@thingd/cli 0.59.0 → 0.61.0

package/dist/commands/cloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,UAAU,EAA6B,MAAM,aAAa,CAAC;AAyIzE,wBAAsB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BjE"}
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/commands/cloud.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,UAAU,EAA6B,MAAM,aAAa,CAAC;AAkHzE,wBAAsB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuCjE"}

package/dist/commands/cloud.js

@@ -1,9 +1,10 @@
 import { execSync } from "node:child_process";
+import * as os from "node:os";
 import { createInterface } from "node:readline/promises";
 import { setTimeout as sleep } from "node:timers/promises";
 import pc from "picocolors";
 import { requiredToken, stringFlag } from "../index.js";
-import { addOrganizationMember, CloudApiError, createApiKey, createInstance, createOrganization, createProject, getMe, getOrganization, listInstances, listOrganizationMembers, listOrganizations, listProjects, pollCliAuth, removeOrganizationMember, resolveAllInstances, startCliAuth, } from "../lib/cloud-api.js";
+import { addOrganizationMember, CloudApiError, cleanupSessions, createApiKey, createInstance, createOrganization, createProject, createUserToken, getMe, getOrganization, listInstances, listOrganizationMembers, listOrganizations, listProjects, listUserTokens, parseUserTokenId, pollCliAuth, removeOrganizationMember, resolveAllInstances, revokeUserToken, startCliAuth, updateUserToken, } from "../lib/cloud-api.js";
 import { readCloudConfig, removeCloudConfig, writeCloudConfig, } from "../lib/cloud-config.js";
 const POLL_INTERVAL_MS = 2_000;
 const POLL_TIMEOUT_MS = 5 * 60 * 1_000;
@@ -37,7 +38,7 @@ function openBrowser(url) {
     }
 }
 function makeBaseConfig(context) {
-    return { token: "", url: cliApiUrl(context) };
+    return { url: cliApiUrl(context) };
 }
 async function askQuestion(rl, query) {
     return rl.question(query);
@@ -77,35 +78,6 @@ async function pickAndSaveInstance(context, cloudConfig) {
         rl.close();
     }
 }
-/**
- * Ensure a data-plane API key exists in the cloud config.
- * Best-effort — if creation fails, the JWT is still usable for management API.
- */
-async function ensureApiKey(context, cloudConfig) {
-    if (cloudConfig.apiKey) {
-        return;
-    }
-    try {
-        let projectId = cloudConfig.projectId;
-        if (!projectId) {
-            const { projects } = await listProjects(cloudConfig);
-            if (projects.length === 0) {
-                return;
-            }
-            projectId = projects[0]?.id;
-        }
-        if (!projectId) {
-            return;
-        }
-        const result = await createApiKey(cloudConfig, projectId);
-        cloudConfig.apiKey = result.token;
-        writeCloudConfig(cloudConfig);
-        context.stderr.write(`  ${pc.dim("API key created for data access\n")}`);
-    }
-    catch {
-        // API key creation is best-effort
-    }
-}
 export async function runCloud(context) {
     const sub = requiredToken(context.parsed, 1, "subcommand");
     switch (sub) {
@@ -118,6 +90,9 @@ export async function runCloud(context) {
         case "status":
             await runCloudStatus(context);
             return;
+        case "token":
+            await runToken(context);
+            return;
         case "project":
             await runProject(context);
             return;
@@ -125,6 +100,7 @@ export async function runCloud(context) {
             await runInstance(context);
             return;
         case "api-key":
+            context.stderr.write(pc.yellow("Deprecated. Use `thingd cloud token create` for CLI tokens. Project API keys are managed in the dashboard.\n"));
             await runApiKey(context);
             return;
         case "org":
@@ -132,7 +108,7 @@ export async function runCloud(context) {
             return;
         default:
             context.stderr.write(`Unknown cloud subcommand: ${sub}\n` +
-                "Available: login, logout, status, org, project, instance, api-key\n");
+                "Available: login, logout, status, token, org, project, instance, api-key\n");
     }
 }
 async function runLogin(context) {
@@ -140,17 +116,19 @@ async function runLogin(context) {
     const token = context.parsed.tokens[3] ?? stringFlag(context.parsed, "token");
     // ── Manual --code --token flow (fallback) ─────────────────────────
     if (code && token) {
-        const config = { token, url: cliApiUrl(context) };
+        const config = { url: cliApiUrl(context) };
         try {
-            const { user } = await getMe(config);
-            const cloudConfig = { ...config, email: user.email };
-            // Save config immediately so login always persists
+            // Verify JWT and get user info
+            const { user } = await getMe({ ...config, token });
+            // Create a permanent user token
+            const hostname = os.hostname();
+            const { token: userToken } = await createUserToken({ ...config, token }, `cli-${hostname}`);
+            // Save config with user token (not JWT)
+            const cloudConfig = { userToken, email: user.email, ...config };
             writeCloudConfig(cloudConfig);
             context.stdout.write(pc.green(`✓ Logged in as ${user.email}\n`));
             // Discover and select an instance (interactive if multiple)
             await pickAndSaveInstance(context, cloudConfig);
-            // Create a data-plane API key for REST/MCP operations
-            await ensureApiKey(context, cloudConfig);
         }
         catch (err) {
             if (err instanceof CloudApiError && err.status === 401) {
@@ -187,17 +165,20 @@ async function runLogin(context) {
         try {
             const result = await pollCliAuth(baseConfig, deviceCode);
             if ("token" in result) {
-                const tokenConfig = { token: result.token, url: cliApiUrl(context) };
+                const jwt = result.token;
+                const tokenConfig = { url: cliApiUrl(context) };
                 try {
-                    const { user } = await getMe(tokenConfig);
-                    const cloudConfig = { ...tokenConfig, email: user.email };
-                    // Save config immediately so login always persists
+                    // Verify temporary JWT
+                    const { user } = await getMe({ ...tokenConfig, token: jwt });
+                    // Create permanent user token
+                    const hostname = os.hostname();
+                    const { token: userToken } = await createUserToken({ ...tokenConfig, token: jwt }, `cli-${hostname}`);
+                    // Save config with user token (not JWT)
+                    const cloudConfig = { userToken, email: user.email, ...tokenConfig };
                     writeCloudConfig(cloudConfig);
                     context.stdout.write(pc.green(`\r✓ Logged in as ${user.email}\n`));
                     // Discover and select an instance (interactive if multiple)
                     await pickAndSaveInstance(context, cloudConfig);
-                    // Create a data-plane API key for REST/MCP operations
-                    await ensureApiKey(context, cloudConfig);
                     return;
                 }
                 catch {
@@ -219,6 +200,18 @@ async function runLogin(context) {
     context.stderr.write(pc.red("\nTimed out. Run `thingd cloud login` again.\n"));
 }
 async function runLogout(context) {
+    const config = readCloudConfig();
+    if (config?.userToken) {
+        try {
+            const tokenId = parseUserTokenId(config.userToken);
+            if (tokenId) {
+                await revokeUserToken(config, tokenId);
+            }
+        }
+        catch {
+            // Best-effort — token may already be revoked or API unreachable
+        }
+    }
     removeCloudConfig();
     context.stdout.write(pc.green("✓ Logged out\n"));
 }
@@ -228,10 +221,31 @@ async function runCloudStatus(context) {
         context.stdout.write(`Not logged in. Run ${pc.cyan("thingd cloud login")}\n`);
         return;
     }
+    // Warn about old config format
+    if (config.token && !config.userToken) {
+        context.stdout.write(`${pc.yellow("Your credentials use an older format.")} Run ${pc.cyan("thingd cloud login")} to upgrade to a persistent CLI token.\n\n`);
+    }
     try {
         const { user } = await getMe(config);
-        context.stdout.write(`Logged in as ${pc.green(user.email)} (${user.role})\n` +
-            `API: ${config.url ?? "https://api.thingd.cloud"}\n`);
+        context.stdout.write(`Logged in as ${pc.green(user.email)} (${user.role})\n`);
+        // Show token info
+        if (config.userToken) {
+            try {
+                const { userTokens } = await listUserTokens(config);
+                const active = userTokens.find((t) => !t.revokedAt);
+                if (active) {
+                    context.stdout.write(`CLI Token: ${pc.cyan(active.name)}\n` +
+                        `  Prefix:   ${pc.dim(active.prefix)}\n` +
+                        `  Created:  ${pc.dim(formatTimeAgo(active.createdAt))}\n` +
+                        `  Last used:${pc.dim(active.lastUsedAt ? formatTimeAgo(active.lastUsedAt) : "never")}\n` +
+                        `  Access:   ${pc.dim(active.projectAccess === "all" ? "All projects" : active.projectAccess)}\n`);
+                }
+            }
+            catch {
+                context.stdout.write(`  ${pc.dim("(token info unavailable)")}\n`);
+            }
+        }
+        context.stdout.write(`API: ${config.url ?? "https://api.thingd.cloud"}\n`);
         if (config.projectSlug && config.instanceSlug && config.instanceUrl) {
             context.stdout.write(`Instance: ${pc.cyan(config.projectSlug)}/${pc.cyan(config.instanceSlug)}\n` +
                 `  ${pc.dim(config.instanceUrl)}\n`);
@@ -256,6 +270,173 @@ async function runCloudStatus(context) {
         context.stdout.write(`Token expired. Run ${pc.cyan("thingd cloud login")}\n`);
     }
 }
+function formatTimeAgo(iso) {
+    const ms = Date.now() - new Date(iso).getTime();
+    const s = Math.floor(ms / 1000);
+    if (s < 5) {
+        return "just now";
+    }
+    if (s < 60) {
+        return `${s}s ago`;
+    }
+    const m = Math.floor(s / 60);
+    if (m < 60) {
+        return `${m}m ago`;
+    }
+    const h = Math.floor(m / 60);
+    if (h < 24) {
+        return `${h}h ago`;
+    }
+    const d = Math.floor(h / 24);
+    return `${d}d ago`;
+}
+// ── Token subcommands ────────────────────────────────────────────────
+function requireLoggedInConfig(context) {
+    const config = readCloudConfig();
+    if (!config?.userToken && !config?.token) {
+        context.stderr.write(pc.yellow("Not logged in. Run thingd cloud login first.\n"));
+        throw new Error("not_logged_in");
+    }
+    return config;
+}
+async function runToken(context) {
+    const sub = context.parsed.tokens[2];
+    if (!sub) {
+        context.stderr.write("Usage: thingd cloud token <list|create|revoke|restrict|unrestricted>\n");
+        return;
+    }
+    switch (sub) {
+        case "list":
+            await runTokenList(context);
+            return;
+        case "create":
+            await runTokenCreate(context);
+            return;
+        case "revoke":
+            await runTokenRevoke(context);
+            return;
+        case "restrict":
+            await runTokenRestrict(context);
+            return;
+        case "unrestricted":
+            await runTokenUnrestricted(context);
+            return;
+        case "cleanup":
+            await runTokenCleanup(context);
+            return;
+        default:
+            context.stderr.write(`Unknown token action: ${sub}. Available: list, create, revoke, restrict, unrestricted, cleanup\n`);
+    }
+}
+async function runTokenCleanup(context) {
+    const config = requireLoggedInConfig(context);
+    try {
+        // Clean up expired sessions on the user's account
+        const { removed } = await cleanupSessions(config);
+        context.stdout.write(pc.green(`✓ Cleaned up ${removed} expired sessions\n`));
+    }
+    catch (err) {
+        context.stderr.write(pc.red(`Failed to clean up sessions: ${err}\n`));
+    }
+}
+async function runTokenList(context) {
+    const config = requireLoggedInConfig(context);
+    try {
+        const { userTokens } = await listUserTokens(config);
+        if (userTokens.length === 0) {
+            context.stdout.write("No CLI tokens found. Create one with `thingd cloud token create <name>`\n");
+            return;
+        }
+        // Header
+        const header = `${pc.bold("Name".padEnd(18))} ${pc.bold("Prefix".padEnd(22))} ${pc.bold("Created".padEnd(14))} ${pc.bold("Last Used".padEnd(14))} ${pc.bold("Access")}`;
+        context.stdout.write(`${header}\n`);
+        context.stdout.write(`${pc.dim("─".repeat(header.length))}\n`);
+        for (const t of userTokens) {
+            if (t.revokedAt) {
+                continue; // Skip revoked tokens
+            }
+            const access = t.projectAccess === "all" ? "All" : t.projectAccess;
+            context.stdout.write(`${t.name.padEnd(18)} ${pc.dim(t.prefix.padEnd(22))} ${formatTimeAgo(t.createdAt).padEnd(14)} ${(t.lastUsedAt ? formatTimeAgo(t.lastUsedAt) : "never").padEnd(14)} ${pc.cyan(access)}\n`);
+        }
+    }
+    catch (err) {
+        context.stderr.write(pc.red(`Failed to list tokens: ${err}\n`));
+    }
+}
+async function runTokenCreate(context) {
+    const config = requireLoggedInConfig(context);
+    const name = context.parsed.tokens[3] ?? "cli-token";
+    try {
+        const { token: userToken } = await createUserToken(config, name);
+        context.stdout.write(`\n${pc.green("✓ Token created")}\n\n` +
+            `${pc.bold(userToken)}\n\n` +
+            `${pc.yellow("⚠ This token will only be shown once. Copy it now.\n")}` +
+            `${pc.dim("Press Enter to continue...")}\n`);
+        // Wait for user to acknowledge
+        const rl = createInterface({
+            input: context.stdin,
+            output: context.stderr,
+        });
+        await rl.question("");
+        rl.close();
+    }
+    catch (err) {
+        context.stderr.write(pc.red(`Failed to create token: ${err}\n`));
+    }
+}
+async function runTokenRevoke(context) {
+    const config = requireLoggedInConfig(context);
+    const tokenId = requiredToken(context.parsed, 3, "token-id");
+    try {
+        await revokeUserToken(config, tokenId);
+        context.stdout.write(pc.green(`✓ Token ${tokenId} revoked\n`));
+    }
+    catch (err) {
+        if (err instanceof CloudApiError && err.status === 404) {
+            context.stderr.write(pc.red("Token not found.\n"));
+        }
+        else {
+            context.stderr.write(pc.red(`Failed to revoke token: ${err}\n`));
+        }
+    }
+}
+async function runTokenRestrict(context) {
+    const config = requireLoggedInConfig(context);
+    const tokenId = requiredToken(context.parsed, 3, "token-id");
+    const projectSlug = requiredToken(context.parsed, 4, "project");
+    try {
+        const { userToken } = await updateUserToken(config, tokenId, {
+            projectAccess: projectSlug,
+        });
+        context.stdout.write(pc.green(`✓ Token "${userToken.name}" restricted to: ${projectSlug}\n`));
+    }
+    catch (err) {
+        if (err instanceof CloudApiError && err.status === 404) {
+            context.stderr.write(pc.red("Token not found.\n"));
+        }
+        else {
+            context.stderr.write(pc.red(`Failed to update token: ${err}\n`));
+        }
+    }
+}
+async function runTokenUnrestricted(context) {
+    const config = requireLoggedInConfig(context);
+    const tokenId = requiredToken(context.parsed, 3, "token-id");
+    try {
+        const { userToken } = await updateUserToken(config, tokenId, {
+            projectAccess: "all",
+        });
+        context.stdout.write(pc.green(`✓ Token "${userToken.name}" now has access to all projects\n`));
+    }
+    catch (err) {
+        if (err instanceof CloudApiError && err.status === 404) {
+            context.stderr.write(pc.red("Token not found.\n"));
+        }
+        else {
+            context.stderr.write(pc.red(`Failed to update token: ${err}\n`));
+        }
+    }
+}
 // ── Org helpers ──────────────────────────────────────────────────────
 async function resolveOrg(config, slugOrId) {
     // Try direct ID lookup first, then assume it's a slug and list

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAQA,OAAO,EAUL,MAAM,EACN,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAEjD,KAAK,YAAY,GAAG;IAClB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,KAAK,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAsCF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAwFF,wBAAsB,MAAM,CAC1B,IAAI,WAAwB,EAC5B,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CA8EjB;AA08BD,wBAAsB,MAAM,CAC1B,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAef;AA4BD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,GAAG,iBAAiB,CAqDxE;AAiDD,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE/E;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAGlF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrF;AAyFD,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEpF;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAElE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAQA,OAAO,EAUL,MAAM,EACN,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAEjD,KAAK,YAAY,GAAG;IAClB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,KAAK,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC;AAE1C,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAsCF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAwFF,wBAAsB,MAAM,CAC1B,IAAI,WAAwB,EAC5B,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CA8EjB;AA08BD,wBAAsB,MAAM,CAC1B,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAef;AA4BD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,GAAG,iBAAiB,CAsDxE;AAiDD,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE/E;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAGlF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrF;AAyFD,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEpF;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAElE"}

package/dist/index.js

@@ -1002,6 +1002,7 @@ export function resolveConnection(context) {
     }
     const resolvedAuthToken = stringFlag(context.parsed, "auth-token") ??
         context.env.THINGD_AUTH_TOKEN ??
+        cloudCfg?.userToken ??
         cloudCfg?.apiKey ??
         cloudCfg?.token;
     // Prefer instanceUrl (resolved MCP endpoint) over raw cloudCfg.url (API base)

package/dist/interactive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../src/interactive.ts"],"names":[],"mappings":"AAoxGA,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CA0FvD"}
+{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../src/interactive.ts"],"names":[],"mappings":"AAqxGA,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CA0FvD"}

package/dist/interactive.js

@@ -824,7 +824,8 @@ function scheduleLoad(node) {
                     : d === "native"
                         ? ` Persistent SQLite database.\n Data is stored on disk.\n\n ${pc.dim("Best for: local development, single-node")}\n\n ${pc.dim("Press")} ${pc.bold("Enter")} ${pc.dim("to connect.")}`
                         : (() => {
-                            const hasCfg = !!readCloudConfig()?.token;
+                            const cfg = readCloudConfig();
+                            const hasCfg = !!(cfg?.userToken ?? cfg?.token);
                             return hasCfg
                                 ? ` Connect to a remote thingd instance.\n Requires a URL and optional auth token.\n\n ${pc.dim("Best for: production, multi-node")}\n\n ${pc.dim("Press")} ${pc.bold("Enter")} ${pc.dim("to connect.")}`
                                 : ` ${pc.yellow("Not logged in to thingd Cloud.")}\n\n Run ${pc.cyan("thingd cloud login")} to authenticate, or\n press ${pc.bold("Enter")} to connect with a URL and token manually.`;
@@ -2731,14 +2732,14 @@ async function handleConnect(node) {
                         cloudCfg.projectSlug = selected.projectSlug;
                         cloudCfg.instanceSlug = selected.instanceSlug;
                         writeCloudConfig(cloudCfg);
-                        await connectToDriver("cloud", deriveRestUrl(selected.mcpUrl), deriveRestUrl(selected.mcpUrl), cloudCfg.apiKey ?? cloudCfg.token, selected.instanceSlug);
+                        await connectToDriver("cloud", deriveRestUrl(selected.mcpUrl), deriveRestUrl(selected.mcpUrl), cloudCfg.userToken ?? cloudCfg.apiKey ?? cloudCfg.token, selected.instanceSlug);
                     });
                     return;
                 }
                 // No instances found — try saved URL or show error
                 if (cloudCfg.instanceUrl) {
                     const restUrl = deriveRestUrl(cloudCfg.instanceUrl);
-                    await connectToDriver("cloud", restUrl, restUrl, cloudCfg.apiKey ?? cloudCfg.token, cloudCfg.instanceSlug);
+                    await connectToDriver("cloud", restUrl, restUrl, cloudCfg.userToken ?? cloudCfg.apiKey ?? cloudCfg.token, cloudCfg.instanceSlug);
                     return;
                 }
                 viewerLines = [
@@ -2751,7 +2752,7 @@ async function handleConnect(node) {
             catch {
                 if (cloudCfg.instanceUrl) {
                     const restUrl = deriveRestUrl(cloudCfg.instanceUrl);
-                    await connectToDriver("cloud", restUrl, restUrl, cloudCfg.apiKey ?? cloudCfg.token, cloudCfg.instanceSlug);
+                    await connectToDriver("cloud", restUrl, restUrl, cloudCfg.userToken ?? cloudCfg.apiKey ?? cloudCfg.token, cloudCfg.instanceSlug);
                     return;
                 }
                 viewerLines = [
@@ -2967,12 +2968,12 @@ export async function runInteractiveCli() {
     }
     // Auto-connect to cloud if credentials exist
     const cloudCfg = readCloudConfig();
-    if (cloudCfg?.token) {
+    if (cloudCfg?.userToken ?? cloudCfg?.token) {
         const cloudUrl = resolveCloudUrl(cloudCfg);
         if (cloudUrl) {
             try {
                 const restUrl = deriveRestUrl(cloudUrl);
-                await connectToDriver("cloud", restUrl, restUrl, cloudCfg.apiKey ?? cloudCfg.token, cloudCfg.instanceSlug);
+                await connectToDriver("cloud", restUrl, restUrl, cloudCfg.userToken ?? cloudCfg.apiKey ?? cloudCfg.token, cloudCfg.instanceSlug);
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);

package/dist/lib/cloud-api.d.ts

@@ -19,6 +19,15 @@ export type CloudApiKey = {
     token?: string;
     createdAt: string;
 };
+export type UserTokenDto = {
+    id: string;
+    name: string;
+    prefix: string;
+    projectAccess: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+};
 export type CloudOrganization = {
     id: string;
     name: string;
@@ -105,6 +114,27 @@ export declare function deriveRestUrl(mcpUrl: string): string;
  * Returns null if no projects or instances exist.
  */
 export declare function resolveFirstInstance(config: CloudConfig): Promise<ResolvedInstance | null>;
+export declare function createUserToken(config: CloudConfig, name: string, projectAccess?: string): Promise<{
+    token: string;
+    userToken: UserTokenDto;
+}>;
+export declare function listUserTokens(config: CloudConfig): Promise<{
+    userTokens: UserTokenDto[];
+}>;
+export declare function revokeUserToken(config: CloudConfig, tokenId: string): Promise<void>;
+export declare function updateUserToken(config: CloudConfig, tokenId: string, updates: {
+    name?: string;
+    projectAccess?: string;
+}): Promise<{
+    userToken: UserTokenDto;
+}>;
+/**
+ * Extract the token ID from a full user token string (md_user_<hexId>_<secret> → utk_<hexId>).
+ */
+export declare function cleanupSessions(config: CloudConfig): Promise<{
+    removed: number;
+}>;
+export declare function parseUserTokenId(userToken: string): string | null;
 /**
  * Fetch all cloud instances across all projects for the logged-in user.
  * Returns an empty array if no projects or instances exist.

package/dist/lib/cloud-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-api.d.ts","sourceRoot":"","sources":["../../src/lib/cloud-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,MAAM,EAAE,MAAM,CAAC;IAEf,YAAY,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAI1C;CACF;AA0BD,wBAAsB,KAAK,CACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAE9E;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,CAE7F;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,CAMpC;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,SAAS,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CAEzC;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAKtC;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9C;AAID,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,YAAY,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAE9C;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC;IAAE,aAAa,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAAC,CAEjD;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,YAAY,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5D;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;CAAE,CAAC,CAEjD;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAAiB,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAK9C;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC,CAI1B;AAkBD,wBAAsB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAEjF;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAEjD;AAID,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAuBhG;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAyB1F"}
+{"version":3,"file":"cloud-api.d.ts","sourceRoot":"","sources":["../../src/lib/cloud-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,qBAAa,aAAc,SAAQ,KAAK;IACtC,MAAM,EAAE,MAAM,CAAC;IAEf,YAAY,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAI1C;CACF;AA+BD,wBAAsB,KAAK,CACzB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAE9E;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,CAE7F;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC,CAMpC;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,SAAS,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CAEzC;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAKtC;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9C;AAID,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,YAAY,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAE9C;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC;IAAE,aAAa,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAAC,CAEjD;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,YAAY,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5D;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;CAAE,CAAC,CAEjD;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAAiB,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAK9C;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC,CAI1B;AAkBD,wBAAsB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAEjF;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAEjD;AAID,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAuBhG;AAID,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,YAAY,CAAA;CAAE,CAAC,CAKrD;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,CAEjG;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC;IAAE,SAAS,EAAE,YAAY,CAAA;CAAE,CAAC,CAKtC;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAEvF;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMjE;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAyB1F"}

package/dist/lib/cloud-api.js

@@ -7,10 +7,14 @@ export class CloudApiError extends Error {
         this.name = "CloudApiError";
     }
 }
+function resolveAuthToken(config) {
+    return config.userToken ?? config.token ?? config.apiKey ?? "";
+}
 async function request(config, path, opts = {}) {
     const url = `${config.url ?? DEFAULT_API_URL}${path}`;
+    const authToken = resolveAuthToken(config);
     const headers = {
-        authorization: `Bearer ${config.token}`,
+        authorization: `Bearer ${authToken}`,
         "content-type": "application/json",
     };
     const res = await fetch(url, {
@@ -137,6 +141,38 @@ export async function resolveFirstInstance(config) {
     }
     return null;
 }
+// ── User Token API ──────────────────────────────────────────────────
+export async function createUserToken(config, name, projectAccess) {
+    return request(config, "/auth/user-tokens", {
+        method: "POST",
+        body: { name, projectAccess },
+    });
+}
+export async function listUserTokens(config) {
+    return request(config, "/auth/user-tokens");
+}
+export async function revokeUserToken(config, tokenId) {
+    await request(config, `/auth/user-tokens/${tokenId}`, { method: "DELETE" });
+}
+export async function updateUserToken(config, tokenId, updates) {
+    return request(config, `/auth/user-tokens/${tokenId}`, {
+        method: "PATCH",
+        body: updates,
+    });
+}
+/**
+ * Extract the token ID from a full user token string (md_user_<hexId>_<secret> → utk_<hexId>).
+ */
+export async function cleanupSessions(config) {
+    return request(config, "/auth/sessions/cleanup", { method: "DELETE" });
+}
+export function parseUserTokenId(userToken) {
+    const match = /^md_user_([a-f0-9]{20})_/.exec(userToken);
+    if (!match?.[1]) {
+        return null;
+    }
+    return `utk_${match[1]}`;
+}
 /**
  * Fetch all cloud instances across all projects for the logged-in user.
  * Returns an empty array if no projects or instances exist.

package/dist/lib/cloud-config.d.ts

@@ -1,8 +1,9 @@
 export type CloudConfig = {
-    token: string;
-    /** API key for data plane operations (REST/MCP) — created after login. */
-    apiKey?: string;
+    /** Primary credential — user token (md_user_*) created on login. */
+    userToken?: string;
+    /** Email of the logged-in user. */
     email?: string;
+    /** API base URL (defaults to https://api.thingd.cloud). */
     url?: string;
     /** Currently active organization context (set by `thingd cloud org use`). */
     organizationId?: string;
@@ -14,6 +15,10 @@ export type CloudConfig = {
     projectSlug?: string;
     /** Active instance slug (set when instanceUrl is resolved). */
     instanceSlug?: string;
+    /** @deprecated Old JWT — still read as fallback if no userToken. */
+    token?: string;
+    /** @deprecated Old project API key — still read as fallback if no userToken or token. */
+    apiKey?: string;
 };
 export declare function cloudConfigPath(): string;
 export declare function readCloudConfig(): CloudConfig | null;

package/dist/lib/cloud-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../../src/lib/cloud-config.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8GAA8G;IAC9G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,eAAe,IAAI,WAAW,GAAG,IAAI,CAUpD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAKvE;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAMxC"}
+{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../../src/lib/cloud-config.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,WAAW,GAAG;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8GAA8G;IAC9G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,eAAe,IAAI,WAAW,GAAG,IAAI,CAUpD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAKvE;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAMxC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thingd/cli",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "description": "CLI, Interactive TUI Dashboard, and MCP server for thingd — a fast object-first data engine for applications and AI agents.",
   "type": "module",
   "homepage": "https://engine.thingd.cloud",
@@ -45,7 +45,7 @@
     "cli-table3": "^0.6.5",
     "picocolors": "^1.1.1",
     "zod": "^4.4.3",
-    "@thingd/sdk": "0.59.0"
+    "@thingd/sdk": "0.61.0"
   },
   "engines": {
     "node": ">=24.0.0"