@kryd/cli 0.15.0 → 0.17.0

package/dist/index.js

@@ -8,6 +8,26 @@ var __export = (target, all) => {
 // src/index.ts
 import { Command } from "commander";
 
+// ../../packages/shared-types/dist/api.js
+var ERROR_CODES = {
+  validationFailed: "validation.failed",
+  unauthorized: "auth.unauthorized",
+  forbidden: "auth.forbidden",
+  notFound: "resource.not_found",
+  conflict: "resource.conflict",
+  unprocessable: "request.unprocessable",
+  badRequest: "request.bad",
+  internal: "internal.error",
+  // KRYD-516b: a request that names no account while the caller is in several (400), and a member
+  // whose role lacks the route's permission (403, `details.permission` names it).
+  accountRequired: "account.required",
+  permissionRequired: "auth.permission_required",
+  // KRYD-592: the analytics store (Umami's database) is unconfigured, down or too slow — a 503 the
+  // Analytics tab shows as its own error band while the rest of the dashboard carries on. (The spec
+  // wrote `analytics_unavailable`; dotted like every code here, which `api.test.ts` enforces.)
+  analyticsUnavailable: "analytics.unavailable"
+};
+
 // ../../packages/shared-types/dist/db-url.js
 function isValidPostgresConnectionString(value) {
   if (value.length === 0 || /\s/.test(value))
@@ -14721,6 +14741,12 @@ var accountUsageSchema = external_exports.object({
   storageBytes: external_exports.number().int().nonnegative()
 });
 
+// ../../packages/shared-types/dist/resource.js
+var BUCKET_UPLOAD_MAX_BYTES = 50 * 1024 * 1024;
+var BUCKET_UPLOAD_MAX_SIZE_LABEL = `${BUCKET_UPLOAD_MAX_BYTES / (1024 * 1024)} MB`;
+var BUCKET_UPLOAD_MAX_TOTAL_BYTES = 100 * 1024 * 1024;
+var BUCKET_UPLOAD_TOTAL_REFUSAL = `Je kunt maximaal ${BUCKET_UPLOAD_MAX_TOTAL_BYTES / (1024 * 1024)} MB per upload versturen.`;
+
 // ../../packages/shared-types/dist/env-vars.js
 var MANAGED_ENV_VAR_NAMES = [
   "AI_GATEWAY_TOKEN",
@@ -14875,7 +14901,44 @@ function parseTicketNumber(raw) {
 var TICKET_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
 var TICKET_ATTACHMENT_MAX_SIZE_LABEL = `${TICKET_ATTACHMENT_MAX_BYTES / (1024 * 1024)} MB`;
 
+// ../../packages/shared-types/dist/permissions.js
+var PERMISSIONS = [
+  /** Open the site of a private preview or a closed production (enforced from KRYD-575). */
+  "app:view",
+  /** See the account itself: name, slug. */
+  "account:view",
+  /** Rename the account and change its slug. */
+  "account:manage",
+  /** See who is a member, and the invites still open. */
+  "members:view",
+  /** Invite people, change a member's role, remove a member. */
+  "members:manage",
+  /** See usage and costs. */
+  "usage:view",
+  /** See projects, deploys, domains, databases, storage, AI and workflows. */
+  "projects:view",
+  /** Change a project: env vars, domains, databases, storage, AI, workflows, remove it. */
+  "projects:manage",
+  /** Read env var VALUES (secrets), not only their names. */
+  "env:read",
+  /** Link a repository, deploy, roll back, get a push credential, manage deploy hooks. */
+  "deploy",
+  /** Read build and runtime logs. */
+  "logs:view",
+  /** Trigger, cancel and replay workflow runs; add and remove crons and schedules. */
+  "workflows:run",
+  /** Open and answer support tickets. */
+  "support"
+];
+var ROLES = {
+  owner: PERMISSIONS,
+  member: PERMISSIONS.filter((p) => p !== "members:manage" && p !== "account:manage"),
+  viewer: ["app:view"]
+};
+var ACCOUNT_HEADER = "Kryd-Account";
+
 // ../../packages/shared-types/dist/workflow-run.js
+var WORKFLOW_RUN_PAYLOAD_MAX_BYTES = 64 * 1024;
 var MAX_WEBHOOK_NAME = 32;
 var WEBHOOK_NAME_RE = new RegExp(`^[a-z0-9](?:[a-z0-9-]{0,${MAX_WEBHOOK_NAME - 2}}[a-z0-9])?$`);
 
@@ -14936,6 +14999,209 @@ import {
 import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, relative, resolve as resolve2 } from "node:path";
 import { pathToFileURL } from "node:url";
 
+// src/config.ts
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var DEFAULT_API_URL = "http://localhost:3000";
+function configPath() {
+  const dir = process.env.KRYD_CONFIG_DIR ?? join(homedir(), ".kryd");
+  return join(dir, "config.json");
+}
+function loadConfig() {
+  let raw;
+  try {
+    raw = readFileSync(configPath(), "utf8");
+  } catch {
+    return {};
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    process.stderr.write(
+      `warning: ${configPath()} is not valid JSON \u2014 ignoring it.
+`
+    );
+    return {};
+  }
+}
+function resolveToken() {
+  const fromEnv = process.env.KRYD_TOKEN?.trim();
+  return fromEnv ? fromEnv : loadConfig().token;
+}
+function writeConfig(config2) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
+  chmodSync(path, 384);
+}
+function saveToken(token, apiUrl) {
+  const config2 = loadConfig();
+  config2.token = token;
+  if (apiUrl) config2.apiUrl = apiUrl;
+  writeConfig(config2);
+}
+function clearToken() {
+  const config2 = loadConfig();
+  delete config2.token;
+  delete config2.account;
+  delete config2.accountSlug;
+  writeConfig(config2);
+}
+function saveAccount(account) {
+  const config2 = loadConfig();
+  config2.account = account.accountId;
+  if (account.slug) config2.accountSlug = account.slug;
+  else delete config2.accountSlug;
+  writeConfig(config2);
+}
+function clearAccount() {
+  const config2 = loadConfig();
+  delete config2.account;
+  delete config2.accountSlug;
+  writeConfig(config2);
+}
+var DEPLOY_TOKEN_PREFIX = "kryd_";
+function accountHeader(token) {
+  if (!token || token.startsWith(DEPLOY_TOKEN_PREFIX)) return {};
+  const account = loadConfig().account;
+  return account ? { [ACCOUNT_HEADER]: account } : {};
+}
+function authHeaders(token) {
+  return { authorization: `Bearer ${token}`, ...accountHeader(token) };
+}
+var lastApiUrl = null;
+function resolveApiUrl(flag) {
+  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
+  return lastApiUrl;
+}
+function currentApiUrl() {
+  return lastApiUrl ?? resolveApiUrl();
+}
+var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
+function resolveDashboardUrl(flag) {
+  return flag ?? process.env.KRYD_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL;
+}
+var PROJECT_LINK_DIR = ".kryd";
+var PROJECT_LINK_FILE = "project.json";
+function findProjectLinkDir(cwd = process.cwd()) {
+  let dir = cwd;
+  for (; ; ) {
+    if (existsSync(join(dir, PROJECT_LINK_DIR, PROJECT_LINK_FILE))) return dir;
+    if (existsSync(join(dir, ".git"))) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function loadProjectLink(cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const path = join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    process.stderr.write(`warning: ${path} is not valid JSON \u2014 ignoring it.
+`);
+    return null;
+  }
+  if (!parsed || typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
+    process.stderr.write(`warning: ${path} has no projectId \u2014 ignoring it.
+`);
+    return null;
+  }
+  return parsed;
+}
+function saveProjectLink(cwd, link) {
+  const dir = join(cwd, PROJECT_LINK_DIR);
+  mkdirSync(dir, { recursive: true });
+  const path = join(dir, PROJECT_LINK_FILE);
+  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
+  return path;
+}
+function ensureIgnored(cwd, entry, aliases = []) {
+  const path = join(cwd, ".gitignore");
+  let current = "";
+  try {
+    current = readFileSync(path, "utf8");
+  } catch {
+  }
+  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
+  if (present) return false;
+  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
+  appendFileSync(path, `${prefix}${entry}
+`);
+  return true;
+}
+function ensureKrydIgnored(cwd) {
+  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
+}
+function directoryIsLinked(cwd) {
+  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
+  if (!existsSync(path)) return null;
+  return loadProjectLink(cwd);
+}
+function writeSecretFile(path, contents) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, contents, { mode: 384 });
+  chmodSync(path, 384);
+}
+function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
+  const root = findProjectLinkDir(cwd);
+  if (!root) return false;
+  const link = loadProjectLink(cwd);
+  if (link?.projectId !== projectId) return false;
+  try {
+    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolvedLink() {
+  return lastLinkResolution;
+}
+var lastLinkResolution = null;
+function resolveProjectId(explicit, cwd = process.cwd()) {
+  lastLinkResolution = null;
+  if (explicit) return explicit;
+  const root = findProjectLinkDir(cwd);
+  if (!root) return null;
+  const link = loadProjectLink(cwd);
+  if (!link) return null;
+  lastLinkResolution = { root, link };
+  return link.projectId;
+}
+function rememberLinkAccount(root, account) {
+  if (!account.accountId) return false;
+  const link = directoryIsLinked(root);
+  if (!link) return false;
+  const slug = account.accountSlug ?? link.accountSlug;
+  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
+  saveProjectLink(root, {
+    ...link,
+    accountId: account.accountId,
+    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
+    ...slug ? { accountSlug: slug } : {}
+  });
+  return true;
+}
+
 // src/client.ts
 var ApiError = class extends Error {
   envelope;
@@ -14965,7 +15231,7 @@ async function parseEnvelope(res) {
 }
 async function whoami(apiUrl, token) {
   const res = await fetch(`${apiUrl}/me`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -14981,7 +15247,7 @@ async function linkProject(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify(input)
   });
@@ -15000,18 +15266,23 @@ async function linkProject(apiUrl, token, input) {
   }
   return parsed;
 }
+function environmentQuery(environment) {
+  return environment === "preview" ? "?environment=preview" : "";
+}
 async function attachDatabase(apiUrl, token, input) {
   const res = await fetch(`${apiUrl}/databases`, {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({
       projectId: input.projectId,
       mode: input.mode,
       // Conditional (exactOptionalPropertyTypes) — only BYO carries a connection string.
-      ...input.connectionString ? { connectionString: input.connectionString } : {}
+      ...input.connectionString ? { connectionString: input.connectionString } : {},
+      // Only sent for preview, so a production attach is byte-identical to what older CLIs send.
+      ...input.environment === "preview" ? { environment: "preview" } : {}
     })
   });
   if (!res.ok) {
@@ -15028,7 +15299,8 @@ async function attachDatabase(apiUrl, token, input) {
   return {
     id: parsed.id,
     mode: parsed.mode,
-    status: parsed.status
+    status: parsed.status,
+    ...parsed.environment === "production" || parsed.environment === "preview" ? { environment: parsed.environment } : {}
   };
 }
 async function createStorage(apiUrl, token, input) {
@@ -15036,7 +15308,7 @@ async function createStorage(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15058,7 +15330,7 @@ async function enableAi(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15077,7 +15349,7 @@ async function enableAi(apiUrl, token, input) {
 }
 async function getAiStatus(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/ai/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15095,7 +15367,7 @@ async function getAiStatus(apiUrl, token, projectId) {
 async function removeAi(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/ai/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15117,7 +15389,7 @@ async function addWorkflows(apiUrl, token, input) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId: input.projectId })
   });
@@ -15132,7 +15404,7 @@ async function addWorkflows(apiUrl, token, input) {
 }
 async function getWorkflowStatus(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15146,7 +15418,7 @@ async function getWorkflowStatus(apiUrl, token, projectId) {
 async function removeWorkflows(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/workflows/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15197,7 +15469,7 @@ function domainsUrl(apiUrl, projectId) {
 }
 async function listDomains(apiUrl, token, projectId) {
   const res = await fetch(domainsUrl(apiUrl, projectId), {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Domain listing failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15214,7 +15486,7 @@ async function listDomains(apiUrl, token, projectId) {
 async function addDomain(apiUrl, token, projectId, host, app, redirectTo) {
   const res = await fetch(domainsUrl(apiUrl, projectId), {
     method: "POST",
-    headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+    headers: { "content-type": "application/json", ...authHeaders(token) },
     body: JSON.stringify({ host, ...app ? { app } : {}, ...redirectTo !== void 0 ? { redirectTo } : {} })
   });
   if (!res.ok) {
@@ -15225,7 +15497,7 @@ async function addDomain(apiUrl, token, projectId, host, app, redirectTo) {
 async function removeDomain(apiUrl, token, projectId, host) {
   const res = await fetch(`${domainsUrl(apiUrl, projectId)}/${encodeURIComponent(host)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Domain removal failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15237,7 +15509,7 @@ function deployHookUrl(apiUrl, projectId) {
 async function createDeployHook(apiUrl, token, projectId) {
   const res = await fetch(deployHookUrl(apiUrl, projectId), {
     method: "PUT",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Deploy hook creation failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15251,7 +15523,7 @@ async function createDeployHook(apiUrl, token, projectId) {
 async function removeDeployHook(apiUrl, token, projectId) {
   const res = await fetch(deployHookUrl(apiUrl, projectId), {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Deploy hook removal failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15264,7 +15536,7 @@ async function removeDeployHook(apiUrl, token, projectId) {
 }
 async function fetchResourceStatus(apiUrl, token, path) {
   const res = await fetch(`${apiUrl}${path}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15279,14 +15551,15 @@ async function fetchResourceStatus(apiUrl, token, path) {
   }
   return {
     status: parsed.status,
-    failureReason: typeof parsed.failureReason === "string" ? parsed.failureReason : null
+    failureReason: typeof parsed.failureReason === "string" ? parsed.failureReason : null,
+    ...parsed.environment === "production" || parsed.environment === "preview" ? { environment: parsed.environment } : {}
   };
 }
-function getDatabaseStatus(apiUrl, token, projectId) {
+function getDatabaseStatus(apiUrl, token, projectId, environment) {
   return fetchResourceStatus(
     apiUrl,
     token,
-    `/databases/${encodeURIComponent(projectId)}`
+    `/databases/${encodeURIComponent(projectId)}${environmentQuery(environment)}`
   );
 }
 function getStorageStatus(apiUrl, token, projectId) {
@@ -15344,10 +15617,10 @@ async function pollResourceDetached(fetchStatus, opts) {
     await sleep(intervalMs);
   }
 }
-async function detachDatabase(apiUrl, token, projectId) {
+async function detachDatabase(apiUrl, token, projectId, environment) {
   const res = await fetch(
-    `${apiUrl}/databases/${encodeURIComponent(projectId)}`,
-    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+    `${apiUrl}/databases/${encodeURIComponent(projectId)}${environmentQuery(environment)}`,
+    { method: "DELETE", headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15357,9 +15630,22 @@ async function detachDatabase(apiUrl, token, projectId) {
     );
   }
 }
+async function resetPreviewDatabase(apiUrl, token, projectId) {
+  const res = await fetch(
+    `${apiUrl}/databases/${encodeURIComponent(projectId)}/reset?environment=preview`,
+    { method: "POST", headers: { ...authHeaders(token) } }
+  );
+  if (!res.ok) {
+    throw new ApiError(
+      `Database reset failed (${res.status})`,
+      await parseEnvelope(res),
+      res.status
+    );
+  }
+}
 async function getProject(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (res.status === 404) return null;
   if (!res.ok) {
@@ -15369,7 +15655,7 @@ async function getProject(apiUrl, token, projectId) {
 }
 async function listProjects(apiUrl, token) {
   const res = await fetch(`${apiUrl}/projects`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Listing projects failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15379,7 +15665,7 @@ async function listProjects(apiUrl, token) {
 async function deleteProject(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/projects/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(`Project delete failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15412,7 +15698,7 @@ async function pollProjectDeleted(read, opts) {
 async function detachStorage(apiUrl, token, projectId) {
   const res = await fetch(`${apiUrl}/storage/${encodeURIComponent(projectId)}`, {
     method: "DELETE",
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (!res.ok) {
     throw new ApiError(
@@ -15425,7 +15711,7 @@ async function detachStorage(apiUrl, token, projectId) {
 async function listEnvVars(apiUrl, token, projectId, include = "all") {
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env?scope=${encodeURIComponent(include)}`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15478,7 +15764,7 @@ async function pullEnvValues(apiUrl, token, projectId, environment = "production
   const query = environment === "production" ? "" : `?environment=${encodeURIComponent(environment)}`;
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/values${query}`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15512,7 +15798,7 @@ async function setEnvVar(apiUrl, token, projectId, key, value, scope = "runtime"
       method: "PUT",
       headers: {
         "content-type": "application/json",
-        authorization: `Bearer ${token}`
+        ...authHeaders(token)
       },
       // `scope`/`environment` are sent only when NOT their defaults. An api older than KRYD-156/159
       // ignores unknown body fields, so this is belt-and-braces — but it keeps a plain runtime
@@ -15553,7 +15839,7 @@ async function removeEnvVar(apiUrl, token, projectId, key, scope = "runtime", en
   const query = params.toString() ? `?${params.toString()}` : "";
   const res = await fetch(
     `${apiUrl}/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(key)}${query}`,
-    { method: "DELETE", headers: { authorization: `Bearer ${token}` } }
+    { method: "DELETE", headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15579,7 +15865,7 @@ async function triggerDeploy(apiUrl, token, projectId) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId })
   });
@@ -15597,7 +15883,7 @@ async function rollbackDeploy(apiUrl, token, projectId, deploymentId, app) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({
       projectId,
@@ -15615,7 +15901,7 @@ async function redeployProject(apiUrl, token, projectId, app) {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${token}`
+      ...authHeaders(token)
     },
     body: JSON.stringify({ projectId, ...app ? { app } : {} })
   });
@@ -15627,7 +15913,7 @@ async function redeployProject(apiUrl, token, projectId, app) {
 async function listDeployments(apiUrl, token, projectId) {
   const url2 = new URL(`${apiUrl}/deployments`);
   if (projectId) url2.searchParams.set("projectId", projectId);
-  const res = await fetch(url2, { headers: { authorization: `Bearer ${token}` } });
+  const res = await fetch(url2, { headers: { ...authHeaders(token) } });
   if (!res.ok) {
     throw new ApiError(`Listing deploys failed (${res.status})`, await parseEnvelope(res), res.status);
   }
@@ -15731,7 +16017,7 @@ async function streamDeploy(apiUrl, token, deploymentId, handlers, opts = {}) {
     let dropped = false;
     try {
       const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/logs`, {
-        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" }
+        headers: { ...authHeaders(token), accept: "text/event-stream" }
       });
       if (!res.ok) {
         throw new ApiError(`Log stream failed (${res.status})`, await parseEnvelope(res), res.status);
@@ -15773,7 +16059,7 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
       if (afterNs) url2.searchParams.set("after", afterNs);
       else if (opts.since) url2.searchParams.set("since", opts.since);
       const res = await doFetch(url2, {
-        headers: { authorization: `Bearer ${token}`, accept: "text/event-stream" },
+        headers: { ...authHeaders(token), accept: "text/event-stream" },
         ...opts.signal ? { signal: opts.signal } : {}
       });
       if (!res.ok) {
@@ -15803,7 +16089,7 @@ async function streamRuntime(apiUrl, token, id, handlers, opts = {}) {
 async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
   const doFetch = opts.fetchImpl ?? fetch;
   const res = await doFetch(`${apiUrl}/deployments/${deploymentId}/log`, {
-    headers: { authorization: `Bearer ${token}` }
+    headers: { ...authHeaders(token) }
   });
   if (res.status === 404) return null;
   if (!res.ok) {
@@ -15818,7 +16104,7 @@ async function fetchDeployLog(apiUrl, token, deploymentId, opts = {}) {
 async function fetchPushCredential(apiUrl, token, projectId) {
   const res = await fetch(
     `${apiUrl}/repos/${encodeURIComponent(projectId)}/push-credential`,
-    { headers: { authorization: `Bearer ${token}` } }
+    { headers: { ...authHeaders(token) } }
   );
   if (!res.ok) {
     throw new ApiError(
@@ -15847,7 +16133,7 @@ async function supportFetch(apiUrl, token, path, what, init = {}) {
   const res = await fetch(`${apiUrl}${path}`, {
     method: init.method ?? "GET",
     headers: {
-      authorization: `Bearer ${token}`,
+      ...authHeaders(token),
       ...init.body !== void 0 ? { "content-type": "application/json" } : {}
     },
     ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {}
@@ -15897,204 +16183,25 @@ async function replySupportTicket(apiUrl, token, ref, text) {
   return body;
 }
 
-// src/config.ts
-import {
-  appendFileSync,
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync
-} from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-var DEFAULT_API_URL = "http://localhost:3000";
-function configPath() {
-  const dir = process.env.KRYD_CONFIG_DIR ?? join(homedir(), ".kryd");
-  return join(dir, "config.json");
+// src/support.ts
+var SUPPORT_TYPES = TICKET_TYPES;
+var MESSAGE_MAX = 2e4;
+var SUBJECT_MAX = 200;
+var LOG_TAIL_LINES = 40;
+var CONTEXT_SEPARATOR = "\n\n---\n";
+var URL_CREDENTIAL = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
+var SECRET_ASSIGNMENT = /\b([A-Za-z0-9_.-]*(?:TOKEN|SECRET|PASSWORD|PASSWD|KEY|DSN|DATABASE_URL|CREDENTIAL)[A-Za-z0-9_.-]*)(\s*[=:]\s*)(["']?)([^\s"']+)/gi;
+function maskSecrets(line) {
+  return line.replace(URL_CREDENTIAL, "$1$2:***@").replace(SECRET_ASSIGNMENT, "$1$2$3***");
 }
-function loadConfig() {
-  let raw;
-  try {
-    raw = readFileSync(configPath(), "utf8");
-  } catch {
-    return {};
-  }
-  try {
-    return JSON.parse(raw);
-  } catch {
-    process.stderr.write(
-      `warning: ${configPath()} is not valid JSON \u2014 ignoring it.
-`
-    );
-    return {};
-  }
+function logTail(log, n = LOG_TAIL_LINES) {
+  const lines = log.split(/\r?\n/);
+  while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();
+  return lines.slice(-n).map(maskSecrets);
 }
-function resolveToken() {
-  const fromEnv = process.env.KRYD_TOKEN?.trim();
-  return fromEnv ? fromEnv : loadConfig().token;
-}
-function writeConfig(config2) {
-  const path = configPath();
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
-  chmodSync(path, 384);
-}
-function saveToken(token, apiUrl) {
-  const config2 = loadConfig();
-  config2.token = token;
-  if (apiUrl) config2.apiUrl = apiUrl;
-  writeConfig(config2);
-}
-function clearToken() {
-  const config2 = loadConfig();
-  delete config2.token;
-  writeConfig(config2);
-}
-var lastApiUrl = null;
-function resolveApiUrl(flag) {
-  lastApiUrl = flag ?? process.env.KRYD_API_URL ?? loadConfig().apiUrl ?? DEFAULT_API_URL;
-  return lastApiUrl;
-}
-function currentApiUrl() {
-  return lastApiUrl ?? resolveApiUrl();
-}
-var DEFAULT_DASHBOARD_URL = "https://app.kryd.eu";
-function resolveDashboardUrl(flag) {
-  return flag ?? process.env.KRYD_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL;
-}
-var PROJECT_LINK_DIR = ".kryd";
-var PROJECT_LINK_FILE = "project.json";
-function findProjectLinkDir(cwd = process.cwd()) {
-  let dir = cwd;
-  for (; ; ) {
-    if (existsSync(join(dir, PROJECT_LINK_DIR, PROJECT_LINK_FILE))) return dir;
-    if (existsSync(join(dir, ".git"))) return null;
-    const parent = dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function loadProjectLink(cwd = process.cwd()) {
-  const root = findProjectLinkDir(cwd);
-  if (!root) return null;
-  const path = join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
-  let raw;
-  try {
-    raw = readFileSync(path, "utf8");
-  } catch {
-    return null;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    process.stderr.write(`warning: ${path} is not valid JSON \u2014 ignoring it.
-`);
-    return null;
-  }
-  if (!parsed || typeof parsed.projectId !== "string" || parsed.projectId.length === 0) {
-    process.stderr.write(`warning: ${path} has no projectId \u2014 ignoring it.
-`);
-    return null;
-  }
-  return parsed;
-}
-function saveProjectLink(cwd, link) {
-  const dir = join(cwd, PROJECT_LINK_DIR);
-  mkdirSync(dir, { recursive: true });
-  const path = join(dir, PROJECT_LINK_FILE);
-  writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
-  return path;
-}
-function ensureIgnored(cwd, entry, aliases = []) {
-  const path = join(cwd, ".gitignore");
-  let current = "";
-  try {
-    current = readFileSync(path, "utf8");
-  } catch {
-  }
-  const present = current.split("\n").map((l) => l.trim()).some((l) => l === entry || aliases.includes(l));
-  if (present) return false;
-  const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
-  appendFileSync(path, `${prefix}${entry}
-`);
-  return true;
-}
-function ensureKrydIgnored(cwd) {
-  ensureIgnored(cwd, `${PROJECT_LINK_DIR}/`, [PROJECT_LINK_DIR]);
-}
-function directoryIsLinked(cwd) {
-  const path = join(cwd, PROJECT_LINK_DIR, PROJECT_LINK_FILE);
-  if (!existsSync(path)) return null;
-  return loadProjectLink(cwd);
-}
-function writeSecretFile(path, contents) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, contents, { mode: 384 });
-  chmodSync(path, 384);
-}
-function clearProjectLinkIfMatches(projectId, cwd = process.cwd()) {
-  const root = findProjectLinkDir(cwd);
-  if (!root) return false;
-  const link = loadProjectLink(cwd);
-  if (link?.projectId !== projectId) return false;
-  try {
-    rmSync(join(root, PROJECT_LINK_DIR, PROJECT_LINK_FILE));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function resolvedLink() {
-  return lastLinkResolution;
-}
-var lastLinkResolution = null;
-function resolveProjectId(explicit, cwd = process.cwd()) {
-  lastLinkResolution = null;
-  if (explicit) return explicit;
-  const root = findProjectLinkDir(cwd);
-  if (!root) return null;
-  const link = loadProjectLink(cwd);
-  if (!link) return null;
-  lastLinkResolution = { root, link };
-  return link.projectId;
-}
-function rememberLinkAccount(root, account) {
-  if (!account.accountId) return false;
-  const link = directoryIsLinked(root);
-  if (!link) return false;
-  const slug = account.accountSlug ?? link.accountSlug;
-  if (link.accountId === account.accountId && link.accountSlug === slug) return false;
-  saveProjectLink(root, {
-    ...link,
-    accountId: account.accountId,
-    // `exactOptionalPropertyTypes`: an absent key and an explicit `undefined` are different types.
-    ...slug ? { accountSlug: slug } : {}
-  });
-  return true;
-}
-
-// src/support.ts
-var SUPPORT_TYPES = TICKET_TYPES;
-var MESSAGE_MAX = 2e4;
-var SUBJECT_MAX = 200;
-var LOG_TAIL_LINES = 40;
-var CONTEXT_SEPARATOR = "\n\n---\n";
-var URL_CREDENTIAL = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
-var SECRET_ASSIGNMENT = /\b([A-Za-z0-9_.-]*(?:TOKEN|SECRET|PASSWORD|PASSWD|KEY|DSN|DATABASE_URL|CREDENTIAL)[A-Za-z0-9_.-]*)(\s*[=:]\s*)(["']?)([^\s"']+)/gi;
-function maskSecrets(line) {
-  return line.replace(URL_CREDENTIAL, "$1$2:***@").replace(SECRET_ASSIGNMENT, "$1$2$3***");
-}
-function logTail(log, n = LOG_TAIL_LINES) {
-  const lines = log.split(/\r?\n/);
-  while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();
-  return lines.slice(-n).map(maskSecrets);
-}
-function fenceFor(lines) {
-  const longest = Math.max(0, ...lines.map((l) => Math.max(0, ...(l.match(/`+/g) ?? []).map((r) => r.length))));
-  return "`".repeat(Math.max(3, longest + 1));
+function fenceFor(lines) {
+  const longest = Math.max(0, ...lines.map((l) => Math.max(0, ...(l.match(/`+/g) ?? []).map((r) => r.length))));
+  return "`".repeat(Math.max(3, longest + 1));
 }
 function deployLine(deploy) {
   if (deploy === "unreadable") return "Last production deploy: could not be read";
@@ -16312,6 +16419,110 @@ async function runSupportReply(raw, opts) {
   }
 }
 
+// src/account.ts
+function fail(message) {
+  process.stderr.write(`${message}
+`);
+  process.exitCode = 1;
+}
+function membershipLabel(m) {
+  return m.slug ?? m.name ?? m.accountId;
+}
+function accountHint(err) {
+  if (!(err instanceof ApiError) || !err.envelope) return "";
+  const { code, details } = err.envelope.error;
+  if (code === ERROR_CODES.accountRequired) {
+    return "You belong to several accounts. Choose one with `kryd account use <slug>` (`kryd account list` shows them).\n";
+  }
+  if (code === ERROR_CODES.permissionRequired) {
+    const permission = typeof details?.permission === "string" ? ` \`${details.permission}\`` : " this permission";
+    const slug = loadConfig().accountSlug;
+    return `Your role in ${slug ? `account ${slug}` : "this account"} lacks${permission}. Ask the account's owner, or switch with \`kryd account use <slug>\`.
+`;
+  }
+  const stored = loadConfig();
+  if (code === ERROR_CODES.forbidden && stored.account && /not a member/i.test(err.envelope.error.message)) {
+    const name = stored.accountSlug ?? stored.account;
+    return `You are no longer a member of account ${name}, which this machine has chosen. See your accounts with \`kryd account list\`, then pick one with \`kryd account use <slug>\`.
+`;
+  }
+  return "";
+}
+async function runAccountList(opts = {}) {
+  const token = resolveToken();
+  if (!token) return fail("Not logged in \u2014 run `kryd login` first.");
+  let memberships;
+  let current;
+  try {
+    const me = await whoami(resolveApiUrl(opts.apiUrl), token);
+    memberships = me.memberships ?? [];
+    current = me.accountId;
+  } catch (err) {
+    return fail(err instanceof ApiError && err.envelope ? err.envelope.error.message : String(err));
+  }
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(memberships.map((m) => ({ ...m, current: m.accountId === current })), null, 2)}
+`);
+    return;
+  }
+  if (memberships.length === 0) {
+    process.stdout.write("You do not belong to any account.\n");
+    return;
+  }
+  const rows = [
+    ["", "SLUG", "NAME", "ROLE", "ID"],
+    ...memberships.map((m) => [m.accountId === current ? "*" : "", m.slug ?? "\u2014", m.name, m.role, m.accountId])
+  ];
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+  for (const r of rows) {
+    process.stdout.write(`${r.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd()}
+`);
+  }
+}
+async function runAccountUse(target, opts = {}) {
+  const token = resolveToken();
+  if (!token) return fail("Not logged in \u2014 run `kryd login` first.");
+  if (token.startsWith("kryd_")) {
+    return fail("A deploy token is bound to one account and cannot switch. Unset KRYD_TOKEN to use your login.");
+  }
+  let memberships;
+  try {
+    memberships = (await whoami(resolveApiUrl(opts.apiUrl), token)).memberships ?? [];
+  } catch (err) {
+    return fail(err instanceof ApiError && err.envelope ? err.envelope.error.message : String(err));
+  }
+  const wanted = target.trim();
+  const match = memberships.find((m) => m.slug === wanted || m.accountId === wanted);
+  if (!match) {
+    const known = memberships.map(membershipLabel).join(", ") || "none";
+    return fail(`You are not a member of an account "${wanted}". Your accounts: ${known}.`);
+  }
+  saveAccount({ accountId: match.accountId, slug: match.slug });
+  process.stdout.write(`Now using account ${membershipLabel(match)} (${match.role}).
+`);
+}
+async function settleAccountAfterLogin(apiUrl, token) {
+  if (token.startsWith("kryd_")) return;
+  let memberships;
+  try {
+    memberships = (await whoami(apiUrl, token)).memberships ?? [];
+  } catch {
+    return;
+  }
+  const stored = loadConfig().account;
+  if (stored && memberships.some((m) => m.accountId === stored)) return;
+  if (memberships.length <= 1) {
+    if (stored) clearAccount();
+    return;
+  }
+  const pick2 = memberships.find((m) => m.role === "owner") ?? memberships[0];
+  saveAccount({ accountId: pick2.accountId, slug: pick2.slug });
+  process.stdout.write(
+    `You belong to ${memberships.length} accounts; using ${membershipLabel(pick2)}. Switch with \`kryd account use <slug>\`.
+`
+  );
+}
+
 // src/tokens.ts
 var TOKEN_EXPIRY_CHOICES = ["30", "90", "365", "never"];
 var DEFAULT_TOKEN_EXPIRY = "90";
@@ -16325,7 +16536,7 @@ async function tokenFetch(apiUrl, token, path, what, body) {
   const res = await fetch(`${apiUrl}/api/auth/api-key/${path}`, {
     method: body === void 0 ? "GET" : "POST",
     headers: {
-      authorization: `Bearer ${token}`,
+      ...authHeaders(token),
       ...body !== void 0 ? { "content-type": "application/json" } : {}
     },
     ...body !== void 0 ? { body: JSON.stringify(body) } : {}
@@ -16363,50 +16574,53 @@ async function listDeployTokens(apiUrl, token) {
 async function revokeDeployToken(apiUrl, token, id) {
   await tokenFetch(apiUrl, token, "delete", "Revoking the token", { keyId: id });
 }
-function fail(message) {
+function fail2(message) {
   process.stderr.write(`${message}
 `);
   process.exitCode = 1;
 }
 function reportTokenError(err) {
   if (err instanceof ApiError && err.status === 401) {
-    fail("Not logged in, or the session expired \u2014 run `kryd login`.");
+    fail2("Not logged in, or the session expired \u2014 run `kryd login`.");
   } else if (err instanceof ApiError && err.status === 403 && resolveToken()?.startsWith("kryd_")) {
-    fail(
+    fail2(
       "A deploy token cannot manage tokens. Sign in with `kryd login` (and unset KRYD_TOKEN for this command)."
     );
   } else if (err instanceof ApiError && err.status === 404) {
-    fail("No such token on your account. `kryd token list` shows their ids.");
+    fail2("No such token on your account. `kryd token list` shows their ids.");
   } else if (err instanceof ApiError && err.envelope) {
-    fail(err.envelope.error.message);
+    fail2(err.envelope.error.message);
+    process.stderr.write(accountHint(err));
   } else {
-    fail(err instanceof Error ? err.message : String(err));
+    fail2(err instanceof Error ? err.message : String(err));
   }
 }
 function requireToken2() {
   const token = resolveToken();
-  if (!token) fail("Not logged in \u2014 run `kryd login` first.");
+  if (!token) fail2("Not logged in \u2014 run `kryd login` first.");
   return token ?? null;
 }
 var day = (iso) => iso ? iso.slice(0, 10) : "\u2014";
 async function runTokenCreate(name, opts) {
   const trimmed = name.trim();
   if (trimmed.length === 0 || trimmed.length > MAX_TOKEN_NAME) {
-    return fail(`A token name is 1 to ${MAX_TOKEN_NAME} characters.`);
+    return fail2(`A token name is 1 to ${MAX_TOKEN_NAME} characters.`);
   }
   const choice = opts.expires ?? DEFAULT_TOKEN_EXPIRY;
   const expiresIn = expiresInSeconds(choice);
   if (expiresIn === void 0) {
-    return fail(`--expires is one of ${TOKEN_EXPIRY_CHOICES.join(", ")} (days, or never).`);
+    return fail2(`--expires is one of ${TOKEN_EXPIRY_CHOICES.join(", ")} (days, or never).`);
   }
   const token = requireToken2();
   if (!token) return;
   try {
-    const created = await createDeployToken(resolveApiUrl(opts.apiUrl), token, { name: trimmed, expiresIn });
+    const apiUrl = resolveApiUrl(opts.apiUrl);
+    const created = await createDeployToken(apiUrl, token, { name: trimmed, expiresIn });
     process.stdout.write(`${created.key}
 `);
+    const account = await boundAccountLabel(apiUrl, token, created);
     process.stderr.write(
-      `Created deploy token "${trimmed}" (${created.id}), ${created.expiresAt ? `valid until ${day(created.expiresAt)}` : "without expiry"}.
+      `Created deploy token "${trimmed}" (${created.id})${account ? ` for account ${account}` : ""}, ${created.expiresAt ? `valid until ${day(created.expiresAt)}` : "without expiry"}.
 This token will not be shown again. Store it now, e.g. as the CI secret KRYD_TOKEN.
 `
     );
@@ -16414,6 +16628,17 @@ This token will not be shown again. Store it now, e.g. as the CI secret KRYD_TOK
     reportTokenError(err);
   }
 }
+async function boundAccountLabel(apiUrl, token, created) {
+  const id = typeof created.metadata?.accountId === "string" ? created.metadata.accountId : null;
+  if (!id) return null;
+  try {
+    const me = await whoami(apiUrl, token);
+    const m = me.memberships?.find((x) => x.accountId === id);
+    return m?.slug ?? id;
+  } catch {
+    return id;
+  }
+}
 async function runTokenList(opts) {
   const token = requireToken2();
   if (!token) return;
@@ -17740,6 +17965,7 @@ async function reportError(err) {
     process.stderr.write(`${err instanceof Error ? err.message : String(err)}
 `);
   }
+  process.stderr.write(accountHint(err));
   process.exitCode = 1;
   if (err instanceof ApiError) {
     process.stderr.write(await explainMissingProject(err));
@@ -17815,20 +18041,31 @@ async function runLogin(opts) {
     warnIfEnvTokenOverrides();
     return;
   }
-  const { token, apiUrl: learnedApiUrl } = await browserLogin(resolveDashboardUrl(opts.dashboardUrl));
+  await browserLoginAndSave(apiUrl, opts.dashboardUrl);
+  warnIfEnvTokenOverrides();
+}
+async function browserLoginAndSave(apiUrl, dashboardUrl) {
+  const { token, apiUrl: learnedApiUrl } = await browserLogin(resolveDashboardUrl(dashboardUrl));
   saveToken(token, learnedApiUrl ?? apiUrl);
   process.stdout.write("Logged in.\n");
-  warnIfEnvTokenOverrides();
+  await settleAccountAfterLogin(learnedApiUrl ?? apiUrl, token);
 }
 async function runWhoami(opts = {}) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = resolveToken() ?? "";
   try {
     const me = await whoami(apiUrl, token);
-    process.stdout.write(
-      `${me.email} (account ${me.accountId ?? "?"}, role ${me.role ?? "?"})
+    const current = me.memberships?.find((m) => m.accountId === me.accountId);
+    const label = current?.slug ?? me.accountSlug ?? me.accountId ?? "?";
+    process.stdout.write(`${me.email} (account ${label}, role ${current?.role ?? me.role ?? "?"})
+`);
+    const others = (me.memberships ?? []).filter((m) => m.accountId !== me.accountId);
+    if (others.length > 0) {
+      process.stdout.write(
+        `Also in: ${others.map((m) => `${m.slug ?? m.accountId} (${m.role})`).join(", ")} \u2014 switch with \`kryd account use <slug>\`.
 `
-    );
+      );
+    }
   } catch (err) {
     await reportError(err);
   }
@@ -17846,13 +18083,46 @@ function runLogout() {
   warnIfEnvTokenOverrides();
 }
 async function runInit(opts) {
-  const apiUrl = resolveApiUrl(opts.apiUrl);
+  let apiUrl = resolveApiUrl(opts.apiUrl);
   const cwd = opts.cwd ?? process.cwd();
-  const token = resolveToken();
+  let token = resolveToken();
   if (!token) {
-    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
-    process.exitCode = 1;
-    return;
+    const refusal = "Not logged in \u2014 run `kryd login` first.\n";
+    const io = opts.io ?? defaultPromptIO();
+    if (opts.offerLogin === false) {
+      process.stderr.write(refusal);
+      process.exitCode = 1;
+      return;
+    }
+    if (!isInteractive(io)) {
+      process.stderr.write(
+        refusal + // KRYD-385 iteration 1: no KRYD_TOKEN advice — `POST /repos` refuses a deploy token (KRYD-578).
+        "No terminal to log in from: ask the user to run `kryd init` (or `kryd login`) in their own terminal. A deploy token (KRYD_TOKEN) cannot create a project.\n"
+      );
+      process.exitCode = 1;
+      return;
+    }
+    io.output.write("You are not logged in to Kryd; `kryd init` can log you in through your browser first.\n");
+    if (!await promptConfirm("Log in now in your browser?", io)) {
+      process.stderr.write(refusal);
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      await browserLoginAndSave(apiUrl);
+    } catch (err) {
+      process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    token = resolveToken();
+    if (!token) {
+      process.stderr.write(refusal);
+      process.exitCode = 1;
+      return;
+    }
+    if (!opts.apiUrl) apiUrl = resolveApiUrl();
   }
   const existingLink = directoryIsLinked(cwd);
   if (existingLink) {
@@ -18447,6 +18717,17 @@ async function runDbAdd(opts) {
     process.exitCode = 1;
     return;
   }
+  if (opts.preview && opts.connectionString !== void 0) {
+    process.stderr.write(
+      "A preview database is always managed by Kryd \u2014 --preview cannot take a --connection-string.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (opts.preview) {
+    await addPreviewDatabase(apiUrl, token, project2);
+    return;
+  }
   let mode;
   let connectionString;
   if (opts.connectionString !== void 0) {
@@ -18492,6 +18773,46 @@ The connection string will be injected as DATABASE_URL on your next deploy.
     await reportError(err);
   }
 }
+async function addPreviewDatabase(apiUrl, token, project2) {
+  try {
+    const db2 = await attachDatabase(apiUrl, token, {
+      projectId: project2,
+      mode: "shared",
+      environment: "preview"
+    });
+    if (db2.environment !== "preview") {
+      process.stderr.write(
+        `The Kryd API did not create a preview database (it does not support them yet) \u2014 run \`kryd db status ${project2}\` to see what is attached.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write(`Provisioning a preview database for ${project2}\u2026
+`);
+    const result = await pollResourceUntilTerminal(
+      () => getDatabaseStatus(apiUrl, token, project2, "preview")
+    );
+    reportSettleResult(result, {
+      readyMsg: `Attached preview database ${db2.id} to ${project2}. It starts empty.
+Every preview deploy gets it as DATABASE_URL from its next deploy; production keeps its own.
+`,
+      failedLabel: "Preview database provisioning",
+      retryCmd: `kryd db status ${project2}`
+    });
+  } catch (err) {
+    await reportError(err);
+  }
+}
+async function readPreviewDatabase(apiUrl, token, project2) {
+  try {
+    const row = await getDatabaseStatus(apiUrl, token, project2, "preview");
+    return row.environment === "preview" ? row : null;
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) return null;
+    throw err;
+  }
+}
 function reportSettleResult(result, opts) {
   if (result.status === "ready") {
     process.stdout.write(opts.readyMsg);
@@ -18712,6 +19033,8 @@ async function describeProjectResources(apiUrl, token, projectId) {
   const out = ["its deployed app, its containers and its built images"];
   const db2 = await getDatabaseStatus(apiUrl, token, projectId).catch(() => null);
   if (db2) out.push("its Postgres database \u2014 and all the data in it");
+  const preview = db2 ? await readPreviewDatabase(apiUrl, token, projectId).catch(() => null) : null;
+  if (preview) out.push("its preview database \u2014 and all the data in it");
   const storage2 = await getStorageStatus(apiUrl, token, projectId).catch(() => null);
   if (storage2) out.push("its object-storage bucket \u2014 and every object in it");
   out.push("its Git repository on the forge, and its push token");
@@ -18730,6 +19053,23 @@ async function runDbRemove(opts) {
     reportNotLinked("kryd db remove <projectId>");
     return;
   }
+  if (opts.preview) {
+    await removePreviewDatabase(apiUrl, token, project2, opts);
+    return;
+  }
+  try {
+    if (await readPreviewDatabase(apiUrl, token, project2)) {
+      process.stderr.write(
+        `${project2} has a preview database \u2014 remove the preview first (\`kryd db remove --preview\`).
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+  } catch (err) {
+    await reportError(err);
+    return;
+  }
   const proceed = await confirmResourceRemoval({
     yes: opts.yes,
     io: opts.io,
@@ -18756,6 +19096,105 @@ async function runDbRemove(opts) {
     await reportError(err);
   }
 }
+async function removePreviewDatabase(apiUrl, token, project2, opts) {
+  try {
+    if (!await readPreviewDatabase(apiUrl, token, project2)) {
+      process.stderr.write(`${project2} has no preview database.
+`);
+      process.exitCode = 1;
+      return;
+    }
+  } catch (err) {
+    await reportError(err);
+    return;
+  }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `the preview database from ${project2}`,
+    question: `Remove the preview database from ${project2}? It is torn down and all the data in it is destroyed \u2014 this cannot be undone. Production is not touched; preview deploys use the production database again from their next deploy.`,
+    declined: `Left the preview database on ${project2} in place.
+`
+  });
+  if (!proceed) return;
+  try {
+    await detachDatabase(apiUrl, token, project2, "preview");
+    process.stdout.write(`Removing the preview database from ${project2}\u2026
+`);
+    const result = await pollResourceDetached(
+      () => getDatabaseStatus(apiUrl, token, project2, "preview")
+    );
+    reportDetachResult(result, {
+      goneMsg: `Removed the preview database from ${project2}.
+Preview deploys use the production database again from their next deploy.
+`,
+      failedLabel: "Preview database removal",
+      retryCmd: `kryd db remove --preview ${project2}`
+    });
+  } catch (err) {
+    await reportError(err);
+  }
+}
+async function runDbReset(opts) {
+  if (!opts.preview) {
+    process.stderr.write(
+      "Only the preview database can be reset \u2014 run `kryd db reset --preview`. Production is never emptied.\n"
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  const token = resolveToken();
+  if (!token) {
+    process.stderr.write("Not logged in \u2014 run `kryd login` first.\n");
+    process.exitCode = 1;
+    return;
+  }
+  const project2 = resolveProjectId(opts.project, opts.cwd);
+  if (!project2) {
+    reportNotLinked("kryd db reset --preview <projectId>");
+    return;
+  }
+  try {
+    if (!await readPreviewDatabase(apiUrl, token, project2)) {
+      process.stderr.write(
+        `${project2} has no preview database \u2014 add one with \`kryd db add --preview ${project2}\`.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+  } catch (err) {
+    await reportError(err);
+    return;
+  }
+  const proceed = await confirmResourceRemoval({
+    yes: opts.yes,
+    io: opts.io,
+    subject: `everything in the preview database of ${project2}`,
+    question: `Empty the preview database of ${project2}? Every table and all the data in it is dropped \u2014 this cannot be undone. Production is not touched.`,
+    declined: `Left the preview database of ${project2} as it is.
+`
+  });
+  if (!proceed) return;
+  try {
+    await resetPreviewDatabase(apiUrl, token, project2);
+    process.stdout.write(`Emptying the preview database of ${project2}\u2026
+`);
+    const result = await pollResourceUntilTerminal(
+      () => getDatabaseStatus(apiUrl, token, project2, "preview")
+    );
+    reportSettleResult(result, {
+      readyMsg: `The preview database of ${project2} is empty again.
+Its credentials did not change, so no deploy is needed.
+`,
+      failedLabel: "Preview database reset",
+      retryCmd: `kryd db status ${project2}`
+    });
+  } catch (err) {
+    await reportError(err);
+  }
+}
 async function runAiAdd(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
   const token = resolveToken();
@@ -18861,12 +19300,45 @@ async function runDbStatus(opts) {
     reportNotLinked("kryd db status <projectId>");
     return;
   }
+  let productionAttached = false;
   await reportResourceStatus({
-    read: () => getDatabaseStatus(apiUrl, token, project2),
+    read: async () => {
+      const row = await getDatabaseStatus(apiUrl, token, project2);
+      productionAttached = true;
+      return row;
+    },
     noun: "database",
     project: project2,
     token
   });
+  if (!productionAttached) return;
+  try {
+    const preview = await readPreviewDatabase(apiUrl, token, project2);
+    if (!preview) {
+      process.stdout.write(
+        `${project2}: no preview database \u2014 preview deploys use the production database.
+`
+      );
+    } else if (preview.status === "failed") {
+      process.stdout.write(
+        `${project2}: preview database failed \u2014 ${preview.failureReason ?? "unknown error"}.
+Remove it with \`kryd db remove --preview\` and add it again.
+`
+      );
+    } else if (preview.status === "ready") {
+      process.stdout.write(
+        `${project2}: preview database ready \u2014 preview deploys get it as DATABASE_URL.
+`
+      );
+    } else {
+      process.stdout.write(
+        `${project2}: preview database ${preview.status} \u2014 preview deploys use the production database until it is ready.
+`
+      );
+    }
+  } catch (err) {
+    await reportError(err);
+  }
 }
 async function runStorageStatus(opts) {
   const apiUrl = resolveApiUrl(opts.apiUrl);
@@ -19326,6 +19798,7 @@ HATCHET_CLIENT_TOKEN is injected into your container on production deploys (prev
   process.exitCode = 0;
   await runInit({
     cwd: target,
+    offerLogin: false,
     ...opts.name ? { name: opts.name } : {},
     ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
   });
@@ -19956,7 +20429,7 @@ Run \`kryd env list\` to see what is set. (If you meant the runtime variable of
     await reportError(err);
   }
 }
-var CLI_VERSION = true ? "0.15.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "0.17.0" : "0.0.0-dev";
 var program = new Command();
 program.name("kryd").description("Kryd CLI").version(CLI_VERSION);
 program.hook("postAction", async () => {
@@ -19967,6 +20440,9 @@ program.command("login").description("Sign in via the browser (default) and stor
   "supply a token instead of the browser flow (prefer $KRYD_TOKEN \u2014 flags are visible in `ps`)"
 ).option("--api-url <url>", "control-plane API base URL").option("--dashboard-url <url>", "dashboard base URL for the browser approve page (default app.kryd.eu)").action((opts) => runLogin(opts));
 program.command("whoami").description("Show the current account").option("--api-url <url>", "control-plane API base URL").action((opts) => runWhoami(opts));
+var accountCommand = program.command("account").description("The accounts you belong to, and which one commands run in");
+accountCommand.command("list").description("List your accounts and your role in each; * marks the one commands run in").option("--json", "print the accounts as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runAccountList(opts));
+accountCommand.command("use <slug>").description("Run every following command in this account").option("--api-url <url>", "control-plane API base URL").action((slug, opts) => runAccountUse(slug, opts));
 program.command("logout").description("Clear the stored token").action(() => runLogout());
 program.command("git-credential <operation>", { hidden: true }).description("git credential helper (invoked by git, not by you)").option("--api-url <url>", "control-plane API base URL").action(async (operation, opts) => {
   const chunks = [];
@@ -19976,7 +20452,9 @@ program.command("git-credential <operation>", { hidden: true }).description("git
     ...opts.apiUrl ? { apiUrl: opts.apiUrl } : {}
   });
 });
-program.command("init").description("Link this project's repo + register its push webhook").option("--name <name>", "project name (defaults to package.json name / dir)").option(
+program.command("init").description(
+  "Link this project's repo + register its push webhook; not logged in \u2192 offers the browser login first (terminal only)"
+).option("--name <name>", "project name (defaults to package.json name / dir)").option(
   "--framework <framework>",
   'react-router | nextjs | vite-spa | node (auto-detected if omitted; `workflow` comes from a committed kryd.json with "web": false)'
 ).option(
@@ -20037,9 +20515,13 @@ var db = program.command("db").description("Manage project databases");
 db.command("add [project]").description("Attach a shared or bring-your-own Postgres database to a project").option("--shared", "attach a shared managed database (the default)").option(
   "--connection-string <url>",
   "attach an existing database (BYO) by pasting its connection string"
+).option(
+  "--preview",
+  "attach an empty preview database that every preview deploy gets instead of production's"
 ).option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbAdd({ ...opts, project: project2 }));
-db.command("remove [project]").description("Tear down the project's database and everything in it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbRemove({ ...opts, project: project2 }));
-db.command("status [project]").description("Show whether the project has a database, and what state it is in").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbStatus({ ...opts, project: project2 }));
+db.command("remove [project]").description("Tear down the project's database and everything in it (asks for confirmation)").option("--preview", "remove the preview database; production is not touched").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbRemove({ ...opts, project: project2 }));
+db.command("reset [project]").description("Empty the preview database: every table dropped, credentials kept (asks for confirmation)").option("--preview", "required \u2014 only the preview database can be reset").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbReset({ ...opts, project: project2 }));
+db.command("status [project]").description("Show the project's database and preview database, and what state they are in").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runDbStatus({ ...opts, project: project2 }));
 var storage = program.command("storage").description("Manage project object storage");
 storage.command("add [project]").description("Create an S3-compatible object-storage bucket for a project").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageAdd({ ...opts, project: project2 }));
 storage.command("remove [project]").description("Tear down the project's bucket and every object in it (asks for confirmation)").option("--yes", "skip the confirmation prompt").option("--api-url <url>", "control-plane API base URL").action((project2, opts) => runStorageRemove({ ...opts, project: project2 }));
@@ -20105,7 +20587,7 @@ support.command("list").description("Your account's tickets, with their status")
 support.command("show <ticket>").description("One ticket and its conversation, e.g. `kryd support show T-1042`").option("--json", "print the ticket and its messages as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportShow(ticket, opts));
 support.command("reply <ticket>").description("Answer in a ticket's conversation \u2014 the ticket goes back to Kryd support (status open)").option("--message <text>", "your reply (required)").option("--json", "print the updated ticket as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((ticket, opts) => runSupportReply(ticket, opts));
 var tokenCommand = program.command("token").description("Deploy tokens for CI and scripts: set one as KRYD_TOKEN and every command uses it, no login needed");
-tokenCommand.command("create <name>").description("Create a deploy token and print it once \u2014 it acts as you, inside your account").option("--expires <days>", "30 | 90 | 365 | never", DEFAULT_TOKEN_EXPIRY).option("--api-url <url>", "control-plane API base URL").action((name, opts) => runTokenCreate(name, opts));
+tokenCommand.command("create <name>").description("Create a deploy token and print it once \u2014 it acts as you, bound to the current account").option("--expires <days>", "30 | 90 | 365 | never", DEFAULT_TOKEN_EXPIRY).option("--api-url <url>", "control-plane API base URL").action((name, opts) => runTokenCreate(name, opts));
 tokenCommand.command("list").description("Your deploy tokens: name, first characters, created, last used, expiry \u2014 never the value").option("--json", "print the tokens as JSON on stdout").option("--api-url <url>", "control-plane API base URL").action((opts) => runTokenList(opts));
 tokenCommand.command("revoke <id>").description("Revoke a deploy token; anything still using it gets 401").option("--api-url <url>", "control-plane API base URL").action((id, opts) => runTokenRevoke(id, opts));
 function invokedDirectly() {
@@ -20134,6 +20616,7 @@ export {
   runAiStatus,
   runDbAdd,
   runDbRemove,
+  runDbReset,
   runDbStatus,
   runDeploy,
   runDeployHookCreate,