@amerged/ohmyhost-cli 0.1.18 → 0.1.20

package/dist/{chunk-MLABIGQ6.js → chunk-2VVAKEZO.js}

@@ -1,11 +1,14 @@
 import { createRequire as __ohmyhostCreateRequire } from "node:module"; const require = __ohmyhostCreateRequire(import.meta.url);
 import {
+  CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,
+  LEGACY_CREDENTIAL_ACCOUNT,
   NativeNapiKeyringCredentialStore,
   __commonJS,
   __require,
-  __toESM
-} from "./chunk-4HFQ54FP.js";
+  __toESM,
+  createNativeEntryFactory
+} from "./chunk-7D2RFLWM.js";
 
 // node_modules/.pnpm/ajv@8.18.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -14930,7 +14933,398 @@ async function requireIgnoredTokenFile(path) {
   }
 }
 
+// apps/product-cli/dist/profile-store.js
+import { randomUUID } from "node:crypto";
+import { link, mkdir as mkdir2, open as open2, readFile, readdir, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var ProfileNameConflictError = class extends Error {
+  profile;
+  constructor(profile) {
+    super("The profile name is used by another saved login");
+    this.profile = profile;
+    this.name = "ProfileNameConflictError";
+  }
+};
+var ProfileLimitError = class extends Error {
+  saved;
+  constructor(saved) {
+    super("The saved logins of this environment reached their limit");
+    this.saved = saved;
+    this.name = "ProfileLimitError";
+  }
+};
+var MAX_PROFILES = 64;
+var MAX_INDEX_ATTEMPTS = 64;
+var INDEX_FILE = /^index-([1-9][0-9]{0,14})\.json$/u;
+var SERVICE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+var PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,62}$/u;
+var USER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
+var ORGANIZATION_ID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+var isProfileName = (value) => PROFILE_NAME.test(value);
+var isProfileUserId = (value) => USER_ID.test(value);
+var profileAccount = (profile) => `profile:${profile.userId}:${profile.organizationId ?? "none"}`;
+var sameLogin = (left, right) => profileAccount(left) === profileAccount(right);
+var profileIndexDirectory = (serviceName) => join(homedir(), ".ohmyhost", "profiles", serviceName);
+var nextProfileIndex = (current, profile, replaces) => [
+  ...current.filter((saved) => !sameLogin(saved, profile) && (replaces === void 0 || !sameLogin(saved, replaces))),
+  profile
+];
+var admitProfile = (next, profile) => {
+  const conflict = next.find((saved) => saved.name === profile.name && saved !== profile);
+  if (conflict !== void 0)
+    throw new ProfileNameConflictError(conflict);
+  if (next.length > MAX_PROFILES)
+    throw new ProfileLimitError(next.length - 1);
+};
+var NativeKeyringProfileRegistry = class {
+  serviceName;
+  #createEntry;
+  #index;
+  constructor(createEntry = void 0, serviceName = "ohmyhost", indexDirectory) {
+    this.serviceName = serviceName;
+    if (!SERVICE_NAME.test(serviceName))
+      throw new CredentialStoreUnavailableError();
+    this.#createEntry = createEntry ?? createNativeEntryFactory(serviceName);
+    this.#index = new ProfileIndexFiles(indexDirectory ?? profileIndexDirectory(serviceName));
+  }
+  async list() {
+    return (await this.#index.read()).profiles;
+  }
+  credential(profile) {
+    return new NativeNapiKeyringCredentialStore(this.#createEntry, this.serviceName, profileAccount(profile));
+  }
+  legacy() {
+    return new NativeNapiKeyringCredentialStore(this.#createEntry, this.serviceName, LEGACY_CREDENTIAL_ACCOUNT);
+  }
+  async save(profile, credential, replaces) {
+    assertProfile(profile);
+    const before = await this.list();
+    admitProfile(nextProfileIndex(before, profile, replaces), profile);
+    await this.credential(profile).replace(credential);
+    try {
+      await this.#index.update((current) => {
+        const next = nextProfileIndex(current, profile, replaces);
+        admitProfile(next, profile);
+        return next;
+      });
+    } catch (error) {
+      if (!before.some((saved) => sameLogin(saved, profile)))
+        await this.credential(profile).clear();
+      throw error;
+    }
+    if (replaces !== void 0 && !sameLogin(replaces, profile))
+      await this.credential(replaces).clear();
+  }
+  async remove(profile) {
+    await this.credential(profile).clear();
+    await this.#index.update((current) => current.some((saved) => sameLogin(saved, profile)) ? current.filter((saved) => !sameLogin(saved, profile)) : void 0);
+  }
+};
+var ProfileIndexFiles = class {
+  directory;
+  constructor(directory) {
+    this.directory = directory;
+  }
+  async read() {
+    for (let attempt = 0; attempt < MAX_INDEX_ATTEMPTS; attempt += 1) {
+      const version2 = await this.#newest();
+      if (version2 === 0)
+        return { version: version2, profiles: [] };
+      let serialized;
+      try {
+        serialized = await readFile(this.#file(version2), "utf8");
+      } catch (error) {
+        if (fileErrorCode(error) === "ENOENT")
+          continue;
+        throw new CredentialStoreUnavailableError();
+      }
+      return { version: version2, profiles: parseProfileIndex(serialized) };
+    }
+    throw new CredentialStoreUnavailableError();
+  }
+  /** Applies `change` to the newest index; `undefined` means nothing to change. */
+  async update(change) {
+    try {
+      await mkdir2(this.directory, { recursive: true, mode: 448 });
+    } catch {
+      throw new CredentialStoreUnavailableError();
+    }
+    for (let attempt = 0; attempt < MAX_INDEX_ATTEMPTS; attempt += 1) {
+      const { version: version2, profiles } = await this.read();
+      const next = change(profiles);
+      if (next === void 0)
+        return;
+      const temporary = join(this.directory, `.index-${randomUUID()}.tmp`);
+      try {
+        await writeDurably(temporary, serializeProfileIndex(next));
+        await link(temporary, this.#file(version2 + 1));
+      } catch (error) {
+        if (fileErrorCode(error) === "EEXIST")
+          continue;
+        throw new CredentialStoreUnavailableError();
+      } finally {
+        await removeTemporary(temporary);
+      }
+      if (await this.#newest() !== version2 + 1)
+        continue;
+      await this.#prune(version2);
+      return;
+    }
+    throw new CredentialStoreUnavailableError();
+  }
+  async #newest() {
+    let names;
+    try {
+      names = await readdir(this.directory);
+    } catch (error) {
+      if (fileErrorCode(error) === "ENOENT")
+        return 0;
+      throw new CredentialStoreUnavailableError();
+    }
+    return names.reduce((newest, name) => Math.max(newest, indexVersion(name)), 0);
+  }
+  /**
+   * Keeps the superseded version for readers that listed it just now; older ones go. Cleanup only:
+   * a file left behind is ignored, since readers take the newest version, and another process may
+   * be removing the same files at this moment.
+   */
+  async #prune(superseded) {
+    let names;
+    try {
+      names = await readdir(this.directory);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const version2 = indexVersion(name);
+      if (version2 === 0 || version2 >= superseded)
+        continue;
+      try {
+        await unlink(join(this.directory, name));
+      } catch {
+      }
+    }
+  }
+  #file(version2) {
+    return join(this.directory, `index-${String(version2)}.json`);
+  }
+};
+var indexVersion = (name) => Number(INDEX_FILE.exec(name)?.[1] ?? 0);
+var removeTemporary = async (path) => {
+  try {
+    await unlink(path);
+  } catch {
+  }
+};
+var fileErrorCode = (error) => typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
+var writeDurably = async (path, text) => {
+  const handle = await open2(path, "wx", 384);
+  try {
+    await handle.writeFile(text, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+};
+var serializeProfileIndex = (profiles) => JSON.stringify({
+  version: 1,
+  profiles: [...profiles].sort((left, right) => left.name < right.name ? -1 : 1).map((profile) => ({
+    name: profile.name,
+    user_id: profile.userId,
+    organization_id: profile.organizationId,
+    organization_name: profile.organizationName
+  }))
+});
+var parseProfileIndex = (serialized) => {
+  try {
+    const value = JSON.parse(serialized);
+    if (!isRecord(value, ["version", "profiles"]) || value["version"] !== 1)
+      throw new Error("Invalid profile index");
+    const entries = value["profiles"];
+    if (!Array.isArray(entries) || entries.length > MAX_PROFILES)
+      throw new Error("Invalid profile index");
+    const profiles = entries.map((entry) => {
+      if (!isRecord(entry, ["name", "user_id", "organization_id", "organization_name"]))
+        throw new Error("Invalid profile");
+      const profile = {
+        name: entry["name"],
+        userId: entry["user_id"],
+        organizationId: entry["organization_id"],
+        organizationName: entry["organization_name"]
+      };
+      assertProfile(profile);
+      return profile;
+    });
+    if (new Set(profiles.map((profile) => profile.name)).size !== profiles.length || new Set(profiles.map(profileAccount)).size !== profiles.length)
+      throw new Error("Duplicate profile");
+    return profiles;
+  } catch {
+    throw new CredentialStoreIntegrityError();
+  }
+};
+var assertProfile = (profile) => {
+  if (typeof profile.name !== "string" || !PROFILE_NAME.test(profile.name) || typeof profile.userId !== "string" || !USER_ID.test(profile.userId) || !(profile.organizationId === null || typeof profile.organizationId === "string" && ORGANIZATION_ID.test(profile.organizationId)) || !(profile.organizationName === null || typeof profile.organizationName === "string" && profile.organizationName.length > 0 && profile.organizationName.length <= 128 && !new RegExp("\\p{Cc}", "u").test(profile.organizationName)) || profile.organizationId === null && profile.organizationName !== null)
+    throw new CredentialStoreIntegrityError();
+};
+var isRecord = (value, keys) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).sort().join(",") === [...keys].sort().join(",");
+var selectProfile = (profiles, request) => {
+  if (request.name !== void 0 && request.bound !== void 0 && request.name !== request.bound)
+    return { outcome: "conflict", field: "binding", profile: null };
+  const named = request.name ?? request.bound;
+  if (named !== void 0) {
+    const profile = profiles.find((saved) => saved.name === named);
+    if (profile === void 0)
+      return { outcome: "not_found" };
+    if (request.organizationId !== void 0 && profile.organizationId !== request.organizationId)
+      return { outcome: "conflict", field: "organization", profile };
+    if (request.userId !== void 0 && profile.userId !== request.userId)
+      return { outcome: "conflict", field: "user", profile };
+    return { outcome: "selected", profile };
+  }
+  const candidates = profiles.filter((profile) => (request.organizationId === void 0 || profile.organizationId === request.organizationId) && (request.userId === void 0 || profile.userId === request.userId));
+  const only = candidates[0];
+  if (candidates.length === 1 && only !== void 0)
+    return { outcome: "selected", profile: only };
+  if (candidates.length > 1)
+    return { outcome: "ambiguous", candidates };
+  return profiles.length === 0 ? { outcome: "none" } : { outcome: "not_found" };
+};
+var selectProfileForOrganization = (profiles, request) => {
+  const user = request.userId === void 0 ? {} : { userId: request.userId };
+  if (request.name !== void 0 || request.bound !== void 0)
+    return selectProfile(profiles, {
+      ...request.name === void 0 ? {} : { name: request.name },
+      ...request.bound === void 0 ? {} : { bound: request.bound },
+      ...user
+    });
+  const candidates = profiles.filter((profile) => request.userId === void 0 || profile.userId === request.userId);
+  const inOrganization = candidates.filter((profile) => profile.organizationId === request.organizationId);
+  if (inOrganization.length > 1)
+    return { outcome: "ambiguous", candidates: inOrganization };
+  const unscoped = candidates.filter((profile) => profile.organizationId === null);
+  const [member] = inOrganization;
+  if (member !== void 0)
+    return { outcome: "selected", profile: member };
+  const [open5] = unscoped;
+  if (unscoped.length === 1 && open5 !== void 0)
+    return { outcome: "selected", profile: open5 };
+  return selectProfile(profiles, user);
+};
+var defaultProfileName = (profiles, login) => {
+  const same = profiles.find((profile) => profile.userId === login.userId && profile.organizationId === login.organizationId);
+  if (same !== void 0)
+    return same.name;
+  const base = slug(login.organizationName ?? "") || (login.organizationId === null ? "account" : "workspace");
+  const free = (name) => profiles.every((profile) => profile.name !== name);
+  if (free(base))
+    return base;
+  const suffix = (login.organizationId ?? login.userId).replace(/[^A-Za-z0-9]/gu, "").slice(-6).toLowerCase();
+  for (let attempt = 1; attempt <= profiles.length + 1; attempt += 1) {
+    const candidate = `${base.slice(0, 48)}-${suffix}${attempt === 1 ? "" : `-${String(attempt)}`}`;
+    if (free(candidate))
+      return candidate;
+  }
+  throw new CredentialStoreIntegrityError();
+};
+var slug = (value) => value.normalize("NFKD").replace(/[\u0300-\u036f]/gu, "").toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+/u, "").slice(0, 40).replace(/-+$/u, "");
+var publicProfile = (profile) => ({
+  name: profile.name,
+  user_id: profile.userId,
+  organization_id: profile.organizationId,
+  organization_name: profile.organizationName
+});
+var profileLimitAction = (commandPrefix) => `Nothing was saved: this environment already keeps ${String(MAX_PROFILES)} saved logins, the most one computer holds. Remove one you no longer need with '${commandPrefix} logout --profile-name NAME --json' ('${commandPrefix} profile list --json' shows them), then retry.`;
+var ProfileSelectionError = class extends Error {
+  code;
+  exitCode;
+  suggestedAction;
+  constructor(code, exitCode, suggestedAction) {
+    super(`${code}: ${suggestedAction}`);
+    this.code = code;
+    this.exitCode = exitCode;
+    this.suggestedAction = suggestedAction;
+    this.name = "ProfileSelectionError";
+  }
+};
+var profileSelectionError = (selection, request, commandPrefix, selector) => {
+  const choose = selector === "cli" ? `pass --profile-name NAME (see '${commandPrefix} profile list --json') or set OHMYHOST_PROFILE for this process` : "pass profile_name (see profile_list) or set OHMYHOST_PROFILE in this MCP server's configuration";
+  const login = `${commandPrefix} login${request.organizationId === void 0 ? "" : ` --organization ${request.organizationId}`}${request.userId === void 0 ? "" : ` --user ${request.userId}`}${(request.name ?? request.bound) === void 0 ? "" : ` --profile-name ${String(request.name ?? request.bound)}`} --json`;
+  if (selection.outcome === "none")
+    return new ProfileSelectionError("authentication_required", 5, `No login is saved on this computer. Run '${login}'.`);
+  if (selection.outcome === "not_found")
+    return new ProfileSelectionError("profile_not_found", 5, `No saved login matches ${describeRequest(request)}. Run '${login}' to add it, signing in as that user; '${commandPrefix} profile list --json' shows the saved logins.`);
+  if (selection.outcome === "ambiguous")
+    return new ProfileSelectionError("profile_selection_required", 2, `Several saved logins could run this: ${selection.candidates.map((profile2) => profile2.name).join(", ")}. Ask the customer which account to use, then ${choose}.`);
+  if (selection.field === "binding")
+    return new ProfileSelectionError("profile_context_mismatch", 2, `This call names profile ${String(request.name)}, but the process is bound to OHMYHOST_PROFILE=${String(request.bound)}. Use the bound profile or start a process for the other one.`);
+  const profile = selection.profile;
+  return new ProfileSelectionError("profile_context_mismatch", 2, selection.field === "organization" ? `Profile ${String(profile?.name)} is signed in to organization ${String(profile?.organizationId ?? "none")}, but this targets organization ${String(request.organizationId)}. Use the profile of that organization or change the target; nothing was sent.` : `Profile ${String(profile?.name)} belongs to user ${String(profile?.userId)}, not ${String(request.userId)}. Use that user's profile; nothing was sent.`);
+};
+var describeRequest = (request) => {
+  const parts = [
+    ...(request.name ?? request.bound) === void 0 ? [] : [`profile ${String(request.name ?? request.bound)}`],
+    ...request.organizationId === void 0 ? [] : [`organization ${request.organizationId}`],
+    ...request.userId === void 0 ? [] : [`user ${request.userId}`]
+  ];
+  return parts.length === 0 ? "this request" : parts.join(", ");
+};
+var describeProfile = (profile) => `profile ${profile.name} (user ${profile.userId}, ${profile.organizationId === null ? "no organization" : `organization ${profile.organizationName === null ? "" : `${profile.organizationName} `}${profile.organizationId}`})`;
+
+// packages/workos-auth-contracts/dist/parsing.js
+var WorkosContractError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "WorkosContractError";
+  }
+};
+var expectRecord = (value, code = "invalid_object") => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new WorkosContractError(code, "WorkOS response must be an object");
+  }
+  return value;
+};
+function expectString(value, field, options = {}) {
+  if (value === void 0 && options.optional === true)
+    return void 0;
+  if (typeof value !== "string" || value.length === 0) {
+    throw new WorkosContractError("invalid_field", `WorkOS field ${field} must be a non-empty string`);
+  }
+  return value;
+}
+function expectPositiveInteger(value, field, options = {}) {
+  if (value === void 0 && options.optional === true)
+    return void 0;
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new WorkosContractError("invalid_field", `WorkOS field ${field} must be positive`);
+  }
+  return value;
+}
+var parseJsonObject = (body) => {
+  try {
+    return expectRecord(JSON.parse(body));
+  } catch (error) {
+    if (error instanceof WorkosContractError)
+      throw error;
+    throw new WorkosContractError("invalid_json", "WorkOS returned invalid JSON");
+  }
+};
+
+// packages/workos-auth-contracts/dist/user-api-keys.js
+var WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
+
 // apps/product-cli/dist/command.js
+var extractProfileName = (argv) => {
+  const index = argv.indexOf("--profile-name");
+  if (index < 0)
+    return { argv };
+  const value = argv[index + 1];
+  if (value === void 0 || !isProfileName(value) || argv.indexOf("--profile-name", index + 1) >= 0)
+    throw new InvalidCommandError();
+  return { argv: [...argv.slice(0, index), ...argv.slice(index + 2)], profileName: value };
+};
 var InvalidCommandError = class extends Error {
   constructor() {
     super("The command arguments are invalid.");
@@ -14945,11 +15339,17 @@ var recognizedCommandLabel = (argv) => {
     return "version";
   while (values.length > 0) {
     const value = values.shift();
+    if (value === "--profile-name") {
+      values.shift();
+      continue;
+    }
     if (value === "--json" || value === "--dry-run" || value === "--revoke" || value === "--yes" || value === "--wait" || value === "--follow" || value === "--stdin") {
       continue;
     }
     if (value === "help" || value === "version" || value === "whoami" || value === "init" || value === "login" || value === "logout")
       return value;
+    if (value === "profile" && values[0] === "list")
+      return "profile list";
     if (value === "github" && values[0] === "connect")
       return "github connect";
     if (value === "github" && values[0] === "status")
@@ -15159,16 +15559,20 @@ var parseProductCliCommand = (argv) => {
   if (dryRun)
     throw new InvalidCommandError();
   if (first === "login" && !revoke && !yes && !wait && !follow && !stdin) {
-    const options = parseOptionalOptions(values, ["--organization"]);
+    const options = parseOptionalOptions(values, ["--organization", "--user"]);
     const organizationId = options["--organization"];
-    if (organizationId !== void 0 && !ORGANIZATION_ULID.test(organizationId))
+    const userId = options["--user"];
+    if (organizationId !== void 0 && !ORGANIZATION_ULID.test(organizationId) || userId !== void 0 && !isProfileUserId(userId))
       throw new InvalidCommandError();
     return {
       kind: "login",
       ...organizationId === void 0 ? {} : { organizationId },
+      ...userId === void 0 ? {} : { userId },
       credentialStore
     };
   }
+  if (first === "profile" && values.length === 1 && values[0] === "list" && !revoke && !yes && !wait && !follow && !stdin)
+    return { kind: "profile-list" };
   if (first === "logout") {
     if (!yes && !wait && !follow && !stdin && values.length === 0)
       return { kind: "logout", revoke, credentialStore };
@@ -16092,15 +16496,32 @@ var parseProductCliCommand = (argv) => {
     const name = values.shift();
     if (!isUserSecretName(name))
       throw new InvalidCommandError();
-    const options = parseOptions(values, ["--project", "--environment", "--idempotency-key"]);
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--idempotency-key",
+      "--token-user",
+      "--token-organization",
+      "--profile-user",
+      "--profile-organization"
+    ]);
+    const projectId = options["--project"];
+    const environmentId = options["--environment"];
+    const idempotencyKey = options["--idempotency-key"];
+    const environmentToken2 = handedAccount(options["--token-user"], options["--token-organization"]);
+    const profileAccount2 = handedAccount(options["--profile-user"], options["--profile-organization"]);
+    if (projectId === void 0 || environmentId === void 0 || idempotencyKey === void 0 || environmentToken2 !== void 0 && profileAccount2 !== void 0)
+      throw new InvalidCommandError();
     return {
       kind: "secret-set",
-      projectId: options["--project"],
-      environmentId: options["--environment"],
+      projectId,
+      environmentId,
       name,
-      idempotencyKey: options["--idempotency-key"],
+      idempotencyKey,
       stdin,
       wait,
+      ...environmentToken2 === void 0 ? {} : { environmentToken: environmentToken2 },
+      ...profileAccount2 === void 0 ? {} : { profileAccount: profileAccount2 },
       credentialStore
     };
   }
@@ -16349,6 +16770,13 @@ var accessTtlSeconds = (value) => {
   return seconds;
 };
 var ORGANIZATION_ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+var handedAccount = (userId, organizationId) => {
+  if (userId === void 0 && organizationId === void 0)
+    return void 0;
+  if (userId === void 0 || organizationId === void 0 || !isProfileUserId(userId) || WORKOS_USER_API_KEY_PATTERN.test(userId) || !ORGANIZATION_ULID.test(organizationId))
+    throw new InvalidCommandError();
+  return { userId, organizationId };
+};
 var isValue = (value) => value !== void 0 && value.length > 0 && !value.startsWith("--");
 var validGithubBranchName = (value) => !(value.length < 1 || value.length > 1024 || !/^[A-Za-z0-9]/u.test(value) || value.startsWith("-") || value.startsWith("/") || value.endsWith("/") || value.endsWith(".") || value.includes("//") || value.includes("..") || value.includes("@{") || [...value].some((character) => {
   const code = character.codePointAt(0) ?? 0;
@@ -16357,46 +16785,6 @@ var validGithubBranchName = (value) => !(value.length < 1 || value.length > 1024
 var validPaidHostname = (value) => /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(value) && !value.endsWith(".poc.aixyte.com") && value !== "omh.st" && !value.endsWith(".omh.st") && value !== "ohmyho.st" && !value.endsWith(".ohmyho.st");
 var isUserSecretName = (value) => isValue(value) && /^[A-Z][A-Z0-9_]{0,127}$/u.test(value) && value !== "DATABASE_URL" && value !== "HYPERDRIVE" && value !== "BETTER_AUTH_SECRET" && value !== "BETTER_AUTH_URL" && value !== "OHMYHOST_MAIL_KEY" && value !== "OHMYHOST_MAIL_GATEWAY_URL";
 
-// apps/product-cli/dist/workspace.js
-var InteractiveSessionRequiredError = class extends Error {
-  constructor() {
-    super("Workspace selection requires an interactive login");
-    this.name = "InteractiveSessionRequiredError";
-  }
-};
-var chooseWorkspace = (organizations, requested) => {
-  if (requested !== void 0) {
-    const match = organizations.find((organization) => organization.id === requested);
-    return match === void 0 ? { outcome: "not_a_member", organizations } : { outcome: "selected", organization: match };
-  }
-  if (organizations.length === 0)
-    return { outcome: "no_workspace" };
-  const only = organizations[0];
-  if (organizations.length === 1 && only !== void 0)
-    return { outcome: "selected", organization: only };
-  return { outcome: "choice_required", organizations };
-};
-var selectWorkspace = async (session, organization, signal) => {
-  const stored = await session.store.read();
-  if (stored === void 0)
-    throw new InteractiveSessionRequiredError();
-  const refreshed = await session.refresher.refresh(stored.refreshToken, signal, organization.workos_id);
-  await session.store.replace({
-    ...refreshed,
-    workosOrganizationId: organization.workos_id,
-    organizationId: organization.id
-  });
-};
-var selectedWorkspaceId = async (session) => (await session.store.read())?.organizationId ?? null;
-var workspaceOf = (credential) => ({
-  ...credential.workosOrganizationId === void 0 ? {} : { workosOrganizationId: credential.workosOrganizationId },
-  ...credential.organizationId === void 0 ? {} : { organizationId: credential.organizationId }
-});
-var publicWorkspace = (organization) => ({
-  id: organization.id,
-  name: organization.name
-});
-
 // packages/contracts/dist/feedback.js
 var FEEDBACK_HISTORY_PAGE_SIZE = 25;
 var FEEDBACK_REPLY_MAX_LENGTH = 2e3;
@@ -16923,7 +17311,7 @@ var PROBLEM_POLICY = {
   github_connection_required: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for this workspace, complete its browser link, then repeat the original source link."
+    action: "This workspace has no GitHub connection yet. Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for it, complete its browser link, then repeat the original source link. If the project belongs to another account, use that account's login instead; error.acting_as names the login this ran as."
   },
   github_connection_revoked: {
     status: 409,
@@ -16997,7 +17385,11 @@ var PROBLEM_POLICY = {
     retryable: false,
     action: "Run 'ohmyhost organization list --json' and select one with 'ohmyhost organization use --organization ULID --json', or create the first workspace."
   },
-  resource_not_found: { status: 404, retryable: false, action: "Check the resource identifier." },
+  resource_not_found: {
+    status: 404,
+    retryable: false,
+    action: "Check the resource identifier and the account: a project is visible only to its own organization, and error.acting_as names the login this ran as. Use the login of the account that owns it."
+  },
   idempotency_key_reused: {
     status: 409,
     retryable: false,
@@ -17488,7 +17880,7 @@ var parseAccountProfile = (value) => {
   });
   if (new Set(workspaces.map((workspace) => workspace.id)).size !== organizationIds.length)
     throw new ResponseContractError();
-  return workspaces;
+  return { userId: input["user_id"], organizations: workspaces };
 };
 var parseProject = (value) => {
   const input = exactRecord2(value, [
@@ -17842,7 +18234,7 @@ var parseOperation = (value) => {
   const blockingOperationId = input["blocking_operation_id"];
   if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3))
     throw new ResponseContractError();
-  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord(result)) {
+  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord2(result)) {
     throw new ResponseContractError();
   }
   let progress;
@@ -17903,12 +18295,12 @@ function parseOperationFailure(value) {
   return safe;
 }
 var exactRecord2 = (value, allowed) => {
-  if (!isRecord(value) || Object.keys(value).some((key) => !allowed.includes(key))) {
+  if (!isRecord2(value) || Object.keys(value).some((key) => !allowed.includes(key))) {
     throw new ResponseContractError();
   }
   return value;
 };
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var boundedString = (value, minimum, maximum) => typeof value === "string" && value.length >= minimum && value.length <= maximum;
 var isUlid = (value) => typeof value === "string" && /^[0-9A-HJKMNP-TV-Z]{26}$/u.test(value);
 var isIsoInstant = (value) => typeof value === "string" && value.length <= 64 && Number.isFinite(Date.parse(value));
@@ -17936,8 +18328,81 @@ var isPaidValidationRecord = (value) => {
 };
 var isHttpsUrlValue = (value) => typeof value === "string" && isHttpsUrl(value);
 
+// apps/product-cli/dist/workspace.js
+var InteractiveSessionRequiredError = class extends Error {
+  constructor() {
+    super("Workspace selection requires an interactive login");
+    this.name = "InteractiveSessionRequiredError";
+  }
+};
+var ProfileOrganizationFixedError = class extends Error {
+  profile;
+  organization;
+  constructor(profile, organization) {
+    super("The saved login is bound to another organization");
+    this.profile = profile;
+    this.organization = organization;
+    this.name = "ProfileOrganizationFixedError";
+  }
+};
+var AccountVerificationError = class extends Error {
+  constructor() {
+    super("The signed-in account does not match the requested one");
+    this.name = "AccountVerificationError";
+  }
+};
+var chooseWorkspace = (organizations, requested) => {
+  if (requested !== void 0) {
+    const match = organizations.find((organization) => organization.id === requested);
+    return match === void 0 ? { outcome: "not_a_member", organizations } : { outcome: "selected", organization: match };
+  }
+  if (organizations.length === 0)
+    return { outcome: "no_workspace" };
+  const only = organizations[0];
+  if (organizations.length === 1 && only !== void 0)
+    return { outcome: "selected", organization: only };
+  return { outcome: "choice_required", organizations };
+};
+var verifiedUserId = (identity) => {
+  const actor = parseCurrentIdentity(identity).actor_id;
+  if (!actor.startsWith("user:") || actor.length === 5)
+    throw new AccountVerificationError();
+  return actor.slice(5);
+};
+var assertVerifiedLogin = (identity, userId, organizationId) => {
+  const organizations = parseCurrentIdentity(identity).organization_ids;
+  if (verifiedUserId(identity) !== userId || (organizationId === null ? organizations.length !== 0 : organizations.length !== 1 || organizations[0] !== organizationId))
+    throw new AccountVerificationError();
+};
+var selectWorkspace = async (session, organization, signal, identity) => {
+  if (session.profile.organizationId === organization.id)
+    return session.profile;
+  if (session.profile.organizationId !== null)
+    throw new ProfileOrganizationFixedError(session.profile, organization);
+  const stored = await session.store.read();
+  if (stored === void 0)
+    throw new InteractiveSessionRequiredError();
+  const refreshed = await session.refresher.refresh(stored.refreshToken, signal, organization.workos_id);
+  assertVerifiedLogin(await identity(refreshed.accessToken), session.profile.userId, organization.id);
+  const bound = {
+    ...session.profile,
+    organizationId: organization.id,
+    organizationName: organization.name
+  };
+  await session.profiles.save(bound, { ...refreshed, workosOrganizationId: organization.workos_id, organizationId: organization.id }, session.profile);
+  return bound;
+};
+var workspaceOf = (credential) => ({
+  ...credential.workosOrganizationId === void 0 ? {} : { workosOrganizationId: credential.workosOrganizationId },
+  ...credential.organizationId === void 0 ? {} : { organizationId: credential.organizationId }
+});
+var publicWorkspace = (organization) => ({
+  id: organization.id,
+  name: organization.name
+});
+
 // apps/product-cli/dist/cli.js
-import { open as open2 } from "node:fs/promises";
+import { open as open3 } from "node:fs/promises";
 
 // packages/contracts/dist/database-access.js
 function parseProjectDatabaseWrite(value) {
@@ -18089,7 +18554,7 @@ function exact2(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.18",
+  version: "0.1.20",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -18259,47 +18724,6 @@ function assertRecharge(value) {
   assertBillingTaxIssue(v["billing_issue"]);
 }
 
-// packages/workos-auth-contracts/dist/parsing.js
-var WorkosContractError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "WorkosContractError";
-  }
-};
-var expectRecord = (value, code = "invalid_object") => {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new WorkosContractError(code, "WorkOS response must be an object");
-  }
-  return value;
-};
-function expectString(value, field, options = {}) {
-  if (value === void 0 && options.optional === true)
-    return void 0;
-  if (typeof value !== "string" || value.length === 0) {
-    throw new WorkosContractError("invalid_field", `WorkOS field ${field} must be a non-empty string`);
-  }
-  return value;
-}
-function expectPositiveInteger(value, field, options = {}) {
-  if (value === void 0 && options.optional === true)
-    return void 0;
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new WorkosContractError("invalid_field", `WorkOS field ${field} must be positive`);
-  }
-  return value;
-}
-var parseJsonObject = (body) => {
-  try {
-    return expectRecord(JSON.parse(body));
-  } catch (error) {
-    if (error instanceof WorkosContractError)
-      throw error;
-    throw new WorkosContractError("invalid_json", "WorkOS returned invalid JSON");
-  }
-};
-
 // apps/product-cli/dist/device-token-expiry.js
 var DeviceTokenExpiryError = class extends Error {
   constructor() {
@@ -18420,9 +18844,10 @@ var PsqlUnavailableError = class extends Error {
 var CLI_VERSION = package_default.version;
 var HELP_USAGE = Object.freeze({
   init: "ohmyhost init [--directory PATH] [--root PATH] [--project SLUG] [--region us|eu] [--dry-run] --json (pass the project's hosting region so storage.jurisdiction matches it; us when omitted)",
-  login: "ohmyhost login [--organization ULID] --json",
-  logout: "ohmyhost logout [--revoke] --json",
-  whoami: "ohmyhost whoami --json",
+  login: "ohmyhost login [--organization ULID] [--user USER_ID] [--profile-name NAME] --json (adds one saved login; nothing is saved unless the browser signed in as that user and organization)",
+  logout: "ohmyhost logout [--profile-name NAME] [--revoke] --json (removes only the selected saved login)",
+  whoami: "ohmyhost whoami [--profile-name NAME] --json (the effective user, organization and saved login)",
+  "profile list": "ohmyhost profile list --json (saved logins on this computer: name, user and organization, never a token; pass --profile-name NAME or set OHMYHOST_PROFILE to choose one)",
   "github connect": "ohmyhost github connect --organization ULID --idempotency-key KEY --json (connect once, then link covered repositories without another browser consent)",
   "github status": "ohmyhost github status --organization ULID --json",
   "export create": "ohmyhost export create --project ULID --idempotency-key KEY --stdin --json (password on stdin only; one accepted SQL ZIP per project per 24 hours)",
@@ -18437,9 +18862,9 @@ var HELP_USAGE = Object.freeze({
   "credits usage": "ohmyhost credits usage --organization ULID --month YYYY-MM [--cursor ULID] --json",
   "budget get": "ohmyhost budget get --project ULID --json",
   "budget set": "ohmyhost budget set --project ULID --credits NUMBER|none [--mode continue|stop] --idempotency-key KEY --json",
-  "organization create": "ohmyhost organization create --name NAME --idempotency-key KEY [--source SOURCE] --json (SOURCE is optional attribution from a link's r value; the new workspace is selected immediately)",
-  "organization list": "ohmyhost organization list --json (the workspaces you belong to and the selected one)",
-  "organization use": "ohmyhost organization use --organization ULID --json",
+  "organization create": "ohmyhost organization create --name NAME --idempotency-key KEY [--source SOURCE] --json (SOURCE is optional attribution from a link's r value; a login without organization is bound to the new workspace, another login keeps its own)",
+  "organization list": "ohmyhost organization list [--profile-name NAME] --json (the workspaces of the chosen login's user and the one that login is scoped to)",
+  "organization use": "ohmyhost organization use --organization ULID [--profile-name NAME] --json (binds a login that has no organization yet; another organization needs its own login)",
   "operation get": "ohmyhost operation get OPERATION_ULID --json",
   "operation reconcile": "ohmyhost operation reconcile OPERATION_ULID --idempotency-key KEY --yes --json",
   "token create": "ohmyhost token create --organization ULID --name NAME --idempotency-key KEY --out .env.local --json",
@@ -18489,7 +18914,7 @@ var HELP_USAGE = Object.freeze({
   delete: "ohmyhost delete --project ULID --if-match ETAG --confirmation-token TOKEN --idempotency-key KEY --yes --json",
   "secret list": "ohmyhost secret list --project ULID --environment ENVIRONMENT_ULID --json",
   "function runs": "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
-  "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY --stdin [--wait] --json`,
+  "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)`,
   "secret delete": "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
   "mail setup": "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
   "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
@@ -18507,8 +18932,8 @@ var HELP_COMMANDS = Object.freeze(Object.entries(HELP_USAGE).map(([command, usag
 var cliMetadataResult = (kind, topic) => kind === "help" ? success("help", {
   status: "succeeded",
   cli_version: CLI_VERSION,
-  usage: "ohmyhost <command> [options] --json",
-  environment: "OHMYHOST_ENVIRONMENT=development|production (default: production)",
+  usage: "ohmyhost <command> [options] [--profile-name NAME] --json",
+  environment: "OHMYHOST_ENVIRONMENT=development|production (default: production); OHMYHOST_PROFILE=NAME binds this process to one saved login",
   commands: HELP_COMMANDS.filter((entry) => !topic || entry.command === topic)
 }) : success("version", { status: "succeeded", cli_version: CLI_VERSION });
 var ProductCliFailure = class extends Error {
@@ -18529,8 +18954,11 @@ var ProductCliFailure = class extends Error {
 };
 var ProductCli = class {
   dependencies;
+  /** The saved login of this run; binding a login without organization replaces it. */
+  #profile;
   constructor(dependencies) {
     this.dependencies = dependencies;
+    this.#profile = dependencies.profile;
   }
   async run(argv, signal = new AbortController().signal) {
     let command;
@@ -18560,8 +18988,10 @@ var ProductCli = class {
       if (this.dependencies.apiToken !== void 0 && (command.kind === "organization-create" || command.kind === "organization-list" || command.kind === "organization-use")) {
         throw new InteractiveSessionRequiredError();
       }
+      if (command.kind === "profile-list")
+        return await this.listProfiles();
       if (command.kind === "login")
-        return await this.login(command.credentialStore, command.organizationId, signal);
+        return await this.login(command.organizationId, command.userId, signal);
       if (command.kind === "logout") {
         return await this.logout(command.credentialStore, command.revoke, signal);
       }
@@ -18672,35 +19102,48 @@ var ProductCli = class {
           ...command.signupSource === void 0 ? {} : { signupSource: command.signupSource },
           idempotencyKey: command.idempotencyKey
         }));
-        const selection = await this.chooseAndStoreWorkspace(await api.getAccountProfile(), organization.id, command.credentialStore, signal);
+        const selection = chooseWorkspace((await api.getAccountProfile()).organizations, organization.id);
         if (selection.outcome !== "selected")
           throw new ProductCliFailure(2, "organization_not_found", true, `The new workspace is not yet readable for this account. Run '${this.dependencies.commandPrefix} organization use --organization ${organization.id} --json' again.`);
+        const current = this.#profile;
+        if (current !== void 0 && current.organizationId !== null && current.organizationId !== organization.id)
+          return success("organization create", {
+            status: "succeeded",
+            organization,
+            selected: current.organizationId,
+            profile: publicProfile(current),
+            next_action: `Run '${this.dependencies.commandPrefix} login --organization ${organization.id} --user ${current.userId} --json' to add a login for the new workspace as the same user; profile ${current.name} stays in organization ${current.organizationId}.`
+          });
+        const profile = await this.bindOrganization(selection.organization, signal);
         return success("organization create", {
           status: "succeeded",
           organization,
           selected: organization.id,
+          profile: publicProfile(profile),
           next_action: `Run '${this.dependencies.commandPrefix} whoami --json' to confirm the selected workspace, then create a project.`,
           ...await this.githubNextAction(await this.authenticatedApi(command.credentialStore, signal), organization.id)
         });
       }
       if (command.kind === "organization-list") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
-        const organizations = await api.getAccountProfile();
+        const account = await api.getAccountProfile();
         return success("organization list", {
           status: "listed",
-          organizations: organizations.map(publicWorkspace),
-          selected: await selectedWorkspaceId(this.workspaceSession(command.credentialStore))
+          organizations: account.organizations.map(publicWorkspace),
+          selected: this.#profile?.organizationId ?? null
         });
       }
       if (command.kind === "organization-use") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
-        const selection = await this.chooseAndStoreWorkspace(await api.getAccountProfile(), command.organizationId, command.credentialStore, signal);
+        const selection = chooseWorkspace((await api.getAccountProfile()).organizations, command.organizationId);
         if (selection.outcome !== "selected")
           throw this.unknownWorkspace(selection);
+        const profile = await this.bindOrganization(selection.organization, signal);
         return success("organization use", {
           status: "selected",
           organization: publicWorkspace(selection.organization),
           selected: selection.organization.id,
+          profile: publicProfile(profile),
           ...await this.githubNextAction(await this.authenticatedApi(command.credentialStore, signal), selection.organization.id)
         });
       }
@@ -18788,7 +19231,7 @@ var ProductCli = class {
         return success(command.kind === "project-dev-share-link" ? "project dev-share link" : command.kind === "project-dev-share-rotate" ? "project dev-share rotate" : command.kind === "project-dev-share-revoke" ? "project dev-share revoke" : "project dev-access mode", { status: "succeeded", state });
       }
       if (command.kind === "database-write") {
-        const file = await open2(command.statementFile, "r"), buffer = Buffer.alloc(65537);
+        const file = await open3(command.statementFile, "r"), buffer = Buffer.alloc(65537);
         let statement;
         try {
           const stat3 = await file.stat();
@@ -18901,8 +19344,10 @@ var ProductCli = class {
         return failure(name, 3, error.code, false, error.message);
       if (error instanceof InteractiveSessionRequiredError)
         return failure(name, 2, "interactive_login_required", false, `A user API token cannot create, list or select a workspace. Run '${this.dependencies.commandPrefix} login --json' in a process without OHMYHOST_TOKEN.`);
+      if (error instanceof ProfileLimitError)
+        return failure(name, 2, "profile_limit_reached", false, profileLimitAction(this.dependencies.commandPrefix));
       this.recordDiagnostic(diagnosticDescriptor(error, signal));
-      return classifyFailure(name, error, signal);
+      return classifyFailure(name, error, signal, this.context());
     }
   }
   githubConnectAction(organizationId) {
@@ -18925,22 +19370,53 @@ var ProductCli = class {
       return success("whoami", {
         status: "authenticated",
         identity,
+        context: this.context(),
         ...identity.organization_ids.length === 1 && identity.organization_ids[0] !== void 0 ? await this.githubNextAction(api, identity.organization_ids[0]) : {}
       });
-    const selection = await this.chooseAndStoreWorkspace(await api.getAccountProfile(), void 0, command.credentialStore, signal);
-    if (selection.outcome === "selected")
+    const selection = chooseWorkspace((await api.getAccountProfile()).organizations, void 0);
+    if (selection.outcome === "selected") {
+      await this.bindOrganization(selection.organization, signal);
       return success("whoami", {
         status: "authenticated",
         identity: parseCurrentIdentity(await api.getCurrentIdentity()),
         organization: publicWorkspace(selection.organization),
         selected: selection.organization.id,
+        context: this.context(),
         ...await this.githubNextAction(api, selection.organization.id)
       });
+    }
     return success("whoami", {
       status: "authenticated",
       identity,
+      context: this.context(),
       organizations: selection.outcome === "choice_required" ? selection.organizations.map(publicWorkspace) : [],
-      next_action: selection.outcome === "choice_required" ? `Ask the customer which workspace to use, then run '${this.dependencies.commandPrefix} organization use --organization ULID --json'.` : `Run '${this.dependencies.commandPrefix} organization create --name NAME --idempotency-key KEY --json' to create the first workspace.`
+      next_action: this.workspaceAction(selection)
+    });
+  }
+  /** Which account this run acts as, without any credential. */
+  context() {
+    if (this.dependencies.apiToken !== void 0)
+      return { credential: "environment_token" };
+    return {
+      credential: "profile",
+      profile: this.#profile === void 0 ? null : publicProfile(this.#profile)
+    };
+  }
+  /** The next step for a login that has no organization yet. */
+  workspaceAction(selection) {
+    const prefix = this.dependencies.commandPrefix;
+    const named = this.#profile === void 0 ? "" : ` --profile-name ${this.#profile.name}`;
+    return selection.outcome === "choice_required" ? `Ask the customer which workspace to use, then run '${prefix} organization use --organization ULID${named} --json'.` : `Run '${prefix} organization create --name NAME --idempotency-key KEY${named} --json' to create the first workspace.`;
+  }
+  async listProfiles() {
+    const profiles = this.dependencies.profiles;
+    if (profiles === void 0)
+      throw new ProviderCapabilityBlockedError();
+    return success("profile list", {
+      status: "listed",
+      profiles: (await profiles.list()).map(publicProfile),
+      bound: this.dependencies.profileBinding ?? null,
+      environment_token: this.dependencies.apiToken !== void 0
     });
   }
   recordDiagnostic(event) {
@@ -18953,7 +19429,11 @@ var ProductCli = class {
     }
   }
   // The reviewed boundary proof parses this signature, so keep its parameters brace-free.
-  async login(credentialStore, organizationId, signal) {
+  async login(organizationId, expectedUserId, signal) {
+    const profiles = this.dependencies.profiles;
+    const readIdentity = this.dependencies.currentIdentity;
+    if (profiles === void 0 || readIdentity === void 0)
+      throw new ProviderCapabilityBlockedError();
     const signInDeadline = this.dependencies.now().getTime() + SIGN_IN_WINDOW_MS;
     let session = await this.dependencies.deviceFlow.authorize();
     await presentAuthorization(this.dependencies.deviceAuthorizationPresenter, session.authorization);
@@ -18990,53 +19470,112 @@ var ProductCli = class {
           throw error;
         throw new ProductCliFailure(4, "device_token_expiry_missing", false, "Run login again; the authorization response was incomplete.");
       }
-      await this.dependencies.credentialStore(credentialStore).replace({
+      const signedIn = {
         accessToken: result.tokens.accessToken,
         refreshToken: result.tokens.refreshToken,
         expiresAt
-      });
-      const profile = await this.dependencies.accountProfile(() => this.authenticatedToken(credentialStore, signal));
-      const selection = await this.chooseAndStoreWorkspace(profile, organizationId, credentialStore, signal);
+      };
+      const account = await this.dependencies.accountProfile(async () => signedIn.accessToken);
+      if (!isProfileUserId(account.userId))
+        throw this.unverifiedLogin();
+      if (expectedUserId !== void 0 && account.userId !== expectedUserId)
+        throw new ProductCliFailure(4, "login_account_mismatch", false, `The browser signed in as user ${account.userId}, not ${expectedUserId}. Nothing was saved and every saved login is unchanged. Sign out of ohmyho.st in that browser or use the browser profile of ${expectedUserId}, then run '${this.dependencies.commandPrefix} login${organizationId === void 0 ? "" : ` --organization ${organizationId}`} --user ${expectedUserId} --json' again.`);
+      const selection = chooseWorkspace(account.organizations, organizationId);
+      if (selection.outcome === "not_a_member")
+        throw this.unknownWorkspace(selection);
+      const credential = selection.outcome === "selected" ? await runBounded((bounded2) => this.dependencies.tokenRefresher.refresh(signedIn.refreshToken, bounded2, selection.organization.workos_id), signal, this.dependencies.lifecycleTimeoutMs) : signedIn;
+      const identity = await readIdentity(async () => credential.accessToken);
+      const scopedId = selection.outcome === "selected" ? selection.organization.id : parseCurrentIdentity(identity).organization_ids[0] ?? null;
+      const organization = scopedId === null ? null : account.organizations.find((candidate) => candidate.id === scopedId);
+      if (organization === void 0)
+        throw this.unverifiedLogin();
+      try {
+        assertVerifiedLogin(identity, account.userId, scopedId);
+      } catch (error) {
+        if (error instanceof AccountVerificationError)
+          throw this.unverifiedLogin();
+        throw error;
+      }
+      const login = {
+        userId: account.userId,
+        organizationId: scopedId,
+        organizationName: organization?.name ?? null
+      };
+      const profile = {
+        name: this.dependencies.profileName ?? defaultProfileName(await profiles.list(), login),
+        ...login
+      };
+      try {
+        await profiles.save(profile, organization === null ? credential : {
+          ...credential,
+          workosOrganizationId: organization.workos_id,
+          organizationId: organization.id
+        });
+      } catch (error) {
+        if (!(error instanceof ProfileNameConflictError))
+          throw error;
+        throw new ProductCliFailure(2, "profile_name_conflict", false, `The name ${profile.name} already belongs to the saved login of user ${error.profile.userId} in organization ${String(error.profile.organizationId ?? "none")}. Nothing was saved. Choose another --profile-name, or remove that login with '${this.dependencies.commandPrefix} logout --profile-name ${profile.name} --json' first.`);
+      }
+      this.#profile = profile;
       const readGithubConnection = this.dependencies.githubConnectionStatus;
-      if (selection.outcome === "selected")
+      if (organization !== null)
         return success("login", {
           status: "authenticated",
-          organization: publicWorkspace(selection.organization),
+          organization: publicWorkspace(organization),
+          profile: publicProfile(profile),
           ...readGithubConnection === void 0 ? {} : await this.githubNextAction({
-            getGithubConnection: (selectedOrganizationId) => readGithubConnection(() => this.authenticatedToken(credentialStore, signal), selectedOrganizationId)
-          }, selection.organization.id)
+            getGithubConnection: (selectedOrganizationId) => readGithubConnection(async () => credential.accessToken, selectedOrganizationId)
+          }, organization.id)
         });
-      if (selection.outcome === "not_a_member")
-        throw this.unknownWorkspace(selection);
       return success("login", {
         status: "authenticated",
         organization: null,
+        profile: publicProfile(profile),
         organizations: selection.outcome === "choice_required" ? selection.organizations.map(publicWorkspace) : [],
-        next_action: selection.outcome === "choice_required" ? `Ask the customer which workspace to use, then run '${this.dependencies.commandPrefix} organization use --organization ULID --json'.` : `Run '${this.dependencies.commandPrefix} organization create --name NAME --idempotency-key KEY --json' to create the first workspace.`
+        next_action: this.workspaceAction(selection)
       });
     }
   }
-  workspaceSession(credentialStore) {
-    return {
-      store: this.dependencies.credentialStore(credentialStore),
-      refresher: this.dependencies.tokenRefresher
-    };
-  }
-  /** Decide the workspace and, when the answer cannot be wrong, put it into the credential. */
-  async chooseAndStoreWorkspace(organizations, requested, credentialStore, signal) {
-    const selection = chooseWorkspace(organizations, requested);
-    if (selection.outcome === "selected")
-      await runBounded((bounded2) => selectWorkspace(this.workspaceSession(credentialStore), selection.organization, bounded2), signal, this.dependencies.lifecycleTimeoutMs);
-    return selection;
+  /** The provider answered with another account than the one this login requested. */
+  unverifiedLogin() {
+    return new ProductCliFailure(4, "login_verification_failed", true, `The signed-in account could not be verified; nothing was saved. Run '${this.dependencies.commandPrefix} login --json' again.`);
+  }
+  /**
+   * Bind the login of this run, which has no organization yet, to one of its user's organizations.
+   * A login that already has one keeps it; another organization is its own login.
+   */
+  async bindOrganization(organization, signal) {
+    const profiles = this.dependencies.profiles;
+    const profile = this.#profile;
+    if (profiles === void 0 || profile === void 0)
+      throw new InteractiveSessionRequiredError();
+    let bound;
+    try {
+      bound = await runBounded((bounded2) => selectWorkspace({
+        store: profiles.credential(profile),
+        refresher: this.dependencies.tokenRefresher,
+        profiles,
+        profile
+      }, organization, bounded2, (accessToken) => this.dependencies.productApi(async () => accessToken).getCurrentIdentity()), signal, this.dependencies.lifecycleTimeoutMs);
+    } catch (error) {
+      if (error instanceof AccountVerificationError)
+        throw this.unverifiedLogin();
+      if (!(error instanceof ProfileOrganizationFixedError))
+        throw error;
+      throw new ProductCliFailure(2, "profile_organization_fixed", false, `Profile ${profile.name} stays signed in to organization ${String(profile.organizationId)}. Run '${this.dependencies.commandPrefix} login --organization ${organization.id} --user ${profile.userId} --json' to add a separate login for ${organization.id} as the same user; a saved login never switches organizations.`);
+    }
+    this.#profile = bound;
+    return bound;
   }
   unknownWorkspace(selection) {
     return new ProductCliFailure(2, "organization_not_found", false, `You are not a member of that workspace. Run '${this.dependencies.commandPrefix} organization list --json' and choose one of ${String(selection.outcome === "not_a_member" ? selection.organizations.length : 0)}.`);
   }
   async logout(credentialStore, revoke, signal) {
-    const store = this.dependencies.credentialStore(credentialStore);
+    const store = this.store(credentialStore);
+    const removed = this.#profile === void 0 ? {} : { profile: publicProfile(this.#profile) };
     if (!revoke) {
-      await store.clear();
-      return success("logout", { status: "logged_out" });
+      await this.forgetLogin(store);
+      return success("logout", { status: "logged_out", ...removed });
     }
     const credential = await store.read();
     let revocationError;
@@ -19047,7 +19586,7 @@ var ProductCli = class {
     } catch (error) {
       revocationError = error;
     } finally {
-      await store.clear();
+      await this.forgetLogin(store);
     }
     if (revocationError !== void 0) {
       if (isCancellation(revocationError) && signal.aborted)
@@ -19063,7 +19602,29 @@ var ProductCli = class {
       }
       throw revocationError;
     }
-    return success("logout", { status: "logged_out" });
+    return success("logout", { status: "logged_out", ...removed });
+  }
+  /** The credential store of this run's saved login; it follows a binding made during the run. */
+  store(kind) {
+    const profiles = this.dependencies.profiles;
+    if (profiles !== void 0 && this.#profile !== void 0)
+      return profiles.credential(this.#profile);
+    if (this.dependencies.credentialStore === void 0)
+      throw new ProductCliFailure(5, "authentication_required", false, this.loginAction());
+    return this.dependencies.credentialStore(kind);
+  }
+  /** Removes only this run's saved login; every other saved login stays untouched. */
+  async forgetLogin(store) {
+    const profiles = this.dependencies.profiles;
+    if (profiles !== void 0 && this.#profile !== void 0)
+      await profiles.remove(this.#profile);
+    else
+      await store.clear();
+  }
+  /** How to sign this run's login in again, naming its organization and alias when known. */
+  loginAction() {
+    const profile = this.#profile;
+    return `Run '${this.dependencies.commandPrefix} login${profile?.organizationId === void 0 || profile.organizationId === null ? "" : ` --organization ${profile.organizationId}`}${profile === void 0 ? "" : ` --profile-name ${profile.name}`} --json'.`;
   }
   async getOperation(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
@@ -19116,7 +19677,7 @@ var ProductCli = class {
   async getProjectStatus(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
     const project = parseProjectStatus(await api.getProjectStatus(command.projectId));
-    return success("project status", { status: "succeeded", project });
+    return success("project status", { status: "succeeded", project, context: this.context() });
   }
   async createDevAccessTicket(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
@@ -19259,14 +19820,18 @@ var ProductCli = class {
     const source = project.source;
     if (project.project_id !== command.projectId || source === null || source.status !== "ready" || source.repository_full_name.toLowerCase() !== `${command.repositoryOwner}/${command.repositoryName}`.toLowerCase())
       throw new ResponseContractError();
+    const [organizationId, ...others] = parseCurrentIdentity(await api.getCurrentIdentity()).organization_ids;
+    if (organizationId === void 0 || others.length > 0)
+      throw new ResponseContractError();
     await this.dependencies.projectLinkStore.save({
-      version: 1,
+      version: 2,
       api_origin: this.dependencies.productApiOrigin,
+      organization_id: organizationId,
       project_id: command.projectId,
       installation_id: source.installation_id,
       repository_full_name: source.repository_full_name
     });
-    return success("link", { status: "completed", operation });
+    return success("link", { status: "completed", operation, organization_id: organizationId });
   }
   async configureAutoDeploy(command, signal) {
     const api = await this.authenticatedApi(command.credentialStore, signal);
@@ -19509,10 +20074,10 @@ var ProductCli = class {
   async authenticatedToken(credentialStore, signal) {
     if (this.dependencies.apiToken !== void 0)
       return this.dependencies.apiToken;
-    const store = this.dependencies.credentialStore(credentialStore);
+    const store = this.store(credentialStore);
     const stored = await store.read();
     if (stored === void 0) {
-      throw new ProductCliFailure(5, "authentication_required", false, "Run 'ohmyhost login'.");
+      throw new ProductCliFailure(5, "authentication_required", false, this.loginAction());
     }
     let refresh;
     try {
@@ -19520,8 +20085,8 @@ var ProductCli = class {
     } catch (error) {
       if (!(error instanceof TokenRefreshRejectedError))
         throw error;
-      await store.clear();
-      throw new ProductCliFailure(5, "authentication_required", false, "Run 'ohmyhost login'.");
+      await this.forgetLogin(store);
+      throw new ProductCliFailure(5, "authentication_required", false, this.loginAction());
     }
     if (refresh.refreshed)
       await store.replace(refresh.credential);
@@ -19587,7 +20152,16 @@ var redactVerificationUri = (value) => {
   url.hash = "";
   return url.toString();
 };
-var classifyFailure = (command, error, signal) => {
+var ACCOUNT_SENSITIVE_PROBLEMS = /* @__PURE__ */ new Set([
+  "resource_not_found",
+  "forbidden",
+  "organization_required",
+  "github_connection_required",
+  "github_connection_revoked",
+  "repository_not_installed"
+]);
+var classifyCliFailure = (command, error, signal) => classifyFailure(command, error, signal);
+var classifyFailure = (command, error, signal, actingAs) => {
   if (signal.aborted || isCancellation(error)) {
     return failure(command, 130, "command_cancelled", true, "Run the command again.");
   }
@@ -19621,7 +20195,7 @@ var classifyFailure = (command, error, signal) => {
   if (looksLikeProblem(error)) {
     try {
       const problem = parseSafeProblem(error);
-      return failure(command, 7, problem.code, problem.retryable, problem.suggestedAction, void 0, problem.retryAfterSeconds, problem.requestId, problem.docsUrl);
+      return failure(command, 7, problem.code, problem.retryable, problem.suggestedAction, void 0, problem.retryAfterSeconds, problem.requestId, problem.docsUrl, ACCOUNT_SENSITIVE_PROBLEMS.has(problem.code) ? actingAs : void 0);
     } catch {
       return failure(command, 7, "response_contract_invalid", false, "Retry only after the client or server contract is repaired.");
     }
@@ -19641,7 +20215,7 @@ var success = (command, body) => ({
 `,
   stderr: ""
 });
-var failure = (command, exitCode, code, retryable, suggestedAction, operation, retryAfterSeconds, requestId, docsUrl) => {
+var failure = (command, exitCode, code, retryable, suggestedAction, operation, retryAfterSeconds, requestId, docsUrl, actingAs) => {
   const document = {
     version: 1,
     command,
@@ -19654,7 +20228,8 @@ var failure = (command, exitCode, code, retryable, suggestedAction, operation, r
       ...retryAfterSeconds === void 0 ? {} : { retry_after_seconds: retryAfterSeconds },
       ...requestId === void 0 ? {} : { request_id: requestId },
       ...docsUrl === void 0 ? {} : { docs_url: docsUrl },
-      ...operation?.error === void 0 ? {} : { message: operation.error.message }
+      ...operation?.error === void 0 ? {} : { message: operation.error.message },
+      ...actingAs === void 0 ? {} : { acting_as: actingAs }
     }
   };
   return { exitCode, stdout: `${JSON.stringify(document)}
@@ -19787,6 +20362,8 @@ var parsedCommandName = (command) => {
     return "secret delete";
   if (command.kind === "managed-mail")
     return command.label;
+  if (command.kind === "profile-list")
+    return "profile list";
   return command.kind;
 };
 var boundedSignal = (parent, timeoutMs) => AbortSignal.any([parent, AbortSignal.timeout(timeoutMs)]);
@@ -21224,6 +21801,23 @@ var deleteProject = (parameters, options) => {
     ...params
   });
 };
+var getProject = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}",
+    ...options,
+    ...params
+  });
+};
 var getProjectContext = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -22908,18 +23502,75 @@ var GeneratedSdkProductApi = class {
 };
 
 // apps/product-cli/dist/project-link-store.js
-import { appendFile, chmod, mkdir as mkdir2, readFile, rename, stat, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-async function readLinkedProjectId(directory, apiOrigin) {
+import { appendFile, chmod, mkdir as mkdir3, readFile as readFile2, readdir as readdir2, rename, stat, unlink as unlink2, writeFile } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var ULID2 = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+var LINKS = "links";
+var LEGACY_LINK = "link.json";
+async function readProjectLinks(directory, apiOrigin) {
+  let names = [];
   try {
-    const link = JSON.parse(await readFile(join(directory, "link.json"), "utf8"));
-    if (typeof link !== "object" || link === null)
-      return null;
-    const { version: version2, api_origin, project_id } = link;
-    return version2 === 1 && api_origin === apiOrigin && typeof project_id === "string" && /^[0-9A-HJKMNP-TV-Z]{26}$/u.test(project_id) ? project_id : null;
+    names = await readdir2(join2(directory, LINKS));
   } catch {
-    return null;
+    names = [];
   }
+  const links = [];
+  for (const name of names.sort()) {
+    const organizationId = /^([0-7][0-9A-HJKMNP-TV-Z]{25})\.json$/u.exec(name)?.[1];
+    if (organizationId === void 0)
+      continue;
+    const link2 = await readJson(join2(directory, LINKS, name));
+    if (isRecord3(link2, [
+      "version",
+      "api_origin",
+      "organization_id",
+      "project_id",
+      "installation_id",
+      "repository_full_name"
+    ]) && link2["version"] === 2 && link2["api_origin"] === apiOrigin && link2["organization_id"] === organizationId && typeof link2["project_id"] === "string" && ULID2.test(link2["project_id"]) && typeof link2["installation_id"] === "string" && typeof link2["repository_full_name"] === "string")
+      links.push(link2);
+  }
+  const legacy = await readJson(join2(directory, LEGACY_LINK));
+  return {
+    links,
+    legacy: typeof legacy === "object" && legacy !== null && legacy["version"] === 1 && legacy["api_origin"] === apiOrigin && typeof legacy["project_id"] === "string" && ULID2.test(legacy["project_id"]) && typeof legacy["installation_id"] === "string" && typeof legacy["repository_full_name"] === "string" ? {
+      project_id: legacy["project_id"],
+      installation_id: legacy["installation_id"],
+      repository_full_name: legacy["repository_full_name"]
+    } : null
+  };
+}
+function chooseLinkedProject(directory, organizationId) {
+  if (organizationId !== void 0) {
+    const link2 = directory.links.find((candidate) => candidate.organization_id === organizationId);
+    if (link2 !== void 0)
+      return { outcome: "linked", projectId: link2.project_id, organizationId };
+    return directory.legacy === null ? { outcome: "none" } : { outcome: "linked", projectId: directory.legacy.project_id, organizationId: null };
+  }
+  const candidates = [
+    ...directory.links.map((link2) => ({
+      projectId: link2.project_id,
+      organizationId: link2.organization_id
+    })),
+    ...directory.legacy === null ? [] : [{ projectId: directory.legacy.project_id, organizationId: null }]
+  ];
+  const [only] = candidates;
+  if (candidates.length === 1 && only !== void 0)
+    return { outcome: "linked", ...only };
+  if (candidates.length === 0)
+    return { outcome: "none" };
+  return {
+    outcome: "ambiguous",
+    organizationIds: directory.links.map((link2) => link2.organization_id)
+  };
+}
+function linkedOrganization(directory, projectId) {
+  const organizations = new Set(directory.links.filter((link2) => link2.project_id === projectId).map((link2) => link2.organization_id));
+  const [organizationId] = organizations;
+  return organizations.size === 1 ? organizationId : void 0;
+}
+async function removeLegacyProjectLink(directory) {
+  await unlink2(join2(directory, LEGACY_LINK));
 }
 var OwnerOnlyProjectLinkStore = class {
   directory;
@@ -22930,10 +23581,15 @@ var OwnerOnlyProjectLinkStore = class {
     this.repositoryRoot = repositoryRoot;
   }
   async save(metadata) {
-    await mkdir2(this.directory, { mode: 448, recursive: true });
-    await chmod(this.directory, 448);
-    const target = join(this.directory, "link.json");
-    const temporary = join(this.directory, `.link-${process.pid}.tmp`);
+    if (!ULID2.test(metadata.organization_id))
+      throw new TypeError("Invalid linked organization");
+    const links = join2(this.directory, LINKS);
+    for (const directory of [this.directory, links]) {
+      await mkdir3(directory, { mode: 448, recursive: true });
+      await chmod(directory, 448);
+    }
+    const target = join2(links, `${metadata.organization_id}.json`);
+    const temporary = join2(links, `.link-${process.pid}.tmp`);
     await writeFile(temporary, `${JSON.stringify(metadata)}
 `, { encoding: "utf8", mode: 384 });
     await chmod(temporary, 384);
@@ -22943,16 +23599,25 @@ var OwnerOnlyProjectLinkStore = class {
       await ignoreLinkDirectory(this.repositoryRoot);
   }
 };
+async function readJson(path) {
+  try {
+    const value = JSON.parse(await readFile2(path, "utf8"));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+var isRecord3 = (value, keys) => typeof value === "object" && value !== null && Object.keys(value).sort().join(",") === [...keys].sort().join(",");
 async function ignoreLinkDirectory(root) {
   try {
-    await stat(join(root, ".git"));
+    await stat(join2(root, ".git"));
   } catch {
     return;
   }
-  const file = join(root, ".gitignore");
+  const file = join2(root, ".gitignore");
   let current = "";
   try {
-    current = await readFile(file, "utf8");
+    current = await readFile2(file, "utf8");
   } catch {
     current = "";
   }
@@ -22965,7 +23630,7 @@ async function ignoreLinkDirectory(root) {
 
 // apps/product-cli/dist/repository-init.js
 import { createHash } from "node:crypto";
-import { lstat as lstat2, open as open3, readFile as readFile2, readdir, stat as stat2 } from "node:fs/promises";
+import { lstat as lstat2, open as open4, readFile as readFile3, readdir as readdir3, stat as stat2 } from "node:fs/promises";
 import { dirname as dirname2, posix, resolve as resolve2 } from "node:path";
 
 // packages/contracts/dist/application-root.js
@@ -23933,7 +24598,7 @@ async function cronBlockers(framework, config, applicationDirectory, files) {
     ];
   }
   const modulePath = framework === "vite" ? "src/ohmyhost/companion.ts" : WORKER_MODULE_PATH;
-  const source = files.includes(modulePath) ? await readFile2(resolve2(applicationDirectory, modulePath), "utf8") : null;
+  const source = files.includes(modulePath) ? await readFile3(resolve2(applicationDirectory, modulePath), "utf8") : null;
   if (framework !== "functions" && source !== null && !DEFAULT_EXPORT_PATTERN.test(source)) {
     return [defaultExportBlocker(modulePath)];
   }
@@ -23957,7 +24622,7 @@ async function storageClientBlockers(config, applicationDirectory, files) {
     const information = await stat2(absolute);
     if (!information.isFile() || information.size > MAXIMUM_SOURCE_BYTES)
       continue;
-    if (callsStorageClient(await readFile2(absolute, "utf8")))
+    if (callsStorageClient(await readFile3(absolute, "utf8")))
       return [];
   }
   return [
@@ -23978,7 +24643,7 @@ async function databaseContractBlockers(config, applicationDirectory, files) {
     const information = await stat2(absolute);
     if (!information.isFile() || information.size > MAXIMUM_SOURCE_BYTES)
       continue;
-    const source = (await readFile2(absolute, "utf8")).replaceAll(INERT_SOURCE_PATTERN, " ");
+    const source = (await readFile3(absolute, "utf8")).replaceAll(INERT_SOURCE_PATTERN, " ");
     if (DATABASE_PRIVATE_BINDING_PATTERN.test(source)) {
       blockers.push({
         code: "database_binding_private",
@@ -23997,7 +24662,7 @@ async function databaseContractBlockers(config, applicationDirectory, files) {
 async function workerModuleBlockers(framework, applicationDirectory, files) {
   if (framework !== "functions" || !files.includes(WORKER_MODULE_PATH))
     return [];
-  const source = await readFile2(resolve2(applicationDirectory, WORKER_MODULE_PATH), "utf8");
+  const source = await readFile3(resolve2(applicationDirectory, WORKER_MODULE_PATH), "utf8");
   return DEFAULT_EXPORT_PATTERN.test(source) ? [] : [defaultExportBlocker(WORKER_MODULE_PATH)];
 }
 function migrationFilenameBlockers(files, configuredPath, provider) {
@@ -24024,7 +24689,7 @@ async function migrationSqlBlockers(applicationDirectory, files, configuredPath,
   }
   const migrations = await Promise.all(migrationPaths.map(async (path) => Object.freeze({
     path,
-    body: new Uint8Array(await readFile2(resolve2(applicationDirectory, root, path)))
+    body: new Uint8Array(await readFile3(resolve2(applicationDirectory, root, path)))
   })));
   const blockers = [];
   for (const migration of migrations) {
@@ -24063,7 +24728,7 @@ async function readExistingConfiguration(repositoryRoot, repositoryFiles, applic
   if (!information.isFile() || information.size > MAXIMUM_CONFIGURATION_BYTES) {
     throw new RepositoryInitError("repository_configuration_invalid", "Existing ohmyhost.yaml must be one bounded regular file.");
   }
-  const configuration = await readFile2(configurationPath, "utf8");
+  const configuration = await readFile3(configurationPath, "utf8");
   let parsed;
   try {
     parsed = parseOhmyhostConfigYaml(configuration);
@@ -24191,7 +24856,7 @@ async function tryReadPackageJson(root) {
 }
 function hasDirectSafeBuildCommand(packageJson, framework) {
   const scripts = packageJson["scripts"];
-  if (!isRecord2(scripts) || typeof scripts["build"] !== "string")
+  if (!isRecord4(scripts) || typeof scripts["build"] !== "string")
     return false;
   const command = scripts["build"];
   if (command.includes("..") || /(?:^|\s)cd(?:\s|$)/u.test(command))
@@ -24239,7 +24904,7 @@ async function collectRepositoryFiles(root) {
     const directory = directories.pop();
     if (directory === void 0)
       break;
-    for (const entry of await readdir(resolve2(root, directory), { withFileTypes: true })) {
+    for (const entry of await readdir3(resolve2(root, directory), { withFileTypes: true })) {
       const relative = directory === "" ? entry.name : posix.join(directory, entry.name);
       if (entry.isSymbolicLink()) {
         throw new RepositoryInitError("repository_symlink_forbidden", "Repository symlinks are forbidden");
@@ -24272,8 +24937,8 @@ async function readPackageJson(root) {
     throw new RepositoryInitError("package_manifest_invalid", "package.json is invalid");
   }
   try {
-    const value = JSON.parse(await readFile2(path, "utf8"));
-    if (!isRecord2(value))
+    const value = JSON.parse(await readFile3(path, "utf8"));
+    if (!isRecord4(value))
       throw new TypeError();
     return value;
   } catch {
@@ -24284,7 +24949,7 @@ function dependencyNames(packageJson) {
   const names = /* @__PURE__ */ new Set();
   for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
     const value = packageJson[field];
-    if (!isRecord2(value))
+    if (!isRecord4(value))
       continue;
     for (const [name, version2] of Object.entries(value)) {
       if (typeof version2 === "string" && version2.length > 0)
@@ -24423,9 +25088,9 @@ function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanSta
     });
   }
   const scripts = packageJson["scripts"];
-  const scriptRecord = isRecord2(scripts) ? scripts : {};
+  const scriptRecord = isRecord4(scripts) ? scripts : {};
   if (framework === "functions") {
-  } else if (!isRecord2(scripts) || typeof scripts["build"] !== "string" || scripts["build"].length === 0) {
+  } else if (!isRecord4(scripts) || typeof scripts["build"] !== "string" || scripts["build"].length === 0) {
     blockers.push({ code: "build_script_missing", message: "Declare a non-empty build script." });
   } else if (!hasDirectSafeBuildCommand(packageJson, framework)) {
     blockers.push({
@@ -24441,7 +25106,7 @@ function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanSta
     });
   }
   if (framework === "nextjs") {
-    const dependencies = isRecord2(packageJson["dependencies"]) ? packageJson["dependencies"] : {};
+    const dependencies = isRecord4(packageJson["dependencies"]) ? packageJson["dependencies"] : {};
     const nextBuild = scriptRecord["build"] === "next build" || scriptRecord["build"] === "next build --webpack";
     const nextPackageConfigured = nextBuild && compatibility.frameworks[0]?.classification !== "unsupported" && exactVersion(dependencies["react"]) && exactVersion(dependencies["react-dom"]) && frameworkConfigs.next !== null;
     const nextConfigured = nextPackageConfigured && frameworkConfigs.ambiguous.every((config) => config !== "open-next");
@@ -24466,7 +25131,7 @@ function exactVersion(value) {
 function dependencyVersion(packageJson, name) {
   for (const field of ["dependencies", "devDependencies", "optionalDependencies"]) {
     const dependencies = packageJson[field];
-    if (!isRecord2(dependencies))
+    if (!isRecord4(dependencies))
       continue;
     const version2 = dependencies[name];
     if (typeof version2 === "string" && version2.length > 0)
@@ -24537,7 +25202,7 @@ async function detectNextStandaloneOutput(root, framework, nextConfigPath) {
   const information = await stat2(path);
   if (!information.isFile() || information.size > MAXIMUM_CONFIGURATION_BYTES)
     return false;
-  return declaresStandaloneOutput(await readFile2(path, "utf8"));
+  return declaresStandaloneOutput(await readFile3(path, "utf8"));
 }
 function declaresStandaloneOutput(source) {
   const tokens = sourceTokens(source);
@@ -24606,7 +25271,7 @@ async function detectTanStackRuntime(root, files, framework, packageJson, viteCo
   const information = await stat2(path);
   if (!information.isFile() || information.size > MAXIMUM_PACKAGE_BYTES)
     return "ambiguous";
-  const source = await readFile2(path, "utf8");
+  const source = await readFile3(path, "utf8");
   const tokens = sourceTokens(source);
   if (isCompleteTanStackStatic(tokens))
     return "static";
@@ -24678,10 +25343,10 @@ function directSourceObjectProperty(tokens, start, end, name) {
   }
   return null;
 }
-function matchingSourceDelimiter(tokens, start, open4, close) {
+function matchingSourceDelimiter(tokens, start, open5, close) {
   let depth = 0;
   for (let index = start; index < tokens.length; index += 1) {
-    if (tokens[index] === open4)
+    if (tokens[index] === open5)
       depth += 1;
     if (tokens[index] === close)
       depth -= 1;
@@ -24715,7 +25380,7 @@ async function detectR2Storage(root, files) {
     const information = await stat2(path);
     if (!information.isFile() || information.size > MAXIMUM_CONFIGURATION_BYTES)
       continue;
-    const source = await readFile2(path, "utf8");
+    const source = await readFile3(path, "utf8");
     if (/\br2_buckets\b/u.test(source))
       return true;
   }
@@ -24757,7 +25422,7 @@ function viteCompanionScaffold(files, capabilities) {
 async function createConfiguration(root, configuration) {
   let handle;
   try {
-    handle = await open3(resolve2(root, "ohmyhost.yaml"), "wx", 384);
+    handle = await open4(resolve2(root, "ohmyhost.yaml"), "wx", 384);
     await handle.writeFile(configuration, "utf8");
     await handle.sync();
   } catch (error) {
@@ -24770,7 +25435,7 @@ async function createConfiguration(root, configuration) {
     await handle?.close();
   }
 }
-function isRecord2(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNodeError(value) {
@@ -24778,11 +25443,8 @@ function isNodeError(value) {
 }
 
 // apps/product-cli/dist/composition.js
-import { randomUUID } from "node:crypto";
-import { join as join2 } from "node:path";
-
-// packages/workos-auth-contracts/dist/user-api-keys.js
-var WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { join as join3 } from "node:path";
 
 // packages/workos-auth-contracts/dist/device-flow.js
 var WORKOS_AUTHKIT_DEVICE_AUTHORIZATION_ENDPOINT = "https://api.workos.com/user_management/authorize/device";
@@ -25012,37 +25674,99 @@ function environmentToken(environment = {}) {
     throw new ProductApiAuthenticationError("invalid_environment_token");
   return value;
 }
+function environmentProfile(environment = {}) {
+  const value = environment.OHMYHOST_PROFILE;
+  if (value === void 0 || value === "")
+    return void 0;
+  if (!isProfileName(value))
+    throw new ProductApiAuthenticationError("invalid_profile_binding");
+  return value;
+}
+var profileRequest = (input, bound) => ({
+  ...input?.name === void 0 ? {} : { name: input.name },
+  ...bound === void 0 ? {} : { bound },
+  ...input?.organizationId === void 0 ? {} : { organizationId: input.organizationId },
+  ...input?.userId === void 0 ? {} : { userId: input.userId }
+});
 var createProductionAuthenticatedProductApi = async (signal, overrides = {}) => {
   const transport = await createAuthenticatedProductTransport(signal, overrides);
   return new GeneratedSdkProductApi(transport.baseUrl, transport.accessToken, transport.fetch);
 };
 var createAuthenticatedProductTransport = async (signal, overrides = {}) => {
-  const profile = resolveProductCliEnvironment(overrides.environment);
+  const platform = resolveProductCliEnvironment(overrides.environment);
   const apiToken = environmentToken(overrides.environment);
+  const bound = environmentProfile(overrides.environment);
+  const baseUrl = overrides.productApiOrigin ?? platform.apiOrigin;
   const boundedFetch = createBoundedFetch(overrides.fetch ?? fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES);
-  if (apiToken !== void 0)
+  const registry = overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform.credentialService);
+  const binding = overrides.request?.bindOrganization === true;
+  const request = profileRequest(overrides.request, bound);
+  if (apiToken !== void 0) {
+    await verifyEnvironmentTokenContext({
+      token: apiToken,
+      request: binding ? profileRequest({}, bound) : request,
+      registry,
+      baseUrl,
+      fetch: boundedFetch
+    });
     return {
-      baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+      baseUrl,
       accessToken: apiToken,
       fetch: boundedFetch,
-      // A user API token carries a fixed scope; there is no session that could select a workspace.
-      workspace: void 0
+      workspace: void 0,
+      context: { credential: "environment_token", profile: null }
     };
-  const store = overrides.credentialStore ?? new NativeNapiKeyringCredentialStore(void 0, profile.credentialService);
-  const stored = await store.read();
-  if (stored === void 0)
-    throw new ProductApiAuthenticationError("authentication_required");
+  }
   const now = overrides.now ?? (() => /* @__PURE__ */ new Date());
   const refresher = overrides.tokenRefresher ?? new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now);
-  const credential = await currentCredential(stored, store, signal, now, refresher);
+  const profiles = await loadProfiles(registry, {
+    baseUrl,
+    fetch: boundedFetch,
+    signal,
+    now,
+    refresher
+  });
+  const selection = binding && request.organizationId !== void 0 ? selectProfileForOrganization(profiles, {
+    ...request,
+    organizationId: request.organizationId
+  }) : selectProfile(profiles, request);
+  if (selection.outcome !== "selected")
+    throw profileSelectionError(selection, request, platform.commandPrefix, overrides.selector ?? "cli");
+  const profile = selection.profile;
+  const store = registry.credential(profile);
+  const stored = await store.read();
+  if (stored === void 0)
+    throw missingLogin(profile, platform.commandPrefix);
+  const credential = await currentCredential(stored, store, signal, now, refresher, () => registry.remove(profile));
   return {
-    baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+    baseUrl,
     accessToken: credential.accessToken,
     fetch: boundedFetch,
-    workspace: { store, refresher }
+    workspace: { store, refresher, profiles: registry, profile },
+    context: { credential: "profile", profile }
+  };
+};
+var listSavedProfiles = async (signal, overrides = {}) => {
+  const platform = resolveProductCliEnvironment(overrides.environment);
+  const apiToken = environmentToken(overrides.environment);
+  const bound = environmentProfile(overrides.environment);
+  const registry = overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform.credentialService);
+  const now = overrides.now ?? (() => /* @__PURE__ */ new Date());
+  const profiles = apiToken === void 0 ? await loadProfiles(registry, {
+    baseUrl: overrides.productApiOrigin ?? platform.apiOrigin,
+    fetch: createBoundedFetch(overrides.fetch ?? fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
+    signal,
+    now,
+    refresher: overrides.tokenRefresher ?? new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now)
+  }) : await registry.list();
+  return {
+    profiles: profiles.map(publicProfile),
+    bound: bound ?? null,
+    environment_token: apiToken !== void 0
   };
 };
-var currentCredential = async (stored, store, signal, now, tokenRefresher) => {
+var missingLogin = (profile, commandPrefix) => new ProfileSelectionError("authentication_required", 5, `The saved login ${profile.name} has no credential on this computer. Run '${commandPrefix} login${profile.organizationId === null ? "" : ` --organization ${profile.organizationId}`} --profile-name ${profile.name} --json'.`);
+var currentCredential = async (stored, store, signal, now, tokenRefresher, forget) => {
   const expiresAt = stored.expiresAt === void 0 ? NaN : Date.parse(stored.expiresAt);
   if (Number.isFinite(expiresAt) && expiresAt > now().getTime() + REQUEST_TIMEOUT_MS) {
     return stored;
@@ -25058,119 +25782,350 @@ var currentCredential = async (stored, store, signal, now, tokenRefresher) => {
     return carried;
   } catch (error) {
     if (error instanceof TokenRefreshRejectedError) {
-      await store.clear();
+      await forget();
       throw new ProductApiAuthenticationError("authentication_required");
     }
     throw new ProductApiAuthenticationError("token_refresh_failed");
   }
 };
+var loadProfiles = async (registry, context) => {
+  const legacy = registry.legacy();
+  const stored = await legacy.read();
+  if (stored !== void 0)
+    await migrateLegacyLogin(registry, legacy, stored, context);
+  return registry.list();
+};
+var migrateLegacyLogin = async (registry, legacy, stored, context) => {
+  let credential;
+  try {
+    credential = await currentCredential(stored, legacy, context.signal, context.now, context.refresher, () => legacy.clear());
+  } catch (error) {
+    if (error instanceof ProductApiAuthenticationError && error.code === "authentication_required")
+      return;
+    throw error;
+  }
+  const api = new GeneratedSdkProductApi(context.baseUrl, credential.accessToken, context.fetch);
+  let identity;
+  try {
+    identity = await api.getCurrentIdentity();
+  } catch (error) {
+    if (!isProblem(error, "unauthenticated"))
+      throw error;
+    return;
+  }
+  const userId = verifiedUserId(identity);
+  const organizationId = parseCurrentIdentity(identity).organization_ids[0] ?? null;
+  const organizationName = organizationId === null ? null : (await api.getAccountProfile()).organizations.find((organization) => organization.id === organizationId)?.name ?? null;
+  const login = { userId, organizationId, organizationName };
+  await registry.save({ name: defaultProfileName(await registry.list(), login), ...login }, credential);
+  await legacy.clear();
+};
+var isProblem = (error, code) => typeof error === "object" && error !== null && "code" in error && error.code === code;
+var verifyEnvironmentTokenContext = async (input) => {
+  const { request } = input;
+  const named = request.name ?? request.bound;
+  if (named === void 0 && request.organizationId === void 0 && request.userId === void 0)
+    return null;
+  const refuse = (target) => new ProfileSelectionError("environment_token_context_mismatch", 2, `${target} Unset OHMYHOST_TOKEN to use the saved login, or load the key of that account from its private env file. Nothing was sent.`);
+  if (request.name !== void 0 && request.bound !== void 0 && request.name !== request.bound)
+    throw refuse(`This call names profile ${request.name}, but the process is bound to OHMYHOST_PROFILE=${request.bound}.`);
+  const profile = named === void 0 ? void 0 : (await input.registry.list()).find((saved) => saved.name === named);
+  if (named !== void 0 && profile === void 0)
+    throw refuse(`OHMYHOST_TOKEN overrides saved logins in this process, and no saved login is named ${named}.`);
+  const { userId, organizationId } = await readTokenIdentity(input);
+  const owner = `OHMYHOST_TOKEN belongs to user ${userId} in organization ${organizationId ?? "none"},`;
+  if (profile !== void 0 && (profile.userId !== userId || profile.organizationId !== organizationId))
+    throw refuse(`${owner} but this call names ${describeProfile(profile)}.`);
+  if (request.organizationId !== void 0 && request.organizationId !== organizationId)
+    throw refuse(`${owner} but this call targets organization ${request.organizationId}.`);
+  if (request.userId !== void 0 && request.userId !== userId)
+    throw refuse(`${owner} but this call targets user ${request.userId}.`);
+  return { userId, organizationId };
+};
+var readTokenIdentity = async (input) => {
+  const identity = parseCurrentIdentity(await new GeneratedSdkProductApi(input.baseUrl, input.token, input.fetch).getCurrentIdentity());
+  return {
+    userId: identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : identity.actor_id,
+    organizationId: identity.organization_ids[0] ?? null
+  };
+};
+var commandOrganizationId = (command) => {
+  if (command.kind === "organization-use" || command.kind === "login")
+    return void 0;
+  if (command.kind === "feedback-submit")
+    return command.report.organization_id;
+  return "organizationId" in command && typeof command.organizationId === "string" ? command.organizationId : void 0;
+};
+var commandProjectId = (command) => {
+  if (command.kind === "managed-mail")
+    return command.request.projectId;
+  return "projectId" in command && typeof command.projectId === "string" ? command.projectId : void 0;
+};
 var runProductionCli = async (argv, environment, io, signal, overrides = {}) => {
   const diagnostics = new StderrDiagnosticSink(io);
+  const written = (result) => {
+    io.writeStdout(result.stdout);
+    if (result.stderr.length > 0)
+      io.writeStderr(result.stderr);
+    return result.exitCode;
+  };
+  let args;
+  let profileName;
+  try {
+    const extracted = extractProfileName(argv);
+    args = extracted.argv;
+    profileName = extracted.profileName;
+  } catch {
+    return written(invalidCommandFailure(recognizedCommandLabel(argv)));
+  }
+  const workingDirectory = overrides.workingDirectory ?? process.cwd();
   let command;
+  let linked;
+  let links = { links: [], legacy: null };
   try {
-    const parsed = await parseWithLinkedProject(argv, async () => {
-      const profile2 = resolveProductCliEnvironment(environment);
-      return readLinkedProjectId(join2(overrides.workingDirectory ?? process.cwd(), profile2.linkDirectory), profile2.apiOrigin);
+    const parsed = await parseWithLinkedProject(args, async () => {
+      let platform2;
+      try {
+        platform2 = resolveProductCliEnvironment(environment);
+      } catch {
+        return { outcome: "none" };
+      }
+      links = await readProjectLinks(join3(workingDirectory, platform2.linkDirectory), platform2.apiOrigin);
+      let named = profileName;
+      try {
+        named ??= environmentProfile(environment);
+      } catch {
+      }
+      const profiles = named === void 0 ? [] : await (overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform2.credentialService)).list();
+      return chooseLinkedProject(links, profiles.find((profile2) => profile2.name === named)?.organizationId ?? void 0);
     });
     command = parsed.command;
-    if (parsed.linkedProjectId !== null)
-      io.writeStderr(`ohmyhost: using linked project ${parsed.linkedProjectId}
+    linked = parsed.linked;
+    if (linked !== null)
+      io.writeStderr(`ohmyhost: using linked project ${linked.projectId}
 `);
   } catch (error) {
-    const result2 = error instanceof InvalidCommandError ? invalidCommandFailure(recognizedCommandLabel(argv)) : errorDocument("unknown", 1, "internal_error", false, "Retry the command.");
+    if (error instanceof LinkedProjectAmbiguousError)
+      return written(errorDocument(recognizedCommandLabel(args), 2, "linked_project_selection_required", false, `This directory is linked to projects of several organizations (${error.organizationIds.join(", ")}). Pass --project ULID, or choose the login with --profile-name NAME; '${resolveProductCliEnvironment(environment).commandPrefix} profile list --json' shows the saved logins.`));
+    if (error instanceof CredentialStoreUnavailableError)
+      return written(errorDocument(recognizedCommandLabel(args), 3, "credential_store_unavailable", true, "Unlock or repair the selected credential store and retry."));
+    const result = error instanceof InvalidCommandError ? invalidCommandFailure(recognizedCommandLabel(args)) : errorDocument("unknown", 1, "internal_error", false, "Retry the command.");
     if (!(error instanceof InvalidCommandError)) {
       diagnostics.record({
-        correlationId: randomUUID(),
+        correlationId: randomUUID2(),
         category: "internal",
         subsystem: "parser",
         errorKind: "unexpected"
       });
     }
-    io.writeStdout(result2.stdout);
-    return result2.exitCode;
+    return written(result);
   }
   if (command.kind === "init") {
+    if (profileName !== void 0)
+      return written(invalidCommandFailure("init"));
     return runOfflineInit(command, io, diagnostics);
   }
   if (command.kind === "help" || command.kind === "version") {
-    const result2 = cliMetadataResult(command.kind, command.kind === "help" ? command.topic : void 0);
-    io.writeStdout(result2.stdout);
-    return result2.exitCode;
+    return written(cliMetadataResult(command.kind, command.kind === "help" ? command.topic : void 0));
   }
-  let profile;
+  let platform;
   try {
-    profile = resolveProductCliEnvironment(environment);
+    platform = resolveProductCliEnvironment(environment);
   } catch {
-    const result2 = errorDocument(recognizedCommandLabel(argv), 2, "invalid_environment", false, "Set OHMYHOST_ENVIRONMENT to development or production.");
-    io.writeStdout(result2.stdout);
-    return result2.exitCode;
+    return written(errorDocument(recognizedCommandLabel(args), 2, "invalid_environment", false, "Set OHMYHOST_ENVIRONMENT to development or production."));
   }
   let apiToken;
   try {
     apiToken = environmentToken(environment);
   } catch {
-    const result2 = errorDocument(recognizedCommandLabel(argv), 2, "invalid_environment_token", false, "Set OHMYHOST_TOKEN to a valid user API key, or unset it to use interactive login.");
-    io.writeStdout(result2.stdout);
-    return result2.exitCode;
+    return written(errorDocument(recognizedCommandLabel(args), 2, "invalid_environment_token", false, "Set OHMYHOST_TOKEN to a valid user API key, or unset it to use interactive login."));
   }
-  if (apiToken !== void 0 && (command.kind === "login" || command.kind === "logout")) {
-    const result2 = errorDocument(recognizedCommandLabel(argv), 2, "environment_token_active", false, "Unset OHMYHOST_TOKEN before changing interactive login credentials. Logout does not revoke a user API key.");
-    io.writeStdout(result2.stdout);
-    return result2.exitCode;
-  }
-  const selectedOverrides = {
-    ...overrides,
-    credentialStore: overrides.credentialStore ?? new NativeNapiKeyringCredentialStore(void 0, profile.credentialService)
-  };
-  if (command.kind === "logout" && !command.revoke) {
-    return runOfflineLogout(io, diagnostics, selectedOverrides);
+  let bound;
+  try {
+    bound = environmentProfile(environment);
+  } catch {
+    return written(errorDocument(recognizedCommandLabel(args), 2, "invalid_profile_binding", false, `Set OHMYHOST_PROFILE to the name of a saved login ('${platform.commandPrefix} profile list --json'), or unset it.`));
   }
-  const productApiOrigin = profile.apiOrigin;
+  if (apiToken !== void 0 && (command.kind === "login" || command.kind === "logout")) {
+    return written(errorDocument(recognizedCommandLabel(args), 2, "environment_token_active", false, "Unset OHMYHOST_TOKEN before changing interactive login credentials. Logout does not revoke a user API key."));
+  }
+  const requiredToken = command.kind === "secret-set" ? command.environmentToken : void 0;
+  const handedAccount2 = command.kind === "secret-set" ? requiredToken ?? command.profileAccount : void 0;
+  if (requiredToken !== void 0 && apiToken === void 0)
+    return written(errorDocument(recognizedCommandLabel(args), 2, "environment_token_required", false, `This command runs only with OHMYHOST_TOKEN holding a key of user ${requiredToken.userId} in organization ${requiredToken.organizationId}; a saved login cannot run it. Load that key from its private env file into this process and retry. Nothing was sent.`));
+  const registry = overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform.credentialService);
+  const linkDirectory = join3(workingDirectory, platform.linkDirectory);
+  const projectId = commandProjectId(command);
+  const organizationId = handedAccount2?.organizationId ?? commandOrganizationId(command) ?? linked?.organizationId ?? (projectId === void 0 ? void 0 : linkedOrganization(links, projectId));
+  const request = profileRequest({
+    ...profileName === void 0 ? {} : { name: profileName },
+    ...organizationId === void 0 || organizationId === null ? {} : { organizationId },
+    ...handedAccount2 === void 0 ? {} : { userId: handedAccount2.userId }
+  }, bound);
   const transport = new FetchWorkosPublicTransport(signal, REQUEST_TIMEOUT_MS);
+  const now = () => /* @__PURE__ */ new Date();
+  const refresher = new PublicWorkosTokenRefresher(environment);
+  const boundedFetch = () => createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES);
+  let profile;
+  try {
+    if (apiToken !== void 0) {
+      if (command.kind !== "profile-list")
+        await verifyEnvironmentTokenContext({
+          token: apiToken,
+          request,
+          registry,
+          baseUrl: platform.apiOrigin,
+          fetch: boundedFetch()
+        });
+      if (linked !== null && linked.organizationId === null)
+        await adoptLegacyLink({
+          links,
+          directory: linkDirectory,
+          repositoryRoot: workingDirectory,
+          apiOrigin: platform.apiOrigin,
+          organizationId: (await readTokenIdentity({
+            token: apiToken,
+            baseUrl: platform.apiOrigin,
+            fetch: boundedFetch()
+          })).organizationId,
+          accessToken: apiToken,
+          fetch: boundedFetch(),
+          actor: "OHMYHOST_TOKEN",
+          commandPrefix: platform.commandPrefix
+        });
+    } else if (command.kind === "logout" && !command.revoke) {
+      return await runOfflineLogout(registry, request, platform.commandPrefix, io, diagnostics);
+    } else if (command.kind !== "login") {
+      const profiles = await loadProfiles(registry, {
+        baseUrl: platform.apiOrigin,
+        fetch: boundedFetch(),
+        signal,
+        now,
+        refresher
+      });
+      if (command.kind !== "profile-list") {
+        const selection = command.kind === "organization-use" ? selectProfileForOrganization(profiles, {
+          ...request,
+          organizationId: command.organizationId
+        }) : selectProfile(profiles, request);
+        if (selection.outcome !== "selected")
+          throw profileSelectionError(selection, request, platform.commandPrefix, "cli");
+        profile = selection.profile;
+        io.writeStderr(`ohmyhost: acting as ${describeProfile(profile)}
+`);
+        if (linked !== null && linked.organizationId === null) {
+          const selected2 = await createAuthenticatedProductTransport(signal, {
+            environment,
+            profiles: registry,
+            request: { name: profile.name }
+          });
+          await adoptLegacyLink({
+            links,
+            directory: linkDirectory,
+            repositoryRoot: workingDirectory,
+            apiOrigin: platform.apiOrigin,
+            organizationId: profile.organizationId,
+            accessToken: selected2.accessToken,
+            fetch: selected2.fetch,
+            actor: `profile ${profile.name}`,
+            commandPrefix: platform.commandPrefix
+          });
+        }
+      }
+    }
+  } catch (error) {
+    return written(compositionFailure(recognizedCommandLabel(args), error, signal, platform.commandPrefix));
+  }
+  const selected = profile;
+  const productApiOrigin = platform.apiOrigin;
   const lifecycle = new GeneratedSdkSessionRevoker({
     environment,
-    credentialStore: selectedOverrides.credentialStore
+    profiles: registry,
+    ...selected === void 0 ? {} : { request: { name: selected.name } }
   });
   const cli = new ProductCli({
     ...apiToken === void 0 ? {} : { apiToken },
-    commandPrefix: profile.commandPrefix,
-    credentialStore: () => selectedOverrides.credentialStore,
+    commandPrefix: platform.commandPrefix,
+    profiles: registry,
+    ...selected === void 0 ? {} : { profile: selected },
+    // A login in a process bound to one saved login renews exactly that one.
+    ...(profileName ?? bound) === void 0 ? {} : { profileName: profileName ?? bound },
+    ...bound === void 0 ? {} : { profileBinding: bound },
     deviceFlow: new WorkosDeviceFlowClient({
-      clientId: profile.clientId,
+      clientId: platform.clientId,
       scope: "openid offline_access",
-      verificationUri: profile.verificationUri
-    }, transport, { now: () => /* @__PURE__ */ new Date() }),
+      verificationUri: platform.verificationUri
+    }, transport, { now }),
     deviceAuthorizationPresenter: new StderrDeviceAuthorizationPresenter(io),
-    productApi: (accessToken) => new GeneratedSdkProductApi(productApiOrigin, accessToken, createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES)),
-    // Login receives read-only workspace and GitHub queries instead of the product surface.
-    accountProfile: async (accessToken) => await new GeneratedSdkProductApi(productApiOrigin, accessToken, createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES)).getAccountProfile(),
-    githubConnectionStatus: (accessToken, organizationId) => getGithubOrganizationConnection({ organization_id: organizationId }, {
+    productApi: (accessToken) => new GeneratedSdkProductApi(productApiOrigin, accessToken, boundedFetch()),
+    // Login receives read-only identity, workspace and GitHub queries instead of the product surface.
+    accountProfile: async (accessToken) => await new GeneratedSdkProductApi(productApiOrigin, accessToken, boundedFetch()).getAccountProfile(),
+    currentIdentity: async (accessToken) => await new GeneratedSdkProductApi(productApiOrigin, accessToken, boundedFetch()).getCurrentIdentity(),
+    githubConnectionStatus: (accessToken, organizationId2) => getGithubOrganizationConnection({ organization_id: organizationId2 }, {
       client: createClient({
         baseUrl: productApiOrigin,
         auth: accessToken,
         throwOnError: true,
-        fetch: createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES)
+        fetch: boundedFetch()
       }),
       signal
     }),
-    projectLinkStore: new OwnerOnlyProjectLinkStore(join2(process.cwd(), profile.linkDirectory), process.cwd()),
-    productApiOrigin: profile.apiOrigin,
-    tokenRefresher: new PublicWorkosTokenRefresher(environment),
+    projectLinkStore: new OwnerOnlyProjectLinkStore(linkDirectory, workingDirectory),
+    productApiOrigin,
+    tokenRefresher: refresher,
     tokenRevoker: lifecycle,
-    now: () => /* @__PURE__ */ new Date(),
+    now,
     waitUntil,
     lifecycleTimeoutMs: REQUEST_TIMEOUT_MS,
-    createCorrelationId: randomUUID,
+    createCorrelationId: randomUUID2,
     diagnosticSink: diagnostics,
     operationEventSink: { write: (value) => io.writeStdout(value) },
     readSecretValue: overrides.readSecretValue ?? ((readSignal) => readSecretValueFromStandardInput(process.stdin, readSignal)),
     spawnPsql: runLocalPsql
   });
-  const result = await cli.runCommand(command, signal);
-  io.writeStdout(result.stdout);
-  if (result.stderr.length > 0)
-    io.writeStderr(result.stderr);
-  return result.exitCode;
+  return written(await cli.runCommand(command, signal));
+};
+var adoptLegacyLink = async (input) => {
+  const legacy = input.links.legacy;
+  if (legacy === null)
+    return;
+  const refuse = () => new ProfileSelectionError("linked_project_organization_mismatch", 2, `This directory's link names project ${legacy.project_id}, which ${input.actor} cannot see${input.organizationId === null ? "" : ` in organization ${input.organizationId}`}. Nothing was sent to it. Pass --project ULID or --profile-name NAME for the account that owns it, or run '${input.commandPrefix} link' again for this account.`);
+  let organizationId;
+  try {
+    const project = await getProject({ project_id: legacy.project_id }, {
+      client: createClient({
+        baseUrl: input.apiOrigin,
+        auth: input.accessToken,
+        fetch: input.fetch,
+        throwOnError: true
+      })
+    });
+    organizationId = project.organization_id;
+  } catch (error) {
+    if (isProblem(error, "resource_not_found") || isProblem(error, "forbidden"))
+      throw refuse();
+    throw error;
+  }
+  if (organizationId !== input.organizationId)
+    throw refuse();
+  await new OwnerOnlyProjectLinkStore(input.directory, input.repositoryRoot).save({
+    version: 2,
+    api_origin: input.apiOrigin,
+    organization_id: organizationId,
+    project_id: legacy.project_id,
+    installation_id: legacy.installation_id,
+    repository_full_name: legacy.repository_full_name
+  });
+  await removeLegacyProjectLink(input.directory);
+};
+var compositionFailure = (command, error, signal, commandPrefix) => {
+  if (error instanceof ProfileSelectionError)
+    return errorDocument(command, error.exitCode, error.code, false, error.suggestedAction);
+  if (error instanceof ProfileLimitError)
+    return errorDocument(command, 2, "profile_limit_reached", false, profileLimitAction(commandPrefix));
+  if (error instanceof ProductApiAuthenticationError)
+    return error.code === "authentication_required" ? errorDocument(command, 5, "authentication_required", false, `Run '${commandPrefix} login --json'.`) : errorDocument(command, 5, "token_refresh_failed", true, `Run '${commandPrefix} login --json' if retrying does not succeed.`);
+  return classifyCliFailure(command, error, signal);
 };
 var runOfflineInit = async (command, io, diagnostics) => {
   try {
@@ -25208,7 +26163,7 @@ var runOfflineInit = async (command, io, diagnostics) => {
   } catch (error) {
     const known = error instanceof RepositoryInitError;
     diagnostics.record({
-      correlationId: randomUUID(),
+      correlationId: randomUUID2(),
       category: known ? "configuration" : "internal",
       subsystem: "runtime",
       errorKind: known ? "invalid_response" : "unexpected"
@@ -25329,7 +26284,7 @@ var GeneratedSdkSessionRevoker = class {
         fetch: transport.fetch,
         throwOnError: true
       });
-      const result = await revokeCurrentSession({ "Idempotency-Key": randomUUID() }, { client: client2, signal });
+      const result = await revokeCurrentSession({ "Idempotency-Key": randomUUID2() }, { client: client2, signal });
       if (result.revoked !== true)
         throw new LifecycleTransportError();
     } catch (error) {
@@ -25339,25 +26294,27 @@ var GeneratedSdkSessionRevoker = class {
     }
   }
 };
-async function parseWithLinkedProject(argv, linkedProjectId) {
+var LinkedProjectAmbiguousError = class extends Error {
+  organizationIds;
+  constructor(organizationIds) {
+    super("Several organizations' links apply");
+    this.organizationIds = organizationIds;
+    this.name = "LinkedProjectAmbiguousError";
+  }
+};
+async function parseWithLinkedProject(argv, linkedProject) {
   try {
-    return { command: parseProductCliCommand(argv), linkedProjectId: null };
+    return { command: parseProductCliCommand(argv), linked: null };
   } catch (error) {
     if (!(error instanceof InvalidCommandError) || argv.includes("--project"))
       throw error;
-    let projectId;
-    try {
-      projectId = await linkedProjectId();
-    } catch {
-      projectId = null;
-    }
-    if (projectId === null)
+    const linked = await linkedProject();
+    if (linked.outcome === "ambiguous")
+      throw new LinkedProjectAmbiguousError(linked.organizationIds);
+    if (linked.outcome === "none")
       throw error;
     try {
-      return {
-        command: parseProductCliCommand([...argv, "--project", projectId]),
-        linkedProjectId: projectId
-      };
+      return { command: parseProductCliCommand([...argv, "--project", linked.projectId]), linked };
     } catch {
       throw error;
     }
@@ -25485,14 +26442,25 @@ var waitUntil = async (instant, signal) => {
 };
 var boundedSignal2 = (parent, timeoutMs) => AbortSignal.any([parent, AbortSignal.timeout(timeoutMs)]);
 var isAbortOrTimeout = (error) => error instanceof DOMException && (error.name === "AbortError" || error.name === "TimeoutError");
-var runOfflineLogout = async (io, diagnostics, overrides) => {
+var runOfflineLogout = async (registry, request, commandPrefix, io, diagnostics) => {
   let result;
   try {
-    await (overrides.credentialStore ?? new NativeNapiKeyringCredentialStore()).clear();
-    result = resultDocument("logout", 0, "logged_out");
+    const selection = selectProfile(await registry.list(), request);
+    if (selection.outcome === "selected") {
+      await registry.remove(selection.profile);
+      result = resultDocument("logout", 0, "logged_out", {
+        profile: publicProfile(selection.profile)
+      });
+    } else if (selection.outcome === "none" && request.name === void 0 && request.bound === void 0) {
+      await registry.legacy().clear();
+      result = resultDocument("logout", 0, "logged_out");
+    } else {
+      const failure2 = profileSelectionError(selection, request, commandPrefix, "cli");
+      result = errorDocument("logout", failure2.exitCode, failure2.code, false, failure2.suggestedAction);
+    }
   } catch {
     diagnostics.record({
-      correlationId: randomUUID(),
+      correlationId: randomUUID2(),
       category: "credential_store",
       subsystem: "credential_store",
       errorKind: "unavailable"
@@ -25533,9 +26501,9 @@ var readSecretValueFromStandardInput = async (input, signal) => {
   }
 };
 var invalidCommandFailure = (command) => errorDocument(command, 2, "invalid_command", false, "Check 'ohmyhost --help'.");
-var resultDocument = (command, exitCode, status) => ({
+var resultDocument = (command, exitCode, status, body = {}) => ({
   exitCode,
-  stdout: `${JSON.stringify({ version: 1, command, status })}
+  stdout: `${JSON.stringify({ version: 1, command, status, ...body })}
 `,
   stderr: ""
 });
@@ -25558,15 +26526,26 @@ var errorDocument = (command, exitCode, code, retryable, suggestedAction) => ({
 export {
   UserTokenFileError,
   prepareUserTokenFile,
+  ProfileNameConflictError,
+  ProfileLimitError,
+  isProfileName,
+  isProfileUserId,
+  sameLogin,
+  profileIndexDirectory,
+  NativeKeyringProfileRegistry,
+  ProfileIndexFiles,
+  selectProfile,
+  selectProfileForOrganization,
+  defaultProfileName,
+  publicProfile,
+  profileLimitAction,
+  ProfileSelectionError,
+  profileSelectionError,
+  describeProfile,
+  extractProfileName,
   InvalidCommandError,
   recognizedCommandLabel,
   parseProductCliCommand,
-  InteractiveSessionRequiredError,
-  chooseWorkspace,
-  selectWorkspace,
-  selectedWorkspaceId,
-  workspaceOf,
-  publicWorkspace,
   parsePaidDomainPlan,
   parsePaidDomain,
   parseCloudflareDnsAuthorization,
@@ -25578,6 +26557,15 @@ export {
   parseOperationEvent,
   parseSafeProblem,
   parseOperation,
+  InteractiveSessionRequiredError,
+  ProfileOrganizationFixedError,
+  AccountVerificationError,
+  chooseWorkspace,
+  verifiedUserId,
+  assertVerifiedLogin,
+  selectWorkspace,
+  workspaceOf,
+  publicWorkspace,
   NetworkTransportError,
   LifecycleTransportError,
   TokenRefreshRejectedError,
@@ -25587,8 +26575,13 @@ export {
   PsqlUnavailableError,
   cliMetadataResult,
   ProductCli,
+  ACCOUNT_SENSITIVE_PROBLEMS,
+  classifyCliFailure,
   GeneratedSdkProductApi,
-  readLinkedProjectId,
+  readProjectLinks,
+  chooseLinkedProject,
+  linkedOrganization,
+  removeLegacyProjectLink,
   OwnerOnlyProjectLinkStore,
   RepositoryInitError,
   RepositoryInitBlockedError,
@@ -25598,10 +26591,13 @@ export {
   resolveProductCliEnvironment,
   createProductionAuthenticatedProductApi,
   createAuthenticatedProductTransport,
+  listSavedProfiles,
+  loadProfiles,
   runProductionCli,
   StderrDeviceAuthorizationPresenter,
   PublicWorkosTokenRefresher,
   GeneratedSdkSessionRevoker,
+  LinkedProjectAmbiguousError,
   parseWithLinkedProject,
   readBoundedResponseBody,
   createBoundedFetch,