convex 1.46.0 → 1.48.0-alpha.0

package/src/cli/lib/utils/utils.ts

@@ -45,6 +45,7 @@ export const CONVEX_DEPLOYMENT_ENV_VAR_NAME = "CONVEX_DEPLOYMENT";
 export const CONVEX_SELF_HOSTED_URL_VAR_NAME = "CONVEX_SELF_HOSTED_URL";
 export const CONVEX_SELF_HOSTED_ADMIN_KEY_VAR_NAME =
   "CONVEX_SELF_HOSTED_ADMIN_KEY";
+export const IGNORED_DEPLOY_KEY = "<ignore_deploy_key>";
 const MAX_RETRIES = 6;
 // After 3 retries, log a progress message that we're retrying the request
 const RETRY_LOG_THRESHOLD = 3;
@@ -69,7 +70,7 @@ export async function processDeployKeyValue(
   }
 
   // Check for <ignore_deploy_key> sentinel
-  if (deployKey === "<ignore_deploy_key>") {
+  if (deployKey === IGNORED_DEPLOY_KEY) {
     return undefined;
   }
 
@@ -96,9 +97,20 @@ export async function processDeployKeyValue(
 export function readDeployKeyFromEnv(
   getEnv: (name: string) => string | undefined | null,
 ): string | undefined {
-  const fromDeployKey = getEnv(CONVEX_DEPLOY_KEY_ENV_VAR_NAME);
-  const fromToken = getEnv(CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME);
-  return fromDeployKey || fromToken || undefined;
+  return readDeployKeyEnvVar(getEnv)?.value;
+}
+
+export function readDeployKeyEnvVar(
+  getEnv: (name: string) => string | undefined | null,
+): { name: string; value: string } | undefined {
+  for (const name of [
+    CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
+    CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,
+  ]) {
+    const value = getEnv(name);
+    if (value) return { name, value };
+  }
+  return undefined;
 }
 
 // The prefix the backend's `require_operation` checks use when an identity
@@ -108,17 +120,9 @@ const PERMISSION_DENIED_MESSAGE_PREFIX =
   "You do not have permission to perform this operation";
 
 function deployKeyPermissionAdvice(): string | null {
-  // Name whichever env var is actually set. `CONVEX_DEPLOY_KEY` takes
-  // precedence over `CONVEX_DEPLOYMENT_TOKEN` when both are present.
-  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME]
-    ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME
-    : process.env[CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME]
-      ? CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME
-      : null;
-  if (envVarName === null) {
-    return null;
-  }
-  return `This is determined by the permissions granted to ${envVarName}.`;
+  const envVar = readDeployKeyEnvVar((name) => process.env[name]);
+  if (envVar === undefined || envVar.value === IGNORED_DEPLOY_KEY) return null;
+  return `This is determined by the permissions granted to ${envVar.name}.`;
 }
 
 /**
@@ -517,6 +521,23 @@ export async function selectRegionOrUseDefault(
   return selectedRegionName;
 }
 
+// Mirrors the order of `REGION_PRESENTATION` in
+// `npm-packages/dashboard/src/lib/regions.ts`, so both region pickers list
+// regions in the same order.
+const REGION_ORDER: string[] = [
+  "aws-us-east-1",
+  "aws-eu-west-1",
+  "aws-ca-central-1",
+  "aws-ap-southeast-2",
+];
+
+// Regions missing from `REGION_ORDER` (e.g. newly launched ones) go last, in
+// server order, since `Array.prototype.sort` is stable.
+function regionSortIndex(regionName: string): number {
+  const index = REGION_ORDER.indexOf(regionName);
+  return index === -1 ? REGION_ORDER.length : index;
+}
+
 export async function selectRegion(
   ctx: Context,
   teamId: number,
@@ -538,12 +559,7 @@ export async function selectRegion(
       name: item.displayName,
       value: item.name,
     }))
-    .sort((a, b) => {
-      // Show US region first if it exists
-      if (a.value === "aws-us-east-1") return -1;
-      if (b.value === "aws-us-east-1") return 1;
-      return 0;
-    });
+    .sort((a, b) => regionSortIndex(a.value) - regionSortIndex(b.value));
   return await promptOptions(ctx, {
     message: `Where should this ${deploymentType} deployment run?`,
     suffix: `\n${chalkStderr.gray(
@@ -559,16 +575,18 @@ export async function hasProject(
   projectSlug: string,
 ) {
   try {
-    const projects: Project[] = (
-      await typedBigBrainClient(ctx).GET("/teams/{team_slug}/projects", {
+    await typedPlatformClient(ctx, { throw: true }).GET(
+      "/teams/{team_id_or_slug}/projects/{project_slug}",
+      {
         params: {
           path: {
-            team_slug: teamSlug,
+            team_id_or_slug: teamSlug,
+            project_slug: projectSlug,
           },
         },
-      })
-    ).data!;
-    return !!projects.find((project) => project.slug === projectSlug);
+      },
+    );
+    return true;
   } catch {
     return false;
   }
@@ -581,19 +599,27 @@ export async function hasProjects(ctx: Context) {
 export async function validateOrSelectProject(
   ctx: Context,
   projectSlug: string | undefined,
-  teamSlug: string,
+  teamId: number,
   singleProjectPrompt: string,
   multiProjectPrompt: string,
 ): Promise<string | null> {
-  const projects: Project[] = (
-    await typedBigBrainClient(ctx).GET("/teams/{team_slug}/projects", {
-      params: {
-        path: {
-          team_slug: teamSlug,
+  const projects: Project[] = [];
+  const client = typedPlatformClient(ctx);
+  let cursor: string | undefined;
+  do {
+    const { items, pagination } = (
+      await client.GET("/teams/{team_id}/projects", {
+        params: {
+          path: { team_id: teamId },
+          query: cursor === undefined ? {} : { cursor },
         },
-      },
-    })
-  ).data!;
+      })
+    ).data!;
+    projects.push(...items);
+    cursor = pagination.hasMore
+      ? (pagination.nextCursor ?? undefined)
+      : undefined;
+  } while (cursor !== undefined);
   if (projects.length === 0) {
     return await ctx.crash({
       exitCode: 1,
@@ -996,6 +1022,27 @@ export function formatSize(n: number): string {
   return `${formatted} ${BYTE_UNITS[unitIndex]}`;
 }
 
+/**
+ * Read an integer override from the environment, falling back to
+ * `defaultValue` when the variable is unset. The whole value must be a
+ * base-10 integer: `parseInt` would read a typo like `100_000` or `100k` as
+ * 100 and silently move the threshold, so anything else is rejected with a
+ * warning instead.
+ */
+export function integerFromEnv(envVar: string, defaultValue: number): number {
+  const envValue = process.env[envVar];
+  if (envValue === undefined) {
+    return defaultValue;
+  }
+  if (!/^[+-]?\d+$/.test(envValue.trim())) {
+    logWarning(
+      `Ignoring ${envVar}=${JSON.stringify(envValue)}: expected an integer, using ${defaultValue}`,
+    );
+    return defaultValue;
+  }
+  return Number(envValue);
+}
+
 export function formatDuration(ms: number): string {
   const twoDigits = (n: number, unit: string) =>
     `${n.toLocaleString("en-US", { maximumFractionDigits: 2 })}${unit}`;

package/src/cli/login.ts

@@ -1,5 +1,4 @@
 import { Command, Option } from "@commander-js/extra-typings";
-import * as dotenv from "dotenv";
 import { BigBrainAuth, Context, oneoffContext } from "../bundler/context.js";
 import { logFinishedStep, logMessage, logWarning } from "../bundler/log.js";
 import {
@@ -21,12 +20,7 @@ import {
   teamDashboardUrl,
 } from "./lib/dashboard.js";
 import { promptSearch, promptYesNo } from "./lib/utils/prompts.js";
-import {
-  CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
-  CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,
-  ENV_VAR_FILE_PATH,
-  validateOrSelectTeam,
-} from "./lib/utils/utils.js";
+import { validateOrSelectTeam } from "./lib/utils/utils.js";
 import {
   selectProject,
   updateEnvAndConfigForDeploymentSelection,
@@ -40,31 +34,24 @@ import {
   removeAnonymousPrefix,
 } from "./lib/deployment.js";
 import {
-  readGlobalConfig,
   globalConfigPath,
+  readGlobalConfig,
 } from "./lib/utils/globalConfig.js";
 import { getTeamsForUser } from "./lib/api.js";
-
-/**
- * The env file a deploy key came from, or null if it came from the shell.
- * `dotenv` doesn't overwrite variables that are already set, so a value from
- * the shell outranks these files -- match on the value to tell them apart.
- */
-function deployKeyEnvFile(
-  ctx: Context,
-  envVarName: string,
-  value: string,
-): string | null {
-  for (const file of [ENV_VAR_FILE_PATH, ".env"]) {
-    if (!ctx.fs.exists(file)) {
-      continue;
-    }
-    if (dotenv.parse(ctx.fs.readUtf8File(file))[envVarName] === value) {
-      return file;
-    }
-  }
-  return null;
-}
+import {
+  getProfileSelection,
+  initializeDefaultProfile,
+  legacyAuthForFirstProfile,
+  profileConfigPath,
+  readProfileAuth,
+  writeProfileCredentials,
+} from "./lib/profiles.js";
+import {
+  getDeployKeySource,
+  loadProjectEnvironmentVariables,
+} from "./lib/envvars.js";
+import { bindProfileToDirectory } from "./lib/profileManagement.js";
+import { warnIfDeployKeyOverridesLogin } from "./lib/deployKeyWarning.js";
 
 /**
  * A project or deployment key in the environment outranks the account token for
@@ -84,11 +71,7 @@ async function reportDeployKeyInWorkingDirectory(
     return;
   }
   const key = auth.kind === "projectKey" ? auth.projectKey : auth.deploymentKey;
-  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME]
-    ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME
-    : CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME;
-  const envFile = deployKeyEnvFile(ctx, envVarName, key);
-  const source = envFile ?? "shell environment";
+  const { envVarName, source } = getDeployKeySource(key);
   // Big Brain only strips a `project:`/`team:` prefix itself, so a deployment
   // key authorizes only without its `dev:`/`prod:` prefix. Split on the first
   // `|` like the server does, so a secret containing one survives.
@@ -100,149 +83,291 @@ async function reportDeployKeyInWorkingDirectory(
   logWarning(`Working Directory: Invalid ${envVarName} in ${source}`);
 }
 
-const loginStatus = new Command("status")
-  .description("Check login status and list accessible teams")
-  .allowExcessArguments(false)
-  .action(async () => {
-    const ctx = await oneoffContext({
-      url: undefined,
-      adminKey: undefined,
-      envFile: undefined,
-    });
-
-    // `_updateBigBrainAuth` below replaces any deploy key in `ctx` with the
-    // account token, so read the deploy key first.
-    const auth = ctx.bigBrainAuth();
-
-    const globalConfig = readGlobalConfig(ctx);
-    if (globalConfig === null) {
-      logMessage(`No Convex account token found in: ${globalConfigPath()}`);
-      logMessage("Status: Not logged in");
-      await reportDeployKeyInWorkingDirectory(ctx, auth);
-      return;
-    }
-    logMessage(`Convex account token found in: ${globalConfigPath()}`);
-
-    const accessToken = globalConfig.accessToken;
-    if (!(await isAuthorizedHeader(ctx, `Bearer ${accessToken}`))) {
-      logMessage("Status: Not logged in");
-      await reportDeployKeyInWorkingDirectory(ctx, auth);
-      return;
-    }
-
-    logMessage("Status: Logged in");
-    // Describe the account, even if a deploy key outranks it for other commands.
-    ctx._updateBigBrainAuth({
-      kind: "accessToken",
-      header: `Bearer ${accessToken}`,
-      accessToken,
-    });
-    const teams = await getTeamsForUser(ctx);
-    logMessage(
-      `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`,
-    );
-    for (const team of teams) {
-      logMessage(`  - ${team.name} (${team.slug})`);
-    }
-    await reportDeployKeyInWorkingDirectory(ctx, auth);
-  });
-
-export const login = new Command("login")
-  .description("Login to Convex")
-  .allowExcessArguments(false)
-  .option(
-    "--device-name <name>",
-    "Provide a name for the device being authorized",
-  )
-  .option(
-    "-f, --force",
-    "Proceed with login even if a valid access token already exists for this device",
-  )
-  .option(
-    "--no-open",
-    "Don't automatically open the login link in the default browser",
-  )
-  .addOption(
-    new Option(
-      "--login-flow <mode>",
-      `How to log in; defaults to guessing based on the environment.`,
+function createLoginStatusCommand() {
+  return new Command("status")
+    .description(
+      "Check login status and list accessible teams. Exits with code 1 when not logged in.",
     )
-      .choices(["paste", "auto", "poll"] as const)
-      .default("auto" as const),
-  )
-  .addOption(new Option("--link-deployments").hideHelp())
-  // These options are hidden from the help/usage message, but allow overriding settings for testing.
-  // Change the auth credentials with the auth provider
-  .addOption(new Option("--override-auth-url <url>").hideHelp())
-  .addOption(new Option("--override-auth-client <id>").hideHelp())
-  .addOption(new Option("--override-auth-username <username>").hideHelp())
-  .addOption(new Option("--override-auth-password <password>").hideHelp())
-  // Skip the auth provider login and directly use this access token
-  .addOption(new Option("--override-access-token <token>").hideHelp())
-  // Automatically accept opt ins without prompting
-  .addOption(new Option("--accept-opt-ins").hideHelp())
-  // Dump the access token from the auth provider and skip authorization with Convex
-  .addOption(new Option("--dump-access-token").hideHelp())
-  // Hidden option for tests to check if the user is logged in.
-  .addOption(new Option("--check-login").hideHelp())
-  // Redirect to Vercel SSO integration URL
-  .addOption(
-    new Option(
-      "--vercel",
-      "Redirect to Vercel SSO integration for login",
-    ).hideHelp(),
-  )
-  // Override the Vercel URL slug (defaults to 'convex')
-  .addOption(new Option("--vercel-override <slug>").hideHelp())
-  .addCommand(loginStatus)
-  .addHelpCommand(false)
-  .action(async (options, cmd: Command) => {
-    const ctx = await oneoffContext({
-      url: undefined,
-      adminKey: undefined,
-      envFile: undefined,
-    });
-    if (
-      !options.force &&
-      (await checkAuthorization(ctx, !!options.acceptOptIns))
-    ) {
-      logFinishedStep(
-        "This device has previously been authorized and is ready for use with Convex.",
-      );
-      await handleLinkingDeployments(ctx, {
-        interactive: !!options.linkDeployments,
+    .allowExcessArguments(false)
+    .action(async () => {
+      const ctx = await oneoffContext({
+        url: undefined,
+        adminKey: undefined,
+        envFile: undefined,
       });
-      return;
-    }
-    if (!options.force && options.checkLogin) {
-      const isLoggedIn = await checkAuthorization(ctx, !!options.acceptOptIns);
-      if (!isLoggedIn) {
-        return ctx.crash({
+
+      // Keep the directory's deploy key for separate reporting after selecting
+      // the account whose teams will be listed.
+      const auth = ctx.bigBrainAuth();
+      let accountAuth = auth?.kind === "accessToken" ? auth : null;
+      if (accountAuth === null) {
+        const profile = await getProfileSelection(ctx);
+        if (profile !== null) {
+          accountAuth = await readProfileAuth(ctx, profile);
+        } else {
+          const globalConfig = readGlobalConfig(ctx);
+          if (globalConfig !== null) {
+            accountAuth = {
+              kind: "accessToken",
+              accessToken: globalConfig.accessToken,
+              header: `Bearer ${globalConfig.accessToken}`,
+              profile: null,
+            };
+          }
+        }
+      }
+      if (accountAuth === null) {
+        logMessage(`No Convex account token found in: ${globalConfigPath()}`);
+        logMessage("Status: Not logged in");
+        await reportDeployKeyInWorkingDirectory(ctx, auth);
+        return await ctx.crash({
           exitCode: 1,
           errorType: "fatal",
-          errForSentry: "You are not logged in.",
-          printedMessage: "You are not logged in.",
+          printedMessage: null,
         });
       }
-    }
-    if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {
-      cmd.error(
-        "If overriding credentials, both username and password must be provided",
-      );
-    }
+      warnIfDeployKeyOverridesLogin(ctx, true);
+      if (accountAuth.profile) {
+        logMessage(`Account: ${accountAuth.profile.name}`);
+        logMessage(`Selected by: ${accountAuth.profile.source}`);
+        logMessage(
+          `Convex account token found in: ${profileConfigPath(accountAuth.profile.name)}`,
+        );
+      } else if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
+        logMessage("Using CONVEX_OVERRIDE_ACCESS_TOKEN from the environment");
+      } else {
+        logMessage(`Convex account token found in: ${globalConfigPath()}`);
+      }
 
-    const uuid = loadUuidForAnonymousUser(ctx);
-    await performLogin(ctx, {
-      ...options,
-      anonymousId: uuid,
-      vercel: options.vercel,
-      vercelOverride: options.vercelOverride,
-    });
+      if (!(await isAuthorizedHeader(ctx, accountAuth.header))) {
+        logMessage("Status: Not logged in");
+        await reportDeployKeyInWorkingDirectory(ctx, auth);
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: null,
+        });
+      }
 
-    await handleLinkingDeployments(ctx, {
-      interactive: !!options.linkDeployments,
+      logMessage("Status: Logged in");
+      ctx._updateBigBrainAuth(accountAuth);
+      const teams = await getTeamsForUser(ctx);
+      logMessage(
+        `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`,
+      );
+      for (const team of teams) {
+        logMessage(`  - ${team.name} (${team.slug})`);
+      }
+      await reportDeployKeyInWorkingDirectory(ctx, auth);
     });
-  });
+}
+
+export function createLoginCommand() {
+  return (
+    new Command("login")
+      .description("Login to Convex")
+      .allowExcessArguments(false)
+      .option("--account <name>", "Log in to a named account")
+      .option(
+        "--select",
+        "Select this account for this directory and its subdirectories",
+      )
+      .option(
+        "--device-name <name>",
+        "Provide a name for the device being authorized",
+      )
+      .option(
+        "-f, --force",
+        "Proceed with login even if a valid access token already exists for this device",
+      )
+      .option(
+        "--no-open",
+        "Don't automatically open the login link in the default browser",
+      )
+      .addOption(
+        new Option(
+          "--login-flow <mode>",
+          `How to log in; defaults to guessing based on the environment.`,
+        )
+          .choices(["paste", "auto", "poll"] as const)
+          .default("auto" as const),
+      )
+      .addOption(new Option("--link-deployments").hideHelp())
+      // These options are hidden from the help/usage message, but allow overriding settings for testing.
+      // Change the auth credentials with the auth provider
+      .addOption(new Option("--override-auth-url <url>").hideHelp())
+      .addOption(new Option("--override-auth-client <id>").hideHelp())
+      .addOption(new Option("--override-auth-username <username>").hideHelp())
+      .addOption(new Option("--override-auth-password <password>").hideHelp())
+      // Skip the auth provider login and directly use this access token
+      .addOption(new Option("--override-access-token <token>").hideHelp())
+      // Automatically accept opt ins without prompting
+      .addOption(new Option("--accept-opt-ins").hideHelp())
+      // Dump the access token from the auth provider and skip authorization with Convex
+      .addOption(new Option("--dump-access-token").hideHelp())
+      // Hidden option for tests to check if the user is logged in.
+      .addOption(new Option("--check-login").hideHelp())
+      // Redirect to Vercel SSO integration URL
+      .addOption(
+        new Option(
+          "--vercel",
+          "Redirect to Vercel SSO integration for login",
+        ).hideHelp(),
+      )
+      // Override the Vercel URL slug (defaults to 'convex')
+      .addOption(new Option("--vercel-override <slug>").hideHelp())
+      .addCommand(createLoginStatusCommand())
+      .addHelpCommand(false)
+      .action(async (options, cmd: Command) => {
+        const ctx = await oneoffContext({
+          url: undefined,
+          adminKey: undefined,
+          envFile: undefined,
+          skipAuth: true,
+        });
+        const profile = await getProfileSelection(ctx, {
+          name: options.account,
+        });
+        if (options.select && profile === null) {
+          cmd.error("Pass --account <name> with --select to name this login.");
+        }
+        loadProjectEnvironmentVariables();
+        let namingLegacyAccount = false;
+        if (profile !== null) {
+          let auth = options.force
+            ? null
+            : await readProfileAuth(ctx, profile, true);
+          if (
+            auth === null &&
+            !options.force &&
+            !options.overrideAccessToken &&
+            !options.overrideAuthUsername &&
+            !process.env.CONVEX_OVERRIDE_ACCESS_TOKEN
+          ) {
+            auth = await legacyAuthForFirstProfile(ctx, profile);
+            namingLegacyAccount = auth !== null;
+          }
+          ctx._updateBigBrainAuth(auth);
+        } else {
+          const accessToken =
+            process.env.CONVEX_OVERRIDE_ACCESS_TOKEN ||
+            readGlobalConfig(ctx)?.accessToken;
+          ctx._updateBigBrainAuth(
+            accessToken
+              ? {
+                  kind: "accessToken",
+                  accessToken,
+                  header: `Bearer ${accessToken}`,
+                  profile: null,
+                }
+              : null,
+          );
+        }
+        warnIfDeployKeyOverridesLogin(ctx, ctx.bigBrainAuth() !== null);
+        if (
+          !options.force &&
+          (await checkAuthorization(ctx, !!options.acceptOptIns))
+        ) {
+          const auth = ctx.bigBrainAuth();
+          if (
+            namingLegacyAccount &&
+            profile !== null &&
+            auth?.kind === "accessToken"
+          ) {
+            await writeProfileCredentials(
+              ctx,
+              profile.name,
+              auth.accessToken,
+              {},
+              null,
+            );
+          }
+          logFinishedStep(
+            profile !== null
+              ? namingLegacyAccount
+                ? `Saved account "${profile.name}" using your existing login.`
+                : `Account "${profile.name}" is already logged in.`
+              : "This device has previously been authorized and is ready for use with Convex.",
+          );
+          if (profile !== null && auth?.kind === "accessToken") {
+            await initializeDefaultProfile(
+              ctx,
+              profile,
+              namingLegacyAccount,
+              !!options.select,
+            );
+          }
+          if (options.select && profile !== null) {
+            if (!(await bindProfileToDirectory(ctx, profile.name))) {
+              return await ctx.crash({
+                exitCode: 1,
+                errorType: "fatal",
+                printedMessage: `Logged in as "${profile.name}", but the directory selection could not be changed.`,
+              });
+            }
+          }
+          await handleLinkingDeployments(ctx, {
+            interactive: !!options.linkDeployments,
+          });
+          return;
+        }
+        if (!options.force && options.checkLogin) {
+          const isLoggedIn = await checkAuthorization(
+            ctx,
+            !!options.acceptOptIns,
+          );
+          if (!isLoggedIn) {
+            return ctx.crash({
+              exitCode: 1,
+              errorType: "fatal",
+              errForSentry: "You are not logged in.",
+              printedMessage: "You are not logged in.",
+            });
+          }
+        }
+        if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {
+          cmd.error(
+            "If overriding credentials, both username and password must be provided",
+          );
+        }
+
+        const uuid = loadUuidForAnonymousUser(ctx);
+        await performLogin(ctx, {
+          ...options,
+          profile,
+          anonymousId: uuid,
+          vercel: options.vercel,
+          vercelOverride: options.vercelOverride,
+        });
+
+        const auth = ctx.bigBrainAuth();
+        if (profile !== null && auth?.kind === "accessToken") {
+          await initializeDefaultProfile(
+            ctx,
+            profile,
+            namingLegacyAccount,
+            !!options.select,
+          );
+        }
+        if (options.select && profile !== null) {
+          if (!(await bindProfileToDirectory(ctx, profile.name))) {
+            return await ctx.crash({
+              exitCode: 1,
+              errorType: "fatal",
+              printedMessage: `Logged in as "${profile.name}", but the directory selection could not be changed.`,
+            });
+          }
+        }
+        warnIfDeployKeyOverridesLogin(ctx, true);
+
+        await handleLinkingDeployments(ctx, {
+          interactive: !!options.linkDeployments,
+        });
+      })
+  );
+}
+
+export const login = createLoginCommand();
 
 async function handleLinkingDeployments(
   ctx: Context,