@amerged/ohmyhost-mcp 0.1.19 → 0.1.21

package/dist/stdio-main.js

@@ -26,7 +26,7 @@ import {
   serverIdentityOf,
   setNegotiatedProtocolVersion,
   validateEnvelopeMeta
-} from "./chunk-PXGLL6SR.js";
+} from "./chunk-4WY7AAPR.js";
 
 // node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
 var StdioServerTransport = class {
@@ -516,7 +516,7 @@ function toError(value) {
 var failures = {
   operation_abandoned: [
     "The operation stopped renewing its execution lease and was ended.",
-    "Inspect project status and deployment diagnostics before creating a fresh plan. Keep this operation ID; the expired execution cannot resume."
+    "Inspect project status and, when this operation names a deployment_id, its diagnostics with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs before creating a fresh plan. Keep this operation ID; the expired execution cannot resume."
   ],
   database_write_rejected: [
     "The database rejected this write; it was not committed.",
@@ -580,7 +580,7 @@ var failures = {
   ],
   build_failed: [
     "The build did not produce a verified deployable artifact.",
-    "Inspect the deployment build diagnostics and verify the install and build commands for the admitted commit. Correct the reported failure before planning a new deployment."
+    "Read the BUILD_FAILED diagnostic of this operation's deployment_id with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs; its excerpt is the tail of the install and build output. Correct that failure and verify the commands for the admitted commit before planning a new deployment."
   ],
   insufficient_organization_credits: [
     "The organization does not have sufficient available credits for this operation.",
@@ -596,7 +596,7 @@ var failures = {
   ],
   runtime_candidate_failed: [
     "The deployed candidate failed its runtime checks.",
-    "Inspect deployment runtime diagnostics, required secrets and the health-check route before creating a new deployment plan."
+    "Read the HEALTH_CHECK_FAILED diagnostic of this operation's deployment_id with 'ohmyhost deployment logs --project PROJECT_ULID --deployment DEPLOYMENT_ULID --follow --json' or MCP deployment_logs. Its route must answer 2xx to a cookieless GET without a redirect; status_code and, for owners, excerpt show what it answered. Fix that, often a missing secret or a redirect, then plan a new deployment."
   ],
   runtime_candidate_rejected: [
     "The runtime rejected the built Worker script.",
@@ -799,7 +799,7 @@ function exact2(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.19",
+  version: "0.1.21",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -1210,6 +1210,15 @@ function expectPositiveInteger(value, field, options = {}) {
   return value;
 }
 
+// packages/workos-auth-contracts/dist/user-api-keys.js
+var WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
+
+// apps/product-cli/dist/profile-store.js
+import { randomUUID } from "node:crypto";
+import { link, mkdir as mkdir2, open as open2, readFile, readdir, unlink } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
 // apps/product-cli/dist/credential-store.js
 var CredentialStoreUnavailableError = class extends Error {
   constructor() {
@@ -1223,10 +1232,12 @@ var CredentialStoreIntegrityError = class extends Error {
     this.name = "CredentialStoreIntegrityError";
   }
 };
-var CREDENTIAL_ACCOUNT = "credential";
+var LEGACY_CREDENTIAL_ACCOUNT = "credential";
 var NativeNapiKeyringCredentialStore = class {
+  account;
   createEntry;
-  constructor(createEntry = void 0, serviceName = "ohmyhost") {
+  constructor(createEntry = void 0, serviceName = "ohmyhost", account = LEGACY_CREDENTIAL_ACCOUNT) {
+    this.account = account;
     this.createEntry = createEntry ?? createNativeEntryFactory(serviceName);
   }
   async read() {
@@ -1248,7 +1259,7 @@ var NativeNapiKeyringCredentialStore = class {
       throw new CredentialStoreIntegrityError();
   }
   entry() {
-    return this.createEntry(CREDENTIAL_ACCOUNT);
+    return this.createEntry(this.account);
   }
 };
 var parseVerifiedCredential = (serialized) => {
@@ -1301,6 +1312,340 @@ var parseCredential = (serialized) => {
   };
 };
 
+// apps/product-cli/dist/profile-store.js
+var ProfileNameConflictError = class extends Error {
+  profile;
+  constructor(profile) {
+    super("The profile name is used by another saved login");
+    this.profile = profile;
+    this.name = "ProfileNameConflictError";
+  }
+};
+var ProfileLimitError = class extends Error {
+  saved;
+  constructor(saved) {
+    super("The saved logins of this environment reached their limit");
+    this.saved = saved;
+    this.name = "ProfileLimitError";
+  }
+};
+var MAX_PROFILES = 64;
+var MAX_INDEX_ATTEMPTS = 64;
+var INDEX_FILE = /^index-([1-9][0-9]{0,14})\.json$/u;
+var SERVICE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+var PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,62}$/u;
+var USER_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
+var ORGANIZATION_ID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+var isProfileName = (value) => PROFILE_NAME.test(value);
+var isProfileUserId = (value) => USER_ID.test(value);
+var profileAccount = (profile) => `profile:${profile.userId}:${profile.organizationId ?? "none"}`;
+var sameLogin = (left, right) => profileAccount(left) === profileAccount(right);
+var profileIndexDirectory = (serviceName) => join(homedir(), ".ohmyhost", "profiles", serviceName);
+var nextProfileIndex = (current, profile, replaces) => [
+  ...current.filter((saved) => !sameLogin(saved, profile) && (replaces === void 0 || !sameLogin(saved, replaces))),
+  profile
+];
+var admitProfile = (next, profile) => {
+  const conflict = next.find((saved) => saved.name === profile.name && saved !== profile);
+  if (conflict !== void 0)
+    throw new ProfileNameConflictError(conflict);
+  if (next.length > MAX_PROFILES)
+    throw new ProfileLimitError(next.length - 1);
+};
+var NativeKeyringProfileRegistry = class {
+  serviceName;
+  #createEntry;
+  #index;
+  constructor(createEntry = void 0, serviceName = "ohmyhost", indexDirectory) {
+    this.serviceName = serviceName;
+    if (!SERVICE_NAME.test(serviceName))
+      throw new CredentialStoreUnavailableError();
+    this.#createEntry = createEntry ?? createNativeEntryFactory(serviceName);
+    this.#index = new ProfileIndexFiles(indexDirectory ?? profileIndexDirectory(serviceName));
+  }
+  async list() {
+    return (await this.#index.read()).profiles;
+  }
+  credential(profile) {
+    return new NativeNapiKeyringCredentialStore(this.#createEntry, this.serviceName, profileAccount(profile));
+  }
+  legacy() {
+    return new NativeNapiKeyringCredentialStore(this.#createEntry, this.serviceName, LEGACY_CREDENTIAL_ACCOUNT);
+  }
+  async save(profile, credential, replaces) {
+    assertProfile(profile);
+    const before = await this.list();
+    admitProfile(nextProfileIndex(before, profile, replaces), profile);
+    await this.credential(profile).replace(credential);
+    try {
+      await this.#index.update((current) => {
+        const next = nextProfileIndex(current, profile, replaces);
+        admitProfile(next, profile);
+        return next;
+      });
+    } catch (error) {
+      if (!before.some((saved) => sameLogin(saved, profile)))
+        await this.credential(profile).clear();
+      throw error;
+    }
+    if (replaces !== void 0 && !sameLogin(replaces, profile))
+      await this.credential(replaces).clear();
+  }
+  async remove(profile) {
+    await this.credential(profile).clear();
+    await this.#index.update((current) => current.some((saved) => sameLogin(saved, profile)) ? current.filter((saved) => !sameLogin(saved, profile)) : void 0);
+  }
+};
+var ProfileIndexFiles = class {
+  directory;
+  constructor(directory) {
+    this.directory = directory;
+  }
+  async read() {
+    for (let attempt = 0; attempt < MAX_INDEX_ATTEMPTS; attempt += 1) {
+      const version2 = await this.#newest();
+      if (version2 === 0)
+        return { version: version2, profiles: [] };
+      let serialized;
+      try {
+        serialized = await readFile(this.#file(version2), "utf8");
+      } catch (error) {
+        if (fileErrorCode(error) === "ENOENT")
+          continue;
+        throw new CredentialStoreUnavailableError();
+      }
+      return { version: version2, profiles: parseProfileIndex(serialized) };
+    }
+    throw new CredentialStoreUnavailableError();
+  }
+  /** Applies `change` to the newest index; `undefined` means nothing to change. */
+  async update(change) {
+    try {
+      await mkdir2(this.directory, { recursive: true, mode: 448 });
+    } catch {
+      throw new CredentialStoreUnavailableError();
+    }
+    for (let attempt = 0; attempt < MAX_INDEX_ATTEMPTS; attempt += 1) {
+      const { version: version2, profiles } = await this.read();
+      const next = change(profiles);
+      if (next === void 0)
+        return;
+      const temporary = join(this.directory, `.index-${randomUUID()}.tmp`);
+      try {
+        await writeDurably(temporary, serializeProfileIndex(next));
+        await link(temporary, this.#file(version2 + 1));
+      } catch (error) {
+        if (fileErrorCode(error) === "EEXIST")
+          continue;
+        throw new CredentialStoreUnavailableError();
+      } finally {
+        await removeTemporary(temporary);
+      }
+      if (await this.#newest() !== version2 + 1)
+        continue;
+      await this.#prune(version2);
+      return;
+    }
+    throw new CredentialStoreUnavailableError();
+  }
+  async #newest() {
+    let names;
+    try {
+      names = await readdir(this.directory);
+    } catch (error) {
+      if (fileErrorCode(error) === "ENOENT")
+        return 0;
+      throw new CredentialStoreUnavailableError();
+    }
+    return names.reduce((newest, name) => Math.max(newest, indexVersion(name)), 0);
+  }
+  /**
+   * Keeps the superseded version for readers that listed it just now; older ones go. Cleanup only:
+   * a file left behind is ignored, since readers take the newest version, and another process may
+   * be removing the same files at this moment.
+   */
+  async #prune(superseded) {
+    let names;
+    try {
+      names = await readdir(this.directory);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const version2 = indexVersion(name);
+      if (version2 === 0 || version2 >= superseded)
+        continue;
+      try {
+        await unlink(join(this.directory, name));
+      } catch {
+      }
+    }
+  }
+  #file(version2) {
+    return join(this.directory, `index-${String(version2)}.json`);
+  }
+};
+var indexVersion = (name) => Number(INDEX_FILE.exec(name)?.[1] ?? 0);
+var removeTemporary = async (path) => {
+  try {
+    await unlink(path);
+  } catch {
+  }
+};
+var fileErrorCode = (error) => typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
+var writeDurably = async (path, text) => {
+  const handle = await open2(path, "wx", 384);
+  try {
+    await handle.writeFile(text, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+};
+var serializeProfileIndex = (profiles) => JSON.stringify({
+  version: 1,
+  profiles: [...profiles].sort((left, right) => left.name < right.name ? -1 : 1).map((profile) => ({
+    name: profile.name,
+    user_id: profile.userId,
+    organization_id: profile.organizationId,
+    organization_name: profile.organizationName
+  }))
+});
+var parseProfileIndex = (serialized) => {
+  try {
+    const value = JSON.parse(serialized);
+    if (!isRecord(value, ["version", "profiles"]) || value["version"] !== 1)
+      throw new Error("Invalid profile index");
+    const entries = value["profiles"];
+    if (!Array.isArray(entries) || entries.length > MAX_PROFILES)
+      throw new Error("Invalid profile index");
+    const profiles = entries.map((entry) => {
+      if (!isRecord(entry, ["name", "user_id", "organization_id", "organization_name"]))
+        throw new Error("Invalid profile");
+      const profile = {
+        name: entry["name"],
+        userId: entry["user_id"],
+        organizationId: entry["organization_id"],
+        organizationName: entry["organization_name"]
+      };
+      assertProfile(profile);
+      return profile;
+    });
+    if (new Set(profiles.map((profile) => profile.name)).size !== profiles.length || new Set(profiles.map(profileAccount)).size !== profiles.length)
+      throw new Error("Duplicate profile");
+    return profiles;
+  } catch {
+    throw new CredentialStoreIntegrityError();
+  }
+};
+var assertProfile = (profile) => {
+  if (typeof profile.name !== "string" || !PROFILE_NAME.test(profile.name) || typeof profile.userId !== "string" || !USER_ID.test(profile.userId) || !(profile.organizationId === null || typeof profile.organizationId === "string" && ORGANIZATION_ID.test(profile.organizationId)) || !(profile.organizationName === null || typeof profile.organizationName === "string" && profile.organizationName.length > 0 && profile.organizationName.length <= 128 && !new RegExp("\\p{Cc}", "u").test(profile.organizationName)) || profile.organizationId === null && profile.organizationName !== null)
+    throw new CredentialStoreIntegrityError();
+};
+var isRecord = (value, keys) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).sort().join(",") === [...keys].sort().join(",");
+var selectProfile = (profiles, request) => {
+  if (request.name !== void 0 && request.bound !== void 0 && request.name !== request.bound)
+    return { outcome: "conflict", field: "binding", profile: null };
+  const named = request.name ?? request.bound;
+  if (named !== void 0) {
+    const profile = profiles.find((saved) => saved.name === named);
+    if (profile === void 0)
+      return { outcome: "not_found" };
+    if (request.organizationId !== void 0 && profile.organizationId !== request.organizationId)
+      return { outcome: "conflict", field: "organization", profile };
+    if (request.userId !== void 0 && profile.userId !== request.userId)
+      return { outcome: "conflict", field: "user", profile };
+    return { outcome: "selected", profile };
+  }
+  const candidates = profiles.filter((profile) => (request.organizationId === void 0 || profile.organizationId === request.organizationId) && (request.userId === void 0 || profile.userId === request.userId));
+  const only = candidates[0];
+  if (candidates.length === 1 && only !== void 0)
+    return { outcome: "selected", profile: only };
+  if (candidates.length > 1)
+    return { outcome: "ambiguous", candidates };
+  return profiles.length === 0 ? { outcome: "none" } : { outcome: "not_found" };
+};
+var selectProfileForOrganization = (profiles, request) => {
+  const user = request.userId === void 0 ? {} : { userId: request.userId };
+  if (request.name !== void 0 || request.bound !== void 0)
+    return selectProfile(profiles, {
+      ...request.name === void 0 ? {} : { name: request.name },
+      ...request.bound === void 0 ? {} : { bound: request.bound },
+      ...user
+    });
+  const candidates = profiles.filter((profile) => request.userId === void 0 || profile.userId === request.userId);
+  const inOrganization = candidates.filter((profile) => profile.organizationId === request.organizationId);
+  if (inOrganization.length > 1)
+    return { outcome: "ambiguous", candidates: inOrganization };
+  const unscoped = candidates.filter((profile) => profile.organizationId === null);
+  const [member] = inOrganization;
+  if (member !== void 0)
+    return { outcome: "selected", profile: member };
+  const [open4] = unscoped;
+  if (unscoped.length === 1 && open4 !== void 0)
+    return { outcome: "selected", profile: open4 };
+  return selectProfile(profiles, user);
+};
+var defaultProfileName = (profiles, login) => {
+  const same = profiles.find((profile) => profile.userId === login.userId && profile.organizationId === login.organizationId);
+  if (same !== void 0)
+    return same.name;
+  const base = slug(login.organizationName ?? "") || (login.organizationId === null ? "account" : "workspace");
+  const free = (name) => profiles.every((profile) => profile.name !== name);
+  if (free(base))
+    return base;
+  const suffix = (login.organizationId ?? login.userId).replace(/[^A-Za-z0-9]/gu, "").slice(-6).toLowerCase();
+  for (let attempt = 1; attempt <= profiles.length + 1; attempt += 1) {
+    const candidate = `${base.slice(0, 48)}-${suffix}${attempt === 1 ? "" : `-${String(attempt)}`}`;
+    if (free(candidate))
+      return candidate;
+  }
+  throw new CredentialStoreIntegrityError();
+};
+var slug = (value) => value.normalize("NFKD").replace(/[\u0300-\u036f]/gu, "").toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+/u, "").slice(0, 40).replace(/-+$/u, "");
+var publicProfile = (profile) => ({
+  name: profile.name,
+  user_id: profile.userId,
+  organization_id: profile.organizationId,
+  organization_name: profile.organizationName
+});
+var profileLimitAction = (commandPrefix) => `Nothing was saved: this environment already keeps ${String(MAX_PROFILES)} saved logins, the most one computer holds. Remove one you no longer need with '${commandPrefix} logout --profile-name NAME --json' ('${commandPrefix} profile list --json' shows them), then retry.`;
+var ProfileSelectionError = class extends Error {
+  code;
+  exitCode;
+  suggestedAction;
+  constructor(code, exitCode, suggestedAction) {
+    super(`${code}: ${suggestedAction}`);
+    this.code = code;
+    this.exitCode = exitCode;
+    this.suggestedAction = suggestedAction;
+    this.name = "ProfileSelectionError";
+  }
+};
+var profileSelectionError = (selection, request, commandPrefix, selector) => {
+  const choose = selector === "cli" ? `pass --profile-name NAME (see '${commandPrefix} profile list --json') or set OHMYHOST_PROFILE for this process` : "pass profile_name (see profile_list) or set OHMYHOST_PROFILE in this MCP server's configuration";
+  const login = `${commandPrefix} login${request.organizationId === void 0 ? "" : ` --organization ${request.organizationId}`}${request.userId === void 0 ? "" : ` --user ${request.userId}`}${(request.name ?? request.bound) === void 0 ? "" : ` --profile-name ${String(request.name ?? request.bound)}`} --json`;
+  if (selection.outcome === "none")
+    return new ProfileSelectionError("authentication_required", 5, `No login is saved on this computer. Run '${login}'.`);
+  if (selection.outcome === "not_found")
+    return new ProfileSelectionError("profile_not_found", 5, `No saved login matches ${describeRequest(request)}. Run '${login}' to add it, signing in as that user; '${commandPrefix} profile list --json' shows the saved logins.`);
+  if (selection.outcome === "ambiguous")
+    return new ProfileSelectionError("profile_selection_required", 2, `Several saved logins could run this: ${selection.candidates.map((profile2) => profile2.name).join(", ")}. Ask the customer which account to use, then ${choose}.`);
+  if (selection.field === "binding")
+    return new ProfileSelectionError("profile_context_mismatch", 2, `This call names profile ${String(request.name)}, but the process is bound to OHMYHOST_PROFILE=${String(request.bound)}. Use the bound profile or start a process for the other one.`);
+  const profile = selection.profile;
+  return new ProfileSelectionError("profile_context_mismatch", 2, selection.field === "organization" ? `Profile ${String(profile?.name)} is signed in to organization ${String(profile?.organizationId ?? "none")}, but this targets organization ${String(request.organizationId)}. Use the profile of that organization or change the target; nothing was sent.` : `Profile ${String(profile?.name)} belongs to user ${String(profile?.userId)}, not ${String(request.userId)}. Use that user's profile; nothing was sent.`);
+};
+var describeRequest = (request) => {
+  const parts = [
+    ...(request.name ?? request.bound) === void 0 ? [] : [`profile ${String(request.name ?? request.bound)}`],
+    ...request.organizationId === void 0 ? [] : [`organization ${request.organizationId}`],
+    ...request.userId === void 0 ? [] : [`user ${request.userId}`]
+  ];
+  return parts.length === 0 ? "this request" : parts.join(", ");
+};
+var describeProfile = (profile) => `profile ${profile.name} (user ${profile.userId}, ${profile.organizationId === null ? "no organization" : `organization ${profile.organizationName === null ? "" : `${profile.organizationName} `}${profile.organizationId}`})`;
+
 // apps/product-cli/dist/device-token-expiry.js
 var DeviceTokenExpiryError = class extends Error {
   constructor() {
@@ -1375,46 +1720,6 @@ var resolveDeviceTokenExpiresAt = (accessToken, expiresInSeconds, now) => {
   return new Date(jwtExpiryMilliseconds).toISOString();
 };
 
-// apps/product-cli/dist/workspace.js
-var InteractiveSessionRequiredError = class extends Error {
-  constructor() {
-    super("Workspace selection requires an interactive login");
-    this.name = "InteractiveSessionRequiredError";
-  }
-};
-var chooseWorkspace = (organizations, requested) => {
-  if (requested !== void 0) {
-    const match = organizations.find((organization) => organization.id === requested);
-    return match === void 0 ? { outcome: "not_a_member", organizations } : { outcome: "selected", organization: match };
-  }
-  if (organizations.length === 0)
-    return { outcome: "no_workspace" };
-  const only = organizations[0];
-  if (organizations.length === 1 && only !== void 0)
-    return { outcome: "selected", organization: only };
-  return { outcome: "choice_required", organizations };
-};
-var selectWorkspace = async (session, organization, signal) => {
-  const stored = await session.store.read();
-  if (stored === void 0)
-    throw new InteractiveSessionRequiredError();
-  const refreshed = await session.refresher.refresh(stored.refreshToken, signal, organization.workos_id);
-  await session.store.replace({
-    ...refreshed,
-    workosOrganizationId: organization.workos_id,
-    organizationId: organization.id
-  });
-};
-var selectedWorkspaceId = async (session) => (await session.store.read())?.organizationId ?? null;
-var workspaceOf = (credential) => ({
-  ...credential.workosOrganizationId === void 0 ? {} : { workosOrganizationId: credential.workosOrganizationId },
-  ...credential.organizationId === void 0 ? {} : { organizationId: credential.organizationId }
-});
-var publicWorkspace = (organization) => ({
-  id: organization.id,
-  name: organization.name
-});
-
 // packages/contracts/dist/feedback.js
 var FEEDBACK_HISTORY_PAGE_SIZE = 25;
 var FEEDBACK_REPLY_MAX_LENGTH = 2e3;
@@ -1648,7 +1953,7 @@ var PROBLEM_POLICY = {
   github_connection_required: {
     status: 409,
     retryable: false,
-    action: "Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for this workspace, complete its browser link, then repeat the original source link."
+    action: "This workspace has no GitHub connection yet. Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for it, complete its browser link, then repeat the original source link. If the project belongs to another account, use that account's login instead; error.acting_as names the login this ran as."
   },
   github_connection_revoked: {
     status: 409,
@@ -1722,7 +2027,11 @@ var PROBLEM_POLICY = {
     retryable: false,
     action: "Run 'ohmyhost organization list --json' and select one with 'ohmyhost organization use --organization ULID --json', or create the first workspace."
   },
-  resource_not_found: { status: 404, retryable: false, action: "Check the resource identifier." },
+  resource_not_found: {
+    status: 404,
+    retryable: false,
+    action: "Check the resource identifier and the account: a project is visible only to its own organization, and error.acting_as names the login this ran as. Use the login of the account that owns it."
+  },
   idempotency_key_reused: {
     status: 409,
     retryable: false,
@@ -1859,6 +2168,11 @@ var PROBLEM_POLICY = {
     retryable: false,
     action: "Finish database provisioning, then request the export again. No backup was accepted."
   },
+  powered_by_flag_required: {
+    status: 409,
+    retryable: false,
+    action: "Keep the flag on, remove the custom domain with 'ohmyhost domain paid delete', or buy Paid, then switch the flag off."
+  },
   rate_limited: { status: 429, retryable: true, action: "Retry after the server delay." },
   insufficient_organization_credits: {
     status: 402,
@@ -1873,7 +2187,7 @@ var PROBLEM_POLICY = {
   paid_plan_required: {
     status: 402,
     retryable: false,
-    action: "Ask the organization Owner to activate Paid through billing checkout, then retry. Top-ups and signup credits do not activate Paid."
+    action: "Ask the organization Owner to activate Paid through billing checkout, then retry. Top-ups and signup credits do not activate Paid. For a website domain alone, a Free workspace may instead show the powered-by flag on the project."
   },
   interactive_login_required: {
     status: 403,
@@ -1981,6 +2295,18 @@ var parseDevAccessState = (value) => {
     throw new ResponseContractError();
   return input;
 };
+var parsePoweredByFlag = (value) => {
+  const input = exactRecord2(value, ["project_id", "enabled", "enabled_at"]);
+  if (!isUlid(input["project_id"]) || typeof input["enabled"] !== "boolean" || (input["enabled"] ? !isIsoInstant(input["enabled_at"]) : input["enabled_at"] !== null))
+    throw new ResponseContractError();
+  return input;
+};
+var parseOrganizationReferral = (value) => {
+  const input = exactRecord2(value, ["organization_id", "referral_url"]);
+  if (!isUlid(input["organization_id"]) || input["referral_url"] !== `https://ohmyho.st/?r=ref-${String(input["organization_id"]).toLowerCase()}`)
+    throw new ResponseContractError();
+  return input;
+};
 var parseDevAccessTicket = (value) => {
   const input = exactRecord2(value, [
     "ticket_id",
@@ -2034,7 +2360,7 @@ var parseAccountProfile = (value) => {
   });
   if (new Set(workspaces.map((workspace) => workspace.id)).size !== organizationIds.length)
     throw new ResponseContractError();
-  return workspaces;
+  return { userId: input["user_id"], organizations: workspaces };
 };
 var parseSafeProblem = (value) => {
   const input = exactRecord2(value, [
@@ -2072,6 +2398,7 @@ var parseSafeProblem = (value) => {
 var parseOperation = (value) => {
   const input = exactRecord2(value, [
     "blocking_operation_id",
+    "deployment_id",
     "id",
     "state",
     "created_at",
@@ -2087,9 +2414,10 @@ var parseOperation = (value) => {
   const updatedAt = input["updated_at"];
   const result = input["result"];
   const blockingOperationId = input["blocking_operation_id"];
-  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3))
+  const deploymentId = input["deployment_id"];
+  if (blockingOperationId !== void 0 && (state !== "queued" || !isUlid(blockingOperationId) || blockingOperationId === id3) || deploymentId !== void 0 && !isUlid(deploymentId))
     throw new ResponseContractError();
-  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord(result)) {
+  if (!isUlid(id3) || !isOperationState(state) || !isIsoInstant(createdAt) || !isIsoInstant(updatedAt) || result !== void 0 && !isRecord2(result)) {
     throw new ResponseContractError();
   }
   let progress;
@@ -2134,6 +2462,7 @@ var parseOperation = (value) => {
     created_at: createdAt,
     updated_at: updatedAt,
     ...blockingOperationId === void 0 ? {} : { blocking_operation_id: blockingOperationId },
+    ...deploymentId === void 0 ? {} : { deployment_id: deploymentId },
     ...progress === void 0 ? {} : { progress },
     ...result === void 0 ? {} : { result },
     ...error === void 0 ? {} : { error },
@@ -2150,12 +2479,12 @@ function parseOperationFailure(value) {
   return safe;
 }
 var exactRecord2 = (value, allowed) => {
-  if (!isRecord(value) || Object.keys(value).some((key) => !allowed.includes(key))) {
+  if (!isRecord2(value) || Object.keys(value).some((key) => !allowed.includes(key))) {
     throw new ResponseContractError();
   }
   return value;
 };
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var boundedString = (value, minimum, maximum) => typeof value === "string" && value.length >= minimum && value.length <= maximum;
 var isUlid = (value) => typeof value === "string" && /^[0-9A-HJKMNP-TV-Z]{26}$/u.test(value);
 var isIsoInstant = (value) => typeof value === "string" && value.length <= 64 && Number.isFinite(Date.parse(value));
@@ -2178,6 +2507,79 @@ var isPaidValidationRecord = (value) => {
   return (record5["type"] === "CNAME" || record5["type"] === "TXT") && boundedString(record5["name"], 1, 253) && boundedString(record5["content"], 1, 2048) && ["traffic", "ownership", "ssl", "dcv_delegation"].includes(String(record5["purpose"]));
 };
 
+// apps/product-cli/dist/workspace.js
+var InteractiveSessionRequiredError = class extends Error {
+  constructor() {
+    super("Workspace selection requires an interactive login");
+    this.name = "InteractiveSessionRequiredError";
+  }
+};
+var ProfileOrganizationFixedError = class extends Error {
+  profile;
+  organization;
+  constructor(profile, organization) {
+    super("The saved login is bound to another organization");
+    this.profile = profile;
+    this.organization = organization;
+    this.name = "ProfileOrganizationFixedError";
+  }
+};
+var AccountVerificationError = class extends Error {
+  constructor() {
+    super("The signed-in account does not match the requested one");
+    this.name = "AccountVerificationError";
+  }
+};
+var chooseWorkspace = (organizations, requested) => {
+  if (requested !== void 0) {
+    const match = organizations.find((organization) => organization.id === requested);
+    return match === void 0 ? { outcome: "not_a_member", organizations } : { outcome: "selected", organization: match };
+  }
+  if (organizations.length === 0)
+    return { outcome: "no_workspace" };
+  const only = organizations[0];
+  if (organizations.length === 1 && only !== void 0)
+    return { outcome: "selected", organization: only };
+  return { outcome: "choice_required", organizations };
+};
+var verifiedUserId = (identity) => {
+  const actor = parseCurrentIdentity(identity).actor_id;
+  if (!actor.startsWith("user:") || actor.length === 5)
+    throw new AccountVerificationError();
+  return actor.slice(5);
+};
+var assertVerifiedLogin = (identity, userId, organizationId) => {
+  const organizations = parseCurrentIdentity(identity).organization_ids;
+  if (verifiedUserId(identity) !== userId || (organizationId === null ? organizations.length !== 0 : organizations.length !== 1 || organizations[0] !== organizationId))
+    throw new AccountVerificationError();
+};
+var selectWorkspace = async (session, organization, signal, identity) => {
+  if (session.profile.organizationId === organization.id)
+    return session.profile;
+  if (session.profile.organizationId !== null)
+    throw new ProfileOrganizationFixedError(session.profile, organization);
+  const stored = await session.store.read();
+  if (stored === void 0)
+    throw new InteractiveSessionRequiredError();
+  const refreshed = await session.refresher.refresh(stored.refreshToken, signal, organization.workos_id);
+  assertVerifiedLogin(await identity(refreshed.accessToken), session.profile.userId, organization.id);
+  const bound = {
+    ...session.profile,
+    organizationId: organization.id,
+    organizationName: organization.name
+  };
+  await session.profiles.save(bound, { ...refreshed, workosOrganizationId: organization.workos_id, organizationId: organization.id }, session.profile);
+  return bound;
+};
+var workspaceOf = (credential) => ({
+  ...credential.workosOrganizationId === void 0 ? {} : { workosOrganizationId: credential.workosOrganizationId },
+  ...credential.organizationId === void 0 ? {} : { organizationId: credential.organizationId }
+});
+var publicWorkspace = (organization) => ({
+  id: organization.id,
+  name: organization.name
+});
+
 // apps/product-cli/dist/cli.js
 var NetworkTransportError = class extends Error {
   constructor() {
@@ -2206,14 +2608,16 @@ var PublicResponseTooLargeError = class extends Error {
 var CLI_VERSION = package_default.version;
 var HELP_USAGE = Object.freeze({
   init: "ohmyhost init [--directory PATH] [--root PATH] [--project SLUG] [--region us|eu] [--dry-run] --json (pass the project's hosting region so storage.jurisdiction matches it; us when omitted)",
-  login: "ohmyhost login [--organization ULID] --json",
-  logout: "ohmyhost logout [--revoke] --json",
-  whoami: "ohmyhost whoami --json",
+  login: "ohmyhost login [--organization ULID] [--user USER_ID] [--profile-name NAME] --json (adds one saved login; nothing is saved unless the browser signed in as that user and organization)",
+  logout: "ohmyhost logout [--profile-name NAME] [--revoke] --json (removes only the selected saved login)",
+  whoami: "ohmyhost whoami [--profile-name NAME] --json (the effective user, organization and saved login)",
+  "profile list": "ohmyhost profile list --json (saved logins on this computer: name, user and organization, never a token; pass --profile-name NAME or set OHMYHOST_PROFILE to choose one)",
   "github connect": "ohmyhost github connect --organization ULID --idempotency-key KEY --json (connect once, then link covered repositories without another browser consent)",
   "github status": "ohmyhost github status --organization ULID --json",
   "export create": "ohmyhost export create --project ULID --idempotency-key KEY --stdin --json (password on stdin only; one accepted SQL ZIP per project per 24 hours)",
   "export get": "ohmyhost export get EXPORT_ULID --project ULID --json (poll the original job; signed ZIP download lasts 24 hours)",
   "credits account": "ohmyhost credits account --organization ULID --json",
+  "referral link": "ohmyhost referral link --organization ULID --json (the workspace's link to share; a new user who signs up through it starts with a free Paid month and 1,000 credits, and their first payment gives this workspace the same)",
   "credits balance": "ohmyhost credits balance --organization ULID --json",
   "billing recharge get": "ohmyhost billing recharge get --organization ULID --json",
   "billing recharge set": "ohmyhost billing recharge set --organization ULID --enabled true|false --monthly-limit-minor CENTS --revision N --idempotency-key KEY [--consent off_session_v1] --json (explicit Owner consent required before enabling)",
@@ -2223,9 +2627,9 @@ var HELP_USAGE = Object.freeze({
   "credits usage": "ohmyhost credits usage --organization ULID --month YYYY-MM [--cursor ULID] --json",
   "budget get": "ohmyhost budget get --project ULID --json",
   "budget set": "ohmyhost budget set --project ULID --credits NUMBER|none [--mode continue|stop] --idempotency-key KEY --json",
-  "organization create": "ohmyhost organization create --name NAME --idempotency-key KEY [--source SOURCE] --json (SOURCE is optional attribution from a link's r value; the new workspace is selected immediately)",
-  "organization list": "ohmyhost organization list --json (the workspaces you belong to and the selected one)",
-  "organization use": "ohmyhost organization use --organization ULID --json",
+  "organization create": "ohmyhost organization create --name NAME --idempotency-key KEY [--source SOURCE] --json (SOURCE is optional attribution from a link's r value; a login without organization is bound to the new workspace, another login keeps its own)",
+  "organization list": "ohmyhost organization list [--profile-name NAME] --json (the workspaces of the chosen login's user and the one that login is scoped to)",
+  "organization use": "ohmyhost organization use --organization ULID [--profile-name NAME] --json (binds a login that has no organization yet; another organization needs its own login)",
   "operation get": "ohmyhost operation get OPERATION_ULID --json",
   "operation reconcile": "ohmyhost operation reconcile OPERATION_ULID --idempotency-key KEY --yes --json",
   "token create": "ohmyhost token create --organization ULID --name NAME --idempotency-key KEY --out .env.local --json",
@@ -2243,6 +2647,8 @@ var HELP_USAGE = Object.freeze({
   "project dev-share rotate": "ohmyhost project dev-share rotate --project ULID --idempotency-key KEY --yes --json",
   "project dev-share revoke": "ohmyhost project dev-share revoke --project ULID --idempotency-key KEY --yes --json",
   "project dev-access mode": "ohmyhost project dev-access mode --project ULID --mode protected|public --idempotency-key KEY --yes --json",
+  "project flag status": "ohmyhost project flag status --project ULID --json",
+  "project flag set": "ohmyhost project flag set --project ULID --enabled true|false --idempotency-key KEY --json (shows the small Powered by ohmyho.st flag on the production site; while it shows, a Free workspace may connect its own domain without the domain fee and each Paid period adds 250 credits)",
   "project handle check": "ohmyhost project handle check --handle HANDLE --json (is this address free? answers with a reason and free alternatives; the address becomes HANDLE.check.omh.st)",
   "project handle set": "ohmyhost project handle set --project ULID --handle HANDLE --if-match ETAG --idempotency-key KEY --json (moves the project to a free address; the old one stops working and anyone may claim it)",
   "database compute set": "ohmyhost database compute set --project ULID --environment dev|prod --profile standard|performance --idempotency-key KEY --yes [--wait] --json\n  standard: Free 0.25 CU/1 GB/60s idle, Paid 0.5 CU/2 GB/60s idle. performance: Paid 1 CU/4 GB/300s idle, 2.5x database compute credits per equal active minute; longer idle time also consumes credits.",
@@ -2275,7 +2681,7 @@ var HELP_USAGE = Object.freeze({
   delete: "ohmyhost delete --project ULID --if-match ETAG --confirmation-token TOKEN --idempotency-key KEY --yes --json",
   "secret list": "ohmyhost secret list --project ULID --environment ENVIRONMENT_ULID --json",
   "function runs": "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
-  "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY --stdin [--wait] --json`,
+  "secret set": `printf '%s' "$SECRET_VALUE" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)`,
   "secret delete": "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
   "mail setup": "ohmyhost mail setup --project ULID --environment ULID --domain DOMAIN --sending true --receiving false --idempotency-key KEY --json",
   "mail status": "ohmyhost mail status --project ULID --environment ULID --json",
@@ -2291,6 +2697,14 @@ var HELP_USAGE = Object.freeze({
 });
 var HELP_COMMANDS = Object.freeze(Object.entries(HELP_USAGE).map(([command, usage]) => Object.freeze({ command, usage })));
 var SIGN_IN_WINDOW_MS = 30 * 60 * 1e3;
+var ACCOUNT_SENSITIVE_PROBLEMS = /* @__PURE__ */ new Set([
+  "resource_not_found",
+  "forbidden",
+  "organization_required",
+  "github_connection_required",
+  "github_connection_revoked",
+  "repository_not_installed"
+]);
 
 // packages/sdk-ts/dist/generated/core/bodySerializer.gen.js
 var jsonBodySerializer = {
@@ -3176,6 +3590,23 @@ var getGithubOrganizationConnection = (parameters, options) => {
     ...params
   });
 };
+var getOrganizationReferral = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "organization_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/organizations/{organization_id}/referral",
+    ...options,
+    ...params
+  });
+};
 var getOrganizationAccount = (parameters, options) => {
   const params = buildClientParams([parameters], [{ args: [{ in: "path", key: "organization_id" }] }]);
   return (options?.client ?? client).get({
@@ -3780,6 +4211,47 @@ var setProjectDevAccessMode = (parameters, options) => {
     }
   });
 };
+var getProjectPoweredByFlag = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/powered-by-flag",
+    ...options,
+    ...params
+  });
+};
+var setProjectPoweredByFlag = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { key: "setPoweredByFlagRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/powered-by-flag",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 var createProjectDevAccessTicket = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -3855,31 +4327,7 @@ var getProjectSource = (parameters, options) => {
     ...params
   });
 };
-var createCloudflareDnsAuthorization = (parameters, options) => {
-  const params = buildClientParams([parameters], [
-    {
-      args: [
-        { in: "headers", key: "X-Request-Id" },
-        { in: "headers", key: "Idempotency-Key" },
-        { in: "path", key: "project_id" },
-        { key: "createCloudflareDnsAuthorizationRequest", map: "body" }
-      ]
-    }
-  ]);
-  return (options?.client ?? client).post({
-    responseStyle: "data",
-    security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/cloudflare-dns/authorization",
-    ...options,
-    ...params,
-    headers: {
-      "Content-Type": "application/json",
-      ...options?.headers,
-      ...params.headers
-    }
-  });
-};
-var getCloudflareDnsAuthorizationStatus = (parameters, options) => {
+var getProjectSourceAutoDeploy = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
@@ -3891,27 +4339,26 @@ var getCloudflareDnsAuthorizationStatus = (parameters, options) => {
   return (options?.client ?? client).get({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/cloudflare-dns",
+    url: "/v1/projects/{project_id}/source/auto-deploy",
     ...options,
     ...params
   });
 };
-var changeProjectHandle = (parameters, options) => {
+var configureProjectSourceAutoDeploy = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
         { in: "headers", key: "Idempotency-Key" },
-        { in: "headers", key: "If-Match" },
         { in: "path", key: "project_id" },
-        { in: "body", key: "handle" }
+        { key: "configureSourceAutoDeployRequest", map: "body" }
       ]
     }
   ]);
   return (options?.client ?? client).put({
     responseStyle: "data",
     security: [{ scheme: "bearer", type: "http" }],
-    url: "/v1/projects/{project_id}/handle",
+    url: "/v1/projects/{project_id}/source/auto-deploy",
     ...options,
     ...params,
     headers: {
@@ -3921,13 +4368,97 @@ var changeProjectHandle = (parameters, options) => {
     }
   });
 };
-var planPaidProjectDomain = (parameters, options) => {
+var createCloudflareDnsAuthorization = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
       args: [
         { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
         { in: "path", key: "project_id" },
-        { key: "paidDomainRequest", map: "body" }
+        { key: "createCloudflareDnsAuthorizationRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).post({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/cloudflare-dns/authorization",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var getCloudflareDnsAuthorizationStatus = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/cloudflare-dns",
+    ...options,
+    ...params
+  });
+};
+var changeProjectHandle = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "headers", key: "If-Match" },
+        { in: "path", key: "project_id" },
+        { in: "body", key: "handle" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/handle",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
+var configureProjectDomains = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/domains",
+    ...options,
+    ...params
+  });
+};
+var planPaidProjectDomain = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { key: "paidDomainRequest", map: "body" }
       ]
     }
   ]);
@@ -4113,6 +4644,24 @@ var getDeploymentLogs = (parameters, options) => {
     ...params
   });
 };
+var streamDeploymentLogs = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "deployment_id" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).sse.get({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/deployments/{deployment_id}/logs/events",
+    ...options,
+    ...params
+  });
+};
 var getDatabaseCompute = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -4398,6 +4947,32 @@ var deleteEnvironmentSecret = (parameters, options) => {
     ...params
   });
 };
+var putEnvironmentSecret = (parameters, options) => {
+  const params = buildClientParams([parameters], [
+    {
+      args: [
+        { in: "headers", key: "X-Request-Id" },
+        { in: "headers", key: "Idempotency-Key" },
+        { in: "path", key: "project_id" },
+        { in: "path", key: "environment_id" },
+        { in: "path", key: "secret_name" },
+        { key: "putEnvironmentSecretRequest", map: "body" }
+      ]
+    }
+  ]);
+  return (options?.client ?? client).put({
+    responseStyle: "data",
+    security: [{ scheme: "bearer", type: "http" }],
+    url: "/v1/projects/{project_id}/environments/{environment_id}/secrets/{secret_name}",
+    ...options,
+    ...params,
+    headers: {
+      "Content-Type": "application/json",
+      ...options?.headers,
+      ...params.headers
+    }
+  });
+};
 var getOperation = (parameters, options) => {
   const params = buildClientParams([parameters], [
     {
@@ -4765,120 +5340,526 @@ function assertManagedMailResponse(value, input) {
     if (typeof a["id"] !== "string" || !/^[A-Za-z0-9_-]{1,128}$/u.test(a["id"]) || a["filename"] !== null && typeof a["filename"] !== "string" || typeof a["content_type"] !== "string" || a["download_path"] !== `/v1/projects/${input.projectId}/environments/${input.environmentId}/mail/messages/${input.messageId}/attachments/${a["id"]}`)
       invalid3();
   }
-}
-function object2(v) {
-  if (typeof v !== "object" || v === null || Array.isArray(v))
-    invalid3();
-  return v;
-}
-function exact3(v, required, optional = []) {
-  if (required.some((k) => !(k in v)) || Object.keys(v).some((k) => !required.includes(k) && !optional.includes(k)))
-    invalid3();
-}
-function id2(v) {
-  if (typeof v !== "string" || !ULID.test(v))
-    invalid3();
-}
-function domain(v) {
-  if (typeof v !== "string" || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(v))
-    invalid3();
-}
-function time(v) {
-  if (typeof v !== "string" || !Number.isFinite(Date.parse(v)) || new Date(v).toISOString() !== v)
-    invalid3();
-}
-function https(v) {
-  if (typeof v !== "string" || !v.startsWith("https://"))
-    invalid3();
-}
-function records(v) {
-  if (!Array.isArray(v))
-    invalid3();
-  for (const value of v) {
-    const r = object2(value);
-    exact3(r, ["type", "name", "value", "purpose", "status"], ["priority"]);
-    if (!["TXT", "CNAME", "MX"].includes(String(r["type"])) || ["name", "value", "purpose", "status"].some((k) => typeof r[k] !== "string") || r["type"] === "MX" && (!Number.isInteger(r["priority"]) || Number(r["priority"]) < 0 || Number(r["priority"]) > 65535))
-      invalid3();
+}
+function object2(v) {
+  if (typeof v !== "object" || v === null || Array.isArray(v))
+    invalid3();
+  return v;
+}
+function exact3(v, required, optional = []) {
+  if (required.some((k) => !(k in v)) || Object.keys(v).some((k) => !required.includes(k) && !optional.includes(k)))
+    invalid3();
+}
+function id2(v) {
+  if (typeof v !== "string" || !ULID.test(v))
+    invalid3();
+}
+function domain(v) {
+  if (typeof v !== "string" || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(v))
+    invalid3();
+}
+function time(v) {
+  if (typeof v !== "string" || !Number.isFinite(Date.parse(v)) || new Date(v).toISOString() !== v)
+    invalid3();
+}
+function https(v) {
+  if (typeof v !== "string" || !v.startsWith("https://"))
+    invalid3();
+}
+function records(v) {
+  if (!Array.isArray(v))
+    invalid3();
+  for (const value of v) {
+    const r = object2(value);
+    exact3(r, ["type", "name", "value", "purpose", "status"], ["priority"]);
+    if (!["TXT", "CNAME", "MX"].includes(String(r["type"])) || ["name", "value", "purpose", "status"].some((k) => typeof r[k] !== "string") || r["type"] === "MX" && (!Number.isInteger(r["priority"]) || Number(r["priority"]) < 0 || Number(r["priority"]) > 65535))
+      invalid3();
+  }
+}
+function invalid3() {
+  throw new TypeError("Mail response contract invalid");
+}
+
+// packages/sdk-ts/dist/managed-mail.js
+function requestManagedMail(client2, input) {
+  const scope = { project_id: input.projectId, environment_id: input.environmentId };
+  switch (input.action) {
+    case "configure":
+      return configureManagedMailDomain({
+        ...scope,
+        "Idempotency-Key": input.idempotencyKey,
+        managedMailDomainRequest: {
+          domain: input.domain,
+          sending: input.sending,
+          receiving: input.receiving
+        }
+      }, { client: client2 });
+    case "status":
+      return getManagedMailDomain(scope, { client: client2 });
+    case "webhook_set":
+      return prepareManagedMailWebhook({
+        ...scope,
+        "Idempotency-Key": input.idempotencyKey,
+        managedMailWebhookRequest: { url: input.url }
+      }, { client: client2 });
+    case "webhook_verify":
+      return verifyManagedMailWebhook({ ...scope, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
+    case "webhook_disable":
+      return disableManagedMailReceiving({ ...scope, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
+    case "domain_delete":
+      return deleteManagedMailDomain({ ...scope, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
+    case "messages_list":
+      return listManagedMailMessages({ ...scope, ...input.after ? { after: input.after } : {} }, { client: client2 });
+    case "message_get":
+      return getManagedMailMessage({ ...scope, message_id: input.messageId }, { client: client2 });
+    case "message_retry":
+      return retryManagedMailMessage({ ...scope, message_id: input.messageId, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
+  }
+}
+async function executeManagedMail(client2, input) {
+  const result = await requestManagedMail(client2, input);
+  assertManagedMailResponse(result, input);
+  return result;
+}
+
+// packages/workos-auth-contracts/dist/device-flow.js
+var WORKOS_AUTHKIT_DEVICE_TOKEN_ENDPOINT = "https://api.workos.com/user_management/authenticate";
+var allowedDeviceTokenFields = /* @__PURE__ */ new Set([
+  "access_token",
+  "refresh_token",
+  "token_type",
+  "expires_in",
+  "organization_id",
+  "authentication_method",
+  "user"
+]);
+var parseDeviceTokens = (value) => {
+  const input = expectRecord(value);
+  for (const field of Object.keys(input)) {
+    if (!allowedDeviceTokenFields.has(field)) {
+      throw new WorkosContractError("unexpected_device_token_field", "Device Flow response contained an unexpected field");
+    }
+  }
+  const expiresIn = expectPositiveInteger(input["expires_in"], "expires_in", { optional: true });
+  const organizationId = expectString(input["organization_id"], "organization_id", {
+    optional: true
+  });
+  return {
+    accessToken: expectString(input["access_token"], "access_token"),
+    refreshToken: expectString(input["refresh_token"], "refresh_token"),
+    tokenType: expectString(input["token_type"], "token_type", { optional: true }) ?? "Bearer",
+    ...expiresIn === void 0 ? {} : { expiresInSeconds: expiresIn },
+    ...organizationId === void 0 ? {} : { organizationId }
+  };
+};
+
+// apps/product-cli/dist/product-api.js
+var GeneratedSdkProductApi = class {
+  #client;
+  constructor(baseUrl, accessToken, fetch2) {
+    this.#client = createClient({ auth: accessToken, baseUrl, fetch: fetch2, throwOnError: true });
+  }
+  async changeDatabaseCompute(input) {
+    return changeDatabaseCompute({
+      project_id: input.projectId,
+      environment: input.environment,
+      profile: input.profile,
+      confirm: true,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client });
+  }
+  async getDatabaseCompute(input) {
+    const value = await getDatabaseCompute({ project_id: input.projectId, environment: input.environment }, { client: this.#client });
+    assertDatabaseCompute(value);
+    if (value.project_id !== input.projectId || value.environment !== input.environment)
+      throw new TypeError("Compute response scope mismatch");
+    return value;
+  }
+  async getProjectContext(projectId) {
+    const result = await getProjectContext({ project_id: projectId }, { client: this.#client });
+    assertProjectContext(result);
+    if (result.project_id !== projectId)
+      throw new TypeError("Project context scope mismatch");
+    return result;
+  }
+  async setProjectNotes(input) {
+    const result = await setProjectNotes({
+      project_id: input.projectId,
+      markdown: input.markdown,
+      expected_version: input.expectedVersion,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client });
+    assertProjectNotesReceipt(result);
+    return result;
+  }
+  createProjectExport(input) {
+    return createProjectExport({
+      project_id: input.projectId,
+      password: input.password,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client });
+  }
+  async getProjectExport(input) {
+    const result = await getProjectExport({ project_id: input.projectId, export_id: input.exportId }, { client: this.#client });
+    assertProjectExport(result);
+    return result;
+  }
+  async getCurrentIdentity() {
+    return getCurrentIdentity({}, { client: this.#client });
+  }
+  async getAccountProfile() {
+    return parseAccountProfile(await getAccountProfile({ client: this.#client }));
+  }
+  getOrganizationReferral(organizationId) {
+    return getOrganizationReferral({ organization_id: organizationId }, { client: this.#client });
+  }
+  getOrganizationAccount(organizationId) {
+    return getOrganizationAccount({ organization_id: organizationId }, { client: this.#client });
+  }
+  getOrganizationCredits(organizationId) {
+    return getOrganizationCredits({ organization_id: organizationId }, { client: this.#client });
+  }
+  async createUserApiKey(input) {
+    return parseUserApiKeyCreation(await createUserApiKey({
+      organization_id: input.organizationId,
+      name: input.name,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client }));
+  }
+  async listUserApiKeys(input) {
+    return parseUserApiKeyPage(await listUserApiKeys({ organization_id: input.organizationId, ...input.after ? { after: input.after } : {} }, { client: this.#client }));
+  }
+  async revokeUserApiKey(input) {
+    await revokeUserApiKey({ organization_id: input.organizationId, key_id: input.keyId }, { client: this.#client });
+  }
+  createBillingCheckout(input) {
+    return createBillingCheckout({
+      organization_id: input.organizationId,
+      offer: input.offer,
+      packs: input.packs,
+      "Idempotency-Key": input.idempotencyKey
+    }, { client: this.#client });
+  }
+  getBillingCheckout(input) {
+    return getBillingCheckout({ organization_id: input.organizationId, checkout_id: input.checkoutId }, { client: this.#client });
+  }
+  getBillingRecharge(organizationId) {
+    return getBillingRecharge({ organization_id: organizationId }, { client: this.#client });
+  }
+  configureBillingRecharge(input) {
+    return configureBillingRecharge({
+      organization_id: input.organizationId,
+      "Idempotency-Key": input.idempotencyKey,
+      enabled: input.enabled,
+      monthly_limit_minor: input.monthlyLimitMinor,
+      consent: input.consent,
+      revision: input.revision
+    }, { client: this.#client });
+  }
+  createBillingPortal(organizationId) {
+    return createBillingPortal({ organization_id: organizationId, body: {} }, { client: this.#client });
+  }
+  getOrganizationCreditUsage(input) {
+    return getOrganizationCreditUsage({
+      organization_id: input.organizationId,
+      month: input.month,
+      ...input.cursor ? { cursor: input.cursor } : {}
+    }, { client: this.#client });
+  }
+  getProjectCreditBudget(projectId) {
+    return getProjectCreditBudget({ project_id: projectId }, { client: this.#client });
+  }
+  setProjectCreditBudget(input) {
+    return setProjectCreditBudget({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      setProjectCreditBudgetRequest: { amount_micros: input.amountMicros, mode: input.mode }
+    }, { client: this.#client });
+  }
+  createOrganization(input) {
+    return createOrganization({
+      "Idempotency-Key": input.idempotencyKey,
+      createOrganizationRequest: {
+        name: input.name,
+        ...input.signupSource === void 0 ? {} : { signup_source: input.signupSource }
+      }
+    }, { client: this.#client });
+  }
+  async listProjects(input) {
+    return listProjects(input, { client: this.#client });
+  }
+  async changeProjectHandle(input) {
+    return changeProjectHandle({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      handle: input.handle
+    }, { client: this.#client });
+  }
+  async checkProjectHandle(input) {
+    return getProjectHandleAvailability({ handle: input.handle }, { client: this.#client });
+  }
+  async getProjectStatus(projectId) {
+    return getProjectStatus({ project_id: projectId }, { client: this.#client });
+  }
+  async writeProjectDatabase(input) {
+    return writeProjectDatabase({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      projectDatabaseWriteRequest: {
+        environment: input.environment,
+        statement: input.statement,
+        parameters: [...input.parameters]
+      }
+    }, { client: this.#client });
+  }
+  async queryProjectDatabase(input) {
+    return queryProjectDatabase({
+      project_id: input.projectId,
+      projectDatabaseQueryRequest: {
+        environment: input.environment,
+        statement: input.statement,
+        parameters: [...input.parameters]
+      }
+    }, { client: this.#client });
+  }
+  /** The connection URI exists only in this response; nothing in the CLI persists it. */
+  async createProjectDatabaseAccess(input) {
+    const value = await createProjectDatabaseAccess({
+      project_id: input.projectId,
+      projectDatabaseAccessRequest: {
+        environment: input.environment,
+        mode: input.mode,
+        ttl_seconds: input.ttlSeconds,
+        label: input.label
+      }
+    }, { client: this.#client });
+    assertProjectDatabaseAccessCredential(value);
+    return value;
+  }
+  async listProjectDatabaseAccess(input) {
+    const value = await listProjectDatabaseAccess({
+      project_id: input.projectId,
+      ...input.environment === void 0 ? {} : { environment: input.environment }
+    }, { client: this.#client });
+    assertProjectDatabaseAccessPage(value);
+    return value;
+  }
+  async revokeProjectDatabaseAccess(input) {
+    const value = await revokeProjectDatabaseAccess({ project_id: input.projectId, access_id: input.accessId }, { client: this.#client });
+    assertProjectDatabaseAccess(value);
+    return value;
+  }
+  async planPaidDomain(input) {
+    return planPaidProjectDomain({ project_id: input.projectId, paidDomainRequest: { hostname: input.hostname } }, { client: this.#client });
+  }
+  async applyPaidDomain(input) {
+    return applyPaidProjectDomain({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      paidDomainRequest: { hostname: input.hostname }
+    }, { client: this.#client });
+  }
+  async getPaidDomain(projectId) {
+    return getPaidProjectDomain({ project_id: projectId }, { client: this.#client });
+  }
+  async deletePaidDomain(input) {
+    return deletePaidProjectDomain({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      paidDomainRequest: { hostname: input.hostname }
+    }, { client: this.#client });
+  }
+  async ensureDevShareLink(projectId) {
+    return ensureProjectDevShareLink({ project_id: projectId }, { client: this.#client });
+  }
+  async rotateDevShareLink(projectId, idempotencyKey2) {
+    return rotateProjectDevShareLink({ project_id: projectId, "Idempotency-Key": idempotencyKey2 }, { client: this.#client });
+  }
+  async revokeDevShareLink(projectId, idempotencyKey2) {
+    return revokeProjectDevShareLink({ project_id: projectId, "Idempotency-Key": idempotencyKey2 }, { client: this.#client });
+  }
+  async setDevAccessMode(projectId, mode, idempotencyKey2) {
+    return setProjectDevAccessMode({
+      project_id: projectId,
+      "Idempotency-Key": idempotencyKey2,
+      setDevAccessModeRequest: { mode }
+    }, { client: this.#client });
+  }
+  async getPoweredByFlag(projectId) {
+    return getProjectPoweredByFlag({ project_id: projectId }, { client: this.#client });
+  }
+  async setPoweredByFlag(projectId, enabled, idempotencyKey2) {
+    return setProjectPoweredByFlag({
+      project_id: projectId,
+      "Idempotency-Key": idempotencyKey2,
+      setPoweredByFlagRequest: { enabled }
+    }, { client: this.#client });
+  }
+  async createDevAccessTicket(projectId) {
+    return createProjectDevAccessTicket({ project_id: projectId }, { client: this.#client });
+  }
+  async submitFeedback(input) {
+    return parseFeedbackReceipt(await submitFeedback({ "Idempotency-Key": input.idempotencyKey, feedbackSubmission: input.report }, { client: this.#client }));
+  }
+  async getFeedback(feedbackId, cursor) {
+    return parseFeedbackStatus(await getFeedback({ feedback_id: feedbackId, ...cursor === void 0 ? {} : { cursor } }, { client: this.#client }));
+  }
+  async createProject(input) {
+    return createProject({
+      "Idempotency-Key": input.idempotencyKey,
+      createProjectRequest: {
+        organization_id: input.organizationId,
+        name: input.name,
+        ...input.dataMode === void 0 ? {} : { data_mode: input.dataMode },
+        ...input.devAccessMode === void 0 ? {} : { dev_access_mode: input.devAccessMode },
+        ...input.region === void 0 ? {} : { region: input.region }
+      }
+    }, { client: this.#client });
+  }
+  async getOperation(operationId) {
+    return getOperation({ operation_id: operationId }, { client: this.#client });
+  }
+  async reconcileOperation(input) {
+    return reconcileOperation({
+      "Idempotency-Key": input.idempotencyKey,
+      operation_id: input.operationId
+    }, { client: this.#client });
+  }
+  async connectGithub(input) {
+    return connectGithubOrganization({
+      organization_id: input.organizationId,
+      "Idempotency-Key": input.idempotencyKey,
+      connectGithubOrganizationRequest: {}
+    }, { client: this.#client });
+  }
+  async getGithubConnection(organizationId) {
+    return getGithubOrganizationConnection({ organization_id: organizationId }, { client: this.#client });
+  }
+  async linkSource(input) {
+    return linkProjectSource({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      linkProjectSourceRequest: {
+        repository_owner: input.repositoryOwner,
+        repository_name: input.repositoryName
+      }
+    }, { client: this.#client });
+  }
+  async configureAutoDeploy(input) {
+    return configureProjectSourceAutoDeploy({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      configureSourceAutoDeployRequest: { branch: input.branch, enabled: input.enabled }
+    }, { client: this.#client });
+  }
+  async getAutoDeploy(projectId) {
+    return getProjectSourceAutoDeploy({ project_id: projectId }, { client: this.#client });
+  }
+  async authorizeCloudflareDns(input) {
+    return createCloudflareDnsAuthorization({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      createCloudflareDnsAuthorizationRequest: { zone: input.zone }
+    }, { client: this.#client });
+  }
+  async getCloudflareDnsStatus(projectId) {
+    return getCloudflareDnsAuthorizationStatus({ project_id: projectId }, { client: this.#client });
+  }
+  async applyProjectDomains(input) {
+    return configureProjectDomains({ "Idempotency-Key": input.idempotencyKey, project_id: input.projectId }, { client: this.#client });
+  }
+  async planDeployment(input) {
+    return planDeployment({
+      project_id: input.projectId,
+      planDeploymentRequest: { commit_sha: input.commitSha, environment: input.environment }
+    }, { client: this.#client });
+  }
+  async createDeployment(input) {
+    return createDeployment({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      createDeploymentRequest: { plan_id: input.planId }
+    }, { client: this.#client });
+  }
+  async getDeployment(input) {
+    return getDeployment({ project_id: input.projectId, deployment_id: input.deploymentId }, { client: this.#client });
+  }
+  async streamOperationEvents(operationId, signal) {
+    return (await streamOperationEvents({ operation_id: operationId }, { client: this.#client, signal, headers: { Accept: "text/event-stream" } })).stream;
+  }
+  async getDeploymentLogs(input) {
+    return getDeploymentLogs({
+      project_id: input.projectId,
+      deployment_id: input.deploymentId,
+      limit: input.limit,
+      ...input.cursor === void 0 ? {} : { cursor: input.cursor }
+    }, { client: this.#client });
+  }
+  async streamDeploymentLogs(input, signal) {
+    return (await streamDeploymentLogs({ project_id: input.projectId, deployment_id: input.deploymentId }, { client: this.#client, signal, headers: { Accept: "text/event-stream" } })).stream;
+  }
+  async planRollback(input) {
+    return planDeploymentRollback({ project_id: input.projectId, target_deployment_id: input.deploymentId }, { client: this.#client });
+  }
+  async rollback(input) {
+    return rollbackDeployment({
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      "X-Confirmation-Token": input.confirmationToken,
+      project_id: input.projectId,
+      target_deployment_id: input.deploymentId
+    }, { client: this.#client });
+  }
+  async planPromotion(input) {
+    return planDeploymentPromotion({ project_id: input.projectId, source_deployment_id: input.sourceDeploymentId }, { client: this.#client });
   }
-}
-function invalid3() {
-  throw new TypeError("Mail response contract invalid");
-}
-
-// packages/sdk-ts/dist/managed-mail.js
-function requestManagedMail(client2, input) {
-  const scope = { project_id: input.projectId, environment_id: input.environmentId };
-  switch (input.action) {
-    case "configure":
-      return configureManagedMailDomain({
-        ...scope,
-        "Idempotency-Key": input.idempotencyKey,
-        managedMailDomainRequest: {
-          domain: input.domain,
-          sending: input.sending,
-          receiving: input.receiving
-        }
-      }, { client: client2 });
-    case "status":
-      return getManagedMailDomain(scope, { client: client2 });
-    case "webhook_set":
-      return prepareManagedMailWebhook({
-        ...scope,
-        "Idempotency-Key": input.idempotencyKey,
-        managedMailWebhookRequest: { url: input.url }
-      }, { client: client2 });
-    case "webhook_verify":
-      return verifyManagedMailWebhook({ ...scope, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
-    case "webhook_disable":
-      return disableManagedMailReceiving({ ...scope, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
-    case "domain_delete":
-      return deleteManagedMailDomain({ ...scope, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
-    case "messages_list":
-      return listManagedMailMessages({ ...scope, ...input.after ? { after: input.after } : {} }, { client: client2 });
-    case "message_get":
-      return getManagedMailMessage({ ...scope, message_id: input.messageId }, { client: client2 });
-    case "message_retry":
-      return retryManagedMailMessage({ ...scope, message_id: input.messageId, "Idempotency-Key": input.idempotencyKey }, { client: client2 });
+  async promote(input) {
+    return promoteDeployment({
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      "X-Confirmation-Token": input.confirmationToken,
+      project_id: input.projectId,
+      source_deployment_id: input.sourceDeploymentId
+    }, { client: this.#client });
   }
-}
-async function executeManagedMail(client2, input) {
-  const result = await requestManagedMail(client2, input);
-  assertManagedMailResponse(result, input);
-  return result;
-}
-
-// packages/workos-auth-contracts/dist/user-api-keys.js
-var WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
-
-// packages/workos-auth-contracts/dist/device-flow.js
-var WORKOS_AUTHKIT_DEVICE_TOKEN_ENDPOINT = "https://api.workos.com/user_management/authenticate";
-var allowedDeviceTokenFields = /* @__PURE__ */ new Set([
-  "access_token",
-  "refresh_token",
-  "token_type",
-  "expires_in",
-  "organization_id",
-  "authentication_method",
-  "user"
-]);
-var parseDeviceTokens = (value) => {
-  const input = expectRecord(value);
-  for (const field of Object.keys(input)) {
-    if (!allowedDeviceTokenFields.has(field)) {
-      throw new WorkosContractError("unexpected_device_token_field", "Device Flow response contained an unexpected field");
-    }
+  async planDelete(projectId) {
+    return planProjectDeletion({ project_id: projectId }, { client: this.#client });
+  }
+  async deleteProject(input) {
+    return deleteProject({
+      "Idempotency-Key": input.idempotencyKey,
+      "If-Match": input.ifMatch,
+      "X-Confirmation-Token": input.confirmationToken,
+      project_id: input.projectId
+    }, { client: this.#client });
+  }
+  async listEnvironmentSecrets(input) {
+    return listEnvironmentSecrets({ project_id: input.projectId, environment_id: input.environmentId }, { client: this.#client });
+  }
+  async listFunctionRuns(input) {
+    return listFunctionRuns({ project_id: input.projectId, environment_id: input.environmentId, limit: input.limit }, { client: this.#client });
+  }
+  async putEnvironmentSecret(input) {
+    return putEnvironmentSecret({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      environment_id: input.environmentId,
+      secret_name: input.name,
+      putEnvironmentSecretRequest: { value: input.value }
+    }, { client: this.#client });
+  }
+  async deleteEnvironmentSecret(input) {
+    return deleteEnvironmentSecret({
+      "Idempotency-Key": input.idempotencyKey,
+      project_id: input.projectId,
+      environment_id: input.environmentId,
+      secret_name: input.name
+    }, { client: this.#client });
+  }
+  managedMail(input) {
+    return executeManagedMail(this.#client, input);
   }
-  const expiresIn = expectPositiveInteger(input["expires_in"], "expires_in", { optional: true });
-  const organizationId = expectString(input["organization_id"], "organization_id", {
-    optional: true
-  });
-  return {
-    accessToken: expectString(input["access_token"], "access_token"),
-    refreshToken: expectString(input["refresh_token"], "refresh_token"),
-    tokenType: expectString(input["token_type"], "token_type", { optional: true }) ?? "Bearer",
-    ...expiresIn === void 0 ? {} : { expiresInSeconds: expiresIn },
-    ...organizationId === void 0 ? {} : { organizationId }
-  };
 };
 
 // apps/product-cli/dist/repository-init.js
@@ -4942,33 +5923,95 @@ function environmentToken(environment2 = {}) {
     throw new ProductApiAuthenticationError("invalid_environment_token");
   return value;
 }
+function environmentProfile(environment2 = {}) {
+  const value = environment2.OHMYHOST_PROFILE;
+  if (value === void 0 || value === "")
+    return void 0;
+  if (!isProfileName(value))
+    throw new ProductApiAuthenticationError("invalid_profile_binding");
+  return value;
+}
+var profileRequest = (input, bound) => ({
+  ...input?.name === void 0 ? {} : { name: input.name },
+  ...bound === void 0 ? {} : { bound },
+  ...input?.organizationId === void 0 ? {} : { organizationId: input.organizationId },
+  ...input?.userId === void 0 ? {} : { userId: input.userId }
+});
 var createAuthenticatedProductTransport = async (signal, overrides = {}) => {
-  const profile = resolveProductCliEnvironment(overrides.environment);
+  const platform = resolveProductCliEnvironment(overrides.environment);
   const apiToken = environmentToken(overrides.environment);
+  const bound = environmentProfile(overrides.environment);
+  const baseUrl = overrides.productApiOrigin ?? platform.apiOrigin;
   const boundedFetch = createBoundedFetch(overrides.fetch ?? fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES);
-  if (apiToken !== void 0)
+  const registry = overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform.credentialService);
+  const binding = overrides.request?.bindOrganization === true;
+  const request = profileRequest(overrides.request, bound);
+  if (apiToken !== void 0) {
+    await verifyEnvironmentTokenContext({
+      token: apiToken,
+      request: binding ? profileRequest({}, bound) : request,
+      registry,
+      baseUrl,
+      fetch: boundedFetch
+    });
     return {
-      baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+      baseUrl,
       accessToken: apiToken,
       fetch: boundedFetch,
-      // A user API token carries a fixed scope; there is no session that could select a workspace.
-      workspace: void 0
+      workspace: void 0,
+      context: { credential: "environment_token", profile: null }
     };
-  const store = overrides.credentialStore ?? new NativeNapiKeyringCredentialStore(void 0, profile.credentialService);
-  const stored = await store.read();
-  if (stored === void 0)
-    throw new ProductApiAuthenticationError("authentication_required");
+  }
   const now = overrides.now ?? (() => /* @__PURE__ */ new Date());
   const refresher = overrides.tokenRefresher ?? new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now);
-  const credential = await currentCredential(stored, store, signal, now, refresher);
+  const profiles = await loadProfiles(registry, {
+    baseUrl,
+    fetch: boundedFetch,
+    signal,
+    now,
+    refresher
+  });
+  const selection = binding && request.organizationId !== void 0 ? selectProfileForOrganization(profiles, {
+    ...request,
+    organizationId: request.organizationId
+  }) : selectProfile(profiles, request);
+  if (selection.outcome !== "selected")
+    throw profileSelectionError(selection, request, platform.commandPrefix, overrides.selector ?? "cli");
+  const profile = selection.profile;
+  const store = registry.credential(profile);
+  const stored = await store.read();
+  if (stored === void 0)
+    throw missingLogin(profile, platform.commandPrefix);
+  const credential = await currentCredential(stored, store, signal, now, refresher, () => registry.remove(profile));
   return {
-    baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+    baseUrl,
     accessToken: credential.accessToken,
     fetch: boundedFetch,
-    workspace: { store, refresher }
+    workspace: { store, refresher, profiles: registry, profile },
+    context: { credential: "profile", profile }
+  };
+};
+var listSavedProfiles = async (signal, overrides = {}) => {
+  const platform = resolveProductCliEnvironment(overrides.environment);
+  const apiToken = environmentToken(overrides.environment);
+  const bound = environmentProfile(overrides.environment);
+  const registry = overrides.profiles ?? new NativeKeyringProfileRegistry(void 0, platform.credentialService);
+  const now = overrides.now ?? (() => /* @__PURE__ */ new Date());
+  const profiles = apiToken === void 0 ? await loadProfiles(registry, {
+    baseUrl: overrides.productApiOrigin ?? platform.apiOrigin,
+    fetch: createBoundedFetch(overrides.fetch ?? fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
+    signal,
+    now,
+    refresher: overrides.tokenRefresher ?? new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now)
+  }) : await registry.list();
+  return {
+    profiles: profiles.map(publicProfile),
+    bound: bound ?? null,
+    environment_token: apiToken !== void 0
   };
 };
-var currentCredential = async (stored, store, signal, now, tokenRefresher) => {
+var missingLogin = (profile, commandPrefix) => new ProfileSelectionError("authentication_required", 5, `The saved login ${profile.name} has no credential on this computer. Run '${commandPrefix} login${profile.organizationId === null ? "" : ` --organization ${profile.organizationId}`} --profile-name ${profile.name} --json'.`);
+var currentCredential = async (stored, store, signal, now, tokenRefresher, forget) => {
   const expiresAt = stored.expiresAt === void 0 ? NaN : Date.parse(stored.expiresAt);
   if (Number.isFinite(expiresAt) && expiresAt > now().getTime() + REQUEST_TIMEOUT_MS) {
     return stored;
@@ -4984,12 +6027,73 @@ var currentCredential = async (stored, store, signal, now, tokenRefresher) => {
     return carried;
   } catch (error) {
     if (error instanceof TokenRefreshRejectedError) {
-      await store.clear();
+      await forget();
       throw new ProductApiAuthenticationError("authentication_required");
     }
     throw new ProductApiAuthenticationError("token_refresh_failed");
   }
 };
+var loadProfiles = async (registry, context) => {
+  const legacy = registry.legacy();
+  const stored = await legacy.read();
+  if (stored !== void 0)
+    await migrateLegacyLogin(registry, legacy, stored, context);
+  return registry.list();
+};
+var migrateLegacyLogin = async (registry, legacy, stored, context) => {
+  let credential;
+  try {
+    credential = await currentCredential(stored, legacy, context.signal, context.now, context.refresher, () => legacy.clear());
+  } catch (error) {
+    if (error instanceof ProductApiAuthenticationError && error.code === "authentication_required")
+      return;
+    throw error;
+  }
+  const api = new GeneratedSdkProductApi(context.baseUrl, credential.accessToken, context.fetch);
+  let identity;
+  try {
+    identity = await api.getCurrentIdentity();
+  } catch (error) {
+    if (!isProblem(error, "unauthenticated"))
+      throw error;
+    return;
+  }
+  const userId = verifiedUserId(identity);
+  const organizationId = parseCurrentIdentity(identity).organization_ids[0] ?? null;
+  const organizationName = organizationId === null ? null : (await api.getAccountProfile()).organizations.find((organization) => organization.id === organizationId)?.name ?? null;
+  const login = { userId, organizationId, organizationName };
+  await registry.save({ name: defaultProfileName(await registry.list(), login), ...login }, credential);
+  await legacy.clear();
+};
+var isProblem = (error, code) => typeof error === "object" && error !== null && "code" in error && error.code === code;
+var verifyEnvironmentTokenContext = async (input) => {
+  const { request } = input;
+  const named = request.name ?? request.bound;
+  if (named === void 0 && request.organizationId === void 0 && request.userId === void 0)
+    return null;
+  const refuse = (target) => new ProfileSelectionError("environment_token_context_mismatch", 2, `${target} Unset OHMYHOST_TOKEN to use the saved login, or load the key of that account from its private env file. Nothing was sent.`);
+  if (request.name !== void 0 && request.bound !== void 0 && request.name !== request.bound)
+    throw refuse(`This call names profile ${request.name}, but the process is bound to OHMYHOST_PROFILE=${request.bound}.`);
+  const profile = named === void 0 ? void 0 : (await input.registry.list()).find((saved) => saved.name === named);
+  if (named !== void 0 && profile === void 0)
+    throw refuse(`OHMYHOST_TOKEN overrides saved logins in this process, and no saved login is named ${named}.`);
+  const { userId, organizationId } = await readTokenIdentity(input);
+  const owner = `OHMYHOST_TOKEN belongs to user ${userId} in organization ${organizationId ?? "none"},`;
+  if (profile !== void 0 && (profile.userId !== userId || profile.organizationId !== organizationId))
+    throw refuse(`${owner} but this call names ${describeProfile(profile)}.`);
+  if (request.organizationId !== void 0 && request.organizationId !== organizationId)
+    throw refuse(`${owner} but this call targets organization ${request.organizationId}.`);
+  if (request.userId !== void 0 && request.userId !== userId)
+    throw refuse(`${owner} but this call targets user ${request.userId}.`);
+  return { userId, organizationId };
+};
+var readTokenIdentity = async (input) => {
+  const identity = parseCurrentIdentity(await new GeneratedSdkProductApi(input.baseUrl, input.token, input.fetch).getCurrentIdentity());
+  return {
+    userId: identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : identity.actor_id,
+    organizationId: identity.organization_ids[0] ?? null
+  };
+};
 var FetchWorkosPublicTransport = class {
   parentSignal;
   timeoutMs;
@@ -5167,7 +6271,7 @@ var boundedSignal = (parent, timeoutMs) => AbortSignal.any([parent, AbortSignal.
 var isAbortOrTimeout = (error) => error instanceof DOMException && (error.name === "AbortError" || error.name === "TimeoutError");
 
 // apps/mcp/dist/local-client.js
-import { lstat as lstat2, open as open2 } from "node:fs/promises";
+import { lstat as lstat2, open as open3 } from "node:fs/promises";
 import { isAbsolute } from "node:path";
 var OperationEventsUnavailableError = class extends Error {
   constructor() {
@@ -5177,8 +6281,11 @@ var OperationEventsUnavailableError = class extends Error {
 };
 async function createAuthenticatedLocalMcpClient(signal, overrides = {}) {
   try {
-    const transport = await createAuthenticatedProductTransport(signal, overrides);
-    return new GeneratedSdkLocalMcpClient(transport.baseUrl, transport.accessToken, transport.fetch, transport.workspace);
+    const transport = await createAuthenticatedProductTransport(signal, {
+      ...overrides,
+      selector: "mcp"
+    });
+    return new GeneratedSdkLocalMcpClient(transport.baseUrl, transport.accessToken, transport.fetch, transport.workspace, transport.context, resolveProductCliEnvironment(overrides.environment).commandPrefix);
   } catch (error) {
     if (!(error instanceof ProductApiAuthenticationError))
       throw error;
@@ -5191,11 +6298,44 @@ async function createAuthenticatedLocalMcpClient(signal, overrides = {}) {
 var GeneratedSdkLocalMcpClient = class {
   #client;
   #workspace;
+  #context;
+  #commandPrefix;
   #rescope;
-  constructor(baseUrl, accessToken, fetch2, workspace) {
+  constructor(baseUrl, accessToken, fetch2, workspace, context, commandPrefix = "OHMYHOST_ENVIRONMENT=production ohmyhost") {
     this.#rescope = (token) => createClient({ auth: token, baseUrl, fetch: fetch2, throwOnError: true });
     this.#client = this.#rescope(accessToken);
     this.#workspace = workspace;
+    this.#context = context ?? {
+      credential: workspace === void 0 ? "environment_token" : "profile",
+      profile: workspace?.profile ?? null
+    };
+    this.#commandPrefix = commandPrefix;
+  }
+  actingAs() {
+    return this.#contextReport();
+  }
+  /** Which account this call acts as, without any credential. */
+  #contextReport() {
+    const profile = this.#workspace?.profile ?? this.#context.profile;
+    return {
+      credential: this.#context.credential,
+      profile: profile === null ? null : publicProfile(profile)
+    };
+  }
+  /**
+   * Bind this call's login, which has no organization yet, and continue with its new credential.
+   * A login in another organization keeps it; the provider verifies the account first.
+   */
+  async #bind(organization, signal) {
+    const session = this.#interactiveSession();
+    const bound = await selectWorkspace(session, organization, signal, (token) => getCurrentIdentity({}, { client: this.#rescope(token) }));
+    const store = session.profiles.credential(bound);
+    const credential = await store.read();
+    if (credential === void 0)
+      throw new InteractiveSessionRequiredError();
+    this.#workspace = { ...session, store, profile: bound };
+    this.#client = this.#rescope(credential.accessToken);
+    return bound;
   }
   async changeDatabaseCompute(input) {
     return changeDatabaseCompute({
@@ -5261,13 +6401,15 @@ var GeneratedSdkLocalMcpClient = class {
   async getCurrentIdentity(signal) {
     const identity = await getCurrentIdentity({}, { client: this.#client });
     if (this.#workspace === void 0 || parseCurrentIdentity(identity).organization_ids.length > 0)
-      return identity;
+      return { ...identity, context: this.#contextReport() };
     const selection = chooseWorkspace(await this.#readWorkspaces(), void 0);
     if (selection.outcome !== "selected")
-      return identity;
-    await selectWorkspace(this.#workspace, selection.organization, signal);
-    const scoped = (await this.#workspace.store.read())?.accessToken;
-    return scoped === void 0 ? identity : getCurrentIdentity({}, { client: this.#rescope(scoped) });
+      return { ...identity, context: this.#contextReport() };
+    await this.#bind(selection.organization, signal);
+    return {
+      ...await getCurrentIdentity({}, { client: this.#client }),
+      context: this.#contextReport()
+    };
   }
   async changeProjectHandle(input) {
     return changeProjectHandle({
@@ -5313,6 +6455,9 @@ var GeneratedSdkLocalMcpClient = class {
     assertOrganizationAccount(account);
     return account;
   }
+  async getOrganizationReferral(organizationId) {
+    return parseOrganizationReferral(await getOrganizationReferral({ organization_id: organizationId }, { client: this.#client }));
+  }
   getOrganizationCredits(organizationId) {
     return getOrganizationCredits({ organization_id: organizationId }, { client: this.#client });
   }
@@ -5380,29 +6525,39 @@ var GeneratedSdkLocalMcpClient = class {
         ...input.signupSource === void 0 ? {} : { signup_source: input.signupSource }
       }
     }, { client: this.#client });
+    const current = this.#interactiveSession().profile;
+    if (current.organizationId !== null && current.organizationId !== created.id)
+      return {
+        organization: { id: created.id, name: created.name },
+        selected: current.organizationId,
+        profile: publicProfile(current),
+        next_action: `Run '${this.#commandPrefix} login --organization ${created.id} --user ${current.userId} --json' to add a login for the new workspace as the same user, then pass its profile_name.`
+      };
     return this.selectOrganization(created.id, signal);
   }
   async listOrganizations() {
     const session = this.#interactiveSession();
     return {
       organizations: (await this.#readWorkspaces()).map(publicWorkspace),
-      selected: await selectedWorkspaceId(session)
+      selected: session.profile.organizationId,
+      profile: publicProfile(session.profile)
     };
   }
   async selectOrganization(organizationId, signal) {
-    const session = this.#interactiveSession();
+    this.#interactiveSession();
     const selection = chooseWorkspace(await this.#readWorkspaces(), organizationId);
     if (selection.outcome !== "selected")
       throw new Error(`ORGANIZATION_NOT_FOUND:${organizationId}`);
-    await selectWorkspace(session, selection.organization, signal);
+    const profile = await this.#bind(selection.organization, signal);
     return {
       organization: publicWorkspace(selection.organization),
-      selected: selection.organization.id
+      selected: selection.organization.id,
+      profile: publicProfile(profile)
     };
   }
   async #readWorkspaces() {
     this.#interactiveSession();
-    return parseAccountProfile(await getAccountProfile({ client: this.#client }));
+    return parseAccountProfile(await getAccountProfile({ client: this.#client })).organizations;
   }
   #interactiveSession() {
     if (this.#workspace === void 0)
@@ -5431,6 +6586,16 @@ var GeneratedSdkLocalMcpClient = class {
       setDevAccessModeRequest: { mode: input.mode }
     }, { client: this.#client }));
   }
+  async getPoweredByFlag(projectId) {
+    return parsePoweredByFlag(await getProjectPoweredByFlag({ project_id: projectId }, { client: this.#client }));
+  }
+  async setPoweredByFlag(input) {
+    return parsePoweredByFlag(await setProjectPoweredByFlag({
+      project_id: input.projectId,
+      "Idempotency-Key": input.idempotencyKey,
+      setPoweredByFlagRequest: { enabled: input.enabled }
+    }, { client: this.#client }));
+  }
   async rotateDevShareLink(input) {
     return parseDevAccessState(await rotateProjectDevShareLink({ project_id: input.projectId, "Idempotency-Key": input.idempotencyKey }, { client: this.#client }));
   }
@@ -5681,7 +6846,7 @@ async function readExportPasswordFile(path) {
     const before = await lstat2(path);
     if (!before.isFile() || before.isSymbolicLink() || before.size < 1 || before.size > 1024 || process.platform !== "win32" && (before.mode & 63) !== 0)
       throw new Error();
-    file = await open2(path, "r");
+    file = await open3(path, "r");
     const after = await file.stat();
     if (after.ino !== before.ino || after.dev !== before.dev || after.size !== before.size)
       throw new Error();
@@ -5702,6 +6867,7 @@ async function readExportPasswordFile(path) {
 
 // apps/mcp/dist/local-server.js
 var identifier2 = external_exports.string().min(1).max(256);
+var profileName = external_exports.string().regex(/^[a-z0-9][a-z0-9_-]{0,62}$/u).optional().describe("Saved login to act as (profile_list shows them). Needed only when several logins could run this call; OHMYHOST_PROFILE of this server must match it.");
 var idempotencyKey = external_exports.string().min(1).max(256);
 var commitSha = external_exports.string().regex(/^[a-f0-9]{40}$/u);
 var domainName = external_exports.string().regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u);
@@ -5835,6 +7001,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     ...input.cursor ? { cursor: input.cursor } : {}
   }));
   registerProductTool(server, dependencies, "organization_account_get", "Owner-only: read the effective Free/Paid plan, its Stripe or granted source, available expiring Free credits and purchased credits that never expire, reservations and next expiry. Granted Paid features do not imply a Stripe subscription or extra monthly Paid allowance. This read grants no access or credits.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getOrganizationAccount(input.organization_id));
+  registerProductTool(server, dependencies, "referral_link_get", "Read the workspace's referral link to share. A new user whose first workspace comes from it starts with a free Paid month and 1,000 credits; that workspace's first payment gives this workspace the same. Any member may read it.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getOrganizationReferral(input.organization_id));
   registerProductTool(server, dependencies, "organization_credits_get", "Read the owner's shared organization credit pool, seven-day grace_started_at/grace_expires_at and published rate_cards. Existing services/domains are not immediately shut down at zero credit; an explicit project stop budget is separate. One credit is 1000000 microcredits. Each rate states credit_micros for units_per_charge; publication alone does not enable billing. active_meters identifies billed sources; provider outages and platform overrun are not customer debt. Works at zero credit.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getOrganizationCredits(input.organization_id));
   registerProductTool(server, dependencies, "project_budget_get", "Read the owner's project UTC-month budget, measured usage and open reservations. A budget never allocates a second wallet.", external_exports.object({ project_id: identifier2 }), (client2, input) => client2.getProjectCreditBudget(input.project_id));
   registerProductTool(server, dependencies, "project_budget_set", "Set an owner's optional monthly project budget in microcredits (1000000 = one credit). continue is the default and uses the org pool after the threshold; stop blocks new billable work. null clears the budget and requires continue. Changing it never resets usage or adds credits. Replay the same key after uncertainty; read the budget again for current usage.", external_exports.object({
@@ -5848,7 +7015,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     mode: input.mode,
     idempotencyKey: input.idempotency_key
   }), { readOnlyHint: false, destructiveHint: false, idempotentHint: true });
-  registerProductTool(server, dependencies, "organization_create", `Create an organization owned by the signed-in user and select it for this machine. Signup is open. signup_source is optional attribution from a link's r parameter, never a secret; omit it when the customer arrived directly. The server decides any once-per-user bonus; do not promise credits for arbitrary sources. Repeat the same name/source/key after uncertainty. No second login is needed: selected names the workspace every later call uses, so continue with identity_get, github_status and github_connect if needed, then projects. An OHMYHOST_TOKEN process cannot do this; it needs ${commandPrefix} login --json.`, external_exports.object({
+  registerProductTool(server, dependencies, "organization_create", `Create an organization owned by the signed-in user. Signup is open. signup_source is optional attribution from a link's r parameter, never a secret; omit it when the customer arrived directly. The server decides any once-per-user bonus; do not promise credits for arbitrary sources. Repeat the same name/source/key after uncertainty. A login that has no organization yet is bound to the new one, so selected names the workspace later calls use; a login already in another organization keeps it and next_action names the login for the new one. Continue with identity_get, github_status and github_connect if needed, then projects. An OHMYHOST_TOKEN process cannot do this; it needs ${commandPrefix} login --json.`, external_exports.object({
     name: external_exports.string().min(1).max(128),
     signup_source: external_exports.string().regex(/^[a-z0-9][a-z0-9_-]{0,63}$/u).optional(),
     idempotency_key: idempotencyKey
@@ -5857,8 +7024,25 @@ function createLocalOhmyhostMcpServer(dependencies) {
     ...input.signup_source === void 0 ? {} : { signupSource: input.signup_source },
     idempotencyKey: input.idempotency_key
   }, signal), mutationAnnotations());
-  registerProductTool(server, dependencies, "organization_list", "List the workspaces the signed-in user belongs to and which one this machine currently uses. selected is null while none is chosen; every project and billing call then answers resource_not_found. Ask the customer which workspace to use instead of guessing, then call organization_use.", external_exports.object({}), (client2) => client2.listOrganizations());
-  registerProductTool(server, dependencies, "organization_use", `Select one workspace for this machine's stored login, so later calls act inside it. Read organization_list first, then github_status for the selected workspace and github_connect if needed; the identifier is the platform ULID, not the provider identifier. An OHMYHOST_TOKEN process cannot select anything and needs ${commandPrefix} login --json instead.`, external_exports.object({ organization_id: identifier2 }), (client2, input, signal) => client2.selectOrganization(input.organization_id, signal), mutationAnnotations());
+  registerProductTool(server, dependencies, "organization_list", "List the workspaces the chosen login's user belongs to and which one that login is scoped to. selected is null while none is chosen; every project and billing call then answers resource_not_found. Ask the customer which workspace to use instead of guessing, then call organization_use.", external_exports.object({}), (client2) => client2.listOrganizations());
+  registerProductTool(server, dependencies, "organization_use", `Bind a saved login that has no organization yet to one workspace, so later calls act inside it. A login already in another organization keeps it (profile_organization_fixed): add a login for the other workspace as the same user with ${commandPrefix} login --organization ULID --user USER_ID --json. Read organization_list first, then github_status for the selected workspace and github_connect if needed; the identifier is the platform ULID, not the provider identifier. An OHMYHOST_TOKEN process cannot select anything and needs ${commandPrefix} login --json instead.`, external_exports.object({ organization_id: identifier2 }), (client2, input, signal) => client2.selectOrganization(input.organization_id, signal), mutationAnnotations(), (input) => ({
+    ...input.profile_name === void 0 ? {} : { name: input.profile_name },
+    organizationId: input.organization_id,
+    bindOrganization: true
+  }));
+  server.registerTool("profile_list", {
+    description: `List the saved ohmyho.st logins on this computer: each has a name, a user and an organization, never a token. When the customer named a user or organization, pass the matching name as profile_name on later calls; with several logins and no profile_name a call answers profile_selection_required. With no match, the customer adds one with ${commandPrefix} login --organization ULID --user USER_ID --json, which saves nothing if the browser signs in as another account. bound is this server's OHMYHOST_PROFILE; environment_token means OHMYHOST_TOKEN replaces saved logins here.`,
+    inputSchema: external_exports.object({}),
+    annotations: readAnnotations()
+  }, (async (_input, context) => {
+    try {
+      if (dependencies.listProfiles === void 0)
+        throw new CredentialStoreUnavailableError();
+      return toolResult(await dependencies.listProfiles(context.mcpReq.signal));
+    } catch (error) {
+      return toolError(error, dependencies);
+    }
+  }));
   registerProductTool(server, dependencies, "database_query", "Read one owner-authorized Dev or Prod database query (at most 100 rows, five-second timeout). Explicitly choose the environment. Shared data resolves to the same physical database. Application RLS policies apply; use an authorized SQL export when a full archive is required.", external_exports.object({
     project_id: identifier2,
     environment: external_exports.enum(["dev", "prod"]),
@@ -5956,7 +7140,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     });
     return { revoked: true, key_id: input.key_id };
   }, destructiveAnnotations());
-  registerProductTool(server, dependencies, "identity_get", "Get the current ohmyho.st customer/agent identity. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.", external_exports.object({}), (client2, _input, signal) => client2.getCurrentIdentity(signal));
+  registerProductTool(server, dependencies, "identity_get", "Get the ohmyho.st customer/agent identity this call acts as: user, organization and, in context, the saved login or OHMYHOST_TOKEN that supplied it. Compare it with the user and organization the customer named before any change. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.", external_exports.object({}), (client2, _input, signal) => client2.getCurrentIdentity(signal));
   registerProductTool(server, dependencies, "project_handle_check", "Check whether a project address is free before offering it to the customer. A handle is one to five lowercase words of letters and digits joined by single hyphens, three to fifty-nine characters, and never a reserved word such as admin, api, dev or www; it becomes <handle>.check.omh.st for Prod and dev-<handle>.check.omh.st for Dev. The answer names why a handle cannot be used and returns free alternatives, so offer one of those instead of guessing again. Check the name here first, then move an existing project onto it with project_handle_set.", external_exports.object({ handle: external_exports.string().min(1).max(120) }), (client2, input) => client2.checkProjectHandle({ handle: input.handle }));
   registerProductTool(server, dependencies, "project_handle_set", "Move a project to an address the customer chose, after project_handle_check said it is free. The Dev and Prod gateways are re-published at the new address and it is stored only once both serve it; the previous address stops answering and anyone may claim it, so a link already shared stops working. Needs the project's current ETag from project_status and one idempotency key; reuse the same key after an uncertain answer. Refused while another operation is running for the project, and refused for an address that is taken, unusable, or the one the project already has. Returns an operation to follow with operation_get.", external_exports.object({
     project_id: identifier2,
@@ -6019,6 +7203,12 @@ function createLocalOhmyhostMcpServer(dependencies) {
     mode: input.mode,
     idempotencyKey: input.idempotency_key
   }), destructiveAnnotations());
+  registerProductTool(server, dependencies, "powered_by_flag_get", 'Read whether the production site shows the opt-in "Powered by ohmyho.st" flag.', external_exports.object({ project_id: identifier2 }), (client2, input) => client2.getPoweredByFlag(input.project_id));
+  registerProductTool(server, dependencies, "powered_by_flag_set", `Owner only, ask the human first: show or hide a small "Powered by ohmyho.st" flag on the right edge of the production site. While it is on, a Free workspace may connect its own domain to this project free of the domain fee, and each Paid period adds 250 credits. Hiding it is refused while a Free workspace's domain depends on it. Replay the same key and value after uncertainty to get the first answer without switching again; every new switch needs a new key.`, external_exports.object({ project_id: identifier2, enabled: external_exports.boolean(), idempotency_key: idempotencyKey }), (client2, input) => client2.setPoweredByFlag({
+    projectId: input.project_id,
+    enabled: input.enabled,
+    idempotencyKey: input.idempotency_key
+  }), mutationAnnotations());
   registerProductTool(server, dependencies, "project_dev_share_link_rotate", "Owner only: replace the persistent Dev link and immediately revoke old links and sessions. Repeat the same key after uncertainty.", external_exports.object({ project_id: identifier2, idempotency_key: idempotencyKey }), (client2, input) => client2.rotateDevShareLink({
     projectId: input.project_id,
     idempotencyKey: input.idempotency_key
@@ -6032,8 +7222,8 @@ function createLocalOhmyhostMcpServer(dependencies) {
     organizationId: input.organization_id,
     idempotencyKey: input.idempotency_key
   }), mutationAnnotations());
-  registerProductTool(server, dependencies, "github_status", "Read this workspace's GitHub connection. If not_connected or revoked, an Owner or Admin must run github_connect. A connected installation covers only repositories selected in its settings.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getGithubConnection(input.organization_id));
-  registerProductTool(server, dependencies, "source_link", "Link a repository covered by the workspace GitHub connection. Call github_status first and github_connect once if needed. This returns an operation without another browser consent and never starts a build. Wait for that operation before planning a deploy. If repository access is missing, update the installation using the returned settings action, then retry the same project and key. Never ask for an installation ID or provider token.", external_exports.object({
+  registerProductTool(server, dependencies, "github_status", "Read this workspace's GitHub connection. If not_connected or revoked, an Owner or Admin must run github_connect. A connected installation covers only repositories selected in its settings. Each workspace has its own connection, so the same repository can be connected and linked in the workspaces of separate accounts.", external_exports.object({ organization_id: identifier2 }), (client2, input) => client2.getGithubConnection(input.organization_id));
+  registerProductTool(server, dependencies, "source_link", "Link a repository covered by the workspace GitHub connection. Call github_status first and github_connect once if needed. This returns an operation without another browser consent and never starts a build. Wait for that operation before planning a deploy. If repository access is missing, update the installation using the returned settings action, then retry the same project and key. Never ask for an installation ID or provider token. Errors name the account the call ran as (acting_as): resource_not_found means that account cannot see the project (use the login of the account that owns it), github_connection_required means that workspace has no GitHub connection yet, and repository_not_installed means its GitHub App installation does not cover the repository.", external_exports.object({
     project_id: identifier2,
     repository_owner: identifier2,
     repository_name: identifier2,
@@ -6069,7 +7259,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     ...input.limit === void 0 ? {} : { limit: input.limit }
   }));
   registerProductTool(server, dependencies, "deployment_get", "Get one deployment", external_exports.object({ project_id: identifier2, deployment_id: identifier2 }), (client2, input) => client2.getDeployment({ projectId: input.project_id, deploymentId: input.deployment_id }));
-  registerProductTool(server, dependencies, "deployment_logs", "List the newest normalized diagnostics of one deployment (build, control, runtime and function failures with catalog codes). A BUILD_FAILED item carries excerpt: the sanitized tail of the customer's own install/build output, newest lines last, with excerpt_truncated when earlier output was omitted. Read it after build_failed before changing source; scheduled runs are in function_runs_list, not here.", external_exports.object({
+  registerProductTool(server, dependencies, "deployment_logs", "List the newest normalized diagnostics of one deployment (build, control, runtime and function failures with catalog codes). A failed operation_get names the deployment as deployment_id. A BUILD_FAILED item carries excerpt: the sanitized tail of the customer's own install/build output, newest lines last, with excerpt_truncated when earlier output was omitted. A HEALTH_CHECK_FAILED item carries the probed route and status_code and, only for a project owner, excerpt: the head (at most 4096 characters, control characters removed, never a header) of what the app answered. The probe is a cookieless GET that follows no redirect, 5 s per try and up to four tries, so a 3xx or an empty 503 is unhealthy too. Read the item before changing source; scheduled runs are in function_runs_list, not here.", external_exports.object({
     project_id: identifier2,
     deployment_id: identifier2,
     limit: external_exports.number().int().min(1).max(100).default(100)
@@ -6078,7 +7268,7 @@ function createLocalOhmyhostMcpServer(dependencies) {
     deploymentId: input.deployment_id,
     limit: input.limit
   }));
-  registerProductTool(server, dependencies, "operation_get", "Get durable operation status and current deployment progress/reconciliation guidance. Follow progress.phase and progress.suggested_action. waiting_for_mail requires mail_domain_status now for the current verification issue and DNS records; publishing means the build completed but runtime preparation/publication is unfinished. Poll this operation after progress.next_poll_after_seconds. A queued/running operation with reconciliation.state=required needs one confirmed operation_reconcile using the same operation; pending means poll this operation after 60 seconds. Never infer deployment success from a completed reconciliation attempt or start another build to recover it.", external_exports.object({ operation_id: identifier2 }), (client2, input) => client2.getOperation(input.operation_id));
+  registerProductTool(server, dependencies, "operation_get", "Get durable operation status and current deployment progress/reconciliation guidance. Follow progress.phase and progress.suggested_action. waiting_for_mail requires mail_domain_status now for the current verification issue and DNS records; publishing means the build completed but runtime preparation/publication is unfinished. Poll this operation after progress.next_poll_after_seconds. A queued/running operation with reconciliation.state=required needs one confirmed operation_reconcile using the same operation; pending means poll this operation after 60 seconds. Never infer deployment success from a completed reconciliation attempt or start another build to recover it. A deploy, promotion or rollback names its deployment_id in every state; when state is failed, read that deployment with deployment_logs and follow error.suggested_action before changing source.", external_exports.object({ operation_id: identifier2 }), (client2, input) => client2.getOperation(input.operation_id));
   registerProductTool(server, dependencies, "operation_logs", "Read available operation events for at most ten seconds, stopping earlier at max_events or a terminal event. This is a bounded snapshot, not a wait for deployment completion. Use operation_get for current progress and keep the same operation. Stream failures are errors, not empty logs.", external_exports.object({
     operation_id: identifier2,
     max_events: external_exports.number().int().min(1).max(100).default(50)
@@ -6251,31 +7441,33 @@ function createLocalOhmyhostMcpServer(dependencies) {
     name: input.name,
     idempotencyKey: input.idempotency_key
   }), destructiveAnnotations());
-  server.registerTool("secret_set_command", {
-    description: "Return the stdin-only CLI command for setting a secret; the value never enters MCP.",
-    inputSchema: external_exports.object({
-      project_id: identifier2,
-      environment_id: identifier2,
-      name: secretName,
-      idempotency_key: idempotencyKey
-    }),
-    annotations: readAnnotations()
-  }, (input) => toolResult({
-    command: [
-      `${commandPrefix} secret set`,
-      shellQuote(input.name),
-      "--project",
-      shellQuote(input.project_id),
-      "--environment",
-      shellQuote(input.environment_id),
-      "--idempotency-key",
-      shellQuote(input.idempotency_key),
-      "--stdin",
-      "--wait",
-      "--json"
-    ].join(" "),
-    instruction: "Pass the secret value on stdin in a local terminal. Never place it in MCP arguments, prompts, command-line arguments, source, or logs."
-  }));
+  registerProductTool(server, dependencies, "secret_set_command", "Return the stdin-only CLI command for setting a secret; the value never enters MCP. The call runs as the chosen login and first reads the project, so an account that cannot see it answers resource_not_found. The command names that login with --profile-name plus its user and organization (--profile-user, --profile-organization), so a login of the same name that belongs to anyone else is refused, for example on another computer; a server with OHMYHOST_TOKEN instead names its key's user and organization with --token-user and --token-organization, and the CLI then runs only with an OHMYHOST_TOKEN of that account. Either way the later write runs as exactly this account or not at all (acting_as shows which).", external_exports.object({
+    project_id: identifier2,
+    environment_id: identifier2,
+    name: secretName,
+    idempotency_key: idempotencyKey
+  }), async (client2, input, signal) => {
+    await client2.getProject(input.project_id);
+    const account = await handoverAccount(client2, signal);
+    return {
+      command: [
+        `${commandPrefix} secret set`,
+        shellQuote(input.name),
+        "--project",
+        shellQuote(input.project_id),
+        "--environment",
+        shellQuote(input.environment_id),
+        "--idempotency-key",
+        shellQuote(input.idempotency_key),
+        ...account.flags,
+        "--stdin",
+        "--wait",
+        "--json"
+      ].join(" "),
+      acting_as: client2.actingAs?.() ?? null,
+      instruction: `Pass the secret value on stdin in a local terminal; ${account.runs}. Never place the value or a key in MCP arguments, prompts, command-line arguments, source, or logs.`
+    };
+  });
   registerProductTool(server, dependencies, "rollback_plan", "Plan a rollback", external_exports.object({ project_id: identifier2, deployment_id: identifier2 }), (client2, input) => client2.planRollback({ projectId: input.project_id, deploymentId: input.deployment_id }));
   registerProductTool(server, dependencies, "rollback_execute", "Execute a reviewed rollback", external_exports.object({
     project_id: identifier2,
@@ -6304,11 +7496,20 @@ function createLocalOhmyhostMcpServer(dependencies) {
   }), destructiveAnnotations());
   return server;
 }
-function registerProductTool(server, dependencies, name, description, inputSchema, execute, annotations = readAnnotations()) {
+function registerProductTool(server, dependencies, name, description, schema, execute, annotations = readAnnotations(), selection = (input) => {
+  const organizationId = input["organization_id"];
+  return {
+    ...input.profile_name === void 0 ? {} : { name: input.profile_name },
+    ...typeof organizationId === "string" ? { organizationId } : {}
+  };
+}) {
+  const inputSchema = schema.extend({ profile_name: profileName });
   const callback = (async (input, context) => {
     const parsed = inputSchema.parse(input);
+    let client2;
     try {
-      const result = toolResult(await execute(await dependencies.authenticatedClient(context.mcpReq.signal), parsed, context.mcpReq.signal));
+      client2 = await dependencies.authenticatedClient(context.mcpReq.signal, selection(parsed));
+      const result = toolResult(await execute(client2, parsed, context.mcpReq.signal));
       const scope = parsed;
       if (typeof scope["project_id"] === "string" && identifier2.safeParse(scope["project_id"]).success)
         result.content.push({
@@ -6320,48 +7521,106 @@ function registerProductTool(server, dependencies, name, description, inputSchem
         });
       return result;
     } catch (error) {
-      let safe;
-      try {
-        safe = error instanceof Error && error.name === "InteractiveSessionRequiredError" ? {
-          code: "interactive_login_required",
-          retryable: false,
-          suggestedAction: `A user API token cannot create, list or select a workspace. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json in a process without OHMYHOST_TOKEN, then retry.`
-        } : error instanceof Error && error.message.startsWith("ORGANIZATION_NOT_FOUND:") ? {
-          code: "organization_not_found",
-          retryable: false,
-          suggestedAction: "Call organization_list and choose one of the returned workspace identifiers. Do not create another workspace to recover."
-        } : error instanceof OperationEventsUnavailableError ? {
-          code: "operation_events_unavailable",
-          retryable: true,
-          suggestedAction: "Read operation_get for current status, then retry operation_logs for this same operation. Do not submit another deployment to recover logs."
-        } : error instanceof Error && error.message.startsWith("EXPORT_PASSWORD_FILE_INVALID:") ? {
-          code: "export_password_file_invalid",
-          retryable: false,
-          suggestedAction: "Choose an existing private UTF-8 password file of 1\u20131024 bytes. The user retains the file and password. Do not paste the password into MCP arguments."
-        } : parseSafeProblem(error);
-      } catch {
-        safe = {
-          code: "client_request_failed",
-          retryable: false,
-          suggestedAction: "Check the connection and run 'ohmyhost login' if authentication expired. Inspect the existing operation before resubmitting any mutation."
-        };
-      }
-      return {
-        ...toolResult({
-          error: {
-            code: safe.code,
-            retryable: safe.retryable,
-            suggested_action: safe.suggestedAction,
-            ...safe.requestId === void 0 ? {} : { request_id: safe.requestId },
-            ...safe.retryAfterSeconds === void 0 ? {} : { retry_after_seconds: safe.retryAfterSeconds }
-          }
-        }),
-        isError: true
-      };
+      return toolError(error, dependencies, client2?.actingAs?.());
     }
   });
   server.registerTool(name, { description, inputSchema, annotations }, callback);
 }
+async function handoverAccount(client2, signal) {
+  const profile = client2.actingAs?.()?.profile ?? null;
+  if (profile !== null) {
+    if (profile.organization_id === null)
+      throw new ProfileSelectionError("profile_context_mismatch", 2, `The saved login ${profile.name} has no organization, so no command can be tied to its account. Nothing was sent.`);
+    return {
+      flags: [
+        "--profile-name",
+        shellQuote(profile.name),
+        "--profile-user",
+        shellQuote(profile.user_id),
+        "--profile-organization",
+        shellQuote(profile.organization_id)
+      ],
+      runs: `the command runs only as the saved login it names and only while that login belongs to user ${profile.user_id} in organization ${profile.organization_id}, so a login of the same name that belongs to anyone else, for example on another computer, is refused before anything is read or sent`
+    };
+  }
+  const report = await client2.getCurrentIdentity(signal);
+  const identity = parseCurrentIdentity({
+    actor_id: report.actor_id,
+    organization_ids: report.organization_ids
+  });
+  const userId = identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : "";
+  const [organizationId, ...others] = identity.organization_ids;
+  if (!isProfileUserId(userId) || organizationId === void 0 || others.length > 0)
+    throw new ProfileSelectionError("environment_token_context_mismatch", 2, "This server's OHMYHOST_TOKEN does not belong to one user in one organization, so no command can be tied to its account. Nothing was sent.");
+  return {
+    flags: ["--token-user", shellQuote(userId), "--token-organization", shellQuote(organizationId)],
+    runs: `run it only where OHMYHOST_TOKEN holds a key of user ${userId} in organization ${organizationId}, loaded from its private env file; it refuses a saved login and any other account's key before anything is sent`
+  };
+}
+function fixedOrganizationAction(error, commandPrefix) {
+  return `This saved login stays in its organization. Add a login for the other workspace with ${commandPrefix} login --organization ${error.organization.id} --user ${error.profile.userId} --json, then pass its profile_name.`;
+}
+function toolError(error, dependencies, actingAs) {
+  let safe;
+  try {
+    safe = error instanceof Error && error.name === "ProfileSelectionError" ? {
+      code: error.code,
+      retryable: false,
+      suggestedAction: error.suggestedAction
+    } : error instanceof Error && error.name === "ProfileLimitError" ? {
+      code: "profile_limit_reached",
+      retryable: false,
+      suggestedAction: profileLimitAction(resolveProductCliEnvironment(dependencies.environment).commandPrefix)
+    } : error instanceof Error && error.name === "ProfileOrganizationFixedError" ? {
+      code: "profile_organization_fixed",
+      retryable: false,
+      suggestedAction: fixedOrganizationAction(error, resolveProductCliEnvironment(dependencies.environment).commandPrefix)
+    } : error instanceof Error && error.name === "AccountVerificationError" ? {
+      code: "login_verification_failed",
+      retryable: true,
+      suggestedAction: `The signed-in account could not be verified; nothing was saved. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json again.`
+    } : error instanceof Error && error.name === "CredentialStoreUnavailableError" ? {
+      code: "credential_store_unavailable",
+      retryable: true,
+      suggestedAction: "Unlock or repair this computer's credential store and retry. Saved logins were not changed."
+    } : error instanceof Error && error.name === "InteractiveSessionRequiredError" ? {
+      code: "interactive_login_required",
+      retryable: false,
+      suggestedAction: `A user API token cannot create, list or select a workspace. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json in a process without OHMYHOST_TOKEN, then retry.`
+    } : error instanceof Error && error.message.startsWith("ORGANIZATION_NOT_FOUND:") ? {
+      code: "organization_not_found",
+      retryable: false,
+      suggestedAction: "Call organization_list and choose one of the returned workspace identifiers. Do not create another workspace to recover."
+    } : error instanceof OperationEventsUnavailableError ? {
+      code: "operation_events_unavailable",
+      retryable: true,
+      suggestedAction: "Read operation_get for current status, then retry operation_logs for this same operation. Do not submit another deployment to recover logs."
+    } : error instanceof Error && error.message.startsWith("EXPORT_PASSWORD_FILE_INVALID:") ? {
+      code: "export_password_file_invalid",
+      retryable: false,
+      suggestedAction: "Choose an existing private UTF-8 password file of 1\u20131024 bytes. The user retains the file and password. Do not paste the password into MCP arguments."
+    } : parseSafeProblem(error);
+  } catch {
+    safe = {
+      code: "client_request_failed",
+      retryable: false,
+      suggestedAction: "Check the connection and run 'ohmyhost login' if authentication expired. Inspect the existing operation before resubmitting any mutation."
+    };
+  }
+  return {
+    ...toolResult({
+      error: {
+        code: safe.code,
+        retryable: safe.retryable,
+        suggested_action: safe.suggestedAction,
+        ...safe.requestId === void 0 ? {} : { request_id: safe.requestId },
+        ...safe.retryAfterSeconds === void 0 ? {} : { retry_after_seconds: safe.retryAfterSeconds },
+        ...actingAs !== void 0 && ACCOUNT_SENSITIVE_PROBLEMS.has(safe.code) ? { acting_as: actingAs } : {}
+      }
+    }),
+    isError: true
+  };
+}
 function toolResult(result) {
   const serialized = JSON.stringify(result);
   return {
@@ -6392,11 +7651,17 @@ function destructiveAnnotations() {
 // apps/mcp/dist/stdio-main.js
 var environment = {
   ...process.env["OHMYHOST_ENVIRONMENT"] === void 0 ? {} : { OHMYHOST_ENVIRONMENT: process.env["OHMYHOST_ENVIRONMENT"] },
-  ...process.env["OHMYHOST_TOKEN"] === void 0 ? {} : { OHMYHOST_TOKEN: process.env["OHMYHOST_TOKEN"] }
+  ...process.env["OHMYHOST_TOKEN"] === void 0 ? {} : { OHMYHOST_TOKEN: process.env["OHMYHOST_TOKEN"] },
+  ...process.env["OHMYHOST_PROFILE"] === void 0 ? {} : { OHMYHOST_PROFILE: process.env["OHMYHOST_PROFILE"] }
 };
 resolveProductCliEnvironment(environment);
 serveStdio(() => createLocalOhmyhostMcpServer({
   environment,
-  authenticatedClient: (signal) => createAuthenticatedLocalMcpClient(signal, { environment })
+  // Every tool call chooses its own saved login; nothing this process remembers can retarget it.
+  authenticatedClient: (signal, request) => createAuthenticatedLocalMcpClient(signal, {
+    environment,
+    ...request === void 0 ? {} : { request }
+  }),
+  listProfiles: (signal) => listSavedProfiles(signal, { environment })
 }), { onerror: (error) => process.stderr.write(`${error.message}
 `) });