cloudhop 1.2.1 → 1.3.1

package/dist/cli.js

@@ -26,9 +26,9 @@ var __export = (target, all) => {
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    for (let key2 of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key2) && key2 !== except)
+        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
   }
   return to;
 };
@@ -118,11 +118,11 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path2) {
-      const ctrl = callVisitor(key, node, visitor, path2);
+    function visit_(key2, node, visitor, path2) {
+      const ctrl = callVisitor(key2, node, visitor, path2);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path2, ctrl);
-        return visit_(key, ctrl, visitor, path2);
+        replaceNode(key2, path2, ctrl);
+        return visit_(key2, ctrl, visitor, path2);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
@@ -166,11 +166,11 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path2) {
-      const ctrl = await callVisitor(key, node, visitor, path2);
+    async function visitAsync_(key2, node, visitor, path2) {
+      const ctrl = await callVisitor(key2, node, visitor, path2);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path2, ctrl);
-        return visitAsync_(key, ctrl, visitor, path2);
+        replaceNode(key2, path2, ctrl);
+        return visitAsync_(key2, ctrl, visitor, path2);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
@@ -220,27 +220,27 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path2) {
+    function callVisitor(key2, node, visitor, path2) {
       if (typeof visitor === "function")
-        return visitor(key, node, path2);
+        return visitor(key2, node, path2);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path2);
+        return visitor.Map?.(key2, node, path2);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path2);
+        return visitor.Seq?.(key2, node, path2);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path2);
+        return visitor.Pair?.(key2, node, path2);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path2);
+        return visitor.Scalar?.(key2, node, path2);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path2);
+        return visitor.Alias?.(key2, node, path2);
       return void 0;
     }
-    function replaceNode(key, path2, node) {
+    function replaceNode(key2, path2, node) {
       const parent = path2[path2.length - 1];
       if (identity.isCollection(parent)) {
-        parent.items[key] = node;
+        parent.items[key2] = node;
       } else if (identity.isPair(parent)) {
-        if (key === "key")
+        if (key2 === "key")
           parent.key = node;
         else
           parent.value = node;
@@ -501,7 +501,7 @@ var require_anchors = __commonJS({
 var require_applyReviver = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/doc/applyReviver.js"(exports) {
     "use strict";
-    function applyReviver(reviver, obj, key, val) {
+    function applyReviver(reviver, obj, key2, val) {
       if (val && typeof val === "object") {
         if (Array.isArray(val)) {
           for (let i2 = 0, len = val.length; i2 < len; ++i2) {
@@ -541,7 +541,7 @@ var require_applyReviver = __commonJS({
           }
         }
       }
-      return reviver.call(obj, key, val);
+      return reviver.call(obj, key2, val);
     }
     exports.applyReviver = applyReviver;
   }
@@ -904,14 +904,14 @@ var require_Collection = __commonJS({
         if (isEmptyPath(path2))
           this.add(value);
         else {
-          const [key, ...rest] = path2;
-          const node = this.get(key, true);
+          const [key2, ...rest] = path2;
+          const node = this.get(key2, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
           else if (node === void 0 && this.schema)
-            this.set(key, collectionFromPath(this.schema, rest, value));
+            this.set(key2, collectionFromPath(this.schema, rest, value));
           else
-            throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
+            throw new Error(`Expected YAML collection at ${key2}. Remaining path: ${rest}`);
         }
       }
       /**
@@ -919,14 +919,14 @@ var require_Collection = __commonJS({
        * @returns `true` if the item was found and removed.
        */
       deleteIn(path2) {
-        const [key, ...rest] = path2;
+        const [key2, ...rest] = path2;
         if (rest.length === 0)
-          return this.delete(key);
-        const node = this.get(key, true);
+          return this.delete(key2);
+        const node = this.get(key2, true);
         if (identity.isCollection(node))
           return node.deleteIn(rest);
         else
-          throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
+          throw new Error(`Expected YAML collection at ${key2}. Remaining path: ${rest}`);
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -934,8 +934,8 @@ var require_Collection = __commonJS({
        * `true` (collections are always returned intact).
        */
       getIn(path2, keepScalar) {
-        const [key, ...rest] = path2;
-        const node = this.get(key, true);
+        const [key2, ...rest] = path2;
+        const node = this.get(key2, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
         else
@@ -953,10 +953,10 @@ var require_Collection = __commonJS({
        * Checks if the collection includes a value with the key `key`.
        */
       hasIn(path2) {
-        const [key, ...rest] = path2;
+        const [key2, ...rest] = path2;
         if (rest.length === 0)
-          return this.has(key);
-        const node = this.get(key, true);
+          return this.has(key2);
+        const node = this.get(key2, true);
         return identity.isCollection(node) ? node.hasIn(rest) : false;
       }
       /**
@@ -964,17 +964,17 @@ var require_Collection = __commonJS({
        * boolean to add/remove the item from the set.
        */
       setIn(path2, value) {
-        const [key, ...rest] = path2;
+        const [key2, ...rest] = path2;
         if (rest.length === 0) {
-          this.set(key, value);
+          this.set(key2, value);
         } else {
-          const node = this.get(key, true);
+          const node = this.get(key2, true);
           if (identity.isCollection(node))
             node.setIn(rest, value);
           else if (node === void 0 && this.schema)
-            this.set(key, collectionFromPath(this.schema, rest, value));
+            this.set(key2, collectionFromPath(this.schema, rest, value));
           else
-            throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
+            throw new Error(`Expected YAML collection at ${key2}. Remaining path: ${rest}`);
         }
       }
     };
@@ -1552,19 +1552,19 @@ var require_stringifyPair = __commonJS({
     var Scalar = require_Scalar();
     var stringify3 = require_stringify();
     var stringifyComment = require_stringifyComment();
-    function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
+    function stringifyPair({ key: key2, value }, ctx, onComment, onChompKeep) {
       const { allNullValues, doc, indent, indentStep, options: { commentString, indentSeq, simpleKeys } } = ctx;
-      let keyComment = identity.isNode(key) && key.comment || null;
+      let keyComment = identity.isNode(key2) && key2.comment || null;
       if (simpleKeys) {
         if (keyComment) {
           throw new Error("With simple keys, key nodes cannot have comments");
         }
-        if (identity.isCollection(key) || !identity.isNode(key) && typeof key === "object") {
+        if (identity.isCollection(key2) || !identity.isNode(key2) && typeof key2 === "object") {
           const msg = "With simple keys, collection cannot be used as a key value";
           throw new Error(msg);
         }
       }
-      let explicitKey = !simpleKeys && (!key || keyComment && value == null && !ctx.inFlow || identity.isCollection(key) || (identity.isScalar(key) ? key.type === Scalar.Scalar.BLOCK_FOLDED || key.type === Scalar.Scalar.BLOCK_LITERAL : typeof key === "object"));
+      let explicitKey = !simpleKeys && (!key2 || keyComment && value == null && !ctx.inFlow || identity.isCollection(key2) || (identity.isScalar(key2) ? key2.type === Scalar.Scalar.BLOCK_FOLDED || key2.type === Scalar.Scalar.BLOCK_LITERAL : typeof key2 === "object"));
       ctx = Object.assign({}, ctx, {
         allNullValues: false,
         implicitKey: !explicitKey && (simpleKeys || !allNullValues),
@@ -1572,7 +1572,7 @@ var require_stringifyPair = __commonJS({
       });
       let keyCommentDone = false;
       let chompKeep = false;
-      let str = stringify3.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+      let str = stringify3.stringify(key2, ctx, () => keyCommentDone = true, () => chompKeep = true);
       if (!explicitKey && !ctx.inFlow && str.length > 1024) {
         if (simpleKeys)
           throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
@@ -1716,7 +1716,7 @@ var require_merge = __commonJS({
       }),
       stringify: () => MERGE_KEY
     };
-    var isMergeKey = (ctx, key) => (merge.identify(key) || identity.isScalar(key) && (!key.type || key.type === Scalar.Scalar.PLAIN) && merge.identify(key.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge.tag && tag.default);
+    var isMergeKey = (ctx, key2) => (merge.identify(key2) || identity.isScalar(key2) && (!key2.type || key2.type === Scalar.Scalar.PLAIN) && merge.identify(key2.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge.tag && tag.default);
     function addMergeToJSMap(ctx, map, value) {
       const source = resolveAliasValue(ctx, value);
       if (identity.isSeq(source))
@@ -1733,14 +1733,14 @@ var require_merge = __commonJS({
       if (!identity.isMap(source))
         throw new Error("Merge sources must be maps or map aliases");
       const srcMap = source.toJSON(null, ctx, Map);
-      for (const [key, value2] of srcMap) {
+      for (const [key2, value2] of srcMap) {
         if (map instanceof Map) {
-          if (!map.has(key))
-            map.set(key, value2);
+          if (!map.has(key2))
+            map.set(key2, value2);
         } else if (map instanceof Set) {
-          map.add(key);
-        } else if (!Object.prototype.hasOwnProperty.call(map, key)) {
-          Object.defineProperty(map, key, {
+          map.add(key2);
+        } else if (!Object.prototype.hasOwnProperty.call(map, key2)) {
+          Object.defineProperty(map, key2, {
             value: value2,
             writable: true,
             enumerable: true,
@@ -1768,19 +1768,19 @@ var require_addPairToJSMap = __commonJS({
     var stringify3 = require_stringify();
     var identity = require_identity();
     var toJS = require_toJS();
-    function addPairToJSMap(ctx, map, { key, value }) {
-      if (identity.isNode(key) && key.addToJSMap)
-        key.addToJSMap(ctx, map, value);
-      else if (merge.isMergeKey(ctx, key))
+    function addPairToJSMap(ctx, map, { key: key2, value }) {
+      if (identity.isNode(key2) && key2.addToJSMap)
+        key2.addToJSMap(ctx, map, value);
+      else if (merge.isMergeKey(ctx, key2))
         merge.addMergeToJSMap(ctx, map, value);
       else {
-        const jsKey = toJS.toJS(key, "", ctx);
+        const jsKey = toJS.toJS(key2, "", ctx);
         if (map instanceof Map) {
           map.set(jsKey, toJS.toJS(value, jsKey, ctx));
         } else if (map instanceof Set) {
           map.add(jsKey);
         } else {
-          const stringKey = stringifyKey(key, jsKey, ctx);
+          const stringKey = stringifyKey(key2, jsKey, ctx);
           const jsValue = toJS.toJS(value, stringKey, ctx);
           if (stringKey in map)
             Object.defineProperty(map, stringKey, {
@@ -1795,19 +1795,19 @@ var require_addPairToJSMap = __commonJS({
       }
       return map;
     }
-    function stringifyKey(key, jsKey, ctx) {
+    function stringifyKey(key2, jsKey, ctx) {
       if (jsKey === null)
         return "";
       if (typeof jsKey !== "object")
         return String(jsKey);
-      if (identity.isNode(key) && ctx?.doc) {
+      if (identity.isNode(key2) && ctx?.doc) {
         const strCtx = stringify3.createStringifyContext(ctx.doc, {});
         strCtx.anchors = /* @__PURE__ */ new Set();
         for (const node of ctx.anchors.keys())
           strCtx.anchors.add(node.anchor);
         strCtx.inFlow = true;
         strCtx.inStringifyKey = true;
-        const strKey = key.toString(strCtx);
+        const strKey = key2.toString(strCtx);
         if (!ctx.mapKeyWarned) {
           let jsonStr = JSON.stringify(strKey);
           if (jsonStr.length > 40)
@@ -1831,24 +1831,24 @@ var require_Pair = __commonJS({
     var stringifyPair = require_stringifyPair();
     var addPairToJSMap = require_addPairToJSMap();
     var identity = require_identity();
-    function createPair(key, value, ctx) {
-      const k = createNode.createNode(key, void 0, ctx);
+    function createPair(key2, value, ctx) {
+      const k = createNode.createNode(key2, void 0, ctx);
       const v = createNode.createNode(value, void 0, ctx);
       return new Pair(k, v);
     }
     var Pair = class _Pair {
-      constructor(key, value = null) {
+      constructor(key2, value = null) {
         Object.defineProperty(this, identity.NODE_TYPE, { value: identity.PAIR });
-        this.key = key;
+        this.key = key2;
         this.value = value;
       }
       clone(schema) {
-        let { key, value } = this;
-        if (identity.isNode(key))
-          key = key.clone(schema);
+        let { key: key2, value } = this;
+        if (identity.isNode(key2))
+          key2 = key2.clone(schema);
         if (identity.isNode(value))
           value = value.clone(schema);
-        return new _Pair(key, value);
+        return new _Pair(key2, value);
       }
       toJSON(_2, ctx) {
         const pair = ctx?.mapAsMap ? /* @__PURE__ */ new Map() : {};
@@ -2024,11 +2024,11 @@ var require_YAMLMap = __commonJS({
     var identity = require_identity();
     var Pair = require_Pair();
     var Scalar = require_Scalar();
-    function findPair(items, key) {
-      const k = identity.isScalar(key) ? key.value : key;
+    function findPair(items, key2) {
+      const k = identity.isScalar(key2) ? key2.value : key2;
       for (const it of items) {
         if (identity.isPair(it)) {
-          if (it.key === key || it.key === k)
+          if (it.key === key2 || it.key === k)
             return it;
           if (identity.isScalar(it.key) && it.key.value === k)
             return it;
@@ -2051,20 +2051,20 @@ var require_YAMLMap = __commonJS({
       static from(schema, obj, ctx) {
         const { keepUndefined, replacer } = ctx;
         const map = new this(schema);
-        const add = (key, value) => {
+        const add = (key2, value) => {
           if (typeof replacer === "function")
-            value = replacer.call(obj, key, value);
-          else if (Array.isArray(replacer) && !replacer.includes(key))
+            value = replacer.call(obj, key2, value);
+          else if (Array.isArray(replacer) && !replacer.includes(key2))
             return;
           if (value !== void 0 || keepUndefined)
-            map.items.push(Pair.createPair(key, value, ctx));
+            map.items.push(Pair.createPair(key2, value, ctx));
         };
         if (obj instanceof Map) {
-          for (const [key, value] of obj)
-            add(key, value);
+          for (const [key2, value] of obj)
+            add(key2, value);
         } else if (obj && typeof obj === "object") {
-          for (const key of Object.keys(obj))
-            add(key, obj[key]);
+          for (const key2 of Object.keys(obj))
+            add(key2, obj[key2]);
         }
         if (typeof schema.sortMapEntries === "function") {
           map.items.sort(schema.sortMapEntries);
@@ -2104,23 +2104,23 @@ var require_YAMLMap = __commonJS({
           this.items.push(_pair);
         }
       }
-      delete(key) {
-        const it = findPair(this.items, key);
+      delete(key2) {
+        const it = findPair(this.items, key2);
         if (!it)
           return false;
         const del = this.items.splice(this.items.indexOf(it), 1);
         return del.length > 0;
       }
-      get(key, keepScalar) {
-        const it = findPair(this.items, key);
+      get(key2, keepScalar) {
+        const it = findPair(this.items, key2);
         const node = it?.value;
         return (!keepScalar && identity.isScalar(node) ? node.value : node) ?? void 0;
       }
-      has(key) {
-        return !!findPair(this.items, key);
+      has(key2) {
+        return !!findPair(this.items, key2);
       }
-      set(key, value) {
-        this.add(new Pair.Pair(key, value), true);
+      set(key2, value) {
+        this.add(new Pair.Pair(key2, value), true);
       }
       /**
        * @param ctx - Conversion context, originally set in Document#toJS()
@@ -2209,15 +2209,15 @@ var require_YAMLSeq = __commonJS({
        *
        * @returns `true` if the item was found and removed.
        */
-      delete(key) {
-        const idx = asItemIndex(key);
+      delete(key2) {
+        const idx = asItemIndex(key2);
         if (typeof idx !== "number")
           return false;
         const del = this.items.splice(idx, 1);
         return del.length > 0;
       }
-      get(key, keepScalar) {
-        const idx = asItemIndex(key);
+      get(key2, keepScalar) {
+        const idx = asItemIndex(key2);
         if (typeof idx !== "number")
           return void 0;
         const it = this.items[idx];
@@ -2229,8 +2229,8 @@ var require_YAMLSeq = __commonJS({
        * `key` must contain a representation of an integer for this to succeed.
        * It may be wrapped in a `Scalar`.
        */
-      has(key) {
-        const idx = asItemIndex(key);
+      has(key2) {
+        const idx = asItemIndex(key2);
         return typeof idx === "number" && idx < this.items.length;
       }
       /**
@@ -2240,10 +2240,10 @@ var require_YAMLSeq = __commonJS({
        * If `key` does not contain a representation of an integer, this will throw.
        * It may be wrapped in a `Scalar`.
        */
-      set(key, value) {
-        const idx = asItemIndex(key);
+      set(key2, value) {
+        const idx = asItemIndex(key2);
         if (typeof idx !== "number")
-          throw new Error(`Expected a valid index, not ${key}.`);
+          throw new Error(`Expected a valid index, not ${key2}.`);
         const prev = this.items[idx];
         if (identity.isScalar(prev) && Scalar.isScalarValue(value))
           prev.value = value;
@@ -2277,8 +2277,8 @@ var require_YAMLSeq = __commonJS({
           let i2 = 0;
           for (let it of obj) {
             if (typeof replacer === "function") {
-              const key = obj instanceof Set ? it : String(i2++);
-              it = replacer.call(obj, key, it);
+              const key2 = obj instanceof Set ? it : String(i2++);
+              it = replacer.call(obj, key2, it);
             }
             seq.items.push(createNode.createNode(it, void 0, ctx));
           }
@@ -2286,8 +2286,8 @@ var require_YAMLSeq = __commonJS({
         return seq;
       }
     };
-    function asItemIndex(key) {
-      let idx = identity.isScalar(key) ? key.value : key;
+    function asItemIndex(key2) {
+      let idx = identity.isScalar(key2) ? key2.value : key2;
       if (idx && typeof idx === "string")
         idx = Number(idx);
       return typeof idx === "number" && Number.isInteger(idx) && idx >= 0 ? idx : null;
@@ -2701,25 +2701,25 @@ ${cn.comment}` : item.comment;
         for (let it of iterable) {
           if (typeof replacer === "function")
             it = replacer.call(iterable, String(i2++), it);
-          let key, value;
+          let key2, value;
           if (Array.isArray(it)) {
             if (it.length === 2) {
-              key = it[0];
+              key2 = it[0];
               value = it[1];
             } else
               throw new TypeError(`Expected [key, value] tuple: ${it}`);
           } else if (it && it instanceof Object) {
             const keys = Object.keys(it);
             if (keys.length === 1) {
-              key = keys[0];
-              value = it[key];
+              key2 = keys[0];
+              value = it[key2];
             } else {
               throw new TypeError(`Expected tuple with one key, not ${keys.length} keys`);
             }
           } else {
-            key = it;
+            key2 = it;
           }
-          pairs2.items.push(Pair.createPair(key, value, ctx));
+          pairs2.items.push(Pair.createPair(key2, value, ctx));
         }
       return pairs2;
     }
@@ -2766,16 +2766,16 @@ var require_omap = __commonJS({
         if (ctx?.onCreate)
           ctx.onCreate(map);
         for (const pair of this.items) {
-          let key, value;
+          let key2, value;
           if (identity.isPair(pair)) {
-            key = toJS.toJS(pair.key, "", ctx);
-            value = toJS.toJS(pair.value, key, ctx);
+            key2 = toJS.toJS(pair.key, "", ctx);
+            value = toJS.toJS(pair.value, key2, ctx);
           } else {
-            key = toJS.toJS(pair, "", ctx);
+            key2 = toJS.toJS(pair, "", ctx);
           }
-          if (map.has(key))
+          if (map.has(key2))
             throw new Error("Ordered maps must not include duplicate keys");
-          map.set(key, value);
+          map.set(key2, value);
         }
         return map;
       }
@@ -2796,12 +2796,12 @@ var require_omap = __commonJS({
       resolve(seq, onError) {
         const pairs$1 = pairs.resolvePairs(seq, onError);
         const seenKeys = [];
-        for (const { key } of pairs$1.items) {
-          if (identity.isScalar(key)) {
-            if (seenKeys.includes(key.value)) {
-              onError(`Ordered maps must not include duplicate keys: ${key.value}`);
+        for (const { key: key2 } of pairs$1.items) {
+          if (identity.isScalar(key2)) {
+            if (seenKeys.includes(key2.value)) {
+              onError(`Ordered maps must not include duplicate keys: ${key2.value}`);
             } else {
-              seenKeys.push(key.value);
+              seenKeys.push(key2.value);
             }
           }
         }
@@ -2986,14 +2986,14 @@ var require_set = __commonJS({
         super(schema);
         this.tag = _YAMLSet.tag;
       }
-      add(key) {
+      add(key2) {
         let pair;
-        if (identity.isPair(key))
-          pair = key;
-        else if (key && typeof key === "object" && "key" in key && "value" in key && key.value === null)
-          pair = new Pair.Pair(key.key, null);
+        if (identity.isPair(key2))
+          pair = key2;
+        else if (key2 && typeof key2 === "object" && "key" in key2 && "value" in key2 && key2.value === null)
+          pair = new Pair.Pair(key2.key, null);
         else
-          pair = new Pair.Pair(key, null);
+          pair = new Pair.Pair(key2, null);
         const prev = YAMLMap.findPair(this.items, pair.key);
         if (!prev)
           this.items.push(pair);
@@ -3002,18 +3002,18 @@ var require_set = __commonJS({
        * If `keepPair` is `true`, returns the Pair matching `key`.
        * Otherwise, returns the value of that Pair's key.
        */
-      get(key, keepPair) {
-        const pair = YAMLMap.findPair(this.items, key);
+      get(key2, keepPair) {
+        const pair = YAMLMap.findPair(this.items, key2);
         return !keepPair && identity.isPair(pair) ? identity.isScalar(pair.key) ? pair.key.value : pair.key : pair;
       }
-      set(key, value) {
+      set(key2, value) {
         if (typeof value !== "boolean")
           throw new Error(`Expected boolean value for set(key, value) in a YAML set, not ${typeof value}`);
-        const prev = YAMLMap.findPair(this.items, key);
+        const prev = YAMLMap.findPair(this.items, key2);
         if (prev && !value) {
           this.items.splice(this.items.indexOf(prev), 1);
         } else if (!prev && value) {
-          this.items.push(new Pair.Pair(key));
+          this.items.push(new Pair.Pair(key2));
         }
       }
       toJSON(_2, ctx) {
@@ -3260,7 +3260,7 @@ var require_tags = __commonJS({
         if (Array.isArray(customTags))
           tags = [];
         else {
-          const keys = Array.from(schemas.keys()).filter((key) => key !== "yaml11").map((key) => JSON.stringify(key)).join(", ");
+          const keys = Array.from(schemas.keys()).filter((key2) => key2 !== "yaml11").map((key2) => JSON.stringify(key2)).join(", ");
           throw new Error(`Unknown schema "${schemaName}"; use one of ${keys} or define customTags array`);
         }
       }
@@ -3276,7 +3276,7 @@ var require_tags = __commonJS({
         const tagObj = typeof tag === "string" ? tagsByName[tag] : tag;
         if (!tagObj) {
           const tagName = JSON.stringify(tag);
-          const keys = Object.keys(tagsByName).map((key) => JSON.stringify(key)).join(", ");
+          const keys = Object.keys(tagsByName).map((key2) => JSON.stringify(key2)).join(", ");
           throw new Error(`Unknown custom tag ${tagName}; use one of ${keys}`);
         }
         if (!tags2.includes(tagObj))
@@ -3540,8 +3540,8 @@ var require_Document = __commonJS({
        * Convert a key and a value into a `Pair` using the current schema,
        * recursively wrapping all values as `Scalar` or `Collection` nodes.
        */
-      createPair(key, value, options = {}) {
-        const k = this.createNode(key, null, options);
+      createPair(key2, value, options = {}) {
+        const k = this.createNode(key2, null, options);
         const v = this.createNode(value, null, options);
         return new Pair.Pair(k, v);
       }
@@ -3549,8 +3549,8 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      delete(key) {
-        return assertCollection(this.contents) ? this.contents.delete(key) : false;
+      delete(key2) {
+        return assertCollection(this.contents) ? this.contents.delete(key2) : false;
       }
       /**
        * Removes a value from the document.
@@ -3570,8 +3570,8 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      get(key, keepScalar) {
-        return identity.isCollection(this.contents) ? this.contents.get(key, keepScalar) : void 0;
+      get(key2, keepScalar) {
+        return identity.isCollection(this.contents) ? this.contents.get(key2, keepScalar) : void 0;
       }
       /**
        * Returns item at `path`, or `undefined` if not found. By default unwraps
@@ -3586,8 +3586,8 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value with the key `key`.
        */
-      has(key) {
-        return identity.isCollection(this.contents) ? this.contents.has(key) : false;
+      has(key2) {
+        return identity.isCollection(this.contents) ? this.contents.has(key2) : false;
       }
       /**
        * Checks if the document includes a value at `path`.
@@ -3601,11 +3601,11 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      set(key, value) {
+      set(key2, value) {
         if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, [key], value);
+          this.contents = Collection.collectionFromPath(this.schema, [key2], value);
         } else if (assertCollection(this.contents)) {
-          this.contents.set(key, value);
+          this.contents.set(key2, value);
         }
       }
       /**
@@ -3913,24 +3913,24 @@ var require_resolve_props = __commonJS({
 var require_util_contains_newline = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/compose/util-contains-newline.js"(exports) {
     "use strict";
-    function containsNewline(key) {
-      if (!key)
+    function containsNewline(key2) {
+      if (!key2)
         return null;
-      switch (key.type) {
+      switch (key2.type) {
         case "alias":
         case "scalar":
         case "double-quoted-scalar":
         case "single-quoted-scalar":
-          if (key.source.includes("\n"))
+          if (key2.source.includes("\n"))
             return true;
-          if (key.end) {
-            for (const st of key.end)
+          if (key2.end) {
+            for (const st of key2.end)
               if (st.type === "newline")
                 return true;
           }
           return false;
         case "flow-collection":
-          for (const it of key.items) {
+          for (const it of key2.items) {
             for (const st of it.start)
               if (st.type === "newline")
                 return true;
@@ -4004,10 +4004,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep, value } = collItem;
+        const { start, key: key2, sep, value } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep?.[0],
+          next: key2 ?? sep?.[0],
           offset,
           onError,
           parentIndent: bm.indent,
@@ -4015,10 +4015,10 @@ var require_resolve_block_map = __commonJS({
         });
         const implicitKey = !keyProps.found;
         if (implicitKey) {
-          if (key) {
-            if (key.type === "block-seq")
+          if (key2) {
+            if (key2.type === "block-seq")
               onError(offset, "BLOCK_AS_IMPLICIT_KEY", "A block sequence may not be used as an implicit map key");
-            else if ("indent" in key && key.indent !== bm.indent)
+            else if ("indent" in key2 && key2.indent !== bm.indent)
               onError(offset, "BAD_INDENT", startColMsg);
           }
           if (!keyProps.anchor && !keyProps.tag && !sep) {
@@ -4031,17 +4031,17 @@ var require_resolve_block_map = __commonJS({
             }
             continue;
           }
-          if (keyProps.newlineAfterProp || utilContainsNewline.containsNewline(key)) {
-            onError(key ?? start[start.length - 1], "MULTILINE_IMPLICIT_KEY", "Implicit keys need to be on a single line");
+          if (keyProps.newlineAfterProp || utilContainsNewline.containsNewline(key2)) {
+            onError(key2 ?? start[start.length - 1], "MULTILINE_IMPLICIT_KEY", "Implicit keys need to be on a single line");
           }
         } else if (keyProps.found?.indent !== bm.indent) {
           onError(offset, "BAD_INDENT", startColMsg);
         }
         ctx.atKey = true;
         const keyStart = keyProps.end;
-        const keyNode = key ? composeNode(ctx, key, keyProps, onError) : composeEmptyNode(ctx, keyStart, start, null, keyProps, onError);
+        const keyNode = key2 ? composeNode(ctx, key2, keyProps, onError) : composeEmptyNode(ctx, keyStart, start, null, keyProps, onError);
         if (ctx.schema.compat)
-          utilFlowIndentCheck.flowIndentCheck(bm.indent, key, onError);
+          utilFlowIndentCheck.flowIndentCheck(bm.indent, key2, onError);
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
           onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
@@ -4051,7 +4051,7 @@ var require_resolve_block_map = __commonJS({
           offset: keyNode.range[2],
           onError,
           parentIndent: bm.indent,
-          startOnNewline: !key || key.type === "block-scalar"
+          startOnNewline: !key2 || key2.type === "block-scalar"
         });
         offset = valueProps.end;
         if (valueProps.found) {
@@ -4215,11 +4215,11 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i2 = 0; i2 < fc.items.length; ++i2) {
         const collItem = fc.items[i2];
-        const { start, key, sep, value } = collItem;
+        const { start, key: key2, sep, value } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep?.[0],
+          next: key2 ?? sep?.[0],
           offset,
           onError,
           parentIndent: fc.indent,
@@ -4240,9 +4240,9 @@ var require_resolve_flow_collection = __commonJS({
             offset = props.end;
             continue;
           }
-          if (!isMap && ctx.options.strict && utilContainsNewline.containsNewline(key))
+          if (!isMap && ctx.options.strict && utilContainsNewline.containsNewline(key2))
             onError(
-              key,
+              key2,
               // checked by containsNewline()
               "MULTILINE_IMPLICIT_KEY",
               "Implicit keys of flow sequence pairs need to be on a single line"
@@ -4289,8 +4289,8 @@ var require_resolve_flow_collection = __commonJS({
         } else {
           ctx.atKey = true;
           const keyStart = props.end;
-          const keyNode = key ? composeNode(ctx, key, props, onError) : composeEmptyNode(ctx, keyStart, start, null, props, onError);
-          if (isBlock(key))
+          const keyNode = key2 ? composeNode(ctx, key2, props, onError) : composeEmptyNode(ctx, keyStart, start, null, props, onError);
+          if (isBlock(key2))
             onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
           const valueProps = resolveProps.resolveProps(sep ?? [], {
@@ -5440,9 +5440,9 @@ var require_cst_scalar = __commonJS({
         ];
         if (!addEndtoBlockProps(props, "end" in token ? token.end : void 0))
           props.push({ type: "newline", offset: -1, indent, source: "\n" });
-        for (const key of Object.keys(token))
-          if (key !== "type" && key !== "offset")
-            delete token[key];
+        for (const key2 of Object.keys(token))
+          if (key2 !== "type" && key2 !== "offset")
+            delete token[key2];
         Object.assign(token, { type: "block-scalar", indent, props, source: body });
       }
     }
@@ -5490,9 +5490,9 @@ var require_cst_scalar = __commonJS({
         default: {
           const indent = "indent" in token ? token.indent : -1;
           const end = "end" in token && Array.isArray(token.end) ? token.end.filter((st) => st.type === "space" || st.type === "comment" || st.type === "newline") : [];
-          for (const key of Object.keys(token))
-            if (key !== "type" && key !== "offset")
-              delete token[key];
+          for (const key2 of Object.keys(token))
+            if (key2 !== "type" && key2 !== "offset")
+              delete token[key2];
           Object.assign(token, { type, indent, source, end });
         }
       }
@@ -5547,12 +5547,12 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep, value }) {
+    function stringifyItem({ start, key: key2, sep, value }) {
       let res = "";
       for (const st of start)
         res += st.source;
-      if (key)
-        res += stringifyToken(key);
+      if (key2)
+        res += stringifyToken(key2);
       if (sep)
         for (const st of sep)
           res += st.source;
@@ -6884,7 +6884,7 @@ var require_parser = __commonJS({
                   });
                 } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it.start);
-                  const key = it.key;
+                  const key2 = it.key;
                   const sep = it.sep;
                   sep.push(this.sourceToken);
                   delete it.key;
@@ -6893,7 +6893,7 @@ var require_parser = __commonJS({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep }]
+                    items: [{ start: start2, key: key2, sep }]
                   });
                 } else if (start.length > 0) {
                   it.sep = it.sep.concat(start, this.sourceToken);
@@ -7430,162 +7430,11 @@ var require_src = __commonJS({
 // src/cli.ts
 import { basename } from "path";
 
-// ../adapters-node/src/node-browser-opener.ts
-import { spawn } from "child_process";
-var NodeBrowserOpener = class {
-  async open(url) {
-    const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
-    await new Promise((resolve) => {
-      const child = spawn(command, args, { stdio: "ignore", detached: true });
-      child.on("error", () => resolve());
-      child.on("spawn", () => {
-        child.unref();
-        resolve();
-      });
-    });
-  }
-};
-
-// ../adapters-node/src/node-process-runner.ts
-import { spawn as spawn2 } from "child_process";
-var STDERR_TAIL_BYTES = 8 * 1024;
-function buildEnv(overrides) {
-  const env = { ...process.env };
-  for (const [key, value] of Object.entries(overrides ?? {})) {
-    if (value === void 0) delete env[key];
-    else env[key] = value;
-  }
-  return env;
-}
-var useShell = process.platform === "win32";
-var NodeProcessRunner = class {
-  run(command, args, options = {}) {
-    return new Promise((resolve, reject) => {
-      const child = spawn2(command, args, {
-        env: buildEnv(options.env),
-        stdio: ["inherit", "inherit", options.captureStderr ? "pipe" : "inherit"],
-        shell: useShell
-      });
-      let tail = "";
-      child.stderr?.on("data", (chunk) => {
-        process.stderr.write(chunk);
-        tail = (tail + chunk.toString()).slice(-STDERR_TAIL_BYTES);
-      });
-      const ignore = () => {
-      };
-      process.on("SIGINT", ignore);
-      process.on("SIGTERM", ignore);
-      const cleanup = () => {
-        process.off("SIGINT", ignore);
-        process.off("SIGTERM", ignore);
-      };
-      child.on("error", (error) => {
-        cleanup();
-        reject(error);
-      });
-      child.on("close", (code, signal) => {
-        cleanup();
-        resolve({ exitCode: code ?? (signal ? 128 + 2 : 1), stderrTail: tail });
-      });
-    });
-  }
-  capture(command, args, options = {}) {
-    return new Promise((resolve) => {
-      const child = spawn2(command, args, { env: buildEnv(options.env), shell: useShell });
-      child.stdin.end();
-      let stdout2 = "";
-      let stderr = "";
-      child.stdout.on("data", (c3) => {
-        stdout2 += c3.toString();
-      });
-      child.stderr.on("data", (c3) => {
-        stderr += c3.toString();
-      });
-      child.on("error", (error) => resolve({ exitCode: 127, stdout: stdout2, stderr: error.message }));
-      child.on("close", (code) => resolve({ exitCode: code ?? 1, stdout: stdout2, stderr }));
-    });
-  }
-  async probe(command) {
-    const result = await this.capture(command, ["--version"]);
-    if (result.exitCode !== 0) return { installed: false };
-    const output = `${result.stdout} ${result.stderr}`;
-    const version = output.match(/(\d+\.\d+\.\d+)/)?.[1];
-    return { installed: true, ...version ? { version } : {} };
-  }
-};
-
-// ../adapters-node/src/system-tool-installer.ts
-var TOOLS = {
-  aws: {
-    manualUrl: "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html",
-    recipes: {
-      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "awscli"] }],
-      win32: [
-        { via: "winget", command: "winget", args: ["install", "--exact", "--id", "Amazon.AWSCLI"] }
-      ]
-    }
-  },
-  az: {
-    manualUrl: "https://learn.microsoft.com/cli/azure/install-azure-cli",
-    recipes: {
-      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "azure-cli"] }],
-      win32: [
-        {
-          via: "winget",
-          command: "winget",
-          args: ["install", "--exact", "--id", "Microsoft.AzureCLI"]
-        }
-      ]
-    }
-  },
-  gcloud: {
-    manualUrl: "https://cloud.google.com/sdk/docs/install",
-    recipes: {
-      darwin: [
-        { via: "Homebrew", command: "brew", args: ["install", "--cask", "google-cloud-sdk"] }
-      ],
-      win32: [
-        {
-          via: "winget",
-          command: "winget",
-          args: ["install", "--exact", "--id", "Google.CloudSDK"]
-        }
-      ]
-    }
-  }
-};
-var SystemToolInstaller = class {
-  constructor(runner, platform = process.platform) {
-    this.runner = runner;
-    this.platform = platform;
-  }
-  runner;
-  platform;
-  available = /* @__PURE__ */ new Map();
-  recipeFor(command) {
-    const tool = TOOLS[command];
-    if (!tool) return void 0;
-    const recipe = tool.recipes[this.platform]?.[0];
-    return recipe ? { ...recipe, manualUrl: tool.manualUrl } : { via: "official installer", command: "", args: [], manualUrl: tool.manualUrl };
-  }
-  async install(recipe) {
-    if (!recipe.command) return false;
-    if (!await this.hasCommand(recipe.command)) return false;
-    const { exitCode } = await this.runner.run(recipe.command, recipe.args);
-    return exitCode === 0;
-  }
-  async hasCommand(command) {
-    if (!this.available.has(command)) {
-      this.available.set(command, (await this.runner.probe(command)).installed);
-    }
-    return this.available.get(command) ?? false;
-  }
-};
-
-// ../adapters-node/src/yaml-config-store.ts
-import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { join } from "path";
+// ../adapters-node/src/folder-files.ts
+import { createHash } from "crypto";
+import { readFileSync, realpathSync, statSync } from "fs";
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { dirname, join, resolve } from "path";
 
 // ../core/src/domain/errors.ts
 var CloudhopError = class extends Error {
@@ -7602,6 +7451,8 @@ var CloudhopError = class extends Error {
 // ../core/src/domain/naming.ts
 var RESERVED_NAMES = /* @__PURE__ */ new Set([
   "add",
+  "allow",
+  "deny",
   "agent",
   "alias",
   "login",
@@ -7647,8 +7498,15 @@ function assertValidName(kind, name) {
   }
 }
 function suggestAliasName(...parts) {
-  const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
-  return slug || "alias";
+  const slug = parts.join("-").toLowerCase().replace(/access$/i, "").replace(/[^a-z0-9]+/g, "-");
+  return trimDashes(slug).slice(0, 63) || "alias";
+}
+function trimDashes(text4) {
+  let start = 0;
+  let end = text4.length;
+  while (start < end && text4[start] === "-") start++;
+  while (end > start && text4[end - 1] === "-") end--;
+  return text4.slice(start, end);
 }
 var slugTokens = (text4) => text4.toLowerCase().replace(/access$/i, "").split(/[^a-z0-9]+/).filter(Boolean);
 var ROLE_WORDS = {
@@ -7930,6 +7788,7 @@ var CloudhopApp = class {
           region: resolved.region,
           attributes: resolved.target?.attributes ?? {},
           prod: alias.prod === true,
+          default: alias.default === true,
           session: source.session,
           next: source.next
         };
@@ -7974,6 +7833,38 @@ var CloudhopApp = class {
     }
     await this.deps.config.save(config);
   }
+  /**
+   * Makes an alias the one new terminals of its cloud start with, replacing
+   * that cloud's previous default. Returns the cloud.
+   */
+  async setDefaultAlias(name) {
+    const config = await this.deps.config.load();
+    const alias = this.findAlias(config, name);
+    const provider = this.findSource(config, alias.source).provider;
+    for (const other of config.aliases) {
+      if (this.findSource(config, other.source).provider === provider) delete other.default;
+    }
+    alias.default = true;
+    await this.deps.config.save(config);
+    return provider;
+  }
+  /** Clears the default alias of a cloud, or of every cloud. Returns the aliases it cleared. */
+  async clearDefaultAlias(provider) {
+    const config = await this.deps.config.load();
+    const cleared = config.aliases.filter(
+      (a2) => a2.default && (!provider || this.findSource(config, a2.source).provider === provider)
+    );
+    for (const alias of cleared) delete alias.default;
+    if (cleared.length) await this.deps.config.save(config);
+    return cleared.map((a2) => a2.name);
+  }
+  /** The alias new terminals start with, per cloud. */
+  async defaultAliases() {
+    const config = await this.deps.config.load();
+    return Object.fromEntries(
+      config.aliases.filter((a2) => a2.default).map((a2) => [this.findSource(config, a2.source).provider, a2.name])
+    );
+  }
   /** Changes an alias' region; matching the source's region clears the override. */
   async setAliasRegion(name, region) {
     const config = await this.deps.config.load();
@@ -8078,6 +7969,29 @@ ${result.stderr}`)) {
     await this.ensureSession(resolved.source.id);
     return provider.processEnv(resolved, mode);
   }
+  /**
+   * What `cloudhop use` puts in a shell: the alias' CLI environment (profile
+   * and region, never credentials) and every variable of that provider to
+   * clear first. With `login: false` it never signs in, so entering a folder
+   * never opens a browser: the first command does it if needed.
+   */
+  async shellEnv(name, { login }) {
+    const resolved = await this.usableAlias(name, {});
+    const provider = this.provider(resolved.source.provider);
+    if (login) await this.ensureSession(resolved.source.id);
+    return {
+      provider: provider.id,
+      clear: provider.shellVars,
+      env: await provider.processEnv(resolved, "cli"),
+      region: resolved.region,
+      label: resolved.target?.label,
+      prod: resolved.alias.prod === true
+    };
+  }
+  /** The variables `cloudhop use --off <provider>` removes from a shell. */
+  shellVars(provider) {
+    return this.provider(provider).shellVars;
+  }
   // ── Health ───────────────────────────────────────────────────────────────
   async doctor() {
     const config = await this.deps.config.load();
@@ -8201,11 +8115,260 @@ ${result.stderr}`)) {
 var PROVIDER_IDS = ["aws", "azure", "gcp"];
 var emptyConfig = () => ({ providers: [], sources: [], aliases: [] });
 
+// ../core/src/domain/folder.ts
+var FOLDER_FILE = ".cloudhoprc";
+var bad = (why) => new CloudhopError(
+  "INVALID_NAME",
+  `Not a valid ${FOLDER_FILE}: ${why}.`,
+  "Write one line per cloud, like `aws: my-alias`."
+);
+function parseFolderFile(text4) {
+  const result = {};
+  for (const raw of text4.split(/\r?\n/)) {
+    const line = raw.replace(/#.*/, "").trim();
+    if (!line) continue;
+    const match = /^([a-z]+)\s*[:=]\s*(\S+)$/.exec(line);
+    const key2 = match ? match[1] : "any";
+    const alias = match ? match[2] : line;
+    if (key2 !== "any" && !PROVIDER_IDS.includes(key2)) throw bad(`unknown cloud "${key2}"`);
+    if (result[key2]) throw bad(`"${key2}" appears twice`);
+    assertValidName("alias", alias);
+    result[key2] = alias;
+  }
+  if (Object.keys(result).length === 0) throw bad("it names no alias");
+  return result;
+}
+function formatFolderFile(aliases) {
+  const lines = Object.entries(aliases).map(
+    ([key2, alias]) => key2 === "any" ? alias : `${key2}: ${alias}`
+  );
+  return `# cloudhop: aliases for this folder (https://dayepesb.github.io/cloudhop/guides/shell/)
+${lines.join("\n")}
+`;
+}
+
+// ../adapters-node/src/folder-files.ts
+function findFolderFile(start) {
+  let dir = resolve(start);
+  for (; ; ) {
+    const file = join(dir, FOLDER_FILE);
+    try {
+      if (statSync(file).isFile()) return file;
+    } catch {
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+var key = (path2) => {
+  try {
+    return realpathSync.native(path2);
+  } catch {
+    return resolve(path2);
+  }
+};
+var digest = (content) => createHash("sha256").update(content).digest("hex");
+var TrustedFolders = class {
+  file;
+  constructor(configDir) {
+    this.file = join(configDir, "trusted-folders.json");
+  }
+  isTrusted(path2, content) {
+    return this.load().files[key(path2)] === digest(content);
+  }
+  async trust(path2, content) {
+    const data = this.load();
+    data.files[key(path2)] = digest(content);
+    await this.save(data);
+  }
+  /** Returns false when the file was not trusted. */
+  async forget(path2) {
+    const data = this.load();
+    const file = key(path2);
+    if (!(file in data.files)) return false;
+    delete data.files[file];
+    await this.save(data);
+    return true;
+  }
+  load() {
+    try {
+      const data = JSON.parse(readFileSync(this.file, "utf8"));
+      return data?.version === 1 && data.files ? data : { version: 1, files: {} };
+    } catch {
+      return { version: 1, files: {} };
+    }
+  }
+  async save(data) {
+    await mkdir(dirname(this.file), { recursive: true });
+    await writeFile(this.file, `${JSON.stringify(data, null, 2)}
+`, { mode: 384 });
+  }
+};
+async function readFolderFile(path2) {
+  return readFile(path2, "utf8").catch(() => void 0);
+}
+
+// ../adapters-node/src/node-browser-opener.ts
+import { spawn } from "child_process";
+var NodeBrowserOpener = class {
+  async open(url) {
+    const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", '""', url.replace(/&/g, "^&")]] : ["xdg-open", [url]];
+    await new Promise((resolve3) => {
+      const child = spawn(command, args, { stdio: "ignore", detached: true });
+      child.on("error", () => resolve3());
+      child.on("spawn", () => {
+        child.unref();
+        resolve3();
+      });
+    });
+  }
+};
+
+// ../adapters-node/src/node-process-runner.ts
+import { spawn as spawn2 } from "child_process";
+var STDERR_TAIL_BYTES = 8 * 1024;
+function buildEnv(overrides) {
+  const env = { ...process.env };
+  for (const [key2, value] of Object.entries(overrides ?? {})) {
+    if (value === void 0) delete env[key2];
+    else env[key2] = value;
+  }
+  return env;
+}
+var useShell = process.platform === "win32";
+var NodeProcessRunner = class {
+  run(command, args, options = {}) {
+    return new Promise((resolve3, reject) => {
+      const child = spawn2(command, args, {
+        env: buildEnv(options.env),
+        stdio: ["inherit", "inherit", options.captureStderr ? "pipe" : "inherit"],
+        shell: useShell
+      });
+      let tail = "";
+      child.stderr?.on("data", (chunk) => {
+        process.stderr.write(chunk);
+        tail = (tail + chunk.toString()).slice(-STDERR_TAIL_BYTES);
+      });
+      const ignore = () => {
+      };
+      process.on("SIGINT", ignore);
+      process.on("SIGTERM", ignore);
+      const cleanup = () => {
+        process.off("SIGINT", ignore);
+        process.off("SIGTERM", ignore);
+      };
+      child.on("error", (error) => {
+        cleanup();
+        reject(error);
+      });
+      child.on("close", (code, signal) => {
+        cleanup();
+        resolve3({ exitCode: code ?? (signal ? 128 + 2 : 1), stderrTail: tail });
+      });
+    });
+  }
+  capture(command, args, options = {}) {
+    return new Promise((resolve3) => {
+      const child = spawn2(command, args, { env: buildEnv(options.env), shell: useShell });
+      child.stdin.end();
+      let stdout2 = "";
+      let stderr = "";
+      child.stdout.on("data", (c3) => {
+        stdout2 += c3.toString();
+      });
+      child.stderr.on("data", (c3) => {
+        stderr += c3.toString();
+      });
+      child.on("error", (error) => resolve3({ exitCode: 127, stdout: stdout2, stderr: error.message }));
+      child.on("close", (code) => resolve3({ exitCode: code ?? 1, stdout: stdout2, stderr }));
+    });
+  }
+  async probe(command) {
+    const result = await this.capture(command, ["--version"]);
+    if (result.exitCode !== 0) return { installed: false };
+    const output = `${result.stdout} ${result.stderr}`;
+    const version = output.match(/(\d+\.\d+\.\d+)/)?.[1];
+    return { installed: true, ...version ? { version } : {} };
+  }
+};
+
+// ../adapters-node/src/system-tool-installer.ts
+var TOOLS = {
+  aws: {
+    manualUrl: "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html",
+    recipes: {
+      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "awscli"] }],
+      win32: [
+        { via: "winget", command: "winget", args: ["install", "--exact", "--id", "Amazon.AWSCLI"] }
+      ]
+    }
+  },
+  az: {
+    manualUrl: "https://learn.microsoft.com/cli/azure/install-azure-cli",
+    recipes: {
+      darwin: [{ via: "Homebrew", command: "brew", args: ["install", "azure-cli"] }],
+      win32: [
+        {
+          via: "winget",
+          command: "winget",
+          args: ["install", "--exact", "--id", "Microsoft.AzureCLI"]
+        }
+      ]
+    }
+  },
+  gcloud: {
+    manualUrl: "https://cloud.google.com/sdk/docs/install",
+    recipes: {
+      darwin: [
+        { via: "Homebrew", command: "brew", args: ["install", "--cask", "google-cloud-sdk"] }
+      ],
+      win32: [
+        {
+          via: "winget",
+          command: "winget",
+          args: ["install", "--exact", "--id", "Google.CloudSDK"]
+        }
+      ]
+    }
+  }
+};
+var SystemToolInstaller = class {
+  constructor(runner, platform = process.platform) {
+    this.runner = runner;
+    this.platform = platform;
+  }
+  runner;
+  platform;
+  available = /* @__PURE__ */ new Map();
+  recipeFor(command) {
+    const tool = TOOLS[command];
+    if (!tool) return void 0;
+    const recipe = tool.recipes[this.platform]?.[0];
+    return recipe ? { ...recipe, manualUrl: tool.manualUrl } : { via: "official installer", command: "", args: [], manualUrl: tool.manualUrl };
+  }
+  async install(recipe) {
+    if (!recipe.command) return false;
+    if (!await this.hasCommand(recipe.command)) return false;
+    const { exitCode } = await this.runner.run(recipe.command, recipe.args);
+    return exitCode === 0;
+  }
+  async hasCommand(command) {
+    if (!this.available.has(command)) {
+      this.available.set(command, (await this.runner.probe(command)).installed);
+    }
+    return this.available.get(command) ?? false;
+  }
+};
+
 // ../adapters-node/src/yaml-config-store.ts
+import { mkdir as mkdir2, readFile as readFile2, rename, rm, writeFile as writeFile2 } from "fs/promises";
+import { homedir } from "os";
+import { join as join2 } from "path";
 var import_yaml = __toESM(require_dist(), 1);
 function defaultConfigDir(env = process.env) {
   if (env.CLOUDHOP_HOME) return env.CLOUDHOP_HOME;
-  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "cloudhop");
+  return join2(env.XDG_CONFIG_HOME || join2(homedir(), ".config"), "cloudhop");
 }
 var HEADER = "# cloudhop configuration. Contains no secrets.\n# Docs: https://github.com/dayepesb/cloudhop\n";
 var YamlConfigStore = class {
@@ -8214,10 +8377,10 @@ var YamlConfigStore = class {
   }
   dir;
   get configPath() {
-    return join(this.dir, "config.yaml");
+    return join2(this.dir, "config.yaml");
   }
   get targetsPath() {
-    return join(this.dir, "targets.json");
+    return join2(this.dir, "targets.json");
   }
   async load() {
     const raw = await this.read(this.configPath);
@@ -8265,7 +8428,7 @@ var YamlConfigStore = class {
   }
   async read(path2) {
     try {
-      return await readFile(path2, "utf8");
+      return await readFile2(path2, "utf8");
     } catch (error) {
       if (error.code === "ENOENT") return void 0;
       throw error;
@@ -8273,9 +8436,9 @@ var YamlConfigStore = class {
   }
   /** Writes through a temp file so a crash never leaves a half-written config. */
   async write(path2, content) {
-    await mkdir(this.dir, { recursive: true, mode: 448 });
+    await mkdir2(this.dir, { recursive: true, mode: 448 });
     const tmp = `${path2}.${process.pid}.tmp`;
-    await writeFile(tmp, content, { mode: 384 });
+    await writeFile2(tmp, content, { mode: 384 });
     await rename(tmp, path2);
   }
 };
@@ -8288,17 +8451,17 @@ var MAX_OUTPUT = 1e5;
 var cap = (text4) => text4.length > MAX_OUTPUT ? `${text4.slice(0, MAX_OUTPUT)}
 \u2026 [truncated: ${text4.length - MAX_OUTPUT} more characters. Narrow the command with --query or filters.]` : text4;
 var WINDOWS_SHELL_CHARS = /[&|<>^%!"\r\n]/;
-var text = (args, key) => {
-  const value = args[key];
+var text = (args, key2) => {
+  const value = args[key2];
   if (typeof value !== "string" || !value.trim()) {
-    throw new CloudhopError("INVALID_NAME", `"${key}" is required.`);
+    throw new CloudhopError("INVALID_NAME", `"${key2}" is required.`);
   }
   return value.trim();
 };
-var stringArray = (args, key) => {
-  const value = args[key];
+var stringArray = (args, key2) => {
+  const value = args[key2];
   if (!Array.isArray(value) || !value.every((v) => typeof v === "string")) {
-    throw new CloudhopError("INVALID_NAME", `"${key}" must be an array of strings.`);
+    throw new CloudhopError("INVALID_NAME", `"${key2}" must be an array of strings.`);
   }
   return value;
 };
@@ -8308,15 +8471,15 @@ var aliasInput = {
     description: "The cloudhop alias to use, as listed by list_aliases. Ask the user which one."
   }
 };
-function createTools(app) {
+function createTools(app, context) {
   return [
     {
       name: "list_aliases",
       title: "List cloudhop aliases",
-      description: "Lists every cloudhop source (SSO portal or personal account) with its session state, and every alias: name, account/role label, region and whether a sign-in is needed. Call this first, then ask the user which alias to work with. Never contains secrets.",
+      description: "Lists every cloudhop source (SSO portal or personal account) with its session state, and every alias: name, account/role label, region and whether a sign-in is needed. Also hints: `folder` (the aliases this project pins in its .cloudhoprc, and whether the user trusted it) and `inUse` (aliases the user switched their terminal to); `default: true` marks the alias new terminals of the user start with. Call this first, then ask the user which alias to work with, offering the hinted one first. Never contains secrets.",
       inputSchema: { type: "object", properties: {}, additionalProperties: false },
       annotations: { readOnlyHint: true, openWorldHint: false },
-      run: () => app.overview()
+      run: async () => ({ ...await app.overview(), ...await context?.() })
     },
     {
       name: "alias_status",
@@ -8476,7 +8639,7 @@ function createTools(app) {
 
 // ../mcp/src/server.ts
 var MCP_INSTRUCTIONS = `cloudhop gives each cloud account + role + region a short alias and signs the user in only when a session expired.
-Before the first cloud operation in a conversation: call list_aliases, show the user the aliases (name, account/role, region) and ask which one to use. Never guess the alias.
+Before the first cloud operation in a conversation: call list_aliases, show the user the aliases (name, account/role, region) and ask which one to use. Never guess the alias. If list_aliases has folder.aliases (the project's .cloudhoprc), inUse or an alias with default: true, offer that alias first, but still ask.
 Use run_cloud_cli for cloud CLI commands, never --profile. Read-only commands may run once the alias is chosen; before anything that creates, changes or deletes resources, show the alias, account, region and exact command, and wait for the user's explicit OK. Aliases with prod: true are production: run_cloud_cli refuses changes there until the user approves and you pass confirm_production: true.
 To show the user something in the web console, call open_console (it opens their browser, already signed in).
 If a tool returns LOGIN_REQUIRED or alias_status says browser-sign-in: tell the user their browser will open, then call login (it waits up to 5 minutes for them to approve). Never print or ask for credentials.`;
@@ -8485,9 +8648,10 @@ function serveMcp({
   app,
   version,
   input = process.stdin,
-  output = process.stdout
+  output = process.stdout,
+  context
 }) {
-  const tools = createTools(app);
+  const tools = createTools(app, context);
   const byName = new Map(tools.map((t2) => [t2.name, t2]));
   const send2 = (message) => output.write(`${JSON.stringify(message)}
 `);
@@ -8553,7 +8717,7 @@ function serveMcp({
         if (!isNotification) fail(id, -32601, `Method not found: ${method}`);
     }
   };
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const lines = createInterface({ input, crlfDelay: Number.POSITIVE_INFINITY });
     const pending = /* @__PURE__ */ new Set();
     lines.on("line", (line) => {
@@ -8573,7 +8737,7 @@ function serveMcp({
       task.finally(() => pending.delete(task));
     });
     lines.on("close", () => {
-      Promise.allSettled([...pending]).then(() => resolve());
+      Promise.allSettled([...pending]).then(() => resolve3());
     });
   });
 }
@@ -8588,7 +8752,11 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "noMcp",
   "force",
   "prod",
-  "off"
+  "off",
+  "save",
+  "leave",
+  "default",
+  "noDefault"
 ]);
 var camel = (name) => name.replace(/-([a-z])/g, (_2, c3) => c3.toUpperCase());
 function parseArgs(argv) {
@@ -10009,7 +10177,7 @@ import { styleText as styleText2, stripVTControlCharacters } from "util";
 import process$1 from "process";
 var import_sisteransi2 = __toESM(require_src(), 1);
 import { existsSync, lstatSync, readdirSync } from "fs";
-import { dirname, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 function isUnicodeSupported() {
   if (process$1.platform !== "win32") {
     return process$1.env.TERM !== "linux";
@@ -10947,10 +11115,10 @@ var path = (e) => {
         return [];
       try {
         let i2;
-        existsSync(t2) ? lstatSync(t2).isDirectory() && (!e.directory || t2.endsWith("/")) ? i2 = t2 : i2 = dirname(t2) : i2 = dirname(t2);
+        existsSync(t2) ? lstatSync(t2).isDirectory() && (!e.directory || t2.endsWith("/")) ? i2 = t2 : i2 = dirname2(t2) : i2 = dirname2(t2);
         const c3 = t2.length > 1 && t2.endsWith("/") ? t2.slice(0, -1) : t2;
         return readdirSync(i2).map((r2) => {
-          const n3 = join2(i2, r2), m3 = lstatSync(n3);
+          const n3 = join3(i2, r2), m3 = lstatSync(n3);
           return {
             name: r2,
             path: n3,
@@ -11707,16 +11875,16 @@ import { homedir as homedir2 } from "os";
 import { isAbsolute, relative } from "path";
 
 // ../assistants/src/installer.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync2 } from "fs";
-import { mkdir as mkdir2, readFile as readFile2, rename as rename2, rm as rm2, rmdir, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname2, join as join4 } from "path";
+import { mkdir as mkdir3, readFile as readFile3, rename as rename2, rm as rm2, rmdir, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join as join5 } from "path";
 
 // ../assistants/src/assets/skill.md
-var skill_default = "---\nname: cloudhop\ndescription: Run AWS CLI commands and other cloud tools as a specific account, role and region through cloudhop aliases (the `hop` and `cloudhop` commands). Use whenever the user asks to do anything in their AWS accounts, inspect or change cloud resources, run aws/terraform/cdk against an account, list their cloud accounts or aliases, or mentions hop or cloudhop.\n---\n\n# Working with cloud accounts through cloudhop\n\nThe user manages their cloud access with **cloudhop**. Each **alias** (for\nexample `acme-dev`) points to one account, one role and one region. cloudhop\nsigns the user in through their browser only when a session has expired. There\nare no access keys: never ask for, create, print or store credentials.\n\n## 1. Pick the alias with the user, every time\n\nBefore the first cloud operation in a conversation:\n\n1. List the aliases. Use the `list_aliases` tool if the cloudhop MCP server is\n   connected; otherwise run `cloudhop ls --json`.\n2. Show the user the options (alias, account / role, region) and **ask which\n   one to use**. Don't guess, even if one name looks right, and don't pick\n   one just because there is only one: confirm it.\n3. Use that alias for the rest of the conversation. Ask again if the user\n   moves to another environment, account or task.\n\n## 2. Check the session before running anything\n\nRun `cloudhop status <alias> --json` (or the `alias_status` tool) and read\n`next`:\n\n| `next`            | Meaning                                      | What to do                                                                                                                                        |\n| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ready`           | Session valid                                | Go ahead                                                                                                                                          |\n| `silent-renewal`  | Expired but renewable without the user       | Go ahead; cloudhop renews it                                                                                                                      |\n| `browser-sign-in` | The user must sign in                        | Tell the user their browser will open and they need to approve, then run `cloudhop login <source>` (or the `login` tool) and wait up to 5 minutes |\n| `unknown`         | Managed by the cloud CLI (personal accounts) | Go ahead; if it fails, run `cloudhop login <source>`                                                                                              |\n\nDon't start several cloud commands in parallel while a sign-in is pending.\n\n## 3. Run commands through the alias\n\n- **AWS CLI**: `hop <alias> <aws arguments>`, e.g. `hop acme-dev s3 ls`.\n  It is exactly `aws <arguments>` with the alias' account, role and region.\n  Never add `--profile`. Use `--region <r>` only to override the region once.\n  With the MCP server, use `run_cloud_cli` with `args` (no program name).\n- **Who am I**: `hop <alias>` with no arguments (or the `whoami` tool).\n- **The same command in several aliases** (after the user chose them):\n  `cloudhop each a,b,c --yes -- <aws arguments>`; add `--json` to parse the\n  results.\n- **The AWS web console**: `cloudhop console <alias> [service]` (or the\n  `open_console` tool) opens it in the user's browser, already signed in.\n  Never try to print or fetch its URL.\n- **Always name the alias.** Never run the interactive forms meant for a\n  person at a terminal: `hop` or `hop -` without an alias, `cloudhop console`\n  without an alias, `cloudhop use` (it only changes an interactive shell),\n  `cloudhop setup`, or `cloudhop add`/`alias` without flags. Nobody can answer\n  their prompts in your terminal.\n- **Other tools** (Terraform, CDK, SDK scripts):\n  `cloudhop exec <alias> -- <command>`, e.g.\n  `cloudhop exec acme-dev -- terraform plan`.\n- Prefer `--output json` and `--query` to keep output small.\n- Don't export `AWS_PROFILE`, `AWS_ACCESS_KEY_ID` or similar variables, don't\n  run commands that print credentials (`env`, `printenv`, `export-credentials`)\n  and never edit `~/.aws/config`, `~/.aws/credentials` or cloudhop's own files.\n\n## 4. Confirm before changing anything\n\n- Read-only commands (`list`, `describe`, `get`, `s3 ls`, `logs tail`) can run\n  once the user has chosen the alias.\n- Before any command that **creates, changes, deletes or costs money**, show\n  the alias, account, region and the exact command, and wait for the user's\n  explicit \"yes\". One confirmation covers one command, not a series.\n- **Production aliases** have `\"prod\": true` in `cloudhop ls --json` (and\n  `PROD` in `cloudhop ls`). Confirm every change there and suggest a dry run\n  (`--dryrun`, `terraform plan`) first. cloudhop enforces it: without a\n  terminal, `hop`/`cloudhop exec` refuse changes on production with\n  `PROD_CONFIRMATION_REQUIRED`. After the user explicitly approves the exact\n  command, rerun it with `CLOUDHOP_CONFIRM_PROD=1` in that command's\n  environment (with MCP: `confirm_production: true`). Never set it on your own.\n- Treat aliases or accounts that merely look like production (`prd`, `live`)\n  the same way, even if they are not marked.\n- Don't change cloudhop itself (`cloudhop add`, `rm`, `mv`, `region`, `prod`,\n  `team import`, `agent`, `login` for another source) unless the user asked\n  for it. Never unmark a production alias to get around a confirmation.\n\n## 5. When something goes wrong\n\n| You see                                             | Do this                                                                        |\n| --------------------------------------------------- | ------------------------------------------------------------------------------ |\n| \"Opening your browser to log in\"                    | Tell the user to approve in the browser; the command continues by itself       |\n| The command was cut off while waiting for a sign-in | Run `cloudhop login <source>` with a timeout of at least 5 minutes, then retry |\n| `LOGIN_REQUIRED`                                    | Same as `browser-sign-in` above                                                |\n| No browser on this machine (remote, container)      | Run `cloudhop login <source> --device-code` and show the user the URL and code |\n| `Alias \"x\" not found`                               | Run `cloudhop ls` and ask the user again                                       |\n| AWS CLI missing or too old                          | Suggest `cloudhop doctor`; don't install anything without asking               |\n| `AccessDenied`                                      | The role lacks permission: tell the user; don't try other aliases on your own  |\n\nMore: https://dayepesb.github.io/cloudhop/guides/hop-like-aws/\n";
+var skill_default = "---\nname: cloudhop\ndescription: Run AWS CLI commands and other cloud tools as a specific account, role and region through cloudhop aliases (the `hop` and `cloudhop` commands). Use whenever the user asks to do anything in their AWS accounts, inspect or change cloud resources, run aws/terraform/cdk against an account, list their cloud accounts or aliases, or mentions hop or cloudhop.\n---\n\n# Working with cloud accounts through cloudhop\n\nThe user manages their cloud access with **cloudhop**. Each **alias** (for\nexample `acme-dev`) points to one account, one role and one region. cloudhop\nsigns the user in through their browser only when a session has expired. There\nare no access keys: never ask for, create, print or store credentials.\n\n## How the user works (to guide them)\n\nWhen the user asks how to set up or use cloudhop themselves, describe this\npath; these are commands for **them** to run in their own terminal:\n\n1. **Once**: `npm install --global cloudhop`, then `cloudhop add` (signs in\n   to an SSO portal or personal account and names each account/role as an\n   alias), then `cloudhop shell` (adds one line to their shell's startup\n   file and, with Starship, the alias segment to `starship.toml`; they open\n   a new terminal afterwards). `cloudhop setup` does all of it in one\n   guided run. Works in zsh, bash (Git Bash too), fish and PowerShell;\n   in Windows `cmd.exe`, `cloudhop use` opens a new `cmd` with the alias in\n   its prompt.\n2. **Every day**: `cloudhop use <alias>` switches that terminal to an\n   account; after that they type plain `aws ...`, Terraform\n   or SDK commands. `cloudhop use <other>` switches accounts and\n   `cloudhop use --off` goes back. Expired sessions sign in by themselves,\n   and on production aliases `aws` asks before changes. Their prompt shows\n   the alias in use, in red for production, and `cloudhop status` tells\n   them which alias their terminal uses. `cloudhop use` is per terminal: a\n   new terminal starts with no alias unless they choose a default with\n   `cloudhop use <alias> --default` (or the **Default** box in\n   `cloudhop ui`); `cloudhop use --no-default` stops it. A production\n   default needs `--yes`. A `cloudhop use` typed in a terminal wins over\n   the folder's `.cloudhoprc`, which wins over the default.\n3. **Per project**: `cloudhop use <alias> --save` writes a `.cloudhoprc` in\n   the folder, so `cd` into it switches the terminal; teammates run\n   `cloudhop allow` once after cloning (and again after the file changes);\n   `cloudhop deny` withdraws it. A file does nothing until it is trusted.\n4. **One-offs**: `hop <alias> <aws args>` runs one command in another\n   account without switching; `cloudhop each` runs it in many;\n   `cloudhop console <alias> [service]` opens the web console signed in.\n\nWhy `cloudhop shell` is needed: a program can't change the environment of\nthe terminal that started it, only the shell can.\nWithout it, `cloudhop use` opens a new shell instead; `hop` always works.\n\nSwitches, for the user: `CLOUDHOP_WRAP=0` keeps `aws` as the plain AWS\nCLI, `CLOUDHOP_AUTO_USE=0` ignores `.cloudhoprc` files, `CLOUDHOP_PROMPT=0`\nhides the prompt label. `cloudhop shell starship` prints the Starship\nsegment for people who place it by hand.\n\nWhen their terminal doesn't do what they expect:\n\n| They say | Suggest |\n| --- | --- |\n| \"Which account am I in?\" | `cloudhop status` (first line) |\n| `cloudhop use` opened a new shell / says it needs the integration | `cloudhop shell`, then a new terminal |\n| No label in the prompt | Run `cloudhop shell` again (it adds what's missing), then a new terminal |\n| `cd` into the project doesn't switch | `cloudhop allow` in that folder; check the alias name exists (`cloudhop ls`) |\n| `aws` runs in the wrong account | `cloudhop status`, then `cloudhop use <alias>` or `cloudhop use --off` |\n| A new terminal forgot the `cloudhop use` | It's per terminal by design: `cloudhop use <alias> --default` makes every new terminal start with it |\n\nThat is the user's way. **You** work differently, below: you always name the\nalias with `hop <alias>`, because your shell doesn't have their integration.\n\n## 1. Pick the alias with the user, every time\n\nBefore the first cloud operation in a conversation:\n\n1. List the aliases. Use the `list_aliases` tool if the cloudhop MCP server is\n   connected; otherwise run `cloudhop ls --json`.\n2. Show the user the options (alias, account / role, region) and **ask which\n   one to use**. Don't guess, even if one name looks right, and don't pick\n   one just because there is only one: confirm it.\n   - The listing may carry hints: `folder.aliases` is what this project pins\n     in its `.cloudhoprc` (`folder.trusted` says whether the user approved\n     it), and `inUse` is what the user switched their terminal to with\n     `cloudhop use` (`cloudhop status --json` has `inUse` too); an alias\n     with `default: true` is the one their new terminals start with. Offer that\n     alias first (\"This project uses\n     `license-qa`, use it?\"), but still wait for the answer.\n3. Use that alias for the rest of the conversation. Ask again if the user\n   moves to another environment, account or task.\n\n## 2. Check the session before running anything\n\nRun `cloudhop status <alias> --json` (or the `alias_status` tool) and read\n`next`:\n\n| `next`            | Meaning                                      | What to do                                                                                                                                        |\n| ----------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ready`           | Session valid                                | Go ahead                                                                                                                                          |\n| `silent-renewal`  | Expired but renewable without the user       | Go ahead; cloudhop renews it                                                                                                                      |\n| `browser-sign-in` | The user must sign in                        | Tell the user their browser will open and they need to approve, then run `cloudhop login <source>` (or the `login` tool) and wait up to 5 minutes |\n| `unknown`         | Managed by the cloud CLI (personal accounts) | Go ahead; if it fails, run `cloudhop login <source>`                                                                                              |\n\nDon't start several cloud commands in parallel while a sign-in is pending.\n\n## 3. Run commands through the alias\n\n- **AWS CLI**: `hop <alias> <aws arguments>`, e.g. `hop acme-dev s3 ls`.\n  It is exactly `aws <arguments>` with the alias' account, role and region.\n  Never add `--profile`. Use `--region <r>` only to override the region once.\n  With the MCP server, use `run_cloud_cli` with `args` (no program name).\n- **Who am I**: `hop <alias>` with no arguments (or the `whoami` tool).\n- **The same command in several aliases** (after the user chose them):\n  `cloudhop each a,b,c --yes -- <aws arguments>`; add `--json` to parse the\n  results.\n- **The AWS web console**: `cloudhop console <alias> [service]` (or the\n  `open_console` tool) opens it in the user's browser, already signed in.\n  Never try to print or fetch its URL.\n- **Always name the alias**, even when the project has a `.cloudhoprc` or\n  the user's terminal uses an alias: your shell doesn't have the user's\n  cloudhop integration, so a plain `aws` may run as anything. Use\n  `hop <alias> ...`, never bare `aws`.\n- Never run the interactive forms meant for a person at a terminal: `hop` or\n  `hop -` without an alias, `cloudhop console` without an alias,\n  `cloudhop use` (it changes or opens an interactive shell), `cloudhop\n  allow`/`deny` (trusting a folder is the user's decision), `cloudhop setup`,\n  or `cloudhop add`/`alias` without flags. Nobody can answer their prompts in\n  your terminal.\n- **Other tools** (Terraform, CDK, SDK scripts):\n  `cloudhop exec <alias> -- <command>`, e.g.\n  `cloudhop exec acme-dev -- terraform plan`.\n- Prefer `--output json` and `--query` to keep output small.\n- Don't export `AWS_PROFILE`, `AWS_ACCESS_KEY_ID` or similar variables, don't\n  run commands that print credentials (`env`, `printenv`, `export-credentials`)\n  and never edit `~/.aws/config`, `~/.aws/credentials` or cloudhop's own files.\n\n## 4. Confirm before changing anything\n\n- Read-only commands (`list`, `describe`, `get`, `s3 ls`, `logs tail`) can run\n  once the user has chosen the alias.\n- Before any command that **creates, changes, deletes or costs money**, show\n  the alias, account, region and the exact command, and wait for the user's\n  explicit \"yes\". One confirmation covers one command, not a series.\n- **Production aliases** have `\"prod\": true` in `cloudhop ls --json` (and\n  `PROD` in `cloudhop ls`). Confirm every change there and suggest a dry run\n  (`--dryrun`, `terraform plan`) first. cloudhop enforces it: without a\n  terminal, `hop`/`cloudhop exec` refuse changes on production with\n  `PROD_CONFIRMATION_REQUIRED`. After the user explicitly approves the exact\n  command, rerun it with `CLOUDHOP_CONFIRM_PROD=1` in that command's\n  environment (with MCP: `confirm_production: true`). Never set it on your own.\n- Treat aliases or accounts that merely look like production (`prd`, `live`)\n  the same way, even if they are not marked.\n- Don't change cloudhop itself (`cloudhop add`, `rm`, `mv`, `region`, `prod`,\n  `team import`, `agent`, `login` for another source) or write a\n  `.cloudhoprc` or change their default alias (`use --default`,\n  `--no-default`) unless the user asked for it. Never unmark a production\n  alias to get around a confirmation.\n\n## 5. When something goes wrong\n\n| You see                                             | Do this                                                                        |\n| --------------------------------------------------- | ------------------------------------------------------------------------------ |\n| \"Opening your browser to log in\"                    | Tell the user to approve in the browser; the command continues by itself       |\n| The command was cut off while waiting for a sign-in | Run `cloudhop login <source>` with a timeout of at least 5 minutes, then retry |\n| `LOGIN_REQUIRED`                                    | Same as `browser-sign-in` above                                                |\n| No browser on this machine (remote, container)      | Run `cloudhop login <source> --device-code` and show the user the URL and code |\n| `Alias \"x\" not found`                               | Run `cloudhop ls` and ask the user again                                       |\n| AWS CLI missing or too old                          | Suggest `cloudhop doctor`; don't install anything without asking               |\n| `AccessDenied`                                      | The role lacks permission: tell the user; don't try other aliases on your own  |\n\nMore: https://dayepesb.github.io/cloudhop/guides/hop-like-aws/\n";
 
 // ../assistants/src/targets.ts
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var ASSISTANT_IDS = [
   "claude",
   "kiro",
@@ -11731,9 +11899,9 @@ var ASSISTANTS = {
   claude: {
     id: "claude",
     name: "Claude Code",
-    markers: ({ home }) => [join3(home, ".claude")],
-    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".claude", "skills", SKILL_NAME),
-    mcp: (scope, { project }) => scope === "project" ? { kind: "json", file: join3(project, ".mcp.json"), key: "mcpServers", withType: false } : {
+    markers: ({ home }) => [join4(home, ".claude")],
+    skillDir: (scope, { home, project }) => join4(scope === "user" ? home : project, ".claude", "skills", SKILL_NAME),
+    mcp: (scope, { project }) => scope === "project" ? { kind: "json", file: join4(project, ".mcp.json"), key: "mcpServers", withType: false } : {
       kind: "cli",
       command: "claude",
       add: ["mcp", "add", "--scope", "user", "cloudhop", "--", MCP_COMMAND, ...MCP_ARGS],
@@ -11744,11 +11912,11 @@ var ASSISTANTS = {
   kiro: {
     id: "kiro",
     name: "Kiro",
-    markers: ({ home }) => [join3(home, ".kiro")],
-    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".kiro", "skills", SKILL_NAME),
+    markers: ({ home }) => [join4(home, ".kiro")],
+    skillDir: (scope, { home, project }) => join4(scope === "user" ? home : project, ".kiro", "skills", SKILL_NAME),
     mcp: (scope, { home, project }) => ({
       kind: "json",
-      file: join3(scope === "user" ? home : project, ".kiro", "settings", "mcp.json"),
+      file: join4(scope === "user" ? home : project, ".kiro", "settings", "mcp.json"),
       key: "mcpServers",
       withType: false
     })
@@ -11756,11 +11924,11 @@ var ASSISTANTS = {
   copilot: {
     id: "copilot",
     name: "GitHub Copilot (VS Code)",
-    markers: ({ home }) => [join3(home, ".copilot"), join3(home, ".vscode")],
-    skillDir: (scope, { home, project }) => scope === "user" ? join3(home, ".copilot", "skills", SKILL_NAME) : join3(project, ".github", "skills", SKILL_NAME),
+    markers: ({ home }) => [join4(home, ".copilot"), join4(home, ".vscode")],
+    skillDir: (scope, { home, project }) => scope === "user" ? join4(home, ".copilot", "skills", SKILL_NAME) : join4(project, ".github", "skills", SKILL_NAME),
     mcp: (scope, { project }) => scope === "project" ? {
       kind: "json",
-      file: join3(project, ".vscode", "mcp.json"),
+      file: join4(project, ".vscode", "mcp.json"),
       key: "servers",
       withType: true
     } : {
@@ -11782,11 +11950,11 @@ var ASSISTANTS = {
   cursor: {
     id: "cursor",
     name: "Cursor",
-    markers: ({ home }) => [join3(home, ".cursor")],
-    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".cursor", "skills", SKILL_NAME),
+    markers: ({ home }) => [join4(home, ".cursor")],
+    skillDir: (scope, { home, project }) => join4(scope === "user" ? home : project, ".cursor", "skills", SKILL_NAME),
     mcp: (scope, { home, project }) => ({
       kind: "json",
-      file: join3(scope === "user" ? home : project, ".cursor", "mcp.json"),
+      file: join4(scope === "user" ? home : project, ".cursor", "mcp.json"),
       key: "mcpServers",
       withType: true
     })
@@ -11794,29 +11962,29 @@ var ASSISTANTS = {
   codex: {
     id: "codex",
     name: "Codex",
-    markers: ({ home }) => [join3(home, ".codex"), join3(home, ".agents")],
-    skillDir: (scope, { home, project }) => join3(scope === "user" ? home : project, ".agents", "skills", SKILL_NAME),
+    markers: ({ home }) => [join4(home, ".codex"), join4(home, ".agents")],
+    skillDir: (scope, { home, project }) => join4(scope === "user" ? home : project, ".agents", "skills", SKILL_NAME),
     mcp: (scope, { home, project }) => ({
       kind: "toml",
-      file: join3(scope === "user" ? home : project, ".codex", "config.toml")
+      file: join4(scope === "user" ? home : project, ".codex", "config.toml")
     })
   }
 };
 
 // ../assistants/src/installer.ts
-var sha = (text4) => createHash("sha256").update(text4).digest("hex");
+var sha = (text4) => createHash2("sha256").update(text4).digest("hex");
 async function writeAtomic(file, content) {
-  await mkdir2(dirname2(file), { recursive: true });
+  await mkdir3(dirname3(file), { recursive: true });
   const tmp = `${file}.cloudhop-${process.pid}.tmp`;
-  await writeFile2(tmp, content);
+  await writeFile3(tmp, content);
   await rename2(tmp, file);
 }
 async function removeFileAndEmptyDir(file) {
   await rm2(file, { force: true });
-  await rmdir(dirname2(file)).catch(() => {
+  await rmdir(dirname3(file)).catch(() => {
   });
 }
-var readText = (file) => readFile2(file, "utf8").catch(() => void 0);
+var readText = (file) => readFile3(file, "utf8").catch(() => void 0);
 var AssistantsInstaller = class {
   constructor(options) {
     this.options = options;
@@ -11840,7 +12008,7 @@ var AssistantsInstaller = class {
     return Promise.all(
       ASSISTANT_IDS.map(async (id) => {
         const assistant = ASSISTANTS[id];
-        const skillPath = join4(assistant.skillDir(scope, this.options.places), "SKILL.md");
+        const skillPath = join5(assistant.skillDir(scope, this.options.places), "SKILL.md");
         const entry = manifest.find((e) => e.skillFile === skillPath);
         return {
           assistant: id,
@@ -11859,7 +12027,7 @@ var AssistantsInstaller = class {
     const manifest = await this.readManifest();
     for (const id of ids) {
       const assistant = ASSISTANTS[id];
-      const skillPath = join4(assistant.skillDir(scope, this.options.places), "SKILL.md");
+      const skillPath = join5(assistant.skillDir(scope, this.options.places), "SKILL.md");
       const content = this.skillContent;
       await writeAtomic(skillPath, content);
       const kept = manifest.filter((e) => e.skillFile !== skillPath);
@@ -11884,9 +12052,9 @@ var AssistantsInstaller = class {
     for (const id of ids) {
       const assistant = ASSISTANTS[id];
       const dir = assistant.skillDir(scope, this.options.places);
-      const skillPath = join4(dir, "SKILL.md");
+      const skillPath = join5(dir, "SKILL.md");
       await rm2(dir, { recursive: true, force: true });
-      await rmdir(dirname2(dir)).then(() => rmdir(dirname2(dirname2(dir)))).catch(() => {
+      await rmdir(dirname3(dir)).then(() => rmdir(dirname3(dirname3(dir)))).catch(() => {
       });
       manifest = manifest.filter((e) => e.skillFile !== skillPath);
       const outcome = await this.removeMcp(assistant.mcp(scope, this.options.places));
@@ -12040,7 +12208,7 @@ args = [${MCP_ARGS.map((a2) => `"${a2}"`).join(", ")}]
   }
   // ───────────── manifest ─────────────
   get manifestPath() {
-    return join4(this.options.configDir, "assistants.json");
+    return join5(this.options.configDir, "assistants.json");
   }
   async readManifest() {
     const text4 = await readText(this.manifestPath);
@@ -12271,9 +12439,16 @@ async function consoleCommand(app, args) {
 }
 
 // src/commands/each.ts
+var MAX_PATTERN = 200;
 function matcher(selector) {
   const regex = /^\/(.+)\/([a-z]*)$/.exec(selector);
   if (regex) {
+    if (selector.length > MAX_PATTERN) {
+      throw new CloudhopError(
+        "INVALID_NAME",
+        `That regular expression is too long (max ${MAX_PATTERN}).`
+      );
+    }
     try {
       const re = new RegExp(regex[1], regex[2]);
       return (name) => re.test(name);
@@ -12375,52 +12550,872 @@ ${listing}
     if (!tty) {
       throw new CloudhopError(
         "PROD_CONFIRMATION_REQUIRED",
-        `This may change resources in production: ${risky.join(", ")}.`,
-        "Run it in a terminal to confirm, or set CLOUDHOP_CONFIRM_PROD=1 once a person has approved it."
+        `This may change resources in production: ${risky.join(", ")}.`,
+        "Run it in a terminal to confirm, or set CLOUDHOP_CONFIRM_PROD=1 once a person has approved it."
+      );
+    }
+    dist_exports.log.warn(
+      `${paint("red", bold("PRODUCTION"))} ${risky.join(", ")}: this may change resources.`
+    );
+    if (!answer(await dist_exports.confirm({ message: "Also run it in production?", initialValue: false })))
+      return 130;
+  }
+  for (const source of new Set(selected.map((a2) => a2.source))) {
+    await app.ensureSession(source, { interactive: tty });
+  }
+  const parallel = Math.max(1, Math.min(16, Number(flags.parallel) || 4));
+  const outcomes = await mapLimit(selected, parallel, async (a2) => {
+    try {
+      const r2 = await app.captureAsAlias(a2.name, cliArgs);
+      const outcome = { alias: a2.name, exitCode: r2.exitCode, stdout: r2.stdout, stderr: r2.stderr };
+      if (!flags.json) printOutcome(outcome, width);
+      return outcome;
+    } catch (error) {
+      const outcome = { alias: a2.name, exitCode: 1, stdout: "", stderr: error.message };
+      if (!flags.json) printOutcome(outcome, width);
+      return outcome;
+    }
+  });
+  const failed = outcomes.filter((o2) => o2.exitCode !== 0);
+  if (flags.json) {
+    console.log(JSON.stringify({ version: 1, command: cliArgs, results: outcomes }, null, 2));
+  } else {
+    const summary = `${outcomes.length - failed.length} ok${failed.length ? `, ${failed.length} failed: ${failed.map((f2) => f2.alias).join(", ")}` : ""}`;
+    process.stderr.write(`${failed.length ? paint("red", summary) : paint("green", summary)}
+`);
+  }
+  return failed.length ? 1 : 0;
+}
+function printOutcome({ alias, exitCode, stdout: stdout2, stderr }, width) {
+  const tag = paint(exitCode === 0 ? "sky" : "red", `[${alias}]`.padEnd(width + 2));
+  for (const line of stdout2.replace(/\n$/, "").split("\n"))
+    if (line) process.stdout.write(`${tag} ${line}
+`);
+  for (const line of stderr.replace(/\n$/, "").split("\n"))
+    if (line) process.stderr.write(`${tag} ${paint("dim", line)}
+`);
+  if (exitCode !== 0) process.stderr.write(`${tag} ${paint("red", `exit ${exitCode}`)}
+`);
+}
+
+// src/commands/use.ts
+import { spawnSync } from "child_process";
+import { writeFile as writeFile5 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname5, join as join7, resolve as resolve2 } from "path";
+
+// src/commands/shell.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { appendFile, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join6 } from "path";
+
+// src/commands/starship.ts
+var BEGIN = "# >>> cloudhop >>> (added by `cloudhop shell`; remove this block and the ${env_var.cloudhop_*} segments in `format` to undo)";
+var END = "# <<< cloudhop <<<";
+var SKY = "#3bb8f5";
+var ON_SKY = "#0b1124";
+var RED = "#be123c";
+var STARSHIP_SEGMENTS = PROVIDER_IDS.map(
+  (p3) => `\${env_var.cloudhop_${p3}}\${env_var.cloudhop_${p3}_prod}`
+).join("");
+function starshipModules(powerline) {
+  const segment = (provider, prod) => {
+    if (!powerline) {
+      return prod ? `[${provider} $env_value PROD ](bold #fb7185)` : `[${provider} $env_value ](bold ${SKY})`;
+    }
+    const { glyph, color } = powerline;
+    const bg = prod ? RED : SKY;
+    const fg = prod ? "#ffffff" : ON_SKY;
+    return `[${glyph}](fg:${color} bg:${bg})[ ${provider} $env_value${prod ? " PROD" : ""} ](bold fg:${fg} bg:${bg})[${glyph}](fg:${bg} bg:${color})`;
+  };
+  return PROVIDER_IDS.map((p3) => {
+    const variable = `CLOUDHOP_${p3.toUpperCase()}`;
+    return `[env_var.cloudhop_${p3}]
+variable = '${variable}_SEGMENT'
+format = '${segment(p3, false)}'
+
+[env_var.cloudhop_${p3}_prod]
+variable = '${variable}_PROD_SEGMENT'
+format = '${segment(p3, true)}'`;
+  }).join("\n\n");
+}
+var hasCloudhopStarship = (text4) => text4.includes("[env_var.cloudhop_aws]");
+var CLOSING_GROUP = /\[\s*([-])\s*\]\(\s*fg:\s*(#[0-9a-fA-F]{3,8}|[a-z_]+)\s*\)/g;
+function addToStarshipConfig(text4) {
+  if (hasCloudhopStarship(text4)) return text4;
+  let result = text4;
+  let powerline;
+  const format = findTopLevelFormat(result);
+  if (format && !/\$all\b|\$\{?env_var\}?(?![._])/.test(format.content)) {
+    const { content, multiline: multiline2 } = format;
+    const continuation = multiline2 ? "\\\n" : "";
+    const closing = [...content.matchAll(CLOSING_GROUP)].at(-1);
+    const lineBreak = [content.lastIndexOf("$line_break"), content.lastIndexOf("$character")].find(
+      (i2) => i2 >= 0
+    );
+    let updated;
+    if (closing?.index !== void 0 && (lineBreak === void 0 || closing.index < lineBreak)) {
+      powerline = { glyph: closing[1], color: closing[2] };
+      updated = `${content.slice(0, closing.index)}${STARSHIP_SEGMENTS}${continuation}${content.slice(closing.index)}`;
+    } else if (lineBreak !== void 0) {
+      updated = `${content.slice(0, lineBreak)}${STARSHIP_SEGMENTS}${continuation}${content.slice(lineBreak)}`;
+    } else {
+      const body = content.trimEnd();
+      const tail = content.slice(body.length);
+      const joiner = multiline2 && body.endsWith("\\") ? "\n" : "";
+      updated = `${body}${joiner}${STARSHIP_SEGMENTS}${multiline2 ? "\\" : ""}${tail}`;
+    }
+    result = result.slice(0, format.start) + updated + result.slice(format.end);
+  }
+  const separator = result.length === 0 || result.endsWith("\n") ? "" : "\n";
+  return `${result}${separator}
+${BEGIN}
+${starshipModules(powerline)}
+${END}
+`;
+}
+function findTopLevelFormat(text4) {
+  const firstTable = text4.search(/^[ \t]*\[/m);
+  const head = firstTable === -1 ? text4 : text4.slice(0, firstTable);
+  const match = /^format\s*=\s*("""|'''|"|')/m.exec(head);
+  if (!match) return void 0;
+  const quote2 = match[1];
+  const start = match.index + match[0].length;
+  const end = text4.indexOf(quote2, start);
+  if (end === -1) return void 0;
+  return { start, end, content: text4.slice(start, end), multiline: quote2.length === 3 };
+}
+
+// src/commands/shell.ts
+var SHELLS = ["zsh", "bash", "fish", "pwsh"];
+var ALIAS_COMMANDS = "use status console region mv prod rm exec";
+var SOURCE_COMMANDS = "alias login sync ls";
+var aliasVar = (provider) => `CLOUDHOP_${provider.toUpperCase()}_ALIAS`;
+var prodVar = (provider) => `CLOUDHOP_${provider.toUpperCase()}_PROD`;
+function posixScript(shell, clis, start) {
+  const wrappers = clis.map(
+    ({ command, provider }) => `${command}() {
+  case " $* " in *" --profile"*) command ${command} "$@"; return $?;; esac
+  if [ -n "$${aliasVar(provider)}" ] && [ "$CLOUDHOP_WRAP" != 0 ]; then
+    command cloudhop "$${aliasVar(provider)}" "$@"
+  else
+    command ${command} "$@"
+  fi
+}`
+  ).join("\n");
+  const prompt = PROVIDER_IDS.map(
+    (p3) => `  [ -n "$${aliasVar(p3)}" ] && out="$out\${out:+ }${p3}:$${aliasVar(p3)}\${${prodVar(p3)}:+ PROD}"`
+  ).join("\n");
+  const hook = shell === "zsh" ? `autoload -Uz add-zsh-hook && add-zsh-hook chpwd _cloudhop_cd` : `case ";$PROMPT_COMMAND;" in *";_cloudhop_cd;"*) ;; *) PROMPT_COMMAND="_cloudhop_cd;_cloudhop_show_prompt\${PROMPT_COMMAND:+;$PROMPT_COMMAND}";; esac`;
+  const promptHook = shell === "zsh" ? `_cloudhop_show_prompt() {
+  [ "$CLOUDHOP_PROMPT" = 0 ] && return 0
+  case "$PROMPT$RPROMPT" in *starship*|*oh-my-posh*|*_cloudhop_rprompt*) return 0 ;; esac
+  setopt prompt_subst
+  RPROMPT='$(_cloudhop_rprompt)'"\${RPROMPT:+ $RPROMPT}"
+}
+# Sky for the alias, rose for production, like the CLI.
+_cloudhop_rprompt() {
+  local p; p="$(cloudhop_prompt)"; [ -n "$p" ] || return 0
+  case "$p" in *PROD*) printf '%%F{204}%s%%f' "$p" ;; *) printf '%%F{75}%s%%f' "$p" ;; esac
+}
+add-zsh-hook precmd _cloudhop_show_prompt` : `# \\001 and \\002 tell readline the colors take no room, so long lines still wrap right.
+_cloudhop_ps1() {
+  local p c=75; p="$(cloudhop_prompt)"; [ -n "$p" ] || return 0
+  case "$p" in *PROD*) c=204 ;; esac
+  printf '\\001\\033[38;5;%sm\\002[%s]\\001\\033[0m\\002 ' "$c" "$p"
+}
+_cloudhop_show_prompt() {
+  [ "$CLOUDHOP_PROMPT" = 0 ] && return 0
+  case "$PS1" in *starship*|*oh-my-posh*|*_cloudhop_ps1*) return 0 ;; esac
+  PS1='$(_cloudhop_ps1)'"$PS1"
+}`;
+  const completion = shell === "zsh" ? `_cloudhop_words() { command cloudhop __complete "$1" 2>/dev/null }
+_hop() { (( CURRENT == 2 )) && { local -a a; a=(\${(f)"$(_cloudhop_words aliases)"}); compadd -a a; } }
+_cloudhop() {
+  local -a w
+  if (( CURRENT == 2 )); then w=(\${(f)"$(_cloudhop_words commands)"}); compadd -a w; return; fi
+  (( CURRENT == 3 )) || return
+  case " ${ALIAS_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words aliases)"});; esac
+  case " ${SOURCE_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words sources)"});; esac
+  compadd -a w
+}
+(( $+functions[compdef] )) && { compdef _hop hop; compdef _cloudhop cloudhop; }` : `_cloudhop_complete() {
+  local cur=\${COMP_WORDS[COMP_CWORD]} cmd=\${COMP_WORDS[0]##*/} kind=""
+  if [ "$cmd" = hop ]; then [ "$COMP_CWORD" -eq 1 ] && kind=aliases
+  elif [ "$COMP_CWORD" -eq 1 ]; then kind=commands
+  elif [ "$COMP_CWORD" -eq 2 ]; then
+    case " ${ALIAS_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=aliases;; esac
+    case " ${SOURCE_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=sources;; esac
+  fi
+  [ -n "$kind" ] && COMPREPLY=($(compgen -W "$(command cloudhop __complete $kind 2>/dev/null)" -- "$cur"))
+}
+complete -o default -F _cloudhop_complete hop cloudhop`;
+  return `# cloudhop shell integration (${shell}). Load it${shell === "zsh" ? " after compinit" : ""}:  ${LOAD_LINE[shell]}
+# - \`cloudhop use <alias>\` switches this shell; \`cloudhop use --off\` goes back.
+# - A folder with a trusted .cloudhoprc switches on cd (off: CLOUDHOP_AUTO_USE=0).
+# - With an alias in use, \`${clis.map((c3) => c3.command).join("`, `") || "aws"}\` signs in when needed and asks before changing production (off: CLOUDHOP_WRAP=0).
+# - Your prompt shows the alias in use (off: CLOUDHOP_PROMPT=0).
+cloudhop() {
+  case "$1" in
+    use)
+      local out; out="$(command cloudhop use --emit ${shell} "\${@:2}")" || return $?
+      eval "$out"; _cloudhop_rc_seen=\${CLOUDHOP_RC:-$_cloudhop_rc_seen} ;;
+    allow|deny) command cloudhop "$@" || return $?; _cloudhop_rc_seen=-; _cloudhop_cd ;;
+    *) command cloudhop "$@" ;;
+  esac
+}
+_cloudhop_cd() {
+  [ "$CLOUDHOP_AUTO_USE" = 0 ] && return
+  [ "$PWD" = "$_cloudhop_pwd" ] && [ "$_cloudhop_rc_seen" != - ] && return
+  _cloudhop_pwd=$PWD
+  local dir=$PWD rc=
+  while :; do
+    if [ -f "$dir/.cloudhoprc" ]; then rc="$dir/.cloudhoprc"; break; fi
+    { [ -z "$dir" ] || [ "$dir" = / ]; } && break
+    dir="\${dir%/*}"
+  done
+  [ "$rc" = "$_cloudhop_rc_seen" ] && return
+  _cloudhop_rc_seen=$rc
+  local out
+  if [ -n "$rc" ]; then out="$(command cloudhop use --emit ${shell} --from "$rc")"
+  elif [ -n "$CLOUDHOP_RC$_cloudhop_start" ]; then out="$(command cloudhop use --emit ${shell} --leave)"
+  else return 0; fi
+  eval "$out"
+}
+${hook}
+${start ? "# New terminals start with your default alias (`cloudhop use <alias> --default`).\n_cloudhop_start=1 _cloudhop_rc_seen=-\n_cloudhop_cd\nunset _cloudhop_start" : "_cloudhop_cd"}
+${wrappers}
+${completion}
+# The aliases in use, e.g. "aws:acme-dev". Shown in your prompt by itself
+# (off: CLOUDHOP_PROMPT=0); Starship gets its own segments from \`cloudhop shell\`.
+cloudhop_prompt() {
+  local out=
+${prompt}
+  [ -n "$out" ] && printf '%s' "$out"
+}
+${promptHook}
+`;
+}
+function fishScript(clis, start) {
+  const wrappers = clis.map(
+    ({ command, provider }) => `function ${command} --wraps ${command}
+  if test -n "$${aliasVar(provider)}" -a "$CLOUDHOP_WRAP" != 0; and not string match -q -- '--profile*' $argv
+    command cloudhop $${aliasVar(provider)} $argv
+  else
+    command ${command} $argv
+  end
+end`
+  ).join("\n");
+  const prompt = PROVIDER_IDS.map(
+    (p3) => `  test -n "$${aliasVar(p3)}"; and set out $out "${p3}:$${aliasVar(p3)}"(test -n "$${prodVar(p3)}"; and echo ' PROD')`
+  ).join("\n");
+  return `# cloudhop shell integration (fish):  ${LOAD_LINE.fish}
+# - \`cloudhop use <alias>\` switches this shell; \`cloudhop use --off\` goes back.
+# - A folder with a trusted .cloudhoprc switches on cd (off: set -gx CLOUDHOP_AUTO_USE 0).
+# - With an alias in use, the cloud CLI signs in when needed and asks before changing production (off: set -gx CLOUDHOP_WRAP 0).
+function cloudhop
+  switch "$argv[1]"
+    case use
+      set -l out (command cloudhop use --emit fish $argv[2..-1]); or return $status
+      printf '%s\\n' $out | source
+      set -q CLOUDHOP_RC; and set -g _cloudhop_rc_seen $CLOUDHOP_RC
+    case allow deny
+      command cloudhop $argv; or return $status
+      set -g _cloudhop_rc_seen -
+      _cloudhop_cd
+    case '*'
+      command cloudhop $argv
+  end
+end
+function _cloudhop_cd --on-variable PWD
+  test "$CLOUDHOP_AUTO_USE" = 0; and return
+  set -l dir $PWD
+  set -l rc ''
+  while true
+    if test -f "$dir/.cloudhoprc"; set rc "$dir/.cloudhoprc"; break; end
+    if test -z "$dir" -o "$dir" = /; break; end
+    set dir (string replace -r '/[^/]*$' '' -- $dir)
+  end
+  test "$rc" = "$_cloudhop_rc_seen"; and return
+  set -g _cloudhop_rc_seen $rc
+  if test -n "$rc"
+    command cloudhop use --emit fish --from $rc | source
+  else if test -n "$CLOUDHOP_RC$_cloudhop_start"
+    command cloudhop use --emit fish --leave | source
+  end
+end
+${start ? "# New terminals start with your default alias (`cloudhop use <alias> --default`).\nset -g _cloudhop_start 1\nset -g _cloudhop_rc_seen -\n_cloudhop_cd\nset -e _cloudhop_start" : "_cloudhop_cd"}
+${wrappers}
+complete -c hop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete aliases 2>/dev/null)'
+complete -c cloudhop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete commands 2>/dev/null)'
+complete -c cloudhop -f -n '__fish_seen_subcommand_from ${ALIAS_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete aliases 2>/dev/null)'
+complete -c cloudhop -f -n '__fish_seen_subcommand_from ${SOURCE_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete sources 2>/dev/null)'
+# The aliases in use, e.g. "aws:acme-dev", at the right of the prompt unless
+# something else (like Starship) draws it (off: set -gx CLOUDHOP_PROMPT 0).
+function cloudhop_prompt
+  set -l out
+${prompt}
+  test -n "$out"; and printf '%s' (string join ' ' $out)
+end
+if not functions -q fish_right_prompt
+  function fish_right_prompt
+    test "$CLOUDHOP_PROMPT" = 0; and return
+    set -l label (cloudhop_prompt)
+    test -n "$label"; or return
+    if string match -q '*PROD*' -- $label; set_color fb7185; else; set_color 3bb8f5; end
+    printf '%s' $label; set_color normal
+  end
+end
+`;
+}
+function pwshScript(clis, start) {
+  const wrappers = clis.map(
+    ({
+      command,
+      provider
+    }) => `$script:CloudhopCli_${provider} = (Get-Command ${command} -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1).Source
+function ${command} {
+  if ($env:${aliasVar(provider)} -and $env:CLOUDHOP_WRAP -ne '0' -and -not ($args -like '--profile*')) { & $script:CloudhopExe $env:${aliasVar(provider)} @args }
+  elseif ($script:CloudhopCli_${provider}) { & $script:CloudhopCli_${provider} @args }
+  else { Write-Error '${command}: command not found' }
+}`
+  ).join("\n");
+  const prompt = PROVIDER_IDS.map(
+    (p3) => `  if ($env:${aliasVar(p3)}) { $out += "${p3}:$env:${aliasVar(p3)}$(if ($env:${prodVar(p3)}) { ' PROD' })" }`
+  ).join("\n");
+  return `# cloudhop shell integration (PowerShell):  ${LOAD_LINE.pwsh}
+# - \`cloudhop use <alias>\` switches this shell; \`cloudhop use --off\` goes back.
+# - A folder with a trusted .cloudhoprc switches on cd (off: $env:CLOUDHOP_AUTO_USE = '0').
+# - With an alias in use, the cloud CLI signs in when needed and asks before changing production (off: $env:CLOUDHOP_WRAP = '0').
+$script:CloudhopExe = (Get-Command cloudhop -CommandType Application, ExternalScript | Select-Object -First 1).Source
+function cloudhop {
+  if ($args.Count -gt 0 -and $args[0] -eq 'use') {
+    $out = & $script:CloudhopExe use --emit pwsh @($args | Select-Object -Skip 1)
+    if ($LASTEXITCODE -eq 0) { $out | Out-String | Invoke-Expression; if ($env:CLOUDHOP_RC) { $script:CloudhopRcSeen = $env:CLOUDHOP_RC } }
+  } elseif ($args.Count -gt 0 -and $args[0] -in 'allow', 'deny') {
+    & $script:CloudhopExe @args
+    if ($LASTEXITCODE -eq 0) { $script:CloudhopRcSeen = '-'; $script:CloudhopPwd = ''; _CloudhopCd }
+  } else { & $script:CloudhopExe @args }
+}
+function _CloudhopCd {
+  if ($env:CLOUDHOP_AUTO_USE -eq '0' -or $PWD.ProviderPath -eq $script:CloudhopPwd) { return }
+  $script:CloudhopPwd = $PWD.ProviderPath
+  $dir = $PWD.ProviderPath; $rc = ''
+  while ($dir) {
+    $file = Join-Path $dir '.cloudhoprc'
+    if (Test-Path -LiteralPath $file -PathType Leaf) { $rc = $file; break }
+    $dir = Split-Path -Parent $dir
+  }
+  if ($rc -eq $script:CloudhopRcSeen) { return }
+  $script:CloudhopRcSeen = $rc
+  $out = if ($rc) { & $script:CloudhopExe use --emit pwsh --from $rc } elseif ($env:CLOUDHOP_RC -or $script:CloudhopStart) { & $script:CloudhopExe use --emit pwsh --leave }
+  $script:CloudhopStart = $false
+  if ($out) { $out | Out-String | Invoke-Expression }
+}
+${start ? "# New terminals start with your default alias (`cloudhop use <alias> --default`).\n$script:CloudhopStart = $true\n" : ""}$script:CloudhopPrompt = $function:prompt
+function prompt {
+  _CloudhopCd
+  $out = & $script:CloudhopPrompt
+  # The alias in use before your prompt, unless Starship draws it (off: $env:CLOUDHOP_PROMPT = '0').
+  if ($env:CLOUDHOP_PROMPT -ne '0' -and "$script:CloudhopPrompt" -notmatch 'starship|oh-my-posh') {
+    $label = cloudhop_prompt
+    if ($label) {
+      if (-not $Host.UI.SupportsVirtualTerminal) { return "[$label] $out" }
+      $color = if ($label -match 'PROD') { 204 } else { 75 }
+      return "$([char]27)[38;5;$($color)m[$label]$([char]27)[0m $out"
+    }
+  }
+  $out
+}
+${wrappers}
+Register-ArgumentCompleter -Native -CommandName hop, cloudhop -ScriptBlock {
+  param($word, $ast)
+  $n = $ast.CommandElements.Count - [int]($word -eq '')
+  $kind = if ($ast.CommandElements[0].Value -match 'hop$' -and $ast.CommandElements[0].Value -notmatch 'cloudhop') { if ($n -le 1) { 'aliases' } }
+          elseif ($n -le 1) { 'commands' }
+          elseif ($n -eq 2 -and ' ${ALIAS_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'aliases' }
+          elseif ($n -eq 2 -and ' ${SOURCE_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'sources' }
+  if ($kind) { & $script:CloudhopExe __complete $kind | Where-Object { $_ -like "$word*" } }
+}
+function cloudhop_prompt {
+  $out = @()
+${prompt}
+  $out -join ' '
+}
+`;
+}
+function shellScript(shell, clis, start = false) {
+  if (shell === "fish") return fishScript(clis, start);
+  if (shell === "pwsh") return pwshScript(clis, start);
+  return posixScript(shell, clis, start);
+}
+function starshipSnippet() {
+  return `# cloudhop: the alias each cloud uses in this shell (\`cloudhop use\`, .cloudhoprc).
+# \`cloudhop shell\` adds this for you. By hand: append it to starship.toml and, if
+# your config has a top-level \`format\`, add this where you want the segments:
+#   ${STARSHIP_SEGMENTS}
+
+${starshipModules()}
+`;
+}
+var quote = (shell, value) => shell === "pwsh" ? `'${value.replace(/'/g, "''")}'` : `'${value.replace(/'/g, "'\\''")}'`;
+function shellExports(shell, env) {
+  return Object.entries(env).map(([key2, value]) => {
+    if (value === void 0) {
+      if (shell === "fish") return `set -e ${key2}`;
+      if (shell === "pwsh") return `Remove-Item Env:${key2} -ErrorAction SilentlyContinue`;
+      return `unset ${key2}`;
+    }
+    if (shell === "fish") return `set -gx ${key2} ${quote(shell, value)}`;
+    if (shell === "pwsh") return `$env:${key2} = ${quote(shell, value)}`;
+    return `export ${key2}=${quote(shell, value)}`;
+  }).join("\n");
+}
+function detectShell() {
+  if (process.platform === "win32") return "pwsh";
+  const name = (process.env.SHELL ?? "").split("/").pop();
+  return SHELLS.includes(name) ? name : "bash";
+}
+function parseShell(value) {
+  if (!value) return detectShell();
+  const shell = value === "powershell" ? "pwsh" : value;
+  if (!SHELLS.includes(shell)) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `Unknown shell "${value}".`,
+      `Use one of: ${SHELLS.join(", ")}.`
+    );
+  }
+  return shell;
+}
+var RC_FILES = {
+  zsh: (home) => join6(home, ".zshrc"),
+  bash: (home) => join6(home, ".bashrc"),
+  fish: (home) => join6(home, ".config", "fish", "config.fish"),
+  pwsh: (home) => process.platform === "win32" ? join6(home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1") : join6(home, ".config", "powershell", "Microsoft.PowerShell_profile.ps1")
+};
+var LOAD_LINE = {
+  zsh: 'eval "$(cloudhop shell zsh)"',
+  bash: 'eval "$(cloudhop shell bash)"',
+  fish: "cloudhop shell fish | source",
+  pwsh: "cloudhop shell pwsh | Out-String | Invoke-Expression"
+};
+function shellIntegrationInstalled() {
+  const shell = detectShell();
+  const read = (file) => {
+    try {
+      return readFileSync2(file, "utf8");
+    } catch {
+      return void 0;
+    }
+  };
+  const rc = read(RC_FILES[shell](homedir3())) ?? "";
+  if (!rc.includes(LOAD_LINE[shell])) return false;
+  const starship = read(starshipFile());
+  if (starship === void 0) return !rc.includes("starship init");
+  return hasCloudhopStarship(starship);
+}
+var starshipFile = () => process.env.STARSHIP_CONFIG || join6(homedir3(), ".config", "starship.toml");
+async function shellCommand(args, clis, start = false) {
+  const { positional, flags } = parseArgs(args);
+  if (positional[0] === "starship") {
+    process.stdout.write(starshipSnippet());
+    return;
+  }
+  const setUp = positional[0] === "install" || !positional[0] && process.stdout.isTTY;
+  if (!setUp) {
+    process.stdout.write(shellScript(parseShell(positional[0]), clis, start));
+    return;
+  }
+  const shell = parseShell(positional[1]);
+  const file = RC_FILES[shell](homedir3());
+  const line = LOAD_LINE[shell];
+  const current = await readIfExists(file) ?? "";
+  const starship = await starshipConfig(current);
+  const needsLine = !current.includes(line);
+  const needsStarship = starship !== void 0 && !hasCloudhopStarship(starship.text);
+  const rcName = file.replace(homedir3(), "~");
+  if (!needsLine && !needsStarship) {
+    console.log(`Already set up in ${rcName}${starship ? " and your Starship prompt" : ""}.`);
+    return;
+  }
+  const changes = [
+    needsLine && `add one line to ${rcName}: \`cloudhop use\`, .cloudhoprc folders, the alias in your prompt`,
+    needsStarship && `show the alias in your Starship prompt (${starship.file.replace(homedir3(), "~")}, keeping a backup)`
+  ].filter(Boolean);
+  if (!flags.yes) {
+    if (!interactive())
+      throw new CloudhopError(
+        "NOT_INTERACTIVE",
+        `Rerun with --yes to ${changes.join(" and ")}.${needsLine ? `
+Or add this line to ${file} yourself:
+  ${line}` : ""}`
+      );
+    console.log(`cloudhop will:
+${changes.map((c3) => `  - ${c3}`).join("\n")}`);
+    const ok = answer(await dist_exports.confirm({ message: "Set up your terminal?", initialValue: true }));
+    if (!ok) return;
+  }
+  if (needsLine) {
+    await mkdir4(dirname4(file), { recursive: true });
+    const note2 = shell === "zsh" ? "  # after compinit" : "";
+    await appendFile(
+      file,
+      `${current && !current.endsWith("\n") ? "\n" : ""}
+# cloudhop: \`cloudhop use\`, .cloudhoprc folders, tab completion, prompt${note2}
+${line}
+`
+    );
+    console.log(`${paint("green", "\u2714")} Added to ${rcName}.`);
+  }
+  if (needsStarship) {
+    await mkdir4(dirname4(starship.file), { recursive: true });
+    if (starship.exists) await writeFile4(`${starship.file}.cloudhop-backup`, starship.text);
+    await writeFile4(starship.file, addToStarshipConfig(starship.text));
+    console.log(
+      `${paint("green", "\u2714")} Your Starship prompt shows the alias in use (backup: ${starship.file.replace(homedir3(), "~")}.cloudhop-backup).`
+    );
+  }
+  console.log(
+    `Open a new terminal (or run ${paint("sky", shell === "pwsh" ? ". $PROFILE" : `exec ${shell}`)}), then:`
+  );
+  console.log(`  ${paint("sky", "cloudhop use <alias>")}   switch this terminal to an account`);
+  console.log(`  ${paint("sky", "aws s3 ls")}              plain aws commands, as that alias`);
+}
+async function starshipConfig(rc) {
+  const file = starshipFile();
+  const text4 = await readIfExists(file);
+  if (text4 === void 0 && !rc.includes("starship init") && !process.env.STARSHIP_SHELL) {
+    return void 0;
+  }
+  return { file, text: text4 ?? "", exists: text4 !== void 0 };
+}
+async function readIfExists(file) {
+  try {
+    return await readFile4(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function completeCommand(app, kind) {
+  if (kind === "commands") {
+    console.log(
+      [...RESERVED_NAMES, "each", "shell", "use"].filter((c3, i2, a2) => a2.indexOf(c3) === i2).sort().join("\n")
+    );
+    return;
+  }
+  const config = await app.config();
+  const words = kind === "sources" ? config.sources.map((s) => s.id) : config.aliases.map((a2) => a2.name);
+  if (words.length) console.log(words.join("\n"));
+}
+
+// src/commands/use.ts
+var activeVars = (provider) => {
+  const prefix = `CLOUDHOP_${provider.toUpperCase()}`;
+  return {
+    alias: `${prefix}_ALIAS`,
+    prod: `${prefix}_PROD`,
+    prompt: `${prefix}_PROMPT`,
+    // One or the other, so prompt themes can style production apart (Starship's env_var).
+    segment: `${prefix}_SEGMENT`,
+    prodSegment: `${prefix}_PROD_SEGMENT`
+  };
+};
+function activeAliases(env = process.env) {
+  return Object.fromEntries(
+    PROVIDER_IDS.filter((p3) => env[activeVars(p3).alias]).map((p3) => [p3, env[activeVars(p3).alias]])
+  );
+}
+async function shellContext(trusted, cwd = process.cwd()) {
+  const file = findFolderFile(cwd);
+  const content = file ? await readFolderFile(file) : void 0;
+  let folder;
+  if (file && content !== void 0) {
+    try {
+      folder = {
+        file,
+        aliases: parseFolderFile(content),
+        trusted: trusted.isTrusted(file, content)
+      };
+    } catch {
+    }
+  }
+  return { inUse: activeAliases(), ...folder ? { folder } : {} };
+}
+var tilde2 = (path2) => path2.replace(homedir4(), "~");
+var folderProviders = () => (process.env.CLOUDHOP_RC_PROVIDERS ?? "").split(",").filter((p3) => PROVIDER_IDS.includes(p3));
+async function activate(app, alias, login) {
+  const shellEnv = await app.shellEnv(alias, { login });
+  const vars = activeVars(shellEnv.provider);
+  const label = shellEnv.region ? `${alias} (${shellEnv.region})` : alias;
+  const env = Object.fromEntries(shellEnv.clear.map((name) => [name, void 0]));
+  Object.assign(env, shellEnv.env, {
+    [vars.alias]: alias,
+    [vars.prod]: shellEnv.prod ? "1" : void 0,
+    [vars.prompt]: label,
+    [vars.segment]: shellEnv.prod ? void 0 : label,
+    [vars.prodSegment]: shellEnv.prod ? label : void 0,
+    // The cloud-neutral pair from cloudhop 1.2, kept for prompts already using it.
+    CLOUDHOP_ALIAS: alias,
+    CLOUDHOP_PROD: shellEnv.prod ? "1" : void 0
+  });
+  const where = [shellEnv.label, shellEnv.region ?? "no region"].filter(Boolean).join(", ");
+  return { provider: shellEnv.provider, env, summary: `${alias} (${where})`, prod: shellEnv.prod };
+}
+function deactivate(app, provider) {
+  const vars = activeVars(provider);
+  const env = Object.fromEntries(app.shellVars(provider).map((n3) => [n3, void 0]));
+  for (const name of Object.values(vars)) env[name] = void 0;
+  if (process.env.CLOUDHOP_ALIAS && process.env.CLOUDHOP_ALIAS === process.env[vars.alias]) {
+    Object.assign(env, { CLOUDHOP_ALIAS: void 0, CLOUDHOP_PROD: void 0 });
+  }
+  return env;
+}
+function warnProduction(activation) {
+  if (!activation.prod) return;
+  const alias = activation.summary.split(" ")[0];
+  notify(
+    paint(
+      "red",
+      `${alias} is production: with the shell integration, \`aws\` asks before changes. Other tools (terraform, scripts) don't.`
+    )
+  );
+}
+async function useCommand(app, trusted, args) {
+  const { positional, flags } = parseArgs(args);
+  const shell = flags.emit ? parseShell(flags.emit) : void 0;
+  if (flags.from !== void 0 || flags.leave) {
+    if (!shell) throw new CloudhopError("INVALID_NAME", "--from and --leave need --emit <shell>.");
+    const env2 = await folderEnv(app, trusted, flags.leave ? void 0 : flags.from);
+    process.stdout.write(`${shellExports(shell, env2)}
+`);
+    return 0;
+  }
+  if (flags.noDefault) {
+    const which = positional[0];
+    const cleared = await app.clearDefaultAlias(which ? cloudArg(which) : void 0);
+    if (shell) process.stdout.write("\n");
+    notify(
+      cleared.length ? `New terminals no longer start with ${cleared.join(", ")}. This one keeps what it uses.` : "There was no default alias."
+    );
+    return 0;
+  }
+  if (flags.off) {
+    if (!shell) throw noIntegration("Nothing to turn off: this shell has no cloudhop integration.");
+    const which = positional[0];
+    const providers = which ? [cloudArg(which)] : app.availableProviders().map((provider) => provider.id);
+    const env2 = {};
+    for (const provider of providers) Object.assign(env2, deactivate(app, provider));
+    const remaining = folderProviders().filter((p3) => !providers.includes(p3));
+    Object.assign(
+      env2,
+      folderMarks(remaining.length ? process.env.CLOUDHOP_RC : void 0, remaining)
+    );
+    process.stdout.write(`${shellExports(shell, env2)}
+`);
+    notify(which ? `No ${which} alias in this shell anymore.` : "No alias in this shell anymore.");
+    return 0;
+  }
+  const alias = positional[0] ?? await pickAlias(app, "Use which alias in this shell?");
+  const activation = await activate(app, alias, true);
+  if (flags.default) {
+    if (activation.prod && !flags.yes) {
+      throw new CloudhopError(
+        "PROD_CONFIRMATION_REQUIRED",
+        `${alias} is production: every new terminal would start in it.`,
+        `If that's what you want, run \`cloudhop use ${alias} --default --yes\`.`
       );
     }
-    dist_exports.log.warn(
-      `${paint("red", bold("PRODUCTION"))} ${risky.join(", ")}: this may change resources.`
-    );
-    if (!answer(await dist_exports.confirm({ message: "Also run it in production?", initialValue: false })))
-      return 130;
+    await app.setDefaultAlias(alias);
   }
-  for (const source of new Set(selected.map((a2) => a2.source))) {
-    await app.ensureSession(source, { interactive: tty });
+  let folder;
+  if (flags.save) folder = await saveFolderFile(trusted, activation.provider, alias);
+  if (!shell) {
+    if (!interactive()) {
+      throw noIntegration("`cloudhop use` needs a terminal or the shell integration.");
+    }
+    return subshell(alias, activation);
   }
-  const parallel = Math.max(1, Math.min(16, Number(flags.parallel) || 4));
-  const outcomes = await mapLimit(selected, parallel, async (a2) => {
+  const fromFolder = folderProviders().filter((p3) => p3 !== activation.provider);
+  const env = { ...activation.env };
+  if (folder) Object.assign(env, folderMarks(folder, [...fromFolder, activation.provider]));
+  else
+    Object.assign(
+      env,
+      folderMarks(fromFolder.length ? process.env.CLOUDHOP_RC : void 0, fromFolder)
+    );
+  process.stdout.write(`${shellExports(shell, env)}
+`);
+  notify(`This shell now uses ${activation.summary}.`);
+  if (flags.default) notify(`New terminals start with ${alias}.`);
+  if (folder) notify(`Saved in ${tilde2(folder)}: this folder switches to ${alias} on cd.`);
+  warnProduction(activation);
+  return 0;
+}
+var folderMarks = (file, providers) => ({
+  CLOUDHOP_RC: providers.length && file ? file : void 0,
+  CLOUDHOP_RC_PROVIDERS: providers.length ? providers.join(",") : void 0
+});
+function cloudArg(which) {
+  if (PROVIDER_IDS.includes(which)) return which;
+  throw new CloudhopError(
+    "INVALID_NAME",
+    `Unknown cloud "${which}".`,
+    `Use one of: ${PROVIDER_IDS.join(", ")}, or nothing for all of them.`
+  );
+}
+var noIntegration = (message) => new CloudhopError(
+  "NOT_INTERACTIVE",
+  message,
+  `Set it up once with \`cloudhop shell install\` (or add ${LOAD_LINE[detectShell()]} to your shell's startup file), then open a new terminal.`
+);
+async function folderEnv(app, trusted, file) {
+  const previous = folderProviders();
+  const activations = [];
+  const path2 = file ? resolve2(file) : void 0;
+  const content = path2 ? await readFolderFile(path2) : void 0;
+  if (path2 && content !== void 0) {
+    let aliases;
     try {
-      const r2 = await app.captureAsAlias(a2.name, cliArgs);
-      const outcome = { alias: a2.name, exitCode: r2.exitCode, stdout: r2.stdout, stderr: r2.stderr };
-      if (!flags.json) printOutcome(outcome, width);
-      return outcome;
+      aliases = parseFolderFile(content);
     } catch (error) {
-      const outcome = { alias: a2.name, exitCode: 1, stdout: "", stderr: error.message };
-      if (!flags.json) printOutcome(outcome, width);
-      return outcome;
+      notify(`${tilde2(path2)}: ${error.message}`);
+    }
+    if (aliases && !trusted.isTrusted(path2, content)) {
+      notify(
+        `${tilde2(path2)} wants this folder to use ${Object.values(aliases).join(", ")}. Run ${bold("cloudhop allow")} if you trust it.`
+      );
+    } else if (aliases) {
+      for (const alias of Object.values(aliases)) {
+        try {
+          activations.push(await activate(app, alias, false));
+        } catch (error) {
+          notify(`${tilde2(path2)}: ${error.message}`);
+        }
+      }
     }
-  });
-  const failed = outcomes.filter((o2) => o2.exitCode !== 0);
-  if (flags.json) {
-    console.log(JSON.stringify({ version: 1, command: cliArgs, results: outcomes }, null, 2));
-  } else {
-    const summary = `${outcomes.length - failed.length} ok${failed.length ? `, ${failed.length} failed: ${failed.map((f2) => f2.alias).join(", ")}` : ""}`;
-    process.stderr.write(`${failed.length ? paint("red", summary) : paint("green", summary)}
-`);
   }
-  return failed.length ? 1 : 0;
+  const fromFolder = activations.map((a2) => a2.provider);
+  const defaults = [];
+  for (const [provider, alias] of Object.entries(await defaultAliases(app))) {
+    if (fromFolder.includes(provider)) continue;
+    const picked = process.env[activeVars(provider).alias];
+    if (picked && !previous.includes(provider)) continue;
+    try {
+      defaults.push(await activate(app, alias, false));
+    } catch (error) {
+      notify(`Default alias: ${error.message}`);
+    }
+  }
+  const applied = [...fromFolder, ...defaults.map((a2) => a2.provider)];
+  const env = {};
+  const left = previous.filter((p3) => !applied.includes(p3));
+  for (const provider of left) Object.assign(env, deactivate(app, provider));
+  for (const activation of [...activations, ...defaults]) Object.assign(env, activation.env);
+  Object.assign(env, folderMarks(path2, applied));
+  const back = defaults.filter((a2) => previous.includes(a2.provider));
+  if (activations.length) {
+    notify(`Using ${activations.map((a2) => a2.summary).join(" and ")}, from ${FOLDER_FILE}.`);
+  } else if (back.length) {
+    notify(`Back to your default ${back.map((a2) => a2.summary).join(" and ")}.`);
+  }
+  const gone = left.map((p3) => process.env[activeVars(p3).alias]).filter(Boolean);
+  if (!activations.length && !back.length && gone.length) {
+    notify(`Left the folder of ${gone.join(", ")}: no alias in this shell.`);
+  }
+  for (const activation of [...activations, ...defaults]) warnProduction(activation);
+  return env;
 }
-function printOutcome({ alias, exitCode, stdout: stdout2, stderr }, width) {
-  const tag = paint(exitCode === 0 ? "sky" : "red", `[${alias}]`.padEnd(width + 2));
-  for (const line of stdout2.replace(/\n$/, "").split("\n"))
-    if (line) process.stdout.write(`${tag} ${line}
-`);
-  for (const line of stderr.replace(/\n$/, "").split("\n"))
-    if (line) process.stderr.write(`${tag} ${paint("dim", line)}
-`);
-  if (exitCode !== 0) process.stderr.write(`${tag} ${paint("red", `exit ${exitCode}`)}
-`);
+async function defaultAliases(app) {
+  try {
+    return await app.defaultAliases();
+  } catch {
+    return {};
+  }
+}
+async function saveFolderFile(trusted, provider, alias) {
+  const file = join7(process.cwd(), FOLDER_FILE);
+  const content = await readFolderFile(file);
+  let aliases = {};
+  if (content !== void 0) {
+    aliases = parseFolderFile(content);
+    delete aliases.any;
+  }
+  aliases[provider] = alias;
+  const text4 = formatFolderFile(aliases);
+  await writeFile5(file, text4);
+  await trusted.trust(file, text4);
+  return file;
+}
+function subshell(alias, activation) {
+  const env = { ...process.env, CLOUDHOP_SUBSHELL: alias };
+  for (const [name, value] of Object.entries(activation.env)) {
+    if (value === void 0) delete env[name];
+    else env[name] = value;
+  }
+  const shell = process.platform === "win32" ? process.env.ComSpec ?? "cmd.exe" : process.env.SHELL ?? "/bin/sh";
+  if (/cmd(\.exe)?$/i.test(shell)) {
+    const label = `${activation.provider}:${alias}${activation.prod ? " PROD" : ""}`;
+    env.PROMPT = `[${label}] ${process.env.PROMPT ?? "$P$G"}`;
+  }
+  if (process.env.CLOUDHOP_SUBSHELL) {
+    notify(
+      `You are already in a cloudhop shell (${process.env.CLOUDHOP_SUBSHELL}): this one goes inside it.`
+    );
+  }
+  notify(`New shell using ${activation.summary}. Type ${bold("exit")} to go back.`);
+  notify(
+    paint(
+      "dim",
+      "Tip: `cloudhop shell install` makes `cloudhop use` switch this same terminal instead."
+    )
+  );
+  warnProduction(activation);
+  const result = spawnSync(shell, [], { stdio: "inherit", env });
+  notify(`Back from ${alias}.`);
+  return result.status ?? 0;
+}
+async function allowCommand(app, trusted, args, allow) {
+  const { positional } = parseArgs(args);
+  const given = positional[0];
+  const file = given ? given.endsWith(FOLDER_FILE) ? resolve2(given) : join7(resolve2(given), FOLDER_FILE) : findFolderFile(process.cwd());
+  if (!file) {
+    throw new CloudhopError(
+      "INVALID_NAME",
+      `No ${FOLDER_FILE} in this folder or above it.`,
+      "Create one with `cloudhop use <alias> --save`."
+    );
+  }
+  if (!allow) {
+    const forgotten = await trusted.forget(file);
+    console.log(
+      forgotten ? `${paint("green", "\u2714")} ${tilde2(file)} is no longer trusted: its folder won't switch aliases.` : `${tilde2(file)} was not trusted.`
+    );
+    return;
+  }
+  const content = await readFolderFile(file);
+  if (content === void 0) throw new CloudhopError("INVALID_NAME", `Can't read ${file}.`);
+  const aliases = parseFolderFile(content);
+  const lines = [];
+  for (const alias of Object.values(aliases)) {
+    try {
+      const status = await app.aliasStatus(alias);
+      lines.push(
+        `  ${bold(alias)}  ${status.label ?? status.target}  ${status.region ?? ""}${status.prod ? `  ${paint("red", "PROD")}` : ""}`
+      );
+    } catch {
+      lines.push(
+        `  ${bold(alias)}  ${paint("yellow", "you don't have this alias: it will be skipped")}`
+      );
+    }
+  }
+  await trusted.trust(file, content);
+  console.log(
+    `${paint("green", "\u2714")} Trusted ${tilde2(file)}. In ${tilde2(dirname5(file))} this shell uses:`
+  );
+  console.log(lines.join("\n"));
 }
 
 // src/commands/manage.ts
@@ -12468,11 +13463,11 @@ var SESSION_LABEL = {
 };
 var JSON_VERSION = 1;
 var printJson = (value) => console.log(JSON.stringify({ version: JSON_VERSION, ...value }, null, 2));
-async function listCommand(app, args = []) {
+async function listCommand(app, args = [], context) {
   const { positional, flags } = parseArgs(args);
   const sourceId = positional[0];
   if (flags.json) {
-    const overview = await app.overview();
+    const overview = { ...await app.overview(), ...await context?.() };
     if (sourceId && !overview.sources.some((s) => s.id === sourceId)) {
       throw new CloudhopError("SOURCE_NOT_FOUND", `Source "${sourceId}" not found.`);
     }
@@ -12519,7 +13514,7 @@ async function listCommand(app, args = []) {
     );
     for (const { alias, target, region } of own) {
       const label = target ? target.label : paint("red", `${alias.target} (no longer available)`);
-      const tag = alias.prod ? `  ${paint("red", "PROD")}` : "";
+      const tag = `${alias.prod ? `  ${paint("red", "PROD")}` : ""}${alias.default ? `  ${paint("dim", "default")}` : ""}`;
       console.log(
         `  ${alias.name.padEnd(nameWidth)}${(region ?? "-").padEnd(regionWidth)}${label}${tag}`
       );
@@ -12651,7 +13646,21 @@ async function statusCommand(app, args) {
     return;
   }
   const overview = await app.overview();
-  if (flags.json) return printJson({ sources: overview.sources });
+  const inUse = activeAliases();
+  const defaults = Object.fromEntries(
+    overview.aliases.filter((a2) => a2.default).map((a2) => [a2.provider, a2.name])
+  );
+  if (flags.json) return printJson({ inUse, defaults, sources: overview.sources });
+  const using = Object.entries(inUse).map(([cloud, alias]) => {
+    const status = overview.aliases.find((a2) => a2.name === alias);
+    const region = status?.region ? ` (${status.region})` : "";
+    return `${cloud} ${bold(paint(status?.prod ? "red" : "sky", alias))}${region}${status?.prod ? ` ${paint("red", "PROD")}` : ""}`;
+  });
+  console.log(
+    using.length ? `This terminal uses ${using.join(", ")}.` : paint("dim", "This terminal uses no alias (`cloudhop use <alias>` to pick one).")
+  );
+  const starts = Object.entries(defaults).map(([cloud, alias]) => `${cloud} ${alias}`);
+  if (starts.length) console.log(paint("dim", `New terminals start with ${starts.join(", ")}.`));
   if (overview.sources.length === 0) {
     console.log("Nothing here yet. Run `cloudhop setup` to get started.");
     return;
@@ -12793,6 +13802,23 @@ async function setupCommand(app, assistants) {
   const addNow = answer(await dist_exports.confirm({ message: "Add an account or SSO portal now?" }));
   if (addNow) await addCommand(app, { positional: [], flags: {} });
   else dist_exports.log.info("Run `cloudhop add` whenever you are ready.");
+  if (!shellIntegrationInstalled()) {
+    dist_exports.note(
+      [
+        "`hop <alias>`, `each` and `console` work as they are. To also switch a terminal",
+        "to an alias (`cloudhop use`, then plain `aws`), switch on `cd` into a folder with",
+        "a .cloudhoprc, see the alias in your prompt (Starship too) and complete aliases",
+        "with <Tab>, your shell loads one line from its startup file. A program can only",
+        "change your terminal this way."
+      ].join("\n"),
+      "Terminal"
+    );
+    const install = answer(
+      await dist_exports.confirm({ message: "Set up your terminal for cloudhop?", initialValue: true })
+    );
+    if (install) await shellCommand(["install", "--yes"], []);
+    else dist_exports.log.info("Later: `cloudhop shell install`. `cloudhop use` still works, in a new shell.");
+  }
   const detected = assistants.detect();
   if (detected.length > 0) {
     const names = detected.map((id) => ASSISTANTS[id].name).join(", ");
@@ -12830,268 +13856,37 @@ async function doctorCommand(app) {
   );
 }
 
-// src/commands/shell.ts
-import { existsSync as existsSync3 } from "fs";
-import { appendFile, mkdir as mkdir3, readFile as readFile3 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
-var SHELLS = ["zsh", "bash", "fish", "pwsh"];
-var ALIAS_COMMANDS = "use status console region mv prod rm exec";
-var SOURCE_COMMANDS = "alias login sync ls";
-var SCRIPTS = {
-  zsh: `# cloudhop shell integration (zsh). Load it after compinit:  eval "$(cloudhop shell zsh)"
-cloudhop() {
-  if [ "$1" = "use" ]; then
-    local out; out="$(command cloudhop use --emit zsh "\${@:2}")" || return $?
-    eval "$out"
-  else
-    command cloudhop "$@"
-  fi
-}
-_cloudhop_words() { command cloudhop __complete "$1" 2>/dev/null }
-_hop() { (( CURRENT == 2 )) && { local -a a; a=(\${(f)"$(_cloudhop_words aliases)"}); compadd -a a; } }
-_cloudhop() {
-  local -a w
-  if (( CURRENT == 2 )); then w=(\${(f)"$(_cloudhop_words commands)"}); compadd -a w; return; fi
-  (( CURRENT == 3 )) || return
-  case " ${ALIAS_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words aliases)"});; esac
-  case " ${SOURCE_COMMANDS} " in *" $words[2] "*) w=(\${(f)"$(_cloudhop_words sources)"});; esac
-  compadd -a w
-}
-(( $+functions[compdef] )) && { compdef _hop hop; compdef _cloudhop cloudhop; }
-# Add $(cloudhop_prompt) to your prompt to see the alias set with \`cloudhop use\`.
-cloudhop_prompt() { [ -n "$CLOUDHOP_ALIAS" ] && printf '\u2601 %s%s' "$CLOUDHOP_ALIAS" "\${CLOUDHOP_PROD:+ PROD}"; }
-`,
-  bash: `# cloudhop shell integration (bash):  eval "$(cloudhop shell bash)"
-cloudhop() {
-  if [ "$1" = "use" ]; then
-    local out; out="$(command cloudhop use --emit bash "\${@:2}")" || return $?
-    eval "$out"
-  else
-    command cloudhop "$@"
-  fi
-}
-_cloudhop_complete() {
-  local cur=\${COMP_WORDS[COMP_CWORD]} cmd=\${COMP_WORDS[0]##*/} kind=""
-  if [ "$cmd" = hop ]; then [ "$COMP_CWORD" -eq 1 ] && kind=aliases
-  elif [ "$COMP_CWORD" -eq 1 ]; then kind=commands
-  elif [ "$COMP_CWORD" -eq 2 ]; then
-    case " ${ALIAS_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=aliases;; esac
-    case " ${SOURCE_COMMANDS} " in *" \${COMP_WORDS[1]} "*) kind=sources;; esac
-  fi
-  [ -n "$kind" ] && COMPREPLY=($(compgen -W "$(command cloudhop __complete $kind 2>/dev/null)" -- "$cur"))
-}
-complete -o default -F _cloudhop_complete hop cloudhop
-# Add $(cloudhop_prompt) to PS1 to see the alias set with \`cloudhop use\`.
-cloudhop_prompt() { [ -n "$CLOUDHOP_ALIAS" ] && printf '\u2601 %s%s' "$CLOUDHOP_ALIAS" "\${CLOUDHOP_PROD:+ PROD}"; }
-`,
-  fish: `# cloudhop shell integration (fish):  cloudhop shell fish | source
-function cloudhop
-  if test "$argv[1]" = use
-    set -l out (command cloudhop use --emit fish $argv[2..-1]); or return $status
-    printf '%s\\n' $out | source
-  else
-    command cloudhop $argv
-  end
-end
-complete -c hop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete aliases 2>/dev/null)'
-complete -c cloudhop -f -n 'test (count (commandline -opc)) -eq 1' -a '(command cloudhop __complete commands 2>/dev/null)'
-complete -c cloudhop -f -n '__fish_seen_subcommand_from ${ALIAS_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete aliases 2>/dev/null)'
-complete -c cloudhop -f -n '__fish_seen_subcommand_from ${SOURCE_COMMANDS}; and test (count (commandline -opc)) -eq 2' -a '(command cloudhop __complete sources 2>/dev/null)'
-# Call cloudhop_prompt from fish_prompt to see the alias set with \`cloudhop use\`.
-function cloudhop_prompt
-  test -n "$CLOUDHOP_ALIAS"; and printf '\u2601 %s%s' $CLOUDHOP_ALIAS (test -n "$CLOUDHOP_PROD"; and echo ' PROD')
-end
-`,
-  pwsh: `# cloudhop shell integration (PowerShell):  cloudhop shell pwsh | Out-String | Invoke-Expression
-$script:CloudhopExe = (Get-Command cloudhop -CommandType Application, ExternalScript | Select-Object -First 1).Source
-function cloudhop {
-  if ($args.Count -gt 0 -and $args[0] -eq 'use') {
-    $out = & $script:CloudhopExe use --emit pwsh @($args | Select-Object -Skip 1)
-    if ($LASTEXITCODE -eq 0) { $out | Out-String | Invoke-Expression }
-  } else { & $script:CloudhopExe @args }
-}
-Register-ArgumentCompleter -Native -CommandName hop, cloudhop -ScriptBlock {
-  param($word, $ast)
-  $n = $ast.CommandElements.Count - [int]($word -eq '')
-  $kind = if ($ast.CommandElements[0].Value -match 'hop$' -and $ast.CommandElements[0].Value -notmatch 'cloudhop') { if ($n -le 1) { 'aliases' } }
-          elseif ($n -le 1) { 'commands' }
-          elseif ($n -eq 2 -and ' ${ALIAS_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'aliases' }
-          elseif ($n -eq 2 -and ' ${SOURCE_COMMANDS} ' -match " $($ast.CommandElements[1].Value) ") { 'sources' }
-  if ($kind) { & $script:CloudhopExe __complete $kind | Where-Object { $_ -like "$word*" } }
-}
-function cloudhop_prompt { if ($env:CLOUDHOP_ALIAS) { "\u2601 $env:CLOUDHOP_ALIAS$(if ($env:CLOUDHOP_PROD) { ' PROD' })" } }
-`
-};
-var quote = (shell, value) => shell === "pwsh" ? `'${value.replace(/'/g, "''")}'` : `'${value.replace(/'/g, "'\\''")}'`;
-function shellExports(shell, env) {
-  return Object.entries(env).map(([key, value]) => {
-    if (value === void 0) {
-      if (shell === "fish") return `set -e ${key}`;
-      if (shell === "pwsh") return `Remove-Item Env:${key} -ErrorAction SilentlyContinue`;
-      return `unset ${key}`;
-    }
-    if (shell === "fish") return `set -gx ${key} ${quote(shell, value)}`;
-    if (shell === "pwsh") return `$env:${key} = ${quote(shell, value)}`;
-    return `export ${key}=${quote(shell, value)}`;
-  }).join("\n");
-}
-function detectShell() {
-  if (process.platform === "win32") return "pwsh";
-  const name = (process.env.SHELL ?? "").split("/").pop();
-  return SHELLS.includes(name) ? name : "bash";
-}
-function parseShell(value) {
-  if (!value) return detectShell();
-  const shell = value === "powershell" ? "pwsh" : value;
-  if (!SHELLS.includes(shell)) {
-    throw new CloudhopError(
-      "INVALID_NAME",
-      `Unknown shell "${value}".`,
-      `Use one of: ${SHELLS.join(", ")}.`
-    );
-  }
-  return shell;
-}
-var RC_FILES = {
-  zsh: (home) => join5(home, ".zshrc"),
-  bash: (home) => join5(home, ".bashrc"),
-  fish: (home) => join5(home, ".config", "fish", "config.fish"),
-  pwsh: (home) => process.platform === "win32" ? join5(home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1") : join5(home, ".config", "powershell", "Microsoft.PowerShell_profile.ps1")
-};
-var LOAD_LINE = {
-  zsh: 'eval "$(cloudhop shell zsh)"',
-  bash: 'eval "$(cloudhop shell bash)"',
-  fish: "cloudhop shell fish | source",
-  pwsh: "cloudhop shell pwsh | Out-String | Invoke-Expression"
-};
-async function shellCommand(args) {
-  const { positional, flags } = parseArgs(args);
-  if (positional[0] !== "install") {
-    process.stdout.write(SCRIPTS[parseShell(positional[0])]);
-    return;
-  }
-  const shell = parseShell(positional[1]);
-  const file = RC_FILES[shell](homedir3());
-  const line = LOAD_LINE[shell];
-  const current = existsSync3(file) ? await readFile3(file, "utf8") : "";
-  if (current.includes(line)) {
-    console.log(`Already set up in ${file.replace(homedir3(), "~")}.`);
-    return;
-  }
-  if (!flags.yes) {
-    if (!interactive())
-      throw new CloudhopError(
-        "NOT_INTERACTIVE",
-        `Add this line to ${file} yourself, or rerun with --yes:
-  ${line}`
-      );
-    const ok = answer(
-      await dist_exports.confirm({
-        message: `Add cloudhop to ${file.replace(homedir3(), "~")}?`,
-        initialValue: true
-      })
-    );
-    if (!ok) return;
-  }
-  await mkdir3(dirname3(file), { recursive: true });
-  const note2 = shell === "zsh" ? "  # after compinit" : "";
-  await appendFile(
-    file,
-    `${current && !current.endsWith("\n") ? "\n" : ""}
-# cloudhop: \`cloudhop use\`, tab completion and cloudhop_prompt${note2}
-${line}
-`
-  );
-  console.log(
-    `${paint("green", "\u2714")} Added to ${file.replace(homedir3(), "~")}. Open a new terminal to use it.`
-  );
-}
-async function useCommand(app, args) {
-  const { positional, flags } = parseArgs(args);
-  const shell = flags.emit ? parseShell(flags.emit) : void 0;
-  if (!shell) {
-    throw new CloudhopError(
-      "NOT_INTERACTIVE",
-      "`cloudhop use` needs the shell integration to change your current shell.",
-      `Set it up once with \`cloudhop shell install\` (or add ${LOAD_LINE[detectShell()]} to your shell's startup file), then open a new terminal.`
-    );
-  }
-  const clear = {
-    AWS_ACCESS_KEY_ID: void 0,
-    AWS_SECRET_ACCESS_KEY: void 0,
-    AWS_SESSION_TOKEN: void 0
-  };
-  if (flags.off) {
-    process.stdout.write(
-      `${shellExports(shell, { ...clear, AWS_PROFILE: void 0, AWS_REGION: void 0, AWS_DEFAULT_REGION: void 0, CLOUDHOP_ALIAS: void 0, CLOUDHOP_PROD: void 0 })}
-`
-    );
-    notify("No alias in this shell anymore.");
-    return;
-  }
-  const alias = positional[0] ?? await pickAlias(app, "Use which alias in this shell?");
-  const env = await app.envForAlias(alias, "cli");
-  const status = await app.aliasStatus(alias);
-  process.stdout.write(
-    `${shellExports(shell, { ...clear, ...env, CLOUDHOP_ALIAS: alias, CLOUDHOP_PROD: status.prod ? "1" : void 0 })}
-`
-  );
-  notify(
-    `This shell now uses ${alias} (${status.label ?? status.target}, ${status.region ?? "no region"}).`
-  );
-  if (status.prod) {
-    notify(
-      paint(
-        "red",
-        `${alias} is production. Plain \`aws\` commands are not protected here: use \`hop ${alias}\` to be asked before changes.`
-      )
-    );
-  }
-}
-async function completeCommand(app, kind) {
-  if (kind === "commands") {
-    console.log(
-      [...RESERVED_NAMES, "each", "shell", "use"].filter((c3, i2, a2) => a2.indexOf(c3) === i2).sort().join("\n")
-    );
-    return;
-  }
-  const config = await app.config();
-  const words = kind === "sources" ? config.sources.map((s) => s.id) : config.aliases.map((a2) => a2.name);
-  if (words.length) console.log(words.join("\n"));
-}
-
 // src/commands/team.ts
-import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
 var import_yaml2 = __toESM(require_dist(), 1);
 var MAX_BYTES = 256 * 1024;
 var HEADER2 = `# cloudhop team setup: import it with \`cloudhop team import <this file or its https URL>\`.
 # No secrets: portal URLs, regions, account ids and role names only.
 `;
 function validate(app, raw) {
-  const bad = (why) => new CloudhopError("INVALID_NAME", `Not a cloudhop team file: ${why}.`);
-  if (!raw || typeof raw !== "object") throw bad("it is empty");
+  const bad2 = (why) => new CloudhopError("INVALID_NAME", `Not a cloudhop team file: ${why}.`);
+  if (!raw || typeof raw !== "object") throw bad2("it is empty");
   const file = raw;
-  if (file.version !== 1) throw bad('unknown "version" (expected 1)');
+  if (file.version !== 1) throw bad2('unknown "version" (expected 1)');
   const sources = file.sources ?? {};
   const aliases = file.aliases ?? {};
   for (const [id, source] of Object.entries(sources)) {
     assertValidName("source", id);
     if (!PROVIDER_IDS.includes(source?.provider))
-      throw bad(`source "${id}" has an unknown provider`);
+      throw bad2(`source "${id}" has an unknown provider`);
     const kind = app.provider(source.provider).sourceKinds.find((k) => k.kind === source.kind);
-    if (!kind) throw bad(`source "${id}" has an unknown kind`);
+    if (!kind) throw bad2(`source "${id}" has an unknown kind`);
     for (const field of kind.fields) {
       const value = source.settings?.[field.key];
-      if (typeof value !== "string" || !value) throw bad(`source "${id}" is missing ${field.key}`);
+      if (typeof value !== "string" || !value) throw bad2(`source "${id}" is missing ${field.key}`);
       const problem = field.validate?.(value);
-      if (problem) throw bad(`source "${id}": ${problem}`);
+      if (problem) throw bad2(`source "${id}": ${problem}`);
     }
   }
   for (const [name, alias] of Object.entries(aliases)) {
     assertValidName("alias", name);
     if (!alias || typeof alias.target !== "string" || !sources[alias.source]) {
-      throw bad(`alias "${name}" must name a source of this file and a target`);
+      throw bad2(`alias "${name}" must name a source of this file and a target`);
     }
   }
   return { version: 1, sources, aliases };
@@ -13107,7 +13902,7 @@ async function load(location) {
       throw new CloudhopError("INVALID_NAME", "That file is too big for a team setup.");
     return text4;
   }
-  return readFile4(location, "utf8");
+  return readFile5(location, "utf8");
 }
 async function teamCommand(app, args) {
   const { positional, flags } = parseArgs(args);
@@ -13128,7 +13923,7 @@ async function teamCommand(app, args) {
     };
     const text4 = HEADER2 + (0, import_yaml2.stringify)(file);
     if (flags.out) {
-      await writeFile3(flags.out, text4);
+      await writeFile6(flags.out, text4);
       console.error(
         `${paint("green", "\u2714")} Wrote ${sources.length} source(s) and ${Object.keys(file.aliases).length} alias(es) to ${flags.out}.`
       );
@@ -13233,8 +14028,8 @@ async function teamCommand(app, args) {
 }
 
 // ../ui/src/api.ts
-var text3 = (body, key) => {
-  const value = body[key];
+var text3 = (body, key2) => {
+  const value = body[key2];
   return typeof value === "string" ? value.trim() : "";
 };
 var badRequest = (message) => new CloudhopError("INVALID_NAME", message);
@@ -13307,8 +14102,8 @@ function createApi(app, assistants) {
             label: kind.label,
             hint: kind.hint,
             nameLabel: kind.nameLabel,
-            fields: kind.fields.map(({ key, label, placeholder, defaultValue }) => ({
-              key,
+            fields: kind.fields.map(({ key: key2, label, placeholder, defaultValue }) => ({
+              key: key2,
               label,
               placeholder,
               defaultValue
@@ -13323,7 +14118,8 @@ function createApi(app, assistants) {
           label: target?.label,
           missing: !target,
           region,
-          prod: alias.prod === true
+          prod: alias.prod === true,
+          default: alias.default === true
         }))
       };
     },
@@ -13418,7 +14214,10 @@ function createApi(app, assistants) {
       await app.addAliases(aliases);
       return { created: aliases.map((a2) => a2.name) };
     },
-    /** Changes an alias: any of `region`, `prod` (production mark) and `name` (rename, applied last). */
+    /**
+     * Changes an alias: any of `region`, `prod` (production mark), `default`
+     * (new terminals start with it) and `name` (rename, applied last).
+     */
     "PATCH /api/aliases/:name": async ([name], body) => {
       let current = name;
       if ("region" in body) {
@@ -13428,6 +14227,11 @@ function createApi(app, assistants) {
         await app.setAliasRegion(current, region);
       }
       if (typeof body.prod === "boolean") await app.setProduction([current], body.prod);
+      if (body.default === true) await app.setDefaultAlias(current);
+      if (body.default === false) {
+        const resolved = await app.resolveAlias(current);
+        if (resolved.alias.default) await app.clearDefaultAlias(resolved.source.provider);
+      }
       if ("name" in body) {
         const to = text3(body, "name");
         await app.renameAlias(current, to);
@@ -13446,8 +14250,8 @@ function createApi(app, assistants) {
       return { removed: name };
     }
   };
-  const table = Object.entries(routes).map(([key, handler]) => {
-    const [method, pattern] = key.split(" ");
+  const table = Object.entries(routes).map(([key2, handler]) => {
+    const [method, pattern] = key2.split(" ");
     const regex = new RegExp(`^${pattern.replace(/:[a-z]+/g, "([^/]+)")}$`);
     return { method, regex, handler };
   });
@@ -13476,7 +14280,7 @@ import { randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
 
 // ../ui/src/assets/app.js
-var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// ---------- pages ----------\n\nconst PAGES = {\n  aliases: 'Aliases',\n  sources: 'Sources',\n  assistants: 'AI assistants',\n  tools: 'Tools',\n};\nlet route = 'aliases';\nconst aliasFilter = { text: '', source: '', prodOnly: false };\n\n/** `#/aliases?source=acme` \u2192 route \"aliases\", filtered by that source. */\nfunction readRoute() {\n  const match = /^#\\/([a-z]+)(?:\\?(.*))?$/.exec(location.hash);\n  route = match && PAGES[match[1]] ? match[1] : 'aliases';\n  const query = new URLSearchParams(match?.[2] ?? '');\n  if (query.has('source')) aliasFilter.source = query.get('source');\n}\n\nfunction go(page, query) {\n  location.hash = `#/${page}${query ? `?${new URLSearchParams(query)}` : ''}`;\n}\n\n// A fresh link opened in this same tab carries a new token: reload to pick it up.\n// Any other fragment is a page change.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) {\n    location.reload();\n    return;\n  }\n  readRoute();\n  if (state) render();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nconst $nav = document.getElementById('nav');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/(sources(\\/[^/]+\\/(login|sync|targets))?|aliases\\/[^/]+\\/console)$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  $nav.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  for (const link of $nav.querySelectorAll('a')) {\n    if (link.dataset.page === route) link.setAttribute('aria-current', 'page');\n    else link.removeAttribute('aria-current');\n  }\n  document.title = `${PAGES[route]} \xB7 cloudhop`;\n  const pages = {\n    aliases: aliasesPage,\n    sources: sourcesPage,\n    assistants: assistantsPage,\n    tools: toolsPage,\n  };\n  $main.replaceChildren(...pages[route]());\n  if (route === 'assistants') loadAssistants();\n  if (route === 'tools') loadTools();\n}\n\nfunction pageHead(title, subtitle, ...actions) {\n  return h(\n    'div',\n    { class: 'page-head' },\n    h('div', {}, h('h1', {}, title), subtitle ? h('p', {}, subtitle) : null),\n    h('div', { class: 'actions' }, actions),\n  );\n}\n\nfunction firstSourceHero() {\n  return h(\n    'div',\n    { class: 'hero' },\n    h('h2', {}, 'Add your first account'),\n    h(\n      'p',\n      {},\n      'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n    ),\n    h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n  );\n}\n\n// ---------- Aliases page ----------\n\nfunction aliasesPage() {\n  if (state.sources.length === 0) return [firstSourceHero()];\n  if (aliasFilter.source && !state.sources.some((s) => s.id === aliasFilter.source))\n    aliasFilter.source = '';\n\n  const addAliases = () => {\n    const source =\n      state.sources.find((s) => s.id === aliasFilter.source) ??\n      (state.sources.length === 1 ? state.sources[0] : undefined);\n    if (source) openAliasPicker(source);\n    else openSourceChooser();\n  };\n  const head = pageHead(\n    'Aliases',\n    'Each alias is one account, role and region. Run it with hop <alias>.',\n    h('button', { onclick: addAliases }, '+ Aliases'),\n  );\n  if (state.aliases.length === 0) {\n    return [\n      head,\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'No aliases yet'),\n        h('p', {}, 'Pick the accounts and roles you use and give each one a short name.'),\n        h('button', { class: 'primary', onclick: addAliases }, 'Pick accounts'),\n      ),\n    ];\n  }\n\n  const rows = h('tbody', { id: 'alias-rows' });\n  const count = h('span', { class: 'count' });\n  const fill = () => {\n    const words = aliasFilter.text.toLowerCase().split(/\\s+/).filter(Boolean);\n    const visible = state.aliases.filter((a) => {\n      if (aliasFilter.source && a.source !== aliasFilter.source) return false;\n      if (aliasFilter.prodOnly && !a.prod) return false;\n      const text = `${a.name} ${a.label ?? a.target} ${a.region ?? ''} ${a.source}`.toLowerCase();\n      return words.every((w) => text.includes(w));\n    });\n    rows.replaceChildren(\n      ...(visible.length\n        ? visible.map(aliasRow)\n        : [\n            h(\n              'tr',\n              {},\n              h('td', { colspan: '5', class: 'empty' }, 'No alias matches these filters.'),\n            ),\n          ]),\n    );\n    count.textContent = `${visible.length} of ${state.aliases.length}`;\n  };\n\n  const search = h('input', {\n    type: 'search',\n    placeholder: 'Filter: name, account, role or region',\n    value: aliasFilter.text,\n    'aria-label': 'Filter aliases',\n    oninput: (e) => {\n      aliasFilter.text = e.currentTarget.value;\n      fill();\n    },\n  });\n  const sourceSelect = h(\n    'select',\n    {\n      'aria-label': 'Source',\n      onchange: (e) => {\n        aliasFilter.source = e.currentTarget.value;\n        fill();\n      },\n    },\n    h('option', { value: '' }, 'All sources'),\n    state.sources.map((s) =>\n      h('option', { value: s.id, selected: s.id === aliasFilter.source }, s.id),\n    ),\n  );\n  const prodOnly = h(\n    'label',\n    { class: 'prod-toggle' },\n    h('input', {\n      type: 'checkbox',\n      checked: aliasFilter.prodOnly,\n      onchange: (e) => {\n        aliasFilter.prodOnly = e.currentTarget.checked;\n        fill();\n      },\n    }),\n    'Production only',\n  );\n\n  const table = h(\n    'table',\n    { class: 'aliases' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Alias'),\n        h('th', {}, 'Source'),\n        h('th', {}, 'Region'),\n        h('th', {}, 'Account / role'),\n        h('th'),\n      ),\n    ),\n    rows,\n  );\n  fill();\n  return [\n    head,\n    h(\n      'div',\n      { class: 'toolbar' },\n      search,\n      sourceSelect,\n      prodOnly,\n      h('div', { class: 'spacer' }),\n      count,\n    ),\n    h('section', { class: 'card' }, table),\n  ];\n}\n\n/** When several sources exist, ask which one to pick accounts from. */\nfunction openSourceChooser() {\n  showDialog(\n    'Add aliases from',\n    h(\n      'div',\n      { class: 'choices' },\n      state.sources.map((source) =>\n        h(\n          'button',\n          { class: 'choice', onclick: () => openAliasPicker(source) },\n          h(\n            'span',\n            {},\n            h('strong', {}, source.id),\n            h('small', {}, source.settings.startUrl ?? source.kindLabel),\n          ),\n        ),\n      ),\n    ),\n  );\n}\n\n// ---------- Sources page ----------\n\nfunction sourcesPage() {\n  const head = pageHead('Sources', 'The SSO portals and personal accounts you sign in to.');\n  if (state.sources.length === 0) return [head, firstSourceHero()];\n  return [head, ...state.sources.map(sourceCard)];\n}\n\n// ---------- AI assistants page ----------\n\nfunction assistantsPage() {\n  return [assistantsCard()];\n}\n\n// ---------- Tools page ----------\n\nfunction snippet(command) {\n  return h(\n    'div',\n    { class: 'snippet' },\n    h('code', {}, command),\n    h(\n      'button',\n      {\n        class: 'link',\n        title: 'Copy',\n        'aria-label': `Copy ${command}`,\n        onclick: () =>\n          navigator.clipboard\n            ?.writeText(command)\n            .then(() => toast('Copied.'))\n            .catch(() =>\n              toast('Copy it by hand: the browser blocked the clipboard.', { error: true }),\n            ),\n      },\n      'Copy',\n    ),\n  );\n}\n\nfunction toolCard(title, text, ...commands) {\n  return h(\n    'section',\n    { class: 'card' },\n    h('div', { class: 'card-head' }, h('h2', {}, title)),\n    h(\n      'div',\n      { class: 'card-body padded' },\n      h('p', { class: 'card-help' }, text),\n      commands.map(snippet),\n    ),\n  );\n}\n\nfunction toolsPage() {\n  const sample = state.aliases[0]?.name ?? 'acme-dev';\n  return [\n    pageHead('Tools', 'More ways to use cloudhop from your terminal.'),\n    h(\n      'section',\n      { class: 'card', id: 'tools-cli' },\n      h('div', { class: 'card-head' }, h('h2', {}, 'Cloud CLIs')),\n      h('div', { class: 'card-body padded' }, h('p', { class: 'card-help' }, 'Checking\u2026')),\n    ),\n    toolCard(\n      'Shell integration',\n      'Pick aliases from a list, tab-complete them, and use one in your shell so plain aws and Terraform work without hop.',\n      'cloudhop shell install',\n      `cloudhop use ${sample}`,\n      'hop',\n    ),\n    toolCard(\n      'Run in many accounts',\n      'Run one command in many aliases at once: names, lists, wildcards or /regex/. It asks before running.',\n      `cloudhop each '${sample.split('-')[0]}-*' -- s3 ls`,\n    ),\n    toolCard(\n      'Share with your team',\n      'Export your portals and aliases (no secrets) and let teammates import them in one command.',\n      'cloudhop team export --out team.yaml',\n      'cloudhop team import team.yaml',\n    ),\n  ];\n}\n\nasync function loadTools() {\n  const card = document.querySelector('#tools-cli .card-body');\n  if (!card) return;\n  try {\n    const entries = await api('GET', '/api/doctor');\n    card.replaceChildren(\n      ...entries.map((e) =>\n        h(\n          'div',\n          { class: 'tool-row' },\n          h('span', { class: `badge ${e.installed && !e.outdated ? 'valid' : 'expired'}` }, e.cli),\n          h(\n            'span',\n            {},\n            !e.installed\n              ? 'Not installed.'\n              : e.outdated\n                ? `${e.version} is older than ${e.minVersion}.`\n                : `Version ${e.version}.`,\n          ),\n          e.installed && !e.outdated ? null : snippet('cloudhop doctor'),\n        ),\n      ),\n    );\n  } catch (error) {\n    card.replaceChildren(h('p', { class: 'card-help' }, error.message));\n  }\n}\n\n// ---------- AI assistants ----------\n\nlet assistantScope = 'user';\ntry {\n  assistantScope =\n    localStorage.getItem('cloudhop-assistant-scope') === 'project' ? 'project' : 'user';\n} catch {}\nlet assistantsData;\n\nconst SKILL_TEXT = {\n  current: ['valid', 'Up to date'],\n  outdated: ['refreshable', 'Outdated'],\n  modified: ['refreshable', 'Edited by you'],\n  missing: ['', 'Not installed'],\n};\nconst MCP_TEXT = { registered: 'On', missing: 'Off', unknown: 'Check in the app' };\n\nfunction assistantsCard() {\n  return h('section', { class: 'card', id: 'assistants', hidden: true });\n}\n\nasync function loadAssistants() {\n  try {\n    assistantsData = await api('GET', '/api/assistants');\n    renderAssistants();\n  } catch {\n    document.getElementById('assistants')?.remove();\n  }\n}\n\nfunction setAssistantScope(scope) {\n  assistantScope = scope;\n  try {\n    localStorage.setItem('cloudhop-assistant-scope', scope);\n  } catch {}\n  renderAssistants();\n}\n\nfunction assistantAction(label, run, { danger = false, confirmText } = {}) {\n  return h(\n    'button',\n    {\n      class: danger ? 'danger' : undefined,\n      onclick: (e) => {\n        if (confirmText && !confirm(confirmText)) return;\n        busy(e.currentTarget, async () => {\n          try {\n            await run();\n          } catch (error) {\n            fail(error);\n          }\n          await loadAssistants();\n        });\n      },\n    },\n    label,\n  );\n}\n\nfunction reportInstall(results) {\n  for (const r of results) {\n    if (r.mcp === 'manual') {\n      toast(`${r.name}: skill installed. Add the MCP server by hand.`, { hint: r.mcpManual });\n    } else {\n      toast(`${r.name} now knows cloudhop. Start a new chat so it picks it up.`);\n    }\n  }\n}\n\nfunction renderAssistants() {\n  const el = document.getElementById('assistants');\n  if (!el || !assistantsData) return;\n  const rows = assistantScope === 'user' ? assistantsData.user : assistantsData.projectScope;\n  const scope = assistantScope;\n  const install = (tools) =>\n    api('POST', '/api/assistants', { tools, scope, mcp: true }).then((r) =>\n      reportInstall(r.results),\n    );\n  const missingDetected = rows\n    .filter((r) => r.detected && r.skill === 'missing')\n    .map((r) => r.assistant);\n\n  const seg = h(\n    'div',\n    { class: 'seg', role: 'group', 'aria-label': 'Where' },\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'user'), onclick: () => setAssistantScope('user') },\n      'For me',\n    ),\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'project'), onclick: () => setAssistantScope('project') },\n      'This project',\n    ),\n  );\n\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, 'AI assistants'),\n    h(\n      'span',\n      { class: 'meta' },\n      scope === 'user'\n        ? 'Installed in your home folder, for every project'\n        : assistantsData.project,\n    ),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      seg,\n      missingDetected.length > 1\n        ? assistantAction('Install for all detected', () => install(missingDetected))\n        : null,\n    ),\n  );\n\n  const table = h(\n    'table',\n    { class: 'assistants' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Assistant'),\n        h('th', {}, 'Skill'),\n        h('th', {}, 'MCP server'),\n        h('th'),\n      ),\n    ),\n    h(\n      'tbody',\n      {},\n      rows.map((r) => {\n        const [badgeClass, skillText] = SKILL_TEXT[r.skill];\n        const actions = [];\n        if (r.skill === 'missing')\n          actions.push(assistantAction('Install', () => install([r.assistant])));\n        if (r.skill === 'outdated') {\n          actions.push(\n            assistantAction('Update', () =>\n              api('POST', '/api/assistants/update', {}).then(() =>\n                toast(`${r.name}: skill updated.`),\n              ),\n            ),\n          );\n        }\n        if (r.skill === 'modified') {\n          actions.push(\n            assistantAction(\n              'Replace',\n              () =>\n                api('POST', '/api/assistants/update', { force: true }).then(() =>\n                  toast('Edited skills replaced.'),\n                ),\n              {\n                confirmText: 'Replace your edited copies with the current cloudhop skill?',\n              },\n            ),\n          );\n        }\n        if (r.skill !== 'missing' || r.mcp === 'registered') {\n          actions.push(\n            assistantAction(\n              'Remove',\n              () => api('POST', '/api/assistants/remove', { tools: [r.assistant], scope }),\n              {\n                danger: true,\n                confirmText: `Remove the cloudhop skill and MCP server from ${r.name}?`,\n              },\n            ),\n          );\n        }\n        return h(\n          'tr',\n          {},\n          h(\n            'td',\n            { class: 'alias' },\n            r.name,\n            r.detected ? null : h('small', { class: 'muted-inline' }, ' not detected'),\n          ),\n          h('td', {}, h('span', { class: `badge ${badgeClass}`, title: r.skillPath }, skillText)),\n          h('td', {}, r.skill === 'missing' && r.mcp !== 'registered' ? '' : MCP_TEXT[r.mcp]),\n          h(\n            'td',\n            { style: 'text-align:right' },\n            h('div', { class: 'actions', style: 'justify-content:flex-end' }, actions),\n          ),\n        );\n      }),\n    ),\n  );\n\n  el.replaceChildren(\n    head,\n    h(\n      'div',\n      { class: 'card-body' },\n      h(\n        'p',\n        { class: 'card-help' },\n        'Teach your AI assistant to use cloudhop: it asks you which alias to work with, runs commands with hop, and confirms before changing anything. Includes the cloudhop MCP server.',\n      ),\n      table,\n    ),\n  );\n  el.hidden = false;\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const prodCount = aliases.filter((a) => a.prod).length;\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'div',\n          { class: 'source-summary' },\n          h(\n            'span',\n            {},\n            `${aliases.length} alias(es)`,\n            prodCount ? h('span', { class: 'prod-tag' }, `${prodCount} PROD`) : null,\n          ),\n          h(\n            'button',\n            { class: 'link', onclick: () => go('aliases', { source: source.id }) },\n            'View aliases \u2192',\n          ),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  const patch = (body, message) =>\n    api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, body)\n      .then(() => message && toast(message))\n      .catch(fail)\n      .then(refresh);\n  const iconButton = (label, title, onclick, extra = {}) =>\n    h('button', { class: 'link', title, 'aria-label': title, onclick, ...extra }, label);\n\n  const actions = h(\n    'div',\n    { class: 'row-actions' },\n    h(\n      'button',\n      {\n        title: `Open the AWS console as ${alias.name}, already signed in`,\n        disabled: alias.missing,\n        onclick: (e) =>\n          busy(e.currentTarget, async () => {\n            const result = await api(\n              'POST',\n              `/api/aliases/${encodeURIComponent(alias.name)}/console`,\n              {},\n            ).catch(fail);\n            if (result) {\n              toast(\n                result.via === 'signed-in'\n                  ? `Opened the console for ${alias.name}.`\n                  : result.via === 'portal'\n                    ? `Opened ${alias.name} through the SSO portal.`\n                    : `Opened the console sign-in page for ${alias.name}.`,\n              );\n            }\n          }),\n      },\n      'Console',\n    ),\n    h(\n      'label',\n      { class: 'prod-toggle', title: 'Production: hop and AI assistants ask before any change' },\n      h('input', {\n        type: 'checkbox',\n        checked: alias.prod,\n        'aria-label': `${alias.name} is production`,\n        onchange: (e) =>\n          patch(\n            { prod: e.currentTarget.checked },\n            e.currentTarget.checked\n              ? `${alias.name} is now production.`\n              : `${alias.name} is no longer production.`,\n          ),\n      }),\n      'Prod',\n    ),\n    iconButton('\u270E', `Rename ${alias.name}`, () => {\n      const to = prompt(`New name for \"${alias.name}\"`, alias.name)?.trim();\n      if (to && to !== alias.name) patch({ name: to }, `${alias.name} is now ${to}.`);\n    }),\n    iconButton(\n      '\u2715',\n      `Remove ${alias.name}`,\n      (e) => {\n        if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n        busy(e.currentTarget, async () => {\n          await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n          await refresh();\n        });\n      },\n      { class: 'link danger-hover' },\n    ),\n  );\n\n  return h(\n    'tr',\n    { class: alias.prod ? 'prod' : undefined },\n    h(\n      'td',\n      { class: 'alias', title: `hop ${alias.name} <command>` },\n      alias.name,\n      alias.prod ? h('span', { class: 'prod-tag' }, 'PROD') : null,\n    ),\n    h('td', { class: 'muted' }, alias.source),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h('td', { style: 'text-align:right' }, actions),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  readRoute();\n  refresh();\n}\n";
+var app_default = "// cloudhop local UI. Plain DOM, no build step: served as-is by `cloudhop ui`.\n\nconst TOKEN_KEY = 'cloudhop-token';\nconst SESSION_TEXT = {\n  valid: 'Session valid',\n  refreshable: 'Renews on next use',\n  expired: 'Expired: sign in on next use',\n  unknown: 'Managed by the cloud CLI',\n};\n\n// The token arrives in the URL fragment once; keep it for this tab and clean the address bar.\nconst fromHash = new URLSearchParams(location.hash.slice(1)).get('token');\nif (fromHash) {\n  try {\n    sessionStorage.setItem(TOKEN_KEY, fromHash);\n  } catch {}\n  history.replaceState(null, '', location.pathname);\n}\nlet token = fromHash;\ntry {\n  token = token ?? sessionStorage.getItem(TOKEN_KEY);\n} catch {}\n\n// ---------- pages ----------\n\nconst PAGES = {\n  aliases: 'Aliases',\n  sources: 'Sources',\n  assistants: 'AI assistants',\n  tools: 'Tools',\n};\nlet route = 'aliases';\nconst aliasFilter = { text: '', source: '', prodOnly: false };\n\n/** `#/aliases?source=acme` \u2192 route \"aliases\", filtered by that source. */\nfunction readRoute() {\n  const match = /^#\\/([a-z]+)(?:\\?(.*))?$/.exec(location.hash);\n  // Own keys only: \"#/constructor\" must not reach Object.prototype.\n  route = match && Object.hasOwn(PAGES, match[1]) ? match[1] : 'aliases';\n  const query = new URLSearchParams(match?.[2] ?? '');\n  if (query.has('source')) aliasFilter.source = query.get('source');\n}\n\nfunction go(page, query) {\n  location.hash = `#/${page}${query ? `?${new URLSearchParams(query)}` : ''}`;\n}\n\n// A fresh link opened in this same tab carries a new token: reload to pick it up.\n// Any other fragment is a page change.\naddEventListener('hashchange', () => {\n  if (new URLSearchParams(location.hash.slice(1)).has('token')) {\n    location.reload();\n    return;\n  }\n  readRoute();\n  if (state) render();\n});\n\nconst $main = document.getElementById('main');\nconst $dialog = document.getElementById('dialog');\nconst $toasts = document.getElementById('toasts');\nconst $addSource = document.getElementById('add-source');\nconst $nav = document.getElementById('nav');\nlet state;\n\n/** Tiny element builder: h('button', { class: 'primary', onclick }, 'Save'). */\nfunction h(tag, attrs = {}, ...children) {\n  const el = document.createElement(tag);\n  for (const [key, value] of Object.entries(attrs)) {\n    if (value === undefined || value === null || value === false) continue;\n    if (key.startsWith('on')) el.addEventListener(key.slice(2), value);\n    else if (key === 'class') el.className = value;\n    else if (value === true) el.setAttribute(key, '');\n    else el.setAttribute(key, value);\n  }\n  for (const child of children.flat()) {\n    if (child === undefined || child === null || child === false) continue;\n    el.append(child instanceof Node ? child : document.createTextNode(String(child)));\n  }\n  return el;\n}\n\nclass ApiError extends Error {\n  constructor(message, hint) {\n    super(message);\n    this.hint = hint;\n  }\n}\n\n// Calls that may sign in wait for the person in the browser; everything else should answer quickly.\nconst MAY_SIGN_IN = /^\\/api\\/(sources(\\/[^/]+\\/(login|sync|targets))?|aliases\\/[^/]+\\/console)$/;\nconst QUICK_TIMEOUT_MS = 20_000;\n\nasync function api(method, path, body) {\n  const waitsForPerson = MAY_SIGN_IN.test(path);\n  let response;\n  try {\n    response = await fetch(path, {\n      method,\n      headers: {\n        'x-cloudhop-token': token ?? '',\n        ...(body ? { 'content-type': 'application/json' } : {}),\n      },\n      body: body ? JSON.stringify(body) : undefined,\n      signal: waitsForPerson ? undefined : AbortSignal.timeout(QUICK_TIMEOUT_MS),\n    });\n  } catch (error) {\n    if (error.name === 'TimeoutError') {\n      throw new ApiError(\n        'cloudhop ui is not responding.',\n        'Is it paused in your terminal (Ctrl-Z)? Run `fg` there, or stop it and run `cloudhop ui` again.',\n      );\n    }\n    throw new ApiError(\n      'cloudhop ui is not running.',\n      'Run `cloudhop ui` again and open the new link it prints.',\n    );\n  }\n  const data = await response.json().catch(() => ({}));\n  if (!response.ok)\n    throw new ApiError(data.error ?? `Request failed (${response.status}).`, data.hint);\n  return data;\n}\n\nfunction toast(message, { error = false, hint } = {}) {\n  const el = h(\n    'div',\n    { class: `toast${error ? ' error' : ''}` },\n    message,\n    hint && h('small', {}, hint),\n  );\n  $toasts.append(el);\n  setTimeout(() => el.remove(), error ? 9000 : 4000);\n}\n\nconst fail = (error) => toast(error.message, { error: true, hint: error.hint });\n\n/** Disables a button while its action runs. */\nasync function busy(button, action) {\n  button.disabled = true;\n  try {\n    return await action();\n  } finally {\n    button.disabled = false;\n  }\n}\n\nasync function refresh() {\n  try {\n    state = await api('GET', '/api/state');\n    render();\n    checkDoctor();\n  } catch (error) {\n    $main.replaceChildren(\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'Cannot reach cloudhop'),\n        h('p', {}, error.message, error.hint ? ` ${error.hint}` : ''),\n      ),\n    );\n  }\n}\n\nasync function checkDoctor() {\n  try {\n    const entries = await api('GET', '/api/doctor');\n    const problems = entries.filter((e) => !e.installed || e.outdated);\n    document.getElementById('doctor')?.remove();\n    if (problems.length === 0) return;\n    $main.prepend(\n      h(\n        'div',\n        { class: 'notice', id: 'doctor' },\n        ...problems.map((e) =>\n          h(\n            'div',\n            {},\n            e.installed\n              ? `${e.cli} ${e.version} is older than ${e.minVersion}. `\n              : `${e.cli} is not installed, so aliases cannot run commands yet. `,\n            'Run ',\n            h('code', {}, 'cloudhop doctor'),\n            ' in a terminal to install it.',\n          ),\n        ),\n      ),\n    );\n  } catch {}\n}\n\n// ---------- main view ----------\n\nfunction render() {\n  const enabled = state.enabledProviders;\n  $addSource.hidden = enabled.length === 0;\n  $nav.hidden = enabled.length === 0;\n  if (enabled.length === 0) return renderChooseClouds();\n  for (const link of $nav.querySelectorAll('a')) {\n    if (link.dataset.page === route) link.setAttribute('aria-current', 'page');\n    else link.removeAttribute('aria-current');\n  }\n  document.title = `${PAGES[route]} \xB7 cloudhop`;\n  const pages = new Map([\n    ['aliases', aliasesPage],\n    ['sources', sourcesPage],\n    ['assistants', assistantsPage],\n    ['tools', toolsPage],\n  ]);\n  const page = pages.get(route) ?? aliasesPage;\n  $main.replaceChildren(...page());\n  if (route === 'assistants') loadAssistants();\n  if (route === 'tools') loadTools();\n}\n\nfunction pageHead(title, subtitle, ...actions) {\n  return h(\n    'div',\n    { class: 'page-head' },\n    h('div', {}, h('h1', {}, title), subtitle ? h('p', {}, subtitle) : null),\n    h('div', { class: 'actions' }, actions),\n  );\n}\n\nfunction firstSourceHero() {\n  return h(\n    'div',\n    { class: 'hero' },\n    h('h2', {}, 'Add your first account'),\n    h(\n      'p',\n      {},\n      'Add a company SSO portal or a personal account. cloudhop signs you in, finds every account and role you can use, and lets you give each one a short alias.',\n    ),\n    h('button', { class: 'primary', onclick: () => openAddSource() }, '+ Add source'),\n  );\n}\n\n// ---------- Aliases page ----------\n\nfunction aliasesPage() {\n  if (state.sources.length === 0) return [firstSourceHero()];\n  if (aliasFilter.source && !state.sources.some((s) => s.id === aliasFilter.source))\n    aliasFilter.source = '';\n\n  const addAliases = () => {\n    const source =\n      state.sources.find((s) => s.id === aliasFilter.source) ??\n      (state.sources.length === 1 ? state.sources[0] : undefined);\n    if (source) openAliasPicker(source);\n    else openSourceChooser();\n  };\n  const head = pageHead(\n    'Aliases',\n    'Each alias is one account, role and region. Run it with hop <alias>.',\n    h('button', { onclick: addAliases }, '+ Aliases'),\n  );\n  if (state.aliases.length === 0) {\n    return [\n      head,\n      h(\n        'div',\n        { class: 'hero' },\n        h('h2', {}, 'No aliases yet'),\n        h('p', {}, 'Pick the accounts and roles you use and give each one a short name.'),\n        h('button', { class: 'primary', onclick: addAliases }, 'Pick accounts'),\n      ),\n    ];\n  }\n\n  const rows = h('tbody', { id: 'alias-rows' });\n  const count = h('span', { class: 'count' });\n  const fill = () => {\n    const words = aliasFilter.text.toLowerCase().split(/\\s+/).filter(Boolean);\n    const visible = state.aliases.filter((a) => {\n      if (aliasFilter.source && a.source !== aliasFilter.source) return false;\n      if (aliasFilter.prodOnly && !a.prod) return false;\n      const text = `${a.name} ${a.label ?? a.target} ${a.region ?? ''} ${a.source}`.toLowerCase();\n      return words.every((w) => text.includes(w));\n    });\n    rows.replaceChildren(\n      ...(visible.length\n        ? visible.map(aliasRow)\n        : [\n            h(\n              'tr',\n              {},\n              h('td', { colspan: '5', class: 'empty' }, 'No alias matches these filters.'),\n            ),\n          ]),\n    );\n    count.textContent = `${visible.length} of ${state.aliases.length}`;\n  };\n\n  const search = h('input', {\n    type: 'search',\n    placeholder: 'Filter: name, account, role or region',\n    value: aliasFilter.text,\n    'aria-label': 'Filter aliases',\n    oninput: (e) => {\n      aliasFilter.text = e.currentTarget.value;\n      fill();\n    },\n  });\n  const sourceSelect = h(\n    'select',\n    {\n      'aria-label': 'Source',\n      onchange: (e) => {\n        aliasFilter.source = e.currentTarget.value;\n        fill();\n      },\n    },\n    h('option', { value: '' }, 'All sources'),\n    state.sources.map((s) =>\n      h('option', { value: s.id, selected: s.id === aliasFilter.source }, s.id),\n    ),\n  );\n  const prodOnly = h(\n    'label',\n    { class: 'prod-toggle' },\n    h('input', {\n      type: 'checkbox',\n      checked: aliasFilter.prodOnly,\n      onchange: (e) => {\n        aliasFilter.prodOnly = e.currentTarget.checked;\n        fill();\n      },\n    }),\n    'Production only',\n  );\n\n  const table = h(\n    'table',\n    { class: 'aliases' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Alias'),\n        h('th', {}, 'Source'),\n        h('th', {}, 'Region'),\n        h('th', {}, 'Account / role'),\n        h('th'),\n      ),\n    ),\n    rows,\n  );\n  fill();\n  return [\n    head,\n    h(\n      'div',\n      { class: 'toolbar' },\n      search,\n      sourceSelect,\n      prodOnly,\n      h('div', { class: 'spacer' }),\n      count,\n    ),\n    h('section', { class: 'card' }, table),\n  ];\n}\n\n/** When several sources exist, ask which one to pick accounts from. */\nfunction openSourceChooser() {\n  showDialog(\n    'Add aliases from',\n    h(\n      'div',\n      { class: 'choices' },\n      state.sources.map((source) =>\n        h(\n          'button',\n          { class: 'choice', onclick: () => openAliasPicker(source) },\n          h(\n            'span',\n            {},\n            h('strong', {}, source.id),\n            h('small', {}, source.settings.startUrl ?? source.kindLabel),\n          ),\n        ),\n      ),\n    ),\n  );\n}\n\n// ---------- Sources page ----------\n\nfunction sourcesPage() {\n  const head = pageHead('Sources', 'The SSO portals and personal accounts you sign in to.');\n  if (state.sources.length === 0) return [head, firstSourceHero()];\n  return [head, ...state.sources.map(sourceCard)];\n}\n\n// ---------- AI assistants page ----------\n\nfunction assistantsPage() {\n  return [assistantsCard()];\n}\n\n// ---------- Tools page ----------\n\nfunction snippet(command) {\n  return h(\n    'div',\n    { class: 'snippet' },\n    h('code', {}, command),\n    h(\n      'button',\n      {\n        class: 'link',\n        title: 'Copy',\n        'aria-label': `Copy ${command}`,\n        onclick: () =>\n          navigator.clipboard\n            ?.writeText(command)\n            .then(() => toast('Copied.'))\n            .catch(() =>\n              toast('Copy it by hand: the browser blocked the clipboard.', { error: true }),\n            ),\n      },\n      'Copy',\n    ),\n  );\n}\n\nfunction toolCard(title, text, ...commands) {\n  return h(\n    'section',\n    { class: 'card' },\n    h('div', { class: 'card-head' }, h('h2', {}, title)),\n    h(\n      'div',\n      { class: 'card-body padded' },\n      h('p', { class: 'card-help' }, text),\n      commands.map(snippet),\n    ),\n  );\n}\n\nfunction toolsPage() {\n  const sample = state.aliases[0]?.name ?? 'acme-dev';\n  return [\n    pageHead('Tools', 'More ways to use cloudhop from your terminal.'),\n    h(\n      'section',\n      { class: 'card', id: 'tools-cli' },\n      h('div', { class: 'card-head' }, h('h2', {}, 'Cloud CLIs')),\n      h('div', { class: 'card-body padded' }, h('p', { class: 'card-help' }, 'Checking\u2026')),\n    ),\n    toolCard(\n      'Shell integration',\n      'Pick aliases from a list, tab-complete them, and use one in your shell so plain aws and Terraform work without hop.',\n      'cloudhop shell install',\n      `cloudhop use ${sample}`,\n      'hop',\n    ),\n    toolCard(\n      'Run in many accounts',\n      'Run one command in many aliases at once: names, lists, wildcards or /regex/. It asks before running.',\n      `cloudhop each '${sample.split('-')[0]}-*' -- s3 ls`,\n    ),\n    toolCard(\n      'Share with your team',\n      'Export your portals and aliases (no secrets) and let teammates import them in one command.',\n      'cloudhop team export --out team.yaml',\n      'cloudhop team import team.yaml',\n    ),\n  ];\n}\n\nasync function loadTools() {\n  const card = document.querySelector('#tools-cli .card-body');\n  if (!card) return;\n  try {\n    const entries = await api('GET', '/api/doctor');\n    card.replaceChildren(\n      ...entries.map((e) =>\n        h(\n          'div',\n          { class: 'tool-row' },\n          h('span', { class: `badge ${e.installed && !e.outdated ? 'valid' : 'expired'}` }, e.cli),\n          h(\n            'span',\n            {},\n            !e.installed\n              ? 'Not installed.'\n              : e.outdated\n                ? `${e.version} is older than ${e.minVersion}.`\n                : `Version ${e.version}.`,\n          ),\n          e.installed && !e.outdated ? null : snippet('cloudhop doctor'),\n        ),\n      ),\n    );\n  } catch (error) {\n    card.replaceChildren(h('p', { class: 'card-help' }, error.message));\n  }\n}\n\n// ---------- AI assistants ----------\n\nlet assistantScope = 'user';\ntry {\n  assistantScope =\n    localStorage.getItem('cloudhop-assistant-scope') === 'project' ? 'project' : 'user';\n} catch {}\nlet assistantsData;\n\nconst SKILL_TEXT = {\n  current: ['valid', 'Up to date'],\n  outdated: ['refreshable', 'Outdated'],\n  modified: ['refreshable', 'Edited by you'],\n  missing: ['', 'Not installed'],\n};\nconst MCP_TEXT = { registered: 'On', missing: 'Off', unknown: 'Check in the app' };\n\nfunction assistantsCard() {\n  return h('section', { class: 'card', id: 'assistants', hidden: true });\n}\n\nasync function loadAssistants() {\n  try {\n    assistantsData = await api('GET', '/api/assistants');\n    renderAssistants();\n  } catch {\n    document.getElementById('assistants')?.remove();\n  }\n}\n\nfunction setAssistantScope(scope) {\n  assistantScope = scope;\n  try {\n    localStorage.setItem('cloudhop-assistant-scope', scope);\n  } catch {}\n  renderAssistants();\n}\n\nfunction assistantAction(label, run, { danger = false, confirmText } = {}) {\n  return h(\n    'button',\n    {\n      class: danger ? 'danger' : undefined,\n      onclick: (e) => {\n        if (confirmText && !confirm(confirmText)) return;\n        busy(e.currentTarget, async () => {\n          try {\n            await run();\n          } catch (error) {\n            fail(error);\n          }\n          await loadAssistants();\n        });\n      },\n    },\n    label,\n  );\n}\n\nfunction reportInstall(results) {\n  for (const r of results) {\n    if (r.mcp === 'manual') {\n      toast(`${r.name}: skill installed. Add the MCP server by hand.`, { hint: r.mcpManual });\n    } else {\n      toast(`${r.name} now knows cloudhop. Start a new chat so it picks it up.`);\n    }\n  }\n}\n\nfunction renderAssistants() {\n  const el = document.getElementById('assistants');\n  if (!el || !assistantsData) return;\n  const rows = assistantScope === 'user' ? assistantsData.user : assistantsData.projectScope;\n  const scope = assistantScope;\n  const install = (tools) =>\n    api('POST', '/api/assistants', { tools, scope, mcp: true }).then((r) =>\n      reportInstall(r.results),\n    );\n  const missingDetected = rows\n    .filter((r) => r.detected && r.skill === 'missing')\n    .map((r) => r.assistant);\n\n  const seg = h(\n    'div',\n    { class: 'seg', role: 'group', 'aria-label': 'Where' },\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'user'), onclick: () => setAssistantScope('user') },\n      'For me',\n    ),\n    h(\n      'button',\n      { 'aria-pressed': String(scope === 'project'), onclick: () => setAssistantScope('project') },\n      'This project',\n    ),\n  );\n\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, 'AI assistants'),\n    h(\n      'span',\n      { class: 'meta' },\n      scope === 'user'\n        ? 'Installed in your home folder, for every project'\n        : assistantsData.project,\n    ),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      seg,\n      missingDetected.length > 1\n        ? assistantAction('Install for all detected', () => install(missingDetected))\n        : null,\n    ),\n  );\n\n  const table = h(\n    'table',\n    { class: 'assistants' },\n    h(\n      'thead',\n      {},\n      h(\n        'tr',\n        {},\n        h('th', {}, 'Assistant'),\n        h('th', {}, 'Skill'),\n        h('th', {}, 'MCP server'),\n        h('th'),\n      ),\n    ),\n    h(\n      'tbody',\n      {},\n      rows.map((r) => {\n        const [badgeClass, skillText] = SKILL_TEXT[r.skill];\n        const actions = [];\n        if (r.skill === 'missing')\n          actions.push(assistantAction('Install', () => install([r.assistant])));\n        if (r.skill === 'outdated') {\n          actions.push(\n            assistantAction('Update', () =>\n              api('POST', '/api/assistants/update', {}).then(() =>\n                toast(`${r.name}: skill updated.`),\n              ),\n            ),\n          );\n        }\n        if (r.skill === 'modified') {\n          actions.push(\n            assistantAction(\n              'Replace',\n              () =>\n                api('POST', '/api/assistants/update', { force: true }).then(() =>\n                  toast('Edited skills replaced.'),\n                ),\n              {\n                confirmText: 'Replace your edited copies with the current cloudhop skill?',\n              },\n            ),\n          );\n        }\n        if (r.skill !== 'missing' || r.mcp === 'registered') {\n          actions.push(\n            assistantAction(\n              'Remove',\n              () => api('POST', '/api/assistants/remove', { tools: [r.assistant], scope }),\n              {\n                danger: true,\n                confirmText: `Remove the cloudhop skill and MCP server from ${r.name}?`,\n              },\n            ),\n          );\n        }\n        return h(\n          'tr',\n          {},\n          h(\n            'td',\n            { class: 'alias' },\n            r.name,\n            r.detected ? null : h('small', { class: 'muted-inline' }, ' not detected'),\n          ),\n          h('td', {}, h('span', { class: `badge ${badgeClass}`, title: r.skillPath }, skillText)),\n          h('td', {}, r.skill === 'missing' && r.mcp !== 'registered' ? '' : MCP_TEXT[r.mcp]),\n          h(\n            'td',\n            { style: 'text-align:right' },\n            h('div', { class: 'actions', style: 'justify-content:flex-end' }, actions),\n          ),\n        );\n      }),\n    ),\n  );\n\n  el.replaceChildren(\n    head,\n    h(\n      'div',\n      { class: 'card-body' },\n      h(\n        'p',\n        { class: 'card-help' },\n        'Teach your AI assistant to use cloudhop: it asks you which alias to work with, runs commands with hop, and confirms before changing anything. Includes the cloudhop MCP server.',\n      ),\n      table,\n    ),\n  );\n  el.hidden = false;\n}\n\nfunction renderChooseClouds() {\n  const boxes = state.providers.map((p) =>\n    h(\n      'label',\n      { class: 'choice' },\n      h('input', { type: 'checkbox', value: p.id, checked: true }),\n      h('span', {}, p.name),\n    ),\n  );\n  const save = h(\n    'button',\n    {\n      class: 'primary',\n      onclick: (e) =>\n        busy(e.currentTarget, async () => {\n          const ids = boxes\n            .map((b) => b.querySelector('input'))\n            .filter((i) => i.checked)\n            .map((i) => i.value);\n          await api('PUT', '/api/providers', { enabled: ids }).catch(fail);\n          await refresh();\n        }),\n    },\n    'Continue',\n  );\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Which clouds do you use?'),\n      h('p', {}, 'Azure and Google Cloud are coming soon.'),\n      h(\n        'div',\n        { class: 'choices', style: 'max-width:320px;margin:0 auto 16px;text-align:left' },\n        boxes,\n      ),\n      save,\n    ),\n  );\n}\n\nfunction sourceCard(source) {\n  const aliases = state.aliases.filter((a) => a.source === source.id);\n  const where = source.settings.startUrl ?? source.kindLabel;\n  const head = h(\n    'div',\n    { class: 'card-head' },\n    h('h2', {}, source.id),\n    h('span', { class: `badge ${source.session}` }, SESSION_TEXT[source.session] ?? source.session),\n    h('span', { class: 'meta' }, `${source.providerName} \xB7 ${where}`),\n    h('div', { class: 'spacer' }),\n    h(\n      'div',\n      { class: 'actions' },\n      h('button', { onclick: () => openAliasPicker(source) }, '+ Aliases'),\n      h(\n        'button',\n        {\n          title: 'Sign in again and refresh its accounts',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              toast('Opening the browser to sign in\u2026');\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/login`,\n              ).catch(fail);\n              if (report)\n                toast(`${source.id}: signed in, ${report.targets.length} account/role(s).`);\n              await refresh();\n            }),\n        },\n        'Sign in',\n      ),\n      h(\n        'button',\n        {\n          title: 'Refresh the accounts and roles you have access to',\n          onclick: (e) =>\n            busy(e.currentTarget, async () => {\n              const report = await api(\n                'POST',\n                `/api/sources/${encodeURIComponent(source.id)}/sync`,\n              ).catch(fail);\n              if (report) toast(syncMessage(source.id, report));\n              await refresh();\n            }),\n        },\n        'Sync',\n      ),\n      h(\n        'button',\n        {\n          class: 'danger',\n          onclick: (e) => {\n            const count = aliases.length;\n            const message = `Remove \"${source.id}\"${count ? ` and its ${count} alias(es)` : ''}?`;\n            if (!confirm(message)) return;\n            busy(e.currentTarget, async () => {\n              await api('DELETE', `/api/sources/${encodeURIComponent(source.id)}`).catch(fail);\n              await refresh();\n            });\n          },\n        },\n        'Remove',\n      ),\n    ),\n  );\n\n  const prodCount = aliases.filter((a) => a.prod).length;\n  const body =\n    aliases.length === 0\n      ? h(\n          'div',\n          { class: 'empty' },\n          'No aliases yet. ',\n          h(\n            'button',\n            { class: 'primary', onclick: () => openAliasPicker(source) },\n            'Pick accounts',\n          ),\n        )\n      : h(\n          'div',\n          { class: 'source-summary' },\n          h(\n            'span',\n            {},\n            `${aliases.length} alias(es)`,\n            prodCount ? h('span', { class: 'prod-tag' }, `${prodCount} PROD`) : null,\n          ),\n          h(\n            'button',\n            { class: 'link', onclick: () => go('aliases', { source: source.id }) },\n            'View aliases \u2192',\n          ),\n        );\n  return h('section', { class: 'card' }, head, h('div', { class: 'card-body' }, body));\n}\n\nfunction syncMessage(id, report) {\n  const parts = [`${report.targets.length} available`];\n  if (report.added) parts.push(`${report.added} new`);\n  if (report.removed) parts.push(`${report.removed} removed`);\n  const orphaned = report.orphanedAliases.length\n    ? ` No longer available: ${report.orphanedAliases.join(', ')}.`\n    : '';\n  return `${id}: ${parts.join(', ')}.${orphaned}`;\n}\n\nfunction aliasRow(alias) {\n  const input = h('input', {\n    value: alias.region ?? '',\n    'aria-label': `Region for ${alias.name}`,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  const save = h('button', { hidden: true }, 'Save');\n  const commit = () =>\n    busy(save, async () => {\n      const region = input.value.trim();\n      const done = await api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, {\n        region,\n      }).catch(fail);\n      if (done) toast(`${alias.name} now runs in ${region}.`);\n      await refresh();\n    });\n  input.addEventListener('input', () => {\n    save.hidden = input.value.trim() === (alias.region ?? '');\n  });\n  input.addEventListener('keydown', (e) => {\n    if (e.key === 'Enter' && !save.hidden) commit();\n    if (e.key === 'Escape') {\n      input.value = alias.region ?? '';\n      save.hidden = true;\n    }\n  });\n  save.addEventListener('click', commit);\n\n  const patch = (body, message) =>\n    api('PATCH', `/api/aliases/${encodeURIComponent(alias.name)}`, body)\n      .then(() => message && toast(message))\n      .catch(fail)\n      .then(refresh);\n  const iconButton = (label, title, onclick, extra = {}) =>\n    h('button', { class: 'link', title, 'aria-label': title, onclick, ...extra }, label);\n\n  const actions = h(\n    'div',\n    { class: 'row-actions' },\n    h(\n      'button',\n      {\n        title: `Open the AWS console as ${alias.name}, already signed in`,\n        disabled: alias.missing,\n        onclick: (e) =>\n          busy(e.currentTarget, async () => {\n            const result = await api(\n              'POST',\n              `/api/aliases/${encodeURIComponent(alias.name)}/console`,\n              {},\n            ).catch(fail);\n            if (result) {\n              toast(\n                result.via === 'signed-in'\n                  ? `Opened the console for ${alias.name}.`\n                  : result.via === 'portal'\n                    ? `Opened ${alias.name} through the SSO portal.`\n                    : `Opened the console sign-in page for ${alias.name}.`,\n              );\n            }\n          }),\n      },\n      'Console',\n    ),\n    h(\n      'label',\n      { class: 'prod-toggle', title: 'Production: hop and AI assistants ask before any change' },\n      h('input', {\n        type: 'checkbox',\n        checked: alias.prod,\n        'aria-label': `${alias.name} is production`,\n        onchange: (e) =>\n          patch(\n            { prod: e.currentTarget.checked },\n            e.currentTarget.checked\n              ? `${alias.name} is now production.`\n              : `${alias.name} is no longer production.`,\n          ),\n      }),\n      'Prod',\n    ),\n    h(\n      'label',\n      {\n        class: 'prod-toggle',\n        title: 'New terminals start with this alias (only one per cloud)',\n      },\n      h('input', {\n        type: 'checkbox',\n        checked: alias.default,\n        'aria-label': `New terminals start with ${alias.name}`,\n        onchange: (e) => {\n          const on = e.currentTarget.checked;\n          if (\n            on &&\n            alias.prod &&\n            !confirm(`${alias.name} is production. Start every new terminal in it?`)\n          ) {\n            e.currentTarget.checked = false;\n            return;\n          }\n          patch(\n            { default: on },\n            on\n              ? `New terminals start with ${alias.name}. Open a new one to see it.`\n              : `New terminals no longer start with ${alias.name}.`,\n          );\n        },\n      }),\n      'Default',\n    ),\n    iconButton('\u270E', `Rename ${alias.name}`, () => {\n      const to = prompt(`New name for \"${alias.name}\"`, alias.name)?.trim();\n      if (to && to !== alias.name) patch({ name: to }, `${alias.name} is now ${to}.`);\n    }),\n    iconButton(\n      '\u2715',\n      `Remove ${alias.name}`,\n      (e) => {\n        if (!confirm(`Remove alias \"${alias.name}\"?`)) return;\n        busy(e.currentTarget, async () => {\n          await api('DELETE', `/api/aliases/${encodeURIComponent(alias.name)}`).catch(fail);\n          await refresh();\n        });\n      },\n      { class: 'link danger-hover' },\n    ),\n  );\n\n  return h(\n    'tr',\n    { class: alias.prod ? 'prod' : undefined },\n    h(\n      'td',\n      { class: 'alias', title: `hop ${alias.name} <command>` },\n      alias.name,\n      alias.prod ? h('span', { class: 'prod-tag' }, 'PROD') : null,\n      alias.default\n        ? h(\n            'span',\n            { class: 'default-tag', title: 'New terminals start with this alias' },\n            'DEFAULT',\n          )\n        : null,\n    ),\n    h('td', { class: 'muted' }, alias.source),\n    h('td', {}, h('div', { class: 'region' }, input, save)),\n    h(\n      'td',\n      {},\n      alias.missing\n        ? h('span', { class: 'missing' }, `${alias.target} (no longer available)`)\n        : alias.label,\n    ),\n    h('td', { style: 'text-align:right' }, actions),\n  );\n}\n\n// ---------- dialogs ----------\n\nfunction showDialog(title, body, footer) {\n  $dialog.replaceChildren(\n    h(\n      'div',\n      { class: 'dlg-head' },\n      h('h2', {}, title),\n      h('button', { class: 'link', 'aria-label': 'Close', onclick: () => $dialog.close() }, '\u2715'),\n    ),\n    h('div', { class: 'dlg-body' }, body),\n    footer ? h('div', { class: 'dlg-foot' }, footer) : null,\n  );\n  if (!$dialog.open) $dialog.showModal();\n}\n\nfunction suggestSourceId(settings, kind) {\n  const host = /^https:\\/\\/([^./]+)\\./.exec(settings.startUrl ?? '')?.[1];\n  return slug(host ?? (kind === 'console-login' ? 'personal' : 'main'));\n}\n\nconst slug = (text) =>\n  text\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 63) || 'main';\n\n/** `previous` refills the form after a failed sign-in: { provider, kind, id, settings, error }. */\nfunction openAddSource(previous) {\n  const providers = state.providers.filter((p) => state.enabledProviders.includes(p.id));\n  let provider = providers.find((p) => p.id === previous?.provider) ?? providers[0];\n  let kind = provider.kinds.find((k) => k.kind === previous?.kind) ?? provider.kinds[0];\n\n  const form = h('form', { onsubmit: (e) => e.preventDefault() });\n  const nameInput = h('input', {\n    id: 'f-name',\n    required: true,\n    class: 'mono',\n    spellcheck: 'false',\n  });\n  let nameTouched = Boolean(previous);\n  nameInput.addEventListener('input', () => {\n    nameTouched = true;\n  });\n\n  const fieldInputs = {};\n  const fieldsBox = h('div');\n  const nameLabel = h('label', { for: 'f-name' });\n\n  function updateSuggestion() {\n    if (nameTouched) return;\n    const settings = Object.fromEntries(\n      Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n    );\n    const taken = new Set(state.sources.map((s) => s.id));\n    let id = suggestSourceId(settings, kind.kind);\n    for (let i = 2; taken.has(id); i++) id = `${suggestSourceId(settings, kind.kind)}-${i}`;\n    nameInput.value = id;\n  }\n\n  function renderFields() {\n    for (const key of Object.keys(fieldInputs)) delete fieldInputs[key];\n    fieldsBox.replaceChildren(\n      ...kind.fields.map((f) => {\n        const input = h('input', {\n          id: `f-${f.key}`,\n          placeholder: f.placeholder ?? f.defaultValue ?? '',\n          value: previous?.settings?.[f.key] ?? f.defaultValue ?? '',\n          required: true,\n          class: 'mono',\n          spellcheck: 'false',\n          oninput: updateSuggestion,\n        });\n        fieldInputs[f.key] = input;\n        return h('div', { class: 'field' }, h('label', { for: input.id }, f.label), input);\n      }),\n    );\n    nameLabel.textContent = kind.nameLabel ?? 'Short name for this source';\n    updateSuggestion();\n  }\n\n  const providerSelect =\n    providers.length > 1\n      ? h(\n          'div',\n          { class: 'field' },\n          h('label', { for: 'f-provider' }, 'Cloud'),\n          h(\n            'select',\n            {\n              id: 'f-provider',\n              onchange: (e) => {\n                provider = providers.find((p) => p.id === e.target.value);\n                kind = provider.kinds[0];\n                renderKinds();\n              },\n            },\n            providers.map((p) => h('option', { value: p.id, selected: p === provider }, p.name)),\n          ),\n        )\n      : null;\n\n  const kindsBox = h('div', { class: 'choices' });\n  function renderKinds() {\n    kindsBox.replaceChildren(\n      ...provider.kinds.map((k) =>\n        h(\n          'label',\n          { class: 'choice' },\n          h('input', {\n            type: 'radio',\n            name: 'kind',\n            value: k.kind,\n            checked: k === kind,\n            onchange: () => {\n              kind = k;\n              renderFields();\n            },\n          }),\n          h('span', {}, h('strong', {}, k.label), k.hint ? h('small', {}, k.hint) : null),\n        ),\n      ),\n    );\n    renderFields();\n  }\n\n  form.append(\n    previous?.error\n      ? h(\n          'div',\n          { class: 'notice error' },\n          h('strong', {}, 'Could not sign in, so nothing was saved. '),\n          previous.error.message,\n          previous.error.hint ? h('div', { class: 'help' }, previous.error.hint) : null,\n        )\n      : '',\n    providerSelect ?? '',\n    h('div', { class: 'field' }, h('label', {}, 'What do you want to add?')),\n    kindsBox,\n    fieldsBox,\n    h(\n      'div',\n      { class: 'field' },\n      nameLabel,\n      nameInput,\n      h(\n        'span',\n        { class: 'help' },\n        'Lowercase letters, numbers and dashes. You will see it in ',\n        h('code', {}, 'cloudhop ls'),\n        '.',\n      ),\n    ),\n  );\n  renderKinds();\n  if (previous) nameInput.value = previous.id;\n\n  const submit = h('button', { class: 'primary', type: 'submit' }, 'Add and sign in');\n  form.addEventListener('submit', async () => {\n    if (!form.reportValidity()) return;\n    const body = {\n      provider: provider.id,\n      kind: kind.kind,\n      id: nameInput.value.trim(),\n      settings: Object.fromEntries(\n        Object.entries(fieldInputs).map(([k, i]) => [k, i.value.trim()]),\n      ),\n    };\n    showDialog(\n      'Sign in',\n      h(\n        'div',\n        { class: 'waiting' },\n        h('div', { class: 'spinner' }),\n        h('strong', {}, 'Finish signing in in the browser tab that just opened.'),\n        h('p', { class: 'help' }, 'This page continues on its own once you approve the request.'),\n      ),\n    );\n    try {\n      const report = await api('POST', '/api/sources', body);\n      await refresh();\n      const source = state.sources.find((s) => s.id === body.id);\n      toast(`Signed in to ${body.id}. ${report.targets.length} account/role(s) found.`);\n      openAliasPicker(source, report.targets);\n    } catch (error) {\n      // Nothing was saved: reopen the form with what was typed so it can be fixed.\n      await refresh();\n      openAddSource({ ...body, error });\n    }\n  });\n\n  showDialog('Add source', form, [\n    h('button', { type: 'button', onclick: () => $dialog.close() }, 'Cancel'),\n    submit,\n  ]);\n  submit.setAttribute('form', 'add-form');\n  form.id = 'add-form';\n}\n\nasync function openAliasPicker(source, preloaded) {\n  let targets = preloaded;\n  if (!targets) {\n    showDialog(\n      `Aliases for ${source.id}`,\n      h('div', { class: 'waiting' }, h('div', { class: 'spinner' }), 'Loading accounts\u2026'),\n    );\n    try {\n      targets = (await api('GET', `/api/sources/${encodeURIComponent(source.id)}/targets`)).targets;\n    } catch (error) {\n      $dialog.close();\n      return fail(error);\n    }\n  }\n\n  const used = new Map(\n    state.aliases.filter((a) => a.source === source.id).map((a) => [a.target, a.name]),\n  );\n  const taken = new Set(state.aliases.map((a) => a.name));\n  const defaultRegion = source.settings.region ?? '';\n  const filter = h('input', {\n    type: 'search',\n    placeholder: `Filter ${targets.length} account/role(s)\u2026`,\n    style: 'width:100%;margin-bottom:12px',\n  });\n\n  const rows = targets.map((t) => {\n    const existing = used.get(t.id);\n    let name = t.suggestedAlias;\n    for (let i = 2; taken.has(name); i++) name = `${t.suggestedAlias}-${i}`;\n    const check = h('input', {\n      type: 'checkbox',\n      disabled: Boolean(existing),\n      'aria-label': t.label,\n    });\n    const aliasInput = h('input', {\n      value: name,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Alias for ${t.label}`,\n      placeholder: 'alias',\n    });\n    const regionInput = h('input', {\n      value: defaultRegion,\n      class: 'mono',\n      spellcheck: 'false',\n      'aria-label': `Region for ${t.label}`,\n      placeholder: 'region',\n    });\n    // Only the checkbox and its text sit in the label, so clicking the inputs never toggles it.\n    const el = h(\n      'div',\n      { class: 'target' },\n      h(\n        'label',\n        { class: 'pick' },\n        check,\n        h(\n          'span',\n          {},\n          t.label,\n          existing ? h('small', { class: 'already' }, `Already: ${existing}`) : null,\n        ),\n      ),\n      h('div', { class: 'inputs' }, aliasInput, regionInput),\n    );\n    return { target: t, el, check, aliasInput, regionInput };\n  });\n\n  filter.addEventListener('input', () => {\n    const q = filter.value.trim().toLowerCase();\n    for (const row of rows) row.el.hidden = q !== '' && !row.target.label.toLowerCase().includes(q);\n  });\n\n  const save = h('button', { class: 'primary' }, 'Create aliases');\n  save.addEventListener('click', () =>\n    busy(save, async () => {\n      const aliases = rows\n        .filter((r) => r.check.checked)\n        .map((r) => ({\n          source: source.id,\n          target: r.target.id,\n          name: r.aliasInput.value.trim(),\n          region: r.regionInput.value.trim(),\n        }));\n      if (aliases.length === 0) return toast('Pick at least one account/role.', { error: true });\n      try {\n        const result = await api('POST', '/api/aliases', { aliases });\n        $dialog.close();\n        toast(`Created ${result.created.join(', ')}. Try: hop ${result.created[0]}`);\n        await refresh();\n      } catch (error) {\n        fail(error);\n      }\n    }),\n  );\n\n  const body =\n    targets.length === 0\n      ? h('p', { class: 'empty' }, 'This source has no accounts or roles assigned to you.')\n      : h(\n          'div',\n          {},\n          filter,\n          h(\n            'div',\n            { class: 'targets' },\n            rows.map((r) => r.el),\n          ),\n        );\n  showDialog(`Aliases for ${source.id}`, body, [\n    h('span', { class: 'note' }, 'Check an account/role, then name its alias and region.'),\n    h('button', { onclick: () => $dialog.close() }, 'Cancel'),\n    targets.length ? save : null,\n  ]);\n}\n\n$addSource.addEventListener('click', () => openAddSource());\n\nif (!token) {\n  $main.replaceChildren(\n    h(\n      'div',\n      { class: 'hero' },\n      h('h2', {}, 'Open the link from your terminal'),\n      h('p', {}, 'Run cloudhop ui and open the link it prints. It includes a one-time access key.'),\n    ),\n  );\n} else {\n  readRoute();\n  refresh();\n}\n";
 
 // ../ui/src/assets/index.html
 var assets_default = `<!doctype html>
@@ -13745,6 +14549,7 @@ var assets_default = `<!doctype html>
       .row-actions { display: flex; gap: 6px; align-items: center; justify-content: flex-end; white-space: nowrap; }
       .prod-toggle { display: inline-flex; align-items: center; gap: 4px; font-size: 13px; color: var(--muted); cursor: pointer; }
       .prod-tag { display: inline-block; white-space: nowrap; margin-left: 8px; font-size: 11px; font-weight: 700; letter-spacing: 0.04em; color: var(--bad); border: 1px solid currentColor; border-radius: 4px; padding: 0 4px; vertical-align: 1px; }
+      .default-tag { display: inline-block; white-space: nowrap; margin-left: 8px; font-size: 11px; font-weight: 700; letter-spacing: 0.04em; color: var(--accent-strong); border: 1px solid currentColor; border-radius: 4px; padding: 0 4px; vertical-align: 1px; }
       tr.prod td:first-child { box-shadow: inset 3px 0 0 var(--bad); }
       button.link.danger-hover:hover { color: var(--bad); }
       .seg { display: inline-flex; border: 1px solid var(--border); border-radius: 8px; overflow: hidden; }
@@ -13877,18 +14682,18 @@ async function startUiServer({
       sendJson(res, 400, { error: error.message });
     }
   });
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve3, reject) => {
     server.once("error", reject);
-    server.listen(port, "127.0.0.1", resolve);
+    server.listen(port, "127.0.0.1", resolve3);
   });
   const actualPort = server.address().port;
   allowedHosts = /* @__PURE__ */ new Set([`127.0.0.1:${actualPort}`, `localhost:${actualPort}`]);
   return {
     // The token travels in the fragment, so it never reaches server logs or Referer headers.
     url: `http://127.0.0.1:${actualPort}/#token=${token}`,
-    close: () => new Promise((resolve) => {
+    close: () => new Promise((resolve3) => {
       server.closeAllConnections();
-      server.close(() => resolve());
+      server.close(() => resolve3());
     })
   };
 }
@@ -13904,23 +14709,23 @@ async function uiCommand(app, assistants, { flags }) {
   console.log("Only this computer can open it, and the link works only while this runs.");
   console.log("Press Ctrl-C to stop.");
   if (!flags.noOpen) await new NodeBrowserOpener().open(server.url);
-  await new Promise((resolve) => {
-    process.once("SIGINT", resolve);
-    process.once("SIGTERM", resolve);
+  await new Promise((resolve3) => {
+    process.once("SIGINT", resolve3);
+    process.once("SIGTERM", resolve3);
   });
   await server.close();
 }
 
 // src/container.ts
-import { homedir as homedir4 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir5 } from "os";
+import { join as join10 } from "path";
 
 // ../provider-aws/src/aws-provider.ts
-import { join as join7 } from "path";
+import { join as join9 } from "path";
 
 // ../provider-aws/src/aws-config.ts
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4 } from "path";
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile7 } from "fs/promises";
+import { dirname as dirname6 } from "path";
 var BLOCK_START = "# >>> cloudhop managed >>> (edit with `cloudhop`, not by hand)";
 var BLOCK_END = "# <<< cloudhop managed <<<";
 function renderBlock(sections) {
@@ -13967,13 +14772,13 @@ function replaceManagedBlock(content, sections) {
 async function writeManagedBlock(path2, sections) {
   let content = "";
   try {
-    content = await readFile5(path2, "utf8");
+    content = await readFile6(path2, "utf8");
   } catch {
   }
   const next = replaceManagedBlock(content, sections);
   if (next === content) return;
-  await mkdir4(dirname4(path2), { recursive: true, mode: 448 });
-  await writeFile4(path2, next, { mode: 384 });
+  await mkdir5(dirname6(path2), { recursive: true, mode: 448 });
+  await writeFile7(path2, next, { mode: 384 });
 }
 
 // ../provider-aws/src/console.ts
@@ -13998,17 +14803,17 @@ function consoleDestination(region, service) {
 async function federatedConsoleUrl(credentials, destination, region, fetchFn) {
   const {
     AWS_ACCESS_KEY_ID: id,
-    AWS_SECRET_ACCESS_KEY: key,
+    AWS_SECRET_ACCESS_KEY: key2,
     AWS_SESSION_TOKEN: token
   } = credentials;
-  if (!id || !key || !token) return void 0;
+  if (!id || !key2 || !token) return void 0;
   const { signin } = partitionHosts(region);
   const response = await fetchFn(`${signin}/federation`, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       Action: "getSigninToken",
-      Session: JSON.stringify({ sessionId: id, sessionKey: key, sessionToken: token })
+      Session: JSON.stringify({ sessionId: id, sessionKey: key2, sessionToken: token })
     }).toString()
   }).catch(() => void 0);
   if (!response?.ok) return void 0;
@@ -14024,7 +14829,9 @@ async function federatedConsoleUrl(credentials, destination, region, fetchFn) {
 }
 function portalShortcutUrl(startUrl, accountId, roleName, destination) {
   const params = new URLSearchParams({ account_id: accountId, role_name: roleName, destination });
-  return `${startUrl.replace(/\/+$/, "")}/#/console?${params}`;
+  let base = startUrl;
+  while (base.endsWith("/")) base = base.slice(0, -1);
+  return `${base}/#/console?${params}`;
 }
 
 // ../provider-aws/src/http.ts
@@ -14089,7 +14896,7 @@ var PortalClient = class {
     );
     return body.roleCredentials;
   }
-  async paginate(path2, params, key) {
+  async paginate(path2, params, key2) {
     const items = [];
     let nextToken;
     do {
@@ -14100,7 +14907,7 @@ var PortalClient = class {
         `${this.endpoint}${path2}?${query}`,
         this.headers()
       );
-      items.push(...page[key] ?? []);
+      items.push(...page[key2] ?? []);
       nextToken = page.nextToken;
     } while (nextToken);
     return items;
@@ -14111,7 +14918,7 @@ var PortalClient = class {
 };
 
 // ../provider-aws/src/sso/sso-login.ts
-import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
 
 // ../provider-aws/src/sso/loopback.ts
 import { createServer as createServer2 } from "http";
@@ -14122,8 +14929,8 @@ var PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>cloudho
 async function startLoopbackServer() {
   let resolveRequest = () => {
   };
-  const request = new Promise((resolve) => {
-    resolveRequest = resolve;
+  const request = new Promise((resolve3) => {
+    resolveRequest = resolve3;
   });
   const server = createServer2((req, res) => {
     const url = new URL(req.url ?? "/", "http://127.0.0.1");
@@ -14138,7 +14945,7 @@ async function startLoopbackServer() {
     );
     resolveRequest(url);
   });
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  await new Promise((resolve3) => server.listen(0, "127.0.0.1", resolve3));
   const { port } = server.address();
   return {
     redirectUri: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
@@ -14244,24 +15051,24 @@ var OidcClient = class {
 };
 
 // ../provider-aws/src/sso/token-cache.ts
-import { createHash as createHash2 } from "crypto";
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
-import { join as join6 } from "path";
+import { createHash as createHash3 } from "crypto";
+import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile8 } from "fs/promises";
+import { join as join8 } from "path";
 var EXPIRY_MARGIN_MS = 5 * 60 * 1e3;
 function tokenCachePath(awsDir, sessionName) {
-  const hash = createHash2("sha1").update(sessionName).digest("hex");
-  return join6(awsDir, "sso", "cache", `${hash}.json`);
+  const hash = createHash3("sha1").update(sessionName).digest("hex");
+  return join8(awsDir, "sso", "cache", `${hash}.json`);
 }
 async function readToken(awsDir, sessionName) {
   try {
-    return JSON.parse(await readFile6(tokenCachePath(awsDir, sessionName), "utf8"));
+    return JSON.parse(await readFile7(tokenCachePath(awsDir, sessionName), "utf8"));
   } catch {
     return void 0;
   }
 }
 async function writeToken(awsDir, sessionName, token) {
-  await mkdir5(join6(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
-  await writeFile5(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
+  await mkdir6(join8(awsDir, "sso", "cache"), { recursive: true, mode: 448 });
+  await writeFile8(tokenCachePath(awsDir, sessionName), JSON.stringify(token, null, 2), {
     mode: 384
   });
 }
@@ -14304,7 +15111,7 @@ async function authorizationCodeLogin(options) {
       clientId: client.clientId,
       redirectUri: server.redirectUri,
       state,
-      codeChallenge: base64url(createHash3("sha256").update(codeVerifier).digest())
+      codeChallenge: base64url(createHash4("sha256").update(codeVerifier).digest())
     });
     options.interaction.notify("Opening your browser to log in\u2026");
     options.interaction.notify(`If it doesn't open, visit: ${url}`);
@@ -14330,7 +15137,7 @@ async function deviceCodeLogin(options) {
   let intervalMs = (device.interval ?? 5) * 1e3;
   const deadline = Date.now() + device.expiresIn * 1e3;
   while (Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    await new Promise((resolve3) => setTimeout(resolve3, intervalMs));
     try {
       return toCachedToken(
         options,
@@ -14446,6 +15253,7 @@ var AwsProvider = class {
   displayName = "AWS";
   cli = { command: "aws", displayName: "AWS CLI v2", minVersion: "2.32.0" };
   identityArgs = ["sts", "get-caller-identity"];
+  shellVars = [...CREDENTIAL_VARS, "AWS_PROFILE", "AWS_REGION", "AWS_DEFAULT_REGION"];
   sourceKinds = [
     {
       kind: SSO_KIND,
@@ -14554,7 +15362,7 @@ var AwsProvider = class {
         }
       });
     }
-    await writeManagedBlock(join7(this.options.awsDir, "config"), sections);
+    await writeManagedBlock(join9(this.options.awsDir, "config"), sections);
   }
   async processEnv(resolved, mode) {
     const region = resolved.region;
@@ -14628,9 +15436,9 @@ var AwsProvider = class {
     if (!token) throw new CloudhopError("LOGIN_FAILED", `Not logged in to ${source.id}.`);
     return new PortalClient(this.setting(source, "region"), token.accessToken, this.fetchFn);
   }
-  setting(source, key) {
-    const value = source.settings[key];
-    if (!value) throw new CloudhopError("SOURCE_NOT_FOUND", `Source "${source.id}" has no ${key}.`);
+  setting(source, key2) {
+    const value = source.settings[key2];
+    if (!value) throw new CloudhopError("SOURCE_NOT_FOUND", `Source "${source.id}" has no ${key2}.`);
     return value;
   }
 };
@@ -14639,7 +15447,7 @@ var AwsProvider = class {
 var browser = new NodeBrowserOpener();
 function createApp(env = process.env) {
   const runner = new NodeProcessRunner();
-  const awsDir = env.CLOUDHOP_AWS_DIR ?? join8(homedir4(), ".aws");
+  const awsDir = env.CLOUDHOP_AWS_DIR ?? join10(homedir5(), ".aws");
   return new CloudhopApp({
     config: new YamlConfigStore(),
     providers: [
@@ -14658,33 +15466,39 @@ function createApp(env = process.env) {
 }
 function createAssistants(version, env = process.env) {
   return new AssistantsInstaller({
-    places: { home: homedir4(), project: process.cwd() },
+    places: { home: homedir5(), project: process.cwd() },
     configDir: defaultConfigDir(env),
     runner: new NodeProcessRunner(),
     cloudhopVersion: version
   });
 }
+function createTrustedFolders(env = process.env) {
+  return new TrustedFolders(defaultConfigDir(env));
+}
 
 // src/update-check.ts
-import { mkdir as mkdir6, readFile as readFile7, writeFile as writeFile6 } from "fs/promises";
-import { join as join9 } from "path";
+import { mkdir as mkdir7, readFile as readFile8, writeFile as writeFile9 } from "fs/promises";
+import { join as join11 } from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var REGISTRY_URL = "https://registry.npmjs.org/cloudhop/latest";
+var VERSION = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.]{1,40})?$/;
+var validVersion = (value) => typeof value === "string" && VERSION.test(value) ? value : void 0;
 function startUpdateCheck(configDir, current) {
   const env = process.env;
   if (env.CLOUDHOP_NO_UPDATE_CHECK === "1" || env.CI || !process.stderr.isTTY)
     return async () => {
     };
-  const file = join9(configDir, "update-check.json");
+  const file = join11(configDir, "update-check.json");
   const work = (async () => {
     let cache = { checkedAt: 0 };
     try {
-      cache = JSON.parse(await readFile7(file, "utf8"));
+      cache = JSON.parse(await readFile8(file, "utf8"));
     } catch {
     }
-    if (cache.latest && compareVersions(cache.latest, current) > 0) {
+    const cached = validVersion(cache.latest);
+    if (cached && compareVersions(cached, current) > 0) {
       process.stderr.write(
-        `\x1B[2mcloudhop \u203A\x1B[22m cloudhop ${cache.latest} is available (you have ${current}): npm i -g cloudhop
+        `\x1B[2mcloudhop \u203A\x1B[22m cloudhop ${cached} is available (you have ${current}): npm i -g cloudhop
 `
       );
     }
@@ -14694,19 +15508,24 @@ function startUpdateCheck(configDir, current) {
       signal: AbortSignal.timeout(1500)
     });
     if (!response.ok) return;
-    const { version } = await response.json();
-    if (typeof version !== "string") return;
-    await mkdir6(configDir, { recursive: true });
-    await writeFile6(file, JSON.stringify({ checkedAt: Date.now(), latest: version }));
+    const latest = validVersion((await response.json()).version);
+    if (!latest) return;
+    await mkdir7(configDir, { recursive: true });
+    await writeFile9(file, JSON.stringify({ checkedAt: Date.now(), latest }));
   })().catch(() => {
   });
-  return () => Promise.race([work, new Promise((resolve) => setTimeout(resolve, 300))]);
+  return () => Promise.race([work, new Promise((resolve3) => setTimeout(resolve3, 300))]);
 }
 
 // src/cli.ts
-var HELP = `cloudhop ${"1.2.1"}
+var HELP = `cloudhop ${"1.3.1"}
 Hop between cloud accounts, roles and regions with one command.
 
+Quick start
+  cloudhop add                   Sign in to an SSO portal or personal account, name aliases
+  cloudhop shell                 Set up your terminal (once)
+  cloudhop use <alias>           Switch this terminal to an alias, then type plain aws ...
+
 Usage
   hop <alias> [args...]          Run the cloud CLI as <alias> (no args: who am I)
   hop                            Pick the alias from a list, then type the command
@@ -14715,8 +15534,13 @@ Usage
                                  Open the web console as <alias>, already signed in
   cloudhop each <selection...> [--source <s>] [--prod|--no-prod] [--yes] [--json] -- <args...>
                                  Run one command in many aliases (names, a,b lists, 'globex-*', /regex/)
-  cloudhop use [alias] | --off    Use an alias in this shell (aws, terraform... without hop)
-  cloudhop shell [install]       Shell integration: cloudhop use, tab completion, cloudhop_prompt
+  cloudhop use [alias] [--save]  Use an alias in this terminal: then plain aws, terraform... run as it
+                                 (--save: remember it for this folder in .cloudhoprc)
+  cloudhop use --off [cloud]     Stop using the alias of every cloud, or just one (aws)
+  cloudhop use <alias> --default Also start every new terminal with it (--no-default: stop)
+  cloudhop allow | deny [folder] Trust (or stop trusting) a folder's .cloudhoprc
+  cloudhop shell                 Set up your terminal once: cloudhop use, .cloudhoprc on cd, completion
+  cloudhop shell starship        Prompt segments for Starship (alias in use, PROD in red)
   cloudhop exec <alias> [--region <r>] -- <cmd...>
                                  Run any tool with the alias' temporary credentials
 
@@ -14784,7 +15608,7 @@ async function main(argv) {
     return 0;
   }
   if (command === "--version" || command === "-v" || command === "version") {
-    console.log("1.2.1");
+    console.log("1.3.1");
     return 0;
   }
   const app = createApp();
@@ -14794,16 +15618,28 @@ async function main(argv) {
     return 0;
   }
   if (command === "shell") {
-    await shellCommand(local);
+    const clis = app.availableProviders().map((p3) => ({ command: p3.cli.command, provider: p3.id }));
+    const start = await app.defaultAliases().then(
+      (d) => Object.keys(d).length > 0,
+      () => false
+    );
+    await shellCommand(local, clis, start);
     return 0;
   }
+  if (command === "use" && local.some((a2) => a2 === "--emit" || a2.startsWith("--emit="))) {
+    return useCommand(app, createTrustedFolders(), local);
+  }
   if (command === "mcp") {
-    await serveMcp({ app, version: "1.2.1" });
+    await serveMcp({
+      app,
+      version: "1.3.1",
+      context: () => shellContext(createTrustedFolders())
+    });
     return 0;
   }
-  const assistants = createAssistants("1.2.1");
+  const assistants = createAssistants("1.3.1");
   await refreshAssistantSkills(assistants, command);
-  const finishUpdateCheck = startUpdateCheck(defaultConfigDir(), "1.2.1");
+  const finishUpdateCheck = startUpdateCheck(defaultConfigDir(), "1.3.1");
   try {
     return await dispatch(app, assistants, command, args, local);
   } finally {
@@ -14852,7 +15688,7 @@ async function dispatch(app, assistants, command, args, local) {
       return 0;
     case "ls":
     case "list":
-      await listCommand(app, local);
+      await listCommand(app, local, () => shellContext(createTrustedFolders()));
       return 0;
     case "rm":
     case "remove":
@@ -14873,7 +15709,10 @@ async function dispatch(app, assistants, command, args, local) {
       await teamCommand(app, local);
       return 0;
     case "use":
-      await useCommand(app, local);
+      return useCommand(app, createTrustedFolders(), local);
+    case "allow":
+    case "deny":
+      await allowCommand(app, createTrustedFolders(), local, command === "allow");
       return 0;
     case "each":
       return eachCommand(app, args);