ninepm 0.64.0 → 0.68.0

package/README.md

@@ -106,7 +106,7 @@ Deploy a first-class Worker runtime app:
 
 The `--runtime worker` entry must be a bundled fetch-compatible JavaScript module with a default export. With `--with-db`, the app receives `env.DB` and should use SQLite-compatible prepared statements.
 
-Choose which files are public with `--assets <dir>`: only the files under that directory are served, from the app's root (`public/index.html` answers on `/`), and nothing else in the deploy directory is uploaded. Use `--no-assets` when the entry serves every response itself. The app remembers the choice, so later deploys need not repeat the flag; pass the other flag, or another directory, to change it — there is no way back to publishing everything. A worker app that has never chosen serves **every file in the deploy directory except the entry** publicly, server helpers and leftovers like `index.js.orig` included; every deploy of such an app prints a warning naming those files, and `9pm deploy --check` lists every file a deploy would make public.
+Choose which files are public with `--assets <dir>`: only the files under that directory are served, from the app's root (`public/index.html` answers on `/`), and nothing else in the deploy directory is uploaded. Use `--no-assets` when the entry serves every response itself. The app remembers the choice, so later deploys need not repeat the flag; pass the other flag, or another directory, to change it — there is no way back to publishing everything. A worker app that has never chosen serves **every file in the deploy directory except the entry** publicly, server helpers and leftovers like `index.js.orig` included; every deploy of such an app prints a warning naming those files, and `9pm deploy --check` lists every file a deploy would make public. Its summary counts the files scanned apart from the files selected for upload (the entry and the public files); `--check` itself uploads nothing.
 
 Deploy a container app from a local Docker build:
 
@@ -221,6 +221,7 @@ Options:
 - `--name <name>` sets the app display name
 - `--slug <slug>` sets the URL-safe app slug
 - `--with-db` requests managed storage for the app
+- `--with-auth` gives the app 9pm-managed end-user sign-in (email one-time codes) and implies `--with-db`. Once enabled it stays on for every later deploy of the app, with or without the flag; it can't be turned off
 - `--database-name <name>` customizes the requested database name
 - `--binding <name>` customizes the database binding name
 - `--environment <name>` sets deployment environment metadata

package/dist/index.d.ts

@@ -38,10 +38,17 @@ export interface DeployResult {
     project: Project;
     deployment: Deployment;
     database: AppDatabase | null;
+    databases: BoundDatabase[];
     uploaded: number;
     url: string;
     containerImageBytes?: number;
 }
+export interface BoundDatabase {
+    bindingName: string;
+    name: string | null;
+}
+export declare function boundDatabasesForDeployment(deployment: Deployment, provisioned: AppDatabase | null): BoundDatabase[];
+export declare function deployDatabaseClause(databases: readonly BoundDatabase[]): string | null;
 export interface ApiOptions {
     apiUrl: string;
     token: string;
@@ -117,7 +124,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.64.0";
+export declare const CLI_VERSION = "0.68.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -191,6 +198,10 @@ export interface DeployCheckResult {
         path: string;
         url: string;
     }>;
+    upload?: {
+        files: number;
+        bytes: number;
+    };
 }
 export type DetectedFramework = "nextjs" | "astro" | "sveltekit" | "vite";
 export declare function detectFramework(directory: string): DetectedFramework | null;
@@ -230,6 +241,7 @@ export declare function measureWorkerModuleFiles(root: string, modulePaths: read
     compressedBytes: number;
 }>;
 export declare function checkDeployDirectory(options: DeployOptions): Promise<DeployCheckResult>;
+export declare function deployCheckSummary(check: DeployCheckResult, publicAssets: string | undefined): string;
 export declare function whoami(options: ApiOptions): Promise<WhoamiResult>;
 export declare function publicWhoamiResult(result: WhoamiResult): PublicWhoamiResult;
 export type CredentialRevocation = {
@@ -334,12 +346,19 @@ export declare function listSites(options: ApiOptions & {
 export declare function deleteSite(options: DeleteSiteOptions): Promise<DeletedSiteResult>;
 export interface DeviceAuthFeedbackOptions {
     progressStream?: NodeJS.WriteStream;
-    openBrowserFn?: (url: string) => BrowserOpenResult;
+    openBrowserFn?: (url: string) => BrowserOpenResult | Promise<BrowserOpenResult>;
     storeCredentialFn?: (token: string, options: {
         allowFileFallback?: boolean | undefined;
         apiUrl?: string | undefined;
     }) => string;
+    inputStream?: NodeJS.ReadStream;
+    signalTarget?: Pick<NodeJS.EventEmitter, "once" | "removeListener">;
+}
+export declare class DeviceAuthCancelledError extends Error {
+    readonly purpose: "login" | "signup";
+    constructor(purpose: "login" | "signup");
 }
+export declare const CANCELLED_EXIT_CODE = 130;
 export type ReplacedCredential = {
     kind: "revoked";
     apiUrl: string;
@@ -453,9 +472,12 @@ export interface UploadProgressReporter {
 export declare function createUploadProgressReporter(stream?: NodeJS.WriteStream): UploadProgressReporter;
 export interface DeviceAuthProgressReporter {
     tick(remainingMs: number): void;
+    note(line: string): void;
     stop(): void;
 }
-export declare function createDeviceAuthProgressReporter(stream?: NodeJS.WriteStream): DeviceAuthProgressReporter;
+export declare function createDeviceAuthProgressReporter(stream?: NodeJS.WriteStream, options?: {
+    hint?: string;
+}): DeviceAuthProgressReporter;
 export declare function noteCliOutdatedAdvisory(response: Response, log?: (line: string) => void): void;
 export declare function resetCliOutdatedAdvisoryForTests(): void;
 export declare function dashboardUrlForApiUrl(apiUrl: string): string;

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
 // Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
@@ -16,7 +16,40 @@ import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WOR
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { NO_PUBLIC_ASSETS, normalizeAssetsDirectory, privateLookingPaths, publicAssetPath } from "./public-assets.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.64.0";
+// What the deployment binds, read from the deployment the server returned (#1949). The
+// server binds every provisioned database of the app on each publish whatever flags were
+// passed, so `--with-db` says nothing about the result. Only a deployment carrying no
+// `databases` record at all - the local mock target, or a server that predates recording
+// it for this runtime - falls back to what this run itself provisioned.
+export function boundDatabasesForDeployment(deployment, provisioned) {
+    const recorded = deployment.metadata["databases"];
+    if (!Array.isArray(recorded)) {
+        return provisioned ? [{ bindingName: provisioned.bindingName, name: provisioned.name }] : [];
+    }
+    const bound = [];
+    for (const entry of recorded) {
+        if (!entry || typeof entry !== "object") {
+            continue;
+        }
+        const record = entry;
+        if (typeof record["bindingName"] !== "string") {
+            continue;
+        }
+        const name = typeof record["name"] === "string" ? record["name"] : provisioned && record["id"] === provisioned.id ? provisioned.name : null;
+        bound.push({ bindingName: record["bindingName"], name });
+    }
+    return bound;
+}
+// The database clause of the deploy summary, or null when nothing is bound - the summary
+// then says nothing about a database rather than "no database".
+export function deployDatabaseClause(databases) {
+    if (databases.length === 0) {
+        return null;
+    }
+    const listed = databases.map((database) => (database.name ? `${database.bindingName}:${database.name}` : database.bindingName)).join(", ");
+    return `${databases.length === 1 ? "database" : "databases"} ${listed}`;
+}
+export const CLI_VERSION = "0.68.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -442,6 +475,7 @@ async function runDeploy(initialOptions, slugHolder) {
                 project,
                 deployment: finalized,
                 database,
+                databases: boundDatabasesForDeployment(finalized, database),
                 uploaded: 1,
                 url: finalized.url,
                 containerImageBytes: image.size,
@@ -637,6 +671,7 @@ async function runDeploy(initialOptions, slugHolder) {
         project,
         deployment: finalized,
         database,
+        databases: boundDatabasesForDeployment(finalized, database),
         uploaded,
         url: finalized.url,
     };
@@ -812,9 +847,12 @@ export async function checkDeployDirectory(options) {
     // #1847: `--check` has no project, so it cannot see a choice made on an earlier deploy;
     // it reports what this invocation's flags would publish, and says so for the legacy case.
     let publicFiles;
+    let upload;
     if (serverEntry) {
         const selection = options.publicAssets ?? null;
         publicFiles = workerPublicFiles(manifest.map((file) => file.path), serverEntry, selection);
+        const selected = uploadedFiles(manifest, serverEntry, selection);
+        upload = { files: selected.length, bytes: selected.reduce((sum, file) => sum + file.size, 0) };
         if (selection !== null && selection !== NO_PUBLIC_ASSETS && publicFiles.length === 0) {
             errors.push(missingAssetsDirectoryMessage(selection));
         }
@@ -847,8 +885,26 @@ export async function checkDeployDirectory(options) {
         bytes: totalBytes,
         ...(serverCode ? { serverCode } : {}),
         ...(publicFiles ? { publicFiles } : {}),
+        ...(upload ? { upload } : {}),
     };
 }
+// The `--check` success line. Static and bundle deploys upload every file they scan, so one
+// count is the whole story there. An entry-based worker deploy uploads only the entry and
+// its public files, so it reports both counts; with no --assets/--no-assets, a choice the
+// app saved on an earlier deploy applies on the server, which a local check cannot see.
+export function deployCheckSummary(check, publicAssets) {
+    if (!check.upload) {
+        return `Deploy check passed: ${check.files} file(s), ${check.bytes} byte(s).`;
+    }
+    const publicCount = check.publicFiles?.length ?? 0;
+    const breakdown = publicAssets === NO_PUBLIC_ASSETS ? "the entry only" : `the entry + ${publicCount} public file(s)`;
+    const summary = `Deploy check passed: ${check.files} file(s) scanned, ${check.upload.files} selected for upload (${breakdown}), ` +
+        `${check.upload.bytes.toLocaleString("en-US")} byte(s) selected.`;
+    if (publicAssets !== undefined) {
+        return summary;
+    }
+    return `${summary}\n  Counted from the flags supplied (no --assets or --no-assets). If this app saved a public-assets choice on an earlier deploy, that choice applies on deploy and only the entry and the files it makes public are uploaded.`;
+}
 export async function whoami(options) {
     return apiRequest(options, "/v1/me", { method: "GET" });
 }
@@ -1332,6 +1388,21 @@ export async function deleteSite(options) {
     });
     return payload.deleted;
 }
+// Thrown out of the device flow when the person pressed Ctrl-C while it waited
+// (#1902). It travels to main() like any other failure, so every `finally` on the
+// way has already run when the process sets its exit code; exiting from inside the
+// signal handler would skip them and leave stdin holding the process open.
+export class DeviceAuthCancelledError extends Error {
+    purpose;
+    constructor(purpose) {
+        super(`Cancelled. Run "9pm ${purpose}" to start again.`);
+        this.name = "DeviceAuthCancelledError";
+        this.purpose = purpose;
+    }
+}
+// The exit status of a command the person interrupted: 128 + SIGINT, which is what
+// a shell reports for one, so a script can tell a cancel from a failure.
+export const CANCELLED_EXIT_CODE = 130;
 export async function loginDevice(options) {
     return deviceAuthFlow({ ...options, purpose: "login" });
 }
@@ -1390,7 +1461,7 @@ async function deviceAuthFlow(options) {
     // lines above plus the caller's unchanged result line, so anything already
     // reading it is unaffected.
     const progressStream = options.progressStream ?? process.stderr;
-    const browser = (options.openBrowserFn ?? openBrowser)(start.verification_uri);
+    const browser = await (options.openBrowserFn ?? openBrowser)(start.verification_uri);
     if (browser === "failed") {
         // Say it the moment it happens. A swallowed browser failure used to look
         // exactly like a flow nobody had approved yet.
@@ -1402,16 +1473,83 @@ async function deviceAuthFlow(options) {
     progressStream.write("Open the URL above in any browser — on this machine or another — to approve this device.\n");
     const deadline = Date.now() + start.expires_in * 1000;
     const intervalMs = Math.max(1, start.interval ?? 2) * 1000;
+    // #1902: the way out of the wait, said on the line itself. Enter is offered only
+    // when it works - stdin a terminal to read it from, stderr a terminal to answer on
+    // - and is read in the terminal's normal line mode, so no terminal setting changes
+    // and Ctrl-C stays the terminal's own signal.
+    const input = options.inputStream ?? process.stdin;
+    const signals = options.signalTarget ?? process;
+    const interactive = input.isTTY === true && progressStream.isTTY === true;
+    let finished = false;
+    let cancelled = false;
+    let wake;
+    // One reopen at a time: presses made while a launch is still running are
+    // ignored rather than queued into more tabs.
+    let reopening = false;
+    // Registered with `once`: a second Ctrl-C finds no listener and gets Node's
+    // default, which ends the process at once. That is the escape hatch for a poll
+    // request that never answers, since the first press waits for it (below).
+    const onSigint = () => {
+        cancelled = true;
+        wake?.();
+    };
+    const onInput = (chunk) => {
+        if (finished || cancelled || !/[\r\n]/.test(String(chunk)))
+            return;
+        // Every Enter echoes a newline that moves the cursor below the spinner line,
+        // ignored presses included; step back up and clear it so the next redraw lands
+        // where the line was instead of stranding a copy above it.
+        progressStream.write("\x1b[1A\r\x1b[K");
+        if (reopening)
+            return;
+        reopening = true;
+        // Asynchronous and bounded (openBrowserAsync), so a slow launcher stalls
+        // neither the polling nor Ctrl-C while it runs.
+        void Promise.resolve()
+            .then(() => (options.openBrowserFn ?? openBrowserAsync)(start.verification_uri))
+            .catch(() => "failed")
+            .then((reopened) => {
+            reopening = false;
+            if (finished)
+                return;
+            progress.note(reopened === "opened"
+                ? "Opened the page again."
+                : reopened === "failed"
+                    ? "Could not open a browser — use the URL above."
+                    : // "unknown": the launcher ran, but nothing says a page appeared.
+                        "Asked the system to open the page again. If it did not appear, use the URL above.");
+        });
+    };
     // stop() in a finally so no outcome — approval, denial, network throw,
-    // expiry — can leave the spinner timer alive or the line half-drawn.
-    const progress = createDeviceAuthProgressReporter(progressStream);
+    // expiry, cancellation — can leave the spinner timer alive or the line half-drawn.
+    const progress = createDeviceAuthProgressReporter(progressStream, {
+        hint: interactive ? "Enter to reopen the page, Ctrl-C to cancel" : "Ctrl-C to cancel",
+    });
+    signals.once("SIGINT", onSigint);
+    if (interactive)
+        input.on("data", onInput);
     try {
         while (Date.now() < deadline) {
+            // Checked here and after the sleep, never during a poll request: once a poll
+            // is in flight the control plane may already have minted the key, and
+            // abandoning that response would leave a live key nobody holds (#859). An
+            // approval that lands in the same instant as Ctrl-C therefore completes.
+            if (cancelled)
+                throw new DeviceAuthCancelledError(options.purpose);
             // Tick before the sleep so the first feedback is immediate rather than
             // one poll interval late. Remaining time is derived from the deadline the
             // server's expires_in produced, never from a CLI-side constant.
             progress.tick(deadline - Date.now());
-            await sleep(intervalMs);
+            await new Promise((resolve) => {
+                const timer = setTimeout(resolve, intervalMs);
+                wake = () => {
+                    clearTimeout(timer);
+                    resolve();
+                };
+            });
+            wake = undefined;
+            if (cancelled)
+                throw new DeviceAuthCancelledError(options.purpose);
             const pollResponse = await fetchFn(`${apiUrl}/v1/oauth/device/poll`, {
                 method: "POST",
                 headers: { "content-type": "application/json", ...cliVersionHeader() },
@@ -1529,7 +1667,15 @@ async function deviceAuthFlow(options) {
         }
     }
     finally {
+        finished = true;
         progress.stop();
+        signals.removeListener("SIGINT", onSigint);
+        if (interactive) {
+            input.removeListener("data", onInput);
+            // Adding the listener put stdin into flowing mode; left flowing, it would
+            // hold the process open after the command is done.
+            input.pause();
+        }
     }
     // Reached only when the client's own deadline elapses without the server having
     // said anything terminal — rarer than the 410 route above, but it must say the
@@ -2117,14 +2263,26 @@ export function createUploadProgressReporter(stream = process.stderr) {
 }
 // Off-TTY ceiling: at most one line per 30s of the window (~20 lines over 600s).
 const DEVICE_AUTH_PROGRESS_LINE_INTERVAL_MS = 30_000;
-export function createDeviceAuthProgressReporter(stream = process.stderr) {
+export function createDeviceAuthProgressReporter(stream = process.stderr, options = {}) {
     const isTty = stream.isTTY === true;
     let timer;
     let frame = 0;
     let finished = false;
     let remainingMs;
     let lastLineRemainingMs;
-    const label = (ms) => `Waiting for approval… ${formatRemainingForCli(ms)} left`;
+    const base = (ms) => `Waiting for approval… ${formatRemainingForCli(ms)} left`;
+    // The hint (#1902) rides the TTY line only: off a TTY nobody is at a keyboard to
+    // act on it. It is dropped when the line would not fit, because a wrapped line
+    // defeats the `\r` redraw and the spinner would stack a copy per frame.
+    const label = (ms) => {
+        const plain = base(ms);
+        if (!isTty || !options.hint)
+            return plain;
+        const full = `${plain} — ${options.hint}`;
+        const width = typeof stream.columns === "number" ? stream.columns : 0;
+        // +2 for the spinner glyph and its space.
+        return width > 0 && full.length + 2 >= width ? plain : full;
+    };
     const redraw = () => {
         if (remainingMs === undefined)
             return;
@@ -2163,6 +2321,16 @@ export function createDeviceAuthProgressReporter(stream = process.stderr) {
             lastLineRemainingMs = nextRemainingMs;
             stream.write(`${label(nextRemainingMs)}\n`);
         },
+        note(line) {
+            if (finished)
+                return;
+            if (!isTty) {
+                stream.write(`${line}\n`);
+                return;
+            }
+            stream.write(`\r\x1b[K${line}\n`);
+            redraw();
+        },
         // Idempotent; called from a finally around the poll loop. On a TTY it erases
         // the in-place line and writes nothing in its place: unlike the upload
         // reporter this deliberately leaves no ✓/✗ summary, because the flow's own
@@ -2193,7 +2361,14 @@ function buildContainerImage(directory) {
     const tempDir = mkdtempSync(path.join(os.tmpdir(), "9pm-container-"));
     const tag = `9pm-local-${Date.now()}-${process.pid}`;
     const imagePath = path.join(tempDir, "image.tar");
-    runDocker(["build", "--platform", "linux/amd64", "-t", tag, root], "build container image");
+    // Build without Buildx's default provenance attestation. With it, Docker Desktop saves the
+    // image as an index carrying an attestation manifest, and the push to Cloudflare's registry
+    // through `wrangler containers push` fails with "blob unknown to registry"; the same image
+    // without the attestation pushes (#1906: two of two attempts each way). The environment
+    // variable rather than `--provenance=false`: it is what that test pushed, and a builder that
+    // has no attestations - the legacy non-Buildx `docker build` - ignores an unknown variable
+    // where it would reject an unknown flag. SBOM generation is untouched: it is off by default.
+    runDocker(["build", "--platform", "linux/amd64", "-t", tag, root], "build container image", { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" });
     const inspected = spawnSync("docker", ["image", "inspect", tag, "--format", "{{.Os}}/{{.Architecture}}"], { encoding: "utf8" });
     if (inspected.status !== 0) {
         throw new Error(`Failed to inspect container image: ${inspected.stderr || inspected.stdout}`.trim());
@@ -2206,8 +2381,8 @@ function buildContainerImage(directory) {
     const sha256 = createHash("sha256").update(readFileSync(imagePath)).digest("hex");
     return { tag, path: imagePath, size, sha256 };
 }
-function runDocker(args, action) {
-    const result = spawnSync("docker", args, { stdio: "inherit" });
+function runDocker(args, action, extraEnv = {}) {
+    const result = spawnSync("docker", args, { stdio: "inherit", env: { ...process.env, ...extraEnv } });
     if (result.status !== 0) {
         throw new Error(`Failed to ${action}.`);
     }
@@ -4160,6 +4335,41 @@ function openBrowser(url) {
         ...(result.error ? { error: result.error } : {}),
     });
 }
+// How long a reopen waits for the launcher to say how it went (#1902). `open` and
+// `xdg-open` hand off and return in well under a second; one still running after
+// this is left to finish on its own, and the person is pointed at the URL instead.
+const BROWSER_LAUNCH_TIMEOUT_MS = 5_000;
+// openBrowser without blocking: the reopen on Enter runs while the login waits,
+// and spawnSync there would freeze the poll loop and the Ctrl-C handler for as long
+// as the launcher took. Same platform choice and verdicts as openBrowser.
+function openBrowserAsync(url) {
+    if (hasNoGraphicalDisplay(process.platform, process.env)) {
+        return Promise.resolve("failed");
+    }
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    return new Promise((resolve) => {
+        let settled = false;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(result);
+        };
+        const child = spawn(command, args, { stdio: "ignore" });
+        // Unref'd at once, not when the wait below runs out: a launcher still running
+        // when the login ends (Ctrl-C, approval) must not keep the CLI alive behind it.
+        // Its exit event still arrives while the CLI is running for another reason.
+        child.unref();
+        // A launcher that has not answered in time may still open the page, so this
+        // is "unknown" rather than "failed".
+        const timer = setTimeout(() => settle("unknown"), BROWSER_LAUNCH_TIMEOUT_MS);
+        timer.unref();
+        child.once("error", (error) => settle(classifyBrowserOpen({ platform: process.platform, status: null, error })));
+        child.once("exit", (status) => settle(classifyBrowserOpen({ platform: process.platform, status })));
+    });
+}
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -4242,7 +4452,7 @@ async function main() {
                     console.log("Deploy check passed: Dockerfile found and Docker is available.");
                 }
                 else {
-                    console.log(`Deploy check passed: ${check.files} file(s), ${check.bytes} byte(s).`);
+                    console.log(deployCheckSummary(check, command.options.publicAssets));
                     if (check.serverCode) {
                         // The compressed server-code figure, printed on success as well as on
                         // warning/rejection, so the number the size limit is enforced on is always
@@ -4291,10 +4501,10 @@ async function main() {
                 const siteFlag = slug ? ` --site ${quoteSiteArg(slug)}` : "";
                 throw new Error(`${base}\n\nStuck? Report it with context: 9pm support${siteFlag} -m "<what happened>"`);
             }
-            const databaseLine = result.database ? `database ${result.database.bindingName}:${result.database.name}` : "no database";
+            const databaseClause = deployDatabaseClause(result.databases);
             const queued = result.deployment.status === "queued" || result.deployment.status === "publishing";
             console.log(`${queued ? "Queued" : "Deployed"} ${result.project.slug} -> ${result.url}`);
-            console.log(`Deployment ${result.deployment.id} ${result.containerImageBytes ? `uploaded ${formatBytesForCli(result.containerImageBytes)} image` : `uploaded ${result.uploaded} file(s)`}, ${databaseLine}.`);
+            console.log(`Deployment ${result.deployment.id} ${result.containerImageBytes ? `uploaded ${formatBytesForCli(result.containerImageBytes)} image` : `uploaded ${result.uploaded} file(s)`}${databaseClause ? `, ${databaseClause}` : ""}.`);
             if (queued) {
                 console.log(`Status: ${result.deployment.status}. Run 9pm apps to check when it becomes active.`);
             }
@@ -4562,6 +4772,13 @@ async function main() {
             process.exitCode = 0;
             return;
         }
+        if (error instanceof DeviceAuthCancelledError) {
+            // The person asked for this, so it is said plainly rather than reported as a
+            // failure with whatever decoration reportCliError adds.
+            console.error(error.message);
+            process.exitCode = CANCELLED_EXIT_CODE;
+            return;
+        }
         reportCliError(error);
         process.exitCode = 1;
     }
@@ -4874,7 +5091,7 @@ Container deploys:
   Requires Docker locally. The CLI builds linux/amd64, exports the image, uploads it through a short-lived session, then finalizes a queued deployment.
   The app must listen on 0.0.0.0:$PORT - always read the PORT env var; on some placements the platform holds the selected --port and hands the app a different one. Use --health-path for a cheap readiness endpoint.
   With --with-db, containers receive NINEPM_SQL_URL and NINEPM_DB_BINDINGS for the managed SQL bridge, plus NINEPM_SQL_TOKEN where that bridge requires one - send it as "Authorization: Bearer <token>" or every query is refused.
-  With --with-auth, the app gets 9pm-managed end-user accounts (email one-time codes); it implies --with-db and is one-way (enable-only).
+  With --with-auth, the app gets 9pm-managed end-user accounts (email one-time codes); it implies --with-db and is one-way: once enabled it stays on for every later deploy of the app, with or without the flag.
   With --with-email, a signed-in end user can send app invitation emails; it implies --with-auth and works on public apps only.
   9pm env set <app> KEY=value [KEY2=value2 ...] [--var]   (secret by default; --var = readable config)
   9pm env set <app> --from-file <path> [--var]            (KEY=value lines; # comments, export prefix, quotes ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.64.0",
+  "version": "0.68.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [