kreftjs 0.0.3-beta → 0.0.4-beta

package/docs/README.md

@@ -22,7 +22,7 @@ action add() { count++ }
 | **The `.kreftjs` language** | `state`, `derive`, `action`, `watch`, props, events, slots, stores, a router with layouts and nested routes, forms with validation, animations. |
 | **The backend** | `Route`, controllers, an Active Record `Model`, migrations, seeders, factories, jobs, mail, cache, file storage, policies, scheduling. |
 | **Authentication** | Sign-in pages, password reset, email verification, two-factor codes, device sessions and API tokens, ready in every new project (leave them out with `--no-auth`). |
-| **Tooling** | `kreftjs dev` with hot reload that keeps state, DevTools, an error monitor, `kreftjs build`, TypeScript, Vite and Electron support. |
+| **Tooling** | `kreft dev` with hot reload that keeps state, DevTools, an error monitor, `kreft build`, TypeScript, Vite and Electron support. |
 | **Security by default** | Escaped views, CSRF protection, hashed passwords, rate limits, hardened package installs. See [Security overview](#security-overview). |
 
 ### How the docs are organised
@@ -34,7 +34,7 @@ action add() { count++ }
 5. **Security** and **Reference** are for checking details.
 
 > [!NOTE]
-> Some chapters mention a few tools by name only (for example `kreftjs make:model`). Run `kreftjs list` to see every command that your installed version has.
+> Some chapters mention a few tools by name only (for example `kreft make:model`). Run `kreft list` to see every command that your installed version has.
 
 ## Installation
 
@@ -42,7 +42,7 @@ action add() { count++ }
 
 | You need | Why |
 |---|---|
-| [Node.js](https://nodejs.org) **22.5 or newer** (npm comes with it) | Runs the `kreftjs` command, the dev server and the backend. 22.5 also gives you SQLite with nothing to install. |
+| [Node.js](https://nodejs.org) **22.5 or newer** (npm comes with it) | Runs the `kreft` command, the dev server and the backend. 22.5 also gives you SQLite with nothing to install. |
 | A terminal | macOS Terminal, Windows PowerShell, or any Linux shell. |
 | A modern browser | Chrome, Edge, Firefox or Safari. |
 | MySQL, PostgreSQL or Redis | Only if you choose them. SQLite needs nothing. |
@@ -57,7 +57,7 @@ node --version      # v22.5.0 or higher
 
 Pick one way.
 
-**1. Once, for every project (recommended).** The `kreftjs` command then works in any folder:
+**1. Once, for every project (recommended).** The `kreft` command then works in any folder (the package is called `kreftjs`):
 
 ```bash
 npm i -g kreftjs
@@ -82,17 +82,17 @@ npx kreftjs dev
 ### Check that it works
 
 ```bash
-kreftjs --version     # for example 0.0.3-beta
-kreftjs about         # Kreft and Node.js versions, this project's settings and drivers
-kreftjs list          # every command your version has
+kreft --version     # for example 0.0.4-beta
+kreft about         # Kreft and Node.js versions, this project's settings and drivers
+kreft list          # every command your version has
 ```
 
-`kreft` is a shorter name for the same command.
+`kreftjs` is a longer name for the same command; both work.
 
 ### Set up your editor
 
 ```bash
-kreftjs vscode
+kreft vscode
 ```
 
 installs colors and snippets for `.kreftjs` files in VS Code (also Cursor and VSCodium). Restart the editor afterwards.
@@ -102,11 +102,11 @@ installs colors and snippets for `.kreftjs` files in VS Code (also Cursor and VS
 ```bash
 npm i -g kreftjs@latest      # the command (or: npm i -D kreftjs@latest inside a project)
 cd my-app
-kreftjs update --check       # what would change
-kreftjs update --core        # refresh this app's kreftjs.js and type files (a backup is saved)
+kreft update --check       # what would change
+kreft update --core        # refresh this app's kreftjs.js and type files (a backup is saved)
 ```
 
-Every app has its own copy of the browser runtime, `frontend/kreftjs.js`. Updating the command does not touch it, so an existing app keeps its old version until you run `kreftjs update --core` inside it.
+Every app has its own copy of the browser runtime, `frontend/kreftjs.js`. Updating the command does not touch it, so an existing app keeps its old version until you run `kreft update --core` inside it.
 
 ### Uninstall
 
@@ -116,7 +116,7 @@ npm rm -g kreftjs
 
 ### Working on Kreft itself
 
-Run `npm link` inside the Kreft folder. The `kreftjs` command then runs that folder's code, and every edit shows at once. Undo it with `npm unlink -g kreftjs`.
+Run `npm link` inside the Kreft folder. The `kreft` command then runs that folder's code, and every edit shows at once. Undo it with `npm unlink -g kreftjs`.
 
 ### If something goes wrong
 
@@ -125,9 +125,9 @@ Run `npm link` inside the Kreft folder. The `kreftjs` command then runs that fol
 | `command not found: kreftjs` | npm's global folder is not on your `PATH`. Run `npm config get prefix`, add its `bin` folder to `PATH`, and open a new terminal. |
 | `EACCES: permission denied` while installing | Do not use `sudo`. Install Node with [nvm](https://github.com/nvm-sh/nvm), or run `npm config set prefix ~/.npm-global` and add `~/.npm-global/bin` to `PATH`. |
 | `SQLite needs Node.js 22.5 or newer` | Update Node.js. `node --version` must show 22.5.0 or higher. |
-| `kreftjs --version` shows an old number | Another copy comes first on your `PATH`. Run `which -a kreftjs` (Windows: `where kreftjs`) and remove the old one. |
+| `kreft --version` shows an old number | Another copy comes first on your `PATH`. Run `which -a kreftjs` (Windows: `where kreftjs`) and remove the old one. |
 | PowerShell says "running scripts is disabled" (Windows) | Run `Set-ExecutionPolicy -Scope CurrentUser RemoteSigned`, or use Command Prompt. |
-| The browser shows a blank page or "Not found: /" | Run `kreftjs dev` from the project's top folder (the one with `frontend/` and `backend/`). The dev server serves `frontend/`. |
+| The browser shows a blank page or "Not found: /" | Run `kreft dev` from the project's top folder (the one with `frontend/` and `backend/`). The dev server serves `frontend/`. |
 
 Next: [Your first app](#your-first-app).
 
@@ -138,26 +138,43 @@ Kreft is Som.js under a new name (the package and command are `kreftjs`), and an
 - **Files:** `.som` (and `.kreft`) files still compile, next to `.kreftjs` ones. A name that is missing with one extension is tried with the others. Everything the tools write is `.kreftjs`.
 - **Templates:** `s-if`, `s-each` and every other `s-` directive are read as `k-if`, `k-each` …, and `<som-view>`, `<som-link>` … as `<kreft-view>`, `<kreft-link>` …
 - **JavaScript:** `Som` and `Kreft` are other names for `Kreftjs` (same object; `Som` is deprecated), and `Som.compileSom` is `Kreftjs.compile`.
-- **Command:** use `kreftjs` (or `kreft`). Kreft does not install a `som` command, so it can be installed next to an old Som.js without an `EEXIST` error; remove the old one with `npm rm -g somjs`.
+- **Command:** use `kreft` (or `kreftjs`). Kreft does not install a `som` command, so it can be installed next to an old Som.js without an `EEXIST` error; remove the old one with `npm rm -g somjs`.
 - **Server code:** `require('somjs/server')` (also `som/server`, `@somjs/server`, `kreft/server`) still works; new code uses `require('kreftjs/server')`.
 - **Settings:** `kreft.config.json`, `som.config.json` and `SOM_` environment variables (`SOM_SSR`, `SOM_ALLOWED_HOSTS` …) are read when the `kreftjs.config.json` file or the `KREFT_` variable is missing.
 - **Cookies:** new projects use `kreft_session`, `kreft_2fa` and `kreft_bypass`. An existing project keeps its `som_` names until you change `app/Auth/Session.js`, and the framework's CSRF check accepts both.
 - **Kept on purpose:** the `som_migrations` table, the `som:` prefix of saved data in `localStorage`, and the `som:` Redis keys of the queue. Renaming them needs a migration, planned for 3.1.
 
-To move a project over, rename `*.som` (or `*.kreft`) to `*.kreftjs` (and the paths that mention them), run `kreftjs update` and replace `s-` with `k-`.
+To move a project over, rename `*.som` (or `*.kreft`) to `*.kreftjs` (and the paths that mention them), run `kreft update` and replace `s-` with `k-`.
 
 ## Your first app
 
 Create a project, move into it and start the development server:
 
 ```bash
-kreftjs new my-app            # asks: JavaScript or TypeScript?
+kreft new my-app            # asks: JavaScript or TypeScript?
 cd my-app
 npm run dev
 ```
 
 Pass `--js` or `--ts` to skip the question, and `--db sqlite` or `--ui tailwind` (also `bootstrap`, `bulma`, `pico`) to start with a database or a CSS library.
 
+Options can be combined. For example, a Bootstrap app without login pages:
+
+```bash
+kreft new app-name --ui bootstrap --no-auth
+```
+
+More examples:
+
+```bash
+kreft new shop --db mysql --ts          # TypeScript, with a MySQL database
+kreft new site --ui tailwind --no-auth  # Tailwind, no sign-in
+kreft new desk --electron               # with desktop-app support
+```
+
+> [!NOTE]
+> Write the option values exactly: `bootstrap` (not `bootstap`), `tailwind`, `bulma` or `pico`. Any other value stops with a message that lists the allowed ones.
+
 A new app comes with login, registration, password reset, email verification, a profile and an admin area. It asks whether you want them; pass `--auth` or `--no-auth` to skip the question. `--no-auth` starts a plain site: the welcome page, the docs, the error monitor and the tests (and the Todos example with `--db`), with no users table, sessions or sign-in pages.
 
 Open the address the terminal shows (normally `http://localhost:8000`). If that port is busy, the next free one is used.
@@ -195,7 +212,7 @@ state name = 'World'
 
 ## Project structure
 
-`kreftjs new` creates two folders that never mix: `frontend/` is what browsers receive, `backend/` is the server and is never reachable over HTTP.
+`kreft new` creates two folders that never mix: `frontend/` is what browsers receive, `backend/` is the server and is never reachable over HTTP.
 
 ```text
 my-app/
@@ -223,13 +240,13 @@ my-app/
 
 ### Why the two folders matter
 
-- `kreftjs dev` and `kreftjs build` serve only `frontend/`. The `backend/` folder, database files and `.env` have no web address.
-- On macOS and Linux `kreftjs new` gives `backend/` and `.env` permissions that only the owner can read.
+- `kreft dev` and `kreft build` serve only `frontend/`. The `backend/` folder, database files and `.env` have no web address.
+- On macOS and Linux `kreft new` gives `backend/` and `.env` permissions that only the owner can read.
 - Files such as `.env`, `*.db`, `*.pem`, `package.json` and `kreftjs.config.json` are refused even if requested by name.
 
 ### Adding a CSS library
 
-Any CSS library works. Add its `<link>` to `index.html`, or install it and import the file from a `.kreftjs` file; it becomes a `<link>` added once, and `kreftjs build` copies it (with its fonts and images) into `dist/vendor/`.
+Any CSS library works. Add its `<link>` to `index.html`, or install it and import the file from a `.kreftjs` file; it becomes a `<link>` added once, and `kreft build` copies it (with its fonts and images) into `dist/vendor/`.
 
 ```html
 import 'bootstrap/dist/css/bootstrap.min.css'   // npm i bootstrap
@@ -238,11 +255,11 @@ import './theme.css'                            // your own file, next to this .
 
 ### npm packages in the browser
 
-Install a package with `kreftjs add`, then import it in any `.kreftjs` file:
+Install a package with `kreft add`, then import it in any `.kreftjs` file:
 
 ```bash
-kreftjs add dayjs nanoid lodash
-kreftjs add -D esbuild      # once per project: it prepares packages for the browser
+kreft add dayjs nanoid lodash
+kreft add -D esbuild      # once per project: it prepares packages for the browser
 ```
 
 ```html
@@ -256,7 +273,7 @@ state id = nanoid()
 </view>
 ```
 
-`kreftjs dev` serves each package as one browser-ready file and tells the browser where it is with an import map. Old-style packages (`module.exports`, such as lodash) work too.
+`kreft dev` serves each package as one browser-ready file and tells the browser where it is with an import map. Old-style packages (`module.exports`, such as lodash) work too.
 
 # The Kreft language
 
@@ -867,7 +884,7 @@ A page can also fill other places in its layout:
 
 ### Error pages
 
-Each HTTP error can have its own page in `errors/`. Turn them on with `errors: 'errors'` in the router. New projects already have the folder (`kreftjs make:errors` adds it to an older one):
+Each HTTP error can have its own page in `errors/`. Turn them on with `errors: 'errors'` in the router. New projects already have the folder (`kreft make:errors` adds it to an older one):
 
 ```text
 errors/401.kreftjs 402.kreftjs 403.kreftjs 404.kreftjs 419.kreftjs 429.kreftjs 500.kreftjs 503.kreftjs
@@ -945,7 +962,7 @@ load posts = api.get('/api/posts', { query: { q: query || undefined, page } })
 
 ### Tables
 
-For tables served by `kreftjs dev --db` or the automatic table API, `table(name)` gives ready-made calls:
+For tables served by `kreft dev --db` or the automatic table API, `table(name)` gives ready-made calls:
 
 ```html
 const posts = table('posts')
@@ -998,14 +1015,14 @@ Requests to your own backend also send `X-XSRF-TOKEN` from the `XSRF-TOKEN` cook
 ### A practice API
 
 ```bash
-kreftjs dev --api db.json              # a REST API at /api, made from a JSON file
-kreftjs dev --api db.json --delay 500  # answer slowly, to see loading states
+kreft dev --api db.json              # a REST API at /api, made from a JSON file
+kreft dev --api db.json --delay 500  # answer slowly, to see loading states
 ```
 
 It gives GET and POST on `/api/posts`, GET, PUT, PATCH and DELETE on `/api/posts/1`, search with `?q=text`, filters with `?field=value`, and standard paging and sorting.
 
 > [!WARNING]
-> `--api` and `--db` are for development. They have no login. `kreftjs dev` answers only your own computer, and refuses requests that change data when they come from another web site, but do not expose them to the internet. In production, write real routes (see [Routing](#routing)).
+> `--api` and `--db` are for development. They have no login. `kreft dev` answers only your own computer, and refuses requests that change data when they come from another web site, but do not expose them to the internet. In production, write real routes (see [Routing](#routing)).
 
 ## Forms and validation
 
@@ -1130,7 +1147,7 @@ Blade and similar engines use `{{ }}`; Kreft uses `{ }`, so they do not clash. P
 
 ## Routing
 
-A project made with `kreftjs new` has a Node.js backend. `kreftjs dev` and `kreftjs serve` load `backend/routes/api.js` by themselves, every address in it starts with `/api`, and `kreftjs dev` picks up each change you save. The backend folder never reaches the browser.
+A project made with `kreft new` has a Node.js backend. `kreft dev` and `kreft serve` load `backend/routes/api.js` by themselves, every address in it starts with `/api`, and `kreft dev` picks up each change you save. The backend folder never reaches the browser.
 
 ```js
 // routes/api.js
@@ -1151,7 +1168,7 @@ Route.prefix('admin').middleware(['auth', 'admin']).group(() => { … })
 
 - Parameters are written `{post}`, or `{post?}` when optional.
 - A route can have a name (`.name('…')`), a pattern (`.whereNumber('id')`) and middleware (`.middleware('auth')`).
-- `kreftjs route:list` prints every route with its name, controller and middleware.
+- `kreft route:list` prints every route with its name, controller and middleware.
 
 ### Namespaces
 
@@ -1197,7 +1214,7 @@ class PostController {
 module.exports = PostController
 ```
 
-Generate one with `kreftjs make:controller PostController --api` (also `--model Post`, `--route=api`, `--auth`).
+Generate one with `kreft make:controller PostController --api` (also `--model Post`, `--route=api`, `--auth`).
 
 ### The request
 
@@ -1233,7 +1250,7 @@ return PostResource.collection(await Post.paginate(15))          // { data, meta
 await req.authorize('update', post)                              // app/Policies/PostPolicy.js
 ```
 
-Generate them with `kreftjs make:request`, `kreftjs make:resource` and `kreftjs make:policy`.
+Generate them with `kreft make:request`, `kreft make:resource` and `kreft make:policy`.
 
 ### Passing data from controllers to pages
 
@@ -1362,14 +1379,14 @@ await User.factory().count(10).has(Post.factory().count(3), 'posts').create()
 
 | Command | What it does |
 |---|---|
-| `kreftjs migrate` | Runs the new migrations (`kreftjs dev` does this by itself). |
-| `kreftjs migrate:rollback` | Undoes the last batch (`--step 2` for the last two). |
-| `kreftjs migrate:fresh --seed` | Drops every table, migrates again, then seeds. |
-| `kreftjs migrate:status` | Which migrations ran. |
-| `kreftjs db:seed` | Runs `DatabaseSeeder` (`--class PostSeeder` for another). |
-| `kreftjs make:model Post -mfsc` | A model plus migration (`-m`), factory (`-f`), seeder (`-s`), controller (`-c`), page (`-p`), route (`-r`). |
-| `kreftjs make:migration create_posts_table` | `add_x_to_posts_table` makes a `schema.table` one. |
-| `kreftjs make:seeder`, `kreftjs make:middleware` | The files, in the right folders. |
+| `kreft migrate` | Runs the new migrations (`kreft dev` does this by itself). |
+| `kreft migrate:rollback` | Undoes the last batch (`--step 2` for the last two). |
+| `kreft migrate:fresh --seed` | Drops every table, migrates again, then seeds. |
+| `kreft migrate:status` | Which migrations ran. |
+| `kreft db:seed` | Runs `DatabaseSeeder` (`--class PostSeeder` for another). |
+| `kreft make:model Post -mfsc` | A model plus migration (`-m`), factory (`-f`), seeder (`-s`), controller (`-c`), page (`-p`), route (`-r`). |
+| `kreft make:migration create_posts_table` | `add_x_to_posts_table` makes a `schema.table` one. |
+| `kreft make:seeder`, `kreft make:middleware` | The files, in the right folders. |
 
 > [!NOTE]
 > `migrate:fresh` and `db:wipe` destroy data. They are meant for development databases only.
@@ -1434,7 +1451,7 @@ await Mail.send({ to, subject, text })   // printed in the terminal until MAIL_U
 
 ### Admin users
 
-An admin is a user whose `is_admin` column is true. The test user is one; give the rights to others on the Users page, or with `kreftjs make:admin you@example.com`. Use `Route.middleware(['auth', 'admin'])` for admin-only routes.
+An admin is a user whose `is_admin` column is true. The test user is one; give the rights to others on the Users page, or with `kreft make:admin you@example.com`. Use `Route.middleware(['auth', 'admin'])` for admin-only routes.
 
 ## Middleware
 
@@ -1501,7 +1518,7 @@ await SendWelcome.dispatch(user).delay(60).onQueue('mail')
 > [!WARNING]
 > `dispatch` sends the job when you `await` it (or call `.then`). Calling it and forgetting the `await` sends nothing.
 
-Queued jobs, listeners, mail and notifications run in the background. `kreftjs dev` and `kreftjs serve` work through the `jobs` table every second. Control workers with `kreftjs queue:work`, `queue:failed`, `queue:retry all`, `queue:flush`. Choose the driver with `QUEUE_CONNECTION` (`database`, `redis`, `sync`).
+Queued jobs, listeners, mail and notifications run in the background. `kreft dev` and `kreft serve` work through the `jobs` table every second. Control workers with `kreft queue:work`, `queue:failed`, `queue:retry all`, `queue:flush`. Choose the driver with `QUEUE_CONNECTION` (`database`, `redis`, `sync`).
 
 ### Uploads
 
@@ -1518,7 +1535,7 @@ Schedule.job(new SendDailyReport()).weekdays().at('08:00')
 Schedule.command('send:report Daily').hourly()
 ```
 
-`kreftjs dev` and `kreftjs serve` check the schedule every minute. Set `SCHEDULER=off` to run it from cron with `kreftjs schedule:run`; `kreftjs schedule:list` shows what is planned.
+`kreft dev` and `kreft serve` check the schedule every minute. Set `SCHEDULER=off` to run it from cron with `kreft schedule:run`; `kreft schedule:list` shows what is planned.
 
 ### Redis
 
@@ -1612,27 +1629,27 @@ test('a post can be created and found', async () => {
 
 To test a whole project's tables, run its real migrations instead of building the schema by hand: `migrator.migrate(db, 'backend/database/migrations')`.
 
-Component pages for the browser live in `frontend/tests/` and are opened with `kreftjs dev`.
+Component pages for the browser live in `frontend/tests/` and are opened with `kreft dev`.
 
 # Tooling
 
 ## Command line
 
-Run `kreftjs list` to see every command your installed version has, and `kreftjs help` for the options of the main ones.
+Run `kreft list` to see every command your installed version has, and `kreft help` for the options of the main ones.
 
 ### The main commands
 
 | Command | What it does |
 |---|---|
-| `kreftjs new my-app` | Makes a project (`--js`, `--ts`, `--db sqlite`, `--ui tailwind`, `--no-auth`). |
-| `kreftjs dev` | Development server with hot reload (`--port`, `--host`, `--db`, `--api`, `--server`, `--backend`, `--seed`, `--no-hot`, `--gc`). |
-| `kreftjs build` | Compiles the app into plain files in `dist/` (`--out`, `--base`, `--prerender`). |
-| `kreftjs serve [dist]` | Runs a built app for real users. Answers everyone, serves only the tables you list. |
-| `kreftjs update` | Updates npm packages and refreshes `kreftjs.js` (`--core`, `--npm`, `--latest`, `--check`). |
-| `kreftjs add <package>` | A safer `npm install`. See [Packages](#packages). |
-| `kreftjs about`, `kreftjs env`, `kreftjs log`, `kreftjs tinker` | Versions and folders, environment, logs, a console with your models (`await User.count()`). |
-| `kreftjs down --secret=x` / `kreftjs up` | Maintenance mode: visitors get `503`, and `/x` lets you in. |
-| `kreftjs vscode` | Installs colors, snippets and folding for `.kreftjs` files in VS Code, Cursor and VSCodium. |
+| `kreft new my-app` | Makes a project (`--js`, `--ts`, `--db sqlite`, `--ui tailwind`, `--no-auth`). |
+| `kreft dev` | Development server with hot reload (`--port`, `--host`, `--db`, `--api`, `--server`, `--backend`, `--seed`, `--no-hot`, `--gc`). |
+| `kreft build` | Compiles the app into plain files in `dist/` (`--out`, `--base`, `--prerender`). |
+| `kreft serve [dist]` | Runs a built app for real users. Answers everyone, serves only the tables you list. |
+| `kreft update` | Updates npm packages and refreshes `kreftjs.js` (`--core`, `--npm`, `--latest`, `--check`). |
+| `kreft add <package>` | A safer `npm install`. See [Packages](#packages). |
+| `kreft about`, `kreft env`, `kreft log`, `kreft tinker` | Versions and folders, environment, logs, a console with your models (`await User.count()`). |
+| `kreft down --secret=x` / `kreft up` | Maintenance mode: visitors get `503`, and `/x` lets you in. |
+| `kreft vscode` | Installs colors, snippets and folding for `.kreftjs` files in VS Code, Cursor and VSCodium. |
 
 ### Generators and database
 
@@ -1645,20 +1662,20 @@ Run `kreftjs list` to see every command your installed version has, and `kreftjs
 | `schedule:` | `run`, `work`, `list` |
 | Others | `route:list`, `cache:clear`, `storage:link`, `key:generate`, `event:list`, `log:clear` |
 
-`kreftjs dev --seed` seeds a brand-new database the first time. `kreftjs key:generate` writes a 256-bit `APP_KEY` into `.env` (`--show` prints it instead).
+`kreft dev --seed` seeds a brand-new database the first time. `kreft key:generate` writes a 256-bit `APP_KEY` into `.env` (`--show` prints it instead).
 
 ### Development server safety
 
-- `kreftjs dev` answers only this computer (`127.0.0.1`) and only requests whose `Host` is a local name (`localhost`, `127.0.0.1`, `::1`, `*.localhost`). This stops DNS-rebinding attacks, where a web page tries to reach your dev server through its own domain name.
+- `kreft dev` answers only this computer (`127.0.0.1`) and only requests whose `Host` is a local name (`localhost`, `127.0.0.1`, `::1`, `*.localhost`). This stops DNS-rebinding attacks, where a web page tries to reach your dev server through its own domain name.
 - To reach it through a tunnel or another name, set `KREFT_ALLOWED_HOSTS=my-tunnel.example`. To share it on your network, use `--host 0.0.0.0`.
 - Requests that change data in `--api` or `--db` mode are refused when they come from another web site (a browser `Origin` that is not local).
-- **Moving or deleting the project folder.** The operating system cannot refuse a delete, so the server says so after it happens: if the project folder is deleted or moved to the Trash while `kreftjs dev` or `kreftjs serve` runs, it stops at once with a message. Any `kreftjs` command started from a deleted folder or one in the Trash refuses to run. Stop the server with <kbd>Ctrl</kbd>+<kbd>C</kbd> before you move or delete a project.
+- **Moving or deleting the project folder.** The operating system cannot refuse a delete, so the server says so after it happens: if the project folder is deleted or moved to the Trash while `kreft dev` or `kreft serve` runs, it stops at once with a message. Any `kreftjs` command started from a deleted folder or one in the Trash refuses to run. Stop the server with <kbd>Ctrl</kbd>+<kbd>C</kbd> before you move or delete a project.
 
 ## Developer tools
 
 Everything here comes with Kreft. Nothing else to install.
 
-**Hot reload.** While `kreftjs dev` runs, save a `.kreftjs` file and only that component is swapped; its state stays. A `.css` file is reloaded without a page refresh, and an error shows an overlay with the file and line.
+**Hot reload.** While `kreft dev` runs, save a `.kreftjs` file and only that component is swapped; its state stays. A `.css` file is reloaded without a page refresh, and an error shows an overlay with the file and line.
 
 **Kreft DevTools.** The **S** button in the corner (or <kbd>Alt</kbd>+<kbd>Shift</kbd>+<kbd>D</kbd>) opens a panel:
 
@@ -1669,9 +1686,9 @@ Everything here comes with Kreft. Nothing else to install.
 | Route | The current route and every route, with a button to go there. |
 | Timeline | Store actions and bus messages as they happen. |
 
-The button and the panel only exist under `kreftjs dev`; built apps never include them.
+The button and the panel only exist under `kreft dev`; built apps never include them.
 
-**Types.** `kreftjs.d.ts` describes everything in `Kreft`, so TypeScript and your editor know it. `kreftjs new` copies it into new projects, and `kreftjs update --core` refreshes it.
+**Types.** `kreftjs.d.ts` describes everything in `Kreft`, so TypeScript and your editor know it. `kreft new` copies it into new projects, and `kreft update --core` refreshes it.
 
 ### Error monitor
 
@@ -1679,7 +1696,7 @@ In development, an uncaught error on the server shows an interactive page instea
 
 - A stack explorer that hides vendor frames and highlights yours.
 - A source preview around the failing line.
-- A suggestion engine for common mistakes (a method typo on a model, reading a property of `undefined`, a missing table that needs `kreftjs migrate`).
+- A suggestion engine for common mistakes (a method typo on a model, reading a property of `undefined`, a missing table that needs `kreft migrate`).
 - The request: method, URL, route and query values, body, headers and client address. Passwords, tokens, cookies and CSRF values are masked.
 - Copy the error as Markdown for an issue, or as JSON.
 
@@ -1698,11 +1715,11 @@ state caught = null
 
 ## Build and deploy
 
-`kreftjs build` compiles your app ahead of time:
+`kreft build` compiles your app ahead of time:
 
 ```bash
-npm run build      # or: kreftjs build
-npm run preview    # check the result: kreftjs dev dist
+npm run build      # or: kreft build
+npm run preview    # check the result: kreft dev dist
 ```
 
 | File | What it is |
@@ -1720,21 +1737,21 @@ What you get:
 - **A strict Content-Security-Policy works.** Every expression becomes a real function, so the built app never uses `eval` or `new Function`.
 - **Errors before you deploy.** A mistake in any `.kreftjs` file stops the build and names the file and line.
 
-Options: `kreftjs build ./site --out public` builds another folder, and `--base /` changes `<base href>`. Upload the output folder to any static host.
+Options: `kreft build ./site --out public` builds another folder, and `--base /` changes `<base href>`. Upload the output folder to any static host.
 
 ### Ready HTML for every page: `--prerender`
 
 ```bash
 npm i -D jsdom                              # once per project
-kreftjs build --prerender                       # every route without :params
-kreftjs build --prerender /users/1,/users/2     # and these addresses too
+kreft build --prerender                       # every route without :params
+kreft build --prerender /users/1,/users/2     # and these addresses too
 ```
 
 Each page is opened in a simulated browser, its data loaded, and the result saved as `dist/<page>/index.html`, so visitors and search engines get finished HTML.
 
 The tags a page sets with `.seo({...})` or `meta` (description, canonical, Open Graph, Twitter, `hreflang`, JSON-LD, `lang` and `dir`) are saved in the page's HTML too, so link previews and crawlers that don't run JavaScript see them. A canonical written in `index.html` is kept for the home page only. A page where the app shows its error page is skipped.
 
-Pages that come from your data (`/posts/:slug`) need their addresses: `kreftjs build --prerender --urls urls.js`. The file is `urls.json` (a list), `urls.txt` (one address per line), or `urls.js` (a list, or an async function that returns it).
+Pages that come from your data (`/posts/:slug`) need their addresses: `kreft build --prerender --urls urls.js`. The file is `urls.json` (a list), `urls.txt` (one address per line), or `urls.js` (a list, or an async function that returns it).
 
 ### SEO for pages from your database: `backend/routes/seo.js`
 
@@ -1757,32 +1774,32 @@ module.exports = {
       alternates: { en: `https://example.com/posts/${slug}`, ar: `https://example.com/ar/posts/${slug}` },
     }
   },
-  // the addresses of your data pages, for `kreftjs sitemap`: '/path' or { path, lastmod }
+  // the addresses of your data pages, for `kreft sitemap`: '/path' or { path, lastmod }
   urls: async () => (await Post.all()).map((p) => ({ path: '/posts/' + p.slug, lastmod: p.updated_at })),
 }
 ```
 
-`kreftjs dev` and `kreftjs serve` answer a page request with `index.html` plus the tags of the first matching address (`:param` and a trailing `/*` work). Set `APP_URL` and each page also gets its `canonical`. An address that isn't listed is the normal page. The browser keeps these tags until the first navigation, then the router's own tags take over.
+`kreft dev` and `kreft serve` answer a page request with `index.html` plus the tags of the first matching address (`:param` and a trailing `/*` work). Set `APP_URL` and each page also gets its `canonical`. An address that isn't listed is the normal page. The browser keeps these tags until the first navigation, then the router's own tags take over.
 
 ### Whole pages for crawlers
 
-A crawler or link preview (Googlebot, Bingbot, WhatsApp, Facebook, X, Slack, Telegram …) that doesn't run JavaScript would see an empty `<div id="app">`. For these visitors `kreftjs dev` and `kreftjs serve` open the page in the same simulated browser as `--prerender`, wait until its data has loaded, and answer with the page already drawn. If the app shows its `errors/404.kreftjs` page, the answer has status 404. A page that `kreftjs build --prerender` already drew is sent as it is. Everyone else gets the normal page.
+A crawler or link preview (Googlebot, Bingbot, WhatsApp, Facebook, X, Slack, Telegram …) that doesn't run JavaScript would see an empty `<div id="app">`. For these visitors `kreft dev` and `kreft serve` open the page in the same simulated browser as `--prerender`, wait until its data has loaded, and answer with the page already drawn. If the app shows its `errors/404.kreftjs` page, the answer has status 404. A page that `kreft build --prerender` already drew is sent as it is. Everyone else gets the normal page.
 
 ```bash
 npm i -D jsdom        # once per project
 KREFT_SSR=bots          # default: crawlers and link previews only
 KREFT_SSR=all           # every visitor
 KREFT_SSR=off           # never
-KREFT_SSR_TTL=300       # seconds a drawn page is kept (kreftjs dev never keeps them)
+KREFT_SSR_TTL=300       # seconds a drawn page is kept (kreft dev never keeps them)
 ```
 
 At most two pages are drawn at a time; the other crawlers wait for their turn (up to 15 seconds, 20 at once), and the same address asked twice is drawn once. A page that takes longer than 15 seconds, fails, or is not a page of the app is not tried again for 30 seconds, and the normal page is sent meanwhile, as it is when jsdom is missing. The query string is part of the address (`/search?q=sofa` is its own page). Images, styles and fonts from other sites are not downloaded while drawing, scripts are. Responses carry `Vary: User-Agent` and the same security headers as every other page. The simulated browser introduces itself with a secret `User-Agent` that changes on every start, so it is never drawn again.
 
-### Sitemap and robots.txt: `kreftjs sitemap`
+### Sitemap and robots.txt: `kreft sitemap`
 
 ```bash
-kreftjs sitemap --url https://example.com                  # public/sitemap.xml and public/robots.txt
-kreftjs sitemap --url https://example.com --urls urls.js   # and the addresses in that file
+kreft sitemap --url https://example.com                  # public/sitemap.xml and public/robots.txt
+kreft sitemap --url https://example.com --urls urls.js   # and the addresses in that file
 ```
 
 It lists the routes of `Kreftjs.router({ routes })` in `index.html` and `routes/web.kreftjs`, skipping redirects and patterns like `/posts/:id`, plus the `urls` of `backend/routes/seo.js` and `--urls`. A `lastmod` is written only when you give one (a database date such as `2026-01-02 10:00:00` becomes `2026-01-02`). A route can list `alternates: { en: '/about', ar: '/ar/about' }` for `xhtml:link` entries.
@@ -1790,7 +1807,7 @@ It lists the routes of `Kreftjs.router({ routes })` in `index.html` and `routes/
 ### Deploying the backend
 
 ```bash
-NODE_ENV=production kreftjs serve dist
+NODE_ENV=production kreft serve dist
 ```
 
 Before you do, work through the [Production checklist](#production-checklist).
@@ -1800,7 +1817,7 @@ Before you do, work through the [Production checklist](#production-checklist).
 TypeScript works in the browser (`.kreftjs` files and `.ts` modules) and on the server (`routes/api.ts`, `app/**/*.ts`, migrations, seeders).
 
 ```bash
-kreftjs new my-app --ts
+kreft new my-app --ts
 ```
 
 Inside a `.kreftjs` file you can write `interface`, `type`, `enum`, `import type`, and typed `prop`, `state`, `derive` and `saved`. `kreftjs make:*` writes `.ts` files when the project has a `tsconfig.json` (or with `--ts`; `--js` forces JavaScript).
@@ -1815,10 +1832,10 @@ Execution needs no setup: Kreft uses `esbuild` if installed, otherwise Node's bu
 **Vite.** If your team prefers the Vite ecosystem, Kreft has a plugin that compiles `.kreftjs` files on the fly:
 
 ```bash
-kreftjs vite:init       # writes vite.config.js with the Kreft plugin
-kreftjs vite:dev        # Vite dev server with the backend API proxied
-kreftjs vite:build      # optimised bundle with code splitting
-kreftjs vite:preview
+kreft vite:init       # writes vite.config.js with the Kreft plugin
+kreft vite:dev        # Vite dev server with the backend API proxied
+kreft vite:build      # optimised bundle with code splitting
+kreft vite:preview
 ```
 
 **Electron.** Turn the same app into a desktop application. See [Desktop apps with Electron](#desktop-apps-with-electron) below.
@@ -1830,16 +1847,16 @@ Kreft can package your app as a desktop application for Windows, macOS and Linux
 ### Quick start
 
 ```bash
-kreftjs new my-app --electron   # a new app with desktop support
+kreft new my-app --electron   # a new app with desktop support
 cd my-app && npm install
-kreftjs electron:dev            # dev server plus a desktop window, with hot reload
-kreftjs electron:build          # an installer in dist-electron/
+kreft electron:dev            # dev server plus a desktop window, with hot reload
+kreft electron:build          # an installer in dist-electron/
 ```
 
 Add desktop support to an existing app instead:
 
 ```bash
-kreftjs electron:init           # alias: kreftjs make:electron
+kreft electron:init           # alias: kreft make:electron
 npm install                     # installs electron and electron-builder
 ```
 
@@ -1847,11 +1864,11 @@ npm install                     # installs electron and electron-builder
 
 | Command | What it does |
 |---|---|
-| `kreftjs electron:init` | Writes `electron/main.js` and `electron/preload.js` and adds the scripts, the `electron` and `electron-builder` dev dependencies and a `build` block to `package.json`. Files that already exist are never overwritten. It also removes the Google Fonts links from `index.html`, so the app starts without a network. |
-| `kreftjs electron:dev` | Starts `kreftjs dev` and opens a window on it. Closing the window stops the server. Flags after the command go to the dev server. |
-| `kreftjs electron:build` | Runs `kreftjs build --base ./`, then `electron-builder`. |
+| `kreft electron:init` | Writes `electron/main.js` and `electron/preload.js` and adds the scripts, the `electron` and `electron-builder` dev dependencies and a `build` block to `package.json`. Files that already exist are never overwritten. It also removes the Google Fonts links from `index.html`, so the app starts without a network. |
+| `kreft electron:dev` | Starts `kreft dev` and opens a window on it. Closing the window stops the server. Flags after the command go to the dev server. |
+| `kreft electron:build` | Runs `kreft build --base ./`, then `electron-builder`. |
 
-`kreftjs electron` is the same as `kreftjs electron:dev`. If the `electron/` folder is missing, both commands create it first.
+`kreft electron` is the same as `kreft electron:dev`. If the `electron/` folder is missing, both commands create it first.
 
 ### Project layout
 
@@ -1868,7 +1885,7 @@ my-app/
 ### How it runs
 
 - **Development.** The window loads `http://localhost:8000` (change it with `PORT`). Hot reload, the DevTools button and the error overlay work as in the browser.
-- **Packaged.** The window loads `dist/index.html` from disk. That is a static build, so the Kreft backend (`routes/`, the database, `kreftjs serve`) is **not** inside the app. Point the API client at a server you host:
+- **Packaged.** The window loads `dist/index.html` from disk. That is a static build, so the Kreft backend (`routes/`, the database, `kreft serve`) is **not** inside the app. Point the API client at a server you host:
 
 ```js
 const api = Kreftjs.api.create({ base: 'https://api.example.com' })
@@ -1927,10 +1944,10 @@ Expose one narrow function per task. Never pass a path or a command from a page
 They are hidden by default. Open them with a flag or an environment variable:
 
 ```bash
-kreftjs electron:dev --devtools          # right side
-kreftjs electron:dev --devtools=bottom   # bottom, left or detach
-kreftjs electron:dev --no-devtools
-ELECTRON_DEVTOOLS=bottom kreftjs electron:dev
+kreft electron:dev --devtools          # right side
+kreft electron:dev --devtools=bottom   # bottom, left or detach
+kreft electron:dev --no-devtools
+ELECTRON_DEVTOOLS=bottom kreft electron:dev
 ```
 
 In development, F12 or Ctrl+Shift+I toggles them.
@@ -1962,23 +1979,23 @@ Do not turn these off to make something work. Add a bridge function instead.
 
 | Problem | Fix |
 |---|---|
-| `Electron is not installed locally` | `kreftjs add -D electron` |
-| `electron-builder is not installed` | `kreftjs add -D electron-builder` |
+| `Electron is not installed locally` | `kreft add -D electron` |
+| `electron-builder is not installed` | `kreft add -D electron-builder` |
 | A white window in the packaged app | Run `electron:build` again; the build must use `--base ./`. Check that `dist/index.html` exists. |
 | API calls fail in the packaged app | The backend is not bundled. Set an absolute `base` for the API client (see above). |
 | The window opens before the server is ready | It waits up to 15 seconds. Check the terminal for a dev server error. |
-| Port 8000 is taken | Run with `PORT=3000 kreftjs electron:dev`. |
+| Port 8000 is taken | Run with `PORT=3000 kreft electron:dev`. |
 
 ## Packages
 
-`kreftjs add` is a safer `npm install`:
+`kreft add` is a safer `npm install`:
 
 ```bash
-kreftjs add pg mysql2                 # install packages
-kreftjs add -D vitest                 # a development dependency
-kreftjs add --dry-run some-package    # inspect without installing
-kreftjs add --allow-scripts better-sqlite3   # allow build scripts for a trusted native package
-kreftjs add --force dotenv            # ignore a warning
+kreft add pg mysql2                 # install packages
+kreft add -D vitest                 # a development dependency
+kreft add --dry-run some-package    # inspect without installing
+kreft add --allow-scripts better-sqlite3   # allow build scripts for a trusted native package
+kreft add --force dotenv            # ignore a warning
 ```
 
 What it checks before and after installing:
@@ -2005,7 +2022,7 @@ Kreft includes a Model Context Protocol server, so an AI coding agent can see yo
 ### Local use (stdio)
 
 ```bash
-kreftjs mcp
+kreft mcp
 ```
 
 ```json
@@ -2018,7 +2035,7 @@ kreftjs mcp
 
 ### Over HTTP
 
-`kreftjs dev` and `kreftjs serve` also answer at `/mcp`. Set a token and send it:
+`kreft dev` and `kreft serve` also answer at `/mcp`. Set a token and send it:
 
 ```env
 MCP_TOKEN=a-long-random-secret
@@ -2053,7 +2070,7 @@ Kreft is built so the safe thing is the default. This chapter lists what is prot
 
 - **Escaped views.** Everything in `{ }`, `k-text` and attributes is shown as text. `<script>` in a user's bio is only text.
 - **`k-html` is cleaned**, not trusted. Kreft parses the HTML the way the browser does, in a document that runs nothing, then removes scripts, frames, forms, SVG and MathML, every `on…` attribute, `srcdoc`, and addresses that start with `javascript:` or an unsafe `data:`. Even so, bind only HTML you trust or that the server already cleaned.
-- **A strict Content-Security-Policy works** with built apps. `kreftjs build` turns every expression into a function ahead of time, so there is no `eval` and no `new Function`. Without a build, views compile in the browser and a strict CSP blocks that.
+- **A strict Content-Security-Policy works** with built apps. `kreft build` turns every expression into a function ahead of time, so there is no `eval` and no `new Function`. Without a build, views compile in the browser and a strict CSP blocks that.
 - **Prototype pollution is blocked.** Paths and keys such as `__proto__`, `constructor` and `prototype` are ignored in views, translations and JSON bodies.
 - **A login cookie is HttpOnly**, so a script on your page cannot read it.
 
@@ -2115,18 +2132,18 @@ Files get random names. Unknown extensions are stored as `.bin`. Public files ar
 #### The database
 
 - Values travel as parameters. Table and column names are quoted.
-- The automatic table API (`--db`) is a development tool with no login. `kreftjs serve` only serves the tables you list in `kreftjs.config.json`, with `write: false` and `hidden: [...]` where needed; hidden columns cannot be read or used to sort.
+- The automatic table API (`--db`) is a development tool with no login. `kreft serve` only serves the tables you list in `kreftjs.config.json`, with `write: false` and `hidden: [...]` where needed; hidden columns cannot be read or used to sort.
 - Raw SQL helpers (`whereRaw`, `selectRaw`, `orderByRaw`, `DB.raw`) are for your own SQL; pass user values in their parameter array.
 
 #### Packages
 
-`kreftjs add` blocks install scripts, typosquats and look-alike names, flags very new packages, and pins exact versions. See [Packages](#packages).
+`kreft add` blocks install scripts, typosquats and look-alike names, flags very new packages, and pins exact versions. See [Packages](#packages).
 
 ### What stays your job
 
 - **Check access on the server.** Client route guards decide what to show, not who may read data. Every route that returns private data needs `auth` and, where it matters, `admin` or a policy.
 - **Never trust HTML you did not clean**, and never put secrets in `PUBLIC_` variables or localStorage.
-- **Keep dependencies and Node.js up to date** (`kreftjs update`, `npm audit`).
+- **Keep dependencies and Node.js up to date** (`kreft update`, `npm audit`).
 - **Protect the machine.** Kreft cannot protect a database, a server or a `.env` file that others can read.
 
 ## Production checklist
@@ -2137,24 +2154,24 @@ Go through this before your first real user:
 |---|---|
 | `NODE_ENV=production` and `APP_ENV=production` | Turns off debug pages, enables HSTS and the https redirect, and makes security errors fatal. |
 | `APP_DEBUG=false` | Never show stack traces or source code to visitors. |
-| `APP_KEY` set to a 32-byte key (`kreftjs key:generate`) | In production the app refuses to start without a key of at least 16 bytes. A random per-process key would also break sessions on restart. |
+| `APP_KEY` set to a 32-byte key (`kreft key:generate`) | In production the app refuses to start without a key of at least 16 bytes. A random per-process key would also break sessions on restart. |
 | `APP_URL=https://your.site` | Used for links in emails, the https redirect and secure cookies. |
 | `TRUSTED_PROXIES` set if you use a proxy | Otherwise every visitor shares the proxy's address and rate limits. |
 | A real `DATABASE_URL` and a backup plan | SQLite is fine for small apps; use MySQL or PostgreSQL for several servers. |
 | `CACHE_STORE=redis` or `database`, `QUEUE_CONNECTION=redis` or `database` | `memory` is per process. Account lockouts live in the cache, so they are shared between servers only with `database` or `redis`. |
 | `MAIL_URL` set | Otherwise emails are only printed in the terminal. |
 | `MCP_TOKEN` set, or MCP left off | The MCP endpoint is disabled in production without it. |
-| Tables listed in `kreftjs.config.json`, or no `--db` at all | `kreftjs serve` serves only the tables you list. |
+| Tables listed in `kreftjs.config.json`, or no `--db` at all | `kreft serve` serves only the tables you list. |
 | No test user | Do not run `--seed` against production; delete `test@example.com` if it exists. |
 | HTTPS in front of the app | Cookies are `Secure` in production and on `https` URLs. |
-| `npm audit` and `kreftjs update` | Fix known vulnerabilities before release. |
+| `npm audit` and `kreft update` | Fix known vulnerabilities before release. |
 
 > [!NOTE]
 > Kreft does not replace a security review. For regulated or high-risk systems, have the app, its infrastructure and its dependencies reviewed by someone who does that professionally.
 
 ## Known limits
 
-- Without a build, views are compiled in the browser with `new Function`, which a strict Content-Security-Policy blocks. Use `kreftjs build` for production.
+- Without a build, views are compiled in the browser with `new Function`, which a strict Content-Security-Policy blocks. Use `kreft build` for production.
 - Inside a view, `<` directly followed by a letter starts a tag, so write `{a < b}` with a space.
 - The memory of which two-factor codes were already used, and login tickets, is kept per process. Behind several servers, a code can be replayed once on each. The per-account lockout (kept in the cache) still limits guessing.
 - The sanitizer removes unsafe markup; it is not a substitute for choosing carefully what HTML you show.
@@ -2174,9 +2191,9 @@ Set these in `.env` (never commit it). Variables that start with `PUBLIC_` are c
 | `APP_NAME`, `APP_URL` | Name and public address (used in emails, https redirects, secure cookies). |
 | `APP_ENV`, `NODE_ENV` | `production` turns on production behaviour (either one is enough). |
 | `APP_DEBUG` | `true` shows the interactive error page outside production. |
-| `APP_KEY` | Encrypts sessions and signs links. Make it with `kreftjs key:generate`; required in production. |
+| `APP_KEY` | Encrypts sessions and signs links. Make it with `kreft key:generate`; required in production. |
 | `APP_LOCALE`, `APP_FALLBACK_LOCALE`, `APP_TIMEZONE` | Language and time zone defaults. |
-| `HOST`, `PORT` | Where `kreftjs serve` listens. |
+| `HOST`, `PORT` | Where `kreft serve` listens. |
 | `FORCE_HTTPS` | `true` redirects plain HTTP in production. |
 | `MAX_BODY_KB` | Largest request body accepted. |
 
@@ -2189,7 +2206,7 @@ Set these in `.env` (never commit it). Variables that start with `PUBLIC_` are c
 | `CACHE_STORE` | `database`, `file`, `memory` or `redis`. Also `CACHE_PREFIX`, `CACHE_DEFAULT_TTL`. |
 | `QUEUE_CONNECTION` | `database`, `redis` or `sync`. Also `QUEUE_NAMES`, `QUEUE_WORKER`. |
 | `REDIS_URL`, or `REDIS_HOST` `REDIS_PORT` `REDIS_USERNAME` `REDIS_PASSWORD` `REDIS_DB` `REDIS_TLS` `REDIS_PREFIX` | Redis connection. |
-| `SCHEDULER` | `off` hands scheduling to cron (`kreftjs schedule:run`). |
+| `SCHEDULER` | `off` hands scheduling to cron (`kreft schedule:run`). |
 | `MAX_QUERY_ROWS`, `HARD_QUERY_LIMIT` | Upper limits on rows a query may return. |
 | `FILESYSTEM_DISK` | `local` or `public`. |
 
@@ -2211,9 +2228,9 @@ Set these in `.env` (never commit it). Variables that start with `PUBLIC_` are c
 | Variable | Meaning |
 |---|---|
 | `TRUSTED_PROXIES`, `TRUSTED_PROXY_HOPS` | Which proxies' `X-Forwarded-For` is believed, and how many stand in front with `*`. |
-| `KREFT_ALLOWED_HOSTS` | Extra host names `kreftjs dev` answers to. |
+| `KREFT_ALLOWED_HOSTS` | Extra host names `kreft dev` answers to. |
 | `MCP_TOKEN`, `MCP_ALLOWED_ORIGIN`, `MCP_QUERY_TIMEOUT_MS` | MCP endpoint token, one extra allowed browser origin, and the query time limit. |
-| `MAIL_URL`, `MAIL_FROM` | `smtp://user:password@host:587` sends real email (needs `kreftjs add nodemailer`). |
+| `MAIL_URL`, `MAIL_FROM` | `smtp://user:password@host:587` sends real email (needs `kreft add nodemailer`). |
 | `LOG_LEVEL`, `LOG_CHANNEL` | `debug`, `info`, `notice`, `warning`, `error`, `critical`. |
 | `AUTO_GC`, `AUTO_GC_THRESHOLD_MB`, `AUTO_GC_INTERVAL_MS` | The memory watchdog. |
 
@@ -2282,8 +2299,8 @@ Kreft is one framework for the browser and the server. The others below each cov
 | `<Transition>` | `k-animate="fade"` |
 | Vue Router with nested routes | `Kreftjs.router()`, `<kreft-view>`, `<kreft-link>`, `children` |
 | Pinia | `Kreftjs.store()` + `use`, with `{ saved: true }` |
-| Vite dev server | `kreftjs dev` (or `kreftjs vite:dev`) |
-| Nuxt static generation | `kreftjs build --prerender` |
+| Vite dev server | `kreft dev` (or `kreft vite:dev`) |
+| Nuxt static generation | `kreft build --prerender` |
 | Nuxt `server/api` | `server/*.js` served at `/api/*` |
 
 ## Glossary