@autohq/cli 0.1.183 → 0.1.185

package/dist/index.js

@@ -9,899 +9,6 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/lib/api/base-url.ts
-function resolveApiBaseUrl(input = {}) {
-  const explicitValues = Array.isArray(input.explicit) ? input.explicit : [input.explicit];
-  const defaultUrl = input.defaultUrl === null ? void 0 : input.defaultUrl ?? DEFAULT_API_BASE_URL;
-  for (const value of [
-    ...explicitValues,
-    input.env?.AUTO_API_BASE_URL,
-    input.configServerUrl,
-    defaultUrl
-  ]) {
-    const normalized = normalizeApiBaseUrl(value);
-    if (normalized) return normalized;
-  }
-  return void 0;
-}
-function normalizeApiBaseUrl(value) {
-  const trimmed = value?.trim();
-  if (!trimmed) return void 0;
-  return trimmed.replace(/\/+$/, "");
-}
-var DEFAULT_API_BASE_URL;
-var init_base_url = __esm({
-  "src/lib/api/base-url.ts"() {
-    "use strict";
-    DEFAULT_API_BASE_URL = "https://www.auto.sh";
-  }
-});
-
-// src/lib/api/http.ts
-async function postJson(fetchImpl, url2, body) {
-  const response = await fetchImpl(url2, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (!response.ok) {
-    const errorBody = await response.json().catch(() => ({}));
-    throw new Error(
-      errorBody.error ?? `Request failed with status ${response.status}`
-    );
-  }
-  return response.json();
-}
-var init_http = __esm({
-  "src/lib/api/http.ts"() {
-    "use strict";
-  }
-});
-
-// src/lib/auth/tokens.ts
-function accessTokenExpiresAt(token2) {
-  if (!token2.access_token) {
-    throw new Error("Token response did not include an access token.");
-  }
-  return new Date(Date.now() + token2.expires_in * 1e3).toISOString();
-}
-function hasUsableAccessToken(config2, project) {
-  if (!config2.accessToken || !config2.accessTokenExpiresAt) {
-    return false;
-  }
-  const expiresAt = Date.parse(config2.accessTokenExpiresAt);
-  return config2.accessTokenOrganizationId === project.organizationId && config2.accessTokenProjectId === project.projectId && Number.isFinite(expiresAt) && expiresAt - ACCESS_TOKEN_REFRESH_SKEW_MS > Date.now();
-}
-var ACCESS_TOKEN_REFRESH_SKEW_MS;
-var init_tokens = __esm({
-  "src/lib/auth/tokens.ts"() {
-    "use strict";
-    ACCESS_TOKEN_REFRESH_SKEW_MS = 3e4;
-  }
-});
-
-// src/lib/browser.ts
-import { spawn } from "child_process";
-function openBrowser(url2) {
-  if (!shouldOpenBrowser(process.env)) {
-    return;
-  }
-  const child = spawn(openCommand(), openArgs(url2), {
-    detached: true,
-    stdio: "ignore"
-  });
-  child.unref();
-}
-function shouldOpenBrowser(env) {
-  if (env.AUTO_ALLOW_BROWSER_OPEN_IN_TESTS === "1") {
-    return true;
-  }
-  return !env.NODE_TEST_CONTEXT;
-}
-function openCommand() {
-  switch (process.platform) {
-    case "darwin":
-      return "open";
-    case "win32":
-      return "cmd";
-    default:
-      return "xdg-open";
-  }
-}
-function openArgs(url2) {
-  return process.platform === "win32" ? ["/c", "start", "", url2] : [url2];
-}
-var init_browser = __esm({
-  "src/lib/browser.ts"() {
-    "use strict";
-  }
-});
-
-// src/lib/config/path.ts
-import { createHash } from "crypto";
-import { homedir } from "os";
-import { basename, dirname, join, normalize } from "path";
-function defaultConfigPath() {
-  return process.env.AUTO_CLI_CONFIG ?? join(homedir(), ".auto", "config.yaml");
-}
-function isProfilePath(path2) {
-  return basename(dirname(path2)) === PROFILES_DIR_NAME;
-}
-function profilesDir(configPath = defaultConfigPath()) {
-  if (isProfilePath(configPath)) return dirname(configPath);
-  return normalize(join(configPath, "..", PROFILES_DIR_NAME));
-}
-function profileFilePath(configPath, name) {
-  return join(profilesDir(configPath), `${name}.yaml`);
-}
-function profileNameFromPath(path2) {
-  return basename(path2).replace(/\.yaml$/, "");
-}
-function assertValidProfileName(name) {
-  if (!PROFILE_NAME_PATTERN.test(name)) {
-    throw new Error(
-      `Invalid profile name "${name}". Profile names use lowercase letters, digits, dots, dashes, and underscores.`
-    );
-  }
-  return name;
-}
-function derivedProfileName(input) {
-  const key = `${input.userEmail.toLowerCase()}
-${serverHost(input.serverUrl)}`;
-  const hash2 = createHash("sha256").update(key).digest("hex").slice(0, 8);
-  return `${slug(input.userEmail)}--${slug(serverHost(input.serverUrl))}-${hash2}`;
-}
-function serverHost(serverUrl) {
-  try {
-    return new URL(serverUrl).host;
-  } catch {
-    return serverUrl;
-  }
-}
-function slug(value) {
-  return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "_");
-}
-var PROFILES_DIR_NAME, PROFILE_NAME_PATTERN;
-var init_path = __esm({
-  "src/lib/config/path.ts"() {
-    "use strict";
-    PROFILES_DIR_NAME = "profiles";
-    PROFILE_NAME_PATTERN = /^[a-z0-9._-]+$/;
-  }
-});
-
-// src/lib/config/file.ts
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname as dirname2 } from "path";
-function readConfig(path2 = defaultConfigPath()) {
-  const profilePath = activeProfilePath(path2);
-  return profilePath ? readProfileFile(profilePath) : {};
-}
-function currentProfileName(path2 = defaultConfigPath()) {
-  if (isProfilePath(path2)) return profileNameFromPath(path2);
-  return readPointerFile(path2);
-}
-function writeConfig(config2, path2 = defaultConfigPath()) {
-  const profilePath = activeProfilePath(path2);
-  if (!profilePath) {
-    throw new Error("Not logged in. Session `auto auth login` first.");
-  }
-  writeProfileFile(config2, profilePath);
-}
-function saveProfile(input) {
-  const configPath = input.configPath ?? defaultConfigPath();
-  const name = resolveProfileName(input);
-  writeProfileFile(input.config, profileFilePath(configPath, name));
-  return name;
-}
-function setCurrentProfile(name, path2 = defaultConfigPath()) {
-  if (isProfilePath(path2)) {
-    throw new Error(
-      "Cannot change the active profile while pinned to a profile."
-    );
-  }
-  writeFile(`${CURRENT_PROFILE_KEY}: ${assertValidProfileName(name)}
-`, path2);
-}
-function clearCurrentProfile(path2 = defaultConfigPath()) {
-  if (isProfilePath(path2)) {
-    throw new Error(
-      "Cannot change the active profile while pinned to a profile."
-    );
-  }
-  writeFile("", path2);
-}
-function activeProfilePath(path2) {
-  if (isProfilePath(path2)) return path2;
-  const currentProfile = readPointerFile(path2);
-  return currentProfile ? profileFilePath(path2, currentProfile) : void 0;
-}
-function resolveProfileName(input) {
-  if (input.name !== void 0) return assertValidProfileName(input.name);
-  if (!input.config.userEmail || !input.config.serverUrl) {
-    throw new Error(
-      "A profile name is required for a config without a signed-in account."
-    );
-  }
-  return derivedProfileName({
-    userEmail: input.config.userEmail,
-    serverUrl: input.config.serverUrl
-  });
-}
-function readPointerFile(path2) {
-  for (const [key, value] of readKeyValueLines(path2)) {
-    if (key === CURRENT_PROFILE_KEY) return value || void 0;
-  }
-  return void 0;
-}
-function readProfileFile(path2) {
-  const config2 = {};
-  for (const [key, value] of readKeyValueLines(path2)) {
-    const known = CONFIG_KEYS.find((candidate) => candidate === key);
-    if (known) config2[known] = value;
-  }
-  return config2;
-}
-function readKeyValueLines(path2) {
-  let text;
-  try {
-    text = readFileSync(path2, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  return text.split(/\r?\n/).map((line) => /^([A-Za-z0-9_]+):\s*(.*)$/.exec(line.trim())).filter((match) => match !== null).map((match) => [match[1] ?? "", match[2] ?? ""]);
-}
-function writeProfileFile(config2, path2) {
-  const lines = CONFIG_KEYS.filter((key) => config2[key]).map(
-    (key) => `${key}: ${config2[key]}`
-  );
-  writeFile(`${lines.join("\n")}
-`, path2);
-}
-function writeFile(content, path2) {
-  mkdirSync(dirname2(path2), { recursive: true });
-  writeFileSync(path2, content, { encoding: "utf8", mode: 384 });
-  chmodSync(path2, 384);
-}
-var CONFIG_KEYS, CURRENT_PROFILE_KEY;
-var init_file = __esm({
-  "src/lib/config/file.ts"() {
-    "use strict";
-    init_path();
-    CONFIG_KEYS = [
-      "serverUrl",
-      "userId",
-      "userEmail",
-      "organizationId",
-      "projectId",
-      "refreshToken",
-      "accessToken",
-      "accessTokenExpiresAt",
-      "accessTokenOrganizationId",
-      "accessTokenProjectId"
-    ];
-    CURRENT_PROFILE_KEY = "currentProfile";
-  }
-});
-
-// src/lib/config/profiles.ts
-import { readdirSync } from "fs";
-import { join as join2 } from "path";
-function listProfiles(configPath = defaultConfigPath()) {
-  const dir = profilesDir(configPath);
-  let entries;
-  try {
-    entries = readdirSync(dir);
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  return entries.filter((entry) => entry.endsWith(".yaml")).sort().map((entry) => {
-    const path2 = join2(dir, entry);
-    return {
-      name: profileNameFromPath(path2),
-      path: path2,
-      config: readConfig(path2)
-    };
-  }).filter((profile) => profile.config.userEmail);
-}
-function findAccountProfile(input) {
-  const candidates = listProfiles(input.configPath).map((profile) => profile.config).filter((config2) => config2.serverUrl === input.serverUrl);
-  return candidates.find(
-    (config2) => input.userId && config2.userId === input.userId
-  ) ?? // Email is only a fallback for when a user id is missing on either side;
-  // it must never override a known user-id mismatch (emails can be
-  // reassigned to a different user).
-  candidates.find(
-    (config2) => input.userEmail && config2.userEmail?.toLowerCase() === input.userEmail.toLowerCase() && !(input.userId && config2.userId && config2.userId !== input.userId)
-  );
-}
-var init_profiles = __esm({
-  "src/lib/config/profiles.ts"() {
-    "use strict";
-    init_file();
-    init_path();
-  }
-});
-
-// src/lib/oauth/loopback.ts
-import { createServer } from "http";
-async function createOAuthLoopbackCallback(input) {
-  const path2 = input?.path ?? "/callback";
-  const successHtml = input?.successHtml ?? renderOAuthLoopbackPage({
-    status: "success",
-    eyebrow: "Auto",
-    title: "Authorization complete",
-    message: "You can close this window and return to your terminal."
-  });
-  const failureHtml = input?.failureHtml ?? renderOAuthLoopbackPage({
-    status: "failure",
-    eyebrow: "Auto",
-    title: "Authorization failed",
-    message: "Return to your terminal to see the error details."
-  });
-  let resolveResult;
-  let rejectResult;
-  const result = new Promise((resolve4, reject) => {
-    resolveResult = resolve4;
-    rejectResult = reject;
-  });
-  const server = createServer((request, response) => {
-    const url2 = new URL(request.url ?? "/", "http://127.0.0.1");
-    if (url2.pathname !== path2) {
-      response.writeHead(404).end("Not found");
-      return;
-    }
-    const error51 = url2.searchParams.get("error");
-    if (error51) {
-      response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-      endThenSettle(
-        response,
-        resolveHtml(failureHtml, { code: "" }),
-        () => rejectResult(new Error(error51))
-      );
-      return;
-    }
-    const code = url2.searchParams.get("code") ?? "";
-    const sensitiveActionToken = url2.searchParams.get("sensitive_action_token") ?? void 0;
-    if (!code && !sensitiveActionToken) {
-      response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-      endThenSettle(
-        response,
-        renderOAuthLoopbackPage({
-          status: "failure",
-          eyebrow: "Auto",
-          title: "Missing authorization result",
-          message: "Return to your terminal to retry the authorization flow."
-        }),
-        () => rejectResult(new Error("Missing authorization result"))
-      );
-      return;
-    }
-    const result2 = {
-      code,
-      sensitiveActionToken,
-      organizationName: url2.searchParams.get("organization_name") ?? void 0,
-      projectName: url2.searchParams.get("project_name") ?? void 0,
-      state: url2.searchParams.get("state") ?? void 0
-    };
-    response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-    endThenSettle(
-      response,
-      resolveHtml(successHtml, result2),
-      () => resolveResult(result2)
-    );
-  });
-  await listenOnPreferredPort(
-    server,
-    input?.preferredPort ?? DEFAULT_CALLBACK_PORT
-  );
-  const address = server.address();
-  return {
-    close: () => {
-      server.close();
-      server.closeAllConnections();
-    },
-    redirectUri: `http://127.0.0.1:${address.port}${path2}`,
-    result
-  };
-}
-function renderOAuthLoopbackPage(input) {
-  const detailRows = (input.details ?? []).filter((detail) => detail.value).map(
-    (detail) => `<div class="detail">
-          <dt>${escapeHtml(detail.label)}</dt>
-          <dd>${escapeHtml(detail.value ?? "")}</dd>
-        </div>`
-  ).join("");
-  const hasDetails = detailRows.length > 0;
-  const statusLabel = input.status === "success" ? "Authorization received" : "Authorization failed";
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>${escapeHtml(input.title)} | Auto</title>
-    <style>
-      :root {
-        color-scheme: light dark;
-        font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-        background: #f6f7f2;
-        color: #171814;
-      }
-      * {
-        box-sizing: border-box;
-      }
-      body {
-        min-height: 100vh;
-        margin: 0;
-        display: grid;
-        place-items: center;
-        padding: 32px;
-        background:
-          linear-gradient(135deg, rgba(35, 108, 96, 0.18), transparent 34%),
-          linear-gradient(315deg, rgba(194, 90, 62, 0.16), transparent 38%),
-          #f6f7f2;
-      }
-      main {
-        width: min(680px, 100%);
-        border: 1px solid rgba(23, 24, 20, 0.12);
-        border-radius: 8px;
-        background: rgba(255, 255, 252, 0.88);
-        box-shadow: 0 24px 70px rgba(23, 24, 20, 0.14);
-        padding: 32px;
-      }
-      .mark {
-        display: inline-flex;
-        align-items: center;
-        gap: 10px;
-        margin-bottom: 28px;
-        color: #4d554b;
-        font-size: 13px;
-        font-weight: 700;
-        letter-spacing: 0;
-        text-transform: uppercase;
-      }
-      .dot {
-        width: 12px;
-        height: 12px;
-        border-radius: 999px;
-        background: ${input.status === "success" ? "#22863a" : "#b42318"};
-        box-shadow: 0 0 0 6px ${input.status === "success" ? "rgba(34, 134, 58, 0.14)" : "rgba(180, 35, 24, 0.14)"};
-      }
-      h1 {
-        margin: 0;
-        max-width: 12ch;
-        font-size: 44px;
-        line-height: 1;
-        letter-spacing: 0;
-      }
-      p {
-        margin: 18px 0 0;
-        max-width: 58ch;
-        color: #4d554b;
-        font-size: 16px;
-        line-height: 1.55;
-      }
-      dl {
-        display: grid;
-        gap: 0;
-        margin: 28px 0 0;
-        border-block: 1px solid rgba(23, 24, 20, 0.13);
-      }
-      .detail {
-        display: grid;
-        grid-template-columns: minmax(118px, 0.42fr) 1fr;
-        gap: 18px;
-        padding: 14px 0;
-        border-bottom: 1px solid rgba(23, 24, 20, 0.09);
-      }
-      .detail:last-child {
-        border-bottom: 0;
-      }
-      dt {
-        color: #697066;
-        font-size: 13px;
-      }
-      dd {
-        margin: 0;
-        min-width: 0;
-        overflow-wrap: anywhere;
-        font-weight: 700;
-      }
-      .footer {
-        margin-top: 28px;
-        color: #697066;
-        font-size: 13px;
-      }
-      @media (max-width: 560px) {
-        body {
-          padding: 18px;
-        }
-        main {
-          padding: 24px;
-        }
-        h1 {
-          max-width: none;
-          font-size: 34px;
-        }
-        .detail {
-          grid-template-columns: 1fr;
-          gap: 4px;
-        }
-      }
-      @media (prefers-color-scheme: dark) {
-        :root {
-          background: #10120f;
-          color: #f2f4ec;
-        }
-        body {
-          background:
-            linear-gradient(135deg, rgba(70, 165, 148, 0.2), transparent 34%),
-            linear-gradient(315deg, rgba(222, 116, 82, 0.16), transparent 38%),
-            #10120f;
-        }
-        main {
-          border-color: rgba(242, 244, 236, 0.13);
-          background: rgba(24, 27, 22, 0.9);
-          box-shadow: 0 24px 70px rgba(0, 0, 0, 0.4);
-        }
-        p, dt, .mark, .footer {
-          color: #aeb6a8;
-        }
-        dl {
-          border-color: rgba(242, 244, 236, 0.14);
-        }
-        .detail {
-          border-bottom-color: rgba(242, 244, 236, 0.09);
-        }
-      }
-    </style>
-  </head>
-  <body>
-    <main>
-      <div class="mark"><span class="dot"></span>${escapeHtml(input.eyebrow ?? statusLabel)}</div>
-      <h1>${escapeHtml(input.title)}</h1>
-      <p>${escapeHtml(input.message)}</p>
-      ${hasDetails ? `<dl>${detailRows}</dl>` : ""}
-      <div class="footer">You can close this window and return to Auto.</div>
-    </main>
-  </body>
-</html>`;
-}
-function resolveHtml(html, result) {
-  return typeof html === "function" ? html(result) : html;
-}
-function endThenSettle(response, html, settle) {
-  response.once("finish", settle);
-  response.once("close", settle);
-  response.end(html);
-}
-function escapeHtml(value) {
-  return value.replace(/[&<>"']/g, (character) => {
-    switch (character) {
-      case "&":
-        return "&amp;";
-      case "<":
-        return "&lt;";
-      case ">":
-        return "&gt;";
-      case '"':
-        return "&quot;";
-      case "'":
-        return "&#39;";
-      default:
-        return character;
-    }
-  });
-}
-async function listenOnPreferredPort(server, port) {
-  try {
-    await listen(server, port);
-  } catch (error51) {
-    if (error51.code !== "EADDRINUSE") {
-      throw error51;
-    }
-    await listen(server, 0);
-  }
-}
-async function listen(server, port) {
-  await new Promise((resolve4, reject) => {
-    const onError = (error51) => {
-      server.off("listening", onListening);
-      reject(error51);
-    };
-    const onListening = () => {
-      server.off("error", onError);
-      resolve4();
-    };
-    server.once("error", onError);
-    server.once("listening", onListening);
-    server.listen(port, "127.0.0.1");
-  });
-}
-var DEFAULT_CALLBACK_PORT;
-var init_loopback = __esm({
-  "src/lib/oauth/loopback.ts"() {
-    "use strict";
-    DEFAULT_CALLBACK_PORT = 4670;
-  }
-});
-
-// src/lib/output/style.ts
-import { Chalk } from "chalk";
-function createStyle(flags) {
-  const textual = flags.outputMode === "text" || flags.outputMode === "tui";
-  if (!textual || flags.noColor || !flags.isTTY) {
-    return plainStyle;
-  }
-  const chalk2 = new Chalk({ level: 1 });
-  return {
-    enabled: true,
-    success: (text) => chalk2.green(text),
-    warn: (text) => chalk2.yellow(text),
-    error: (text) => chalk2.red(text),
-    heading: (text) => chalk2.bold.underline(text),
-    label: (text) => chalk2.bold(text),
-    id: (text) => chalk2.cyan(text),
-    url: (text) => chalk2.cyan.underline(text),
-    dim: (text) => chalk2.dim(text)
-  };
-}
-function identity(text) {
-  return text;
-}
-var plainStyle;
-var init_style = __esm({
-  "src/lib/output/style.ts"() {
-    "use strict";
-    plainStyle = {
-      enabled: false,
-      success: identity,
-      warn: identity,
-      error: identity,
-      heading: identity,
-      label: identity,
-      id: identity,
-      url: identity,
-      dim: identity
-    };
-  }
-});
-
-// src/commands/auth/pkce.ts
-import { createHash as createHash2, randomBytes } from "crypto";
-function pkceVerifier() {
-  return randomBytes(32).toString("base64url");
-}
-function pkceChallenge(verifier) {
-  return createHash2("sha256").update(verifier).digest("base64url");
-}
-var init_pkce = __esm({
-  "src/commands/auth/pkce.ts"() {
-    "use strict";
-  }
-});
-
-// src/commands/auth/login.ts
-async function login(input) {
-  const style = input.style ?? plainStyle;
-  if (input.options.profile !== void 0) {
-    assertValidProfileName(input.options.profile);
-  }
-  const serverUrl = resolveApiBaseUrl({ explicit: input.options.apiUrl });
-  if (input.options.device) {
-    const device = await postJson(
-      input.fetch,
-      `${serverUrl}/api/v1/auth/device/code`,
-      {}
-    );
-    input.writeOutput(
-      `Open ${style.url(device.verification_uri)} and enter ${style.label(
-        device.user_code
-      )}`
-    );
-    input.writeOutput(
-      `${style.label("Device code:")} ${style.id(device.device_code)}`
-    );
-    const deadline = Date.now() + device.expires_in * 1e3;
-    let firstAttempt = true;
-    while (Date.now() < deadline) {
-      if (!firstAttempt) {
-        await sleep(Math.max(0, device.interval) * 1e3);
-      }
-      firstAttempt = false;
-      let token3;
-      try {
-        token3 = await postJson(
-          input.fetch,
-          `${serverUrl}/api/v1/auth/cli/token`,
-          {
-            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-            device_code: device.device_code
-          }
-        );
-      } catch (error51) {
-        if (error51 instanceof Error && error51.message === "authorization_pending") {
-          continue;
-        }
-        throw error51;
-      }
-      await finishLogin({
-        token: token3,
-        serverUrl,
-        fetch: input.fetch,
-        configPath: input.configPath,
-        profileName: input.options.profile,
-        writeOutput: input.writeOutput,
-        style
-      });
-      return;
-    }
-    throw new Error("Device authorization expired before approval.");
-  }
-  const verifier = input.options.verifier ?? pkceVerifier();
-  if (!input.options.code) {
-    const callback = await createOAuthLoopbackCallback({
-      successHtml: () => renderOAuthLoopbackPage({
-        status: "success",
-        eyebrow: "Auto CLI",
-        title: "Login authorized",
-        message: "Auto received the browser authorization. The CLI will finish signing you in from your terminal.",
-        details: [{ label: "Server", value: serverUrl }]
-      }),
-      failureHtml: () => renderOAuthLoopbackPage({
-        status: "failure",
-        eyebrow: "Auto CLI",
-        title: "Login failed",
-        message: "The browser authorization did not complete. Return to your terminal to retry or inspect the error.",
-        details: [{ label: "Server", value: serverUrl }]
-      })
-    });
-    try {
-      const authorizeUrl = new URL("/auth/cli", serverUrl);
-      authorizeUrl.searchParams.set("pkce_challenge", pkceChallenge(verifier));
-      authorizeUrl.searchParams.set("redirect_uri", callback.redirectUri);
-      input.writeOutput(`Opening ${style.url(authorizeUrl.toString())}`);
-      input.writeOutput(style.dim("Waiting for browser authorization..."));
-      openBrowser(authorizeUrl.toString());
-      const { code } = await callback.result;
-      const token3 = await exchangeAuthorizationCode({
-        code,
-        fetch: input.fetch,
-        redirectUri: callback.redirectUri,
-        serverUrl,
-        verifier
-      });
-      await finishLogin({
-        token: token3,
-        serverUrl,
-        fetch: input.fetch,
-        configPath: input.configPath,
-        profileName: input.options.profile,
-        writeOutput: input.writeOutput,
-        style
-      });
-      return;
-    } finally {
-      callback.close();
-    }
-  }
-  const token2 = await exchangeAuthorizationCode({
-    code: input.options.code,
-    fetch: input.fetch,
-    redirectUri: "http://127.0.0.1/callback",
-    serverUrl,
-    verifier
-  });
-  await finishLogin({
-    token: token2,
-    serverUrl,
-    fetch: input.fetch,
-    configPath: input.configPath,
-    profileName: input.options.profile,
-    writeOutput: input.writeOutput,
-    style
-  });
-}
-async function exchangeAuthorizationCode(input) {
-  return postJson(
-    input.fetch,
-    `${input.serverUrl}/api/v1/auth/cli/token`,
-    {
-      grant_type: "authorization_code",
-      code: input.code,
-      code_verifier: input.verifier,
-      redirect_uri: input.redirectUri
-    }
-  );
-}
-async function finishLogin(input) {
-  const { token: token2, serverUrl } = input;
-  const profile = token2.user ? findAccountProfile({
-    configPath: input.configPath,
-    serverUrl,
-    userId: token2.user.id,
-    userEmail: token2.user.email
-  }) : void 0;
-  const selection = profile?.organizationId && profile.projectId ? {
-    organizationId: profile.organizationId,
-    projectId: profile.projectId
-  } : void 0;
-  let config2 = {
-    serverUrl,
-    userId: token2.user?.id,
-    userEmail: token2.user?.email,
-    refreshToken: token2.refresh_token,
-    accessToken: token2.access_token,
-    accessTokenExpiresAt: token2.access_token ? accessTokenExpiresAt(token2) : void 0
-  };
-  if (selection) {
-    try {
-      const scoped = await postJson(
-        input.fetch,
-        `${serverUrl}/api/v1/auth/cli/token`,
-        {
-          grant_type: "refresh_token",
-          refresh_token: token2.refresh_token,
-          organization_id: selection.organizationId,
-          project_id: selection.projectId
-        }
-      );
-      config2 = {
-        ...config2,
-        ...selection,
-        refreshToken: scoped.refresh_token,
-        accessToken: scoped.access_token,
-        accessTokenExpiresAt: scoped.access_token ? accessTokenExpiresAt(scoped) : void 0,
-        accessTokenOrganizationId: scoped.access_token ? selection.organizationId : void 0,
-        accessTokenProjectId: scoped.access_token ? selection.projectId : void 0
-      };
-    } catch {
-      input.writeOutput(
-        input.style.warn(
-          "The saved organization/project selection is not available for this account; run `auto orgs list` to pick a new one."
-        )
-      );
-    }
-  }
-  persistLogin(config2, input);
-  input.writeOutput(
-    input.style.success(
-      token2.user ? `Logged in as ${token2.user.email}.` : "Logged in."
-    )
-  );
-}
-function persistLogin(config2, input) {
-  const pinned = input.configPath !== void 0 && isProfilePath(input.configPath);
-  const name = saveProfile({
-    config: config2,
-    name: input.profileName ?? (pinned && input.configPath ? profileNameFromPath(input.configPath) : void 0),
-    configPath: input.configPath
-  });
-  if (!pinned) {
-    setCurrentProfile(name, input.configPath);
-  }
-}
-async function sleep(ms) {
-  await new Promise((resolve4) => setTimeout(resolve4, ms));
-}
-var init_login = __esm({
-  "src/commands/auth/login.ts"() {
-    "use strict";
-    init_base_url();
-    init_http();
-    init_tokens();
-    init_browser();
-    init_file();
-    init_path();
-    init_profiles();
-    init_loopback();
-    init_style();
-    init_pkce();
-  }
-});
-
 // ../../node_modules/zod/v4/core/core.js
 // @__NO_SIDE_EFFECTS__
 function $constructor(name, initializer3, params) {
@@ -19794,6 +18901,201 @@ var init_src = __esm({
   }
 });
 
+// src/lib/auth/tokens.ts
+function accessTokenExpiresAt(token2) {
+  if (!token2.access_token) {
+    throw new Error("Token response did not include an access token.");
+  }
+  return new Date(Date.now() + token2.expires_in * 1e3).toISOString();
+}
+function hasUsableAccessToken(config2, project) {
+  if (!config2.accessToken || !config2.accessTokenExpiresAt) {
+    return false;
+  }
+  const expiresAt = Date.parse(config2.accessTokenExpiresAt);
+  return config2.accessTokenOrganizationId === project.organizationId && config2.accessTokenProjectId === project.projectId && Number.isFinite(expiresAt) && expiresAt - ACCESS_TOKEN_REFRESH_SKEW_MS > Date.now();
+}
+var ACCESS_TOKEN_REFRESH_SKEW_MS;
+var init_tokens = __esm({
+  "src/lib/auth/tokens.ts"() {
+    "use strict";
+    ACCESS_TOKEN_REFRESH_SKEW_MS = 3e4;
+  }
+});
+
+// src/lib/config/path.ts
+import { createHash } from "crypto";
+import { homedir } from "os";
+import { basename, dirname, join, normalize } from "path";
+function defaultConfigPath() {
+  return process.env.AUTO_CLI_CONFIG ?? join(homedir(), ".auto", "config.yaml");
+}
+function isAccountPath(path2) {
+  return basename(dirname(path2)) === ACCOUNTS_DIR_NAME;
+}
+function accountsDir(configPath = defaultConfigPath()) {
+  if (isAccountPath(configPath)) return dirname(configPath);
+  return normalize(join(configPath, "..", ACCOUNTS_DIR_NAME));
+}
+function accountFilePath(configPath, accountKey) {
+  return join(accountsDir(configPath), `${accountKey}.yaml`);
+}
+function accountKeyFromPath(path2) {
+  return basename(path2).replace(/\.yaml$/, "");
+}
+function assertValidAccountKey(accountKey) {
+  if (!ACCOUNT_KEY_PATTERN.test(accountKey)) {
+    throw new Error(
+      `Invalid account key "${accountKey}". Account keys use lowercase letters, digits, dots, dashes, and underscores.`
+    );
+  }
+  return accountKey;
+}
+function derivedAccountKey(input) {
+  const key = `${input.userEmail.toLowerCase()}
+${serverHost(input.serverUrl)}`;
+  const hash2 = createHash("sha256").update(key).digest("hex").slice(0, 8);
+  return `${slug(input.userEmail)}--${slug(serverHost(input.serverUrl))}-${hash2}`;
+}
+function serverHost(serverUrl) {
+  try {
+    return new URL(serverUrl).host;
+  } catch {
+    return serverUrl;
+  }
+}
+function slug(value) {
+  return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "_");
+}
+var ACCOUNTS_DIR_NAME, ACCOUNT_KEY_PATTERN;
+var init_path = __esm({
+  "src/lib/config/path.ts"() {
+    "use strict";
+    ACCOUNTS_DIR_NAME = "accounts";
+    ACCOUNT_KEY_PATTERN = /^[a-z0-9._-]+$/;
+  }
+});
+
+// src/lib/config/file.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname as dirname2 } from "path";
+function readConfig(path2 = defaultConfigPath()) {
+  const accountPath = activeAccountPath(path2);
+  return accountPath ? readAccountFile(accountPath) : {};
+}
+function activeAccountKey(path2 = defaultConfigPath()) {
+  if (isAccountPath(path2)) return accountKeyFromPath(path2);
+  return readActiveAccountFile(path2);
+}
+function writeConfig(config2, path2 = defaultConfigPath()) {
+  const accountPath = activeAccountPath(path2);
+  if (!accountPath) {
+    throw new Error("Not logged in. Session `auto auth login` first.");
+  }
+  writeAccountFile(config2, accountPath);
+}
+function saveAccount(input) {
+  const configPath = input.configPath ?? defaultConfigPath();
+  const accountKey = resolveAccountKey(input);
+  writeAccountFile(input.config, accountFilePath(configPath, accountKey));
+  return accountKey;
+}
+function setActiveAccount(accountKey, path2 = defaultConfigPath()) {
+  if (isAccountPath(path2)) {
+    throw new Error(
+      "Cannot change the active account while operating on an account file."
+    );
+  }
+  writeFile(
+    `${ACTIVE_ACCOUNT_KEY}: ${assertValidAccountKey(accountKey)}
+`,
+    path2
+  );
+}
+function clearActiveAccount(path2 = defaultConfigPath()) {
+  if (isAccountPath(path2)) {
+    throw new Error(
+      "Cannot change the active account while operating on an account file."
+    );
+  }
+  writeFile("", path2);
+}
+function activeAccountPath(path2) {
+  if (isAccountPath(path2)) return path2;
+  const accountKey = readActiveAccountFile(path2);
+  return accountKey ? accountFilePath(path2, accountKey) : void 0;
+}
+function resolveAccountKey(input) {
+  if (input.accountKey !== void 0) {
+    return assertValidAccountKey(input.accountKey);
+  }
+  if (!input.config.userEmail || !input.config.serverUrl) {
+    throw new Error(
+      "An account key is required for a config without a signed-in account."
+    );
+  }
+  return derivedAccountKey({
+    userEmail: input.config.userEmail,
+    serverUrl: input.config.serverUrl
+  });
+}
+function readActiveAccountFile(path2) {
+  for (const [key, value] of readKeyValueLines(path2)) {
+    if (key === ACTIVE_ACCOUNT_KEY) return value || void 0;
+  }
+  return void 0;
+}
+function readAccountFile(path2) {
+  const config2 = {};
+  for (const [key, value] of readKeyValueLines(path2)) {
+    const known = CONFIG_KEYS.find((candidate) => candidate === key);
+    if (known) config2[known] = value;
+  }
+  return config2;
+}
+function readKeyValueLines(path2) {
+  let text;
+  try {
+    text = readFileSync(path2, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  return text.split(/\r?\n/).map((line) => /^([A-Za-z0-9_]+):\s*(.*)$/.exec(line.trim())).filter((match) => match !== null).map((match) => [match[1] ?? "", match[2] ?? ""]);
+}
+function writeAccountFile(config2, path2) {
+  const lines = CONFIG_KEYS.filter((key) => config2[key]).map(
+    (key) => `${key}: ${config2[key]}`
+  );
+  writeFile(`${lines.join("\n")}
+`, path2);
+}
+function writeFile(content, path2) {
+  mkdirSync(dirname2(path2), { recursive: true });
+  writeFileSync(path2, content, { encoding: "utf8", mode: 384 });
+  chmodSync(path2, 384);
+}
+var CONFIG_KEYS, ACTIVE_ACCOUNT_KEY;
+var init_file = __esm({
+  "src/lib/config/file.ts"() {
+    "use strict";
+    init_path();
+    CONFIG_KEYS = [
+      "serverUrl",
+      "userId",
+      "userEmail",
+      "organizationId",
+      "projectId",
+      "refreshToken",
+      "accessToken",
+      "accessTokenExpiresAt",
+      "accessTokenOrganizationId",
+      "accessTokenProjectId"
+    ];
+    ACTIVE_ACCOUNT_KEY = "activeAccount";
+  }
+});
+
 // src/lib/config/active-project.ts
 function requireActiveProject(config2) {
   if (!config2.organizationId || !config2.projectId) {
@@ -19909,6 +19211,34 @@ var init_sse = __esm({
   }
 });
 
+// src/lib/api/base-url.ts
+function resolveApiBaseUrl(input = {}) {
+  const explicitValues = Array.isArray(input.explicit) ? input.explicit : [input.explicit];
+  const defaultUrl = input.defaultUrl === null ? void 0 : input.defaultUrl ?? DEFAULT_API_BASE_URL;
+  for (const value of [
+    ...explicitValues,
+    input.env?.AUTO_API_BASE_URL,
+    input.configServerUrl,
+    defaultUrl
+  ]) {
+    const normalized = normalizeApiBaseUrl(value);
+    if (normalized) return normalized;
+  }
+  return void 0;
+}
+function normalizeApiBaseUrl(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) return void 0;
+  return trimmed.replace(/\/+$/, "");
+}
+var DEFAULT_API_BASE_URL;
+var init_base_url = __esm({
+  "src/lib/api/base-url.ts"() {
+    "use strict";
+    DEFAULT_API_BASE_URL = "https://www.auto.sh";
+  }
+});
+
 // src/lib/api/errors.ts
 async function responseErrorMessage(response) {
   const text = await response.text();
@@ -19930,6 +19260,27 @@ var init_errors3 = __esm({
   }
 });
 
+// src/lib/api/http.ts
+async function postJson(fetchImpl, url2, body) {
+  const response = await fetchImpl(url2, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    const errorBody = await response.json().catch(() => ({}));
+    throw new Error(
+      errorBody.error ?? `Request failed with status ${response.status}`
+    );
+  }
+  return response.json();
+}
+var init_http = __esm({
+  "src/lib/api/http.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/api/paths.ts
 function apiPath(path2 = "") {
   return `${API_PREFIX}${cleanSubpath(path2)}`;
@@ -19975,7 +19326,7 @@ var init_paths = __esm({
 });
 
 // src/lib/api/resources.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function createResourceApi(context) {
   const environments = projectResource(context, {
     path: "/environments",
@@ -20042,7 +19393,7 @@ async function stageEmptyApplyBundle(context, options) {
   const sizeBytes = Buffer.byteLength(body, "utf8");
   const upload = await prepareProjectApplyBundleUpload(
     context,
-    { sha256: createHash3("sha256").update(body).digest("hex"), sizeBytes },
+    { sha256: createHash2("sha256").update(body).digest("hex"), sizeBytes },
     options
   );
   await uploadProjectApplyBundle(context, {
@@ -21675,13 +21026,393 @@ var init_client = __esm({
   }
 });
 
+// src/lib/config/accounts.ts
+import { readdirSync } from "fs";
+import { join as join2 } from "path";
+function listAccounts(configPath = defaultConfigPath()) {
+  const dir = accountsDir(configPath);
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  return entries.filter((entry) => entry.endsWith(".yaml")).sort().map((entry) => {
+    const path2 = join2(dir, entry);
+    return {
+      key: accountKeyFromPath(path2),
+      path: path2,
+      config: readConfig(path2)
+    };
+  }).filter((account) => account.config.userEmail);
+}
+function findStoredAccountConfig(input) {
+  const candidates = listAccounts(input.configPath).map((account) => account.config).filter((config2) => config2.serverUrl === input.serverUrl);
+  return candidates.find(
+    (config2) => input.userId && config2.userId === input.userId
+  ) ?? // Email is only a fallback for when a user id is missing on either side;
+  // it must never override a known user-id mismatch (emails can be
+  // reassigned to a different user).
+  candidates.find(
+    (config2) => input.userEmail && config2.userEmail?.toLowerCase() === input.userEmail.toLowerCase() && !(input.userId && config2.userId && config2.userId !== input.userId)
+  );
+}
+var init_accounts = __esm({
+  "src/lib/config/accounts.ts"() {
+    "use strict";
+    init_file();
+    init_path();
+  }
+});
+
+// src/lib/browser.ts
+import { spawn } from "child_process";
+function openBrowser(url2) {
+  if (!shouldOpenBrowser(process.env)) {
+    return;
+  }
+  const child = spawn(openCommand(), openArgs(url2), {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+}
+function shouldOpenBrowser(env) {
+  if (env.AUTO_ALLOW_BROWSER_OPEN_IN_TESTS === "1") {
+    return true;
+  }
+  return !env.NODE_TEST_CONTEXT;
+}
+function openCommand() {
+  switch (process.platform) {
+    case "darwin":
+      return "open";
+    case "win32":
+      return "cmd";
+    default:
+      return "xdg-open";
+  }
+}
+function openArgs(url2) {
+  return process.platform === "win32" ? ["/c", "start", "", url2] : [url2];
+}
+var init_browser = __esm({
+  "src/lib/browser.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/oauth/loopback.ts
+import { createServer } from "http";
+async function createOAuthLoopbackCallback(input) {
+  const path2 = input?.path ?? "/callback";
+  const successHtml = input?.successHtml ?? renderOAuthLoopbackPage({
+    status: "success",
+    eyebrow: "Auto",
+    title: "Authorization complete",
+    message: "You can close this window and return to your terminal."
+  });
+  const failureHtml = input?.failureHtml ?? renderOAuthLoopbackPage({
+    status: "failure",
+    eyebrow: "Auto",
+    title: "Authorization failed",
+    message: "Return to your terminal to see the error details."
+  });
+  let resolveResult;
+  let rejectResult;
+  const result = new Promise((resolve4, reject) => {
+    resolveResult = resolve4;
+    rejectResult = reject;
+  });
+  const server = createServer((request, response) => {
+    const url2 = new URL(request.url ?? "/", "http://127.0.0.1");
+    if (url2.pathname !== path2) {
+      response.writeHead(404).end("Not found");
+      return;
+    }
+    const error51 = url2.searchParams.get("error");
+    if (error51) {
+      response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+      endThenSettle(
+        response,
+        resolveHtml(failureHtml, { code: "" }),
+        () => rejectResult(new Error(error51))
+      );
+      return;
+    }
+    const code = url2.searchParams.get("code") ?? "";
+    const sensitiveActionToken = url2.searchParams.get("sensitive_action_token") ?? void 0;
+    if (!code && !sensitiveActionToken) {
+      response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+      endThenSettle(
+        response,
+        renderOAuthLoopbackPage({
+          status: "failure",
+          eyebrow: "Auto",
+          title: "Missing authorization result",
+          message: "Return to your terminal to retry the authorization flow."
+        }),
+        () => rejectResult(new Error("Missing authorization result"))
+      );
+      return;
+    }
+    const result2 = {
+      code,
+      sensitiveActionToken,
+      organizationName: url2.searchParams.get("organization_name") ?? void 0,
+      projectName: url2.searchParams.get("project_name") ?? void 0,
+      state: url2.searchParams.get("state") ?? void 0
+    };
+    response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    endThenSettle(
+      response,
+      resolveHtml(successHtml, result2),
+      () => resolveResult(result2)
+    );
+  });
+  await listenOnPreferredPort(
+    server,
+    input?.preferredPort ?? DEFAULT_CALLBACK_PORT
+  );
+  const address = server.address();
+  return {
+    close: () => {
+      server.close();
+      server.closeAllConnections();
+    },
+    redirectUri: `http://127.0.0.1:${address.port}${path2}`,
+    result
+  };
+}
+function renderOAuthLoopbackPage(input) {
+  const detailRows = (input.details ?? []).filter((detail) => detail.value).map(
+    (detail) => `<div class="detail">
+          <dt>${escapeHtml(detail.label)}</dt>
+          <dd>${escapeHtml(detail.value ?? "")}</dd>
+        </div>`
+  ).join("");
+  const hasDetails = detailRows.length > 0;
+  const statusLabel = input.status === "success" ? "Authorization received" : "Authorization failed";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>${escapeHtml(input.title)} | Auto</title>
+    <style>
+      :root {
+        color-scheme: light dark;
+        font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+        background: #f6f7f2;
+        color: #171814;
+      }
+      * {
+        box-sizing: border-box;
+      }
+      body {
+        min-height: 100vh;
+        margin: 0;
+        display: grid;
+        place-items: center;
+        padding: 32px;
+        background:
+          linear-gradient(135deg, rgba(35, 108, 96, 0.18), transparent 34%),
+          linear-gradient(315deg, rgba(194, 90, 62, 0.16), transparent 38%),
+          #f6f7f2;
+      }
+      main {
+        width: min(680px, 100%);
+        border: 1px solid rgba(23, 24, 20, 0.12);
+        border-radius: 8px;
+        background: rgba(255, 255, 252, 0.88);
+        box-shadow: 0 24px 70px rgba(23, 24, 20, 0.14);
+        padding: 32px;
+      }
+      .mark {
+        display: inline-flex;
+        align-items: center;
+        gap: 10px;
+        margin-bottom: 28px;
+        color: #4d554b;
+        font-size: 13px;
+        font-weight: 700;
+        letter-spacing: 0;
+        text-transform: uppercase;
+      }
+      .dot {
+        width: 12px;
+        height: 12px;
+        border-radius: 999px;
+        background: ${input.status === "success" ? "#22863a" : "#b42318"};
+        box-shadow: 0 0 0 6px ${input.status === "success" ? "rgba(34, 134, 58, 0.14)" : "rgba(180, 35, 24, 0.14)"};
+      }
+      h1 {
+        margin: 0;
+        max-width: 12ch;
+        font-size: 44px;
+        line-height: 1;
+        letter-spacing: 0;
+      }
+      p {
+        margin: 18px 0 0;
+        max-width: 58ch;
+        color: #4d554b;
+        font-size: 16px;
+        line-height: 1.55;
+      }
+      dl {
+        display: grid;
+        gap: 0;
+        margin: 28px 0 0;
+        border-block: 1px solid rgba(23, 24, 20, 0.13);
+      }
+      .detail {
+        display: grid;
+        grid-template-columns: minmax(118px, 0.42fr) 1fr;
+        gap: 18px;
+        padding: 14px 0;
+        border-bottom: 1px solid rgba(23, 24, 20, 0.09);
+      }
+      .detail:last-child {
+        border-bottom: 0;
+      }
+      dt {
+        color: #697066;
+        font-size: 13px;
+      }
+      dd {
+        margin: 0;
+        min-width: 0;
+        overflow-wrap: anywhere;
+        font-weight: 700;
+      }
+      .footer {
+        margin-top: 28px;
+        color: #697066;
+        font-size: 13px;
+      }
+      @media (max-width: 560px) {
+        body {
+          padding: 18px;
+        }
+        main {
+          padding: 24px;
+        }
+        h1 {
+          max-width: none;
+          font-size: 34px;
+        }
+        .detail {
+          grid-template-columns: 1fr;
+          gap: 4px;
+        }
+      }
+      @media (prefers-color-scheme: dark) {
+        :root {
+          background: #10120f;
+          color: #f2f4ec;
+        }
+        body {
+          background:
+            linear-gradient(135deg, rgba(70, 165, 148, 0.2), transparent 34%),
+            linear-gradient(315deg, rgba(222, 116, 82, 0.16), transparent 38%),
+            #10120f;
+        }
+        main {
+          border-color: rgba(242, 244, 236, 0.13);
+          background: rgba(24, 27, 22, 0.9);
+          box-shadow: 0 24px 70px rgba(0, 0, 0, 0.4);
+        }
+        p, dt, .mark, .footer {
+          color: #aeb6a8;
+        }
+        dl {
+          border-color: rgba(242, 244, 236, 0.14);
+        }
+        .detail {
+          border-bottom-color: rgba(242, 244, 236, 0.09);
+        }
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <div class="mark"><span class="dot"></span>${escapeHtml(input.eyebrow ?? statusLabel)}</div>
+      <h1>${escapeHtml(input.title)}</h1>
+      <p>${escapeHtml(input.message)}</p>
+      ${hasDetails ? `<dl>${detailRows}</dl>` : ""}
+      <div class="footer">You can close this window and return to Auto.</div>
+    </main>
+  </body>
+</html>`;
+}
+function resolveHtml(html, result) {
+  return typeof html === "function" ? html(result) : html;
+}
+function endThenSettle(response, html, settle) {
+  response.once("finish", settle);
+  response.once("close", settle);
+  response.end(html);
+}
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (character) => {
+    switch (character) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      case "'":
+        return "&#39;";
+      default:
+        return character;
+    }
+  });
+}
+async function listenOnPreferredPort(server, port) {
+  try {
+    await listen(server, port);
+  } catch (error51) {
+    if (error51.code !== "EADDRINUSE") {
+      throw error51;
+    }
+    await listen(server, 0);
+  }
+}
+async function listen(server, port) {
+  await new Promise((resolve4, reject) => {
+    const onError = (error51) => {
+      server.off("listening", onListening);
+      reject(error51);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve4();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, "127.0.0.1");
+  });
+}
+var DEFAULT_CALLBACK_PORT;
+var init_loopback = __esm({
+  "src/lib/oauth/loopback.ts"() {
+    "use strict";
+    DEFAULT_CALLBACK_PORT = 4670;
+  }
+});
+
 // package.json
 var package_default;
 var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.183",
+      version: "0.1.185",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -22450,6 +22181,47 @@ var init_progress = __esm({
   }
 });
 
+// src/lib/output/style.ts
+import { Chalk } from "chalk";
+function createStyle(flags) {
+  const textual = flags.outputMode === "text" || flags.outputMode === "tui";
+  if (!textual || flags.noColor || !flags.isTTY) {
+    return plainStyle;
+  }
+  const chalk2 = new Chalk({ level: 1 });
+  return {
+    enabled: true,
+    success: (text) => chalk2.green(text),
+    warn: (text) => chalk2.yellow(text),
+    error: (text) => chalk2.red(text),
+    heading: (text) => chalk2.bold.underline(text),
+    label: (text) => chalk2.bold(text),
+    id: (text) => chalk2.cyan(text),
+    url: (text) => chalk2.cyan.underline(text),
+    dim: (text) => chalk2.dim(text)
+  };
+}
+function identity(text) {
+  return text;
+}
+var plainStyle;
+var init_style = __esm({
+  "src/lib/output/style.ts"() {
+    "use strict";
+    plainStyle = {
+      enabled: false,
+      success: identity,
+      warn: identity,
+      error: identity,
+      heading: identity,
+      label: identity,
+      id: identity,
+      url: identity,
+      dim: identity
+    };
+  }
+});
+
 // src/commands/apply/agent-tool-connect.ts
 async function connectAgentTool(input) {
   if (input.manual) {
@@ -23429,7 +23201,7 @@ var init_apply_result = __esm({
 });
 
 // ../../packages/schemas/src/project-apply-files/assets.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { extname as extname2 } from "path";
 function readApplyAssets(resources, readAsset) {
   const assets = {};
@@ -23476,7 +23248,7 @@ function projectApplyAssetFromSource(input) {
     );
   }
   return {
-    sha256: createHash4("sha256").update(bytes).digest("hex"),
+    sha256: createHash3("sha256").update(bytes).digest("hex"),
     contentType: extension === ".png" ? "image/png" : "image/jpeg",
     dataBase64: bytes.toString("base64")
   };
@@ -23665,7 +23437,7 @@ var init_project_apply_files2 = __esm({
 
 // src/commands/apply/files.ts
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync3,
   readFileSync as readFileSync4,
   readdirSync as readdirSync3,
   realpathSync,
@@ -23813,7 +23585,7 @@ function applyFileSourceRoot(file2, projectRoot) {
 }
 function directoryHasAutoRoot(directory) {
   const autoRoot = resolve2(directory, ".auto");
-  if (!existsSync4(autoRoot)) {
+  if (!existsSync3(autoRoot)) {
     return false;
   }
   return statSync2(autoRoot).isDirectory();
@@ -23893,7 +23665,7 @@ var init_files = __esm({
 });
 
 // src/commands/apply/actions.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 async function applyResource(input) {
   if (input.commandOptions.connect && input.commandOptions.json) {
     throw new Error("Cannot use --connect with --json output.");
@@ -23930,7 +23702,7 @@ async function applyProjectBundleInput(input) {
     spinner.start("Preparing upload");
     const upload = await input.client.prepareProjectApplyBundleUpload(
       {
-        sha256: createHash5("sha256").update(body).digest("hex"),
+        sha256: createHash4("sha256").update(body).digest("hex"),
         sizeBytes
       },
       { apiBaseUrl: input.commandOptions.apiBaseUrl }
@@ -24088,6 +23860,233 @@ var init_actions = __esm({
   }
 });
 
+// src/commands/auth/pkce.ts
+import { createHash as createHash5, randomBytes as randomBytes2 } from "crypto";
+function pkceVerifier() {
+  return randomBytes2(32).toString("base64url");
+}
+function pkceChallenge(verifier) {
+  return createHash5("sha256").update(verifier).digest("base64url");
+}
+var init_pkce = __esm({
+  "src/commands/auth/pkce.ts"() {
+    "use strict";
+  }
+});
+
+// src/commands/auth/login.ts
+async function login(input) {
+  const style = input.style ?? plainStyle;
+  const serverUrl = resolveApiBaseUrl({ explicit: input.options.apiUrl });
+  if (input.options.device) {
+    const device = await postJson(
+      input.fetch,
+      `${serverUrl}/api/v1/auth/device/code`,
+      {}
+    );
+    input.writeOutput(
+      `Open ${style.url(device.verification_uri)} and enter ${style.label(
+        device.user_code
+      )}`
+    );
+    input.writeOutput(
+      `${style.label("Device code:")} ${style.id(device.device_code)}`
+    );
+    const deadline = Date.now() + device.expires_in * 1e3;
+    let firstAttempt = true;
+    while (Date.now() < deadline) {
+      if (!firstAttempt) {
+        await sleep2(Math.max(0, device.interval) * 1e3);
+      }
+      firstAttempt = false;
+      let token3;
+      try {
+        token3 = await postJson(
+          input.fetch,
+          `${serverUrl}/api/v1/auth/cli/token`,
+          {
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            device_code: device.device_code
+          }
+        );
+      } catch (error51) {
+        if (error51 instanceof Error && error51.message === "authorization_pending") {
+          continue;
+        }
+        throw error51;
+      }
+      await finishLogin({
+        token: token3,
+        serverUrl,
+        fetch: input.fetch,
+        configPath: input.configPath,
+        writeOutput: input.writeOutput,
+        style
+      });
+      return;
+    }
+    throw new Error("Device authorization expired before approval.");
+  }
+  const verifier = input.options.verifier ?? pkceVerifier();
+  if (!input.options.code) {
+    const callback = await createOAuthLoopbackCallback({
+      successHtml: () => renderOAuthLoopbackPage({
+        status: "success",
+        eyebrow: "Auto CLI",
+        title: "Login authorized",
+        message: "Auto received the browser authorization. The CLI will finish signing you in from your terminal.",
+        details: [{ label: "Server", value: serverUrl }]
+      }),
+      failureHtml: () => renderOAuthLoopbackPage({
+        status: "failure",
+        eyebrow: "Auto CLI",
+        title: "Login failed",
+        message: "The browser authorization did not complete. Return to your terminal to retry or inspect the error.",
+        details: [{ label: "Server", value: serverUrl }]
+      })
+    });
+    try {
+      const authorizeUrl = new URL("/auth/cli", serverUrl);
+      authorizeUrl.searchParams.set("pkce_challenge", pkceChallenge(verifier));
+      authorizeUrl.searchParams.set("redirect_uri", callback.redirectUri);
+      input.writeOutput(`Opening ${style.url(authorizeUrl.toString())}`);
+      input.writeOutput(style.dim("Waiting for browser authorization..."));
+      openBrowser(authorizeUrl.toString());
+      const { code } = await callback.result;
+      const token3 = await exchangeAuthorizationCode({
+        code,
+        fetch: input.fetch,
+        redirectUri: callback.redirectUri,
+        serverUrl,
+        verifier
+      });
+      await finishLogin({
+        token: token3,
+        serverUrl,
+        fetch: input.fetch,
+        configPath: input.configPath,
+        writeOutput: input.writeOutput,
+        style
+      });
+      return;
+    } finally {
+      callback.close();
+    }
+  }
+  const token2 = await exchangeAuthorizationCode({
+    code: input.options.code,
+    fetch: input.fetch,
+    redirectUri: "http://127.0.0.1/callback",
+    serverUrl,
+    verifier
+  });
+  await finishLogin({
+    token: token2,
+    serverUrl,
+    fetch: input.fetch,
+    configPath: input.configPath,
+    writeOutput: input.writeOutput,
+    style
+  });
+}
+async function exchangeAuthorizationCode(input) {
+  return postJson(
+    input.fetch,
+    `${input.serverUrl}/api/v1/auth/cli/token`,
+    {
+      grant_type: "authorization_code",
+      code: input.code,
+      code_verifier: input.verifier,
+      redirect_uri: input.redirectUri
+    }
+  );
+}
+async function finishLogin(input) {
+  const { token: token2, serverUrl } = input;
+  const storedAccount = token2.user ? findStoredAccountConfig({
+    configPath: input.configPath,
+    serverUrl,
+    userId: token2.user.id,
+    userEmail: token2.user.email
+  }) : void 0;
+  const selection = storedAccount?.organizationId && storedAccount.projectId ? {
+    organizationId: storedAccount.organizationId,
+    projectId: storedAccount.projectId
+  } : void 0;
+  let config2 = {
+    serverUrl,
+    userId: token2.user?.id,
+    userEmail: token2.user?.email,
+    refreshToken: token2.refresh_token,
+    accessToken: token2.access_token,
+    accessTokenExpiresAt: token2.access_token ? accessTokenExpiresAt(token2) : void 0
+  };
+  if (selection) {
+    try {
+      const scoped = await postJson(
+        input.fetch,
+        `${serverUrl}/api/v1/auth/cli/token`,
+        {
+          grant_type: "refresh_token",
+          refresh_token: token2.refresh_token,
+          organization_id: selection.organizationId,
+          project_id: selection.projectId
+        }
+      );
+      config2 = {
+        ...config2,
+        ...selection,
+        refreshToken: scoped.refresh_token,
+        accessToken: scoped.access_token,
+        accessTokenExpiresAt: scoped.access_token ? accessTokenExpiresAt(scoped) : void 0,
+        accessTokenOrganizationId: scoped.access_token ? selection.organizationId : void 0,
+        accessTokenProjectId: scoped.access_token ? selection.projectId : void 0
+      };
+    } catch {
+      input.writeOutput(
+        input.style.warn(
+          "The saved organization/project selection is not available for this account; run `auto orgs list` to pick a new one."
+        )
+      );
+    }
+  }
+  persistLogin(config2, input);
+  input.writeOutput(
+    input.style.success(
+      token2.user ? `Logged in as ${token2.user.email}.` : "Logged in."
+    )
+  );
+}
+function persistLogin(config2, input) {
+  const directAccountPath = input.configPath !== void 0 && isAccountPath(input.configPath);
+  const accountKey = saveAccount({
+    config: config2,
+    accountKey: directAccountPath && input.configPath ? accountKeyFromPath(input.configPath) : void 0,
+    configPath: input.configPath
+  });
+  if (!directAccountPath) {
+    setActiveAccount(accountKey, input.configPath);
+  }
+}
+async function sleep2(ms) {
+  await new Promise((resolve4) => setTimeout(resolve4, ms));
+}
+var init_login = __esm({
+  "src/commands/auth/login.ts"() {
+    "use strict";
+    init_base_url();
+    init_http();
+    init_tokens();
+    init_browser();
+    init_accounts();
+    init_file();
+    init_path();
+    init_loopback();
+    init_style();
+    init_pkce();
+  }
+});
+
 // src/lib/resources.ts
 function parseProjectResourceReference(resource) {
   const [kind, name, extra] = resource.split("/");
@@ -29643,7 +29642,7 @@ __export(launcher_exports, {
   launch: () => launch
 });
 import { spawnSync } from "child_process";
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { dirname as dirname6, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
@@ -29833,7 +29832,7 @@ function resolveLatestReleaseVersionFromCheckout() {
 function findRepoRoot(startDirectory) {
   let directory = startDirectory;
   while (true) {
-    if (existsSync5(resolve3(directory, ".git")) && existsSync5(resolve3(directory, "apps/cli/package.json"))) {
+    if (existsSync4(resolve3(directory, ".git")) && existsSync4(resolve3(directory, "apps/cli/package.json"))) {
       return directory;
     }
     const parent = dirname6(directory);
@@ -29900,16 +29899,13 @@ var init_launcher = __esm({
 });
 
 // src/cli/program.ts
-import { existsSync as existsSync6 } from "fs";
 import { Command, Option as Option4 } from "commander";
 
 // src/commands/account/commands.ts
-init_base_url();
-init_login();
 import { Option } from "commander";
 
-// src/commands/auth/profile.ts
-import { existsSync, rmSync } from "fs";
+// src/commands/auth/accounts.ts
+import { rmSync } from "fs";
 
 // src/lib/api/context.ts
 init_client();
@@ -29932,10 +29928,102 @@ function createContextApiClient(context) {
   });
 }
 
-// src/commands/auth/profile.ts
+// src/commands/auth/accounts.ts
+init_accounts();
 init_file();
-init_path();
-init_profiles();
+
+// src/lib/stdio/select.ts
+async function selectFromList(context, input) {
+  if (input.items.length === 0) {
+    throw new Error("No options available.");
+  }
+  if (!context.io.canPrompt()) {
+    throw new Error("Cannot prompt in a non-interactive terminal.");
+  }
+  const stdin = context.stdin;
+  const stdout = context.stdout;
+  let selected = clamp(input.initialIndex ?? 0, input.items.length);
+  let renderedLines = 0;
+  let rawModeWasEnabled = Boolean(stdin.isRaw);
+  return await new Promise((resolve4, reject) => {
+    let settled = false;
+    const settle = (callback) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      callback();
+    };
+    const render2 = () => {
+      clearRendered(stdout, renderedLines);
+      const lines = [
+        input.title,
+        "",
+        ...input.items.map(
+          (item, index) => input.renderItem(item, index === selected)
+        ),
+        "",
+        "up/down navigate  enter select  esc cancel"
+      ];
+      renderedLines = lines.length;
+      stdout.write(`${lines.join("\n")}
+`);
+    };
+    const onData = (chunk) => {
+      const key = chunk.toString("utf8");
+      if (key === "") {
+        settle(() => reject(new Error("Cancelled.")));
+        return;
+      }
+      if (key === "\x1B") {
+        settle(() => reject(new Error("Cancelled.")));
+        return;
+      }
+      if (key === "\r" || key === "\n") {
+        settle(() => resolve4(input.items[selected]));
+        return;
+      }
+      if (key === "\x1B[A" || key === "k") {
+        selected = selected === 0 ? input.items.length - 1 : selected - 1;
+        render2();
+        return;
+      }
+      if (key === "\x1B[B" || key === "j") {
+        selected = selected === input.items.length - 1 ? 0 : selected + 1;
+        render2();
+      }
+    };
+    const cleanup = () => {
+      stdin.off?.("data", onData);
+      clearRendered(stdout, renderedLines);
+      renderedLines = 0;
+      stdout.write("\x1B[?25h");
+      if (stdin.setRawMode) {
+        stdin.setRawMode(rawModeWasEnabled);
+      }
+      stdin.pause?.();
+    };
+    try {
+      rawModeWasEnabled = Boolean(stdin.isRaw);
+      stdin.setEncoding?.("utf8");
+      stdin.setRawMode?.(true);
+      stdin.resume?.();
+      stdout.write("\x1B[?25l");
+      stdin.on("data", onData);
+      render2();
+    } catch (error51) {
+      settle(() => reject(error51));
+    }
+  });
+}
+function clamp(value, length) {
+  return Math.min(Math.max(0, value), length - 1);
+}
+function clearRendered(stdout, lines) {
+  if (lines === 0) return;
+  stdout.write(`\x1B[${lines}A\x1B[J`);
+}
+
+// src/commands/auth/accounts.ts
 async function handleAuthStatus(context) {
   const result = await fetchAuthStatus(context);
   context.io.writeResult(result, formatAuthStatusText);
@@ -29946,7 +30034,7 @@ async function handleWhoami(context) {
   context.io.writeResult(whoami, formatWhoamiText);
 }
 function logout(context) {
-  if (currentProfileName(context.configPath) !== void 0) {
+  if (activeAccountKey(context.configPath) !== void 0) {
     const config2 = readConfig(context.configPath);
     writeConfig(
       {
@@ -29962,62 +30050,103 @@ function logout(context) {
   }
   context.writeOutput(context.io.style.success("Logged out."));
 }
-function listAccounts(context) {
-  const profiles = listProfiles(context.configPath);
-  if (profiles.length === 0) {
+function listAccounts2(context) {
+  const accounts = listAccounts(context.configPath);
+  if (accounts.length === 0) {
     throw new Error("No stored accounts. Session `auto auth login` first.");
   }
-  for (const profile of profiles) {
+  for (const account of accounts) {
     context.writeOutput(
       accountLine(
-        profile,
-        currentProfileName(context.configPath),
+        account,
+        activeAccountKey(context.configPath),
         context.io.style
       )
     );
   }
 }
-function switchAccount(context, accountRef, options = {}) {
+async function switchAccount(context, input = {}) {
+  const accountRef = input.user ?? input.accountRef;
+  if (input.user && input.accountRef) {
+    throw new Error("Choose either an account argument or --user, not both.");
+  }
   if (!accountRef) {
-    listAccounts(context);
+    await switchAccountInteractive(context);
     return;
   }
-  if (context.pinnedProfile) {
-    throw new Error(
-      "Cannot switch the active account while pinned to a profile via --profile or AUTO_PROFILE."
-    );
+  useAccount(
+    context,
+    resolveAccountByEmail(context, accountRef, {
+      server: input.server,
+      preferActiveServer: true,
+      command: "switch"
+    })
+  );
+}
+function removeAccount(context, input) {
+  const account = resolveAccountByEmail(context, input.accountRef, {
+    server: input.server,
+    preferActiveServer: false,
+    command: "remove"
+  });
+  if (activeAccountKey(context.configPath) === account.key) {
+    clearActiveAccount(context.configPath);
   }
-  const profiles = listProfiles(context.configPath);
-  if (profiles.length === 0) {
+  rmSync(account.path);
+  context.writeOutput(
+    context.io.style.success(
+      `Removed account ${account.config.userEmail} (${account.config.serverUrl}).`
+    )
+  );
+}
+function accountLine(account, activeKey, style) {
+  return [
+    account.config.userEmail,
+    style.dim(`server=${account.config.serverUrl ?? "(unset)"}`),
+    account.config.refreshToken ? void 0 : style.warn("logged_out"),
+    account.key === activeKey ? style.success("(active)") : void 0
+  ].filter(Boolean).join(" ");
+}
+async function switchAccountInteractive(context) {
+  const accounts = listAccounts(context.configPath);
+  if (accounts.length === 0) {
     throw new Error("No stored accounts. Session `auto auth login` first.");
   }
-  const byName = profiles.find((profile) => profile.name === accountRef);
-  const matches = byName ? [byName] : profiles.filter(
-    (profile) => profile.config.userEmail?.toLowerCase() === accountRef.toLowerCase() && (!options.server || profile.config.serverUrl === options.server)
-  );
-  if (matches.length === 0) {
+  if (!context.io.canPrompt()) {
     throw new Error(
-      `No stored account for ${accountRef}. Session \`auto auth login\` to add it.`
+      "Cannot prompt for an account in a non-interactive terminal. Rerun with `auto auth switch --user <email>`."
     );
   }
-  const active = readConfig(context.configPath);
-  const match = matches.length === 1 ? matches[0] : matches.find(
-    (profile) => profile.config.serverUrl === active.serverUrl
+  const activeKey = activeAccountKey(context.configPath);
+  const initialIndex = Math.max(
+    0,
+    accounts.findIndex((account) => account.key === activeKey)
   );
-  if (!match) {
-    throw new Error(
-      `Multiple servers have a stored account for ${accountRef}: ${matches.map((profile) => profile.config.serverUrl).join(
-        ", "
-      )}. Pick one with \`auto auth switch ${accountRef} --server <url>\`.`
-    );
-  }
-  setCurrentProfile(match.name, context.configPath);
+  const selected = await selectFromList(context, {
+    title: "Select account",
+    items: accounts,
+    initialIndex,
+    renderItem: (account, selected2) => interactiveAccountLine(account, activeKey, selected2, context.io.style)
+  });
+  useAccount(context, selected);
+}
+function interactiveAccountLine(account, activeKey, selected, style) {
+  return [
+    selected ? ">" : " ",
+    account.config.userEmail,
+    style.dim(account.config.serverUrl ?? "(unset)"),
+    account.config.refreshToken ? void 0 : style.warn("logged_out"),
+    account.key === activeKey ? style.success("active") : void 0
+  ].filter(Boolean).join(" ");
+}
+function useAccount(context, account) {
+  setActiveAccount(account.key, context.configPath);
   context.writeOutput(
     context.io.style.success(
-      `Switched to ${match.config.userEmail} (${match.config.serverUrl}).`
+      `Switched to ${account.config.userEmail} (${account.config.serverUrl}).`
     )
   );
-  if (!match.config.refreshToken) {
+  if (!account.config.refreshToken) {
     context.writeOutput(
       context.io.style.warn(
         "This account has no stored credentials; run `auto auth login`."
@@ -30025,35 +30154,32 @@ function switchAccount(context, accountRef, options = {}) {
     );
   }
 }
-function removeProfile(context, name) {
-  assertValidProfileName(name);
-  if (context.pinnedProfile === name) {
-    throw new Error(`Cannot remove profile "${name}" while pinned to it.`);
+function resolveAccountByEmail(context, accountRef, options) {
+  const accounts = listAccounts(context.configPath);
+  if (accounts.length === 0) {
+    throw new Error("No stored accounts. Session `auto auth login` first.");
   }
-  const configPath = context.configPath ?? defaultConfigPath();
-  const path2 = profileFilePath(configPath, name);
-  if (!existsSync(path2)) {
-    const names = listProfiles(context.configPath).map(
-      (profile) => profile.name
-    );
+  const matches = accounts.filter(
+    (account) => account.config.userEmail?.toLowerCase() === accountRef.toLowerCase() && (!options.server || account.config.serverUrl === options.server)
+  );
+  if (matches.length === 0) {
     throw new Error(
-      `No stored profile "${name}". Stored profiles: ${names.join(", ") || "(none)"}.`
+      `No stored account for ${accountRef}. Session \`auto auth login\` to add it.`
     );
   }
-  if (currentProfileName(context.configPath) === name) {
-    clearCurrentProfile(context.configPath);
+  if (matches.length === 1) return matches[0];
+  if (options.preferActiveServer) {
+    const active = readConfig(context.configPath);
+    const activeServerMatch = matches.find(
+      (account) => account.config.serverUrl === active.serverUrl
+    );
+    if (activeServerMatch) return activeServerMatch;
   }
-  rmSync(path2);
-  context.writeOutput(context.io.style.success(`Removed profile "${name}".`));
-}
-function accountLine(profile, activeName, style) {
-  return [
-    profile.name,
-    profile.config.userEmail,
-    style.dim(`server=${profile.config.serverUrl ?? "(unset)"}`),
-    profile.config.refreshToken ? void 0 : style.warn("logged_out"),
-    profile.name === activeName ? style.success("(active)") : void 0
-  ].filter(Boolean).join(" ");
+  throw new Error(
+    `Multiple servers have a stored account for ${accountRef}: ${matches.map((account) => account.config.serverUrl).join(
+      ", "
+    )}. Pick one with \`auto auth ${options.command} ${accountRef} --server <url>\`.`
+  );
 }
 async function fetchAuthStatus(context) {
   const config2 = readConfig(context.configPath);
@@ -30382,7 +30508,7 @@ async function authorizeSensitiveActionDevice(input) {
   let firstAttempt = true;
   while (Date.now() < deadline) {
     if (!firstAttempt) {
-      await sleep2(Math.max(0, device.interval) * 1e3);
+      await sleep(Math.max(0, device.interval) * 1e3);
     }
     firstAttempt = false;
     try {
@@ -30407,39 +30533,26 @@ async function requireYes(rl, prompt) {
     throw new Error("Account deletion cancelled.");
   }
 }
-async function sleep2(ms) {
+async function sleep(ms) {
   await new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 
 // src/commands/account/commands.ts
 function registerAccountCommands(program, context) {
-  const account = program.command("account").description("Manage stored account profiles.");
-  account.command("list").description("List stored account profiles.").action(() => listAccounts(context));
-  account.command("create").description("Log in and store the account under a profile name.").argument("<name>", "Profile name for the new account").option("--api-url <url>", "Auto web server URL").option("--device", "Use device authorization flow").option("--code <code>", "Exchange an existing authorization code").option("--verifier <verifier>", "PKCE verifier for --code").action(
-    async (name, options) => {
-      const globalOptions = program.opts();
-      await login({
-        options: {
-          ...options,
-          profile: name,
-          apiUrl: resolveApiBaseUrl({
-            explicit: [options.apiUrl, globalOptions.apiUrl],
-            env: context.env
-          })
-        },
-        env: context.env,
-        fetch: context.fetch,
-        configPath: context.configPath,
-        writeOutput: context.writeOutput,
-        writeError: context.writeError,
-        style: context.io.style
-      });
-    }
+  const account = program.command("account").description("Manage the signed-in Auto account.");
+  account.command("list", { hidden: true }).description("Deprecated alias for `auth list`.").action(() => listAccounts2(context));
+  account.command("switch", { hidden: true }).description("Deprecated alias for `auth switch`.").argument("<account>", "Email address of the stored account").option("--server <url>", "Auto web server URL of the stored account").action(
+    async (accountRef, options) => await switchAccount(context, {
+      accountRef,
+      server: options.server
+    })
   );
-  account.command("switch").description("Switch the active account to a stored profile.").argument("<account>", "Profile name or email of a stored account").option("--server <url>", "Auto web server URL of the stored account").action(
-    (accountRef, options) => switchAccount(context, accountRef, options)
+  account.command("remove", { hidden: true }).description("Deprecated alias for `auth remove`.").argument("<account>", "Email address of the stored account").option("--server <url>", "Auto web server URL of the stored account").action(
+    (accountRef, options) => removeAccount(context, {
+      accountRef,
+      server: options.server
+    })
   );
-  account.command("remove").description("Remove a stored account profile.").argument("<name>", "Profile name to remove").action((name) => removeProfile(context, name));
   account.command("delete").description("Permanently delete the signed-in Auto account.").option("--api-url <url>", "Auto web server URL").option(
     "--delete-admin-orgs",
     "delete organizations where this account is an admin"
@@ -30872,7 +30985,7 @@ import {
   createCipheriv,
   createDecipheriv,
   hkdfSync,
-  randomBytes as randomBytes2
+  randomBytes
 } from "crypto";
 var BOOTSTRAP_CRYPTO_INFO = "auto-agent-bridge-bootstrap/v1";
 var BOOTSTRAP_KEY_LENGTH = 32;
@@ -31397,14 +31510,14 @@ function partialTextDeltaPayload(message, messageId) {
 }
 
 // src/commands/agent-bridge/harness/claude-code/resume-store.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname3 } from "path";
 var AGENT_BRIDGE_RUNTIME_DIR = "/tmp/auto-bridge-runtime";
 var CLAUDE_SESSION_RESUME_PATH = `${AGENT_BRIDGE_RUNTIME_DIR}/claude-session-id`;
 function fileClaudeSessionResumeStore(path2 = CLAUDE_SESSION_RESUME_PATH) {
   return {
     read(sessionId) {
-      if (!existsSync2(path2)) {
+      if (!existsSync(path2)) {
         return null;
       }
       const record2 = parseResumeRecord(readFileSync2(path2, "utf8"));
@@ -32482,7 +32595,7 @@ function statusAgents(input) {
 // src/commands/agents/connect.ts
 init_resources2();
 init_browser();
-import { existsSync as existsSync3, mkdtempSync, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync2, mkdtempSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3, tmpdir } from "os";
 import { join as join4 } from "path";
 
@@ -32688,7 +32801,7 @@ async function stageAvatarImage(input) {
     const contentType = response.headers.get("content-type") ?? "";
     const extension = contentType.includes("jpeg") ? ".jpg" : ".png";
     const downloads = join4(homedir3(), "Downloads");
-    const directory = existsSync3(downloads) ? downloads : mkdtempSync(join4(tmpdir(), "auto-avatar-"));
+    const directory = existsSync2(downloads) ? downloads : mkdtempSync(join4(tmpdir(), "auto-avatar-"));
     const path2 = join4(directory, `${input.agent}-avatar${extension}`);
     writeFileSync3(path2, Buffer.from(await response.arrayBuffer()));
     return path2;
@@ -32940,7 +33053,6 @@ function registerAuthCommands(program, context) {
     await login({
       options: {
         ...options,
-        profile: globalOptions.profile,
         apiUrl: resolveApiBaseUrl({
           explicit: [options.apiUrl, globalOptions.apiUrl],
           env: context.env
@@ -32955,7 +33067,7 @@ function registerAuthCommands(program, context) {
     });
   });
   auth.command("status").description(
-    "Show current auth profile and validate the token against the server."
+    "Show current authentication state and validate the token against the server."
   ).action(async () => {
     await handleAuthStatus(context);
   });
@@ -32963,13 +33075,21 @@ function registerAuthCommands(program, context) {
     await handleWhoami(context);
   });
   auth.command("logout").description("Remove the local user refresh token.").action(() => logout(context));
-  auth.command("list").description("List stored account profiles.").action(() => listAccounts(context));
+  auth.command("list").description("List stored accounts.").action(() => listAccounts2(context));
   auth.command("switch").description(
-    "Switch the active account to a stored profile, or list stored accounts."
-  ).argument("[account]", "Profile name or email of a stored account").option("--server <url>", "Auto web server URL of the stored account").action(
-    (account, options) => switchAccount(context, account, options)
+    "Switch the active account, prompting interactively when no account is provided."
+  ).argument("[account]", "Email address of a stored account").option("--user <email>", "Email address of the stored account").option("--server <url>", "Auto web server URL of the stored account").action(
+    async (account, options) => {
+      await switchAccount(context, {
+        accountRef: account,
+        user: options.user,
+        server: options.server
+      });
+    }
+  );
+  auth.command("remove").description("Remove a stored account.").argument("<account>", "Email address of the stored account").option("--server <url>", "Auto web server URL of the stored account").action(
+    (account, options) => removeAccount(context, { accountRef: account, server: options.server })
   );
-  auth.command("remove").description("Remove a stored account profile.").argument("<name>", "Profile name to remove").action((name) => removeProfile(context, name));
 }
 
 // src/lib/stdio/confirm.ts
@@ -36637,10 +36757,6 @@ function registerSyncCommands(program, context) {
   });
 }
 
-// src/cli/program.ts
-init_path();
-init_profiles();
-
 // src/lib/output/iostreams.ts
 init_style();
 function createIOStreams(flags) {
@@ -36734,12 +36850,9 @@ function createProgram(options = {}) {
       "stream-json",
       "tui"
     ])
-  ).option("--no-color", "disable color output").option("--api-url <url>", "override API base URL").option(
-    "--profile <name>",
-    "use this stored profile for the invocation (or set AUTO_PROFILE); for `auth login`, the profile name to store the login under"
-  );
+  ).option("--no-color", "disable color output").option("--api-url <url>", "override API base URL");
   program.configureHelp({ showGlobalOptions: true });
-  program.hook("preAction", (_thisCommand, actionCommand) => {
+  program.hook("preAction", () => {
     if (!options.io) {
       const g = program.opts();
       context.io = createIOStreams({
@@ -36749,22 +36862,6 @@ function createProgram(options = {}) {
         writeError: options.writeError
       });
     }
-    const isLoginLike = actionCommand.name() === "login" && actionCommand.parent?.name() === "auth" || actionCommand.name() === "create" && actionCommand.parent?.name() === "account";
-    const flagPin = isLoginLike ? void 0 : program.opts().profile;
-    const pin = flagPin ?? context.env.AUTO_PROFILE;
-    if (pin && context.pinnedProfile !== pin) {
-      assertValidProfileName(pin);
-      const base = options.configPath ?? defaultConfigPath();
-      const pinnedPath = profileFilePath(base, pin);
-      if (!existsSync6(pinnedPath)) {
-        const names = listProfiles(base).map((profile) => profile.name);
-        throw new Error(
-          `No stored profile "${pin}". Stored profiles: ${names.join(", ") || "(none)"}.`
-        );
-      }
-      context.configPath = pinnedPath;
-      context.pinnedProfile = pin;
-    }
   });
   const launchTui = async () => {
     const g = program.opts();