latchkey 2.21.0 → 3.0.0

package/dist/tests/cli.test.js

@@ -11,8 +11,8 @@ import { EncryptedStorage } from '../src/encryptedStorage.js';
 import { Config } from '../src/config.js';
 import { ServiceRegistry } from '../src/serviceRegistry.js';
 import { ApiCredentialStatus } from '../src/apiCredentials/base.js';
-import { SlackApiCredentials } from '../src/services/slack.js';
-import { NoCurlCredentialsNotSupportedError, Service } from '../src/services/core/base.js';
+import { Service } from '../src/services/core/base.js';
+import { createMockService, MockService } from './mockService.js';
 import { RegisteredService } from '../src/services/core/registered.js';
 import { GITLAB } from '../src/services/gitlab.js';
 import { GITHUB } from '../src/services/github.js';
@@ -33,6 +33,27 @@ function readSecureFile(path) {
     const storage = new EncryptedStorage(TEST_ENCRYPTION_KEY);
     return storage.readFile(path);
 }
+// Wrap a flat { service: credentials } map into the on-disk layout, storing
+// everything as account-keyed credentials under the default account.
+function nestAccounts(flat) {
+    return {
+        credentials: Object.fromEntries(Object.entries(flat).map(([service, creds]) => [service, { '': creds }])),
+    };
+}
+// Read the raw account-keyed credentials section of the store.
+function readStore(path) {
+    const parsed = JSON.parse(readSecureFile(path) ?? '{}');
+    return parsed.credentials ?? {};
+}
+// Read the raw preparations section of the store.
+function readPreparations(path) {
+    const parsed = JSON.parse(readSecureFile(path) ?? '{}');
+    return parsed.preparations ?? {};
+}
+// Read a single service's default-account credentials from the store.
+function readDefaultCredentials(path, service) {
+    return readStore(path)[service]?.[''];
+}
 function getCliPath() {
     const projectRoot = join(__dirname, '..');
     // Check both possible paths based on tsconfig setup
@@ -302,6 +323,7 @@ describe('CLI commands with dependency injection', () => {
             serviceName: overrides.serviceName ?? defaultConfig.serviceName,
             accountName: overrides.accountName ?? defaultConfig.accountName,
             browserDisabled: overrides.browserDisabled ?? false,
+            browserEphemeral: overrides.browserEphemeral ?? false,
             countingDisabled: overrides.countingDisabled ?? false,
             credentialsRefreshDisabled: overrides.credentialsRefreshDisabled ?? false,
             permissionsDoNotUseBuiltinSchemas: overrides.permissionsDoNotUseBuiltinSchemas ?? false,
@@ -318,24 +340,7 @@ describe('CLI commands with dependency injection', () => {
         };
     }
     function createMockDependencies(overrides = {}) {
-        const mockSlackService = {
-            name: 'slack',
-            displayName: 'Slack',
-            baseApiUrls: ['https://slack.com/api/'],
-            loginUrl: 'https://slack.com/signin',
-            info: 'Test info for Slack service.',
-            credentialCheckCurlArguments: ['https://slack.com/api/auth.test'],
-            checkApiCredentials: vi.fn().mockResolvedValue(ApiCredentialStatus.Valid),
-            setCredentialsExample(serviceName) {
-                return `latchkey auth set ${serviceName} -H "Authorization: Bearer xoxb-your-token"`;
-            },
-            getCredentialsNoCurl() {
-                throw new NoCurlCredentialsNotSupportedError('slack');
-            },
-            getSession: vi.fn().mockReturnValue({
-                login: vi.fn().mockResolvedValue(new SlackApiCredentials('xoxc-test-token', 'test-cookie')),
-            }),
-        };
+        const mockSlackService = new MockService();
         const mockRegistry = new ServiceRegistry([mockSlackService]);
         return {
             registry: mockRegistry,
@@ -416,9 +421,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should include services with stored credentials when using --viable', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'test-token', dCookie: 'test-cookie' },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand(['services', 'list', '--viable'], deps);
             expect(logs).toHaveLength(1);
@@ -451,7 +456,7 @@ describe('CLI commands with dependency injection', () => {
         it('should exclude services without credentials or browser auth when using --viable', async () => {
             const storePath = join(tempDir, 'credentials.json');
             writeSecureFile(storePath, '{}');
-            const noLoginService = {
+            const noLoginService = createMockService({
                 name: 'nologin',
                 displayName: 'No Login Service',
                 baseApiUrls: ['https://nologin.example.com/api/'],
@@ -459,13 +464,9 @@ describe('CLI commands with dependency injection', () => {
                 info: 'A service without browser login support.',
                 credentialCheckCurlArguments: [],
                 checkApiCredentials: vi.fn().mockResolvedValue(ApiCredentialStatus.Missing),
-                setCredentialsExample(serviceName) {
-                    return `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`;
-                },
-                getCredentialsNoCurl() {
-                    throw new NoCurlCredentialsNotSupportedError('nologin');
-                },
-            };
+                setCredentialsExample: (serviceName) => `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`,
+                getSession: undefined,
+            });
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([noLoginService]),
             });
@@ -519,9 +520,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should include services with credentials even when no graphical environment with --viable', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'test-token', dCookie: 'test-cookie' },
-            }));
+            })));
             const originalPlatform = process.platform;
             const originalDisplay = process.env.DISPLAY;
             const originalWayland = process.env.WAYLAND_DISPLAY;
@@ -553,9 +554,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should include services with credentials even when browser is disabled with --viable', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'test-token', dCookie: 'test-cookie' },
-            }));
+            })));
             const deps = createMockDependencies({
                 config: createMockConfig({ browserDisabled: true }),
             });
@@ -566,12 +567,12 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should combine --builtin and --viable filters', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'my-gitlab': {
                     objectType: 'rawCurl',
                     curlArguments: ['-H', 'PRIVATE-TOKEN: token'],
                 },
-            }));
+            })));
             // Ensure a graphical environment is available so browser auth is considered viable
             const originalDisplay = process.env.DISPLAY;
             try {
@@ -608,14 +609,14 @@ describe('CLI commands with dependency injection', () => {
             expect(info.type).toBe('built-in');
             expect(info.baseApiUrls).toEqual(['https://slack.com/api/']);
             expect(info.authOptions).toEqual(['browser', 'set']);
-            expect(info.credentialStatus).toBe('missing');
+            expect(info.credentials).toEqual({});
             expect(info.setCredentialsExample).toBe('latchkey auth set slack -H "Authorization: Bearer xoxb-your-token"');
             expect(info.developerNotes).toBe('Test info for Slack service.');
         });
         it('should show auth set only for services without browser login', async () => {
             const storePath = join(tempDir, 'credentials.json');
             writeSecureFile(storePath, '{}');
-            const noLoginService = {
+            const noLoginService = createMockService({
                 name: 'nologin',
                 displayName: 'No Login Service',
                 baseApiUrls: ['https://nologin.example.com/api/'],
@@ -623,13 +624,9 @@ describe('CLI commands with dependency injection', () => {
                 info: 'A service without browser login support.',
                 credentialCheckCurlArguments: [],
                 checkApiCredentials: vi.fn().mockResolvedValue(ApiCredentialStatus.Missing),
-                setCredentialsExample(serviceName) {
-                    return `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`;
-                },
-                getCredentialsNoCurl() {
-                    throw new NoCurlCredentialsNotSupportedError('nologin');
-                },
-            };
+                setCredentialsExample: (serviceName) => `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`,
+                getSession: undefined,
+            });
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([noLoginService]),
             });
@@ -649,13 +646,33 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should show valid credentials status when credentials are valid', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'test-token', dCookie: 'test-cookie' },
+            })));
+            const deps = createMockDependencies();
+            await runCommand(['services', 'info', 'slack'], deps);
+            const info = JSON.parse(logs[0] ?? '');
+            expect(info.credentials).toEqual({
+                '': { credentialType: 'slack', credentialStatus: 'valid' },
+            });
+        });
+        it('should list credentials for each account', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, JSON.stringify({
+                credentials: {
+                    slack: {
+                        '': { objectType: 'rawCurl', curlArguments: ['-H', 'X-Token: default'] },
+                        'work@example.com': { objectType: 'rawCurl', curlArguments: ['-H', 'X-Token: work'] },
+                    },
+                },
             }));
             const deps = createMockDependencies();
             await runCommand(['services', 'info', 'slack'], deps);
             const info = JSON.parse(logs[0] ?? '');
-            expect(info.credentialStatus).toBe('valid');
+            expect(info.credentials).toEqual({
+                '': { credentialType: 'rawCurl', credentialStatus: 'valid' },
+                'work@example.com': { credentialType: 'rawCurl', credentialStatus: 'valid' },
+            });
         });
         it('should return error for unknown service', async () => {
             const deps = createMockDependencies();
@@ -677,9 +694,9 @@ describe('CLI commands with dependency injection', () => {
     describe('clear command', () => {
         it('should delete credentials for a service', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'test-token', dCookie: 'test-cookie' },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand(['auth', 'clear', 'slack'], deps);
             const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
@@ -693,21 +710,21 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should preserve other services when clearing one', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'slack-token', dCookie: 'slack-cookie' },
                 discord: { objectType: 'authorizationBare', token: 'discord-token' },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand(['auth', 'clear', 'slack'], deps);
-            const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
+            const storedData = readStore(storePath);
             expect(storedData.slack).toBeUndefined();
             expect(storedData.discord).toBeDefined();
-            expect(storedData.discord?.token).toBe('discord-token');
+            expect((storedData.discord?.['']).token).toBe('discord-token');
         });
         it('should delete both store and browser state with -y flag', async () => {
             const storePath = join(tempDir, 'credentials.json');
             const browserStatePath = join(tempDir, 'browser_state.json');
-            writeSecureFile(storePath, JSON.stringify({ slack: { objectType: 'slack', token: 'test', dCookie: 'test' } }));
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({ slack: { objectType: 'slack', token: 'test', dCookie: 'test' } })));
             writeSecureFile(browserStatePath, '{}');
             const deps = createMockDependencies();
             await runCommand(['auth', 'clear', '-y'], deps);
@@ -715,19 +732,168 @@ describe('CLI commands with dependency injection', () => {
             expect(existsSync(browserStatePath)).toBe(false);
         });
     });
+    describe('--account option', () => {
+        const rawCurl = (token) => ({
+            objectType: 'rawCurl',
+            curlArguments: ['-H', `X-Token: ${token}`],
+        });
+        function writeMultiAccountStore(accounts) {
+            const storePath = join(tempDir, 'credentials.json');
+            const slackAccounts = Object.fromEntries(Object.entries(accounts).map(([account, token]) => [account, rawCurl(token)]));
+            writeSecureFile(storePath, JSON.stringify({ credentials: { slack: slackAccounts } }));
+            return storePath;
+        }
+        it('auth set stores credentials under the given account', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, '{}');
+            const deps = createMockDependencies();
+            await runCommand(['--account', 'work@example.com', 'auth', 'set', 'slack', '-H', 'X-Token: secret'], deps);
+            expect(logs).toContain('Credentials stored.');
+            const store = readStore(storePath);
+            expect(store.slack?.['work@example.com']).toEqual(rawCurl('secret'));
+            expect(store.slack?.['']).toBeUndefined();
+        });
+        it('curl injects credentials for the requested account', async () => {
+            writeMultiAccountStore({ '': 'default', 'work@example.com': 'work' });
+            const deps = createMockDependencies();
+            await runCommand(['--account', 'work@example.com', 'curl', 'https://slack.com/api/test'], deps);
+            expect(exitCode).toBe(0);
+            expect(capturedArgs).toEqual(['-H', 'X-Token: work', 'https://slack.com/api/test']);
+        });
+        it('curl uses the single stored account without requiring --account', async () => {
+            writeMultiAccountStore({ 'only@example.com': 'solo' });
+            const deps = createMockDependencies();
+            await runCommand(['curl', 'https://slack.com/api/test'], deps);
+            expect(exitCode).toBe(0);
+            expect(capturedArgs).toEqual(['-H', 'X-Token: solo', 'https://slack.com/api/test']);
+        });
+        it('curl requires --account when multiple accounts exist', async () => {
+            writeMultiAccountStore({ 'a@example.com': 'a', 'b@example.com': 'b' });
+            const deps = createMockDependencies();
+            await runCommand(['curl', 'https://slack.com/api/test'], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.join('\n')).toContain('--account');
+        });
+        it('curl fails gracefully for a non-existing account', async () => {
+            writeMultiAccountStore({ '': 'default' });
+            const deps = createMockDependencies();
+            await runCommand(['--account', 'missing@example.com', 'curl', 'https://slack.com/api/test'], deps);
+            // A missing account is treated as "no credentials for this service",
+            // and the suggested commands carry the requested account.
+            expect(exitCode).toBe(1);
+            expect(capturedArgs).toEqual([]);
+            expect(errorLogs.join('\n')).toContain("No credentials found for slack (account 'missing@example.com')");
+            expect(errorLogs.join('\n')).toContain('latchkey --account missing@example.com auth browser slack');
+        });
+        it('auth clear keeps the preparation without --all', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, JSON.stringify({
+                credentials: { slack: { 'a@example.com': rawCurl('a') } },
+                preparations: {
+                    slack: { objectType: 'oauth', clientId: 'cid', clientSecret: 'csecret' },
+                },
+            }));
+            const deps = createMockDependencies();
+            await runCommand(['auth', 'clear', 'slack'], deps);
+            expect(readStore(storePath).slack).toBeUndefined();
+            expect(readPreparations(storePath).slack).toBeDefined();
+        });
+        it('auth clear --all removes all accounts and the preparation', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, JSON.stringify({
+                credentials: { slack: { 'a@example.com': rawCurl('a'), 'b@example.com': rawCurl('b') } },
+                preparations: {
+                    slack: { objectType: 'oauth', clientId: 'cid', clientSecret: 'csecret' },
+                },
+            }));
+            const deps = createMockDependencies();
+            await runCommand(['auth', 'clear', 'slack', '--all'], deps);
+            expect(logs.join('\n')).toContain('API credentials for slack have been cleared.');
+            expect(readStore(storePath).slack).toBeUndefined();
+            expect(readPreparations(storePath).slack).toBeUndefined();
+        });
+        it('auth clear --all rejects a missing service name', async () => {
+            const deps = createMockDependencies();
+            await runCommand(['auth', 'clear', '--all'], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.join('\n')).toContain('--all requires a service name');
+        });
+        it('auth clear --all rejects --account', async () => {
+            writeMultiAccountStore({ 'a@example.com': 'a' });
+            const deps = createMockDependencies();
+            await runCommand(['--account', 'a@example.com', 'auth', 'clear', 'slack', '--all'], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.join('\n')).toContain('--all cannot be combined with --account');
+        });
+        it('auth clear removes only the requested account', async () => {
+            const storePath = writeMultiAccountStore({
+                'a@example.com': 'a',
+                'b@example.com': 'b',
+            });
+            const deps = createMockDependencies();
+            await runCommand(['--account', 'a@example.com', 'auth', 'clear', 'slack'], deps);
+            const store = readStore(storePath);
+            expect(store.slack?.['a@example.com']).toBeUndefined();
+            expect(store.slack?.['b@example.com']).toBeDefined();
+        });
+        it('auth clear requires --account when multiple accounts exist', async () => {
+            writeMultiAccountStore({ 'a@example.com': 'a', 'b@example.com': 'b' });
+            const deps = createMockDependencies();
+            await runCommand(['auth', 'clear', 'slack'], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.join('\n')).toContain('--account');
+        });
+        it('auth clear fails gracefully for a non-existing account', async () => {
+            writeMultiAccountStore({ '': 'default' });
+            const deps = createMockDependencies();
+            await runCommand(['--account', 'missing@example.com', 'auth', 'clear', 'slack'], deps);
+            // Clearing a missing account is a no-op rather than an error.
+            expect(exitCode).toBeNull();
+            expect(logs.join('\n')).toContain('No API credentials found for slack.');
+        });
+        it.each([
+            ['services', 'info', 'slack'],
+            ['auth', 'browser-prepare', 'slack'],
+            ['auth', 'prepare', 'google-gmail', '{"clientId":"a","clientSecret":"b"}'],
+            ['auth', 'list'],
+            ['services', 'list'],
+        ])('rejects --account for the unsupported command: %s %s', async (...commandArgs) => {
+            const deps = createMockDependencies();
+            await runCommand(['--account', 'hola@jola.com', ...commandArgs], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs.join('\n')).toContain('--account option is not supported');
+        });
+    });
     describe('auth list command', () => {
         it('should list stored credentials with their status', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'test-token', dCookie: 'test-cookie' },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand(['auth', 'list'], deps);
             expect(logs).toHaveLength(1);
             const entries = JSON.parse(logs[0] ?? '');
             expect(entries.slack).toEqual({
-                credentialType: 'slack',
-                credentialStatus: 'valid',
+                '': { credentialType: 'slack', credentialStatus: 'valid' },
+            });
+        });
+        it('should key each service by account', async () => {
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, JSON.stringify({
+                credentials: {
+                    slack: {
+                        '': { objectType: 'rawCurl', curlArguments: ['-H', 'X-Token: default'] },
+                        'work@example.com': { objectType: 'rawCurl', curlArguments: ['-H', 'X-Token: work'] },
+                    },
+                },
+            }));
+            const deps = createMockDependencies();
+            await runCommand(['auth', 'list'], deps);
+            const entries = JSON.parse(logs[0] ?? '');
+            expect(entries.slack).toEqual({
+                '': { credentialType: 'rawCurl', credentialStatus: 'valid' },
+                'work@example.com': { credentialType: 'rawCurl', credentialStatus: 'valid' },
             });
         });
         it('should output empty object when no credentials are stored', async () => {
@@ -741,16 +907,15 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should treat unknown services as valid', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 unknown: { objectType: 'rawCurl', curlArguments: ['-H', 'X-Token: secret'] },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand(['auth', 'list'], deps);
             expect(logs).toHaveLength(1);
             const entries = JSON.parse(logs[0] ?? '');
             expect(entries.unknown).toEqual({
-                credentialType: 'rawCurl',
-                credentialStatus: 'valid',
+                '': { credentialType: 'rawCurl', credentialStatus: 'valid' },
             });
         });
     });
@@ -761,8 +926,7 @@ describe('CLI commands with dependency injection', () => {
             const deps = createMockDependencies();
             await runCommand(['auth', 'set', 'slack', '-H', 'X-Token: secret', '-H', 'X-Other: value'], deps);
             expect(logs).toContain('Credentials stored.');
-            const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
-            expect(storedData.slack).toEqual({
+            expect(readDefaultCredentials(storePath, 'slack')).toEqual({
                 objectType: 'rawCurl',
                 curlArguments: ['-H', 'X-Token: secret', '-H', 'X-Other: value'],
             });
@@ -784,14 +948,13 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should overwrite existing credentials', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'old-token', dCookie: 'old-cookie' },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand(['auth', 'set', 'slack', '-H', 'X-Token: new-secret'], deps);
             expect(logs).toContain('Credentials stored.');
-            const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
-            expect(storedData.slack).toEqual({
+            expect(readDefaultCredentials(storePath, 'slack')).toEqual({
                 objectType: 'rawCurl',
                 curlArguments: ['-H', 'X-Token: new-secret'],
             });
@@ -802,7 +965,9 @@ describe('CLI commands with dependency injection', () => {
         const NEW_ENCRYPTION_KEY = 'Cc3mOUF63KFLOU3oJwFdfCBaMWlvjlbgxkcLlX+bEzM=';
         function readWithKey(path, key) {
             const storage = new EncryptedStorage(key);
-            return JSON.parse(storage.readFile(path) ?? '{}');
+            const raw = JSON.parse(storage.readFile(path) ?? '{}');
+            // Unwrap the default account so assertions can compare flat credentials.
+            return Object.fromEntries(Object.entries(raw.credentials ?? {}).map(([service, accounts]) => [service, accounts['']]));
         }
         function withStdinKey(key, overrides = {}) {
             return createMockDependencies({ readStdin: () => Promise.resolve(key), ...overrides });
@@ -810,7 +975,7 @@ describe('CLI commands with dependency injection', () => {
         // The credential store filename used by the mock config.
         const STORE_FILENAME = 'credentials.json';
         function writeStore(contents) {
-            writeSecureFile(join(tempDir, STORE_FILENAME), JSON.stringify(contents));
+            writeSecureFile(join(tempDir, STORE_FILENAME), JSON.stringify(nestAccounts(contents)));
         }
         it('re-encrypts all stored credentials with the new key', async () => {
             writeStore({
@@ -920,8 +1085,7 @@ describe('CLI commands with dependency injection', () => {
             });
             await runCommand(['auth', 'set-nocurl', 'telegram', '123456:ABC-DEF'], deps);
             expect(logs).toContain('Credentials stored.');
-            const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
-            expect(storedData.telegram).toEqual({
+            expect(readDefaultCredentials(storePath, 'telegram')).toEqual({
                 objectType: 'telegramBot',
                 token: '123456:ABC-DEF',
             });
@@ -952,7 +1116,7 @@ describe('CLI commands with dependency injection', () => {
         });
     });
     describe('prepare command', () => {
-        it('stores an OAuth client for a Google service and reports success', async () => {
+        it("stores an OAuth client as the service's preparation and reports success", async () => {
             const storePath = join(tempDir, 'credentials.json');
             writeSecureFile(storePath, '{}');
             const deps = createMockDependencies({
@@ -960,12 +1124,12 @@ describe('CLI commands with dependency injection', () => {
             });
             await runCommand(['auth', 'prepare', 'google-gmail', '{"clientId":"cid","clientSecret":"csecret"}'], deps);
             expect(logs).toContain('Done');
-            const storedData = JSON.parse(readSecureFile(storePath) ?? '{}');
-            expect(storedData['google-gmail']).toEqual({
+            expect(readPreparations(storePath)['google-gmail']).toEqual({
                 objectType: 'oauth',
                 clientId: 'cid',
                 clientSecret: 'csecret',
             });
+            expect(readDefaultCredentials(storePath, 'google-gmail')).toBeUndefined();
         });
         it('returns an error for an unknown service', async () => {
             const deps = createMockDependencies();
@@ -1003,9 +1167,9 @@ describe('CLI commands with dependency injection', () => {
     describe('curl command', () => {
         it('should pass arguments to subprocess', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand(['curl', 'https://slack.com/api/test'], deps);
             expect(capturedArgs).toEqual([
@@ -1019,9 +1183,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should pass raw curl credentials to subprocess', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'rawCurl', curlArguments: ['-H', 'X-Custom: header'] },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand(['curl', 'https://slack.com/api/test'], deps);
             expect(capturedArgs).toEqual(['-H', 'X-Custom: header', 'https://slack.com/api/test']);
@@ -1029,9 +1193,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should pass multiple arguments correctly', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
-            }));
+            })));
             const deps = createMockDependencies();
             await runCommand([
                 'curl',
@@ -1051,9 +1215,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should return subprocess exit code', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
-            }));
+            })));
             const deps = createMockDependencies({
                 runCurl: () => ({ returncode: 42, stdout: '', stderr: '' }),
             });
@@ -1072,9 +1236,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should return error when OAuth credentials lack an access token', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'google-gmail': { objectType: 'oauth', clientId: 'cid', clientSecret: 'csecret' },
-            }));
+            })));
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([GOOGLE_GMAIL]),
             });
@@ -1084,14 +1248,14 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should route a shared Drive files call to the Docs service when only Docs is authed', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'google-docs': {
                     objectType: 'oauth',
                     clientId: 'cid',
                     clientSecret: 'csecret',
                     accessToken: 'docs-token',
                 },
-            }));
+            })));
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([GOOGLE_DRIVE, GOOGLE_DOCS]),
             });
@@ -1101,7 +1265,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should prefer the canonical Drive service for a shared Drive files call when both are authed', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'google-drive': {
                     objectType: 'oauth',
                     clientId: 'cid',
@@ -1114,7 +1278,7 @@ describe('CLI commands with dependency injection', () => {
                     clientSecret: 'csecret',
                     accessToken: 'docs-token',
                 },
-            }));
+            })));
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([GOOGLE_DRIVE, GOOGLE_DOCS]),
             });
@@ -1124,7 +1288,7 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should skip an expired candidate in favor of one with unexpired credentials', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'google-drive': {
                     objectType: 'oauth',
                     clientId: 'cid',
@@ -1138,7 +1302,7 @@ describe('CLI commands with dependency injection', () => {
                     clientSecret: 'csecret',
                     accessToken: 'docs-token',
                 },
-            }));
+            })));
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([GOOGLE_DRIVE, GOOGLE_DOCS]),
                 config: createMockConfig({ credentialsRefreshDisabled: true }),
@@ -1149,14 +1313,14 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should not route a non-files Drive call to the Docs service', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'google-docs': {
                     objectType: 'oauth',
                     clientId: 'cid',
                     clientSecret: 'csecret',
                     accessToken: 'docs-token',
                 },
-            }));
+            })));
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([GOOGLE_DRIVE, GOOGLE_DOCS]),
             });
@@ -1186,9 +1350,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should still inject credentials for known services when passthroughUnknown is enabled', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
-            }));
+            })));
             const deps = createMockDependencies({
                 config: createMockConfig({ passthroughUnknown: true }),
             });
@@ -1198,26 +1362,15 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should read credentials from store and not call login', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
-            }));
+            })));
             const mockLogin = vi.fn();
-            const mockSlackService = {
-                name: 'slack',
-                displayName: 'Slack',
-                baseApiUrls: ['https://slack.com/api/'],
-                loginUrl: 'https://slack.com/signin',
-                info: 'Test info for Slack service.',
+            const mockSlackService = createMockService({
                 credentialCheckCurlArguments: [],
                 checkApiCredentials: vi.fn(),
-                setCredentialsExample(serviceName) {
-                    return `latchkey auth set ${serviceName} -H "Authorization: Bearer xoxb-your-token"`;
-                },
-                getCredentialsNoCurl() {
-                    throw new NoCurlCredentialsNotSupportedError('slack');
-                },
                 getSession: vi.fn().mockReturnValue({ login: mockLogin }),
-            };
+            });
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([mockSlackService]),
             });
@@ -1234,9 +1387,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should inject telegram bot token into URL path', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 telegram: { objectType: 'telegramBot', token: '123456:ABC-DEF' },
-            }));
+            })));
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([TELEGRAM]),
             });
@@ -1246,10 +1399,10 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should work when service does not have getSession but credentials exist', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 nologin: { objectType: 'rawCurl', curlArguments: ['-H', 'X-API-Key: secret'] },
-            }));
-            const noLoginService = {
+            })));
+            const noLoginService = createMockService({
                 name: 'nologin',
                 displayName: 'No Login Service',
                 baseApiUrls: ['https://nologin.example.com/api/'],
@@ -1257,14 +1410,10 @@ describe('CLI commands with dependency injection', () => {
                 info: 'A service without browser login support.',
                 credentialCheckCurlArguments: [],
                 checkApiCredentials: vi.fn().mockResolvedValue(ApiCredentialStatus.Valid),
-                setCredentialsExample(serviceName) {
-                    return `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`;
-                },
-                getCredentialsNoCurl() {
-                    throw new NoCurlCredentialsNotSupportedError('nologin');
-                },
+                setCredentialsExample: (serviceName) => `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`,
                 // No getSession - service doesn't support browser login
-            };
+                getSession: undefined,
+            });
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([noLoginService]),
             });
@@ -1275,9 +1424,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should reject request when permission check denies it', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
-            }));
+            })));
             const deps = createMockDependencies({
                 checkPermission: () => Promise.resolve(false),
             });
@@ -1288,9 +1437,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should allow request when permission check approves it', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
-            }));
+            })));
             const deps = createMockDependencies({
                 checkPermission: () => Promise.resolve(true),
             });
@@ -1300,9 +1449,9 @@ describe('CLI commands with dependency injection', () => {
         });
         it('should exit with error when permission check fails', async () => {
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 slack: { objectType: 'slack', token: 'stored-token', dCookie: 'stored-cookie' },
-            }));
+            })));
             const { PermissionCheckError } = await import('../src/permissions.js');
             const deps = createMockDependencies({
                 checkPermission: () => {
@@ -1317,7 +1466,7 @@ describe('CLI commands with dependency injection', () => {
     });
     describe('auth browser command', () => {
         it('should return error when service does not support browser login', async () => {
-            const noLoginService = {
+            const noLoginService = createMockService({
                 name: 'nologin',
                 displayName: 'No Login Service',
                 baseApiUrls: ['https://nologin.example.com/api/'],
@@ -1325,13 +1474,12 @@ describe('CLI commands with dependency injection', () => {
                 info: 'A service without browser login support.',
                 credentialCheckCurlArguments: [],
                 checkApiCredentials: vi.fn(),
-                setCredentialsExample(serviceName) {
-                    return `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`;
-                },
+                setCredentialsExample: (serviceName) => `latchkey auth set ${serviceName} -H "Authorization: Bearer <token>"`,
                 // eslint-disable-next-line @typescript-eslint/unbound-method
                 getCredentialsNoCurl: Service.prototype.getCredentialsNoCurl,
                 // No getSession - service doesn't support browser login
-            };
+                getSession: undefined,
+            });
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([noLoginService]),
             });
@@ -1370,7 +1518,7 @@ describe('CLI commands with dependency injection', () => {
             }
         });
         it('should suggest set-nocurl when service supports nocurl credentials', async () => {
-            const nocurlService = {
+            const nocurlService = createMockService({
                 name: 'nocurl-only',
                 displayName: 'NoCurl Only Service',
                 baseApiUrls: ['https://nocurl.example.com/api/'],
@@ -1378,9 +1526,7 @@ describe('CLI commands with dependency injection', () => {
                 info: 'A service with nocurl credentials but no browser login.',
                 credentialCheckCurlArguments: [],
                 checkApiCredentials: vi.fn(),
-                setCredentialsExample(serviceName) {
-                    return `latchkey auth set-nocurl ${serviceName} <some-arg>`;
-                },
+                setCredentialsExample: (serviceName) => `latchkey auth set-nocurl ${serviceName} <some-arg>`,
                 getCredentialsNoCurl(arguments_) {
                     if (arguments_.length !== 1) {
                         throw new Error('Expected exactly one argument');
@@ -1388,7 +1534,8 @@ describe('CLI commands with dependency injection', () => {
                     return { objectType: 'test', injectIntoCurlCall: vi.fn(), isExpired: () => false };
                 },
                 // No getSession - service doesn't support browser login
-            };
+                getSession: undefined,
+            });
             const deps = createMockDependencies({
                 registry: new ServiceRegistry([nocurlService]),
             });
@@ -1659,12 +1806,12 @@ describe('CLI commands with dependency injection', () => {
             await runCommand(['services', 'register', 'my-api', '--base-api-url', 'https://api.example.com/'], deps);
             // Store credentials
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'my-api': {
                     objectType: 'rawCurl',
                     curlArguments: ['-H', 'Authorization: Bearer my-token'],
                 },
-            }));
+            })));
             logs = [];
             exitCode = null;
             capturedArgs = [];
@@ -1713,12 +1860,12 @@ describe('CLI commands with dependency injection', () => {
             ], deps);
             // Store credentials
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'my-gitlab': {
                     objectType: 'rawCurl',
                     curlArguments: ['-H', 'PRIVATE-TOKEN: my-secret-token'],
                 },
-            }));
+            })));
             logs = [];
             exitCode = null;
             capturedArgs = [];
@@ -1796,19 +1943,51 @@ describe('CLI commands with dependency injection', () => {
             ], deps);
             // Store credentials for it
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'my-gitlab': {
                     objectType: 'rawCurl',
                     curlArguments: ['-H', 'PRIVATE-TOKEN: my-secret-token'],
                 },
+            })));
+            logs = [];
+            errorLogs = [];
+            exitCode = null;
+            await runCommand(['services', 'deregister', 'my-gitlab'], deps);
+            expect(exitCode).toBe(1);
+            expect(errorLogs[0]).toContain('Credentials or a preparation still exist');
+            expect(errorLogs[0]).toContain('latchkey auth clear my-gitlab --all');
+            // Service should still be in config
+            const entries = loadRegisteredServices(deps.config.configPath);
+            expect(entries.get('my-gitlab')).toBeDefined();
+        });
+        it('should reject deregistering when only a preparation still exists', async () => {
+            const deps = createMockDependencies({
+                registry: new ServiceRegistry([GITLAB]),
+            });
+            await runCommand([
+                'services',
+                'register',
+                'my-gitlab',
+                '--base-api-url',
+                'https://gitlab.mycompany.com/api/',
+                '--service-family',
+                'gitlab',
+            ], deps);
+            // Store a preparation (but no credentials) for the service
+            const storePath = join(tempDir, 'credentials.json');
+            writeSecureFile(storePath, JSON.stringify({
+                credentials: {},
+                preparations: {
+                    'my-gitlab': { objectType: 'oauth', clientId: 'cid', clientSecret: 'csecret' },
+                },
             }));
             logs = [];
             errorLogs = [];
             exitCode = null;
             await runCommand(['services', 'deregister', 'my-gitlab'], deps);
             expect(exitCode).toBe(1);
-            expect(errorLogs[0]).toContain('Credentials still exist');
-            expect(errorLogs[0]).toContain('latchkey auth clear my-gitlab');
+            expect(errorLogs[0]).toContain('Credentials or a preparation still exist');
+            expect(errorLogs[0]).toContain('latchkey auth clear my-gitlab --all');
             // Service should still be in config
             const entries = loadRegisteredServices(deps.config.configPath);
             expect(entries.get('my-gitlab')).toBeDefined();
@@ -1829,12 +2008,12 @@ describe('CLI commands with dependency injection', () => {
             ], deps);
             // Store and then clear credentials
             const storePath = join(tempDir, 'credentials.json');
-            writeSecureFile(storePath, JSON.stringify({
+            writeSecureFile(storePath, JSON.stringify(nestAccounts({
                 'my-gitlab': {
                     objectType: 'rawCurl',
                     curlArguments: ['-H', 'PRIVATE-TOKEN: my-secret-token'],
                 },
-            }));
+            })));
             logs = [];
             errorLogs = [];
             exitCode = null;
@@ -1998,6 +2177,14 @@ describe('CLI commands with dependency injection', () => {
             });
             expect(logs).toContain('Done');
         });
+        it('reports the account returned by the gateway for `auth browser`', async () => {
+            makeFetchMock(new Response(JSON.stringify({ result: { account: 'user@example.com' } }), { status: 200 }));
+            const deps = createMockDependencies({
+                config: createMockConfig({ gatewayUrl: GATEWAY_URL }),
+            });
+            await runCommand(['auth', 'browser', 'slack'], deps);
+            expect(logs).toContain("Done. Stored credentials for account 'user@example.com'.");
+        });
         it('forwards `auth browser-prepare` and reports `Already prepared.` when the gateway says so', async () => {
             makeFetchMock(new Response(JSON.stringify({ result: { alreadyPrepared: true } }), { status: 200 }));
             const deps = createMockDependencies({