@kryd/cli 0.15.0 → 0.16.0

package/README.md

@@ -31,7 +31,8 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 
 | Command | What it does |
 |---|---|
-| `kryd login` / `logout` / `whoami` | Authenticate the CLI (browser flow); the token is stored in `~/.kryd`. |
+| `kryd login` / `logout` / `whoami` | Authenticate the CLI (browser flow); the token is stored in `~/.kryd`. `whoami` shows the account commands run in, your role there, and your other accounts. |
+| `kryd account list \| use <slug>` | You can belong to several accounts (your own, a customer's as a member). `list` shows them with your role in each, `*` marking the current one; `use` makes every following command run in that account. |
 | `kryd init` | Link the current repo to a Kryd project + register the deploy webhook + add a `kryd` git remote. |
 | `kryd push [branch]` | Push to the `kryd` remote and follow the deploy it triggers (defaults to the current branch). Shows which step the deploy is on, how long it has taken and a progress bar; `--logs` streams the full build log instead. |
 | `kryd deploy [project]` | Re-deploy the production-branch HEAD already on the forge — no new commit. |
@@ -43,7 +44,7 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 | `kryd ai add \| remove \| status [project]` | Give the project an authenticated EU AI-gateway endpoint (injected on the next deploy), take it away again, or show what it has. |
 | `kryd workflow add \| remove \| status [project]` | Give the project its own durable-workflow tenant — `HATCHET_CLIENT_TOKEN` is injected on the next deploy — revoke that token again, or show whether it has one and when it expires. `remove` keeps the tenant's history, crons and schedules until the project is deleted. |
 | `kryd workflow init --language <typescript\|python\|go>` | Scaffold a workflow worker here and link it as a new project. The worker ships with the small HTTP health listener Kryd's deploy gate needs — without it a deploy is torn down with "nothing listening yet" — plus a `kryd.json` that tells `kryd init` what this project is. `--no-link` writes the files only. |
-| `kryd token create \| list \| revoke` | Deploy tokens for CI and scripts. `create <name> [--expires 30\|90\|365\|never]` (default 90 days) prints the token once; it acts as you, inside your account, and cannot create tokens itself. Managing tokens needs `kryd login`. A token can do what you can on your projects — read env values and push — so after a leak, revoke it and also rotate the secrets it could read. |
+| `kryd token create \| list \| revoke` | Deploy tokens for CI and scripts. `create <name> [--expires 30\|90\|365\|never]` (default 90 days) prints the token once; it acts as you, with your role in the **current account**, is bound to that one account for good, and cannot create tokens itself. Managing tokens needs `kryd login`. A token can do what you can on your projects — read env values and push — so after a leak, revoke it and also rotate the secrets it could read. |
 | `kryd support new \| list \| show \| reply` | Ask Kryd support a question, report a bug or a wish, and read the answer. Non-interactive (every input is a flag) and `--json` prints one JSON document on stdout — so an agent can use it too. In a linked folder, `new` adds the project and its last production deploy; when that deploy failed, the last lines of its log are sent to Kryd support too, with secret-looking values masked. `--no-context` leaves all of it out. |
 
 For an agent, for example:
@@ -60,6 +61,8 @@ kryd token create github-actions     # prints kryd_… once — store it as the
 KRYD_TOKEN=kryd_… kryd deploy <project>
 ```
 
+**Several accounts.** Every request names its account in a `Kryd-Account` header: the one chosen with `kryd account use <slug>` (stored in `~/.kryd/config.json`). With nothing chosen no header is sent and the API uses your only account; if you are in several it answers `account.required` and the CLI tells you to run `kryd account use`. `kryd login` chooses for you when you are in several — the account you own, else the first you joined — and says so. A deploy token never sends the header: it runs in the account it was created in, and `kryd token create` says which. When your role lacks something, the error names the missing permission (for example `deploy`).
+
 Run `kryd <command> --help` for options. Every project-scoped command accepts an explicit `<project>` id, or resolves it from the `.kryd` link (walking up from the current directory, git-style).
 
 ## Sovereignty

package/dist/index.js

@@ -8,6 +8,22 @@ var __export = (target, all) => {
 // src/index.ts
 import { Command } from "commander";
 
+// ../../packages/shared-types/dist/api.js
+var ERROR_CODES = {
+  validationFailed: "validation.failed",
+  unauthorized: "auth.unauthorized",
+  forbidden: "auth.forbidden",
+  notFound: "resource.not_found",
+  conflict: "resource.conflict",
+  unprocessable: "request.unprocessable",
+  badRequest: "request.bad",
+  internal: "internal.error",
+  // KRYD-516b: a request that names no account while the caller is in several (400), and a member
+  // whose role lacks the route's permission (403, `details.permission` names it).
+  accountRequired: "account.required",
+  permissionRequired: "auth.permission_required"
+};
+
 // ../../packages/shared-types/dist/db-url.js
 function isValidPostgresConnectionString(value) {
   if (value.length === 0 || /\s/.test(value))
@@ -14875,6 +14891,42 @@ function parseTicketNumber(raw) {
 var TICKET_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
 var TICKET_ATTACHMENT_MAX_SIZE_LABEL = `${TICKET_ATTACHMENT_MAX_BYTES / (1024 * 1024)} MB`;
 
+// ../../packages/shared-types/dist/permissions.js
+var PERMISSIONS = [
+  /** Open the site of a private preview or a closed production (enforced from KRYD-575). */
+  "app:view",
+  /** See the account itself: name, slug. */
+  "account:view",
+  /** Rename the account and change its slug. */
+  "account:manage",
+  /** See who is a member, and the invites still open. */
+  "members:view",
+  /** Invite people, change a member's role, remove a member. */
+  "members:manage",
+  /** See usage and costs. */
+  "usage:view",
+  /** See projects, deploys, domains, databases, storage, AI and workflows. */
+  "projects:view",
+  /** Change a project: env vars, domains, databases, storage, AI, workflows, remove it. */
+  "projects:manage",
+  /** Read env var VALUES (secrets), not only their names. */
+  "env:read",
+  /** Link a repository, deploy, roll back, get a push credential, manage deploy hooks. */
+  "deploy",
+  /** Read build and runtime logs. */
+  "logs:view",
+  /** Trigger, cancel and replay workflow runs; add and remove crons and schedules. */
+  "workflows:run",
+  /** Open and answer support tickets. */
+  "support"
+];
+var ROLES = {
+  owner: PERMISSIONS,
+  member: PERMISSIONS.filter((p) => p !== "members:manage" && p !== "account:manage"),
+  viewer: ["app:view"]
+};
+var ACCOUNT_HEADER = "Kryd-Account";
+
 // ../../packages/shared-types/dist/workflow-run.js
 var MAX_WEBHOOK_NAME = 32;
 var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
@@ -14936,6 +14988,209 @@ import {
 import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, relative, resolve as resolve2 } from "node:path";
 import { pathToFileURL } from "node:url";
 
+// src/config.ts
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var DEFAULT_API_URL = "http://localhost:3000";
+function configPath() {
+  const dir = process.env.KRYD_CONFIG_DIR ?? join(homedir(), ".kryd");
+  return join(dir, "config.json");
+}
+function loadConfig() {
+  let raw;
+  try {
+    raw = readFileSync(configPath(), "utf8");
+  } catch {
+    return {};
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    process.stderr.write(
+      `warning: ${configPath()} is not valid JSON \u2014 ignoring it.
+`
+    );
+    return {};
+  }
+}
+function resolveToken() {
+  const fromEnv = process.env.KRYD_TOKEN?.trim();
+  return fromEnv ? fromEnv : loadConfig().token;
+}
+function writeConfig(config2) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
+  chmodSync(path, 384);
+}
+function saveToken(token, apiUrl) {
+  const config2 = loadConfig();
+  config2.token = token;
+  if (apiUrl) config2.apiUrl = apiUrl;
+  writeConfig(config2);
+}
+function clearToken() {
+  const config2 = loadConfig();
+  delete config2.token;
+  delete config2.account;
+  delete config2.accountSlug;
+  writeConfig(config2);
+}
+function saveAccount(account) {
+  const config2 = loadConfig();
+  config2.account = account.accountId;
+  if (account.slug) config2.accountSlug = account.slug;
+  else delete config2.accountSlug;
+  writeConfig(config2);
+}
+function clearAccount() {
+  const config2 = loadConfig();
+  delete config2.account;
+  delete config2.accountSlug;
+  writeConfig(config2);
+}
+var DEPLOY_TOKEN_PREFIX = "kryd_";
+function accountHeader(token) {
+  if (!token || token.startsWith(DEPLOY_TOKEN_PREFIX)) return {};
+  const account = loadConfig().account;
+  return account ? { [ACCOUNT_HEADER]: account } : {};
+}
+function authHeaders(token) {
+  return { authorization: `Bearer ${token}`, ...accountHeader(token) };
+}
+var lastApiUrl = null;
+function resolveApiUrl(flag) {
+  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  return lastApiUrl;
+}
+function currentApiUrl() {
+  return lastApiUrl ?? resolveApiUrl();
+}
+var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
+function resolveDashboardUrl(flag) {
+  return flag ?? process.env.KRYD_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL;
+}
+var PROJECT_LINK_DIR = ".kryd";
+var PROJECT_LINK_FILE = "project.json";
+function findProjectLinkDir(cwd = process.cwd()) {
+  let dir = cwd;
+  for (; ; ) {
+    if (existsSync(join(dir, PROJECT_LINK_DIR, PROJECT_LINK_FILE))) return dir;
+    if (existsSync(join(dir, ".git"))) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function loadProjectLink(cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const path = join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    process.stderr.write(`warning: ${path} is not valid JSON \u2014 ignoring it.
+`);
+    return null;
+  }
+  if (!parsed || typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
+    process.stderr.write(`warning: ${path} has no projectId \u2014 ignoring it.
+`);
+    return null;
+  }
+  return parsed;
+}
+function saveProjectLink(cwd, link) {
+  const dir = join(cwd, PROJECT_LINK_DIR);
+  mkdirSync(dir, { recursive: true });
+  const path = join(dir, PROJECT_LINK_FILE);
+  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
+  return path;
+}
+function ensureIgnored(cwd, entry, aliases = []) {
+  const path = join(cwd, ".gitignore");
+  let current = "";
+  try {
+    current = readFileSync(path, "utf8");
+  } catch {
+  }
+  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
+  if (present) return false;
+  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
+  appendFileSync(path, `${prefix}${entry}
+`);
+  return true;
+}
+function ensureKrydIgnored(cwd) {
+  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
+}
+function directoryIsLinked(cwd) {
+  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  if (!existsSync(path)) return null;
+  return loadProjectLink(cwd);
+}
+function writeSecretFile(path, contents) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, contents, { mode: 384 });
+  chmodSync(path, 384);
+}
+function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return false;
+  const link = loadProjectLink(cwd);
+  if (link?.projectId !== projectId) return false;
+  try {
+    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolvedLink() {
+  return lastLinkResolution;
+}
+var lastLinkResolution = null;
+function resolveProjectId(explicit, cwd = process.cwd()) {
+  lastLinkResolution = null;
+  if (explicit) return explicit;
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const link = loadProjectLink(cwd);
+  if (!link) return null;
+  lastLinkResolution = { root, link };
+  return link.projectId;
+}
+function rememberLinkAccount(root, account) {
+  if (!account.accountId) return false;
+  const link = directoryIsLinked(root);
+  if (!link) return false;
+  const slug = account.accountSlug ?? link.accountSlug;
+  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
+  saveProjectLink(root, {
+    ...link,
+    accountId: account.accountId,
+    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
+    ...slug ? { accountSlug: slug } : {}
+  });
+  return true;
+}
+
 // src/client.ts
 var ApiError = class extends Error {
   envelope;
@@ -14965,7 +15220,7 @@ async function parseEnvelope(res) {
 }
 async function whoami(apiUrl, token) {
   const res = await fetch(`${apiUrl}/me`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -14981,7 +15236,7 @@ async function linkProject(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify(input)
   });
@@ -15005,7 +15260,7 @@ async function attachDatabase(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({
       projectId: input.projectId,
@@ -15036,7 +15291,7 @@ async function createStorage(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15058,7 +15313,7 @@ async function enableAi(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15077,7 +15332,7 @@ async function enableAi(apiUrl, token, input) {
 }
 async function getAiStatus(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/ai/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15095,7 +15350,7 @@ async function getAiStatus(apiUrl, token, projectId) {
 async function removeAi(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/ai/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15117,7 +15372,7 @@ async function addWorkflows(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15132,7 +15387,7 @@ async function addWorkflows(apiUrl, token, input) {
 }
 async function getWorkflowStatus(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15146,7 +15401,7 @@ async function getWorkflowStatus(apiUrl, token, projectId) {
 async function removeWorkflows(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15197,7 +15452,7 @@ function domainsUrl(apiUrl, projectId) {
 }
 async function listDomains(apiUrl, token, projectId) {
   const res = await fetch(domainsUrl(apiUrl, projectId), {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Domain listing failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15214,7 +15469,7 @@ async function listDomains(apiUrl, token, projectId) {
 async function addDomain(apiUrl, token, projectId, host, app, redirectTo) {
   const res = await fetch(domainsUrl(apiUrl, projectId), {
     method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+    headers: { "content-type": "application/json", ...authHeaders(token) },
     body: JSON.stringify({ host, ...app ? { app } : {}, ...redirectTo !== void 0 ? { redirectTo } : {} })
   });
   if (!res.ok) {
@@ -15225,7 +15480,7 @@ async function addDomain(apiUrl, token, projectId, host, app, redirectTo) {
 async function removeDomain(apiUrl, token, projectId, host) {
   const res = await fetch(`${domainsUrl(apiUrl, projectId)}/${encodeURIComponent(host)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Domain removal failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15237,7 +15492,7 @@ function deployHookUrl(apiUrl, projectId) {
 async function createDeployHook(apiUrl, token, projectId) {
   const res = await fetch(deployHookUrl(apiUrl, projectId), {
     method: "PUT",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Deploy hook creation failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15251,7 +15506,7 @@ async function createDeployHook(apiUrl, token, projectId) {
 async function removeDeployHook(apiUrl, token, projectId) {
   const res = await fetch(deployHookUrl(apiUrl, projectId), {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Deploy hook removal failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15264,7 +15519,7 @@ async function removeDeployHook(apiUrl, token, projectId) {
 }
 async function fetchResourceStatus(apiUrl, token, path) {
   const res = await fetch(`${apiUrl}${path}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15347,7 +15602,7 @@ async function pollResourceDetached(fetchStatus, opts) {
 async function detachDatabase(apiUrl, token, projectId) {
   const res = await fetch(
     `${apiUrl}/databases/${encodeURIComponent(projectId)}`,
-    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+    { method: "DELETE", headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15359,7 +15614,7 @@ async function detachDatabase(apiUrl, token, projectId) {
 }
 async function getProject(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (res.status === 404) return null;
   if (!res.ok) {
@@ -15369,7 +15624,7 @@ async function getProject(apiUrl, token, projectId) {
 }
 async function listProjects(apiUrl, token) {
   const res = await fetch(`${apiUrl}/projects`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15379,7 +15634,7 @@ async function listProjects(apiUrl, token) {
 async function deleteProject(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15412,7 +15667,7 @@ async function pollProjectDeleted(read, opts) {
 async function detachStorage(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/storage/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15425,7 +15680,7 @@ async function detachStorage(apiUrl, token, projectId) {
 async function listEnvVars(apiUrl, token, projectId, include = "all") {
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env?scope=${encodeURIComponent(include)}`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15478,7 +15733,7 @@ async function pullEnvValues(apiUrl, token, projectId, environment = "production
   const query = environment === "production" ? "" : `?environment=${encodeURIComponent(environment)}`;
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/values${query}`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15512,7 +15767,7 @@ async function setEnvVar(apiUrl, token, projectId, key, value, scope = "runtime"
       method: "PUT",
       headers: {
         "content-type": "application/json",
-        authorization: `Bearer ${token}`
+        ...authHeaders(token)
       },
       // `scope`/`environment` are sent only when NOT their defaults. An api older than KRYD-156/159
       // ignores unknown body fields, so this is belt-and-braces — but it keeps a plain runtime
@@ -15553,7 +15808,7 @@ async function removeEnvVar(apiUrl, token, projectId, key, scope = "runtime", en
   const query = params.toString() ? `?${params.toString()}` : "";
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(key)}${query}`,
-    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+    { method: "DELETE", headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15579,7 +15834,7 @@ async function triggerDeploy(apiUrl, token, projectId) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId })
   });
@@ -15597,7 +15852,7 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId, app) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({
       projectId,
@@ -15615,7 +15870,7 @@ async function redeployProject(apiUrl, token, projectId, app) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId, ...app ? { app } : {} })
   });
@@ -15627,7 +15882,7 @@ async function redeployProject(apiUrl, token, projectId, app) {
 async function listDeployments(apiUrl, token, projectId) {
   const url2 = new URL(`${apiUrl}/deployments`);
   if (projectId) url2.searchParams.set("projectId", projectId);
-  const res = await fetch(url2, { headers: { authorization: `Bearer ${token}` } });
+  const res = await fetch(url2, { headers: { ...authHeaders(token) } });
   if (!res.ok) {
     throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res), res.status);
   }
@@ -15731,7 +15986,7 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
     let dropped = false;
     try {
       const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/logs`, {
-        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }
+        headers: { ...authHeaders(token), accept: "text/event-stream" }
       });
       if (!res.ok) {
         throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15773,7 +16028,7 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
       if (afterNs) url2.searchParams.set("after", afterNs);
       else if (opts.since) url2.searchParams.set("since", opts.since);
       const res = await doFetch(url2, {
-        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" },
+        headers: { ...authHeaders(token), accept: "text/event-stream" },
         ...opts.signal ? { signal: opts.signal } : {}
       });
       if (!res.ok) {
@@ -15803,7 +16058,7 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
 async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
   const doFetch = opts.fetchImpl ?? fetch;
   const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/log`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (res.status === 404) return null;
   if (!res.ok) {
@@ -15818,7 +16073,7 @@ async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
 async function fetchPushCredential(apiUrl, token, projectId) {
   const res = await fetch(
     `${apiUrl}/repos/${encodeURIComponent(projectId)}/push-credential`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15847,7 +16102,7 @@ async function supportFetch(apiUrl, token, path, what, init = {}) {
   const res = await fetch(`${apiUrl}${path}`, {
     method: init.method ?? "GET",
     headers: {
-      authorization: `Bearer ${token}`,
+      ...authHeaders(token),
       ...init.body !== void 0 ? { "content-type": "application/json" } : {}
     },
     ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {}
@@ -15897,185 +16152,6 @@ async function replySupportTicket(apiUrl, token, ref, text) {
   return body;
 }
 
-// src/config.ts
-import {
-  appendFileSync,
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync
-} from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-var DEFAULT_API_URL = "http://localhost:3000";
-function configPath() {
-  const dir = process.env.KRYD_CONFIG_DIR ?? join(homedir(), ".kryd");
-  return join(dir, "config.json");
-}
-function loadConfig() {
-  let raw;
-  try {
-    raw = readFileSync(configPath(), "utf8");
-  } catch {
-    return {};
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    process.stderr.write(
-      `warning: ${configPath()} is not valid JSON \u2014 ignoring it.
-`
-    );
-    return {};
-  }
-}
-function resolveToken() {
-  const fromEnv = process.env.KRYD_TOKEN?.trim();
-  return fromEnv ? fromEnv : loadConfig().token;
-}
-function writeConfig(config2) {
-  const path = configPath();
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
-  chmodSync(path, 384);
-}
-function saveToken(token, apiUrl) {
-  const config2 = loadConfig();
-  config2.token = token;
-  if (apiUrl) config2.apiUrl = apiUrl;
-  writeConfig(config2);
-}
-function clearToken() {
-  const config2 = loadConfig();
-  delete config2.token;
-  writeConfig(config2);
-}
-var lastApiUrl = null;
-function resolveApiUrl(flag) {
-  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
-  return lastApiUrl;
-}
-function currentApiUrl() {
-  return lastApiUrl ?? resolveApiUrl();
-}
-var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
-function resolveDashboardUrl(flag) {
-  return flag ?? process.env.KRYD_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL;
-}
-var PROJECT_LINK_DIR = ".kryd";
-var PROJECT_LINK_FILE = "project.json";
-function findProjectLinkDir(cwd = process.cwd()) {
-  let dir = cwd;
-  for (; ; ) {
-    if (existsSync(join(dir, PROJECT_LINK_DIR, PROJECT_LINK_FILE))) return dir;
-    if (existsSync(join(dir, ".git"))) return null;
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function loadProjectLink(cwd = process.cwd()) {
-  const root = findProjectLinkDir(cwd);
-  if (!root) return null;
-  const path = join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
-  let raw;
-  try {
-    raw = readFileSync(path, "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    process.stderr.write(`warning: ${path} is not valid JSON \u2014 ignoring it.
-`);
-    return null;
-  }
-  if (!parsed || typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
-    process.stderr.write(`warning: ${path} has no projectId \u2014 ignoring it.
-`);
-    return null;
-  }
-  return parsed;
-}
-function saveProjectLink(cwd, link) {
-  const dir = join(cwd, PROJECT_LINK_DIR);
-  mkdirSync(dir, { recursive: true });
-  const path = join(dir, PROJECT_LINK_FILE);
-  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
-  return path;
-}
-function ensureIgnored(cwd, entry, aliases = []) {
-  const path = join(cwd, ".gitignore");
-  let current = "";
-  try {
-    current = readFileSync(path, "utf8");
-  } catch {
-  }
-  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
-  if (present) return false;
-  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
-  appendFileSync(path, `${prefix}${entry}
-`);
-  return true;
-}
-function ensureKrydIgnored(cwd) {
-  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
-}
-function directoryIsLinked(cwd) {
-  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
-  if (!existsSync(path)) return null;
-  return loadProjectLink(cwd);
-}
-function writeSecretFile(path, contents) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, contents, { mode: 384 });
-  chmodSync(path, 384);
-}
-function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
-  const root = findProjectLinkDir(cwd);
-  if (!root) return false;
-  const link = loadProjectLink(cwd);
-  if (link?.projectId !== projectId) return false;
-  try {
-    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function resolvedLink() {
-  return lastLinkResolution;
-}
-var lastLinkResolution = null;
-function resolveProjectId(explicit, cwd = process.cwd()) {
-  lastLinkResolution = null;
-  if (explicit) return explicit;
-  const root = findProjectLinkDir(cwd);
-  if (!root) return null;
-  const link = loadProjectLink(cwd);
-  if (!link) return null;
-  lastLinkResolution = { root, link };
-  return link.projectId;
-}
-function rememberLinkAccount(root, account) {
-  if (!account.accountId) return false;
-  const link = directoryIsLinked(root);
-  if (!link) return false;
-  const slug = account.accountSlug ?? link.accountSlug;
-  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
-  saveProjectLink(root, {
-    ...link,
-    accountId: account.accountId,
-    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
-    ...slug ? { accountSlug: slug } : {}
-  });
-  return true;
-}
-
 // src/support.ts
 var SUPPORT_TYPES = TICKET_TYPES;
 var MESSAGE_MAX = 2e4;
@@ -16312,6 +16388,110 @@ async function runSupportReply(raw, opts) {
   }
 }
 
+// src/account.ts
+function fail(message) {
+  process.stderr.write(`${message}
+`);
+  process.exitCode = 1;
+}
+function membershipLabel(m) {
+  return m.slug ?? m.name ?? m.accountId;
+}
+function accountHint(err) {
+  if (!(err instanceof ApiError) || !err.envelope) return "";
+  const { code, details } = err.envelope.error;
+  if (code === ERROR_CODES.accountRequired) {
+    return "You belong to several accounts. Choose one with `kryd account use <slug>` (`kryd account list` shows them).\n";
+  }
+  if (code === ERROR_CODES.permissionRequired) {
+    const permission = typeof details?.permission === "string" ? ` \`${details.permission}\`` : " this permission";
+    const slug = loadConfig().accountSlug;
+    return `Your role in ${slug ? `account ${slug}` : "this account"} lacks${permission}. Ask the account's owner, or switch with \`kryd account use <slug>\`.
+`;
+  }
+  const stored = loadConfig();
+  if (code === ERROR_CODES.forbidden && stored.account && /not a member/i.test(err.envelope.error.message)) {
+    const name = stored.accountSlug ?? stored.account;
+    return `You are no longer a member of account ${name}, which this machine has chosen. See your accounts with \`kryd account list\`, then pick one with \`kryd account use <slug>\`.
+`;
+  }
+  return "";
+}
+async function runAccountList(opts = {}) {
+  const token = resolveToken();
+  if (!token) return fail("Not logged in \u2014 run `kryd login` first.");
+  let memberships;
+  let current;
+  try {
+    const me = await whoami(resolveApiUrl(opts.apiUrl), token);
+    memberships = me.memberships ?? [];
+    current = me.accountId;
+  } catch (err) {
+    return fail(err instanceof ApiError && err.envelope ? err.envelope.error.message : String(err));
+  }
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(memberships.map((m) => ({ ...m, current: m.accountId === current })), null, 2)}
+`);
+    return;
+  }
+  if (memberships.length === 0) {
+    process.stdout.write("You do not belong to any account.\n");
+    return;
+  }
+  const rows = [
+    ["", "SLUG", "NAME", "ROLE", "ID"],
+    ...memberships.map((m) => [m.accountId === current ? "*" : "", m.slug ?? "\u2014", m.name, m.role, m.accountId])
+  ];
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+  for (const r of rows) {
+    process.stdout.write(`${r.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd()}
+`);
+  }
+}
+async function runAccountUse(target, opts = {}) {
+  const token = resolveToken();
+  if (!token) return fail("Not logged in \u2014 run `kryd login` first.");
+  if (token.startsWith("kryd_")) {
+    return fail("A deploy token is bound to one account and cannot switch. Unset KRYD_TOKEN to use your login.");
+  }
+  let memberships;
+  try {
+    memberships = (await whoami(resolveApiUrl(opts.apiUrl), token)).memberships ?? [];
+  } catch (err) {
+    return fail(err instanceof ApiError && err.envelope ? err.envelope.error.message : String(err));
+  }
+  const wanted = target.trim();
+  const match = memberships.find((m) => m.slug === wanted || m.accountId === wanted);
+  if (!match) {
+    const known = memberships.map(membershipLabel).join(", ") || "none";
+    return fail(`You are not a member of an account "${wanted}". Your accounts: ${known}.`);
+  }
+  saveAccount({ accountId: match.accountId, slug: match.slug });
+  process.stdout.write(`Now using account ${membershipLabel(match)} (${match.role}).
+`);
+}
+async function settleAccountAfterLogin(apiUrl, token) {
+  if (token.startsWith("kryd_")) return;
+  let memberships;
+  try {
+    memberships = (await whoami(apiUrl, token)).memberships ?? [];
+  } catch {
+    return;
+  }
+  const stored = loadConfig().account;
+  if (stored && memberships.some((m) => m.accountId === stored)) return;
+  if (memberships.length <= 1) {
+    if (stored) clearAccount();
+    return;
+  }
+  const pick2 = memberships.find((m) => m.role === "owner") ?? memberships[0];
+  saveAccount({ accountId: pick2.accountId, slug: pick2.slug });
+  process.stdout.write(
+    `You belong to ${memberships.length} accounts; using ${membershipLabel(pick2)}. Switch with \`kryd account use <slug>\`.
+`
+  );
+}
+
 // src/tokens.ts
 var TOKEN_EXPIRY_CHOICES = ["30", "90", "365", "never"];
 var DEFAULT_TOKEN_EXPIRY = "90";
@@ -16325,7 +16505,7 @@ async function tokenFetch(apiUrl, token, path, what, body) {
   const res = await fetch(`${apiUrl}/api/auth/api-key/${path}`, {
     method: body === void 0 ? "GET" : "POST",
     headers: {
-      authorization: `Bearer ${token}`,
+      ...authHeaders(token),
       ...body !== void 0 ? { "content-type": "application/json" } : {}
     },
     ...body !== void 0 ? { body: JSON.stringify(body) } : {}
@@ -16363,50 +16543,53 @@ async function listDeployTokens(apiUrl, token) {
 async function revokeDeployToken(apiUrl, token, id) {
   await tokenFetch(apiUrl, token, "delete", "Revoking the token", { keyId: id });
 }
-function fail(message) {
+function fail2(message) {
   process.stderr.write(`${message}
 `);
   process.exitCode = 1;
 }
 function reportTokenError(err) {
   if (err instanceof ApiError && err.status === 401) {
-    fail("Not logged in, or the session expired \u2014 run `kryd login`.");
+    fail2("Not logged in, or the session expired \u2014 run `kryd login`.");
   } else if (err instanceof ApiError && err.status === 403 && resolveToken()?.startsWith("kryd_")) {
-    fail(
+    fail2(
       "A deploy token cannot manage tokens. Sign in with `kryd login` (and unset KRYD_TOKEN for this command)."
     );
   } else if (err instanceof ApiError && err.status === 404) {
-    fail("No such token on your account. `kryd token list` shows their ids.");
+    fail2("No such token on your account. `kryd token list` shows their ids.");
   } else if (err instanceof ApiError && err.envelope) {
-    fail(err.envelope.error.message);
+    fail2(err.envelope.error.message);
+    process.stderr.write(accountHint(err));
   } else {
-    fail(err instanceof Error ? err.message : String(err));
+    fail2(err instanceof Error ? err.message : String(err));
   }
 }
 function requireToken2() {
   const token = resolveToken();
-  if (!token) fail("Not logged in \u2014 run `kryd login` first.");
+  if (!token) fail2("Not logged in \u2014 run `kryd login` first.");
   return token ?? null;
 }
 var day = (iso) => iso ? iso.slice(0, 10) : "\u2014";
 async function runTokenCreate(name, opts) {
   const trimmed = name.trim();
   if (trimmed.length === 0 || trimmed.length > MAX_TOKEN_NAME) {
-    return fail(`A token name is 1 to ${MAX_TOKEN_NAME} characters.`);
+    return fail2(`A token name is 1 to ${MAX_TOKEN_NAME} characters.`);
   }
   const choice = opts.expires ?? DEFAULT_TOKEN_EXPIRY;
   const expiresIn = expiresInSeconds(choice);
   if (expiresIn === void 0) {
-    return fail(`--expires is one of ${TOKEN_EXPIRY_CHOICES.join(", ")} (days, or never).`);
+    return fail2(`--expires is one of ${TOKEN_EXPIRY_CHOICES.join(", ")} (days, or never).`);
   }
   const token = requireToken2();
   if (!token) return;
   try {
-    const created = await createDeployToken(resolveApiUrl(opts.apiUrl), token, { name: trimmed, expiresIn });
+    const apiUrl = resolveApiUrl(opts.apiUrl);
+    const created = await createDeployToken(apiUrl, token, { name: trimmed, expiresIn });
     process.stdout.write(`${created.key}
 `);
+    const account = await boundAccountLabel(apiUrl, token, created);
     process.stderr.write(
-      `Created deploy token "${trimmed}" (${created.id}), ${created.expiresAt ? `valid until ${day(created.expiresAt)}` : "without expiry"}.
+      `Created deploy token "${trimmed}" (${created.id})${account ? ` for account ${account}` : ""}, ${created.expiresAt ? `valid until ${day(created.expiresAt)}` : "without expiry"}.
 This token will not be shown again. Store it now, e.g. as the CI secret KRYD_TOKEN.
 `
     );
@@ -16414,6 +16597,17 @@ This token will not be shown again. Store it now, e.g. as the CI secret KRYD_TOK
     reportTokenError(err);
   }
 }
+async function boundAccountLabel(apiUrl, token, created) {
+  const id = typeof created.metadata?.accountId === "string" ? created.metadata.accountId : null;
+  if (!id) return null;
+  try {
+    const me = await whoami(apiUrl, token);
+    const m = me.memberships?.find((x) => x.accountId === id);
+    return m?.slug ?? id;
+  } catch {
+    return id;
+  }
+}
 async function runTokenList(opts) {
   const token = requireToken2();
   if (!token) return;
@@ -17740,6 +17934,7 @@ async function reportError(err) {
     process.stderr.write(`${err instanceof Error ? err.message : String(err)}
 `);
   }
+  process.stderr.write(accountHint(err));
   process.exitCode = 1;
   if (err instanceof ApiError) {
     process.stderr.write(await explainMissingProject(err));
@@ -17818,6 +18013,7 @@ async function runLogin(opts) {
   const { token, apiUrl: learnedApiUrl } = await browserLogin(resolveDashboardUrl(opts.dashboardUrl));
   saveToken(token, learnedApiUrl ?? apiUrl);
   process.stdout.write("Logged in.\n");
+  await settleAccountAfterLogin(learnedApiUrl ?? apiUrl, token);
   warnIfEnvTokenOverrides();
 }
 async function runWhoami(opts = {}) {
@@ -17825,10 +18021,17 @@ async function runWhoami(opts = {}) {
   const token = resolveToken() ?? "";
   try {
     const me = await whoami(apiUrl, token);
-    process.stdout.write(
-      `${me.email} (account ${me.accountId ?? "?"}, role ${me.role ?? "?"})
+    const current = me.memberships?.find((m) => m.accountId === me.accountId);
+    const label = current?.slug ?? me.accountSlug ?? me.accountId ?? "?";
+    process.stdout.write(`${me.email} (account ${label}, role ${current?.role ?? me.role ?? "?"})
+`);
+    const others = (me.memberships ?? []).filter((m) => m.accountId !== me.accountId);
+    if (others.length > 0) {
+      process.stdout.write(
+        `Also in: ${others.map((m) => `${m.slug ?? m.accountId} (${m.role})`).join(", ")} \u2014 switch with \`kryd account use <slug>\`.
 `
-    );
+      );
+    }
   } catch (err) {
     await reportError(err);
   }
@@ -19956,7 +20159,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.15.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.16.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.hook("postAction", async () => {
@@ -19967,6 +20170,9 @@ program.command("login").description("Sign in via the browser (default) and stor
   "supply a token instead of the browser flow (prefer $KRYD_TOKEN \u2014 flags are visible in `ps`)"
 ).option("--api-url <url>", "control-plane API base URL").option("--dashboard-url <url>", "dashboard base URL for the browser approve page (default app.kryd.eu)").action((opts) => runLogin(opts));
 program.command("whoami").description("Show the current account").option("--api-url <url>", "control-plane API base URL").action((opts) => runWhoami(opts));
+var accountCommand = program.command("account").description("The accounts you belong to, and which one commands run in");
+accountCommand.command("list").description("List your accounts and your role in each; * marks the one commands run in").option("--json", "print the accounts as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runAccountList(opts));
+accountCommand.command("use <slug>").description("Run every following command in this account").option("--api-url <url>", "control-plane API base URL").action((slug, opts) => runAccountUse(slug, opts));
 program.command("logout").description("Clear the stored token").action(() => runLogout());
 program.command("git-credential <operation>", { hidden: true }).description("git credential helper (invoked by git, not by you)").option("--api-url <url>", "control-plane API base URL").action(async (operation, opts) => {
   const chunks = [];
@@ -20105,7 +20311,7 @@ support.command("list").description("Your account's tickets, with their status")
 support.command("show <ticket>").description("One ticket and its conversation, e.g. `kryd support show T-1042`").option("--json", "print the ticket and its messages as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportShow(ticket, opts));
 support.command("reply <ticket>").description("Answer in a ticket's conversation \u2014 the ticket goes back to Kryd support (status open)").option("--message <text>", "your reply (required)").option("--json", "print the updated ticket as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportReply(ticket, opts));
 var tokenCommand = program.command("token").description("Deploy tokens for CI and scripts: set one as KRYD_TOKEN and every command uses it, no login needed");
-tokenCommand.command("create <name>").description("Create a deploy token and print it once \u2014 it acts as you, inside your account").option("--expires <days>", "30 | 90 | 365 | never", DEFAULT_TOKEN_EXPIRY).option("--api-url <url>", "control-plane API base URL").action((name, opts) => runTokenCreate(name, opts));
+tokenCommand.command("create <name>").description("Create a deploy token and print it once \u2014 it acts as you, bound to the current account").option("--expires <days>", "30 | 90 | 365 | never", DEFAULT_TOKEN_EXPIRY).option("--api-url <url>", "control-plane API base URL").action((name, opts) => runTokenCreate(name, opts));
 tokenCommand.command("list").description("Your deploy tokens: name, first characters, created, last used, expiry \u2014 never the value").option("--json", "print the tokens as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runTokenList(opts));
 tokenCommand.command("revoke <id>").description("Revoke a deploy token; anything still using it gets 401").option("--api-url <url>", "control-plane API base URL").action((id, opts) => runTokenRevoke(id, opts));
 function invokedDirectly() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kryd/cli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Kryd CLI — git push → live on the European cloud for your AI: SSL, managed Postgres & object storage, and an EU-hosted AI gateway. Your code and model calls stay in the EU. Beta: sign up at https://kryd.eu/beta",
   "keywords": [
     "kryd",