@tonbo/cli 0.11.1 → 0.13.0

package/dist/bin/tonbo.js

@@ -4,185 +4,6 @@
 import { Command, InvalidArgumentError, Option } from "commander";
 import { readFileSync } from "node:fs";
 
-// ../../packages/tonbo-cli-core/dist/src/auth.js
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { execFile } from "node:child_process";
-import os2 from "node:os";
-import { promisify } from "node:util";
-
-// ../../packages/tonbo-cli-core/dist/src/callback-page.js
-var WORDMARK = [
-  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
-  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
-].join("\n");
-var OUTCOMES = {
-  complete: {
-    status: 200,
-    title: "You are signed in.",
-    body: "Return to your terminal. This tab can be closed."
-  },
-  denied: {
-    status: 400,
-    title: "Login was not completed.",
-    body: "Nothing was authorized. Return to your terminal to try again."
-  },
-  invalid: {
-    // The state did not match, the code was missing, or the path was wrong.
-    // Say that it could not be verified rather than which check failed: the
-    // person who can read this page is not necessarily the one who started
-    // the login.
-    status: 400,
-    title: "This callback could not be verified.",
-    body: "Return to your terminal and start the login again."
-  }
-};
-function renderCallbackPage(outcome) {
-  const { title, body } = OUTCOMES[outcome];
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex">
-<title>Tonbo CLI</title>
-<style>
-  :root {
-    --paper: #f3f2ee;
-    --ink: #1d1b17;
-    --rule: #c9c5ba;
-    --quiet: #5c564a;
-    --signal: #d64a03;
-  }
-  @media (prefers-color-scheme: dark) {
-    :root {
-      --paper: #1d1b17;
-      --ink: #f3f2ee;
-      --rule: #3a362e;
-      --quiet: #a49e8f;
-      --signal: #f08b4b;
-    }
-  }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: grid;
-    grid-template-rows: auto 1fr;
-    padding: 0 clamp(20px, 5vw, 72px);
-    background: var(--paper);
-    color: var(--ink);
-    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;
-    -webkit-font-smoothing: antialiased;
-  }
-  header { padding: 28px 0; }
-  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
-     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
-     what makes the rows meet without seams. Iosevka is not available here,
-     so it falls back to the platform monospace. */
-  pre.wordmark {
-    margin: 0;
-    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
-    font-size: 8px;
-    font-weight: 400;
-    line-height: 10px;
-    letter-spacing: 0;
-    white-space: pre;
-    color: var(--signal);
-    transform: scaleY(0.8);
-    transform-origin: left top;
-  }
-  main {
-    display: flex;
-    flex-direction: column;
-    justify-content: center;
-    max-width: 46ch;
-    padding-bottom: 12vh;
-  }
-  h1 {
-    margin: 0;
-    font-size: 26px;
-    font-weight: 300;
-    line-height: 1.16;
-    letter-spacing: -0.018em;
-  }
-  p {
-    margin: 14px 0 0;
-    font-size: 16px;
-    line-height: 1.55;
-    color: var(--quiet);
-  }
-  hr {
-    width: 40px;
-    margin: 28px 0 0;
-    border: 0;
-    border-top: 1px solid var(--rule);
-  }
-</style>
-</head>
-<body>
-<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
-<main>
-  <h1>${title}</h1>
-  <p>${body}</p>
-  <hr>
-</main>
-</body>
-</html>
-`;
-}
-function callbackResponse(outcome) {
-  return {
-    status: OUTCOMES[outcome].status,
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store"
-    },
-    body: renderCallbackPage(outcome)
-  };
-}
-
-// ../../packages/tonbo-cli-core/dist/src/http.js
-var HttpError = class extends Error {
-  status;
-  body;
-  requestId;
-  constructor(message, status, body, requestId) {
-    super(message);
-    this.status = status;
-    this.body = body;
-    this.requestId = requestId;
-  }
-  /** The problem `code` of a Management API refusal, such as `unauthenticated`. */
-  get code() {
-    const record = this.body && typeof this.body === "object" ? this.body : {};
-    const code = record.code;
-    return typeof code === "string" ? code : null;
-  }
-};
-async function requestJson(fetcher, url, init = {}) {
-  const response = await fetcher(url, init);
-  const body = await response.json().catch(() => null);
-  if (response.ok)
-    return body;
-  const record = body && typeof body === "object" ? body : {};
-  const reason = [record.detail, record.title, record.error].find((value) => typeof value === "string" && value.length > 0);
-  const requestId = response.headers.get("x-request-id") ?? (typeof record.request_id === "string" ? record.request_id : null);
-  const issues = Array.isArray(record.errors) ? record.errors.filter((issue) => typeof issue?.field === "string" && typeof issue.code === "string").map((issue) => `${issue.field}: ${issue.code}`) : [];
-  const message = [
-    reason ?? `Request failed with HTTP ${response.status}.`,
-    ...issues.length ? [`(${issues.join(", ")})`] : []
-  ].join(" ");
-  throw new HttpError(requestId ? `${message} (request ${requestId})` : message, response.status, body, requestId);
-}
-
-// ../../packages/tonbo-cli-core/dist/src/credentials.js
-import { randomUUID } from "node:crypto";
-import { chmod, lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-
 // ../../packages/tonbo-cli-core/dist/src/generated/contracts.js
 var agentNameContract = {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
@@ -512,7 +333,9 @@ var managementOperations = {
     "method": "GET",
     "path": "/usage/today",
     "pathParams": [],
-    "query": [],
+    "query": [
+      "tz"
+    ],
     "idempotencyKey": false,
     "cli": "tonbo usage today"
   },
@@ -592,7 +415,8 @@ var managementOperations = {
     "pathParams": [],
     "query": [
       "after",
-      "wait"
+      "wait",
+      "include"
     ],
     "idempotencyKey": false
   },
@@ -765,6 +589,61 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "listYieldQuestions": {
+    "method": "GET",
+    "path": "/yield/questions",
+    "pathParams": [],
+    "query": [
+      "team",
+      "limit"
+    ],
+    "idempotencyKey": false
+  },
+  "createYieldQuestion": {
+    "method": "POST",
+    "path": "/yield/questions",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
+  "showYieldQuestion": {
+    "method": "GET",
+    "path": "/yield/questions/{id}",
+    "pathParams": [
+      "id"
+    ],
+    "query": [],
+    "idempotencyKey": false
+  },
+  "replyYieldQuestion": {
+    "method": "POST",
+    "path": "/yield/questions/{id}/replies",
+    "pathParams": [
+      "id"
+    ],
+    "query": [],
+    "idempotencyKey": false
+  },
+  "closeYieldQuestion": {
+    "method": "POST",
+    "path": "/yield/questions/{id}/close",
+    "pathParams": [
+      "id"
+    ],
+    "query": [],
+    "idempotencyKey": false
+  },
+  "listYieldDecisions": {
+    "method": "GET",
+    "path": "/yield/decisions",
+    "pathParams": [],
+    "query": [
+      "project",
+      "path",
+      "limit"
+    ],
+    "idempotencyKey": false
+  },
   "listDatabases": {
     "method": "GET",
     "path": "/databases",
@@ -1056,7 +935,7 @@ var apiKeyExpirations = [
 ];
 var credentialsContract = {
   "version": 1,
-  "description": "The login `tonbo login` (and `yield login`) saves: a personal key of one account at the top level, the login made last, and, beside it, every account's login of this device in `accounts` with the device's `login_secret` (ADR-0016, \"Credentials\", PR 4b-ii). @tonbo/cli-core writes and reads it; the Tonbo SDK (@tonbo/sdk and tonbo-sdk, contracts/sdk/v1.json) reads it as its last key source, and every other reader follows `reader` and reads the top level alone.",
+  "description": "Legacy from ADR-0018: the per-account CLI login of @tonbo/cli 0.11 and @tonbo/yield 0.3. From @tonbo/cli 0.12 and @tonbo/yield 0.4 a login is one session of the person in login.json (credentials-v2.json); clients read this file only as the fallback when login.json is missing, and the per-account keys it holds were retired when those CLIs shipped (founder, 2026-11-03): User Center issues them no more (access-token-v1.json `cli_session.login.retired`) and the live ones were revoked, so no client writes this file any longer. Before that: the login `tonbo login` (and `yield login`) saves: a personal key of one account at the top level, the login made last, and, beside it, every account's login of this device in `accounts` with the device's `login_secret` (ADR-0016, \"Credentials\", PR 4b-ii). @tonbo/cli-core writes and reads it; the Tonbo SDK (@tonbo/sdk and tonbo-sdk, contracts/sdk/v1.json) reads it as its last key source, and every other reader follows `reader` and reads the top level alone.",
   "path": {
     "description": "`${XDG_CONFIG_HOME}/tonbo/credentials.json` when XDG_CONFIG_HOME is set and not empty, else `${HOME}/.config/tonbo/credentials.json`.",
     "base_env": "XDG_CONFIG_HOME",
@@ -1095,11 +974,11 @@ var credentialsContract = {
     "login_hint": "tonbo login"
   },
   "accounts": {
-    "description": "One CLI login key per account (ADR-0016 R7 (a)): a daemon that publishes into an organization holds that organization's key beside the personal account's, since a key reaches only its own account. The fields are additive and optional, so a version 1 reader that knows only the top level keeps working, and the format stays version 1.",
+    "description": "Retiring with ADR-0018: a session reaches every account through per-account tokens, so no client writes per-account keys once @tonbo/cli 0.12 and @tonbo/yield 0.4 ship. One CLI login key per account (ADR-0016 R7 (a)): a daemon that publishes into an organization holds that organization's key beside the personal account's, since a key reaches only its own account. The fields are additive and optional, so a version 1 reader that knows only the top level keeps working, and the format stays version 1.",
     "top_level": "The login made last, by `tonbo login` or `yield login`: the account `tonbo` acts in. A login made only to publish into an organization (`yield connect --account`) is added to `accounts` and leaves the top level alone.",
     "entries": "`accounts` maps an account id to that account's login on this device, the top level's account included. `kind` and `name` are the redemption's answer; a file written before them, or by a server that does not answer them, has the top level alone, whose kind a client asks the API for.",
     "personal": "The entry whose kind is `user` is the person's personal account's login: it alone captures raw sessions and registers the device (ADR-0016 W-10, W-14).",
-    "login_secret": "One random per-device secret, 32 bytes base64url, made at the first login and kept: it is sent only in the redeem POST, beside the PKCE verifier, never in the /cli/login URL, and User Center keeps only the suffix it derives from it, in an organization key's name `Yield CLI \xB7 <8 hex>`. `tonbo` and `yield` share it through this file, and so share one key per account. A lost file sends a new secret and gets a new suffix; the old key stays until it is revoked or idles out."
+    "login_secret": "Retiring with ADR-0018. One random per-device secret, 32 bytes base64url, made at the first login and kept: it is sent only in the redeem POST, beside the PKCE verifier, never in the /cli/login URL, and User Center keeps only the suffix it derives from it, in an organization key's name `Yield CLI \xB7 <8 hex>`. `tonbo` and `yield` share it through this file, and so share one key per account. A lost file sends a new secret and gets a new suffix; the old key stays until it is revoked or idles out."
   },
   "current_version": 1,
   "schema": {
@@ -1326,864 +1205,1940 @@ var credentialsContract = {
     ]
   }
 };
-var machineIdleActions = [
-  "suspend",
-  "release"
-];
-var machinePortAccess = [
-  "private",
-  "public"
-];
-var machineTimings = {
-  "pollAfterSeconds": 2,
-  "sleepPollAfterSeconds": 5,
-  "wakeHoldSeconds": 25,
-  "earlyReclaimSeconds": 120
-};
-
-// ../../packages/tonbo-cli-core/dist/src/credentials.js
-var DIRECTORY_MODE = Number.parseInt(credentialsContract.permissions.directory_mode, 8);
-var FILE_MODE = Number.parseInt(credentialsContract.permissions.file_mode, 8);
-var REFUSED_MODE_BITS = Number.parseInt(credentialsContract.reader.refuse_mode_bits, 8);
-function defaultCredentialsPath(env = process.env) {
-  const rule = credentialsContract.path;
-  const base = env[rule.base_env] || path.join(...rule.fallback_base.map((part) => part === "$HOME" ? os.homedir() : part));
-  return path.join(base, ...rule.relative);
-}
-function isExpiredLogin(login, now = Date.now()) {
-  return login.expires_at !== null && Date.parse(login.expires_at) <= now;
-}
-var UnusableLoginError = class extends Error {
-};
-var FileCredentialStore = class {
-  filename;
-  loginHint;
-  constructor(filename = defaultCredentialsPath(), loginHint = credentialsContract.reader.login_hint) {
-    this.filename = filename;
-    this.loginHint = loginHint;
+var loginContract = {
+  "version": 2,
+  "description": "The CLI login `tonbo login` (and `yield login`) saves from @tonbo/cli 0.12 and @tonbo/yield 0.4 (ADR-0018): one session of the person per computer, tied to the computer's device id, that reaches every account the person belongs to only through per-account access tokens exchanged at POST /api/iam/token (contracts/iam/access-token-v1.json `cli_session`). It is a new file beside credentials-v1.json's, not a version 2 of it, so a reader of version 1 never sees it and never overwrites it. @tonbo/cli-core writes and reads it; the Tonbo SDK (contracts/sdk/v1.json) reads it before the legacy file.",
+  "path": {
+    "description": "`${XDG_CONFIG_HOME}/tonbo/login.json` when XDG_CONFIG_HOME is set and not empty, else `${HOME}/.config/tonbo/login.json`.",
+    "base_env": "XDG_CONFIG_HOME",
+    "fallback_base": [
+      "$HOME",
+      ".config"
+    ],
+    "relative": [
+      "tonbo",
+      "login.json"
+    ]
+  },
+  "permissions": {
+    "description": "POSIX only; a reader on Windows skips the mode checks. The same rules as credentials-v1.json.",
+    "directory_mode": "0700",
+    "file_mode": "0600",
+    "writer": "The writer creates the directory 0700, writes a temporary file 0600 beside the target, syncs it and renames it over the target, so a crash never leaves a partial login. It refuses to replace or remove a symlink or anything that is not a regular file."
+  },
+  "key_sources": {
+    "description": "Where a client takes its credential, first match wins. A library takes an explicit option first; the CLIs have none. `env` is an API key of one account (TONBO_API_KEY, contracts/iam/access-token-v1.json `personal_key`), which binds the client to the key's account. `file` is this login, then the legacy file of credentials-v1.json, which a client reads only when this file is missing.",
+    "order": [
+      "option",
+      "env",
+      "file"
+    ],
+    "env": "TONBO_API_KEY",
+    "files": [
+      "login.json",
+      "credentials.json"
+    ]
+  },
+  "account": {
+    "description": "Which account a client acts in with this login. A session reaches no account by itself: every request names one, and the exchange checks the person's role there at that moment.",
+    "order": [
+      "option",
+      "env",
+      "default_account_id",
+      "personal_account_id"
+    ],
+    "option": "The command's `--account <name|id>` or the library's `account` option.",
+    "env": "TONBO_ACCOUNT",
+    "env_description": "An account's name or id. Beside TONBO_API_KEY it must name the key's own account, or the client refuses before it calls anything.",
+    "names": "A name is resolved through `accounts`; when it misses, or the exchange answers account_not_found, the client refreshes `accounts` from GET /api/iam/session and tries once more. `accounts` is a cache for names and offline display, never authority."
+  },
+  "device_file": {
+    "description": "The computer's device id (ADR-0015's device id), kept in the state directory and never written to login.json, which holds only its SHA-256 (`device_id_sha256`). So a login.json copied without the state directory (a synced or published `~/.config`, a backup restored onto another computer) carries no device id, and an exchange that presents any other id is refused with cli_session_device_mismatch. @tonbo/cli-core makes it at the first login of either CLI and re-makes it when the saved hash of the operating system's machine id differs from the machine's (a cloned disk). A reader that only reads it (the SDK) takes `device_id` and never writes the file.",
+    "base_env": "XDG_STATE_HOME",
+    "fallback_base": [
+      "$HOME",
+      ".local",
+      "state"
+    ],
+    "relative": [
+      "tonbo-yield",
+      "device.json"
+    ],
+    "schema": {
+      "type": "object",
+      "required": [
+        "version",
+        "device_id",
+        "machine_id_sha256"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "version": {
+          "const": 1
+        },
+        "device_id": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+          "description": "A random UUID made at the first run."
+        },
+        "machine_id_sha256": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "pattern": "^[0-9a-f]{64}$",
+          "description": "The SHA-256 of the operating system's machine id (macOS IOPlatformUUID, Linux /etc/machine-id), or null when it could not be read."
+        }
+      }
+    },
+    "missing": "No file, or one that does not match `schema`: a reader that does not make it treats the login as unusable on this computer and asks the person to run `tonbo login`."
+  },
+  "reader": {
+    "missing": "No file: read credentials.json under credentials-v1.json; with neither, ask the person to run `tonbo login`.",
+    "refuse_symlink": true,
+    "refuse_non_regular_file": true,
+    "refuse_mode_bits": "0077",
+    "refused": "A symlink, a non-regular file, or a file any group or other permission bit is set on is an error and is never read; do not fall back to another source.",
+    "unknown_version": "A `version` other than `current_version`, or content that does not match `schema`, is unusable: ask the person to run `tonbo login`. It is never migrated, and the legacy file is not read in its place.",
+    "expired": "A login whose `session.expires_at` is at or before now is expired: ask the person to run `tonbo login`. The server also ends a session 30 days after its last use and whenever it is revoked; a client learns that from a 401 at the exchange.",
+    "device": "Every exchange sends the `device_id` of the computer's device file (`device_file`), and only when its SHA-256 (lowercase hex of the id's UTF-8 text) equals the login's `device_id_sha256`. Without a usable device file, or with another device's, the login is unusable on this computer: ask the person to run `tonbo login`, never send a mismatched id. A writer never puts the device id itself in login.json.",
+    "login_hint": "tonbo login"
+  },
+  "current_version": 2,
+  "schema": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://tonbo.dev/contracts/cli/credentials-v2.json",
+    "title": "Tonbo CLI login session",
+    "type": "object",
+    "required": [
+      "version",
+      "session",
+      "user_id",
+      "device_id_sha256",
+      "personal_account_id"
+    ],
+    "additionalProperties": true,
+    "properties": {
+      "version": {
+        "const": 2
+      },
+      "session": {
+        "type": "object",
+        "required": [
+          "id",
+          "secret",
+          "expires_at"
+        ],
+        "additionalProperties": true,
+        "properties": {
+          "id": {
+            "type": "string",
+            "minLength": 1,
+            "description": "The session's id (a UUID)."
+          },
+          "secret": {
+            "type": "string",
+            "pattern": "^tbs_",
+            "description": "The session's secret (contracts/iam/access-token-v1.json `cli_session.format`). It is presented only to POST /api/iam/token and /api/iam/session, never to a resource server."
+          },
+          "expires_at": {
+            "type": "string",
+            "format": "date-time",
+            "description": "The session's absolute expiry, ISO 8601."
+          }
+        }
+      },
+      "user_id": {
+        "type": "string",
+        "minLength": 1,
+        "description": "The person the session belongs to (a UUID)."
+      },
+      "device_id_sha256": {
+        "type": "string",
+        "pattern": "^[0-9a-f]{64}$",
+        "description": "The SHA-256 (lowercase hex) of the device id the session is tied to. The id itself stays in the device file (`device_file`), so this file alone cannot be presented from another computer."
+      },
+      "personal_account_id": {
+        "type": "string",
+        "minLength": 1,
+        "description": "The person's personal account (a UUID): the account of a command without --account, TONBO_ACCOUNT or a default."
+      },
+      "default_account_id": {
+        "type": [
+          "string",
+          "null"
+        ],
+        "minLength": 1,
+        "description": "The account commands act in without --account or TONBO_ACCOUNT (`tonbo account use`); null or absent for the personal account."
+      },
+      "accounts": {
+        "type": "object",
+        "description": "The person's accounts as GET /api/iam/session last answered them, keyed by account id: a cache of names, never authority.",
+        "additionalProperties": {
+          "type": "object",
+          "required": [
+            "name",
+            "kind"
+          ],
+          "properties": {
+            "name": {
+              "type": "string",
+              "minLength": 1,
+              "description": "The account's name, which --account and TONBO_ACCOUNT take."
+            },
+            "kind": {
+              "type": "string",
+              "pattern": "^(user|organization)$",
+              "description": "`user` for the personal account."
+            },
+            "role": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "The person's role when the cache was written; display only."
+            }
+          }
+        }
+      }
+    }
+  },
+  "examples": {
+    "usable": [
+      {
+        "version": 2,
+        "session": {
+          "id": "30000000-0000-4000-8000-000000000003",
+          "secret": "tbs_secret",
+          "expires_at": "2027-05-02T00:00:00.000Z"
+        },
+        "user_id": "40000000-0000-4000-8000-000000000004",
+        "device_id_sha256": "342ace7df588b4b741e10d57aeab9d9a79dab7cc931ddc50204c5bf381c96415",
+        "personal_account_id": "10000000-0000-4000-8000-000000000001"
+      },
+      {
+        "version": 2,
+        "session": {
+          "id": "30000000-0000-4000-8000-000000000003",
+          "secret": "tbs_secret",
+          "expires_at": "2027-05-02T00:00:00.000Z"
+        },
+        "user_id": "40000000-0000-4000-8000-000000000004",
+        "device_id_sha256": "342ace7df588b4b741e10d57aeab9d9a79dab7cc931ddc50204c5bf381c96415",
+        "personal_account_id": "10000000-0000-4000-8000-000000000001",
+        "default_account_id": "10000000-0000-4000-8000-0000000000a1",
+        "accounts": {
+          "10000000-0000-4000-8000-000000000001": {
+            "name": "sam",
+            "kind": "user",
+            "role": "owner"
+          },
+          "10000000-0000-4000-8000-0000000000a1": {
+            "name": "acme",
+            "kind": "organization",
+            "role": "member"
+          }
+        }
+      }
+    ],
+    "unusable": [
+      {
+        "version": 1,
+        "account_id": "10000000-0000-4000-8000-000000000001",
+        "key_id": "20000000-0000-4000-8000-000000000002",
+        "key": "tbo_secret",
+        "expires_at": null
+      },
+      {
+        "version": 2,
+        "session": {
+          "id": "30000000-0000-4000-8000-000000000003",
+          "secret": "tbo_secret",
+          "expires_at": "2027-05-02T00:00:00.000Z"
+        },
+        "user_id": "40000000-0000-4000-8000-000000000004",
+        "device_id_sha256": "342ace7df588b4b741e10d57aeab9d9a79dab7cc931ddc50204c5bf381c96415",
+        "personal_account_id": "10000000-0000-4000-8000-000000000001"
+      },
+      {
+        "version": 2,
+        "session": {
+          "id": "30000000-0000-4000-8000-000000000003",
+          "secret": "tbs_secret",
+          "expires_at": null
+        },
+        "user_id": "40000000-0000-4000-8000-000000000004",
+        "device_id_sha256": "342ace7df588b4b741e10d57aeab9d9a79dab7cc931ddc50204c5bf381c96415",
+        "personal_account_id": "10000000-0000-4000-8000-000000000001"
+      },
+      {
+        "version": 2,
+        "session": {
+          "id": "30000000-0000-4000-8000-000000000003",
+          "secret": "tbs_secret",
+          "expires_at": "2027-05-02T00:00:00.000Z"
+        },
+        "user_id": "40000000-0000-4000-8000-000000000004",
+        "personal_account_id": "10000000-0000-4000-8000-000000000001"
+      },
+      {
+        "version": 2,
+        "session": {
+          "id": "30000000-0000-4000-8000-000000000003",
+          "secret": "tbs_secret",
+          "expires_at": "2027-05-02T00:00:00.000Z"
+        },
+        "user_id": "40000000-0000-4000-8000-000000000004",
+        "device_id_sha256": "342ace7df588b4b741e10d57aeab9d9a79dab7cc931ddc50204c5bf381c96415",
+        "personal_account_id": "10000000-0000-4000-8000-000000000001",
+        "accounts": {
+          "10000000-0000-4000-8000-0000000000a1": {
+            "name": "acme",
+            "kind": "team"
+          }
+        }
+      },
+      {
+        "version": 3,
+        "session": {
+          "id": "30000000-0000-4000-8000-000000000003",
+          "secret": "tbs_secret",
+          "expires_at": "2027-05-02T00:00:00.000Z"
+        },
+        "user_id": "40000000-0000-4000-8000-000000000004",
+        "device_id_sha256": "342ace7df588b4b741e10d57aeab9d9a79dab7cc931ddc50204c5bf381c96415",
+        "personal_account_id": "10000000-0000-4000-8000-000000000001"
+      }
+    ]
   }
-  async load() {
-    let parsed;
+};
+var cliSessionContract = {
+  "prefix": "tbs_",
+  "grant": "cli_session",
+  "grantParameter": "grant",
+  "exchangePath": "/api/iam/token",
+  "sessionPath": "/api/iam/session",
+  "audiences": {
+    "streams": "https://streams.tonbo.dev",
+    "management": "https://api.tonbo.dev"
+  },
+  "idleDays": 30
+};
+var machineIdleActions = [
+  "suspend",
+  "release"
+];
+var machinePortAccess = [
+  "private",
+  "public"
+];
+var machineTimings = {
+  "pollAfterSeconds": 2,
+  "sleepPollAfterSeconds": 5,
+  "wakeHoldSeconds": 25,
+  "earlyReclaimSeconds": 120
+};
+
+// ../../packages/tonbo-cli-core/dist/src/bearer.js
+var MANAGEMENT_AUDIENCE = cliSessionContract.audiences.management;
+function isAccountBearer(bearer) {
+  return typeof bearer !== "string";
+}
+function managementBearer(bearer) {
+  return isAccountBearer(bearer) ? bearer.token(MANAGEMENT_AUDIENCE) : Promise.resolve(bearer);
+}
+
+// ../../packages/tonbo-cli-core/dist/src/access-token.js
+var DEFAULT_LOGIN_HINT = credentialsContract.reader.login_hint;
+var GIT_AUDIENCE = "https://git.tonbo.dev";
+var AccessTokenError = class extends Error {
+  status;
+  retryAfterMs;
+  code;
+  constructor(message, status, retryAfterMs = null, code = null) {
+    super(message);
+    this.status = status;
+    this.retryAfterMs = retryAfterMs;
+    this.code = code;
+  }
+  get retryable() {
+    return this.status === null || this.status === 429 || this.status >= 500;
+  }
+};
+
+// ../../packages/tonbo-cli-core/dist/src/http.js
+var HttpError = class extends Error {
+  status;
+  body;
+  requestId;
+  constructor(message, status, body, requestId) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.requestId = requestId;
+  }
+  /** The problem `code` of a Management API refusal, such as `unauthenticated`. */
+  get code() {
+    const record = this.body && typeof this.body === "object" ? this.body : {};
+    const code = record.code;
+    return typeof code === "string" ? code : null;
+  }
+};
+async function requestJson(fetcher, url, init = {}) {
+  const response = await fetcher(url, init);
+  const body = await response.json().catch(() => null);
+  if (response.ok)
+    return body;
+  const record = body && typeof body === "object" ? body : {};
+  const reason = [record.detail, record.title, record.error].find((value) => typeof value === "string" && value.length > 0);
+  const requestId = response.headers.get("x-request-id") ?? (typeof record.request_id === "string" ? record.request_id : null);
+  const issues = Array.isArray(record.errors) ? record.errors.filter((issue) => typeof issue?.field === "string" && typeof issue.code === "string").map((issue) => `${issue.field}: ${issue.code}`) : [];
+  const message = [
+    reason ?? `Request failed with HTTP ${response.status}.`,
+    ...issues.length ? [`(${issues.join(", ")})`] : []
+  ].join(" ");
+  throw new HttpError(requestId ? `${message} (request ${requestId})` : message, response.status, body, requestId);
+}
+
+// ../../packages/tonbo-cli-core/dist/src/api.js
+var DEFAULT_API_ORIGIN = "https://api.tonbo.dev";
+var DEFAULT_LOGIN_HINT2 = credentialsContract.reader.login_hint;
+var ExchangeRefusal = class extends HttpError {
+};
+async function presented(key) {
+  try {
+    return await managementBearer(key);
+  } catch (error) {
+    if (!(error instanceof AccessTokenError))
+      throw error;
+    throw new ExchangeRefusal(error.message, error.status ?? 503, { code: error.code }, null);
+  }
+}
+var ManagementApi = class {
+  fetcher;
+  apiOrigin;
+  loginHint;
+  pause;
+  constructor(fetcher, apiOrigin2 = DEFAULT_API_ORIGIN, loginHint = DEFAULT_LOGIN_HINT2, pause = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))) {
+    this.fetcher = fetcher;
+    this.apiOrigin = apiOrigin2;
+    this.loginHint = loginHint;
+    this.pause = pause;
+  }
+  /** The answer's `data`. A refusal throws an HttpError naming the request id. */
+  async call(operationId, key, request = {}) {
+    return (await this.request(operationId, key, request)).data;
+  }
+  /** One page of a list operation: its `data` and `next_cursor`, with the
+   * operation's other query parameters, if any. */
+  page(operationId, key, { limit, cursor } = {}, query = {}) {
+    return this.request(operationId, key, { query: { ...query, limit, cursor } });
+  }
+  async request(operationId, key, request, seen) {
+    const attempt = async () => this.requestWith(operationId, await presented(key), request, seen);
     try {
-      await assertPrivateRegularFile(this.filename);
-      parsed = JSON.parse(await readFile(this.filename, "utf8"));
+      return await attempt();
     } catch (error) {
-      if (error.code === "ENOENT")
-        return null;
-      throw new Error(`Could not read Tonbo credentials at ${this.filename}.`, { cause: error });
+      if (!isAccountBearer(key) || !(error instanceof HttpError) || error.status !== 401 || error instanceof ExchangeRefusal)
+        throw error;
+      key.invalidate(MANAGEMENT_AUDIENCE);
+      return attempt();
     }
-    if (!isStoredLogin(parsed))
-      throw new UnusableLoginError(`The saved login at ${this.filename} is not usable by this CLI. Run \`${this.loginHint}\`.`);
-    return parsed;
   }
-  async save(login) {
-    if (!isStoredLogin(login))
-      throw new Error("Refusing to store a malformed Tonbo login.");
-    const directory = path.dirname(this.filename);
-    await mkdir(directory, { mode: DIRECTORY_MODE, recursive: true });
-    await preparePrivateDirectory(directory);
-    await assertExistingDestinationIsSafe(this.filename);
-    const temporary = path.join(directory, `.${path.basename(this.filename)}.${process.pid}.${randomUUID()}.tmp`);
-    let handle = null;
-    try {
-      handle = await open(temporary, "wx", FILE_MODE);
-      await handle.writeFile(`${JSON.stringify(login, null, 2)}
-`, "utf8");
-      await handle.sync();
-      await handle.close();
-      handle = null;
-      if (process.platform !== "win32")
-        await chmod(temporary, FILE_MODE);
-      await rename(temporary, this.filename);
-    } catch (error) {
-      await handle?.close().catch(() => void 0);
-      await rm(temporary, { force: true }).catch(() => void 0);
-      throw new Error(`Could not store Tonbo credentials at ${this.filename}.`, { cause: error });
-    }
+  async requestWith(operationId, key, { params = {}, query = {}, body, idempotencyKey, ifMatch }, seen) {
+    const operation = managementOperations[operationId];
+    const path4 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
+      const value = params[name];
+      if (value === void 0)
+        throw new Error(`${operationId} needs the path parameter ${name}.`);
+      return encodeURIComponent(value);
+    });
+    const search = new URLSearchParams();
+    for (const [name, value] of Object.entries(query)) {
+      if (value === void 0)
+        continue;
+      if (!operation.query.includes(name))
+        throw new Error(`${operationId} takes no query parameter ${name}.`);
+      search.set(name, String(value));
+    }
+    if (operation.idempotencyKey && !idempotencyKey)
+      throw new Error(`${operationId} needs an Idempotency-Key.`);
+    const headers = { authorization: `Bearer ${key}` };
+    if (body !== void 0)
+      headers["content-type"] = "application/json";
+    if (idempotencyKey)
+      headers["idempotency-key"] = idempotencyKey;
+    if (ifMatch)
+      headers["if-match"] = ifMatch;
+    const queryString = search.toString();
+    const url = `${this.apiOrigin}${managementApiBasePath}${path4}${queryString ? `?${queryString}` : ""}`;
+    try {
+      const fetcher = seen ? async (input, init) => {
+        const response = await this.fetcher(input, init);
+        seen(response);
+        return response;
+      } : this.fetcher;
+      return await requestJson(fetcher, url, {
+        method: operation.method,
+        headers,
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+    } catch (error) {
+      if (error instanceof HttpError && error.status === 401)
+        throw new HttpError(`${error.message} Run \`${this.loginHint}\`.`, error.status, error.body, error.requestId);
+      throw error;
+    }
+  }
+  getAccount(key) {
+    return this.call("getAccount", key);
+  }
+  listRegions(key) {
+    return this.call("listRegions", key);
+  }
+  listMembers(key, page) {
+    return this.page("listMembers", key, page);
+  }
+  listGitWorkspaces(key, page) {
+    return this.page("listGitWorkspaces", key, page);
+  }
+  updateMember(key, subject, change) {
+    return this.call("updateMember", key, { params: { subject }, body: change });
+  }
+  /** A replay with the same idempotency key returns the Agent the first
+   * request created, so an unconfirmed creation is retried with that key. */
+  createAgent(key, request, idempotencyKey) {
+    return this.call("createAgent", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Agent creation", idempotencyKey, "the same name, role and region"));
+  }
+  listApiKeys(key, page) {
+    return this.page("listApiKeys", key, page);
+  }
+  /** Not idempotent: the secret is never stored, so a replay could not
+   * return it, and a blind retry of a live name answers 409. */
+  createApiKey(key, request) {
+    return this.call("createApiKey", key, { body: withoutUndefined(request) });
+  }
+  getApiKey(key, keyId) {
+    return this.call("getApiKey", key, { params: { key_id: keyId } });
+  }
+  revokeApiKey(key, keyId) {
+    return this.call("revokeApiKey", key, {
+      params: { key_id: keyId }
+    });
+  }
+  listBuckets(key, page) {
+    return this.page("listBuckets", key, page);
+  }
+  /** A replay with the same idempotency key returns the bucket the first
+   * request created. */
+  createBucket(key, request, idempotencyKey) {
+    return this.call("createBucket", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Bucket creation", idempotencyKey, "the same name and region"));
+  }
+  getBucket(key, name) {
+    return this.call("getBucket", key, { params: { name } });
+  }
+  updateBucket(key, name, change) {
+    return this.call("updateBucket", key, { params: { name }, body: change });
+  }
+  deleteBucket(key, name) {
+    return this.call("deleteBucket", key, { params: { name } });
+  }
+  listDatabases(key, page, prefix) {
+    return this.page("listDatabases", key, page, { prefix });
+  }
+  /** A replay with the same idempotency key returns the database the first
+   * request created. */
+  createDatabase(key, request, idempotencyKey) {
+    return this.call("createDatabase", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Database creation", idempotencyKey, request.expires_at ? `the same name, region and --expires-at ${request.expires_at}` : "the same name and region"));
+  }
+  getDatabase(key, name) {
+    return this.call("getDatabase", key, { params: { name } });
+  }
+  updateDatabase(key, name, change) {
+    return this.call("updateDatabase", key, { params: { name }, body: change });
+  }
+  deleteDatabase(key, name) {
+    return this.call("deleteDatabase", key, { params: { name } });
+  }
+  /** A database's writes per hour or day and its size at each step's end. */
+  getDatabaseActivity(key, name, query = {}) {
+    return this.call("getDatabaseActivity", key, { params: { name }, query });
+  }
+  /** The whole usage page: its rows, `other`, prices and checkpoint. */
+  listDatabaseUsage(key, page, query = {}) {
+    return this.page("listDatabaseUsage", key, page, query);
+  }
+  listStreams(key, page, prefix) {
+    return this.page("listStreams", key, page, { prefix });
+  }
+  /** A replay with the same idempotency key returns the stream the first
+   * request created. */
+  createStream(key, request, idempotencyKey) {
+    return this.call("createStream", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Stream creation", idempotencyKey, request.expires_at ? `the same name, region, content type and --expires-at ${request.expires_at}` : "the same name, region and content type"));
+  }
+  getStream(key, name) {
+    return this.call("getStream", key, { params: { name } });
+  }
+  updateStream(key, name, change) {
+    return this.call("updateStream", key, { params: { name }, body: change });
+  }
+  deleteStream(key, name) {
+    return this.call("deleteStream", key, { params: { name } });
+  }
+  /** A stream's appends per hour or day and its size at each step's end. */
+  getStreamActivity(key, name, query = {}) {
+    return this.call("getStreamActivity", key, { params: { name }, query });
+  }
+  /** The whole usage page: its rows, `other`, prices and checkpoint. */
+  listStreamUsage(key, page, query = {}) {
+    return this.page("listStreamUsage", key, page, query);
+  }
+  getUsage(key, period) {
+    return this.call("getUsage", key, { query: { period } });
+  }
+  getUsageSeries(key, query = {}) {
+    return this.call("getUsageSeries", key, { query });
+  }
+  /** The account's writes of yesterday and today, hourly, per lane. */
+  getUsageToday(key) {
+    return this.call("getUsageToday", key);
+  }
+  listMachines(key, page) {
+    return this.page("listMachines", key, page);
+  }
+  /**
+   * A replay with the same idempotency key returns the Machine the first
+   * request created, so a transport failure or a 5xx answer is retried here
+   * with the same key, at most `CREATE_ATTEMPTS` times, after the answer's
+   * Retry-After (bounded) or a short backoff. A refusal is final; a create
+   * still unconfirmed after the last attempt names the key to retry with.
+   * The answer carries the Machine's `Location` and, while it is creating,
+   * the `Retry-After` to read it again after (machine-v2.json
+   * `creation.create_status`).
+   */
+  async createMachine(key, request, idempotencyKey) {
+    let last;
+    for (let attempt = 1; attempt <= CREATE_ATTEMPTS; attempt++) {
+      const headers = {
+        location: null,
+        retryAfter: null
+      };
+      try {
+        const answer = await this.request("createMachine", key, { body: withoutUndefined(request), idempotencyKey }, (response) => {
+          headers.location = response.headers.get("location");
+          headers.retryAfter = response.headers.get("retry-after");
+        });
+        return {
+          machine: answer.data,
+          location: headers.location,
+          retryAfterSeconds: retryAfterSeconds(headers.retryAfter)
+        };
+      } catch (error) {
+        if (error instanceof HttpError && error.status < 500)
+          throw error;
+        last = error;
+        if (attempt === CREATE_ATTEMPTS)
+          break;
+        const wait = retryAfterSeconds(headers.retryAfter) ?? attempt;
+        await this.pause(Math.min(wait, CREATE_RETRY_MAX_WAIT_SECONDS) * 1e3);
+      }
+    }
+    return unconfirmed("Machine creation", idempotencyKey, "the same arguments")(last);
+  }
+  /** The name of the Machine a create's `Location` names, when it is this
+   * client's origin and `getMachine`'s path; null otherwise, so the key is
+   * never sent to another origin and the caller reads the Machine by the
+   * name it created. */
+  machineNameAt(location) {
+    if (!location)
+      return null;
+    let url;
+    try {
+      url = new URL(location, this.apiOrigin);
+    } catch {
+      return null;
+    }
+    if (url.origin !== new URL(this.apiOrigin).origin || url.search || url.hash)
+      return null;
+    const prefix = `${managementApiBasePath}${managementOperations.getMachine.path.replace("{name}", "")}`;
+    if (!url.pathname.startsWith(prefix))
+      return null;
+    const segment = url.pathname.slice(prefix.length);
+    if (!segment || segment.includes("/"))
+      return null;
+    try {
+      return decodeURIComponent(segment);
+    } catch {
+      return null;
+    }
+  }
+  getMachine(key, name) {
+    return this.call("getMachine", key, { params: { name } });
+  }
+  /** The Machine with its ETag, which is opaque (machine-v2.json `etag`)
+   * and is sent back as it was read. */
+  async getMachineWithEtag(key, name) {
+    const headers = { etag: null };
+    const answer = await this.request("getMachine", key, { params: { name } }, (response) => {
+      headers.etag = response.headers.get("etag");
+    });
+    return { machine: answer.data, etag: headers.etag };
+  }
+  /** Written only to the Machine and revision `etag` names, the ETag as read
+   * (machine-v2 requires If-Match on update); a stale one is refused with
+   * `precondition_failed`. */
+  updateMachine(key, name, etag, change) {
+    return this.call("updateMachine", key, {
+      params: { name },
+      body: withoutUndefined(change),
+      ifMatch: etag
+    });
+  }
+  /** With `etag`, only the Machine that ETag names, at that revision, is put
+   * to sleep (machine-v2.json `etag.if_match.sleep` is optional). A 202
+   * carries the `Retry-After` to read the Machine again after
+   * (machine-v2.json `sleep.poll_after_seconds`); a 200 carries none. */
+  async sleepMachine(key, name, etag) {
+    const headers = { retryAfter: null };
+    const answer = await this.request("sleepMachine", key, { params: { name }, ...etag ? { ifMatch: etag } : {} }, (response) => {
+      headers.retryAfter = response.headers.get("retry-after");
+    });
+    return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
+  }
+  /** The Machine being deleted or the device forgotten, with its kind; the
+   * Machine is null when the API answered 204, whose `X-Tonbo-Machine-Kind`
+   * says whether a name was released (`managed`: its create never reached its
+   * region) or a device was forgotten (`byoc`: its region held no row). With
+   * `etag`, only the Machine that ETag names is deleted
+   * (machine-v2.json `etag.if_match.delete` is optional). */
+  async deleteMachine(key, name, etag) {
+    const headers = { kind: null };
+    const answer = await this.request("deleteMachine", key, { params: { name }, ...etag ? { ifMatch: etag } : {} }, (response) => {
+      headers.kind = response.headers.get("x-tonbo-machine-kind");
+    });
+    if (answer?.data)
+      return { machine: answer.data, kind: answer.data.kind };
+    return { machine: null, kind: headers.kind === "byoc" ? "byoc" : "managed" };
+  }
+  /** One page of a managed Machine's activations, newest first; the cursor
+   * pages that Machine only. */
+  listMachineActivations(key, name, { limit, cursor } = {}) {
+    return this.request("listMachineActivations", key, {
+      params: { name },
+      query: { limit, cursor }
+    });
+  }
+  /** The whole answer: the shapes and the default one. */
+  listMachineShapes(key) {
+    return this.request("listMachineShapes", key, {});
+  }
+  /** Every Volume of the account, and the regions that could not be read. */
+  listVolumes(key) {
+    return this.request("listVolumes", key, {});
   }
-  async remove() {
-    await assertExistingDestinationIsSafe(this.filename);
-    await rm(this.filename, { force: true });
+  /** A replay with the same idempotency key answers the Volume the first
+   * request created, so an unconfirmed create names the key to retry with. */
+  createVolume(key, request, idempotencyKey) {
+    return this.call("createVolume", key, { body: request, idempotencyKey }).catch(unconfirmed("Volume creation", idempotencyKey, "the same name, region and size"));
   }
-};
-var RULE_KEYWORDS = /* @__PURE__ */ new Set([
-  "const",
-  "type",
-  "minLength",
-  "pattern",
-  "format",
-  "description",
-  "additionalProperties"
-]);
-function isPlainObject(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function matchesObject(value, rule) {
-  if (rule.type !== "object" || !isPlainObject(value))
-    return false;
-  if (!rule.required.every((name) => Object.hasOwn(value, name)))
-    return false;
-  return Object.entries(rule.properties).every(([name, inner]) => !Object.hasOwn(value, name) || matchesRule(value[name], inner));
-}
-function matchesRule(value, rule) {
-  if (Object.keys(rule).some((keyword) => !RULE_KEYWORDS.has(keyword)))
-    return false;
-  if ("const" in rule)
-    return value === rule.const;
-  const types = typeof rule.type === "string" ? [rule.type] : rule.type ?? [];
-  if (types.includes("object")) {
-    if (!isPlainObject(value) || !rule.additionalProperties)
-      return false;
-    const entries = rule.additionalProperties;
-    return Object.entries(value).every(([key, entry]) => key.length > 0 && matchesObject(entry, entries));
+  getVolume(key, name) {
+    return this.call("getVolume", key, { params: { name } });
   }
-  if (value === null)
-    return types.includes("null");
-  if (typeof value !== "string" || !types.includes("string"))
-    return false;
-  if (rule.minLength !== void 0 && value.length < rule.minLength)
-    return false;
-  if (rule.pattern !== void 0 && !new RegExp(rule.pattern, "u").test(value))
-    return false;
-  if (rule.format === "date-time" && Number.isNaN(Date.parse(value)))
-    return false;
-  return true;
-}
-function isStoredLogin(value) {
-  if (!isPlainObject(value))
-    return false;
-  const login = value;
-  const schema = credentialsContract.schema;
-  if (login.version !== credentialsContract.current_version)
-    return false;
-  if (!schema.required.every((name) => Object.hasOwn(login, name)))
-    return false;
-  const properties = schema.properties;
-  return Object.entries(properties).every(([name, rule]) => !Object.hasOwn(login, name) || matchesRule(login[name], rule));
+  /** The Volume being deleted; refused (409) while it is bound. */
+  deleteVolume(key, name) {
+    return this.call("deleteVolume", key, { params: { name } });
+  }
+};
+var CREATE_ATTEMPTS = 3;
+var CREATE_RETRY_MAX_WAIT_SECONDS = 30;
+function retryAfterSeconds(value) {
+  if (value === null || !/^[0-9]+$/.test(value.trim()))
+    return null;
+  return Number(value.trim());
 }
-function accountLogins(login) {
-  const entries = Object.entries(login.accounts ?? {}).map(([account_id, entry]) => ({
-    ...entry,
-    account_id,
-    kind: entry.kind ?? null,
-    name: entry.name ?? null
-  }));
-  if (!entries.some((entry) => entry.account_id === login.account_id))
-    entries.unshift({
-      account_id: login.account_id,
-      key_id: login.key_id,
-      key: login.key,
-      expires_at: login.expires_at,
-      kind: null,
-      name: null
-    });
-  return entries;
+function withoutUndefined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, field]) => field !== void 0));
 }
-function withAccountLogin(file, entry, options) {
-  const accounts = {};
-  if (file)
-    for (const known of accountLogins(file)) {
-      const { account_id: account_id2, ...rest2 } = known;
-      accounts[account_id2] = rest2;
-    }
-  const { account_id, ...rest } = entry;
-  accounts[account_id] = rest;
-  const top = options.current || !file ? entry : file;
-  return {
-    version: 1,
-    account_id: top.account_id,
-    key_id: top.key_id,
-    key: top.key,
-    expires_at: top.expires_at,
-    login_secret: options.loginSecret,
-    accounts
+function unconfirmed(what, idempotencyKey, same) {
+  return (cause) => {
+    if (cause instanceof HttpError && cause.status < 500)
+      throw cause;
+    throw new Error(`${what} was not confirmed: ${cause instanceof Error ? cause.message : String(cause)} Retry with --idempotency-key ${idempotencyKey} and ${same}.`, { cause });
   };
 }
-async function preparePrivateDirectory(directory) {
-  const stat = await lstat(directory);
-  if (stat.isSymbolicLink() || !stat.isDirectory())
-    throw new Error("Tonbo config directory must be a real directory.");
-  if (process.platform !== "win32")
-    await chmod(directory, DIRECTORY_MODE);
-}
-async function assertExistingDestinationIsSafe(filename) {
-  try {
-    const stat = await lstat(filename);
-    if (stat.isSymbolicLink() || !stat.isFile())
-      throw new Error("Tonbo credential path must be a regular file.");
-  } catch (error) {
-    if (error.code !== "ENOENT")
-      throw error;
-  }
-}
-async function assertPrivateRegularFile(filename) {
-  const stat = await lstat(filename);
-  if (stat.isSymbolicLink() || !stat.isFile())
-    throw new Error("Tonbo credential path must be a regular file.");
-  if (process.platform !== "win32" && (stat.mode & REFUSED_MODE_BITS) !== 0)
-    throw new Error(`Tonbo credential file must have mode ${credentialsContract.permissions.file_mode}.`);
-}
 
 // ../../packages/tonbo-cli-core/dist/src/auth.js
-var exec = promisify(execFile);
-var DEFAULT_LOGIN_HINT = credentialsContract.reader.login_hint;
-var LOOPBACK_HOST = "127.0.0.1";
-var BrowserUnavailableError = class extends Error {
+import { createHash as createHash3, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { execFile as execFile2 } from "node:child_process";
+import os4 from "node:os";
+import { promisify as promisify2 } from "node:util";
+
+// ../../packages/tonbo-cli-core/dist/src/callback-page.js
+var WORDMARK = [
+  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
+  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
+  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
+].join("\n");
+var OUTCOMES = {
+  complete: {
+    status: 200,
+    title: "You are signed in.",
+    body: "Return to your terminal. This tab can be closed."
+  },
+  denied: {
+    status: 400,
+    title: "Login was not completed.",
+    body: "Nothing was authorized. Return to your terminal to try again."
+  },
+  invalid: {
+    // The state did not match, the code was missing, or the path was wrong.
+    // Say that it could not be verified rather than which check failed: the
+    // person who can read this page is not necessarily the one who started
+    // the login.
+    status: 400,
+    title: "This callback could not be verified.",
+    body: "Return to your terminal and start the login again."
+  }
 };
-function prefersDeviceLogin(env = process.env) {
-  const ssh = Boolean(env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY);
-  return ssh && !env.DISPLAY && !env.WAYLAND_DISPLAY;
+function renderCallbackPage(outcome) {
+  const { title, body } = OUTCOMES[outcome];
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Tonbo CLI</title>
+<style>
+  :root {
+    --paper: #f3f2ee;
+    --ink: #1d1b17;
+    --rule: #c9c5ba;
+    --quiet: #5c564a;
+    --signal: #d64a03;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --paper: #1d1b17;
+      --ink: #f3f2ee;
+      --rule: #3a362e;
+      --quiet: #a49e8f;
+      --signal: #f08b4b;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: grid;
+    grid-template-rows: auto 1fr;
+    padding: 0 clamp(20px, 5vw, 72px);
+    background: var(--paper);
+    color: var(--ink);
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  header { padding: 28px 0; }
+  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
+     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
+     what makes the rows meet without seams. Iosevka is not available here,
+     so it falls back to the platform monospace. */
+  pre.wordmark {
+    margin: 0;
+    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
+    font-size: 8px;
+    font-weight: 400;
+    line-height: 10px;
+    letter-spacing: 0;
+    white-space: pre;
+    color: var(--signal);
+    transform: scaleY(0.8);
+    transform-origin: left top;
+  }
+  main {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    max-width: 46ch;
+    padding-bottom: 12vh;
+  }
+  h1 {
+    margin: 0;
+    font-size: 26px;
+    font-weight: 300;
+    line-height: 1.16;
+    letter-spacing: -0.018em;
+  }
+  p {
+    margin: 14px 0 0;
+    font-size: 16px;
+    line-height: 1.55;
+    color: var(--quiet);
+  }
+  hr {
+    width: 40px;
+    margin: 28px 0 0;
+    border: 0;
+    border-top: 1px solid var(--rule);
+  }
+</style>
+</head>
+<body>
+<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
+<main>
+  <h1>${title}</h1>
+  <p>${body}</p>
+  <hr>
+</main>
+</body>
+</html>
+`;
+}
+function callbackResponse(outcome) {
+  return {
+    status: OUTCOMES[outcome].status,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
+    },
+    body: renderCallbackPage(outcome)
+  };
 }
-function newLoginSecret() {
-  return randomBytes(32).toString("base64url");
+
+// ../../packages/tonbo-cli-core/dist/src/credentials.js
+import { randomUUID } from "node:crypto";
+import { chmod, lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+var DIRECTORY_MODE = Number.parseInt(credentialsContract.permissions.directory_mode, 8);
+var FILE_MODE = Number.parseInt(credentialsContract.permissions.file_mode, 8);
+var REFUSED_MODE_BITS = Number.parseInt(credentialsContract.reader.refuse_mode_bits, 8);
+function defaultCredentialsPath(env = process.env) {
+  const rule = credentialsContract.path;
+  const base = env[rule.base_env] || path.join(...rule.fallback_base.map((part) => part === "$HOME" ? os.homedir() : part));
+  return path.join(base, ...rule.relative);
 }
-function loginHostname(hostname = os2.hostname()) {
-  const cleaned = hostname.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
-  return cleaned || "computer";
+function isExpiredLogin(login, now = Date.now()) {
+  return login.expires_at !== null && Date.parse(login.expires_at) <= now;
 }
-var AuthClient = class {
-  credentials;
-  fetcher;
-  loginOrigin;
-  browserOpener;
-  hostname;
+var UnusableLoginError = class extends Error {
+};
+var FileCredentialStore = class {
+  filename;
   loginHint;
-  entryLine;
-  env;
-  constructor(credentials, fetcher, loginOrigin2 = "https://tonbo.dev", browserOpener = openBrowser, hostname = loginHostname(), loginHint = DEFAULT_LOGIN_HINT, entryLine = "cli", env = process.env) {
-    this.credentials = credentials;
-    this.fetcher = fetcher;
-    this.loginOrigin = loginOrigin2;
-    this.browserOpener = browserOpener;
-    this.hostname = hostname;
+  constructor(filename = defaultCredentialsPath(), loginHint = credentialsContract.reader.login_hint) {
+    this.filename = filename;
     this.loginHint = loginHint;
-    this.entryLine = entryLine;
-    this.env = env;
   }
-  /** The personal key requests are made with: TONBO_API_KEY, or the saved
-   * login while it has not expired. */
-  async apiKey() {
-    const injected = process.env.TONBO_API_KEY?.trim();
-    if (injected)
-      return injected;
-    const login = await this.credentials.load();
-    if (!login)
-      throw new Error(`Not logged in. Run \`${this.loginHint}\`.`);
-    if (isExpiredLogin(login))
-      throw new Error(`Your Tonbo login has expired. Run \`${this.loginHint}\`.`);
-    return login.key;
+  async load() {
+    const parsed = await readPrivateJson(this.filename);
+    if (parsed === null)
+      return null;
+    if (!isStoredLogin(parsed))
+      throw new UnusableLoginError(`The saved login at ${this.filename} is not usable by this CLI. Run \`${this.loginHint}\`.`);
+    return parsed;
   }
-  /**
-   * The browser handoff of /cli/login: PKCE S256 with a loopback redirect on
-   * a free port, then the one-time code is redeemed, with this device's login
-   * secret, for the account's login key, which replaces this device's earlier
-   * login key there ("CLI on <hostname>" in a personal account, `Yield CLI ·
-   * <8 hex>` in any other). With `device`, in an SSH session without a
-   * display, or when no browser can be opened, the same PKCE challenge goes
-   * to a device-code login instead: the person enters a short code at
-   * /cli/device in any browser and the CLI polls for the key. The key joins
-   * the file's `accounts`; it becomes the top level too unless `current` is
-   * false (a login made only to publish into an organization). Answers that
-   * account's login.
-   */
-  async login(progress = () => {
-  }, account, { current = true, device } = {}) {
-    const existing = await this.credentials.load().catch((error) => {
-      if (error instanceof UnusableLoginError)
-        return null;
-      throw error;
-    });
-    const loginSecret = existing?.login_secret ?? newLoginSecret();
-    const verifier = randomBytes(48).toString("base64url");
-    const challenge = createHash("sha256").update(verifier).digest("base64url");
-    const redeemed = device ?? prefersDeviceLogin(this.env) ? await this.deviceLogin(challenge, verifier, loginSecret, account, progress) : await this.browserLogin(challenge, verifier, loginSecret, account, progress).catch((error) => {
-      if (!(error instanceof BrowserUnavailableError))
-        throw error;
-      progress({ status: "failed", step: "browser", reason: error.message });
-      return this.deviceLogin(challenge, verifier, loginSecret, account, progress);
-    });
-    const login = {
-      account_id: redeemed.account_id,
-      key_id: redeemed.api_key.id,
-      key: redeemed.key,
-      expires_at: redeemed.api_key.expires_at,
-      kind: redeemed.account_kind ?? null,
-      name: redeemed.account_name ?? null
-    };
-    progress({ status: "started", step: "credential-store" });
-    const latest = await this.credentials.load().catch(() => existing);
-    await this.credentials.save(withAccountLogin(latest, login, {
-      current,
-      loginSecret: latest?.login_secret ?? loginSecret
-    }));
-    progress({ status: "completed", step: "credential-store" });
-    return login;
+  /** Writes a legacy login; nothing but tests writes one from ADR-0018. */
+  async save(login) {
+    if (!isStoredLogin(login))
+      throw new Error("Refusing to store a malformed Tonbo login.");
+    await writePrivateJson(this.filename, login);
   }
-  async browserLogin(challenge, verifier, loginSecret, account, progress) {
-    const state = randomBytes(24).toString("base64url");
-    const code = await this.listenForCode(state, (redirectUri) => {
-      const authorization = new URL("/cli/login", this.loginOrigin);
-      authorization.search = new URLSearchParams({
-        code_challenge: challenge,
-        code_challenge_method: "S256",
-        redirect_uri: redirectUri,
-        state,
-        hostname: this.hostname,
-        from: this.entryLine,
-        ...account ? { account } : {}
-      }).toString();
-      return authorization.toString();
-    }, progress);
-    progress({ status: "started", step: "key-redemption" });
-    const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/token", this.loginOrigin).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      // The secret goes only here, in the POST body, never in the URL.
-      body: JSON.stringify({ code, code_verifier: verifier, login_secret: loginSecret })
-    });
-    progress({ status: "completed", step: "key-redemption" });
-    return redeemed;
+  async remove() {
+    await removePrivateFile(this.filename);
   }
-  /**
-   * The device-code login (RFC 8628's shape): the PKCE challenge and the
-   * hostname buy a device code and a user code; the person approves the user
-   * code at /cli/device, seeing the hostname; the CLI polls with the device
-   * code, its verifier and the login secret, all in POST bodies, and the
-   * approved poll answers the key once. A denied or expired code ends it.
-   */
-  async deviceLogin(challenge, verifier, loginSecret, account, progress) {
-    progress({ status: "started", step: "device-code" });
-    const started = await requestJson(this.fetcher, new URL("/api/cli/login/device", this.loginOrigin).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        code_challenge: challenge,
-        code_challenge_method: "S256",
-        hostname: this.hostname
-      })
-    });
-    progress({ status: "completed", step: "device-code" });
-    const page = new URL("/cli/device", this.loginOrigin);
-    const complete = new URL(page);
-    complete.search = new URLSearchParams({
-      code: started.user_code,
-      from: this.entryLine,
-      ...account ? { account } : {}
-    }).toString();
-    progress({
-      status: "device-code",
-      step: "device-authorization",
-      userCode: started.user_code,
-      url: page.toString(),
-      completeUrl: complete.toString(),
-      expiresIn: started.expires_in
-    });
-    progress({ status: "started", step: "device-authorization" });
-    const expired = new Error(`The login code expired. Run \`${this.loginHint}\` again.`);
-    const deadline = Date.now() + started.expires_in * 1e3;
-    let interval = started.interval;
-    for (; ; ) {
-      await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
-      try {
-        const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/device/token", this.loginOrigin).toString(), {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            device_code: started.device_code,
-            code_verifier: verifier,
-            login_secret: loginSecret
-          })
-        });
-        progress({ status: "completed", step: "device-authorization" });
-        return redeemed;
-      } catch (error) {
-        const code = error instanceof HttpError ? error.code : null;
-        if (code === "slow_down")
-          interval += 5;
-        else if (code === "access_denied")
-          throw new Error("The login was not approved (access_denied).");
-        else if (code === "expired_token")
-          throw expired;
-        else if (code !== "authorization_pending" && !transient(error))
-          throw error;
-        if (Date.now() >= deadline)
-          throw expired;
-      }
-    }
+};
+async function readPrivateJson(filename) {
+  try {
+    await assertPrivateRegularFile(filename);
+    return JSON.parse(await readFile(filename, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw new Error(`Could not read Tonbo credentials at ${filename}.`, { cause: error });
   }
-  listenForCode(expectedState, authorizationUrl, progress) {
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const sockets = /* @__PURE__ */ new Set();
-      let authorizationStarted = false;
-      const startAuthorization = () => {
-        if (authorizationStarted)
-          return;
-        authorizationStarted = true;
-        progress({ status: "completed", step: "browser" });
-        progress({ status: "started", step: "browser-authorization" });
-      };
-      const finish = (result, completedResponseSocket) => {
-        if (settled)
-          return;
-        settled = true;
-        clearTimeout(timeout);
-        const complete = (closeError) => {
-          if (closeError)
-            reject(closeError);
-          else if ("code" in result) {
-            progress({ status: "completed", step: "callback-close" });
-            resolve(result.code);
-          } else
-            reject(result.error);
-        };
-        if ("code" in result)
-          progress({ status: "started", step: "callback-close" });
-        if (!server.listening) {
-          complete();
-          return;
-        }
-        server.close(complete);
-        for (const socket of sockets) {
-          if (socket !== completedResponseSocket)
-            socket.destroy();
-        }
-        server.closeIdleConnections();
-      };
-      const timeout = setTimeout(() => {
-        finish({ error: new Error("Timed out waiting for browser login.") });
-      }, 5 * 60 * 1e3);
-      const server = createServer((request, response) => {
-        const url = new URL(request.url ?? "/", `http://${LOOPBACK_HOST}`);
-        if (url.pathname !== "/callback" || url.searchParams.get("state") !== expectedState) {
-          respond(response, "invalid");
-          return;
-        }
-        const denied = url.searchParams.get("error");
-        if (denied) {
-          const responseSocket2 = response.socket;
-          respond(response, "denied", () => finish({ error: new Error(`The login was not approved (${denied}).`) }, responseSocket2));
-          return;
-        }
-        const code = url.searchParams.get("code");
-        if (!code) {
-          respond(response, "invalid");
-          return;
-        }
-        startAuthorization();
-        progress({ status: "completed", step: "browser-authorization" });
-        const responseSocket = response.socket;
-        respond(response, "complete", () => finish({ code }, responseSocket));
-      });
-      server.on("connection", (socket) => {
-        sockets.add(socket);
-        socket.once("close", () => sockets.delete(socket));
-      });
-      server.once("error", (error) => finish({ error }));
-      progress({ status: "started", step: "callback-server" });
-      server.listen(0, LOOPBACK_HOST, () => {
-        const { port } = server.address();
-        progress({ status: "completed", step: "callback-server" });
-        const url = authorizationUrl(`http://${LOOPBACK_HOST}:${port}/callback`);
-        progress({ status: "authorization-url", step: "browser", url });
-        progress({ status: "started", step: "browser" });
-        void Promise.resolve().then(() => this.browserOpener(url)).then(() => startAuthorization(), (error) => {
-          if (settled || authorizationStarted)
-            return;
-          finish({
-            error: new BrowserUnavailableError(error instanceof Error ? error.message : String(error))
-          });
-        });
-      });
-    });
+}
+async function writePrivateJson(filename, value) {
+  const directory = path.dirname(filename);
+  await mkdir(directory, { mode: DIRECTORY_MODE, recursive: true });
+  await preparePrivateDirectory(directory);
+  await assertExistingDestinationIsSafe(filename);
+  const temporary = path.join(directory, `.${path.basename(filename)}.${process.pid}.${randomUUID()}.tmp`);
+  let handle = null;
+  try {
+    handle = await open(temporary, "wx", FILE_MODE);
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}
+`, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    if (process.platform !== "win32")
+      await chmod(temporary, FILE_MODE);
+    await rename(temporary, filename);
+  } catch (error) {
+    await handle?.close().catch(() => void 0);
+    await rm(temporary, { force: true }).catch(() => void 0);
+    throw new Error(`Could not store Tonbo credentials at ${filename}.`, { cause: error });
+  }
+}
+async function removePrivateFile(filename) {
+  await assertExistingDestinationIsSafe(filename);
+  await rm(filename, { force: true });
+}
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "$schema",
+  "$id",
+  "title",
+  "description",
+  "const",
+  "type",
+  "minLength",
+  "pattern",
+  "format",
+  "required",
+  "properties",
+  "additionalProperties"
+]);
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function matchesSchema(value, schema) {
+  const rule = schema;
+  if (Object.keys(rule).some((keyword) => !KEYWORDS.has(keyword)))
+    return false;
+  if ("const" in rule)
+    return value === rule.const;
+  const types = typeof rule.type === "string" ? [rule.type] : rule.type ?? [];
+  if (value === null)
+    return types.includes("null");
+  if (isPlainObject(value)) {
+    if (!types.includes("object"))
+      return false;
+    if (!(rule.required ?? []).every((name) => Object.hasOwn(value, name)))
+      return false;
+    const properties = rule.properties ?? {};
+    for (const [name, inner] of Object.entries(value)) {
+      if (Object.hasOwn(properties, name)) {
+        if (!matchesSchema(inner, properties[name]))
+          return false;
+      } else if (isPlainObject(rule.additionalProperties)) {
+        if (!name || !matchesSchema(inner, rule.additionalProperties))
+          return false;
+      } else if (rule.additionalProperties === false)
+        return false;
+    }
+    return true;
   }
-};
-function transient(error) {
-  return error instanceof HttpError ? error.status === 429 || error.status >= 500 : error instanceof TypeError;
+  if (typeof value !== "string" || !types.includes("string"))
+    return false;
+  if (rule.minLength !== void 0 && value.length < rule.minLength)
+    return false;
+  if (rule.pattern !== void 0 && !new RegExp(rule.pattern, "u").test(value))
+    return false;
+  if (rule.format === "date-time" && Number.isNaN(Date.parse(value)))
+    return false;
+  return true;
 }
-function respond(response, outcome, finished) {
-  const page = callbackResponse(outcome);
-  if (finished)
-    response.once("finish", finished);
-  response.writeHead(page.status, { ...page.headers, connection: "close" });
-  response.end(page.body);
+function isStoredLogin(value) {
+  return isPlainObject(value) && value.version === credentialsContract.current_version && matchesSchema(value, credentialsContract.schema);
 }
-function browserCommand(url, platform = process.platform, env = process.env) {
-  if (platform === "darwin")
-    return ["open", [url]];
-  if (platform === "win32")
-    return ["rundll32", ["url.dll,FileProtocolHandler", url]];
-  if (!env.DISPLAY && !env.WAYLAND_DISPLAY)
-    throw new Error("there is no graphical session (DISPLAY and WAYLAND_DISPLAY are unset)");
-  return ["xdg-open", [url]];
+function accountLogins(login) {
+  const entries = Object.entries(login.accounts ?? {}).map(([account_id, entry]) => ({
+    ...entry,
+    account_id,
+    kind: entry.kind ?? null,
+    name: entry.name ?? null
+  }));
+  if (!entries.some((entry) => entry.account_id === login.account_id))
+    entries.unshift({
+      account_id: login.account_id,
+      key_id: login.key_id,
+      key: login.key,
+      expires_at: login.expires_at,
+      kind: null,
+      name: null
+    });
+  return entries;
 }
-async function openBrowser(url) {
-  const [command, args] = browserCommand(url);
+async function preparePrivateDirectory(directory) {
+  const stat = await lstat(directory);
+  if (stat.isSymbolicLink() || !stat.isDirectory())
+    throw new Error("Tonbo config directory must be a real directory.");
+  if (process.platform !== "win32")
+    await chmod(directory, DIRECTORY_MODE);
+}
+async function assertExistingDestinationIsSafe(filename) {
   try {
-    await exec(command, args);
+    const stat = await lstat(filename);
+    if (stat.isSymbolicLink() || !stat.isFile())
+      throw new Error("Tonbo credential path must be a regular file.");
   } catch (error) {
-    const code = error.code;
-    if (code === "ENOENT")
-      throw new Error(`${command} is not installed`, { cause: error });
-    if (typeof code === "number")
-      throw new Error(`${command} exited with code ${code}`, { cause: error });
-    throw error;
+    if (error.code !== "ENOENT")
+      throw error;
   }
 }
+async function assertPrivateRegularFile(filename) {
+  const stat = await lstat(filename);
+  if (stat.isSymbolicLink() || !stat.isFile())
+    throw new Error("Tonbo credential path must be a regular file.");
+  if (process.platform !== "win32" && (stat.mode & REFUSED_MODE_BITS) !== 0)
+    throw new Error(`Tonbo credential file must have mode ${credentialsContract.permissions.file_mode}.`);
+}
 
-// ../../packages/tonbo-cli-core/dist/src/api.js
-var DEFAULT_API_ORIGIN = "https://api.tonbo.dev";
-var ManagementApi = class {
-  fetcher;
-  apiOrigin;
-  loginHint;
-  pause;
-  constructor(fetcher, apiOrigin2 = DEFAULT_API_ORIGIN, loginHint = DEFAULT_LOGIN_HINT, pause = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))) {
-    this.fetcher = fetcher;
-    this.apiOrigin = apiOrigin2;
-    this.loginHint = loginHint;
-    this.pause = pause;
-  }
-  /** The answer's `data`. A refusal throws an HttpError naming the request id. */
-  async call(operationId, key, request = {}) {
-    return (await this.request(operationId, key, request)).data;
+// ../../packages/tonbo-cli-core/dist/src/device.js
+import { execFile } from "node:child_process";
+import { createHash, randomUUID as randomUUID2 } from "node:crypto";
+import { link, mkdir as mkdir2, open as open2, readFile as readFile2, rename as rename2, rm as rm2 } from "node:fs/promises";
+import os2 from "node:os";
+import path2 from "node:path";
+import { promisify } from "node:util";
+function defaultDevicePath(env = process.env, home = os2.homedir()) {
+  const rule = loginContract.device_file;
+  const base = env[rule.base_env] || path2.join(...rule.fallback_base.map((part) => part === "$HOME" ? home : part));
+  return path2.join(base, ...rule.relative);
+}
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var SHA256 = /^[0-9a-f]{64}$/;
+var execFileAsync = promisify(execFile);
+async function readMachineId(platform = process.platform) {
+  try {
+    if (platform === "darwin") {
+      const { stdout } = await execFileAsync("/usr/sbin/ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], { timeout: 5e3 });
+      return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(stdout)?.[1].trim() || null;
+    }
+    if (platform === "linux")
+      return (await readFile2("/etc/machine-id", "utf8")).trim() || null;
+  } catch {
   }
-  /** One page of a list operation: its `data` and `next_cursor`, with the
-   * operation's other query parameters, if any. */
-  page(operationId, key, { limit, cursor } = {}, query = {}) {
-    return this.request(operationId, key, { query: { ...query, limit, cursor } });
+  return null;
+}
+function machineIdHash(machineId) {
+  return createHash("sha256").update(machineId).digest("hex");
+}
+var DeviceStore = class {
+  filename;
+  machineId;
+  constructor(filename = defaultDevicePath(), machineId = readMachineId) {
+    this.filename = filename;
+    this.machineId = machineId;
   }
-  async request(operationId, key, { params = {}, query = {}, body, idempotencyKey, ifMatch }, seen) {
-    const operation = managementOperations[operationId];
-    const path2 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
-      const value = params[name];
-      if (value === void 0)
-        throw new Error(`${operationId} needs the path parameter ${name}.`);
-      return encodeURIComponent(value);
-    });
-    const search = new URLSearchParams();
-    for (const [name, value] of Object.entries(query)) {
-      if (value === void 0)
-        continue;
-      if (!operation.query.includes(name))
-        throw new Error(`${operationId} takes no query parameter ${name}.`);
-      search.set(name, String(value));
+  /**
+   * This computer's device id. The first call makes it, a random UUID saved
+   * with the hash of the machine id; two first runs at once agree on the one
+   * saved first. When the saved hash and the machine's differ, the state
+   * directory came from another computer (a cloned disk), and a new id
+   * replaces it. A machine id that cannot be read keeps the saved id.
+   */
+  async deviceId() {
+    const machineId = await this.machineId().catch(() => null);
+    const hash = machineId ? machineIdHash(machineId) : null;
+    const saved = await this.load();
+    if (saved && (saved.machine_id_sha256 === hash || hash === null))
+      return saved.device_id;
+    if (saved && saved.machine_id_sha256 === null) {
+      await this.write({ ...saved, machine_id_sha256: hash }, true);
+      return saved.device_id;
     }
-    if (operation.idempotencyKey && !idempotencyKey)
-      throw new Error(`${operationId} needs an Idempotency-Key.`);
-    const headers = { authorization: `Bearer ${key}` };
-    if (body !== void 0)
-      headers["content-type"] = "application/json";
-    if (idempotencyKey)
-      headers["idempotency-key"] = idempotencyKey;
-    if (ifMatch)
-      headers["if-match"] = ifMatch;
-    const queryString = search.toString();
-    const url = `${this.apiOrigin}${managementApiBasePath}${path2}${queryString ? `?${queryString}` : ""}`;
+    const record = { version: 1, device_id: randomUUID2(), machine_id_sha256: hash };
+    if (saved) {
+      await this.write(record, true);
+      return record.device_id;
+    }
+    if (await this.write(record, false))
+      return record.device_id;
+    const winner = await this.load();
+    if (!winner)
+      throw new Error(`${this.filename} vanished while it was made.`);
+    return winner.device_id;
+  }
+  /** The saved record, or null before the first run. */
+  async load() {
+    let body;
     try {
-      const fetcher = seen ? async (input, init) => {
-        const response = await this.fetcher(input, init);
-        seen(response);
-        return response;
-      } : this.fetcher;
-      return await requestJson(fetcher, url, {
-        method: operation.method,
-        headers,
-        ...body === void 0 ? {} : { body: JSON.stringify(body) }
-      });
+      body = await readFile2(this.filename, "utf8");
     } catch (error) {
-      if (error instanceof HttpError && error.status === 401)
-        throw new HttpError(`${error.message} Run \`${this.loginHint}\`.`, error.status, error.body, error.requestId);
+      if (error.code === "ENOENT")
+        return null;
       throw error;
     }
+    let parsed = null;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+    }
+    if (parsed?.version !== 1 || typeof parsed.device_id !== "string" || !UUID.test(parsed.device_id) || !(parsed.machine_id_sha256 === null || SHA256.test(String(parsed.machine_id_sha256))))
+      throw new Error(`${this.filename} is not a Tonbo device file.`);
+    return parsed;
   }
-  getAccount(key) {
-    return this.call("getAccount", key);
-  }
-  listRegions(key) {
-    return this.call("listRegions", key);
-  }
-  listMembers(key, page) {
-    return this.page("listMembers", key, page);
-  }
-  listGitWorkspaces(key, page) {
-    return this.page("listGitWorkspaces", key, page);
+  /** Writes `record` through a synced temporary file: in place of the saved
+   * one when `replace`, otherwise only if there is none (false when there
+   * was). */
+  async write(record, replace) {
+    const directory = path2.dirname(this.filename);
+    await mkdir2(directory, { recursive: true, mode: 448 });
+    const temporary = path2.join(directory, `.device.${process.pid}.${randomUUID2()}.tmp`);
+    const handle = await open2(temporary, "wx", 384);
+    try {
+      await handle.writeFile(JSON.stringify(record));
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    try {
+      if (replace) {
+        await rename2(temporary, this.filename);
+        return true;
+      }
+      await link(temporary, this.filename);
+      return true;
+    } catch (error) {
+      if (!replace && error.code === "EEXIST")
+        return false;
+      throw error;
+    } finally {
+      await rm2(temporary, { force: true });
+    }
   }
-  updateMember(key, subject, change) {
-    return this.call("updateMember", key, { params: { subject }, body: change });
+};
+
+// ../../packages/tonbo-cli-core/dist/src/session.js
+import { createHash as createHash2 } from "node:crypto";
+import os3 from "node:os";
+import path3 from "node:path";
+function defaultLoginPath(env = process.env) {
+  const rule = loginContract.path;
+  const base = env[rule.base_env] || path3.join(...rule.fallback_base.map((part) => part === "$HOME" ? os3.homedir() : part));
+  return path3.join(base, ...rule.relative);
+}
+function isStoredSession(value) {
+  return !!value && typeof value === "object" && value.version === loginContract.current_version && matchesSchema(value, loginContract.schema);
+}
+function deviceIdHash(deviceId) {
+  return createHash2("sha256").update(deviceId, "utf8").digest("hex");
+}
+function isExpiredSession(stored, now = Date.now()) {
+  return Date.parse(stored.session.expires_at) <= now;
+}
+var FileSessionStore = class {
+  filename;
+  loginHint;
+  constructor(filename = defaultLoginPath(), loginHint = loginContract.reader.login_hint) {
+    this.filename = filename;
+    this.loginHint = loginHint;
   }
-  /** A replay with the same idempotency key returns the Agent the first
-   * request created, so an unconfirmed creation is retried with that key. */
-  createAgent(key, request, idempotencyKey) {
-    return this.call("createAgent", key, {
-      body: withoutUndefined(request),
-      idempotencyKey
-    }).catch(unconfirmed("Agent creation", idempotencyKey, "the same name, role and region"));
+  async load() {
+    const parsed = await readPrivateJson(this.filename);
+    if (parsed === null)
+      return null;
+    if (!isStoredSession(parsed))
+      throw new UnusableLoginError(`The saved login at ${this.filename} is not usable by this CLI. Run \`${this.loginHint}\`.`);
+    return parsed;
   }
-  listApiKeys(key, page) {
-    return this.page("listApiKeys", key, page);
+  async save(stored) {
+    if (!isStoredSession(stored))
+      throw new Error("Refusing to store a malformed Tonbo login.");
+    await writePrivateJson(this.filename, stored);
   }
-  /** Not idempotent: the secret is never stored, so a replay could not
-   * return it, and a blind retry of a live name answers 409. */
-  createApiKey(key, request) {
-    return this.call("createApiKey", key, { body: withoutUndefined(request) });
+  async remove() {
+    await removePrivateFile(this.filename);
   }
-  getApiKey(key, keyId) {
-    return this.call("getApiKey", key, { params: { key_id: keyId } });
+};
+var REFRESH_MARGIN_MS = 6e4;
+var clients = /* @__PURE__ */ new WeakMap();
+var SessionClient = class _SessionClient {
+  stored;
+  origins;
+  deviceId;
+  bearers = /* @__PURE__ */ new Map();
+  tokens = /* @__PURE__ */ new Map();
+  inflight = /* @__PURE__ */ new Map();
+  workspaces = /* @__PURE__ */ new Map();
+  constructor(stored, origins, deviceId) {
+    this.stored = stored;
+    this.origins = origins;
+    this.deviceId = deviceId;
   }
-  revokeApiKey(key, keyId) {
-    return this.call("revokeApiKey", key, {
-      params: { key_id: keyId }
-    });
+  /** The client of `stored`, shared by every read of the same login. */
+  static for(stored, origins, deviceId) {
+    const id = `${origins.loginOrigin} ${origins.apiOrigin} ${stored.session.secret}`;
+    let known = clients.get(origins.fetcher);
+    if (!known)
+      clients.set(origins.fetcher, known = /* @__PURE__ */ new Map());
+    const client = known.get(id);
+    if (client) {
+      client.stored = stored;
+      client.deviceId = deviceId;
+      return client;
+    }
+    const made = new _SessionClient(stored, origins, deviceId);
+    known.set(id, made);
+    return made;
   }
-  listBuckets(key, page) {
-    return this.page("listBuckets", key, page);
+  now() {
+    return (this.origins.now ?? Date.now)();
   }
-  /** A replay with the same idempotency key returns the bucket the first
-   * request created. */
-  createBucket(key, request, idempotencyKey) {
-    return this.call("createBucket", key, {
-      body: withoutUndefined(request),
-      idempotencyKey
-    }).catch(unconfirmed("Bucket creation", idempotencyKey, "the same name and region"));
+  /** The bearer of `accountId`: tokens of that account, exchanged from this session. */
+  bearer(accountId) {
+    let bearer = this.bearers.get(accountId);
+    if (!bearer) {
+      bearer = {
+        kind: "session",
+        accountId,
+        token: (audience) => this.token(audience, accountId),
+        invalidate: (audience) => {
+          this.tokens.delete(`${audience} ${accountId}`);
+        }
+      };
+      this.bearers.set(accountId, bearer);
+    }
+    return bearer;
   }
-  getBucket(key, name) {
-    return this.call("getBucket", key, { params: { name } });
+  /** A token of `accountId` for `audience`, kept until a minute before it expires. */
+  async token(audience, accountId) {
+    const id = `${audience} ${accountId}`;
+    const cached = this.tokens.get(id);
+    if (cached && cached.refreshAt > this.now())
+      return cached.token;
+    let pending = this.inflight.get(id);
+    if (!pending) {
+      pending = this.exchange(audience, accountId).finally(() => this.inflight.delete(id));
+      this.inflight.set(id, pending);
+    }
+    return pending;
   }
-  updateBucket(key, name, change) {
-    return this.call("updateBucket", key, { params: { name }, body: change });
+  /** The device id every exchange and the session endpoint name. */
+  presentedDevice() {
+    if (this.deviceId === null)
+      throw new AccessTokenError(`This login was made on another computer. Run \`${this.origins.loginHint}\` here.`, 401, null, "cli_session_device_mismatch");
+    return this.deviceId;
   }
-  deleteBucket(key, name) {
-    return this.call("deleteBucket", key, { params: { name } });
+  accountName(accountId) {
+    return this.stored.accounts?.[accountId]?.name ?? accountId;
   }
-  listDatabases(key, page, prefix) {
-    return this.page("listDatabases", key, page, { prefix });
+  /** POST /api/iam/token with the session (access-token-v1.json `cli_session.exchange`). */
+  async exchange(audience, accountId) {
+    const what = audience === GIT_AUDIENCE ? "git" : audience === MANAGEMENT_AUDIENCE ? "Management" : "Streams";
+    if (isExpiredSession(this.stored, this.now()))
+      throw new AccessTokenError(`Your Tonbo login has expired. Run \`${this.origins.loginHint}\`.`, 401, null, "cli_session_invalid");
+    const workspace = audience === GIT_AUDIENCE && accountId !== this.stored.personal_account_id ? await this.defaultWorkspace(accountId) : void 0;
+    const issuedAt = this.now();
+    const body = await this.post({
+      audience,
+      device: this.presentedDevice(),
+      account: accountId,
+      ...workspace ? { workspace } : {}
+    }, what, accountId);
+    this.tokens.set(`${audience} ${accountId}`, {
+      token: body.access_token,
+      refreshAt: issuedAt + Math.max(0, body.expires_in * 1e3 - REFRESH_MARGIN_MS)
+    });
+    return body.access_token;
   }
-  /** A replay with the same idempotency key returns the database the first
-   * request created. */
-  createDatabase(key, request, idempotencyKey) {
-    return this.call("createDatabase", key, {
-      body: withoutUndefined(request),
-      idempotencyKey
-    }).catch(unconfirmed("Database creation", idempotencyKey, request.expires_at ? `the same name, region and --expires-at ${request.expires_at}` : "the same name and region"));
+  async post(fields2, what, accountId) {
+    let response;
+    try {
+      response = await this.origins.fetcher(`${this.origins.loginOrigin}${cliSessionContract.exchangePath}`, {
+        method: "POST",
+        redirect: "manual",
+        signal: AbortSignal.timeout(3e4),
+        headers: {
+          authorization: `Bearer ${this.stored.session.secret}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(fields2)
+      });
+    } catch (error) {
+      throw new AccessTokenError(`The ${what} token exchange failed: ${error instanceof Error ? error.message : String(error)}`, null);
+    }
+    if (!response.ok)
+      throw await this.refusal(response, what, accountId);
+    const body = await response.json().catch(() => null);
+    if (typeof body?.access_token !== "string" || !body.access_token || typeof body.expires_in !== "number" || !(body.expires_in > 0))
+      throw new AccessTokenError(`The ${what} token exchange answered no token.`, response.status);
+    return { access_token: body.access_token, expires_in: body.expires_in };
   }
-  getDatabase(key, name) {
-    return this.call("getDatabase", key, { params: { name } });
+  /** The exchange's refusal (`cli_session.exchange.refusals`) as an AccessTokenError. */
+  async refusal(response, what, accountId) {
+    const problem = await response.json().catch(() => null);
+    const code = typeof problem?.code === "string" ? problem.code : null;
+    const retryAfter = Number(response.headers.get("retry-after") ?? "");
+    const hint = this.origins.loginHint;
+    const message = code === "cli_session_device_mismatch" ? `This login was made on another computer. Run \`${hint}\` here.` : response.status === 401 ? `Your Tonbo login has ended (logged out, revoked, unused for ${cliSessionContract.idleDays} days or expired). Run \`${hint}\`.` : code === "account_not_found" ? `You are not a member of ${this.accountName(accountId)}, or it does not exist.` : `The ${what} token exchange answered ${response.status}.`;
+    return new AccessTokenError(message, response.status, Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1e3 : null, code);
   }
-  updateDatabase(key, name, change) {
-    return this.call("updateDatabase", key, { params: { name }, body: change });
+  /** An organization's default git workspace, read with its Management token. */
+  defaultWorkspace(accountId) {
+    let pending = this.workspaces.get(accountId);
+    if (!pending) {
+      pending = this.readDefaultWorkspace(accountId).catch((error) => {
+        this.workspaces.delete(accountId);
+        throw error;
+      });
+      this.workspaces.set(accountId, pending);
+    }
+    return pending;
   }
-  deleteDatabase(key, name) {
-    return this.call("deleteDatabase", key, { params: { name } });
+  async readDefaultWorkspace(accountId) {
+    const token = await this.token(MANAGEMENT_AUDIENCE, accountId);
+    const operation = managementOperations.listGitWorkspaces;
+    let response;
+    try {
+      response = await this.origins.fetcher(`${this.origins.apiOrigin}${managementApiBasePath}${operation.path}?limit=100`, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(3e4),
+        headers: { authorization: `Bearer ${token}`, accept: "application/json" }
+      });
+    } catch (error) {
+      throw new AccessTokenError(`Reading ${this.accountName(accountId)}'s git workspaces failed: ${error instanceof Error ? error.message : String(error)}`, null);
+    }
+    const body = await response.json().catch(() => null);
+    if (!response.ok)
+      throw new AccessTokenError(`Reading ${this.accountName(accountId)}'s git workspaces answered ${response.status}.`, response.status);
+    const found = body?.data?.find((workspace) => workspace.default === true);
+    if (typeof found?.id !== "string")
+      throw new AccessTokenError(`${this.accountName(accountId)} has no default git workspace.`, 404, null, "git_workspace_not_found");
+    return found.id;
   }
-  /** A database's writes per hour or day and its size at each step's end. */
-  getDatabaseActivity(key, name, query = {}) {
-    return this.call("getDatabaseActivity", key, { params: { name }, query });
+  /** GET /api/iam/session: the person's accounts now, the personal account first. */
+  async accounts() {
+    const url = new URL(cliSessionContract.sessionPath, this.origins.loginOrigin);
+    url.searchParams.set("device", this.presentedDevice());
+    let response;
+    try {
+      response = await this.origins.fetcher(url.toString(), {
+        redirect: "manual",
+        signal: AbortSignal.timeout(3e4),
+        headers: {
+          authorization: `Bearer ${this.stored.session.secret}`,
+          accept: "application/json"
+        }
+      });
+    } catch (error) {
+      throw new AccessTokenError(`Reading your accounts failed: ${error instanceof Error ? error.message : String(error)}`, null);
+    }
+    if (!response.ok)
+      throw await this.refusal(response, "session", "");
+    const body = await response.json().catch(() => null);
+    if (!Array.isArray(body?.accounts))
+      throw new AccessTokenError("The session endpoint answered no accounts.", response.status);
+    return body.accounts.filter((account) => typeof account?.id === "string" && typeof account.name === "string" && (account.kind === "user" || account.kind === "organization"));
   }
-  /** The whole usage page: its rows, `other`, prices and checkpoint. */
-  listDatabaseUsage(key, page, query = {}) {
-    return this.page("listDatabaseUsage", key, page, query);
+  /** DELETE /api/iam/session: ends the session, from any computer. */
+  async logout() {
+    const response = await this.origins.fetcher(new URL(cliSessionContract.sessionPath, this.origins.loginOrigin).toString(), {
+      method: "DELETE",
+      redirect: "manual",
+      signal: AbortSignal.timeout(3e4),
+      headers: { authorization: `Bearer ${this.stored.session.secret}` }
+    });
+    await response.body?.cancel();
+    if (!response.ok && response.status !== 401)
+      throw new Error(`The logout answered ${response.status}.`);
   }
-  listStreams(key, page, prefix) {
-    return this.page("listStreams", key, page, { prefix });
+};
+function withAccounts(stored, accounts) {
+  const cache = {};
+  for (const account of accounts)
+    cache[account.id] = { name: account.name, kind: account.kind, role: account.role };
+  return { ...stored, accounts: cache };
+}
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var UnknownAccountError = class extends Error {
+};
+var LoginStore = class {
+  options;
+  sessions;
+  legacy;
+  loginHint;
+  fetcher;
+  devices;
+  constructor(options) {
+    this.options = options;
+    this.loginHint = options.loginHint ?? loginContract.reader.login_hint;
+    this.fetcher = options.fetcher ?? fetch;
+    this.sessions = options.sessions ?? new FileSessionStore(void 0, this.loginHint);
+    this.legacy = options.legacy ?? new FileCredentialStore(void 0, this.loginHint);
+    this.devices = options.devices ?? new DeviceStore();
   }
-  /** A replay with the same idempotency key returns the stream the first
-   * request created. */
-  createStream(key, request, idempotencyKey) {
-    return this.call("createStream", key, {
-      body: withoutUndefined(request),
-      idempotencyKey
-    }).catch(unconfirmed("Stream creation", idempotencyKey, request.expires_at ? `the same name, region, content type and --expires-at ${request.expires_at}` : "the same name, region and content type"));
+  /** The account the command named, if any. */
+  get account() {
+    return this.options.account;
   }
-  getStream(key, name) {
-    return this.call("getStream", key, { params: { name } });
+  /** The session client of this computer's CLI login; null without one. A login whose
+   * device id hash is not this computer's is unusable here (credentials-v2.json
+   * `reader.device`), except with `anyDevice`, whose client can only log out. */
+  async session({ anyDevice = false } = {}) {
+    const stored = await this.sessions.load();
+    return stored ? this.client(stored, anyDevice) : null;
   }
-  updateStream(key, name, change) {
-    return this.call("updateStream", key, { params: { name }, body: change });
+  async client(stored, anyDevice = false) {
+    const deviceId = await this.devices.deviceId();
+    const here = deviceIdHash(deviceId) === stored.device_id_sha256;
+    if (!here && !anyDevice)
+      throw new UnusableLoginError(`The saved login at ${this.sessions.filename} was made on another computer. Run \`${this.loginHint}\` here.`);
+    return SessionClient.for(stored, {
+      fetcher: this.fetcher,
+      loginOrigin: this.options.loginOrigin,
+      apiOrigin: this.options.apiOrigin,
+      loginHint: this.loginHint,
+      now: this.options.now
+    }, here ? deviceId : null);
   }
-  deleteStream(key, name) {
-    return this.call("deleteStream", key, { params: { name } });
+  async load() {
+    const stored = await this.sessions.load();
+    if (stored)
+      return this.view(await this.client(stored));
+    const legacy = await this.legacy.load();
+    return legacy && this.options.account ? legacyNamed(legacy, this.options.account) : legacy;
   }
-  /** A stream's appends per hour or day and its size at each step's end. */
-  getStreamActivity(key, name, query = {}) {
-    return this.call("getStreamActivity", key, { params: { name }, query });
+  /** Removes both files. */
+  async remove() {
+    await this.sessions.remove();
+    await this.legacy.remove();
   }
-  /** The whole usage page: its rows, `other`, prices and checkpoint. */
-  listStreamUsage(key, page, query = {}) {
-    return this.page("listStreamUsage", key, page, query);
+  /** The person's accounts now, saved as the login's cache of names. */
+  async refreshAccounts(client) {
+    const accounts = await client.accounts();
+    const latest = await this.sessions.load() ?? client.stored;
+    if (latest.session.id === client.stored.session.id) {
+      const saved = withAccounts(latest, accounts);
+      await this.sessions.save(saved);
+      client.stored = saved;
+    }
+    return accounts;
   }
-  getUsage(key, period) {
-    return this.call("getUsage", key, { query: { period } });
+  /** The id of the account `nameOrId` names, looked up again once when the cache misses. */
+  async resolve(client, nameOrId) {
+    if (UUID2.test(nameOrId))
+      return nameOrId;
+    const find = (stored) => Object.entries(stored.accounts ?? {}).find(([, entry]) => entry.name.toLowerCase() === nameOrId.toLowerCase())?.[0];
+    const cached = find(client.stored);
+    if (cached)
+      return cached;
+    const found = (await this.refreshAccounts(client)).find((account) => account.name.toLowerCase() === nameOrId.toLowerCase());
+    if (found)
+      return found.id;
+    throw new UnknownAccountError(`You belong to no account named ${nameOrId}. \`tonbo account list\` lists yours.`);
   }
-  getUsageSeries(key, query = {}) {
-    return this.call("getUsageSeries", key, { query });
+  /** The session as one login per account, the top level the command's account. */
+  async view(client) {
+    const stored = client.stored;
+    const chosen = this.options.account ? await this.resolve(client, this.options.account) : stored.default_account_id ?? stored.personal_account_id;
+    const current = client.stored;
+    const accounts = {};
+    const entry = (id) => ({
+      key_id: `session:${current.session.id}`,
+      key: client.bearer(id),
+      expires_at: current.session.expires_at,
+      kind: current.accounts?.[id]?.kind ?? (id === current.personal_account_id ? "user" : null),
+      name: current.accounts?.[id]?.name ?? null
+    });
+    accounts[current.personal_account_id] = entry(current.personal_account_id);
+    for (const id of Object.keys(current.accounts ?? {}))
+      accounts[id] = entry(id);
+    if (!accounts[chosen])
+      accounts[chosen] = entry(chosen);
+    const top = accounts[chosen];
+    return {
+      version: 1,
+      account_id: chosen,
+      key_id: top.key_id,
+      key: top.key,
+      expires_at: top.expires_at,
+      accounts,
+      session: {
+        id: current.session.id,
+        userId: current.user_id,
+        deviceId: client.presentedDevice(),
+        personalAccountId: current.personal_account_id,
+        defaultAccountId: current.default_account_id ?? null,
+        expiresAt: current.session.expires_at
+      }
+    };
   }
-  /** The account's writes of yesterday and today, hourly, per lane. */
-  getUsageToday(key) {
-    return this.call("getUsageToday", key);
+  /**
+   * With TONBO_API_KEY, an account the command named must be the key's own,
+   * checked before anything else is called (credentials-v2.json `account`).
+   */
+  async checkKeyAccount(key) {
+    const named = this.options.account;
+    if (!named)
+      return;
+    const response = await this.fetcher(`${this.options.apiOrigin}${managementApiBasePath}${managementOperations.getAccount.path}`, {
+      redirect: "manual",
+      signal: AbortSignal.timeout(3e4),
+      headers: { authorization: `Bearer ${key}`, accept: "application/json" }
+    });
+    const body = await response.json().catch(() => null);
+    if (!response.ok)
+      throw new Error(`TONBO_API_KEY was refused (HTTP ${response.status}).`);
+    const account = body?.data;
+    const matches = UUID2.test(named) ? account?.id === named : typeof account?.name === "string" && account.name.toLowerCase() === named.toLowerCase();
+    if (!matches)
+      throw new UnknownAccountError(`TONBO_API_KEY reaches only its own account${typeof account?.name === "string" ? `, ${account.name}` : ""}, not ${named}. Unset --account and TONBO_ACCOUNT, or use ${named}'s key.`);
   }
-  listMachines(key, page) {
-    return this.page("listMachines", key, page);
+};
+function legacyNamed(login, named) {
+  const wanted = named.toLowerCase();
+  const entry = Object.entries(login.accounts ?? {}).find(([id, value2]) => id === named || value2.name?.toLowerCase() === wanted);
+  if (!entry && login.account_id !== named)
+    throw new UnknownAccountError(`This computer's login has no key of ${named}. Run \`tonbo login\` once: the new login reaches every account you belong to.`);
+  if (!entry)
+    return login;
+  const [account_id, value] = entry;
+  return {
+    ...login,
+    account_id,
+    key_id: value.key_id,
+    key: value.key,
+    expires_at: value.expires_at
+  };
+}
+
+// ../../packages/tonbo-cli-core/dist/src/auth.js
+var exec = promisify2(execFile2);
+var DEFAULT_LOGIN_HINT3 = credentialsContract.reader.login_hint;
+var LOOPBACK_HOST = "127.0.0.1";
+var BrowserUnavailableError = class extends Error {
+};
+function prefersDeviceLogin(env = process.env) {
+  const ssh = Boolean(env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY);
+  return ssh && !env.DISPLAY && !env.WAYLAND_DISPLAY;
+}
+function loginHostname(hostname = os4.hostname()) {
+  const cleaned = hostname.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
+  return cleaned || "computer";
+}
+function clientFact(value) {
+  return value && /^[A-Za-z0-9][A-Za-z0-9._+-]{0,31}$/.test(value) ? value : void 0;
+}
+var AuthClient = class {
+  credentials;
+  fetcher;
+  loginOrigin;
+  browserOpener;
+  hostname;
+  loginHint;
+  entryLine;
+  env;
+  facts;
+  keyChecked = null;
+  constructor(credentials, fetcher, loginOrigin2 = "https://tonbo.dev", browserOpener = openBrowser, hostname = loginHostname(), loginHint = DEFAULT_LOGIN_HINT3, entryLine = "cli", env = process.env, facts = {}) {
+    this.credentials = credentials;
+    this.fetcher = fetcher;
+    this.loginOrigin = loginOrigin2;
+    this.browserOpener = browserOpener;
+    this.hostname = hostname;
+    this.loginHint = loginHint;
+    this.entryLine = entryLine;
+    this.env = env;
+    this.facts = facts;
   }
   /**
-   * A replay with the same idempotency key returns the Machine the first
-   * request created, so a transport failure or a 5xx answer is retried here
-   * with the same key, at most `CREATE_ATTEMPTS` times, after the answer's
-   * Retry-After (bounded) or a short backoff. A refusal is final; a create
-   * still unconfirmed after the last attempt names the key to retry with.
-   * The answer carries the Machine's `Location` and, while it is creating,
-   * the `Retry-After` to read it again after (machine-v2.json
-   * `creation.create_status`).
+   * The credential of the account a command acts in: TONBO_API_KEY (whose
+   * own account any account the command named must be), or the CLI login's
+   * bearer of the named account, else of its default, else of the personal
+   * account; with only a legacy login, that file's key.
    */
-  async createMachine(key, request, idempotencyKey) {
-    let last;
-    for (let attempt = 1; attempt <= CREATE_ATTEMPTS; attempt++) {
-      const headers = {
-        location: null,
-        retryAfter: null
-      };
-      try {
-        const answer = await this.request("createMachine", key, { body: withoutUndefined(request), idempotencyKey }, (response) => {
-          headers.location = response.headers.get("location");
-          headers.retryAfter = response.headers.get("retry-after");
-        });
-        return {
-          machine: answer.data,
-          location: headers.location,
-          retryAfterSeconds: retryAfterSeconds(headers.retryAfter)
-        };
-      } catch (error) {
-        if (error instanceof HttpError && error.status < 500)
-          throw error;
-        last = error;
-        if (attempt === CREATE_ATTEMPTS)
-          break;
-        const wait = retryAfterSeconds(headers.retryAfter) ?? attempt;
-        await this.pause(Math.min(wait, CREATE_RETRY_MAX_WAIT_SECONDS) * 1e3);
+  async apiKey() {
+    const injected = this.env.TONBO_API_KEY?.trim();
+    if (injected) {
+      if (this.keyChecked !== injected) {
+        await this.credentials.checkKeyAccount(injected);
+        this.keyChecked = injected;
       }
+      return injected;
     }
-    return unconfirmed("Machine creation", idempotencyKey, "the same arguments")(last);
-  }
-  /** The name of the Machine a create's `Location` names, when it is this
-   * client's origin and `getMachine`'s path; null otherwise, so the key is
-   * never sent to another origin and the caller reads the Machine by the
-   * name it created. */
-  machineNameAt(location) {
-    if (!location)
-      return null;
-    let url;
-    try {
-      url = new URL(location, this.apiOrigin);
-    } catch {
-      return null;
-    }
-    if (url.origin !== new URL(this.apiOrigin).origin || url.search || url.hash)
-      return null;
-    const prefix = `${managementApiBasePath}${managementOperations.getMachine.path.replace("{name}", "")}`;
-    if (!url.pathname.startsWith(prefix))
-      return null;
-    const segment = url.pathname.slice(prefix.length);
-    if (!segment || segment.includes("/"))
-      return null;
-    try {
-      return decodeURIComponent(segment);
-    } catch {
-      return null;
-    }
-  }
-  getMachine(key, name) {
-    return this.call("getMachine", key, { params: { name } });
+    const login = await this.credentials.load();
+    if (!login)
+      throw new Error(`Not logged in. Run \`${this.loginHint}\`.`);
+    if (isExpiredLogin(login))
+      throw new Error(`Your Tonbo login has expired. Run \`${this.loginHint}\`.`);
+    return login.key;
   }
-  /** The Machine with its ETag, which is opaque (machine-v2.json `etag`)
-   * and is sent back as it was read. */
-  async getMachineWithEtag(key, name) {
-    const headers = { etag: null };
-    const answer = await this.request("getMachine", key, { params: { name } }, (response) => {
-      headers.etag = response.headers.get("etag");
+  /**
+   * Logs this computer in (ADR-0018): the browser handoff of /cli/login, PKCE
+   * S256 with a loopback redirect on a free port, asks for a session
+   * (`grant=cli_session`); the approval names this computer and asks no
+   * account. With `device`, in an SSH session without a display, or when no
+   * browser can be opened, the same PKCE challenge goes to a device-code
+   * login instead: the person enters a short code at /cli/device in any
+   * browser and the CLI polls. The redeemed session, tied to this
+   * computer's device id, is saved as `login.json` and replaces this
+   * computer's earlier session; the legacy `credentials.json` is left as it
+   * is. With `account` (a name or id), commands act there by default unless
+   * `current` is false. Answers the login of the account commands act in.
+   */
+  async login(progress = () => {
+  }, account, { current = true, device } = {}) {
+    const deviceId = await (this.facts.devices ?? new DeviceStore()).deviceId();
+    const verifier = randomBytes(48).toString("base64url");
+    const challenge = createHash3("sha256").update(verifier).digest("base64url");
+    const redeem = {
+      grant: cliSessionContract.grant,
+      device_id: deviceId,
+      client: this.facts.client ?? (this.entryLine === "yield" ? "yield" : "tonbo"),
+      ...clientFact(this.facts.clientVersion) ? { client_version: clientFact(this.facts.clientVersion) } : {},
+      ...clientFact(process.platform) ? { os: process.platform } : {}
+    };
+    const redeemed = device ?? prefersDeviceLogin(this.env) ? await this.deviceLogin(challenge, verifier, redeem, progress) : await this.browserLogin(challenge, verifier, redeem, progress).catch((error) => {
+      if (!(error instanceof BrowserUnavailableError))
+        throw error;
+      progress({ status: "failed", step: "browser", reason: error.message });
+      return this.deviceLogin(challenge, verifier, redeem, progress);
     });
-    return { machine: answer.data, etag: headers.etag };
+    progress({ status: "started", step: "credential-store" });
+    const previous = await this.credentials.sessions.load().catch(() => null);
+    const wanted = account?.toLowerCase();
+    const named = wanted ? redeemed.accounts.find((entry) => entry.id === account || entry.name.toLowerCase() === wanted) : void 0;
+    const kept = previous?.user_id === redeemed.user_id ? previous.default_account_id ?? null : null;
+    const chosen = named && current ? named.id === redeemed.personal_account_id ? null : named.id : kept;
+    const stored = {
+      version: 2,
+      session: redeemed.session,
+      user_id: redeemed.user_id,
+      // The id itself stays in the device file (credentials-v2.json `device_id_sha256`).
+      device_id_sha256: deviceIdHash(deviceId),
+      personal_account_id: redeemed.personal_account_id,
+      default_account_id: chosen && redeemed.accounts.some((entry) => entry.id === chosen) ? chosen : null,
+      accounts: Object.fromEntries(redeemed.accounts.map((entry) => [
+        entry.id,
+        { name: entry.name, kind: entry.kind, role: entry.role }
+      ]))
+    };
+    await this.credentials.sessions.save(stored);
+    progress({ status: "completed", step: "credential-store" });
+    if (account && !named)
+      throw new UnknownAccountError(`Logged in, but you belong to no account named ${account}. Commands act in ${redeemed.accounts.find((entry) => entry.id === redeemed.personal_account_id)?.name ?? "your personal account"}; \`tonbo account list\` lists your accounts.`);
+    const view = await this.credentials.load();
+    const actsIn = named?.id ?? stored.default_account_id ?? stored.personal_account_id;
+    const login = view && accountLogins(view).find((entry) => entry.account_id === actsIn);
+    if (!login)
+      throw new Error("The saved login could not be read back.");
+    return login;
   }
-  /** Written only to the Machine and revision `etag` names, the ETag as read
-   * (machine-v2 requires If-Match on update); a stale one is refused with
-   * `precondition_failed`. */
-  updateMachine(key, name, etag, change) {
-    return this.call("updateMachine", key, {
-      params: { name },
-      body: withoutUndefined(change),
-      ifMatch: etag
+  async browserLogin(challenge, verifier, redeem, progress) {
+    const state = randomBytes(24).toString("base64url");
+    const code = await this.listenForCode(state, (redirectUri) => {
+      const authorization = new URL("/cli/login", this.loginOrigin);
+      authorization.search = new URLSearchParams({
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        redirect_uri: redirectUri,
+        state,
+        hostname: this.hostname,
+        from: this.entryLine,
+        [cliSessionContract.grantParameter]: cliSessionContract.grant
+      }).toString();
+      return authorization.toString();
+    }, progress);
+    progress({ status: "started", step: "key-redemption" });
+    const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/token", this.loginOrigin).toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ code, code_verifier: verifier, ...redeem })
     });
+    progress({ status: "completed", step: "key-redemption" });
+    return redeemed;
   }
-  /** With `etag`, only the Machine that ETag names, at that revision, is put
-   * to sleep (machine-v2.json `etag.if_match.sleep` is optional). A 202
-   * carries the `Retry-After` to read the Machine again after
-   * (machine-v2.json `sleep.poll_after_seconds`); a 200 carries none. */
-  async sleepMachine(key, name, etag) {
-    const headers = { retryAfter: null };
-    const answer = await this.request("sleepMachine", key, { params: { name }, ...etag ? { ifMatch: etag } : {} }, (response) => {
-      headers.retryAfter = response.headers.get("retry-after");
+  /**
+   * The device-code login (RFC 8628's shape): the PKCE challenge and the
+   * hostname buy a device code and a user code; the person approves the user
+   * code at /cli/device, seeing the hostname; the CLI polls with the device
+   * code, its verifier and this computer's facts, all in POST bodies, and
+   * the approved poll answers the session once. A denied or expired code
+   * ends it.
+   */
+  async deviceLogin(challenge, verifier, redeem, progress) {
+    progress({ status: "started", step: "device-code" });
+    const started = await requestJson(this.fetcher, new URL("/api/cli/login/device", this.loginOrigin).toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        hostname: this.hostname,
+        [cliSessionContract.grantParameter]: cliSessionContract.grant
+      })
     });
-    return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
-  }
-  /** The Machine being deleted or the device forgotten, with its kind; the
-   * Machine is null when the API answered 204, whose `X-Tonbo-Machine-Kind`
-   * says whether a name was released (`managed`: its create never reached its
-   * region) or a device was forgotten (`byoc`: its region held no row). With
-   * `etag`, only the Machine that ETag names is deleted
-   * (machine-v2.json `etag.if_match.delete` is optional). */
-  async deleteMachine(key, name, etag) {
-    const headers = { kind: null };
-    const answer = await this.request("deleteMachine", key, { params: { name }, ...etag ? { ifMatch: etag } : {} }, (response) => {
-      headers.kind = response.headers.get("x-tonbo-machine-kind");
+    progress({ status: "completed", step: "device-code" });
+    const page = new URL("/cli/device", this.loginOrigin);
+    const complete = new URL(page);
+    complete.search = new URLSearchParams({
+      code: started.user_code,
+      from: this.entryLine
+    }).toString();
+    progress({
+      status: "device-code",
+      step: "device-authorization",
+      userCode: started.user_code,
+      url: page.toString(),
+      completeUrl: complete.toString(),
+      expiresIn: started.expires_in
     });
-    if (answer?.data)
-      return { machine: answer.data, kind: answer.data.kind };
-    return { machine: null, kind: headers.kind === "byoc" ? "byoc" : "managed" };
+    progress({ status: "started", step: "device-authorization" });
+    const expired = new Error(`The login code expired. Run \`${this.loginHint}\` again.`);
+    const deadline = Date.now() + started.expires_in * 1e3;
+    let interval = started.interval;
+    for (; ; ) {
+      await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
+      try {
+        const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/device/token", this.loginOrigin).toString(), {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            device_code: started.device_code,
+            code_verifier: verifier,
+            ...redeem
+          })
+        });
+        progress({ status: "completed", step: "device-authorization" });
+        return redeemed;
+      } catch (error) {
+        const code = error instanceof HttpError ? error.code : null;
+        if (code === "slow_down")
+          interval += 5;
+        else if (code === "access_denied")
+          throw new Error("The login was not approved (access_denied).");
+        else if (code === "expired_token")
+          throw expired;
+        else if (code !== "authorization_pending" && !transient(error))
+          throw error;
+        if (Date.now() >= deadline)
+          throw expired;
+      }
+    }
   }
-  /** One page of a managed Machine's activations, newest first; the cursor
-   * pages that Machine only. */
-  listMachineActivations(key, name, { limit, cursor } = {}) {
-    return this.request("listMachineActivations", key, {
-      params: { name },
-      query: { limit, cursor }
+  listenForCode(expectedState, authorizationUrl, progress) {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const sockets = /* @__PURE__ */ new Set();
+      let authorizationStarted = false;
+      const startAuthorization = () => {
+        if (authorizationStarted)
+          return;
+        authorizationStarted = true;
+        progress({ status: "completed", step: "browser" });
+        progress({ status: "started", step: "browser-authorization" });
+      };
+      const finish = (result, completedResponseSocket) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timeout);
+        const complete = (closeError) => {
+          if (closeError)
+            reject(closeError);
+          else if ("code" in result) {
+            progress({ status: "completed", step: "callback-close" });
+            resolve(result.code);
+          } else
+            reject(result.error);
+        };
+        if ("code" in result)
+          progress({ status: "started", step: "callback-close" });
+        if (!server.listening) {
+          complete();
+          return;
+        }
+        server.close(complete);
+        for (const socket of sockets) {
+          if (socket !== completedResponseSocket)
+            socket.destroy();
+        }
+        server.closeIdleConnections();
+      };
+      const timeout = setTimeout(() => {
+        finish({ error: new Error("Timed out waiting for browser login.") });
+      }, 5 * 60 * 1e3);
+      const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", `http://${LOOPBACK_HOST}`);
+        if (url.pathname !== "/callback" || url.searchParams.get("state") !== expectedState) {
+          respond(response, "invalid");
+          return;
+        }
+        const denied = url.searchParams.get("error");
+        if (denied) {
+          const responseSocket2 = response.socket;
+          respond(response, "denied", () => finish({ error: new Error(`The login was not approved (${denied}).`) }, responseSocket2));
+          return;
+        }
+        const code = url.searchParams.get("code");
+        if (!code) {
+          respond(response, "invalid");
+          return;
+        }
+        startAuthorization();
+        progress({ status: "completed", step: "browser-authorization" });
+        const responseSocket = response.socket;
+        respond(response, "complete", () => finish({ code }, responseSocket));
+      });
+      server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+      });
+      server.once("error", (error) => finish({ error }));
+      progress({ status: "started", step: "callback-server" });
+      server.listen(0, LOOPBACK_HOST, () => {
+        const { port } = server.address();
+        progress({ status: "completed", step: "callback-server" });
+        const url = authorizationUrl(`http://${LOOPBACK_HOST}:${port}/callback`);
+        progress({ status: "authorization-url", step: "browser", url });
+        progress({ status: "started", step: "browser" });
+        void Promise.resolve().then(() => this.browserOpener(url)).then(() => startAuthorization(), (error) => {
+          if (settled || authorizationStarted)
+            return;
+          finish({
+            error: new BrowserUnavailableError(error instanceof Error ? error.message : String(error))
+          });
+        });
+      });
     });
   }
-  /** The whole answer: the shapes and the default one. */
-  listMachineShapes(key) {
-    return this.request("listMachineShapes", key, {});
-  }
-  /** Every Volume of the account, and the regions that could not be read. */
-  listVolumes(key) {
-    return this.request("listVolumes", key, {});
-  }
-  /** A replay with the same idempotency key answers the Volume the first
-   * request created, so an unconfirmed create names the key to retry with. */
-  createVolume(key, request, idempotencyKey) {
-    return this.call("createVolume", key, { body: request, idempotencyKey }).catch(unconfirmed("Volume creation", idempotencyKey, "the same name, region and size"));
-  }
-  getVolume(key, name) {
-    return this.call("getVolume", key, { params: { name } });
-  }
-  /** The Volume being deleted; refused (409) while it is bound. */
-  deleteVolume(key, name) {
-    return this.call("deleteVolume", key, { params: { name } });
-  }
 };
-var CREATE_ATTEMPTS = 3;
-var CREATE_RETRY_MAX_WAIT_SECONDS = 30;
-function retryAfterSeconds(value) {
-  if (value === null || !/^[0-9]+$/.test(value.trim()))
-    return null;
-  return Number(value.trim());
+function transient(error) {
+  return error instanceof HttpError ? error.status === 429 || error.status >= 500 : error instanceof TypeError;
 }
-function withoutUndefined(value) {
-  return Object.fromEntries(Object.entries(value).filter(([, field]) => field !== void 0));
+function respond(response, outcome, finished) {
+  const page = callbackResponse(outcome);
+  if (finished)
+    response.once("finish", finished);
+  response.writeHead(page.status, { ...page.headers, connection: "close" });
+  response.end(page.body);
 }
-function unconfirmed(what, idempotencyKey, same) {
-  return (cause) => {
-    if (cause instanceof HttpError && cause.status < 500)
-      throw cause;
-    throw new Error(`${what} was not confirmed: ${cause instanceof Error ? cause.message : String(cause)} Retry with --idempotency-key ${idempotencyKey} and ${same}.`, { cause });
-  };
+function browserCommand(url, platform = process.platform, env = process.env) {
+  if (platform === "darwin")
+    return ["open", [url]];
+  if (platform === "win32")
+    return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+  if (!env.DISPLAY && !env.WAYLAND_DISPLAY)
+    throw new Error("there is no graphical session (DISPLAY and WAYLAND_DISPLAY are unset)");
+  return ["xdg-open", [url]];
+}
+async function openBrowser(url) {
+  const [command, args] = browserCommand(url);
+  try {
+    await exec(command, args);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT")
+      throw new Error(`${command} is not installed`, { cause: error });
+    if (typeof code === "number")
+      throw new Error(`${command} exited with code ${code}`, { cause: error });
+    throw error;
+  }
 }
 
 // ../../packages/tonbo-cli-core/dist/src/format.js
@@ -2228,7 +3183,12 @@ function when(timestamp, absent = "never") {
 async function loginCommand(deps, options = {}) {
   try {
     const login = await deps.auth.login((event) => reportLoginProgress(deps.progress, event), options.account, { current: options.current, device: options.device });
-    deps.output(`Logged in to account ${login.name ?? login.account_id}.${login.expires_at ? ` The login expires ${login.expires_at}.` : ""}`);
+    const file = await deps.credentials.load();
+    const names = file ? accountLogins(file).map((entry) => entry.kind === "user" ? `${entry.name ?? "you"} (personal)` : entry.name ?? entry.account_id) : [];
+    deps.output([
+      `Logged in. This computer can act in every account you belong to, with your role in each${names.length ? `: ${names.join(", ")}` : ""}.`,
+      `Commands act in ${login.kind === "user" ? "your personal account" : login.name ?? login.account_id} unless you pass --account.${login.expires_at ? ` The login ends ${login.expires_at.slice(0, 10)}, or after 30 days unused.` : ""}`
+    ].join("\n"));
     return login;
   } catch (error) {
     deps.progress.fail();
@@ -2253,8 +3213,8 @@ var LOGIN_PROGRESS_MESSAGES = {
     completed: "Local browser callback closed"
   },
   "key-redemption": {
-    started: "Receiving the CLI key",
-    completed: "CLI key received"
+    started: "Receiving the CLI login",
+    completed: "CLI login received"
   },
   "device-code": {
     started: "Requesting a login code",
@@ -2291,37 +3251,46 @@ function reportLoginProgress(progress, event) {
     progress.succeed(messages.completed);
 }
 async function logoutCommand(deps) {
-  let login;
+  const failures = [];
+  let first;
+  const failed = (what, error) => {
+    const failure = error instanceof Error ? error : new Error("The revocation failed.");
+    first ??= failure;
+    failures.push(`${what}: ${failure.message}`);
+  };
+  let session = null;
   try {
-    login = await deps.credentials.load();
+    session = await deps.credentials.session({ anyDevice: true });
   } catch (error) {
     if (!(error instanceof UnusableLoginError))
       throw error;
-    await deps.credentials.remove();
-    deps.output("Removed a saved login this CLI cannot use; it had no key to revoke.");
-    return;
   }
-  if (!login) {
-    deps.output("Not logged in.");
-    return;
+  let legacy = null;
+  try {
+    legacy = await deps.credentials.legacy.load();
+  } catch (error) {
+    if (!(error instanceof UnusableLoginError))
+      throw error;
   }
-  const failures = [];
-  let first;
-  for (const entry of accountLogins(login)) {
+  if (session)
+    await session.logout().catch((error) => failed("the CLI login", error));
+  for (const entry of legacy ? accountLogins(legacy) : []) {
     try {
       await deps.api.revokeApiKey(entry.key, entry.key_id);
     } catch (error) {
       if (error instanceof HttpError && (error.status === 401 || error.status === 404))
         continue;
-      const failure = error instanceof Error ? error : new Error("The revocation failed.");
-      first ??= failure;
-      failures.push(`${entry.key_id}: ${failure.message}`);
+      failed(entry.key_id, error);
     }
   }
   await deps.credentials.remove();
+  if (!session && !legacy) {
+    deps.output("Not logged in.");
+    return;
+  }
   if (failures.length)
-    throw new Error(`Removed the saved login, but could not revoke ${failures.length === 1 ? "its key" : "these keys"} ${failures.join("; ")} Revoke ${failures.length === 1 ? "it" : "them"} under API keys in the Tonbo console.`, { cause: first });
-  deps.output(login.accounts && Object.keys(login.accounts).length > 1 ? "Logged out. Every account's CLI key on this computer is revoked." : "Logged out. The CLI key is revoked.");
+    throw new Error(`Removed the saved login, but could not revoke ${failures.join("; ")}. Revoke ${failures.length === 1 ? "it" : "them"} on the Sign-in sessions page or under API keys in the Tonbo console.`, { cause: first });
+  deps.output(session ? "Logged out. This computer's CLI login is ended for every account." : "Logged out. Every account's CLI key on this computer is revoked.");
 }
 
 // ../../packages/tonbo-cli-core/dist/src/origin.js
@@ -2410,7 +3379,7 @@ var TerminalProgress = class {
 };
 
 // src/commands.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 
 // src/agent-name.ts
 var AGENT_NAME_RULE = agentNameContract.$defs.name;
@@ -2467,7 +3436,7 @@ async function agentCreateCommand(deps, name, options = {}) {
   const agent = await deps.api.createAgent(
     key,
     { name, region, ...options.role === void 0 ? {} : { role: options.role } },
-    options.idempotencyKey ?? randomUUID2()
+    options.idempotencyKey ?? randomUUID3()
   );
   print(
     deps,
@@ -2756,7 +3725,7 @@ async function bucketCreateCommand(deps, name, options = {}) {
   const bucket = await deps.api.createBucket(
     await deps.auth.apiKey(),
     { name, region: options.region },
-    options.idempotencyKey ?? randomUUID2()
+    options.idempotencyKey ?? randomUUID3()
   );
   print(
     deps,
@@ -2887,7 +3856,7 @@ async function databaseCreateCommand(deps, name, options = {}) {
   const database = await deps.api.createDatabase(
     await deps.auth.apiKey(),
     { name, region: options.region, expires_at: expiresAt },
-    options.idempotencyKey ?? randomUUID2()
+    options.idempotencyKey ?? randomUUID3()
   );
   print(
     deps,
@@ -3075,7 +4044,7 @@ async function streamCreateCommand(deps, name, options = {}) {
       content_type: options.contentType,
       expires_at: expiresAt
     },
-    options.idempotencyKey ?? randomUUID2()
+    options.idempotencyKey ?? randomUUID3()
   );
   print(
     deps,
@@ -3238,14 +4207,71 @@ async function usageShowCommand(deps, options = {}) {
   );
 }
 
+// src/account.ts
+async function sessionOf(deps, command) {
+  const session = await deps.credentials.session();
+  if (!session)
+    throw new Error(
+      `\`${command}\` needs the CLI login that reaches every account you belong to. Run \`tonbo login\`.`
+    );
+  return session;
+}
+async function accountListCommand(deps, options = {}) {
+  if (process.env.TONBO_API_KEY?.trim())
+    throw new Error(
+      "TONBO_API_KEY reaches only its own account (`tonbo account show`). Unset it to list the accounts your login reaches."
+    );
+  const session = await sessionOf(deps, "tonbo account list");
+  const accounts = await deps.credentials.refreshAccounts(session);
+  const chosen = session.stored.default_account_id ?? session.stored.personal_account_id;
+  const rows = accounts.map((account) => ({
+    ...account,
+    default: account.id === chosen
+  }));
+  print(
+    deps,
+    options.json,
+    rows,
+    table(
+      ["", "NAME", "KIND", "YOUR ROLE", "ID"],
+      rows.map((row) => [row.default ? "*" : "", row.name, row.kind, row.role, row.id])
+    )
+  );
+}
+async function accountUseCommand(deps, account, options = {}) {
+  const session = await sessionOf(deps, "tonbo account use");
+  const wanted = account.toLowerCase();
+  const accounts = await deps.credentials.refreshAccounts(session);
+  const found = accounts.find(
+    (entry) => entry.id === account || entry.name.toLowerCase() === wanted
+  );
+  if (!found)
+    throw new UnknownAccountError(
+      `You belong to no account named ${account}. \`tonbo account list\` lists yours.`
+    );
+  const stored = session.stored;
+  const saved = {
+    ...stored,
+    default_account_id: found.id === stored.personal_account_id ? null : found.id
+  };
+  await deps.credentials.sessions.save(saved);
+  session.stored = saved;
+  print(
+    deps,
+    options.json,
+    { ...found, default: true },
+    `Commands act in ${found.kind === "user" ? `${found.name}, your personal account,` : found.name} from now on, unless you pass --account.`
+  );
+}
+
 // src/help.ts
 import { Help } from "commander";
 
 // src/machine.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 
 // src/volume.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 var VOLUME_DURABILITY_LINK = "https://tonbo.dev/docs/machines/guarantees/data#volume";
 var VOLUME_ERROR_HINTS = {
   payment_required: "Add credit at <billing>, then create the Volume again.",
@@ -3331,7 +4357,7 @@ async function volumeCreateCommand(deps, name, options = {}) {
     const volume = await deps.api.createVolume(
       key,
       { name, region, size_gib: sizeGib },
-      options.idempotencyKey ?? randomUUID3()
+      options.idempotencyKey ?? randomUUID4()
     );
     print(
       deps,
@@ -3389,8 +4415,8 @@ var MACHINE_ERROR_HINTS = {
   precondition_failed: "The Machine changed since it was read, or another Machine now has its name; `tonbo machine show` it and run the command again.",
   machine_failed: "A Machine whose creation failed does not change: `tonbo machine show` says why; delete it with `tonbo machine delete` and create it again.",
   snapshot_would_be_discarded: "Pass --discard-snapshot to apply the change at the next boot, which then starts fresh.",
-  database_limit_reached: "Each Machine counts one database: delete a Machine or a database (`tonbo database list`) first.",
   machine_limit_reached: "The account holds as many Machines as it may: delete one you no longer need (`tonbo machine list`), or ask for more.",
+  database_bound: "Another Machine binds that database, and a database binds one Machine: name another, or delete the Machine that binds it first.",
   idempotency_conflict: "That idempotency key belongs to another request: leave out --idempotency-key to create a new Machine.",
   create_rate_limited: "Too many Machines were created in the last hour; try again later.",
   image_pulling: "The Machine's image is still being pulled; the request was not run. Try again shortly; `tonbo machine show` reports the image's state.",
@@ -3405,8 +4431,8 @@ var MACHINE_IMAGE_FAILURE_HINTS = {
   image_unsupported: "Rebuild the image without the entry the message names"
 };
 var MACHINE_CREATION_FAILURE_HINTS = {
-  database_creation_failed: "The Machine's database could not be created; the message names the stream and the code. If the code is payment_required, add credit at <billing> first; then delete the Machine and create it again.",
-  database_limit_reached: "Each Machine counts one database: delete a Machine or a database (`tonbo database list`), then delete this Machine and create it again.",
+  database_creation_failed: "A stream of the Machine (its logs) could not be created; the message names the stream and the code. If the code is payment_required, add credit at <billing> first; then delete the Machine and create it again.",
+  database_limit_reached: "The account's database limit was reached: delete a database (`tonbo database list`), then delete this Machine and create it again.",
   payment_required: "The account's credit is exhausted: add credit at <billing>, then delete the Machine and create it again.",
   ...Object.fromEntries(
     Object.entries(MACHINE_IMAGE_FAILURE_HINTS).map(([code, hint]) => [
@@ -3596,7 +4622,7 @@ function machineFields(machine, billing, etag = null, lastEnd = null) {
     ["Stop grace", `${machine.stop_grace_seconds} s`],
     ["Volume", volumeText(machine)],
     ...deleteFields(machine),
-    ["Database", `${machine.database.name} (${machine.database.url})`],
+    ["Database", machine.database ? `${machine.database.name} (${machine.database.url})` : "none"],
     ["Logs", machine.logs.url],
     ["Durability", DURABILITY_LINK],
     ["Revision", String(machine.revision)],
@@ -3854,7 +4880,12 @@ async function machineCreateCommand(deps, name, command, options = {}) {
     const ports = withDefault(parsePorts(options.port ?? []), options.defaultPort);
     const key = await deps.auth.apiKey();
     const bound = typeof options.volume === "string" ? await resolveVolumeBinding(deps, key, options.volume) : null;
-    const region = options.region ?? bound?.region;
+    const database = typeof options.database === "string" ? await deps.api.getDatabase(key, options.database) : null;
+    if (database && bound && database.region !== bound.region && !options.region)
+      throw new Error(
+        `The Volume is in ${bound.region} and database ${database.name} in ${database.region}; a Machine binds both only in its own region.`
+      );
+    const region = options.region ?? bound?.region ?? database?.region;
     const shape = options.shape ?? (await deps.api.listMachineShapes(key)).default;
     let created;
     try {
@@ -3872,9 +4903,11 @@ async function machineCreateCommand(deps, name, command, options = {}) {
           idle_action: options.idleAction,
           stop_grace_seconds: options.stopGrace,
           ...bound ? { volumes: [bound.binding] } : {},
-          delete_after_seconds: deleteAfterSeconds(options.deleteAfter)
+          delete_after_seconds: deleteAfterSeconds(options.deleteAfter),
+          ...database ? { database: database.name } : {},
+          ...options.database === false ? { database: null } : {}
         },
-        options.idempotencyKey ?? randomUUID4()
+        options.idempotencyKey ?? randomUUID5()
       );
     } catch (error) {
       if (error instanceof HttpError && error.code === "name_taken")
@@ -4104,9 +5137,11 @@ async function machineDeleteCommand(deps, name, options = {}) {
 }
 async function deleteQuestion(deps, key, name, read) {
   let kind = null;
+  let ownDatabase = false;
   try {
     const answer = await deps.api.getMachineWithEtag(key, name);
     kind = answer.machine.kind;
+    ownDatabase = answer.machine.kind === "managed" && !!answer.machine.database?.name.startsWith("m.");
     read.etag = answer.etag;
   } catch (error) {
     if (!(error instanceof HttpError && error.status === 404)) throw error;
@@ -4114,7 +5149,7 @@ async function deleteQuestion(deps, key, name, read) {
   if (kind === "byoc")
     return `Forget your computer ${name}? It disappears from your Machines; its key is not revoked. Type its name to confirm:`;
   if (kind === "managed")
-    return `Delete Machine ${name} with its disk, database and logs? This cannot be undone. Type the Machine's name to confirm:`;
+    return `Delete Machine ${name} with its disk${ownDatabase ? ", database" : ""} and logs? This cannot be undone. Type the Machine's name to confirm:`;
   return `Delete Machine ${name}? Type its name to confirm:`;
 }
 function deletedText(name, machine, kind) {
@@ -4154,7 +5189,11 @@ async function machineShapesCommand(deps, options = {}) {
 var ENVIRONMENT = [
   {
     names: ["TONBO_API_KEY"],
-    description: "A personal key (`tbo_\u2026`) every command uses instead of the saved login, for non-interactive use such as CI. `tonbo logout` acts only on the saved login."
+    description: "An API key (`tbo_\u2026`) of one account that every command uses instead of the saved login, for non-interactive use such as CI and Agents. `--account` and `TONBO_ACCOUNT` must then name the key's own account. `tonbo logout` acts only on the saved login."
+  },
+  {
+    names: ["TONBO_ACCOUNT"],
+    description: "The account commands act in, by name or id, when `--account` is not given; else the default `tonbo account use` set, else your personal account."
   },
   {
     names: ["TONBO_API_ORIGIN"],
@@ -4162,7 +5201,11 @@ var ENVIRONMENT = [
   },
   {
     names: ["XDG_CONFIG_HOME"],
-    description: "Where the login file lives: `$XDG_CONFIG_HOME/tonbo/credentials.json` when it is set and not empty, else `$HOME/.config/tonbo/credentials.json`."
+    description: "Where the login file lives: `$XDG_CONFIG_HOME/tonbo/login.json` when it is set and not empty, else `$HOME/.config/tonbo/login.json`. A login an earlier release saved, `credentials.json` beside it, is read only when there is no `login.json`."
+  },
+  {
+    names: ["XDG_STATE_HOME"],
+    description: "Where this computer's device id lives, which the login is tied to: `$XDG_STATE_HOME/tonbo-yield/device.json` when it is set and not empty, else `$HOME/.local/state/tonbo-yield/device.json`. `yield` shares it."
   },
   {
     names: ["SSH_CONNECTION", "SSH_CLIENT", "SSH_TTY"],
@@ -4198,10 +5241,11 @@ var TOPICS = [
   },
   {
     id: "credentials",
-    title: "Keys and the login file",
+    title: "The login, accounts and keys",
     text: [
-      "Every command but `login` and `logout` sends a personal key as its Bearer credential: `TONBO_API_KEY` when it is set, else the key `tonbo login` saved. What a command may do is what that key's member may do in the account, as narrowed by the key; the CLI never decides it.",
-      "The login is saved at `${XDG_CONFIG_HOME:-$HOME/.config}/tonbo/credentials.json`, which `yield` shares: either CLI's `login` signs both in, and either `logout` signs both out. The CLI replaces the file atomically with owner-only permissions and refuses a symlink or a file other users can read. A file an earlier release wrote is never migrated; run `tonbo login`."
+      "Log in once per computer: `tonbo login` signs this computer in as you, and every account you belong to is reachable with `--account`, with your role in each. Joining an organization needs no new login, and leaving one ends this computer's access to it at once. A command acts in one account: `--account`, else `TONBO_ACCOUNT`, else the default `tonbo account use` set, else your personal account. For each request the CLI exchanges the login for a short-lived token of that account; what a command may do is what your role there allows, and the CLI never decides it.",
+      "`TONBO_API_KEY`, when it is set, is used instead: an API key reaches only its own account and is sent as the Bearer credential, as narrowed by the key. Agents and CI should use an Agent key or an API key of one account, never your login, which reaches every account you belong to.",
+      "The login is saved at `${XDG_CONFIG_HOME:-$HOME/.config}/tonbo/login.json`, which `yield` shares: either CLI's `login` signs both in, and either `logout` signs both out. It works only on the computer that logged in, ends after 30 days unused or 180 days at most, and is listed and revoked on the console's Sign-in sessions page. The CLI replaces the file atomically with owner-only permissions and refuses a symlink or a file other users can read."
     ]
   },
   {
@@ -4238,24 +5282,37 @@ var NAME = (noun) => ({ name: `the ${noun}'s name` });
 var COMMAND_HELP = {
   "tonbo login": {
     about: [
-      "Prints the login URL and opens the browser at `https://tonbo.dev/cli/login`, where you pick the account and approve a personal API key named `CLI on <hostname>`. The browser returns a one-time code to a local callback on `127.0.0.1`, and the CLI redeems it with its PKCE verifier for the key.",
-      "The key acts as you, with your role in that account. It expires after six months and replaces the key an earlier login on the same computer created; there is no refresh, so an expired or revoked key asks you to run `tonbo login` again. `tonbo` acts in the account of the last login: log in again to switch. The login file keeps one key per account of this computer beside it, for `yield`; a key in an account other than your personal one is named `Yield CLI \xB7 <8 hex>` instead of after the host.",
-      "When the browser is on another computer, the login uses a device code instead: with `--device`, in an SSH session without a display, or when no browser can be opened here. The CLI prints a short code and `https://tonbo.dev/cli/device`; open it in any browser where you are signed in, enter the code, check the computer name it shows, pick the account and approve. The CLI polls and saves the same key. The code works once and expires after ten minutes."
+      "Prints the login URL and opens the browser at `https://tonbo.dev/cli/login`, which names this computer and asks you to sign it in as you. It can then act in every account you belong to, with your role in each, so approve only a computer you are using. The browser returns a one-time code to a local callback on `127.0.0.1`, and the CLI redeems it with its PKCE verifier for the login, tied to this computer's device id.",
+      "There is one login per computer: a new one replaces this computer's earlier login. It ends after 30 days unused or 180 days at most, when you log out, or when you revoke it on the console's Sign-in sessions page; then run `tonbo login` again. With `--account`, commands act in that account by default afterwards, as `tonbo account use` sets.",
+      "When the browser is on another computer, the login uses a device code instead: with `--device`, in an SSH session without a display, or when no browser can be opened here. The CLI prints a short code and `https://tonbo.dev/cli/device`; open it in any browser where you are signed in, enter the code, check the computer name it shows and approve. The CLI polls and saves the same login. The code works once and expires after ten minutes."
     ],
-    examples: ["tonbo login", "tonbo login --device"],
-    defaults: { "--account": "your personal account" }
+    examples: ["tonbo login", "tonbo login --device", "tonbo login --account acme"]
   },
   "tonbo logout": {
     about: [
-      "Revokes every account's key in the login file, each with its own credential, and removes the file, which signs `yield` out too. A key that is already revoked or expired is skipped. If another revocation fails, the file is still removed, and the CLI prints the key's id and exits 1, so you can revoke it under API keys in the console. `TONBO_API_KEY` is never touched."
+      "Ends this computer's login for every account and removes the file, which signs `yield` out too. A login an earlier release saved (one key per account in `credentials.json`) has each key revoked as well; one already revoked or expired is skipped. If a revocation fails, the files are still removed, and the CLI says what it could not revoke and exits 1, so you can revoke it on the console's Sign-in sessions page or under API keys. `TONBO_API_KEY` is never touched."
     ],
     examples: ["tonbo logout"]
   },
   "tonbo account show": {
     about: [
-      "Prints the account you are logged in to: its id, name and kind, your member subject and role in it, and its limits."
+      "Prints the account commands act in: its id, name and kind, your member subject and role in it, and its limits."
+    ],
+    examples: ["tonbo account show --json", "tonbo account show --account acme"]
+  },
+  "tonbo account list": {
+    about: [
+      "Lists every account your login reaches, read from Tonbo now: its name, whether it is your personal account or an organization, your role there and its id. `*` marks the account commands act in without `--account`. With `--json` it prints the list, each entry with `default`.",
+      "It needs the login of `tonbo login`: an API key in `TONBO_API_KEY` reaches only its own account, which `tonbo account show` prints."
     ],
-    examples: ["tonbo account show --json"]
+    examples: ["tonbo account list", "tonbo account list --json"]
+  },
+  "tonbo account use": {
+    about: [
+      "Makes the account the one commands act in from now on when they name none, on this computer only; `--account` and `TONBO_ACCOUNT` still choose another for one command. The account is checked against the accounts you belong to now. Use your personal account's name to go back to it."
+    ],
+    examples: ["tonbo account use acme"],
+    arguments: { account: "an account you belong to, by name or id" }
   },
   "tonbo region list": {
     about: [
@@ -4482,7 +5539,7 @@ var COMMAND_HELP = {
   },
   "tonbo machine create": {
     about: [
-      "Creates a Machine, a VM booted from an image in one region with its own database. The image is a public OCI image with a linux/arm64 variant, from Docker Hub or another public registry (`nginx:1.27`, `ghcr.io/org/app:v1`, or one pinned by digest), or `tonbo.dev/platform`, the platform image. A registry reachable only over IPv6, one named by an IP address, and one that redirects its manifests are refused. The CLI resolves a registry image to its linux/arm64 digest, and the image is pulled before the Machine leaves `creating`.",
+      "Creates a Machine, a VM booted from an image in one region. It has no database of its own: `--database <name>` binds one of the account's databases of its region, which it then reaches at `TONBO_DATABASE_URL`, and a database binds one Machine at a time; its files can last on a Volume (`--volume`), and its program can open any other database by URL with a key. The image is a public OCI image with a linux/arm64 variant, from Docker Hub or another public registry (`nginx:1.27`, `ghcr.io/org/app:v1`, or one pinned by digest), or `tonbo.dev/platform`, the platform image. A registry reachable only over IPv6, one named by an IP address, and one that redirects its manifests are refused. The CLI resolves a registry image to its linux/arm64 digest, and the image is pulled before the Machine leaves `creating`.",
       "The Machine is served at `https://<name>-<account>.tonbo.sh` on its default port. `--port <port>` serves a private port, which takes a member's token, and `--port <port>:public` an open one, which needs the `machines.public` capability. A command after `--` replaces the image's CMD. The CLI warns on stderr when the Machine has no port, since nothing can wake it then, and when an `--env` key looks secret: env values are readable by every member through the API.",
       "The answer is the Machine while it is `creating`. With `--wait` the CLI reads it until it is `active` or `failed`, or `--timeout` passes: a failure prints what to do and exits 1, and a timeout says it is still creating and undoes nothing. A creation the network or a 5xx answer did not confirm is sent at most three times with the same idempotency key, each retry after its `Retry-After` (at most 30 s) or a short backoff; a `name_taken` refusal says which Machine holds the name and how old it is, in case it is yours from a lost reply. In a region not open for Machines the creation is refused with `region_not_offered`, and nothing is created."
     ],
@@ -4494,7 +5551,7 @@ var COMMAND_HELP = {
     defaults: {
       "--shape": "the shape `tonbo machine shapes` marks as the default",
       "--default-port": "the first --port",
-      "--region": "the --volume's region, else the account's default region",
+      "--region": "the --volume's or --database's region, else the account's default region",
       "--idempotency-key": "a new UUID",
       "--timeout": String(DEFAULT_WAIT_SECONDS),
       "--delete-after": "never"
@@ -4502,7 +5559,7 @@ var COMMAND_HELP = {
   },
   "tonbo machine show": {
     about: [
-      "Prints the Machine's state and what it means (an `active` Machine that is asleep boots on its first request), its hostnames, image and whether it is pulled, the live activation and conditions with what to do about each, when it sleeps, its database and logs URLs, a link to what its disk keeps, its ETag and who created it. For an `active` Machine it also reads the newest activations and prints how the last one ended. When the live activation runs an older revision than the Machine's, it says which changes already apply and that the rest apply after `tonbo machine sleep <name>`.",
+      "Prints the Machine's state and what it means (an `active` Machine that is asleep boots on its first request), its hostnames, image and whether it is pulled, the live activation and conditions with what to do about each, when it sleeps, the database it binds (or none) and its logs URL, a link to what its disk keeps, its ETag and who created it. For an `active` Machine it also reads the newest activations and prints how the last one ended. When the live activation runs an older revision than the Machine's, it says which changes already apply and that the rest apply after `tonbo machine sleep <name>`.",
       "When the default port is private, it prints the `curl` call that reaches it with a personal key. For one of your computers it prints its system, harnesses, hostname and device id, which only you see."
     ],
     examples: ["tonbo machine show web"],
@@ -4534,7 +5591,7 @@ var COMMAND_HELP = {
   },
   "tonbo machine delete": {
     about: [
-      "Deletes the Machine with its disk, database and logs; its name is free for a new Machine at once. At a terminal it asks you to type the Machine's name first, and sends the ETag it read then.",
+      "Deletes the Machine with its disk and logs; a Volume or database it binds stays. Its name is free for a new Machine at once. At a terminal it asks you to type the Machine's name first, and sends the ETag it read then.",
       "For one of your computers it forgets the computer: it leaves the list at once, and its name is free once the forget completes. Forgetting does not revoke the computer's key, so a computer whose key is still active registers again at its next start; run `yield logout` on it, or `tonbo api-key revoke`, first."
     ],
     examples: ["tonbo machine delete web --yes"],
@@ -4648,19 +5705,19 @@ function optionDescription(option) {
 function applyHelp(program) {
   const named = /* @__PURE__ */ new Set();
   const walk = (command, words) => {
-    const path2 = words.join(" ");
+    const path4 = words.join(" ");
     command.configureHelp({ ...command.configureHelp(), optionDescription });
-    const help = COMMAND_HELP[path2];
+    const help = COMMAND_HELP[path4];
     if (help) {
-      named.add(path2);
+      named.add(path4);
       for (const [name, text] of Object.entries(help.arguments ?? {})) {
         const argument = command.registeredArguments.find((entry) => entry.name() === name);
-        if (!argument) throw new Error(`${path2} has no argument ${name}`);
+        if (!argument) throw new Error(`${path4} has no argument ${name}`);
         argument.description = text;
       }
       for (const [flag, text] of Object.entries(help.defaults ?? {})) {
         const option = command.options.find((entry) => entry.long === flag);
-        if (!option) throw new Error(`${path2} has no option ${flag}`);
+        if (!option) throw new Error(`${path4} has no option ${flag}`);
         option.defaultValueDescription = text;
       }
       command.addHelpText("after", commandHelpText(help));
@@ -4668,8 +5725,8 @@ function applyHelp(program) {
     for (const child of command.commands) walk(child, [...words, child.name()]);
   };
   walk(program, [program.name()]);
-  for (const path2 of Object.keys(COMMAND_HELP))
-    if (!named.has(path2)) throw new Error(`The help of ${path2} names no command`);
+  for (const path4 of Object.keys(COMMAND_HELP))
+    if (!named.has(path4)) throw new Error(`The help of ${path4} names no command`);
   program.addHelpText("after", programHelpText());
   return program;
 }
@@ -4703,13 +5760,29 @@ async function terminalAsk(question) {
 var packageVersion = JSON.parse(
   readFileSync(new URL("../../package.json", import.meta.url), "utf8")
 );
-function createDependencies() {
+function createDependencies(selection = {}) {
   const api = apiOrigin();
-  const credentials = new FileCredentialStore();
+  const account = selection.account?.trim() || process.env.TONBO_ACCOUNT?.trim() || void 0;
+  const credentials = new LoginStore({
+    fetcher: fetch,
+    apiOrigin: api,
+    loginOrigin: loginOrigin(api),
+    account
+  });
   return {
     api: new ManagementApi(fetch, api),
     ask: terminalAsk,
-    auth: new AuthClient(credentials, fetch, loginOrigin(api)),
+    auth: new AuthClient(
+      credentials,
+      fetch,
+      loginOrigin(api),
+      void 0,
+      void 0,
+      void 0,
+      void 0,
+      process.env,
+      { client: "tonbo", clientVersion: packageVersion.version }
+    ),
     credentials,
     interactive: () => process.stdin.isTTY === true && process.stderr.isTTY === true,
     output: (text) => console.log(text),
@@ -4786,20 +5859,31 @@ function parseUsageSort(value) {
     throw new InvalidArgumentError(error.message);
   }
 }
-function createProgram(dependencies = createDependencies) {
-  const program = new Command().name("tonbo").description("Sign in to Tonbo and manage account resources.").version(packageVersion.version);
-  program.command("login").description("sign in through the browser and save a personal key for this computer").option("--account <name>", "the account to log in to").option(
+function createProgram(makeDependencies = createDependencies) {
+  const program = new Command().name("tonbo").description("Sign in to Tonbo and manage account resources.").version(packageVersion.version).option(
+    "--account <account>",
+    "the account to act in, by name or id: any account you belong to; else TONBO_ACCOUNT, else the default `tonbo account use` set, else your personal account"
+  );
+  const dependencies = () => makeDependencies({ account: program.opts().account });
+  program.command("login").description(
+    "sign this computer in through the browser; it can then act in every account you belong to"
+  ).option(
     "--device",
     "approve with a code in a browser on any computer, as over SSH without a display"
   ).action(async (options) => {
-    await loginCommand(dependencies(), options);
+    const account2 = program.opts().account;
+    await loginCommand(dependencies(), { ...options, account: account2 });
   });
-  program.command("logout").description("revoke this computer's key and remove the saved login").action(async () => logoutCommand(dependencies()));
-  const account = program.command("account").description("the account you are logged in to");
+  program.command("logout").description("end this computer's CLI login and remove the saved login").action(async () => logoutCommand(dependencies()));
+  const account = program.command("account").description("the accounts you belong to and the one commands act in");
   operationOptions(
     account.command("show").description("show the account, your role in it and its limits"),
     "getAccount"
   ).action(async (options) => accountShowCommand(dependencies(), options));
+  account.command("list").description("list the accounts your login reaches, with your role, the default marked").option("--json", "print the accounts as JSON").action(async (options) => accountListCommand(dependencies(), options));
+  account.command("use <account>").description("act in this account, by name or id, from now on unless --account names another").option("--json", "print the account as JSON").action(
+    async (name, options) => accountUseCommand(dependencies(), name, options)
+  );
   operationOptions(
     program.command("region").description("regions new resources can be created in").command("list").description("list the regions"),
     "listRegions"
@@ -5042,7 +6126,10 @@ function createProgram(dependencies = createDependencies) {
       ).requiredOption(
         "--image <reference>",
         "the image the Machine boots: a public OCI image with a linux/arm64 variant (nginx:1.27, ghcr.io/org/app@sha256:...), or tonbo.dev/platform"
-      ).option("--region <region>", "the Machine's region, fixed for its life"),
+      ).option("--region <region>", "the Machine's region, fixed for its life").option(
+        "--database <name>",
+        "bind the account's database <name> (see tonbo database list), of the Machine's region: its URL is TONBO_DATABASE_URL and the Machine writes it"
+      ).option("--no-database", "bind no database (the default)"),
       false
     ).option(
       "--idempotency-key <key>",
@@ -5076,9 +6163,7 @@ function createProgram(dependencies = createDependencies) {
     async (name, options) => machineSleepCommand(dependencies(), name, options)
   );
   operationOptions(
-    machine.command("delete <name>").description(
-      "delete a Machine with its disk, database and logs, or forget one of your computers"
-    ).option("--yes", "delete without asking; required when stdin is not a terminal").option("--if-match <etag>", ifMatchHelp("delete")),
+    machine.command("delete <name>").description("delete a Machine with its disk and logs, or forget one of your computers").option("--yes", "delete without asking; required when stdin is not a terminal").option("--if-match <etag>", ifMatchHelp("delete")),
     "deleteMachine"
   ).action(
     async (name, options) => machineDeleteCommand(dependencies(), name, options)