@hs-x/cli 0.1.2 → 0.2.0

package/dist/commands/login.js

@@ -1,421 +1,227 @@
-import { defaultStorePath, setUserSession, } from '../account-store.js';
 import * as Command from '@effect/cli/Command';
 import * as Options from '@effect/cli/Options';
-import { HttpClientRequest, Schema, schemas } from '@hs-x/types';
-import { Effect, Option } from 'effect';
-import { exitWith } from '../cli-error.js';
-import { jsonOption, controlPlaneUrlOption, cwdOption, runHandler, runQuarantined, } from '../cli/kit.js';
-import { DEFAULT_CONTROL_PLANE_URL, resolveControlPlaneUrl } from '../config.js';
-import { executeCliHttp } from '../effect-http.js';
-import { emitHelp } from '../help.js';
+import { HttpClientRequest } from '@hs-x/types';
+import { Clock, Effect, Option } from 'effect';
+import { cliError, exitWith } from '../cli-error.js';
+import { controlPlaneUrlOption, jsonOption, runHandler } from '../cli/kit.js';
+import { isCustomControlPlane, resolveControlPlaneUrl } from '../config.js';
 import { openInBrowser } from '../hubspot-auth.js';
-import { getMachineId } from '../machine-id.js';
-import { promptText } from '../prompt.js';
-import { createReporter } from '../reporter/index.js';
+import { isInteractive, promptSelect, promptText } from '../prompt.js';
 import { AccountStore } from '../services/account-store.js';
 import { CliHttp } from '../services/http.js';
 import { Reporter } from '../services/reporter.js';
-import os from 'node:os';
-const SESSION_COOKIE_NAME = '__Secure-hsx_session';
+// Local heuristic only — the control plane enforces real token expiry; this
+// gates whether the CLI bothers sending a likely-dead token.
 const THIRTY_DAYS_MS = 30 * 24 * 3_600_000;
-export async function loginCommand(input) {
-    const argv = input.argv;
-    const sub = argv[0];
-    const json = argv.includes('--json');
-    if (sub === 'help' || sub === '--help' || sub === '-h') {
-        emitHelp(loginHelpText(), json);
-        return { exitCode: 0 };
-    }
-    // Default is the device-authorization flow; magic-link is the browserless /
-    // CI fallback kept behind --magic-link.
-    if (argv.includes('--magic-link')) {
-        return magicLinkLogin(input);
-    }
-    return deviceFlowLogin(input);
+/** Dashboard page where users generate a CLI API token to paste. */
+function tokenPageUrl() {
+    const base = process.env.HSX_DASHBOARD_URL ?? 'https://app.hs-x.dev';
+    return new URL('/settings/tokens', base).toString();
+}
+function authErr(message) {
+    return cliError('HSX_E_API_UNAUTHORIZED', message);
 }
 /* -------------------------------------------------------------------------- */
-/* Device-authorization flow (default)                                        */
+/* hs-x login — paste a per-account API token (HubSpot `hs`-style)            */
 /* -------------------------------------------------------------------------- */
-async function deviceFlowLogin(input) {
-    const argv = input.argv;
-    const json = argv.includes('--json');
-    const reporter = createReporter({ command: 'login', argv, entry: true });
-    if (!json)
-        reporter.banner();
-    const controlPlaneUrl = resolveControlPlaneUrl(argv);
-    if (!json)
-        reporter.header(`device login → ${controlPlaneUrl}`);
-    const machineId = await getMachineId();
-    const deviceName = os.hostname() || 'unknown-device';
-    const cwd = input.cwd ?? process.cwd();
-    // Step 1: create the pairing (unauthenticated — the CLI has no session yet).
-    let created;
-    try {
-        const payload = Schema.decodeUnknownSync(schemas.CliLoginPairingCreateRequest)({
-            machineId,
-            deviceName,
-            cwd,
+/**
+ * Authenticate an HS-X account by pasting an API token generated in the HS-X
+ * dashboard. The token authenticates a *user*, but is stored against one
+ * *HS-X account* (a person may have several user accounts, and each HS-X
+ * account carries its own token — like HubSpot's per-account personal access
+ * keys). The active account's token is what every control-plane call uses.
+ */
+function loginBody(opts) {
+    return Effect.gen(function* () {
+        const accounts = yield* AccountStore;
+        const http = yield* CliHttp;
+        const reporter = yield* Reporter;
+        const json = opts.json;
+        const interactive = !json && isInteractive();
+        const controlPlaneUrl = Option.match(opts.controlPlaneUrl, {
+            onNone: () => resolveControlPlaneUrl([]),
+            onSome: (value) => resolveControlPlaneUrl(['--control-plane-url', value]),
         });
-        const response = await executeCliHttp(HttpClientRequest.post(new URL('/v1/cli/login/pairings', controlPlaneUrl)).pipe(HttpClientRequest.bodyText(JSON.stringify(payload), 'application/json')));
-        if (!response.ok) {
-            const body = await response.text().catch(() => '');
-            reporter.error('HSX_E_API_UNEXPECTED', `Control plane refused to start a login pairing (${response.status}).`, { hint: body.slice(0, 200) || 'Check your network and try again.' });
-            reporter.done(undefined, 1);
-            return { exitCode: 1 };
+        if (!json)
+            yield* reporter.header(isCustomControlPlane(controlPlaneUrl) ? `login → ${controlPlaneUrl}` : 'login');
+        // 1. Obtain the token: flag, env, or interactive paste after opening the
+        //    dashboard token page.
+        let token = Option.getOrUndefined(opts.token)?.trim() || process.env.HSX_API_TOKEN?.trim() || undefined;
+        if (!token) {
+            if (!interactive) {
+                yield* reporter.error('HSX_E_INPUT_MISSING_VALUE', 'No API token provided.', {
+                    hint: 'Generate one in the HS-X dashboard, then pass --token <token> or set HSX_API_TOKEN.',
+                });
+                yield* reporter.done(undefined, 10);
+                return yield* Effect.fail(exitWith(10, 'HSX_E_INPUT_MISSING_VALUE'));
+            }
+            const page = tokenPageUrl();
+            yield* reporter.info(`Opening ${page}`);
+            yield* reporter.info('Generate a CLI token there, then paste it here.');
+            yield* Effect.promise(() => openInBrowser(page));
+            const pasted = yield* Effect.promise(() => promptText({
+                message: 'Paste your HS-X API token',
+                validate: (v) => (v.trim().length >= 10 ? undefined : 'That token looks too short.'),
+            }));
+            if (pasted === undefined) {
+                yield* reporter.info('Cancelled.');
+                return yield* Effect.fail(exitWith(130));
+            }
+            token = pasted.trim();
         }
-        created = Schema.decodeUnknownSync(schemas.CliLoginPairingCreateResponse)(await response.json());
-    }
-    catch (error) {
-        reporter.error('HSX_E_API_UNEXPECTED', 'Could not start a login pairing.', {
-            hint: error instanceof Error ? error.message : String(error),
-        });
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    // Step 2/3: show the code and open the dashboard approval page. The
-    // pairingId is not a secret — the dashboard needs it to call /approve.
-    const authorizeUrl = cliAuthorizeUrl(created.userCode, created.pairingId);
-    if (json) {
-        process.stdout.write(`${JSON.stringify({
-            ok: true,
-            command: 'login',
-            mode: 'device',
-            status: 'pending',
-            userCode: created.userCode,
-            pairingId: created.pairingId,
-            verificationUri: authorizeUrl,
-        })}\n`);
-    }
-    else {
-        reporter.block([
-            `Code      ${created.userCode}`,
-            `Approve   ${authorizeUrl}`,
-            `Device    ${deviceName}`,
-        ].join('\n'));
-        await openInBrowser(authorizeUrl);
-        reporter.info('Waiting for approval in your browser…');
-    }
-    // Step 4: poll until approved / expired / timeout. The deviceCode is the
-    // poll bearer; it is held only by this CLI process.
-    let result;
-    try {
-        result = await pollCliLoginPairing({
-            controlPlaneUrl,
-            pairingId: created.pairingId,
-            deviceCode: created.deviceCode,
-            intervalSeconds: created.interval,
-            expiresInSeconds: created.expiresIn,
-        });
-    }
-    catch (error) {
-        reporter.error('HSX_E_API_UNEXPECTED', 'Login polling failed.', {
-            hint: error instanceof Error ? error.message : String(error),
-        });
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    if (result.status === 'expired') {
-        reporter.error('HSX_E_API_UNAUTHORIZED', 'Login request expired before approval.', {
-            hint: 'Re-run `hs-x login` and approve the code in the dashboard within the time limit.',
-        });
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    if (result.status !== 'approved' || !result.token) {
-        reporter.error('HSX_E_API_UNEXPECTED', 'Login was not approved in time.', {
-            hint: `Open ${authorizeUrl} to approve, then re-run \`hs-x login\`.`,
+        // 2. Validate the token and learn who it belongs to.
+        const me = yield* validateToken(http, controlPlaneUrl, token).pipe(Effect.catchAll((error) => Effect.gen(function* () {
+            yield* reporter.error('HSX_E_API_UNAUTHORIZED', 'Token rejected by the control plane.', {
+                hint: error.message,
+            });
+            yield* reporter.done(undefined, 10);
+            return yield* Effect.fail(exitWith(10, 'HSX_E_API_UNAUTHORIZED'));
+        })));
+        // 3. Resolve which HS-X account to bind the token to.
+        const list = yield* listUserAccounts(http, controlPlaneUrl, token);
+        const target = yield* resolveTargetAccount({
+            flagAccount: Option.getOrUndefined(opts.account)?.trim(),
+            list,
+            interactive,
+        }).pipe(Effect.catchAll((error) => Effect.gen(function* () {
+            // A silent error is the prompt-cancel signal — propagate without re-rendering.
+            if (error.silent)
+                return yield* Effect.fail(error);
+            yield* reporter.error('HSX_E_INPUT_BAD_FIELD', error.message, {
+                hint: 'Create an HS-X account in the dashboard, or pass --account <id>.',
+            });
+            yield* reporter.done(undefined, 10);
+            return yield* Effect.fail(exitWith(10, 'HSX_E_INPUT_BAD_FIELD'));
+        })));
+        // 4. Persist the token against that account and make it active.
+        const nowMs = yield* Clock.currentTimeMillis;
+        const session = {
+            sessionToken: token,
+            expiresAt: new Date(nowMs + THIRTY_DAYS_MS).toISOString(),
+            email: me.email,
+            userId: me.id,
+            accountId: target.accountId,
+        };
+        yield* accounts.setAccountSession(target.accountId, session, {
+            ...(target.displayName ? { displayName: target.displayName } : {}),
+            makeDefault: true,
         });
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    // Step 5: persist the PAT as the bearer session.
-    const session = {
-        sessionToken: result.token,
-        expiresAt: result.expiresAt ?? new Date(Date.now() + THIRTY_DAYS_MS).toISOString(),
-        email: result.email ?? '',
-        userId: result.userId ?? '',
-        ...(result.accountId ? { accountId: result.accountId } : {}),
-    };
-    await setUserSession(session, defaultStorePath());
-    if (json) {
-        process.stdout.write(`${JSON.stringify({
-            ok: true,
-            command: 'login',
-            mode: 'device',
-            status: 'approved',
-            userId: session.userId,
-            email: session.email,
-            ...(session.accountId ? { accountId: session.accountId } : {}),
-        })}\n`);
-    }
-    else {
-        const who = session.email || session.userId || 'your account';
-        reporter.block(`Session stored in ${defaultStorePath()} · \`hs-x logout\` to revoke`);
-        reporter.done(`Logged in as ${who}${session.accountId ? ` (account ${session.accountId})` : ''}`, 0);
-    }
-    return { exitCode: 0 };
-}
-async function pollCliLoginPairing(input) {
-    const intervalMs = Math.max(1, input.intervalSeconds) * 1000;
-    const deadline = Date.now() + Math.max(1, input.expiresInSeconds) * 1000;
-    const url = new URL(`/v1/cli/login/pairings/${encodeURIComponent(input.pairingId)}`, input.controlPlaneUrl);
-    let last = { status: 'pending' };
-    while (Date.now() < deadline) {
-        const response = await executeCliHttp(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeader('authorization', `Bearer ${input.deviceCode}`)));
-        if (response.ok) {
-            last = Schema.decodeUnknownSync(schemas.CliLoginPairingReadResponse)(await response.json());
-            if (last.status === 'approved' && last.token)
-                return last;
-            if (last.status === 'expired')
-                return last;
+        if (json) {
+            yield* reporter.raw(`${JSON.stringify({
+                ok: true,
+                command: 'login',
+                status: 'approved',
+                userId: me.id,
+                email: me.email,
+                accountId: target.accountId,
+            })}\n`);
         }
-        else if (response.status === 404) {
-            throw new Error('Login pairing not found (it may have expired or been revoked).');
+        else {
+            const label = target.displayName
+                ? `${target.displayName} (${target.accountId})`
+                : target.accountId;
+            yield* reporter.block('Token stored · `hs-x logout` to revoke');
+            yield* reporter.done(`Logged in as ${me.email || me.id} → ${label}`, 0);
         }
-        await new Promise((resolve) => setTimeout(resolve, intervalMs));
-    }
-    return last;
-}
-function cliAuthorizeUrl(userCode, pairingId) {
-    const base = process.env.HSX_DASHBOARD_URL ?? 'https://app.hs-x.dev';
-    const url = new URL('/cli/authorize', base);
-    url.searchParams.set('code', userCode);
-    url.searchParams.set('pairing', pairingId);
-    return url.toString();
+    });
 }
-/* -------------------------------------------------------------------------- */
-/* Magic-link flow (--magic-link fallback)                                    */
-/* -------------------------------------------------------------------------- */
-async function magicLinkLogin(input) {
-    const argv = input.argv;
-    const json = argv.includes('--json');
-    const reporter = createReporter({ command: 'login', argv, entry: true });
-    if (!json)
-        reporter.banner();
-    const controlPlaneUrl = resolveControlPlaneUrl(argv);
-    reporter.header(`magic-link → ${controlPlaneUrl}`);
-    const email = resolveFlag(argv, '--email') ??
-        process.env.HSX_LOGIN_EMAIL ??
-        (await promptText({
-            message: 'Email address',
-            validate: (value) => /.+@.+\..+/.test(value) ? undefined : 'Enter a valid email address.',
-        }));
-    if (!email || email.length === 0) {
-        reporter.error('HSX_E_INPUT_MISSING_VALUE', 'Email is required for login.', {
-            hint: 'Re-run with --email <you@example.com> or HSX_LOGIN_EMAIL=...',
-            docs_url: 'https://hs-x.dev/errors/HSX_E_INPUT_MISSING_VALUE',
+/** GET /v1/sessions/me with the token as a bearer; returns the user or fails. */
+function validateToken(http, controlPlaneUrl, token) {
+    return Effect.gen(function* () {
+        const response = yield* http.execute(HttpClientRequest.get(new URL('/v1/sessions/me', controlPlaneUrl)).pipe(HttpClientRequest.setHeader('authorization', `Bearer ${token}`)));
+        if (!response.ok) {
+            return yield* Effect.fail(authErr(`Validation returned ${response.status}. Generate a fresh token and retry.`));
+        }
+        const body = yield* Effect.tryPromise({
+            try: () => response.json(),
+            catch: () => authErr('Could not parse the validation response.'),
         });
-        reporter.done(undefined, 10);
-        return { exitCode: 10 };
-    }
-    // Step 1: ask the control plane to mint and email a magic link.
-    const start = await executeCliHttp(HttpClientRequest.post(new URL('/v1/auth/magic-link/start', controlPlaneUrl)).pipe(HttpClientRequest.bodyText(JSON.stringify({ email, redirectTo: '/' }), 'application/json')));
-    if (!start.ok) {
-        const body = await start.text();
-        reporter.error('HSX_E_API_UNEXPECTED', `Control plane refused to send a magic link (${start.status}).`, { hint: body.slice(0, 200) || 'Check your network and try again.' });
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    reporter.info(`Magic link sent to ${email}. Check your inbox.`);
-    // Step 2: ask the user to paste the link from their email. The email links to
-    // the dashboard callback (`/auth/callback?token=…`), so accept any URL that
-    // carries a `token` param — we only need the token, and we re-derive the
-    // control-plane consume URL ourselves below.
-    const linkUrl = await promptText({
-        message: 'Paste the magic link URL from the email',
-        validate: (value) => {
-            try {
-                return new URL(value.trim()).searchParams.get('token')
-                    ? undefined
-                    : 'That URL has no ?token=… parameter. Paste the full link from the email.';
-            }
-            catch {
-                return 'Enter the full URL from the email (it should start with https://).';
-            }
-        },
+        const id = typeof body.user?.id === 'string' ? body.user.id : undefined;
+        const email = typeof body.user?.email === 'string' ? body.user.email : '';
+        if (!id)
+            return yield* Effect.fail(authErr('Validation response had no user id.'));
+        return { id, email };
     });
-    if (!linkUrl) {
-        reporter.error('HSX_E_INPUT_MISSING_VALUE', 'No magic-link URL provided.', {
-            hint: 'Click the link in your email and paste the URL, or re-run `hs-x login`.',
-        });
-        reporter.done(undefined, 10);
-        return { exitCode: 10 };
-    }
-    let consumeUrl;
-    try {
-        consumeUrl = new URL(linkUrl);
-    }
-    catch {
-        reporter.error('HSX_E_INPUT_BAD_FIELD', 'Pasted value is not a valid URL.', {});
-        reporter.done(undefined, 10);
-        return { exitCode: 10 };
-    }
-    const token = consumeUrl.searchParams.get('token');
-    if (!token) {
-        reporter.error('HSX_E_INPUT_BAD_FIELD', 'Pasted URL has no `token` query param.', {});
-        reporter.done(undefined, 10);
-        return { exitCode: 10 };
-    }
-    // Step 3: consume the token ourselves. The CP responds 302 + Set-Cookie;
-    // we intercept (manual redirect) and parse the cookie value, which is the
-    // bearer the runtime auth.ts validates via `getWebSessionByToken`.
-    const consume = await executeCliHttp(HttpClientRequest.get(new URL(`/v1/auth/magic-link/consume?token=${encodeURIComponent(token)}`, controlPlaneUrl)), { redirect: 'manual' });
-    if (consume.status !== 302) {
-        const body = await consume.text();
-        reporter.error('HSX_E_API_UNEXPECTED', `Magic-link consume failed (${consume.status}).`, { hint: body.slice(0, 200) });
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    const setCookie = consume.headers.get('set-cookie');
-    if (!setCookie) {
-        reporter.error('HSX_E_API_UNEXPECTED', 'Magic-link consume did not set a session cookie.', {});
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    const sessionToken = extractCookieValue(setCookie, SESSION_COOKIE_NAME);
-    if (!sessionToken) {
-        reporter.error('HSX_E_API_UNEXPECTED', `Magic-link consume Set-Cookie did not contain ${SESSION_COOKIE_NAME}.`, { hint: 'Server may be misconfigured; try again or contact support.' });
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    const expiresAt = extractCookieExpires(setCookie) ?? new Date(Date.now() + THIRTY_DAYS_MS).toISOString();
-    // Step 4: confirm with /v1/sessions/me so we know who we are.
-    const me = await executeCliHttp(HttpClientRequest.get(new URL('/v1/sessions/me', controlPlaneUrl)).pipe(HttpClientRequest.setHeader('authorization', `Bearer ${sessionToken}`)));
-    if (!me.ok) {
-        reporter.error('HSX_E_API_UNAUTHORIZED', `Session token works for the cookie path but Bearer auth failed (${me.status}).`, { hint: 'The control-plane worker may not yet accept Bearer tokens on /v1/sessions/me.' });
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    const meBody = (await me.json());
-    if (!meBody.user) {
-        reporter.error('HSX_E_API_UNEXPECTED', '/v1/sessions/me returned an unexpected shape.', {});
-        reporter.done(undefined, 1);
-        return { exitCode: 1 };
-    }
-    const session = {
-        sessionToken,
-        expiresAt,
-        email: meBody.user.email,
-        userId: meBody.user.id,
-    };
-    await setUserSession(session, defaultStorePath());
-    reporter.info(`Logged in as ${meBody.user.email} (user_id=${meBody.user.id}).`);
-    reporter.info(`Session stored in ${defaultStorePath()}. Use \`hs-x logout\` to revoke.`);
-    reporter.done(undefined, 0);
-    return { exitCode: 0 };
 }
-function extractCookieValue(setCookie, name) {
-    // wrangler / undici may concatenate multiple Set-Cookie headers with commas.
-    // Cookie values themselves never contain commas in our case (token is base64url).
-    for (const segment of setCookie.split(/,\s*(?=[\w-]+=)/)) {
-        const [pair] = segment.split(';', 1);
-        if (!pair)
-            continue;
-        const eq = pair.indexOf('=');
-        if (eq <= 0)
-            continue;
-        if (pair.slice(0, eq).trim() === name) {
-            return pair.slice(eq + 1).trim();
+/** GET /v1/users/me/accounts; best-effort (empty list on any failure). */
+function listUserAccounts(http, controlPlaneUrl, token) {
+    return Effect.gen(function* () {
+        const response = yield* http
+            .execute(HttpClientRequest.get(new URL('/v1/users/me/accounts', controlPlaneUrl)).pipe(HttpClientRequest.setHeader('authorization', `Bearer ${token}`)))
+            .pipe(Effect.option);
+        if (Option.isNone(response) || !response.value.ok)
+            return [];
+        const parsed = yield* Effect.tryPromise(() => response.value.json()).pipe(Effect.orElseSucceed(() => ({ accounts: undefined })));
+        const raw = Array.isArray(parsed.accounts) ? parsed.accounts : [];
+        const list = [];
+        for (const entry of raw) {
+            if (!entry || typeof entry !== 'object')
+                continue;
+            const e = entry;
+            if (typeof e.accountId !== 'string')
+                continue;
+            list.push({
+                accountId: e.accountId,
+                ...(typeof e.displayName === 'string' ? { displayName: e.displayName } : {}),
+            });
         }
-    }
-    return undefined;
-}
-function extractCookieExpires(setCookie) {
-    const match = /Expires=([^;]+)/i.exec(setCookie);
-    if (!match || !match[1])
-        return undefined;
-    const parsed = new Date(match[1]);
-    return Number.isFinite(parsed.getTime()) ? parsed.toISOString() : undefined;
-}
-function resolveFlag(argv, name) {
-    for (let i = 0; i < argv.length; i += 1) {
-        if (argv[i] === name)
-            return argv[i + 1];
-        if (argv[i]?.startsWith(`${name}=`))
-            return argv[i].slice(name.length + 1);
-    }
-    return undefined;
+        return list;
+    });
 }
-function loginHelpText() {
-    return `hs-x login
-
-Log the current shell into the HS-X control plane.
-
-Usage:
-  hs-x login [--control-plane-url <url>]
-  hs-x login --magic-link [--email <you@example.com>] [--control-plane-url <url>]
-
-Default (device authorization):
-  1. We create a login pairing on the control plane and show you a short
-     code (e.g. ABCD-1234), then open the dashboard approval page.
-  2. Approve the code in your browser (you choose which account the CLI
-     token is scoped to). The control plane mints a Personal Access Token.
-  3. We poll until approval, then store the PAT in
-     $XDG_CONFIG_HOME/hs-x/config.json and send it as
-     Authorization: Bearer <token> on later commands.
-
-Fallback (--magic-link, for browserless / CI):
-  1. We POST your email to the control plane; it sends you a magic-link.
-  2. Paste the URL from that email here. We extract the token, call the
-     consume endpoint ourselves, and store the captured session cookie.
-
-To leave: \`hs-x logout\` revokes the session on the control plane and
-clears the local copy. The default control-plane URL is
-${DEFAULT_CONTROL_PLANE_URL}; override with --control-plane-url or
-HSX_CONTROL_PLANE_URL. The dashboard URL defaults to https://app.hs-x.dev;
-override with HSX_DASHBOARD_URL.
-`;
+/** Pick the HS-X account to bind: flag → single → interactive prompt → fail. */
+function resolveTargetAccount(input) {
+    return Effect.gen(function* () {
+        if (input.flagAccount) {
+            const match = input.list.find((a) => a.accountId === input.flagAccount);
+            return match ?? { accountId: input.flagAccount };
+        }
+        if (input.list.length === 1 && input.list[0])
+            return input.list[0];
+        if (input.list.length === 0) {
+            return yield* Effect.fail(cliError('HSX_E_INPUT_BAD_FIELD', 'This token has no HS-X accounts.'));
+        }
+        if (!input.interactive) {
+            return yield* Effect.fail(cliError('HSX_E_INPUT_BAD_FIELD', 'This token grants multiple HS-X accounts; pass --account <id>.'));
+        }
+        const picked = yield* Effect.promise(() => promptSelect({
+            message: 'Which HS-X account?',
+            options: input.list.map((a) => ({
+                value: a.accountId,
+                label: a.displayName ?? a.accountId,
+                ...(a.displayName ? { description: a.accountId } : {}),
+            })),
+        }));
+        const match = input.list.find((a) => a.accountId === picked);
+        if (!match)
+            return yield* Effect.fail(exitWith(130));
+        return match;
+    });
 }
-// ─── Native @effect/cli commands (Phase 4) ──────────────────────────────────
-// `logout` is built natively on the `AccountStore` service (`load` +
-// `clearUserSession`), with the best-effort control-plane revoke POST going
-// through the `CliHttp` service and human output through the `Reporter`
-// service — byte-for-byte with the legacy `logoutCommand`.
-//
-// `login` is QUARANTINED: the device-authorization flow binds to an imperative
-// browser/loopback/poll orchestration whose internal purity is out of scope for
-// this pass. The native `loginCmd` reconstructs the legacy argv from its typed
-// options and delegates to the existing `loginCommand` Promise via
-// `Effect.tryPromise`; only the command boundary is Effect. A non-zero
-// `CliResult.exitCode` is surfaced as a silent `exitWith(code)` (output already
-// rendered by the legacy body) so `runHandler` does not re-render.
-//
-// JSON-shape NOTE (flagged): `logout --json` emits the bespoke `{ok:true}` flat
-// line, then the entry reporter's own `done` envelope — identical to the legacy
-// sequence; `login --json` shapes are owned entirely by the quarantined legacy
-// body. TODO(phase-5): reconcile these payloads with the standard envelope.
-const magicLinkOption = Options.boolean('magic-link').pipe(Options.withDefault(false));
-const emailOption = Options.text('email').pipe(Options.optional);
+/* -------------------------------------------------------------------------- */
+/* Native @effect/cli commands                                                */
+/* -------------------------------------------------------------------------- */
+const accountOption = Options.text('account').pipe(Options.optional);
+const tokenOption = Options.text('token').pipe(Options.optional);
 export const loginCmd = Command.make('login', {
     json: jsonOption,
-    magicLink: magicLinkOption,
-    email: emailOption,
+    account: accountOption,
+    token: tokenOption,
     controlPlaneUrl: controlPlaneUrlOption,
-    cwd: cwdOption,
-}, (opts) => runHandler('login', { json: opts.json }, Effect.gen(function* () {
-    // Reconstruct the legacy argv the quarantined body parses (it reads
-    // --json / --magic-link / --email / --control-plane-url off argv).
-    const argv = ['login'];
-    if (opts.json)
-        argv.push('--json');
-    if (opts.magicLink)
-        argv.push('--magic-link');
-    if (Option.isSome(opts.email))
-        argv.push('--email', opts.email.value);
-    if (Option.isSome(opts.controlPlaneUrl)) {
-        argv.push('--control-plane-url', opts.controlPlaneUrl.value);
-    }
-    const cwd = Option.getOrUndefined(opts.cwd);
-    yield* runQuarantined(opts.json, () => loginCommand(cwd === undefined ? { argv } : { argv, cwd }));
+}, (opts) => runHandler('login', { json: opts.json }, loginBody({
+    json: opts.json,
+    account: opts.account,
+    token: opts.token,
+    controlPlaneUrl: opts.controlPlaneUrl,
 })));
-export const logoutCmd = Command.make('logout', { json: jsonOption, controlPlaneUrl: controlPlaneUrlOption, cwd: cwdOption }, (opts) => runHandler('logout', { json: opts.json }, logoutBody(opts)));
+export const logoutCmd = Command.make('logout', { json: jsonOption, controlPlaneUrl: controlPlaneUrlOption }, (opts) => runHandler('logout', { json: opts.json }, logoutBody(opts)));
 function logoutBody(opts) {
     return Effect.gen(function* () {
         const accounts = yield* AccountStore;
         const http = yield* CliHttp;
         const reporter = yield* Reporter;
         const store = yield* accounts.load;
-        if (!store.userSession) {
+        const active = store.defaultAccountId ? store.accounts[store.defaultAccountId] : undefined;
+        if (!active?.session) {
             yield* reporter.info('Not logged in.');
             yield* reporter.done(undefined, 0);
             return;
@@ -424,13 +230,13 @@ function logoutBody(opts) {
             onNone: () => resolveControlPlaneUrl([]),
             onSome: (value) => resolveControlPlaneUrl(['--control-plane-url', value]),
         });
-        // best-effort revoke; ignore any transport/status failure (matches legacy `.catch`)
+        // best-effort revoke; ignore any transport/status failure
         yield* http
-            .execute(HttpClientRequest.post(new URL('/v1/sessions/logout', controlPlaneUrl)).pipe(HttpClientRequest.setHeader('authorization', `Bearer ${store.userSession.sessionToken}`)))
+            .execute(HttpClientRequest.post(new URL('/v1/sessions/logout', controlPlaneUrl)).pipe(HttpClientRequest.setHeader('authorization', `Bearer ${active.session.sessionToken}`)))
             .pipe(Effect.ignore);
-        yield* accounts.clearUserSession;
+        yield* accounts.clearAccountSession(active.id);
         if (!opts.json)
-            yield* reporter.info('Logged out. Local session cleared.');
+            yield* reporter.info(`Logged out of ${active.displayName}. Local token cleared.`);
         else
             yield* Effect.sync(() => process.stdout.write(`${JSON.stringify({ ok: true })}\n`));
         yield* reporter.done(undefined, 0);