@kryd/cli 0.12.1 → 0.13.0

package/dist/index.js

@@ -14859,6 +14859,22 @@ function validateBuildEnvVarValue(value) {
 var BUILD_ENV_PUBLIC_WARNING = "\u26A0 Build-time values are compiled into your app's public bundle \u2014 anyone who loads your site can read them. Never put a secret here.";
 var BUILD_ENV_REBUILD_NOTE = "This takes effect at your next BUILD, not your next deploy \u2014 the value is compiled into the image, so redeploying the existing image keeps the old value. Push a commit (`kryd push`) to rebuild.";
 
+// ../../packages/shared-types/dist/tickets.js
+var TICKET_STATUSES = ["open", "waiting", "solved"];
+var TICKET_TYPES = ["question", "bug", "request"];
+function formatTicketNumber(n) {
+  return `T-${n}`;
+}
+function parseTicketNumber(raw) {
+  const m = /^(?:[tT]-?)?(\d{1,9})$/.exec(raw.trim());
+  if (!m)
+    return null;
+  const n = Number(m[1]);
+  return Number.isSafeInteger(n) && n > 0 ? n : null;
+}
+var TICKET_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+var TICKET_ATTACHMENT_MAX_SIZE_LABEL = `${TICKET_ATTACHMENT_MAX_BYTES / (1024 * 1024)} MB`;
+
 // ../../packages/shared-types/dist/workflow-run.js
 var MAX_WEBHOOK_NAME = 32;
 var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
@@ -14920,398 +14936,141 @@ import {
 import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, relative, resolve as resolve2 } from "node:path";
 import { pathToFileURL } from "node:url";
 
-// src/config.ts
-import {
-  appendFileSync,
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync
-} from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-var DEFAULT_API_URL = "http://localhost:3000";
-function configPath() {
-  const dir = process.env.KRYD_CONFIG_DIR ?? join(homedir(), ".kryd");
-  return join(dir, "config.json");
-}
-function loadConfig() {
-  let raw;
-  try {
-    raw = readFileSync(configPath(), "utf8");
-  } catch {
-    return {};
+// src/client.ts
+var ApiError = class extends Error {
+  envelope;
+  /**
+   * The HTTP status of the failed response, when it came from one (used to detect a 404 = gone).
+   *
+   * ⚠️ Still optional because an `ApiError` is also thrown for a well-formed response the CLI
+   * cannot use ("the API returned an unexpected …") and for a stream's own error frame — neither
+   * has a status. Every throw that DOES hold a `Response` now passes it (KRYD-481): the 404
+   * diagnosis keys on the status, and a third of them used to omit it, which made the same
+   * failure explainable or unexplainable depending on which verb the customer typed.
+   */
+  status;
+  constructor(message, envelope, status) {
+    super(message);
+    this.name = "ApiError";
+    this.envelope = envelope;
+    this.status = status;
   }
+};
+async function parseEnvelope(res) {
   try {
-    return JSON.parse(raw);
+    return await res.json();
   } catch {
-    process.stderr.write(
-      `warning: ${configPath()} is not valid JSON \u2014 ignoring it.
-`
-    );
-    return {};
+    return void 0;
   }
 }
-function writeConfig(config2) {
-  const path = configPath();
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
-  chmodSync(path, 384);
-}
-function saveToken(token, apiUrl) {
-  const config2 = loadConfig();
-  config2.token = token;
-  if (apiUrl) config2.apiUrl = apiUrl;
-  writeConfig(config2);
-}
-function clearToken() {
-  const config2 = loadConfig();
-  delete config2.token;
-  writeConfig(config2);
-}
-var lastApiUrl = null;
-function resolveApiUrl(flag) {
-  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
-  return lastApiUrl;
-}
-function currentApiUrl() {
-  return lastApiUrl ?? resolveApiUrl();
-}
-var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
-function resolveDashboardUrl(flag) {
-  return flag ?? process.env.KRYD_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL;
-}
-var PROJECT_LINK_DIR = ".kryd";
-var PROJECT_LINK_FILE = "project.json";
-function findProjectLinkDir(cwd = process.cwd()) {
-  let dir = cwd;
-  for (; ; ) {
-    if (existsSync(join(dir, PROJECT_LINK_DIR, PROJECT_LINK_FILE))) return dir;
-    if (existsSync(join(dir, ".git"))) return null;
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
+async function login(apiUrl, creds) {
+  const res = await fetch(`${apiUrl}/api/auth/sign-in/email`, {
+    method: "POST",
+    headers: { "content-type": "application/json", origin: apiUrl },
+    body: JSON.stringify(creds)
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Login failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const token = res.headers.get("set-auth-token");
+  if (!token) {
+    throw new ApiError("Login succeeded but the API returned no token.");
   }
+  return token;
 }
-function loadProjectLink(cwd = process.cwd()) {
-  const root = findProjectLinkDir(cwd);
-  if (!root) return null;
-  const path = join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
-  let raw;
-  try {
-    raw = readFileSync(path, "utf8");
-  } catch {
-    return null;
+async function whoami(apiUrl, token) {
+  const res = await fetch(`${apiUrl}/me`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Request failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
   }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    process.stderr.write(`warning: ${path} is not valid JSON \u2014 ignoring it.
-`);
-    return null;
+  return await res.json();
+}
+async function linkProject(apiUrl, token, input) {
+  const res = await fetch(`${apiUrl}/repos`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify(input)
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Repo linking failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
   }
-  if (!parsed || typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
-    process.stderr.write(`warning: ${path} has no projectId \u2014 ignoring it.
-`);
-    return null;
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.pushToken !== "string" || parsed.pushToken.length === 0 || typeof parsed.repo?.cloneUrl !== "string" || // `runInit` derives the owner slug from `fullName` (`.split("/")`), so guard it here too —
+  // a 200 missing it must raise the friendly ApiError, not a raw TypeError downstream.
+  typeof parsed.repo?.fullName !== "string" || parsed.repo.fullName.length === 0) {
+    throw new ApiError("The API returned an unexpected repo-link response.");
   }
   return parsed;
 }
-function saveProjectLink(cwd, link) {
-  const dir = join(cwd, PROJECT_LINK_DIR);
-  mkdirSync(dir, { recursive: true });
-  const path = join(dir, PROJECT_LINK_FILE);
-  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
-  return path;
-}
-function ensureIgnored(cwd, entry, aliases = []) {
-  const path = join(cwd, ".gitignore");
-  let current = "";
-  try {
-    current = readFileSync(path, "utf8");
-  } catch {
+async function attachDatabase(apiUrl, token, input) {
+  const res = await fetch(`${apiUrl}/databases`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({
+      projectId: input.projectId,
+      mode: input.mode,
+      // Conditional (exactOptionalPropertyTypes) — only BYO carries a connection string.
+      ...input.connectionString ? { connectionString: input.connectionString } : {}
+    })
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Database attach failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
   }
-  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
-  if (present) return false;
-  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
-  appendFileSync(path, `${prefix}${entry}
-`);
-  return true;
-}
-function ensureKrydIgnored(cwd) {
-  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
-}
-function directoryIsLinked(cwd) {
-  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
-  if (!existsSync(path)) return null;
-  return loadProjectLink(cwd);
-}
-function writeSecretFile(path, contents) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, contents, { mode: 384 });
-  chmodSync(path, 384);
-}
-function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
-  const root = findProjectLinkDir(cwd);
-  if (!root) return false;
-  const link = loadProjectLink(cwd);
-  if (link?.projectId !== projectId) return false;
-  try {
-    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
-    return true;
-  } catch {
-    return false;
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.id !== "string" || parsed.id.length === 0 || !DATABASE_MODES.includes(parsed.mode) || !RESOURCE_STATUSES.includes(parsed.status)) {
+    throw new ApiError("The API returned an unexpected database response.");
   }
+  return {
+    id: parsed.id,
+    mode: parsed.mode,
+    status: parsed.status
+  };
 }
-function resolvedLink() {
-  return lastLinkResolution;
-}
-var lastLinkResolution = null;
-function resolveProjectId(explicit, cwd = process.cwd()) {
-  lastLinkResolution = null;
-  if (explicit) return explicit;
-  const root = findProjectLinkDir(cwd);
-  if (!root) return null;
-  const link = loadProjectLink(cwd);
-  if (!link) return null;
-  lastLinkResolution = { root, link };
-  return link.projectId;
-}
-function rememberLinkAccount(root, account) {
-  if (!account.accountId) return false;
-  const link = directoryIsLinked(root);
-  if (!link) return false;
-  const slug = account.accountSlug ?? link.accountSlug;
-  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
-  saveProjectLink(root, {
-    ...link,
-    accountId: account.accountId,
-    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
-    ...slug ? { accountSlug: slug } : {}
-  });
-  return true;
-}
-
-// src/browser-login.ts
-import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { createServer } from "node:http";
-var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>Kryd CLI</title></head><body style="font-family:system-ui,-apple-system,sans-serif;text-align:center;padding:3rem;color:#1a2634"><h1>${title}</h1><p>${body}</p></body></html>`;
-var SUCCESS_HTML = page("\u2713 Logged in to Kryd", "You can close this tab and return to your terminal.");
-var FAIL_HTML = page("Login failed", "Please return to your terminal and run <code>kryd login</code> again.");
-function openBrowser(url2) {
-  const [cmd, args] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : ["xdg-open", [url2]];
-  try {
-    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
-  } catch {
-  }
-}
-function browserLogin(dashboardUrl, opts = {}) {
-  const state = randomUUID();
-  const timeoutMs = opts.timeoutMs ?? 12e4;
-  const shouldOpen = opts.open ?? true;
-  return new Promise((resolve3, reject) => {
-    let settled = false;
-    const settle = (fn) => {
-      if (settled) return;
-      settled = true;
-      fn();
-    };
-    const server = createServer((req, res) => {
-      res.setHeader("connection", "close");
-      const reqUrl = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (reqUrl.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end();
-        return;
-      }
-      const token = reqUrl.searchParams.get("token");
-      const apiUrl = reqUrl.searchParams.get("apiUrl") ?? void 0;
-      const gotState = reqUrl.searchParams.get("state");
-      if (!token || gotState !== state) {
-        res.writeHead(400, { "content-type": "text/html" });
-        res.end(FAIL_HTML, () => {
-          settle(() => {
-            shutdown();
-            reject(new Error("Login failed \u2014 the approval didn't match this request. Try `kryd login` again."));
-          });
-        });
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html" });
-      res.end(SUCCESS_HTML, () => {
-        settle(() => {
-          shutdown();
-          resolve3({ token, ...apiUrl ? { apiUrl } : {} });
-        });
-      });
-    });
-    const shutdown = () => {
-      server.closeAllConnections();
-      server.close();
-    };
-    server.on("error", (err) => settle(() => reject(err)));
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      const authorizeUrl = `${dashboardUrl.replace(/\/$/, "")}/cli/authorize?port=${port}&state=${state}`;
-      process.stdout.write(
-        `
-To sign in, approve the CLI in your browser:
-  ${authorizeUrl}
-
-Waiting for approval\u2026
-`
-      );
-      if (shouldOpen) openBrowser(authorizeUrl);
-    });
-    setTimeout(
-      () => settle(() => {
-        shutdown();
-        reject(new Error("Login timed out after 2 minutes."));
-      }),
-      timeoutMs
-    ).unref();
-  });
-}
-
-// src/client.ts
-var ApiError = class extends Error {
-  envelope;
-  /**
-   * The HTTP status of the failed response, when it came from one (used to detect a 404 = gone).
-   *
-   * ⚠️ Still optional because an `ApiError` is also thrown for a well-formed response the CLI
-   * cannot use ("the API returned an unexpected …") and for a stream's own error frame — neither
-   * has a status. Every throw that DOES hold a `Response` now passes it (KRYD-481): the 404
-   * diagnosis keys on the status, and a third of them used to omit it, which made the same
-   * failure explainable or unexplainable depending on which verb the customer typed.
-   */
-  status;
-  constructor(message, envelope, status) {
-    super(message);
-    this.name = "ApiError";
-    this.envelope = envelope;
-    this.status = status;
-  }
-};
-async function parseEnvelope(res) {
-  try {
-    return await res.json();
-  } catch {
-    return void 0;
-  }
-}
-async function login(apiUrl, creds) {
-  const res = await fetch(`${apiUrl}/api/auth/sign-in/email`, {
-    method: "POST",
-    headers: { "content-type": "application/json", origin: apiUrl },
-    body: JSON.stringify(creds)
-  });
-  if (!res.ok) {
-    throw new ApiError(
-      `Login failed (${res.status})`,
-      await parseEnvelope(res),
-      res.status
-    );
-  }
-  const token = res.headers.get("set-auth-token");
-  if (!token) {
-    throw new ApiError("Login succeeded but the API returned no token.");
-  }
-  return token;
-}
-async function whoami(apiUrl, token) {
-  const res = await fetch(`${apiUrl}/me`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (!res.ok) {
-    throw new ApiError(
-      `Request failed (${res.status})`,
-      await parseEnvelope(res),
-      res.status
-    );
-  }
-  return await res.json();
-}
-async function linkProject(apiUrl, token, input) {
-  const res = await fetch(`${apiUrl}/repos`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`
-    },
-    body: JSON.stringify(input)
-  });
-  if (!res.ok) {
-    throw new ApiError(
-      `Repo linking failed (${res.status})`,
-      await parseEnvelope(res),
-      res.status
-    );
-  }
-  const parsed = await res.json().catch(() => void 0);
-  if (!parsed || typeof parsed.pushToken !== "string" || parsed.pushToken.length === 0 || typeof parsed.repo?.cloneUrl !== "string" || // `runInit` derives the owner slug from `fullName` (`.split("/")`), so guard it here too —
-  // a 200 missing it must raise the friendly ApiError, not a raw TypeError downstream.
-  typeof parsed.repo?.fullName !== "string" || parsed.repo.fullName.length === 0) {
-    throw new ApiError("The API returned an unexpected repo-link response.");
-  }
-  return parsed;
-}
-async function attachDatabase(apiUrl, token, input) {
-  const res = await fetch(`${apiUrl}/databases`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`
-    },
-    body: JSON.stringify({
-      projectId: input.projectId,
-      mode: input.mode,
-      // Conditional (exactOptionalPropertyTypes) — only BYO carries a connection string.
-      ...input.connectionString ? { connectionString: input.connectionString } : {}
-    })
-  });
-  if (!res.ok) {
-    throw new ApiError(
-      `Database attach failed (${res.status})`,
-      await parseEnvelope(res),
-      res.status
-    );
-  }
-  const parsed = await res.json().catch(() => void 0);
-  if (!parsed || typeof parsed.id !== "string" || parsed.id.length === 0 || !DATABASE_MODES.includes(parsed.mode) || !RESOURCE_STATUSES.includes(parsed.status)) {
-    throw new ApiError("The API returned an unexpected database response.");
-  }
-  return {
-    id: parsed.id,
-    mode: parsed.mode,
-    status: parsed.status
-  };
-}
-async function createStorage(apiUrl, token, input) {
-  const res = await fetch(`${apiUrl}/storage`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`
-    },
-    body: JSON.stringify({ projectId: input.projectId })
-  });
-  if (!res.ok) {
-    throw new ApiError(
-      `Storage create failed (${res.status})`,
-      await parseEnvelope(res),
-      res.status
-    );
-  }
-  const parsed = await res.json().catch(() => void 0);
-  if (!parsed || typeof parsed.id !== "string" || parsed.id.length === 0 || !RESOURCE_STATUSES.includes(parsed.status)) {
-    throw new ApiError("The API returned an unexpected storage response.");
-  }
-  return { id: parsed.id, status: parsed.status };
+async function createStorage(apiUrl, token, input) {
+  const res = await fetch(`${apiUrl}/storage`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ projectId: input.projectId })
+  });
+  if (!res.ok) {
+    throw new ApiError(
+      `Storage create failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.id !== "string" || parsed.id.length === 0 || !RESOURCE_STATUSES.includes(parsed.status)) {
+    throw new ApiError("The API returned an unexpected storage response.");
+  }
+  return { id: parsed.id, status: parsed.status };
 }
 async function enableAi(apiUrl, token, input) {
   const res = await fetch(`${apiUrl}/ai/enable`, {
@@ -15945,153 +15704,709 @@ async function pollForNewDeployments(fetchDeployments, match, opts) {
     await sleep(intervalMs);
   }
 }
-function dataFromFrame(frame) {
-  const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).replace(/^ /, "")).join("\n");
-  return data.length > 0 ? data : void 0;
+function dataFromFrame(frame) {
+  const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).replace(/^ /, "")).join("\n");
+  return data.length > 0 ? data : void 0;
+}
+async function* readSseFrames(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  try {
+    for (; ; ) {
+      const { value, done } = await reader.read();
+      if (done) return;
+      buffer += decoder.decode(value, { stream: true });
+      let sep;
+      while ((sep = buffer.indexOf("\n\n")) !== -1) {
+        const data = dataFromFrame(buffer.slice(0, sep));
+        buffer = buffer.slice(sep + 2);
+        if (data !== void 0) yield data;
+      }
+    }
+  } finally {
+    await reader.cancel().catch(() => void 0);
+  }
+}
+function abortableSleep(ms, signal) {
+  if (signal?.aborted) return Promise.resolve();
+  return new Promise((resolve3) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve3();
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve3();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const reconnectMs = opts.reconnectMs ?? 1e3;
+  let terminal;
+  while (terminal === void 0) {
+    let dropped = false;
+    try {
+      const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/logs`, {
+        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }
+      });
+      if (!res.ok) {
+        throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res), res.status);
+      }
+      if (!res.body) throw new Error("The log stream returned no body.");
+      for await (const data of readSseFrames(res.body)) {
+        const event = parseDeployEvent(data);
+        if (!event) continue;
+        if (event.kind === "log") {
+          handlers.onLog(event.line);
+        } else {
+          handlers.onStatus(event);
+          if (isTerminalDeployState(event.status)) {
+            terminal = event.status;
+            break;
+          }
+        }
+      }
+      if (terminal === void 0) dropped = true;
+    } catch (err) {
+      if (err instanceof ApiError) throw err;
+      dropped = true;
+    }
+    if (terminal === void 0 && dropped) {
+      await new Promise((r) => setTimeout(r, reconnectMs));
+    }
+  }
+  return terminal;
+}
+async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
+  const path = opts.resource === "deployment" ? `deployments/${id}/runtime-logs` : opts.resource === "worker" ? `projects/${id}/workflow-logs` : `projects/${id}/runtime-logs`;
+  const doFetch = opts.fetchImpl ?? fetch;
+  const reconnectMs = opts.reconnectMs ?? 1e3;
+  let afterNs;
+  while (!opts.signal?.aborted) {
+    try {
+      const url2 = new URL(`${apiUrl}/${path}`);
+      if (opts.app && (opts.resource ?? "project") === "project") url2.searchParams.set("app", opts.app);
+      if (afterNs) url2.searchParams.set("after", afterNs);
+      else if (opts.since) url2.searchParams.set("since", opts.since);
+      const res = await doFetch(url2, {
+        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" },
+        ...opts.signal ? { signal: opts.signal } : {}
+      });
+      if (!res.ok) {
+        throw new ApiError(
+          `Runtime log stream failed (${res.status})`,
+          await parseEnvelope(res),
+          res.status
+        );
+      }
+      if (!res.body) throw new Error("The runtime log stream returned no body.");
+      for await (const data of readSseFrames(res.body)) {
+        const frame = parseRuntimeStreamFrame(data);
+        if (!frame) continue;
+        if (frame.kind === "error") throw new ApiError(frame.message);
+        handlers.onLine({ stream: frame.stream, line: frame.line });
+        if (frame.ts) afterNs = frame.ts;
+      }
+    } catch (err) {
+      if (opts.signal?.aborted) return;
+      if (err instanceof ApiError) throw err;
+    }
+    if (!opts.signal?.aborted) {
+      await abortableSleep(reconnectMs, opts.signal);
+    }
+  }
+}
+async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/log`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new ApiError(
+      `Fetching the stored log failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  return (await res.json()).log;
+}
+async function fetchPushCredential(apiUrl, token, projectId) {
+  const res = await fetch(
+    `${apiUrl}/repos/${encodeURIComponent(projectId)}/push-credential`,
+    { headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Could not fetch the push credential (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+  const parsed = await res.json().catch(() => void 0);
+  if (!parsed || typeof parsed.username !== "string" || typeof parsed.password !== "string" || parsed.password.length === 0) {
+    throw new ApiError("The API returned an unexpected push-credential response.");
+  }
+  return { username: parsed.username, password: parsed.password };
+}
+function isSupportTicket(v) {
+  const t = v;
+  return typeof t === "object" && t !== null && typeof t.ref === "string" && typeof t.subject === "string" && typeof t.status === "string" && typeof t.type === "string" && (t.project === null || t.project === void 0 || typeof t.project?.name === "string");
+}
+function isSupportDetail(v) {
+  return isSupportTicket(v) && Array.isArray(v.messages) && v.messages.every(
+    (m) => typeof m?.text === "string" && typeof m?.side === "string" && typeof m?.createdAt === "string"
+  );
+}
+var unexpected = (what) => new ApiError(`The API returned ${what} in a shape this CLI does not recognise`);
+async function supportFetch(apiUrl, token, path, what, init = {}) {
+  const res = await fetch(`${apiUrl}${path}`, {
+    method: init.method ?? "GET",
+    headers: {
+      authorization: `Bearer ${token}`,
+      ...init.body !== void 0 ? { "content-type": "application/json" } : {}
+    },
+    ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {}
+  });
+  if (!res.ok) {
+    throw new ApiError(`${what} failed (${res.status})`, await parseEnvelope(res), res.status);
+  }
+  try {
+    return await res.json();
+  } catch {
+    throw unexpected(`an answer to "${what.toLowerCase()}"`);
+  }
+}
+async function createSupportTicket(apiUrl, token, input) {
+  const body = await supportFetch(apiUrl, token, "/support/tickets", "Opening the ticket", {
+    method: "POST",
+    body: {
+      type: input.type,
+      subject: input.subject,
+      text: input.text,
+      ...input.projectId ? { projectId: input.projectId } : {},
+      via: "cli"
+    }
+  });
+  if (!isSupportTicket(body)) throw unexpected("the new ticket");
+  return body;
+}
+async function listSupportTickets(apiUrl, token) {
+  const body = await supportFetch(apiUrl, token, "/support/tickets", "Listing the tickets");
+  if (!Array.isArray(body?.items) || !body.items.every(isSupportTicket)) throw unexpected("the tickets");
+  return body.items;
+}
+async function getSupportTicket(apiUrl, token, ref) {
+  const body = await supportFetch(apiUrl, token, `/support/tickets/${encodeURIComponent(ref)}`, "Reading the ticket");
+  if (!isSupportDetail(body)) throw unexpected("the ticket");
+  return body;
+}
+async function replySupportTicket(apiUrl, token, ref, text) {
+  const body = await supportFetch(
+    apiUrl,
+    token,
+    `/support/tickets/${encodeURIComponent(ref)}/messages`,
+    "Sending the reply",
+    { method: "POST", body: { text } }
+  );
+  if (!isSupportDetail(body)) throw unexpected("the ticket");
+  return body;
+}
+
+// src/config.ts
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var DEFAULT_API_URL = "http://localhost:3000";
+function configPath() {
+  const dir = process.env.KRYD_CONFIG_DIR ?? join(homedir(), ".kryd");
+  return join(dir, "config.json");
+}
+function loadConfig() {
+  let raw;
+  try {
+    raw = readFileSync(configPath(), "utf8");
+  } catch {
+    return {};
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    process.stderr.write(
+      `warning: ${configPath()} is not valid JSON \u2014 ignoring it.
+`
+    );
+    return {};
+  }
+}
+function writeConfig(config2) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
+  chmodSync(path, 384);
+}
+function saveToken(token, apiUrl) {
+  const config2 = loadConfig();
+  config2.token = token;
+  if (apiUrl) config2.apiUrl = apiUrl;
+  writeConfig(config2);
+}
+function clearToken() {
+  const config2 = loadConfig();
+  delete config2.token;
+  writeConfig(config2);
+}
+var lastApiUrl = null;
+function resolveApiUrl(flag) {
+  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  return lastApiUrl;
+}
+function currentApiUrl() {
+  return lastApiUrl ?? resolveApiUrl();
+}
+var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
+function resolveDashboardUrl(flag) {
+  return flag ?? process.env.KRYD_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL;
+}
+var PROJECT_LINK_DIR = ".kryd";
+var PROJECT_LINK_FILE = "project.json";
+function findProjectLinkDir(cwd = process.cwd()) {
+  let dir = cwd;
+  for (; ; ) {
+    if (existsSync(join(dir, PROJECT_LINK_DIR, PROJECT_LINK_FILE))) return dir;
+    if (existsSync(join(dir, ".git"))) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function loadProjectLink(cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const path = join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    process.stderr.write(`warning: ${path} is not valid JSON \u2014 ignoring it.
+`);
+    return null;
+  }
+  if (!parsed || typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
+    process.stderr.write(`warning: ${path} has no projectId \u2014 ignoring it.
+`);
+    return null;
+  }
+  return parsed;
+}
+function saveProjectLink(cwd, link) {
+  const dir = join(cwd, PROJECT_LINK_DIR);
+  mkdirSync(dir, { recursive: true });
+  const path = join(dir, PROJECT_LINK_FILE);
+  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
+  return path;
+}
+function ensureIgnored(cwd, entry, aliases = []) {
+  const path = join(cwd, ".gitignore");
+  let current = "";
+  try {
+    current = readFileSync(path, "utf8");
+  } catch {
+  }
+  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
+  if (present) return false;
+  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
+  appendFileSync(path, `${prefix}${entry}
+`);
+  return true;
+}
+function ensureKrydIgnored(cwd) {
+  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
+}
+function directoryIsLinked(cwd) {
+  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  if (!existsSync(path)) return null;
+  return loadProjectLink(cwd);
+}
+function writeSecretFile(path, contents) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, contents, { mode: 384 });
+  chmodSync(path, 384);
+}
+function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return false;
+  const link = loadProjectLink(cwd);
+  if (link?.projectId !== projectId) return false;
+  try {
+    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolvedLink() {
+  return lastLinkResolution;
+}
+var lastLinkResolution = null;
+function resolveProjectId(explicit, cwd = process.cwd()) {
+  lastLinkResolution = null;
+  if (explicit) return explicit;
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const link = loadProjectLink(cwd);
+  if (!link) return null;
+  lastLinkResolution = { root, link };
+  return link.projectId;
+}
+function rememberLinkAccount(root, account) {
+  if (!account.accountId) return false;
+  const link = directoryIsLinked(root);
+  if (!link) return false;
+  const slug = account.accountSlug ?? link.accountSlug;
+  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
+  saveProjectLink(root, {
+    ...link,
+    accountId: account.accountId,
+    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
+    ...slug ? { accountSlug: slug } : {}
+  });
+  return true;
+}
+
+// src/support.ts
+var SUPPORT_TYPES = TICKET_TYPES;
+var MESSAGE_MAX = 2e4;
+var SUBJECT_MAX = 200;
+var LOG_TAIL_LINES = 40;
+var CONTEXT_SEPARATOR = "\n\n---\n";
+var URL_CREDENTIAL = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
+var SECRET_ASSIGNMENT = /\b([A-Za-z0-9_.-]*(?:TOKEN|SECRET|PASSWORD|PASSWD|KEY|DSN|DATABASE_URL|CREDENTIAL)[A-Za-z0-9_.-]*)(\s*[=:]\s*)(["']?)([^\s"']+)/gi;
+function maskSecrets(line) {
+  return line.replace(URL_CREDENTIAL, "$1$2:***@").replace(SECRET_ASSIGNMENT, "$1$2$3***");
+}
+function logTail(log, n = LOG_TAIL_LINES) {
+  const lines = log.split(/\r?\n/);
+  while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();
+  return lines.slice(-n).map(maskSecrets);
+}
+function fenceFor(lines) {
+  const longest = Math.max(0, ...lines.map((l) => Math.max(0, ...(l.match(/`+/g) ?? []).map((r) => r.length))));
+  return "`".repeat(Math.max(3, longest + 1));
+}
+function deployLine(deploy) {
+  if (deploy === "unreadable") return "Last production deploy: could not be read";
+  if (deploy === null) return "Last production deploy: none yet";
+  return `Last production deploy: ${deploy.id} (${deploy.type}, app ${deploy.app ?? "web"}) \u2014 ${deploy.status}, branch ${deploy.branch}, commit ${deploy.commitSha.slice(0, 7)}, ${deploy.statusChangedAt}`;
+}
+function buildContext(input, room) {
+  if (!input.project) return null;
+  const head = [
+    "Context added by the Kryd CLI (kryd support new \u2014 leave it out with --no-context)",
+    `Project: ${input.project.name} (${input.project.id})`,
+    deployLine(input.deploy)
+  ].join("\n");
+  if (head.length > room) return null;
+  let lines = input.log ? logTail(input.log) : [];
+  const withLog = (ls) => {
+    const fence = fenceFor(ls);
+    return `${head}
+Last ${ls.length} lines of its log (secret-looking values masked):
+${fence}
+${ls.join("\n")}
+${fence}`;
+  };
+  while (lines.length > 0 && withLog(lines).length > room) lines = lines.slice(1);
+  return lines.length > 0 ? withLog(lines) : head;
+}
+function composeMessage(text, context) {
+  return context ? `${text}${CONTEXT_SEPARATOR}${context}` : text;
+}
+function contextRoom(text) {
+  return MESSAGE_MAX - text.length - CONTEXT_SEPARATOR.length;
+}
+var STATUS_TEXT = {
+  open: "open \u2014 Kryd support is on it",
+  waiting: "waiting on you",
+  solved: "solved"
+};
+var statusText = (s) => TICKET_STATUSES.includes(s) ? STATUS_TEXT[s] : s;
+function printJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function usage(message) {
+  process.stderr.write(`${message}
+`);
+  process.exitCode = 1;
+}
+function issueMessages(details) {
+  const list = Array.isArray(details) ? details : Array.isArray(details?.issues) ? details.issues : [];
+  return list.map((i) => i?.message).filter((m) => typeof m === "string" && m.length > 0);
 }
-async function* readSseFrames(body) {
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  try {
-    for (; ; ) {
-      const { value, done } = await reader.read();
-      if (done) return;
-      buffer += decoder.decode(value, { stream: true });
-      let sep;
-      while ((sep = buffer.indexOf("\n\n")) !== -1) {
-        const data = dataFromFrame(buffer.slice(0, sep));
-        buffer = buffer.slice(sep + 2);
-        if (data !== void 0) yield data;
-      }
-    }
-  } finally {
-    await reader.cancel().catch(() => void 0);
+function reportSupportError(err) {
+  if (err instanceof ApiError && err.status === 401) {
+    process.stderr.write("Not logged in, or the session expired \u2014 run `kryd login`.\n");
+  } else if (err instanceof ApiError && err.envelope?.error) {
+    const issues = issueMessages(err.envelope.error.details);
+    process.stderr.write(`${issues.length > 0 ? issues.join("\n") : err.envelope.error.message}
+`);
+  } else {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
   }
+  process.exitCode = 1;
 }
-function abortableSleep(ms, signal) {
-  if (signal?.aborted) return Promise.resolve();
-  return new Promise((resolve3) => {
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve3();
-    };
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve3();
-    }, ms);
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
+function requireToken() {
+  const token = loadConfig().token;
+  if (!token) usage("Not logged in \u2014 run `kryd login` first.");
+  return token ?? null;
 }
-async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
-  const doFetch = opts.fetchImpl ?? fetch;
-  const reconnectMs = opts.reconnectMs ?? 1e3;
-  let terminal;
-  while (terminal === void 0) {
-    let dropped = false;
-    try {
-      const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/logs`, {
-        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }
-      });
-      if (!res.ok) {
-        throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res), res.status);
+function ticketRef(raw) {
+  const n = raw ? parseTicketNumber(raw) : null;
+  return n === null ? null : formatTicketNumber(n);
+}
+function printTicketLine(t) {
+  process.stdout.write(`${t.ref}  ${statusText(t.status).padEnd(30)}  ${t.type.padEnd(8)}  ${t.subject}
+`);
+}
+function printDetail(t) {
+  process.stdout.write(`${t.ref} \u2014 ${t.subject}
+`);
+  process.stdout.write(`Status: ${statusText(t.status)} \xB7 ${t.type}${t.project ? ` \xB7 ${t.project.name}` : ""}
+`);
+  for (const m of t.messages) {
+    const who = m.side === "reply" ? "Kryd support" : m.author?.name ?? m.author?.email ?? "you";
+    process.stdout.write(`
+\u2014 ${who}, ${m.createdAt}
+${m.text}
+`);
+  }
+}
+var errStatus = (err) => err instanceof ApiError && err.status ? String(err.status) : err instanceof Error ? err.message : "error";
+async function runSupportNew(opts) {
+  const type = opts.type?.trim().toLowerCase();
+  const subject = opts.subject?.trim();
+  const text = opts.message?.trim();
+  if (!type || !SUPPORT_TYPES.includes(type)) {
+    return usage(`--type is required: one of ${SUPPORT_TYPES.join(", ")}.`);
+  }
+  if (!subject) return usage("--subject is required.");
+  if (subject.length > SUBJECT_MAX) return usage(`--subject is at most ${SUBJECT_MAX} characters (this one is ${subject.length}).`);
+  if (!text) return usage("--message is required.");
+  if (text.length > MESSAGE_MAX) return usage(`--message is at most ${MESSAGE_MAX} characters (this one is ${text.length}).`);
+  const token = requireToken();
+  if (!token) return;
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const explicit = opts.project?.trim() || void 0;
+  const target = resolveProjectId(explicit, opts.cwd);
+  const notes = [];
+  const flushNotes = () => {
+    for (const n of notes) process.stderr.write(`note: ${n}
+`);
+  };
+  let project2 = null;
+  let context = null;
+  try {
+    if (target) {
+      let found;
+      try {
+        found = await getProject(apiUrl, token, target);
+      } catch (err) {
+        if (explicit) return reportSupportError(err);
+        notes.push(`could not read the linked project ${target} (${errStatus(err)}); the ticket is opened without it`);
       }
-      if (!res.body) throw new Error("The log stream returned no body.");
-      for await (const data of readSseFrames(res.body)) {
-        const event = parseDeployEvent(data);
-        if (!event) continue;
-        if (event.kind === "log") {
-          handlers.onLog(event.line);
-        } else {
-          handlers.onStatus(event);
-          if (isTerminalDeployState(event.status)) {
-            terminal = event.status;
-            break;
-          }
-        }
+      if (found === null) {
+        if (explicit) return usage(`--project ${target} is not a project in your account. Nothing was sent.`);
+        notes.push(`this folder is linked to ${target}, which is not in your account; the ticket is opened without a project`);
       }
-      if (terminal === void 0) dropped = true;
-    } catch (err) {
-      if (err instanceof ApiError) throw err;
-      dropped = true;
+      if (found) project2 = { id: found.id, name: found.name };
     }
-    if (terminal === void 0 && dropped) {
-      await new Promise((r) => setTimeout(r, reconnectMs));
+    if (project2 && opts.context !== false) {
+      let deploy;
+      try {
+        deploy = (await listDeployments(apiUrl, token, project2.id)).find((d) => d.type === "production") ?? null;
+      } catch (err) {
+        deploy = "unreadable";
+        notes.push(`could not read the project's deploys (${errStatus(err)}); the context says so`);
+      }
+      let log = null;
+      if (deploy && deploy !== "unreadable" && deploy.status === "failed") {
+        try {
+          log = await fetchDeployLog(apiUrl, token, deploy.id);
+        } catch (err) {
+          notes.push(`could not read the failed deploy's log (${errStatus(err)}); the context leaves it out`);
+        }
+      }
+      context = buildContext({ project: project2, deploy, log }, contextRoom(text));
+      if (context === null) notes.push("the context did not fit next to your message; it was left out");
     }
+    const ticket = await createSupportTicket(apiUrl, token, {
+      type,
+      subject,
+      text: composeMessage(text, context),
+      projectId: project2?.id ?? null
+    });
+    flushNotes();
+    if (opts.json) return printJson({ ...ticket, contextIncluded: context !== null, notes });
+    process.stdout.write(`Opened ${ticket.ref} \u2014 ${ticket.subject}
+`);
+    process.stdout.write(`Status: ${statusText(ticket.status)}
+`);
+    process.stdout.write(
+      context ? `Context: added (${project2.name})
+` : project2 ? "Context: none\n" : target ? "Opened without a project (see the note above).\n" : "No linked project here \u2014 opened without project context.\n"
+    );
+    process.stdout.write(`Follow it with \`kryd support show ${ticket.ref}\`.
+`);
+  } catch (err) {
+    flushNotes();
+    reportSupportError(err);
   }
-  return terminal;
 }
-async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
-  const path = opts.resource === "deployment" ? `deployments/${id}/runtime-logs` : opts.resource === "worker" ? `projects/${id}/workflow-logs` : `projects/${id}/runtime-logs`;
-  const doFetch = opts.fetchImpl ?? fetch;
-  const reconnectMs = opts.reconnectMs ?? 1e3;
-  let afterNs;
-  while (!opts.signal?.aborted) {
-    try {
-      const url2 = new URL(`${apiUrl}/${path}`);
-      if (opts.app && (opts.resource ?? "project") === "project") url2.searchParams.set("app", opts.app);
-      if (afterNs) url2.searchParams.set("after", afterNs);
-      else if (opts.since) url2.searchParams.set("since", opts.since);
-      const res = await doFetch(url2, {
-        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" },
-        ...opts.signal ? { signal: opts.signal } : {}
-      });
-      if (!res.ok) {
-        throw new ApiError(
-          `Runtime log stream failed (${res.status})`,
-          await parseEnvelope(res),
-          res.status
-        );
-      }
-      if (!res.body) throw new Error("The runtime log stream returned no body.");
-      for await (const data of readSseFrames(res.body)) {
-        const frame = parseRuntimeStreamFrame(data);
-        if (!frame) continue;
-        if (frame.kind === "error") throw new ApiError(frame.message);
-        handlers.onLine({ stream: frame.stream, line: frame.line });
-        if (frame.ts) afterNs = frame.ts;
-      }
-    } catch (err) {
-      if (opts.signal?.aborted) return;
-      if (err instanceof ApiError) throw err;
-    }
-    if (!opts.signal?.aborted) {
-      await abortableSleep(reconnectMs, opts.signal);
+async function runSupportList(opts) {
+  const token = requireToken();
+  if (!token) return;
+  try {
+    const items = await listSupportTickets(resolveApiUrl(opts.apiUrl), token);
+    if (opts.json) return printJson({ items });
+    if (items.length === 0) {
+      process.stdout.write("No tickets yet. Open one with `kryd support new`.\n");
+      return;
     }
+    for (const t of items) printTicketLine(t);
+  } catch (err) {
+    reportSupportError(err);
   }
 }
-async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
-  const doFetch = opts.fetchImpl ?? fetch;
-  const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/log`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (res.status === 404) return null;
-  if (!res.ok) {
-    throw new ApiError(
-      `Fetching the stored log failed (${res.status})`,
-      await parseEnvelope(res),
-      res.status
-    );
+async function runSupportShow(raw, opts) {
+  const ref = ticketRef(raw);
+  if (!ref) return usage("Which ticket? Give its number, e.g. `kryd support show T-1042`.");
+  const token = requireToken();
+  if (!token) return;
+  try {
+    const t = await getSupportTicket(resolveApiUrl(opts.apiUrl), token, ref);
+    if (opts.json) return printJson(t);
+    printDetail(t);
+  } catch (err) {
+    reportSupportError(err);
   }
-  return (await res.json()).log;
 }
-async function fetchPushCredential(apiUrl, token, projectId) {
-  const res = await fetch(
-    `${apiUrl}/repos/${encodeURIComponent(projectId)}/push-credential`,
-    { headers: { authorization: `Bearer ${token}` } }
-  );
-  if (!res.ok) {
-    throw new ApiError(
-      `Could not fetch the push credential (${res.status})`,
-      await parseEnvelope(res),
-      res.status
-    );
+async function runSupportReply(raw, opts) {
+  const ref = ticketRef(raw);
+  if (!ref) return usage("Which ticket? Give its number, e.g. `kryd support reply T-1042 --message \u2026`.");
+  const text = opts.message?.trim();
+  if (!text) return usage("--message is required.");
+  if (text.length > MESSAGE_MAX) return usage(`--message is at most ${MESSAGE_MAX} characters (this one is ${text.length}).`);
+  const token = requireToken();
+  if (!token) return;
+  try {
+    const t = await replySupportTicket(resolveApiUrl(opts.apiUrl), token, ref, text);
+    if (opts.json) return printJson(t);
+    process.stdout.write(`Sent. ${t.ref} is now ${statusText(t.status)}.
+`);
+  } catch (err) {
+    reportSupportError(err);
   }
-  const parsed = await res.json().catch(() => void 0);
-  if (!parsed || typeof parsed.username !== "string" || typeof parsed.password !== "string" || parsed.password.length === 0) {
-    throw new ApiError("The API returned an unexpected push-credential response.");
+}
+
+// src/browser-login.ts
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>Kryd CLI</title></head><body style="font-family:system-ui,-apple-system,sans-serif;text-align:center;padding:3rem;color:#1a2634"><h1>${title}</h1><p>${body}</p></body></html>`;
+var SUCCESS_HTML = page("\u2713 Logged in to Kryd", "You can close this tab and return to your terminal.");
+var FAIL_HTML = page("Login failed", "Please return to your terminal and run <code>kryd login</code> again.");
+function openBrowser(url2) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : ["xdg-open", [url2]];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
   }
-  return { username: parsed.username, password: parsed.password };
+}
+function browserLogin(dashboardUrl, opts = {}) {
+  const state = randomUUID();
+  const timeoutMs = opts.timeoutMs ?? 12e4;
+  const shouldOpen = opts.open ?? true;
+  return new Promise((resolve3, reject) => {
+    let settled = false;
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      fn();
+    };
+    const server = createServer((req, res) => {
+      res.setHeader("connection", "close");
+      const reqUrl = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (reqUrl.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const token = reqUrl.searchParams.get("token");
+      const apiUrl = reqUrl.searchParams.get("apiUrl") ?? void 0;
+      const gotState = reqUrl.searchParams.get("state");
+      if (!token || gotState !== state) {
+        res.writeHead(400, { "content-type": "text/html" });
+        res.end(FAIL_HTML, () => {
+          settle(() => {
+            shutdown();
+            reject(new Error("Login failed \u2014 the approval didn't match this request. Try `kryd login` again."));
+          });
+        });
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html" });
+      res.end(SUCCESS_HTML, () => {
+        settle(() => {
+          shutdown();
+          resolve3({ token, ...apiUrl ? { apiUrl } : {} });
+        });
+      });
+    });
+    const shutdown = () => {
+      server.closeAllConnections();
+      server.close();
+    };
+    server.on("error", (err) => settle(() => reject(err)));
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      const authorizeUrl = `${dashboardUrl.replace(/\/$/, "")}/cli/authorize?port=${port}&state=${state}`;
+      process.stdout.write(
+        `
+To sign in, approve the CLI in your browser:
+  ${authorizeUrl}
+
+Waiting for approval\u2026
+`
+      );
+      if (shouldOpen) openBrowser(authorizeUrl);
+    });
+    setTimeout(
+      () => settle(() => {
+        shutdown();
+        reject(new Error("Login timed out after 2 minutes."));
+      }),
+      timeoutMs
+    ).unref();
+  });
 }
 
 // src/git-credential.ts
@@ -18613,7 +18928,7 @@ function formatDomainRecords(records) {
   }
   return out;
 }
-function domainContext(opts, usage) {
+function domainContext(opts, usage2) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = loadConfig().token;
   if (!token) {
@@ -18623,7 +18938,7 @@ function domainContext(opts, usage) {
   }
   const project2 = resolveProjectId(opts.project, opts.cwd);
   if (!project2) {
-    reportNotLinked(usage);
+    reportNotLinked(usage2);
     return null;
   }
   return { apiUrl, token, project: project2 };
@@ -19508,7 +19823,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.12.1" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.13.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.hook("postAction", async () => {
@@ -19647,6 +19962,15 @@ domain2.command("add <host>").description("Add a custom domain and print the DNS
 ).option("--api-url <url>", "control-plane API base URL").action((host, opts) => runDomainAdd({ ...opts, host }));
 domain2.command("remove <host>").description("Remove a custom domain \u2014 its route and certificate go (asks for confirmation)").option("--project <projectId>", "the project (default: the one linked here)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((host, opts) => runDomainRemove({ ...opts, host }));
 domain2.command("status [host]").description("Show the project's custom domains, or one in detail with what is missing").option("--project <projectId>", "the project (default: the one linked here)").option("--api-url <url>", "control-plane API base URL").action((host, opts) => runDomainStatus({ ...opts, host }));
+var support = program.command("support").description(
+  "Ask Kryd support a question, report a bug or a wish, and read the answer \u2014 non-interactive, with --json for agents"
+);
+support.command("new").description(
+  "Open a ticket. In a linked folder it adds the project and its last production deploy; if that deploy failed, the last lines of its log are sent to Kryd support too (secret-looking values masked). --no-context leaves all of it out"
+).option("--type <type>", "question | bug | request (required)").option("--subject <text>", "one line: what it is about (required)").option("--message <text>", "the question or the bug report, in full (required)").option("--project <projectId>", "the project it is about (default: the one linked here)").option("--no-context", "leave out the project, deploy and log context").option("--json", "print the ticket as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runSupportNew(opts));
+support.command("list").description("Your account's tickets, with their status").option("--json", "print { items } as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runSupportList(opts));
+support.command("show <ticket>").description("One ticket and its conversation, e.g. `kryd support show T-1042`").option("--json", "print the ticket and its messages as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportShow(ticket, opts));
+support.command("reply <ticket>").description("Answer in a ticket's conversation \u2014 the ticket goes back to Kryd support (status open)").option("--message <text>", "your reply (required)").option("--json", "print the updated ticket as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportReply(ticket, opts));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;