@kryd/cli 0.13.0 → 0.15.0

package/README.md

@@ -43,6 +43,7 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 | `kryd ai add \| remove \| status [project]` | Give the project an authenticated EU AI-gateway endpoint (injected on the next deploy), take it away again, or show what it has. |
 | `kryd workflow add \| remove \| status [project]` | Give the project its own durable-workflow tenant — `HATCHET_CLIENT_TOKEN` is injected on the next deploy — revoke that token again, or show whether it has one and when it expires. `remove` keeps the tenant's history, crons and schedules until the project is deleted. |
 | `kryd workflow init --language <typescript\|python\|go>` | Scaffold a workflow worker here and link it as a new project. The worker ships with the small HTTP health listener Kryd's deploy gate needs — without it a deploy is torn down with "nothing listening yet" — plus a `kryd.json` that tells `kryd init` what this project is. `--no-link` writes the files only. |
+| `kryd token create \| list \| revoke` | Deploy tokens for CI and scripts. `create <name> [--expires 30\|90\|365\|never]` (default 90 days) prints the token once; it acts as you, inside your account, and cannot create tokens itself. Managing tokens needs `kryd login`. A token can do what you can on your projects — read env values and push — so after a leak, revoke it and also rotate the secrets it could read. |
 | `kryd support new \| list \| show \| reply` | Ask Kryd support a question, report a bug or a wish, and read the answer. Non-interactive (every input is a flag) and `--json` prints one JSON document on stdout — so an agent can use it too. In a linked folder, `new` adds the project and its last production deploy; when that deploy failed, the last lines of its log are sent to Kryd support too, with secret-looking values masked. `--no-context` leaves all of it out. |
 
 For an agent, for example:
@@ -52,6 +53,13 @@ kryd support new --type bug --subject "Deploy hangs on build" --message "Every d
 kryd support show T-1042 --json
 ```
 
+In CI, no `kryd login` and no config file: set a deploy token as the secret `KRYD_TOKEN` and every command uses it (it wins over a stored login).
+
+```sh
+kryd token create github-actions     # prints kryd_… once — store it as the CI secret KRYD_TOKEN
+KRYD_TOKEN=kryd_… kryd deploy <project>
+```
+
 Run `kryd <command> --help` for options. Every project-scoped command accepts an explicit `<project>` id, or resolves it from the `.kryd` link (walking up from the current directory, git-style).
 
 ## Sovereignty

package/dist/index.js

@@ -14963,25 +14963,6 @@ async function parseEnvelope(res) {
     return void 0;
   }
 }
-async function login(apiUrl, creds) {
-  const res = await fetch(`${apiUrl}/api/auth/sign-in/email`, {
-    method: "POST",
-    headers: { "content-type": "application/json", origin: apiUrl },
-    body: JSON.stringify(creds)
-  });
-  if (!res.ok) {
-    throw new ApiError(
-      `Login failed (${res.status})`,
-      await parseEnvelope(res),
-      res.status
-    );
-  }
-  const token = res.headers.get("set-auth-token");
-  if (!token) {
-    throw new ApiError("Login succeeded but the API returned no token.");
-  }
-  return token;
-}
 async function whoami(apiUrl, token) {
   const res = await fetch(`${apiUrl}/me`, {
     headers: { authorization: `Bearer ${token}` }
@@ -15950,6 +15931,10 @@ function loadConfig() {
     return {};
   }
 }
+function resolveToken() {
+  const fromEnv = process.env.KRYD_TOKEN?.trim();
+  return fromEnv ? fromEnv : loadConfig().token;
+}
 function writeConfig(config2) {
   const path = configPath();
   mkdirSync(dirname(path), { recursive: true, mode: 448 });
@@ -16175,7 +16160,7 @@ function reportSupportError(err) {
   process.exitCode = 1;
 }
 function requireToken() {
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) usage("Not logged in \u2014 run `kryd login` first.");
   return token ?? null;
 }
@@ -16327,6 +16312,154 @@ async function runSupportReply(raw, opts) {
   }
 }
 
+// src/tokens.ts
+var TOKEN_EXPIRY_CHOICES = ["30", "90", "365", "never"];
+var DEFAULT_TOKEN_EXPIRY = "90";
+var MAX_TOKEN_NAME = 32;
+function expiresInSeconds(choice) {
+  if (choice === "never") return null;
+  if (!TOKEN_EXPIRY_CHOICES.includes(choice)) return void 0;
+  return Number(choice) * 24 * 60 * 60;
+}
+async function tokenFetch(apiUrl, token, path, what, body) {
+  const res = await fetch(`${apiUrl}/api/auth/api-key/${path}`, {
+    method: body === void 0 ? "GET" : "POST",
+    headers: {
+      authorization: `Bearer ${token}`,
+      ...body !== void 0 ? { "content-type": "application/json" } : {}
+    },
+    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+  });
+  if (!res.ok) {
+    const parsed = await res.json().catch(() => void 0);
+    const message = typeof parsed?.message === "string" ? parsed.message : `${what} failed (${res.status})`;
+    const code = typeof parsed?.code === "string" ? parsed.code : `http.${res.status}`;
+    throw new ApiError(`${what} failed (${res.status})`, { error: { code, message } }, res.status);
+  }
+  try {
+    return await res.json();
+  } catch {
+    throw new ApiError(`The API returned an unexpected answer to "${what.toLowerCase()}".`);
+  }
+}
+var isToken = (v) => {
+  const t = v;
+  return typeof t?.id === "string" && typeof t?.createdAt === "string";
+};
+async function createDeployToken(apiUrl, token, input) {
+  const body = await tokenFetch(apiUrl, token, "create", "Creating the token", input);
+  if (!isToken(body) || typeof body.key !== "string" || body.key.length === 0) {
+    throw new ApiError("The API returned an unexpected answer to creating the token.");
+  }
+  return body;
+}
+async function listDeployTokens(apiUrl, token) {
+  const body = await tokenFetch(apiUrl, token, "list", "Listing the tokens");
+  if (!Array.isArray(body?.apiKeys) || !body.apiKeys.every(isToken)) {
+    throw new ApiError("The API returned an unexpected answer to listing the tokens.");
+  }
+  return body.apiKeys;
+}
+async function revokeDeployToken(apiUrl, token, id) {
+  await tokenFetch(apiUrl, token, "delete", "Revoking the token", { keyId: id });
+}
+function fail(message) {
+  process.stderr.write(`${message}
+`);
+  process.exitCode = 1;
+}
+function reportTokenError(err) {
+  if (err instanceof ApiError && err.status === 401) {
+    fail("Not logged in, or the session expired \u2014 run `kryd login`.");
+  } else if (err instanceof ApiError && err.status === 403 && resolveToken()?.startsWith("kryd_")) {
+    fail(
+      "A deploy token cannot manage tokens. Sign in with `kryd login` (and unset KRYD_TOKEN for this command)."
+    );
+  } else if (err instanceof ApiError && err.status === 404) {
+    fail("No such token on your account. `kryd token list` shows their ids.");
+  } else if (err instanceof ApiError && err.envelope) {
+    fail(err.envelope.error.message);
+  } else {
+    fail(err instanceof Error ? err.message : String(err));
+  }
+}
+function requireToken2() {
+  const token = resolveToken();
+  if (!token) fail("Not logged in \u2014 run `kryd login` first.");
+  return token ?? null;
+}
+var day = (iso) => iso ? iso.slice(0, 10) : "\u2014";
+async function runTokenCreate(name, opts) {
+  const trimmed = name.trim();
+  if (trimmed.length === 0 || trimmed.length > MAX_TOKEN_NAME) {
+    return fail(`A token name is 1 to ${MAX_TOKEN_NAME} characters.`);
+  }
+  const choice = opts.expires ?? DEFAULT_TOKEN_EXPIRY;
+  const expiresIn = expiresInSeconds(choice);
+  if (expiresIn === void 0) {
+    return fail(`--expires is one of ${TOKEN_EXPIRY_CHOICES.join(", ")} (days, or never).`);
+  }
+  const token = requireToken2();
+  if (!token) return;
+  try {
+    const created = await createDeployToken(resolveApiUrl(opts.apiUrl), token, { name: trimmed, expiresIn });
+    process.stdout.write(`${created.key}
+`);
+    process.stderr.write(
+      `Created deploy token "${trimmed}" (${created.id}), ${created.expiresAt ? `valid until ${day(created.expiresAt)}` : "without expiry"}.
+This token will not be shown again. Store it now, e.g. as the CI secret KRYD_TOKEN.
+`
+    );
+  } catch (err) {
+    reportTokenError(err);
+  }
+}
+async function runTokenList(opts) {
+  const token = requireToken2();
+  if (!token) return;
+  try {
+    const list = await listDeployTokens(resolveApiUrl(opts.apiUrl), token);
+    if (opts.json) {
+      process.stdout.write(`${JSON.stringify(list, null, 2)}
+`);
+      return;
+    }
+    if (list.length === 0) {
+      process.stdout.write("No deploy tokens. Create one with `kryd token create <name>`.\n");
+      return;
+    }
+    const rows = [
+      ["ID", "NAME", "STARTS WITH", "CREATED", "LAST USED", "EXPIRES"],
+      ...list.map((t) => [
+        t.id,
+        t.name ?? "\u2014",
+        t.start ? `${t.start}\u2026` : "\u2014",
+        day(t.createdAt),
+        day(t.lastRequest),
+        t.expiresAt ? day(t.expiresAt) : "never"
+      ])
+    ];
+    const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+    for (const r of rows) {
+      process.stdout.write(`${r.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd()}
+`);
+    }
+  } catch (err) {
+    reportTokenError(err);
+  }
+}
+async function runTokenRevoke(id, opts) {
+  const token = requireToken2();
+  if (!token) return;
+  try {
+    await revokeDeployToken(resolveApiUrl(opts.apiUrl), token, id);
+    process.stdout.write(`Revoked ${id}. Anything still using it now gets 401.
+`);
+  } catch (err) {
+    reportTokenError(err);
+  }
+}
+
 // src/browser-login.ts
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -16415,7 +16548,7 @@ async function runGitCredential(operation, opts = {}) {
   const input = parseCredentialInput(opts.stdin ?? "");
   if (input.protocol && input.protocol !== "https") return;
   const cwd = opts.cwd ?? process.cwd();
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) return;
   const projectId = resolveProjectId(void 0, cwd);
   if (!projectId) return;
@@ -17626,7 +17759,7 @@ async function explainMissingProject(err) {
   if (err.status !== 404) return "";
   const resolution = resolvedLink();
   if (!resolution) return "";
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) return "";
   if (await projectIsVisible(token, resolution.link.projectId) !== false) return "";
   let session;
@@ -17654,7 +17787,7 @@ async function backfillLinkAccount() {
   const resolution = resolvedLink();
   if (!resolution) return;
   if (resolution.link.accountId && resolution.link.accountSlug) return;
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) return;
   if (await projectIsVisible(token, resolution.link.projectId) !== true) return;
   try {
@@ -17679,25 +17812,17 @@ async function runLogin(opts) {
   if (pastedToken) {
     saveToken(pastedToken, apiUrl);
     process.stdout.write("Token saved.\n");
+    warnIfEnvTokenOverrides();
     return;
   }
-  if (opts.email && opts.password) {
-    const token2 = await login(apiUrl, { email: opts.email, password: opts.password });
-    saveToken(token2, apiUrl);
-    process.stdout.write(`Logged in as ${opts.email}.
-`);
-    return;
-  }
-  if (opts.email || opts.password) {
-    throw new Error("Provide BOTH --email and --password, or omit them to log in via the browser.");
-  }
   const { token, apiUrl: learnedApiUrl } = await browserLogin(resolveDashboardUrl(opts.dashboardUrl));
   saveToken(token, learnedApiUrl ?? apiUrl);
   process.stdout.write("Logged in.\n");
+  warnIfEnvTokenOverrides();
 }
 async function runWhoami(opts = {}) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token ?? "";
+  const token = resolveToken() ?? "";
   try {
     const me = await whoami(apiUrl, token);
     process.stdout.write(
@@ -17708,14 +17833,22 @@ async function runWhoami(opts = {}) {
     await reportError(err);
   }
 }
+function warnIfEnvTokenOverrides() {
+  if (process.env.KRYD_TOKEN?.trim()) {
+    process.stderr.write(
+      "KRYD_TOKEN is set in this shell and overrides the stored login; commands keep using it until you unset it.\n"
+    );
+  }
+}
 function runLogout() {
   clearToken();
   process.stdout.write("Logged out.\n");
+  warnIfEnvTokenOverrides();
 }
 async function runInit(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const cwd = opts.cwd ?? process.cwd();
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -17938,7 +18071,7 @@ async function replayStoredLog(apiUrl, token, deploymentId) {
 }
 async function runLogs(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -17990,7 +18123,7 @@ async function runLogs(opts) {
 }
 async function runRuntimeLogs(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18047,7 +18180,7 @@ async function runRuntimeLogs(opts) {
 }
 async function runDeploy(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18083,7 +18216,7 @@ function renderFor(logs) {
 var LOGS_FLAG_HELP = "stream the full build log line by line instead of the progress display";
 async function runPush(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18235,7 +18368,7 @@ async function followApps(apiUrl, token, deployments, render, estimateFrom) {
 }
 async function runRollback(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18266,7 +18399,7 @@ async function runRollback(opts) {
 }
 async function runRedeploy(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18296,7 +18429,7 @@ ${note}
 }
 async function runDbAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18377,7 +18510,7 @@ function reportSettleResult(result, opts) {
 }
 async function runStorageAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18471,7 +18604,7 @@ ${listed}Re-run \`kryd project rm <id>\` with the one you mean.
 }
 async function runProjectRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18586,7 +18719,7 @@ async function describeProjectResources(apiUrl, token, projectId) {
 }
 async function runDbRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18625,7 +18758,7 @@ async function runDbRemove(opts) {
 }
 async function runAiAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18650,7 +18783,7 @@ async function runAiAdd(opts) {
 }
 async function runAiRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18717,7 +18850,7 @@ Remove it before attaching another.
 }
 async function runDbStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18737,7 +18870,7 @@ async function runDbStatus(opts) {
 }
 async function runStorageStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18757,7 +18890,7 @@ async function runStorageStatus(opts) {
 }
 async function runAiStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18793,7 +18926,7 @@ function daysUntil(iso) {
 var TOKEN_EXPIRY_WARNING_DAYS = 30;
 async function runWorkflowAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18826,7 +18959,7 @@ HATCHET_CLIENT_TOKEN will be injected on your next production deploy (kryd deplo
 }
 async function runWorkflowRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18871,7 +19004,7 @@ Workflow history, crons and schedules stay until the project is deleted.
 }
 async function runWorkflowStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -18930,7 +19063,7 @@ function formatDomainRecords(records) {
 }
 function domainContext(opts, usage2) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19337,7 +19470,7 @@ HATCHET_CLIENT_TOKEN is injected into your app and your worker on production dep
 }
 async function runStorageRemove(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19400,7 +19533,7 @@ function envAnnotation(environments) {
 }
 async function runProjectList(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19451,7 +19584,7 @@ ${rows}`;
 }
 async function runEnvList(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19533,7 +19666,7 @@ function toDotenvLine(key, value) {
 }
 async function runEnvPull(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19634,7 +19767,7 @@ async function runEnvSet(opts) {
   const scope = opts.build ? "build" : "runtime";
   const environment = opts.preview ? "preview" : "production";
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19729,7 +19862,7 @@ async function runEnvRemove(opts) {
   const scope = opts.build ? "build" : "runtime";
   const environment = opts.preview ? "preview" : "production";
   const apiUrl = resolveApiUrl(opts.apiUrl);
-  const token = loadConfig().token;
+  const token = resolveToken();
   if (!token) {
     process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
     process.exitCode = 1;
@@ -19823,13 +19956,13 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.13.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.15.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.hook("postAction", async () => {
   await backfillLinkAccount();
 });
-program.command("login").description("Sign in via the browser (default) and store a token").option("--email <email>", "account email (with --password; non-interactive escape hatch)").option("--password <password>", "account password (with --email; visible in `ps` \u2014 prefer the browser flow)").option(
+program.command("login").description("Sign in via the browser (default) and store a token").option(
   "--token <token>",
   "supply a token instead of the browser flow (prefer $KRYD_TOKEN \u2014 flags are visible in `ps`)"
 ).option("--api-url <url>", "control-plane API base URL").option("--dashboard-url <url>", "dashboard base URL for the browser approve page (default app.kryd.eu)").action((opts) => runLogin(opts));
@@ -19971,6 +20104,10 @@ support.command("new").description(
 support.command("list").description("Your account's tickets, with their status").option("--json", "print { items } as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runSupportList(opts));
 support.command("show <ticket>").description("One ticket and its conversation, e.g. `kryd support show T-1042`").option("--json", "print the ticket and its messages as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportShow(ticket, opts));
 support.command("reply <ticket>").description("Answer in a ticket's conversation \u2014 the ticket goes back to Kryd support (status open)").option("--message <text>", "your reply (required)").option("--json", "print the updated ticket as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportReply(ticket, opts));
+var tokenCommand = program.command("token").description("Deploy tokens for CI and scripts: set one as KRYD_TOKEN and every command uses it, no login needed");
+tokenCommand.command("create <name>").description("Create a deploy token and print it once \u2014 it acts as you, inside your account").option("--expires <days>", "30 | 90 | 365 | never", DEFAULT_TOKEN_EXPIRY).option("--api-url <url>", "control-plane API base URL").action((name, opts) => runTokenCreate(name, opts));
+tokenCommand.command("list").description("Your deploy tokens: name, first characters, created, last used, expiry \u2014 never the value").option("--json", "print the tokens as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runTokenList(opts));
+tokenCommand.command("revoke <id>").description("Revoke a deploy token; anything still using it gets 401").option("--api-url <url>", "control-plane API base URL").action((id, opts) => runTokenRevoke(id, opts));
 function invokedDirectly() {
   const entry = process.argv[1];
   if (!entry) return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Kryd CLI — git push → live on the European cloud for your AI: SSL, managed Postgres & object storage, and an EU-hosted AI gateway. Your code and model calls stay in the EU. Beta: sign up at https://kryd.eu/beta",
   "keywords": [
     "kryd",
@@ -42,8 +42,8 @@
     "typescript": "^5.6.3",
     "vitest": "^2.1.8",
     "@kryd/shared-types": "0.0.0",
-    "@kryd/config-eslint": "0.0.0",
-    "@kryd/config-ts": "0.0.0"
+    "@kryd/config-ts": "0.0.0",
+    "@kryd/config-eslint": "0.0.0"
   },
   "scripts": {
     "build": "esbuild src/index.ts --bundle --platform=node --format=esm --external:commander --define:__KRYD_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/index.js",