@nebulr-group/bridge-cli 0.4.4 → 0.5.0

package/README.md

@@ -27,10 +27,48 @@ bridge auth login
 Opens your default browser, runs through a PKCE-secured loopback flow (RFC 8252), and stores a 10-day token at `~/.config/bridge/credentials.json` (mode `0600`). After that, every subsequent `bridge` command picks the token up automatically — no env vars needed.
 
 ```bash
-bridge auth status   # show who you're logged in as and when the token expires
-bridge auth logout   # revoke the token and delete the credentials file
+bridge auth status   # show every stored app, and which one is active
+bridge auth logout   # revoke the active token and remove it locally
 ```
 
+#### Several apps at once
+
+The credentials file holds one credential per app, so you can log in to your
+local, stage and prod apps and move between them without a browser round-trip —
+the tokens are already on disk with days left on them.
+
+```bash
+bridge auth login --label northwhistle-local     # once per app
+bridge auth login --label northwhistle-prod
+
+bridge auth status                               # lists both, marks the active one
+bridge auth use northwhistle-local               # switch the default, offline
+bridge --profile northwhistle-prod app get       # target ONE command, default untouched
+```
+
+A profile is selected by its `--label`, its app id, or its app name, in that
+order. An ambiguous name is an error rather than a guess. `BRIDGE_PROFILE` does
+the same thing as `--profile` for a whole shell session.
+
+Prefer `--profile` over `bridge auth use` in scripts and long-running agent
+sessions: `use` mutates state another process may be reading, `--profile` does
+not.
+
+Every command prints one line to **stderr** naming the app that answered:
+
+```
+bridge: northwhistle-prod (606b4416fabdc800087d09ec) · https://api.thebridge.dev · via saved default
+```
+
+stdout stays pure JSON, so this does not disturb anything parsing it. Silence it
+with `BRIDGE_NO_BANNER=true` if you are already certain which app you are on.
+
+`bridge auth logout` removes the active app only. Use `--profile <name>` for a
+specific one, or `--all` to clear the file.
+
+Existing single-app credentials files keep working and are upgraded in place the
+next time something writes.
+
 #### `bridge auth login` flags
 
 | Flag | Description |
@@ -56,7 +94,17 @@ For non-interactive contexts (CI/CD pipelines, Docker images, headless agents) s
 export BRIDGE_API_KEY=<your-api-token>
 ```
 
-If you have logged in via `bridge auth login`, the credentials file always wins — a fresh login takes effect immediately, even when `BRIDGE_API_KEY` is still exported in your shell. `BRIDGE_API_KEY` is only used when no credentials file is present (the typical CI runner shape). To switch back to env-var auth on a developer machine, run `bridge auth logout` first.
+If you have logged in via `bridge auth login`, the credentials file always wins — a fresh login takes effect immediately, even when `BRIDGE_API_KEY` is still exported in your shell. `BRIDGE_API_KEY` is only used when no credentials file is present (the typical CI runner shape). To switch back to env-var auth on a developer machine, run `bridge auth logout --all` first.
+
+Because that trips people up, the CLI now says so at the moment it happens: with
+both present you get a line on stderr telling you `BRIDGE_API_KEY` is set and
+being ignored, and what to do instead. To point the CLI at a different app, use
+`--profile`, not the env vars.
+
+**`BRIDGE_APP_ID` has no effect on any path.** The app is carried by the
+credential itself — a login token and an API key are both already scoped to one
+app, so there is nothing for it to change. It is called out on stderr whenever it
+is set, rather than being quietly ignored.
 
 Optional configuration (applies to both auth paths):
 
@@ -139,8 +187,11 @@ bridge auth login                # default: open browser, complete PKCE flow
 bridge auth login --app acme     # pin to a specific app
 bridge auth login --label "work laptop"
 bridge auth login --no-browser   # print the URL (headless / SSH)
-bridge auth status               # show current login state
-bridge auth logout               # revoke token + delete local file
+bridge auth status               # show every stored app, active one marked
+bridge auth use <label|app-id>   # switch the default app, no browser
+bridge auth logout               # revoke + remove the active app
+bridge auth logout --all         # ...or every stored app
+bridge --profile <label> <cmd>   # target one app for one command
 ```
 
 ### Auth Configuration (app-level — separate from `auth login`)

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyBpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}

package/dist/cli.js

@@ -18,6 +18,7 @@ import { registerInfoCommands } from './commands/info.command.js';
 import { registerGuideCommands } from './commands/guide.command.js';
 import { registerOpsCommands } from './commands/ops.command.js';
 import { registerStripeCommands } from './commands/stripe.command.js';
+import { setProfileOverride } from './config.js';
 // Read version from package.json so `bridge --version` never drifts from the
 // published package. dist/cli.js lives at <pkg>/dist/cli.js, so `../package.json`
 // resolves to the package root in both the published tarball and during dev.
@@ -27,7 +28,18 @@ export const program = new Command();
 program
     .name('bridge')
     .description('Bridge platform CLI — optimized for AI coding agents')
-    .version(version);
+    .version(version)
+    // TBP-628 — target another stored app for ONE command, without touching the
+    // persisted default another process may be reading. Named `--profile` rather
+    // than `--app` because `bridge auth login --app` already exists and means
+    // something different (which app to authorise), and because `--profile` is
+    // what aws/npm users already reach for.
+    .option('--profile <label|app-id|app-name>', 'Use a specific stored credential for this command (env: BRIDGE_PROFILE)');
+// Runs before any subcommand action, so `getManagementClient()` sees the
+// override wherever in the tree it is eventually called from.
+program.hook('preAction', (thisCommand) => {
+    setProfileOverride(thisCommand.opts().profile);
+});
 registerAppCommands(program);
 registerTenantCommands(program);
 registerUserCommands(program);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC;IACjB,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,wCAAwC;KACvC,MAAM,CACL,mCAAmC,EACnC,yEAAyE,CAC1E,CAAC;AAEJ,yEAAyE;AACzE,8DAA8D;AAC9D,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE;IACxC,kBAAkB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,OAA6B,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AAEH,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC"}

package/dist/commands/auth/logout.command.d.ts

@@ -3,11 +3,18 @@
  *
  * Behavior:
  *   - No credentials file → "Not logged in." (exit 0).
- *   - File present       → call `POST /v1/auth/cli/revoke` with `x-api-key`,
+ *   - Otherwise          → call `POST /v1/auth/cli/revoke` with `x-api-key`,
  *                          treat 401 as success (token already gone), then
- *                          delete the file. Network errors → warn but still
- *                          delete (the local file is the source of truth for
+ *                          remove it locally. Network errors → warn but still
+ *                          remove (the local file is the source of truth for
  *                          "logged in" on this machine).
+ *
+ * TBP-628 — the file can hold several apps, so logout now has a scope.
+ * Bare `logout` removes the ACTIVE credential and leaves the others; the
+ * alternative, wiping every app because you finished with one of them, throws
+ * away valid tokens and forces browser round-trips to get them back, which is
+ * the friction this ticket exists to remove. `--profile` names one, `--all`
+ * asks for the old whole-file behaviour explicitly.
  */
 import type { Command } from 'commander';
 export declare function registerAuthLogoutCommand(auth: Command): void;

package/dist/commands/auth/logout.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}
+{"version":3,"file":"logout.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAczC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAgB7D"}

package/dist/commands/auth/logout.command.js

@@ -1,13 +1,15 @@
-import { credentialsPath, deleteCredentials, readCredentials } from '../../credentials.js';
+import { credentialsPath, CredentialSelectorError, deleteAllCredentials, findCredential, listCredentials, readCredentials, removeCredential, } from '../../credentials.js';
 import { resetManagementClient } from '../../config.js';
 import { createCliApiClient, CliAuthApiError } from '../../auth/api-client.js';
 export function registerAuthLogoutCommand(auth) {
     auth
         .command('logout')
-        .description('Revoke the saved CLI token and delete local credentials')
-        .action(async () => {
+        .description('Revoke the active CLI token and remove it locally')
+        .option('--profile <label|app-id|app-name>', 'Log out of one specific stored app')
+        .option('--all', 'Log out of every stored app and delete the credentials file')
+        .action(async (opts) => {
         try {
-            await runLogout();
+            await runLogout(opts);
             process.exitCode = 0;
         }
         catch (err) {
@@ -17,41 +19,79 @@ export function registerAuthLogoutCommand(auth) {
         }
     });
 }
-async function runLogout() {
+async function runLogout(opts = {}) {
     const stdout = process.stdout;
     const stderr = process.stderr;
-    let creds;
+    let entries;
     try {
-        creds = readCredentials();
+        entries = listCredentials();
     }
     catch (err) {
-        // Malformed credentials file — still try to delete it so the user gets unstuck.
+        // Malformed credentials file — still delete it so the user gets unstuck.
         stderr.write(`Warning: existing credentials file at ${credentialsPath()} could not be parsed (${err instanceof Error ? err.message : String(err)}). Removing it.\n`);
-        deleteCredentials();
+        deleteAllCredentials();
         stdout.write('Logged out (credentials file removed).\n');
         return;
     }
-    if (!creds) {
+    if (entries.length === 0) {
         stdout.write('Not logged in.\n');
         return;
     }
+    if (opts.all) {
+        for (const entry of entries)
+            await revoke(entry.creds, stderr);
+        deleteAllCredentials();
+        resetManagementClient();
+        stdout.write(`Logged out of ${entries.length} app(s).\n`);
+        return;
+    }
+    let target;
+    if (opts.profile) {
+        try {
+            target = findCredential(opts.profile);
+        }
+        catch (err) {
+            if (err instanceof CredentialSelectorError)
+                throw new Error(err.message);
+            throw err;
+        }
+    }
+    else {
+        const active = readCredentials();
+        if (!active) {
+            // Several stored, none active. Removing one by guess is exactly the
+            // silent choice this ticket forbids.
+            throw new Error('No active credential. Name one with `--profile <label|app id>`, or use `--all`. ' +
+                `Stored: ${entries.map((e) => e.creds.label ?? e.creds.app.name).join(', ')}.`);
+        }
+        target = entries.find((e) => e.key === active.app.id);
+    }
+    await revoke(target.creds, stderr);
+    const remaining = removeCredential(target.key);
+    resetManagementClient();
+    const name = target.creds.label ?? target.creds.app.name;
+    stdout.write(`Logged out ${target.creds.user.email} from ${name}.\n`);
+    if (remaining > 0) {
+        const rest = listCredentials();
+        const nowActive = rest.find((e) => e.isActive);
+        stdout.write(`  ${remaining} credential(s) still stored` +
+            (nowActive ? `; now using ${nowActive.creds.label ?? nowActive.creds.app.name}` : '') +
+            '.\n');
+    }
+}
+/** Best-effort server-side revoke. Never fatal — local removal is the point. */
+async function revoke(creds, stderr) {
     const api = createCliApiClient({ baseUrl: creds.baseUrl });
     try {
         await api.revokeToken(creds.apiKey);
     }
     catch (err) {
-        // Network failure — warn but still proceed with local deletion.
         if (err instanceof CliAuthApiError && err.code === 'network_error') {
-            stderr.write(`Warning: could not reach bridge-api to revoke server-side (${err.message}). Removing local credentials anyway.\n`);
+            stderr.write(`Warning: could not reach bridge-api to revoke ${creds.app.name} server-side (${err.message}). Removing local credentials anyway.\n`);
         }
         else {
-            // Any other API error is also non-fatal for the local cleanup, but we
-            // surface it so the user knows the server-side revoke didn't happen.
-            stderr.write(`Warning: server-side revoke returned an error (${err instanceof Error ? err.message : String(err)}). Removing local credentials anyway.\n`);
+            stderr.write(`Warning: server-side revoke for ${creds.app.name} returned an error (${err instanceof Error ? err.message : String(err)}). Removing local credentials anyway.\n`);
         }
     }
-    deleteCredentials();
-    resetManagementClient();
-    stdout.write(`Logged out ${creds.user.email}.\n`);
 }
 //# sourceMappingURL=logout.command.js.map

package/dist/commands/auth/logout.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.command.js","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gFAAgF;QAChF,MAAM,CAAC,KAAK,CACV,yCAAyC,eAAe,EAAE,yBACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,mBAAmB,CACpB,CAAC;QACF,iBAAiB,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,8DAA8D,GAAG,CAAC,OAAO,yCAAyC,CAAC,CAAC;QACnI,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,CAAC,KAAK,CACV,kDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iBAAiB,EAAE,CAAC;IACpB,qBAAqB,EAAE,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"logout.command.js","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,mCAAmC,EAAE,oCAAoC,CAAC;SACjF,MAAM,CAAC,OAAO,EAAE,6DAA6D,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAA4C,EAAE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,MAAM,CAAC,KAAK,CACV,yCAAyC,eAAe,EAAE,yBACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,mBAAmB,CACpB,CAAC;QACF,oBAAoB,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,oBAAoB,EAAE,CAAC;QACvB,qBAAqB,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oEAAoE;YACpE,qCAAqC;YACrC,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAChF,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/C,qBAAqB,EAAE,CAAC;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC;IACtE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CACV,KAAK,SAAS,6BAA6B;YACzC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,KAAK,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,MAAM,CAAC,KAAwB,EAAE,MAA0B;IACxE,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnE,MAAM,CAAC,KAAK,CACV,iDAAiD,KAAK,CAAC,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,OAAO,yCAAyC,CACrI,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CACV,mCAAmC,KAAK,CAAC,GAAG,CAAC,IAAI,uBAC/C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/auth/status.command.d.ts

@@ -8,6 +8,10 @@
  * optimize for readability over machine-parseability.
  *
  * If the user wants JSON, they can run `cat ~/.config/bridge/credentials.json`.
+ *
+ * TBP-628 — the file can hold several apps, so this lists ALL of them and marks
+ * the active one. Knowing which app is in force is the whole reason somebody
+ * runs this command, and it was already the only place that told them.
  */
 import type { Command } from 'commander';
 export declare function registerAuthStatusCommand(auth: Command): void;

package/dist/commands/auth/status.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}
+{"version":3,"file":"status.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}

package/dist/commands/auth/status.command.js

@@ -1,4 +1,4 @@
-import { credentialsPath, isExpired, readCredentials } from '../../credentials.js';
+import { credentialsPath, isExpired, listCredentials, readCredentialsFile, } from '../../credentials.js';
 import { formatRelativeTime } from '../../auth/relative-time.js';
 export function registerAuthStatusCommand(auth) {
     auth
@@ -18,18 +18,20 @@ export function registerAuthStatusCommand(auth) {
 }
 function runStatus() {
     const stdout = process.stdout;
-    // Prefer the credentials file; report on `BRIDGE_API_KEY` separately if set
-    // (so a CI user setting the env var sees something useful).
+    // Report on `BRIDGE_API_KEY` separately if set, so a CI user setting the env
+    // var sees something useful.
     const envApiKey = process.env.BRIDGE_API_KEY?.trim();
-    let creds;
+    const envProfile = process.env.BRIDGE_PROFILE?.trim();
+    let entries;
     try {
-        creds = readCredentials();
+        readCredentialsFile();
+        entries = listCredentials();
     }
     catch (err) {
         stdout.write(`Credentials file at ${credentialsPath()} is unreadable: ${err instanceof Error ? err.message : String(err)}\n` + 'Run `bridge auth login` to refresh, or delete the file manually.\n');
         return;
     }
-    if (!creds) {
+    if (entries.length === 0) {
         if (envApiKey && envApiKey.length > 0) {
             stdout.write('Using BRIDGE_API_KEY from environment (service-account / CI path).\n' +
                 'Run `bridge auth login` to switch to interactive credentials.\n');
@@ -38,22 +40,51 @@ function runStatus() {
         stdout.write('Not logged in. Run `bridge auth login`.\n');
         return;
     }
-    const expiryDate = new Date(creds.expiresAt);
-    const expiryDelta = expiryDate.getTime() - Date.now();
-    const expiryRel = formatRelativeTime(expiryDelta);
-    const expiredLabel = isExpired(creds) ? ' (EXPIRED)' : '';
-    stdout.write(`Logged in as ${creds.user.email}\n`);
-    stdout.write(`  app=${creds.app.name} (${creds.app.id})\n`);
-    stdout.write(`  expires=${expiryRel} — ${creds.expiresAt}${expiredLabel}\n`);
-    stdout.write(`  baseUrl=${creds.baseUrl}\n`);
-    if (creds.label)
-        stdout.write(`  label=${creds.label}\n`);
+    const active = entries.find((e) => e.isActive);
+    if (active) {
+        stdout.write(`Logged in as ${active.creds.user.email}\n`);
+    }
+    else {
+        // A pointer at a credential that is gone. Say so rather than picking one:
+        // an inferred default is exactly what this ticket is about.
+        stdout.write('No active credential selected — run `bridge auth use <profile>` to pick one.\n');
+    }
+    for (const entry of entries) {
+        writeEntry(entry, entries.length > 1);
+    }
     stdout.write(`  credentials=${credentialsPath()}\n`);
+    if (entries.length > 1) {
+        stdout.write('\nSwitch the default with `bridge auth use <label|app id>`, ' +
+            'or target one command with `--profile <label|app id>`.\n');
+    }
+    if (envProfile) {
+        stdout.write(`\nBRIDGE_PROFILE=${envProfile} is set — it overrides the active credential above.\n`);
+    }
     if (envApiKey && envApiKey.length > 0) {
-        stdout.write('\nNote: BRIDGE_API_KEY is also set in your environment — it takes precedence over the credentials file.\n');
+        // This used to claim the opposite. The credentials file has always won;
+        // saying otherwise is how somebody comes to believe they retargeted the
+        // CLI when they did not (TBP-628).
+        stdout.write('\nNote: BRIDGE_API_KEY is set in your environment but is IGNORED while a ' +
+            'credentials file exists.\nTo use it, run `bridge auth logout --all`. ' +
+            'To target another stored app, use `--profile`.\n');
     }
-    if (isExpired(creds)) {
-        process.exitCode = 0; // status is informational; don't fail just because expired.
+    if (process.env.BRIDGE_APP_ID?.trim()) {
+        stdout.write('\nNote: BRIDGE_APP_ID has no effect. The app is carried by the credential ' +
+            'itself; use `--profile <label|app id>` to target another one.\n');
     }
 }
+function writeEntry(entry, showMarker) {
+    const stdout = process.stdout;
+    const { creds } = entry;
+    const expiryDelta = new Date(creds.expiresAt).getTime() - Date.now();
+    const expiryRel = formatRelativeTime(expiryDelta);
+    const expiredLabel = isExpired(creds) ? ' (EXPIRED)' : '';
+    const marker = showMarker ? (entry.isActive ? '* ' : '  ') : '';
+    stdout.write(`  ${marker}app=${creds.app.name} (${creds.app.id})\n`);
+    if (creds.label)
+        stdout.write(`  ${marker}  label=${creds.label}\n`);
+    stdout.write(`  ${marker}  user=${creds.user.email}\n`);
+    stdout.write(`  ${marker}  expires=${expiryRel} — ${creds.expiresAt}${expiredLabel}\n`);
+    stdout.write(`  ${marker}  baseUrl=${creds.baseUrl}\n`);
+}
 //# sourceMappingURL=status.command.js.map

package/dist/commands/auth/status.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.command.js","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAErD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uBAAuB,eAAe,EAAE,mBACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,GAAG,oEAAoE,CAC5E,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,sEAAsE;gBACpE,iEAAiE,CACpE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1D,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,aAAa,SAAS,MAAM,KAAK,CAAC,SAAS,GAAG,YAAY,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,iBAAiB,eAAe,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CACV,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,4DAA4D;IACpF,CAAC;AACH,CAAC"}
+{"version":3,"file":"status.command.js","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,eAAe,EACf,SAAS,EACT,eAAe,EACf,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAEtD,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,mBAAmB,EAAE,CAAC;QACtB,OAAO,GAAG,eAAe,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uBAAuB,eAAe,EAAE,mBACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,GAAG,oEAAoE,CAC5E,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,sEAAsE;gBACpE,iEAAiE,CACpE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,CAAC,KAAK,CACV,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,eAAe,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CACV,8DAA8D;YAC5D,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,oBAAoB,UAAU,uDAAuD,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,wEAAwE;QACxE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,CAAC,KAAK,CACV,2EAA2E;YACzE,uEAAuE;YACvE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CACV,4EAA4E;YAC1E,iEAAiE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,UAAmB;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAExB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,WAAW,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,UAAU,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,aAAa,SAAS,MAAM,KAAK,CAAC,SAAS,GAAG,YAAY,IAAI,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAC1D,CAAC"}

package/dist/commands/auth/use.command.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `bridge auth use <profile>` — move the persisted default to another stored
+ * credential, without a browser round-trip (TBP-628).
+ *
+ * The credential is already on disk with days left on it; switching is a
+ * pointer move. Before this existed the only way to change apps was
+ * `auth logout` + `auth login`, which discarded a perfectly valid token and
+ * cost a browser trip, so people did not switch — they ran commands against
+ * whichever app happened to be active and read the answers as if they came
+ * from the one they meant.
+ *
+ * For a single command, prefer `--profile` / `BRIDGE_PROFILE`: this command
+ * mutates state that other processes read.
+ */
+import type { Command } from 'commander';
+export declare function registerAuthUseCommand(auth: Command): void;
+//# sourceMappingURL=use.command.d.ts.map

package/dist/commands/auth/use.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/use.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc1D"}

package/dist/commands/auth/use.command.js

@@ -0,0 +1,47 @@
+import { CredentialSelectorError, findCredential, isExpired, listCredentials, setActiveCredential, } from '../../credentials.js';
+import { resetManagementClient } from '../../config.js';
+export function registerAuthUseCommand(auth) {
+    auth
+        .command('use <profile>')
+        .description('Switch the default app to another stored credential (no re-login)')
+        .action((profile) => {
+        try {
+            runUse(profile);
+            process.exitCode = 0;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`bridge auth use: ${msg}\n`);
+            process.exitCode = 1;
+        }
+    });
+}
+function runUse(profile) {
+    const stdout = process.stdout;
+    let entry;
+    try {
+        entry = findCredential(profile);
+    }
+    catch (err) {
+        if (err instanceof CredentialSelectorError)
+            throw new Error(err.message);
+        throw err;
+    }
+    setActiveCredential(entry.key);
+    resetManagementClient();
+    const name = entry.creds.label ?? entry.creds.app.name;
+    stdout.write(`Now using ${name} — ${entry.creds.app.name} (${entry.creds.app.id})\n`);
+    stdout.write(`  baseUrl=${entry.creds.baseUrl}\n`);
+    // Switching TO an expired credential is allowed — it is the user's stated
+    // intent, and refusing would leave them unable to make it the default before
+    // re-authenticating it. But it must not be a surprise at the next command.
+    if (isExpired(entry.creds)) {
+        stdout.write(`  WARNING: this credential expired ${entry.creds.expiresAt}. ` +
+            'Run `bridge auth login` to refresh it.\n');
+    }
+    const others = listCredentials().filter((e) => e.key !== entry.key);
+    if (others.length > 0) {
+        stdout.write(`  also stored: ${others.map((e) => e.creds.label ?? e.creds.app.name).join(', ')}\n`);
+    }
+}
+//# sourceMappingURL=use.command.js.map

package/dist/commands/auth/use.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.command.js","sourceRoot":"","sources":["../../../src/commands/auth/use.command.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,eAAe,EACf,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,CAAC,OAAe,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,CAAC;YAChB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAClD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAuB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,qBAAqB,EAAE,CAAC;IAExB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAEnD,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,sCAAsC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI;YAC7D,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CACV,kBAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACtF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/auth.command.d.ts

@@ -5,6 +5,7 @@
  *   - `login`           (TBP-113): browser-based PKCE auth.
  *   - `logout`          (TBP-113): revoke + delete credentials.
  *   - `status`          (TBP-113): show current login state.
+ *   - `use`             (TBP-628): switch the default app, offline.
  *   - `config`/`mfa`/`password-policy`: pre-existing app auth-config commands.
  */
 import type { Command } from 'commander';

package/dist/commands/auth.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.command.d.ts","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAY3D"}
+{"version":3,"file":"auth.command.d.ts","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAe3D"}

package/dist/commands/auth.command.js

@@ -1,6 +1,7 @@
 import { registerAuthLoginCommand } from './auth/login.command.js';
 import { registerAuthLogoutCommand } from './auth/logout.command.js';
 import { registerAuthStatusCommand } from './auth/status.command.js';
+import { registerAuthUseCommand } from './auth/use.command.js';
 import { registerAuthConfigCommands } from './auth/config.command.js';
 export function registerAuthCommands(program) {
     const auth = program
@@ -10,6 +11,8 @@ export function registerAuthCommands(program) {
     registerAuthLoginCommand(auth);
     registerAuthLogoutCommand(auth);
     registerAuthStatusCommand(auth);
+    // TBP-628 — several apps side by side; switch without a browser round-trip.
+    registerAuthUseCommand(auth);
     // Pre-existing — app-level auth configuration.
     registerAuthConfigCommands(auth);
 }

package/dist/commands/auth.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.command.js","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC,CAAC;IAE7E,qCAAqC;IACrC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChC,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAEhC,+CAA+C;IAC/C,0BAA0B,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"auth.command.js","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC,CAAC;IAE7E,qCAAqC;IACrC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChC,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAEhC,4EAA4E;IAC5E,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE7B,+CAA+C;IAC/C,0BAA0B,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/config.d.ts

@@ -1,22 +1,29 @@
 import { BridgeManagement } from '@nebulr-group/bridge-auth-core';
 export declare const DEFAULT_BASE_URL = "https://api.thebridge.dev";
+/** Called once from the CLI entrypoint, before any action runs. */
+export declare function setProfileOverride(profile: string | null | undefined): void;
 /**
  * Resolution order:
- *   1. `~/.config/bridge/credentials.json` (or `$XDG_CONFIG_HOME/bridge/credentials.json`)
- *      written by `bridge auth login`. The interactive primary path. Token
- *      carries the appId baked in by /v1/auth/cli/token, so post-login the
- *      JWT is the source of truth for which app the CLI operates on.
- *   2. `BRIDGE_API_KEY` env var  (CI / service-account fallback). Used when no
- *      credentials file exists — typical CI runner shape.
- *   3. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
+ *   1. `--profile <label|id|name>` / `BRIDGE_PROFILE` — a stored credential,
+ *      named for this one invocation. Never falls back: naming a profile and
+ *      silently getting a different app is the exact failure TBP-628 exists to
+ *      stop, so an unknown or expired profile is an error.
+ *   2. The ACTIVE credential in `~/.config/bridge/credentials.json` (or
+ *      `$XDG_CONFIG_HOME/...`), written by `bridge auth login` and moved by
+ *      `bridge auth use`.
+ *   3. `BRIDGE_API_KEY` env var (CI / service-account fallback). Used when no
+ *      usable credentials file exists — the typical CI runner shape.
+ *   4. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
  *
- * Note: credentials-file wins over env so `bridge auth login` does what users
- * expect — the new login takes effect immediately. CI is unaffected because
- * runners typically have no credentials file and fall through to step 2.
+ * The credentials file still wins over `BRIDGE_API_KEY`, unchanged, so
+ * `bridge auth login` takes effect immediately and CI is unaffected. What HAS
+ * changed is that being ignored is now said out loud: `BRIDGE_API_KEY` and
+ * `BRIDGE_APP_ID` look like a way to retarget the CLI and are not, and reading
+ * that in the output beats discovering it from a write that went to the wrong
+ * app (TBP-628).
  *
- * If a credentials file exists but its `expiresAt` is in the past, we fall
- * through to env (if set) — same as if there were no file. Otherwise throw a
- * friendly error pointing the user back to `bridge auth login`.
+ * Every resolution also prints one line to stderr naming the app that is about
+ * to answer. See `writeContextBanner`.
  */
 export declare function getManagementClient(): BridgeManagement;
 /**

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAI5D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,CA+CtD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQnE;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AASlE,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAa5D,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAE3E;AAQD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,CA0EtD;AAoDD;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQnE;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B"}

package/dist/config.js

@@ -1,24 +1,47 @@
 import { BridgeManagement } from '@nebulr-group/bridge-auth-core';
-import { isExpired, readCredentials } from './credentials.js';
+import { CredentialSelectorError, findCredential, isExpired, readCredentials, } from './credentials.js';
 export const DEFAULT_BASE_URL = 'https://api.thebridge.dev';
 let _client = null;
+/**
+ * The `--profile` value for this invocation, set by the CLI's preAction hook.
+ *
+ * A per-invocation override rather than a persisted switch, because that is
+ * what scripts and long-running agent sessions need: target one app for one
+ * command without mutating state another process is reading (TBP-628).
+ */
+let _profileOverride = null;
+/** Called once from the CLI entrypoint, before any action runs. */
+export function setProfileOverride(profile) {
+    _profileOverride = profile?.trim() || null;
+}
+/** The profile in force: `--profile` beats `BRIDGE_PROFILE`. */
+function activeProfileSelector() {
+    if (_profileOverride)
+        return _profileOverride;
+    return process.env.BRIDGE_PROFILE?.trim() || null;
+}
 /**
  * Resolution order:
- *   1. `~/.config/bridge/credentials.json` (or `$XDG_CONFIG_HOME/bridge/credentials.json`)
- *      written by `bridge auth login`. The interactive primary path. Token
- *      carries the appId baked in by /v1/auth/cli/token, so post-login the
- *      JWT is the source of truth for which app the CLI operates on.
- *   2. `BRIDGE_API_KEY` env var  (CI / service-account fallback). Used when no
- *      credentials file exists — typical CI runner shape.
- *   3. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
+ *   1. `--profile <label|id|name>` / `BRIDGE_PROFILE` — a stored credential,
+ *      named for this one invocation. Never falls back: naming a profile and
+ *      silently getting a different app is the exact failure TBP-628 exists to
+ *      stop, so an unknown or expired profile is an error.
+ *   2. The ACTIVE credential in `~/.config/bridge/credentials.json` (or
+ *      `$XDG_CONFIG_HOME/...`), written by `bridge auth login` and moved by
+ *      `bridge auth use`.
+ *   3. `BRIDGE_API_KEY` env var (CI / service-account fallback). Used when no
+ *      usable credentials file exists — the typical CI runner shape.
+ *   4. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
  *
- * Note: credentials-file wins over env so `bridge auth login` does what users
- * expect — the new login takes effect immediately. CI is unaffected because
- * runners typically have no credentials file and fall through to step 2.
+ * The credentials file still wins over `BRIDGE_API_KEY`, unchanged, so
+ * `bridge auth login` takes effect immediately and CI is unaffected. What HAS
+ * changed is that being ignored is now said out loud: `BRIDGE_API_KEY` and
+ * `BRIDGE_APP_ID` look like a way to retarget the CLI and are not, and reading
+ * that in the output beats discovering it from a write that went to the wrong
+ * app (TBP-628).
  *
- * If a credentials file exists but its `expiresAt` is in the past, we fall
- * through to env (if set) — same as if there were no file. Otherwise throw a
- * friendly error pointing the user back to `bridge auth login`.
+ * Every resolution also prints one line to stderr naming the app that is about
+ * to answer. See `writeContextBanner`.
  */
 export function getManagementClient() {
     if (_client)
@@ -29,29 +52,56 @@ export function getManagementClient() {
     let apiKey;
     let baseUrl;
     let source;
-    // 1. Credentials file from `bridge auth login` (interactive primary).
-    const creds = safeReadCredentials();
-    if (creds && !isExpired(creds)) {
+    let creds = null;
+    const selector = activeProfileSelector();
+    if (selector) {
+        // 1. Explicit profile. Resolve it or fail — no fallback of any kind.
+        let entry;
+        try {
+            entry = findCredential(selector);
+        }
+        catch (err) {
+            if (err instanceof CredentialSelectorError)
+                throw new ConfigError(err.message);
+            throw err;
+        }
+        if (isExpired(entry.creds)) {
+            throw new ConfigError(`Credential for "${selector}" (${entry.creds.app.name}) expired ` +
+                `${entry.creds.expiresAt}. Run \`bridge auth login\` to re-authenticate it. ` +
+                'Refusing to fall back to another app.');
+        }
+        creds = entry.creds;
         apiKey = creds.apiKey;
-        // Env override still wins for baseUrl (useful for hitting a local bridge-api
-        // with a token issued by prod, or vice versa during dev).
         baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : creds.baseUrl;
-        source = 'credentials-file';
-    }
-    else if (envApiKey && envApiKey.length > 0) {
-        // 2. BRIDGE_API_KEY env var (CI / service-account fallback).
-        apiKey = envApiKey;
-        baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : DEFAULT_BASE_URL;
-        source = 'env';
-    }
-    else if (creds && isExpired(creds)) {
-        // 3a. Found a credentials file but token expired; no env fallback either.
-        throw new ConfigError('Token expired. Run `bridge auth login` to re-authenticate.');
+        source = 'profile';
     }
     else {
-        // 3b. No credentials at all.
-        throw new ConfigError('Not logged in. Run `bridge auth login`.');
+        // 2. Active credential from `bridge auth login` / `bridge auth use`.
+        const active = safeReadCredentials();
+        if (active && !isExpired(active)) {
+            creds = active;
+            apiKey = active.apiKey;
+            // Env override still wins for baseUrl (useful for hitting a local
+            // bridge-api with a token issued by prod, or vice versa during dev).
+            baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : active.baseUrl;
+            source = 'credentials-file';
+        }
+        else if (envApiKey && envApiKey.length > 0) {
+            // 3. BRIDGE_API_KEY env var (CI / service-account fallback).
+            apiKey = envApiKey;
+            baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : DEFAULT_BASE_URL;
+            source = 'env';
+        }
+        else if (active && isExpired(active)) {
+            // 4a. Found a credentials file but token expired; no env fallback either.
+            throw new ConfigError('Token expired. Run `bridge auth login` to re-authenticate.');
+        }
+        else {
+            // 4b. No credentials at all.
+            throw new ConfigError('Not logged in. Run `bridge auth login`.');
+        }
     }
+    writeContextBanner({ creds, source, baseUrl, selector });
     if (debug) {
         const baseSource = envBaseUrl && envBaseUrl.length > 0
             ? 'env'
@@ -63,6 +113,44 @@ export function getManagementClient() {
     _client = new BridgeManagement({ apiKey, baseUrl, debug });
     return _client;
 }
+/**
+ * One line on stderr naming the app that is about to answer.
+ *
+ * On EVERY command, not only writes. The incident behind TBP-628 started with a
+ * read: `bridge role list` was believed to describe the local app and described
+ * production, and nothing in the output said otherwise. A banner that only
+ * appears on writes would not have prevented it, because the wrong belief was
+ * already formed by then.
+ *
+ * stderr, so stdout stays pure JSON for the agents and scripts that parse it.
+ * Suppress with `BRIDGE_NO_BANNER=true` — for the one caller who is already
+ * certain and is merging the two streams.
+ */
+function writeContextBanner(ctx) {
+    if (process.env.BRIDGE_NO_BANNER === 'true')
+        return;
+    const { creds, source, baseUrl, selector } = ctx;
+    const who = creds
+        ? `${creds.label ?? creds.app.name} (${creds.app.id})`
+        : 'BRIDGE_API_KEY (app unknown — the key carries it)';
+    const via = source === 'profile'
+        ? `--profile ${selector}`
+        : source === 'env'
+            ? 'BRIDGE_API_KEY'
+            : 'saved default';
+    process.stderr.write(`bridge: ${who} · ${baseUrl} · via ${via}\n`);
+    // The two env vars that look like a way to retarget the CLI and are not.
+    // Saying so here, at the moment they are being ignored, is the whole point:
+    // the reported incident was a session that set them and believed them.
+    if (source !== 'env' && process.env.BRIDGE_API_KEY?.trim()) {
+        process.stderr.write('bridge: BRIDGE_API_KEY is set but IGNORED — the credentials file wins. ' +
+            'Use `--profile <label>` to pick a stored app, or `bridge auth logout` to use the key.\n');
+    }
+    if (process.env.BRIDGE_APP_ID?.trim()) {
+        process.stderr.write('bridge: BRIDGE_APP_ID has no effect — the app is carried by the credential itself. ' +
+            'Use `--profile <label|app id>` or `BRIDGE_PROFILE` to target another app.\n');
+    }
+}
 /**
  * For tests and for `bridge auth logout` / `bridge auth status` — they need
  * to reset the cached client between operations.

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,eAAe,EAA0B,MAAM,kBAAkB,CAAC;AAEtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,IAAI,OAAO,GAA4B,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IAEnB,sEAAsE;IACtE,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACtB,6EAA6E;QAC7E,0DAA0D;QAC1D,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3E,MAAM,GAAG,kBAAkB,CAAC;IAC9B,CAAC;SAAM,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,6DAA6D;QAC7D,MAAM,GAAG,SAAS,CAAC;QACnB,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC9E,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;SAAM,IAAI,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,0EAA0E;QAC1E,MAAM,IAAI,WAAW,CACnB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,KAAK,KAAK;gBAChB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,aAAa,OAAO,KAAK,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CACnB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YACtF,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,IAAI,OAAO,GAA4B,IAAI,CAAC;AAE5C;;;;;;GAMG;AACH,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,gBAAgB,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7C,CAAC;AAED,gEAAgE;AAChE,SAAS,qBAAqB;IAC5B,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,KAAK,GAA6B,IAAI,CAAC;IAE3C,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,qEAAqE;QACrE,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,mBAAmB,QAAQ,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY;gBAC/D,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,qDAAqD;gBAC7E,uCAAuC,CAC1C,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACpB,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACtB,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3E,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,KAAK,GAAG,MAAM,CAAC;YACf,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACvB,kEAAkE;YAClE,qEAAqE;YACrE,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5E,MAAM,GAAG,kBAAkB,CAAC;QAC9B,CAAC;aAAM,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,6DAA6D;YAC7D,MAAM,GAAG,SAAS,CAAC;YACnB,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC9E,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;aAAM,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,0EAA0E;YAC1E,MAAM,IAAI,WAAW,CACnB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,6BAA6B;YAC7B,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEzD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,KAAK,KAAK;gBAChB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,aAAa,OAAO,KAAK,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,GAK3B;IACC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO;IAEpD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG;QACtD,CAAC,CAAC,mDAAmD,CAAC;IACxD,MAAM,GAAG,GACP,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,aAAa,QAAQ,EAAE;QACzB,CAAC,CAAC,MAAM,KAAK,KAAK;YAChB,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,OAAO,UAAU,GAAG,IAAI,CAAC,CAAC;IAEnE,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE;YACvE,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qFAAqF;YACnF,6EAA6E,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CACnB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YACtF,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/credentials.d.ts

@@ -20,6 +20,21 @@ export interface StoredCredentials {
     /** Optional human-friendly label set via `bridge auth login --label`. */
     label?: string;
 }
+/** Current on-disk shape. See the module docstring for why it is a map. */
+export interface CredentialsFile {
+    version: 2;
+    /** App id of the credential commands use by default. `null` when empty. */
+    active: string | null;
+    /** All stored credentials, keyed by `app.id`. */
+    credentials: Record<string, StoredCredentials>;
+}
+/** One entry, as `bridge auth status` and the selector logic see it. */
+export interface CredentialEntry {
+    /** The map key — always `creds.app.id`. */
+    key: string;
+    creds: StoredCredentials;
+    isActive: boolean;
+}
 /**
  * Returns the absolute path to the credentials file based on the current
  * environment. Does not create directories or files — pure path resolution.
@@ -37,17 +52,65 @@ export interface StoredCredentials {
  */
 export declare function credentialsPath(): string;
 /**
- * Reads and parses the credentials file. Returns `null` if the file does not
- * exist. Throws if the file exists but is unreadable or contains invalid JSON.
+ * Read the whole store, migrating a v1 file in memory. `null` if no file.
+ *
+ * Throws if the file exists but is unreadable or malformed — a corrupt store is
+ * not the same as an absent one, and silently treating it as absent would make
+ * `bridge auth status` report "not logged in" to somebody who very much is.
+ */
+export declare function readCredentialsFile(): CredentialsFile | null;
+/**
+ * The credential commands act on by default: the active one.
+ *
+ * Kept with its original name and signature because every existing caller wants
+ * exactly this, and because "which credential is in force" is a question with
+ * one answer whether the file holds one app or ten.
  */
 export declare function readCredentials(): StoredCredentials | null;
+/** Every stored credential, active one first, then by app name. */
+export declare function listCredentials(): CredentialEntry[];
+/** Raised when a selector matches nothing, or matches more than one entry. */
+export declare class CredentialSelectorError extends Error {
+    constructor(message: string);
+}
+/**
+ * Find one stored credential by label, app id, or app name.
+ *
+ * Label first: users think in environments, not in 24-character object ids, and
+ * `--label` exists precisely so they can name one. App id is exact and always
+ * works. App name is last because two apps may share one.
+ *
+ * An ambiguous selector is an ERROR, never a first match. Picking one of two
+ * candidate apps silently is the whole failure mode this ticket is about.
+ */
+export declare function findCredential(selector: string): CredentialEntry;
 /**
- * Writes the credentials atomically with mode 0600. Creates the parent
- * directory with mode 0700 if it does not exist.
+ * Upsert a credential by app id and make it active.
+ *
+ * Same name and signature as before: `bridge auth login` still ends with one
+ * call, and still leaves the app it just authorised in force.
  */
 export declare function writeCredentials(creds: StoredCredentials): void;
+/** Point the persisted default at an already-stored credential. Offline. */
+export declare function setActiveCredential(key: string): void;
+/** Persist the store atomically with mode 0600, dir 0700. */
+export declare function writeCredentialsFile(file: CredentialsFile): void;
 /**
- * Deletes the credentials file. No-op if it does not exist.
+ * Remove ONE credential. Deletes the file entirely when it was the last.
+ *
+ * Returns the remaining count so a caller can tell the user what is left.
+ * Removing the active one moves `active` to another entry rather than leaving a
+ * dangling pointer — with credentials still stored, "logged out of everything"
+ * would be a lie.
+ */
+export declare function removeCredential(key: string): number;
+/** Delete the whole credentials file. No-op if it does not exist. */
+export declare function deleteAllCredentials(): void;
+/**
+ * Back-compat alias for the single-app era: remove the active credential.
+ *
+ * @deprecated Prefer `removeCredential(key)` or `deleteAllCredentials()`, which
+ * say which of the two things they do.
  */
 export declare function deleteCredentials(): void;
 /**

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,qCAAqC;IACrC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAQxC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAiB1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CA4B/D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAQxC;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAInF"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AA6CA,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,qCAAqC;IACrC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,2EAA2E;IAC3E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAQxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,eAAe,GAAG,IAAI,CAyB5D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAU1D;AAED,mEAAmE;AACnE,wBAAgB,eAAe,IAAI,eAAe,EAAE,CASnD;AAED,8EAA8E;AAC9E,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAmChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAK/D;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA4BhE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWpD;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,IAAI,IAAI,CAQ3C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC;AAsBD;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAInF"}

package/dist/credentials.js

@@ -10,6 +10,34 @@
  *   2. `~/.config/bridge/credentials.json` otherwise
  *
  * File mode: 0600 (owner read/write only). Containing dir created with 0700.
+ *
+ * ## The file holds MANY apps (TBP-628)
+ *
+ * It used to hold exactly one. Anyone running the same product as several apps
+ * — one appId per environment — had to `logout` + `login` through the browser
+ * to move between them, even though the token they already held had days left
+ * on it. Worse, nothing in a read command's output said which app answered, so
+ * a session holding a prod token could run `role list` believing it described
+ * local, and the next step would have rewritten production roles.
+ *
+ * So the on-disk shape is now a map keyed by app id, plus a pointer at the
+ * active one:
+ *
+ * ```json
+ * {
+ *   "version": 2,
+ *   "active": "606b4416fabdc800087d09ec",
+ *   "credentials": { "606b4416fabdc800087d09ec": { …StoredCredentials } }
+ * }
+ * ```
+ *
+ * Keyed by app id, not by label: the label is optional and user-chosen, so it
+ * is a fine way to SELECT a credential and a bad way to key one.
+ *
+ * A v1 file (a bare `StoredCredentials` object) is migrated on read, in memory
+ * only. Reading never rewrites the file — a read command must not mutate state
+ * another process is reading. The v2 shape is persisted the next time
+ * something writes.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -39,10 +67,13 @@ export function credentialsPath() {
     return path.join(base, '.config', 'bridge', 'credentials.json');
 }
 /**
- * Reads and parses the credentials file. Returns `null` if the file does not
- * exist. Throws if the file exists but is unreadable or contains invalid JSON.
+ * Read the whole store, migrating a v1 file in memory. `null` if no file.
+ *
+ * Throws if the file exists but is unreadable or malformed — a corrupt store is
+ * not the same as an absent one, and silently treating it as absent would make
+ * `bridge auth status` report "not logged in" to somebody who very much is.
  */
-export function readCredentials() {
+export function readCredentialsFile() {
     const filePath = credentialsPath();
     if (!fs.existsSync(filePath))
         return null;
@@ -54,16 +85,120 @@ export function readCredentials() {
     catch {
         throw new Error(`Credentials file at ${filePath} is not valid JSON.`);
     }
-    if (!isStoredCredentials(parsed)) {
-        throw new Error(`Credentials file at ${filePath} is missing required fields.`);
+    // v2 — the current shape.
+    if (isCredentialsFile(parsed))
+        return parsed;
+    // v1 — a bare StoredCredentials object. Migrate in memory; do NOT write.
+    if (isStoredCredentials(parsed)) {
+        return {
+            version: 2,
+            active: parsed.app.id,
+            credentials: { [parsed.app.id]: parsed },
+        };
     }
-    return parsed;
+    throw new Error(`Credentials file at ${filePath} is missing required fields.`);
 }
 /**
- * Writes the credentials atomically with mode 0600. Creates the parent
- * directory with mode 0700 if it does not exist.
+ * The credential commands act on by default: the active one.
+ *
+ * Kept with its original name and signature because every existing caller wants
+ * exactly this, and because "which credential is in force" is a question with
+ * one answer whether the file holds one app or ten.
+ */
+export function readCredentials() {
+    const file = readCredentialsFile();
+    if (!file)
+        return null;
+    if (file.active && file.credentials[file.active])
+        return file.credentials[file.active];
+    // A pointer at a credential that is gone. Fall back to the only entry if
+    // there is exactly one — otherwise there is no defensible default, and
+    // guessing would pick an app on the user's behalf, which is the failure this
+    // ticket exists to stop.
+    const keys = Object.keys(file.credentials);
+    return keys.length === 1 ? file.credentials[keys[0]] : null;
+}
+/** Every stored credential, active one first, then by app name. */
+export function listCredentials() {
+    const file = readCredentialsFile();
+    if (!file)
+        return [];
+    return Object.entries(file.credentials)
+        .map(([key, creds]) => ({ key, creds, isActive: key === file.active }))
+        .sort((a, b) => {
+        if (a.isActive !== b.isActive)
+            return a.isActive ? -1 : 1;
+        return a.creds.app.name.localeCompare(b.creds.app.name);
+    });
+}
+/** Raised when a selector matches nothing, or matches more than one entry. */
+export class CredentialSelectorError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CredentialSelectorError';
+    }
+}
+/**
+ * Find one stored credential by label, app id, or app name.
+ *
+ * Label first: users think in environments, not in 24-character object ids, and
+ * `--label` exists precisely so they can name one. App id is exact and always
+ * works. App name is last because two apps may share one.
+ *
+ * An ambiguous selector is an ERROR, never a first match. Picking one of two
+ * candidate apps silently is the whole failure mode this ticket is about.
+ */
+export function findCredential(selector) {
+    const needle = selector.trim();
+    if (!needle)
+        throw new CredentialSelectorError('Empty profile selector.');
+    const entries = listCredentials();
+    if (entries.length === 0) {
+        throw new CredentialSelectorError('No stored credentials. Run `bridge auth login` first.');
+    }
+    const lower = needle.toLowerCase();
+    const byLabel = entries.filter((e) => e.creds.label?.toLowerCase() === lower);
+    const byId = entries.filter((e) => e.key === needle);
+    const byName = entries.filter((e) => e.creds.app.name.toLowerCase() === lower);
+    for (const [what, matches] of [
+        ['label', byLabel],
+        ['app id', byId],
+        ['app name', byName],
+    ]) {
+        if (matches.length === 1)
+            return matches[0];
+        if (matches.length > 1) {
+            throw new CredentialSelectorError(`"${needle}" matches ${matches.length} stored credentials by ${what} ` +
+                `(${matches.map((m) => m.key).join(', ')}). Select by app id instead.`);
+        }
+    }
+    throw new CredentialSelectorError(`No stored credential matches "${needle}". Known: ` +
+        entries.map((e) => e.creds.label ?? e.creds.app.name).join(', ') +
+        '. Run `bridge auth status` to see them all.');
+}
+/**
+ * Upsert a credential by app id and make it active.
+ *
+ * Same name and signature as before: `bridge auth login` still ends with one
+ * call, and still leaves the app it just authorised in force.
  */
 export function writeCredentials(creds) {
+    const file = readCredentialsFileOrEmpty();
+    file.credentials[creds.app.id] = creds;
+    file.active = creds.app.id;
+    writeCredentialsFile(file);
+}
+/** Point the persisted default at an already-stored credential. Offline. */
+export function setActiveCredential(key) {
+    const file = readCredentialsFileOrEmpty();
+    if (!file.credentials[key]) {
+        throw new CredentialSelectorError(`No stored credential with app id ${key}.`);
+    }
+    file.active = key;
+    writeCredentialsFile(file);
+}
+/** Persist the store atomically with mode 0600, dir 0700. */
+export function writeCredentialsFile(file) {
     const filePath = credentialsPath();
     const dir = path.dirname(filePath);
     // Create dir with restrictive perms. mkdirSync `mode` is masked by umask, so
@@ -80,7 +215,7 @@ export function writeCredentials(creds) {
     const tmpPath = `${filePath}.${process.pid}.tmp`;
     const fd = fs.openSync(tmpPath, 'w', 0o600);
     try {
-        fs.writeFileSync(fd, JSON.stringify(creds, null, 2) + '\n');
+        fs.writeFileSync(fd, JSON.stringify(file, null, 2) + '\n');
     }
     finally {
         fs.closeSync(fd);
@@ -94,9 +229,28 @@ export function writeCredentials(creds) {
     fs.renameSync(tmpPath, filePath);
 }
 /**
- * Deletes the credentials file. No-op if it does not exist.
+ * Remove ONE credential. Deletes the file entirely when it was the last.
+ *
+ * Returns the remaining count so a caller can tell the user what is left.
+ * Removing the active one moves `active` to another entry rather than leaving a
+ * dangling pointer — with credentials still stored, "logged out of everything"
+ * would be a lie.
  */
-export function deleteCredentials() {
+export function removeCredential(key) {
+    const file = readCredentialsFileOrEmpty();
+    delete file.credentials[key];
+    const remaining = Object.keys(file.credentials);
+    if (remaining.length === 0) {
+        deleteAllCredentials();
+        return 0;
+    }
+    if (file.active === key)
+        file.active = remaining[0];
+    writeCredentialsFile(file);
+    return remaining.length;
+}
+/** Delete the whole credentials file. No-op if it does not exist. */
+export function deleteAllCredentials() {
     const filePath = credentialsPath();
     try {
         fs.unlinkSync(filePath);
@@ -107,6 +261,43 @@ export function deleteCredentials() {
         throw err;
     }
 }
+/**
+ * Back-compat alias for the single-app era: remove the active credential.
+ *
+ * @deprecated Prefer `removeCredential(key)` or `deleteAllCredentials()`, which
+ * say which of the two things they do.
+ */
+export function deleteCredentials() {
+    const file = readCredentialsFileOrEmpty();
+    if (file.active) {
+        removeCredential(file.active);
+        return;
+    }
+    deleteAllCredentials();
+}
+/** The store, or an empty one — for the write paths, which create on demand. */
+function readCredentialsFileOrEmpty() {
+    try {
+        return readCredentialsFile() ?? { version: 2, active: null, credentials: {} };
+    }
+    catch {
+        // A corrupt file must not wedge `login` — overwriting it is how the user
+        // gets unstuck, and the token in it is unusable anyway.
+        return { version: 2, active: null, credentials: {} };
+    }
+}
+function isCredentialsFile(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    if (v.version !== 2)
+        return false;
+    if (v.active !== null && typeof v.active !== 'string')
+        return false;
+    if (!v.credentials || typeof v.credentials !== 'object')
+        return false;
+    return Object.values(v.credentials).every(isStoredCredentials);
+}
 /**
  * True if the credentials' `expiresAt` is in the past relative to `now`.
  */

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAmB9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnC,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB,EAAE,MAAY,IAAI,IAAI,EAAE;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,GAAG,KAAK,IAAI;QACd,OAAQ,CAAC,CAAC,GAA+B,CAAC,EAAE,KAAK,QAAQ;QACzD,OAAQ,CAAC,CAAC,GAA+B,CAAC,IAAI,KAAK,QAAQ;QAC3D,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,OAAQ,CAAC,CAAC,IAAgC,CAAC,EAAE,KAAK,QAAQ;QAC1D,OAAQ,CAAC,CAAC,IAAgC,CAAC,KAAK,KAAK,QAAQ,CAC9D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAoC9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAED,0BAA0B;IAC1B,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAE7C,yEAAyE;IACzE,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;YACrB,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,yBAAyB;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;SACtE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;IAE1E,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAC/B,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,OAAO,CAAC;QAClB,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChB,CAAC,UAAU,EAAE,MAAM,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,MAAM,aAAa,OAAO,CAAC,MAAM,0BAA0B,IAAI,GAAG;gBACpE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,uBAAuB,CAC/B,iCAAiC,MAAM,YAAY;QACjD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAChE,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3B,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,GAAG,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;IAClB,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnC,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,oBAAoB,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACpD,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,SAAS,CAAC,MAAM,CAAC;AAC1B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,SAAS,0BAA0B;IACjC,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,wDAAwD;QACxD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAsC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAC5F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB,EAAE,MAAY,IAAI,IAAI,EAAE;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,GAAG,KAAK,IAAI;QACd,OAAQ,CAAC,CAAC,GAA+B,CAAC,EAAE,KAAK,QAAQ;QACzD,OAAQ,CAAC,CAAC,GAA+B,CAAC,IAAI,KAAK,QAAQ;QAC3D,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,OAAQ,CAAC,CAAC,IAAgC,CAAC,EAAE,KAAK,QAAQ;QAC1D,OAAQ,CAAC,CAAC,IAAgC,CAAC,KAAK,KAAK,QAAQ,CAC9D,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-cli",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "description": "Bridge platform CLI for AI coding agents and developers",
   "author": "Nebulr Group",
   "license": "MIT",