convex 1.47.0 → 1.48.0-alpha.0

package/dist/esm/cli/login.js

@@ -1,6 +1,5 @@
 "use strict";
 import { Command, Option } from "@commander-js/extra-typings";
-import * as dotenv from "dotenv";
 import { oneoffContext } from "../bundler/context.js";
 import { logFinishedStep, logMessage, logWarning } from "../bundler/log.js";
 import {
@@ -22,12 +21,7 @@ import {
   teamDashboardUrl
 } from "./lib/dashboard.js";
 import { promptSearch, promptYesNo } from "./lib/utils/prompts.js";
-import {
-  CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
-  CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,
-  ENV_VAR_FILE_PATH,
-  validateOrSelectTeam
-} from "./lib/utils/utils.js";
+import { validateOrSelectTeam } from "./lib/utils/utils.js";
 import {
   selectProject,
   updateEnvAndConfigForDeploymentSelection
@@ -41,29 +35,30 @@ import {
   removeAnonymousPrefix
 } from "./lib/deployment.js";
 import {
-  readGlobalConfig,
-  globalConfigPath
+  globalConfigPath,
+  readGlobalConfig
 } from "./lib/utils/globalConfig.js";
 import { getTeamsForUser } from "./lib/api.js";
-function deployKeyEnvFile(ctx, envVarName, value) {
-  for (const file of [ENV_VAR_FILE_PATH, ".env"]) {
-    if (!ctx.fs.exists(file)) {
-      continue;
-    }
-    if (dotenv.parse(ctx.fs.readUtf8File(file))[envVarName] === value) {
-      return file;
-    }
-  }
-  return null;
-}
+import {
+  getProfileSelection,
+  initializeDefaultProfile,
+  legacyAuthForFirstProfile,
+  profileConfigPath,
+  readProfileAuth,
+  writeProfileCredentials
+} from "./lib/profiles.js";
+import {
+  getDeployKeySource,
+  loadProjectEnvironmentVariables
+} from "./lib/envvars.js";
+import { bindProfileToDirectory } from "./lib/profileManagement.js";
+import { warnIfDeployKeyOverridesLogin } from "./lib/deployKeyWarning.js";
 async function reportDeployKeyInWorkingDirectory(ctx, auth) {
   if (auth === null || auth.kind === "accessToken" || auth.kind === "previewDeployKey") {
     return;
   }
   const key = auth.kind === "projectKey" ? auth.projectKey : auth.deploymentKey;
-  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME] ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME : CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME;
-  const envFile = deployKeyEnvFile(ctx, envVarName, key);
-  const source = envFile ?? "shell environment";
+  const { envVarName, source } = getDeployKeySource(key);
   const secret = key.slice(key.indexOf("|") + 1);
   if (await isAuthorizedHeader(ctx, `Bearer ${secret}`)) {
     logMessage(`Working Directory: Valid ${envVarName} in ${source}`);
@@ -71,103 +66,221 @@ async function reportDeployKeyInWorkingDirectory(ctx, auth) {
   }
   logWarning(`Working Directory: Invalid ${envVarName} in ${source}`);
 }
-const loginStatus = new Command("status").description("Check login status and list accessible teams").allowExcessArguments(false).action(async () => {
-  const ctx = await oneoffContext({
-    url: void 0,
-    adminKey: void 0,
-    envFile: void 0
-  });
-  const auth = ctx.bigBrainAuth();
-  const globalConfig = readGlobalConfig(ctx);
-  if (globalConfig === null) {
-    logMessage(`No Convex account token found in: ${globalConfigPath()}`);
-    logMessage("Status: Not logged in");
-    await reportDeployKeyInWorkingDirectory(ctx, auth);
-    return;
-  }
-  logMessage(`Convex account token found in: ${globalConfigPath()}`);
-  const accessToken = globalConfig.accessToken;
-  if (!await isAuthorizedHeader(ctx, `Bearer ${accessToken}`)) {
-    logMessage("Status: Not logged in");
-    await reportDeployKeyInWorkingDirectory(ctx, auth);
-    return;
-  }
-  logMessage("Status: Logged in");
-  ctx._updateBigBrainAuth({
-    kind: "accessToken",
-    header: `Bearer ${accessToken}`,
-    accessToken
-  });
-  const teams = await getTeamsForUser(ctx);
-  logMessage(
-    `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`
-  );
-  for (const team of teams) {
-    logMessage(`  - ${team.name} (${team.slug})`);
-  }
-  await reportDeployKeyInWorkingDirectory(ctx, auth);
-});
-export const login = new Command("login").description("Login to Convex").allowExcessArguments(false).option(
-  "--device-name <name>",
-  "Provide a name for the device being authorized"
-).option(
-  "-f, --force",
-  "Proceed with login even if a valid access token already exists for this device"
-).option(
-  "--no-open",
-  "Don't automatically open the login link in the default browser"
-).addOption(
-  new Option(
-    "--login-flow <mode>",
-    `How to log in; defaults to guessing based on the environment.`
-  ).choices(["paste", "auto", "poll"]).default("auto")
-).addOption(new Option("--link-deployments").hideHelp()).addOption(new Option("--override-auth-url <url>").hideHelp()).addOption(new Option("--override-auth-client <id>").hideHelp()).addOption(new Option("--override-auth-username <username>").hideHelp()).addOption(new Option("--override-auth-password <password>").hideHelp()).addOption(new Option("--override-access-token <token>").hideHelp()).addOption(new Option("--accept-opt-ins").hideHelp()).addOption(new Option("--dump-access-token").hideHelp()).addOption(new Option("--check-login").hideHelp()).addOption(
-  new Option(
-    "--vercel",
-    "Redirect to Vercel SSO integration for login"
-  ).hideHelp()
-).addOption(new Option("--vercel-override <slug>").hideHelp()).addCommand(loginStatus).addHelpCommand(false).action(async (options, cmd) => {
-  const ctx = await oneoffContext({
-    url: void 0,
-    adminKey: void 0,
-    envFile: void 0
-  });
-  if (!options.force && await checkAuthorization(ctx, !!options.acceptOptIns)) {
-    logFinishedStep(
-      "This device has previously been authorized and is ready for use with Convex."
-    );
-    await handleLinkingDeployments(ctx, {
-      interactive: !!options.linkDeployments
+function createLoginStatusCommand() {
+  return new Command("status").description(
+    "Check login status and list accessible teams. Exits with code 1 when not logged in."
+  ).allowExcessArguments(false).action(async () => {
+    const ctx = await oneoffContext({
+      url: void 0,
+      adminKey: void 0,
+      envFile: void 0
     });
-    return;
-  }
-  if (!options.force && options.checkLogin) {
-    const isLoggedIn = await checkAuthorization(ctx, !!options.acceptOptIns);
-    if (!isLoggedIn) {
-      return ctx.crash({
+    const auth = ctx.bigBrainAuth();
+    let accountAuth = auth?.kind === "accessToken" ? auth : null;
+    if (accountAuth === null) {
+      const profile = await getProfileSelection(ctx);
+      if (profile !== null) {
+        accountAuth = await readProfileAuth(ctx, profile);
+      } else {
+        const globalConfig = readGlobalConfig(ctx);
+        if (globalConfig !== null) {
+          accountAuth = {
+            kind: "accessToken",
+            accessToken: globalConfig.accessToken,
+            header: `Bearer ${globalConfig.accessToken}`,
+            profile: null
+          };
+        }
+      }
+    }
+    if (accountAuth === null) {
+      logMessage(`No Convex account token found in: ${globalConfigPath()}`);
+      logMessage("Status: Not logged in");
+      await reportDeployKeyInWorkingDirectory(ctx, auth);
+      return await ctx.crash({
         exitCode: 1,
         errorType: "fatal",
-        errForSentry: "You are not logged in.",
-        printedMessage: "You are not logged in."
+        printedMessage: null
       });
     }
-  }
-  if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {
-    cmd.error(
-      "If overriding credentials, both username and password must be provided"
+    warnIfDeployKeyOverridesLogin(ctx, true);
+    if (accountAuth.profile) {
+      logMessage(`Account: ${accountAuth.profile.name}`);
+      logMessage(`Selected by: ${accountAuth.profile.source}`);
+      logMessage(
+        `Convex account token found in: ${profileConfigPath(accountAuth.profile.name)}`
+      );
+    } else if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
+      logMessage("Using CONVEX_OVERRIDE_ACCESS_TOKEN from the environment");
+    } else {
+      logMessage(`Convex account token found in: ${globalConfigPath()}`);
+    }
+    if (!await isAuthorizedHeader(ctx, accountAuth.header)) {
+      logMessage("Status: Not logged in");
+      await reportDeployKeyInWorkingDirectory(ctx, auth);
+      return await ctx.crash({
+        exitCode: 1,
+        errorType: "fatal",
+        printedMessage: null
+      });
+    }
+    logMessage("Status: Logged in");
+    ctx._updateBigBrainAuth(accountAuth);
+    const teams = await getTeamsForUser(ctx);
+    logMessage(
+      `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`
     );
-  }
-  const uuid = loadUuidForAnonymousUser(ctx);
-  await performLogin(ctx, {
-    ...options,
-    anonymousId: uuid,
-    vercel: options.vercel,
-    vercelOverride: options.vercelOverride
+    for (const team of teams) {
+      logMessage(`  - ${team.name} (${team.slug})`);
+    }
+    await reportDeployKeyInWorkingDirectory(ctx, auth);
   });
-  await handleLinkingDeployments(ctx, {
-    interactive: !!options.linkDeployments
+}
+export function createLoginCommand() {
+  return new Command("login").description("Login to Convex").allowExcessArguments(false).option("--account <name>", "Log in to a named account").option(
+    "--select",
+    "Select this account for this directory and its subdirectories"
+  ).option(
+    "--device-name <name>",
+    "Provide a name for the device being authorized"
+  ).option(
+    "-f, --force",
+    "Proceed with login even if a valid access token already exists for this device"
+  ).option(
+    "--no-open",
+    "Don't automatically open the login link in the default browser"
+  ).addOption(
+    new Option(
+      "--login-flow <mode>",
+      `How to log in; defaults to guessing based on the environment.`
+    ).choices(["paste", "auto", "poll"]).default("auto")
+  ).addOption(new Option("--link-deployments").hideHelp()).addOption(new Option("--override-auth-url <url>").hideHelp()).addOption(new Option("--override-auth-client <id>").hideHelp()).addOption(new Option("--override-auth-username <username>").hideHelp()).addOption(new Option("--override-auth-password <password>").hideHelp()).addOption(new Option("--override-access-token <token>").hideHelp()).addOption(new Option("--accept-opt-ins").hideHelp()).addOption(new Option("--dump-access-token").hideHelp()).addOption(new Option("--check-login").hideHelp()).addOption(
+    new Option(
+      "--vercel",
+      "Redirect to Vercel SSO integration for login"
+    ).hideHelp()
+  ).addOption(new Option("--vercel-override <slug>").hideHelp()).addCommand(createLoginStatusCommand()).addHelpCommand(false).action(async (options, cmd) => {
+    const ctx = await oneoffContext({
+      url: void 0,
+      adminKey: void 0,
+      envFile: void 0,
+      skipAuth: true
+    });
+    const profile = await getProfileSelection(ctx, {
+      name: options.account
+    });
+    if (options.select && profile === null) {
+      cmd.error("Pass --account <name> with --select to name this login.");
+    }
+    loadProjectEnvironmentVariables();
+    let namingLegacyAccount = false;
+    if (profile !== null) {
+      let auth2 = options.force ? null : await readProfileAuth(ctx, profile, true);
+      if (auth2 === null && !options.force && !options.overrideAccessToken && !options.overrideAuthUsername && !process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
+        auth2 = await legacyAuthForFirstProfile(ctx, profile);
+        namingLegacyAccount = auth2 !== null;
+      }
+      ctx._updateBigBrainAuth(auth2);
+    } else {
+      const accessToken = process.env.CONVEX_OVERRIDE_ACCESS_TOKEN || readGlobalConfig(ctx)?.accessToken;
+      ctx._updateBigBrainAuth(
+        accessToken ? {
+          kind: "accessToken",
+          accessToken,
+          header: `Bearer ${accessToken}`,
+          profile: null
+        } : null
+      );
+    }
+    warnIfDeployKeyOverridesLogin(ctx, ctx.bigBrainAuth() !== null);
+    if (!options.force && await checkAuthorization(ctx, !!options.acceptOptIns)) {
+      const auth2 = ctx.bigBrainAuth();
+      if (namingLegacyAccount && profile !== null && auth2?.kind === "accessToken") {
+        await writeProfileCredentials(
+          ctx,
+          profile.name,
+          auth2.accessToken,
+          {},
+          null
+        );
+      }
+      logFinishedStep(
+        profile !== null ? namingLegacyAccount ? `Saved account "${profile.name}" using your existing login.` : `Account "${profile.name}" is already logged in.` : "This device has previously been authorized and is ready for use with Convex."
+      );
+      if (profile !== null && auth2?.kind === "accessToken") {
+        await initializeDefaultProfile(
+          ctx,
+          profile,
+          namingLegacyAccount,
+          !!options.select
+        );
+      }
+      if (options.select && profile !== null) {
+        if (!await bindProfileToDirectory(ctx, profile.name)) {
+          return await ctx.crash({
+            exitCode: 1,
+            errorType: "fatal",
+            printedMessage: `Logged in as "${profile.name}", but the directory selection could not be changed.`
+          });
+        }
+      }
+      await handleLinkingDeployments(ctx, {
+        interactive: !!options.linkDeployments
+      });
+      return;
+    }
+    if (!options.force && options.checkLogin) {
+      const isLoggedIn = await checkAuthorization(
+        ctx,
+        !!options.acceptOptIns
+      );
+      if (!isLoggedIn) {
+        return ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          errForSentry: "You are not logged in.",
+          printedMessage: "You are not logged in."
+        });
+      }
+    }
+    if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {
+      cmd.error(
+        "If overriding credentials, both username and password must be provided"
+      );
+    }
+    const uuid = loadUuidForAnonymousUser(ctx);
+    await performLogin(ctx, {
+      ...options,
+      profile,
+      anonymousId: uuid,
+      vercel: options.vercel,
+      vercelOverride: options.vercelOverride
+    });
+    const auth = ctx.bigBrainAuth();
+    if (profile !== null && auth?.kind === "accessToken") {
+      await initializeDefaultProfile(
+        ctx,
+        profile,
+        namingLegacyAccount,
+        !!options.select
+      );
+    }
+    if (options.select && profile !== null) {
+      if (!await bindProfileToDirectory(ctx, profile.name)) {
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: `Logged in as "${profile.name}", but the directory selection could not be changed.`
+        });
+      }
+    }
+    warnIfDeployKeyOverridesLogin(ctx, true);
+    await handleLinkingDeployments(ctx, {
+      interactive: !!options.linkDeployments
+    });
   });
-});
+}
+export const login = createLoginCommand();
 async function handleLinkingDeployments(ctx, args) {
   if (!shouldAllowAnonymousDevelopment()) {
     return;

package/dist/esm/cli/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/cli/login.ts"],
-  "sourcesContent": ["import { Command, Option } from \"@commander-js/extra-typings\";\nimport * as dotenv from \"dotenv\";\nimport { BigBrainAuth, Context, oneoffContext } from \"../bundler/context.js\";\nimport { logFinishedStep, logMessage, logWarning } from \"../bundler/log.js\";\nimport {\n  checkAuthorization,\n  isAuthorizedHeader,\n  performLogin,\n} from \"./lib/login.js\";\nimport {\n  loadProjectLocalConfig,\n  loadUuidForAnonymousUser,\n} from \"./lib/localDeployment/filePaths.js\";\nimport {\n  handleLinkToProject,\n  listLegacyAnonymousDeployments,\n} from \"./lib/localDeployment/anonymous.js\";\nimport {\n  DASHBOARD_HOST,\n  deploymentDashboardUrlPage,\n  teamDashboardUrl,\n} from \"./lib/dashboard.js\";\nimport { promptSearch, promptYesNo } from \"./lib/utils/prompts.js\";\nimport {\n  CONVEX_DEPLOY_KEY_ENV_VAR_NAME,\n  CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,\n  ENV_VAR_FILE_PATH,\n  validateOrSelectTeam,\n} from \"./lib/utils/utils.js\";\nimport {\n  selectProject,\n  updateEnvAndConfigForDeploymentSelection,\n} from \"./configure.js\";\nimport {\n  getDeploymentSelection,\n  shouldAllowAnonymousDevelopment,\n} from \"./lib/deploymentSelection.js\";\nimport {\n  isAnonymousDeployment,\n  removeAnonymousPrefix,\n} from \"./lib/deployment.js\";\nimport {\n  readGlobalConfig,\n  globalConfigPath,\n} from \"./lib/utils/globalConfig.js\";\nimport { getTeamsForUser } from \"./lib/api.js\";\n\n/**\n * The env file a deploy key came from, or null if it came from the shell.\n * `dotenv` doesn't overwrite variables that are already set, so a value from\n * the shell outranks these files -- match on the value to tell them apart.\n */\nfunction deployKeyEnvFile(\n  ctx: Context,\n  envVarName: string,\n  value: string,\n): string | null {\n  for (const file of [ENV_VAR_FILE_PATH, \".env\"]) {\n    if (!ctx.fs.exists(file)) {\n      continue;\n    }\n    if (dotenv.parse(ctx.fs.readUtf8File(file))[envVarName] === value) {\n      return file;\n    }\n  }\n  return null;\n}\n\n/**\n * A project or deployment key in the environment outranks the account token for\n * commands run from this directory, and an expired one makes the CLI look\n * logged out, so report it separately from the account.\n */\nasync function reportDeployKeyInWorkingDirectory(\n  ctx: Context,\n  auth: BigBrainAuth | null,\n) {\n  // A preview deploy key is only used when there's no account token at all.\n  if (\n    auth === null ||\n    auth.kind === \"accessToken\" ||\n    auth.kind === \"previewDeployKey\"\n  ) {\n    return;\n  }\n  const key = auth.kind === \"projectKey\" ? auth.projectKey : auth.deploymentKey;\n  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME]\n    ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME\n    : CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME;\n  const envFile = deployKeyEnvFile(ctx, envVarName, key);\n  const source = envFile ?? \"shell environment\";\n  // Big Brain only strips a `project:`/`team:` prefix itself, so a deployment\n  // key authorizes only without its `dev:`/`prod:` prefix. Split on the first\n  // `|` like the server does, so a secret containing one survives.\n  const secret = key.slice(key.indexOf(\"|\") + 1);\n  if (await isAuthorizedHeader(ctx, `Bearer ${secret}`)) {\n    logMessage(`Working Directory: Valid ${envVarName} in ${source}`);\n    return;\n  }\n  logWarning(`Working Directory: Invalid ${envVarName} in ${source}`);\n}\n\nconst loginStatus = new Command(\"status\")\n  .description(\"Check login status and list accessible teams\")\n  .allowExcessArguments(false)\n  .action(async () => {\n    const ctx = await oneoffContext({\n      url: undefined,\n      adminKey: undefined,\n      envFile: undefined,\n    });\n\n    // `_updateBigBrainAuth` below replaces any deploy key in `ctx` with the\n    // account token, so read the deploy key first.\n    const auth = ctx.bigBrainAuth();\n\n    const globalConfig = readGlobalConfig(ctx);\n    if (globalConfig === null) {\n      logMessage(`No Convex account token found in: ${globalConfigPath()}`);\n      logMessage(\"Status: Not logged in\");\n      await reportDeployKeyInWorkingDirectory(ctx, auth);\n      return;\n    }\n    logMessage(`Convex account token found in: ${globalConfigPath()}`);\n\n    const accessToken = globalConfig.accessToken;\n    if (!(await isAuthorizedHeader(ctx, `Bearer ${accessToken}`))) {\n      logMessage(\"Status: Not logged in\");\n      await reportDeployKeyInWorkingDirectory(ctx, auth);\n      return;\n    }\n\n    logMessage(\"Status: Logged in\");\n    // Describe the account, even if a deploy key outranks it for other commands.\n    ctx._updateBigBrainAuth({\n      kind: \"accessToken\",\n      header: `Bearer ${accessToken}`,\n      accessToken,\n    });\n    const teams = await getTeamsForUser(ctx);\n    logMessage(\n      `Teams: ${teams.length} team${teams.length === 1 ? \"\" : \"s\"} accessible`,\n    );\n    for (const team of teams) {\n      logMessage(`  - ${team.name} (${team.slug})`);\n    }\n    await reportDeployKeyInWorkingDirectory(ctx, auth);\n  });\n\nexport const login = new Command(\"login\")\n  .description(\"Login to Convex\")\n  .allowExcessArguments(false)\n  .option(\n    \"--device-name <name>\",\n    \"Provide a name for the device being authorized\",\n  )\n  .option(\n    \"-f, --force\",\n    \"Proceed with login even if a valid access token already exists for this device\",\n  )\n  .option(\n    \"--no-open\",\n    \"Don't automatically open the login link in the default browser\",\n  )\n  .addOption(\n    new Option(\n      \"--login-flow <mode>\",\n      `How to log in; defaults to guessing based on the environment.`,\n    )\n      .choices([\"paste\", \"auto\", \"poll\"] as const)\n      .default(\"auto\" as const),\n  )\n  .addOption(new Option(\"--link-deployments\").hideHelp())\n  // These options are hidden from the help/usage message, but allow overriding settings for testing.\n  // Change the auth credentials with the auth provider\n  .addOption(new Option(\"--override-auth-url <url>\").hideHelp())\n  .addOption(new Option(\"--override-auth-client <id>\").hideHelp())\n  .addOption(new Option(\"--override-auth-username <username>\").hideHelp())\n  .addOption(new Option(\"--override-auth-password <password>\").hideHelp())\n  // Skip the auth provider login and directly use this access token\n  .addOption(new Option(\"--override-access-token <token>\").hideHelp())\n  // Automatically accept opt ins without prompting\n  .addOption(new Option(\"--accept-opt-ins\").hideHelp())\n  // Dump the access token from the auth provider and skip authorization with Convex\n  .addOption(new Option(\"--dump-access-token\").hideHelp())\n  // Hidden option for tests to check if the user is logged in.\n  .addOption(new Option(\"--check-login\").hideHelp())\n  // Redirect to Vercel SSO integration URL\n  .addOption(\n    new Option(\n      \"--vercel\",\n      \"Redirect to Vercel SSO integration for login\",\n    ).hideHelp(),\n  )\n  // Override the Vercel URL slug (defaults to 'convex')\n  .addOption(new Option(\"--vercel-override <slug>\").hideHelp())\n  .addCommand(loginStatus)\n  .addHelpCommand(false)\n  .action(async (options, cmd: Command) => {\n    const ctx = await oneoffContext({\n      url: undefined,\n      adminKey: undefined,\n      envFile: undefined,\n    });\n    if (\n      !options.force &&\n      (await checkAuthorization(ctx, !!options.acceptOptIns))\n    ) {\n      logFinishedStep(\n        \"This device has previously been authorized and is ready for use with Convex.\",\n      );\n      await handleLinkingDeployments(ctx, {\n        interactive: !!options.linkDeployments,\n      });\n      return;\n    }\n    if (!options.force && options.checkLogin) {\n      const isLoggedIn = await checkAuthorization(ctx, !!options.acceptOptIns);\n      if (!isLoggedIn) {\n        return ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          errForSentry: \"You are not logged in.\",\n          printedMessage: \"You are not logged in.\",\n        });\n      }\n    }\n    if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {\n      cmd.error(\n        \"If overriding credentials, both username and password must be provided\",\n      );\n    }\n\n    const uuid = loadUuidForAnonymousUser(ctx);\n    await performLogin(ctx, {\n      ...options,\n      anonymousId: uuid,\n      vercel: options.vercel,\n      vercelOverride: options.vercelOverride,\n    });\n\n    await handleLinkingDeployments(ctx, {\n      interactive: !!options.linkDeployments,\n    });\n  });\n\nasync function handleLinkingDeployments(\n  ctx: Context,\n  args: {\n    interactive: boolean;\n  },\n) {\n  if (!shouldAllowAnonymousDevelopment()) {\n    return;\n  }\n\n  // Check for project-local anonymous deployment first - this takes priority\n  const projectLocal = loadProjectLocalConfig(ctx);\n  if (\n    projectLocal !== null &&\n    isAnonymousDeployment(projectLocal.deploymentName)\n  ) {\n    const shouldLink = await promptYesNo(ctx, {\n      message: `Would you like to link your existing deployment to your account? (\"${projectLocal.deploymentName}\")`,\n      default: true,\n    });\n    if (!shouldLink) {\n      logMessage(\n        \"Not linking your existing deployment. If you want to link it later, run `npx convex login --link-deployments`.\",\n      );\n      logMessage(\n        `Visit ${DASHBOARD_HOST} or run \\`npx convex dev\\` to get started with your new account.`,\n      );\n      return;\n    }\n\n    const { dashboardUrl } = await linkSingleDeployment(\n      ctx,\n      projectLocal.deploymentName,\n      projectLocal.deploymentName,\n    );\n    logFinishedStep(`Visit ${dashboardUrl} to get started.`);\n    return;\n  }\n\n  // No project-local deployment - check for legacy deployments\n  const legacyDeployments = listLegacyAnonymousDeployments(ctx);\n  if (legacyDeployments.length === 0) {\n    if (args.interactive) {\n      logMessage(\n        \"It doesn't look like you have any deployments to link. You can run `npx convex dev` to set up a new project or select an existing one.\",\n      );\n    }\n    return;\n  }\n\n  // Get the currently configured deployment (if any) for env var updates\n  const deploymentSelection = await getDeploymentSelection(ctx, {\n    url: undefined,\n    adminKey: undefined,\n    envFile: undefined,\n  });\n  const configuredDeployment =\n    deploymentSelection.kind === \"anonymous\"\n      ? deploymentSelection.deploymentName\n      : null;\n\n  if (!args.interactive) {\n    // Non-interactive: link all legacy deployments automatically\n    const message = getMessage(legacyDeployments.map((d) => d.deploymentName));\n    const createProjects = await promptYesNo(ctx, {\n      message,\n      default: true,\n    });\n    if (!createProjects) {\n      logMessage(\n        \"Not linking your existing deployments. If you want to link them later, run `npx convex login --link-deployments`.\",\n      );\n      logMessage(\n        `Visit ${DASHBOARD_HOST} or run \\`npx convex dev\\` to get started with your new account.`,\n      );\n      return;\n    }\n\n    const {\n      team: { slug: teamSlug },\n    } = await validateOrSelectTeam(\n      ctx,\n      undefined,\n      \"Choose a team for your deployments:\",\n    );\n    let dashboardUrl = teamDashboardUrl(teamSlug);\n    for (const deployment of legacyDeployments) {\n      const result = await linkSingleDeployment(\n        ctx,\n        deployment.deploymentName,\n        configuredDeployment,\n        { teamSlug, projectSlug: null },\n      );\n      if (deployment.deploymentName === configuredDeployment) {\n        dashboardUrl = result.dashboardUrl;\n      }\n    }\n    logFinishedStep(\n      `Successfully linked your deployments! Visit ${dashboardUrl} to get started.`,\n    );\n    return;\n  }\n\n  // Interactive mode: let user choose which legacy deployments to link\n  while (true) {\n    const currentLegacyDeployments = listLegacyAnonymousDeployments(ctx);\n    if (currentLegacyDeployments.length === 0) {\n      logMessage(\"All deployments have been linked.\");\n      break;\n    }\n    logMessage(\n      getDeploymentListMessage(\n        currentLegacyDeployments.map((d) => d.deploymentName),\n      ),\n    );\n    const deploymentToLink = await promptSearch(ctx, {\n      message: \"Which deployment would you like to link to your account?\",\n      choices: currentLegacyDeployments.map((d) => ({\n        name: d.deploymentName,\n        value: d.deploymentName,\n      })),\n    });\n\n    await linkSingleDeployment(ctx, deploymentToLink, configuredDeployment);\n\n    const shouldContinue = await promptYesNo(ctx, {\n      message: \"Would you like to link another deployment?\",\n      default: true,\n    });\n    if (!shouldContinue) {\n      break;\n    }\n  }\n}\n\n/**\n * Link a single deployment to a project, prompting for team and project selection.\n * Updates env vars if this is the currently configured deployment.\n */\nasync function linkSingleDeployment(\n  ctx: Context,\n  deploymentName: string,\n  configuredDeployment: string | null,\n  options?: {\n    teamSlug?: string;\n    projectSlug?: string | null;\n  },\n): Promise<{ dashboardUrl: string }> {\n  const { team } = await validateOrSelectTeam(\n    ctx,\n    options?.teamSlug,\n    \"Choose a team for your deployment:\",\n  );\n\n  const projectSlug =\n    options?.projectSlug ??\n    (\n      await selectProject(ctx, \"ask\", {\n        team: team.slug,\n        devDeployment: \"local\",\n        defaultProjectName: removeAnonymousPrefix(deploymentName),\n      })\n    ).projectSlug;\n\n  const linkedDeployment = await handleLinkToProject(ctx, {\n    deploymentName,\n    teamSlug: team.slug,\n    teamId: team.id,\n    projectSlug,\n  });\n\n  if (deploymentName === configuredDeployment) {\n    await updateEnvAndConfigForDeploymentSelection(\n      ctx,\n      {\n        url: linkedDeployment.deploymentUrl,\n        deploymentName: linkedDeployment.deploymentName,\n        teamSlug: team.slug,\n        projectSlug: linkedDeployment.projectSlug,\n        deploymentType: \"local\",\n      },\n      configuredDeployment,\n    );\n  }\n\n  return {\n    dashboardUrl: deploymentDashboardUrlPage(\n      linkedDeployment.deploymentName,\n      \"\",\n    ),\n  };\n}\n\nfunction getDeploymentListMessage(anonymousDeploymentNames: string[]) {\n  let message = `You have ${anonymousDeploymentNames.length} existing deployments.`;\n  message += `\\n\\nDeployments:`;\n  for (const deploymentName of anonymousDeploymentNames) {\n    message += `\\n- ${deploymentName}`;\n  }\n  return message;\n}\n\nfunction getMessage(anonymousDeploymentNames: string[]) {\n  if (anonymousDeploymentNames.length === 1) {\n    return `Would you like to link your existing deployment to your account? (\"${anonymousDeploymentNames[0]}\")`;\n  }\n  let message = `You have ${anonymousDeploymentNames.length} existing deployments. Would you like to link them to your account?`;\n  message += `\\n\\nDeployments:`;\n  for (const deploymentName of anonymousDeploymentNames) {\n    message += `\\n- ${deploymentName}`;\n  }\n  message += `\\n\\nYou can alternatively run \\`npx convex login --link-deployments\\` to interactively choose which deployments to add.`;\n  return message;\n}\n"],
-  "mappings": ";AAAA,SAAS,SAAS,cAAc;AAChC,YAAY,YAAY;AACxB,SAAgC,qBAAqB;AACrD,SAAS,iBAAiB,YAAY,kBAAkB;AACxD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAc,mBAAmB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAOhC,SAAS,iBACP,KACA,YACA,OACe;AACf,aAAW,QAAQ,CAAC,mBAAmB,MAAM,GAAG;AAC9C,QAAI,CAAC,IAAI,GAAG,OAAO,IAAI,GAAG;AACxB;AAAA,IACF;AACA,QAAI,OAAO,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,EAAE,UAAU,MAAM,OAAO;AACjE,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAOA,eAAe,kCACb,KACA,MACA;AAEA,MACE,SAAS,QACT,KAAK,SAAS,iBACd,KAAK,SAAS,oBACd;AACA;AAAA,EACF;AACA,QAAM,MAAM,KAAK,SAAS,eAAe,KAAK,aAAa,KAAK;AAChE,QAAM,aAAa,QAAQ,IAAI,8BAA8B,IACzD,iCACA;AACJ,QAAM,UAAU,iBAAiB,KAAK,YAAY,GAAG;AACrD,QAAM,SAAS,WAAW;AAI1B,QAAM,SAAS,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAAC;AAC7C,MAAI,MAAM,mBAAmB,KAAK,UAAU,MAAM,EAAE,GAAG;AACrD,eAAW,4BAA4B,UAAU,OAAO,MAAM,EAAE;AAChE;AAAA,EACF;AACA,aAAW,8BAA8B,UAAU,OAAO,MAAM,EAAE;AACpE;AAEA,MAAM,cAAc,IAAI,QAAQ,QAAQ,EACrC,YAAY,8CAA8C,EAC1D,qBAAqB,KAAK,EAC1B,OAAO,YAAY;AAClB,QAAM,MAAM,MAAM,cAAc;AAAA,IAC9B,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AAID,QAAM,OAAO,IAAI,aAAa;AAE9B,QAAM,eAAe,iBAAiB,GAAG;AACzC,MAAI,iBAAiB,MAAM;AACzB,eAAW,qCAAqC,iBAAiB,CAAC,EAAE;AACpE,eAAW,uBAAuB;AAClC,UAAM,kCAAkC,KAAK,IAAI;AACjD;AAAA,EACF;AACA,aAAW,kCAAkC,iBAAiB,CAAC,EAAE;AAEjE,QAAM,cAAc,aAAa;AACjC,MAAI,CAAE,MAAM,mBAAmB,KAAK,UAAU,WAAW,EAAE,GAAI;AAC7D,eAAW,uBAAuB;AAClC,UAAM,kCAAkC,KAAK,IAAI;AACjD;AAAA,EACF;AAEA,aAAW,mBAAmB;AAE9B,MAAI,oBAAoB;AAAA,IACtB,MAAM;AAAA,IACN,QAAQ,UAAU,WAAW;AAAA,IAC7B;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,MAAM,gBAAgB,GAAG;AACvC;AAAA,IACE,UAAU,MAAM,MAAM,QAAQ,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,EAC7D;AACA,aAAW,QAAQ,OAAO;AACxB,eAAW,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG;AAAA,EAC9C;AACA,QAAM,kCAAkC,KAAK,IAAI;AACnD,CAAC;AAEI,aAAM,QAAQ,IAAI,QAAQ,OAAO,EACrC,YAAY,iBAAiB,EAC7B,qBAAqB,KAAK,EAC1B;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC;AAAA,EACA;AACF,EACC;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EACG,QAAQ,CAAC,SAAS,QAAQ,MAAM,CAAU,EAC1C,QAAQ,MAAe;AAC5B,EACC,UAAU,IAAI,OAAO,oBAAoB,EAAE,SAAS,CAAC,EAGrD,UAAU,IAAI,OAAO,2BAA2B,EAAE,SAAS,CAAC,EAC5D,UAAU,IAAI,OAAO,6BAA6B,EAAE,SAAS,CAAC,EAC9D,UAAU,IAAI,OAAO,qCAAqC,EAAE,SAAS,CAAC,EACtE,UAAU,IAAI,OAAO,qCAAqC,EAAE,SAAS,CAAC,EAEtE,UAAU,IAAI,OAAO,iCAAiC,EAAE,SAAS,CAAC,EAElE,UAAU,IAAI,OAAO,kBAAkB,EAAE,SAAS,CAAC,EAEnD,UAAU,IAAI,OAAO,qBAAqB,EAAE,SAAS,CAAC,EAEtD,UAAU,IAAI,OAAO,eAAe,EAAE,SAAS,CAAC,EAEhD;AAAA,EACC,IAAI;AAAA,IACF;AAAA,IACA;AAAA,EACF,EAAE,SAAS;AACb,EAEC,UAAU,IAAI,OAAO,0BAA0B,EAAE,SAAS,CAAC,EAC3D,WAAW,WAAW,EACtB,eAAe,KAAK,EACpB,OAAO,OAAO,SAAS,QAAiB;AACvC,QAAM,MAAM,MAAM,cAAc;AAAA,IAC9B,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACD,MACE,CAAC,QAAQ,SACR,MAAM,mBAAmB,KAAK,CAAC,CAAC,QAAQ,YAAY,GACrD;AACA;AAAA,MACE;AAAA,IACF;AACA,UAAM,yBAAyB,KAAK;AAAA,MAClC,aAAa,CAAC,CAAC,QAAQ;AAAA,IACzB,CAAC;AACD;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAS,QAAQ,YAAY;AACxC,UAAM,aAAa,MAAM,mBAAmB,KAAK,CAAC,CAAC,QAAQ,YAAY;AACvE,QAAI,CAAC,YAAY;AACf,aAAO,IAAI,MAAM;AAAA,QACf,UAAU;AAAA,QACV,WAAW;AAAA,QACX,cAAc;AAAA,QACd,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,CAAC,CAAC,QAAQ,yBAAyB,CAAC,CAAC,QAAQ,sBAAsB;AACrE,QAAI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,yBAAyB,GAAG;AACzC,QAAM,aAAa,KAAK;AAAA,IACtB,GAAG;AAAA,IACH,aAAa;AAAA,IACb,QAAQ,QAAQ;AAAA,IAChB,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AAED,QAAM,yBAAyB,KAAK;AAAA,IAClC,aAAa,CAAC,CAAC,QAAQ;AAAA,EACzB,CAAC;AACH,CAAC;AAEH,eAAe,yBACb,KACA,MAGA;AACA,MAAI,CAAC,gCAAgC,GAAG;AACtC;AAAA,EACF;AAGA,QAAM,eAAe,uBAAuB,GAAG;AAC/C,MACE,iBAAiB,QACjB,sBAAsB,aAAa,cAAc,GACjD;AACA,UAAM,aAAa,MAAM,YAAY,KAAK;AAAA,MACxC,SAAS,sEAAsE,aAAa,cAAc;AAAA,MAC1G,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,YAAY;AACf;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE,SAAS,cAAc;AAAA,MACzB;AACA;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM;AAAA,MAC7B;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AACA,oBAAgB,SAAS,YAAY,kBAAkB;AACvD;AAAA,EACF;AAGA,QAAM,oBAAoB,+BAA+B,GAAG;AAC5D,MAAI,kBAAkB,WAAW,GAAG;AAClC,QAAI,KAAK,aAAa;AACpB;AAAA,QACE;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAGA,QAAM,sBAAsB,MAAM,uBAAuB,KAAK;AAAA,IAC5D,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACD,QAAM,uBACJ,oBAAoB,SAAS,cACzB,oBAAoB,iBACpB;AAEN,MAAI,CAAC,KAAK,aAAa;AAErB,UAAM,UAAU,WAAW,kBAAkB,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;AACzE,UAAM,iBAAiB,MAAM,YAAY,KAAK;AAAA,MAC5C;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,gBAAgB;AACnB;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE,SAAS,cAAc;AAAA,MACzB;AACA;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,MAAM,EAAE,MAAM,SAAS;AAAA,IACzB,IAAI,MAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,eAAe,iBAAiB,QAAQ;AAC5C,eAAW,cAAc,mBAAmB;AAC1C,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,WAAW;AAAA,QACX;AAAA,QACA,EAAE,UAAU,aAAa,KAAK;AAAA,MAChC;AACA,UAAI,WAAW,mBAAmB,sBAAsB;AACtD,uBAAe,OAAO;AAAA,MACxB;AAAA,IACF;AACA;AAAA,MACE,+CAA+C,YAAY;AAAA,IAC7D;AACA;AAAA,EACF;AAGA,SAAO,MAAM;AACX,UAAM,2BAA2B,+BAA+B,GAAG;AACnE,QAAI,yBAAyB,WAAW,GAAG;AACzC,iBAAW,mCAAmC;AAC9C;AAAA,IACF;AACA;AAAA,MACE;AAAA,QACE,yBAAyB,IAAI,CAAC,MAAM,EAAE,cAAc;AAAA,MACtD;AAAA,IACF;AACA,UAAM,mBAAmB,MAAM,aAAa,KAAK;AAAA,MAC/C,SAAS;AAAA,MACT,SAAS,yBAAyB,IAAI,CAAC,OAAO;AAAA,QAC5C,MAAM,EAAE;AAAA,QACR,OAAO,EAAE;AAAA,MACX,EAAE;AAAA,IACJ,CAAC;AAED,UAAM,qBAAqB,KAAK,kBAAkB,oBAAoB;AAEtE,UAAM,iBAAiB,MAAM,YAAY,KAAK;AAAA,MAC5C,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,gBAAgB;AACnB;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAe,qBACb,KACA,gBACA,sBACA,SAImC;AACnC,QAAM,EAAE,KAAK,IAAI,MAAM;AAAA,IACrB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF;AAEA,QAAM,cACJ,SAAS,gBAEP,MAAM,cAAc,KAAK,OAAO;AAAA,IAC9B,MAAM,KAAK;AAAA,IACX,eAAe;AAAA,IACf,oBAAoB,sBAAsB,cAAc;AAAA,EAC1D,CAAC,GACD;AAEJ,QAAM,mBAAmB,MAAM,oBAAoB,KAAK;AAAA,IACtD;AAAA,IACA,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb;AAAA,EACF,CAAC;AAED,MAAI,mBAAmB,sBAAsB;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,KAAK,iBAAiB;AAAA,QACtB,gBAAgB,iBAAiB;AAAA,QACjC,UAAU,KAAK;AAAA,QACf,aAAa,iBAAiB;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,cAAc;AAAA,MACZ,iBAAiB;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,0BAAoC;AACpE,MAAI,UAAU,YAAY,yBAAyB,MAAM;AACzD,aAAW;AAAA;AAAA;AACX,aAAW,kBAAkB,0BAA0B;AACrD,eAAW;AAAA,IAAO,cAAc;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,0BAAoC;AACtD,MAAI,yBAAyB,WAAW,GAAG;AACzC,WAAO,sEAAsE,yBAAyB,CAAC,CAAC;AAAA,EAC1G;AACA,MAAI,UAAU,YAAY,yBAAyB,MAAM;AACzD,aAAW;AAAA;AAAA;AACX,aAAW,kBAAkB,0BAA0B;AACrD,eAAW;AAAA,IAAO,cAAc;AAAA,EAClC;AACA,aAAW;AAAA;AAAA;AACX,SAAO;AACT;",
-  "names": []
+  "sourcesContent": ["import { Command, Option } from \"@commander-js/extra-typings\";\nimport { BigBrainAuth, Context, oneoffContext } from \"../bundler/context.js\";\nimport { logFinishedStep, logMessage, logWarning } from \"../bundler/log.js\";\nimport {\n  checkAuthorization,\n  isAuthorizedHeader,\n  performLogin,\n} from \"./lib/login.js\";\nimport {\n  loadProjectLocalConfig,\n  loadUuidForAnonymousUser,\n} from \"./lib/localDeployment/filePaths.js\";\nimport {\n  handleLinkToProject,\n  listLegacyAnonymousDeployments,\n} from \"./lib/localDeployment/anonymous.js\";\nimport {\n  DASHBOARD_HOST,\n  deploymentDashboardUrlPage,\n  teamDashboardUrl,\n} from \"./lib/dashboard.js\";\nimport { promptSearch, promptYesNo } from \"./lib/utils/prompts.js\";\nimport { validateOrSelectTeam } from \"./lib/utils/utils.js\";\nimport {\n  selectProject,\n  updateEnvAndConfigForDeploymentSelection,\n} from \"./configure.js\";\nimport {\n  getDeploymentSelection,\n  shouldAllowAnonymousDevelopment,\n} from \"./lib/deploymentSelection.js\";\nimport {\n  isAnonymousDeployment,\n  removeAnonymousPrefix,\n} from \"./lib/deployment.js\";\nimport {\n  globalConfigPath,\n  readGlobalConfig,\n} from \"./lib/utils/globalConfig.js\";\nimport { getTeamsForUser } from \"./lib/api.js\";\nimport {\n  getProfileSelection,\n  initializeDefaultProfile,\n  legacyAuthForFirstProfile,\n  profileConfigPath,\n  readProfileAuth,\n  writeProfileCredentials,\n} from \"./lib/profiles.js\";\nimport {\n  getDeployKeySource,\n  loadProjectEnvironmentVariables,\n} from \"./lib/envvars.js\";\nimport { bindProfileToDirectory } from \"./lib/profileManagement.js\";\nimport { warnIfDeployKeyOverridesLogin } from \"./lib/deployKeyWarning.js\";\n\n/**\n * A project or deployment key in the environment outranks the account token for\n * commands run from this directory, and an expired one makes the CLI look\n * logged out, so report it separately from the account.\n */\nasync function reportDeployKeyInWorkingDirectory(\n  ctx: Context,\n  auth: BigBrainAuth | null,\n) {\n  // A preview deploy key is only used when there's no account token at all.\n  if (\n    auth === null ||\n    auth.kind === \"accessToken\" ||\n    auth.kind === \"previewDeployKey\"\n  ) {\n    return;\n  }\n  const key = auth.kind === \"projectKey\" ? auth.projectKey : auth.deploymentKey;\n  const { envVarName, source } = getDeployKeySource(key);\n  // Big Brain only strips a `project:`/`team:` prefix itself, so a deployment\n  // key authorizes only without its `dev:`/`prod:` prefix. Split on the first\n  // `|` like the server does, so a secret containing one survives.\n  const secret = key.slice(key.indexOf(\"|\") + 1);\n  if (await isAuthorizedHeader(ctx, `Bearer ${secret}`)) {\n    logMessage(`Working Directory: Valid ${envVarName} in ${source}`);\n    return;\n  }\n  logWarning(`Working Directory: Invalid ${envVarName} in ${source}`);\n}\n\nfunction createLoginStatusCommand() {\n  return new Command(\"status\")\n    .description(\n      \"Check login status and list accessible teams. Exits with code 1 when not logged in.\",\n    )\n    .allowExcessArguments(false)\n    .action(async () => {\n      const ctx = await oneoffContext({\n        url: undefined,\n        adminKey: undefined,\n        envFile: undefined,\n      });\n\n      // Keep the directory's deploy key for separate reporting after selecting\n      // the account whose teams will be listed.\n      const auth = ctx.bigBrainAuth();\n      let accountAuth = auth?.kind === \"accessToken\" ? auth : null;\n      if (accountAuth === null) {\n        const profile = await getProfileSelection(ctx);\n        if (profile !== null) {\n          accountAuth = await readProfileAuth(ctx, profile);\n        } else {\n          const globalConfig = readGlobalConfig(ctx);\n          if (globalConfig !== null) {\n            accountAuth = {\n              kind: \"accessToken\",\n              accessToken: globalConfig.accessToken,\n              header: `Bearer ${globalConfig.accessToken}`,\n              profile: null,\n            };\n          }\n        }\n      }\n      if (accountAuth === null) {\n        logMessage(`No Convex account token found in: ${globalConfigPath()}`);\n        logMessage(\"Status: Not logged in\");\n        await reportDeployKeyInWorkingDirectory(ctx, auth);\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: null,\n        });\n      }\n      warnIfDeployKeyOverridesLogin(ctx, true);\n      if (accountAuth.profile) {\n        logMessage(`Account: ${accountAuth.profile.name}`);\n        logMessage(`Selected by: ${accountAuth.profile.source}`);\n        logMessage(\n          `Convex account token found in: ${profileConfigPath(accountAuth.profile.name)}`,\n        );\n      } else if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {\n        logMessage(\"Using CONVEX_OVERRIDE_ACCESS_TOKEN from the environment\");\n      } else {\n        logMessage(`Convex account token found in: ${globalConfigPath()}`);\n      }\n\n      if (!(await isAuthorizedHeader(ctx, accountAuth.header))) {\n        logMessage(\"Status: Not logged in\");\n        await reportDeployKeyInWorkingDirectory(ctx, auth);\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: null,\n        });\n      }\n\n      logMessage(\"Status: Logged in\");\n      ctx._updateBigBrainAuth(accountAuth);\n      const teams = await getTeamsForUser(ctx);\n      logMessage(\n        `Teams: ${teams.length} team${teams.length === 1 ? \"\" : \"s\"} accessible`,\n      );\n      for (const team of teams) {\n        logMessage(`  - ${team.name} (${team.slug})`);\n      }\n      await reportDeployKeyInWorkingDirectory(ctx, auth);\n    });\n}\n\nexport function createLoginCommand() {\n  return (\n    new Command(\"login\")\n      .description(\"Login to Convex\")\n      .allowExcessArguments(false)\n      .option(\"--account <name>\", \"Log in to a named account\")\n      .option(\n        \"--select\",\n        \"Select this account for this directory and its subdirectories\",\n      )\n      .option(\n        \"--device-name <name>\",\n        \"Provide a name for the device being authorized\",\n      )\n      .option(\n        \"-f, --force\",\n        \"Proceed with login even if a valid access token already exists for this device\",\n      )\n      .option(\n        \"--no-open\",\n        \"Don't automatically open the login link in the default browser\",\n      )\n      .addOption(\n        new Option(\n          \"--login-flow <mode>\",\n          `How to log in; defaults to guessing based on the environment.`,\n        )\n          .choices([\"paste\", \"auto\", \"poll\"] as const)\n          .default(\"auto\" as const),\n      )\n      .addOption(new Option(\"--link-deployments\").hideHelp())\n      // These options are hidden from the help/usage message, but allow overriding settings for testing.\n      // Change the auth credentials with the auth provider\n      .addOption(new Option(\"--override-auth-url <url>\").hideHelp())\n      .addOption(new Option(\"--override-auth-client <id>\").hideHelp())\n      .addOption(new Option(\"--override-auth-username <username>\").hideHelp())\n      .addOption(new Option(\"--override-auth-password <password>\").hideHelp())\n      // Skip the auth provider login and directly use this access token\n      .addOption(new Option(\"--override-access-token <token>\").hideHelp())\n      // Automatically accept opt ins without prompting\n      .addOption(new Option(\"--accept-opt-ins\").hideHelp())\n      // Dump the access token from the auth provider and skip authorization with Convex\n      .addOption(new Option(\"--dump-access-token\").hideHelp())\n      // Hidden option for tests to check if the user is logged in.\n      .addOption(new Option(\"--check-login\").hideHelp())\n      // Redirect to Vercel SSO integration URL\n      .addOption(\n        new Option(\n          \"--vercel\",\n          \"Redirect to Vercel SSO integration for login\",\n        ).hideHelp(),\n      )\n      // Override the Vercel URL slug (defaults to 'convex')\n      .addOption(new Option(\"--vercel-override <slug>\").hideHelp())\n      .addCommand(createLoginStatusCommand())\n      .addHelpCommand(false)\n      .action(async (options, cmd: Command) => {\n        const ctx = await oneoffContext({\n          url: undefined,\n          adminKey: undefined,\n          envFile: undefined,\n          skipAuth: true,\n        });\n        const profile = await getProfileSelection(ctx, {\n          name: options.account,\n        });\n        if (options.select && profile === null) {\n          cmd.error(\"Pass --account <name> with --select to name this login.\");\n        }\n        loadProjectEnvironmentVariables();\n        let namingLegacyAccount = false;\n        if (profile !== null) {\n          let auth = options.force\n            ? null\n            : await readProfileAuth(ctx, profile, true);\n          if (\n            auth === null &&\n            !options.force &&\n            !options.overrideAccessToken &&\n            !options.overrideAuthUsername &&\n            !process.env.CONVEX_OVERRIDE_ACCESS_TOKEN\n          ) {\n            auth = await legacyAuthForFirstProfile(ctx, profile);\n            namingLegacyAccount = auth !== null;\n          }\n          ctx._updateBigBrainAuth(auth);\n        } else {\n          const accessToken =\n            process.env.CONVEX_OVERRIDE_ACCESS_TOKEN ||\n            readGlobalConfig(ctx)?.accessToken;\n          ctx._updateBigBrainAuth(\n            accessToken\n              ? {\n                  kind: \"accessToken\",\n                  accessToken,\n                  header: `Bearer ${accessToken}`,\n                  profile: null,\n                }\n              : null,\n          );\n        }\n        warnIfDeployKeyOverridesLogin(ctx, ctx.bigBrainAuth() !== null);\n        if (\n          !options.force &&\n          (await checkAuthorization(ctx, !!options.acceptOptIns))\n        ) {\n          const auth = ctx.bigBrainAuth();\n          if (\n            namingLegacyAccount &&\n            profile !== null &&\n            auth?.kind === \"accessToken\"\n          ) {\n            await writeProfileCredentials(\n              ctx,\n              profile.name,\n              auth.accessToken,\n              {},\n              null,\n            );\n          }\n          logFinishedStep(\n            profile !== null\n              ? namingLegacyAccount\n                ? `Saved account \"${profile.name}\" using your existing login.`\n                : `Account \"${profile.name}\" is already logged in.`\n              : \"This device has previously been authorized and is ready for use with Convex.\",\n          );\n          if (profile !== null && auth?.kind === \"accessToken\") {\n            await initializeDefaultProfile(\n              ctx,\n              profile,\n              namingLegacyAccount,\n              !!options.select,\n            );\n          }\n          if (options.select && profile !== null) {\n            if (!(await bindProfileToDirectory(ctx, profile.name))) {\n              return await ctx.crash({\n                exitCode: 1,\n                errorType: \"fatal\",\n                printedMessage: `Logged in as \"${profile.name}\", but the directory selection could not be changed.`,\n              });\n            }\n          }\n          await handleLinkingDeployments(ctx, {\n            interactive: !!options.linkDeployments,\n          });\n          return;\n        }\n        if (!options.force && options.checkLogin) {\n          const isLoggedIn = await checkAuthorization(\n            ctx,\n            !!options.acceptOptIns,\n          );\n          if (!isLoggedIn) {\n            return ctx.crash({\n              exitCode: 1,\n              errorType: \"fatal\",\n              errForSentry: \"You are not logged in.\",\n              printedMessage: \"You are not logged in.\",\n            });\n          }\n        }\n        if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {\n          cmd.error(\n            \"If overriding credentials, both username and password must be provided\",\n          );\n        }\n\n        const uuid = loadUuidForAnonymousUser(ctx);\n        await performLogin(ctx, {\n          ...options,\n          profile,\n          anonymousId: uuid,\n          vercel: options.vercel,\n          vercelOverride: options.vercelOverride,\n        });\n\n        const auth = ctx.bigBrainAuth();\n        if (profile !== null && auth?.kind === \"accessToken\") {\n          await initializeDefaultProfile(\n            ctx,\n            profile,\n            namingLegacyAccount,\n            !!options.select,\n          );\n        }\n        if (options.select && profile !== null) {\n          if (!(await bindProfileToDirectory(ctx, profile.name))) {\n            return await ctx.crash({\n              exitCode: 1,\n              errorType: \"fatal\",\n              printedMessage: `Logged in as \"${profile.name}\", but the directory selection could not be changed.`,\n            });\n          }\n        }\n        warnIfDeployKeyOverridesLogin(ctx, true);\n\n        await handleLinkingDeployments(ctx, {\n          interactive: !!options.linkDeployments,\n        });\n      })\n  );\n}\n\nexport const login = createLoginCommand();\n\nasync function handleLinkingDeployments(\n  ctx: Context,\n  args: {\n    interactive: boolean;\n  },\n) {\n  if (!shouldAllowAnonymousDevelopment()) {\n    return;\n  }\n\n  // Check for project-local anonymous deployment first - this takes priority\n  const projectLocal = loadProjectLocalConfig(ctx);\n  if (\n    projectLocal !== null &&\n    isAnonymousDeployment(projectLocal.deploymentName)\n  ) {\n    const shouldLink = await promptYesNo(ctx, {\n      message: `Would you like to link your existing deployment to your account? (\"${projectLocal.deploymentName}\")`,\n      default: true,\n    });\n    if (!shouldLink) {\n      logMessage(\n        \"Not linking your existing deployment. If you want to link it later, run `npx convex login --link-deployments`.\",\n      );\n      logMessage(\n        `Visit ${DASHBOARD_HOST} or run \\`npx convex dev\\` to get started with your new account.`,\n      );\n      return;\n    }\n\n    const { dashboardUrl } = await linkSingleDeployment(\n      ctx,\n      projectLocal.deploymentName,\n      projectLocal.deploymentName,\n    );\n    logFinishedStep(`Visit ${dashboardUrl} to get started.`);\n    return;\n  }\n\n  // No project-local deployment - check for legacy deployments\n  const legacyDeployments = listLegacyAnonymousDeployments(ctx);\n  if (legacyDeployments.length === 0) {\n    if (args.interactive) {\n      logMessage(\n        \"It doesn't look like you have any deployments to link. You can run `npx convex dev` to set up a new project or select an existing one.\",\n      );\n    }\n    return;\n  }\n\n  // Get the currently configured deployment (if any) for env var updates\n  const deploymentSelection = await getDeploymentSelection(ctx, {\n    url: undefined,\n    adminKey: undefined,\n    envFile: undefined,\n  });\n  const configuredDeployment =\n    deploymentSelection.kind === \"anonymous\"\n      ? deploymentSelection.deploymentName\n      : null;\n\n  if (!args.interactive) {\n    // Non-interactive: link all legacy deployments automatically\n    const message = getMessage(legacyDeployments.map((d) => d.deploymentName));\n    const createProjects = await promptYesNo(ctx, {\n      message,\n      default: true,\n    });\n    if (!createProjects) {\n      logMessage(\n        \"Not linking your existing deployments. If you want to link them later, run `npx convex login --link-deployments`.\",\n      );\n      logMessage(\n        `Visit ${DASHBOARD_HOST} or run \\`npx convex dev\\` to get started with your new account.`,\n      );\n      return;\n    }\n\n    const {\n      team: { slug: teamSlug },\n    } = await validateOrSelectTeam(\n      ctx,\n      undefined,\n      \"Choose a team for your deployments:\",\n    );\n    let dashboardUrl = teamDashboardUrl(teamSlug);\n    for (const deployment of legacyDeployments) {\n      const result = await linkSingleDeployment(\n        ctx,\n        deployment.deploymentName,\n        configuredDeployment,\n        { teamSlug, projectSlug: null },\n      );\n      if (deployment.deploymentName === configuredDeployment) {\n        dashboardUrl = result.dashboardUrl;\n      }\n    }\n    logFinishedStep(\n      `Successfully linked your deployments! Visit ${dashboardUrl} to get started.`,\n    );\n    return;\n  }\n\n  // Interactive mode: let user choose which legacy deployments to link\n  while (true) {\n    const currentLegacyDeployments = listLegacyAnonymousDeployments(ctx);\n    if (currentLegacyDeployments.length === 0) {\n      logMessage(\"All deployments have been linked.\");\n      break;\n    }\n    logMessage(\n      getDeploymentListMessage(\n        currentLegacyDeployments.map((d) => d.deploymentName),\n      ),\n    );\n    const deploymentToLink = await promptSearch(ctx, {\n      message: \"Which deployment would you like to link to your account?\",\n      choices: currentLegacyDeployments.map((d) => ({\n        name: d.deploymentName,\n        value: d.deploymentName,\n      })),\n    });\n\n    await linkSingleDeployment(ctx, deploymentToLink, configuredDeployment);\n\n    const shouldContinue = await promptYesNo(ctx, {\n      message: \"Would you like to link another deployment?\",\n      default: true,\n    });\n    if (!shouldContinue) {\n      break;\n    }\n  }\n}\n\n/**\n * Link a single deployment to a project, prompting for team and project selection.\n * Updates env vars if this is the currently configured deployment.\n */\nasync function linkSingleDeployment(\n  ctx: Context,\n  deploymentName: string,\n  configuredDeployment: string | null,\n  options?: {\n    teamSlug?: string;\n    projectSlug?: string | null;\n  },\n): Promise<{ dashboardUrl: string }> {\n  const { team } = await validateOrSelectTeam(\n    ctx,\n    options?.teamSlug,\n    \"Choose a team for your deployment:\",\n  );\n\n  const projectSlug =\n    options?.projectSlug ??\n    (\n      await selectProject(ctx, \"ask\", {\n        team: team.slug,\n        devDeployment: \"local\",\n        defaultProjectName: removeAnonymousPrefix(deploymentName),\n      })\n    ).projectSlug;\n\n  const linkedDeployment = await handleLinkToProject(ctx, {\n    deploymentName,\n    teamSlug: team.slug,\n    teamId: team.id,\n    projectSlug,\n  });\n\n  if (deploymentName === configuredDeployment) {\n    await updateEnvAndConfigForDeploymentSelection(\n      ctx,\n      {\n        url: linkedDeployment.deploymentUrl,\n        deploymentName: linkedDeployment.deploymentName,\n        teamSlug: team.slug,\n        projectSlug: linkedDeployment.projectSlug,\n        deploymentType: \"local\",\n      },\n      configuredDeployment,\n    );\n  }\n\n  return {\n    dashboardUrl: deploymentDashboardUrlPage(\n      linkedDeployment.deploymentName,\n      \"\",\n    ),\n  };\n}\n\nfunction getDeploymentListMessage(anonymousDeploymentNames: string[]) {\n  let message = `You have ${anonymousDeploymentNames.length} existing deployments.`;\n  message += `\\n\\nDeployments:`;\n  for (const deploymentName of anonymousDeploymentNames) {\n    message += `\\n- ${deploymentName}`;\n  }\n  return message;\n}\n\nfunction getMessage(anonymousDeploymentNames: string[]) {\n  if (anonymousDeploymentNames.length === 1) {\n    return `Would you like to link your existing deployment to your account? (\"${anonymousDeploymentNames[0]}\")`;\n  }\n  let message = `You have ${anonymousDeploymentNames.length} existing deployments. Would you like to link them to your account?`;\n  message += `\\n\\nDeployments:`;\n  for (const deploymentName of anonymousDeploymentNames) {\n    message += `\\n- ${deploymentName}`;\n  }\n  message += `\\n\\nYou can alternatively run \\`npx convex login --link-deployments\\` to interactively choose which deployments to add.`;\n  return message;\n}\n"],
+  "mappings": ";AAAA,SAAS,SAAS,cAAc;AAChC,SAAgC,qBAAqB;AACrD,SAAS,iBAAiB,YAAY,kBAAkB;AACxD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAc,mBAAmB;AAC1C,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,qCAAqC;AAO9C,eAAe,kCACb,KACA,MACA;AAEA,MACE,SAAS,QACT,KAAK,SAAS,iBACd,KAAK,SAAS,oBACd;AACA;AAAA,EACF;AACA,QAAM,MAAM,KAAK,SAAS,eAAe,KAAK,aAAa,KAAK;AAChE,QAAM,EAAE,YAAY,OAAO,IAAI,mBAAmB,GAAG;AAIrD,QAAM,SAAS,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAAC;AAC7C,MAAI,MAAM,mBAAmB,KAAK,UAAU,MAAM,EAAE,GAAG;AACrD,eAAW,4BAA4B,UAAU,OAAO,MAAM,EAAE;AAChE;AAAA,EACF;AACA,aAAW,8BAA8B,UAAU,OAAO,MAAM,EAAE;AACpE;AAEA,SAAS,2BAA2B;AAClC,SAAO,IAAI,QAAQ,QAAQ,EACxB;AAAA,IACC;AAAA,EACF,EACC,qBAAqB,KAAK,EAC1B,OAAO,YAAY;AAClB,UAAM,MAAM,MAAM,cAAc;AAAA,MAC9B,KAAK;AAAA,MACL,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AAID,UAAM,OAAO,IAAI,aAAa;AAC9B,QAAI,cAAc,MAAM,SAAS,gBAAgB,OAAO;AACxD,QAAI,gBAAgB,MAAM;AACxB,YAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,UAAI,YAAY,MAAM;AACpB,sBAAc,MAAM,gBAAgB,KAAK,OAAO;AAAA,MAClD,OAAO;AACL,cAAM,eAAe,iBAAiB,GAAG;AACzC,YAAI,iBAAiB,MAAM;AACzB,wBAAc;AAAA,YACZ,MAAM;AAAA,YACN,aAAa,aAAa;AAAA,YAC1B,QAAQ,UAAU,aAAa,WAAW;AAAA,YAC1C,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,gBAAgB,MAAM;AACxB,iBAAW,qCAAqC,iBAAiB,CAAC,EAAE;AACpE,iBAAW,uBAAuB;AAClC,YAAM,kCAAkC,KAAK,IAAI;AACjD,aAAO,MAAM,IAAI,MAAM;AAAA,QACrB,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AACA,kCAA8B,KAAK,IAAI;AACvC,QAAI,YAAY,SAAS;AACvB,iBAAW,YAAY,YAAY,QAAQ,IAAI,EAAE;AACjD,iBAAW,gBAAgB,YAAY,QAAQ,MAAM,EAAE;AACvD;AAAA,QACE,kCAAkC,kBAAkB,YAAY,QAAQ,IAAI,CAAC;AAAA,MAC/E;AAAA,IACF,WAAW,QAAQ,IAAI,8BAA8B;AACnD,iBAAW,yDAAyD;AAAA,IACtE,OAAO;AACL,iBAAW,kCAAkC,iBAAiB,CAAC,EAAE;AAAA,IACnE;AAEA,QAAI,CAAE,MAAM,mBAAmB,KAAK,YAAY,MAAM,GAAI;AACxD,iBAAW,uBAAuB;AAClC,YAAM,kCAAkC,KAAK,IAAI;AACjD,aAAO,MAAM,IAAI,MAAM;AAAA,QACrB,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH;AAEA,eAAW,mBAAmB;AAC9B,QAAI,oBAAoB,WAAW;AACnC,UAAM,QAAQ,MAAM,gBAAgB,GAAG;AACvC;AAAA,MACE,UAAU,MAAM,MAAM,QAAQ,MAAM,WAAW,IAAI,KAAK,GAAG;AAAA,IAC7D;AACA,eAAW,QAAQ,OAAO;AACxB,iBAAW,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG;AAAA,IAC9C;AACA,UAAM,kCAAkC,KAAK,IAAI;AAAA,EACnD,CAAC;AACL;AAEO,gBAAS,qBAAqB;AACnC,SACE,IAAI,QAAQ,OAAO,EAChB,YAAY,iBAAiB,EAC7B,qBAAqB,KAAK,EAC1B,OAAO,oBAAoB,2BAA2B,EACtD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC,IAAI;AAAA,MACF;AAAA,MACA;AAAA,IACF,EACG,QAAQ,CAAC,SAAS,QAAQ,MAAM,CAAU,EAC1C,QAAQ,MAAe;AAAA,EAC5B,EACC,UAAU,IAAI,OAAO,oBAAoB,EAAE,SAAS,CAAC,EAGrD,UAAU,IAAI,OAAO,2BAA2B,EAAE,SAAS,CAAC,EAC5D,UAAU,IAAI,OAAO,6BAA6B,EAAE,SAAS,CAAC,EAC9D,UAAU,IAAI,OAAO,qCAAqC,EAAE,SAAS,CAAC,EACtE,UAAU,IAAI,OAAO,qCAAqC,EAAE,SAAS,CAAC,EAEtE,UAAU,IAAI,OAAO,iCAAiC,EAAE,SAAS,CAAC,EAElE,UAAU,IAAI,OAAO,kBAAkB,EAAE,SAAS,CAAC,EAEnD,UAAU,IAAI,OAAO,qBAAqB,EAAE,SAAS,CAAC,EAEtD,UAAU,IAAI,OAAO,eAAe,EAAE,SAAS,CAAC,EAEhD;AAAA,IACC,IAAI;AAAA,MACF;AAAA,MACA;AAAA,IACF,EAAE,SAAS;AAAA,EACb,EAEC,UAAU,IAAI,OAAO,0BAA0B,EAAE,SAAS,CAAC,EAC3D,WAAW,yBAAyB,CAAC,EACrC,eAAe,KAAK,EACpB,OAAO,OAAO,SAAS,QAAiB;AACvC,UAAM,MAAM,MAAM,cAAc;AAAA,MAC9B,KAAK;AAAA,MACL,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,UAAU,MAAM,oBAAoB,KAAK;AAAA,MAC7C,MAAM,QAAQ;AAAA,IAChB,CAAC;AACD,QAAI,QAAQ,UAAU,YAAY,MAAM;AACtC,UAAI,MAAM,yDAAyD;AAAA,IACrE;AACA,oCAAgC;AAChC,QAAI,sBAAsB;AAC1B,QAAI,YAAY,MAAM;AACpB,UAAIA,QAAO,QAAQ,QACf,OACA,MAAM,gBAAgB,KAAK,SAAS,IAAI;AAC5C,UACEA,UAAS,QACT,CAAC,QAAQ,SACT,CAAC,QAAQ,uBACT,CAAC,QAAQ,wBACT,CAAC,QAAQ,IAAI,8BACb;AACA,QAAAA,QAAO,MAAM,0BAA0B,KAAK,OAAO;AACnD,8BAAsBA,UAAS;AAAA,MACjC;AACA,UAAI,oBAAoBA,KAAI;AAAA,IAC9B,OAAO;AACL,YAAM,cACJ,QAAQ,IAAI,gCACZ,iBAAiB,GAAG,GAAG;AACzB,UAAI;AAAA,QACF,cACI;AAAA,UACE,MAAM;AAAA,UACN;AAAA,UACA,QAAQ,UAAU,WAAW;AAAA,UAC7B,SAAS;AAAA,QACX,IACA;AAAA,MACN;AAAA,IACF;AACA,kCAA8B,KAAK,IAAI,aAAa,MAAM,IAAI;AAC9D,QACE,CAAC,QAAQ,SACR,MAAM,mBAAmB,KAAK,CAAC,CAAC,QAAQ,YAAY,GACrD;AACA,YAAMA,QAAO,IAAI,aAAa;AAC9B,UACE,uBACA,YAAY,QACZA,OAAM,SAAS,eACf;AACA,cAAM;AAAA,UACJ;AAAA,UACA,QAAQ;AAAA,UACRA,MAAK;AAAA,UACL,CAAC;AAAA,UACD;AAAA,QACF;AAAA,MACF;AACA;AAAA,QACE,YAAY,OACR,sBACE,kBAAkB,QAAQ,IAAI,iCAC9B,YAAY,QAAQ,IAAI,4BAC1B;AAAA,MACN;AACA,UAAI,YAAY,QAAQA,OAAM,SAAS,eAAe;AACpD,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,UACA;AAAA,UACA,CAAC,CAAC,QAAQ;AAAA,QACZ;AAAA,MACF;AACA,UAAI,QAAQ,UAAU,YAAY,MAAM;AACtC,YAAI,CAAE,MAAM,uBAAuB,KAAK,QAAQ,IAAI,GAAI;AACtD,iBAAO,MAAM,IAAI,MAAM;AAAA,YACrB,UAAU;AAAA,YACV,WAAW;AAAA,YACX,gBAAgB,iBAAiB,QAAQ,IAAI;AAAA,UAC/C,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,yBAAyB,KAAK;AAAA,QAClC,aAAa,CAAC,CAAC,QAAQ;AAAA,MACzB,CAAC;AACD;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,SAAS,QAAQ,YAAY;AACxC,YAAM,aAAa,MAAM;AAAA,QACvB;AAAA,QACA,CAAC,CAAC,QAAQ;AAAA,MACZ;AACA,UAAI,CAAC,YAAY;AACf,eAAO,IAAI,MAAM;AAAA,UACf,UAAU;AAAA,UACV,WAAW;AAAA,UACX,cAAc;AAAA,UACd,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,CAAC,QAAQ,yBAAyB,CAAC,CAAC,QAAQ,sBAAsB;AACrE,UAAI;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,yBAAyB,GAAG;AACzC,UAAM,aAAa,KAAK;AAAA,MACtB,GAAG;AAAA,MACH;AAAA,MACA,aAAa;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AAED,UAAM,OAAO,IAAI,aAAa;AAC9B,QAAI,YAAY,QAAQ,MAAM,SAAS,eAAe;AACpD,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAC,CAAC,QAAQ;AAAA,MACZ;AAAA,IACF;AACA,QAAI,QAAQ,UAAU,YAAY,MAAM;AACtC,UAAI,CAAE,MAAM,uBAAuB,KAAK,QAAQ,IAAI,GAAI;AACtD,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB,iBAAiB,QAAQ,IAAI;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,IACF;AACA,kCAA8B,KAAK,IAAI;AAEvC,UAAM,yBAAyB,KAAK;AAAA,MAClC,aAAa,CAAC,CAAC,QAAQ;AAAA,IACzB,CAAC;AAAA,EACH,CAAC;AAEP;AAEO,aAAM,QAAQ,mBAAmB;AAExC,eAAe,yBACb,KACA,MAGA;AACA,MAAI,CAAC,gCAAgC,GAAG;AACtC;AAAA,EACF;AAGA,QAAM,eAAe,uBAAuB,GAAG;AAC/C,MACE,iBAAiB,QACjB,sBAAsB,aAAa,cAAc,GACjD;AACA,UAAM,aAAa,MAAM,YAAY,KAAK;AAAA,MACxC,SAAS,sEAAsE,aAAa,cAAc;AAAA,MAC1G,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,YAAY;AACf;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE,SAAS,cAAc;AAAA,MACzB;AACA;AAAA,IACF;AAEA,UAAM,EAAE,aAAa,IAAI,MAAM;AAAA,MAC7B;AAAA,MACA,aAAa;AAAA,MACb,aAAa;AAAA,IACf;AACA,oBAAgB,SAAS,YAAY,kBAAkB;AACvD;AAAA,EACF;AAGA,QAAM,oBAAoB,+BAA+B,GAAG;AAC5D,MAAI,kBAAkB,WAAW,GAAG;AAClC,QAAI,KAAK,aAAa;AACpB;AAAA,QACE;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAGA,QAAM,sBAAsB,MAAM,uBAAuB,KAAK;AAAA,IAC5D,KAAK;AAAA,IACL,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACD,QAAM,uBACJ,oBAAoB,SAAS,cACzB,oBAAoB,iBACpB;AAEN,MAAI,CAAC,KAAK,aAAa;AAErB,UAAM,UAAU,WAAW,kBAAkB,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;AACzE,UAAM,iBAAiB,MAAM,YAAY,KAAK;AAAA,MAC5C;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,gBAAgB;AACnB;AAAA,QACE;AAAA,MACF;AACA;AAAA,QACE,SAAS,cAAc;AAAA,MACzB;AACA;AAAA,IACF;AAEA,UAAM;AAAA,MACJ,MAAM,EAAE,MAAM,SAAS;AAAA,IACzB,IAAI,MAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,eAAe,iBAAiB,QAAQ;AAC5C,eAAW,cAAc,mBAAmB;AAC1C,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,WAAW;AAAA,QACX;AAAA,QACA,EAAE,UAAU,aAAa,KAAK;AAAA,MAChC;AACA,UAAI,WAAW,mBAAmB,sBAAsB;AACtD,uBAAe,OAAO;AAAA,MACxB;AAAA,IACF;AACA;AAAA,MACE,+CAA+C,YAAY;AAAA,IAC7D;AACA;AAAA,EACF;AAGA,SAAO,MAAM;AACX,UAAM,2BAA2B,+BAA+B,GAAG;AACnE,QAAI,yBAAyB,WAAW,GAAG;AACzC,iBAAW,mCAAmC;AAC9C;AAAA,IACF;AACA;AAAA,MACE;AAAA,QACE,yBAAyB,IAAI,CAAC,MAAM,EAAE,cAAc;AAAA,MACtD;AAAA,IACF;AACA,UAAM,mBAAmB,MAAM,aAAa,KAAK;AAAA,MAC/C,SAAS;AAAA,MACT,SAAS,yBAAyB,IAAI,CAAC,OAAO;AAAA,QAC5C,MAAM,EAAE;AAAA,QACR,OAAO,EAAE;AAAA,MACX,EAAE;AAAA,IACJ,CAAC;AAED,UAAM,qBAAqB,KAAK,kBAAkB,oBAAoB;AAEtE,UAAM,iBAAiB,MAAM,YAAY,KAAK;AAAA,MAC5C,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,gBAAgB;AACnB;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAe,qBACb,KACA,gBACA,sBACA,SAImC;AACnC,QAAM,EAAE,KAAK,IAAI,MAAM;AAAA,IACrB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF;AAEA,QAAM,cACJ,SAAS,gBAEP,MAAM,cAAc,KAAK,OAAO;AAAA,IAC9B,MAAM,KAAK;AAAA,IACX,eAAe;AAAA,IACf,oBAAoB,sBAAsB,cAAc;AAAA,EAC1D,CAAC,GACD;AAEJ,QAAM,mBAAmB,MAAM,oBAAoB,KAAK;AAAA,IACtD;AAAA,IACA,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb;AAAA,EACF,CAAC;AAED,MAAI,mBAAmB,sBAAsB;AAC3C,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,KAAK,iBAAiB;AAAA,QACtB,gBAAgB,iBAAiB;AAAA,QACjC,UAAU,KAAK;AAAA,QACf,aAAa,iBAAiB;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,cAAc;AAAA,MACZ,iBAAiB;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,0BAAoC;AACpE,MAAI,UAAU,YAAY,yBAAyB,MAAM;AACzD,aAAW;AAAA;AAAA;AACX,aAAW,kBAAkB,0BAA0B;AACrD,eAAW;AAAA,IAAO,cAAc;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,0BAAoC;AACtD,MAAI,yBAAyB,WAAW,GAAG;AACzC,WAAO,sEAAsE,yBAAyB,CAAC,CAAC;AAAA,EAC1G;AACA,MAAI,UAAU,YAAY,yBAAyB,MAAM;AACzD,aAAW;AAAA;AAAA;AACX,aAAW,kBAAkB,0BAA0B;AACrD,eAAW;AAAA,IAAO,cAAc;AAAA,EAClC;AACA,aAAW;AAAA;AAAA;AACX,SAAO;AACT;",
+  "names": ["auth"]
 }

package/dist/esm/cli/logout.js

@@ -1,20 +1,117 @@
 "use strict";
 import { Command } from "@commander-js/extra-typings";
 import { oneoffContext } from "../bundler/context.js";
-import { logFinishedStep } from "../bundler/log.js";
+import { logFinishedStep, logMessage, logWarning } from "../bundler/log.js";
 import { recursivelyDelete } from "./lib/fsUtils.js";
 import { globalConfigPath } from "./lib/utils/globalConfig.js";
-export const logout = new Command("logout").description("Log out of Convex on this machine").allowExcessArguments(false).action(async () => {
-  const ctx = await oneoffContext({
-    url: void 0,
-    adminKey: void 0,
-    envFile: void 0
+import {
+  getProfileSelection,
+  profileConfigPath,
+  readProfileToken,
+  readProfileSettings,
+  updateProfileSettings,
+  savedProfileNames
+} from "./lib/profiles.js";
+import path from "path";
+import { rootDirectory } from "./lib/utils/utils.js";
+import { promptOptions } from "./lib/utils/prompts.js";
+export function createLogoutCommand() {
+  return new Command("logout").description(
+    "Log out of the selected account. Directory selections are preserved."
+  ).option("--account <name>", "Remove only this account's saved credentials").option(
+    "--all",
+    "Remove all saved account credentials, preserving account selections"
+  ).allowExcessArguments(false).action(async (options, cmd) => {
+    if (options.all && options.account !== void 0)
+      cmd.error("Pass either --account or --all, not both.");
+    const ctx = await oneoffContext({
+      url: void 0,
+      adminKey: void 0,
+      envFile: void 0,
+      skipAuth: true
+    });
+    let all = !!options.all;
+    let profile = all ? null : await getProfileSelection(ctx, { name: options.account });
+    if (!all && options.account === void 0 && process.stdin.isTTY && profile !== null) {
+      const token = readProfileToken(ctx, profile.name);
+      const settings = await readProfileSettings(ctx);
+      const selectedName = profile.name;
+      const hasOtherLogins = savedProfileNames(ctx).some((name) => name !== selectedName) || typeof settings.accessToken === "string" && settings.accessToken.length > 0 && settings.accessToken !== token;
+      if (hasOtherLogins) {
+        const scope = await promptOptions(ctx, {
+          message: "Which saved logins would you like to log out of?",
+          choices: [
+            { name: `Only account "${profile.name}"`, value: "profile" },
+            { name: "All saved logins on this device", value: "all" }
+          ],
+          default: "profile"
+        });
+        if (scope === "all") {
+          profile = null;
+          all = true;
+        }
+      }
+    }
+    let warnAboutLegacyCredentials = false;
+    if (profile !== null) {
+      const selectedName = profile.name;
+      await updateProfileSettings(
+        ctx,
+        (settings) => {
+          const token = readProfileToken(ctx, selectedName);
+          if (token !== null && settings.accessToken === token) {
+            delete settings.accessToken;
+          } else if (settings.defaultProfile === selectedName && typeof settings.accessToken === "string" && settings.accessToken.length > 0) {
+            warnAboutLegacyCredentials = true;
+          }
+        },
+        () => {
+          const configPath = profileConfigPath(selectedName);
+          recursivelyDelete(ctx, configPath, {
+            force: true,
+            followSymlinks: false
+          });
+        }
+      );
+    } else {
+      await updateProfileSettings(
+        ctx,
+        async (settings) => {
+          if (!all && savedProfileNames(ctx).length > 0 && settings.accessToken === void 0) {
+            return await ctx.crash({
+              exitCode: 1,
+              errorType: "fatal",
+              printedMessage: "No account is selected. Use `npx convex logout --account <name>` or `npx convex logout --all`."
+            });
+          }
+          delete settings.accessToken;
+        },
+        () => {
+          const profilesDir = path.join(rootDirectory(), "profiles");
+          if (all)
+            recursivelyDelete(ctx, profilesDir, {
+              force: true,
+              followSymlinks: false
+            });
+        }
+      );
+    }
+    logFinishedStep(
+      profile !== null ? `Removed credentials for account "${profile.name}".
+  Run \`npx convex login --account ${profile.name}\` to log in.` : `${all ? "Removed all saved Convex account credentials." : "Removed your saved Convex login credentials."}
+  Run \`npx convex login\` to log in.`
+    );
+    if (warnAboutLegacyCredentials) {
+      logWarning(
+        `Saved credentials remain in ${globalConfigPath()} for older CLI versions. To remove all saved account credentials, run \`npx convex logout --all\`.`
+      );
+    }
+    if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
+      logMessage(
+        "CONVEX_OVERRIDE_ACCESS_TOKEN still supplies credentials. Unset it to stop using that token."
+      );
+    }
   });
-  if (ctx.fs.exists(globalConfigPath())) {
-    recursivelyDelete(ctx, globalConfigPath());
-  }
-  logFinishedStep(
-    "You have been logged out of Convex.\n  Run `npx convex dev` to log in."
-  );
-});
+}
+export const logout = createLogoutCommand();
 //# sourceMappingURL=logout.js.map