@pungoyal/kite-cli 0.1.1 → 0.2.0

package/dist/commands/auth.js

@@ -1,12 +1,13 @@
 import { isCancel, note, password, text } from '@clack/prompts';
 import { buildLoginUrl, computeChecksum, generateState, openBrowser, redirectUrlFor, waitForCallback, } from '../core/auth.js';
-import { SANDBOX_CREDENTIALS, saveConfig } from '../core/config.js';
+import { loadConfig, SANDBOX_CREDENTIALS, saveConfig } from '../core/config.js';
 import { deleteAllSecrets, getSecret, keyringAvailable, setSecret } from '../core/credentials.js';
 import { AbortedError, ExitCode, KiteCliError } from '../core/errors.js';
+import { getProfile, listProfileNames } from '../core/profiles.js';
 import { maskSecret, registerSecret } from '../core/redact.js';
 import { clearSessionMeta, isExpired, loadSessionMeta, nextTokenExpiry, saveSessionMeta, timeUntilExpiry, } from '../core/session.js';
 import { dateTime } from '../output/format.js';
-import { renderKeyValue } from '../output/table.js';
+import { printTable, renderKeyValue } from '../output/table.js';
 export const authCommands = (program, run) => {
     program
         .command('login')
@@ -20,10 +21,15 @@ export const authCommands = (program, run) => {
         .description('Invalidate the session and remove the stored access token')
         .option('--all', 'Also remove the stored API secret')
         .action(run(logout));
-    program.command('whoami').description('Show the current session and account details').action(run(whoami));
+    program
+        .command('whoami')
+        .description('Show the current session and account details')
+        .option('--all', 'List every configured profile and its session status')
+        .action(run(whoami));
 };
 async function login(ctx, opts) {
     const { io } = ctx;
+    const profileName = ctx.profile.name;
     if (!opts.force && ctx.client.hasSession() && ctx.session && !isExpired(ctx.session)) {
         io.success(`Already logged in as ${io.bold(ctx.session.userName ?? ctx.session.userId)} ` +
             `(expires in ${timeUntilExpiry(ctx.session)}).`);
@@ -31,8 +37,11 @@ async function login(ctx, opts) {
         return;
     }
     const isSandbox = ctx.env === 'sandbox';
+    if (profileName !== 'default' && !isSandbox) {
+        io.info(`Logging in to profile ${io.bold(profileName)}.`);
+    }
     // --- credentials -------------------------------------------------------
-    let apiKey = opts.apiKey ?? (isSandbox ? SANDBOX_CREDENTIALS.apiKey : (ctx.config.apiKey ?? ''));
+    let apiKey = opts.apiKey ?? (isSandbox ? SANDBOX_CREDENTIALS.apiKey : ctx.profile.apiKey);
     let apiSecret;
     if (isSandbox) {
         apiKey = SANDBOX_CREDENTIALS.apiKey;
@@ -43,7 +52,7 @@ async function login(ctx, opts) {
         if (!apiKey) {
             apiKey = await promptText('Kite Connect API key', 'Create an app at https://developers.kite.trade to get one.');
         }
-        const stored = await getSecret('api_secret', { env: ctx.env });
+        const stored = await getSecret('api_secret', { scope: ctx.credentialScope });
         if (stored && !opts.force) {
             apiSecret = stored.value;
             io.info(`Using stored API secret (${maskSecret(apiSecret)}) from the ${stored.backend}.`);
@@ -83,10 +92,10 @@ async function login(ctx, opts) {
     registerSecret(session.access_token);
     // --- persist ------------------------------------------------------------
     const backend = await setSecret('access_token', session.access_token, {
-        env: ctx.env,
+        scope: ctx.credentialScope,
     });
     if (!isSandbox) {
-        await setSecret('api_secret', apiSecret, { env: ctx.env });
+        await setSecret('api_secret', apiSecret, { scope: ctx.credentialScope });
     }
     const expiresAt = nextTokenExpiry();
     await saveSessionMeta({
@@ -95,25 +104,31 @@ async function login(ctx, opts) {
         broker: session.broker,
         env: ctx.env,
         apiKey,
+        profile: profileName,
         expiresAt: expiresAt.toISOString(),
         loginTime: session.login_time,
         exchanges: session.exchanges,
         products: session.products,
     });
-    if (ctx.config.apiKey !== apiKey && !isSandbox) {
-        await saveConfig({ ...ctx.config, apiKey });
+    // Register the profile's api key so subsequent runs find it, and so a new
+    // named profile becomes discoverable in `kite profiles`. The sandbox uses the
+    // public constant, so there is nothing worth persisting for it.
+    if (!isSandbox) {
+        await persistProfileApiKey(profileName, ctx.env, apiKey);
     }
     if (io.json) {
         io.writeJson({
             user_id: session.user_id,
             user_name: session.user_name,
             env: ctx.env,
+            profile: profileName,
             expires_at: expiresAt.toISOString(),
             storage: backend,
         });
         return;
     }
-    io.success(`Logged in as ${io.bold(session.user_name ?? session.user_id)}.`);
+    const asProfile = profileName === 'default' ? '' : ` on profile ${io.bold(profileName)}`;
+    io.success(`Logged in as ${io.bold(session.user_name ?? session.user_id)}${asProfile}.`);
     io.info(`Session expires ${dateTime(expiresAt)} IST (Kite invalidates all tokens at 6 AM daily).`);
     io.info(backend === 'keyring'
         ? 'Credentials stored in your OS keyring.'
@@ -166,11 +181,12 @@ function extractState(loginUrl) {
 }
 async function logout(ctx, opts) {
     const { io } = ctx;
+    const profileName = ctx.profile.name;
     // Best-effort server-side invalidation; a failure here must not stop us
     // clearing local state, or the user is stuck with credentials they cannot
     // remove.
     if (ctx.client.hasSession()) {
-        const stored = await getSecret('access_token', { env: ctx.env });
+        const stored = await getSecret('access_token', { scope: ctx.credentialScope });
         if (stored) {
             try {
                 await ctx.api.invalidateSession(stored.value);
@@ -183,53 +199,63 @@ async function logout(ctx, opts) {
     }
     const { deleteSecret } = await import('../core/credentials.js');
     if (opts.all) {
-        await deleteAllSecrets({ env: ctx.env });
+        await deleteAllSecrets({ scope: ctx.credentialScope });
     }
     else {
-        await deleteSecret('access_token', { env: ctx.env });
+        await deleteSecret('access_token', { scope: ctx.credentialScope });
     }
-    await clearSessionMeta();
+    await clearSessionMeta(profileName);
+    const onProfile = profileName === 'default' ? '' : ` (profile ${io.bold(profileName)})`;
     if (io.json) {
-        io.writeJson({ logged_out: true, removed_api_secret: Boolean(opts.all) });
+        io.writeJson({ logged_out: true, profile: profileName, removed_api_secret: Boolean(opts.all) });
         return;
     }
-    io.success(opts.all ? 'Logged out and removed the stored API secret.' : 'Logged out.');
+    io.success(opts.all ? `Logged out and removed the stored API secret${onProfile}.` : `Logged out${onProfile}.`);
     if (!opts.all)
         io.info('Your API secret is still stored. Use `kite logout --all` to remove it.');
 }
-async function whoami(ctx) {
+async function whoami(ctx, opts) {
+    if (opts.all) {
+        await whoamiAll(ctx);
+        return;
+    }
     const { io } = ctx;
-    const meta = await loadSessionMeta();
+    const profileName = ctx.profile.name;
+    const meta = await loadSessionMeta(profileName);
     if (!ctx.client.hasSession()) {
         // Exit non-zero in both modes: a script checking `kite whoami` must be able
         // to branch on the exit code, not parse stdout.
         process.exitCode = ExitCode.Auth;
         if (io.json) {
-            io.writeJson({ logged_in: false });
+            io.writeJson({ logged_in: false, profile: profileName });
             return;
         }
-        io.error('Not logged in.');
-        io.info('Run `kite login` to start a session.');
+        io.error(profileName === 'default' ? 'Not logged in.' : `Not logged in to profile "${profileName}".`);
+        io.info(profileName === 'default'
+            ? 'Run `kite login` to start a session.'
+            : `Run \`kite --profile ${profileName} login\`.`);
         return;
     }
     // Hit the API so this reflects reality, not just what we cached.
-    const profile = await ctx.api.getProfile(ctx.signal);
+    const account = await ctx.api.getProfile(ctx.signal);
     if (io.json) {
         io.writeJson({
             logged_in: true,
             env: ctx.env,
+            profile: profileName,
             expires_at: meta?.expiresAt,
-            profile,
+            account,
         });
         return;
     }
     io.line(renderKeyValue(io, [
-        ['User', `${profile.user_name ?? '—'} (${profile.user_id})`],
-        ['Email', profile.email ?? '—'],
-        ['Broker', profile.broker ?? '—'],
+        ['Profile', profileName === 'default' ? profileName : io.bold(profileName)],
+        ['User', `${account.user_name ?? '—'} (${account.user_id})`],
+        ['Email', account.email ?? '—'],
+        ['Broker', account.broker ?? '—'],
         ['Environment', ctx.env === 'sandbox' ? io.cyan('sandbox') : 'production'],
-        ['Exchanges', profile.exchanges.join(', ') || '—'],
-        ['Products', profile.products.join(', ') || '—'],
+        ['Exchanges', account.exchanges.join(', ') || '—'],
+        ['Products', account.products.join(', ') || '—'],
         [
             'Session expires',
             meta ? `${dateTime(meta.expiresAt)} IST (${timeUntilExpiry(meta)} left)` : 'unknown (token from environment)',
@@ -237,6 +263,56 @@ async function whoami(ctx) {
         ['Keyring', (await keyringAvailable()) ? 'available' : 'unavailable (using encrypted file)'],
     ]));
 }
+/** Enumerate every configured profile and its cached session, no network calls. */
+async function whoamiAll(ctx) {
+    const { io } = ctx;
+    const config = await loadConfig();
+    const rows = await Promise.all(listProfileNames(config).map(async (name) => {
+        const meta = await loadSessionMeta(name);
+        const status = !meta
+            ? io.dim('no session')
+            : isExpired(meta)
+                ? io.yellow('expired')
+                : `expires in ${timeUntilExpiry(meta)}`;
+        return {
+            profile: name,
+            env: getProfile(config, name).env,
+            user: meta?.userName ?? meta?.userId ?? '—',
+            session: status,
+            current: name === ctx.profile.name,
+        };
+    }));
+    printTable(io, rows, [
+        { header: '', value: (r) => (r.current ? io.green('●') : ' ') },
+        { header: 'Profile', value: (r) => (r.current ? io.bold(r.profile) : r.profile) },
+        { header: 'Env', value: (r) => (r.env === 'sandbox' ? io.cyan(r.env) : r.env) },
+        { header: 'User', value: (r) => r.user },
+        { header: 'Session', value: (r) => r.session },
+    ], rows.map(({ current: _current, ...rest }) => rest));
+}
+/**
+ * Persist a profile's (semi-public) api key so later runs find it. The default
+ * profile keeps its key at the top level of the config for back-compat; a named
+ * profile is registered under `profiles`, which also makes it show up in
+ * `kite profiles`. Reads the raw config fresh so the in-memory effective
+ * trading overlay is never written back.
+ */
+async function persistProfileApiKey(profileName, env, apiKey) {
+    const config = await loadConfig();
+    if (profileName === 'default') {
+        if (config.apiKey === apiKey)
+            return;
+        await saveConfig({ ...config, apiKey });
+        return;
+    }
+    const existing = config.profiles[profileName];
+    if (existing?.apiKey === apiKey && existing?.env === env)
+        return;
+    await saveConfig({
+        ...config,
+        profiles: { ...config.profiles, [profileName]: { ...existing, apiKey, env } },
+    });
+}
 async function promptText(message, hint) {
     if (!process.stdin.isTTY) {
         throw new KiteCliError(`${message} is required but this is not an interactive terminal.`, ExitCode.ConfirmationRequired, 'Supply it via a flag or environment variable.');

package/dist/commands/config.js

@@ -29,12 +29,16 @@ async function showConfig(ctx) {
         io.writeJson(config);
         return;
     }
-    const secret = await getSecret('api_secret', { env: ctx.env });
+    const secret = await getSecret('api_secret', { scope: ctx.credentialScope });
+    // Effective trading config for the active profile (global overlaid with the
+    // profile's overrides), so this view matches what a money-moving command sees.
+    const trading = ctx.config.trading;
     io.line(heading(io, 'Account'));
     io.line(renderKeyValue(io, [
-        ['API key', config.apiKey ?? io.dim('not set')],
+        ['Profile', ctx.profile.name === 'default' ? ctx.profile.name : io.bold(ctx.profile.name)],
+        ['API key', ctx.profile.apiKey || io.dim('not set')],
         ['API secret', secret ? `${maskSecret(secret.value)} (${secret.backend})` : io.dim('not set')],
-        ['Environment', config.env === 'sandbox' ? io.cyan('sandbox') : 'production'],
+        ['Environment', ctx.profile.env === 'sandbox' ? io.cyan('sandbox') : 'production'],
         [
             'Keyring',
             (await keyringAvailable()) ? io.green('available') : io.yellow('unavailable — using an encrypted file'),
@@ -42,11 +46,17 @@ async function showConfig(ctx) {
     ]));
     io.line(heading(io, 'Trading safety'));
     io.line(renderKeyValue(io, [
-        ['Trading enabled', config.trading.enabled ? io.green('yes') : io.red('no — all order commands will refuse')],
-        ['Confirm orders', config.trading.confirm ? 'yes' : io.yellow('no')],
-        ['Max order value', config.trading.maxOrderValue ? rupees(config.trading.maxOrderValue) : io.dim('no cap')],
-        ['Strict confirm above', rupees(config.trading.strictConfirmAbove)],
+        ['Trading enabled', trading.enabled ? io.green('yes') : io.red('no — all order commands will refuse')],
+        ['Confirm orders', trading.confirm ? 'yes' : io.yellow('no')],
+        ['Max order value', trading.maxOrderValue ? rupees(trading.maxOrderValue) : io.dim('no cap')],
+        ['Strict confirm above', rupees(trading.strictConfirmAbove)],
     ]));
+    const others = Object.keys(config.profiles);
+    if (others.length > 0) {
+        io.line(heading(io, 'Profiles'));
+        io.line(renderKeyValue(io, [['Configured', ['default', 'sandbox', ...others].join(', ')]]));
+        io.note(io.dim('  Manage them with `kite profiles`.'));
+    }
     io.line(heading(io, 'Login callback'));
     io.line(renderKeyValue(io, [
         ['Redirect URL', redirectUrlFor(config.redirectPort, config.redirectPath)],
@@ -78,7 +88,22 @@ async function setConfig(ctx, _opts, command) {
     const config = await loadConfig();
     const coerced = coerce(rawValue, SETTABLE_KEYS[key].type, key);
     const updated = structuredClone(config);
-    writePath(updated, key, coerced);
+    const target = ctx.profile.name;
+    if (target === 'default') {
+        writePath(updated, key, coerced);
+    }
+    else {
+        // Only account- and trading-scoped keys make sense per profile; global
+        // presentation/callback settings would be silently ignored, so refuse them.
+        if (!isProfileScopedKey(key)) {
+            throw new UsageError(`"${key}" is a global setting.`, 'Drop --profile to set it globally.');
+        }
+        const profiles = (updated.profiles ?? {});
+        updated.profiles = profiles;
+        const entry = (profiles[target] ?? {});
+        profiles[target] = entry;
+        writePath(entry, key, coerced);
+    }
     const parsed = ConfigSchema.safeParse(updated);
     if (!parsed.success) {
         const { z } = await import('zod');
@@ -86,10 +111,11 @@ async function setConfig(ctx, _opts, command) {
     }
     await saveConfig(parsed.data);
     if (ctx.io.json) {
-        ctx.io.writeJson({ key, value: coerced });
+        ctx.io.writeJson({ key, value: coerced, profile: target });
         return;
     }
-    ctx.io.success(`Set ${ctx.io.bold(key)} to ${JSON.stringify(coerced)}.`);
+    const onProfile = target === 'default' ? '' : ` on profile ${ctx.io.bold(target)}`;
+    ctx.io.success(`Set ${ctx.io.bold(key)} to ${JSON.stringify(coerced)}${onProfile}.`);
     if (key === 'trading.enabled' && coerced === false) {
         ctx.io.info('The kill switch is on. All order commands will now refuse before contacting Kite.');
     }
@@ -107,7 +133,19 @@ async function unsetConfig(ctx, _opts, command) {
     }
     const config = await loadConfig();
     const updated = structuredClone(config);
-    deletePath(updated, key);
+    const target = ctx.profile.name;
+    if (target === 'default') {
+        deletePath(updated, key);
+    }
+    else {
+        if (!isProfileScopedKey(key)) {
+            throw new UsageError(`"${key}" is a global setting.`, 'Drop --profile to unset it globally.');
+        }
+        const profiles = (updated.profiles ?? {});
+        const entry = profiles[target];
+        if (entry)
+            deletePath(entry, key);
+    }
     const parsed = ConfigSchema.safeParse(updated);
     if (!parsed.success) {
         const { z } = await import('zod');
@@ -115,10 +153,11 @@ async function unsetConfig(ctx, _opts, command) {
     }
     await saveConfig(parsed.data);
     if (ctx.io.json) {
-        ctx.io.writeJson({ key, unset: true });
+        ctx.io.writeJson({ key, unset: true, profile: target });
         return;
     }
-    ctx.io.success(`Unset ${ctx.io.bold(key)}.`);
+    const onProfile = target === 'default' ? '' : ` on profile ${ctx.io.bold(target)}`;
+    ctx.io.success(`Unset ${ctx.io.bold(key)}${onProfile}.`);
 }
 async function showPaths(ctx) {
     const { io } = ctx;
@@ -139,6 +178,10 @@ async function showPaths(ctx) {
     ]));
 }
 // ---------------------------------------------------------------------------
+/** Keys that mean something per profile; the rest are global (output, callback). */
+function isProfileScopedKey(key) {
+    return key === 'apiKey' || key === 'env' || key.startsWith('trading.');
+}
 /** Coerce an argv string to the type the setting declares. */
 function coerce(raw, type, key) {
     if (type === 'boolean') {

package/dist/commands/profiles.d.ts

@@ -0,0 +1,10 @@
+import type { CommandFactory } from './types.js';
+/**
+ * Account profile management.
+ *
+ * Selection itself is stateless (`--profile` / KITE_PROFILE, resolved every
+ * run); these commands only manage the persisted set of profiles and the
+ * rarely-changed default. Logging in is deliberately left to `kite login` so
+ * credential handling lives in exactly one place.
+ */
+export declare const profileCommands: CommandFactory;

package/dist/commands/profiles.js

@@ -0,0 +1,213 @@
+import { confirm, isCancel } from '@clack/prompts';
+import { EnvironmentSchema, loadConfig, saveConfig } from '../core/config.js';
+import { deleteAllSecrets } from '../core/credentials.js';
+import { AbortedError, ExitCode, KiteCliError, UsageError } from '../core/errors.js';
+import { assertValidProfileName, DEFAULT_PROFILE, getProfile, isKnownProfile, listProfileNames, RESERVED_PROFILES, storagePrefixFor, } from '../core/profiles.js';
+import { clearSessionMeta, isExpired, loadSessionMeta, timeUntilExpiry } from '../core/session.js';
+import { printTable, renderKeyValue } from '../output/table.js';
+/**
+ * Account profile management.
+ *
+ * Selection itself is stateless (`--profile` / KITE_PROFILE, resolved every
+ * run); these commands only manage the persisted set of profiles and the
+ * rarely-changed default. Logging in is deliberately left to `kite login` so
+ * credential handling lives in exactly one place.
+ */
+export const profileCommands = (program, run) => {
+    const profiles = program.command('profiles').description('Manage account profiles for multiple Zerodha accounts');
+    profiles
+        .command('list', { isDefault: true })
+        .alias('ls')
+        .description('List configured profiles and their session status')
+        .action(run(listProfiles));
+    profiles
+        .command('add')
+        .description('Register a new account profile (does not log in)')
+        .argument('<name>', 'A short label, e.g. personal or huf')
+        .option('--api-key <key>', 'Kite Connect API key for this account')
+        // `--env` is a global option; it cannot be redeclared here without being
+        // shadowed by the root parser, so `addProfile` reads it from ctx.options.
+        .option('--max-order-value <rupees>', 'Per-profile cap on any single order')
+        .action(run(addProfile));
+    profiles
+        .command('remove')
+        .alias('rm')
+        .description('Delete a profile and its stored credentials')
+        .argument('<name>')
+        .action(run(removeProfile));
+    profiles
+        .command('use')
+        .description('Set the default profile for future commands')
+        .argument('<name>')
+        .action(run(useProfile));
+    profiles.command('current').description('Show the profile this invocation resolves to').action(run(currentProfile));
+};
+async function listProfiles(ctx) {
+    const { io } = ctx;
+    const config = await loadConfig();
+    const rows = await Promise.all(listProfileNames(config).map(async (name) => {
+        const profile = getProfile(config, name);
+        const meta = await loadSessionMeta(name);
+        return {
+            profile: name,
+            env: profile.env,
+            api_key: Boolean(profile.apiKey),
+            default: (config.defaultProfile ?? DEFAULT_PROFILE) === name,
+            current: name === ctx.profile.name,
+            session: !meta
+                ? io.dim('no session')
+                : isExpired(meta)
+                    ? io.yellow('expired')
+                    : `expires in ${timeUntilExpiry(meta)}`,
+        };
+    }));
+    printTable(io, rows, [
+        { header: '', value: (r) => (r.current ? io.green('●') : ' ') },
+        { header: 'Profile', value: (r) => (r.current ? io.bold(r.profile) : r.profile) },
+        { header: 'Env', value: (r) => (r.env === 'sandbox' ? io.cyan(r.env) : r.env) },
+        { header: 'API key', value: (r) => (r.api_key ? io.green('set') : io.dim('—')) },
+        { header: 'Default', value: (r) => (r.default ? '✓' : ' ') },
+        { header: 'Session', value: (r) => r.session },
+    ], rows.map(({ current: _current, ...rest }) => rest));
+    if (!io.json) {
+        io.note('');
+        io.info('Target a profile with `--profile <name>`, or set a default with `kite profiles use <name>`.');
+    }
+}
+async function addProfile(ctx, opts, command) {
+    const { io } = ctx;
+    const name = command.args[0];
+    if (!name)
+        throw new UsageError('A profile name is required, e.g. `kite profiles add personal`.');
+    assertValidProfileName(name);
+    if (RESERVED_PROFILES.includes(name)) {
+        throw new UsageError(`"${name}" is a reserved profile and always exists.`);
+    }
+    const config = await loadConfig();
+    if (isKnownProfile(config, name)) {
+        throw new UsageError(`Profile "${name}" already exists.`, 'Use `kite profiles remove` first, or pick another name.');
+    }
+    const entry = {};
+    if (opts.apiKey)
+        entry.apiKey = opts.apiKey;
+    // The global `--env` lands in ctx.options (see the command definition). It was
+    // already validated by profile resolution, so re-check defensively only.
+    if (ctx.options.env) {
+        const parsed = EnvironmentSchema.safeParse(ctx.options.env);
+        if (!parsed.success) {
+            throw new UsageError(`Unknown environment "${ctx.options.env}". Expected "production" or "sandbox".`);
+        }
+        entry.env = parsed.data;
+    }
+    if (opts.maxOrderValue !== undefined) {
+        const cap = Number(opts.maxOrderValue);
+        if (!Number.isFinite(cap) || cap <= 0)
+            throw new UsageError(`--max-order-value must be a positive number.`);
+        entry.trading = { maxOrderValue: cap };
+    }
+    await saveConfig({ ...config, profiles: { ...config.profiles, [name]: entry } });
+    if (io.json) {
+        io.writeJson({ added: name, ...entry });
+        return;
+    }
+    io.success(`Added profile ${io.bold(name)}.`);
+    io.info(`Log in with \`kite --profile ${name} login\`.`);
+}
+async function removeProfile(ctx, _opts, command) {
+    const { io } = ctx;
+    const name = command.args[0];
+    if (!name)
+        throw new UsageError('A profile name is required.');
+    if (RESERVED_PROFILES.includes(name)) {
+        throw new UsageError(`The reserved profile "${name}" cannot be removed.`);
+    }
+    const config = await loadConfig();
+    if (!isKnownProfile(config, name)) {
+        throw new UsageError(`No profile named "${name}".`, 'Run `kite profiles list` to see what exists.');
+    }
+    await confirmDestructive(ctx, `Remove profile "${name}" and its stored credentials?`);
+    // Drop the token and secret for this profile, then its session and config entry.
+    const scope = storagePrefixFor(getProfile(config, name));
+    await deleteAllSecrets({ scope });
+    await clearSessionMeta(name);
+    const profiles = { ...config.profiles };
+    delete profiles[name];
+    const next = { ...config, profiles };
+    // If this was the default, fall back to the reserved default rather than
+    // leaving a dangling pointer.
+    if (config.defaultProfile === name)
+        delete next.defaultProfile;
+    await saveConfig(next);
+    if (io.json) {
+        io.writeJson({ removed: name });
+        return;
+    }
+    io.success(`Removed profile ${io.bold(name)}.`);
+}
+async function useProfile(ctx, _opts, command) {
+    const { io } = ctx;
+    const name = command.args[0];
+    if (!name)
+        throw new UsageError('A profile name is required.');
+    assertValidProfileName(name);
+    const config = await loadConfig();
+    if (!isKnownProfile(config, name)) {
+        throw new UsageError(`No profile named "${name}".`, 'Create it first with `kite profiles add`.');
+    }
+    // Storing the reserved default as the pointer is just noise; clearing it says
+    // the same thing.
+    const next = { ...config };
+    if (name === DEFAULT_PROFILE)
+        delete next.defaultProfile;
+    else
+        next.defaultProfile = name;
+    await saveConfig(next);
+    const meta = await loadSessionMeta(name);
+    if (io.json) {
+        io.writeJson({ default_profile: name, user_id: meta?.userId ?? null });
+        return;
+    }
+    io.success(`Default profile is now ${io.bold(name)}.`);
+    // Loud, because a persisted default silently changes which account every
+    // later command targets — the exact thing a multi-account user must not lose
+    // track of. The identity is echoed so they can confirm it is who they meant.
+    const who = meta ? `${meta.userName ?? meta.userId} (${meta.userId})` : io.dim('not logged in yet');
+    io.warn(`Every command without --profile will now use ${io.bold(name)} — ${who}.`);
+}
+async function currentProfile(ctx) {
+    const { io, profile } = ctx;
+    const meta = await loadSessionMeta(profile.name);
+    if (io.json) {
+        io.writeJson({
+            profile: profile.name,
+            env: profile.env,
+            logged_in: ctx.client.hasSession(),
+            user_id: meta?.userId ?? null,
+        });
+        return;
+    }
+    io.line(renderKeyValue(io, [
+        ['Profile', profile.name === DEFAULT_PROFILE ? profile.name : io.bold(profile.name)],
+        ['Environment', profile.env === 'sandbox' ? io.cyan('sandbox') : 'production'],
+        ['API key', profile.apiKey ? io.green('set') : io.dim('not set')],
+        [
+            'Session',
+            !ctx.client.hasSession()
+                ? io.dim('not logged in')
+                : meta
+                    ? `${meta.userName ?? meta.userId} (${meta.userId}), expires in ${timeUntilExpiry(meta)}`
+                    : 'token from environment',
+        ],
+    ]));
+}
+/** A yes/no gate that respects --yes and refuses (rather than proceeds) without a TTY. */
+async function confirmDestructive(ctx, message) {
+    if (ctx.options.yes)
+        return;
+    if (!process.stdin.isTTY || !ctx.io.stderrIsTty) {
+        throw new KiteCliError(`${message} needs confirmation, but this is not an interactive terminal.`, ExitCode.ConfirmationRequired, 'Pass --yes to confirm non-interactively.');
+    }
+    const answer = await confirm({ message, initialValue: false });
+    if (isCancel(answer) || answer !== true)
+        throw new AbortedError();
+}

package/dist/commands/watch.js

@@ -72,7 +72,7 @@ async function watch(ctx, opts, command) {
     }
     const tokenToKey = new Map(watchlist.map((entry) => [entry.token, entry.key]));
     // --- credentials for the socket ----------------------------------------
-    const stored = await getSecret('access_token', { env: ctx.env });
+    const stored = await getSecret('access_token', { scope: ctx.credentialScope });
     if (!stored) {
         throw new KiteCliError('No access token available for streaming.', ExitCode.Auth, 'Run `kite login`.');
     }

package/dist/context.d.ts

@@ -2,6 +2,7 @@ import { KiteApi } from './core/api.js';
 import { KiteClient } from './core/client.js';
 import { type Config, type Endpoints, type Environment } from './core/config.js';
 import { InstrumentStore } from './core/instruments.js';
+import { type ResolvedProfile } from './core/profiles.js';
 import { type SessionMeta } from './core/session.js';
 import { Io, type IoStreams } from './output/io.js';
 /**
@@ -18,6 +19,7 @@ export interface GlobalOptions {
     quiet?: boolean;
     debug?: boolean;
     env?: string;
+    profile?: string;
     yes?: boolean;
     dryRun?: boolean;
 }
@@ -25,6 +27,10 @@ export interface Context {
     io: Io;
     config: Config;
     env: Environment;
+    /** The account this invocation targets. */
+    profile: ResolvedProfile;
+    /** Keyring / file namespace prefix for this profile's secrets. */
+    credentialScope: string;
     endpoints: Endpoints;
     client: KiteClient;
     api: KiteApi;