@genex-ai/cli-demo 0.97.0-dev.277 → 0.98.0-dev.280

package/dist/index.js

@@ -194,440 +194,379 @@ async function flushSentry(timeoutMs = 2e3) {
 // src/index.ts
 import * as Sentry2 from "@sentry/node";
 
-// src/commands/init.ts
-import path9 from "path";
+// src/lib/auth.ts
+import http from "http";
+import crypto from "crypto";
+import os3 from "os";
+import readline from "readline";
+import { spawn as spawn2 } from "child_process";
+import { URL as URL2 } from "url";
 
-// src/lib/copy-templates.ts
-import fs2 from "fs/promises";
-import path2 from "path";
-function isGenexManaged(rel) {
-  return rel.split(path2.sep).some((seg) => seg.startsWith("genex"));
+// src/utils/colors.ts
+var useColor = Boolean(process.stdout.isTTY) && process.env.NO_COLOR === void 0 && process.env.TERM !== "dumb";
+var ESC = String.fromCharCode(27);
+var code = (open, close) => (s) => useColor ? `${ESC}[${open}m${s}${ESC}[${close}m` : s;
+var c = {
+  bold: code(1, 22),
+  dim: code(2, 22),
+  red: code(31, 39),
+  green: code(32, 39),
+  yellow: code(33, 39),
+  blue: code(34, 39),
+  cyan: code(36, 39),
+  gray: code(90, 39)
+};
+
+// src/lib/api.ts
+var CLI_VERSION_HEADER = "x-genex-cli-version";
+function formatUpdateRequired(body) {
+  const action = body.action ?? `npm i -D @genex-ai/cli-demo@${CLI_CHANNEL}`;
+  const message = body.message ?? `Genex CLI ${body.clientVersion ?? getCliVersion()} is below the minimum supported version${body.minVersion ? ` ${body.minVersion}` : ""}.`;
+  return [`${c.red("\u2717")} ${message}`, `  Update now \u2014 run: ${action}  (then re-run this command)`];
 }
-async function copyTemplates(srcDir, destDir, opts = {}) {
-  const result = { copied: [], updated: [], skipped: [] };
-  await walk(srcDir, srcDir, destDir, opts, result);
-  return result;
+function shortDate(iso) {
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return iso;
+  return d.toLocaleDateString("en-US", { month: "short", day: "numeric" });
 }
-async function walk(rootSrc, src, dest, opts, result) {
-  const entries = await fs2.readdir(src, { withFileTypes: true });
-  for (const entry of entries) {
-    const srcPath = path2.join(src, entry.name);
-    const destPath = path2.join(dest, entry.name);
-    const rel = path2.relative(rootSrc, srcPath);
-    if (opts.exclude?.includes(rel)) continue;
-    if (entry.isDirectory()) {
-      await fs2.mkdir(destPath, { recursive: true });
-      await walk(rootSrc, srcPath, destPath, opts, result);
-      continue;
-    }
-    if (!entry.isFile()) {
-      continue;
-    }
-    const present = await exists(destPath);
-    const mayOverwrite = opts.force || isGenexManaged(rel);
-    if (present && !mayOverwrite) {
-      result.skipped.push(rel);
-      continue;
-    }
-    await fs2.mkdir(path2.dirname(destPath), { recursive: true });
-    await fs2.copyFile(srcPath, destPath);
-    result.copied.push(rel);
-    if (present) result.updated.push(rel);
+function formatInsufficientCredits(body) {
+  const message = body.message ?? `this generation costs ${body.price ?? "?"} credits; your balance is ${body.balance ?? 0}.`;
+  const lines = [`${c.red("\u2717")} Out of credits \u2014 ${lowerFirst(message)}`];
+  if (body.refillAt && body.refillTo) {
+    lines.push(`  Credits refill to ${body.refillTo} on ${shortDate(body.refillAt)}.`);
   }
+  if (body.url) lines.push(`  Get more or check your balance: ${body.url}`);
+  return lines;
 }
-async function exists(p) {
-  try {
-    await fs2.access(p);
-    return true;
-  } catch {
-    return false;
-  }
+function formatVerificationRequired(body) {
+  const lines = [
+    `${c.red("\u2717")} Email not verified \u2014 verify your email to unlock your free generation credits.`
+  ];
+  if (body.url) lines.push(`  Verify here: ${body.url}  (then re-run this command)`);
+  return lines;
 }
-
-// src/lib/agents-contract.ts
-import fs3 from "fs/promises";
-import path3 from "path";
-var CONTRACT_BEGIN = "<!-- genex:contract:begin (managed by genex \u2014 edits inside this block are overwritten on sync) -->";
-var CONTRACT_END = "<!-- genex:contract:end -->";
-var GENEX_CONTRACT_BLOCK = `${CONTRACT_BEGIN}
-# Genex build contract (always in effect for this game)
-
-Your capabilities (all via \`npx genex \u2026\`): generate \`model\` \xB7 \`skybox\` \xB7 \`sfx\` \xB7 \`music\` \xB7 \`voice\` \xB7 \`texture\` \xB7 \`image\` (\`--edit\` \xB7 \`--inpaint\` \xB7 \`--glass\` \xB7 \`--clean\` \xB7 \`--upscale\`) \xB7 \`video\` \xB7 rigged \`character\` / \`creature\` \xB7 \`character animate <id> "<verb>"\` (also \`creature animate\`; \`--locomotion\` for the 8-way movement set, \`--video\` for your own footage) \xB7 the pixel toolbox \`ui extract|masks|plate|text-color|trim|audit\` \xB7 vendored \`controller character|car|drone|touch|quality\` \xB7 \`animations search\` \xB7 \`wait <id>\` / \`wait --all\` \xB7 \`preview\` / \`publish\`. Full options: \`npx genex --help\`. Task\u2192lane routing lives in the \`genex-game-director\` skill's routing map \u2014 re-load it whenever you're unsure which lane owns a task.
-
-1. Load the \`genex-game-director\` skill before starting the requested work. Route from the player's latest clear request: a focused request starts directly without replaying discovery or commissioning unrelated lanes. After ANY context compaction or session resume, re-read this file and \`DESIGN.md\`, re-load the skill for the stage you are executing, and continue from the Build plan's \`Now:\` line \u2014 never from memory alone.
-2. Ask only when one unresolved answer materially changes the work. If the request is clear, do not repeat an interview, confirm the pitch, force a concept round, or ask whole-game-vs-one-part again. For a genuinely broad new game, ask one decision: whole coordinated build or one request-relevant part first. If there is no clear request \u2014 a setup prompt pasted with nothing of their own \u2014 ask in PLAIN CHAT what they want to make, in their own words, and never fill the blank by pitching concepts. That opening question stays in chat on purpose: their reply carries the whole request, including anything they say about HOW you should work, and a menu of options answers a narrower question than the one they need to answer. Once you know what you are building, ask one decision at a time with your built-in question tool with clickable answer options when you have one; use a short plain-chat question otherwise. If the player stays silent after a necessary question, proceed on stated assumptions where reasonable and record each as "assumed \u2014 player didn't answer" in DESIGN.md \u2192 Decisions.
-3. \`DESIGN.md\` at the project root is the durable design contract AND build plan. Keep three truths distinct: the player's requested outcome, the current \`Now:\` focus, and open commitments. It must carry a \`## Build plan & status\` section with the working mode (\`whole coordinated build\`, \`step by step\`, or \`focused change\`), numbered milestones with status marks, and a \`Now:\` line naming the current one \u2014 a milestone is done only when its work reached a preview. The latest clear request may replace \`Now:\` immediately; it never silently shrinks the requested outcome or deletes unrelated commitments. Keep every decision, assumption, generation id/URL, local output, and wiring state current. When the plan first lands, tell the player in one plain line that you recorded what they asked for in \`DESIGN.md\` and will keep it current.
-4. ALL generated art, audio, video, characters, and UI come from \`genex\` commands \u2014 never from any other generation tool your platform bundles, unless the player explicitly asks for that tool by name. A local reference image is not a reason to switch tools: pass its file path to genex (\`--edit\` and \`--inpaint\` accept local paths). The same exclusivity covers shipping: building, previewing, and publishing go only through \`genex preview\` / \`genex publish\` \u2014 never load your platform's own site-building, hosting, or deploy skills for this game.
-5. Generated UI art is a tool you reach for, not a pipeline you owe. A restrained interface built in clean CSS is a finished, legitimate HUD \u2014 not a placeholder. Reach for the sprite lane (\`genex-ai-hud\`) when the game's own style genuinely wants drawn chrome \u2014 ornate, painterly, comic, hand-made \u2014 or when the player asks for HUD art. Generating ONE element you decided the game needs \u2014 a frame, a mask, an icon, a wordmark, a menu backdrop, a menu video \u2014 is a normal use of these tools, never a half-run pipeline. There is NO global game-concept image and no UI plan recited in chat: the art direction lives in the game's brief in words. A lane's own concept step survives only where the player is choosing a concrete thing (a character's candidates). Whatever you do generate, run its quality steps in full \u2014 extraction, masks, wiring, \`npx genex ui audit\`.
-6. Never draw a rectangular backing plate behind bars, digits, or icons \u2014 in sprites or CSS. Ornament lives on the widget's own silhouette; a truly needed shaped plate comes from \`npx genex ui plate\`.
-7. Fonts: the brief's display + body pair comes from the menu skill's genre table (or carries a one-line stated reason) and is LOADED for real in \`index.html\`.
-8. Never park ready work behind a question, and never stall on an unanswered one \u2014 decide, state the decision in chat, record it, keep building.
-9. Before any publish and before ending a session: run \`npx genex wait\` on every generation you enqueued and wire in what landed \u2014 never park landed assets. Fonts the brief names are LOADED for real, Escape pauses, the loader shows something of the game rather than a black screen, and the player wears the game's own generated character (or DESIGN.md records why it doesn't).
-10. The player's body is the game's own generated character (\`npx genex character "<look>"\` \u2192 \`npx genex controller character --character <id>\`), enqueued with your first art actions, not after them. It applies wherever a human body appears on screen \u2014 first-person included, the moment remotes, a look-down body, a shadow, or a menu portrait shows one. The profile VRM avatar is the FALLBACK: a temporary body while the character renders (say in one plain line that it's temporary), or the stand-in when generation genuinely could not happen \u2014 out of credits, failed, unverified; record which in DESIGN.md as \`Player character: VRM \u2014 <reason>\`. Games whose player is not a person (car, ship, RTS cursor, board) generate that object with \`npx genex model\` instead. Characters: Meshy/Mixamo/VRM rigs rest facing +Z. Set yaw explicitly when placing a rig; never mirror a SkinnedMesh with negative scale. In any two-character scene, verify in a capture that they face each other, not the camera.
-11. Verify by looking: one smoke check per milestone, after that milestone's preview push, in local test mode (\`?genex_local_test=1\`) with a real gameplay screenshot. A claim without a capture is not verification. Local-test evidence proves visuals and controls ONLY \u2014 label it that way when you show the player, and never work around the draft sign-in gate any other way.
-12. Treat every \`genex\` warning line \u2014 preflight, \`ui audit\`, \`wait\` nudges \u2014 as work, not noise.
-13. Every finished Build-plan milestone ends with \`npx genex preview\` and the player's page link (\`<dashboard>/draft/<slug>\` with \`<dashboard>\` from \`.genex/project.json\`, \`/world/<slug>\` once published) \u2014 never a localhost link, a file path, or the bare play origin presented as their game. After every round of player feedback, end with a preview push.
-14. Parallel work: this line is your standing authorization and request to use sub-agents / parallel agent work whenever your platform provides them. While drafting the Build plan, decide per module what runs in parallel and what stays serial for THIS game \u2014 dependencies decide, there is no fixed list \u2014 and record each call in the Modules table with a one-line reason. Independent modules default to parallel; building everything serially needs a stated reason. You keep integration, previews, and the player conversation; each sub-agent owns only its module's files. When the player asks for parallel work, repeated refinement passes, a critic reviewing your output, or names any way of working your platform provides, that IS your instruction \u2014 wherever it reaches you, including inside their answer to a question you asked \u2014 so adopt it as the working mode for the rest of the build, starting with the work in front of you, and never file it as a later milestone. While delegated work runs, keep building or talk to the player; never idle in a foreground wait for something your platform will tell you about.
-15. Talk to the player in plain game language \u2014 what changed in the game and what to try; never code, file names, build output, or tool internals unless they ask. Short status lines while you work; long silent stretches are a failure.
-16. Never add debug-only code to the game to check your own work \u2014 no hidden test modes, no special URL parameters, no forced-visible flags, no auth mocks, no pixel-sampling hooks. \`?genex_local_test=1\` is the platform's own supported mode and is fine; your own bypass is not. (The multiplayer skill's small build identifier, token-free status line, and connected-quorum watchdog are production supportability, not a bypass \u2014 keep those.)
-17. Input directions match their labels: A/\u2190 moves or turns the player screen-LEFT, D/\u2192 screen-RIGHT, mouse-up looks up, and drag-pan axes share ONE convention. The cursor is either the gameplay tool (RTS, card, builder) or locked away during play \u2014 keyboard-only games included. Check it in every milestone's smoke pass.
-18. v0 is a milestone, not the destination. When the ask was bigger than one loop, every milestone after v0 grows back toward the FULL ask with DESIGN.md's content lines as the checklist \u2014 a slice that previewed well never quietly becomes the game. Cosmetics never jump the queue past promised content.
-${CONTRACT_END}
-`;
-var CLAUDE_IMPORT_LINE = "@AGENTS.md";
-function mergeContractBlock(existing) {
-  const block = GENEX_CONTRACT_BLOCK.trimEnd();
-  if (existing === null || existing.trim() === "") return `${block}
-`;
-  const region = /<!-- genex:contract:begin[^\n]*-->[\s\S]*?<!-- genex:contract:end -->/;
-  if (region.test(existing)) {
-    return existing.replace(region, block);
-  }
-  const cleaned = existing.split("\n").filter(
-    (line) => !line.includes("genex:contract:begin") && !line.includes("genex:contract:end")
-  ).join("\n").trimEnd();
-  return cleaned === "" ? `${block}
-` : `${cleaned}
-
-${block}
-`;
+function lowerFirst(s) {
+  return s ? s[0].toLowerCase() + s.slice(1) : s;
 }
-async function writeAgentsContract(projectDir) {
-  let changed = false;
-  try {
-    const agentsPath = path3.join(projectDir, "AGENTS.md");
-    let existing = null;
+var structuredPrinted = /* @__PURE__ */ new WeakSet();
+function printedStructuredError(res) {
+  return structuredPrinted.has(res);
+}
+async function apiFetch(url, init2 = {}) {
+  const headers = new Headers(init2.headers);
+  if (!headers.has(CLI_VERSION_HEADER)) headers.set(CLI_VERSION_HEADER, getCliVersion());
+  const res = await fetch(url, { ...init2, headers });
+  if (res.status === 426) {
     try {
-      existing = await fs3.readFile(agentsPath, "utf8");
+      const body = await res.clone().json();
+      if (body?.error === "cli_update_required") {
+        for (const line of formatUpdateRequired(body)) process.stderr.write(line + "\n");
+      }
     } catch {
-      existing = null;
-    }
-    const next = mergeContractBlock(existing);
-    if (next !== existing) {
-      await fs3.writeFile(agentsPath, next, "utf8");
-      changed = true;
     }
-    const claudePath = path3.join(projectDir, "CLAUDE.md");
-    let claude = null;
+  }
+  if (res.status === 402) {
     try {
-      claude = await fs3.readFile(claudePath, "utf8");
+      const body = await res.clone().json();
+      if (body?.error === "insufficient_credits") {
+        for (const line of formatInsufficientCredits(body)) process.stderr.write(line + "\n");
+        structuredPrinted.add(res);
+      }
     } catch {
-      claude = null;
     }
-    if (claude === null) {
-      await fs3.writeFile(claudePath, `${CLAUDE_IMPORT_LINE}
-`, "utf8");
-      changed = true;
-    } else if (!claude.split("\n").some((line) => line.trim() === CLAUDE_IMPORT_LINE)) {
-      const sep = claude.endsWith("\n") ? "" : "\n";
-      await fs3.writeFile(claudePath, `${claude}${sep}
-${CLAUDE_IMPORT_LINE}
-`, "utf8");
-      changed = true;
+  }
+  if (res.status === 403) {
+    try {
+      const body = await res.clone().json();
+      if (body?.error === "email_verification_required") {
+        for (const line of formatVerificationRequired(body)) process.stderr.write(line + "\n");
+        structuredPrinted.add(res);
+      }
+    } catch {
     }
-  } catch {
   }
-  return changed;
-}
-
-// src/lib/updates.ts
-import fs4 from "fs/promises";
-import os3 from "os";
-import path4 from "path";
-function parseSemver(v) {
-  const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v.trim());
-  if (!m) return null;
-  return [Number(m[1]), Number(m[2]), Number(m[3])];
-}
-function isNewerVersion(a, b) {
-  const pa = parseSemver(a);
-  const pb = parseSemver(b);
-  if (!pa || !pb) return false;
-  for (let i = 0; i < 3; i++) {
-    if (pa[i] !== pb[i]) return pa[i] > pb[i];
+  if (res.status === 503) {
+    try {
+      const body = await res.clone().json();
+      if (body?.error === "generation_paused") {
+        process.stderr.write(
+          `${c.red("\u2717")} ${body.message ?? "Generation is temporarily paused platform-wide. Try again later."}
+`
+        );
+        structuredPrinted.add(res);
+      }
+    } catch {
+    }
   }
-  return false;
+  return res;
 }
-var SKILLS_VERSION_MARKER = "genex-skills-version.json";
-async function readSkillsMarker(skillsDir) {
+async function fetchSignedInEmail(apiUrl, token) {
   try {
-    const raw = await fs4.readFile(path4.join(skillsDir, SKILLS_VERSION_MARKER), "utf8");
-    const parsed = JSON.parse(raw);
-    return typeof parsed.version === "string" ? parsed.version : null;
+    const res = await apiFetch(`${apiUrl}/api/auth/get-session`, {
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) return null;
+    const data = await res.json().catch(() => null);
+    return data?.user?.email ?? null;
   } catch {
     return null;
   }
 }
-async function writeSkillsMarker(skillsDir, version = getCliVersion()) {
-  await fs4.mkdir(skillsDir, { recursive: true });
-  await fs4.writeFile(
-    path4.join(skillsDir, SKILLS_VERSION_MARKER),
-    JSON.stringify({ version, syncedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n"
-  );
-}
-async function hasGenexSkills(skillsDir) {
+
+// src/lib/pending-auth.ts
+import fs3 from "fs/promises";
+import path3 from "path";
+
+// src/lib/env.ts
+import fs2 from "fs/promises";
+import path2 from "path";
+import { spawn } from "child_process";
+async function writeEnvVar(envPath, key, value) {
+  let content = "";
+  let existed = false;
   try {
-    const entries = await fs4.readdir(skillsDir);
-    return entries.some((name) => name.startsWith("genex-"));
+    content = await fs2.readFile(envPath, "utf8");
+    existed = true;
   } catch {
-    return false;
   }
-}
-var REMOVED_SKILLS = [
-  "genex-explore",
-  "genex-threejs-skill-router",
-  "genex-threejs-bloom",
-  "genex-threejs-screen-space-ambient-occlusion",
-  "genex-threejs-atmosphere-aerial-perspective",
-  "genex-threejs-volumetric-clouds",
-  "genex-threejs-spectral-ocean",
-  "genex-threejs-water-optics",
-  "genex-threejs-temporal-surfaces",
-  "genex-threejs-raymarched-space-effects",
-  "genex-threejs-procedural-architecture",
-  "genex-threejs-procedural-fields",
-  "genex-threejs-procedural-geometry",
-  "genex-threejs-procedural-planets",
-  "genex-threejs-procedural-vegetation",
-  "genex-threejs-image-pipeline",
-  "genex-threejs-lighting-design",
-  "genex-threejs-precipitation-surfaces",
-  "genex-threejs-game-content",
-  "genex-threejs-open-world"
-];
-async function pruneRemovedSkills(skillsDir, log) {
-  const removed = [];
-  for (const name of REMOVED_SKILLS) {
-    const target = path4.join(skillsDir, name);
-    try {
-      await fs4.access(target);
-    } catch {
-      continue;
-    }
-    try {
-      await fs4.rm(target, { recursive: true });
-      removed.push(name);
-    } catch {
-    }
-  }
-  if (removed.length > 0) {
-    log?.plain(
-      `\u{1F9F9} Removed retired Genex skill${removed.length > 1 ? "s" : ""}: ${removed.join(", ")}`
-    );
+  const assignment = `${key}=${formatValue(value)}`;
+  const keyPattern = new RegExp(
+    `^(\\s*export\\s+)?${escapeRegExp(key)}=.*$`,
+    "gm"
+  );
+  let next;
+  let mode;
+  if (keyPattern.test(content)) {
+    next = content.replace(keyPattern, assignment);
+    mode = "updated";
+  } else {
+    let prefix = content;
+    if (prefix.length > 0 && !prefix.endsWith("\n")) prefix += "\n";
+    next = prefix + assignment + "\n";
+    mode = existed ? "appended" : "created";
   }
-  return removed.length > 0;
-}
-async function syncSkillsForTarget(target, templatesDir = getTemplatesDir(), version = getCliVersion(), log) {
-  const skillsDir = path4.join(target.baseDir, "skills");
-  if (!await hasGenexSkills(skillsDir)) return false;
-  if (await readSkillsMarker(skillsDir) === version) return false;
-  const src = target.full ? templatesDir : path4.join(templatesDir, "skills");
-  const dest = target.full ? target.baseDir : skillsDir;
-  await copyTemplates(src, dest, { exclude: ["controllers", "motion"] });
-  await pruneRemovedSkills(skillsDir, log);
-  await writeSkillsMarker(skillsDir, version);
-  return true;
+  await fs2.mkdir(path2.dirname(envPath), { recursive: true });
+  await fs2.writeFile(envPath, next, { mode: 384 });
+  await restrictFilePermissions(envPath);
+  return { mode, path: envPath };
 }
-async function cleanupLegacyGlobalSkills(log) {
-  try {
-    const home = os3.homedir();
-    const [realCwd, realHome] = await Promise.all([
-      fs4.realpath(process.cwd()).catch(() => path4.resolve(process.cwd())),
-      fs4.realpath(home).catch(() => path4.resolve(home))
-    ]);
-    if (realCwd === realHome) return false;
-    let removed = false;
-    for (const dirName of [".claude", ".codex", ".cursor"]) {
-      const skillsDir = path4.join(home, dirName, "skills");
-      let entries = [];
-      try {
-        entries = await fs4.readdir(skillsDir);
-      } catch {
-        continue;
-      }
-      for (const name of entries) {
-        if (!name.startsWith("genex-")) continue;
-        try {
-          await fs4.rm(path4.join(skillsDir, name), { recursive: true });
-          removed = true;
-        } catch {
-        }
-      }
-    }
-    for (const rel of [
-      path4.join("agents", "genex-helper.md"),
-      path4.join("commands", "genex-status.md")
-    ]) {
-      try {
-        await fs4.rm(path4.join(home, ".claude", rel));
-        removed = true;
-      } catch {
-      }
-    }
-    if (removed) {
-      log?.plain("\u{1F9F9} Removed legacy GLOBAL Genex skills \u2014 installs are project-local now");
-    }
-    return removed;
-  } catch {
-    return false;
+async function restrictFilePermissions(filePath) {
+  if (process.platform !== "win32") {
+    await fs2.chmod(filePath, 384).catch(() => {
+    });
+    return;
   }
-}
-async function syncSkills(log) {
-  try {
-    await cleanupLegacyGlobalSkills(log);
-    const version = getCliVersion();
-    const templatesDir = getTemplatesDir();
-    let refreshed = false;
-    for (const target of resolveAgentTargets()) {
-      try {
-        refreshed = await syncSkillsForTarget(target, templatesDir, version, log) || refreshed;
-      } catch {
-      }
-    }
-    if (refreshed) log.plain(`\u{1F504} Genex skills updated to ${version}`);
+  const user = process.env.USERNAME ?? process.env.USER;
+  if (!user) return;
+  await new Promise((resolve) => {
     try {
-      await fs4.access(path4.join(process.cwd(), ".genex"));
-      if (await writeAgentsContract(process.cwd())) {
-        log.plain("\u{1F504} Genex build contract refreshed (AGENTS.md managed block)");
-      }
+      const child = spawn(
+        "icacls",
+        [filePath, "/inheritance:r", "/grant:r", `${user}:F`],
+        { stdio: "ignore" }
+      );
+      child.on("error", () => resolve());
+      child.on("close", () => resolve());
     } catch {
+      resolve();
     }
-  } catch {
-  }
+  });
 }
-var PUBLISHED_PACKAGES = [
-  { name: "@genex-ai/cli-demo", label: "CLI", install: "npm i -D @genex-ai/cli-demo@latest" },
-  { name: "@genex-ai/embed-sdk", label: "embed SDK", install: "npm i @genex-ai/embed-sdk@latest" },
-  {
-    name: "@genex-ai/multiplayer",
-    label: "multiplayer SDK",
-    install: "npm i @genex-ai/multiplayer@latest"
+function formatValue(value) {
+  if (/[\s#"'$`\\]/.test(value)) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
   }
-];
-var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var REGISTRY_TIMEOUT_MS = 1500;
-function getUpdateCachePath() {
-  return path4.join(getGenexDir(), "update-check.json");
+  return value;
 }
-function isCacheFresh(cache, nowMs) {
-  const at = Date.parse(cache.checkedAt);
-  return Number.isFinite(at) && nowMs - at < CHECK_INTERVAL_MS;
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function wasRecentlyNotified(cache, name, latest, nowMs) {
-  if (cache.notified?.[name] !== latest) return false;
-  const at = Date.parse(cache.notifiedAt ?? "");
-  return Number.isFinite(at) && nowMs - at < CHECK_INTERVAL_MS;
+
+// src/lib/pending-auth.ts
+function pendingAuthPath() {
+  return path3.join(getGenexDir(), "pending-auth.json");
 }
-async function readUpdateCache() {
+async function readPendingAuth(apiUrl) {
   try {
-    const raw = await fs4.readFile(getUpdateCachePath(), "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.checkedAt !== "string" || typeof parsed.latest !== "object") return null;
-    return parsed;
+    const raw = JSON.parse(await fs3.readFile(pendingAuthPath(), "utf8"));
+    if (!raw?.deviceCode || !raw.userCode || raw.apiUrl !== apiUrl) return null;
+    if (Date.now() >= raw.expiresAt) return null;
+    return raw;
   } catch {
     return null;
   }
 }
-async function fetchLatestFromRegistry(name) {
+async function writePendingAuth(pending) {
+  const file = pendingAuthPath();
+  await fs3.mkdir(path3.dirname(file), { recursive: true });
+  await fs3.writeFile(file, JSON.stringify(pending, null, 2), { mode: 384 });
+  await restrictFilePermissions(file);
+}
+async function clearPendingAuth() {
+  await fs3.rm(pendingAuthPath(), { force: true }).catch(() => {
+  });
+}
+
+// src/lib/auth.ts
+var DEFAULT_INLINE_WAIT_MS = 100 * 1e3;
+var MIN_POLL_INTERVAL_MS = 1e3;
+var REASSURE_EVERY_MS = 30 * 1e3;
+var AuthPendingError = class extends Error {
+  // Plain fields, not parameter properties: `erasableSyntaxOnly` (Node runs the
+  // .ts sources directly by stripping types) forbids the shorthand.
+  userCode;
+  verifyUrl;
+  constructor(userCode, verifyUrl) {
+    super("Authorization is still pending.");
+    this.name = "AuthPendingError";
+    this.userCode = userCode;
+    this.verifyUrl = verifyUrl;
+  }
+};
+function formatUserCode(code2) {
+  return code2.length === 8 ? `${code2.slice(0, 4)}-${code2.slice(4)}` : code2;
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function authorize(apiBaseUrl, authBaseUrl, options) {
+  const { log, inlineWaitMs = DEFAULT_INLINE_WAIT_MS, open = openBrowser, label } = options;
+  const resumed = await readPendingAuth(apiBaseUrl);
+  if (resumed) {
+    log.step("Picking up where the last sign-in left off\u2026");
+    printCode(log, resumed.userCode, resumed.verifyUrl);
+    return await pollForToken(apiBaseUrl, resumed, { log, inlineWaitMs });
+  }
+  let started;
   try {
-    const res = await fetch(
-      `https://registry.npmjs.org/-/package/${encodeURIComponent(name)}/dist-tags`,
-      { signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS) }
-    );
-    if (!res.ok) return null;
-    const tags = await res.json();
-    return typeof tags.latest === "string" && parseSemver(tags.latest) ? tags.latest : null;
-  } catch {
-    return null;
+    started = await startDeviceAuth(apiBaseUrl, label);
+  } catch (err) {
+    if (err instanceof LegacyApiError) {
+      log.dim("This Genex API doesn't support device sign-in yet \u2014 using the legacy browser flow.");
+      return await authorizeLoopback(authBaseUrl, { log, open, timeoutMs: inlineWaitMs });
+    }
+    throw err;
   }
+  const pending = {
+    deviceCode: started.deviceCode,
+    userCode: started.userCode,
+    verifyUrl: started.verifyUrl,
+    expiresAt: Date.now() + started.expiresIn * 1e3,
+    apiUrl: apiBaseUrl
+  };
+  await writePendingAuth(pending);
+  printCode(log, started.userCode, started.verifyUrl);
+  let warned = false;
+  const warnManual = () => {
+    if (warned) return;
+    warned = true;
+    log.dim("  (couldn't open a browser here \u2014 open the link above yourself)");
+  };
+  if (!open(started.verifyUrl, warnManual)) warnManual();
+  return await pollForToken(apiBaseUrl, pending, { log, inlineWaitMs, interval: started.interval });
 }
-function startUpdateCheck() {
-  return (async () => {
-    try {
-      const cached = await readUpdateCache();
-      if (cached && isCacheFresh(cached, Date.now())) return cached;
-      const latest = { ...cached?.latest ?? {} };
-      const results = await Promise.allSettled(
-        PUBLISHED_PACKAGES.map((p) => fetchLatestFromRegistry(p.name))
+var LegacyApiError = class extends Error {
+};
+async function startDeviceAuth(apiBaseUrl, label) {
+  const url = `${apiBaseUrl}/api/cli/device/start`;
+  const body = JSON.stringify({ label: label ?? defaultLabel() });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const res = await apiFetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body
+    });
+    if (res.status === 404 || res.status === 501) throw new LegacyApiError();
+    if (res.status === 409) continue;
+    if (!res.ok) {
+      throw new Error(
+        `Couldn't start sign-in (HTTP ${res.status}). Check your connection and re-run this command.`
       );
-      results.forEach((r, i) => {
-        if (r.status === "fulfilled" && r.value) latest[PUBLISHED_PACKAGES[i].name] = r.value;
-      });
-      const next = {
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        latest,
-        ...cached?.notified ? { notified: cached.notified } : {},
-        ...cached?.notifiedAt ? { notifiedAt: cached.notifiedAt } : {}
-      };
-      await fs4.mkdir(getGenexDir(), { recursive: true });
-      await fs4.writeFile(getUpdateCachePath(), JSON.stringify(next, null, 2) + "\n");
-      return next;
-    } catch {
-      return null;
     }
-  })();
+    return await res.json();
+  }
+  throw new Error("Couldn't start sign-in \u2014 please re-run this command.");
 }
-async function installedPackageVersion(cwd, name) {
+function defaultLabel() {
   try {
-    const raw = await fs4.readFile(path4.join(cwd, "node_modules", name, "package.json"), "utf8");
-    const pkg = JSON.parse(raw);
-    return typeof pkg.version === "string" ? pkg.version : null;
+    return os3.hostname();
   } catch {
-    return null;
+    return "";
   }
 }
-function formatNudge(label, latest, installed, install) {
-  return `\u2B06 Genex ${label} ${latest} available (installed ${installed}) \u2014 run: ${install}`;
+function printCode(log, userCode, verifyUrl) {
+  log.plain("");
+  log.step("Connect this project to your Genex account.");
+  log.plain(
+    [
+      "",
+      `  ${c.cyan("\u2192")} Open:  ${c.cyan(verifyUrl)}`,
+      `  ${c.cyan("\u2192")} Code:  ${c.bold(formatUserCode(userCode))}`,
+      "",
+      "  The link works on any device \u2014 your phone, or another computer.",
+      "  Sign up there if you don't have an account yet; this waits for you.",
+      ""
+    ].join("\n")
+  );
 }
-async function reportUpdateNudges(check, log, cwd = process.cwd(), cachePath = getUpdateCachePath()) {
-  try {
-    const cache = await check;
-    if (!cache) return;
-    const now = Date.now();
-    const lines = [];
-    const announced = {};
-    let whatsNew = null;
-    for (const pkg of PUBLISHED_PACKAGES) {
-      if (pkg.name === "@genex-ai/cli-demo" && CLI_CHANNEL === "dev") continue;
-      const latest = cache.latest[pkg.name];
-      if (!latest) continue;
-      if (wasRecentlyNotified(cache, pkg.name, latest, now)) continue;
-      const installed = pkg.name === "@genex-ai/cli-demo" ? getCliVersion() : await installedPackageVersion(cwd, pkg.name);
-      if (!installed) continue;
-      if (isNewerVersion(latest, installed)) {
-        lines.push(formatNudge(pkg.label, latest, installed, pkg.install));
-        announced[pkg.name] = latest;
-        whatsNew ??= `https://www.npmjs.com/package/${pkg.name}`;
+async function pollForToken(apiBaseUrl, pending, opts) {
+  const { log, inlineWaitMs } = opts;
+  const deadline = Date.now() + inlineWaitMs;
+  let intervalMs = Math.max((opts.interval ?? 2) * 1e3, MIN_POLL_INTERVAL_MS);
+  let nextReassureAt = Date.now() + REASSURE_EVERY_MS;
+  for (; ; ) {
+    let res;
+    try {
+      res = await apiFetch(`${apiBaseUrl}/api/cli/device/poll`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ deviceCode: pending.deviceCode })
+      });
+    } catch {
+      res = new Response(null, { status: 599 });
+    }
+    if (res.status === 410) {
+      await clearPendingAuth();
+      throw new Error("That sign-in code expired. Re-run this command for a fresh one.");
+    }
+    if (res.ok) {
+      const body = await res.json().catch(() => null);
+      if (body?.status === "approved" && body.token) {
+        await clearPendingAuth();
+        return body.token;
       }
+      if (body?.status === "denied") {
+        await clearPendingAuth();
+        throw new Error("Sign-in was cancelled in the browser. Re-run this command to try again.");
+      }
+      if (body?.interval) intervalMs = Math.max(body.interval * 1e3, MIN_POLL_INTERVAL_MS);
     }
-    if (lines.length === 0) return;
-    for (const line of lines) log.plain(line);
-    log.dim(
-      `  Apply at a safe moment (never mid-task) \u2014 see the genex-updates skill. What's new: ${whatsNew}`
-    );
-    await recordNotified(cache, announced, cachePath);
-  } catch {
+    if (Date.now() + intervalMs > deadline) {
+      throw new AuthPendingError(pending.userCode, pending.verifyUrl);
+    }
+    if (Date.now() >= nextReassureAt) {
+      log.dim("  still waiting for you to approve\u2026");
+      nextReassureAt = Date.now() + REASSURE_EVERY_MS;
+    }
+    await sleep(intervalMs);
   }
 }
-async function recordNotified(cache, announced, cachePath) {
-  try {
-    const next = {
-      ...cache,
-      notified: { ...cache.notified ?? {}, ...announced },
-      notifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await fs4.mkdir(path4.dirname(cachePath), { recursive: true });
-    await fs4.writeFile(cachePath, JSON.stringify(next, null, 2) + "\n");
-  } catch {
-  }
+function printAuthHandoff(log, err) {
+  log.plain("");
+  log.warn("Not approved yet \u2014 nothing is broken, the sign-in is still waiting for you.");
+  log.plain(
+    [
+      `  ${c.cyan("\u2192")} Approve at ${c.cyan(err.verifyUrl)}  (code ${c.bold(formatUserCode(err.userCode))})`,
+      `  ${c.cyan("\u2192")} Then run ${c.cyan("npx genex auth")} \u2014 it picks up exactly where this left off.`,
+      ""
+    ].join("\n")
+  );
+}
+async function resumeAuthorization(apiBaseUrl, options) {
+  const pending = await readPendingAuth(apiBaseUrl);
+  if (!pending) return null;
+  const { log, inlineWaitMs = DEFAULT_INLINE_WAIT_MS } = options;
+  printCode(log, pending.userCode, pending.verifyUrl);
+  return await pollForToken(apiBaseUrl, pending, { log, inlineWaitMs });
 }
-
-// src/lib/auth.ts
-import http from "http";
-import crypto from "crypto";
-import readline from "readline";
-import { spawn } from "child_process";
-import { URL as URL2 } from "url";
 var SUCCESS_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Genex</title>
 <style>body{font-family:system-ui,sans-serif;background:#0b0b0f;color:#eaeaea;display:grid;place-items:center;height:100vh;margin:0}
 .card{text-align:center;padding:2rem 3rem;border:1px solid #26262e;border-radius:14px;background:#13131a}
@@ -636,7 +575,7 @@ h1{font-size:1.3rem;margin:0 0 .5rem}p{color:#9a9aa6;margin:0}</style></head>
 var ERROR_HTML = `<!doctype html><html><head><meta charset="utf-8"><title>Genex</title></head>
 <body style="font-family:system-ui,sans-serif"><h1>Authorization failed</h1>
 <p>No token was provided. Please return to your terminal and try again.</p></body></html>`;
-async function authorize(authBaseUrl, options) {
+async function authorizeLoopback(authBaseUrl, options) {
   const {
     log,
     timeoutMs = 5 * 60 * 1e3,
@@ -833,7 +772,7 @@ function openBrowser(url, onError = () => {
     }
   }
   try {
-    const child = spawn(command, args, {
+    const child = spawn2(command, args, {
       stdio: "ignore",
       detached: true
     });
@@ -871,117 +810,566 @@ function tokenizeCommand(input) {
   return tokens2;
 }
 
-// src/utils/colors.ts
-var useColor = Boolean(process.stdout.isTTY) && process.env.NO_COLOR === void 0 && process.env.TERM !== "dumb";
-var ESC = String.fromCharCode(27);
-var code = (open, close) => (s) => useColor ? `${ESC}[${open}m${s}${ESC}[${close}m` : s;
-var c = {
-  bold: code(1, 22),
-  dim: code(2, 22),
-  red: code(31, 39),
-  green: code(32, 39),
-  yellow: code(33, 39),
-  blue: code(34, 39),
-  cyan: code(36, 39),
-  gray: code(90, 39)
-};
-
-// src/lib/api.ts
-var CLI_VERSION_HEADER = "x-genex-cli-version";
-function formatUpdateRequired(body) {
-  const action = body.action ?? `npm i -D @genex-ai/cli-demo@${CLI_CHANNEL}`;
-  const message = body.message ?? `Genex CLI ${body.clientVersion ?? getCliVersion()} is below the minimum supported version${body.minVersion ? ` ${body.minVersion}` : ""}.`;
-  return [`${c.red("\u2717")} ${message}`, `  Update now \u2014 run: ${action}  (then re-run this command)`];
+// src/lib/store.ts
+import fs4 from "fs/promises";
+import path4 from "path";
+function getProjectMetadataPath(cwd = process.cwd()) {
+  return path4.join(cwd, ".genex", "project.json");
 }
-function shortDate(iso) {
-  const d = new Date(iso);
-  if (Number.isNaN(d.getTime())) return iso;
-  return d.toLocaleDateString("en-US", { month: "short", day: "numeric" });
+async function writeUserToken(token, envPath) {
+  const { path: written } = await writeEnvVar(getGenexEnvPath(envPath), ENV_TOKEN_KEY, token);
+  return { path: written };
 }
-function formatInsufficientCredits(body) {
-  const message = body.message ?? `this generation costs ${body.price ?? "?"} credits; your balance is ${body.balance ?? 0}.`;
-  const lines = [`${c.red("\u2717")} Out of credits \u2014 ${lowerFirst(message)}`];
-  if (body.refillAt && body.refillTo) {
-    lines.push(`  Credits refill to ${body.refillTo} on ${shortDate(body.refillAt)}.`);
+async function rotateRejectedEnv(envPath) {
+  const file = getGenexEnvPath(envPath);
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const aside = `${file}.rejected-${stamp}`;
+  try {
+    await fs4.rename(file, aside);
+    return aside;
+  } catch {
+    return null;
   }
-  if (body.url) lines.push(`  Get more or check your balance: ${body.url}`);
-  return lines;
 }
-function formatVerificationRequired(body) {
-  const lines = [
-    `${c.red("\u2717")} Email not verified \u2014 verify your email to unlock your free generation credits.`
-  ];
-  if (body.url) lines.push(`  Verify here: ${body.url}  (then re-run this command)`);
-  return lines;
+async function readUserToken(envPath) {
+  const fromGenex = await readTokenFromFile(getGenexEnvPath(envPath));
+  if (fromGenex) return fromGenex;
+  if (!envPath && !process.env[ENV_FILE_ENV]) {
+    return readTokenFromFile(path4.join(process.cwd(), ".env"));
+  }
+  return null;
 }
-function lowerFirst(s) {
-  return s ? s[0].toLowerCase() + s.slice(1) : s;
+async function readTokenFromFile(file) {
+  let content;
+  try {
+    content = await fs4.readFile(file, "utf8");
+  } catch {
+    return null;
+  }
+  const m = content.match(/^\s*(?:export\s+)?GENEX_TOKEN=(.*)$/m);
+  if (!m) return null;
+  return stripQuotes(m[1].trim()) || null;
 }
-var structuredPrinted = /* @__PURE__ */ new WeakSet();
-function printedStructuredError(res) {
-  return structuredPrinted.has(res);
+function stripQuotes(v) {
+  if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
+    return v.slice(1, -1);
+  }
+  return v;
 }
-async function apiFetch(url, init2 = {}) {
-  const headers = new Headers(init2.headers);
-  if (!headers.has(CLI_VERSION_HEADER)) headers.set(CLI_VERSION_HEADER, getCliVersion());
-  const res = await fetch(url, { ...init2, headers });
-  if (res.status === 426) {
-    try {
-      const body = await res.clone().json();
-      if (body?.error === "cli_update_required") {
-        for (const line of formatUpdateRequired(body)) process.stderr.write(line + "\n");
-      }
-    } catch {
-    }
+async function readProject(cwd = process.cwd()) {
+  try {
+    const raw = await fs4.readFile(getProjectMetadataPath(cwd), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
   }
-  if (res.status === 402) {
-    try {
-      const body = await res.clone().json();
-      if (body?.error === "insufficient_credits") {
-        for (const line of formatInsufficientCredits(body)) process.stderr.write(line + "\n");
-        structuredPrinted.add(res);
+}
+async function writeProject(meta, cwd = process.cwd()) {
+  const file = getProjectMetadataPath(cwd);
+  await fs4.mkdir(path4.dirname(file), { recursive: true });
+  await fs4.writeFile(file, JSON.stringify(meta, null, 2) + "\n", { mode: 384 });
+  await fs4.chmod(file, 384).catch(() => {
+  });
+  return { path: file };
+}
+
+// src/utils/logger.ts
+function createLogger(opts = {}) {
+  const out = (s) => {
+    if (!opts.quiet) process.stdout.write(s + "\n");
+  };
+  const err = (s) => {
+    process.stderr.write(s + "\n");
+  };
+  return {
+    info: (m) => out(`${c.cyan("i")} ${m}`),
+    success: (m) => out(`${c.green("\u2713")} ${m}`),
+    warn: (m) => out(`${c.yellow("!")} ${m}`),
+    error: (m) => err(`${c.red("\u2717")} ${m}`),
+    step: (m) => out(`${c.blue("\u203A")} ${m}`),
+    dim: (m) => out(c.dim(m)),
+    plain: (m) => out(m)
+  };
+}
+
+// src/commands/auth.ts
+async function runAuth(opts) {
+  const log = createLogger({ quiet: opts.quiet });
+  const apiUrl = getApiUrl(opts.apiUrl);
+  const authUrl = getAuthUrl(opts.authUrl);
+  const inlineWaitMs = opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0;
+  if (!opts.force) {
+    const existing = await readUserToken(opts.envPath);
+    if (existing) {
+      const email2 = await fetchSignedInEmail(apiUrl, existing);
+      if (email2) {
+        log.success(`Already connected as ${c.cyan(email2)}.`);
+        log.dim("  Pass --force to connect a different account.");
+        return;
       }
-    } catch {
+      log.warn("Your saved sign-in is no longer valid \u2014 reconnecting\u2026");
     }
   }
-  if (res.status === 403) {
-    try {
-      const body = await res.clone().json();
-      if (body?.error === "email_verification_required") {
-        for (const line of formatVerificationRequired(body)) process.stderr.write(line + "\n");
-        structuredPrinted.add(res);
-      }
-    } catch {
+  let token;
+  try {
+    token = await resumeAuthorization(apiUrl, { log, inlineWaitMs }) ?? "";
+    if (!token) token = await authorize(apiUrl, authUrl, { log, inlineWaitMs });
+  } catch (err) {
+    if (err instanceof AuthPendingError) {
+      printAuthHandoff(log, err);
+      process.exitCode = 1;
+      return;
     }
+    log.error(err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+    return;
   }
-  if (res.status === 503) {
-    try {
-      const body = await res.clone().json();
-      if (body?.error === "generation_paused") {
-        process.stderr.write(
-          `${c.red("\u2717")} ${body.message ?? "Generation is temporarily paused platform-wide. Try again later."}
-`
-        );
-        structuredPrinted.add(res);
-      }
-    } catch {
+  const { path: tokenPath } = await writeUserToken(token, opts.envPath);
+  log.success(`Connected. Saved your token to ${c.cyan(tokenPath)}.`);
+  const email = await fetchSignedInEmail(apiUrl, token);
+  if (email) log.plain(`  signed in as ${c.cyan(email)}`);
+  log.plain("");
+  log.dim("Now re-run the command you were doing (`genex init`, `genex preview`, \u2026).");
+}
+
+// src/commands/init.ts
+import path10 from "path";
+
+// src/lib/copy-templates.ts
+import fs5 from "fs/promises";
+import path5 from "path";
+function isGenexManaged(rel) {
+  return rel.split(path5.sep).some((seg) => seg.startsWith("genex"));
+}
+async function copyTemplates(srcDir, destDir, opts = {}) {
+  const result = { copied: [], updated: [], skipped: [] };
+  await walk(srcDir, srcDir, destDir, opts, result);
+  return result;
+}
+async function walk(rootSrc, src, dest, opts, result) {
+  const entries = await fs5.readdir(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = path5.join(src, entry.name);
+    const destPath = path5.join(dest, entry.name);
+    const rel = path5.relative(rootSrc, srcPath);
+    if (opts.exclude?.includes(rel)) continue;
+    if (entry.isDirectory()) {
+      await fs5.mkdir(destPath, { recursive: true });
+      await walk(rootSrc, srcPath, destPath, opts, result);
+      continue;
+    }
+    if (!entry.isFile()) {
+      continue;
+    }
+    const present = await exists(destPath);
+    const mayOverwrite = opts.force || isGenexManaged(rel);
+    if (present && !mayOverwrite) {
+      result.skipped.push(rel);
+      continue;
     }
+    await fs5.mkdir(path5.dirname(destPath), { recursive: true });
+    await fs5.copyFile(srcPath, destPath);
+    result.copied.push(rel);
+    if (present) result.updated.push(rel);
   }
-  return res;
 }
-async function fetchSignedInEmail(apiUrl, token) {
+async function exists(p) {
   try {
-    const res = await apiFetch(`${apiUrl}/api/auth/get-session`, {
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    if (!res.ok) return null;
-    const data = await res.json().catch(() => null);
-    return data?.user?.email ?? null;
+    await fs5.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/agents-contract.ts
+import fs6 from "fs/promises";
+import path6 from "path";
+var CONTRACT_BEGIN = "<!-- genex:contract:begin (managed by genex \u2014 edits inside this block are overwritten on sync) -->";
+var CONTRACT_END = "<!-- genex:contract:end -->";
+var GENEX_CONTRACT_BLOCK = `${CONTRACT_BEGIN}
+# Genex build contract (always in effect for this game)
+
+Your capabilities (all via \`npx genex \u2026\`): generate \`model\` \xB7 \`skybox\` \xB7 \`sfx\` \xB7 \`music\` \xB7 \`voice\` \xB7 \`texture\` \xB7 \`image\` (\`--edit\` \xB7 \`--inpaint\` \xB7 \`--glass\` \xB7 \`--clean\` \xB7 \`--upscale\`) \xB7 \`video\` \xB7 rigged \`character\` / \`creature\` \xB7 \`character animate <id> "<verb>"\` (also \`creature animate\`; \`--locomotion\` for the 8-way movement set, \`--video\` for your own footage) \xB7 the pixel toolbox \`ui extract|masks|plate|text-color|trim|audit\` \xB7 vendored \`controller character|car|drone|touch|quality\` \xB7 \`animations search\` \xB7 \`wait <id>\` / \`wait --all\` \xB7 \`preview\` / \`publish\`. Full options: \`npx genex --help\`. Task\u2192lane routing lives in the \`genex-game-director\` skill's routing map \u2014 re-load it whenever you're unsure which lane owns a task.
+
+1. Load the \`genex-game-director\` skill before starting the requested work. Route from the player's latest clear request: a focused request starts directly without replaying discovery or commissioning unrelated lanes. After ANY context compaction or session resume, re-read this file and \`DESIGN.md\`, re-load the skill for the stage you are executing, and continue from the Build plan's \`Now:\` line \u2014 never from memory alone.
+2. Ask only when one unresolved answer materially changes the work. If the request is clear, do not repeat an interview, confirm the pitch, force a concept round, or ask whole-game-vs-one-part again. For a genuinely broad new game, ask one decision: whole coordinated build or one request-relevant part first. If there is no clear request \u2014 a setup prompt pasted with nothing of their own \u2014 ask in PLAIN CHAT what they want to make, in their own words, and never fill the blank by pitching concepts. That opening question stays in chat on purpose: their reply carries the whole request, including anything they say about HOW you should work, and a menu of options answers a narrower question than the one they need to answer. Once you know what you are building, ask one decision at a time with your built-in question tool with clickable answer options when you have one; use a short plain-chat question otherwise. If the player stays silent after a necessary question, proceed on stated assumptions where reasonable and record each as "assumed \u2014 player didn't answer" in DESIGN.md \u2192 Decisions.
+3. \`DESIGN.md\` at the project root is the durable design contract AND build plan. Keep three truths distinct: the player's requested outcome, the current \`Now:\` focus, and open commitments. It must carry a \`## Build plan & status\` section with the working mode (\`whole coordinated build\`, \`step by step\`, or \`focused change\`), numbered milestones with status marks, and a \`Now:\` line naming the current one \u2014 a milestone is done only when its work reached a preview. The latest clear request may replace \`Now:\` immediately; it never silently shrinks the requested outcome or deletes unrelated commitments. Keep every decision, assumption, generation id/URL, local output, and wiring state current. When the plan first lands, tell the player in one plain line that you recorded what they asked for in \`DESIGN.md\` and will keep it current.
+4. ALL generated art, audio, video, characters, and UI come from \`genex\` commands \u2014 never from any other generation tool your platform bundles, unless the player explicitly asks for that tool by name. A local reference image is not a reason to switch tools: pass its file path to genex (\`--edit\` and \`--inpaint\` accept local paths). The same exclusivity covers shipping: building, previewing, and publishing go only through \`genex preview\` / \`genex publish\` \u2014 never load your platform's own site-building, hosting, or deploy skills for this game.
+5. Generated UI art is a tool you reach for, not a pipeline you owe. A restrained interface built in clean CSS is a finished, legitimate HUD \u2014 not a placeholder. Reach for the sprite lane (\`genex-ai-hud\`) when the game's own style genuinely wants drawn chrome \u2014 ornate, painterly, comic, hand-made \u2014 or when the player asks for HUD art. Generating ONE element you decided the game needs \u2014 a frame, a mask, an icon, a wordmark, a menu backdrop, a menu video \u2014 is a normal use of these tools, never a half-run pipeline. There is NO global game-concept image and no UI plan recited in chat: the art direction lives in the game's brief in words. A lane's own concept step survives only where the player is choosing a concrete thing (a character's candidates). Whatever you do generate, run its quality steps in full \u2014 extraction, masks, wiring, \`npx genex ui audit\`.
+6. Never draw a rectangular backing plate behind bars, digits, or icons \u2014 in sprites or CSS. Ornament lives on the widget's own silhouette; a truly needed shaped plate comes from \`npx genex ui plate\`.
+7. Fonts: the brief's display + body pair comes from the menu skill's genre table (or carries a one-line stated reason) and is LOADED for real in \`index.html\`.
+8. Never park ready work behind a question, and never stall on an unanswered one \u2014 decide, state the decision in chat, record it, keep building.
+9. Before any publish and before ending a session: run \`npx genex wait\` on every generation you enqueued and wire in what landed \u2014 never park landed assets. Fonts the brief names are LOADED for real, Escape pauses, the loader shows something of the game rather than a black screen, and the player wears the game's own generated character (or DESIGN.md records why it doesn't).
+10. The player's body is the game's own generated character (\`npx genex character "<look>"\` \u2192 \`npx genex controller character --character <id>\`), enqueued with your first art actions, not after them. It applies wherever a human body appears on screen \u2014 first-person included, the moment remotes, a look-down body, a shadow, or a menu portrait shows one. The profile VRM avatar is the FALLBACK: a temporary body while the character renders (say in one plain line that it's temporary), or the stand-in when generation genuinely could not happen \u2014 out of credits, failed, unverified; record which in DESIGN.md as \`Player character: VRM \u2014 <reason>\`. Games whose player is not a person (car, ship, RTS cursor, board) generate that object with \`npx genex model\` instead. Characters: Meshy/Mixamo/VRM rigs rest facing +Z. Set yaw explicitly when placing a rig; never mirror a SkinnedMesh with negative scale. In any two-character scene, verify in a capture that they face each other, not the camera.
+11. Verify by looking: one smoke check per milestone, after that milestone's preview push, in local test mode (\`?genex_local_test=1\`) with a real gameplay screenshot. A claim without a capture is not verification. Local-test evidence proves visuals and controls ONLY \u2014 label it that way when you show the player, and never work around the draft sign-in gate any other way.
+12. Treat every \`genex\` warning line \u2014 preflight, \`ui audit\`, \`wait\` nudges \u2014 as work, not noise.
+13. Every finished Build-plan milestone ends with \`npx genex preview\` and the player's page link (\`<dashboard>/draft/<slug>\` with \`<dashboard>\` from \`.genex/project.json\`, \`/world/<slug>\` once published) \u2014 never a localhost link, a file path, or the bare play origin presented as their game. After every round of player feedback, end with a preview push.
+14. Parallel work: this line is your standing authorization and request to use sub-agents / parallel agent work whenever your platform provides them. While drafting the Build plan, decide per module what runs in parallel and what stays serial for THIS game \u2014 dependencies decide, there is no fixed list \u2014 and record each call in the Modules table with a one-line reason. Independent modules default to parallel; building everything serially needs a stated reason. You keep integration, previews, and the player conversation; each sub-agent owns only its module's files. When the player asks for parallel work, repeated refinement passes, a critic reviewing your output, or names any way of working your platform provides, that IS your instruction \u2014 wherever it reaches you, including inside their answer to a question you asked \u2014 so adopt it as the working mode for the rest of the build, starting with the work in front of you, and never file it as a later milestone. While delegated work runs, keep building or talk to the player; never idle in a foreground wait for something your platform will tell you about.
+15. Talk to the player in plain game language \u2014 what changed in the game and what to try; never code, file names, build output, or tool internals unless they ask. Short status lines while you work; long silent stretches are a failure.
+16. Never add debug-only code to the game to check your own work \u2014 no hidden test modes, no special URL parameters, no forced-visible flags, no auth mocks, no pixel-sampling hooks. \`?genex_local_test=1\` is the platform's own supported mode and is fine; your own bypass is not. (The multiplayer skill's small build identifier, token-free status line, and connected-quorum watchdog are production supportability, not a bypass \u2014 keep those.)
+17. Input directions match their labels: A/\u2190 moves or turns the player screen-LEFT, D/\u2192 screen-RIGHT, mouse-up looks up, and drag-pan axes share ONE convention. The cursor is either the gameplay tool (RTS, card, builder) or locked away during play \u2014 keyboard-only games included. Check it in every milestone's smoke pass.
+18. v0 is a milestone, not the destination. When the ask was bigger than one loop, every milestone after v0 grows back toward the FULL ask with DESIGN.md's content lines as the checklist \u2014 a slice that previewed well never quietly becomes the game. Cosmetics never jump the queue past promised content.
+${CONTRACT_END}
+`;
+var CLAUDE_IMPORT_LINE = "@AGENTS.md";
+function mergeContractBlock(existing) {
+  const block = GENEX_CONTRACT_BLOCK.trimEnd();
+  if (existing === null || existing.trim() === "") return `${block}
+`;
+  const region = /<!-- genex:contract:begin[^\n]*-->[\s\S]*?<!-- genex:contract:end -->/;
+  if (region.test(existing)) {
+    return existing.replace(region, block);
+  }
+  const cleaned = existing.split("\n").filter(
+    (line) => !line.includes("genex:contract:begin") && !line.includes("genex:contract:end")
+  ).join("\n").trimEnd();
+  return cleaned === "" ? `${block}
+` : `${cleaned}
+
+${block}
+`;
+}
+async function writeAgentsContract(projectDir) {
+  let changed = false;
+  try {
+    const agentsPath = path6.join(projectDir, "AGENTS.md");
+    let existing = null;
+    try {
+      existing = await fs6.readFile(agentsPath, "utf8");
+    } catch {
+      existing = null;
+    }
+    const next = mergeContractBlock(existing);
+    if (next !== existing) {
+      await fs6.writeFile(agentsPath, next, "utf8");
+      changed = true;
+    }
+    const claudePath = path6.join(projectDir, "CLAUDE.md");
+    let claude = null;
+    try {
+      claude = await fs6.readFile(claudePath, "utf8");
+    } catch {
+      claude = null;
+    }
+    if (claude === null) {
+      await fs6.writeFile(claudePath, `${CLAUDE_IMPORT_LINE}
+`, "utf8");
+      changed = true;
+    } else if (!claude.split("\n").some((line) => line.trim() === CLAUDE_IMPORT_LINE)) {
+      const sep = claude.endsWith("\n") ? "" : "\n";
+      await fs6.writeFile(claudePath, `${claude}${sep}
+${CLAUDE_IMPORT_LINE}
+`, "utf8");
+      changed = true;
+    }
+  } catch {
+  }
+  return changed;
+}
+
+// src/lib/updates.ts
+import fs7 from "fs/promises";
+import os4 from "os";
+import path7 from "path";
+function parseSemver(v) {
+  const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v.trim());
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function isNewerVersion(a, b) {
+  const pa = parseSemver(a);
+  const pb = parseSemver(b);
+  if (!pa || !pb) return false;
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) return pa[i] > pb[i];
+  }
+  return false;
+}
+var SKILLS_VERSION_MARKER = "genex-skills-version.json";
+async function readSkillsMarker(skillsDir) {
+  try {
+    const raw = await fs7.readFile(path7.join(skillsDir, SKILLS_VERSION_MARKER), "utf8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed.version === "string" ? parsed.version : null;
+  } catch {
+    return null;
+  }
+}
+async function writeSkillsMarker(skillsDir, version = getCliVersion()) {
+  await fs7.mkdir(skillsDir, { recursive: true });
+  await fs7.writeFile(
+    path7.join(skillsDir, SKILLS_VERSION_MARKER),
+    JSON.stringify({ version, syncedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n"
+  );
+}
+async function hasGenexSkills(skillsDir) {
+  try {
+    const entries = await fs7.readdir(skillsDir);
+    return entries.some((name) => name.startsWith("genex-"));
+  } catch {
+    return false;
+  }
+}
+var REMOVED_SKILLS = [
+  "genex-explore",
+  "genex-threejs-skill-router",
+  "genex-threejs-bloom",
+  "genex-threejs-screen-space-ambient-occlusion",
+  "genex-threejs-atmosphere-aerial-perspective",
+  "genex-threejs-volumetric-clouds",
+  "genex-threejs-spectral-ocean",
+  "genex-threejs-water-optics",
+  "genex-threejs-temporal-surfaces",
+  "genex-threejs-raymarched-space-effects",
+  "genex-threejs-procedural-architecture",
+  "genex-threejs-procedural-fields",
+  "genex-threejs-procedural-geometry",
+  "genex-threejs-procedural-planets",
+  "genex-threejs-procedural-vegetation",
+  "genex-threejs-image-pipeline",
+  "genex-threejs-lighting-design",
+  "genex-threejs-precipitation-surfaces",
+  "genex-threejs-game-content",
+  "genex-threejs-open-world"
+];
+async function pruneRemovedSkills(skillsDir, log) {
+  const removed = [];
+  for (const name of REMOVED_SKILLS) {
+    const target = path7.join(skillsDir, name);
+    try {
+      await fs7.access(target);
+    } catch {
+      continue;
+    }
+    try {
+      await fs7.rm(target, { recursive: true });
+      removed.push(name);
+    } catch {
+    }
+  }
+  if (removed.length > 0) {
+    log?.plain(
+      `\u{1F9F9} Removed retired Genex skill${removed.length > 1 ? "s" : ""}: ${removed.join(", ")}`
+    );
+  }
+  return removed.length > 0;
+}
+async function syncSkillsForTarget(target, templatesDir = getTemplatesDir(), version = getCliVersion(), log) {
+  const skillsDir = path7.join(target.baseDir, "skills");
+  if (!await hasGenexSkills(skillsDir)) return false;
+  if (await readSkillsMarker(skillsDir) === version) return false;
+  const src = target.full ? templatesDir : path7.join(templatesDir, "skills");
+  const dest = target.full ? target.baseDir : skillsDir;
+  await copyTemplates(src, dest, { exclude: ["controllers", "motion"] });
+  await pruneRemovedSkills(skillsDir, log);
+  await writeSkillsMarker(skillsDir, version);
+  return true;
+}
+async function cleanupLegacyGlobalSkills(log) {
+  try {
+    const home = os4.homedir();
+    const [realCwd, realHome] = await Promise.all([
+      fs7.realpath(process.cwd()).catch(() => path7.resolve(process.cwd())),
+      fs7.realpath(home).catch(() => path7.resolve(home))
+    ]);
+    if (realCwd === realHome) return false;
+    let removed = false;
+    for (const dirName of [".claude", ".codex", ".cursor"]) {
+      const skillsDir = path7.join(home, dirName, "skills");
+      let entries = [];
+      try {
+        entries = await fs7.readdir(skillsDir);
+      } catch {
+        continue;
+      }
+      for (const name of entries) {
+        if (!name.startsWith("genex-")) continue;
+        try {
+          await fs7.rm(path7.join(skillsDir, name), { recursive: true });
+          removed = true;
+        } catch {
+        }
+      }
+    }
+    for (const rel of [
+      path7.join("agents", "genex-helper.md"),
+      path7.join("commands", "genex-status.md")
+    ]) {
+      try {
+        await fs7.rm(path7.join(home, ".claude", rel));
+        removed = true;
+      } catch {
+      }
+    }
+    if (removed) {
+      log?.plain("\u{1F9F9} Removed legacy GLOBAL Genex skills \u2014 installs are project-local now");
+    }
+    return removed;
+  } catch {
+    return false;
+  }
+}
+async function syncSkills(log) {
+  try {
+    await cleanupLegacyGlobalSkills(log);
+    const version = getCliVersion();
+    const templatesDir = getTemplatesDir();
+    let refreshed = false;
+    for (const target of resolveAgentTargets()) {
+      try {
+        refreshed = await syncSkillsForTarget(target, templatesDir, version, log) || refreshed;
+      } catch {
+      }
+    }
+    if (refreshed) log.plain(`\u{1F504} Genex skills updated to ${version}`);
+    try {
+      await fs7.access(path7.join(process.cwd(), ".genex"));
+      if (await writeAgentsContract(process.cwd())) {
+        log.plain("\u{1F504} Genex build contract refreshed (AGENTS.md managed block)");
+      }
+    } catch {
+    }
+  } catch {
+  }
+}
+var PUBLISHED_PACKAGES = [
+  { name: "@genex-ai/cli-demo", label: "CLI", install: "npm i -D @genex-ai/cli-demo@latest" },
+  { name: "@genex-ai/embed-sdk", label: "embed SDK", install: "npm i @genex-ai/embed-sdk@latest" },
+  {
+    name: "@genex-ai/multiplayer",
+    label: "multiplayer SDK",
+    install: "npm i @genex-ai/multiplayer@latest"
+  }
+];
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var REGISTRY_TIMEOUT_MS = 1500;
+function getUpdateCachePath() {
+  return path7.join(getGenexDir(), "update-check.json");
+}
+function isCacheFresh(cache, nowMs) {
+  const at = Date.parse(cache.checkedAt);
+  return Number.isFinite(at) && nowMs - at < CHECK_INTERVAL_MS;
+}
+function wasRecentlyNotified(cache, name, latest, nowMs) {
+  if (cache.notified?.[name] !== latest) return false;
+  const at = Date.parse(cache.notifiedAt ?? "");
+  return Number.isFinite(at) && nowMs - at < CHECK_INTERVAL_MS;
+}
+async function readUpdateCache() {
+  try {
+    const raw = await fs7.readFile(getUpdateCachePath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.checkedAt !== "string" || typeof parsed.latest !== "object") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function fetchLatestFromRegistry(name) {
+  try {
+    const res = await fetch(
+      `https://registry.npmjs.org/-/package/${encodeURIComponent(name)}/dist-tags`,
+      { signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS) }
+    );
+    if (!res.ok) return null;
+    const tags = await res.json();
+    return typeof tags.latest === "string" && parseSemver(tags.latest) ? tags.latest : null;
+  } catch {
+    return null;
+  }
+}
+function startUpdateCheck() {
+  return (async () => {
+    try {
+      const cached = await readUpdateCache();
+      if (cached && isCacheFresh(cached, Date.now())) return cached;
+      const latest = { ...cached?.latest ?? {} };
+      const results = await Promise.allSettled(
+        PUBLISHED_PACKAGES.map((p) => fetchLatestFromRegistry(p.name))
+      );
+      results.forEach((r, i) => {
+        if (r.status === "fulfilled" && r.value) latest[PUBLISHED_PACKAGES[i].name] = r.value;
+      });
+      const next = {
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        latest,
+        ...cached?.notified ? { notified: cached.notified } : {},
+        ...cached?.notifiedAt ? { notifiedAt: cached.notifiedAt } : {}
+      };
+      await fs7.mkdir(getGenexDir(), { recursive: true });
+      await fs7.writeFile(getUpdateCachePath(), JSON.stringify(next, null, 2) + "\n");
+      return next;
+    } catch {
+      return null;
+    }
+  })();
+}
+async function installedPackageVersion(cwd, name) {
+  try {
+    const raw = await fs7.readFile(path7.join(cwd, "node_modules", name, "package.json"), "utf8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+function formatNudge(label, latest, installed, install) {
+  return `\u2B06 Genex ${label} ${latest} available (installed ${installed}) \u2014 run: ${install}`;
+}
+async function reportUpdateNudges(check, log, cwd = process.cwd(), cachePath = getUpdateCachePath()) {
+  try {
+    const cache = await check;
+    if (!cache) return;
+    const now = Date.now();
+    const lines = [];
+    const announced = {};
+    let whatsNew = null;
+    for (const pkg of PUBLISHED_PACKAGES) {
+      if (pkg.name === "@genex-ai/cli-demo" && CLI_CHANNEL === "dev") continue;
+      const latest = cache.latest[pkg.name];
+      if (!latest) continue;
+      if (wasRecentlyNotified(cache, pkg.name, latest, now)) continue;
+      const installed = pkg.name === "@genex-ai/cli-demo" ? getCliVersion() : await installedPackageVersion(cwd, pkg.name);
+      if (!installed) continue;
+      if (isNewerVersion(latest, installed)) {
+        lines.push(formatNudge(pkg.label, latest, installed, pkg.install));
+        announced[pkg.name] = latest;
+        whatsNew ??= `https://www.npmjs.com/package/${pkg.name}`;
+      }
+    }
+    if (lines.length === 0) return;
+    for (const line of lines) log.plain(line);
+    log.dim(
+      `  Apply at a safe moment (never mid-task) \u2014 see the genex-updates skill. What's new: ${whatsNew}`
+    );
+    await recordNotified(cache, announced, cachePath);
+  } catch {
+  }
+}
+async function recordNotified(cache, announced, cachePath) {
+  try {
+    const next = {
+      ...cache,
+      notified: { ...cache.notified ?? {}, ...announced },
+      notifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await fs7.mkdir(path7.dirname(cachePath), { recursive: true });
+    await fs7.writeFile(cachePath, JSON.stringify(next, null, 2) + "\n");
   } catch {
-    return null;
   }
 }
 
+// src/lib/printed.ts
+var printed = /* @__PURE__ */ new WeakSet();
+function markPrinted(err) {
+  if (typeof err === "object" && err !== null) printed.add(err);
+  return err;
+}
+function wasPrinted(err) {
+  return typeof err === "object" && err !== null && printed.has(err);
+}
+
 // src/lib/project.ts
 import crypto2 from "crypto";
 async function createDraftProject(opts) {
@@ -1066,13 +1454,13 @@ async function fetchProjectStatus(apiUrl, token, slug) {
 }
 
 // src/lib/ssh.ts
-import fs5 from "fs/promises";
-import path5 from "path";
+import fs8 from "fs/promises";
+import path8 from "path";
 async function writeGitignore(dir, log) {
-  const file = path5.join(dir, ".gitignore");
+  const file = path8.join(dir, ".gitignore");
   let content = "";
   try {
-    content = await fs5.readFile(file, "utf8");
+    content = await fs8.readFile(file, "utf8");
   } catch {
   }
   const present = new Set(content.split("\n").map((l) => l.trim()));
@@ -1082,7 +1470,7 @@ async function writeGitignore(dir, log) {
   if (next.length > 0 && !next.endsWith("\n")) next += "\n";
   if (!content.trim()) next += "# genex local metadata + secrets \u2014 never publish\n";
   next += toAdd.join("\n") + "\n";
-  await fs5.writeFile(file, next);
+  await fs8.writeFile(file, next);
   log.dim(`Updated .gitignore (${toAdd.join(", ")}).`);
 }
 var LFS_PATTERNS = [
@@ -1112,10 +1500,10 @@ var LFS_PATTERNS = [
   "*.webm"
 ];
 async function writeGitattributes(dir, log) {
-  const file = path5.join(dir, ".gitattributes");
+  const file = path8.join(dir, ".gitattributes");
   let content = "";
   try {
-    content = await fs5.readFile(file, "utf8");
+    content = await fs8.readFile(file, "utf8");
   } catch {
   }
   const present = new Set(content.split("\n").map((l) => l.trim().split(/\s+/)[0]));
@@ -1125,143 +1513,13 @@ async function writeGitattributes(dir, log) {
   if (next.length > 0 && !next.endsWith("\n")) next += "\n";
   if (!content.trim()) next += "# Binary game assets go to Git LFS (R2) \u2014 keeps the source push small\n";
   next += toAdd.map((p) => `${p} filter=lfs diff=lfs merge=lfs -text`).join("\n") + "\n";
-  await fs5.writeFile(file, next);
+  await fs8.writeFile(file, next);
   log.dim(`Updated .gitattributes (${toAdd.length} binary globs \u2192 Git LFS).`);
 }
 
-// src/lib/store.ts
-import fs7 from "fs/promises";
-import path7 from "path";
-
-// src/lib/env.ts
-import fs6 from "fs/promises";
-import path6 from "path";
-import { spawn as spawn2 } from "child_process";
-async function writeEnvVar(envPath, key, value) {
-  let content = "";
-  let existed = false;
-  try {
-    content = await fs6.readFile(envPath, "utf8");
-    existed = true;
-  } catch {
-  }
-  const assignment = `${key}=${formatValue(value)}`;
-  const keyPattern = new RegExp(
-    `^(\\s*export\\s+)?${escapeRegExp(key)}=.*$`,
-    "gm"
-  );
-  let next;
-  let mode;
-  if (keyPattern.test(content)) {
-    next = content.replace(keyPattern, assignment);
-    mode = "updated";
-  } else {
-    let prefix = content;
-    if (prefix.length > 0 && !prefix.endsWith("\n")) prefix += "\n";
-    next = prefix + assignment + "\n";
-    mode = existed ? "appended" : "created";
-  }
-  await fs6.mkdir(path6.dirname(envPath), { recursive: true });
-  await fs6.writeFile(envPath, next, { mode: 384 });
-  await restrictFilePermissions(envPath);
-  return { mode, path: envPath };
-}
-async function restrictFilePermissions(filePath) {
-  if (process.platform !== "win32") {
-    await fs6.chmod(filePath, 384).catch(() => {
-    });
-    return;
-  }
-  const user = process.env.USERNAME ?? process.env.USER;
-  if (!user) return;
-  await new Promise((resolve) => {
-    try {
-      const child = spawn2(
-        "icacls",
-        [filePath, "/inheritance:r", "/grant:r", `${user}:F`],
-        { stdio: "ignore" }
-      );
-      child.on("error", () => resolve());
-      child.on("close", () => resolve());
-    } catch {
-      resolve();
-    }
-  });
-}
-function formatValue(value) {
-  if (/[\s#"'$`\\]/.test(value)) {
-    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-  }
-  return value;
-}
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-// src/lib/store.ts
-function getProjectMetadataPath(cwd = process.cwd()) {
-  return path7.join(cwd, ".genex", "project.json");
-}
-async function writeUserToken(token, envPath) {
-  const { path: written } = await writeEnvVar(getGenexEnvPath(envPath), ENV_TOKEN_KEY, token);
-  return { path: written };
-}
-async function rotateRejectedEnv(envPath) {
-  const file = getGenexEnvPath(envPath);
-  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const aside = `${file}.rejected-${stamp}`;
-  try {
-    await fs7.rename(file, aside);
-    return aside;
-  } catch {
-    return null;
-  }
-}
-async function readUserToken(envPath) {
-  const fromGenex = await readTokenFromFile(getGenexEnvPath(envPath));
-  if (fromGenex) return fromGenex;
-  if (!envPath && !process.env[ENV_FILE_ENV]) {
-    return readTokenFromFile(path7.join(process.cwd(), ".env"));
-  }
-  return null;
-}
-async function readTokenFromFile(file) {
-  let content;
-  try {
-    content = await fs7.readFile(file, "utf8");
-  } catch {
-    return null;
-  }
-  const m = content.match(/^\s*(?:export\s+)?GENEX_TOKEN=(.*)$/m);
-  if (!m) return null;
-  return stripQuotes(m[1].trim()) || null;
-}
-function stripQuotes(v) {
-  if (v.startsWith('"') && v.endsWith('"') || v.startsWith("'") && v.endsWith("'")) {
-    return v.slice(1, -1);
-  }
-  return v;
-}
-async function readProject(cwd = process.cwd()) {
-  try {
-    const raw = await fs7.readFile(getProjectMetadataPath(cwd), "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-async function writeProject(meta, cwd = process.cwd()) {
-  const file = getProjectMetadataPath(cwd);
-  await fs7.mkdir(path7.dirname(file), { recursive: true });
-  await fs7.writeFile(file, JSON.stringify(meta, null, 2) + "\n", { mode: 384 });
-  await fs7.chmod(file, 384).catch(() => {
-  });
-  return { path: file };
-}
-
 // src/lib/game-config.ts
-import fs8 from "fs/promises";
-import path8 from "path";
+import fs9 from "fs/promises";
+import path9 from "path";
 var DEFAULT_DASHBOARD_ORIGIN = new URL(DEFAULT_AUTH_URL).origin;
 function renderGenexConfig(slug) {
   return `// src/genex.config.ts \u2014 written by \`genex init\`. DO NOT hardcode URLs here.
@@ -1318,7 +1576,7 @@ ${overrides.join("\n")}
 }
 async function writeIfAbsent(file, content, log) {
   try {
-    await fs8.writeFile(file, content, { flag: "wx" });
+    await fs9.writeFile(file, content, { flag: "wx" });
     log.dim(`  wrote ${c.cyan(file)}`);
     return true;
   } catch (err) {
@@ -1330,34 +1588,15 @@ async function writeIfAbsent(file, content, log) {
   }
 }
 async function writeGameConfigFiles(meta, log, cwd = process.cwd()) {
-  await fs8.mkdir(path8.join(cwd, "src"), { recursive: true });
-  await writeIfAbsent(path8.join(cwd, "src", "genex.config.ts"), renderGenexConfig(meta.slug), log);
-  await writeIfAbsent(path8.join(cwd, ".env"), renderSlugEnv(meta.slug), log);
+  await fs9.mkdir(path9.join(cwd, "src"), { recursive: true });
+  await writeIfAbsent(path9.join(cwd, "src", "genex.config.ts"), renderGenexConfig(meta.slug), log);
+  await writeIfAbsent(path9.join(cwd, ".env"), renderSlugEnv(meta.slug), log);
   const overrides = renderDevOverrides(meta);
   if (overrides) {
-    await writeIfAbsent(path8.join(cwd, ".env.development.local"), overrides, log);
+    await writeIfAbsent(path9.join(cwd, ".env.development.local"), overrides, log);
   }
 }
 
-// src/utils/logger.ts
-function createLogger(opts = {}) {
-  const out = (s) => {
-    if (!opts.quiet) process.stdout.write(s + "\n");
-  };
-  const err = (s) => {
-    process.stderr.write(s + "\n");
-  };
-  return {
-    info: (m) => out(`${c.cyan("i")} ${m}`),
-    success: (m) => out(`${c.green("\u2713")} ${m}`),
-    warn: (m) => out(`${c.yellow("!")} ${m}`),
-    error: (m) => err(`${c.red("\u2717")} ${m}`),
-    step: (m) => out(`${c.blue("\u203A")} ${m}`),
-    dim: (m) => out(c.dim(m)),
-    plain: (m) => out(m)
-  };
-}
-
 // src/commands/init.ts
 async function runInit(opts) {
   const log = createLogger({ quiet: opts.quiet });
@@ -1372,14 +1611,14 @@ async function runInit(opts) {
   let totalNew = 0;
   let totalUpdated = 0;
   for (const t of targets) {
-    const src = t.full ? templatesDir : path9.join(templatesDir, "skills");
-    const dest = t.full ? t.baseDir : path9.join(t.baseDir, "skills");
+    const src = t.full ? templatesDir : path10.join(templatesDir, "skills");
+    const dest = t.full ? t.baseDir : path10.join(t.baseDir, "skills");
     const { copied, updated } = await copyTemplates(src, dest, {
       force: opts.force,
       exclude: ["controllers", "motion"]
     });
-    await pruneRemovedSkills(path9.join(t.baseDir, "skills"), log);
-    await writeSkillsMarker(path9.join(t.baseDir, "skills"));
+    await pruneRemovedSkills(path10.join(t.baseDir, "skills"), log);
+    await writeSkillsMarker(path10.join(t.baseDir, "skills"));
     const added = copied.length - updated.length;
     totalNew += added;
     totalUpdated += updated.length;
@@ -1395,18 +1634,24 @@ async function runInit(opts) {
     return;
   }
   const authBaseUrl = getAuthUrl(opts.authUrl);
+  const authApiUrl = getApiUrl(opts.apiUrl);
   let token = await readUserToken(opts.envPath);
   let savedToken = Boolean(token);
   if (!token) {
     try {
-      token = await authorize(authBaseUrl, {
+      token = await authorize(authApiUrl, authBaseUrl, {
         log,
-        timeoutMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
+        inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
     } catch (err) {
+      if (err instanceof AuthPendingError) {
+        printAuthHandoff(log, err);
+        log.dim("Everything else is installed \u2014 `genex auth` finishes the sign-in, then re-run `genex init`.");
+        return;
+      }
       log.error(err instanceof Error ? err.message : String(err));
       log.dim("Your workspace files were installed. Re-run `genex init` to finish authorizing.");
-      throw err;
+      throw markPrinted(err);
     }
     const { path: tokenPath } = await writeUserToken(token, opts.envPath);
     log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)} (${ENV_TOKEN_KEY}).`);
@@ -1423,7 +1668,7 @@ async function runInit(opts) {
     if (email) log.plain(`  signed in as ${c.cyan(email)}`);
   };
   await echoIdentity();
-  const projectName = opts.name?.trim() || path9.basename(process.cwd());
+  const projectName = opts.name?.trim() || path10.basename(process.cwd());
   const create = (bearer) => createDraftProject({
     apiUrl,
     token: bearer,
@@ -1441,14 +1686,19 @@ async function runInit(opts) {
     const aside = await rotateRejectedEnv(opts.envPath);
     if (aside) log.dim(`  moved the rejected credential to ${c.cyan(aside)}`);
     try {
-      token = await authorize(authBaseUrl, {
+      token = await authorize(authApiUrl, authBaseUrl, {
         log,
-        timeoutMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
+        inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
     } catch (err) {
+      if (err instanceof AuthPendingError) {
+        printAuthHandoff(log, err);
+        log.dim("Then re-run `genex init` \u2014 your workspace files are already installed.");
+        return;
+      }
       log.error(err instanceof Error ? err.message : String(err));
       log.dim("Your workspace files were installed. Re-run `genex init` to finish authorizing.");
-      throw err;
+      throw markPrinted(err);
     }
     const { path: tokenPath } = await writeUserToken(token, opts.envPath);
     log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)} (${ENV_TOKEN_KEY}).`);
@@ -1470,8 +1720,8 @@ async function runInit(opts) {
 }
 
 // src/commands/link.ts
-import fs9 from "fs/promises";
-import path10 from "path";
+import fs10 from "fs/promises";
+import path11 from "path";
 async function runLink(opts) {
   const log = createLogger({ quiet: opts.quiet });
   log.plain(c.bold("genex link"));
@@ -1491,17 +1741,26 @@ async function runLink(opts) {
     return;
   }
   const authBaseUrl = getAuthUrl(opts.authUrl);
+  const apiUrl = getApiUrl(opts.apiUrl);
   let token = await readUserToken(opts.envPath);
   if (!token) {
-    token = await authorize(authBaseUrl, {
-      log,
-      timeoutMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
-    });
+    try {
+      token = await authorize(apiUrl, authBaseUrl, {
+        log,
+        inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
+      });
+    } catch (err) {
+      if (err instanceof AuthPendingError) {
+        printAuthHandoff(log, err);
+        log.dim(`Then re-run ${c.cyan(`genex link ${slug}`)}.`);
+        return;
+      }
+      throw err;
+    }
     const { path: tokenPath } = await writeUserToken(token, opts.envPath);
     log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)}.`);
     log.plain("");
   }
-  const apiUrl = getApiUrl(opts.apiUrl);
   const email = await fetchSignedInEmail(apiUrl, token);
   if (email) log.plain(`  signed in as ${c.cyan(email)}`);
   log.step(`Looking up ${c.cyan(slug)}\u2026`);
@@ -1531,23 +1790,23 @@ async function runLink(opts) {
   if (project.playUrl) log.dim(`  play URL: ${project.playUrl}`);
 }
 async function ensureSlugEnv(slug, log, cwd = process.cwd()) {
-  const file = path10.join(cwd, ".env");
+  const file = path11.join(cwd, ".env");
   let content;
   try {
-    content = await fs9.readFile(file, "utf8");
+    content = await fs10.readFile(file, "utf8");
   } catch {
     return;
   }
   const re = /^(\s*VITE_GENEX_SLUG=)(.*)$/m;
   const m = content.match(re);
   if (!m) {
-    await fs9.appendFile(file, `${content.endsWith("\n") ? "" : "\n"}VITE_GENEX_SLUG=${slug}
+    await fs10.appendFile(file, `${content.endsWith("\n") ? "" : "\n"}VITE_GENEX_SLUG=${slug}
 `);
     log.dim(`  added VITE_GENEX_SLUG=${slug} to .env`);
     return;
   }
   if (m[2].trim() === slug) return;
-  await fs9.writeFile(file, content.replace(re, `$1${slug}`));
+  await fs10.writeFile(file, content.replace(re, `$1${slug}`));
   log.dim(`  updated .env: VITE_GENEX_SLUG=${slug} (was ${m[2].trim()})`);
 }
 async function fetchOwnProject(apiUrl, token, slug, log) {
@@ -1611,21 +1870,29 @@ async function runList(opts) {
     process.exitCode = 1;
     return;
   }
+  const meta = await readProject();
+  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
+  const dashOrigin = (meta?.dashboardOrigins?.[0] ?? getAuthUrl(opts.authUrl)).replace(/\/+$/, "");
   let token = opts.token ?? await readUserToken(opts.envPath);
   if (!token) {
     if (opts.noAuth) {
-      log.error("Not signed in. Re-run without --no-auth to connect in the browser.");
+      log.error("Not signed in. Re-run without --no-auth to connect.");
       process.exitCode = 1;
       return;
     }
-    log.plain("Not signed in \u2014 opening the browser to connect\u2026");
+    log.plain("Not signed in \u2014 connecting\u2026");
     try {
-      token = await authorize(getAuthUrl(opts.authUrl), {
+      token = await authorize(apiUrl, getAuthUrl(opts.authUrl), {
         log,
-        timeoutMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
+        inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
       });
     } catch (err) {
-      log.error(`Sign-in didn't complete: ${String(err)}`);
+      if (err instanceof AuthPendingError) {
+        printAuthHandoff(log, err);
+        log.dim(`Then re-run ${c.cyan("genex list")}.`);
+        return;
+      }
+      log.error(`Sign-in didn't complete: ${err instanceof Error ? err.message : String(err)}`);
       process.exitCode = 1;
       return;
     }
@@ -1633,20 +1900,28 @@ async function runList(opts) {
     log.success(`Authorized. Saved your token to ${c.cyan(tokenPath)}.`);
     log.plain("");
   }
-  const meta = await readProject();
-  const apiUrl = getApiUrl(opts.apiUrl ?? meta?.apiUrl);
-  const dashOrigin = (meta?.dashboardOrigins?.[0] ?? getAuthUrl(opts.authUrl)).replace(/\/+$/, "");
   const projectsUrl = `${apiUrl}/api/projects`;
   const fetchProjects = (t) => apiFetch(projectsUrl, { headers: { Authorization: `Bearer ${t}` } });
   let res;
   try {
     res = await fetchProjects(token);
     if (res.status === 401 && !opts.token && !opts.noAuth) {
-      log.plain("Your saved sign-in was rejected \u2014 reconnecting in the browser\u2026");
-      token = await authorize(getAuthUrl(opts.authUrl), {
-        log,
-        timeoutMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
-      });
+      log.plain("Your saved sign-in was rejected \u2014 reconnecting\u2026");
+      try {
+        token = await authorize(apiUrl, getAuthUrl(opts.authUrl), {
+          log,
+          inlineWaitMs: opts.timeoutSec ? opts.timeoutSec * 1e3 : void 0
+        });
+      } catch (err) {
+        if (err instanceof AuthPendingError) {
+          printAuthHandoff(log, err);
+          log.dim(`Then re-run ${c.cyan("genex list")}.`);
+          return;
+        }
+        log.error(`Sign-in didn't complete: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+        return;
+      }
       await writeUserToken(token, opts.envPath);
       res = await fetchProjects(token);
     }
@@ -1710,9 +1985,9 @@ function relTime(iso) {
 // src/lib/deploy.ts
 import { spawn as spawn3 } from "child_process";
 import crypto3 from "crypto";
-import fs12 from "fs/promises";
-import os4 from "os";
-import path12 from "path";
+import fs13 from "fs/promises";
+import os5 from "os";
+import path13 from "path";
 
 // ../../packages/mobile-scan/src/image-dims.ts
 function u32be(b, o) {
@@ -1975,12 +2250,12 @@ function tierFor(estVramMb) {
 }
 
 // src/commands/ui.ts
-import fs11 from "fs/promises";
-import path11 from "path";
+import fs12 from "fs/promises";
+import path12 from "path";
 import { PNG as PNG2 } from "pngjs";
 
 // src/lib/png-tools.ts
-import fs10 from "fs/promises";
+import fs11 from "fs/promises";
 import { PNG } from "pngjs";
 var ALPHA_TRANSPARENT_MAX = 16;
 var isHttpUrl = (s) => /^https?:\/\//i.test(s);
@@ -1991,12 +2266,12 @@ async function loadPng(input) {
     if (!res.ok) throw new Error(`Couldn't fetch ${input} (HTTP ${res.status}).`);
     buf = Buffer.from(await res.arrayBuffer());
   } else {
-    buf = await fs10.readFile(input);
+    buf = await fs11.readFile(input);
   }
   return PNG.sync.read(buf);
 }
 async function writePng(file, png) {
-  await fs10.writeFile(file, PNG.sync.write(png));
+  await fs11.writeFile(file, PNG.sync.write(png));
 }
 function cropPng(image, box) {
   const out = new PNG({ width: box.w, height: box.h });
@@ -2296,7 +2571,7 @@ async function uiExtract(opts, log) {
   const dilatePx = opts.dilate ?? 0;
   const sheet = await loadPng(input);
   const { width: W, height: H, data } = sheet;
-  await fs11.mkdir(outDir, { recursive: true });
+  await fs12.mkdir(outDir, { recursive: true });
   log.plain(c.bold("genex ui extract"));
   log.dim(`  ${input} (${W}x${H}) \u2192 ${outDir}, ${names.length} names`);
   let hasTransparency = false;
@@ -2525,7 +2800,7 @@ async function uiExtract(opts, log) {
         rimPixels: speckle.sampled
       });
     }
-    const outPath = path11.join(outDir, `${name}.png`);
+    const outPath = path12.join(outDir, `${name}.png`);
     await writePng(outPath, out);
     const sidecar = {
       name,
@@ -2544,7 +2819,7 @@ async function uiExtract(opts, log) {
       defringed
     };
     const { name: _n, out: _o, ...sidecarBody } = sidecar;
-    await fs11.writeFile(
+    await fs12.writeFile(
       outPath.replace(/\.png$/i, "") + ".bbox.json",
       JSON.stringify(sidecarBody, null, 2)
     );
@@ -2553,8 +2828,8 @@ async function uiExtract(opts, log) {
       `${name}.png  ${cropW}x${cropH} (ar ${sidecar.aspectRatio}) at sheet ${padX0},${padY0}`
     );
   }
-  const debugPath = path11.join(outDir, "extract-debug.json");
-  await fs11.writeFile(
+  const debugPath = path12.join(outDir, "extract-debug.json");
+  await fs12.writeFile(
     debugPath,
     JSON.stringify(
       {
@@ -3016,7 +3291,7 @@ async function uiMasks(opts, log) {
   const registrationTolerance = opts.registrationTolerance ?? 0.04;
   const edgeFlushMax = opts.edgeFlushMax ?? 0.04;
   const loosened = registrationTolerance > 0.04 || edgeFlushMax > 0.04 || minCoverage < 0.01 || maxCoverage > 0.85;
-  await fs11.mkdir(outDir, { recursive: true });
+  await fs12.mkdir(outDir, { recursive: true });
   log.plain(c.bold("genex ui masks"));
   log.dim(`  ${input} (${image.width}x${image.height}), ${pairs.length} pair(s) \u2192 ${outDir}`);
   const sheetComponents = detectSheetComponents(image, opts.minPixels ?? 2e3);
@@ -3069,11 +3344,11 @@ async function uiMasks(opts, log) {
       });
     }
     const overlay = makeOverlay(clean2, converted.png);
-    const framePath = path11.join(outDir, `${pair.name}-frame.png`);
-    const maskPath = path11.join(outDir, `${pair.name}-mask.png`);
-    const annotatedPath = path11.join(outDir, `${pair.name}-annotated-source.png`);
-    const overlayPath = path11.join(outDir, `${pair.name}-overlay.png`);
-    const metaPath = path11.join(outDir, `${pair.name}.annotated-progress.json`);
+    const framePath = path12.join(outDir, `${pair.name}-frame.png`);
+    const maskPath = path12.join(outDir, `${pair.name}-mask.png`);
+    const annotatedPath = path12.join(outDir, `${pair.name}-annotated-source.png`);
+    const overlayPath = path12.join(outDir, `${pair.name}-overlay.png`);
+    const metaPath = path12.join(outDir, `${pair.name}.annotated-progress.json`);
     await writePng(framePath, clean2);
     await writePng(maskPath, converted.png);
     await writePng(annotatedPath, annotated);
@@ -3120,7 +3395,7 @@ async function uiMasks(opts, log) {
       },
       overlay: overlayPath
     };
-    await fs11.writeFile(metaPath, `${JSON.stringify(meta, null, 2)}
+    await fs12.writeFile(metaPath, `${JSON.stringify(meta, null, 2)}
 `);
     results.push(meta);
     const fb = converted.bbox;
@@ -3136,8 +3411,8 @@ async function uiMasks(opts, log) {
       );
     }
   }
-  const indexPath = path11.join(outDir, "annotated-progress.json");
-  await fs11.writeFile(indexPath, `${JSON.stringify({ input, loosened, pairs: results }, null, 2)}
+  const indexPath = path12.join(outDir, "annotated-progress.json");
+  await fs12.writeFile(indexPath, `${JSON.stringify({ input, loosened, pairs: results }, null, 2)}
 `);
   log.plain("");
   log.success(`Wrote ${pairs.length} frame+mask pair(s) \u2192 ${outDir} (index: ${indexPath}).`);
@@ -3263,7 +3538,7 @@ async function uiTextColor(opts, log) {
   };
   process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
-  if (opts.out) await fs11.writeFile(opts.out, `${JSON.stringify(result, null, 2)}
+  if (opts.out) await fs12.writeFile(opts.out, `${JSON.stringify(result, null, 2)}
 `);
   if (opts.cropPath) log.dim(`  crop \u2192 ${opts.cropPath}`);
 }
@@ -3295,7 +3570,7 @@ async function uiTrim(opts, log) {
   const sidecar = computeBBoxes(trimmed);
   const speckleAllowed = !!(speckle && speckle.ratio > SPECKLE_MAX_RATIO);
   const sidecarPath = outPath.replace(/\.png$/i, "") + ".bbox.json";
-  await fs11.writeFile(
+  await fs12.writeFile(
     sidecarPath,
     JSON.stringify(speckleAllowed ? { ...sidecar, speckleAllowed: true } : sidecar, null, 2)
   );
@@ -3402,7 +3677,7 @@ async function uiPlate(opts, log) {
     fail("No interior found \u2014 the image is fully transparent (or erode ate everything). Check --in / lower --erode.");
   }
   await writePng(outPath, out);
-  const name = path11.basename(outPath);
+  const name = path12.basename(outPath);
   log.plain(c.bold("genex ui plate"));
   log.success(`${outPath}  ${W}x${H}, interior ${(count / (W * H) * 100).toFixed(1)}% (erode ${erode}px)`);
   log.dim("  Wire it as the plate's silhouette (same box as the frame <img>, plate UNDER the art):");
@@ -3567,13 +3842,13 @@ async function walkFiles(dir) {
   const out = [];
   let entries;
   try {
-    entries = await fs11.readdir(dir, { withFileTypes: true });
+    entries = await fs12.readdir(dir, { withFileTypes: true });
   } catch {
     return out;
   }
   for (const entry of entries) {
     if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
-    const p = path11.join(dir, entry.name);
+    const p = path12.join(dir, entry.name);
     if (entry.isDirectory()) out.push(...await walkFiles(p));
     else out.push(p);
   }
@@ -3582,7 +3857,7 @@ async function walkFiles(dir) {
 async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   const viewportFindings = [];
   try {
-    const indexHtml = await fs11.readFile(path11.join(cwd, "index.html"), "utf8");
+    const indexHtml = await fs12.readFile(path12.join(cwd, "index.html"), "utf8");
     if (!/<meta[^>]+name=["']viewport["']/i.test(indexHtml)) {
       viewportFindings.push({
         kind: "viewport-meta",
@@ -3596,28 +3871,28 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
     }
   } catch {
   }
-  const absAssets = path11.resolve(cwd, assetDir);
+  const absAssets = path12.resolve(cwd, assetDir);
   try {
-    if (!(await fs11.stat(absAssets)).isDirectory()) {
+    if (!(await fs12.stat(absAssets)).isDirectory()) {
       return viewportFindings.length > 0 ? viewportFindings : null;
     }
   } catch {
     return viewportFindings.length > 0 ? viewportFindings : null;
   }
-  const srcFiles = (await walkFiles(path11.resolve(cwd, srcDir))).filter(
-    (p) => AUDIT_SRC_EXTS.has(path11.extname(p).toLowerCase())
+  const srcFiles = (await walkFiles(path12.resolve(cwd, srcDir))).filter(
+    (p) => AUDIT_SRC_EXTS.has(path12.extname(p).toLowerCase())
   );
   try {
-    for (const name of await fs11.readdir(cwd)) {
-      const ext = path11.extname(name).toLowerCase();
-      if (ext === ".html" || ext === ".css") srcFiles.push(path11.join(cwd, name));
+    for (const name of await fs12.readdir(cwd)) {
+      const ext = path12.extname(name).toLowerCase();
+      if (ext === ".html" || ext === ".css") srcFiles.push(path12.join(cwd, name));
     }
   } catch {
   }
   const sources = [];
   for (const p of srcFiles) {
     try {
-      sources.push({ rel: path11.relative(cwd, p), text: await fs11.readFile(p, "utf8") });
+      sources.push({ rel: path12.relative(cwd, p), text: await fs12.readFile(p, "utf8") });
     } catch {
     }
   }
@@ -3627,11 +3902,11 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   const metaByName = /* @__PURE__ */ new Map();
   const bboxByPng = /* @__PURE__ */ new Map();
   for (const p of assetFiles) {
-    const base = path11.basename(p);
+    const base = path12.basename(p);
     const metaMatch = /^(.+)\.annotated-progress\.json$/.exec(base);
     if (metaMatch) {
       try {
-        const meta = JSON.parse(await fs11.readFile(p, "utf8"));
+        const meta = JSON.parse(await fs12.readFile(p, "utf8"));
         metaByName.set(metaMatch[1], {
           cleanCrop: meta.clean?.crop ?? null,
           loosened: meta.loosened === true
@@ -3642,7 +3917,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
     }
     if (base.endsWith(".bbox.json")) {
       try {
-        const sidecar = JSON.parse(await fs11.readFile(p, "utf8"));
+        const sidecar = JSON.parse(await fs12.readFile(p, "utf8"));
         if (sidecar.sheetBBox) bboxByPng.set(base.replace(/\.bbox\.json$/, ".png"), sidecar.sheetBBox);
       } catch {
       }
@@ -3651,7 +3926,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   for (const [name, meta] of metaByName) {
     if (!meta.cleanCrop || !referenced(`${name}-mask.png`)) continue;
     for (const p of assetFiles) {
-      const base = path11.basename(p);
+      const base = path12.basename(p);
       if (!base.toLowerCase().endsWith(".png")) continue;
       if (base !== `${name}.png` && !base.startsWith(`${name}-`)) continue;
       if (/-mask\.png$|-frame\.png$|-overlay\.png$|-annotated-source\.png$/.test(base)) continue;
@@ -3675,7 +3950,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   }
   const pngByBase = /* @__PURE__ */ new Map();
   for (const p of assetFiles) {
-    const base = path11.basename(p);
+    const base = path12.basename(p);
     if (base.toLowerCase().endsWith(".png")) pngByBase.set(base, p);
   }
   for (const [maskBase, maskPath] of pngByBase) {
@@ -3688,8 +3963,8 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
       let frame;
       let mask;
       try {
-        frame = PNG2.sync.read(await fs11.readFile(framePath));
-        mask = PNG2.sync.read(await fs11.readFile(maskPath));
+        frame = PNG2.sync.read(await fs12.readFile(framePath));
+        mask = PNG2.sync.read(await fs12.readFile(maskPath));
       } catch {
         continue;
       }
@@ -3708,7 +3983,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
     if (!referenced(base)) continue;
     let png;
     try {
-      png = PNG2.sync.read(await fs11.readFile(p));
+      png = PNG2.sync.read(await fs12.readFile(p));
     } catch {
       continue;
     }
@@ -3728,7 +4003,7 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
   }
   const maskReported = /* @__PURE__ */ new Set();
   for (const p of assetFiles) {
-    const m = /^(.+)\.annotated-progress\.json$/.exec(path11.basename(p));
+    const m = /^(.+)\.annotated-progress\.json$/.exec(path12.basename(p));
     if (!m) continue;
     const maskBase = `${m[1]}-mask.png`;
     if (!referenced(maskBase)) {
@@ -3740,14 +4015,14 @@ async function collectUiAuditFindings(assetDir, srcDir, cwd = process.cwd()) {
     }
   }
   for (const p of assetFiles) {
-    const base = path11.basename(p);
+    const base = path12.basename(p);
     if (!base.toLowerCase().endsWith(".png")) continue;
     if (/-annotated-source\.png$|-overlay\.png$/.test(base)) continue;
     if (maskReported.has(base)) continue;
     if (!referenced(base)) {
       findings.push({
         kind: "unwired-sprite",
-        message: `${path11.relative(cwd, p)} is on disk but never referenced in ${srcDir}/index.html/CSS \u2014 wire it, or record the one-line reason it was cut. (Computed-string references are invisible here \u2014 check.)`
+        message: `${path12.relative(cwd, p)} is on disk but never referenced in ${srcDir}/index.html/CSS \u2014 wire it, or record the one-line reason it was cut. (Computed-string references are invisible here \u2014 check.)`
       });
     }
   }
@@ -3881,7 +4156,7 @@ async function printUiAuditPreflight(log) {
 }
 async function printPipelineStatePreflight(log, cwd = process.cwd()) {
   try {
-    const design = await fs12.readFile(path12.join(cwd, "DESIGN.md"), "utf8").catch(() => "");
+    const design = await fs13.readFile(path13.join(cwd, "DESIGN.md"), "utf8").catch(() => "");
     const warnings = [];
     if (design.length > 0 && !/##\s*build plan & status/i.test(design)) {
       warnings.push(
@@ -3889,7 +4164,7 @@ async function printPipelineStatePreflight(log, cwd = process.cwd()) {
       );
     }
     if (!/player character:/i.test(design)) {
-      const hasCharacter = await fs12.access(path12.join(cwd, "public", "assets", "meshy-character.json")).then(() => true, () => false);
+      const hasCharacter = await fs13.access(path13.join(cwd, "public", "assets", "meshy-character.json")).then(() => true, () => false);
       if (!hasCharacter && await loadsPlayerBody(cwd)) {
         warnings.push(
           `Player character is the stock avatar \u2014 no generated character is wired. The game's own generated character is the player's body wherever a human body appears on screen, first-person included (genex-ai-character). Generate it, or record "Player character: VRM \u2014 <reason>" in DESIGN.md (no human body in this game / out of credits / player declined).`
@@ -3903,12 +4178,12 @@ async function printPipelineStatePreflight(log, cwd = process.cwd()) {
 async function loadsPlayerBody(cwd) {
   const BODY_LOADERS = /\bloadPlayerCharacter\s*\(|\bloadVrm(?:Clone)?\s*\(/;
   try {
-    const entries = await fs12.readdir(path12.join(cwd, "src"), { recursive: true });
+    const entries = await fs13.readdir(path13.join(cwd, "src"), { recursive: true });
     for (const rel of entries) {
       if (rel.includes("node_modules")) continue;
-      if (rel.split(path12.sep)[0] === "controllers" || rel.startsWith("controllers/")) continue;
+      if (rel.split(path13.sep)[0] === "controllers" || rel.startsWith("controllers/")) continue;
       if (!/\.(ts|tsx|js|jsx)$/.test(rel)) continue;
-      const text = await fs12.readFile(path12.join(cwd, "src", rel), "utf8").catch(() => "");
+      const text = await fs13.readFile(path13.join(cwd, "src", rel), "utf8").catch(() => "");
       if (BODY_LOADERS.test(text)) return true;
     }
   } catch {
@@ -3932,9 +4207,9 @@ async function deployGame(ctx, opts, log) {
     }
     log.success("Built.");
   }
-  const distDir = path12.join(cwd, "dist");
+  const distDir = path13.join(cwd, "dist");
   const siteDir = await isDir2(distDir) ? distDir : cwd;
-  const rel = path12.relative(cwd, siteDir) || ".";
+  const rel = path13.relative(cwd, siteDir) || ".";
   if (siteDir === cwd) await writeGitignore(cwd, log);
   const files = await collectFiles(siteDir);
   if (files.length === 0) {
@@ -3992,7 +4267,7 @@ async function deployGame(ctx, opts, log) {
 }
 async function hasBuildScript(cwd) {
   try {
-    const pkg = JSON.parse(await fs12.readFile(path12.join(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(await fs13.readFile(path13.join(cwd, "package.json"), "utf8"));
     return Boolean(pkg.scripts?.build);
   } catch {
     return false;
@@ -4001,12 +4276,12 @@ async function hasBuildScript(cwd) {
 async function collectFiles(root) {
   const out = [];
   const walk2 = async (dir, prefix) => {
-    for (const e of await fs12.readdir(dir, { withFileTypes: true })) {
+    for (const e of await fs13.readdir(dir, { withFileTypes: true })) {
       const relPath = prefix ? `${prefix}/${e.name}` : e.name;
       if (e.isDirectory()) {
-        if (!EXCLUDE_DIRS.has(e.name)) await walk2(path12.join(dir, e.name), relPath);
+        if (!EXCLUDE_DIRS.has(e.name)) await walk2(path13.join(dir, e.name), relPath);
       } else if (e.isFile() && !isSecretEnvFile(e.name)) {
-        out.push({ relPath, bytes: await fs12.readFile(path12.join(dir, e.name)) });
+        out.push({ relPath, bytes: await fs13.readFile(path13.join(dir, e.name)) });
       }
     }
   };
@@ -4233,7 +4508,7 @@ async function pushWorktree(cwd, pushUrl, managed, log) {
     log.error("Couldn't save your game's source \u2014 please try again.");
     return false;
   };
-  const gitDir = await fs12.mkdtemp(path12.join(os4.tmpdir(), "genex-source-"));
+  const gitDir = await fs13.mkdtemp(path13.join(os5.tmpdir(), "genex-source-"));
   const base = { GIT_DIR: gitDir };
   if (urlHasEmbeddedCredentials(pushUrl)) {
     base.GIT_CONFIG_COUNT = "1";
@@ -4248,12 +4523,12 @@ async function pushWorktree(cwd, pushUrl, managed, log) {
   };
   try {
     if ((await run("git", ["init", "-q"], base)).code !== 0) return failed();
-    await fs12.writeFile(
-      path12.join(gitDir, "info", "exclude"),
+    await fs13.writeFile(
+      path13.join(gitDir, "info", "exclude"),
       // .env* are secrets — never publish them; `!` keeps the non-secret template.
       ["node_modules/", "dist/", ".git/", ".genex/", ".env", ".env.*", "!.env.example", ""].join("\n")
     );
-    const env = { ...base, GIT_WORK_TREE: cwd, GIT_INDEX_FILE: path12.join(gitDir, "index-source") };
+    const env = { ...base, GIT_WORK_TREE: cwd, GIT_INDEX_FILE: path13.join(gitDir, "index-source") };
     let lfs = (await run("git", ["lfs", "version"], base)).code !== 0 ? false : true;
     if (!lfs) {
       log.step("Installing git-lfs (keeps large binary assets out of the source push)\u2026");
@@ -4304,7 +4579,7 @@ async function pushWorktree(cwd, pushUrl, managed, log) {
   } catch {
     return failed();
   } finally {
-    await fs12.rm(gitDir, { recursive: true, force: true }).catch(() => {
+    await fs13.rm(gitDir, { recursive: true, force: true }).catch(() => {
     });
   }
 }
@@ -4340,12 +4615,12 @@ async function fetchPushUrl(ctx, log) {
 }
 async function isDir2(p) {
   try {
-    return (await fs12.stat(p)).isDirectory();
+    return (await fs13.stat(p)).isDirectory();
   } catch {
     return false;
   }
 }
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
 function fingerprintOf(html) {
   const m = html.match(/[A-Za-z0-9_]+-[A-Za-z0-9_-]{8}\.(?:js|css)/);
   return m ? m[0] : null;
@@ -4366,7 +4641,7 @@ async function waitUntilLive(playUrl, fingerprint, timeoutMs, log) {
       }
     } catch {
     }
-    await sleep(1500);
+    await sleep2(1500);
   }
   log.success(`Published. \u{1F310}  ${playUrl}`);
   log.dim("  (If the previous build shows, hard-refresh in a few seconds.)");
@@ -4442,17 +4717,17 @@ async function runMakeRemixable(opts) {
 }
 
 // src/lib/detect-features.ts
-import fs14 from "fs/promises";
-import path14 from "path";
+import fs15 from "fs/promises";
+import path15 from "path";
 
 // src/lib/generation-ledger.ts
-import fs13 from "fs/promises";
-import path13 from "path";
-var ledgerPath = (cwd) => path13.join(cwd, ".genex", "generations.ndjson");
+import fs14 from "fs/promises";
+import path14 from "path";
+var ledgerPath = (cwd) => path14.join(cwd, ".genex", "generations.ndjson");
 async function append(cwd, event) {
   try {
-    await fs13.access(path13.join(cwd, ".genex"));
-    await fs13.appendFile(ledgerPath(cwd), `${JSON.stringify(event)}
+    await fs14.access(path14.join(cwd, ".genex"));
+    await fs14.appendFile(ledgerPath(cwd), `${JSON.stringify(event)}
 `, "utf8");
   } catch {
   }
@@ -4460,7 +4735,7 @@ async function append(cwd, event) {
 async function readLedger(cwd = process.cwd()) {
   let raw;
   try {
-    raw = await fs13.readFile(ledgerPath(cwd), "utf8");
+    raw = await fs14.readFile(ledgerPath(cwd), "utf8");
   } catch {
     return [];
   }
@@ -4514,7 +4789,7 @@ async function countFailed(kind, cwd = process.cwd()) {
 // src/lib/detect-features.ts
 async function detectEmbedSdkVersion(cwd = process.cwd()) {
   try {
-    const raw = await fs14.readFile(path14.join(cwd, "package.json"), "utf8");
+    const raw = await fs15.readFile(path15.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     const version = pkg.dependencies?.["@genex-ai/embed-sdk"] ?? pkg.devDependencies?.["@genex-ai/embed-sdk"];
     return typeof version === "string" && version ? version : null;
@@ -4524,7 +4799,7 @@ async function detectEmbedSdkVersion(cwd = process.cwd()) {
 }
 async function detectMultiplayer(cwd = process.cwd()) {
   try {
-    const raw = await fs14.readFile(path14.join(cwd, "package.json"), "utf8");
+    const raw = await fs15.readFile(path15.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     return Boolean(
       pkg.dependencies?.["@genex-ai/multiplayer"] ?? pkg.devDependencies?.["@genex-ai/multiplayer"]
@@ -4536,7 +4811,7 @@ async function detectMultiplayer(cwd = process.cwd()) {
 async function detectMatchmaking(log, cwd = process.cwd()) {
   let pkg;
   try {
-    pkg = JSON.parse(await fs14.readFile(path14.join(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(await fs15.readFile(path15.join(cwd, "package.json"), "utf8"));
   } catch (err) {
     log.dim(`  (skipping matchmaking \u2014 couldn't read package.json: ${String(err)})`);
     return null;
@@ -4554,15 +4829,15 @@ async function detectMatchmaking(log, cwd = process.cwd()) {
 var TOUCH_KIT_MARKERS = /controllers\/touch\/|controllers\/character\/touch-joystick|TouchJoystick|VirtualButton|DragZone|RotateOverlay/;
 async function detectMobileControls(cwd = process.cwd()) {
   try {
-    const raw = await fs14.readFile(path14.join(cwd, "package.json"), "utf8");
+    const raw = await fs15.readFile(path15.join(cwd, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     if (pkg.genex?.mobileControls === true) return true;
   } catch {
   }
-  const srcDir = path14.join(cwd, "src");
+  const srcDir = path15.join(cwd, "src");
   let entries;
   try {
-    entries = await fs14.readdir(srcDir, { recursive: true });
+    entries = await fs15.readdir(srcDir, { recursive: true });
   } catch {
     return false;
   }
@@ -4570,7 +4845,7 @@ async function detectMobileControls(cwd = process.cwd()) {
     if (rel.includes("node_modules")) continue;
     if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(rel)) continue;
     try {
-      const content = await fs14.readFile(path14.join(srcDir, rel), "utf8");
+      const content = await fs15.readFile(path15.join(srcDir, rel), "utf8");
       if (TOUCH_KIT_MARKERS.test(content)) return true;
     } catch {
     }
@@ -4579,10 +4854,10 @@ async function detectMobileControls(cwd = process.cwd()) {
 }
 var GAME_STATE_CALLS = /savePlayerState|saveWorldState|submitScore/;
 async function detectGameStateUsage(cwd = process.cwd()) {
-  const srcDir = path14.join(cwd, "src");
+  const srcDir = path15.join(cwd, "src");
   let entries;
   try {
-    entries = await fs14.readdir(srcDir, { recursive: true });
+    entries = await fs15.readdir(srcDir, { recursive: true });
   } catch {
     return false;
   }
@@ -4590,7 +4865,7 @@ async function detectGameStateUsage(cwd = process.cwd()) {
     if (rel.includes("node_modules")) continue;
     if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(rel)) continue;
     try {
-      const content = await fs14.readFile(path14.join(srcDir, rel), "utf8");
+      const content = await fs15.readFile(path15.join(srcDir, rel), "utf8");
       if (GAME_STATE_CALLS.test(content)) return true;
     } catch {
     }
@@ -4634,18 +4909,19 @@ var lineOf = (content, index) => content.slice(0, index).split("\n").length;
 var DEPTH_RATIO_LIMIT = 1e6;
 async function detectSurfaceScan(cwd = process.cwd()) {
   const found = { guessedRepeat: [], squarePoints: [], depthRange: [] };
-  const srcDir = path14.join(cwd, "src");
+  const srcDir = path15.join(cwd, "src");
   let entries;
   try {
-    entries = await fs14.readdir(srcDir, { recursive: true });
+    entries = await fs15.readdir(srcDir, { recursive: true });
   } catch {
     return found;
   }
-  for (const rel of entries) {
-    if (rel.includes("node_modules")) continue;
-    if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(rel)) continue;
-    const raw = await fs14.readFile(path14.join(srcDir, rel), "utf8").catch(() => "");
+  for (const nativeRel of entries) {
+    if (nativeRel.includes("node_modules")) continue;
+    if (!/\.(ts|js|mts|mjs|tsx|jsx)$/.test(nativeRel)) continue;
+    const raw = await fs15.readFile(path15.join(srcDir, nativeRel), "utf8").catch(() => "");
     if (!raw) continue;
+    const rel = nativeRel.split(path15.sep).join("/");
     const content = raw.replace(/\/\*[\s\S]*?\*\//g, (m2) => m2.replace(/[^\n]/g, " ")).replace(/(^|[^:])\/\/[^\n]*/gm, (m2, p1) => p1 + " ".repeat(m2.length - p1.length));
     const repeatRe = /\.repeat\.set\(\s*(-?\d+(?:\.\d+)?)\s*,\s*(-?\d+(?:\.\d+)?)\s*\)/g;
     let m;
@@ -4691,25 +4967,25 @@ async function detectGenerationAudit(cwd = process.cwd()) {
   let haystack = "";
   const read = async (file) => {
     try {
-      haystack += await fs14.readFile(file, "utf8");
+      haystack += await fs15.readFile(file, "utf8");
     } catch {
     }
   };
   try {
-    for (const entry of await fs14.readdir(cwd, { withFileTypes: true })) {
+    for (const entry of await fs15.readdir(cwd, { withFileTypes: true })) {
       if (entry.isFile() && /\.(ts|tsx|js|jsx|css|html|json)$/.test(entry.name)) {
-        await read(path14.join(cwd, entry.name));
+        await read(path15.join(cwd, entry.name));
       }
     }
   } catch {
   }
   for (const sub of ["src", "public"]) {
     try {
-      const entries = await fs14.readdir(path14.join(cwd, sub), { recursive: true });
+      const entries = await fs15.readdir(path15.join(cwd, sub), { recursive: true });
       for (const rel of entries) {
         if (rel.includes("node_modules")) continue;
         if (!/\.(ts|tsx|js|jsx|css|html|json|txt)$/.test(rel)) continue;
-        await read(path14.join(cwd, sub, rel));
+        await read(path15.join(cwd, sub, rel));
       }
     } catch {
     }
@@ -4835,7 +5111,7 @@ async function borrowEvidence(meta, cwd) {
   } catch {
     return true;
   }
-  const gitConfig = await fs14.readFile(path14.join(cwd, ".git", "config"), "utf8").catch(() => "");
+  const gitConfig = await fs15.readFile(path15.join(cwd, ".git", "config"), "utf8").catch(() => "");
   for (const m of gitConfig.matchAll(/url\s*=\s*(\S+)/g)) {
     try {
       const u = new URL(m[1]);
@@ -4843,7 +5119,7 @@ async function borrowEvidence(meta, cwd) {
     } catch {
     }
   }
-  const readme = await fs14.readFile(path14.join(cwd, "README.md"), "utf8").catch(() => "");
+  const readme = await fs15.readFile(path15.join(cwd, "README.md"), "utf8").catch(() => "");
   return readme.includes(host) || /\b(upstream|originally by|ported from|borrowed from)\b/i.test(readme);
 }
 
@@ -4993,8 +5269,8 @@ async function runPreview(opts) {
 }
 
 // src/commands/generate.ts
-import fs15 from "fs/promises";
-import path15 from "path";
+import fs16 from "fs/promises";
+import path16 from "path";
 import { PNG as PNG4 } from "pngjs";
 
 // src/lib/glass.ts
@@ -5152,7 +5428,7 @@ async function* readSSE(body) {
 }
 
 // src/commands/generate.ts
-var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
 var INLINE_IMAGE_LIMIT_BYTES = 4 * 1024 * 1024;
 var IMAGE_MIME_BY_EXT = {
   ".png": "image/png",
@@ -5164,7 +5440,7 @@ var isRemoteRef = (value) => /^(https?:\/\/|data:)/i.test(value);
 async function inlineLocalImage(filePath, flag) {
   let bytes;
   try {
-    bytes = await fs15.readFile(filePath);
+    bytes = await fs16.readFile(filePath);
   } catch {
     return { ok: false, error: `Couldn't read the ${flag} file at ${filePath}.` };
   }
@@ -5174,7 +5450,7 @@ async function inlineLocalImage(filePath, flag) {
       error: `${flag} file is ${(bytes.length / 1048576).toFixed(1)} MB \u2014 over the ~4 MB inline limit. Downscale/compress it first, or pass an asset URL instead.`
     };
   }
-  const mime = IMAGE_MIME_BY_EXT[path15.extname(filePath).toLowerCase()] ?? "image/png";
+  const mime = IMAGE_MIME_BY_EXT[path16.extname(filePath).toLowerCase()] ?? "image/png";
   return { ok: true, dataUri: `data:${mime};base64,${bytes.toString("base64")}` };
 }
 var SKYBOX_ENVIRONMENT_SUFFIX = ". The image contains ONLY sky: cloud, atmosphere, light, weather and distant haze at the horizon. Every structure, object, plant and ground surface is outside the frame.";
@@ -5370,7 +5646,7 @@ async function runGenerate(kind, opts) {
       return;
     }
     try {
-      const bytes = await fs15.readFile(opts.inpaintUrl);
+      const bytes = await fs16.readFile(opts.inpaintUrl);
       opts = { ...opts, inpaintUrl: `data:image/png;base64,${bytes.toString("base64")}` };
     } catch {
       log.error(`Couldn't read the --inpaint mask at ${opts.inpaintUrl}.`);
@@ -5494,7 +5770,7 @@ async function reportGlassTerminal(view, outDir, log, json) {
     return;
   }
   await recordTerminal(view.id, "completed", files.map((f) => f.url));
-  await fs15.mkdir(outDir, { recursive: true });
+  await fs16.mkdir(outDir, { recursive: true });
   const solved = [];
   for (let i = 0; i < files.length; i++) {
     const f = files[i];
@@ -5526,8 +5802,8 @@ async function reportGlassTerminal(view, outDir, log, json) {
       });
       continue;
     }
-    const outPath = path15.join(outDir, `glass-${i + 1}.png`);
-    await fs15.writeFile(outPath, PNG4.sync.write(r.png));
+    const outPath = path16.join(outDir, `glass-${i + 1}.png`);
+    await fs16.writeFile(outPath, PNG4.sync.write(r.png));
     solved.push({
       path: outPath,
       url: f.url,
@@ -5686,14 +5962,14 @@ async function waitViaSSE(apiUrl, token, id, onProgress, deadline) {
         });
       } catch {
         if (++connectFailures >= 3) return "unsupported";
-        await sleep2(2e3);
+        await sleep3(2e3);
         continue;
       }
       if (res.status === 404 || res.status === 405) return "unsupported";
       const contentType = res.headers.get("content-type") ?? "";
       if (!res.ok || !res.body || !contentType.includes("text/event-stream")) {
         if (++connectFailures >= 3) return "unsupported";
-        await sleep2(2e3);
+        await sleep3(2e3);
         continue;
       }
       connectFailures = 0;
@@ -5714,7 +5990,7 @@ async function waitViaSSE(apiUrl, token, id, onProgress, deadline) {
         }
       } catch {
       }
-      await sleep2(1e3);
+      await sleep3(1e3);
     } finally {
       clearTimeout(timer);
       abort.abort();
@@ -5742,7 +6018,7 @@ async function poll(apiUrl, token, id, onProgress, timeoutMs) {
       }
     } catch {
     }
-    await sleep2(3e3);
+    await sleep3(3e3);
   }
   return null;
 }
@@ -6121,8 +6397,8 @@ async function toRow(e, v, cwd) {
 }
 
 // src/commands/controller.ts
-import fs17 from "fs/promises";
-import path17 from "path";
+import fs18 from "fs/promises";
+import path18 from "path";
 
 // ../../packages/meshy-animation-catalog/src/index.ts
 import { createHash } from "crypto";
@@ -15252,9 +15528,9 @@ function searchMeshyAnimations(query, options = {}) {
 }
 
 // src/lib/anims.ts
-import fs16 from "fs/promises";
-import path16 from "path";
-var ANIMS_DEST = path16.join("public", "assets", "anims");
+import fs17 from "fs/promises";
+import path17 from "path";
+var ANIMS_DEST = path17.join("public", "assets", "anims");
 var HIDDEN_TAG = "reference";
 async function runAnims(opts) {
   const log = createLogger({ quiet: opts.quiet });
@@ -15270,7 +15546,7 @@ async function runAnims(opts) {
     printCatalog(log, manifest, selectors);
     return;
   }
-  const controllerMarker = path16.join(root, "src", "controllers", "character");
+  const controllerMarker = path17.join(root, "src", "controllers", "character");
   if (!await exists2(controllerMarker)) {
     log.error(
       `No character controller in this game (missing ${c.cyan("src/controllers/character/")}).`
@@ -15279,11 +15555,11 @@ async function runAnims(opts) {
     process.exitCode = 1;
     return;
   }
-  const destDir = path16.join(root, ANIMS_DEST);
-  const gameManifestPath = path16.join(destDir, "manifest.json");
+  const destDir = path17.join(root, ANIMS_DEST);
+  const gameManifestPath = path17.join(destDir, "manifest.json");
   if (opts.reset) {
-    await fs16.rm(destDir, { recursive: true, force: true });
-    log.step(`Cleared ${c.cyan(ANIMS_DEST + path16.sep)} (--reset)`);
+    await fs17.rm(destDir, { recursive: true, force: true });
+    log.step(`Cleared ${c.cyan(ANIMS_DEST + path17.sep)} (--reset)`);
   }
   if (selectors.length === 0) {
     const installed = await readGameManifest(gameManifestPath);
@@ -15321,35 +15597,35 @@ async function runAnims(opts) {
     }
   }
   const wanted = [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
-  const cacheDir = path16.join(
+  const cacheDir = path17.join(
     opts.cacheDir ?? getAnimsCacheDir(),
     `${manifest.library}-v${manifest.version}`
   );
-  await fs16.mkdir(cacheDir, { recursive: true });
-  await fs16.mkdir(destDir, { recursive: true });
+  await fs17.mkdir(cacheDir, { recursive: true });
+  await fs17.mkdir(destDir, { recursive: true });
   const base = getAnimsBase(opts.animsBase);
   let installedCount = 0;
   let presentCount = 0;
   let addedBytes = 0;
   const failures = [];
   for (const entry of wanted) {
-    const dest = path16.join(destDir, entry.file);
+    const dest = path17.join(destDir, entry.file);
     if (await hasSize(dest, entry.bytes)) {
       presentCount++;
       continue;
     }
     try {
-      const cached = path16.join(cacheDir, entry.file);
+      const cached = path17.join(cacheDir, entry.file);
       if (!await hasSize(cached, entry.bytes)) {
         const res = await fetch(base + entry.file);
         if (!res.ok) throw new Error(`HTTP ${res.status}`);
         const buf = Buffer.from(await res.arrayBuffer());
-        await fs16.writeFile(cached, buf);
+        await fs17.writeFile(cached, buf);
       }
-      await fs16.copyFile(cached, dest);
+      await fs17.copyFile(cached, dest);
       installedCount++;
       addedBytes += entry.bytes;
-      log.dim(`  ${path16.join(ANIMS_DEST, entry.file)} (${formatMb(entry.bytes)})`);
+      log.dim(`  ${path17.join(ANIMS_DEST, entry.file)} (${formatMb(entry.bytes)})`);
     } catch (err) {
       failures.push(`${entry.name} (${err instanceof Error ? err.message : String(err)})`);
     }
@@ -15365,13 +15641,13 @@ async function runAnims(opts) {
     version: manifest.version,
     clips: [...union].sort((a, b) => a.localeCompare(b))
   };
-  await fs16.writeFile(gameManifestPath, JSON.stringify(gameManifest, null, 2) + "\n");
+  await fs17.writeFile(gameManifestPath, JSON.stringify(gameManifest, null, 2) + "\n");
   log.plain("");
   const parts = [`${installedCount} clip${installedCount === 1 ? "" : "s"} installed`];
   if (presentCount > 0) parts.push(`${presentCount} already present`);
   if (bundledSkips > 0) parts.push(`${bundledSkips} already bundled in animation-library.glb`);
   log.success(
-    `${parts.join(", ")} \u2192 ${c.cyan(ANIMS_DEST + path16.sep)}${addedBytes > 0 ? ` (+${formatMb(addedBytes)})` : ""}`
+    `${parts.join(", ")} \u2192 ${c.cyan(ANIMS_DEST + path17.sep)}${addedBytes > 0 ? ` (+${formatMb(addedBytes)})` : ""}`
   );
   for (const [selector, entries] of resolved) {
     const names = entries.filter((e) => !coreNames.has(e.name)).map((e) => e.name);
@@ -15403,8 +15679,8 @@ async function loadManifest(baseOverride) {
     }
   } catch {
   }
-  const snapshotPath = path16.join(getTemplatesDir(), "controllers", "assets", "anims-manifest.json");
-  const manifest = JSON.parse(await fs16.readFile(snapshotPath, "utf8"));
+  const snapshotPath = path17.join(getTemplatesDir(), "controllers", "assets", "anims-manifest.json");
+  const manifest = JSON.parse(await fs17.readFile(snapshotPath, "utf8"));
   return { manifest, source: "snapshot" };
 }
 function resolveSelectors(manifest, selectors) {
@@ -15522,21 +15798,21 @@ function printCatalog(log, manifest, selectors) {
 }
 async function readGameManifest(file) {
   try {
-    return JSON.parse(await fs16.readFile(file, "utf8"));
+    return JSON.parse(await fs17.readFile(file, "utf8"));
   } catch {
     return null;
   }
 }
 async function hasSize(file, bytes) {
   try {
-    return (await fs16.stat(file)).size === bytes;
+    return (await fs17.stat(file)).size === bytes;
   } catch {
     return false;
   }
 }
 async function exists2(p) {
   try {
-    await fs16.access(p);
+    await fs17.access(p);
     return true;
   } catch {
     return false;
@@ -15705,8 +15981,8 @@ var CONTROLLER_FILE_SETS = {
     ]
   }
 };
-var CODE_DEST = path17.join("src", "controllers");
-var ASSETS_DEST = path17.join("public", "assets");
+var CODE_DEST = path18.join("src", "controllers");
+var ASSETS_DEST = path18.join("public", "assets");
 async function runController(opts) {
   const log = createLogger({ quiet: opts.quiet });
   if (opts.kind?.trim() === "anims") {
@@ -15723,31 +15999,31 @@ async function runController(opts) {
     process.exitCode = 1;
     return;
   }
-  const srcDir = path17.join(getTemplatesDir(), "controllers");
+  const srcDir = path18.join(getTemplatesDir(), "controllers");
   const root = opts.cwd ?? process.cwd();
   const set = CONTROLLER_FILE_SETS[kind];
   log.plain(c.bold(`genex controller ${kind}`));
   log.plain("");
-  log.step(`Installing the ${kind} controller into ${c.cyan(CODE_DEST + path17.sep)}`);
+  log.step(`Installing the ${kind} controller into ${c.cyan(CODE_DEST + path18.sep)}`);
   const plan = [
-    ...set.code.map((rel) => ({ from: rel, rel: path17.join(CODE_DEST, rel) })),
+    ...set.code.map((rel) => ({ from: rel, rel: path18.join(CODE_DEST, rel) })),
     ...set.assets.map((rel) => ({
       from: rel,
-      rel: path17.join(ASSETS_DEST, path17.basename(rel))
+      rel: path18.join(ASSETS_DEST, path18.basename(rel))
     }))
   ];
   let copied = 0;
   let skipped = 0;
   try {
     for (const file of plan) {
-      const dest = path17.join(root, file.rel);
+      const dest = path18.join(root, file.rel);
       if (!opts.force && await exists3(dest)) {
         skipped++;
         log.dim(`  skipped ${file.rel} (exists \u2014 use --force to overwrite)`);
         continue;
       }
-      await fs17.mkdir(path17.dirname(dest), { recursive: true });
-      await fs17.copyFile(path17.join(srcDir, file.from), dest);
+      await fs18.mkdir(path18.dirname(dest), { recursive: true });
+      await fs18.copyFile(path18.join(srcDir, file.from), dest);
       copied++;
       log.dim(`  ${file.rel}`);
     }
@@ -15800,7 +16076,7 @@ async function runController(opts) {
   for (const line of set.sketch) {
     log.dim(`       ${line}`);
   }
-  if (kind === "character" && !await exists3(path17.join(root, ASSETS_DEST, "meshy-character.json"))) {
+  if (kind === "character" && !await exists3(path18.join(root, ASSETS_DEST, "meshy-character.json"))) {
     log.plain("");
     log.plain(
       `  ${stepOffset + 3}. This game has no generated character yet \u2014 ${c.cyan(
@@ -15832,9 +16108,9 @@ async function installMeshyCharacterManifest(args) {
     throw new Error("The API returned an invalid Meshy character manifest.");
   }
   assertCompleteMeshyControllerPack(manifest);
-  const destination = path17.join(args.root, ASSETS_DEST, "meshy-character.json");
-  await fs17.mkdir(path17.dirname(destination), { recursive: true });
-  await fs17.writeFile(
+  const destination = path18.join(args.root, ASSETS_DEST, "meshy-character.json");
+  await fs18.mkdir(path18.dirname(destination), { recursive: true });
+  await fs18.writeFile(
     destination,
     `${JSON.stringify(manifest, null, 2)}
 `
@@ -15972,14 +16248,14 @@ function assertCompleteMeshyControllerPack(manifest) {
 }
 async function installFallbackAvatar(args) {
   const { root, srcDir, log } = args;
-  const dest = path17.join(root, ASSETS_DEST, "avatar.vrm");
-  await fs17.mkdir(path17.dirname(dest), { recursive: true });
-  await fs17.copyFile(path17.join(srcDir, "assets", "default-avatar.vrm"), dest);
+  const dest = path18.join(root, ASSETS_DEST, "avatar.vrm");
+  await fs18.mkdir(path18.dirname(dest), { recursive: true });
+  await fs18.copyFile(path18.join(srcDir, "assets", "default-avatar.vrm"), dest);
   log.dim("  public/assets/avatar.vrm (fallback avatar \u2014 bundled CC0 default)");
 }
 async function exists3(p) {
   try {
-    await fs17.access(p);
+    await fs18.access(p);
     return true;
   } catch {
     return false;
@@ -16473,22 +16749,22 @@ async function context2(opts) {
   const project = await readProject();
   return { token, apiUrl: getApiUrl(opts.apiUrl ?? project?.apiUrl) };
 }
-async function readVideo(path19, log) {
+async function readVideo(path20, log) {
   let bytes;
   try {
-    bytes = await readFile(path19);
+    bytes = await readFile(path20);
   } catch {
-    log.error(`Can't read ${path19}.`);
+    log.error(`Can't read ${path20}.`);
     return null;
   }
   if (bytes.byteLength > MAX_VIDEO_BYTES) {
-    log.error(`${basename(path19)} is ${(bytes.byteLength / 1e6).toFixed(0)} MB \u2014 the limit is ${MAX_VIDEO_BYTES / 1e6} MB.`);
+    log.error(`${basename(path20)} is ${(bytes.byteLength / 1e6).toFixed(0)} MB \u2014 the limit is ${MAX_VIDEO_BYTES / 1e6} MB.`);
     return null;
   }
   return bytes;
 }
-async function uploadVideo(apiUrl, token, characterId, path19, bytes, log) {
-  const contentType = /\.mov$/i.test(path19) ? "video/quicktime" : "video/mp4";
+async function uploadVideo(apiUrl, token, characterId, path20, bytes, log) {
+  const contentType = /\.mov$/i.test(path20) ? "video/quicktime" : "video/mp4";
   const minted = await apiFetch(
     `${apiUrl}/api/characters/${encodeURIComponent(characterId)}/motions/video-url`,
     {
@@ -16503,7 +16779,7 @@ async function uploadVideo(apiUrl, token, characterId, path19, bytes, log) {
     return null;
   }
   const { uploadUrl, videoUrl } = await minted.json();
-  log.dim(`  uploading ${basename(path19)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
+  log.dim(`  uploading ${basename(path20)} (${(bytes.byteLength / 1e6).toFixed(1)} MB)\u2026`);
   const put = await fetch(uploadUrl, {
     method: "PUT",
     headers: { "Content-Type": contentType, "Content-Length": String(bytes.byteLength) },
@@ -16819,8 +17095,8 @@ function rank(items, query) {
 }
 
 // src/commands/motion.ts
-import fs18 from "fs/promises";
-import path18 from "path";
+import fs19 from "fs/promises";
+import path19 from "path";
 
 // src/lib/motion/npz.ts
 import zlib from "zlib";
@@ -18071,7 +18347,7 @@ async function motionGen(opts, log) {
   }
   if (opts.constraintsPath !== void 0) {
     try {
-      const raw = await fs18.readFile(opts.constraintsPath, "utf8");
+      const raw = await fs19.readFile(opts.constraintsPath, "utf8");
       generationOptions.constraints = JSON.parse(raw);
     } catch {
       log.error(`Couldn't read the --constraints JSON at ${opts.constraintsPath}.`);
@@ -18095,10 +18371,10 @@ async function motionGen(opts, log) {
 async function expandTakes(selectors) {
   const out = [];
   for (const sel of selectors) {
-    const st = await fs18.stat(sel).catch(() => null);
+    const st = await fs19.stat(sel).catch(() => null);
     if (st?.isDirectory()) {
-      const names = await fs18.readdir(sel);
-      for (const n of names.sort()) if (n.endsWith(".npz")) out.push(path18.join(sel, n));
+      const names = await fs19.readdir(sel);
+      for (const n of names.sort()) if (n.endsWith(".npz")) out.push(path19.join(sel, n));
     } else if (st?.isFile()) {
       out.push(sel);
     } else {
@@ -18133,7 +18409,7 @@ async function motionVerify(opts, log) {
   let gates = DEFAULT_GATES;
   if (opts.gatesPath) {
     try {
-      gates = mergeGates(DEFAULT_GATES, JSON.parse(await fs18.readFile(opts.gatesPath, "utf8")));
+      gates = mergeGates(DEFAULT_GATES, JSON.parse(await fs19.readFile(opts.gatesPath, "utf8")));
     } catch {
       log.error(`Couldn't read the --gates JSON at ${opts.gatesPath}.`);
       process.exitCode = 1;
@@ -18155,9 +18431,9 @@ async function motionVerify(opts, log) {
   }
   const reports = [];
   for (const file of files) {
-    const stem = path18.basename(file).replace(/\.npz$/, "");
+    const stem = path19.basename(file).replace(/\.npz$/, "");
     try {
-      reports.push(analyzeTake(stem, await fs18.readFile(file), gates));
+      reports.push(analyzeTake(stem, await fs19.readFile(file), gates));
     } catch (err) {
       reports.push({
         take: stem,
@@ -18195,7 +18471,7 @@ async function motionCompile(opts, log) {
   let cfg = DEFAULT_MOTION_CONFIG;
   if (opts.configPath) {
     try {
-      const patch = JSON.parse(await fs18.readFile(opts.configPath, "utf8"));
+      const patch = JSON.parse(await fs19.readFile(opts.configPath, "utf8"));
       cfg = { ...DEFAULT_MOTION_CONFIG, ...patch, idleLoop: { ...DEFAULT_MOTION_CONFIG.idleLoop, ...patch.idleLoop } };
     } catch {
       log.error(`Couldn't read the --config JSON at ${opts.configPath}.`);
@@ -18213,16 +18489,16 @@ async function motionCompile(opts, log) {
   }
   const inputs = [];
   for (const file of files) {
-    const stem = path18.basename(file).replace(/\.npz$/, "");
+    const stem = path19.basename(file).replace(/\.npz$/, "");
     try {
-      inputs.push({ stem, take: loadTake(await fs18.readFile(file)) });
+      inputs.push({ stem, take: loadTake(await fs19.readFile(file)) });
     } catch (err) {
       log.error(`${stem}: ${err instanceof Error ? err.message : String(err)}`);
       process.exitCode = 1;
       return;
     }
   }
-  const setName = opts.set ?? path18.basename(opts.out).replace(/\.json$/, "");
+  const setName = opts.set ?? path19.basename(opts.out).replace(/\.json$/, "");
   let result;
   try {
     result = compileSet(inputs, setName, cfg);
@@ -18237,9 +18513,9 @@ async function motionCompile(opts, log) {
     process.exitCode = 1;
     return;
   }
-  await fs18.mkdir(path18.dirname(path18.resolve(opts.out)), { recursive: true });
+  await fs19.mkdir(path19.dirname(path19.resolve(opts.out)), { recursive: true });
   const json = JSON.stringify(result.data);
-  await fs18.writeFile(opts.out, json);
+  await fs19.writeFile(opts.out, json);
   if (opts.json) {
     writeJson({ out: opts.out, set: setName, tracks: Object.keys(result.data.gaits), bytes: json.length });
     return;
@@ -18257,9 +18533,9 @@ var MOTION_RUNTIME_FILES = [
 var MOTION_PRESETS = {
   rifle: ["sets/rifle.json", "sets/jumps.json"]
 };
-var MOTION_DEST = path18.join("src", "motion");
+var MOTION_DEST = path19.join("src", "motion");
 async function motionInstall(opts, log) {
-  const srcDir = path18.join(getTemplatesDir(), "motion");
+  const srcDir = path19.join(getTemplatesDir(), "motion");
   const root = opts.cwd ?? process.cwd();
   const preset = opts.set;
   if (preset !== void 0 && !MOTION_PRESETS[preset]) {
@@ -18270,21 +18546,21 @@ async function motionInstall(opts, log) {
   const files = [...MOTION_RUNTIME_FILES, ...preset ? MOTION_PRESETS[preset] : []];
   log.plain(c.bold(`genex motion install${preset ? ` --set ${preset}` : ""}`));
   log.plain("");
-  log.step(`Vendoring the motion runtime into ${c.cyan(MOTION_DEST + path18.sep)}`);
+  log.step(`Vendoring the motion runtime into ${c.cyan(MOTION_DEST + path19.sep)}`);
   let copied = 0, skipped = 0;
   try {
     for (const rel of files) {
-      const dest = path18.join(root, MOTION_DEST, rel);
-      const exists4 = await fs18.access(dest).then(() => true, () => false);
+      const dest = path19.join(root, MOTION_DEST, rel);
+      const exists4 = await fs19.access(dest).then(() => true, () => false);
       if (!opts.force && exists4) {
         skipped++;
-        log.dim(`  skipped ${path18.join(MOTION_DEST, rel)} (exists \u2014 use --force to overwrite)`);
+        log.dim(`  skipped ${path19.join(MOTION_DEST, rel)} (exists \u2014 use --force to overwrite)`);
         continue;
       }
-      await fs18.mkdir(path18.dirname(dest), { recursive: true });
-      await fs18.copyFile(path18.join(srcDir, rel), dest);
+      await fs19.mkdir(path19.dirname(dest), { recursive: true });
+      await fs19.copyFile(path19.join(srcDir, rel), dest);
       copied++;
-      log.dim(`  ${path18.join(MOTION_DEST, rel)}`);
+      log.dim(`  ${path19.join(MOTION_DEST, rel)}`);
     }
   } catch (err) {
     log.error(`Copy failed: ${String(err)}`);
@@ -18325,7 +18601,7 @@ async function motionConstraints(opts, log) {
   }
   const doc = directionConstraint(dir, speed, duration);
   const out = opts.out ?? "constraints.json";
-  await fs18.writeFile(out, JSON.stringify(doc));
+  await fs19.writeFile(out, JSON.stringify(doc));
   if (opts.json) {
     writeJson({ out, dir: dirName, speed, duration, waypoints: doc[0].frame_indices.length });
     return;
@@ -18367,6 +18643,11 @@ var HELP = `${c.bold("genex")} \u2014 set up your project's agent workspace, aut
 
 ${c.bold("Usage")}
   genex init [<name>] [options]      Scaffold + authorize + create the draft project.
+  genex auth [options]               Connect this machine to your Genex account, or
+                                     finish a sign-in another command started \u2014 it
+                                     resumes the same code, so an interrupted
+                                     'genex init' costs nothing. --force switches
+                                     accounts.
   genex link <slug> [options]        Re-link THIS folder to an existing game of yours
                                      (lost folder / new machine); preview/publish then
                                      update the same live game. Never creates a project.
@@ -18512,7 +18793,16 @@ ${c.bold("Options for `init`")}
   --api-url <url>      Override the API base URL (default: ${DEFAULT_API_URL}).
   --no-auth            Only scaffold templates; skip authorization.
   --force              Overwrite existing files (default: never overwrite).
-  --timeout <seconds>  How long to wait for the auth redirect (default: 300).
+  --timeout <seconds>  How long to wait inline for sign-in approval before handing
+                       off to 'genex auth' (default: 100). The code itself stays
+                       valid for 15 minutes either way.
+
+${c.bold("Options for `auth`")}
+  --force              Connect a different account even though one is already saved.
+  --env <path>         Token env file (default: ~/.genex/env).
+  --auth-url <url>     Override the auth site (default: ${DEFAULT_AUTH_URL}).
+  --api-url <url>      Override the API base URL (default: ${DEFAULT_API_URL}).
+  --timeout <seconds>  Inline wait before printing the approval link again (default: 100).
 
 ${c.bold("Options for `link`")}
   <slug>               The game to reconnect to (the name in your play URL). Required.
@@ -18520,7 +18810,9 @@ ${c.bold("Options for `link`")}
   --env <path>         Token env file (default: ~/.genex/env).
   --auth-url <url>     Override the auth site (used only if sign-in is needed).
   --api-url <url>      Override the API base URL.
-  --timeout <seconds>  How long to wait for the auth redirect (default: 300).
+  --timeout <seconds>  How long to wait inline for sign-in approval before handing
+                       off to 'genex auth' (default: 100). The code itself stays
+                       valid for 15 minutes either way.
 
 ${c.bold("Options for `preview` / `publish`")}
   --no-build           Skip the build step; deploy whatever is already built.
@@ -19168,6 +19460,9 @@ async function main() {
       case "init":
         await runInit(parsed.options);
         break;
+      case "auth":
+        await runAuth(parsed.options);
+        break;
       case "link":
         await runLink(parsed.options);
         break;
@@ -19267,10 +19562,31 @@ async function main() {
     await flushSentry();
   }
 }
-main().catch(async (err) => {
-  Sentry2.captureException(err);
+function checkNodeVersion() {
+  const major = Number(process.versions.node.split(".")[0]);
+  if (!Number.isFinite(major) || major >= 20) return true;
   const log = createLogger();
-  log.error(err instanceof Error ? err.message : String(err));
-  await flushSentry();
+  log.error(`Genex needs Node 20 or newer \u2014 this is Node ${process.versions.node}.`);
+  log.plain(
+    [
+      `  ${c.cyan("\u2192")} macOS:   ${c.cyan("brew install node")}   (no Homebrew? use the installer at nodejs.org/download)`,
+      `  ${c.cyan("\u2192")} Windows: ${c.cyan("winget install OpenJS.NodeJS.LTS")}`,
+      `  ${c.cyan("\u2192")} Linux:   your distro's node package, or nodejs.org/download`,
+      "",
+      "  Then re-run this command."
+    ].join("\n")
+  );
   process.exitCode = 1;
-});
+  return false;
+}
+if (checkNodeVersion()) {
+  main().catch(async (err) => {
+    Sentry2.captureException(err);
+    if (!wasPrinted(err)) {
+      const log = createLogger();
+      log.error(err instanceof Error ? err.message : String(err));
+    }
+    await flushSentry();
+    process.exitCode = 1;
+  });
+}