const deploy = defineCommand({
 		const query = new URLSearchParams();
 		if (args.check !== void 0) query.set("check", args.check);
 		if (args["rollback-on-fail"]) query.set("rollbackOnFail", "1");
+		if (args.maintenance) query.set("maintenance", "1");
 		const res = await api(`/v1/apps/${name}/deploys${query.size ? `?${query}` : ""}`, args, {
 			method: "POST",
 			headers: {
@@ -513,6 +722,7 @@ const deploy = defineCommand({
 		});
 		const labels = {
 			extract: "Extracting",
+			maintenance: "Turning on maintenance mode",
 			migrate: "Migrating database",
 			storage: "Setting up storage",
 			activate: "Activating",
@@ -745,6 +955,63 @@ const reprovision = defineCommand({
 		if (results.some((r) => r.error)) process.exitCode = 1;
 	}
 });
+const db = defineCommand({
+	meta: {
+		name: "db",
+		description: "Work with an app's database"
+	},
+	subCommands: { sql: defineCommand({
+		meta: {
+			name: "sql",
+			description: "Run one SQL statement as the app's role: read-only unless you pass --write"
+		},
+		args: {
+			app: {
+				type: "positional",
+				required: true,
+				description: "App name"
+			},
+			statement: {
+				type: "positional",
+				required: false,
+				description: "SQL statement"
+			},
+			file: {
+				type: "string",
+				description: "Read the statement from this file"
+			},
+			write: {
+				type: "boolean",
+				description: "Allow changes and commit them"
+			},
+			preview: {
+				type: "string",
+				description: "Run against this preview, like pr-12"
+			},
+			json: {
+				type: "boolean",
+				description: "Print the result as JSON"
+			},
+			...connection
+		},
+		async run({ args }) {
+			if (!args.statement === !args.file) throw new Error("Pass a statement or --file");
+			const sql = args.file ? await readFile(args.file, "utf8") : args.statement;
+			const result = await (await api(`/v1/apps/${previewName(args.app, args.preview)}/db/query`, args, {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					sql,
+					write: args.write === true
+				})
+			})).json();
+			if (args.json) return console.log(JSON.stringify(result));
+			if (result.columns.length) console.log(sqlTable(result.columns, result.rows));
+			const limited = result.truncated ? ` (first ${result.rows.length})` : "";
+			console.error(styleText("dim", `${result.command} ${result.count}${limited} in ${result.ms}ms`));
+		}
+	}) }
+});
 const toList = (value) => (Array.isArray(value) ? value : value === void 0 ? [] : [value]).flatMap((v) => String(v).split(","));
 const access = defineCommand({
 	meta: {
@@ -808,6 +1075,87 @@ const access = defineCommand({
 		}
 	}
 });
+const maintenance = defineCommand({
+	meta: {
+		name: "maintenance",
+		description: "Show, plan or end maintenance: visitors get a 503 page, the owner, members and admins still get in"
+	},
+	args: {
+		app: {
+			type: "positional",
+			required: true,
+			description: "App name"
+		},
+		state: {
+			type: "positional",
+			required: false,
+			description: "on or off"
+		},
+		for: {
+			type: "string",
+			description: "End by itself after this long, like 30m, 2h or 1d"
+		},
+		from: {
+			type: "string",
+			description: "Start at this time instead of now, like 2026-12-01T22:00"
+		},
+		until: {
+			type: "string",
+			description: "End by itself at this time"
+		},
+		title: {
+			type: "string",
+			description: "The page's title (empty for the default)"
+		},
+		message: {
+			type: "string",
+			description: "The page's text (empty for the default)"
+		},
+		color: {
+			type: "string",
+			description: "The page's color, like #2f5bff (empty for the brand's)"
+		},
+		link: {
+			type: "string",
+			description: "A contact or status link on the page (empty for none)"
+		},
+		"link-label": {
+			type: "string",
+			description: "The text of that link"
+		},
+		...connection
+	},
+	async run({ args }) {
+		if (args.state !== void 0 && args.state !== "on" && args.state !== "off") throw new Error(`Expected on or off, not "${args.state}"`);
+		const change = {};
+		if (args.state) change.enabled = args.state === "on";
+		if (args.state !== "on" && (args.for ?? args.from ?? args.until) !== void 0) throw new Error("--for, --from and --until plan maintenance: add `on`");
+		if (args.for !== void 0) change.minutes = parseMinutes(args.for);
+		if (args.from !== void 0) change.from = localTime(args.from);
+		if (args.until !== void 0) change.until = localTime(args.until);
+		if (args.title !== void 0) change.title = args.title;
+		if (args.message !== void 0) change.message = args.message;
+		if (args.color !== void 0) change.color = args.color;
+		if (args.link !== void 0) change.linkUrl = args.link;
+		if (args["link-label"] !== void 0) change.linkLabel = args["link-label"];
+		const result = await (Object.keys(change).length ? await api(`/v1/apps/${args.app}/maintenance`, args, {
+			method: "PATCH",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(change)
+		}) : await api(`/v1/apps/${args.app}/maintenance`, args)).json();
+		const when = (iso) => new Date(iso).toLocaleString();
+		if (result.deploying) console.log(`${args.app} is in maintenance for a deploy`);
+		if (result.state === "off" && !result.deploying) console.log(`${args.app} is not in maintenance`);
+		if (result.state === "on") console.log(`${args.app} is in maintenance ${result.until ? `until ${when(result.until)}` : "until you turn it off"}`);
+		if (result.state === "scheduled") console.log(`${args.app} goes into maintenance at ${when(result.from)}${result.until ? `, until ${when(result.until)}` : ""}`);
+	}
+});
+/** A time as ISO, read in this machine's time zone unless it names one. */
+function localTime(value) {
+	const time = new Date(value);
+	if (Number.isNaN(time.getTime())) throw new Error(`Can't read the time "${value}"`);
+	return time.toISOString();
+}
 const domains = defineCommand({
 	meta: {
 		name: "domains",
@@ -1002,6 +1350,14 @@ const accounts = defineCommand({
 			type: "string",
 			description: "Space all releases of their apps may take, e.g. 2GB. \"none\", \"default\""
 		},
+		admin: {
+			type: "boolean",
+			description: "Make the account an admin (only admins from WERVT_ADMIN_EMAILS can)"
+		},
+		"revoke-admin": {
+			type: "boolean",
+			description: "Take admin away from the account"
+		},
 		into: {
 			type: "string",
 			description: "Merge the account into this one (same person, two sign-ups): its logins, apps and access move over, apps move their data, then it is deleted"
@@ -1009,6 +1365,15 @@ const accounts = defineCommand({
 		...connection
 	},
 	async run({ args }) {
+		const admin = adminFlag(args);
+		if (admin !== void 0) {
+			const result = await (await api(`/v1/accounts/${encodeURIComponent(args.email ?? "")}`, args, {
+				method: "PATCH",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({ admin })
+			})).json();
+			return console.log(`${result.email} ${result.admin ? "is now an admin" : "is no admin now"}`);
+		}
 		if (args.email && args.into) {
 			const result = await (await api("/v1/accounts/merge", args, {
 				method: "POST",
@@ -1036,7 +1401,7 @@ const accounts = defineCommand({
 			const change = {};
 			if (args.apps) change.apps = args.apps === "none" ? null : args.apps === "default" ? "default" : Number(args.apps);
 			for (const flag of SIZE_FLAGS) if (args[flag]) change[flag] = args[flag] === "none" ? null : args[flag];
-			if (!Object.keys(change).length) throw new Error("Pass --apps, --database, --storage or --releases (a value, none or default)");
+			if (!Object.keys(change).length) throw new Error("Pass --apps, --database, --storage or --releases (a value, none or default), or --admin or --revoke-admin");
 			const result = await (await api(`/v1/accounts/${encodeURIComponent(args.email)}`, args, {
 				method: "PATCH",
 				headers: { "content-type": "application/json" },
@@ -1219,6 +1584,262 @@ const clients = defineCommand({
 		})
 	}
 });
+const updatePlatforms = (value) => {
+	const list = toList(value ?? UPDATE_PLATFORMS.join(","));
+	for (const platform of list) if (!UPDATE_PLATFORMS.includes(platform)) throw new Error(`--platform must be ios or android, not ${platform}`);
+	return list;
+};
+/** Runs a tool of the Expo project and returns what it printed. */
+async function expoTool(dir, args) {
+	const result = await x("npx", args, {
+		nodeOptions: { cwd: dir },
+		throwOnError: false
+	});
+	if (result.exitCode !== 0) throw new Error(`npx ${args.join(" ")} failed:\n${result.stderr || result.stdout}`);
+	return result.stdout;
+}
+const gitLine = async (dir, args) => {
+	const result = await x("git", args, {
+		nodeOptions: { cwd: dir },
+		throwOnError: false
+	});
+	return result.exitCode === 0 ? result.stdout.trim() : void 0;
+};
+const UPLOADS_AT_ONCE = 8;
+const updates = defineCommand({
+	meta: {
+		name: "updates",
+		description: "Publish over-the-air updates for the Expo app that goes with an app"
+	},
+	subCommands: {
+		publish: defineCommand({
+			meta: {
+				name: "publish",
+				description: "Export the Expo project and publish it to the app's devices"
+			},
+			args: {
+				app: appArg,
+				channel: {
+					type: "string",
+					default: "production",
+					description: "Channel of the builds"
+				},
+				message: {
+					type: "string",
+					description: "Default: the last commit subject"
+				},
+				platform: {
+					type: "string",
+					description: "ios, android or both (default: both)"
+				},
+				dir: {
+					type: "string",
+					default: ".",
+					description: "The Expo project (default: .)"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const dir = resolve(args.dir);
+				const platforms = updatePlatforms(args.platform);
+				p.intro(`wervt updates publish ${args.app}`);
+				const out = await mkdtemp(join(tmpdir(), "wervt-update-"));
+				try {
+					p.log.step("expo export");
+					if ((await x("npx", [
+						"expo",
+						"export",
+						...platforms.flatMap((platform) => ["--platform", platform]),
+						"--output-dir",
+						out
+					], {
+						nodeOptions: {
+							cwd: dir,
+							stdio: "inherit"
+						},
+						throwOnError: false
+					})).exitCode !== 0) throw new Error("expo export failed");
+					const config = JSON.parse(await expoTool(dir, [
+						"expo",
+						"config",
+						"--json",
+						"--type",
+						"public"
+					]));
+					const commit = await gitLine(dir, [
+						"rev-parse",
+						"--short=12",
+						"HEAD"
+					]);
+					const message = args.message ?? await gitLine(dir, [
+						"log",
+						"-1",
+						"--format=%s"
+					]);
+					const prepared = await Promise.all(platforms.map(async (platform) => {
+						const { runtimeVersion } = JSON.parse(await expoTool(dir, [
+							"expo-updates",
+							"runtimeversion:resolve",
+							"--platform",
+							platform
+						]));
+						if (!runtimeVersion) throw new Error(`No runtimeVersion for ${platform}, set it in the app config`);
+						return {
+							platform,
+							runtimeVersion,
+							...await readExport(out, platform)
+						};
+					}));
+					const files = uniqueFiles(prepared.flatMap((u) => [u.launchAsset, ...u.assets]));
+					const { missing } = await (await api(`/v1/apps/${args.app}/updates/missing`, args, {
+						method: "POST",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({ hashes: files.map((file) => file.hash) })
+					})).json();
+					const wanted = new Set(missing);
+					const uploads = files.filter((file) => wanted.has(file.hash));
+					const spin = progress();
+					spin.start(`Uploading ${uploads.length} of ${files.length} files`);
+					await forEachLimit(uploads, UPLOADS_AT_ONCE, async (file) => {
+						await api(`/v1/apps/${args.app}/updates/assets/${file.hash}`, args, {
+							method: "PUT",
+							headers: { "content-type": file.contentType },
+							body: await readFile(file.path)
+						});
+					});
+					spin.stop(`Uploaded ${uploads.length} of ${files.length} files`);
+					for (const { platform, runtimeVersion, launchAsset, assets } of prepared) {
+						const created = await (await api(`/v1/apps/${args.app}/updates`, args, {
+							method: "POST",
+							headers: { "content-type": "application/json" },
+							body: JSON.stringify({
+								channel: args.channel,
+								platform,
+								runtimeVersion,
+								launchAsset: withoutPath(launchAsset),
+								assets: assets.map(withoutPath),
+								extra: { expoClient: config },
+								message,
+								commit
+							})
+						})).json();
+						p.log.success(`${platform}: ${created[0].id} (runtime ${runtimeVersion})`);
+					}
+					outro(`Published to ${args.channel}`);
+				} finally {
+					await rm(out, {
+						recursive: true,
+						force: true
+					});
+				}
+			}
+		}),
+		list: defineCommand({
+			meta: {
+				name: "list",
+				description: "List published updates, newest first"
+			},
+			args: {
+				app: appArg,
+				channel: {
+					type: "string",
+					description: "Only this channel"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const shown = (await (await api(`/v1/apps/${args.app}/updates`, args)).json()).filter((u) => !args.channel || u.channel === args.channel);
+				if (!shown.length) return console.log(`No updates for ${args.app}.`);
+				for (const update of shown) {
+					const what = update.rollBackToEmbedded ? "back to the embedded update" : `${update.files} files, ${formatBytes(update.bytes)}`;
+					console.log(`${update.createdAt.slice(0, 16).replace("T", " ")}  ${update.channel}  ${update.platform}  ${update.id}  ${what}`);
+					const note = [
+						update.message,
+						update.commit,
+						`runtime ${update.runtimeVersion.slice(0, 12)}`,
+						update.republishOf && `again from ${update.republishOf}`
+					];
+					console.log(styleText("dim", `  ${note.filter(Boolean).join(" · ")}`));
+				}
+			}
+		}),
+		rollback: defineCommand({
+			meta: {
+				name: "rollback",
+				description: "Send a channel back to the previous update, or the one built into the app"
+			},
+			args: {
+				app: appArg,
+				channel: {
+					type: "string",
+					default: "production",
+					description: "Channel to roll back"
+				},
+				platform: {
+					type: "string",
+					description: "ios or android (default: both)"
+				},
+				runtime: {
+					type: "string",
+					description: "A runtime version (default: each platform's newest)"
+				},
+				embedded: {
+					type: "boolean",
+					description: "Go back to the update built into the app"
+				},
+				yes: {
+					type: "boolean",
+					description: "Skip the confirmation"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const platforms = args.platform ? updatePlatforms(args.platform) : [];
+				if (platforms.length > 1) throw new Error("--platform takes one platform");
+				if (!args.yes) {
+					const ok = await p.confirm({
+						message: `Roll back ${args.channel} of ${args.app}? Devices take this on their next start.`,
+						initialValue: false
+					});
+					if (p.isCancel(ok) || !ok) return p.cancel("Cancelled");
+				}
+				const created = await (await api(`/v1/apps/${args.app}/updates/rollback`, args, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify({
+						channel: args.channel,
+						platform: platforms[0],
+						runtimeVersion: args.runtime,
+						embedded: args.embedded
+					})
+				})).json();
+				for (const update of created) console.log(`${update.platform}: ${update.rollBackToEmbedded ? "back to the embedded update" : `back to ${update.republishOf}`}`);
+			}
+		}),
+		certificate: defineCommand({
+			meta: {
+				name: "certificate",
+				description: "Save the code signing certificate that goes into the build"
+			},
+			args: {
+				app: appArg,
+				out: {
+					type: "string",
+					default: DEFAULT_CERTIFICATE,
+					description: "Where to save it"
+				},
+				...connection
+			},
+			async run({ args }) {
+				const { certificate } = await (await api(`/v1/apps/${args.app}/updates/certificate`, args, { method: "POST" })).json();
+				await mkdir(dirname(resolve(args.out)), { recursive: true });
+				await writeFile(args.out, certificate);
+				console.log(args.out);
+				console.error(styleText("dim", "Public: commit it. Builds with it only take updates signed for this app."));
+			}
+		})
+	}
+});
 const token = defineCommand({
 	meta: {
 		name: "token",
@@ -1857,6 +2478,37 @@ const login = defineCommand({
 		outro(`Signed in to ${url} (saved to ${file})`);
 	}
 });
+const dev = defineCommand({
+	meta: {
+		name: "dev",
+		description: "Run an app's dev server against its local database: wervt dev -- <command>"
+	},
+	args: {
+		name: {
+			type: "string",
+			description: "App name (default: from package.json)"
+		},
+		storage: {
+			type: "boolean",
+			description: "Set up the app's local bucket too"
+		},
+		reset: {
+			type: "boolean",
+			description: "Drop the app's local database first; without a command, only that"
+		}
+	},
+	async run({ args, rawArgs }) {
+		const command = passthrough(rawArgs);
+		if (!command.length && !args.reset) throw new Error("Pass a command: wervt dev -- <command>");
+		await dev$1({
+			dir: ".",
+			command,
+			name: args.name,
+			storage: args.storage,
+			reset: args.reset
+		});
+	}
+});
 const build = defineCommand({
 	meta: {
 		name: "build",
@@ -1905,6 +2557,7 @@ runMain(defineCommand({
 	},
 	subCommands: {
 		deploy,
+		dev,
 		build,
 		apps,
 		releases,
@@ -1914,7 +2567,9 @@ runMain(defineCommand({
 		activate,
 		rollback,
 		reprovision,
+		db,
 		access,
+		maintenance,
 		domains,
 		members,
 		accounts,
@@ -1922,6 +2577,7 @@ runMain(defineCommand({
 		tokens,
 		token,
 		clients,
+		updates,
 		identity,
 		tasks,
 		stats,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/cli",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "Deploy and manage apps on wervt.",
   "keywords": [
     "agents",
@@ -29,14 +29,16 @@
   "type": "module",
   "dependencies": {
     "@clack/prompts": "^1.8.1",
+    "@wervt/platform": "^0.0.4",
     "citty": "^0.2.2",
+    "drizzle-orm": "1.0.0-rc.5",
     "modern-tar": "^0.8.6",
     "nypm": "^0.6.12",
     "rolldown": "^1.2.16",
     "tinyexec": "^1.3.1"
   },
   "devDependencies": {
-    "@wervt/core": "0.0.2"
+    "@wervt/core": "0.0.3"
   },
   "scripts": {
     "build": "vp pack"

package/skill/SKILL.md

@@ -152,6 +152,7 @@ pnpm exec wervt queries <name>                 # saved queries and their alerts
 pnpm exec wervt tasks <name>                   # tasks, schedules, next runs
 pnpm exec wervt tasks <name> --run <task>      # run one now
 pnpm exec wervt rollback <name>                # the previous release (migrations stay)
+pnpm exec wervt db sql <name> "select …"       # one read-only statement as the app's role
 ```
 
 For debugging, use the app's `wervt-logs` skill (logs live 14 days; queries are LogsQL).
@@ -159,6 +160,6 @@ For debugging, use the app's `wervt-logs` skill (logs live 14 days; queries are
 ## Never without asking
 
 `wervt delete` (never with `--drop-database` unless the user says so explicitly), `rollback`,
-`activate`, revoking tokens, making a private app public, or deploying over an app you didn't
+`activate`, `wervt db sql --write`, revoking tokens, making a private app public, or deploying over an app you didn't
 create in this conversation. Outside an app directory, `pnpm exec wervt` isn't installed: use
 `npx -y @wervt/cli <command>`.