@userland.fun/cli 0.1.3 → 0.3.0

package/dist/index.js

@@ -5,8 +5,8 @@ import os from "node:os";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
 const DEFAULT_API_BASE_URL = "https://api.userland.fun";
-const KEYCHAIN_SERVICE = "fun.userland.cli";
-const KEYCHAIN_ACCOUNT = "default";
+const DEFAULT_CONSOLE_BASE_URL = "https://console.userland.fun";
+const CLI_VERSION = "0.0.0";
 async function main() {
     const [command, ...args] = process.argv.slice(2);
     if (isHelpCommand(command)) {
@@ -24,6 +24,10 @@ async function main() {
         await accountsCommand(args);
         return;
     }
+    if (command === "ops") {
+        await opsCommand(args);
+        return;
+    }
     if (command === "signup") {
         await signupCommand(args);
         return;
@@ -68,6 +72,22 @@ async function appsCommand(args) {
         await eventsCommand(rest);
         return;
     }
+    if (subcommand === "status") {
+        await appStatusCommand(rest);
+        return;
+    }
+    if (subcommand === "routes" && rest[0] === "list") {
+        await routesListCommand(rest.slice(1));
+        return;
+    }
+    if (subcommand === "slugs") {
+        await appSlugsCommand(rest);
+        return;
+    }
+    if (subcommand === "domains") {
+        await appDomainsCommand(rest);
+        return;
+    }
     usage(1);
 }
 async function authCommand(args) {
@@ -88,6 +108,10 @@ async function authCommand(args) {
         await saveKeyCommand(rest);
         return;
     }
+    if (subcommand === "logout") {
+        await logoutCommand(rest);
+        return;
+    }
     usage(1);
 }
 async function accountsCommand(args) {
@@ -100,90 +124,203 @@ async function accountsCommand(args) {
         await useAccountCommand(rest);
         return;
     }
+    if (subcommand === "status") {
+        await accountStatusCommand(rest);
+        return;
+    }
+    if (subcommand === "limits") {
+        await accountLimitsCommand(rest);
+        return;
+    }
+    if (subcommand === "downgrade" && rest[0] === "preview") {
+        await downgradePreviewCommand(rest.slice(1));
+        return;
+    }
     usage(1);
 }
-async function signupCommand(args) {
-    const options = parseAuthOptions(args);
-    const username = options.username ?? (await promptRequired("Username: "));
-    const password = options.password ?? (await promptPassword("Password: "));
-    const body = { username, password };
-    if (options.email) {
-        body.email = options.email;
+async function opsCommand(args) {
+    const [scope, subcommand, id, actionOrFlag, ...rest] = args;
+    if (scope === "accounts" && subcommand === "status" && id) {
+        await printObject(await apiFetch(`/v0/ops/accounts/${encodeURIComponent(id)}/status`, { method: "GET" }));
+        return;
     }
-    const response = await unauthenticatedApiFetch("/v0/accounts", {
-        method: "POST",
-        body: JSON.stringify(body)
-    });
-    if (options.save !== false) {
-        await saveAccountCredentials({ username: response.username, password });
-        const filePath = await saveCredentials({
-            api_key: response.api_key,
-            api_base_url: await apiBaseUrl(),
-            account_id: response.account_id ?? null
-        });
-        console.log(`Created Userland account ${response.username}`);
-        console.log(`Saved API key to ${filePath}`);
-        console.log(`Saved account login to ${accountCredentialStoreLabel()}`);
+    if (scope === "accounts" && subcommand === "flag" && id && actionOrFlag) {
+        await printObject(await opsFlagCommand("accounts", id, actionOrFlag, rest, false));
         return;
     }
-    console.log(`Created Userland account ${response.username}`);
-    console.log(`api_key=${response.api_key}`);
+    if (scope === "accounts" && subcommand === "clear" && id && actionOrFlag) {
+        await printObject(await opsFlagCommand("accounts", id, actionOrFlag, rest, true));
+        return;
+    }
+    if (scope === "apps" && subcommand === "status" && id) {
+        await printObject(await apiFetch(`/v0/ops/apps/${encodeURIComponent(id)}/status`, { method: "GET" }));
+        return;
+    }
+    if (scope === "apps" && subcommand === "flag" && id && actionOrFlag) {
+        await printObject(await opsFlagCommand("apps", id, actionOrFlag, rest, false));
+        return;
+    }
+    if (scope === "apps" && subcommand === "clear" && id && actionOrFlag) {
+        await printObject(await opsFlagCommand("apps", id, actionOrFlag, rest, true));
+        return;
+    }
+    if (scope === "apps" && subcommand === "takedown" && id) {
+        const options = parseReasonOptions([actionOrFlag, ...rest].filter((value) => value !== undefined));
+        await printObject(await apiFetch(`/v0/ops/apps/${encodeURIComponent(id)}/takedown`, {
+            method: "POST",
+            body: JSON.stringify(bodyWithReason(options))
+        }));
+        return;
+    }
+    if (scope === "routes" && subcommand === "disable" && id) {
+        const options = parseRouteDisableOptions([actionOrFlag, ...rest].filter((value) => value !== undefined));
+        if (!options.status) {
+            usage(1);
+        }
+        await printObject(await apiFetch(`/v0/ops/routes/${encodeURIComponent(id)}/disable`, {
+            method: "POST",
+            body: JSON.stringify({ status: options.status, ...bodyWithReason(options) })
+        }));
+        return;
+    }
+    if (scope === "routes" && subcommand === "enable" && id) {
+        const options = parseReasonOptions([actionOrFlag, ...rest].filter((value) => value !== undefined));
+        await printObject(await apiFetch(`/v0/ops/routes/${encodeURIComponent(id)}/enable`, {
+            method: "POST",
+            body: JSON.stringify(bodyWithReason(options))
+        }));
+        return;
+    }
+    usage(1);
+}
+async function signupCommand(args) {
+    const options = parseAuthOptions(args);
+    await deviceLoginCommand(options, { signupAlias: true });
 }
 async function loginCommand(args) {
     const options = parseAuthOptions(args);
-    const storedAccount = await readAccountCredentials();
-    const username = options.username ?? storedAccount?.username ?? (await promptRequired("Username: "));
-    const password = options.password ?? storedAccount?.password ?? (await promptPassword("Password: "));
-    const response = await unauthenticatedApiFetch("/v0/auth/token", {
+    await deviceLoginCommand(options, { signupAlias: false });
+}
+async function deviceLoginCommand(options, context) {
+    const credentials = await readCredentials();
+    const baseUrl = await apiBaseUrl(credentials, options.apiBaseUrl);
+    const configuredConsoleUrl = await consoleBaseUrl(credentials, options.consoleUrl);
+    const start = await requestJson(baseUrl, "/v0/auth/device/start", {
         method: "POST",
-        body: JSON.stringify({ username, password })
+        body: JSON.stringify({
+            client: "userland-cli",
+            client_version: CLI_VERSION,
+            requested_capability: "api_key"
+        })
     });
+    const verificationUrl = options.consoleUrl
+        ? `${configuredConsoleUrl.replace(/\/$/u, "")}/device?code=${encodeURIComponent(start.user_code)}`
+        : start.verification_uri_complete;
+    const consoleUrl = options.consoleUrl ?? consoleUrlFromVerification(start.verification_uri, configuredConsoleUrl);
+    if (context.signupAlias) {
+        console.log("Signup uses the same browser approval flow as login. New accounts are created in the browser after email proof.");
+    }
+    if (options.email) {
+        console.log(`email_hint=${options.email}`);
+    }
+    if (!options.noBrowser) {
+        const opened = await openBrowser(verificationUrl);
+        if (opened) {
+            console.log("Opened your browser for Userland authorization.");
+        }
+    }
+    console.log("Open this URL to sign in to Userland:");
+    console.log("");
+    console.log(verificationUrl);
+    console.log("");
+    console.log(`user_code=${start.user_code}`);
+    console.log("Waiting for approval...");
+    const response = await pollDeviceAuthorization(baseUrl, start);
     if (options.save !== false) {
-        const baseUrl = await apiBaseUrl();
-        const accountId = response.account_id ?? (await discoverDefaultAccountId(response.api_key, baseUrl).catch(() => undefined));
-        await saveAccountCredentials({ username, password });
         const filePath = await saveCredentials({
             api_key: response.api_key,
+            api_key_id: response.api_key_id ?? null,
             api_base_url: baseUrl,
-            account_id: accountId ?? null
+            console_url: consoleUrl,
+            username: response.username ?? null,
+            account_id: response.default_account_id ?? null
         });
         console.log(`Saved API key to ${filePath}`);
-        console.log(`Saved account login to ${accountCredentialStoreLabel()}`);
+        if (response.username) {
+            console.log(`username=${response.username}`);
+        }
+        if (response.default_account_id) {
+            console.log(`selected_account_id=${response.default_account_id}`);
+        }
         return;
     }
     console.log(`api_key=${response.api_key}`);
+    if (response.api_key_id) {
+        console.log(`api_key_id=${response.api_key_id}`);
+    }
+    if (response.default_account_id) {
+        console.log(`selected_account_id=${response.default_account_id}`);
+    }
 }
 async function authStatusCommand() {
     const credentials = await readCredentials();
-    const account = await readAccountCredentials();
     const filePath = credentialsPath();
     const apiKeySource = process.env.USERLAND_API_KEY ? "env" : credentials?.api_key ? "file" : "missing";
     const selectedAccountId = process.env.USERLAND_ACCOUNT_ID ?? credentials?.account_id;
     const accountSource = process.env.USERLAND_ACCOUNT_ID ? "env" : credentials?.account_id ? "file" : apiKeySource === "missing" ? "missing" : "default";
     console.log(`api_base_url=${await apiBaseUrl(credentials)}`);
+    console.log(`console_url=${await consoleBaseUrl(credentials)}`);
     console.log(`api_key=${apiKeySource}`);
     console.log(`credentials_file=${filePath}`);
+    if (apiKeySource === "file" && credentials?.api_key_id) {
+        console.log(`api_key_id=${credentials.api_key_id}`);
+    }
     console.log(`account=${accountSource}`);
     if (selectedAccountId) {
         console.log(`account_id=${selectedAccountId}`);
     }
-    console.log(`account_login=${account ? "keychain" : "missing"}`);
-    if (account?.username) {
-        console.log(`username=${account.username}`);
+    if (apiKeySource === "file" && credentials?.username) {
+        console.log(`username=${credentials.username}`);
     }
 }
 async function saveKeyCommand(args) {
     const options = parseAuthOptions(args);
-    const username = options.username ?? (await promptRequired("Username: "));
     const apiKey = options.apiKey ?? (await promptRequired("API key: "));
-    await saveAccountCredentials({ username, password: options.password });
+    const credentials = await readCredentials();
     const filePath = await saveCredentials({
         api_key: apiKey,
-        api_base_url: await apiBaseUrl(),
-        account_id: null
+        api_key_id: null,
+        api_base_url: await apiBaseUrl(credentials, options.apiBaseUrl),
+        console_url: await consoleBaseUrl(credentials, options.consoleUrl),
+        username: null,
+        account_id: options.account ?? null
     });
     console.log(`Saved API key to ${filePath}`);
-    console.log(`Saved account login to ${accountCredentialStoreLabel()}`);
+    if (options.account) {
+        console.log(`selected_account_id=${options.account}`);
+    }
+}
+async function logoutCommand(args) {
+    const options = parseAuthOptions(args);
+    const credentials = await readCredentials();
+    const filePath = credentialsPath();
+    if (options.revoke) {
+        if (credentials?.api_key && credentials.api_key_id) {
+            await requestJson(await apiBaseUrl(credentials, options.apiBaseUrl), `/v0/auth/api-keys/${encodeURIComponent(credentials.api_key_id)}`, {
+                method: "DELETE",
+                headers: {
+                    authorization: `Bearer ${credentials.api_key}`
+                }
+            });
+            console.log(`revoked_api_key_id=${credentials.api_key_id}`);
+        }
+        else {
+            console.log("revoke=skipped api_key_id_missing");
+        }
+    }
+    await fs.rm(filePath, { force: true });
+    console.log("local_credentials=removed");
+    console.log(`credentials_file=${filePath}`);
 }
 async function listAccountsCommand() {
     const response = await apiFetch("/v0/accounts", {
@@ -203,6 +340,69 @@ async function useAccountCommand(args) {
     console.log(`selected_account_id=${accountId}`);
     console.log(`credentials_file=${filePath}`);
 }
+async function accountStatusCommand(args) {
+    const options = parseAccountOptions(args);
+    const accountId = await resolveAccountId(options.account);
+    const response = await apiFetch(`/v0/accounts/${encodeURIComponent(accountId)}/status`, {
+        method: "GET"
+    }, { accountId: options.account, accountScoped: true });
+    console.log(`account_id=${response.account_id}`);
+    if (response.plan_key)
+        console.log(`plan_key=${response.plan_key}`);
+    console.log(`billing_access_state=${response.billing_access_state}`);
+    console.log(`grace_ends_at=${response.grace_ends_at ?? ""}`);
+    if (response.suspended !== undefined)
+        console.log(`suspended=${response.suspended}`);
+    if (response.restricted !== undefined)
+        console.log(`restricted=${response.restricted}`);
+    printList("account_flags", response.account_flags ?? response.active_flags);
+    printList("reasons", response.reasons);
+    printWarnings(response.warnings);
+}
+async function accountLimitsCommand(args) {
+    const options = parseAccountOptions(args);
+    const accountId = await resolveAccountId(options.account);
+    const response = await apiFetch(`/v0/accounts/${encodeURIComponent(accountId)}/limits`, {
+        method: "GET"
+    }, { accountId: options.account, accountScoped: true });
+    console.log(`account_id=${response.account_id}`);
+    console.log(`plan_key=${response.plan_key}`);
+    if (response.usage_period?.period_start)
+        console.log(`usage_period_start=${response.usage_period.period_start}`);
+    if (response.usage_period?.period_end)
+        console.log(`usage_period_end=${response.usage_period.period_end}`);
+    printKeyValues("feature", response.features);
+    printKeyValues("manifest_limit", response.manifest_limits);
+    printKeyValues("deployment_limit", response.deployment_limits);
+    printKeyValues("runtime_limit", response.runtime_limits);
+    printKeyValues("release_limit", response.release_limits);
+    printKeyValues("usage_limit", response.usage_limits);
+    printKeyValues("usage", response.usage);
+    if (response.route_counts)
+        printKeyValues("route_count", response.route_counts);
+    printWarnings(response.compatibility_warnings);
+}
+async function downgradePreviewCommand(args) {
+    const options = parseDowngradePreviewOptions(args);
+    if (!options.to) {
+        usage(1);
+    }
+    const accountId = await resolveAccountId(options.account);
+    const params = new URLSearchParams({ plan: options.to });
+    const response = await apiFetch(`/v0/accounts/${encodeURIComponent(accountId)}/downgrade-preview?${params.toString()}`, {
+        method: "GET"
+    }, { accountId: options.account, accountScoped: true });
+    console.log(`account_id=${response.account_id}`);
+    console.log(`current_plan_key=${response.current_plan_key}`);
+    console.log(`target_plan_key=${response.target_plan_key}`);
+    console.log(`compatible=${response.compatible}`);
+    for (const violation of response.violations) {
+        console.log(`violation=${formatFields(violation)}`);
+    }
+    for (const action of response.actions) {
+        console.log(`action=${formatFields(action)}`);
+    }
+}
 async function publishCommand(args) {
     const dir = args[0];
     const options = parseOptions(args.slice(1));
@@ -306,6 +506,185 @@ async function eventsCommand(args) {
         console.log(`cursor=${response.cursor}`);
     }
 }
+async function appStatusCommand(args) {
+    const appId = args[0];
+    if (!appId) {
+        usage(1);
+    }
+    const options = parseAccountOptions(args.slice(1));
+    const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}`, {
+        method: "GET"
+    }, { accountId: options.account, accountScoped: true });
+    const state = objectValue(response.operational_state) ?? {};
+    console.log(`app_id=${response.app_id}`);
+    if (response.account_id)
+        console.log(`account_id=${response.account_id}`);
+    if (stringValue(state.billing_access_state) ?? response.billing_access_state)
+        console.log(`billing_access_state=${stringValue(state.billing_access_state) ?? response.billing_access_state}`);
+    printOptionalBoolean("suspended", state.suspended ?? response.suspended);
+    printOptionalBoolean("takedown", state.takedown ?? response.takedown);
+    printOptionalBoolean("restricted", state.restricted);
+    printOptionalBoolean("can_serve_canonical", state.can_serve_canonical ?? response.can_serve_canonical);
+    printOptionalBoolean("can_mutate", state.can_mutate ?? response.can_mutate);
+    printList("account_flags", stringArrayValue(state.account_flags) ?? response.account_flags);
+    printList("app_flags", stringArrayValue(state.app_flags) ?? response.app_flags);
+    printList("reasons", stringArrayValue(state.reasons) ?? response.reasons);
+    if (response.routes) {
+        for (const route of response.routes) {
+            printRoute(route);
+        }
+    }
+}
+async function routesListCommand(args) {
+    const appId = args[0];
+    if (!appId) {
+        usage(1);
+    }
+    const options = parseAccountOptions(args.slice(1));
+    const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}/routes`, {
+        method: "GET"
+    }, { accountId: options.account, accountScoped: true });
+    printRoutes(response.routes);
+}
+async function appSlugsCommand(args) {
+    const [action, appId, slug, ...optionArgs] = args;
+    if (action === "list" && appId) {
+        const options = parseAccountOptions([slug, ...optionArgs].filter((value) => value !== undefined));
+        const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}/slugs`, {
+            method: "GET"
+        }, { accountId: options.account, accountScoped: true });
+        printRoutes(response.routes);
+        return;
+    }
+    if (action === "add" && appId && slug) {
+        const options = parseAccountOptions(optionArgs);
+        const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}/slugs`, {
+            method: "POST",
+            body: JSON.stringify({ slug })
+        }, { accountId: options.account, accountScoped: true });
+        printRoute(response.route);
+        return;
+    }
+    if (action === "remove" && appId && slug) {
+        const options = parseAccountOptions(optionArgs);
+        const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}/slugs/${encodeURIComponent(slug)}`, {
+            method: "DELETE"
+        }, { accountId: options.account, accountScoped: true });
+        printRoute(response.route);
+        return;
+    }
+    usage(1);
+}
+async function appDomainsCommand(args) {
+    const [action, appId, hostname, ...optionArgs] = args;
+    if (action === "list" && appId) {
+        const options = parseAccountOptions([hostname, ...optionArgs].filter((value) => value !== undefined));
+        const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}/domains`, {
+            method: "GET"
+        }, { accountId: options.account, accountScoped: true });
+        printRoutes(response.routes);
+        return;
+    }
+    if (action === "add" && appId && hostname) {
+        const options = parseAccountOptions(optionArgs);
+        const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}/domains`, {
+            method: "POST",
+            body: JSON.stringify({ hostname })
+        }, { accountId: options.account, accountScoped: true });
+        printRoute(response.route);
+        return;
+    }
+    if (action === "verify" && appId && hostname) {
+        const options = parseAccountOptions(optionArgs);
+        const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}/domains/${encodeURIComponent(hostname)}/verify`, {
+            method: "POST",
+            body: JSON.stringify({})
+        }, { accountId: options.account, accountScoped: true });
+        printRoute(response.route);
+        return;
+    }
+    if (action === "remove" && appId && hostname) {
+        const options = parseAccountOptions(optionArgs);
+        const response = await apiFetch(`/v0/apps/${encodeURIComponent(appId)}/domains/${encodeURIComponent(hostname)}`, {
+            method: "DELETE"
+        }, { accountId: options.account, accountScoped: true });
+        printRoute(response.route);
+        return;
+    }
+    usage(1);
+}
+async function opsFlagCommand(scope, id, flag, args, clear) {
+    const options = parseReasonOptions(args);
+    return await apiFetch(`/v0/ops/${scope}/${encodeURIComponent(id)}/flags/${encodeURIComponent(flag)}${clear ? "/clear" : ""}`, {
+        method: clear ? "POST" : "PUT",
+        body: JSON.stringify(bodyWithReason(options))
+    });
+}
+async function resolveAccountId(explicitAccountId) {
+    const credentials = await readCredentials();
+    const accountId = selectedAccountId(explicitAccountId, credentials);
+    if (accountId) {
+        return accountId;
+    }
+    const response = await apiFetch("/v0/accounts", { method: "GET" });
+    return response.default_account_id;
+}
+function printRoutes(routes) {
+    for (const route of routes) {
+        printRoute(route);
+    }
+}
+function printRoute(route) {
+    console.log([
+        route.route_id,
+        route.route_type,
+        route.status,
+        route.hostname,
+        route.slug ?? "",
+        route.reason ?? ""
+    ].join("\t"));
+    if (route.verification && Object.keys(route.verification).length > 0) {
+        console.log(`verification=${JSON.stringify(route.verification)}`);
+    }
+}
+async function printObject(value) {
+    for (const [key, entry] of Object.entries(value)) {
+        if (Array.isArray(entry)) {
+            for (const item of entry) {
+                console.log(`${key}=${isPlainObject(item) ? formatFields(item) : String(item)}`);
+            }
+        }
+        else if (isPlainObject(entry)) {
+            console.log(`${key}=${JSON.stringify(entry)}`);
+        }
+        else {
+            console.log(`${key}=${entry ?? ""}`);
+        }
+    }
+}
+function printKeyValues(prefix, values) {
+    for (const [key, value] of Object.entries(values).sort(([left], [right]) => left.localeCompare(right))) {
+        console.log(`${prefix}=${key} value=${value === null ? "unlimited" : formatFieldValue(value)}`);
+    }
+}
+function printList(label, values) {
+    if (values && values.length > 0) {
+        console.log(`${label}=${values.join(",")}`);
+    }
+}
+function printWarnings(warnings) {
+    for (const warning of warnings ?? []) {
+        console.log(`warning=${formatFields(warning)}`);
+    }
+}
+function printOptionalBoolean(label, value) {
+    if (typeof value === "boolean") {
+        console.log(`${label}=${value}`);
+    }
+}
+function bodyWithReason(options) {
+    return options.reason ? { reason: options.reason } : {};
+}
 async function readPublishDirectory(rootDir, options) {
     const absoluteRoot = path.resolve(rootDir);
     const stat = await fs.stat(absoluteRoot).catch(() => null);
@@ -434,20 +813,50 @@ async function apiFetch(apiPath, init, options = {}) {
         headers
     });
 }
-async function unauthenticatedApiFetch(apiPath, init) {
-    return await requestJson(await apiBaseUrl(), apiPath, init);
+function selectedAccountId(explicitAccountId, credentials) {
+    return explicitAccountId ?? process.env.USERLAND_ACCOUNT_ID ?? credentials?.account_id;
 }
-async function discoverDefaultAccountId(apiKey, baseUrl) {
-    const response = await requestJson(baseUrl, "/v0/accounts", {
-        method: "GET",
-        headers: {
-            authorization: `Bearer ${apiKey}`
+async function pollDeviceAuthorization(baseUrl, start) {
+    let intervalSeconds = positiveNumber(start.interval, 5);
+    const deadline = Date.now() + positiveNumber(start.expires_in, 900) * 1000;
+    while (Date.now() <= deadline) {
+        const poll = await requestJson(baseUrl, "/v0/auth/device/poll", {
+            method: "POST",
+            body: JSON.stringify({ device_code: start.device_code })
+        });
+        if (poll.ok) {
+            return poll;
         }
-    });
-    return response.default_account_id;
+        if (poll.status === "authorization_pending") {
+            await sleep(intervalSeconds * 1000);
+            continue;
+        }
+        if (poll.status === "slow_down") {
+            intervalSeconds = positiveNumber(poll.interval, intervalSeconds + 5);
+            await sleep(intervalSeconds * 1000);
+            continue;
+        }
+        throw new Error(deviceAuthorizationStatusMessage(poll.status));
+    }
+    throw new Error("Device authorization expired before approval.");
 }
-function selectedAccountId(explicitAccountId, credentials) {
-    return explicitAccountId ?? process.env.USERLAND_ACCOUNT_ID ?? credentials?.account_id;
+function deviceAuthorizationStatusMessage(status) {
+    if (status === "denied") {
+        return "Device authorization was denied in the browser.";
+    }
+    if (status === "expired") {
+        return "Device authorization expired before approval.";
+    }
+    return "Device authorization was already consumed. Run `userland login` again.";
+}
+function positiveNumber(value, fallback) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+async function sleep(milliseconds) {
+    if (milliseconds <= 0) {
+        return;
+    }
+    await new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 async function requestJson(baseUrl, apiPath, init) {
     const response = await fetch(`${baseUrl.replace(/\/$/u, "")}${apiPath}`, {
@@ -465,8 +874,38 @@ async function requestJson(baseUrl, apiPath, init) {
     }
     return body;
 }
-async function apiBaseUrl(credentials) {
-    return process.env.USERLAND_API_BASE_URL ?? credentials?.api_base_url ?? (await readCredentials())?.api_base_url ?? DEFAULT_API_BASE_URL;
+async function apiBaseUrl(credentials, override) {
+    return override ?? process.env.USERLAND_API_BASE_URL ?? credentials?.api_base_url ?? (await readCredentials())?.api_base_url ?? DEFAULT_API_BASE_URL;
+}
+async function consoleBaseUrl(credentials, override) {
+    return override ?? process.env.USERLAND_CONSOLE_URL ?? credentials?.console_url ?? (await readCredentials())?.console_url ?? DEFAULT_CONSOLE_BASE_URL;
+}
+function consoleUrlFromVerification(verificationUri, fallback) {
+    if (!verificationUri) {
+        return fallback;
+    }
+    try {
+        const url = new URL(verificationUri);
+        return `${url.origin}`;
+    }
+    catch {
+        return fallback;
+    }
+}
+async function openBrowser(url) {
+    const [command, args] = process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+            ? ["cmd", ["/c", "start", "", url]]
+            : ["xdg-open", [url]];
+    return await new Promise((resolve) => {
+        const child = spawn(command, args, { detached: true, stdio: "ignore" });
+        child.once("error", () => resolve(false));
+        child.once("spawn", () => {
+            child.unref();
+            resolve(true);
+        });
+    });
 }
 function credentialsPath() {
     return process.env.USERLAND_CREDENTIALS_FILE ?? path.join(os.homedir(), ".userland", "credentials.json");
@@ -491,7 +930,10 @@ async function readCredentials() {
         account_id: stringValue(credentials.account_id),
         api_base_url: stringValue(credentials.api_base_url),
         api_key: stringValue(credentials.api_key),
-        updated_at: stringValue(credentials.updated_at)
+        api_key_id: stringValue(credentials.api_key_id),
+        console_url: stringValue(credentials.console_url),
+        updated_at: stringValue(credentials.updated_at),
+        username: stringValue(credentials.username)
     };
 }
 async function saveCredentials(update) {
@@ -503,8 +945,10 @@ async function saveCredentials(update) {
         ...sanitizedUpdate,
         updated_at: new Date().toISOString()
     };
-    if (update.account_id === null) {
-        delete credentials.account_id;
+    for (const [key, value] of Object.entries(update)) {
+        if (value === null) {
+            delete credentials[key];
+        }
     }
     const dir = path.dirname(filePath);
     await fs.mkdir(dir, { recursive: true, mode: 0o700 });
@@ -513,261 +957,6 @@ async function saveCredentials(update) {
     await fs.chmod(filePath, 0o600).catch(() => undefined);
     return filePath;
 }
-async function readAccountCredentials() {
-    const raw = await keychainGetSecret().catch((error) => {
-        if (error instanceof KeychainUnavailableError) {
-            return undefined;
-        }
-        throw error;
-    });
-    if (!raw) {
-        return undefined;
-    }
-    const parsed = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        throw new Error("Stored Userland account credentials are malformed.");
-    }
-    const credentials = parsed;
-    const username = stringValue(credentials.username);
-    const password = stringValue(credentials.password);
-    return username || password ? { username, password } : undefined;
-}
-async function saveAccountCredentials(update) {
-    const existing = (await readAccountCredentials()) ?? {};
-    const sanitizedUpdate = Object.fromEntries(Object.entries(update).filter(([, value]) => value !== undefined));
-    const credentials = {
-        ...existing,
-        ...sanitizedUpdate
-    };
-    if (!credentials.username && !credentials.password) {
-        return;
-    }
-    await keychainSetSecret(JSON.stringify(credentials));
-}
-function accountCredentialStoreLabel() {
-    return process.env.USERLAND_KEYCHAIN_FILE ? "test keychain" : "OS keychain";
-}
-class KeychainUnavailableError extends Error {
-}
-async function keychainGetSecret() {
-    const testKeychainFile = process.env.USERLAND_KEYCHAIN_FILE;
-    if (testKeychainFile) {
-        return await fileKeychainGet(testKeychainFile);
-    }
-    if (process.platform === "darwin") {
-        const result = await runCommand("security", ["find-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", KEYCHAIN_SERVICE, "-w"]);
-        if (result.code === 44) {
-            return undefined;
-        }
-        assertCommandOk("security", result);
-        return result.stdout.trimEnd();
-    }
-    if (process.platform === "linux") {
-        const result = await runCommand("secret-tool", ["lookup", "service", KEYCHAIN_SERVICE, "account", KEYCHAIN_ACCOUNT]);
-        if (result.code === 1) {
-            return undefined;
-        }
-        assertCommandOk("secret-tool", result);
-        return result.stdout.trimEnd();
-    }
-    if (process.platform === "win32") {
-        const result = await runPowerShell(windowsCredentialReadScript());
-        if (result.code === 2) {
-            return undefined;
-        }
-        assertCommandOk("powershell", result);
-        return result.stdout.trimEnd();
-    }
-    throw new KeychainUnavailableError(`OS keychain is not supported on ${process.platform}.`);
-}
-async function keychainSetSecret(secret) {
-    const testKeychainFile = process.env.USERLAND_KEYCHAIN_FILE;
-    if (testKeychainFile) {
-        await fileKeychainSet(testKeychainFile, secret);
-        return;
-    }
-    if (process.platform === "darwin") {
-        assertCommandOk("security", await runCommand("security", ["add-generic-password", "-U", "-a", KEYCHAIN_ACCOUNT, "-s", KEYCHAIN_SERVICE, "-w", secret]));
-        return;
-    }
-    if (process.platform === "linux") {
-        assertCommandOk("secret-tool", await runCommand("secret-tool", ["store", "--label", "Userland CLI", "service", KEYCHAIN_SERVICE, "account", KEYCHAIN_ACCOUNT], secret));
-        return;
-    }
-    if (process.platform === "win32") {
-        assertCommandOk("powershell", await runPowerShell(windowsCredentialWriteScript(), secret));
-        return;
-    }
-    throw new KeychainUnavailableError(`OS keychain is not supported on ${process.platform}.`);
-}
-async function fileKeychainGet(filePath) {
-    const contents = await fs.readFile(filePath, "utf8").catch((error) => {
-        if (error.code === "ENOENT") {
-            return undefined;
-        }
-        throw error;
-    });
-    if (!contents) {
-        return undefined;
-    }
-    const parsed = JSON.parse(contents);
-    return parsed[`${KEYCHAIN_SERVICE}:${KEYCHAIN_ACCOUNT}`];
-}
-async function fileKeychainSet(filePath, secret) {
-    const existing = await fs.readFile(filePath, "utf8").catch((error) => {
-        if (error.code === "ENOENT") {
-            return "{}";
-        }
-        throw error;
-    });
-    const parsed = JSON.parse(existing);
-    parsed[`${KEYCHAIN_SERVICE}:${KEYCHAIN_ACCOUNT}`] = secret;
-    await fs.mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
-    await fs.writeFile(filePath, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
-    await fs.chmod(filePath, 0o600).catch(() => undefined);
-}
-async function runCommand(command, args, stdin, env) {
-    return await new Promise((resolve, reject) => {
-        const child = spawn(command, args, { env: env ? { ...process.env, ...env } : process.env, stdio: ["pipe", "pipe", "pipe"] });
-        const stdout = [];
-        const stderr = [];
-        child.stdout.on("data", (chunk) => stdout.push(chunk));
-        child.stderr.on("data", (chunk) => stderr.push(chunk));
-        child.on("error", (error) => {
-            if (error.code === "ENOENT") {
-                reject(new KeychainUnavailableError(`${command} is required for OS keychain access.`));
-                return;
-            }
-            reject(error);
-        });
-        child.on("close", (code) => {
-            resolve({
-                code,
-                stdout: Buffer.concat(stdout).toString("utf8"),
-                stderr: Buffer.concat(stderr).toString("utf8")
-            });
-        });
-        child.stdin.end(stdin ?? "");
-    });
-}
-async function runPowerShell(script, stdin) {
-    const env = stdin === undefined ? undefined : { USERLAND_KEYCHAIN_SECRET: stdin };
-    return await runCommand("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "-"], scriptWithInput(script), env);
-}
-function scriptWithInput(script) {
-    return `$ErrorActionPreference = "Stop"\n${script}`;
-}
-function assertCommandOk(command, result) {
-    if (result.code !== 0) {
-        const detail = result.stderr.trim() || result.stdout.trim() || `exit ${result.code ?? "unknown"}`;
-        throw new Error(`${command} failed while accessing the OS keychain: ${detail}`);
-    }
-}
-function windowsCredentialWriteScript() {
-    return `
-Add-Type -TypeDefinition @"
-using System;
-using System.ComponentModel;
-using System.Runtime.InteropServices;
-using System.Text;
-
-public static class UserlandCredential {
-  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-  private struct Credential {
-    public UInt32 Flags;
-    public UInt32 Type;
-    public string TargetName;
-    public string Comment;
-    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
-    public UInt32 CredentialBlobSize;
-    public IntPtr CredentialBlob;
-    public UInt32 Persist;
-    public UInt32 AttributeCount;
-    public IntPtr Attributes;
-    public string TargetAlias;
-    public string UserName;
-  }
-
-  [DllImport("Advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
-  private static extern bool CredWrite(ref Credential credential, UInt32 flags);
-
-  public static void Write(string target, string username, string secret) {
-    byte[] bytes = Encoding.Unicode.GetBytes(secret);
-    IntPtr blob = Marshal.AllocCoTaskMem(bytes.Length);
-    try {
-      Marshal.Copy(bytes, 0, blob, bytes.Length);
-      Credential credential = new Credential();
-      credential.Type = 1;
-      credential.TargetName = target;
-      credential.UserName = username;
-      credential.CredentialBlob = blob;
-      credential.CredentialBlobSize = (UInt32)bytes.Length;
-      credential.Persist = 2;
-      if (!CredWrite(ref credential, 0)) {
-        throw new Win32Exception(Marshal.GetLastWin32Error());
-      }
-    } finally {
-      Marshal.FreeCoTaskMem(blob);
-    }
-  }
-}
-"@
-$secret = [Environment]::GetEnvironmentVariable("USERLAND_KEYCHAIN_SECRET")
-[UserlandCredential]::Write(${JSON.stringify(KEYCHAIN_SERVICE)}, ${JSON.stringify(KEYCHAIN_ACCOUNT)}, $secret)
-`;
-}
-function windowsCredentialReadScript() {
-    return `
-Add-Type -TypeDefinition @"
-using System;
-using System.ComponentModel;
-using System.Runtime.InteropServices;
-
-public static class UserlandCredential {
-  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
-  private struct Credential {
-    public UInt32 Flags;
-    public UInt32 Type;
-    public string TargetName;
-    public string Comment;
-    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
-    public UInt32 CredentialBlobSize;
-    public IntPtr CredentialBlob;
-    public UInt32 Persist;
-    public UInt32 AttributeCount;
-    public IntPtr Attributes;
-    public string TargetAlias;
-    public string UserName;
-  }
-
-  [DllImport("Advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
-  private static extern bool CredRead(string target, UInt32 type, UInt32 reservedFlag, out IntPtr credentialPtr);
-
-  [DllImport("Advapi32.dll", SetLastError = true)]
-  private static extern void CredFree(IntPtr buffer);
-
-  public static string Read(string target) {
-    IntPtr credentialPtr;
-    if (!CredRead(target, 1, 0, out credentialPtr)) {
-      int error = Marshal.GetLastWin32Error();
-      if (error == 1168) {
-        Environment.Exit(2);
-      }
-      throw new Win32Exception(error);
-    }
-
-    try {
-      Credential credential = (Credential)Marshal.PtrToStructure(credentialPtr, typeof(Credential));
-      return Marshal.PtrToStringUni(credential.CredentialBlob, (int)credential.CredentialBlobSize / 2);
-    } finally {
-      CredFree(credentialPtr);
-    }
-  }
-}
-"@
-[Console]::Out.Write([UserlandCredential]::Read(${JSON.stringify(KEYCHAIN_SERVICE)}))
-`;
-}
 function parseOptions(args) {
     const options = {};
     for (let index = 0; index < args.length; index += 1) {
@@ -791,11 +980,8 @@ function parseAuthOptions(args) {
     const options = { save: true };
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
-        if (arg === "--username") {
-            options.username = args[++index];
-        }
-        else if (arg === "--password") {
-            options.password = args[++index];
+        if (arg === "--username" || arg === "--password") {
+            throw new Error("Userland platform auth is passwordless. Run `userland login` without username/password flags.");
         }
         else if (arg === "--email") {
             options.email = args[++index];
@@ -806,6 +992,24 @@ function parseAuthOptions(args) {
         else if (arg === "--no-save") {
             options.save = false;
         }
+        else if (arg === "--save=false") {
+            options.save = false;
+        }
+        else if (arg === "--no-browser") {
+            options.noBrowser = true;
+        }
+        else if (arg === "--api-base-url") {
+            options.apiBaseUrl = args[++index];
+        }
+        else if (arg === "--console-url") {
+            options.consoleUrl = args[++index];
+        }
+        else if (arg === "--account") {
+            options.account = args[++index];
+        }
+        else if (arg === "--revoke") {
+            options.revoke = true;
+        }
         else {
             throw new Error(`Unknown option: ${arg}`);
         }
@@ -853,6 +1057,54 @@ function parseEventsOptions(args) {
     }
     return options;
 }
+function parseDowngradePreviewOptions(args) {
+    const options = {};
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--to") {
+            options.to = args[++index];
+        }
+        else if (arg === "--account") {
+            options.account = args[++index];
+        }
+        else {
+            throw new Error(`Unknown option: ${arg}`);
+        }
+    }
+    return options;
+}
+function parseReasonOptions(args) {
+    const options = {};
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--reason") {
+            options.reason = args[++index];
+        }
+        else if (arg === "--account") {
+            options.account = args[++index];
+        }
+        else {
+            throw new Error(`Unknown option: ${arg}`);
+        }
+    }
+    return options;
+}
+function parseRouteDisableOptions(args) {
+    const options = {};
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--status") {
+            options.status = args[++index];
+        }
+        else if (arg === "--reason") {
+            options.reason = args[++index];
+        }
+        else {
+            throw new Error(`Unknown option: ${arg}`);
+        }
+    }
+    return options;
+}
 function parseAccountOptions(args) {
     const options = {};
     for (let index = 0; index < args.length; index += 1) {
@@ -892,54 +1144,33 @@ async function promptLine(prompt) {
         readline.close();
     }
 }
-async function promptPassword(prompt) {
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        return await promptRequired(prompt);
-    }
-    process.stdout.write(prompt);
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.setEncoding("utf8");
-    return await new Promise((resolve, reject) => {
-        let value = "";
-        const cleanup = () => {
-            process.stdin.setRawMode(false);
-            process.stdin.off("data", onData);
-        };
-        const onData = (chunk) => {
-            for (const char of chunk) {
-                if (char === "\u0003") {
-                    cleanup();
-                    process.stdout.write("\n");
-                    reject(new Error("Interrupted."));
-                    return;
-                }
-                if (char === "\r" || char === "\n" || char === "\u0004") {
-                    cleanup();
-                    process.stdout.write("\n");
-                    if (!value) {
-                        reject(new Error("Password is required."));
-                        return;
-                    }
-                    resolve(value);
-                    return;
-                }
-                if (char === "\u007f") {
-                    value = value.slice(0, -1);
-                    continue;
-                }
-                value += char;
-            }
-        };
-        process.stdin.on("data", onData);
-    });
-}
 function objectValue(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
 }
 function stringValue(value) {
     return typeof value === "string" ? value : undefined;
 }
+function stringArrayValue(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : undefined;
+}
+function formatFields(value) {
+    return Object.entries(value)
+        .filter(([, entry]) => entry !== undefined && entry !== null)
+        .map(([key, entry]) => `${key}=${formatFieldValue(entry)}`)
+        .join(" ");
+}
+function formatFieldValue(value) {
+    if (typeof value === "string") {
+        return /\s/u.test(value) ? JSON.stringify(value) : value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(formatFieldValue).join(",");
+    }
+    if (isPlainObject(value)) {
+        return JSON.stringify(value);
+    }
+    return String(value);
+}
 function contentTypeForPath(filePath) {
     const ext = path.extname(filePath).toLowerCase();
     const types = {
@@ -958,46 +1189,57 @@ function contentTypeForPath(filePath) {
     return types[ext] ?? "application/octet-stream";
 }
 function errorMessage(body) {
-    if (typeof body !== "object" || body === null || !("error" in body)) {
+    if (!isPlainObject(body) || !("error" in body)) {
         return undefined;
     }
-    const error = body.error;
-    if (typeof error !== "object" || error === null || !("message" in error)) {
+    const parsed = parseApiError(body);
+    if (!parsed.message && !parsed.code) {
         return undefined;
     }
-    const typedError = error;
-    const message = typeof typedError.message === "string" ? typedError.message : undefined;
-    const code = typeof typedError.code === "string" ? typedError.code : undefined;
-    const detail = entitlementDetailMessage(typedError.details);
-    const base = code && message ? `${code}: ${message}` : message ?? code;
-    return [base, detail].filter(Boolean).join("\n");
+    const lines = [parsed.message ?? parsed.code];
+    if (parsed.code) {
+        lines.push(`error=${parsed.code}`);
+    }
+    lines.push(...structuredDetailLines(parsed.details));
+    return lines.filter(Boolean).join("\n");
+}
+function parseApiError(body) {
+    const error = body.error;
+    if (typeof error === "string") {
+        return {
+            code: error,
+            message: stringValue(body.message),
+            details: body.details
+        };
+    }
+    if (!isPlainObject(error)) {
+        return {};
+    }
+    return {
+        code: stringValue(error.code),
+        message: stringValue(error.message),
+        details: error.details
+    };
 }
-function entitlementDetailMessage(details) {
+function structuredDetailLines(details) {
     if (!isPlainObject(details)) {
-        return undefined;
+        return [];
     }
-    const requiredPlan = stringValue(details.required_plan_key);
-    const violations = Array.isArray(details.violations) ? details.violations.map(formatEntitlementViolation).filter(Boolean) : [];
-    const limit = stringValue(details.limit_key);
-    const allowed = details.allowed;
-    const value = details.value;
     const lines = [];
-    if (requiredPlan) {
-        lines.push(`Required plan: ${requiredPlan}`);
-    }
-    if (violations.length > 0) {
-        lines.push("Violations:");
-        lines.push(...violations.map((violation) => `- ${violation}`));
+    for (const key of ["metric", "plan_key", "required_plan_key", "limit", "limit_key", "current", "increment", "value", "upgrade_required"]) {
+        if (details[key] !== undefined) {
+            lines.push(`${key}=${formatFieldValue(details[key])}`);
+        }
     }
-    else if (limit) {
-        lines.push(`Limit: ${limit}${value !== undefined ? ` value=${String(value)}` : ""}${allowed !== undefined ? ` allowed=${formatAllowed(allowed)}` : ""}`);
+    const violations = Array.isArray(details.violations) ? details.violations : [];
+    for (const violation of violations) {
+        if (isPlainObject(violation)) {
+            lines.push(`violation=${formatViolation(violation)}`);
+        }
     }
-    return lines.length > 0 ? lines.join("\n") : undefined;
+    return lines;
 }
-function formatEntitlementViolation(value) {
-    if (!isPlainObject(value)) {
-        return undefined;
-    }
+function formatViolation(value) {
     const path = stringValue(value.manifest_path);
     const feature = stringValue(value.feature_key);
     const limit = stringValue(value.limit_key);
@@ -1012,7 +1254,7 @@ function formatEntitlementViolation(value) {
         allowed !== undefined ? `allowed=${formatAllowed(allowed)}` : undefined,
         requiredPlan ? `requires=${requiredPlan}` : undefined
     ].filter(Boolean);
-    return parts.length > 0 ? parts.join(" ") : undefined;
+    return parts.length > 0 ? parts.join(" ") : formatFields(value);
 }
 function formatAllowed(value) {
     return Array.isArray(value) ? value.join(",") : String(value);
@@ -1021,7 +1263,7 @@ function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function docsUrlForError(message) {
-    if (message.includes("entitlement_required") || message.includes("plan_limit_exceeded")) {
+    if (message.includes("entitlement_required") || message.includes("plan_limit_exceeded") || message.includes("quota_exceeded") || message.includes("downgrade_incompatible")) {
         return "https://docs.userland.fun/reference/errors";
     }
     if (message.includes("USERLAND_API_KEY") || message.includes("credentials")) {
@@ -1041,29 +1283,52 @@ function isHelpCommand(command) {
 function usage(exitCode) {
     const message = `Usage:
   userland [--help]
-  userland signup [--username <username>] [--password <password>] [--email <email>] [--no-save]
-  userland login [--username <username>] [--password <password>] [--no-save]
+  userland signup [--no-browser] [--email <email>] [--api-base-url <url>] [--console-url <url>] [--no-save]
+  userland login [--no-browser] [--email <email>] [--api-base-url <url>] [--console-url <url>] [--no-save]
   userland auth status
-  userland auth save-key --username <username> --api-key <api-key> [--password <password>]
+  userland auth save-key --api-key <api-key> [--account <account-id>] [--api-base-url <url>] [--console-url <url>]
+  userland auth logout [--revoke]
   userland accounts list
   userland accounts use <account-id>
+  userland accounts status [--account <account-id>]
+  userland accounts limits [--account <account-id>]
+  userland accounts downgrade preview --to <plan> [--account <account-id>]
   userland apps publish <dir> [--app <app-id>] [--message <message>] [--account <account-id>]
   userland apps list [--account <account-id>]
+  userland apps status <app-id> [--account <account-id>]
   userland apps releases <app-id> [--account <account-id>]
   userland apps rollback <app-id> <release-id> [--account <account-id>]
   userland apps secrets set <app-id> <NAME> [--value <value>] [--account <account-id>]
   userland apps events <app-id> [--type <event-type>] [--severity <level>] [--release <release-id>] [--limit <n>] [--account <account-id>]
+  userland apps routes list <app-id> [--account <account-id>]
+  userland apps slugs list <app-id> [--account <account-id>]
+  userland apps slugs add <app-id> <slug> [--account <account-id>]
+  userland apps slugs remove <app-id> <slug> [--account <account-id>]
+  userland apps domains list <app-id> [--account <account-id>]
+  userland apps domains add <app-id> <hostname> [--account <account-id>]
+  userland apps domains verify <app-id> <hostname> [--account <account-id>]
+  userland apps domains remove <app-id> <hostname> [--account <account-id>]
+  userland ops accounts status <account-id>
+  userland ops accounts flag <account-id> <flag> [--reason <text>]
+  userland ops accounts clear <account-id> <flag> [--reason <text>]
+  userland ops apps status <app-id>
+  userland ops apps flag <app-id> <flag> [--reason <text>]
+  userland ops apps clear <app-id> <flag> [--reason <text>]
+  userland ops apps takedown <app-id> [--reason <text>]
+  userland ops routes disable <route-id> --status <disabled_abuse|disabled_billing|disabled_downgrade> [--reason <text>]
+  userland ops routes enable <route-id> [--reason <text>]
 
 Aliases:
-  userland auth signup [--username <username>] [--password <password>] [--email <email>] [--no-save]
-  userland auth login [--username <username>] [--password <password>] [--no-save]
+  userland auth signup [--no-browser] [--email <email>] [--no-save]
+  userland auth login [--no-browser] [--email <email>] [--no-save]
   userland publish <dir> [--app <app-id>] [--message <message>] [--account <account-id>]
   userland releases <app-id> [--account <account-id>]
+  userland versions <app-id> [--account <account-id>]
 
 Credentials:
   Commands use USERLAND_API_KEY first, then ~/.userland/credentials.json for API keys.
   App commands use --account, then USERLAND_ACCOUNT_ID, then saved account_id when set.
-  Account username and password are stored in the OS keychain.
+  Login and signup use browser device authorization and save only API-key credentials locally.
 
 Docs:
   https://docs.userland.fun/reference/cli