@amerged/ohmyhost-mcp 0.1.18 → 0.1.20

package/dist/stdio-main.js

@@ -26,7 +26,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-X6IS5LX7.js";
+} from "./chunk-NESQZ3BS.js";
 
 // node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
 var StdioServerTransport = class {
@@ -799,7 +799,7 @@ function exact2(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.18",
+  version: "0.1.20",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -1210,6 +1210,15 @@ function expectPositiveInteger(value, field, options = {}) {
   return value;
 }
 
+// packages/workos-auth-contracts/dist/user-api-keys.js
+var WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
+
+// apps/product-cli/dist/profile-store.js
+import { randomUUID } from "node:crypto";
+import { link, mkdir as mkdir2, open as open2, readFile, readdir, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
 // apps/product-cli/dist/credential-store.js
 var CredentialStoreUnavailableError = class extends Error {
   constructor() {
@@ -1223,10 +1232,12 @@ var CredentialStoreIntegrityError = class extends Error {
     this.name = "CredentialStoreIntegrityError";
   }
 };
-var CREDENTIAL_ACCOUNT = "credential";
+var LEGACY_CREDENTIAL_ACCOUNT = "credential";
 var NativeNapiKeyringCredentialStore = class {
+  account;
   createEntry;
-  constructor(createEntry = void 0, serviceName = "ohmyhost") {
+  constructor(createEntry = void 0, serviceName = "ohmyhost", account = LEGACY_CREDENTIAL_ACCOUNT) {
+    this.account = account;
     this.createEntry = createEntry ?? createNativeEntryFactory(serviceName);
   }
   async read() {
@@ -1248,7 +1259,7 @@ var NativeNapiKeyringCredentialStore = class {
       throw new CredentialStoreIntegrityError();
   }
   entry() {
-    return this.createEntry(CREDENTIAL_ACCOUNT);
+    return this.createEntry(this.account);
   }
 };
 var parseVerifiedCredential = (serialized) => {
@@ -1301,6 +1312,340 @@ var parseCredential = (serialized) => {
   };
 };
 
+// apps/product-cli/dist/profile-store.js
+var ProfileNameConflictError = class extends Error {
+  profile;
+  constructor(profile) {
+    super("The profile name is used by another saved login");
+    this.profile = profile;
+    this.name = "ProfileNameConflictError";
+  }
+};
+var ProfileLimitError = class extends Error {
+  saved;
+  constructor(saved) {
+    super("The saved logins of this environment reached their limit");
+    this.saved = saved;
+    this.name = "ProfileLimitError";
+  }
+};
+var MAX_PROFILES = 64;
+var MAX_INDEX_ATTEMPTS = 64;
+var INDEX_FILE = /^index-([1-9][0-9]{0,14})\.json$/u;
+var SERVICE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+var PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,62}$/u;
+var USER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
+var ORGANIZATION_ID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+var isProfileName = (value) => PROFILE_NAME.test(value);
+var isProfileUserId = (value) => USER_ID.test(value);
+var profileAccount = (profile) => `profile:${profile.userId}:${profile.organizationId ?? "none"}`;
+var sameLogin = (left, right) => profileAccount(left) === profileAccount(right);
+var profileIndexDirectory = (serviceName) => join(homedir(), ".ohmyhost", "profiles", serviceName);
+var nextProfileIndex = (current, profile, replaces) => [
+  ...current.filter((saved) => !sameLogin(saved, profile) && (replaces === void 0 || !sameLogin(saved, replaces))),
+  profile
+];
+var admitProfile = (next, profile) => {
+  const conflict = next.find((saved) => saved.name === profile.name && saved !== profile);
+  if (conflict !== void 0)
+    throw new ProfileNameConflictError(conflict);
+  if (next.length > MAX_PROFILES)
+    throw new ProfileLimitError(next.length - 1);
+};
+var NativeKeyringProfileRegistry = class {
+  serviceName;
+  #createEntry;
+  #index;
+  constructor(createEntry = void 0, serviceName = "ohmyhost", indexDirectory) {
+    this.serviceName = serviceName;
+    if (!SERVICE_NAME.test(serviceName))
+      throw new CredentialStoreUnavailableError();
+    this.#createEntry = createEntry ?? createNativeEntryFactory(serviceName);
+    this.#index = new ProfileIndexFiles(indexDirectory ?? profileIndexDirectory(serviceName));
+  }
+  async list() {
+    return (await this.#index.read()).profiles;
+  }
+  credential(profile) {
+    return new NativeNapiKeyringCredentialStore(this.#createEntry, this.serviceName, profileAccount(profile));
+  }
+  legacy() {
+    return new NativeNapiKeyringCredentialStore(this.#createEntry, this.serviceName, LEGACY_CREDENTIAL_ACCOUNT);
+  }
+  async save(profile, credential, replaces) {
+    assertProfile(profile);
+    const before = await this.list();
+    admitProfile(nextProfileIndex(before, profile, replaces), profile);
+    await this.credential(profile).replace(credential);
+    try {
+      await this.#index.update((current) => {
+        const next = nextProfileIndex(current, profile, replaces);
+        admitProfile(next, profile);
+        return next;
+      });
+    } catch (error) {
+      if (!before.some((saved) => sameLogin(saved, profile)))
+        await this.credential(profile).clear();
+      throw error;
+    }
+    if (replaces !== void 0 && !sameLogin(replaces, profile))
+      await this.credential(replaces).clear();
+  }
+  async remove(profile) {
+    await this.credential(profile).clear();
+    await this.#index.update((current) => current.some((saved) => sameLogin(saved, profile)) ? current.filter((saved) => !sameLogin(saved, profile)) : void 0);
+  }
+};
+var ProfileIndexFiles = class {
+  directory;
+  constructor(directory) {
+    this.directory = directory;
+  }
+  async read() {
+    for (let attempt = 0; attempt < MAX_INDEX_ATTEMPTS; attempt += 1) {
+      const version2 = await this.#newest();
+      if (version2 === 0)
+        return { version: version2, profiles: [] };
+      let serialized;
+      try {
+        serialized = await readFile(this.#file(version2), "utf8");
+      } catch (error) {
+        if (fileErrorCode(error) === "ENOENT")
+          continue;
+        throw new CredentialStoreUnavailableError();
+      }
+      return { version: version2, profiles: parseProfileIndex(serialized) };
+    }
+    throw new CredentialStoreUnavailableError();
+  }
+  /** Applies `change` to the newest index; `undefined` means nothing to change. */
+  async update(change) {
+    try {
+      await mkdir2(this.directory, { recursive: true, mode: 448 });
+    } catch {
+      throw new CredentialStoreUnavailableError();
+    }
+    for (let attempt = 0; attempt < MAX_INDEX_ATTEMPTS; attempt += 1) {
+      const { version: version2, profiles } = await this.read();
+      const next = change(profiles);
+      if (next === void 0)
+        return;
+      const temporary = join(this.directory, `.index-${randomUUID()}.tmp`);
+      try {
+        await writeDurably(temporary, serializeProfileIndex(next));
+        await link(temporary, this.#file(version2 + 1));
+      } catch (error) {
+        if (fileErrorCode(error) === "EEXIST")
+          continue;
+        throw new CredentialStoreUnavailableError();
+      } finally {
+        await removeTemporary(temporary);
+      }
+      if (await this.#newest() !== version2 + 1)
+        continue;
+      await this.#prune(version2);
+      return;
+    }
+    throw new CredentialStoreUnavailableError();
+  }
+  async #newest() {
+    let names;
+    try {
+      names = await readdir(this.directory);
+    } catch (error) {
+      if (fileErrorCode(error) === "ENOENT")
+        return 0;
+      throw new CredentialStoreUnavailableError();
+    }
+    return names.reduce((newest, name) => Math.max(newest, indexVersion(name)), 0);
+  }
+  /**
+   * Keeps the superseded version for readers that listed it just now; older ones go. Cleanup only:
+   * a file left behind is ignored, since readers take the newest version, and another process may
+   * be removing the same files at this moment.
+   */
+  async #prune(superseded) {
+    let names;
+    try {
+      names = await readdir(this.directory);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const version2 = indexVersion(name);
+      if (version2 === 0 || version2 >= superseded)
+        continue;
+      try {
+        await unlink(join(this.directory, name));
+      } catch {
+      }
+    }
+  }
+  #file(version2) {
+    return join(this.directory, `index-${String(version2)}.json`);
+  }
+};
+var indexVersion = (name) => Number(INDEX_FILE.exec(name)?.[1] ?? 0);
+var removeTemporary = async (path) => {
+  try {
+    await unlink(path);
+  } catch {
+  }
+};
+var fileErrorCode = (error) => typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
+var writeDurably = async (path, text) => {
+  const handle = await open2(path, "wx", 384);
+  try {
+    await handle.writeFile(text, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+};
+var serializeProfileIndex = (profiles) => JSON.stringify({
+  version: 1,
+  profiles: [...profiles].sort((left, right) => left.name < right.name ? -1 : 1).map((profile) => ({
+    name: profile.name,
+    user_id: profile.userId,
+    organization_id: profile.organizationId,
+    organization_name: profile.organizationName
+  }))
+});
+var parseProfileIndex = (serialized) => {
+  try {
+    const value = JSON.parse(serialized);
+    if (!isRecord(value, ["version", "profiles"]) || value["version"] !== 1)
+      throw new Error("Invalid profile index");
+    const entries = value["profiles"];
+    if (!Array.isArray(entries) || entries.length > MAX_PROFILES)
+      throw new Error("Invalid profile index");
+    const profiles = entries.map((entry) => {
+      if (!isRecord(entry, ["name", "user_id", "organization_id", "organization_name"]))
+        throw new Error("Invalid profile");
+      const profile = {
+        name: entry["name"],
+        userId: entry["user_id"],
+        organizationId: entry["organization_id"],
+        organizationName: entry["organization_name"]
+      };
+      assertProfile(profile);
+      return profile;
+    });
+    if (new Set(profiles.map((profile) => profile.name)).size !== profiles.length || new Set(profiles.map(profileAccount)).size !== profiles.length)
+      throw new Error("Duplicate profile");
+    return profiles;
+  } catch {
+    throw new CredentialStoreIntegrityError();
+  }
+};
+var assertProfile = (profile) => {
+  if (typeof profile.name !== "string" || !PROFILE_NAME.test(profile.name) || typeof profile.userId !== "string" || !USER_ID.test(profile.userId) || !(profile.organizationId === null || typeof profile.organizationId === "string" && ORGANIZATION_ID.test(profile.organizationId)) || !(profile.organizationName === null || typeof profile.organizationName === "string" && profile.organizationName.length > 0 && profile.organizationName.length <= 128 && !new RegExp("\\p{Cc}", "u").test(profile.organizationName)) || profile.organizationId === null && profile.organizationName !== null)
+    throw new CredentialStoreIntegrityError();
+};
+var isRecord = (value, keys) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).sort().join(",") === [...keys].sort().join(",");
+var selectProfile = (profiles, request) => {
+  if (request.name !== void 0 && request.bound !== void 0 && request.name !== request.bound)
+    return { outcome: "conflict", field: "binding", profile: null };
+  const named = request.name ?? request.bound;
+  if (named !== void 0) {
+    const profile = profiles.find((saved) => saved.name === named);
+    if (profile === void 0)
+      return { outcome: "not_found" };
+    if (request.organizationId !== void 0 && profile.organizationId !== request.organizationId)
+      return { outcome: "conflict", field: "organization", profile };
+    if (request.userId !== void 0 && profile.userId !== request.userId)
+      return { outcome: "conflict", field: "user", profile };
+    return { outcome: "selected", profile };
+  }
+  const candidates = profiles.filter((profile) => (request.organizationId === void 0 || profile.organizationId === request.organizationId) && (request.userId === void 0 || profile.userId === request.userId));
+  const only = candidates[0];
+  if (candidates.length === 1 && only !== void 0)
+    return { outcome: "selected", profile: only };
+  if (candidates.length > 1)
+    return { outcome: "ambiguous", candidates };
+  return profiles.length === 0 ? { outcome: "none" } : { outcome: "not_found" };
+};
+var selectProfileForOrganization = (profiles, request) => {
+  const user = request.userId === void 0 ? {} : { userId: request.userId };
+  if (request.name !== void 0 || request.bound !== void 0)
+    return selectProfile(profiles, {
+      ...request.name === void 0 ? {} : { name: request.name },
+      ...request.bound === void 0 ? {} : { bound: request.bound },
+      ...user
+    });
+  const candidates = profiles.filter((profile) => request.userId === void 0 || profile.userId === request.userId);
+  const inOrganization = candidates.filter((profile) => profile.organizationId === request.organizationId);
+  if (inOrganization.length > 1)
+    return { outcome: "ambiguous", candidates: inOrganization };
+  const unscoped = candidates.filter((profile) => profile.organizationId === null);
+  const [member] = inOrganization;
+  if (member !== void 0)
+    return { outcome: "selected", profile: member };
+  const [open4] = unscoped;
+  if (unscoped.length === 1 && open4 !== void 0)
+    return { outcome: "selected", profile: open4 };
+  return selectProfile(profiles, user);
+};
+var defaultProfileName = (profiles, login) => {
+  const same = profiles.find((profile) => profile.userId === login.userId && profile.organizationId === login.organizationId);
+  if (same !== void 0)
+    return same.name;
+  const base = slug(login.organizationName ?? "") || (login.organizationId === null ? "account" : "workspace");
+  const free = (name) => profiles.every((profile) => profile.name !== name);
+  if (free(base))
+    return base;
+  const suffix = (login.organizationId ?? login.userId).replace(/[^A-Za-z0-9]/gu, "").slice(-6).toLowerCase();
+  for (let attempt = 1; attempt <= profiles.length + 1; attempt += 1) {
+    const candidate = `${base.slice(0, 48)}-${suffix}${attempt === 1 ? "" : `-${String(attempt)}`}`;
+    if (free(candidate))
+      return candidate;
+  }
+  throw new CredentialStoreIntegrityError();
+};
+var slug = (value) => value.normalize("NFKD").replace(/[\u0300-\u036f]/gu, "").toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+/u, "").slice(0, 40).replace(/-+$/u, "");
+var publicProfile = (profile) => ({
+  name: profile.name,
+  user_id: profile.userId,
+  organization_id: profile.organizationId,
+  organization_name: profile.organizationName
+});
+var profileLimitAction = (commandPrefix) => `Nothing was saved: this environment already keeps ${String(MAX_PROFILES)} saved logins, the most one computer holds. Remove one you no longer need with '${commandPrefix} logout --profile-name NAME --json' ('${commandPrefix} profile list --json' shows them), then retry.`;
+var ProfileSelectionError = class extends Error {
+  code;
+  exitCode;
+  suggestedAction;
+  constructor(code, exitCode, suggestedAction) {
+    super(`${code}: ${suggestedAction}`);
+    this.code = code;
+    this.exitCode = exitCode;
+    this.suggestedAction = suggestedAction;
+    this.name = "ProfileSelectionError";
+  }
+};
+var profileSelectionError = (selection, request, commandPrefix, selector) => {
+  const choose = selector === "cli" ? `pass --profile-name NAME (see '${commandPrefix} profile list --json') or set OHMYHOST_PROFILE for this process` : "pass profile_name (see profile_list) or set OHMYHOST_PROFILE in this MCP server's configuration";
+  const login = `${commandPrefix} login${request.organizationId === void 0 ? "" : ` --organization ${request.organizationId}`}${request.userId === void 0 ? "" : ` --user ${request.userId}`}${(request.name ?? request.bound) === void 0 ? "" : ` --profile-name ${String(request.name ?? request.bound)}`} --json`;
+  if (selection.outcome === "none")
+    return new ProfileSelectionError("authentication_required", 5, `No login is saved on this computer. Run '${login}'.`);
+  if (selection.outcome === "not_found")
+    return new ProfileSelectionError("profile_not_found", 5, `No saved login matches ${describeRequest(request)}. Run '${login}' to add it, signing in as that user; '${commandPrefix} profile list --json' shows the saved logins.`);
+  if (selection.outcome === "ambiguous")
+    return new ProfileSelectionError("profile_selection_required", 2, `Several saved logins could run this: ${selection.candidates.map((profile2) => profile2.name).join(", ")}. Ask the customer which account to use, then ${choose}.`);
+  if (selection.field === "binding")
+    return new ProfileSelectionError("profile_context_mismatch", 2, `This call names profile ${String(request.name)}, but the process is bound to OHMYHOST_PROFILE=${String(request.bound)}. Use the bound profile or start a process for the other one.`);
+  const profile = selection.profile;
+  return new ProfileSelectionError("profile_context_mismatch", 2, selection.field === "organization" ? `Profile ${String(profile?.name)} is signed in to organization ${String(profile?.organizationId ?? "none")}, but this targets organization ${String(request.organizationId)}. Use the profile of that organization or change the target; nothing was sent.` : `Profile ${String(profile?.name)} belongs to user ${String(profile?.userId)}, not ${String(request.userId)}. Use that user's profile; nothing was sent.`);
+};
+var describeRequest = (request) => {
+  const parts = [
+    ...(request.name ?? request.bound) === void 0 ? [] : [`profile ${String(request.name ?? request.bound)}`],
+    ...request.organizationId === void 0 ? [] : [`organization ${request.organizationId}`],
+    ...request.userId === void 0 ? [] : [`user ${request.userId}`]
+  ];
+  return parts.length === 0 ? "this request" : parts.join(", ");
+};
+var describeProfile = (profile) => `profile ${profile.name} (user ${profile.userId}, ${profile.organizationId === null ? "no organization" : `organization ${profile.organizationName === null ? "" : `${profile.organizationName} `}${profile.organizationId}`})`;
+
 // apps/product-cli/dist/device-token-expiry.js
 var DeviceTokenExpiryError = class extends Error {
   constructor() {
@@ -1375,46 +1720,6 @@ var resolveDeviceTokenExpiresAt = (accessToken, expiresInSeconds, now) => {
   return new Date(jwtExpiryMilliseconds).toISOString();
 };
 
-// apps/product-cli/dist/workspace.js
-var InteractiveSessionRequiredError = class extends Error {
-  constructor() {
-    super("Workspace selection requires an interactive login");
-    this.name = "InteractiveSessionRequiredError";
-  }
-};
-var chooseWorkspace = (organizations, requested) => {
-  if (requested !== void 0) {
-    const match = organizations.find((organization) => organization.id === requested);
-    return match === void 0 ? { outcome: "not_a_member", organizations } : { outcome: "selected", organization: match };
-  }
-  if (organizations.length === 0)
-    return { outcome: "no_workspace" };
-  const only = organizations[0];
-  if (organizations.length === 1 && only !== void 0)
-    return { outcome: "selected", organization: only };
-  return { outcome: "choice_required", organizations };
-};
-var selectWorkspace = async (session, organization, signal) => {
-  const stored = await session.store.read();
-  if (stored === void 0)
-    throw new InteractiveSessionRequiredError();
-  const refreshed = await session.refresher.refresh(stored.refreshToken, signal, organization.workos_id);
-  await session.store.replace({
-    ...refreshed,
-    workosOrganizationId: organization.workos_id,
-    organizationId: organization.id
-  });
-};
-var selectedWorkspaceId = async (session) => (await session.store.read())?.organizationId ?? null;
-var workspaceOf = (credential) => ({
-  ...credential.workosOrganizationId === void 0 ? {} : { workosOrganizationId: credential.workosOrganizationId },
-  ...credential.organizationId === void 0 ? {} : { organizationId: credential.organizationId }
-});
-var publicWorkspace = (organization) => ({
-  id: organization.id,
-  name: organization.name
-});
-
 // packages/contracts/dist/feedback.js
 var FEEDBACK_HISTORY_PAGE_SIZE = 25;
 var FEEDBACK_REPLY_MAX_LENGTH = 2e3;
@@ -1648,7 +1953,7 @@ var PROBLEM_POLICY = {
   github_connection_required: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for this workspace, complete its browser link, then repeat the original source link."
+    action: "This workspace has no GitHub connection yet. Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for it, complete its browser link, then repeat the original source link. If the project belongs to another account, use that account's login instead; error.acting_as names the login this ran as."
   },
   github_connection_revoked: {
     status: 409,
@@ -1722,7 +2027,11 @@ var PROBLEM_POLICY = {
     retryable: false,
     action: "Run 'ohmyhost organization list --json' and select one with 'ohmyhost organization use --organization ULID --json', or create the first workspace."
   },
-  resource_not_found: { status: 404, retryable: false, action: "Check the resource identifier." },
+  resource_not_found: {
+    status: 404,
+    retryable: false,
+    action: "Check the resource identifier and the account: a project is visible only to its own organization, and error.acting_as names the login this ran as. Use the login of the account that owns it."
+  },
   idempotency_key_reused: {
     status: 409,
     retryable: false,
@@ -2034,7 +2343,7 @@ var parseAccountProfile = (value) => {
   });
   if (new Set(workspaces.map((workspace) => workspace.id)).size !== organizationIds.length)
     throw new ResponseContractError();
-  return workspaces;
+  return { userId: input["user_id"], organizations: workspaces };
 };
 var parseSafeProblem = (value) => {
   const input = exactRecord2(value, [
@@ -2089,7 +2398,7 @@ var parseOperation = (value) => {
   const blockingOperationId = input["blocking_operation_id"];
   if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3))
     throw new ResponseContractError();
-  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord(result)) {
+  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord2(result)) {
     throw new ResponseContractError();
   }
   let progress;
@@ -2150,12 +2459,12 @@ function parseOperationFailure(value) {
   return safe;
 }
 var exactRecord2 = (value, allowed) => {
-  if (!isRecord(value) || Object.keys(value).some((key) => !allowed.includes(key))) {
+  if (!isRecord2(value) || Object.keys(value).some((key) => !allowed.includes(key))) {
     throw new ResponseContractError();
   }
   return value;
 };
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var boundedString = (value, minimum, maximum) => typeof value === "string" && value.length >= minimum && value.length <= maximum;
 var isUlid = (value) => typeof value === "string" && /^[0-9A-HJKMNP-TV-Z]{26}$/u.test(value);
 var isIsoInstant = (value) => typeof value === "string" && value.length <= 64 && Number.isFinite(Date.parse(value));
@@ -2178,6 +2487,79 @@ var isPaidValidationRecord = (value) => {
   return (record5["type"] === "CNAME" || record5["type"] === "TXT") && boundedString(record5["name"], 1, 253) && boundedString(record5["content"], 1, 2048) && ["traffic", "ownership", "ssl", "dcv_delegation"].includes(String(record5["purpose"]));
 };
 
+// apps/product-cli/dist/workspace.js
+var InteractiveSessionRequiredError = class extends Error {
+  constructor() {
+    super("Workspace selection requires an interactive login");
+    this.name = "InteractiveSessionRequiredError";
+  }
+};
+var ProfileOrganizationFixedError = class extends Error {
+  profile;
+  organization;
+  constructor(profile, organization) {
+    super("The saved login is bound to another organization");
+    this.profile = profile;
+    this.organization = organization;
+    this.name = "ProfileOrganizationFixedError";
+  }
+};
+var AccountVerificationError = class extends Error {
+  constructor() {
+    super("The signed-in account does not match the requested one");
+    this.name = "AccountVerificationError";
+  }
+};
+var chooseWorkspace = (organizations, requested) => {
+  if (requested !== void 0) {
+    const match = organizations.find((organization) => organization.id === requested);
+    return match === void 0 ? { outcome: "not_a_member", organizations } : { outcome: "selected", organization: match };
+  }
+  if (organizations.length === 0)
+    return { outcome: "no_workspace" };
+  const only = organizations[0];
+  if (organizations.length === 1 && only !== void 0)
+    return { outcome: "selected", organization: only };
+  return { outcome: "choice_required", organizations };
+};
+var verifiedUserId = (identity) => {
+  const actor = parseCurrentIdentity(identity).actor_id;
+  if (!actor.startsWith("user:") || actor.length === 5)
+    throw new AccountVerificationError();
+  return actor.slice(5);
+};
+var assertVerifiedLogin = (identity, userId, organizationId) => {
+  const organizations = parseCurrentIdentity(identity).organization_ids;
+  if (verifiedUserId(identity) !== userId || (organizationId === null ? organizations.length !== 0 : organizations.length !== 1 || organizations[0] !== organizationId))
+    throw new AccountVerificationError();
+};
+var selectWorkspace = async (session, organization, signal, identity) => {
+  if (session.profile.organizationId === organization.id)
+    return session.profile;
+  if (session.profile.organizationId !== null)
+    throw new ProfileOrganizationFixedError(session.profile, organization);
+  const stored = await session.store.read();
+  if (stored === void 0)
+    throw new InteractiveSessionRequiredError();
+  const refreshed = await session.refresher.refresh(stored.refreshToken, signal, organization.workos_id);
+  assertVerifiedLogin(await identity(refreshed.accessToken), session.profile.userId, organization.id);
+  const bound = {
+    ...session.profile,
+    organizationId: organization.id,
+    organizationName: organization.name
+  };
+  await session.profiles.save(bound, { ...refreshed, workosOrganizationId: organization.workos_id, organizationId: organization.id }, session.profile);
+  return bound;
+};
+var workspaceOf = (credential) => ({
+  ...credential.workosOrganizationId === void 0 ? {} : { workosOrganizationId: credential.workosOrganizationId },
+  ...credential.organizationId === void 0 ? {} : { organizationId: credential.organizationId }
+});
+var publicWorkspace = (organization) => ({
+  id: organization.id,
+  name: organization.name
+});
+
 // apps/product-cli/dist/cli.js
 var NetworkTransportError = class extends Error {
   constructor() {
@@ -2206,9 +2588,10 @@ var PublicResponseTooLargeError = class extends Error {
 var CLI_VERSION = package_default.version;
 var HELP_USAGE = Object.freeze({
   init: "ohmyhost init [--directory PATH] [--root PATH] [--project SLUG] [--region us|eu] [--dry-run] --json (pass the project's hosting region so storage.jurisdiction matches it; us when omitted)",
-  login: "ohmyhost login [--organization ULID] --json",
-  logout: "ohmyhost logout [--revoke] --json",
-  whoami: "ohmyhost whoami --json",
+  login: "ohmyhost login [--organization ULID] [--user USER_ID] [--profile-name NAME] --json (adds one saved login; nothing is saved unless the browser signed in as that user and organization)",
+  logout: "ohmyhost logout [--profile-name NAME] [--revoke] --json (removes only the selected saved login)",
+  whoami: "ohmyhost whoami [--profile-name NAME] --json (the effective user, organization and saved login)",
+  "profile list": "ohmyhost profile list --json (saved logins on this computer: name, user and organization, never a token; pass --profile-name NAME or set OHMYHOST_PROFILE to choose one)",
   "github connect": "ohmyhost github connect --organization ULID --idempotency-key KEY --json (connect once, then link covered repositories without another browser consent)",
   "github status": "ohmyhost github status --organization ULID --json",
   "export create": "ohmyhost export create --project ULID --idempotency-key KEY --stdin --json (password on stdin only; one accepted SQL ZIP per project per 24 hours)",
@@ -2223,9 +2606,9 @@ var HELP_USAGE = Object.freeze({
   "credits usage": "ohmyhost credits usage --organization ULID --month YYYY-MM [--cursor ULID] --json",
   "budget get": "ohmyhost budget get --project ULID --json",
   "budget set": "ohmyhost budget set --project ULID --credits NUMBER|none [--mode continue|stop] --idempotency-key KEY --json",
-  "organization create": "ohmyhost organization create --name NAME --idempotency-key KEY [--source SOURCE] --json (SOURCE is optional attribution from a link's r value; the new workspace is selected immediately)",
-  "organization list": "ohmyhost organization list --json (the workspaces you belong to and the selected one)",
-  "organization use": "ohmyhost organization use --organization ULID --json",
+  "organization create": "ohmyhost organization create --name NAME --idempotency-key KEY [--source SOURCE] --json (SOURCE is optional attribution from a link's r value; a login without organization is bound to the new workspace, another login keeps its own)",
+  "organization list": "ohmyhost organization list [--profile-name NAME] --json (the workspaces of the chosen login's user and the one that login is scoped to)",
+  "organization use": "ohmyhost organization use --organization ULID [--profile-name NAME] --json (binds a login that has no organization yet; another organization needs its own login)",
   "operation get": "ohmyhost operation get OPERATION_ULID --json",
   "operation reconcile": "ohmyhost operation reconcile OPERATION_ULID --idempotency-key KEY --yes --json",
   "token create": "ohmyhost token create --organization ULID --name NAME --idempotency-key KEY --out .env.local --json",
@@ -2275,7 +2658,7 @@ var HELP_USAGE = Object.freeze({
   delete: "ohmyhost delete --project ULID --if-match ETAG --confirmation-token TOKEN --idempotency-key KEY --yes --json",
   "secret list": "ohmyhost secret list --project ULID --environment ENVIRONMENT_ULID --json",
   "function runs": "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
-  "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY --stdin [--wait] --json`,
+  "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)`,
   "secret delete": "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
   "mail setup": "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
   "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
@@ -2291,6 +2674,14 @@ var HELP_USAGE = Object.freeze({
 });
 var HELP_COMMANDS = Object.freeze(Object.entries(HELP_USAGE).map(([command, usage]) => Object.freeze({ command, usage })));
 var SIGN_IN_WINDOW_MS = 30 * 60 * 1e3;
+var ACCOUNT_SENSITIVE_PROBLEMS = /* @__PURE__ */ new Set([
+  "resource_not_found",
+  "forbidden",
+  "organization_required",
+  "github_connection_required",
+  "github_connection_revoked",
+  "repository_not_installed"
+]);
 
 // packages/sdk-ts/dist/generated/core/bodySerializer.gen.js
 var jsonBodySerializer = {
@@ -3855,6 +4246,47 @@ var getProjectSource = (parameters, options) => {
     ...params
   });
 };
+var getProjectSourceAutoDeploy = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/source/auto-deploy",
+    ...options,
+    ...params
+  });
+};
+var configureProjectSourceAutoDeploy = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "configureSourceAutoDeployRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/source/auto-deploy",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 var createCloudflareDnsAuthorization = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -3921,6 +4353,24 @@ var changeProjectHandle = (parameters, options) => {
     }
   });
 };
+var configureProjectDomains = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/domains",
+    ...options,
+    ...params
+  });
+};
 var planPaidProjectDomain = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -4113,6 +4563,24 @@ var getDeploymentLogs = (parameters, options) => {
     ...params
   });
 };
+var streamDeploymentLogs = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "deployment_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).sse.get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/deployments/{deployment_id}/logs/events",
+    ...options,
+    ...params
+  });
+};
 var getDatabaseCompute = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -4398,6 +4866,32 @@ var deleteEnvironmentSecret = (parameters, options) => {
     ...params
   });
 };
+var putEnvironmentSecret = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "secret_name" },
+        { key: "putEnvironmentSecretRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/secrets/{secret_name}",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 var getOperation = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -4847,9 +5341,6 @@ async function executeManagedMail(client2, input) {
   return result;
 }
 
-// packages/workos-auth-contracts/dist/user-api-keys.js
-var WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
-
 // packages/workos-auth-contracts/dist/device-flow.js
 var WORKOS_AUTHKIT_DEVICE_TOKEN_ENDPOINT = "https://api.workos.com/user_management/authenticate";
 var allowedDeviceTokenFields = /* @__PURE__ */ new Set([
@@ -4881,8 +5372,404 @@ var parseDeviceTokens = (value) => {
   };
 };
 
-// apps/product-cli/dist/repository-init.js
-var MAXIMUM_PACKAGE_BYTES = 1024 * 1024;
+// apps/product-cli/dist/product-api.js
+var GeneratedSdkProductApi = class {
+  #client;
+  constructor(baseUrl, accessToken, fetch2) {
+    this.#client = createClient({ auth: accessToken, baseUrl, fetch: fetch2, throwOnError: true });
+  }
+  async changeDatabaseCompute(input) {
+    return changeDatabaseCompute({
+      project_id: input.projectId,
+      environment: input.environment,
+      profile: input.profile,
+      confirm: true,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client });
+  }
+  async getDatabaseCompute(input) {
+    const value = await getDatabaseCompute({ project_id: input.projectId, environment: input.environment }, { client: this.#client });
+    assertDatabaseCompute(value);
+    if (value.project_id !== input.projectId || value.environment !== input.environment)
+      throw new TypeError("Compute response scope mismatch");
+    return value;
+  }
+  async getProjectContext(projectId) {
+    const result = await getProjectContext({ project_id: projectId }, { client: this.#client });
+    assertProjectContext(result);
+    if (result.project_id !== projectId)
+      throw new TypeError("Project context scope mismatch");
+    return result;
+  }
+  async setProjectNotes(input) {
+    const result = await setProjectNotes({
+      project_id: input.projectId,
+      markdown: input.markdown,
+      expected_version: input.expectedVersion,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client });
+    assertProjectNotesReceipt(result);
+    return result;
+  }
+  createProjectExport(input) {
+    return createProjectExport({
+      project_id: input.projectId,
+      password: input.password,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client });
+  }
+  async getProjectExport(input) {
+    const result = await getProjectExport({ project_id: input.projectId, export_id: input.exportId }, { client: this.#client });
+    assertProjectExport(result);
+    return result;
+  }
+  async getCurrentIdentity() {
+    return getCurrentIdentity({}, { client: this.#client });
+  }
+  async getAccountProfile() {
+    return parseAccountProfile(await getAccountProfile({ client: this.#client }));
+  }
+  getOrganizationAccount(organizationId) {
+    return getOrganizationAccount({ organization_id: organizationId }, { client: this.#client });
+  }
+  getOrganizationCredits(organizationId) {
+    return getOrganizationCredits({ organization_id: organizationId }, { client: this.#client });
+  }
+  async createUserApiKey(input) {
+    return parseUserApiKeyCreation(await createUserApiKey({
+      organization_id: input.organizationId,
+      name: input.name,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client }));
+  }
+  async listUserApiKeys(input) {
+    return parseUserApiKeyPage(await listUserApiKeys({ organization_id: input.organizationId, ...input.after ? { after: input.after } : {} }, { client: this.#client }));
+  }
+  async revokeUserApiKey(input) {
+    await revokeUserApiKey({ organization_id: input.organizationId, key_id: input.keyId }, { client: this.#client });
+  }
+  createBillingCheckout(input) {
+    return createBillingCheckout({
+      organization_id: input.organizationId,
+      offer: input.offer,
+      packs: input.packs,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client });
+  }
+  getBillingCheckout(input) {
+    return getBillingCheckout({ organization_id: input.organizationId, checkout_id: input.checkoutId }, { client: this.#client });
+  }
+  getBillingRecharge(organizationId) {
+    return getBillingRecharge({ organization_id: organizationId }, { client: this.#client });
+  }
+  configureBillingRecharge(input) {
+    return configureBillingRecharge({
+      organization_id: input.organizationId,
+      "Idempotency-Key": input.idempotencyKey,
+      enabled: input.enabled,
+      monthly_limit_minor: input.monthlyLimitMinor,
+      consent: input.consent,
+      revision: input.revision
+    }, { client: this.#client });
+  }
+  createBillingPortal(organizationId) {
+    return createBillingPortal({ organization_id: organizationId, body: {} }, { client: this.#client });
+  }
+  getOrganizationCreditUsage(input) {
+    return getOrganizationCreditUsage({
+      organization_id: input.organizationId,
+      month: input.month,
+      ...input.cursor ? { cursor: input.cursor } : {}
+    }, { client: this.#client });
+  }
+  getProjectCreditBudget(projectId) {
+    return getProjectCreditBudget({ project_id: projectId }, { client: this.#client });
+  }
+  setProjectCreditBudget(input) {
+    return setProjectCreditBudget({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      setProjectCreditBudgetRequest: { amount_micros: input.amountMicros, mode: input.mode }
+    }, { client: this.#client });
+  }
+  createOrganization(input) {
+    return createOrganization({
+      "Idempotency-Key": input.idempotencyKey,
+      createOrganizationRequest: {
+        name: input.name,
+        ...input.signupSource === void 0 ? {} : { signup_source: input.signupSource }
+      }
+    }, { client: this.#client });
+  }
+  async listProjects(input) {
+    return listProjects(input, { client: this.#client });
+  }
+  async changeProjectHandle(input) {
+    return changeProjectHandle({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      handle: input.handle
+    }, { client: this.#client });
+  }
+  async checkProjectHandle(input) {
+    return getProjectHandleAvailability({ handle: input.handle }, { client: this.#client });
+  }
+  async getProjectStatus(projectId) {
+    return getProjectStatus({ project_id: projectId }, { client: this.#client });
+  }
+  async writeProjectDatabase(input) {
+    return writeProjectDatabase({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      projectDatabaseWriteRequest: {
+        environment: input.environment,
+        statement: input.statement,
+        parameters: [...input.parameters]
+      }
+    }, { client: this.#client });
+  }
+  async queryProjectDatabase(input) {
+    return queryProjectDatabase({
+      project_id: input.projectId,
+      projectDatabaseQueryRequest: {
+        environment: input.environment,
+        statement: input.statement,
+        parameters: [...input.parameters]
+      }
+    }, { client: this.#client });
+  }
+  /** The connection URI exists only in this response; nothing in the CLI persists it. */
+  async createProjectDatabaseAccess(input) {
+    const value = await createProjectDatabaseAccess({
+      project_id: input.projectId,
+      projectDatabaseAccessRequest: {
+        environment: input.environment,
+        mode: input.mode,
+        ttl_seconds: input.ttlSeconds,
+        label: input.label
+      }
+    }, { client: this.#client });
+    assertProjectDatabaseAccessCredential(value);
+    return value;
+  }
+  async listProjectDatabaseAccess(input) {
+    const value = await listProjectDatabaseAccess({
+      project_id: input.projectId,
+      ...input.environment === void 0 ? {} : { environment: input.environment }
+    }, { client: this.#client });
+    assertProjectDatabaseAccessPage(value);
+    return value;
+  }
+  async revokeProjectDatabaseAccess(input) {
+    const value = await revokeProjectDatabaseAccess({ project_id: input.projectId, access_id: input.accessId }, { client: this.#client });
+    assertProjectDatabaseAccess(value);
+    return value;
+  }
+  async planPaidDomain(input) {
+    return planPaidProjectDomain({ project_id: input.projectId, paidDomainRequest: { hostname: input.hostname } }, { client: this.#client });
+  }
+  async applyPaidDomain(input) {
+    return applyPaidProjectDomain({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      paidDomainRequest: { hostname: input.hostname }
+    }, { client: this.#client });
+  }
+  async getPaidDomain(projectId) {
+    return getPaidProjectDomain({ project_id: projectId }, { client: this.#client });
+  }
+  async deletePaidDomain(input) {
+    return deletePaidProjectDomain({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      paidDomainRequest: { hostname: input.hostname }
+    }, { client: this.#client });
+  }
+  async ensureDevShareLink(projectId) {
+    return ensureProjectDevShareLink({ project_id: projectId }, { client: this.#client });
+  }
+  async rotateDevShareLink(projectId, idempotencyKey2) {
+    return rotateProjectDevShareLink({ project_id: projectId, "Idempotency-Key": idempotencyKey2 }, { client: this.#client });
+  }
+  async revokeDevShareLink(projectId, idempotencyKey2) {
+    return revokeProjectDevShareLink({ project_id: projectId, "Idempotency-Key": idempotencyKey2 }, { client: this.#client });
+  }
+  async setDevAccessMode(projectId, mode, idempotencyKey2) {
+    return setProjectDevAccessMode({
+      project_id: projectId,
+      "Idempotency-Key": idempotencyKey2,
+      setDevAccessModeRequest: { mode }
+    }, { client: this.#client });
+  }
+  async createDevAccessTicket(projectId) {
+    return createProjectDevAccessTicket({ project_id: projectId }, { client: this.#client });
+  }
+  async submitFeedback(input) {
+    return parseFeedbackReceipt(await submitFeedback({ "Idempotency-Key": input.idempotencyKey, feedbackSubmission: input.report }, { client: this.#client }));
+  }
+  async getFeedback(feedbackId, cursor) {
+    return parseFeedbackStatus(await getFeedback({ feedback_id: feedbackId, ...cursor === void 0 ? {} : { cursor } }, { client: this.#client }));
+  }
+  async createProject(input) {
+    return createProject({
+      "Idempotency-Key": input.idempotencyKey,
+      createProjectRequest: {
+        organization_id: input.organizationId,
+        name: input.name,
+        ...input.dataMode === void 0 ? {} : { data_mode: input.dataMode },
+        ...input.devAccessMode === void 0 ? {} : { dev_access_mode: input.devAccessMode },
+        ...input.region === void 0 ? {} : { region: input.region }
+      }
+    }, { client: this.#client });
+  }
+  async getOperation(operationId) {
+    return getOperation({ operation_id: operationId }, { client: this.#client });
+  }
+  async reconcileOperation(input) {
+    return reconcileOperation({
+      "Idempotency-Key": input.idempotencyKey,
+      operation_id: input.operationId
+    }, { client: this.#client });
+  }
+  async connectGithub(input) {
+    return connectGithubOrganization({
+      organization_id: input.organizationId,
+      "Idempotency-Key": input.idempotencyKey,
+      connectGithubOrganizationRequest: {}
+    }, { client: this.#client });
+  }
+  async getGithubConnection(organizationId) {
+    return getGithubOrganizationConnection({ organization_id: organizationId }, { client: this.#client });
+  }
+  async linkSource(input) {
+    return linkProjectSource({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      linkProjectSourceRequest: {
+        repository_owner: input.repositoryOwner,
+        repository_name: input.repositoryName
+      }
+    }, { client: this.#client });
+  }
+  async configureAutoDeploy(input) {
+    return configureProjectSourceAutoDeploy({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      configureSourceAutoDeployRequest: { branch: input.branch, enabled: input.enabled }
+    }, { client: this.#client });
+  }
+  async getAutoDeploy(projectId) {
+    return getProjectSourceAutoDeploy({ project_id: projectId }, { client: this.#client });
+  }
+  async authorizeCloudflareDns(input) {
+    return createCloudflareDnsAuthorization({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      createCloudflareDnsAuthorizationRequest: { zone: input.zone }
+    }, { client: this.#client });
+  }
+  async getCloudflareDnsStatus(projectId) {
+    return getCloudflareDnsAuthorizationStatus({ project_id: projectId }, { client: this.#client });
+  }
+  async applyProjectDomains(input) {
+    return configureProjectDomains({ "Idempotency-Key": input.idempotencyKey, project_id: input.projectId }, { client: this.#client });
+  }
+  async planDeployment(input) {
+    return planDeployment({
+      project_id: input.projectId,
+      planDeploymentRequest: { commit_sha: input.commitSha, environment: input.environment }
+    }, { client: this.#client });
+  }
+  async createDeployment(input) {
+    return createDeployment({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      createDeploymentRequest: { plan_id: input.planId }
+    }, { client: this.#client });
+  }
+  async getDeployment(input) {
+    return getDeployment({ project_id: input.projectId, deployment_id: input.deploymentId }, { client: this.#client });
+  }
+  async streamOperationEvents(operationId, signal) {
+    return (await streamOperationEvents({ operation_id: operationId }, { client: this.#client, signal, headers: { Accept: "text/event-stream" } })).stream;
+  }
+  async getDeploymentLogs(input) {
+    return getDeploymentLogs({
+      project_id: input.projectId,
+      deployment_id: input.deploymentId,
+      limit: input.limit,
+      ...input.cursor === void 0 ? {} : { cursor: input.cursor }
+    }, { client: this.#client });
+  }
+  async streamDeploymentLogs(input, signal) {
+    return (await streamDeploymentLogs({ project_id: input.projectId, deployment_id: input.deploymentId }, { client: this.#client, signal, headers: { Accept: "text/event-stream" } })).stream;
+  }
+  async planRollback(input) {
+    return planDeploymentRollback({ project_id: input.projectId, target_deployment_id: input.deploymentId }, { client: this.#client });
+  }
+  async rollback(input) {
+    return rollbackDeployment({
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      "X-Confirmation-Token": input.confirmationToken,
+      project_id: input.projectId,
+      target_deployment_id: input.deploymentId
+    }, { client: this.#client });
+  }
+  async planPromotion(input) {
+    return planDeploymentPromotion({ project_id: input.projectId, source_deployment_id: input.sourceDeploymentId }, { client: this.#client });
+  }
+  async promote(input) {
+    return promoteDeployment({
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      "X-Confirmation-Token": input.confirmationToken,
+      project_id: input.projectId,
+      source_deployment_id: input.sourceDeploymentId
+    }, { client: this.#client });
+  }
+  async planDelete(projectId) {
+    return planProjectDeletion({ project_id: projectId }, { client: this.#client });
+  }
+  async deleteProject(input) {
+    return deleteProject({
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      "X-Confirmation-Token": input.confirmationToken,
+      project_id: input.projectId
+    }, { client: this.#client });
+  }
+  async listEnvironmentSecrets(input) {
+    return listEnvironmentSecrets({ project_id: input.projectId, environment_id: input.environmentId }, { client: this.#client });
+  }
+  async listFunctionRuns(input) {
+    return listFunctionRuns({ project_id: input.projectId, environment_id: input.environmentId, limit: input.limit }, { client: this.#client });
+  }
+  async putEnvironmentSecret(input) {
+    return putEnvironmentSecret({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      environment_id: input.environmentId,
+      secret_name: input.name,
+      putEnvironmentSecretRequest: { value: input.value }
+    }, { client: this.#client });
+  }
+  async deleteEnvironmentSecret(input) {
+    return deleteEnvironmentSecret({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      environment_id: input.environmentId,
+      secret_name: input.name
+    }, { client: this.#client });
+  }
+  managedMail(input) {
+    return executeManagedMail(this.#client, input);
+  }
+};
+
+// apps/product-cli/dist/repository-init.js
+var MAXIMUM_PACKAGE_BYTES = 1024 * 1024;
 var MAXIMUM_CONFIGURATION_BYTES = 64 * 1024;
 var MAXIMUM_SOURCE_BYTES = 2 * 1024 * 1024;
 var STORAGE_RUNTIME_BINDINGS = Object.freeze([
@@ -4942,33 +5829,95 @@ function environmentToken(environment2 = {}) {
     throw new ProductApiAuthenticationError("invalid_environment_token");
   return value;
 }
+function environmentProfile(environment2 = {}) {
+  const value = environment2.OHMYHOST_PROFILE;
+  if (value === void 0 || value === "")
+    return void 0;
+  if (!isProfileName(value))
+    throw new ProductApiAuthenticationError("invalid_profile_binding");
+  return value;
+}
+var profileRequest = (input, bound) => ({
+  ...input?.name === void 0 ? {} : { name: input.name },
+  ...bound === void 0 ? {} : { bound },
+  ...input?.organizationId === void 0 ? {} : { organizationId: input.organizationId },
+  ...input?.userId === void 0 ? {} : { userId: input.userId }
+});
 var createAuthenticatedProductTransport = async (signal, overrides = {}) => {
-  const profile = resolveProductCliEnvironment(overrides.environment);
+  const platform = resolveProductCliEnvironment(overrides.environment);
   const apiToken = environmentToken(overrides.environment);
+  const bound = environmentProfile(overrides.environment);
+  const baseUrl = overrides.productApiOrigin ?? platform.apiOrigin;
   const boundedFetch = createBoundedFetch(overrides.fetch ?? fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES);
-  if (apiToken !== void 0)
+  const registry = overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform.credentialService);
+  const binding = overrides.request?.bindOrganization === true;
+  const request = profileRequest(overrides.request, bound);
+  if (apiToken !== void 0) {
+    await verifyEnvironmentTokenContext({
+      token: apiToken,
+      request: binding ? profileRequest({}, bound) : request,
+      registry,
+      baseUrl,
+      fetch: boundedFetch
+    });
     return {
-      baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+      baseUrl,
       accessToken: apiToken,
       fetch: boundedFetch,
-      // A user API token carries a fixed scope; there is no session that could select a workspace.
-      workspace: void 0
+      workspace: void 0,
+      context: { credential: "environment_token", profile: null }
     };
-  const store = overrides.credentialStore ?? new NativeNapiKeyringCredentialStore(void 0, profile.credentialService);
-  const stored = await store.read();
-  if (stored === void 0)
-    throw new ProductApiAuthenticationError("authentication_required");
+  }
   const now = overrides.now ?? (() => /* @__PURE__ */ new Date());
   const refresher = overrides.tokenRefresher ?? new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now);
-  const credential = await currentCredential(stored, store, signal, now, refresher);
+  const profiles = await loadProfiles(registry, {
+    baseUrl,
+    fetch: boundedFetch,
+    signal,
+    now,
+    refresher
+  });
+  const selection = binding && request.organizationId !== void 0 ? selectProfileForOrganization(profiles, {
+    ...request,
+    organizationId: request.organizationId
+  }) : selectProfile(profiles, request);
+  if (selection.outcome !== "selected")
+    throw profileSelectionError(selection, request, platform.commandPrefix, overrides.selector ?? "cli");
+  const profile = selection.profile;
+  const store = registry.credential(profile);
+  const stored = await store.read();
+  if (stored === void 0)
+    throw missingLogin(profile, platform.commandPrefix);
+  const credential = await currentCredential(stored, store, signal, now, refresher, () => registry.remove(profile));
   return {
-    baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+    baseUrl,
     accessToken: credential.accessToken,
     fetch: boundedFetch,
-    workspace: { store, refresher }
+    workspace: { store, refresher, profiles: registry, profile },
+    context: { credential: "profile", profile }
+  };
+};
+var listSavedProfiles = async (signal, overrides = {}) => {
+  const platform = resolveProductCliEnvironment(overrides.environment);
+  const apiToken = environmentToken(overrides.environment);
+  const bound = environmentProfile(overrides.environment);
+  const registry = overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform.credentialService);
+  const now = overrides.now ?? (() => /* @__PURE__ */ new Date());
+  const profiles = apiToken === void 0 ? await loadProfiles(registry, {
+    baseUrl: overrides.productApiOrigin ?? platform.apiOrigin,
+    fetch: createBoundedFetch(overrides.fetch ?? fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
+    signal,
+    now,
+    refresher: overrides.tokenRefresher ?? new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now)
+  }) : await registry.list();
+  return {
+    profiles: profiles.map(publicProfile),
+    bound: bound ?? null,
+    environment_token: apiToken !== void 0
   };
 };
-var currentCredential = async (stored, store, signal, now, tokenRefresher) => {
+var missingLogin = (profile, commandPrefix) => new ProfileSelectionError("authentication_required", 5, `The saved login ${profile.name} has no credential on this computer. Run '${commandPrefix} login${profile.organizationId === null ? "" : ` --organization ${profile.organizationId}`} --profile-name ${profile.name} --json'.`);
+var currentCredential = async (stored, store, signal, now, tokenRefresher, forget) => {
   const expiresAt = stored.expiresAt === void 0 ? NaN : Date.parse(stored.expiresAt);
   if (Number.isFinite(expiresAt) && expiresAt > now().getTime() + REQUEST_TIMEOUT_MS) {
     return stored;
@@ -4984,12 +5933,73 @@ var currentCredential = async (stored, store, signal, now, tokenRefresher) => {
     return carried;
   } catch (error) {
     if (error instanceof TokenRefreshRejectedError) {
-      await store.clear();
+      await forget();
       throw new ProductApiAuthenticationError("authentication_required");
     }
     throw new ProductApiAuthenticationError("token_refresh_failed");
   }
 };
+var loadProfiles = async (registry, context) => {
+  const legacy = registry.legacy();
+  const stored = await legacy.read();
+  if (stored !== void 0)
+    await migrateLegacyLogin(registry, legacy, stored, context);
+  return registry.list();
+};
+var migrateLegacyLogin = async (registry, legacy, stored, context) => {
+  let credential;
+  try {
+    credential = await currentCredential(stored, legacy, context.signal, context.now, context.refresher, () => legacy.clear());
+  } catch (error) {
+    if (error instanceof ProductApiAuthenticationError && error.code === "authentication_required")
+      return;
+    throw error;
+  }
+  const api = new GeneratedSdkProductApi(context.baseUrl, credential.accessToken, context.fetch);
+  let identity;
+  try {
+    identity = await api.getCurrentIdentity();
+  } catch (error) {
+    if (!isProblem(error, "unauthenticated"))
+      throw error;
+    return;
+  }
+  const userId = verifiedUserId(identity);
+  const organizationId = parseCurrentIdentity(identity).organization_ids[0] ?? null;
+  const organizationName = organizationId === null ? null : (await api.getAccountProfile()).organizations.find((organization) => organization.id === organizationId)?.name ?? null;
+  const login = { userId, organizationId, organizationName };
+  await registry.save({ name: defaultProfileName(await registry.list(), login), ...login }, credential);
+  await legacy.clear();
+};
+var isProblem = (error, code) => typeof error === "object" && error !== null && "code" in error && error.code === code;
+var verifyEnvironmentTokenContext = async (input) => {
+  const { request } = input;
+  const named = request.name ?? request.bound;
+  if (named === void 0 && request.organizationId === void 0 && request.userId === void 0)
+    return null;
+  const refuse = (target) => new ProfileSelectionError("environment_token_context_mismatch", 2, `${target} Unset OHMYHOST_TOKEN to use the saved login, or load the key of that account from its private env file. Nothing was sent.`);
+  if (request.name !== void 0 && request.bound !== void 0 && request.name !== request.bound)
+    throw refuse(`This call names profile ${request.name}, but the process is bound to OHMYHOST_PROFILE=${request.bound}.`);
+  const profile = named === void 0 ? void 0 : (await input.registry.list()).find((saved) => saved.name === named);
+  if (named !== void 0 && profile === void 0)
+    throw refuse(`OHMYHOST_TOKEN overrides saved logins in this process, and no saved login is named ${named}.`);
+  const { userId, organizationId } = await readTokenIdentity(input);
+  const owner = `OHMYHOST_TOKEN belongs to user ${userId} in organization ${organizationId ?? "none"},`;
+  if (profile !== void 0 && (profile.userId !== userId || profile.organizationId !== organizationId))
+    throw refuse(`${owner} but this call names ${describeProfile(profile)}.`);
+  if (request.organizationId !== void 0 && request.organizationId !== organizationId)
+    throw refuse(`${owner} but this call targets organization ${request.organizationId}.`);
+  if (request.userId !== void 0 && request.userId !== userId)
+    throw refuse(`${owner} but this call targets user ${request.userId}.`);
+  return { userId, organizationId };
+};
+var readTokenIdentity = async (input) => {
+  const identity = parseCurrentIdentity(await new GeneratedSdkProductApi(input.baseUrl, input.token, input.fetch).getCurrentIdentity());
+  return {
+    userId: identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : identity.actor_id,
+    organizationId: identity.organization_ids[0] ?? null
+  };
+};
 var FetchWorkosPublicTransport = class {
   parentSignal;
   timeoutMs;
@@ -5167,7 +6177,7 @@ var boundedSignal = (parent, timeoutMs) => AbortSignal.any([parent, AbortSignal.
 var isAbortOrTimeout = (error) => error instanceof DOMException && (error.name === "AbortError" || error.name === "TimeoutError");
 
 // apps/mcp/dist/local-client.js
-import { lstat as lstat2, open as open2 } from "node:fs/promises";
+import { lstat as lstat2, open as open3 } from "node:fs/promises";
 import { isAbsolute } from "node:path";
 var OperationEventsUnavailableError = class extends Error {
   constructor() {
@@ -5177,8 +6187,11 @@ var OperationEventsUnavailableError = class extends Error {
 };
 async function createAuthenticatedLocalMcpClient(signal, overrides = {}) {
   try {
-    const transport = await createAuthenticatedProductTransport(signal, overrides);
-    return new GeneratedSdkLocalMcpClient(transport.baseUrl, transport.accessToken, transport.fetch, transport.workspace);
+    const transport = await createAuthenticatedProductTransport(signal, {
+      ...overrides,
+      selector: "mcp"
+    });
+    return new GeneratedSdkLocalMcpClient(transport.baseUrl, transport.accessToken, transport.fetch, transport.workspace, transport.context, resolveProductCliEnvironment(overrides.environment).commandPrefix);
   } catch (error) {
     if (!(error instanceof ProductApiAuthenticationError))
       throw error;
@@ -5191,11 +6204,44 @@ async function createAuthenticatedLocalMcpClient(signal, overrides = {}) {
 var GeneratedSdkLocalMcpClient = class {
   #client;
   #workspace;
+  #context;
+  #commandPrefix;
   #rescope;
-  constructor(baseUrl, accessToken, fetch2, workspace) {
+  constructor(baseUrl, accessToken, fetch2, workspace, context, commandPrefix = "OHMYHOST_ENVIRONMENT=production ohmyhost") {
     this.#rescope = (token) => createClient({ auth: token, baseUrl, fetch: fetch2, throwOnError: true });
     this.#client = this.#rescope(accessToken);
     this.#workspace = workspace;
+    this.#context = context ?? {
+      credential: workspace === void 0 ? "environment_token" : "profile",
+      profile: workspace?.profile ?? null
+    };
+    this.#commandPrefix = commandPrefix;
+  }
+  actingAs() {
+    return this.#contextReport();
+  }
+  /** Which account this call acts as, without any credential. */
+  #contextReport() {
+    const profile = this.#workspace?.profile ?? this.#context.profile;
+    return {
+      credential: this.#context.credential,
+      profile: profile === null ? null : publicProfile(profile)
+    };
+  }
+  /**
+   * Bind this call's login, which has no organization yet, and continue with its new credential.
+   * A login in another organization keeps it; the provider verifies the account first.
+   */
+  async #bind(organization, signal) {
+    const session = this.#interactiveSession();
+    const bound = await selectWorkspace(session, organization, signal, (token) => getCurrentIdentity({}, { client: this.#rescope(token) }));
+    const store = session.profiles.credential(bound);
+    const credential = await store.read();
+    if (credential === void 0)
+      throw new InteractiveSessionRequiredError();
+    this.#workspace = { ...session, store, profile: bound };
+    this.#client = this.#rescope(credential.accessToken);
+    return bound;
   }
   async changeDatabaseCompute(input) {
     return changeDatabaseCompute({
@@ -5261,13 +6307,15 @@ var GeneratedSdkLocalMcpClient = class {
   async getCurrentIdentity(signal) {
     const identity = await getCurrentIdentity({}, { client: this.#client });
     if (this.#workspace === void 0 || parseCurrentIdentity(identity).organization_ids.length > 0)
-      return identity;
+      return { ...identity, context: this.#contextReport() };
     const selection = chooseWorkspace(await this.#readWorkspaces(), void 0);
     if (selection.outcome !== "selected")
-      return identity;
-    await selectWorkspace(this.#workspace, selection.organization, signal);
-    const scoped = (await this.#workspace.store.read())?.accessToken;
-    return scoped === void 0 ? identity : getCurrentIdentity({}, { client: this.#rescope(scoped) });
+      return { ...identity, context: this.#contextReport() };
+    await this.#bind(selection.organization, signal);
+    return {
+      ...await getCurrentIdentity({}, { client: this.#client }),
+      context: this.#contextReport()
+    };
   }
   async changeProjectHandle(input) {
     return changeProjectHandle({
@@ -5380,29 +6428,39 @@ var GeneratedSdkLocalMcpClient = class {
         ...input.signupSource === void 0 ? {} : { signup_source: input.signupSource }
       }
     }, { client: this.#client });
+    const current = this.#interactiveSession().profile;
+    if (current.organizationId !== null && current.organizationId !== created.id)
+      return {
+        organization: { id: created.id, name: created.name },
+        selected: current.organizationId,
+        profile: publicProfile(current),
+        next_action: `Run '${this.#commandPrefix} login --organization ${created.id} --user ${current.userId} --json' to add a login for the new workspace as the same user, then pass its profile_name.`
+      };
     return this.selectOrganization(created.id, signal);
   }
   async listOrganizations() {
     const session = this.#interactiveSession();
     return {
       organizations: (await this.#readWorkspaces()).map(publicWorkspace),
-      selected: await selectedWorkspaceId(session)
+      selected: session.profile.organizationId,
+      profile: publicProfile(session.profile)
     };
   }
   async selectOrganization(organizationId, signal) {
-    const session = this.#interactiveSession();
+    this.#interactiveSession();
     const selection = chooseWorkspace(await this.#readWorkspaces(), organizationId);
     if (selection.outcome !== "selected")
       throw new Error(`ORGANIZATION_NOT_FOUND:${organizationId}`);
-    await selectWorkspace(session, selection.organization, signal);
+    const profile = await this.#bind(selection.organization, signal);
     return {
       organization: publicWorkspace(selection.organization),
-      selected: selection.organization.id
+      selected: selection.organization.id,
+      profile: publicProfile(profile)
     };
   }
   async #readWorkspaces() {
     this.#interactiveSession();
-    return parseAccountProfile(await getAccountProfile({ client: this.#client }));
+    return parseAccountProfile(await getAccountProfile({ client: this.#client })).organizations;
   }
   #interactiveSession() {
     if (this.#workspace === void 0)
@@ -5681,7 +6739,7 @@ async function readExportPasswordFile(path) {
     const before = await lstat2(path);
     if (!before.isFile() || before.isSymbolicLink() || before.size < 1 || before.size > 1024 || process.platform !== "win32" && (before.mode & 63) !== 0)
       throw new Error();
-    file = await open2(path, "r");
+    file = await open3(path, "r");
     const after = await file.stat();
     if (after.ino !== before.ino || after.dev !== before.dev || after.size !== before.size)
       throw new Error();
@@ -5702,6 +6760,7 @@ async function readExportPasswordFile(path) {
 
 // apps/mcp/dist/local-server.js
 var identifier2 = external_exports.string().min(1).max(256);
+var profileName = external_exports.string().regex(/^[a-z0-9][a-z0-9_-]{0,62}$/u).optional().describe("Saved login to act as (profile_list shows them). Needed only when several logins could run this call; OHMYHOST_PROFILE of this server must match it.");
 var idempotencyKey = external_exports.string().min(1).max(256);
 var commitSha = external_exports.string().regex(/^[a-f0-9]{40}$/u);
 var domainName = external_exports.string().regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u);
@@ -5848,7 +6907,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     mode: input.mode,
     idempotencyKey: input.idempotency_key
   }), { readOnlyHint: false, destructiveHint: false, idempotentHint: true });
-  registerProductTool(server, dependencies, "organization_create", `Create an organization owned by the signed-in user and select it for this machine. Signup is open. signup_source is optional attribution from a link's r parameter, never a secret; omit it when the customer arrived directly. The server decides any once-per-user bonus; do not promise credits for arbitrary sources. Repeat the same name/source/key after uncertainty. No second login is needed: selected names the workspace every later call uses, so continue with identity_get, github_status and github_connect if needed, then projects. An OHMYHOST_TOKEN process cannot do this; it needs ${commandPrefix} login --json.`, external_exports.object({
+  registerProductTool(server, dependencies, "organization_create", `Create an organization owned by the signed-in user. Signup is open. signup_source is optional attribution from a link's r parameter, never a secret; omit it when the customer arrived directly. The server decides any once-per-user bonus; do not promise credits for arbitrary sources. Repeat the same name/source/key after uncertainty. A login that has no organization yet is bound to the new one, so selected names the workspace later calls use; a login already in another organization keeps it and next_action names the login for the new one. Continue with identity_get, github_status and github_connect if needed, then projects. An OHMYHOST_TOKEN process cannot do this; it needs ${commandPrefix} login --json.`, external_exports.object({
     name: external_exports.string().min(1).max(128),
     signup_source: external_exports.string().regex(/^[a-z0-9][a-z0-9_-]{0,63}$/u).optional(),
     idempotency_key: idempotencyKey
@@ -5857,8 +6916,25 @@ function createLocalOhmyhostMcpServer(dependencies) {
     ...input.signup_source === void 0 ? {} : { signupSource: input.signup_source },
     idempotencyKey: input.idempotency_key
   }, signal), mutationAnnotations());
-  registerProductTool(server, dependencies, "organization_list", "List the workspaces the signed-in user belongs to and which one this machine currently uses. selected is null while none is chosen; every project and billing call then answers resource_not_found. Ask the customer which workspace to use instead of guessing, then call organization_use.", external_exports.object({}), (client2) => client2.listOrganizations());
-  registerProductTool(server, dependencies, "organization_use", `Select one workspace for this machine's stored login, so later calls act inside it. Read organization_list first, then github_status for the selected workspace and github_connect if needed; the identifier is the platform ULID, not the provider identifier. An OHMYHOST_TOKEN process cannot select anything and needs ${commandPrefix} login --json instead.`, external_exports.object({ organization_id: identifier2 }), (client2, input, signal) => client2.selectOrganization(input.organization_id, signal), mutationAnnotations());
+  registerProductTool(server, dependencies, "organization_list", "List the workspaces the chosen login's user belongs to and which one that login is scoped to. selected is null while none is chosen; every project and billing call then answers resource_not_found. Ask the customer which workspace to use instead of guessing, then call organization_use.", external_exports.object({}), (client2) => client2.listOrganizations());
+  registerProductTool(server, dependencies, "organization_use", `Bind a saved login that has no organization yet to one workspace, so later calls act inside it. A login already in another organization keeps it (profile_organization_fixed): add a login for the other workspace as the same user with ${commandPrefix} login --organization ULID --user USER_ID --json. Read organization_list first, then github_status for the selected workspace and github_connect if needed; the identifier is the platform ULID, not the provider identifier. An OHMYHOST_TOKEN process cannot select anything and needs ${commandPrefix} login --json instead.`, external_exports.object({ organization_id: identifier2 }), (client2, input, signal) => client2.selectOrganization(input.organization_id, signal), mutationAnnotations(), (input) => ({
+    ...input.profile_name === void 0 ? {} : { name: input.profile_name },
+    organizationId: input.organization_id,
+    bindOrganization: true
+  }));
+  server.registerTool("profile_list", {
+    description: `List the saved ohmyho.st logins on this computer: each has a name, a user and an organization, never a token. When the customer named a user or organization, pass the matching name as profile_name on later calls; with several logins and no profile_name a call answers profile_selection_required. With no match, the customer adds one with ${commandPrefix} login --organization ULID --user USER_ID --json, which saves nothing if the browser signs in as another account. bound is this server's OHMYHOST_PROFILE; environment_token means OHMYHOST_TOKEN replaces saved logins here.`,
+    inputSchema: external_exports.object({}),
+    annotations: readAnnotations()
+  }, (async (_input, context) => {
+    try {
+      if (dependencies.listProfiles === void 0)
+        throw new CredentialStoreUnavailableError();
+      return toolResult(await dependencies.listProfiles(context.mcpReq.signal));
+    } catch (error) {
+      return toolError(error, dependencies);
+    }
+  }));
   registerProductTool(server, dependencies, "database_query", "Read one owner-authorized Dev or Prod database query (at most 100 rows, five-second timeout). Explicitly choose the environment. Shared data resolves to the same physical database. Application RLS policies apply; use an authorized SQL export when a full archive is required.", external_exports.object({
     project_id: identifier2,
     environment: external_exports.enum(["dev", "prod"]),
@@ -5956,7 +7032,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     });
     return { revoked: true, key_id: input.key_id };
   }, destructiveAnnotations());
-  registerProductTool(server, dependencies, "identity_get", "Get the current ohmyho.st customer/agent identity. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.", external_exports.object({}), (client2, _input, signal) => client2.getCurrentIdentity(signal));
+  registerProductTool(server, dependencies, "identity_get", "Get the ohmyho.st customer/agent identity this call acts as: user, organization and, in context, the saved login or OHMYHOST_TOKEN that supplied it. Compare it with the user and organization the customer named before any change. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.", external_exports.object({}), (client2, _input, signal) => client2.getCurrentIdentity(signal));
   registerProductTool(server, dependencies, "project_handle_check", "Check whether a project address is free before offering it to the customer. A handle is one to five lowercase words of letters and digits joined by single hyphens, three to fifty-nine characters, and never a reserved word such as admin, api, dev or www; it becomes <handle>.check.omh.st for Prod and dev-<handle>.check.omh.st for Dev. The answer names why a handle cannot be used and returns free alternatives, so offer one of those instead of guessing again. Check the name here first, then move an existing project onto it with project_handle_set.", external_exports.object({ handle: external_exports.string().min(1).max(120) }), (client2, input) => client2.checkProjectHandle({ handle: input.handle }));
   registerProductTool(server, dependencies, "project_handle_set", "Move a project to an address the customer chose, after project_handle_check said it is free. The Dev and Prod gateways are re-published at the new address and it is stored only once both serve it; the previous address stops answering and anyone may claim it, so a link already shared stops working. Needs the project's current ETag from project_status and one idempotency key; reuse the same key after an uncertain answer. Refused while another operation is running for the project, and refused for an address that is taken, unusable, or the one the project already has. Returns an operation to follow with operation_get.", external_exports.object({
     project_id: identifier2,
@@ -6032,8 +7108,8 @@ function createLocalOhmyhostMcpServer(dependencies) {
     organizationId: input.organization_id,
     idempotencyKey: input.idempotency_key
   }), mutationAnnotations());
-  registerProductTool(server, dependencies, "github_status", "Read this workspace's GitHub connection. If not_connected or revoked, an Owner or Admin must run github_connect. A connected installation covers only repositories selected in its settings.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getGithubConnection(input.organization_id));
-  registerProductTool(server, dependencies, "source_link", "Link a repository covered by the workspace GitHub connection. Call github_status first and github_connect once if needed. This returns an operation without another browser consent and never starts a build. Wait for that operation before planning a deploy. If repository access is missing, update the installation using the returned settings action, then retry the same project and key. Never ask for an installation ID or provider token.", external_exports.object({
+  registerProductTool(server, dependencies, "github_status", "Read this workspace's GitHub connection. If not_connected or revoked, an Owner or Admin must run github_connect. A connected installation covers only repositories selected in its settings. Each workspace has its own connection, so the same repository can be connected and linked in the workspaces of separate accounts.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getGithubConnection(input.organization_id));
+  registerProductTool(server, dependencies, "source_link", "Link a repository covered by the workspace GitHub connection. Call github_status first and github_connect once if needed. This returns an operation without another browser consent and never starts a build. Wait for that operation before planning a deploy. If repository access is missing, update the installation using the returned settings action, then retry the same project and key. Never ask for an installation ID or provider token. Errors name the account the call ran as (acting_as): resource_not_found means that account cannot see the project (use the login of the account that owns it), github_connection_required means that workspace has no GitHub connection yet, and repository_not_installed means its GitHub App installation does not cover the repository.", external_exports.object({
     project_id: identifier2,
     repository_owner: identifier2,
     repository_name: identifier2,
@@ -6251,31 +7327,33 @@ function createLocalOhmyhostMcpServer(dependencies) {
     name: input.name,
     idempotencyKey: input.idempotency_key
   }), destructiveAnnotations());
-  server.registerTool("secret_set_command", {
-    description: "Return the stdin-only CLI command for setting a secret; the value never enters MCP.",
-    inputSchema: external_exports.object({
-      project_id: identifier2,
-      environment_id: identifier2,
-      name: secretName,
-      idempotency_key: idempotencyKey
-    }),
-    annotations: readAnnotations()
-  }, (input) => toolResult({
-    command: [
-      `${commandPrefix} secret set`,
-      shellQuote(input.name),
-      "--project",
-      shellQuote(input.project_id),
-      "--environment",
-      shellQuote(input.environment_id),
-      "--idempotency-key",
-      shellQuote(input.idempotency_key),
-      "--stdin",
-      "--wait",
-      "--json"
-    ].join(" "),
-    instruction: "Pass the secret value on stdin in a local terminal. Never place it in MCP arguments, prompts, command-line arguments, source, or logs."
-  }));
+  registerProductTool(server, dependencies, "secret_set_command", "Return the stdin-only CLI command for setting a secret; the value never enters MCP. The call runs as the chosen login and first reads the project, so an account that cannot see it answers resource_not_found. The command names that login with --profile-name plus its user and organization (--profile-user, --profile-organization), so a login of the same name that belongs to anyone else is refused, for example on another computer; a server with OHMYHOST_TOKEN instead names its key's user and organization with --token-user and --token-organization, and the CLI then runs only with an OHMYHOST_TOKEN of that account. Either way the later write runs as exactly this account or not at all (acting_as shows which).", external_exports.object({
+    project_id: identifier2,
+    environment_id: identifier2,
+    name: secretName,
+    idempotency_key: idempotencyKey
+  }), async (client2, input, signal) => {
+    await client2.getProject(input.project_id);
+    const account = await handoverAccount(client2, signal);
+    return {
+      command: [
+        `${commandPrefix} secret set`,
+        shellQuote(input.name),
+        "--project",
+        shellQuote(input.project_id),
+        "--environment",
+        shellQuote(input.environment_id),
+        "--idempotency-key",
+        shellQuote(input.idempotency_key),
+        ...account.flags,
+        "--stdin",
+        "--wait",
+        "--json"
+      ].join(" "),
+      acting_as: client2.actingAs?.() ?? null,
+      instruction: `Pass the secret value on stdin in a local terminal; ${account.runs}. Never place the value or a key in MCP arguments, prompts, command-line arguments, source, or logs.`
+    };
+  });
   registerProductTool(server, dependencies, "rollback_plan", "Plan a rollback", external_exports.object({ project_id: identifier2, deployment_id: identifier2 }), (client2, input) => client2.planRollback({ projectId: input.project_id, deploymentId: input.deployment_id }));
   registerProductTool(server, dependencies, "rollback_execute", "Execute a reviewed rollback", external_exports.object({
     project_id: identifier2,
@@ -6304,11 +7382,20 @@ function createLocalOhmyhostMcpServer(dependencies) {
   }), destructiveAnnotations());
   return server;
 }
-function registerProductTool(server, dependencies, name, description, inputSchema, execute, annotations = readAnnotations()) {
+function registerProductTool(server, dependencies, name, description, schema, execute, annotations = readAnnotations(), selection = (input) => {
+  const organizationId = input["organization_id"];
+  return {
+    ...input.profile_name === void 0 ? {} : { name: input.profile_name },
+    ...typeof organizationId === "string" ? { organizationId } : {}
+  };
+}) {
+  const inputSchema = schema.extend({ profile_name: profileName });
   const callback = (async (input, context) => {
     const parsed = inputSchema.parse(input);
+    let client2;
     try {
-      const result = toolResult(await execute(await dependencies.authenticatedClient(context.mcpReq.signal), parsed, context.mcpReq.signal));
+      client2 = await dependencies.authenticatedClient(context.mcpReq.signal, selection(parsed));
+      const result = toolResult(await execute(client2, parsed, context.mcpReq.signal));
       const scope = parsed;
       if (typeof scope["project_id"] === "string" && identifier2.safeParse(scope["project_id"]).success)
         result.content.push({
@@ -6320,48 +7407,106 @@ function registerProductTool(server, dependencies, name, description, inputSchem
         });
       return result;
     } catch (error) {
-      let safe;
-      try {
-        safe = error instanceof Error && error.name === "InteractiveSessionRequiredError" ? {
-          code: "interactive_login_required",
-          retryable: false,
-          suggestedAction: `A user API token cannot create, list or select a workspace. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json in a process without OHMYHOST_TOKEN, then retry.`
-        } : error instanceof Error && error.message.startsWith("ORGANIZATION_NOT_FOUND:") ? {
-          code: "organization_not_found",
-          retryable: false,
-          suggestedAction: "Call organization_list and choose one of the returned workspace identifiers. Do not create another workspace to recover."
-        } : error instanceof OperationEventsUnavailableError ? {
-          code: "operation_events_unavailable",
-          retryable: true,
-          suggestedAction: "Read operation_get for current status, then retry operation_logs for this same operation. Do not submit another deployment to recover logs."
-        } : error instanceof Error && error.message.startsWith("EXPORT_PASSWORD_FILE_INVALID:") ? {
-          code: "export_password_file_invalid",
-          retryable: false,
-          suggestedAction: "Choose an existing private UTF-8 password file of 1\u20131024 bytes. The user retains the file and password. Do not paste the password into MCP arguments."
-        } : parseSafeProblem(error);
-      } catch {
-        safe = {
-          code: "client_request_failed",
-          retryable: false,
-          suggestedAction: "Check the connection and run 'ohmyhost login' if authentication expired. Inspect the existing operation before resubmitting any mutation."
-        };
-      }
-      return {
-        ...toolResult({
-          error: {
-            code: safe.code,
-            retryable: safe.retryable,
-            suggested_action: safe.suggestedAction,
-            ...safe.requestId === void 0 ? {} : { request_id: safe.requestId },
-            ...safe.retryAfterSeconds === void 0 ? {} : { retry_after_seconds: safe.retryAfterSeconds }
-          }
-        }),
-        isError: true
-      };
+      return toolError(error, dependencies, client2?.actingAs?.());
     }
   });
   server.registerTool(name, { description, inputSchema, annotations }, callback);
 }
+async function handoverAccount(client2, signal) {
+  const profile = client2.actingAs?.()?.profile ?? null;
+  if (profile !== null) {
+    if (profile.organization_id === null)
+      throw new ProfileSelectionError("profile_context_mismatch", 2, `The saved login ${profile.name} has no organization, so no command can be tied to its account. Nothing was sent.`);
+    return {
+      flags: [
+        "--profile-name",
+        shellQuote(profile.name),
+        "--profile-user",
+        shellQuote(profile.user_id),
+        "--profile-organization",
+        shellQuote(profile.organization_id)
+      ],
+      runs: `the command runs only as the saved login it names and only while that login belongs to user ${profile.user_id} in organization ${profile.organization_id}, so a login of the same name that belongs to anyone else, for example on another computer, is refused before anything is read or sent`
+    };
+  }
+  const report = await client2.getCurrentIdentity(signal);
+  const identity = parseCurrentIdentity({
+    actor_id: report.actor_id,
+    organization_ids: report.organization_ids
+  });
+  const userId = identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : "";
+  const [organizationId, ...others] = identity.organization_ids;
+  if (!isProfileUserId(userId) || organizationId === void 0 || others.length > 0)
+    throw new ProfileSelectionError("environment_token_context_mismatch", 2, "This server's OHMYHOST_TOKEN does not belong to one user in one organization, so no command can be tied to its account. Nothing was sent.");
+  return {
+    flags: ["--token-user", shellQuote(userId), "--token-organization", shellQuote(organizationId)],
+    runs: `run it only where OHMYHOST_TOKEN holds a key of user ${userId} in organization ${organizationId}, loaded from its private env file; it refuses a saved login and any other account's key before anything is sent`
+  };
+}
+function fixedOrganizationAction(error, commandPrefix) {
+  return `This saved login stays in its organization. Add a login for the other workspace with ${commandPrefix} login --organization ${error.organization.id} --user ${error.profile.userId} --json, then pass its profile_name.`;
+}
+function toolError(error, dependencies, actingAs) {
+  let safe;
+  try {
+    safe = error instanceof Error && error.name === "ProfileSelectionError" ? {
+      code: error.code,
+      retryable: false,
+      suggestedAction: error.suggestedAction
+    } : error instanceof Error && error.name === "ProfileLimitError" ? {
+      code: "profile_limit_reached",
+      retryable: false,
+      suggestedAction: profileLimitAction(resolveProductCliEnvironment(dependencies.environment).commandPrefix)
+    } : error instanceof Error && error.name === "ProfileOrganizationFixedError" ? {
+      code: "profile_organization_fixed",
+      retryable: false,
+      suggestedAction: fixedOrganizationAction(error, resolveProductCliEnvironment(dependencies.environment).commandPrefix)
+    } : error instanceof Error && error.name === "AccountVerificationError" ? {
+      code: "login_verification_failed",
+      retryable: true,
+      suggestedAction: `The signed-in account could not be verified; nothing was saved. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json again.`
+    } : error instanceof Error && error.name === "CredentialStoreUnavailableError" ? {
+      code: "credential_store_unavailable",
+      retryable: true,
+      suggestedAction: "Unlock or repair this computer's credential store and retry. Saved logins were not changed."
+    } : error instanceof Error && error.name === "InteractiveSessionRequiredError" ? {
+      code: "interactive_login_required",
+      retryable: false,
+      suggestedAction: `A user API token cannot create, list or select a workspace. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json in a process without OHMYHOST_TOKEN, then retry.`
+    } : error instanceof Error && error.message.startsWith("ORGANIZATION_NOT_FOUND:") ? {
+      code: "organization_not_found",
+      retryable: false,
+      suggestedAction: "Call organization_list and choose one of the returned workspace identifiers. Do not create another workspace to recover."
+    } : error instanceof OperationEventsUnavailableError ? {
+      code: "operation_events_unavailable",
+      retryable: true,
+      suggestedAction: "Read operation_get for current status, then retry operation_logs for this same operation. Do not submit another deployment to recover logs."
+    } : error instanceof Error && error.message.startsWith("EXPORT_PASSWORD_FILE_INVALID:") ? {
+      code: "export_password_file_invalid",
+      retryable: false,
+      suggestedAction: "Choose an existing private UTF-8 password file of 1\u20131024 bytes. The user retains the file and password. Do not paste the password into MCP arguments."
+    } : parseSafeProblem(error);
+  } catch {
+    safe = {
+      code: "client_request_failed",
+      retryable: false,
+      suggestedAction: "Check the connection and run 'ohmyhost login' if authentication expired. Inspect the existing operation before resubmitting any mutation."
+    };
+  }
+  return {
+    ...toolResult({
+      error: {
+        code: safe.code,
+        retryable: safe.retryable,
+        suggested_action: safe.suggestedAction,
+        ...safe.requestId === void 0 ? {} : { request_id: safe.requestId },
+        ...safe.retryAfterSeconds === void 0 ? {} : { retry_after_seconds: safe.retryAfterSeconds },
+        ...actingAs !== void 0 && ACCOUNT_SENSITIVE_PROBLEMS.has(safe.code) ? { acting_as: actingAs } : {}
+      }
+    }),
+    isError: true
+  };
+}
 function toolResult(result) {
   const serialized = JSON.stringify(result);
   return {
@@ -6392,11 +7537,17 @@ function destructiveAnnotations() {
 // apps/mcp/dist/stdio-main.js
 var environment = {
   ...process.env["OHMYHOST_ENVIRONMENT"] === void 0 ? {} : { OHMYHOST_ENVIRONMENT: process.env["OHMYHOST_ENVIRONMENT"] },
-  ...process.env["OHMYHOST_TOKEN"] === void 0 ? {} : { OHMYHOST_TOKEN: process.env["OHMYHOST_TOKEN"] }
+  ...process.env["OHMYHOST_TOKEN"] === void 0 ? {} : { OHMYHOST_TOKEN: process.env["OHMYHOST_TOKEN"] },
+  ...process.env["OHMYHOST_PROFILE"] === void 0 ? {} : { OHMYHOST_PROFILE: process.env["OHMYHOST_PROFILE"] }
 };
 resolveProductCliEnvironment(environment);
 serveStdio(() => createLocalOhmyhostMcpServer({
   environment,
-  authenticatedClient: (signal) => createAuthenticatedLocalMcpClient(signal, { environment })
+  // Every tool call chooses its own saved login; nothing this process remembers can retarget it.
+  authenticatedClient: (signal, request) => createAuthenticatedLocalMcpClient(signal, {
+    environment,
+    ...request === void 0 ? {} : { request }
+  }),
+  listProfiles: (signal) => listSavedProfiles(signal, { environment })
 }), { onerror: (error) => process.stderr.write(`${error.message}
 `) });