@runtypelabs/cli 2.47.8 → 2.48.1

package/dist/index.js

@@ -2,39 +2,40 @@
 import { createRequire } from "node:module";
 import { Command, InvalidArgumentError, Option } from "commander";
 import chalk from "chalk";
-import * as fs$2 from "node:fs";
+import * as fs$1 from "node:fs";
 import fs, { closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path$2 from "node:path";
 import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import React, { memo, useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { Box, Text, render, useApp, useInput, useStdout } from "ink";
-import open from "open";
-import crypto$1 from "crypto";
-import express from "express";
 import { ClientTokensNamespace, DEFAULT_STALL_STOP_AFTER, ENSURE_RELEASE_DEPLOY_CONFLICT_MESSAGE, FlowsNamespace, LEDGER_ARTIFACT_LINE_PREFIX, ProductsNamespace, RuntypeApiError, RuntypeClient, SkillsNamespace, SurfacesNamespace, ToolsNamespace, activateAgentPromotion, buildLedgerOffloadReference, compileWorkflowConfig, createClient, defaultWorkflow, defineFlow, defineFpo, defineProduct, defineSkill, defineSurface, defineTool, deployWorkflow, ensureDefaultWorkflowHooks, evaluateGeneratedRuntimeToolProposal, gameWorkflow, getDefaultPlanPath, isBuiltinToolExecuteResponse, isWorkflowHookRef, parseFinalBuffer, parseLedgerArtifactRelativePath, parseOffloadedOutputId, parseSSEChunk, prepareAgentPromotion, processStream, registerWorkflowHook, validateAgentPromotion } from "@runtypelabs/sdk";
 import Conf from "conf";
-import os, { tmpdir } from "os";
-import path$1, { delimiter, dirname as dirname$1, join as join$1, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
-import fs$1, { copyFileSync, existsSync as existsSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1, realpathSync as realpathSync$1, unlinkSync, writeFileSync as writeFileSync$1 } from "fs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import * as crypto$3 from "node:crypto";
+import crypto$1, { createHash, randomBytes, randomUUID } from "node:crypto";
+import * as os$1 from "node:os";
+import os, { constants as constants$1 } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import open from "open";
+import crypto$2 from "crypto";
+import express from "express";
 import readline from "readline";
 import { ErrorDisplay, Spinner, StatusBar, StreamOutput, renderMarkdownToTerminal, theme } from "@runtypelabs/ink-components";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
-import TextInput from "ink-text-input";
 import SelectInput from "ink-select-input";
+import { copyFileSync, existsSync as existsSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1, realpathSync as realpathSync$1, unlinkSync, writeFileSync as writeFileSync$1 } from "fs";
+import path$1, { delimiter, dirname as dirname$1, join as join$1, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
+import { access, chmod, copyFile, mkdir, open as open$1, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import TextInput from "ink-text-input";
 import { execSync, spawn, spawnSync } from "node:child_process";
-import * as crypto$2 from "node:crypto";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import * as os$2 from "node:os";
-import os$1, { constants as constants$1 } from "node:os";
 import { AnimatedVariant, LoadingAnimation, StartupGridIconCompactLightInverted } from "@runtypelabs/terminal-animations";
 import { createJiti } from "jiti";
 import micromatch from "micromatch";
 import { parse } from "yaml";
-import { access, chmod, copyFile, mkdir, open as open$1, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { execFileSync, spawn as spawn$1 } from "child_process";
 import { createServer } from "node:http";
 import { createServer as createServer$1 } from "node:net";
+import { tmpdir } from "os";
 import { zipSync } from "fflate";
 import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 import WebSocket from "ws";
@@ -66,378 +67,6 @@ function loadEnv(path = resolve(process.cwd(), ".env")) {
 	} catch {}
 }
 //#endregion
-//#region src/auth/callback-server.ts
-var CallbackServer = class {
-	server = null;
-	app;
-	codeResolve;
-	codeReject;
-	codePromise;
-	expectedState;
-	constructor() {
-		this.app = express();
-		this.codePromise = new Promise((resolve, reject) => {
-			this.codeResolve = resolve;
-			this.codeReject = reject;
-		});
-		this.app.get("/callback", (req, res) => {
-			const { token, code, state, error } = req.query;
-			if (typeof state !== "string" || state !== this.expectedState) {
-				res.status(400).send(this.errorHTML("Invalid authentication state. Continue the login you started in the CLI."));
-				return;
-			}
-			const values = [
-				token,
-				code,
-				error
-			].filter((value) => value !== void 0);
-			if (values.length !== 1 || typeof values[0] !== "string" || values[0].length === 0) {
-				res.status(400).send(this.errorHTML("Invalid authentication callback"));
-				return;
-			}
-			if (typeof error === "string") {
-				res.send(this.errorHTML(error));
-				this.codeReject(new Error(error));
-				setTimeout(() => this.stop(), 1e3);
-				return;
-			}
-			res.send(this.successHTML());
-			this.codeResolve(values[0]);
-			setTimeout(() => this.stop(), 1e3);
-		});
-		this.app.get("/health", (_req, res) => {
-			res.json({ status: "ok" });
-		});
-	}
-	/** Set expected state parameter for OAuth2 CSRF validation */
-	setExpectedState(state) {
-		if (!state) throw new Error("Authentication requires a nonempty expected state");
-		if (this.server) throw new Error("Expected state must be registered before listening");
-		this.expectedState = state;
-	}
-	async start(port = 8765) {
-		if (!this.expectedState) throw new Error("Authentication requires an expected state before listening");
-		return new Promise((resolveStart, rejectStart) => {
-			this.server = this.app.listen(port, "127.0.0.1", () => {
-				const address = this.server?.address();
-				const actualPort = address && typeof address === "object" && "port" in address ? address.port : port;
-				console.log(`Callback server listening on port ${actualPort}`);
-				resolveStart({
-					actualPort,
-					codePromise: this.codePromise
-				});
-			});
-			this.server.on("error", (error) => {
-				if (error.code === "EADDRINUSE") {
-					console.log(`Port ${port} is in use, trying ${port + 1}...`);
-					this.server = null;
-					this.start(port + 1).then(resolveStart).catch(rejectStart);
-				} else rejectStart(error);
-			});
-		});
-	}
-	stop() {
-		if (this.server) {
-			const s = this.server;
-			this.server = null;
-			s.unref();
-			if (typeof s.closeAllConnections === "function") s.closeAllConnections();
-			s.close();
-		}
-	}
-	successHTML() {
-		return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <title>Authentication Successful</title>
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    body {
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-      height: 100vh;
-      overflow: hidden;
-      background: #0a0a0a;
-    }
-    .grid-bg {
-      position: absolute;
-      inset: 0;
-      z-index: 0;
-      overflow: hidden;
-    }
-    .grid-bg .gradient {
-      position: absolute;
-      inset: 0;
-      background: linear-gradient(to bottom, #0a0a0a 0%, #171717 50%, #262626 100%);
-    }
-    @keyframes gridMove {
-      0% { background-position-y: 0; }
-      100% { background-position-y: 30px; }
-    }
-    .grid-bg .grid-vertical-wrap {
-      position: absolute;
-      left: 0;
-      right: 0;
-      bottom: 0;
-      top: 40%;
-      transform-origin: top center;
-      transform: perspective(500px) rotateX(60deg);
-    }
-    .grid-bg .grid-vertical-wrap .fade {
-      position: absolute;
-      inset: 0;
-      background: linear-gradient(to bottom, transparent 0%, rgba(255,255,255,0.02) 100%);
-    }
-    .grid-bg .grid-vertical-wrap .lines {
-      position: absolute;
-      inset: 0;
-      background-image: repeating-linear-gradient(
-        90deg,
-        transparent 0,
-        transparent 49px,
-        rgba(255,255,255,0.08) 49px,
-        rgba(255,255,255,0.08) 50px
-      );
-      background-size: 50px 100%;
-    }
-    .grid-bg .grid-horizontal {
-      position: absolute;
-      left: 0;
-      right: 0;
-      bottom: 0;
-      top: 40%;
-      transform-origin: top center;
-      transform: perspective(500px) rotateX(60deg);
-      background-image: repeating-linear-gradient(
-        0deg,
-        transparent 0,
-        transparent 29px,
-        rgba(255,255,255,0.06) 29px,
-        rgba(255,255,255,0.06) 30px
-      );
-      background-size: 100% 30px;
-      animation: gridMove 2s linear infinite;
-    }
-    .card-wrap {
-      position: absolute;
-      left: 50%;
-      top: 50%;
-      transform: translate(-50%, -50%);
-      z-index: 10;
-      width: 100%;
-      max-width: 400px;
-      perspective: 1400px;
-      animation: cardIn 0.4s ease-out;
-    }
-    @keyframes cardIn {
-      from { opacity: 0; transform: translate(-50%, -50%) translateY(16px); }
-      to { opacity: 1; transform: translate(-50%, -50%) translateY(0); }
-    }
-    .card-inner {
-      position: relative;
-    }
-    .card-layer-back,
-    .card-layer-mid {
-      position: absolute;
-      inset: 0;
-      border-radius: 12px;
-      border: 1px solid #e5e7eb;
-      pointer-events: none;
-    }
-    .card-layer-back {
-      background: rgba(0, 0, 0, 0.08);
-      transform: translate3d(0, -18px, -36px) rotateX(6deg);
-    }
-    .card-layer-mid {
-      background: rgba(0, 0, 0, 0.05);
-      transform: translate3d(0, -10px, -20px) rotateX(3deg);
-    }
-    .card-front {
-      position: relative;
-      border-radius: 12px;
-      border: 1px solid rgba(255, 255, 255, 1);
-      background: rgba(0, 0, 0, .5);
-      backdrop-filter: blur(10px);
-      -webkit-backdrop-filter: blur(10px);
-      padding: 2rem 2.5rem;
-      text-align: center;
-      box-shadow: 0 1px 3px rgba(0, 0, 0, 0.2);
-      transform: rotateX(-10deg) translateZ(0);
-      transform-style: preserve-3d;
-    }
-    .card-front .section-title {
-      color: #ffffff;
-      font-size: 0.8125rem;
-      font-weight: 600;
-      letter-spacing: 0.05em;
-      text-transform: uppercase;
-      margin-bottom: 1rem;
-    }
-    .card-front .flow-arrow {
-      color: rgba(255, 255, 255, 0.7);
-      font-size: 1rem;
-      margin-bottom: 1rem;
-      line-height: 1;
-    }
-    .card-front .message {
-      color: #ffffff;
-      font-size: 0.75rem;
-      font-weight: 100;
-      margin-bottom: 0.5rem;
-      font-family: monospace;
-    }
-    .card-front .progress {
-      color: rgba(255, 255, 255, 0.75);
-      font-size: 0.8125rem;
-    }
-  </style>
-</head>
-<body>
-  <div class="grid-bg">
-    <div class="gradient"></div>
-    <div class="grid-vertical-wrap">
-      <div class="fade"></div>
-      <div class="lines"></div>
-    </div>
-    <div class="grid-horizontal"></div>
-  </div>
-  <div id="card-wrap" class="card-wrap">
-    <div class="card-inner">
-      <div class="card-layer-back" aria-hidden="true"></div>
-      <div class="card-layer-mid" aria-hidden="true"></div>
-      <div id="card" class="card-front">
-        <div class="section-title">Authentication Successful</div>
-        <div class="flow-arrow" aria-hidden="true">↓</div>
-        <p class="message">You can close this window and return to your terminal.</p>
-        <p class="progress" id="progress">Closing automatically in 3 seconds…</p>
-      </div>
-    </div>
-  </div>
-  <script>
-    setTimeout(function() {
-      window.close();
-      var prog = document.getElementById('progress');
-      if (prog) prog.textContent = 'You can now close this window.';
-      var card = document.getElementById('card');
-      if (card) card.innerHTML = '<div class="section-title">Runtype is Ready</div><p class="message">You can now close this window</p>';
-    }, 3000);
-  <\/script>
-</body>
-</html>`;
-	}
-	escapeHtml(str) {
-		return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-	}
-	errorHTML(error) {
-		return `
-      <!DOCTYPE html>
-      <html>
-        <head>
-          <title>Authentication Failed</title>
-          <style>
-            * {
-              margin: 0;
-              padding: 0;
-              box-sizing: border-box;
-            }
-            body { 
-              font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-              display: flex; 
-              align-items: center; 
-              justify-content: center; 
-              height: 100vh;
-              background: linear-gradient(135deg, #ef4444 0%, #dc2626 100%);
-            }
-            .container {
-              background: white;
-              padding: 3rem;
-              border-radius: 12px;
-              text-align: center;
-              box-shadow: 0 20px 40px rgba(0,0,0,0.1);
-              max-width: 400px;
-            }
-            .error-icon { 
-              color: #ef4444; 
-              font-size: 64px;
-              margin-bottom: 1rem;
-            }
-            h1 {
-              color: #1f2937;
-              margin-bottom: 0.5rem;
-              font-size: 1.5rem;
-            }
-            p {
-              color: #6b7280;
-              font-size: 1rem;
-              margin-bottom: 1rem;
-            }
-            .error-details {
-              background: #fef2f2;
-              color: #991b1b;
-              padding: 0.75rem;
-              border-radius: 6px;
-              font-size: 0.875rem;
-              font-family: monospace;
-            }
-          </style>
-        </head>
-        <body>
-          <div class="container">
-            <div class="error-icon">✕</div>
-            <h1>Authentication Failed</h1>
-            <p>There was an error during authentication.</p>
-            <div class="error-details">${this.escapeHtml(error)}</div>
-          </div>
-        </body>
-      </html>
-    `;
-	}
-};
-//#endregion
-//#region src/auth/oauth-manager.ts
-var OAuthManager = class {
-	clerkPublishableKey;
-	dashboardUrl;
-	constructor(config) {
-		this.clerkPublishableKey = config.clerkPublishableKey;
-		this.dashboardUrl = config.dashboardUrl;
-	}
-	async authenticate(mode) {
-		const state = crypto$1.randomBytes(32).toString("base64url");
-		const codeVerifier = crypto$1.randomBytes(32).toString("base64url");
-		const codeChallenge = crypto$1.createHash("sha256").update(codeVerifier).digest("base64url");
-		const callbackServer = new CallbackServer();
-		callbackServer.setExpectedState(state);
-		const requestedPort = await this.findAvailablePort();
-		const { actualPort, codePromise } = await callbackServer.start(requestedPort);
-		const redirectUri = `http://127.0.0.1:${actualPort}/callback`;
-		const authUrl = new URL(`${this.dashboardUrl.replace(/\/$/, "")}/${mode}`);
-		authUrl.searchParams.set("redirect_uri", redirectUri);
-		authUrl.searchParams.set("cli", "true");
-		authUrl.searchParams.set("state", state);
-		authUrl.searchParams.set("code_challenge", codeChallenge);
-		authUrl.searchParams.set("code_challenge_method", "S256");
-		authUrl.searchParams.set("publishable_key", this.clerkPublishableKey);
-		console.log("🌐 Opening browser for authentication...");
-		console.log(`If the browser doesn't open, visit: ${authUrl}`);
-		try {
-			console.log("⏳ Waiting for authentication...");
-			const [code] = await Promise.all([codePromise, open(authUrl.toString()).catch(() => {
-				console.log("Failed to open browser automatically. Please visit the URL above.");
-			})]);
-			return await this.exchangeCodeForSession(code, codeVerifier, redirectUri);
-		} finally {
-			callbackServer.stop();
-		}
-	}
-	async findAvailablePort() {
-		return 8765;
-	}
-	async exchangeCodeForSession(code, codeVerifier, redirectUri) {
-		return code;
-	}
-};
-//#endregion
 //#region ../shared/dist/chunk-1Tgh2C1u.mjs
 /**
 * Get nested property value using dot notation and bracket notation.
@@ -11528,7 +11157,7 @@ function isDataConnectionToolId(toolId) {
 	return toolId.startsWith("dc:");
 }
 //#endregion
-//#region ../shared/dist/chunk-CN8mv6N6.mjs
+//#region ../shared/dist/chunk-InaIcoUA.mjs
 /**
 * Maps model families to provider-specific model IDs.
 * Use for routing: family + provider → exact model ID
@@ -11551,6 +11180,11 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 	},
 	"claude-haiku-4-5-20251001": { "anthropic": "claude-haiku-4-5-20251001" },
 	"claude-haiku-4.5": { "vercel": "anthropic/claude-haiku-4.5" },
+	"claude-haiku-5-5": {
+		"anthropic": "claude-haiku-5-5",
+		"vercel": "anthropic/claude-haiku-5.5"
+	},
+	"claude-haiku-5.5": { "vercel": "anthropic/claude-haiku-5.5" },
 	"claude-opus-4": { "vercel": "anthropic/claude-opus-4" },
 	"claude-opus-4-5": {
 		"anthropic": "claude-opus-4-5-20251101",
@@ -11613,12 +11247,14 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 	"deep-research-max-preview-04-2026": { "google": "deep-research-max-preview-04-2026" },
 	"deep-research-preview-04-2026": { "google": "deep-research-preview-04-2026" },
 	"deepseek-v4-1-flash": { "vercel": "deepseek/deepseek-v4.1-flash" },
+	"deepseek-v4-1-flash-fast": { "vercel": "deepseek/deepseek-v4.1-flash-fast" },
 	"deepseek-v4-flash": { "vercel": "deepseek/deepseek-v4-flash" },
 	"deepseek-v4-flash-0731": { "vercel": "deepseek/deepseek-v4-flash-0731" },
 	"deepseek-v4-flash-vision-exp": { "vercel": "deepseek/deepseek-v4-flash-vision-exp" },
 	"deepseek-v4-pro": { "vercel": "deepseek/deepseek-v4-pro" },
 	"deepseek-v4-pro-0813": { "vercel": "deepseek/deepseek-v4-pro-0813" },
 	"deepseek-v4.1-flash": { "vercel": "deepseek/deepseek-v4.1-flash" },
+	"deepseek-v4.1-flash-fast": { "vercel": "deepseek/deepseek-v4.1-flash-fast" },
 	"ember-1": { "vercel": "fireworks/ember-1" },
 	"fugu-max": { "vercel": "sakana/fugu-max" },
 	"fugu-ultra": { "vercel": "sakana/fugu-ultra-v2" },
@@ -11746,6 +11382,8 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 	"gemini-3.8-live-extended-thinking": { "vercel": "google/gemini-3.8-live-extended-thinking" },
 	"gemini-embedding-001": { "google": "gemini-embedding-001" },
 	"gemini-embedding-2": { "google": "gemini-embedding-2" },
+	"gemini-nano-banana-2-1": { "vercel": "google/gemini-nano-banana-2.1" },
+	"gemini-nano-banana-2.1": { "vercel": "google/gemini-nano-banana-2.1" },
 	"gemini-omni-flash": { "vercel": "google/gemini-omni-flash-preview" },
 	"gemini-omni-flash-preview": { "vercel": "google/gemini-omni-flash-preview" },
 	"gemma-4-26b-a4b-it": {
@@ -12056,11 +11694,10 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 	"inkling": { "vercel": "thinkingmachines/inkling" },
 	"inkling-small": { "vercel": "thinkingmachines/inkling-small" },
 	"interfaze-beta": { "vercel": "interfaze/interfaze-beta" },
-	"kimi-k2": { "vercel": "moonshotai/kimi-k2-thinking" },
+	"kimi-k2": { "vercel": "moonshotai/kimi-k2" },
 	"kimi-k2-6": { "vercel": "moonshotai/kimi-k2.6" },
 	"kimi-k2-7-code": { "vercel": "moonshotai/kimi-k2.7-code" },
 	"kimi-k2-7-code-highspeed": { "vercel": "moonshotai/kimi-k2.7-code-highspeed" },
-	"kimi-k2-thinking": { "vercel": "moonshotai/kimi-k2-thinking" },
 	"kimi-k2.6": { "vercel": "moonshotai/kimi-k2.6" },
 	"kimi-k2.7-code": { "vercel": "moonshotai/kimi-k2.7-code" },
 	"kimi-k2.7-code-highspeed": { "vercel": "moonshotai/kimi-k2.7-code-highspeed" },
@@ -12072,13 +11709,11 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 	"laguna-s-2.1-free": { "vercel": "poolside/laguna-s-2.1-free" },
 	"ling-3-0-flash": { "vercel": "inclusionai/ling-3.0-flash" },
 	"ling-3-0-flash-sante": { "vercel": "inclusionai/ling-3.0-flash-sante" },
-	"ling-3-0-flash-sante-free": { "vercel": "inclusionai/ling-3.0-flash-sante-free" },
 	"ling-3-0-flash-vl": { "vercel": "inclusionai/ling-3.0-flash-vl" },
 	"ling-3-1-flash": { "vercel": "inclusionai/ling-3.1-flash" },
 	"ling-3-1-flash-free": { "vercel": "inclusionai/ling-3.1-flash-free" },
 	"ling-3.0-flash": { "vercel": "inclusionai/ling-3.0-flash" },
 	"ling-3.0-flash-sante": { "vercel": "inclusionai/ling-3.0-flash-sante" },
-	"ling-3.0-flash-sante-free": { "vercel": "inclusionai/ling-3.0-flash-sante-free" },
 	"ling-3.0-flash-vl": { "vercel": "inclusionai/ling-3.0-flash-vl" },
 	"ling-3.1-flash": { "vercel": "inclusionai/ling-3.1-flash" },
 	"ling-3.1-flash-free": { "vercel": "inclusionai/ling-3.1-flash-free" },
@@ -12117,6 +11752,7 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 	"ministral-3b": { "vercel": "mistral/ministral-3b" },
 	"ministral-8b": { "vercel": "mistral/ministral-8b" },
 	"mistral-large-3": { "vercel": "mistral/mistral-large-3" },
+	"mistral-large-4": { "vercel": "mistral/mistral-large-4" },
 	"mistral-medium-3-5": { "vercel": "mistral/mistral-medium-3.5" },
 	"mistral-medium-3.5": { "vercel": "mistral/mistral-medium-3.5" },
 	"mistral-small": { "vercel": "mistral/mistral-small" },
@@ -12228,9 +11864,7 @@ const MODEL_FAMILY_PROVIDER_IDS = {
 	"seed-2-1-turbo": { "vercel": "bytedance/seed-2.1-turbo" },
 	"seed-2.1-turbo": { "vercel": "bytedance/seed-2.1-turbo" },
 	"sonar": { "vercel": "perplexity/sonar" },
-	"step-3-5-flash": { "vercel": "stepfun/step-3.5-flash" },
 	"step-3-7-flash": { "vercel": "stepfun/step-3.7-flash" },
-	"step-3.5-flash": { "vercel": "stepfun/step-3.5-flash" },
 	"step-3.7-flash": { "vercel": "stepfun/step-3.7-flash" },
 	"step-5": { "vercel": "stepfun/step-5-preview" },
 	"step-5-preview": { "vercel": "stepfun/step-5-preview" },
@@ -12322,7 +11956,10 @@ const QWEN_3_8_27B_IDS = [
 	"claude-sonnet-5",
 	"anthropic/claude-sonnet-5",
 	"claude-haiku-4.5",
-	"anthropic/claude-haiku-4.5"
+	"anthropic/claude-haiku-4.5",
+	"claude-haiku-5-5",
+	"claude-haiku-5.5",
+	"anthropic/claude-haiku-5.5"
 ]) }), {
 	...workersAiPrimary(DEEPSEEK_V4_FLASH_IDS),
 	...vercelPrimary(QWEN_3_8_27B_IDS, ["mixlayer"]),
@@ -12385,6 +12022,14 @@ const MANUAL_PROVIDER_MAP_OVERRIDES = {
 		"vercel": "anthropic/claude-haiku-4.5",
 		"anthropic": "claude-haiku-4-5-20251001"
 	},
+	"claude-haiku-5.5": {
+		"vercel": "anthropic/claude-haiku-5.5",
+		"anthropic": "claude-haiku-5-5"
+	},
+	"anthropic/claude-haiku-5.5": {
+		"vercel": "anthropic/claude-haiku-5.5",
+		"anthropic": "claude-haiku-5-5"
+	},
 	...workersAiAliases("@cf/zai-org/glm-5.3-flash", GLM_5_3_FLASH_IDS),
 	"qwen/qwen3.8-27b": {
 		"mixlayer": "qwen/qwen3.8-27b",
@@ -12495,7 +12140,7 @@ const CREATOR_TO_PROVIDER = {
 	"unknown": "openai"
 };
 //#endregion
-//#region ../shared/dist/chunk-EZRDnysg.mjs
+//#region ../shared/dist/chunk-ykhTBHKy.mjs
 /**
 * The reserved model-facing name of the agent state write tool
 * (`packages/runtime/src/engine/state-write-tool.ts`). The model is told to call
@@ -12899,7 +12544,7 @@ function durableCrawlBudget(plan) {
 	};
 }
 //#endregion
-//#region ../shared/dist/chunk-2PJvKrV8.mjs
+//#region ../shared/dist/chunk-BcuKxfZa.mjs
 /**
 * Unwraps a single {{variableName}} template to its bare variable name, preserving array/object identity instead of stringifying via the template engine.
 * Returns source unchanged when it is not a lone {{...}} wrapper.
@@ -13005,6 +12650,14 @@ strictObject({
 	required: array(fieldNameSchema).optional(),
 	additionalProperties: boolean().optional()
 }).superRefine((schema, ctx) => addSemanticIssues(schema, ctx));
+//#endregion
+//#region ../shared/dist/chunk-DoQn4_pS.mjs
+/** The Tenancy Assurance Levels, in the order `tenancyAssuranceLevelSchema` is built from. */
+const TENANCY_ASSURANCE_LEVELS = [
+	"anonymous",
+	"asserted",
+	"verified"
+];
 const FLOW_STEP_TYPES = ["prompt", ...[
 	"crawl",
 	"fetch-url",
@@ -13737,19 +13390,68 @@ object({
 	model: string().min(1).optional(),
 	calibration: judgmentCalibrationSchema.optional()
 });
-Object.freeze({ "typesafe-ai/jev": Object.freeze({
-	id: "typesafe-ai/jev",
-	name: "Jev",
-	description: "TypeSafe AI System One evaluation model. Accepts shared state and typed questions, returning choices, scores, and boolean probabilities. Limits: 64,000 tokens total per request; 32,000 tokens for the state plus the longest question. No streaming or output-token limit.",
-	contextWindow: 32e3,
-	supportedSpecifications: Object.freeze(["v4"]),
-	pricing: Object.freeze({
-		inputPerToken: "0.000000042",
-		outputPerToken: "0",
-		inputPer1MTokens: .042,
-		outputPer1MTokens: 0
+Object.freeze({
+	"convaiinnovations/laya": Object.freeze({
+		id: "convaiinnovations/laya",
+		name: "Laya",
+		description: "Laya is Convai Innovations’ System One evaluation model for fast, structured decisions. It evaluates shared state against choice, score, and yes/no questions and returns typed answers with probabilities in a single forward pass. It supports classification, routing, guardrail checks, and rubric-based assessment without generating free-form text.",
+		contextWindow: 8192,
+		supportedSpecifications: Object.freeze(["v4"]),
+		pricing: Object.freeze({
+			inputPerToken: "0",
+			outputPerToken: "0",
+			inputPer1MTokens: 0,
+			outputPer1MTokens: 0
+		})
+	}),
+	"convaiinnovations/laya-free": Object.freeze({
+		id: "convaiinnovations/laya-free",
+		name: "Laya (Free)",
+		description: "Laya is Convai Innovations’ System One evaluation model for fast, structured decisions. It evaluates shared state against choice, score, and yes/no questions and returns typed answers with probabilities in a single forward pass. It supports classification, routing, guardrail checks, and rubric-based assessment without generating free-form text.",
+		contextWindow: 8192,
+		supportedSpecifications: Object.freeze(["v4"]),
+		pricing: Object.freeze({
+			inputPerToken: "0",
+			outputPerToken: "0",
+			inputPer1MTokens: 0,
+			outputPer1MTokens: 0
+		})
+	}),
+	"liquid/d1": Object.freeze({
+		id: "liquid/d1",
+		name: "Liquid d1",
+		description: "Liquid d1 is a decision model for classification, routing, and scoring. It evaluates shared state against typed Choice, Score, and yes/no questions and returns structured answers with calibrated probabilities through the TypeSafe-compatible System One API.",
+		contextWindow: 65536,
+		supportedSpecifications: Object.freeze(["v4"]),
+		pricing: Object.freeze({
+			inputPerToken: "0.00000004",
+			outputPerToken: "0",
+			inputPer1MTokens: .04,
+			outputPer1MTokens: 0
+		})
+	}),
+	"openai/gpt-6-luna-decisions": Object.freeze({
+		id: "openai/gpt-6-luna-decisions",
+		name: "GPT-6 Luna Decisions",
+		description: "GPT-6 Luna Decisions evaluates classification and scoring questions against shared text and image input using OpenAI's Decisions API. It supports predicate, choice, and score questions with probabilities and confidence values.",
+		contextWindow: 105e4,
+		supportedSpecifications: Object.freeze(["v4"]),
+		pricing: null
+	}),
+	"typesafe-ai/jev": Object.freeze({
+		id: "typesafe-ai/jev",
+		name: "Jev",
+		description: "TypeSafe AI System One decision model. Accepts shared state and typed questions, returning choices, scores, and boolean probabilities. Limits: 64,000 tokens total per request; 32,000 tokens for the state plus the longest question. No streaming or output-token limit.",
+		contextWindow: 32e3,
+		supportedSpecifications: Object.freeze(["v4"]),
+		pricing: Object.freeze({
+			inputPerToken: "0.000000042",
+			outputPerToken: "0",
+			inputPer1MTokens: .042,
+			outputPer1MTokens: 0
+		})
 	})
-}) });
+});
 //#endregion
 //#region ../shared/dist/chunk-CIi5jW2t.mjs
 /**
@@ -15266,11 +14968,7 @@ const agentStateChannelSchema = object({
 * Tenant vs End User). The vocabulary the trust boundary grades into and a
 * strategy's assurance floor is expressed in. `CONTEXT.md` → "Assurance level".
 */
-const tenancyAssuranceLevelSchema = _enum([
-	"anonymous",
-	"asserted",
-	"verified"
-]);
+const tenancyAssuranceLevelSchema = _enum(TENANCY_ASSURANCE_LEVELS);
 /**
 * Named archetype preset for a Tenancy Strategy (ADR 0012): the elicitable, auditable unit.
 * internal: Builder-Org internal tooling, product-scoped data, no tenant/end-user required.
@@ -23079,6 +22777,7 @@ const agentExternalConfigSchema = object({
 	auth: record(string(), any()).optional(),
 	timeout: number$1().positive().optional(),
 	retryCount: number$1().int().nonnegative().optional(),
+	identityAssertion: boolean().optional(),
 	skillOrchestration: union([_enum(["delegate", "managed"]), boolean()]).optional()
 });
 /**
@@ -25106,7 +24805,7 @@ const AgentInputSchema = object({
 	durability: agentDurabilityConfigSchema.optional(),
 	tenancyStrategy: agentRuntimeConfigSchema.shape.tenancyStrategy
 }).superRefine((val, ctx) => {
-	const unsupported = val.tenancyStrategy !== void 0 ? [["tenancyStrategy"], "tenancyStrategy is server-authored; save it on an agent"] : val.voice !== void 0 ? [["voice"], "voice is unsupported by agent dispatch"] : Object.keys(val.temporal ?? {}).some((key) => key !== "timezone") ? [["temporal"], "Only temporal.timezone is supported by agent dispatch"] : void 0;
+	const unsupported = val.tenancyStrategy !== void 0 ? [["tenancyStrategy"], "tenancyStrategy is server-authored; save it on an agent"] : val.voice !== void 0 ? [["voice"], "voice is unsupported by agent dispatch"] : void 0;
 	if (unsupported) {
 		const [path, message] = unsupported;
 		ctx.addIssue({
@@ -25973,7 +25672,10 @@ object({
 	metering: _enum(["active", "legacy-untracked"]),
 	sleepPolicy: sandboxDeploySleepPolicySchema.optional(),
 	autoStopInterval: number$1().optional(),
-	autoDeleteInterval: number$1().optional()
+	autoDeleteInterval: number$1().optional(),
+	containerEpoch: number$1().int().optional().describe("Runtype Sandbox: the container epoch the preview URL is bound to; a new epoch mints a new URL."),
+	freshContainer: boolean().optional().describe("Runtype Sandbox: true when this deploy started a new container rather than reusing a running one."),
+	previewUrlChanged: boolean().optional().describe("Runtype Sandbox: true when the preview URL differs from the one the previous successful deploy to this sandbox returned. Re-register any saved copy of the old URL. False for a first deploy.")
 });
 Object.freeze({
 	/** Automatic attempts per incident, counted in OPERATIONS rather than requests. */
@@ -26508,97 +26210,550 @@ object({
 	diagnosticId: string().max(64)
 });
 //#endregion
-//#region src/auth/credential-store.ts
-var credential_store_exports = /* @__PURE__ */ __exportAll({ CredentialStore: () => CredentialStore });
-const CREDENTIALS_DIR = path$1.join(os.homedir(), ".runtype");
-const CREDENTIALS_PATH = path$1.join(CREDENTIALS_DIR, "credentials.json");
-function createConf(encryptionKey) {
-	return new Conf({
-		projectName: "runtype-cli",
-		projectSuffix: "",
-		configName: "credentials",
-		encryptionKey,
-		cwd: CREDENTIALS_DIR
-	});
+//#region src/config/paths.ts
+/** Root state directory: RUNTYPE_STATE_DIR or ~/.runtype */
+function getRuntypeHomeDir() {
+	return process.env.RUNTYPE_STATE_DIR || path$2.join(os$1.homedir(), ".runtype");
 }
-function isCorruptStoreError$1(error) {
-	if (error instanceof SyntaxError) return true;
-	const message = error instanceof Error ? error.message : String(error);
-	return typeof message === "string" && message.includes("JSON");
+/** Per-project state dir: ~/.runtype/projects/{hash}/ */
+function getProjectStateDir(projectDir) {
+	const dir = projectDir || process.cwd();
+	const hash = crypto$3.createHash("sha256").update(dir).digest("hex").slice(0, 12);
+	const stateDir = path$2.join(getRuntypeHomeDir(), "projects", hash);
+	const breadcrumb = path$2.join(stateDir, "project-path.txt");
+	if (!fs$1.existsSync(breadcrumb)) {
+		fs$1.mkdirSync(stateDir, { recursive: true });
+		fs$1.writeFileSync(breadcrumb, dir);
+	}
+	return stateDir;
 }
-var CredentialStore = class {
-	config;
-	encryptionKey;
-	constructor() {
-		this.encryptionKey = this.getMachineKey();
+/** Marathon state dir: ~/.runtype/projects/{hash}/marathons/ */
+function getMarathonStateDir(projectDir) {
+	return path$2.join(getProjectStateDir(projectDir), "marathons");
+}
+//#endregion
+//#region src/auth/secret-backend.ts
+const KEYCHAIN_SERVICE = "runtype-cli";
+let keyringModule;
+/** Load the native keyring binding lazily; a missing prebuilt binary means "no keychain", not a crash. */
+function loadKeyring() {
+	keyringModule ??= import("@napi-rs/keyring").then((mod) => mod.AsyncEntry).catch(() => null);
+	return keyringModule;
+}
+var KeychainSecretBackend = class {
+	kind = "keychain";
+	async entry(name) {
+		const AsyncEntry = await loadKeyring();
+		if (!AsyncEntry) throw new Error("OS keychain is not available on this platform.");
+		return new AsyncEntry(KEYCHAIN_SERVICE, name);
+	}
+	async get(name) {
+		return await (await this.entry(name)).getPassword() ?? null;
+	}
+	async set(name, value) {
+		await (await this.entry(name)).setPassword(value);
+	}
+	async delete(name) {
+		await (await this.entry(name)).deleteCredential();
+	}
+};
+/**
+* Fallback for hosts with no usable OS keychain (headless Linux, containers, CI).
+* Values are AES-256-CBC encrypted with a host/user-derived key: obfuscation at rest, not secrecy
+* from someone who can read the file. The file is written 0600 inside a 0700 directory.
+*/
+var FileSecretBackend = class {
+	filePath;
+	kind = "file";
+	constructor(filePath = path.join(getRuntypeHomeDir(), "secrets.json")) {
+		this.filePath = filePath;
+	}
+	async get(name) {
+		const encrypted = this.read()[name];
+		return encrypted ? decryptWithMachineKey(encrypted) : null;
+	}
+	async set(name, value) {
+		this.write({
+			...this.read(),
+			[name]: encryptWithMachineKey(value)
+		});
+	}
+	async delete(name) {
+		const secrets = this.read();
+		if (!(name in secrets)) return;
+		delete secrets[name];
+		this.write(secrets);
+	}
+	read() {
 		try {
-			this.config = createConf(this.encryptionKey);
-		} catch (error) {
-			if (isCorruptStoreError$1(error)) {
-				try {
-					if (fs$1.existsSync(CREDENTIALS_PATH)) fs$1.unlinkSync(CREDENTIALS_PATH);
-				} catch {}
-				this.config = createConf(this.encryptionKey);
-			} else throw error;
+			const parsed = JSON.parse(fs.readFileSync(this.filePath, "utf8"));
+			return parsed && typeof parsed === "object" ? parsed : {};
+		} catch {
+			return {};
 		}
 	}
-	/**
-	* Replace the entire backing store in one file write.
-	* Conf's store setter is typed read-only, hence the cast to assign it.
-	* Single-write replacement is load-bearing: a multi-write sequence could lose the only copy of a fresh credential after the server revokes the previous key.
-	*/
-	replaceStore(data) {
-		this.config.store = data;
+	write(secrets) {
+		writePrivateJsonFile(this.filePath, secrets);
+	}
+};
+/** Write JSON atomically (temp file + rename) with owner-only permissions. */
+function writePrivateJsonFile(filePath, data) {
+	const directory = path.dirname(filePath);
+	fs.mkdirSync(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporaryPath = path.join(directory, `.${path.basename(filePath)}.${crypto$1.randomUUID()}.tmp`);
+	try {
+		fs.writeFileSync(temporaryPath, `${JSON.stringify(data, null, 2)}\n`, { mode: 384 });
+		fs.renameSync(temporaryPath, filePath);
+	} finally {
+		fs.rmSync(temporaryPath, { force: true });
+	}
+}
+function getMachineKey() {
+	return crypto$1.createHash("sha256").update(`runtype-cli-${os.hostname()}-${os.userInfo().username}`).digest("hex").substring(0, 32);
+}
+function encryptWithMachineKey(text) {
+	const iv = crypto$1.randomBytes(16);
+	const cipher = crypto$1.createCipheriv("aes-256-cbc", Buffer.from(getMachineKey()), iv);
+	return `${iv.toString("hex")}:${cipher.update(text, "utf8", "hex")}${cipher.final("hex")}`;
+}
+function decryptWithMachineKey(text) {
+	const [ivHex, encrypted] = text.split(":");
+	const decipher = crypto$1.createDecipheriv("aes-256-cbc", Buffer.from(getMachineKey()), Buffer.from(ivHex, "hex"));
+	return `${decipher.update(encrypted, "hex", "utf8")}${decipher.final("utf8")}`;
+}
+/** `RUNTYPE_CREDENTIAL_STORE=file|keychain` pins the backend; anything else is `auto`. */
+function getSecretStorePreference() {
+	const value = process.env.RUNTYPE_CREDENTIAL_STORE?.trim().toLowerCase();
+	return value === "file" || value === "keychain" ? value : "auto";
+}
+//#endregion
+//#region src/auth/account-store.ts
+const LAST_USED_RESOLUTION_MS = 6e4;
+/** Canonical API base used for account identity; mirrors normalizeApiUrl for valid URLs. */
+function canonicalApiUrl(value) {
+	try {
+		return new URL(value).toString().replace(/\/+$/, "");
+	} catch {
+		return value.replace(/\/+$/, "");
+	}
+}
+function accountIdFor(apiUrl, orgId, userId) {
+	return `${canonicalApiUrl(apiUrl)}#${orgId ?? `user:${userId}`}`;
+}
+function recency(account) {
+	return Date.parse(account.lastUsedAt ?? account.createdAt) || 0;
+}
+function mostRecent(accounts) {
+	return [...accounts].sort((a, b) => recency(b) - recency(a))[0] ?? null;
+}
+/**
+* Pick the stored login for an invocation. A requested organization only ever matches that
+* organization: a project linked to org A must never silently run with org B's credential.
+* Without one, the default login wins when it targets the explicit API URL (if any).
+*/
+function selectAccount(accounts, options) {
+	const apiUrl = options.apiUrl ? canonicalApiUrl(options.apiUrl) : void 0;
+	const onTarget = apiUrl ? accounts.filter((account) => account.apiUrl === apiUrl) : accounts;
+	if (options.orgId) return mostRecent(onTarget.filter((account) => account.orgId === options.orgId));
+	return onTarget.find((account) => account.id === options.defaultAccountId) ?? mostRecent(onTarget);
+}
+const LOCK_STALE_MS = 3e4;
+const LOCK_TIMEOUT_MS = 1e4;
+const heldLocks = new AsyncLocalStorage();
+/** Multi-account login store: one org-scoped credential per (API URL, organization). */
+var AccountStore = class {
+	filePath;
+	lockPath;
+	keychain;
+	fileBackend;
+	legacyCredentialsDir;
+	secretPrefix;
+	constructor(options = {}) {
+		const homeDir = path.resolve(options.homeDir ?? getRuntypeHomeDir());
+		this.filePath = path.join(homeDir, "accounts.json");
+		this.lockPath = `${this.filePath}.lock`;
+		this.keychain = options.keychain ?? new KeychainSecretBackend();
+		this.fileBackend = options.file ?? new FileSecretBackend(path.join(homeDir, "secrets.json"));
+		const defaultHome = path.join(os.homedir(), ".runtype");
+		const isDefaultHome = homeDir === defaultHome;
+		this.legacyCredentialsDir = options.legacyCredentialsDir ?? (isDefaultHome ? defaultHome : null);
+		this.secretPrefix = isDefaultHome ? "" : `${crypto$1.createHash("sha256").update(homeDir).digest("hex").slice(0, 12)}/`;
+	}
+	async list() {
+		return (await this.load()).accounts;
+	}
+	async get(id) {
+		return (await this.list()).find((account) => account.id === id) ?? null;
+	}
+	async getDefault() {
+		const data = await this.load();
+		return data.accounts.find((account) => account.id === data.defaultAccountId) ?? null;
+	}
+	async setDefault(id) {
+		await this.withLock(async () => {
+			const data = await this.load();
+			if (id !== null && !data.accounts.some((account) => account.id === id)) throw new Error(`No stored login with id ${id}.`);
+			this.persist({
+				...data,
+				defaultAccountId: id
+			});
+		});
+	}
+	/** Store (or replace) the login for this credential's org, secret first so metadata never points at nothing. */
+	async save(input, options = {}) {
+		return this.withLock(async () => {
+			const apiUrl = canonicalApiUrl(input.apiUrl);
+			const orgId = input.orgId ?? null;
+			const id = accountIdFor(apiUrl, orgId, input.userId);
+			const backend = await this.writeSecret(this.apiKeySecretName(id), input.apiKey);
+			const { claim: claimInput } = options;
+			let claim;
+			if (claimInput) {
+				const { claimToken, ...claimMetadata } = claimInput;
+				await backend.set(this.claimTokenSecretName(id), claimToken);
+				claim = claimMetadata;
+			} else await this.deleteSecret(backend, this.claimTokenSecretName(id));
+			const data = await this.load();
+			const previous = data.accounts.find((account) => account.id === id);
+			if (previous && previous.secretStore !== backend.kind) {
+				await this.deleteSecret(this.backendFor(previous), this.apiKeySecretName(id));
+				await this.deleteSecret(this.backendFor(previous), this.claimTokenSecretName(id));
+			}
+			const now = (/* @__PURE__ */ new Date()).toISOString();
+			const account = {
+				id,
+				apiUrl,
+				orgId,
+				userId: input.userId,
+				secretStore: backend.kind,
+				createdAt: now,
+				lastUsedAt: now,
+				...claim ? { claim } : {}
+			};
+			const accounts = [...data.accounts.filter((existing) => existing.id !== id), account];
+			const makeDefault = options.makeDefault ?? !data.defaultAccountId;
+			this.persist({
+				version: 1,
+				accounts,
+				defaultAccountId: makeDefault ? id : data.defaultAccountId
+			});
+			return account;
+		});
+	}
+	async getApiKey(account) {
+		return this.backendFor(account).get(this.apiKeySecretName(account.id));
+	}
+	async getClaimToken(account) {
+		if (!account.claim) return null;
+		return this.backendFor(account).get(this.claimTokenSecretName(account.id));
+	}
+	async setClaim(id, claim) {
+		await this.withLock(async () => {
+			const data = await this.load();
+			const account = data.accounts.find((existing) => existing.id === id);
+			if (!account) throw new Error(`No stored login with id ${id}.`);
+			const backend = this.backendFor(account);
+			let nextClaim;
+			if (claim) {
+				const { claimToken, ...metadata } = claim;
+				if (claimToken) await backend.set(this.claimTokenSecretName(id), claimToken);
+				nextClaim = metadata;
+			} else await this.deleteSecret(backend, this.claimTokenSecretName(id));
+			const { claim: _previousClaim, ...rest } = account;
+			const updated = nextClaim ? {
+				...rest,
+				claim: nextClaim
+			} : rest;
+			this.persist({
+				...data,
+				accounts: data.accounts.map((existing) => existing.id === id ? updated : existing)
+			});
+		});
+	}
+	async remove(id) {
+		return this.withLock(async () => {
+			const data = await this.load();
+			const account = data.accounts.find((existing) => existing.id === id);
+			if (!account) return false;
+			const backend = this.backendFor(account);
+			await this.deleteSecret(backend, this.apiKeySecretName(id));
+			await this.deleteSecret(backend, this.claimTokenSecretName(id));
+			this.persist({
+				version: 1,
+				accounts: data.accounts.filter((existing) => existing.id !== id),
+				defaultAccountId: data.defaultAccountId === id ? null : data.defaultAccountId
+			});
+			return true;
+		});
 	}
-	getMachineKey() {
-		const hostname = os.hostname();
-		const username = os.userInfo().username;
-		return crypto$1.createHash("sha256").update(`runtype-cli-${hostname}-${username}`).digest("hex").substring(0, 32);
+	async touch(id) {
+		const current = (await this.load()).accounts.find((account) => account.id === id);
+		if (!current) return;
+		const last = current.lastUsedAt ? Date.parse(current.lastUsedAt) : 0;
+		if (Date.now() - last < LAST_USED_RESOLUTION_MS) return;
+		await this.withLock(async () => {
+			const data = await this.load();
+			const account = data.accounts.find((existing) => existing.id === id);
+			if (!account) return;
+			account.lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
+			this.persist(data);
+		});
+	}
+	apiKeySecretName(accountId) {
+		return `${this.secretPrefix}${accountId}:api-key`;
+	}
+	claimTokenSecretName(accountId) {
+		return `${this.secretPrefix}${accountId}:claim-token`;
 	}
 	/**
-	* Store credentials, optionally together with agent-auth claim state, in one write.
-	* Passing claimState here keeps the credential and claim token atomic, avoiding an orphaned pre-claim key.
-	* Storing credentials WITHOUT claimState invalidates any in-flight claim ceremony.
+	* Serialize read-modify-write of accounts.json (and secrets.json) across CLI processes with an
+	* exclusive lock file. Re-entrant along one async call chain so a locked operation may call another.
 	*/
-	async saveCredentials(credentials, claimState) {
-		const configData = {
-			apiKey: this.encrypt(credentials.apiKey),
-			userId: credentials.userId,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-			lastUsed: (/* @__PURE__ */ new Date()).toISOString()
+	async withLock(operation) {
+		const held = heldLocks.getStore() ?? /* @__PURE__ */ new Set();
+		if (held.has(this.lockPath)) return operation();
+		fs.mkdirSync(path.dirname(this.lockPath), {
+			recursive: true,
+			mode: 448
+		});
+		const deadline = Date.now() + LOCK_TIMEOUT_MS;
+		for (;;) try {
+			fs.closeSync(fs.openSync(this.lockPath, "wx", 384));
+			break;
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			if (this.lockIsStale()) {
+				fs.rmSync(this.lockPath, { force: true });
+				continue;
+			}
+			if (Date.now() > deadline) throw new Error(`Timed out waiting for another runtype process to finish updating logins (${this.lockPath}).`, { cause: error });
+			await new Promise((resolve) => setTimeout(resolve, 25 + Math.random() * 50));
+		}
+		try {
+			return await heldLocks.run(/* @__PURE__ */ new Set([...held, this.lockPath]), operation);
+		} finally {
+			fs.rmSync(this.lockPath, { force: true });
+		}
+	}
+	lockIsStale() {
+		try {
+			return Date.now() - fs.statSync(this.lockPath).mtimeMs > LOCK_STALE_MS;
+		} catch {
+			return false;
+		}
+	}
+	backendFor(account) {
+		return account.secretStore === "keychain" ? this.keychain : this.fileBackend;
+	}
+	async writeSecret(name, value) {
+		const preference = getSecretStorePreference();
+		if (preference === "file") {
+			await this.fileBackend.set(name, value);
+			return this.fileBackend;
+		}
+		try {
+			await this.keychain.set(name, value);
+			return this.keychain;
+		} catch (error) {
+			if (preference === "keychain") throw error;
+			await this.fileBackend.set(name, value);
+			return this.fileBackend;
+		}
+	}
+	async deleteSecret(backend, name) {
+		try {
+			await backend.delete(name);
+		} catch {}
+	}
+	readFile() {
+		let raw;
+		try {
+			raw = fs.readFileSync(this.filePath, "utf8");
+		} catch {
+			return null;
+		}
+		try {
+			const parsed = JSON.parse(raw);
+			if (parsed?.version === 1 && Array.isArray(parsed.accounts)) return {
+				version: 1,
+				defaultAccountId: parsed.defaultAccountId ?? null,
+				accounts: parsed.accounts
+			};
+		} catch {}
+		return {
+			version: 1,
+			defaultAccountId: null,
+			accounts: []
 		};
-		if (credentials.orgId !== void 0) configData.orgId = credentials.orgId;
-		if (credentials.apiUrl !== void 0) configData.apiUrl = credentials.apiUrl;
-		if (claimState) Object.assign(configData, this.claimStateToConfig(claimState));
-		this.replaceStore(configData);
-	}
-	claimStateToConfig(state) {
-		const data = {
-			claimToken: this.encrypt(state.claimToken),
-			registrationId: state.registrationId
+	}
+	async load() {
+		const existing = this.readFile();
+		if (existing) return existing;
+		const empty = {
+			version: 1,
+			defaultAccountId: null,
+			accounts: []
+		};
+		const legacy = this.readLegacyCredentials();
+		if (!legacy) return empty;
+		return this.withLock(async () => {
+			const raced = this.readFile();
+			if (raced) return raced;
+			this.persist(empty);
+			try {
+				await this.save(legacy.account, {
+					claim: legacy.claim,
+					makeDefault: true
+				});
+			} catch {
+				fs.rmSync(this.filePath, { force: true });
+				return empty;
+			}
+			return this.readFile() ?? empty;
+		});
+	}
+	readLegacyCredentials() {
+		if (!this.legacyCredentialsDir) return null;
+		if (!fs.existsSync(path.join(this.legacyCredentialsDir, "credentials.json"))) return null;
+		try {
+			const store = new Conf({
+				projectName: "runtype-cli",
+				projectSuffix: "",
+				configName: "credentials",
+				encryptionKey: getMachineKey(),
+				cwd: this.legacyCredentialsDir
+			}).store;
+			if (!store.apiKey || !store.userId) return null;
+			const apiKey = decryptWithMachineKey(store.apiKey);
+			const claim = store.claimToken && store.registrationId ? {
+				claimToken: decryptWithMachineKey(store.claimToken),
+				registrationId: store.registrationId,
+				claimEmail: store.claimEmail,
+				credentialExpires: store.credentialExpires,
+				claimTokenExpires: store.claimTokenExpires,
+				apiUrl: store.claimApiUrl
+			} : void 0;
+			return {
+				account: {
+					apiKey,
+					userId: store.userId,
+					orgId: store.orgId ?? null,
+					apiUrl: store.apiUrl || "https://api.runtype.com"
+				},
+				claim
+			};
+		} catch {
+			return null;
+		}
+	}
+	persist(data) {
+		writePrivateJsonFile(this.filePath, data);
+	}
+};
+//#endregion
+//#region src/auth/credential-store.ts
+var credential_store_exports = /* @__PURE__ */ __exportAll({ CredentialStore: () => CredentialStore });
+/**
+* Credential access for CLI commands. "Active" methods act on the login this invocation
+* resolved to (`--org` > `RUNTYPE_ORG` > `.runtype/project.json` > default login); the
+* account methods manage every stored login. Secrets live in the OS keychain when available.
+*/
+var CredentialStore = class {
+	accounts;
+	constructor(accounts = new AccountStore()) {
+		this.accounts = accounts;
+	}
+	async resolveCredentials(selection) {
+		const account = selectAccount(await this.accounts.list(), {
+			...selection,
+			defaultAccountId: (await this.accounts.getDefault())?.id ?? null
+		});
+		if (!account) return null;
+		let apiKey;
+		try {
+			apiKey = await this.accounts.getApiKey(account);
+		} catch (error) {
+			return {
+				account,
+				credentials: null,
+				readError: error instanceof Error ? error.message : String(error)
+			};
+		}
+		if (!apiKey) return {
+			account,
+			credentials: null
+		};
+		await this.accounts.touch(account.id).catch(() => void 0);
+		return {
+			account,
+			credentials: {
+				accountId: account.id,
+				apiKey,
+				userId: account.userId,
+				...account.orgId ? { orgId: account.orgId } : {},
+				apiUrl: account.apiUrl,
+				createdAt: account.createdAt,
+				lastUsed: account.lastUsedAt
+			}
 		};
-		if (state.claimEmail !== void 0) data.claimEmail = state.claimEmail;
-		if (state.credentialExpires !== void 0) data.credentialExpires = state.credentialExpires;
-		if (state.claimTokenExpires !== void 0) data.claimTokenExpires = state.claimTokenExpires;
-		if (state.apiUrl !== void 0) data.claimApiUrl = state.apiUrl;
-		return data;
 	}
 	async getApiKey() {
-		const encrypted = this.config.get("apiKey");
-		if (!encrypted) return null;
-		this.config.set("lastUsed", (/* @__PURE__ */ new Date()).toISOString());
-		return this.decrypt(encrypted);
+		return (await this.getCredentials())?.apiKey ?? null;
 	}
 	async getCredentials() {
-		const stored = this.config.store;
-		if (!stored.apiKey) return null;
-		return {
-			...stored,
-			apiKey: this.decrypt(stored.apiKey)
+		return (await loadEffectiveContext()).credentials;
+	}
+	async hasCredentials() {
+		return await this.getCredentials() !== null;
+	}
+	/**
+	* Store a login for the credential's organization, replacing any earlier login for the same
+	* (API URL, org). Passing claimState stores the pre-claim credential and its claim token
+	* together; storing without it ends any in-flight claim ceremony for that login.
+	*/
+	async saveCredentials(credentials, claimState, options = {}) {
+		const context = await loadEffectiveContext();
+		const input = {
+			apiKey: credentials.apiKey,
+			userId: credentials.userId,
+			orgId: credentials.orgId ?? null,
+			apiUrl: credentials.apiUrl ?? context.apiUrl
 		};
+		const hasDefault = await this.accounts.getDefault() !== null;
+		const makeDefault = options.makeDefault ?? (!context.projectLink || !hasDefault);
+		const claim = claimState ? {
+			...claimState,
+			accountId: void 0
+		} : void 0;
+		const account = await this.accounts.save(input, {
+			claim,
+			makeDefault
+		});
+		resetEffectiveContext();
+		return account;
 	}
+	/** Remove the active login (logout); other stored logins are untouched. */
 	async clearCredentials() {
-		this.config.clear();
+		const active = (await loadEffectiveContext()).account;
+		if (!active) return null;
+		await this.accounts.remove(active.id);
+		resetEffectiveContext();
+		return active;
+	}
+	/** Pending claim on the active login, else the most recent login with one. */
+	async getClaimState() {
+		const account = await this.pendingClaimAccount();
+		if (!account?.claim) return null;
+		const claimToken = await this.accounts.getClaimToken(account);
+		if (!claimToken) return null;
+		return {
+			...account.claim,
+			claimToken,
+			accountId: account.id
+		};
 	}
 	/**
 	* Persist agent-auth claim ceremony state alongside the pre-claim credential.
@@ -26606,54 +26761,129 @@ var CredentialStore = class {
 	* The claim token is encrypted like the API key since it can mint the post-claim credential.
 	*/
 	async saveClaimState(state) {
-		this.config.set(this.claimStateToConfig(state));
-	}
-	async getClaimState() {
-		const claimToken = this.config.get("claimToken");
-		const registrationId = this.config.get("registrationId");
-		if (!claimToken || !registrationId) return null;
-		return {
-			claimToken: this.decrypt(claimToken),
-			registrationId,
-			claimEmail: this.config.get("claimEmail"),
-			credentialExpires: this.config.get("credentialExpires"),
-			claimTokenExpires: this.config.get("claimTokenExpires"),
-			apiUrl: this.config.get("claimApiUrl")
-		};
+		const { accountId, ...claim } = state;
+		const targetId = accountId ?? (await this.pendingClaimAccount())?.id ?? (await loadEffectiveContext()).account?.id;
+		if (!targetId) throw new Error("No stored login to attach the claim to.");
+		await this.accounts.setClaim(targetId, claim);
+		resetEffectiveContext();
 	}
 	async clearClaimState() {
-		const store = { ...this.config.store };
-		delete store.claimToken;
-		delete store.registrationId;
-		delete store.claimEmail;
-		delete store.credentialExpires;
-		delete store.claimTokenExpires;
-		delete store.claimApiUrl;
-		this.replaceStore(store);
+		const account = await this.pendingClaimAccount();
+		if (!account) return;
+		await this.accounts.setClaim(account.id, null);
+		resetEffectiveContext();
 	}
-	async hasCredentials() {
-		return !!this.config.get("apiKey");
-	}
-	encrypt(text) {
-		const algorithm = "aes-256-cbc";
-		const key = Buffer.from(this.encryptionKey);
-		const iv = crypto$1.randomBytes(16);
-		const cipher = crypto$1.createCipheriv(algorithm, key, iv);
-		let encrypted = cipher.update(text, "utf8", "hex");
-		encrypted += cipher.final("hex");
-		return iv.toString("hex") + ":" + encrypted;
-	}
-	decrypt(text) {
-		const algorithm = "aes-256-cbc";
-		const key = Buffer.from(this.encryptionKey);
-		const [ivHex, encrypted] = text.split(":");
-		const iv = Buffer.from(ivHex, "hex");
-		const decipher = crypto$1.createDecipheriv(algorithm, key, iv);
-		let decrypted = decipher.update(encrypted, "hex", "utf8");
-		decrypted += decipher.final("utf8");
-		return decrypted;
+	async listAccounts() {
+		return this.accounts.list();
+	}
+	async getDefaultAccount() {
+		return this.accounts.getDefault();
+	}
+	async setDefaultAccount(id) {
+		await this.accounts.setDefault(id);
+		resetEffectiveContext();
+	}
+	async removeAccount(id) {
+		const removed = await this.accounts.remove(id);
+		resetEffectiveContext();
+		return removed;
+	}
+	async pendingClaimAccount() {
+		const active = (await loadEffectiveContext()).account;
+		if (active?.claim) return active;
+		return (await this.accounts.list()).filter((account) => account.claim).sort((a, b) => b.createdAt.localeCompare(a.createdAt))[0] ?? null;
+	}
+};
+//#endregion
+//#region src/config/project-link.ts
+const PROJECT_LINK_DIR = ".runtype";
+const PROJECT_LINK_FILENAME = "project.json";
+var ProjectLinkError = class extends Error {
+	path;
+	constructor(message, path) {
+		super(message);
+		this.path = path;
+		this.name = "ProjectLinkError";
 	}
 };
+const FIRST_PARTY_API_HOST_SUFFIXES = [
+	".runtype.com",
+	".runtype-staging.com",
+	".runtype-preview.com",
+	".runtype.workers.dev"
+];
+/** A committed link may only pin HTTPS Runtype-operated hosts; local or other APIs need --api-url. */
+function isFirstPartyApiUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	const hostname = url.hostname.toLowerCase();
+	return url.protocol === "https:" && (hostname === "runtype.com" || FIRST_PARTY_API_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix)));
+}
+function projectLinkPath(directory) {
+	return path.join(directory, PROJECT_LINK_DIR, PROJECT_LINK_FILENAME);
+}
+function parseProjectLink(raw, filePath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new ProjectLinkError(`${filePath} is not valid JSON.`, filePath);
+	}
+	const record = parsed && typeof parsed === "object" ? parsed : {};
+	if (typeof record.orgId !== "string" || record.orgId.trim() === "") throw new ProjectLinkError(`${filePath} must contain a non-empty "orgId" string.`, filePath);
+	if (record.apiUrl !== void 0 && typeof record.apiUrl !== "string") throw new ProjectLinkError(`${filePath} has a non-string "apiUrl".`, filePath);
+	return {
+		orgId: record.orgId.trim(),
+		...typeof record.apiUrl === "string" && record.apiUrl ? { apiUrl: record.apiUrl } : {}
+	};
+}
+/** Walk up from `startDir` to the filesystem root and return the nearest link, if any. */
+function findProjectLink(startDir = process.cwd()) {
+	if (process.env.RUNTYPE_IGNORE_PROJECT_LINK === "1") return null;
+	let directory = path.resolve(startDir);
+	for (;;) {
+		const filePath = projectLinkPath(directory);
+		let raw = null;
+		try {
+			raw = fs.readFileSync(filePath, "utf8");
+		} catch {
+			raw = null;
+		}
+		if (raw !== null) return {
+			...parseProjectLink(raw, filePath),
+			path: filePath,
+			root: directory
+		};
+		const parent = path.dirname(directory);
+		if (parent === directory) return null;
+		directory = parent;
+	}
+}
+function writeProjectLink(directory, link) {
+	const filePath = projectLinkPath(directory);
+	fs.mkdirSync(path.dirname(filePath), { recursive: true });
+	const content = {
+		orgId: link.orgId,
+		...link.apiUrl ? { apiUrl: link.apiUrl } : {}
+	};
+	fs.writeFileSync(filePath, `${JSON.stringify(content, null, 2)}\n`);
+	return filePath;
+}
+/** Remove `project.json`, and the `.runtype/` folder only when nothing else lives in it. */
+function removeProjectLink(directory) {
+	const filePath = projectLinkPath(directory);
+	if (!fs.existsSync(filePath)) return false;
+	fs.rmSync(filePath);
+	const folder = path.dirname(filePath);
+	try {
+		if (fs.readdirSync(folder).length === 0) fs.rmdirSync(folder);
+	} catch {}
+	return true;
+}
 //#endregion
 //#region src/config/effective-context.ts
 var CliContextError = class extends Error {
@@ -26674,11 +26904,15 @@ function getCliConfig() {
 		projectName: "runtype-cli",
 		projectSuffix: "",
 		configName: "config",
-		cwd: path$1.join(os.homedir(), ".runtype")
+		cwd: getRuntypeHomeDir()
 	});
 }
 function setInvocationOptions(options) {
 	invocationOptions = options;
+	resetEffectiveContext();
+}
+/** Drop the memoized context so the next read sees logins saved or removed in this process. */
+function resetEffectiveContext() {
 	effectiveContext = void 0;
 	identityCheck = void 0;
 	verifiedIdentity = void 0;
@@ -26697,11 +26931,12 @@ function normalizeApiUrl(value) {
 	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new CliContextError("API URL must use HTTP(S) without credentials, query, or fragment.");
 	return url.toString().replace(/\/+$/, "");
 }
-/** API target precedence: explicit flag > environment > saved config > credential endpoint > production. */
+/** API target precedence: flag > environment > project link > saved config > credential endpoint > production. */
 function resolveApiTarget(values) {
 	const [apiUrlSource, value] = [
 		["flag", values.flag],
 		["environment", values.environment],
+		["project", values.project],
 		["config", values.config],
 		["credential", values.credential],
 		["default", "https://api.runtype.com"]
@@ -26711,36 +26946,83 @@ function resolveApiTarget(values) {
 		apiUrlSource
 	};
 }
-function resolveTarget(apiUrl, credentials) {
-	if (apiUrl && invocationOptions.apiUrl && normalizeApiUrl(apiUrl) !== normalizeApiUrl(invocationOptions.apiUrl)) throw new CliContextError("Conflicting explicit --api-url values; choose one API target.");
-	return resolveApiTarget({
-		flag: apiUrl || invocationOptions.apiUrl,
-		environment: process.env.RUNTYPE_API_URL,
-		config: getCliConfig().get("apiUrl"),
-		credential: credentials?.apiUrl
-	});
+function readProjectLink() {
+	try {
+		return findProjectLink();
+	} catch (error) {
+		if (error instanceof ProjectLinkError) throw new CliContextError(error.message);
+		throw error;
+	}
+}
+function requestedOrganization(link) {
+	if (invocationOptions.org) return {
+		orgId: invocationOptions.org,
+		source: "flag"
+	};
+	const environmentOrg = process.env.RUNTYPE_ORG?.trim();
+	if (environmentOrg) return {
+		orgId: environmentOrg,
+		source: "environment"
+	};
+	if (link) return {
+		orgId: link.orgId,
+		source: "project"
+	};
+	return { source: "default" };
+}
+/**
+* Every invocation-scoped API target source, in precedence order. A project link's apiUrl only
+* counts when no flag or environment value outranks it, and must name a Runtype-operated host:
+* the file is committed, so an arbitrary host would receive credentials from anyone running here.
+*/
+function explicitApiTarget(flag) {
+	const projectLink = readProjectLink();
+	const environment = process.env.RUNTYPE_API_URL;
+	const project = projectLink?.apiUrl;
+	if (projectLink && project && !flag && !environment && !isFirstPartyApiUrl(project)) throw new CliContextError(`${projectLink.path} pins apiUrl ${project}, which is not a Runtype API host. Pass --api-url or set RUNTYPE_API_URL to use it deliberately.`);
+	return {
+		projectLink,
+		target: {
+			flag,
+			environment,
+			project,
+			config: getCliConfig().get("apiUrl")
+		}
+	};
+}
+async function buildContext(apiUrlOverride) {
+	if (apiUrlOverride && invocationOptions.apiUrl && normalizeApiUrl(apiUrlOverride) !== normalizeApiUrl(invocationOptions.apiUrl)) throw new CliContextError("Conflicting explicit --api-url values; choose one API target.");
+	const { projectLink, target: explicitTarget } = explicitApiTarget(apiUrlOverride || invocationOptions.apiUrl);
+	const explicitApiUrl = Object.values(explicitTarget).some(Boolean) ? resolveApiTarget(explicitTarget).apiUrl : void 0;
+	const { orgId: requestedOrgId, source: accountSource } = requestedOrganization(projectLink);
+	const envKey = process.env.RUNTYPE_API_KEY;
+	const login = await new CredentialStore().resolveCredentials({
+		orgId: requestedOrgId,
+		apiUrl: explicitApiUrl
+	});
+	const credentials = login?.credentials ?? null;
+	return {
+		...resolveApiTarget({
+			...explicitTarget,
+			credential: login?.account.apiUrl
+		}),
+		credentials,
+		account: login?.account ?? null,
+		...login?.readError ? { credentialError: login.readError } : {},
+		apiKey: envKey || credentials?.apiKey,
+		credentialSource: envKey ? "environment" : credentials ? "stored" : "none",
+		...requestedOrgId ? { requestedOrgId } : {},
+		accountSource,
+		projectLink
+	};
 }
 function getEffectiveApiUrl() {
-	return effectiveContext?.apiUrl ?? resolveTarget().apiUrl;
+	return effectiveContext?.apiUrl ?? resolveApiTarget(explicitApiTarget(invocationOptions.apiUrl).target).apiUrl;
 }
 async function loadEffectiveContext(apiUrl) {
-	if (!effectiveContext) {
-		const credentials = await new CredentialStore().getCredentials();
-		const envKey = process.env.RUNTYPE_API_KEY;
-		effectiveContext = {
-			...resolveTarget(apiUrl, credentials),
-			credentials,
-			apiKey: envKey || credentials?.apiKey,
-			credentialSource: envKey ? "environment" : credentials?.apiKey ? "stored" : "none"
-		};
-	} else if (apiUrl) {
-		const target = resolveTarget(apiUrl, effectiveContext.credentials);
-		if (target.apiUrl !== effectiveContext.apiUrl) effectiveContext = {
-			...effectiveContext,
-			...target
-		};
-		else effectiveContext.apiUrlSource = target.apiUrlSource;
-	}
+	if (!effectiveContext) effectiveContext = await buildContext(apiUrl);
+	else if (apiUrl && normalizeApiUrl(apiUrl) !== effectiveContext.apiUrl) effectiveContext = await buildContext(apiUrl);
+	else if (apiUrl) effectiveContext.apiUrlSource = "flag";
 	return effectiveContext;
 }
 function useStoredCredential(context) {
@@ -26781,7 +27063,11 @@ function redactEffectiveContext(context) {
 		apiUrlSource: context.apiUrlSource,
 		credentialSource: context.credentialSource,
 		orgId: storedOrgApplies ? context.credentials?.orgId ?? null : null,
-		orgVerified: false
+		orgVerified: false,
+		accountSource: context.accountSource,
+		requestedOrgId: context.requestedOrgId ?? null,
+		credentialStore: context.credentialSource === "stored" ? context.account?.secretStore ?? null : null,
+		projectLink: context.projectLink?.path ?? null
 	};
 }
 //#endregion
@@ -26943,6 +27229,437 @@ var ApiKeyManager = class {
 	}
 };
 //#endregion
+//#region src/auth/callback-server.ts
+var CallbackServer = class {
+	server = null;
+	app;
+	codeResolve;
+	codeReject;
+	codePromise;
+	expectedState;
+	constructor() {
+		this.app = express();
+		this.codePromise = new Promise((resolve, reject) => {
+			this.codeResolve = resolve;
+			this.codeReject = reject;
+		});
+		this.app.get("/callback", (req, res) => {
+			const { token, code, state, error } = req.query;
+			if (typeof state !== "string" || state !== this.expectedState) {
+				res.status(400).send(this.errorHTML("Invalid authentication state. Continue the login you started in the CLI."));
+				return;
+			}
+			const values = [
+				token,
+				code,
+				error
+			].filter((value) => value !== void 0);
+			if (values.length !== 1 || typeof values[0] !== "string" || values[0].length === 0) {
+				res.status(400).send(this.errorHTML("Invalid authentication callback"));
+				return;
+			}
+			if (typeof error === "string") {
+				res.send(this.errorHTML(error));
+				this.codeReject(new Error(error));
+				setTimeout(() => this.stop(), 1e3);
+				return;
+			}
+			res.send(this.successHTML());
+			this.codeResolve(values[0]);
+			setTimeout(() => this.stop(), 1e3);
+		});
+		this.app.get("/health", (_req, res) => {
+			res.json({ status: "ok" });
+		});
+	}
+	/** Set expected state parameter for OAuth2 CSRF validation */
+	setExpectedState(state) {
+		if (!state) throw new Error("Authentication requires a nonempty expected state");
+		if (this.server) throw new Error("Expected state must be registered before listening");
+		this.expectedState = state;
+	}
+	async start(port = 8765) {
+		if (!this.expectedState) throw new Error("Authentication requires an expected state before listening");
+		return new Promise((resolveStart, rejectStart) => {
+			this.server = this.app.listen(port, "127.0.0.1", () => {
+				const address = this.server?.address();
+				const actualPort = address && typeof address === "object" && "port" in address ? address.port : port;
+				console.log(`Callback server listening on port ${actualPort}`);
+				resolveStart({
+					actualPort,
+					codePromise: this.codePromise
+				});
+			});
+			this.server.on("error", (error) => {
+				if (error.code === "EADDRINUSE") {
+					console.log(`Port ${port} is in use, trying ${port + 1}...`);
+					this.server = null;
+					this.start(port + 1).then(resolveStart).catch(rejectStart);
+				} else rejectStart(error);
+			});
+		});
+	}
+	stop() {
+		if (this.server) {
+			const s = this.server;
+			this.server = null;
+			s.unref();
+			if (typeof s.closeAllConnections === "function") s.closeAllConnections();
+			s.close();
+		}
+	}
+	successHTML() {
+		return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Authentication Successful</title>
+  <style>
+    * { margin: 0; padding: 0; box-sizing: border-box; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      height: 100vh;
+      overflow: hidden;
+      background: #0a0a0a;
+    }
+    .grid-bg {
+      position: absolute;
+      inset: 0;
+      z-index: 0;
+      overflow: hidden;
+    }
+    .grid-bg .gradient {
+      position: absolute;
+      inset: 0;
+      background: linear-gradient(to bottom, #0a0a0a 0%, #171717 50%, #262626 100%);
+    }
+    @keyframes gridMove {
+      0% { background-position-y: 0; }
+      100% { background-position-y: 30px; }
+    }
+    .grid-bg .grid-vertical-wrap {
+      position: absolute;
+      left: 0;
+      right: 0;
+      bottom: 0;
+      top: 40%;
+      transform-origin: top center;
+      transform: perspective(500px) rotateX(60deg);
+    }
+    .grid-bg .grid-vertical-wrap .fade {
+      position: absolute;
+      inset: 0;
+      background: linear-gradient(to bottom, transparent 0%, rgba(255,255,255,0.02) 100%);
+    }
+    .grid-bg .grid-vertical-wrap .lines {
+      position: absolute;
+      inset: 0;
+      background-image: repeating-linear-gradient(
+        90deg,
+        transparent 0,
+        transparent 49px,
+        rgba(255,255,255,0.08) 49px,
+        rgba(255,255,255,0.08) 50px
+      );
+      background-size: 50px 100%;
+    }
+    .grid-bg .grid-horizontal {
+      position: absolute;
+      left: 0;
+      right: 0;
+      bottom: 0;
+      top: 40%;
+      transform-origin: top center;
+      transform: perspective(500px) rotateX(60deg);
+      background-image: repeating-linear-gradient(
+        0deg,
+        transparent 0,
+        transparent 29px,
+        rgba(255,255,255,0.06) 29px,
+        rgba(255,255,255,0.06) 30px
+      );
+      background-size: 100% 30px;
+      animation: gridMove 2s linear infinite;
+    }
+    .card-wrap {
+      position: absolute;
+      left: 50%;
+      top: 50%;
+      transform: translate(-50%, -50%);
+      z-index: 10;
+      width: 100%;
+      max-width: 400px;
+      perspective: 1400px;
+      animation: cardIn 0.4s ease-out;
+    }
+    @keyframes cardIn {
+      from { opacity: 0; transform: translate(-50%, -50%) translateY(16px); }
+      to { opacity: 1; transform: translate(-50%, -50%) translateY(0); }
+    }
+    .card-inner {
+      position: relative;
+    }
+    .card-layer-back,
+    .card-layer-mid {
+      position: absolute;
+      inset: 0;
+      border-radius: 12px;
+      border: 1px solid #e5e7eb;
+      pointer-events: none;
+    }
+    .card-layer-back {
+      background: rgba(0, 0, 0, 0.08);
+      transform: translate3d(0, -18px, -36px) rotateX(6deg);
+    }
+    .card-layer-mid {
+      background: rgba(0, 0, 0, 0.05);
+      transform: translate3d(0, -10px, -20px) rotateX(3deg);
+    }
+    .card-front {
+      position: relative;
+      border-radius: 12px;
+      border: 1px solid rgba(255, 255, 255, 1);
+      background: rgba(0, 0, 0, .5);
+      backdrop-filter: blur(10px);
+      -webkit-backdrop-filter: blur(10px);
+      padding: 2rem 2.5rem;
+      text-align: center;
+      box-shadow: 0 1px 3px rgba(0, 0, 0, 0.2);
+      transform: rotateX(-10deg) translateZ(0);
+      transform-style: preserve-3d;
+    }
+    .card-front .section-title {
+      color: #ffffff;
+      font-size: 0.8125rem;
+      font-weight: 600;
+      letter-spacing: 0.05em;
+      text-transform: uppercase;
+      margin-bottom: 1rem;
+    }
+    .card-front .flow-arrow {
+      color: rgba(255, 255, 255, 0.7);
+      font-size: 1rem;
+      margin-bottom: 1rem;
+      line-height: 1;
+    }
+    .card-front .message {
+      color: #ffffff;
+      font-size: 0.75rem;
+      font-weight: 100;
+      margin-bottom: 0.5rem;
+      font-family: monospace;
+    }
+    .card-front .progress {
+      color: rgba(255, 255, 255, 0.75);
+      font-size: 0.8125rem;
+    }
+  </style>
+</head>
+<body>
+  <div class="grid-bg">
+    <div class="gradient"></div>
+    <div class="grid-vertical-wrap">
+      <div class="fade"></div>
+      <div class="lines"></div>
+    </div>
+    <div class="grid-horizontal"></div>
+  </div>
+  <div id="card-wrap" class="card-wrap">
+    <div class="card-inner">
+      <div class="card-layer-back" aria-hidden="true"></div>
+      <div class="card-layer-mid" aria-hidden="true"></div>
+      <div id="card" class="card-front">
+        <div class="section-title">Authentication Successful</div>
+        <div class="flow-arrow" aria-hidden="true">↓</div>
+        <p class="message">You can close this window and return to your terminal.</p>
+        <p class="progress" id="progress">Closing automatically in 3 seconds…</p>
+      </div>
+    </div>
+  </div>
+  <script>
+    setTimeout(function() {
+      window.close();
+      var prog = document.getElementById('progress');
+      if (prog) prog.textContent = 'You can now close this window.';
+      var card = document.getElementById('card');
+      if (card) card.innerHTML = '<div class="section-title">Runtype is Ready</div><p class="message">You can now close this window</p>';
+    }, 3000);
+  <\/script>
+</body>
+</html>`;
+	}
+	escapeHtml(str) {
+		return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+	}
+	errorHTML(error) {
+		return `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <title>Authentication Failed</title>
+          <style>
+            * {
+              margin: 0;
+              padding: 0;
+              box-sizing: border-box;
+            }
+            body { 
+              font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
+              display: flex; 
+              align-items: center; 
+              justify-content: center; 
+              height: 100vh;
+              background: linear-gradient(135deg, #ef4444 0%, #dc2626 100%);
+            }
+            .container {
+              background: white;
+              padding: 3rem;
+              border-radius: 12px;
+              text-align: center;
+              box-shadow: 0 20px 40px rgba(0,0,0,0.1);
+              max-width: 400px;
+            }
+            .error-icon { 
+              color: #ef4444; 
+              font-size: 64px;
+              margin-bottom: 1rem;
+            }
+            h1 {
+              color: #1f2937;
+              margin-bottom: 0.5rem;
+              font-size: 1.5rem;
+            }
+            p {
+              color: #6b7280;
+              font-size: 1rem;
+              margin-bottom: 1rem;
+            }
+            .error-details {
+              background: #fef2f2;
+              color: #991b1b;
+              padding: 0.75rem;
+              border-radius: 6px;
+              font-size: 0.875rem;
+              font-family: monospace;
+            }
+          </style>
+        </head>
+        <body>
+          <div class="container">
+            <div class="error-icon">✕</div>
+            <h1>Authentication Failed</h1>
+            <p>There was an error during authentication.</p>
+            <div class="error-details">${this.escapeHtml(error)}</div>
+          </div>
+        </body>
+      </html>
+    `;
+	}
+};
+//#endregion
+//#region src/auth/oauth-manager.ts
+var OAuthManager = class {
+	clerkPublishableKey;
+	dashboardUrl;
+	constructor(config) {
+		this.clerkPublishableKey = config.clerkPublishableKey;
+		this.dashboardUrl = config.dashboardUrl;
+	}
+	/** `orgId` preselects that organization on the dashboard's account picker; the user can still choose another. */
+	async authenticate(mode, options = {}) {
+		const state = crypto$2.randomBytes(32).toString("base64url");
+		const codeVerifier = crypto$2.randomBytes(32).toString("base64url");
+		const codeChallenge = crypto$2.createHash("sha256").update(codeVerifier).digest("base64url");
+		const callbackServer = new CallbackServer();
+		callbackServer.setExpectedState(state);
+		const requestedPort = await this.findAvailablePort();
+		const { actualPort, codePromise } = await callbackServer.start(requestedPort);
+		const redirectUri = `http://127.0.0.1:${actualPort}/callback`;
+		const authUrl = new URL(`${this.dashboardUrl.replace(/\/$/, "")}/${mode}`);
+		authUrl.searchParams.set("redirect_uri", redirectUri);
+		authUrl.searchParams.set("cli", "true");
+		authUrl.searchParams.set("state", state);
+		authUrl.searchParams.set("code_challenge", codeChallenge);
+		authUrl.searchParams.set("code_challenge_method", "S256");
+		authUrl.searchParams.set("publishable_key", this.clerkPublishableKey);
+		if (options.orgId) authUrl.searchParams.set("org", options.orgId);
+		console.log("🌐 Opening browser for authentication...");
+		console.log(`If the browser doesn't open, visit: ${authUrl}`);
+		try {
+			console.log("⏳ Waiting for authentication...");
+			const [code] = await Promise.all([codePromise, open(authUrl.toString()).catch(() => {
+				console.log("Failed to open browser automatically. Please visit the URL above.");
+			})]);
+			return await this.exchangeCodeForSession(code, codeVerifier, redirectUri);
+		} finally {
+			callbackServer.stop();
+		}
+	}
+	async findAvailablePort() {
+		return 8765;
+	}
+	async exchangeCodeForSession(code, codeVerifier, redirectUri) {
+		return code;
+	}
+};
+//#endregion
+//#region src/auth/login-flow.ts
+var InvalidApiKeyError = class extends Error {
+	constructor() {
+		super("Invalid API key");
+		this.name = "InvalidApiKeyError";
+	}
+};
+async function storeLogin(credentials) {
+	const context = await loadEffectiveContext(credentials.apiUrl);
+	const store = new CredentialStore();
+	const account = await store.saveCredentials(credentials);
+	const isDefault = (await store.getDefaultAccount())?.id === account.id;
+	return {
+		...credentials,
+		account,
+		isDefault,
+		...context.requestedOrgId ? { requestedOrgId: context.requestedOrgId } : {}
+	};
+}
+/** Browser (Clerk) login: mint an org-owned CLI key for the organization the user authorizes. */
+async function browserLogin(options = {}) {
+	const context = await loadEffectiveContext(options.apiUrl);
+	const oauth = new OAuthManager({
+		clerkPublishableKey: getClerkPublishableKey(),
+		dashboardUrl: options.dashboardUrl || getDashboardUrl()
+	});
+	options.onProgress?.("Waiting for browser authentication...");
+	const sessionToken = await oauth.authenticate("sign-in", { orgId: context.requestedOrgId });
+	options.onProgress?.("Creating API key...");
+	const { key, userId, orgId } = await new ApiKeyManager().exchangeSessionForApiKey(sessionToken, context.apiUrl);
+	options.onProgress?.("Storing credentials securely...");
+	return storeLogin({
+		apiKey: key,
+		userId,
+		orgId,
+		apiUrl: context.apiUrl
+	});
+}
+/** Store an existing API key as a login for whichever organization owns it. */
+async function apiKeyLogin(apiKey, options = {}) {
+	const context = await loadEffectiveContext(options.apiUrl);
+	const manager = new ApiKeyManager();
+	if (!await manager.validateApiKey(apiKey, context.apiUrl)) throw new InvalidApiKeyError();
+	const user = await manager.getCurrentUser(apiKey, context.apiUrl);
+	return storeLogin({
+		apiKey,
+		userId: user.userId,
+		orgId: user.orgId ?? void 0,
+		apiUrl: context.apiUrl
+	});
+}
+/** Non-null when the user authorized a different organization than the one this directory targets. */
+function orgMismatchWarning(login) {
+	if (!login.requestedOrgId || login.requestedOrgId === login.orgId) return null;
+	return `Logged in to ${login.orgId ?? "a personal account"}, but this invocation targets ${login.requestedOrgId}. Commands here will keep asking for a login to ${login.requestedOrgId}; run "runtype login" again and pick that organization, or update the link with "runtype link ${login.orgId ?? ""}".`;
+}
+//#endregion
 //#region src/lib/ensure-auth.ts
 const verifiedUsers = /* @__PURE__ */ new WeakMap();
 async function getAuthenticatedUser() {
@@ -27011,7 +27728,7 @@ async function ensureAuth(options) {
 	}
 	if (options?.interactive === false || process.stdin.isTTY !== true || invocation.noInput || strictIdentity) {
 		if (options?.exitOnFailure === false) return null;
-		const message = "Authentication required. Run \"runtype auth login\" first or set RUNTYPE_API_KEY.";
+		const message = authRequiredMessage(context);
 		console.error(invocation.json ? JSON.stringify({
 			success: false,
 			error: {
@@ -27022,39 +27739,39 @@ async function ensureAuth(options) {
 		process.exit(1);
 		return null;
 	}
-	console.log(chalk.yellow("\nAuthentication required."));
+	console.log(chalk.yellow(`\n${authRequiredMessage(context)}`));
 	if (!await promptConfirm$2("Would you like to log in now?", { default: true })) {
 		console.log(chalk.gray("Run \"runtype auth login\" when you're ready."));
 		if (options?.exitOnFailure !== false) process.exit(1);
 		return null;
 	}
-	const apiKey = await handleBrowserLogin(new CredentialStore(), context.apiUrl);
+	const apiKey = await handleBrowserLogin(context.apiUrl);
 	if (apiKey) {
 		context.apiKey = apiKey;
 		context.credentialSource = "stored";
 	}
 	return apiKey;
 }
-async function handleBrowserLogin(store, apiUrl) {
+/** Name the organization the invocation needs, so a linked project never reads as "logged out". */
+function authRequiredMessage(context) {
+	if (context.credentialError && context.account) return `The stored login for ${context.account.orgId ?? "your personal account"} could not be read (${context.credentialError}). Log in again with "runtype login" (or set RUNTYPE_CREDENTIAL_STORE=file first if the OS keychain is unavailable here), or set RUNTYPE_API_KEY.`;
+	if (context.requestedOrgId) return `${context.accountSource === "project" && context.projectLink ? `This directory is linked to ${context.requestedOrgId} (${context.projectLink.path})` : `This command targets ${context.requestedOrgId}`}, but there is no stored login for it on ${context.apiUrl}. Run "runtype login" and authorize that organization, or set RUNTYPE_API_KEY.`;
+	return "Authentication required. Run \"runtype auth login\" first or set RUNTYPE_API_KEY.";
+}
+async function handleBrowserLogin(apiUrl) {
 	console.log(chalk.gray("Opening browser for authentication..."));
 	try {
-		const oauth = new OAuthManager({
-			clerkPublishableKey: getClerkPublishableKey(),
-			dashboardUrl: getDashboardUrl()
-		});
-		console.log(chalk.gray("Waiting for browser authentication..."));
-		const sessionToken = await oauth.authenticate("sign-in");
-		console.log(chalk.gray("Getting API key..."));
-		const { key, userId, orgId } = await new ApiKeyManager().exchangeSessionForApiKey(sessionToken, apiUrl || getApiUrl());
-		console.log(chalk.gray("Storing credentials..."));
-		await store.saveCredentials({
-			apiKey: key,
-			userId,
-			orgId,
-			apiUrl: apiUrl || getApiUrl()
+		const login = await browserLogin({
+			apiUrl,
+			onProgress: (label) => console.log(chalk.gray(label))
 		});
+		const warning = orgMismatchWarning(login);
+		if (warning) {
+			console.log(chalk.yellow(warning));
+			return null;
+		}
 		console.log(chalk.green("Logged in successfully!"));
-		return key;
+		return login.apiKey;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
 		console.log(chalk.red("Login failed"));
@@ -27285,6 +28002,25 @@ function MutationResult({ loading, loadingLabel = "Processing...", success, succ
 	return null;
 }
 //#endregion
+//#region src/ink/shared/account-picker.ts
+/** Interactive picker over stored logins; resolves undefined if the user exits without choosing. */
+async function promptForAccount(accounts) {
+	let chosen;
+	const { waitUntilExit, unmount } = render(React.createElement(SelectInput, {
+		items: accounts.map((account) => ({
+			key: account.id,
+			label: `${account.orgId ?? "Personal"}  ${account.apiUrl}`,
+			value: account.id
+		})),
+		onSelect: (item) => {
+			chosen = accounts.find((account) => account.id === item.value);
+			unmount();
+		}
+	}));
+	await waitUntilExit();
+	return chosen;
+}
+//#endregion
 //#region src/auth/agent-auth-client.ts
 /**
 * Protocol error with the spec error code and an agent-actionable hint.
@@ -27539,7 +28275,7 @@ async function registerAction(options) {
 		claimTokenExpires: registration.claimTokenExpires,
 		apiUrl
 	};
-	await store.saveCredentials({
+	const registered = await store.saveCredentials({
 		apiKey: registration.credential,
 		userId: identity.userId,
 		orgId: identity.orgId,
@@ -27557,7 +28293,8 @@ async function registerAction(options) {
 		const claim = await initiateClaim(registration.claimToken, options.email, apiUrl);
 		await store.saveClaimState({
 			...claimState,
-			claimEmail: options.email
+			claimEmail: options.email,
+			accountId: registered.id
 		});
 		printJson({
 			...base,
@@ -27638,13 +28375,15 @@ async function verifyAction(code, options) {
 	try {
 		identity = await fetchIdentity(completed.credential, apiUrl);
 	} catch {}
-	await store.saveCredentials({
+	const preClaimAccountId = claimState.accountId;
+	const wasDefault = (await store.getDefaultAccount())?.id === preClaimAccountId;
+	const saved = await store.saveCredentials({
 		apiKey: completed.credential,
 		userId: identity.userId,
 		orgId: identity.orgId,
 		apiUrl
-	});
-	await store.clearClaimState();
+	}, void 0, { makeDefault: wasDefault });
+	if (preClaimAccountId && preClaimAccountId !== saved.id) await store.removeAccount(preClaimAccountId);
 	printJson({
 		status: "authenticated",
 		accountState: "full",
@@ -27693,149 +28432,122 @@ async function getBillingInfo(apiKey, apiUrl) {
 		return null;
 	}
 }
-authCommand.command("signup").description("Create a new Runtype account (alias for \"auth login\")").option("--api-url <url>", "Custom API URL").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
-	await loadEffectiveContext(options.apiUrl);
-	refuseForcedTtyLogin(options);
-	if (!isTTY(options)) {
-		console.error(JSON.stringify(NON_TTY_LOGIN_GUIDANCE, null, 2));
-		process.exit(1);
-	}
+/** Run one async step under the shared spinner/result chrome. */
+async function renderTask(loadingLabel, task) {
 	const App = () => {
 		const [loading, setLoading] = useState(true);
-		const [loadingLabel, setLoadingLabel] = useState("Opening browser for authentication...");
+		const [label, setLabel] = useState(loadingLabel);
 		const [success, setSuccess] = useState(null);
 		const [error, setError] = useState(null);
+		const [outcome, setOutcome] = useState(null);
 		useEffect(() => {
-			const run = async () => {
-				try {
-					const oauth = new OAuthManager({
-						clerkPublishableKey: getClerkPublishableKey(),
-						dashboardUrl: getDashboardUrl()
-					});
-					setLoadingLabel("Waiting for browser authentication...");
-					const sessionToken = await oauth.authenticate("sign-in");
-					setLoadingLabel("Creating API key...");
-					const { key, userId, orgId } = await new ApiKeyManager().exchangeSessionForApiKey(sessionToken, options.apiUrl || getApiUrl());
-					setLoadingLabel("Storing credentials securely...");
-					await new CredentialStore().saveCredentials({
-						apiKey: key,
-						userId,
-						orgId,
-						apiUrl: options.apiUrl || getApiUrl()
-					});
-					setSuccess(true);
-					setLoading(false);
-				} catch (err) {
-					setError(err instanceof Error ? err : new Error(String(err)));
-					setSuccess(false);
-					setLoading(false);
-				}
-			};
-			run();
+			task(setLabel).then((value) => {
+				setOutcome(value);
+				setSuccess(true);
+			}).catch((err) => {
+				setError(err instanceof Error ? err : new Error(String(err)));
+				setSuccess(false);
+			}).finally(() => setLoading(false));
 		}, []);
 		return React.createElement(MutationResult, {
 			loading,
-			loadingLabel,
+			loadingLabel: label,
 			success,
-			successMessage: "Authentication successful! Welcome to Runtype!",
+			successMessage: outcome?.message ?? "",
 			error,
-			result: React.createElement(EntityCard, { fields: [{
-				label: "Next",
-				value: "runtype flows list"
-			}] })
+			result: outcome?.result
 		});
 	};
 	const { waitUntilExit } = render(React.createElement(App));
 	await waitUntilExit();
+}
+function loginFields(login) {
+	return [
+		{
+			label: "Organization",
+			value: login.orgId ?? "Personal"
+		},
+		{
+			label: "User ID",
+			value: login.userId
+		},
+		{
+			label: "API URL",
+			value: login.apiUrl
+		},
+		{
+			label: "Default login",
+			value: login.isDefault ? "yes" : "no (run: runtype auth switch)"
+		}
+	];
+}
+function loginJson(login) {
+	const warning = orgMismatchWarning(login);
+	return {
+		status: "authenticated",
+		userId: login.userId,
+		orgId: login.orgId ?? null,
+		apiUrl: login.apiUrl,
+		accountId: login.account.id,
+		isDefault: login.isDefault,
+		secretStore: login.account.secretStore,
+		...warning ? { warning } : {}
+	};
+}
+function loginOutcome(login) {
+	return {
+		message: orgMismatchWarning(login) ?? `Logged in to ${login.orgId ?? "your personal account"}.`,
+		result: React.createElement(EntityCard, { fields: loginFields(login) })
+	};
+}
+authCommand.command("signup").description("Create a new Runtype account (alias for \"auth login\")").option("--api-url <url>", "Custom API URL").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+	await loadEffectiveContext(options.apiUrl);
+	refuseForcedTtyLogin(options);
+	if (!isTTY(options)) {
+		console.error(JSON.stringify(NON_TTY_LOGIN_GUIDANCE, null, 2));
+		process.exit(1);
+	}
+	await renderTask("Opening browser for authentication...", async (setLabel) => loginOutcome(await browserLogin({
+		...options,
+		onProgress: setLabel
+	})));
 });
+function failApiKeyLogin(error) {
+	if (error instanceof ApiKeyValidationUnavailableError) {
+		console.error(JSON.stringify({
+			status: "error",
+			code: "api_unreachable",
+			error: error.message,
+			next: API_UNREACHABLE_NEXT
+		}, null, 2));
+		process.exit(1);
+	}
+	const message = error instanceof Error ? error.message : "Unknown error";
+	console.error(JSON.stringify({
+		status: "error",
+		error: message
+	}, null, 2));
+	process.exit(1);
+}
 async function loginAction(options) {
 	await loadEffectiveContext(options.apiUrl);
-	const store = new CredentialStore();
 	if (options.apiKey) {
+		const apiKey = options.apiKey;
 		if (!isTTY(options)) {
+			let login;
 			try {
-				const apiKeyManager = new ApiKeyManager();
-				if (!await apiKeyManager.validateApiKey(options.apiKey, options.apiUrl)) {
-					console.error(JSON.stringify({
-						status: "error",
-						error: "Invalid API key"
-					}, null, 2));
-					process.exit(1);
-				}
-				const userData = await apiKeyManager.getCurrentUser(options.apiKey, options.apiUrl);
-				await store.saveCredentials({
-					apiKey: options.apiKey,
-					userId: userData.userId,
-					orgId: userData.orgId ?? void 0,
-					apiUrl: options.apiUrl || getApiUrl()
-				});
-				console.log(JSON.stringify({
-					status: "authenticated",
-					userId: userData.userId,
-					next: "Continue with setup: runtype install-mcp (then confirm with: runtype auth whoami)"
-				}, null, 2));
+				login = await apiKeyLogin(apiKey, { apiUrl: options.apiUrl });
 			} catch (error) {
-				if (error instanceof ApiKeyValidationUnavailableError) {
-					console.error(JSON.stringify({
-						status: "error",
-						code: "api_unreachable",
-						error: error.message,
-						next: API_UNREACHABLE_NEXT
-					}, null, 2));
-					process.exit(1);
-				}
-				const message = error instanceof Error ? error.message : "Unknown error";
-				console.error(JSON.stringify({
-					status: "error",
-					error: message
-				}, null, 2));
-				process.exit(1);
+				failApiKeyLogin(error);
+				return;
 			}
+			console.log(JSON.stringify({
+				...loginJson(login),
+				next: "Continue with setup: runtype install-mcp (then confirm with: runtype auth whoami)"
+			}, null, 2));
 			return;
 		}
-		const App = () => {
-			const [loading, setLoading] = useState(true);
-			const [success, setSuccess] = useState(null);
-			const [error, setError] = useState(null);
-			const [userId, setUserId] = useState(null);
-			useEffect(() => {
-				const run = async () => {
-					try {
-						const apiKeyManager = new ApiKeyManager();
-						if (!await apiKeyManager.validateApiKey(options.apiKey, options.apiUrl)) {
-							setError(/* @__PURE__ */ new Error("Invalid API key"));
-							setSuccess(false);
-							setLoading(false);
-							return;
-						}
-						const userData = await apiKeyManager.getCurrentUser(options.apiKey, options.apiUrl);
-						await store.saveCredentials({
-							apiKey: options.apiKey,
-							userId: userData.userId,
-							orgId: userData.orgId ?? void 0,
-							apiUrl: options.apiUrl || getApiUrl()
-						});
-						setUserId(userData.userId);
-						setSuccess(true);
-						setLoading(false);
-					} catch (err) {
-						setError(err instanceof Error ? err : new Error(String(err)));
-						setSuccess(false);
-						setLoading(false);
-					}
-				};
-				run();
-			}, []);
-			return React.createElement(MutationResult, {
-				loading,
-				loadingLabel: "Validating API key...",
-				success,
-				successMessage: `Logged in successfully!${userId ? ` User ID: ${userId}` : ""}`,
-				error
-			});
-		};
-		const { waitUntilExit } = render(React.createElement(App));
-		await waitUntilExit();
+		await renderTask("Validating API key...", async () => loginOutcome(await apiKeyLogin(apiKey, { apiUrl: options.apiUrl })));
 		return;
 	}
 	refuseForcedTtyLogin(options);
@@ -27843,73 +28555,54 @@ async function loginAction(options) {
 		console.error(JSON.stringify(NON_TTY_LOGIN_GUIDANCE, null, 2));
 		process.exit(1);
 	}
-	const App = () => {
-		const [loading, setLoading] = useState(true);
-		const [loadingLabel, setLoadingLabel] = useState("Initializing authentication...");
-		const [success, setSuccess] = useState(null);
-		const [error, setError] = useState(null);
-		const [userId, setUserId] = useState(null);
-		useEffect(() => {
-			const run = async () => {
-				try {
-					const oauth = new OAuthManager({
-						clerkPublishableKey: getClerkPublishableKey(),
-						dashboardUrl: options.dashboardUrl || getDashboardUrl()
-					});
-					setLoadingLabel("Waiting for browser authentication...");
-					const sessionToken = await oauth.authenticate("sign-in");
-					setLoadingLabel("Getting API key...");
-					const { key, userId: uid, orgId } = await new ApiKeyManager().exchangeSessionForApiKey(sessionToken, options.apiUrl || getApiUrl());
-					setLoadingLabel("Storing credentials...");
-					await store.saveCredentials({
-						apiKey: key,
-						userId: uid,
-						orgId,
-						apiUrl: options.apiUrl || getApiUrl()
-					});
-					setUserId(uid);
-					setSuccess(true);
-					setLoading(false);
-				} catch (err) {
-					setError(err instanceof Error ? err : new Error(String(err)));
-					setSuccess(false);
-					setLoading(false);
-				}
-			};
-			run();
-		}, []);
-		return React.createElement(MutationResult, {
-			loading,
-			loadingLabel,
-			success,
-			successMessage: `Logged in successfully!${userId ? ` User ID: ${userId}` : ""}`,
-			error
-		});
-	};
-	const { waitUntilExit } = render(React.createElement(App));
-	await waitUntilExit();
+	await renderTask("Initializing authentication...", async (setLabel) => loginOutcome(await browserLogin({
+		...options,
+		onProgress: setLabel
+	})));
+}
+const LOGIN_DESCRIPTION = "Log in to an organization (adds a login; the target org comes from --org, RUNTYPE_ORG, or .runtype/project.json)";
+authCommand.command("login").description(LOGIN_DESCRIPTION).option("--api-url <url>", "Custom API URL").option("--api-key <key>", "Use API key directly").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(loginAction);
+const loginCommand = new Command("login").description(LOGIN_DESCRIPTION).option("--api-url <url>", "Custom API URL").option("--api-key <key>", "Use API key directly").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(loginAction);
+function describeAccountSource(context) {
+	switch (context.accountSource) {
+		case "flag": return "--org flag";
+		case "environment": return "RUNTYPE_ORG";
+		case "project": return context.projectLink ? `project link (${context.projectLink.path})` : "project link";
+		default: return "default login";
+	}
 }
-authCommand.command("login").description("Login to existing account").option("--api-url <url>", "Custom API URL").option("--api-key <key>", "Use API key directly").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(loginAction);
-const loginCommand = new Command("login").description("Log in to Runtype").option("--api-url <url>", "Custom API URL").option("--api-key <key>", "Use API key directly").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(loginAction);
-authCommand.command("status").description("Show authentication status").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+authCommand.command("status").description("Show which login this directory uses").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
 	const store = new CredentialStore();
 	if (!isTTY(options)) {
 		try {
-			if (!await store.hasCredentials()) {
+			const context = await loadEffectiveContext();
+			const storedLogins = (await store.listAccounts()).length;
+			const credentials = context.credentials;
+			if (!credentials) {
 				console.log(JSON.stringify({
 					status: "unauthenticated",
-					next: "New account: runtype auth register --email <email>. Existing account: runtype auth login --api-key <key>."
+					requestedOrgId: context.requestedOrgId ?? null,
+					accountSource: context.accountSource,
+					projectLink: context.projectLink?.path ?? null,
+					storedLogins,
+					next: context.requestedOrgId ? authRequiredMessage(context) : "New account: runtype auth register --email <email>. Existing account: runtype auth login --api-key <key>."
 				}, null, 2));
 				return;
 			}
-			const credentials = await store.getCredentials();
-			const claimState = await store.getClaimState();
+			const pendingClaim = await store.getClaimState();
+			const claimState = pendingClaim?.accountId === credentials.accountId ? pendingClaim : null;
 			console.log(JSON.stringify({
 				status: "authenticated",
 				accountState: claimState ? "temporary" : "full",
-				userId: credentials?.userId,
-				apiUrl: credentials?.apiUrl || "default",
-				orgId: credentials?.orgId || null,
+				userId: credentials.userId,
+				apiUrl: credentials.apiUrl,
+				orgId: credentials.orgId || null,
+				accountId: credentials.accountId,
+				accountSource: context.accountSource,
+				projectLink: context.projectLink?.path ?? null,
+				secretStore: context.account?.secretStore ?? null,
+				storedLogins,
+				...context.credentialSource === "environment" ? { note: "RUNTYPE_API_KEY is set and takes precedence over the stored login." } : {},
 				...claimState ? {
 					registrationId: claimState.registrationId,
 					credentialExpires: claimState.credentialExpires,
@@ -27926,74 +28619,158 @@ authCommand.command("status").description("Show authentication status").option("
 		}
 		return;
 	}
-	const App = () => {
-		const [loading, setLoading] = useState(true);
-		const [success, setSuccess] = useState(null);
-		const [error, setError] = useState(null);
-		const [resultNode, setResultNode] = useState(void 0);
-		useEffect(() => {
-			const run = async () => {
-				try {
-					if (!await store.hasCredentials()) {
-						setResultNode(React.createElement(EntityCard, { fields: [{
-							label: "Status",
-							value: "Not authenticated",
-							color: "yellow"
-						}, {
-							label: "Hint",
-							value: "Run runtype auth login"
-						}] }));
-						setSuccess(true);
-						setLoading(false);
-						return;
-					}
-					const credentials = await store.getCredentials();
-					if (credentials) setResultNode(React.createElement(EntityCard, { fields: [
-						{
-							label: "Status",
-							value: "Authenticated",
-							color: "green"
-						},
-						{
-							label: "User ID",
-							value: credentials.userId
-						},
-						{
-							label: "API URL",
-							value: credentials.apiUrl || "default"
-						},
-						{
-							label: "API Key",
-							value: credentials.apiKey ? credentials.apiKey.substring(0, 12) + "..." : "missing"
-						},
-						{
-							label: "Org ID",
-							value: credentials.orgId || "none"
-						}
-					] }));
-					setSuccess(true);
-					setLoading(false);
-				} catch (err) {
-					setError(err instanceof Error ? err : new Error(String(err)));
-					setSuccess(false);
-					setLoading(false);
+	await renderTask("Checking authentication...", async () => {
+		const context = await loadEffectiveContext();
+		const storedLogins = (await store.listAccounts()).length;
+		const credentials = context.credentials;
+		if (!credentials) return {
+			message: "Auth Status",
+			result: React.createElement(EntityCard, { fields: [
+				{
+					label: "Status",
+					value: "Not authenticated",
+					color: "yellow"
+				},
+				{
+					label: "Selected by",
+					value: describeAccountSource(context)
+				},
+				{
+					label: "Stored logins",
+					value: String(storedLogins)
+				},
+				{
+					label: "Hint",
+					value: context.requestedOrgId ? authRequiredMessage(context) : "Run runtype auth login"
 				}
-			};
-			run();
-		}, []);
-		return React.createElement(MutationResult, {
-			loading,
-			loadingLabel: "Checking authentication...",
-			success,
-			successMessage: "Auth Status",
-			error,
-			result: resultNode
-		});
-	};
-	const { waitUntilExit } = render(React.createElement(App));
-	await waitUntilExit();
+			] })
+		};
+		return {
+			message: "Auth Status",
+			result: React.createElement(EntityCard, { fields: [
+				{
+					label: "Status",
+					value: "Authenticated",
+					color: "green"
+				},
+				{
+					label: "Organization",
+					value: credentials.orgId || "Personal"
+				},
+				{
+					label: "User ID",
+					value: credentials.userId
+				},
+				{
+					label: "API URL",
+					value: credentials.apiUrl
+				},
+				{
+					label: "API Key",
+					value: credentials.apiKey.substring(0, 12) + "..."
+				},
+				{
+					label: "Selected by",
+					value: describeAccountSource(context)
+				},
+				{
+					label: "Stored in",
+					value: context.account?.secretStore === "file" ? "credential file" : "OS keychain"
+				},
+				{
+					label: "Stored logins",
+					value: String(storedLogins)
+				},
+				...context.credentialSource === "environment" ? [{
+					label: "Note",
+					value: "RUNTYPE_API_KEY overrides the stored login",
+					color: "yellow"
+				}] : []
+			] })
+		};
+	});
+});
+authCommand.command("accounts").alias("list").description("List stored logins (one per organization and API URL)").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+	const store = new CredentialStore();
+	const [accounts, defaultAccount, context] = await Promise.all([
+		store.listAccounts(),
+		store.getDefaultAccount(),
+		loadEffectiveContext()
+	]);
+	const rows = accounts.map((account) => ({
+		accountId: account.id,
+		orgId: account.orgId,
+		userId: account.userId,
+		apiUrl: account.apiUrl,
+		isDefault: account.id === defaultAccount?.id,
+		isActive: account.id === context.account?.id,
+		secretStore: account.secretStore,
+		pendingClaim: Boolean(account.claim),
+		lastUsedAt: account.lastUsedAt ?? null
+	}));
+	if (!isTTY(options) || options.json) {
+		console.log(JSON.stringify({ accounts: rows }, null, 2));
+		return;
+	}
+	if (rows.length === 0) {
+		console.log(chalk.yellow("No stored logins. Run: runtype login"));
+		return;
+	}
+	for (const row of rows) {
+		const marker = row.isActive ? chalk.green("*") : " ";
+		const tags = [row.isDefault ? "default" : null, row.pendingClaim ? "unclaimed" : null].filter(Boolean).join(", ");
+		console.log(`${marker} ${chalk.bold(row.orgId ?? "Personal")}  ${chalk.gray(row.apiUrl)}${tags ? `  ${chalk.cyan(`(${tags})`)}` : ""}`);
+	}
+	console.log(chalk.gray("\n* = login used in this directory"));
+});
+/** Resolve an `auth switch`/`logout` argument (org id or account id) to exactly one stored login. */
+async function findAccountArgument(store, value, apiUrl) {
+	const accounts = await store.listAccounts();
+	const byId = accounts.find((account) => account.id === value);
+	if (byId) return byId;
+	const target = apiUrl ? normalizeApiUrl(apiUrl) : void 0;
+	const matches = accounts.filter((account) => account.orgId === value && (!target || account.apiUrl === target));
+	if (matches.length === 1) return matches[0];
+	if (matches.length > 1) throw new CliContextError(`${value} has logins on several API URLs (${matches.map((m) => m.apiUrl).join(", ")}); pass --api-url to pick one.`);
+	throw new CliContextError(`No stored login for ${value}. Run: runtype login --org ${value}`);
+}
+authCommand.command("switch [org]").description("Set the default login used outside linked projects").option("--api-url <url>", "Disambiguate when the organization has logins on several API URLs").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (org, options) => {
+	const store = new CredentialStore();
+	const accounts = await store.listAccounts();
+	if (accounts.length === 0) {
+		console.error(chalk.yellow("No stored logins. Run: runtype login"));
+		process.exit(1);
+		return;
+	}
+	let account;
+	if (org) account = await findAccountArgument(store, org, options.apiUrl ?? getInvocationOptions().apiUrl);
+	else if (!isTTY(options)) {
+		console.error(JSON.stringify({
+			status: "error",
+			error: "Pass the organization to switch to.",
+			next: "runtype auth accounts --json, then: runtype auth switch <orgId>"
+		}));
+		process.exit(1);
+		return;
+	} else account = await promptForAccount(accounts);
+	if (!account) return;
+	await store.setDefaultAccount(account.id);
+	const context = await loadEffectiveContext();
+	const shadowed = context.accountSource !== "default" && context.account?.id !== account.id ? `This directory still uses ${context.requestedOrgId} (${describeAccountSource(context)}).` : null;
+	if (!isTTY(options)) {
+		console.log(JSON.stringify({
+			status: "switched",
+			accountId: account.id,
+			orgId: account.orgId,
+			apiUrl: account.apiUrl,
+			...shadowed ? { note: shadowed } : {}
+		}, null, 2));
+		return;
+	}
+	console.log(chalk.green(`Default login is now ${account.orgId ?? "Personal"} (${account.apiUrl}).`));
+	if (shadowed) console.log(chalk.yellow(shadowed));
 });
-authCommand.command("export-key").description("Print the stored API key to stdout (for use in scripts and .env files)").action(async () => {
+authCommand.command("export-key").description("Print the active login's API key to stdout (for use in scripts and .env files)").action(async () => {
 	const apiKey = await new CredentialStore().getApiKey();
 	if (!apiKey) {
 		console.error("Not authenticated. Run `runtype auth login` first.");
@@ -28003,52 +28780,43 @@ authCommand.command("export-key").description("Print the stored API key to stdou
 	process.stdout.write(apiKey);
 });
 registerAgentAuthCommands(authCommand);
-authCommand.command("logout").description("Remove stored credentials").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+authCommand.command("logout [org]").description("Remove the login this directory uses (or the named org's login, or --all)").option("--all", "Remove every stored login").option("--api-url <url>", "Disambiguate when the organization has logins on several API URLs").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (org, options) => {
 	const store = new CredentialStore();
+	const logout = async () => {
+		if (options.all) {
+			const accounts = await store.listAccounts();
+			for (const account of accounts) await store.removeAccount(account.id);
+			return { removed: accounts };
+		}
+		if (org) {
+			const account = await findAccountArgument(store, org, options.apiUrl ?? getInvocationOptions().apiUrl);
+			await store.removeAccount(account.id);
+			return { removed: [account] };
+		}
+		const removed = await store.clearCredentials();
+		return { removed: removed ? [removed] : [] };
+	};
 	if (!isTTY(options)) {
-		if (!await store.hasCredentials()) {
+		const { removed } = await logout();
+		if (removed.length === 0) {
 			console.log(JSON.stringify({ status: "no_credentials" }, null, 2));
 			return;
 		}
-		await store.clearCredentials();
-		console.log(JSON.stringify({ status: "logged_out" }, null, 2));
+		console.log(JSON.stringify({
+			status: "logged_out",
+			removed: removed.map((account) => ({
+				orgId: account.orgId,
+				apiUrl: account.apiUrl
+			})),
+			remainingLogins: (await store.listAccounts()).length
+		}, null, 2));
 		return;
 	}
-	const App = () => {
-		const [loading, setLoading] = useState(true);
-		const [success, setSuccess] = useState(null);
-		const [error, setError] = useState(null);
-		const [msg, setMsg] = useState("Logged out successfully");
-		useEffect(() => {
-			const run = async () => {
-				try {
-					if (!await store.hasCredentials()) {
-						setMsg("No stored credentials found");
-						setSuccess(true);
-						setLoading(false);
-						return;
-					}
-					await store.clearCredentials();
-					setSuccess(true);
-					setLoading(false);
-				} catch (err) {
-					setError(err instanceof Error ? err : new Error(String(err)));
-					setSuccess(false);
-					setLoading(false);
-				}
-			};
-			run();
-		}, []);
-		return React.createElement(MutationResult, {
-			loading,
-			loadingLabel: "Logging out...",
-			success,
-			successMessage: msg,
-			error
-		});
-	};
-	const { waitUntilExit } = render(React.createElement(App));
-	await waitUntilExit();
+	await renderTask("Logging out...", async () => {
+		const { removed } = await logout();
+		if (removed.length === 0) return { message: "No stored credentials found" };
+		return { message: `Logged out of ${removed.map((account) => account.orgId ?? "Personal").join(", ")}` };
+	});
 });
 authCommand.command("whoami").description("Display current user information").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
 	const apiKey = await ensureAuth({
@@ -28062,10 +28830,16 @@ authCommand.command("whoami").description("Display current user information").op
 		apiUrl: context.apiUrl
 	};
 	if (!credentials || !credentials.apiKey) {
-		if (!isTTY(options) || options.json) console.log(JSON.stringify({ status: "unauthenticated" }, null, 2));
+		if (!isTTY(options) || options.json) console.log(JSON.stringify({
+			status: "unauthenticated",
+			...context.requestedOrgId ? {
+				requestedOrgId: context.requestedOrgId,
+				next: authRequiredMessage(context)
+			} : {}
+		}, null, 2));
 		else {
-			console.log(chalk.yellow("Not logged in"));
-			console.log("Run: runtype auth login");
+			console.log(chalk.yellow(context.requestedOrgId ? authRequiredMessage(context) : "Not logged in"));
+			if (!context.requestedOrgId) console.log("Run: runtype auth login");
 		}
 		return;
 	}
@@ -28077,6 +28851,9 @@ authCommand.command("whoami").description("Display current user information").op
 				userId: user.userId,
 				orgId: user.orgId,
 				apiUrl: credentials.apiUrl || getApiUrl(),
+				credentialSource: context.credentialSource,
+				accountSource: context.accountSource,
+				projectLink: context.projectLink?.path ?? null,
 				billing: billingInfo
 			}, null, 2));
 		} catch (error) {
@@ -28089,81 +28866,142 @@ authCommand.command("whoami").description("Display current user information").op
 		}
 		return;
 	}
-	const App = () => {
-		const [loading, setLoading] = useState(true);
-		const [success, setSuccess] = useState(null);
-		const [error, setError] = useState(null);
-		const [resultNode, setResultNode] = useState(void 0);
-		useEffect(() => {
-			const run = async () => {
-				try {
-					const user = await getAuthenticatedUser();
-					const billingInfo = await getBillingInfo(credentials.apiKey, credentials.apiUrl);
-					const fields = [
-						{
-							label: "User ID",
-							value: user.userId
-						},
-						{
-							label: "Organization",
-							value: user.orgId || "Personal"
-						},
-						{
-							label: "API Key",
-							value: credentials.apiKey.substring(0, 10) + "..."
-						},
-						{
-							label: "API URL",
-							value: credentials.apiUrl || getApiUrl()
-						},
-						{
-							label: "Created",
-							value: credentials.createdAt
-						},
-						{
-							label: "Last Used",
-							value: credentials.lastUsed
-						}
-					];
-					if (billingInfo) {
-						const plan = billingInfo.planName || billingInfo.plan;
-						if (plan) fields.push({
-							label: "Plan",
-							value: plan,
-							color: "green"
-						});
-						const usage = billingInfo.usage;
-						if (usage) {
-							const used = usage.executionsToday ?? usage.executionsThisMonth;
-							const value = usage.executionsThisMonthAvailable === false || typeof used !== "number" ? "unavailable" : used.toLocaleString();
-							fields.push({
-								label: "Executions today",
-								value
-							});
-						}
-					}
-					setResultNode(React.createElement(EntityCard, { fields }));
-					setSuccess(true);
-					setLoading(false);
-				} catch (err) {
-					setError(err instanceof Error ? err : new Error(String(err)));
-					setSuccess(false);
-					setLoading(false);
-				}
-			};
-			run();
-		}, []);
-		return React.createElement(MutationResult, {
-			loading,
-			loadingLabel: "Fetching user information...",
-			success,
-			successMessage: "Current User",
-			error,
-			result: resultNode
-		});
+	await renderTask("Fetching user information...", async () => {
+		const user = await getAuthenticatedUser();
+		const billingInfo = await getBillingInfo(credentials.apiKey, credentials.apiUrl);
+		const fields = [
+			{
+				label: "User ID",
+				value: user.userId
+			},
+			{
+				label: "Organization",
+				value: user.orgId || "Personal"
+			},
+			{
+				label: "API Key",
+				value: credentials.apiKey.substring(0, 10) + "..."
+			},
+			{
+				label: "API URL",
+				value: credentials.apiUrl || getApiUrl()
+			},
+			{
+				label: "Selected by",
+				value: context.credentialSource === "environment" ? "RUNTYPE_API_KEY" : describeAccountSource(context)
+			},
+			{
+				label: "Created",
+				value: credentials.createdAt
+			},
+			{
+				label: "Last Used",
+				value: credentials.lastUsed
+			}
+		];
+		if (billingInfo) {
+			const plan = billingInfo.planName || billingInfo.plan;
+			if (plan) fields.push({
+				label: "Plan",
+				value: plan,
+				color: "green"
+			});
+			const usage = billingInfo.usage;
+			if (usage) {
+				const used = usage.executionsToday ?? usage.executionsThisMonth;
+				const value = usage.executionsThisMonthAvailable === false || typeof used !== "number" ? "unavailable" : used.toLocaleString();
+				fields.push({
+					label: "Executions today",
+					value
+				});
+			}
+		}
+		return {
+			message: "Current User",
+			result: React.createElement(EntityCard, { fields })
+		};
+	});
+});
+//#endregion
+//#region src/commands/link.ts
+const PRODUCTION_API_URL = "https://api.runtype.com";
+async function chooseOrganization(orgArgument, options) {
+	if (orgArgument) return { orgId: orgArgument };
+	const accounts = (await new CredentialStore().listAccounts()).filter((account) => account.orgId);
+	if (accounts.length > 1 && isTTY(options) && !options.json) {
+		console.log(chalk.cyan("Which organization should this directory use?"));
+		const chosen = await promptForAccount(accounts);
+		if (!chosen?.orgId) throw new CliContextError("No organization selected.");
+		return {
+			orgId: chosen.orgId,
+			apiUrl: chosen.apiUrl
+		};
+	}
+	const context = await loadEffectiveContext();
+	const orgId = context.credentials?.orgId ?? (accounts.length === 1 ? accounts[0].orgId : null);
+	if (!orgId) throw new CliContextError("Pass the organization to link (runtype link <orgId>), or log in first with: runtype login");
+	return {
+		orgId,
+		apiUrl: context.credentials?.orgId ? context.credentials.apiUrl : accounts[0]?.apiUrl
 	};
-	const { waitUntilExit } = render(React.createElement(App));
-	await waitUntilExit();
+}
+const linkCommand = new Command("link").description("Link this directory to an organization: writes .runtype/project.json (no secrets; commit it)").argument("[orgId]", "Organization ID (defaults to a stored login)").option("--api-url <url>", "Also pin the API URL for this directory").option("--dir <path>", "Directory to link (default: current directory)").option("--force", "Replace an existing link in that directory").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (orgArgument, options) => {
+	const directory = path.resolve(options.dir ?? process.cwd());
+	const existingPath = projectLinkPath(directory);
+	let existingApiUrl;
+	if (fs.existsSync(existingPath) && !options.force) {
+		let existingOrg = null;
+		try {
+			const existing = parseProjectLink(fs.readFileSync(existingPath, "utf8"), existingPath);
+			existingOrg = existing.orgId;
+			existingApiUrl = existing.apiUrl;
+		} catch {
+			existingOrg = null;
+		}
+		if (existingOrg !== orgArgument || !orgArgument) throw new CliContextError(`${existingPath} already links ${existingOrg ?? "an unreadable organization"}. Pass --force to replace it.`);
+	}
+	const chosen = await chooseOrganization(orgArgument, options);
+	const candidateApiUrl = options.apiUrl ?? getInvocationOptions().apiUrl ?? existingApiUrl ?? chosen.apiUrl;
+	const apiUrl = candidateApiUrl && normalizeApiUrl(candidateApiUrl) !== PRODUCTION_API_URL ? normalizeApiUrl(candidateApiUrl) : void 0;
+	if (apiUrl && !isFirstPartyApiUrl(apiUrl)) throw new CliContextError(`${apiUrl} is not a Runtype API host, so it cannot be pinned in a committed link. Use --api-url or RUNTYPE_API_URL for it instead.`);
+	const filePath = writeProjectLink(directory, {
+		orgId: chosen.orgId,
+		apiUrl
+	});
+	const hasLogin = (await new CredentialStore().listAccounts()).some((account) => account.orgId === chosen.orgId && account.apiUrl === (apiUrl ?? account.apiUrl));
+	const next = hasLogin ? null : `No stored login for ${chosen.orgId} yet. Run: runtype login`;
+	if (options.json || !isTTY(options)) {
+		console.log(JSON.stringify({
+			status: "linked",
+			path: filePath,
+			orgId: chosen.orgId,
+			apiUrl: apiUrl ?? null,
+			hasLogin,
+			...next ? { next } : {}
+		}, null, 2));
+		return;
+	}
+	console.log(chalk.green(`Linked ${directory} to ${chosen.orgId}${apiUrl ? ` (${apiUrl})` : ""}.`));
+	console.log(chalk.gray(`Wrote ${filePath}. It holds no secrets; commit it so teammates use the same org.`));
+	if (next) console.log(chalk.yellow(next));
+});
+const unlinkCommand = new Command("unlink").description("Remove the nearest .runtype/project.json so commands use the default login again").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+	let root = null;
+	try {
+		root = findProjectLink()?.root ?? null;
+	} catch (error) {
+		if (!(error instanceof ProjectLinkError)) throw error;
+		root = path.dirname(path.dirname(error.path));
+	}
+	const removedPath = root && removeProjectLink(root) ? projectLinkPath(root) : null;
+	if (options.json || !isTTY(options)) {
+		console.log(JSON.stringify(removedPath ? {
+			status: "unlinked",
+			path: removedPath
+		} : { status: "not_linked" }, null, 2));
+		return;
+	}
+	console.log(removedPath ? chalk.green(`Removed ${removedPath}. Commands here now use the default login.`) : chalk.yellow("No .runtype/project.json found in this directory or its parents."));
 });
 //#endregion
 //#region src/lib/file-utils.ts
@@ -31429,6 +32267,9 @@ configCommand.command("context").description("Show the effective API target and
 	console.log(`API URL: ${context.apiUrl} (${context.apiUrlSource})`);
 	console.log(`Credential source: ${context.credentialSource}`);
 	console.log(`Organization: ${context.orgId ?? "unknown"} (not verified; use auth whoami)`);
+	console.log(`Login selected by: ${context.accountSource}${context.requestedOrgId ? ` (${context.requestedOrgId})` : ""}`);
+	if (context.projectLink) console.log(`Project link: ${context.projectLink}`);
+	if (context.credentialStore) console.log(`Credential stored in: ${context.credentialStore}`);
 });
 configCommand.command("get [key]").description("Get configuration value").action((key) => {
 	const config = getCliConfig();
@@ -32832,6 +33673,32 @@ integrationsCommand.command("get <id>").description("Get integration details, in
 });
 //#endregion
 //#region src/commands/surfaces.ts
+const DELIVERY_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+async function readStdin$1() {
+	let value = "";
+	process.stdin.setEncoding("utf8");
+	for await (const chunk of process.stdin) value += chunk;
+	return value;
+}
+/** The `--payload` object, read from a file or from stdin when the source is `-`. */
+async function readPayloadObject(source) {
+	const label = source === "-" ? "stdin" : source;
+	const raw = source === "-" ? await readStdin$1() : await readFile(source, "utf8");
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(`--payload: invalid JSON in ${label}`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`--payload: ${label} must contain a JSON object`);
+	return parsed;
+}
+/** `Attempt 1: HTTP 202, run exec_1 (route: event_route opened)` */
+function formatDeliveryAttempt(attempt) {
+	const outcome = attempt.deduplicated ? ", deduplicated" : attempt.executionId ? `, run ${attempt.executionId}` : "";
+	const route = attempt.route ? ` (route: ${[attempt.route.matchedBy, attempt.route.pattern].filter(Boolean).join(" ")})` : "";
+	return `Attempt ${attempt.attempt}: HTTP ${attempt.status}${outcome}${route}`;
+}
 function parsePositiveInteger$1(value, option) {
 	const parsed = Number(value);
 	if (!Number.isInteger(parsed) || parsed < 1) throw new Error(`${option} must be a positive integer`);
@@ -33076,19 +33943,23 @@ surfacesCommand.command("get <id>").description("Get surface details including i
 	const { waitUntilExit } = render(React.createElement(App));
 	await waitUntilExit();
 });
-surfacesCommand.command("test <id>").description("Send a provider fixture through a surface’s real ingress").addOption(new Option("--product <productId>", "Deprecated; surface IDs resolve their product").hideHelp()).requiredOption("--fixture <fixture>", "Fixture name, such as github.pull_request.opened or github.pull_request.merged_plan").requiredOption("--repo <owner/repository>", "GitHub repository in owner/repository format").requiredOption("--pr <number>", "Pull request number").option("--repeat <number>", "Deliver the same provider event more than once", "1").option("--planning-path <path>", "Planning-document directory for merged-plan fixtures").option("--json", "Output as JSON").action(async (id, options) => {
+surfacesCommand.command("test <id>").description("Send a provider fixture through a surface’s real ingress").addOption(new Option("--product <productId>", "Deprecated; surface IDs resolve their product").hideHelp()).requiredOption("--fixture <fixture>", "Fixture name, such as github.pull_request.opened or github.pull_request.merged_plan").requiredOption("--repo <owner/repository>", "GitHub repository in owner/repository format").requiredOption("--pr <number>", "Pull request number").option("--repeat <number>", "Deliver the same provider event more than once", "1").option("--planning-path <path>", "Planning-document directory for merged-plan fixtures").option("--delivery-id <id>", "Reuse a previous delivery ID (X-GitHub-Delivery), to check the surface handles a repeat once").option("--payload <file>", "Send and sign this JSON object instead of the built fixture; - reads it from stdin").option("--json", "Output as JSON").action(async (id, options) => {
 	const apiKey = await ensureAuth();
 	if (!apiKey) return;
 	try {
 		const pullRequest = parsePositiveInteger$1(options.pr, "--pr");
 		const repeat = parsePositiveInteger$1(options.repeat, "--repeat");
 		if (repeat > 3) throw new Error("--repeat must not exceed 3");
+		if (options.deliveryId !== void 0 && !DELIVERY_ID_PATTERN.test(options.deliveryId)) throw new Error("--delivery-id must be 1-128 letters, digits, dots, underscores, colons or hyphens");
+		const payload = options.payload !== void 0 ? await readPayloadObject(options.payload) : void 0;
 		const result = await createCliClient(apiKey).post(`/surfaces/${encodeURIComponent(id)}/test-deliveries`, {
 			fixture: options.fixture,
 			repository: options.repo,
 			pullRequest,
 			repeat,
-			...options.planningPath ? { planningPath: options.planningPath } : {}
+			...options.planningPath ? { planningPath: options.planningPath } : {},
+			...options.deliveryId ? { deliveryId: options.deliveryId } : {},
+			...payload ? { payload } : {}
 		});
 		if (options.json) {
 			printJson(result);
@@ -33099,7 +33970,7 @@ surfacesCommand.command("test <id>").description("Send a provider fixture throug
 		console.log(`  Fixture:  ${result.fixture}`);
 		console.log(`  Source:   ${result.repository}#${result.pullRequest}`);
 		console.log(`  Delivery: ${result.deliveryId}`);
-		for (const attempt of result.attempts) console.log(`  Attempt ${attempt.attempt}: HTTP ${attempt.status}`);
+		for (const attempt of result.attempts) console.log(`  ${formatDeliveryAttempt(attempt)}`);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : "Unknown error";
 		console.error(chalk.red(`Failed to test surface: ${message}`));
@@ -34100,21 +34971,16 @@ function InitApp({ apiUrl, onComplete }) {
 				loadingLabel: storedKeyNotice ? `${storedKeyNotice} Opening browser to sign in instead...` : "Opening browser to sign in..."
 			}));
 			try {
-				const sessionToken = await new OAuthManager({
-					clerkPublishableKey: getClerkPublishableKey(),
-					dashboardUrl: getDashboardUrl()
-				}).authenticate("sign-in");
-				setState((s) => ({
-					...s,
-					loadingLabel: "Exchanging credentials..."
-				}));
-				const { key, userId, orgId } = await new ApiKeyManager().exchangeSessionForApiKey(sessionToken, apiUrl || getApiUrl());
-				await store.saveCredentials({
-					apiKey: key,
-					userId,
-					orgId,
-					apiUrl: apiUrl || getApiUrl()
+				const login = await browserLogin({
+					apiUrl,
+					onProgress: (label) => setState((s) => ({
+						...s,
+						loadingLabel: label
+					}))
 				});
+				const mismatch = orgMismatchWarning(login);
+				if (mismatch) throw new Error(mismatch);
+				const { apiKey: key, userId, orgId } = login;
 				setState((s) => ({
 					...s,
 					apiKey: key,
@@ -37659,7 +38525,7 @@ function applyMaxLines(raw, maxLines) {
 function readFileContent(filePath, snapshots, liveTools, maxLines = 5e3) {
 	try {
 		return {
-			...applyMaxLines(fs$2.readFileSync(filePath, "utf-8"), maxLines),
+			...applyMaxLines(fs$1.readFileSync(filePath, "utf-8"), maxLines),
 			source: "disk"
 		};
 	} catch {}
@@ -37964,7 +38830,7 @@ const deployLifecycleParameters = {
 		description: "Runtype destruction backstop. Omitted: Daytona 10m, Runtype Sandbox unlimited. Provider sleep/loss can end availability earlier."
 	},
 	sleepPolicy: {
-		description: "Idle compute policy, independent of retention. Legacy Runtype Sandbox supports idle only.",
+		description: "Idle compute policy, independent of retention.",
 		oneOf: [{
 			type: "object",
 			properties: { mode: { const: "never" } },
@@ -38087,7 +38953,7 @@ function createDeploySandboxLocalTool(client, debugMode) {
 let activeCfSandboxId;
 function createDeployCfSandboxLocalTool(client, debugMode) {
 	return {
-		description: "Deploy a live Runtype Sandbox server preview. Omitted retention preserves the unlimited legacy backstop; explicit lifecycle policy requires rollout enablement. Provider sleep/loss can end availability earlier; the URL is not durable hosting.",
+		description: "Deploy a live Runtype Sandbox server preview. Omitted retention preserves the unlimited legacy backstop; explicit lifecycle policy requires rollout enablement. Provider sleep/loss can end availability earlier; the URL is not durable hosting. A redeploy stops the previous server; when effectivePolicy.previewUrlChanged is true, re-register any saved copy of the URL.",
 		parametersSchema: {
 			type: "object",
 			properties: {
@@ -38096,6 +38962,10 @@ function createDeployCfSandboxLocalTool(client, debugMode) {
 					description: "Code to deploy (main entry point file)"
 				},
 				...deployLifecycleParameters,
+				sleepPolicy: {
+					...deployLifecycleParameters.sleepPolicy,
+					description: "Idle sleep, or { mode: \"never\" } to keep the container running until the retention deadline. \"never\" requires retention 10m, 1h or 24h."
+				},
 				packageJson: {
 					type: "object",
 					description: "package.json content as a JSON object, e.g. { \"dependencies\": { \"hono\": \"^4.0.0\" } }"
@@ -38189,14 +39059,14 @@ function createEventLogWriter(stateFilePath, initialSessionIndex) {
 	let stream = null;
 	function ensureDir() {
 		if (!dirCreated) {
-			fs$2.mkdirSync(eventsDir, { recursive: true });
+			fs$1.mkdirSync(eventsDir, { recursive: true });
 			dirCreated = true;
 		}
 	}
 	function ensureStream() {
 		if (!stream || stream.destroyed) {
 			ensureDir();
-			stream = fs$2.createWriteStream(currentPath, { flags: "a" });
+			stream = fs$1.createWriteStream(currentPath, { flags: "a" });
 			stream.on("error", () => {});
 		}
 	}
@@ -38225,8 +39095,8 @@ function createEventLogWriter(stateFilePath, initialSessionIndex) {
 *  Returns an empty array if the file doesn't exist. */
 function readSessionEventLog(stateFilePath, sessionIndex) {
 	const logPath = sessionEventLogPath(stateFilePath, sessionIndex);
-	if (!fs$2.existsSync(logPath)) return [];
-	const content = fs$2.readFileSync(logPath, "utf-8");
+	if (!fs$1.existsSync(logPath)) return [];
+	const content = fs$1.readFileSync(logPath, "utf-8");
 	const events = [];
 	for (const line of content.split("\n")) {
 		if (!line.trim()) continue;
@@ -38261,7 +39131,7 @@ function isTreeLogEntry(value) {
 function loadTreeLog(filePath) {
 	let raw;
 	try {
-		raw = fs$2.readFileSync(filePath, "utf-8");
+		raw = fs$1.readFileSync(filePath, "utf-8");
 	} catch {
 		return null;
 	}
@@ -38298,8 +39168,8 @@ function loadTreeLog(filePath) {
 	};
 }
 function appendLine(log, entry) {
-	fs$2.mkdirSync(path$2.dirname(log.filePath), { recursive: true });
-	fs$2.appendFileSync(log.filePath, JSON.stringify(entry) + "\n");
+	fs$1.mkdirSync(path$2.dirname(log.filePath), { recursive: true });
+	fs$1.appendFileSync(log.filePath, JSON.stringify(entry) + "\n");
 	log.entries.push(entry);
 	if (entry.type !== "head") {
 		log.byId.set(entry.id, entry);
@@ -38364,7 +39234,7 @@ function appendArtifact(log, payload) {
 		type: "artifact",
 		payload: {
 			...payload,
-			host: payload.host || os$2.hostname()
+			host: payload.host || os$1.hostname()
 		}
 	};
 	appendLine(log, entry);
@@ -41440,7 +42310,7 @@ function MarathonApp({ taskName, agentId, model, sandbox, goal, initialSessionCo
 		setShowSessionMenu(false);
 		try {
 			let json;
-			if (stateFilePath && fs$2.existsSync(stateFilePath)) json = fs$2.readFileSync(stateFilePath, "utf-8");
+			if (stateFilePath && fs$1.existsSync(stateFilePath)) json = fs$1.readFileSync(stateFilePath, "utf-8");
 			else json = JSON.stringify({
 				sessionSnapshots,
 				content: state.content,
@@ -41463,8 +42333,8 @@ function MarathonApp({ taskName, agentId, model, sandbox, goal, initialSessionCo
 		setShowSessionMenu(false);
 		try {
 			let json;
-			if (stateFilePath && fs$2.existsSync(stateFilePath)) {
-				const raw = fs$2.readFileSync(stateFilePath, "utf-8");
+			if (stateFilePath && fs$1.existsSync(stateFilePath)) {
+				const raw = fs$1.readFileSync(stateFilePath, "utf-8");
 				const parsed = JSON.parse(raw);
 				json = JSON.stringify(compactMarathonStateJsonForContextExport(parsed), null, 2);
 			} else {
@@ -41490,7 +42360,7 @@ function MarathonApp({ taskName, agentId, model, sandbox, goal, initialSessionCo
 	]);
 	const handleOpenStateFile = useCallback(() => {
 		setShowSessionMenu(false);
-		if (stateFilePath && fs$2.existsSync(stateFilePath)) {
+		if (stateFilePath && fs$1.existsSync(stateFilePath)) {
 			open(stateFilePath);
 			showFlash("Opening state file...");
 		} else showFlash("No state file yet");
@@ -41885,7 +42755,7 @@ function MarathonApp({ taskName, agentId, model, sandbox, goal, initialSessionCo
 			const file = detailFile ?? trackedFiles[fileCursor];
 			if (file) {
 				const filePath = path$2.resolve(file.path);
-				if (fs$2.existsSync(filePath)) {
+				if (fs$1.existsSync(filePath)) {
 					open(filePath);
 					showFlash(`Opening ${file.path}`);
 				} else showFlash("File not found on disk");
@@ -42400,7 +43270,7 @@ function MarathonApp({ taskName, agentId, model, sandbox, goal, initialSessionCo
 					onOpenDashboard: handleOpenDashboard,
 					onClose: () => setShowSessionMenu(false),
 					hasDashboard: !!agentPageUrl,
-					hasStateFile: !!stateFilePath && fs$2.existsSync(stateFilePath)
+					hasStateFile: !!stateFilePath && fs$1.existsSync(stateFilePath)
 				})
 			}),
 			showUpgradeModal && upgradePrompt && /* @__PURE__ */ jsx(Box, {
@@ -42941,28 +43811,6 @@ function setMarathonTitle() {
 	setTerminalTitle(`Runtype: Marathon (${getFolderName()})`);
 }
 //#endregion
-//#region src/config/paths.ts
-/** Root state directory: RUNTYPE_STATE_DIR or ~/.runtype */
-function getRuntypeHomeDir() {
-	return process.env.RUNTYPE_STATE_DIR || path$2.join(os$2.homedir(), ".runtype");
-}
-/** Per-project state dir: ~/.runtype/projects/{hash}/ */
-function getProjectStateDir(projectDir) {
-	const dir = projectDir || process.cwd();
-	const hash = crypto$2.createHash("sha256").update(dir).digest("hex").slice(0, 12);
-	const stateDir = path$2.join(getRuntypeHomeDir(), "projects", hash);
-	const breadcrumb = path$2.join(stateDir, "project-path.txt");
-	if (!fs$2.existsSync(breadcrumb)) {
-		fs$2.mkdirSync(stateDir, { recursive: true });
-		fs$2.writeFileSync(breadcrumb, dir);
-	}
-	return stateDir;
-}
-/** Marathon state dir: ~/.runtype/projects/{hash}/marathons/ */
-function getMarathonStateDir(projectDir) {
-	return path$2.join(getProjectStateDir(projectDir), "marathons");
-}
-//#endregion
 //#region src/marathon/checkpoint.ts
 function defaultStateDir$2() {
 	return getMarathonStateDir();
@@ -42983,14 +43831,14 @@ function ensureMarathonFileCheckpoint(taskName, targetPath, stateDir, stateFileP
 	const normalizedTargetPath = path$2.resolve(targetPath);
 	const relativeTargetPath = path$2.relative(process.cwd(), normalizedTargetPath);
 	if (!relativeTargetPath || relativeTargetPath.startsWith("..")) return void 0;
-	if (!fs$2.existsSync(normalizedTargetPath)) return void 0;
-	if (!fs$2.statSync(normalizedTargetPath).isFile()) return void 0;
+	if (!fs$1.existsSync(normalizedTargetPath)) return void 0;
+	if (!fs$1.statSync(normalizedTargetPath).isFile()) return void 0;
 	if (relativeTargetPath.replace(/\\/g, "/").startsWith(".runtype/")) return void 0;
 	if (normalizedTargetPath.startsWith(getRuntypeHomeDir() + path$2.sep)) return void 0;
 	const checkpointPath = resolveMarathonCheckpointPath(taskName, normalizedTargetPath, stateDir, stateFilePath);
-	if (fs$2.existsSync(checkpointPath)) return checkpointPath;
-	fs$2.mkdirSync(path$2.dirname(checkpointPath), { recursive: true });
-	fs$2.copyFileSync(normalizedTargetPath, checkpointPath);
+	if (fs$1.existsSync(checkpointPath)) return checkpointPath;
+	fs$1.mkdirSync(path$2.dirname(checkpointPath), { recursive: true });
+	fs$1.copyFileSync(normalizedTargetPath, checkpointPath);
 	return checkpointPath;
 }
 function restoreMarathonFileCheckpoint(taskName, targetPath, stateDir, stateFilePath) {
@@ -43001,13 +43849,13 @@ function restoreMarathonFileCheckpoint(taskName, targetPath, stateDir, stateFile
 		error: `Cannot restore checkpoint outside the current repository: ${normalizedTargetPath}`
 	};
 	const checkpointPath = resolveMarathonCheckpointPath(taskName, normalizedTargetPath, stateDir, stateFilePath);
-	if (!fs$2.existsSync(checkpointPath)) return {
+	if (!fs$1.existsSync(checkpointPath)) return {
 		restored: false,
 		checkpointPath,
 		error: `No checkpoint found for ${normalizedTargetPath}`
 	};
-	fs$2.mkdirSync(path$2.dirname(normalizedTargetPath), { recursive: true });
-	fs$2.copyFileSync(checkpointPath, normalizedTargetPath);
+	fs$1.mkdirSync(path$2.dirname(normalizedTargetPath), { recursive: true });
+	fs$1.copyFileSync(checkpointPath, normalizedTargetPath);
 	return {
 		restored: true,
 		checkpointPath
@@ -43537,7 +44385,7 @@ function normalizeMarathonStatePath(candidatePath) {
 }
 function marathonStatePathExists(candidatePath) {
 	if (!candidatePath) return false;
-	return fs$2.existsSync(path$2.resolve(candidatePath));
+	return fs$1.existsSync(path$2.resolve(candidatePath));
 }
 function isMarathonArtifactStatePath(candidatePath) {
 	if (!candidatePath) return false;
@@ -43698,7 +44546,7 @@ function sanitizeLoadedMarathonState(state) {
 }
 function loadState(filePath) {
 	try {
-		const raw = fs$2.readFileSync(filePath, "utf-8");
+		const raw = fs$1.readFileSync(filePath, "utf-8");
 		return sanitizeLoadedMarathonState(JSON.parse(raw));
 	} catch {
 		return null;
@@ -43706,7 +44554,7 @@ function loadState(filePath) {
 }
 function saveState(filePath, state, options) {
 	const dir = path$2.dirname(filePath);
-	fs$2.mkdirSync(dir, { recursive: true });
+	fs$1.mkdirSync(dir, { recursive: true });
 	const stateToWrite = options?.stripSnapshotEvents && state.sessionSnapshots?.length ? {
 		...state,
 		sessionSnapshots: state.sessionSnapshots.map((snapshot) => ({
@@ -43714,7 +44562,7 @@ function saveState(filePath, state, options) {
 			rawEvents: []
 		}))
 	} : state;
-	fs$2.writeFileSync(filePath, JSON.stringify(stateToWrite, null, 2));
+	fs$1.writeFileSync(filePath, JSON.stringify(stateToWrite, null, 2));
 	syncTreeLogWithState(filePath, state);
 }
 function extractRunTaskResumeState(state) {
@@ -43760,11 +44608,11 @@ function offsetNewContextCompactionSummaries(summaries, existingSummaryIds, sess
 function findStateFile(name, stateDir) {
 	if (stateDir) return stateFilePath(name, stateDir);
 	const homePath = stateFilePath(name, getMarathonStateDir());
-	if (fs$2.existsSync(homePath)) return homePath;
+	if (fs$1.existsSync(homePath)) return homePath;
 	const oldMarathonPath = stateFilePath(name, path$2.join(process.cwd(), ".runtype", "marathons"));
-	if (fs$2.existsSync(oldMarathonPath)) return oldMarathonPath;
+	if (fs$1.existsSync(oldMarathonPath)) return oldMarathonPath;
 	const oldTaskPath = stateFilePath(name, path$2.join(process.cwd(), ".runtype", "tasks"));
-	if (fs$2.existsSync(oldTaskPath)) return oldTaskPath;
+	if (fs$1.existsSync(oldTaskPath)) return oldTaskPath;
 	return homePath;
 }
 function findLatestStateFile(stateDir) {
@@ -43775,11 +44623,11 @@ function findLatestStateFile(stateDir) {
 	];
 	let latest = null;
 	for (const dir of dirs) {
-		if (!fs$2.existsSync(dir)) continue;
-		const files = fs$2.readdirSync(dir).filter((f) => f.endsWith(".json"));
+		if (!fs$1.existsSync(dir)) continue;
+		const files = fs$1.readdirSync(dir).filter((f) => f.endsWith(".json"));
 		for (const file of files) {
 			const fullPath = path$2.join(dir, file);
-			const stat = fs$2.statSync(fullPath);
+			const stat = fs$1.statSync(fullPath);
 			if (!latest || stat.mtimeMs > latest.mtime) latest = {
 				name: file.replace(".json", ""),
 				filePath: fullPath,
@@ -43863,7 +44711,7 @@ async function resolveMarathonStateResolution(options, taskName, filePath, promp
 		};
 	}
 	if (options.fresh) return { action: "fresh" };
-	if (!fs$2.existsSync(filePath)) return { action: "fresh" };
+	if (!fs$1.existsSync(filePath)) return { action: "fresh" };
 	if (!allowPrompt) throw new Error(`Local marathon state already exists at ${filePath}. Use --resume to continue it or --fresh to start over.`);
 	const choice = await promptForChoice({
 		reason: "existing-state",
@@ -44143,9 +44991,9 @@ function shouldIgnoreRepoEntry(entryPath) {
 function safeReadTextFile(filePath) {
 	try {
 		if (isSensitivePath(normalizeToolPath(filePath).replace(/\\/g, "/"))) return null;
-		const stat = fs$2.statSync(filePath);
+		const stat = fs$1.statSync(filePath);
 		if (!stat.isFile() || stat.size > 1048576) return null;
-		const buffer = fs$2.readFileSync(filePath);
+		const buffer = fs$1.readFileSync(filePath);
 		if (buffer.includes(0)) return null;
 		return buffer.toString("utf-8");
 	} catch {
@@ -44153,14 +45001,14 @@ function safeReadTextFile(filePath) {
 	}
 }
 function walkRepo(startPath, visitor) {
-	if (!fs$2.existsSync(startPath) || !fs$2.statSync(startPath).isDirectory()) return;
+	if (!fs$1.existsSync(startPath) || !fs$1.statSync(startPath).isDirectory()) return;
 	const stack = [startPath];
 	while (stack.length > 0) {
 		const currentDir = stack.pop();
 		if (!currentDir) continue;
 		let entries;
 		try {
-			entries = fs$2.readdirSync(currentDir, { withFileTypes: true });
+			entries = fs$1.readdirSync(currentDir, { withFileTypes: true });
 		} catch {
 			continue;
 		}
@@ -44200,7 +45048,7 @@ function buildTree(dirPath, maxDepth, depth = 0) {
 	if (depth > maxDepth || shouldIgnoreRepoEntry(dirPath)) return [];
 	let entries;
 	try {
-		entries = fs$2.readdirSync(dirPath, { withFileTypes: true });
+		entries = fs$1.readdirSync(dirPath, { withFileTypes: true });
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		return [`${"  ".repeat(depth)}[error reading ${normalizeToolPath(dirPath)}: ${message}]`];
@@ -44237,8 +45085,8 @@ function resolveCanonicalToolPath(toolPath, allowMissing) {
 	let remainingSegments = absolutePath.slice(canonicalPath.length).split(path$2.sep);
 	let symlinksFollowed = 0;
 	try {
-		if (fs$2.existsSync(absolutePath)) return {
-			canonicalPath: fs$2.realpathSync.native(absolutePath),
+		if (fs$1.existsSync(absolutePath)) return {
+			canonicalPath: fs$1.realpathSync.native(absolutePath),
 			exists: true
 		};
 		if (!allowMissing) return null;
@@ -44250,25 +45098,25 @@ function resolveCanonicalToolPath(toolPath, allowMissing) {
 				continue;
 			}
 			const candidatePath = path$2.join(canonicalPath, segment);
-			const entry = fs$2.lstatSync(candidatePath, { throwIfNoEntry: false });
+			const entry = fs$1.lstatSync(candidatePath, { throwIfNoEntry: false });
 			if (!entry) {
 				canonicalPath = candidatePath;
 				continue;
 			}
 			if (entry.isSymbolicLink()) {
 				if (++symlinksFollowed > MAX_TOOL_PATH_SYMLINKS) return null;
-				const target = fs$2.readlinkSync(candidatePath);
+				const target = fs$1.readlinkSync(candidatePath);
 				const targetRoot = path$2.isAbsolute(target) ? path$2.parse(target).root : "";
 				if (targetRoot) canonicalPath = targetRoot;
 				remainingSegments = [...target.slice(targetRoot.length).split(path$2.sep), ...remainingSegments];
 				continue;
 			}
 			if (remainingSegments.length > 0 && !entry.isDirectory()) return null;
-			canonicalPath = fs$2.realpathSync.native(candidatePath);
+			canonicalPath = fs$1.realpathSync.native(candidatePath);
 		}
 		return {
 			canonicalPath,
-			exists: fs$2.existsSync(canonicalPath)
+			exists: fs$1.existsSync(canonicalPath)
 		};
 	} catch {
 		return null;
@@ -44294,7 +45142,7 @@ function resolveToolPath(toolPath, options = {}) {
 		ok: false,
 		error: `Path does not exist: ${requestedPath}`
 	};
-	const workspaceRoot = fs$2.realpathSync.native(process.cwd());
+	const workspaceRoot = fs$1.realpathSync.native(process.cwd());
 	const extraRoots = (options.allowedRoots || []).map((rootPath) => canonicalizeAllowedRoot(rootPath));
 	const matchedRoot = [...extraRoots, workspaceRoot].find((rootPath) => isPathWithinRoot(resolved.canonicalPath, rootPath));
 	if (!matchedRoot) return {
@@ -44315,7 +45163,7 @@ function resolveToolPath(toolPath, options = {}) {
 		}
 	}
 	if (resolved.exists) {
-		const stat = fs$2.statSync(resolved.canonicalPath);
+		const stat = fs$1.statSync(resolved.canonicalPath);
 		if (options.requireFile && !stat.isFile()) return {
 			ok: false,
 			error: `Path is not a file: ${requestedPath}`
@@ -44363,7 +45211,7 @@ function createDefaultLocalTools(context) {
 					allowedRoots: allowedReadRoots
 				});
 				if (!resolvedPath.ok) return `Error: ${resolvedPath.error}`;
-				return fs$2.readFileSync(resolvedPath.resolvedPath, "utf-8");
+				return fs$1.readFileSync(resolvedPath.resolvedPath, "utf-8");
 			}
 		},
 		write_file: {
@@ -44386,10 +45234,10 @@ function createDefaultLocalTools(context) {
 				const resolvedPath = resolveToolPath(String(args.path || ""), { allowMissing: true });
 				if (!resolvedPath.ok) return `Error: ${resolvedPath.error}`;
 				const content = String(args.content || "");
-				if (fs$2.existsSync(resolvedPath.resolvedPath) && fs$2.statSync(resolvedPath.resolvedPath).isDirectory()) return `Error: Path is a directory: ${String(args.path || "")}`;
+				if (fs$1.existsSync(resolvedPath.resolvedPath) && fs$1.statSync(resolvedPath.resolvedPath).isDirectory()) return `Error: Path is a directory: ${String(args.path || "")}`;
 				const dir = path$2.dirname(resolvedPath.resolvedPath);
-				fs$2.mkdirSync(dir, { recursive: true });
-				fs$2.writeFileSync(resolvedPath.resolvedPath, content);
+				fs$1.mkdirSync(dir, { recursive: true });
+				fs$1.writeFileSync(resolvedPath.resolvedPath, content);
 				return "ok";
 			}
 		},
@@ -44405,7 +45253,7 @@ function createDefaultLocalTools(context) {
 			execute: async (args) => {
 				const resolvedPath = resolveToolPath(String(args.path || "."), { requireDirectory: true });
 				if (!resolvedPath.ok) return `Error: ${resolvedPath.error}`;
-				return fs$2.readdirSync(resolvedPath.resolvedPath, { withFileTypes: true }).filter((entry) => !shouldIgnoreRepoEntry(path$2.join(resolvedPath.resolvedPath, entry.name))).map((entry) => entry.name).join("\n");
+				return fs$1.readdirSync(resolvedPath.resolvedPath, { withFileTypes: true }).filter((entry) => !shouldIgnoreRepoEntry(path$2.join(resolvedPath.resolvedPath, entry.name))).map((entry) => entry.name).join("\n");
 			}
 		},
 		search_repo: {
@@ -44569,8 +45417,8 @@ function createCheckpointedWriteFileTool(taskName, stateDir, planPath, stateFile
 			const content = String(args.content || "");
 			ensureMarathonFileCheckpoint(taskName, resolvedPath.resolvedPath, stateDir, stateFilePath);
 			const dir = path$2.dirname(resolvedPath.resolvedPath);
-			fs$2.mkdirSync(dir, { recursive: true });
-			fs$2.writeFileSync(resolvedPath.resolvedPath, content);
+			fs$1.mkdirSync(dir, { recursive: true });
+			fs$1.writeFileSync(resolvedPath.resolvedPath, content);
 			const ext = path$2.extname(resolvedPath.resolvedPath).toLowerCase();
 			if (ext === ".js" || ext === ".jsx") {
 				const syntaxError = quickJsSyntaxCheck(content);
@@ -44646,7 +45494,7 @@ function createEditFileTool(taskName, stateDir, planPath, stateFilePath) {
 			if (oldString === newString) return "Error: old_string and new_string are identical";
 			let content;
 			try {
-				content = fs$2.readFileSync(resolvedPath.resolvedPath, "utf-8");
+				content = fs$1.readFileSync(resolvedPath.resolvedPath, "utf-8");
 			} catch {
 				return `Error: Could not read file: ${String(args.path || "")}`;
 			}
@@ -44657,7 +45505,7 @@ function createEditFileTool(taskName, stateDir, planPath, stateFilePath) {
 			}
 			ensureMarathonFileCheckpoint(taskName, resolvedPath.resolvedPath, stateDir, stateFilePath);
 			const updated = replaceAll ? content.split(oldString).join(newString) : content.replace(oldString, newString);
-			fs$2.writeFileSync(resolvedPath.resolvedPath, updated);
+			fs$1.writeFileSync(resolvedPath.resolvedPath, updated);
 			const ext = path$2.extname(resolvedPath.resolvedPath).toLowerCase();
 			if (ext === ".js" || ext === ".jsx") {
 				const syntaxError = quickJsSyntaxCheck(updated);
@@ -44709,13 +45557,13 @@ function createReadOffloadedOutputTool(taskName, stateDir, stateFilePath) {
 			};
 			const idEmbeddedSha256 = /^art_([0-9a-f]{64})$/.exec(outputId)?.[1];
 			const outputPath = path$2.join(getOffloadedOutputDir(taskName, stateDir, stateFilePath), `${outputId}.txt`);
-			if (!fs$2.existsSync(outputPath) || !fs$2.statSync(outputPath).isFile()) {
+			if (!fs$1.existsSync(outputPath) || !fs$1.statSync(outputPath).isFile()) {
 				const resolvedStateFilePath = getStateFilePathForTask(taskName, stateDir, stateFilePath);
 				const log = loadTreeLog(treeLogPathForStateFile(resolvedStateFilePath));
 				const artifact = log ? findArtifactPayload(log, outputId) : void 0;
 				if (artifact) {
 					const ledgerPath = path$2.resolve(path$2.dirname(treeLogPathForStateFile(resolvedStateFilePath)), artifact.relativePath);
-					if (fs$2.existsSync(ledgerPath) && fs$2.statSync(ledgerPath).isFile()) return verifyContent(fs$2.readFileSync(ledgerPath, "utf-8"), artifact.sha256);
+					if (fs$1.existsSync(ledgerPath) && fs$1.statSync(ledgerPath).isFile()) return verifyContent(fs$1.readFileSync(ledgerPath, "utf-8"), artifact.sha256);
 					return [
 						`Error: offloaded output recorded in the context ledger but missing locally: ${outputId}`,
 						artifact.host ? `Stored on host: ${artifact.host}` : void 0,
@@ -44724,7 +45572,7 @@ function createReadOffloadedOutputTool(taskName, stateDir, stateFilePath) {
 				}
 				return `Error: offloaded output not found: ${outputId}`;
 			}
-			return verifyContent(fs$2.readFileSync(outputPath, "utf-8"), idEmbeddedSha256);
+			return verifyContent(fs$1.readFileSync(outputPath, "utf-8"), idEmbeddedSha256);
 		}
 	};
 }
@@ -44908,7 +45756,7 @@ function resolveLedgerToolResult(tool, stateFilePath, log) {
 	if (!artifact) return result;
 	const artifactPath = path$2.resolve(path$2.dirname(treeLogPathForStateFile(stateFilePath)), artifact.relativePath);
 	try {
-		if (fs$2.existsSync(artifactPath) && fs$2.statSync(artifactPath).isFile()) return fs$2.readFileSync(artifactPath, "utf-8");
+		if (fs$1.existsSync(artifactPath) && fs$1.statSync(artifactPath).isFile()) return fs$1.readFileSync(artifactPath, "utf-8");
 	} catch {}
 	return result;
 }
@@ -45122,8 +45970,8 @@ function offloadToolOutput(taskName, toolName, output, options = {}, stateDir) {
 	const dir = artifactStoreDirForStateFile(stateFilePath);
 	const fileName = `${outputId}.txt`;
 	const filePath = path$2.join(dir, fileName);
-	fs$2.mkdirSync(dir, { recursive: true });
-	if (!fs$2.existsSync(filePath)) fs$2.writeFileSync(filePath, output, "utf-8");
+	fs$1.mkdirSync(dir, { recursive: true });
+	if (!fs$1.existsSync(filePath)) fs$1.writeFileSync(filePath, output, "utf-8");
 	recordOffloadedArtifact({
 		taskName,
 		toolName,
@@ -45273,14 +46121,14 @@ const RULES_DIR = ".marathon/rules";
 function loadRules(cwd) {
 	const baseCwd = cwd || process.cwd();
 	const rulesDir = path$2.resolve(baseCwd, RULES_DIR);
-	if (!fs$2.existsSync(rulesDir)) return [];
+	if (!fs$1.existsSync(rulesDir)) return [];
 	const rules = [];
 	try {
-		const entries = fs$2.readdirSync(rulesDir).filter((f) => f.endsWith(".md"));
+		const entries = fs$1.readdirSync(rulesDir).filter((f) => f.endsWith(".md"));
 		for (const entry of entries) {
 			const filePath = path$2.join(rulesDir, entry);
 			try {
-				const parsed = parseRuleFile(fs$2.readFileSync(filePath, "utf-8"));
+				const parsed = parseRuleFile(fs$1.readFileSync(filePath, "utf-8"));
 				rules.push({
 					...parsed,
 					filePath
@@ -45416,7 +46264,7 @@ function resolveErrorHandlingForPhase(phase, cliFallbackModel, milestoneFallback
 //#region src/marathon/playbook-loader.ts
 const PLAYBOOKS_DIR = ".runtype/marathons/playbooks";
 function getCandidatePaths(nameOrPath, cwd) {
-	const home = os$2.homedir();
+	const home = os$1.homedir();
 	return [
 		path$2.resolve(cwd, nameOrPath),
 		path$2.resolve(cwd, PLAYBOOKS_DIR, `${nameOrPath}.yaml`),
@@ -45456,7 +46304,7 @@ async function loadModulePlaybook(filePath) {
 	return config;
 }
 function parsePlaybookFile(filePath) {
-	const raw = fs$2.readFileSync(filePath, "utf-8");
+	const raw = fs$1.readFileSync(filePath, "utf-8");
 	if (path$2.extname(filePath).toLowerCase() === ".json") return JSON.parse(raw);
 	return parse(raw);
 }
@@ -45518,7 +46366,7 @@ async function loadPlaybookPlugins(plugins, playbookFilePath, playbookName) {
 		const resolved = path$2.resolve(baseDir, plugin);
 		if (resolved !== baseDir && !resolved.startsWith(baseDir + path$2.sep)) throw new Error(`Playbook '${playbookName}': plugin "${plugin}" resolves outside the playbook's directory. Keep plugin modules next to the playbook.`);
 		if (!PLUGIN_EXTENSIONS.has(path$2.extname(resolved).toLowerCase())) throw new Error(`Playbook '${playbookName}': plugin "${plugin}" must be a .js, .mjs, or .cjs module.`);
-		if (!fs$2.existsSync(resolved)) throw new Error(`Playbook '${playbookName}': plugin "${plugin}" not found at ${resolved}.`);
+		if (!fs$1.existsSync(resolved)) throw new Error(`Playbook '${playbookName}': plugin "${plugin}" not found at ${resolved}.`);
 		const mod = await import(pathToFileURL(resolved).href);
 		if (typeof mod.default !== "function") throw new Error(`Playbook '${playbookName}': plugin "${plugin}" must export a default function: export default ({ registerWorkflowHook }) => { ... }`);
 		await mod.default({ registerWorkflowHook });
@@ -45551,7 +46399,7 @@ function toWorkflowConfig(config) {
 async function loadPlaybook(nameOrPath, cwd) {
 	const candidates = getCandidatePaths(nameOrPath, cwd || process.cwd());
 	for (const candidate of candidates) {
-		if (!fs$2.existsSync(candidate) || fs$2.statSync(candidate).isDirectory()) continue;
+		if (!fs$1.existsSync(candidate) || fs$1.statSync(candidate).isDirectory()) continue;
 		const ext = path$2.extname(candidate).toLowerCase();
 		const config = MODULE_PLAYBOOK_EXTENSIONS.has(ext) ? await loadModulePlaybook(candidate) : parsePlaybookFile(candidate);
 		validatePlaybook(config, candidate);
@@ -45943,7 +46791,7 @@ async function taskAction(agent, options) {
 			forcedResumeFilePath = stateResolution.filePath;
 		} else {
 			resumeRequested = false;
-			if (options.fresh && fs$2.existsSync(filePath)) {
+			if (options.fresh && fs$1.existsSync(filePath)) {
 				if (useStartupShell) setStartupStatus("starting fresh");
 				else console.log(chalk.gray(`Starting fresh and ignoring saved local state at ${filePath}`));
 			}
@@ -48777,17 +49625,17 @@ const deployCommand = new Command("deploy").description("Export an agent and sca
 		}
 		slugSet.add(slug);
 	}
-	fs$2.mkdirSync(path$2.join(outDir, "agents"), { recursive: true });
-	fs$2.mkdirSync(path$2.join(outDir, "packages"), { recursive: true });
+	fs$1.mkdirSync(path$2.join(outDir, "agents"), { recursive: true });
+	fs$1.mkdirSync(path$2.join(outDir, "packages"), { recursive: true });
 	for (const { name, def } of agentDefs) {
 		const filename = `${slugify(name)}.json`;
-		fs$2.writeFileSync(path$2.join(outDir, "agents", filename), JSON.stringify(def, null, 2));
+		fs$1.writeFileSync(path$2.join(outDir, "agents", filename), JSON.stringify(def, null, 2));
 		console.log(`  Wrote agents/${filename}`);
 	}
 	const agentNames = agentDefs.map((a) => a.name);
 	let monorepoRoot = process.cwd();
 	for (let i = 0; i < 8; i++) {
-		if (fs$2.existsSync(path$2.join(monorepoRoot, "pnpm-workspace.yaml"))) break;
+		if (fs$1.existsSync(path$2.join(monorepoRoot, "pnpm-workspace.yaml"))) break;
 		const parent = path$2.dirname(monorepoRoot);
 		if (parent === monorepoRoot) break;
 		monorepoRoot = parent;
@@ -48803,35 +49651,35 @@ const deployCommand = new Command("deploy").description("Export an agent and sca
 	const secretNames = Array.from(allSecrets);
 	const optionalSettings = Array.from(allOptionalSettings.values());
 	if (target === "cloudflare") {
-		fs$2.mkdirSync(path$2.join(outDir, "src"), { recursive: true });
-		fs$2.writeFileSync(path$2.join(outDir, "src", "index.ts"), workerIndexTs(agentSlugs));
-		fs$2.writeFileSync(path$2.join(outDir, "wrangler.toml"), wranglerToml(projectName));
-		fs$2.writeFileSync(path$2.join(outDir, "package.json"), workerPackageJson(projectName, "workspace:*"));
-		fs$2.writeFileSync(path$2.join(outDir, "tsconfig.json"), workerTsconfigJson());
+		fs$1.mkdirSync(path$2.join(outDir, "src"), { recursive: true });
+		fs$1.writeFileSync(path$2.join(outDir, "src", "index.ts"), workerIndexTs(agentSlugs));
+		fs$1.writeFileSync(path$2.join(outDir, "wrangler.toml"), wranglerToml(projectName));
+		fs$1.writeFileSync(path$2.join(outDir, "package.json"), workerPackageJson(projectName, "workspace:*"));
+		fs$1.writeFileSync(path$2.join(outDir, "tsconfig.json"), workerTsconfigJson());
 		const setupPath = path$2.join(outDir, "setup.sh");
-		fs$2.writeFileSync(setupPath, workerSetupSh(monorepoRoot));
-		fs$2.chmodSync(setupPath, 493);
-		fs$2.writeFileSync(path$2.join(outDir, "README.md"), workerReadme(agentNames, secretNames, optionalSettings));
+		fs$1.writeFileSync(setupPath, workerSetupSh(monorepoRoot));
+		fs$1.chmodSync(setupPath, 493);
+		fs$1.writeFileSync(path$2.join(outDir, "README.md"), workerReadme(agentNames, secretNames, optionalSettings));
 	} else if (target === "vercel") {
-		fs$2.mkdirSync(path$2.join(outDir, "api"), { recursive: true });
-		fs$2.writeFileSync(path$2.join(outDir, "api", "[[...route]].ts"), vercelRouteTs(agentSlugs));
-		fs$2.writeFileSync(path$2.join(outDir, "vercel.json"), vercelJson());
-		fs$2.writeFileSync(path$2.join(outDir, "package.json"), vercelPackageJson(projectName, "workspace:*"));
-		fs$2.writeFileSync(path$2.join(outDir, "tsconfig.json"), vercelTsconfigJson());
+		fs$1.mkdirSync(path$2.join(outDir, "api"), { recursive: true });
+		fs$1.writeFileSync(path$2.join(outDir, "api", "[[...route]].ts"), vercelRouteTs(agentSlugs));
+		fs$1.writeFileSync(path$2.join(outDir, "vercel.json"), vercelJson());
+		fs$1.writeFileSync(path$2.join(outDir, "package.json"), vercelPackageJson(projectName, "workspace:*"));
+		fs$1.writeFileSync(path$2.join(outDir, "tsconfig.json"), vercelTsconfigJson());
 		const setupPath = path$2.join(outDir, "setup.sh");
-		fs$2.writeFileSync(setupPath, vercelSetupSh(monorepoRoot));
-		fs$2.chmodSync(setupPath, 493);
-		fs$2.writeFileSync(path$2.join(outDir, "README.md"), vercelReadme(agentNames, secretNames, optionalSettings));
+		fs$1.writeFileSync(setupPath, vercelSetupSh(monorepoRoot));
+		fs$1.chmodSync(setupPath, 493);
+		fs$1.writeFileSync(path$2.join(outDir, "README.md"), vercelReadme(agentNames, secretNames, optionalSettings));
 	} else {
-		fs$2.writeFileSync(path$2.join(outDir, "server.ts"), serverTs());
-		fs$2.writeFileSync(path$2.join(outDir, "Dockerfile"), dockerfile());
-		fs$2.writeFileSync(path$2.join(outDir, ".dockerignore"), dockerignore());
-		fs$2.writeFileSync(path$2.join(outDir, "tsconfig.json"), tsconfigJson());
-		fs$2.writeFileSync(path$2.join(outDir, "package.json"), packageJson(projectName, "workspace:*"));
+		fs$1.writeFileSync(path$2.join(outDir, "server.ts"), serverTs());
+		fs$1.writeFileSync(path$2.join(outDir, "Dockerfile"), dockerfile());
+		fs$1.writeFileSync(path$2.join(outDir, ".dockerignore"), dockerignore());
+		fs$1.writeFileSync(path$2.join(outDir, "tsconfig.json"), tsconfigJson());
+		fs$1.writeFileSync(path$2.join(outDir, "package.json"), packageJson(projectName, "workspace:*"));
 		const setupPath = path$2.join(outDir, "setup.sh");
-		fs$2.writeFileSync(setupPath, setupSh(monorepoRoot));
-		fs$2.chmodSync(setupPath, 493);
-		fs$2.writeFileSync(path$2.join(outDir, "README.md"), readme(agentNames, secretNames, optionalSettings));
+		fs$1.writeFileSync(setupPath, setupSh(monorepoRoot));
+		fs$1.chmodSync(setupPath, 493);
+		fs$1.writeFileSync(path$2.join(outDir, "README.md"), readme(agentNames, secretNames, optionalSettings));
 	}
 	console.log("");
 	console.log(chalk.green(`✓ Scaffold written to ${outDir}`));
@@ -48900,13 +49748,13 @@ const agentExportRuntimeCommand = new Command("export-runtime").description("Exp
 		if (options.format === "json") {
 			const exported = await client.agents.exportRuntime(id, selector.params);
 			const body = `${JSON.stringify(exported, null, 2)}\n`;
-			if (options.output) fs$2.writeFileSync(path$2.resolve(options.output), body);
+			if (options.output) fs$1.writeFileSync(path$2.resolve(options.output), body);
 			else process.stdout.write(body);
 			return;
 		}
 		const bundle = await client.agents.exportRuntimeBundle(id, selector.params);
 		const outPath = path$2.resolve(options.output ?? bundle.fileName);
-		fs$2.writeFileSync(outPath, bundle.bytes);
+		fs$1.writeFileSync(outPath, bundle.bytes);
 		console.log(JSON.stringify({
 			path: outPath,
 			bytes: bundle.bytes.byteLength,
@@ -56436,7 +57284,7 @@ npm install -g @runtypelabs/cli
 runtype auth status
 \`\`\`
 
-Reuse an installed CLI rather than reinstalling it. If status reports \`authenticated\` with \`accountState: "full"\`, skip to step 3. If it reports a pending signup, follow its \`next\` command instead of registering again. If \`RUNTYPE_API_KEY\` is configured, verify it with \`runtype auth whoami --no-tty\` and reuse that account before following stored signup state: \`auth status\` only inspects stored credentials. Never print the key.
+Reuse an installed CLI rather than reinstalling it. If status reports \`authenticated\` with \`accountState: "full"\`, skip to step 3. If it reports a pending signup, follow its \`next\` command instead of registering again. If it reports \`unauthenticated\` with a non-null \`requestedOrgId\`, this directory is linked to an organization (\`.runtype/project.json\`, \`--org\`, or \`RUNTYPE_ORG\`) that has no stored login: do not register a new account. Have the user privately run \`runtype auth login --api-key <key>\` with a key from that organization (or \`runtype login\` in their own terminal), then verify with \`runtype auth whoami --no-tty\`. If the link looks wrong, confirm with the user before \`runtype unlink\`. If \`RUNTYPE_API_KEY\` is configured, verify it with \`runtype auth whoami --no-tty\` and reuse that account before following stored signup state: \`auth status\` only inspects stored credentials. Never print the key.
 
 ### 2. Sign the user up from the terminal
 
@@ -56525,7 +57373,9 @@ The signup commands wrap the agent auth protocol documented at \`https://runtype
 - \`runtype auth claim <email>\` — re-send or change the email for a pending signup
 - \`runtype auth verify <code>\` — finish signup with the 6-digit code
 - \`runtype auth login --api-key <key>\` — privately store an existing credential; not an account-creation command
-- \`runtype auth status\` — inspect stored login and pending signup state
+- \`runtype auth status\` — inspect the login this directory uses, linked-org state, and pending signup state
+- \`runtype auth accounts\` — list stored logins (one per organization)
+- \`runtype link <orgId>\` — pin the current project to an organization (writes \`.runtype/project.json\`, no secrets)
 - \`runtype auth whoami --no-tty\` — verify the effective credential (environment key first, then stored login)
 
 A user-supplied \`RUNTYPE_API_KEY\` environment variable also authenticates API-backed CLI commands without a stored login; \`auth status\` still describes only the stored state. Never print a credential into the transcript or write one into a committed file.
@@ -58293,7 +59143,8 @@ const FORWARDED_REQUEST_HEADERS = /* @__PURE__ */ new Set([
 	"authorization",
 	"a2a-version",
 	"content-type",
-	"x-api-key"
+	"x-api-key",
+	"x-runtype-identity"
 ]);
 const BLOCKED_AUTH_HEADERS = /* @__PURE__ */ new Set([
 	"host",
@@ -58396,7 +59247,7 @@ function readIdentity(value) {
 function resolveDeviceListenName(requested) {
 	const explicit = requested?.trim();
 	if (explicit) return explicit.slice(0, 120);
-	const hostname = os$1.hostname().trim();
+	const hostname = os.hostname().trim();
 	if (!hostname) return "This computer";
 	return hostname.slice(0, 120);
 }
@@ -58416,8 +59267,8 @@ async function signDeviceListenChallenge(identity, input) {
 	});
 }
 function deviceListenEncryptionKey() {
-	const hostname = os$1.hostname();
-	const username = os$1.userInfo().username;
+	const hostname = os.hostname();
+	const username = os.userInfo().username;
 	return createHash("sha256").update(`runtype-device-listen-${hostname}-${username}`).digest("hex");
 }
 function isCorruptStoreError(error) {
@@ -58971,8 +59822,8 @@ var MacOSDeviceProvider = class {
 	constructor(options = {}) {
 		this.platform = options.platform ?? process.platform;
 		this.architecture = options.architecture ?? process.arch;
-		this.operatingSystemRelease = options.operatingSystemRelease ?? os$1.release();
-		this.homeDirectory = options.homeDirectory ?? os$1.homedir();
+		this.operatingSystemRelease = options.operatingSystemRelease ?? os.release();
+		this.homeDirectory = options.homeDirectory ?? os.homedir();
 		this.workingDirectory = options.workingDirectory ?? process.cwd();
 		this.environment = options.environment ?? process.env;
 		this.sidecarTimeoutMs = options.sidecarTimeoutMs ?? DEFAULT_SIDECAR_TIMEOUT_MS;
@@ -59674,6 +60525,7 @@ function registerGlobalOptionForwarding(program) {
 		const options = actionCommand.optsWithGlobals();
 		const invocation = {
 			apiUrl: apiUrls.at(-1),
+			org: typeof options.org === "string" && options.org ? options.org : void 0,
 			expectApiUrl: options.expectApiUrl,
 			expectOrg: options.expectOrg,
 			noInput: options.input === false || options.noInput === true,
@@ -59699,10 +60551,12 @@ function registerGlobalOptionForwarding(program) {
 //#region src/index.ts
 loadEnv();
 const program = new Command();
-program.name("runtype").description("CLI for Runtype AI Platform").version(getCliVersion()).option("-v, --verbose", "Enable verbose output").option("--api-url <url>", "API URL (flag > env > saved config > credential endpoint > default)").option("--expect-api-url <url>", "Refuse actions unless the effective API URL matches").option("--expect-org <id>", "Require authenticated organization ID before API actions").option("--no-input", "Disable prompts; destructive delete/revoke/reset requires --yes").option("-y, --yes", "Explicitly consent to destructive commands in --no-input mode").option("--json", "Output as JSON").action(() => program.outputHelp());
+program.name("runtype").description("CLI for Runtype AI Platform").version(getCliVersion()).option("-v, --verbose", "Enable verbose output").option("--api-url <url>", "API URL (flag > env > project link > saved config > credential endpoint > default)").option("--org <id>", "Use the stored login for this organization (overrides RUNTYPE_ORG and .runtype/project.json)").option("--expect-api-url <url>", "Refuse actions unless the effective API URL matches").option("--expect-org <id>", "Require authenticated organization ID before API actions").option("--no-input", "Disable prompts; destructive delete/revoke/reset requires --yes").option("-y, --yes", "Explicitly consent to destructive commands in --no-input mode").option("--json", "Output as JSON").action(() => program.outputHelp());
 program.addCommand(initCommand);
 program.addCommand(loginCommand);
 program.addCommand(authCommand);
+program.addCommand(linkCommand);
+program.addCommand(unlinkCommand);
 program.addCommand(flowsCommand);
 program.addCommand(recordsCommand);
 program.addCommand(collectionsCommand);
@@ -59801,7 +60655,7 @@ run().catch((error) => {
 	}
 });
 async function handleNoCommand() {
-	if (!await new CredentialStore().hasCredentials()) {
+	if (!((await new CredentialStore().listAccounts()).length > 0) && !process.env.RUNTYPE_API_KEY) {
 		console.log(chalk.cyan("\nWelcome to Runtype CLI!\n"));
 		console.log("It looks like this is your first time. Run the setup wizard:");
 		console.log(`  ${chalk.green("runtype init")}\n`);