@kryd/cli 0.15.0 → 0.17.0

package/README.md

@@ -17,8 +17,7 @@ Requires Node.js ≥ 22 and git (the CLI shells out to git for `kryd init` and `
 ## Quickstart
 
 ```sh
-kryd login                    # sign in via the browser
-kryd init                     # link this folder to a Kryd project (+ a `kryd` git remote)
+kryd init                     # link this folder to a Kryd project (+ a `kryd` git remote); not signed in? it asks, then signs you in via the browser
 kryd push                     # push the current branch → build → deploy → live, with live progress
 kryd logs                     # the full build log of the latest deploy (kryd push shows progress, not log lines)
 kryd logs <project> --runtime # tail the live app's stdout/stderr
@@ -31,8 +30,9 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 
 | Command | What it does |
 |---|---|
-| `kryd login` / `logout` / `whoami` | Authenticate the CLI (browser flow); the token is stored in `~/.kryd`. |
-| `kryd init` | Link the current repo to a Kryd project + register the deploy webhook + add a `kryd` git remote. |
+| `kryd login` / `logout` / `whoami` | Authenticate the CLI (browser flow); the token is stored in `~/.kryd`. `whoami` shows the account commands run in, your role there, and your other accounts. |
+| `kryd account list \| use <slug>` | You can belong to several accounts (your own, a customer's as a member). `list` shows them with your role in each, `*` marking the current one; `use` makes every following command run in that account. |
+| `kryd init` | Link the current repo to a Kryd project + register the deploy webhook + add a `kryd` git remote. Not logged in and at a terminal? It asks, then runs the same browser login as `kryd login`; without a terminal it refuses (a deploy token, `KRYD_TOKEN`, cannot create a project). |
 | `kryd push [branch]` | Push to the `kryd` remote and follow the deploy it triggers (defaults to the current branch). Shows which step the deploy is on, how long it has taken and a progress bar; `--logs` streams the full build log instead. |
 | `kryd deploy [project]` | Re-deploy the production-branch HEAD already on the forge — no new commit. |
 | `kryd logs [target]` | Follow a deploy's build/deploy log **in full** — this is where the build output lives (`--runtime` tails the live container instead; `--worker` tails the project's workflow worker, also when it has a web app). |
@@ -43,7 +43,7 @@ Once you've run `kryd init` in a directory, the commands below work **arg-less**
 | `kryd ai add \| remove \| status [project]` | Give the project an authenticated EU AI-gateway endpoint (injected on the next deploy), take it away again, or show what it has. |
 | `kryd workflow add \| remove \| status [project]` | Give the project its own durable-workflow tenant — `HATCHET_CLIENT_TOKEN` is injected on the next deploy — revoke that token again, or show whether it has one and when it expires. `remove` keeps the tenant's history, crons and schedules until the project is deleted. |
 | `kryd workflow init --language <typescript\|python\|go>` | Scaffold a workflow worker here and link it as a new project. The worker ships with the small HTTP health listener Kryd's deploy gate needs — without it a deploy is torn down with "nothing listening yet" — plus a `kryd.json` that tells `kryd init` what this project is. `--no-link` writes the files only. |
-| `kryd token create \| list \| revoke` | Deploy tokens for CI and scripts. `create <name> [--expires 30\|90\|365\|never]` (default 90 days) prints the token once; it acts as you, inside your account, and cannot create tokens itself. Managing tokens needs `kryd login`. A token can do what you can on your projects — read env values and push — so after a leak, revoke it and also rotate the secrets it could read. |
+| `kryd token create \| list \| revoke` | Deploy tokens for CI and scripts. `create <name> [--expires 30\|90\|365\|never]` (default 90 days) prints the token once; it acts as you, with your role in the **current account**, is bound to that one account for good, and cannot create tokens itself. Managing tokens needs `kryd login`. A token can do what you can on your projects — read env values and push — so after a leak, revoke it and also rotate the secrets it could read. |
 | `kryd support new \| list \| show \| reply` | Ask Kryd support a question, report a bug or a wish, and read the answer. Non-interactive (every input is a flag) and `--json` prints one JSON document on stdout — so an agent can use it too. In a linked folder, `new` adds the project and its last production deploy; when that deploy failed, the last lines of its log are sent to Kryd support too, with secret-looking values masked. `--no-context` leaves all of it out. |
 
 For an agent, for example:
@@ -60,6 +60,8 @@ kryd token create github-actions     # prints kryd_… once — store it as the
 KRYD_TOKEN=kryd_… kryd deploy <project>
 ```
 
+**Several accounts.** Every request names its account in a `Kryd-Account` header: the one chosen with `kryd account use <slug>` (stored in `~/.kryd/config.json`). With nothing chosen no header is sent and the API uses your only account; if you are in several it answers `account.required` and the CLI tells you to run `kryd account use`. `kryd login` chooses for you when you are in several — the account you own, else the first you joined — and says so. A deploy token never sends the header: it runs in the account it was created in, and `kryd token create` says which. When your role lacks something, the error names the missing permission (for example `deploy`).
+
 Run `kryd <command> --help` for options. Every project-scoped command accepts an explicit `<project>` id, or resolves it from the `.kryd` link (walking up from the current directory, git-style).
 
 ## Sovereignty