groundmail-cli 0.15.0 → 0.16.0

package/dist/cli.js

@@ -1264,6 +1264,866 @@ async function runListKeysCommandWithClient(args, env = process.env) {
   }
 }
 
+// src/session/brand.ts
+var GROUNDMAIL = {
+  bin: "groundmail",
+  product: "Groundmail",
+  configDirName: "groundmail",
+  keyEnvVar: "GROUNDMAIL_API_KEY",
+  npx: "npx -y groundmail-cli@latest"
+};
+function cliBrand(_env = process.env) {
+  return GROUNDMAIL;
+}
+var SDK_DEFAULT_API_URL = "https://api.groundmail.dev";
+var DEFAULT_API_URL_ENV = "GROUNDMAIL_DEFAULT_API_URL";
+function defaultApiUrl(env = process.env) {
+  return trimUrl(env[DEFAULT_API_URL_ENV]) || SDK_DEFAULT_API_URL;
+}
+function explicitApiUrl(env = process.env) {
+  return trimUrl(env.GROUNDMAIL_API_URL) || null;
+}
+function trimUrl(value) {
+  return (value ?? "").trim().replace(/\/+$/, "");
+}
+
+// package.json
+var version = "0.16.0";
+
+// src/user-agent.ts
+function buildUserAgent(own) {
+  return `${own.name}/${own.version} node/${process.versions.node}`;
+}
+function withUserAgent(init, userAgent) {
+  const headers = init?.headers;
+  if (headers instanceof Headers) {
+    const next = new Headers(headers);
+    if (!next.has("user-agent")) next.set("User-Agent", userAgent);
+    return { ...init, headers: next };
+  }
+  if (Array.isArray(headers)) {
+    const has2 = headers.some(([key]) => key.toLowerCase() === "user-agent");
+    return { ...init, headers: has2 ? headers : [...headers, ["User-Agent", userAgent]] };
+  }
+  const record = headers ?? {};
+  const has = Object.keys(record).some((key) => key.toLowerCase() === "user-agent");
+  return { ...init, headers: has ? record : { ...record, "User-Agent": userAgent } };
+}
+function fetchWithUserAgent(userAgent) {
+  return ((input, init) => globalThis.fetch(input, withUserAgent(init, userAgent)));
+}
+
+// src/client-info.ts
+var CLI_PACKAGE = { name: "groundmail-cli", version };
+
+// src/session/http.ts
+var CliRequestError = class extends Error {
+};
+async function apiRequest(baseUrl, path, options = {}) {
+  const doFetch = fetchWithUserAgent(buildUserAgent(CLI_PACKAGE));
+  const url = `${baseUrl.replace(/\/+$/, "")}${path}`;
+  let response;
+  try {
+    response = await doFetch(url, {
+      method: options.method ?? (options.body === void 0 ? "GET" : "POST"),
+      headers: {
+        Accept: "application/json",
+        ...options.body === void 0 ? {} : { "Content-Type": "application/json" },
+        ...options.apiKey ? { Authorization: `Bearer ${options.apiKey}` } : {}
+      },
+      ...options.body === void 0 ? {} : { body: JSON.stringify(options.body) }
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new CliRequestError(`Could not reach ${baseUrl}: ${reason}`);
+  }
+  const text = await response.text();
+  let body = {};
+  try {
+    const parsed = text ? JSON.parse(text) : {};
+    body = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : { value: parsed };
+  } catch {
+    body = { error: text.slice(0, 300) || `HTTP ${response.status}` };
+  }
+  return { ok: response.ok, status: response.status, body };
+}
+function sentence(text) {
+  return /[.!?…)]$/.test(text.trim()) ? text.trim() : `${text.trim()}.`;
+}
+function errorMessage(response, fallback) {
+  const error = response.body.error;
+  if (typeof error === "string" && error.trim()) return error.trim();
+  if (error && typeof error === "object") {
+    const message = error.message;
+    if (typeof message === "string" && message.trim()) return message.trim();
+  }
+  return `${fallback} (HTTP ${response.status}).`;
+}
+
+// src/commands/login.ts
+import { spawn } from "child_process";
+import { hostname } from "os";
+
+// src/session/args.ts
+var COMMON_VALUE_FLAGS = ["--api-key", "--base-url", "--workspace"];
+var COMMON_BOOLEAN_FLAGS = ["--json"];
+function parseArgs(argv, spec) {
+  const valueFlags = new Set(spec.values ?? []);
+  const booleanFlags = new Set(spec.booleans ?? []);
+  const values = {};
+  const booleans = {};
+  const positionals = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (!arg.startsWith("--") || arg === "-") {
+      positionals.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const name = eq === -1 ? arg : arg.slice(0, eq);
+    if (valueFlags.has(name)) {
+      const value = eq === -1 ? argv[i + 1] : arg.slice(eq + 1);
+      if (value === void 0 || eq === -1 && value.startsWith("--")) {
+        return { ok: false, error: `${name} needs a value.` };
+      }
+      values[name] = value;
+      if (eq === -1) i++;
+      continue;
+    }
+    if (booleanFlags.has(name) && eq === -1) {
+      booleans[name] = true;
+      continue;
+    }
+    const negated = name.startsWith("--no-") ? `--${name.slice("--no-".length)}` : null;
+    if (negated && booleanFlags.has(negated) && eq === -1) {
+      booleans[negated] = false;
+      continue;
+    }
+    const known = [...valueFlags, ...booleanFlags].sort().join(", ");
+    return { ok: false, error: `Unknown flag ${name}.${known ? ` This command takes: ${known}.` : ""}` };
+  }
+  return { ok: true, args: { values, booleans, positionals } };
+}
+function wantsJson(args, stdout = process.stdout) {
+  if (args.booleans["--json"] !== void 0) return args.booleans["--json"];
+  return !stdout.isTTY;
+}
+var EXIT_OK = 0;
+var EXIT_FAILED = 1;
+var EXIT_USAGE = 2;
+
+// src/session/config.ts
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function configDir(env = process.env) {
+  const override2 = env.GROUNDMAIL_CONFIG_DIR?.trim();
+  if (override2) return override2;
+  const base = env.XDG_CONFIG_HOME?.trim() || (process.platform === "win32" ? env.APPDATA?.trim() || join(homedir(), "AppData", "Roaming") : "") || join(homedir(), ".config");
+  return join(base, cliBrand(env).configDirName);
+}
+function configPath(env = process.env) {
+  return join(configDir(env), "config.json");
+}
+function loadConfig(env = process.env) {
+  try {
+    const parsed = JSON.parse(readFileSync(configPath(env), "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const record = parsed;
+    const workspaces = {};
+    for (const [id, entry] of Object.entries(record.workspaces ?? {})) {
+      const hasKey = typeof entry?.apiKey === "string" && entry.apiKey.length > 0;
+      const hasOAuth = Boolean(entry?.oauth && typeof entry.oauth === "object" && typeof entry.oauth.clientId === "string");
+      if (entry && typeof entry.id === "string" && (hasKey || hasOAuth)) {
+        workspaces[id] = entry;
+      }
+    }
+    return {
+      ...typeof record.current === "string" && workspaces[record.current] ? { current: record.current } : {},
+      workspaces,
+      ...record.pendingLogin && typeof record.pendingLogin.deviceCode === "string" ? { pendingLogin: record.pendingLogin } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function saveConfig(config, env = process.env) {
+  const file = configPath(env);
+  mkdirSync(dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  renameSync(tmp, file);
+  try {
+    chmodSync(file, 384);
+  } catch {
+  }
+}
+function updateConfig(change, env = process.env) {
+  const next = change(loadConfig(env));
+  saveConfig(next, env);
+  return next;
+}
+function savedWorkspaces(config) {
+  return Object.values(config.workspaces ?? {}).sort((a, b) => a.name.localeCompare(b.name));
+}
+function findSavedWorkspace(config, wanted) {
+  const all = savedWorkspaces(config);
+  const key = wanted.trim();
+  const byId = all.find((workspace) => workspace.id === key);
+  if (byId) return { ok: true, workspace: byId };
+  const byName = all.filter((workspace) => workspace.name.trim().toLowerCase() === key.toLowerCase());
+  if (byName.length === 1) return { ok: true, workspace: byName[0] };
+  return { ok: false, reason: byName.length ? "ambiguous" : "none", matches: byName };
+}
+
+// src/session/keychain.ts
+import { createRequire } from "module";
+var SERVICE = "groundmail-cli";
+var override;
+var cached;
+function platformLabel() {
+  if (process.platform === "darwin") return "the macOS Keychain";
+  if (process.platform === "win32") return "Windows Credential Manager";
+  return "the system keyring";
+}
+function loadKeyring() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    return require2("@napi-rs/keyring");
+  } catch {
+    return null;
+  }
+}
+function secretStore(env = process.env) {
+  if (override !== void 0) return override;
+  if (/^(1|true|yes)$/i.test(env.GROUNDMAIL_NO_KEYCHAIN?.trim() ?? "")) return null;
+  if (cached !== void 0) return cached;
+  const keyring = loadKeyring();
+  if (!keyring) {
+    cached = null;
+    return cached;
+  }
+  cached = {
+    label: platformLabel(),
+    get(account) {
+      try {
+        return new keyring.Entry(SERVICE, account).getPassword() ?? null;
+      } catch {
+        return null;
+      }
+    },
+    set(account, secret) {
+      try {
+        const entry = new keyring.Entry(SERVICE, account);
+        entry.setPassword(secret);
+        return entry.getPassword() === secret;
+      } catch {
+        return false;
+      }
+    },
+    delete(account) {
+      try {
+        new keyring.Entry(SERVICE, account).deletePassword();
+      } catch {
+      }
+    }
+  };
+  return cached;
+}
+
+// src/session/oauth.ts
+var CLI_OAUTH_CLIENT_ID = "groundmail-cli";
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var EXPIRY_SKEW_MS = 60 * 1e3;
+function oauthErrorCode(response) {
+  const error = response.body.error;
+  return typeof error === "string" ? error : null;
+}
+function oauthErrorMessage(response, fallback) {
+  const description = response.body.error_description;
+  if (typeof description === "string" && description.trim()) return description.trim();
+  return errorMessage(response, fallback);
+}
+function isTokenSet(body) {
+  return typeof body.access_token === "string" && typeof body.refresh_token === "string";
+}
+function keychainAccount(apiUrl, workspaceId) {
+  return `${apiUrl.replace(/\/+$/, "")}#${workspaceId}`;
+}
+function storeRefreshToken(input, env = process.env) {
+  const keychain = secretStore(env);
+  if (keychain?.set(keychainAccount(input.apiUrl, input.workspaceId), input.refreshToken)) {
+    return { clientId: CLI_OAUTH_CLIENT_ID, scope: input.scope, store: "keychain" };
+  }
+  return { clientId: CLI_OAUTH_CLIENT_ID, scope: input.scope, store: "file", refreshToken: input.refreshToken };
+}
+function readRefreshToken(workspace, apiUrl, env = process.env) {
+  const oauth = workspace.oauth;
+  if (!oauth) return null;
+  if (oauth.store === "file") return oauth.refreshToken ?? null;
+  return secretStore(env)?.get(keychainAccount(apiUrl, workspace.id)) ?? null;
+}
+function forgetRefreshToken(workspace, apiUrl, env = process.env) {
+  if (workspace.oauth?.store === "keychain") secretStore(env)?.delete(keychainAccount(apiUrl, workspace.id));
+}
+function storeLabel(oauth, configFile, env = process.env) {
+  return oauth.store === "keychain" ? secretStore(env)?.label ?? "the system keychain" : `${configFile} (readable by you only)`;
+}
+async function refresh(apiUrl, refreshToken, scope, env) {
+  return apiRequest(apiUrl, "/oauth/token", {
+    body: {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLI_OAUTH_CLIENT_ID,
+      ...scope ? { scope } : {}
+    },
+    env
+  });
+}
+async function accessTokenFor(workspace, apiUrl, options = {}) {
+  const env = options.env ?? process.env;
+  const now = options.now ?? Date.now;
+  const brand = cliBrand(env);
+  const oauth = workspace.oauth;
+  if (!oauth) return { ok: false, error: "Not an OAuth sign-in." };
+  const narrowed = Boolean(options.scope && options.scope.trim() !== oauth.scope);
+  if (!narrowed && oauth.accessToken && (oauth.accessTokenExpiresAt ?? 0) - EXPIRY_SKEW_MS > now()) {
+    return { ok: true, token: oauth.accessToken, scope: oauth.scope };
+  }
+  const signInAgain = `Run ${brand.bin} login${workspace.name ? ` --workspace "${workspace.name}"` : ""} to sign in again.`;
+  let refreshToken = readRefreshToken(workspace, apiUrl, env);
+  if (!refreshToken) return { ok: false, error: `The saved sign-in for ${workspace.name} has no refresh token. ${signInAgain}` };
+  for (let attempt = 0; attempt < 2; attempt++) {
+    const response = await refresh(apiUrl, refreshToken, narrowed ? options.scope.trim() : null, env);
+    if (response.ok && isTokenSet(response.body)) {
+      const tokens = response.body;
+      const stored = storeRefreshToken({ apiUrl, workspaceId: workspace.id, refreshToken: tokens.refresh_token, scope: oauth.scope }, env);
+      updateConfig((config) => {
+        const current = config.workspaces?.[workspace.id];
+        if (!current) return config;
+        const next = {
+          ...stored,
+          scope: oauth.scope,
+          ...narrowed ? { accessToken: current.oauth?.accessToken, accessTokenExpiresAt: current.oauth?.accessTokenExpiresAt } : { accessToken: tokens.access_token, accessTokenExpiresAt: now() + tokens.expires_in * 1e3 }
+        };
+        return { ...config, workspaces: { ...config.workspaces, [workspace.id]: { ...current, oauth: next } } };
+      }, env);
+      return { ok: true, token: tokens.access_token, scope: tokens.scope };
+    }
+    const code = oauthErrorCode(response);
+    if (code === "invalid_grant" && attempt === 0) {
+      const latest = loadConfig(env).workspaces?.[workspace.id];
+      const latestToken = latest ? readRefreshToken(latest, apiUrl, env) : null;
+      if (latest?.oauth && latestToken && latestToken !== refreshToken) {
+        if (!narrowed && latest.oauth.accessToken && (latest.oauth.accessTokenExpiresAt ?? 0) - EXPIRY_SKEW_MS > now()) {
+          return { ok: true, token: latest.oauth.accessToken, scope: latest.oauth.scope };
+        }
+        refreshToken = latestToken;
+        continue;
+      }
+    }
+    if (code === "invalid_grant") {
+      return { ok: false, error: `${oauthErrorMessage(response, "The sign-in is no longer valid")} ${signInAgain}`.trim() };
+    }
+    if (code === "invalid_scope") {
+      return { ok: false, error: `${oauthErrorMessage(response, "That scope was not approved for this sign-in")} To get it: ${brand.bin} login --scope "${options.scope ?? ""}".` };
+    }
+    return { ok: false, error: oauthErrorMessage(response, "Could not refresh the access token") };
+  }
+  return { ok: false, error: `The sign-in is no longer valid. ${signInAgain}` };
+}
+async function revokeRefreshToken(apiUrl, refreshToken, env = process.env) {
+  return apiRequest(apiUrl, "/oauth/revoke", {
+    body: { token: refreshToken, token_type_hint: "refresh_token", client_id: CLI_OAUTH_CLIENT_ID },
+    env
+  });
+}
+
+// src/session/credentials.ts
+function envApiKey(env = process.env) {
+  return env.GROUNDMAIL_API_KEY?.trim() || null;
+}
+function currentSavedWorkspace(config, env = process.env) {
+  const brand = cliBrand(env);
+  const all = savedWorkspaces(config);
+  if (config.current && config.workspaces?.[config.current]) {
+    return { ok: true, workspace: config.workspaces[config.current] };
+  }
+  if (all.length === 1) return { ok: true, workspace: all[0] };
+  if (all.length === 0) {
+    return {
+      ok: false,
+      reason: "none",
+      error: `Not signed in. Run: ${brand.bin} login (it prints a link to approve in the browser). Or set ${brand.keyEnvVar}.`
+    };
+  }
+  return {
+    ok: false,
+    reason: "ambiguous",
+    error: `Signed in to ${all.length} workspaces on this computer and none is picked: ${all.map((workspace) => `"${workspace.name}"`).join(", ")}. Pick one: ${brand.bin} workspaces use <name>, or pass --workspace <name>.`
+  };
+}
+function savedApiUrl(workspace, env = process.env, flagUrl) {
+  return trimUrl(flagUrl) || explicitApiUrl(env) || trimUrl(workspace?.apiUrl) || defaultApiUrl(env);
+}
+async function savedCredential(workspace, env = process.env) {
+  if (workspace.oauth) {
+    const issuer = trimUrl(workspace.apiUrl) || defaultApiUrl(env);
+    const token = await accessTokenFor(workspace, issuer, { env });
+    return token.ok ? { ok: true, token: token.token, kind: "oauth" } : token;
+  }
+  if (workspace.apiKey) return { ok: true, token: workspace.apiKey, kind: "api_key" };
+  return { ok: false, error: `The saved sign-in for ${workspace.name} has no credential. Run ${cliBrand(env).bin} login.` };
+}
+async function resolveAuth(flags, env = process.env, config = loadConfig(env)) {
+  const brand = cliBrand(env);
+  const flagUrl = trimUrl(flags.baseUrl) || null;
+  const urlFor = (workspace) => savedApiUrl(workspace, env, flagUrl);
+  const flagKey = flags.apiKey?.trim();
+  if (flagKey) {
+    return { ok: true, auth: { apiKey: flagKey, baseUrl: urlFor(null), source: "flag", kind: "api_key", workspace: null } };
+  }
+  const fromSaved = async (workspace) => {
+    const baseUrl = urlFor(workspace);
+    const credential = await savedCredential(workspace, env);
+    if (!credential.ok) return credential;
+    return { ok: true, auth: { apiKey: credential.token, baseUrl, source: "saved", kind: credential.kind, workspace } };
+  };
+  if (flags.workspace?.trim()) {
+    const match = findSavedWorkspace(config, flags.workspace);
+    if (!match.ok) {
+      const saved = savedWorkspaces(config);
+      return {
+        ok: false,
+        error: match.reason === "ambiguous" ? `More than one saved workspace is called "${flags.workspace}". Use its id: ${match.matches.map((w) => w.id).join(", ")}.` : `Not signed in to "${flags.workspace}" on this computer.${saved.length ? ` Signed in: ${saved.map((w) => `"${w.name}"`).join(", ")}.` : ""} To add it: ${brand.bin} login --workspace "${flags.workspace}".`
+      };
+    }
+    return fromSaved(match.workspace);
+  }
+  const fromEnv = envApiKey(env);
+  if (fromEnv) {
+    return { ok: true, auth: { apiKey: fromEnv, baseUrl: urlFor(null), source: "env", kind: "api_key", workspace: null } };
+  }
+  const current = currentSavedWorkspace(config, env);
+  if (!current.ok) return { ok: false, error: current.error };
+  return fromSaved(current.workspace);
+}
+async function applySavedSession(argv, env = process.env, config) {
+  const hasFlag = (flag) => argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
+  let workspace = null;
+  let notice;
+  if (!hasFlag("--api-key") && !envApiKey(env)) {
+    const current = currentSavedWorkspace(config ?? loadConfig(env), env);
+    if (current.ok) {
+      workspace = current.workspace;
+      const credential = await savedCredential(current.workspace, env);
+      if (credential.ok) env.GROUNDMAIL_API_KEY = credential.token;
+      else notice = credential.error;
+    } else if (current.reason === "ambiguous") {
+      notice = current.error;
+    }
+  }
+  if (hasFlag("--base-url")) return { argv, notice };
+  const url = explicitApiUrl(env) || trimUrl(workspace?.apiUrl) || trimUrl(env.GROUNDMAIL_DEFAULT_API_URL);
+  return { argv: url ? [...argv, "--base-url", url] : argv, notice };
+}
+
+// src/session/io.ts
+var processIo = {
+  out: (text) => process.stdout.write(text.endsWith("\n") ? text : `${text}
+`),
+  err: (text) => process.stderr.write(text.endsWith("\n") ? text : `${text}
+`),
+  get isTTY() {
+    return Boolean(process.stdout.isTTY);
+  }
+};
+function printJson(io, value) {
+  io.out(JSON.stringify(value, null, 2));
+}
+
+// src/commands/login.ts
+var realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var CLI_SCOPES = [
+  "full",
+  "emails:send",
+  "emails:read",
+  "domains:read",
+  "domains:write",
+  "webhooks:write",
+  "templates:write",
+  "suppressions:write",
+  "account:read"
+];
+function parseScopeFlag(value) {
+  const tokens = String(value ?? "").split(/[\s,]+/).map((token) => token.trim()).filter(Boolean);
+  if (!tokens.length) return { ok: true, scope: "full" };
+  const unknown = tokens.filter((token) => !CLI_SCOPES.includes(token));
+  if (unknown.length) {
+    return { ok: false, error: `Unknown scope: ${unknown.join(", ")}. Scopes: ${CLI_SCOPES.join(", ")}.` };
+  }
+  if (tokens.includes("full")) return { ok: true, scope: "full" };
+  return { ok: true, scope: CLI_SCOPES.filter((scope) => tokens.includes(scope)).join(" ") };
+}
+function openInBrowser(url) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function sourceLabel(source, env) {
+  if (source === "flag") return "--api-key";
+  if (source === "env") return cliBrand(env).keyEnvVar;
+  return "saved login";
+}
+function defaultDeviceName() {
+  try {
+    return hostname().slice(0, 80) || "this computer";
+  } catch {
+    return "this computer";
+  }
+}
+var dropPending = (env) => updateConfig(({ pendingLogin: _drop, ...rest }) => rest, env);
+async function runLoginCommand(argv, deps = {}) {
+  const io = deps.io ?? processIo;
+  const env = deps.env ?? process.env;
+  const sleep = deps.sleep ?? realSleep;
+  const now = deps.now ?? Date.now;
+  const brand = cliBrand(env);
+  const usage = `Usage: ${brand.bin} login [--scope <scopes>] [--workspace <name>] [--new] [--no-browser] [--wait|--no-wait] [--json]`;
+  const parsed = parseArgs(argv, {
+    values: ["--base-url", "--workspace", "--scope", "--device-name"],
+    booleans: ["--json", "--browser", "--wait", "--new"]
+  });
+  if (!parsed.ok) return { exitCode: EXIT_USAGE, error: `${parsed.error}
+${usage}` };
+  const { args } = parsed;
+  if (args.positionals.length) {
+    return { exitCode: EXIT_USAGE, error: `${brand.bin} login takes no arguments. To sign in to a workspace by name: ${brand.bin} login --workspace "<name>".` };
+  }
+  const scopeFlag = parseScopeFlag(args.values["--scope"]);
+  if (!scopeFlag.ok) return { exitCode: EXIT_USAGE, error: `${scopeFlag.error}
+${usage}` };
+  const scope = scopeFlag.scope;
+  const json = wantsJson(args, io);
+  const wait = args.booleans["--wait"] ?? io.isTTY;
+  const browser = args.booleans["--browser"] ?? true;
+  const apiUrl = trimUrl(args.values["--base-url"]) || explicitApiUrl(env) || defaultApiUrl(env);
+  const workspaceHint = args.values["--workspace"]?.trim() || null;
+  const deviceName = args.values["--device-name"]?.trim() || (deps.deviceName ?? defaultDeviceName)();
+  try {
+    const config = loadConfig(env);
+    let login = config.pendingLogin;
+    const resumed = Boolean(
+      !args.booleans["--new"] && login && login.kind === "oauth" && login.apiUrl === apiUrl && login.expiresAt > now() + 5e3 && (login.workspace ?? null) === workspaceHint && (login.scope ?? "full") === scope
+    );
+    if (!resumed && !workspaceHint && !args.booleans["--new"] && !args.values["--scope"]) {
+      const current = currentSavedWorkspace(config, env);
+      if (current.ok && current.workspace.oauth && (trimUrl(current.workspace.apiUrl) || defaultApiUrl(env)) === apiUrl) {
+        const next = `To sign in to another workspace: ${brand.bin} login --workspace "<name>". For other scopes: ${brand.bin} login --scope <scopes>. To sign in as someone else: ${brand.bin} logout, then ${brand.bin} login.`;
+        if (json) {
+          printJson(io, {
+            status: "signed_in",
+            already: true,
+            workspace: { id: current.workspace.id, name: current.workspace.name },
+            email: current.workspace.email ?? null,
+            scope: current.workspace.oauth.scope,
+            config_path: configPath(env),
+            next
+          });
+        } else {
+          io.out(`Already signed in${current.workspace.email ? ` as ${current.workspace.email}` : ""} to ${current.workspace.name}.
+${next}`);
+        }
+        return { exitCode: EXIT_OK };
+      }
+    }
+    if (!resumed) {
+      const start = await apiRequest(apiUrl, "/oauth/device_authorization", {
+        body: {
+          client_id: CLI_OAUTH_CLIENT_ID,
+          scope,
+          device_name: deviceName,
+          ...workspaceHint ? { workspace: workspaceHint } : {}
+        },
+        env
+      });
+      if (!start.ok) return { exitCode: EXIT_FAILED, error: oauthErrorMessage(start, "Could not start the sign-in") };
+      const body = start.body;
+      const url = typeof body.verification_uri_complete === "string" ? body.verification_uri_complete : body.verification_uri;
+      if (typeof body.device_code !== "string" || typeof body.user_code !== "string" || typeof url !== "string") {
+        return { exitCode: EXIT_FAILED, error: `Unexpected answer from ${apiUrl}/oauth/device_authorization. Is --base-url right?` };
+      }
+      login = {
+        kind: "oauth",
+        scope,
+        deviceCode: body.device_code,
+        userCode: body.user_code,
+        url,
+        interval: Math.max(1, Number(body.interval) || 5),
+        expiresAt: now() + (Number(body.expires_in) || 600) * 1e3,
+        apiUrl,
+        workspace: workspaceHint
+      };
+      const pending = login;
+      updateConfig((current) => ({ ...current, pendingLogin: pending }), env);
+    }
+    const active = login;
+    const link = `${resumed ? "Still waiting for approval" : `Sign in to ${brand.product}`}: open this link and approve code ${active.userCode}
+  ${active.url}`;
+    if (!json) {
+      io.out(`${link}${wait ? "\nWaiting\u2026 (Ctrl-C to stop; run the same command again to pick up where you left off)" : ""}`);
+    } else if (wait) {
+      io.err(link);
+    }
+    if (browser && !resumed && !env.CI) (deps.openBrowser ?? openInBrowser)(active.url);
+    let interval = active.interval;
+    for (; ; ) {
+      const poll = await apiRequest(apiUrl, "/oauth/token", {
+        body: { grant_type: DEVICE_CODE_GRANT_TYPE, device_code: active.deviceCode, client_id: CLI_OAUTH_CLIENT_ID },
+        env
+      });
+      if (poll.ok && isTokenSet(poll.body)) {
+        return finishLogin(poll.body, active, { io, env, json, now });
+      }
+      const code = oauthErrorCode(poll);
+      if (code === "slow_down") interval += 5;
+      else if (code === "access_denied") {
+        dropPending(env);
+        return {
+          exitCode: EXIT_FAILED,
+          error: `${sentence(oauthErrorMessage(poll, "The sign-in was canceled in the browser"))} Run ${brand.bin} login to start again.`
+        };
+      } else if (code !== "authorization_pending") {
+        if (poll.status < 500 && poll.status !== 429) dropPending(env);
+        if (code === "expired_token" || code === "invalid_grant") {
+          return { exitCode: EXIT_FAILED, error: `The sign-in code expired or was already used. Run ${brand.bin} login again.` };
+        }
+        return { exitCode: EXIT_FAILED, error: oauthErrorMessage(poll, "The sign-in check failed") };
+      }
+      if (!wait || now() + interval * 1e3 > active.expiresAt) {
+        const next = `Not signed in yet. Approve code ${active.userCode} in the browser, then run ${brand.bin} login again to finish.`;
+        if (json) {
+          printJson(io, {
+            status: "pending",
+            user_code: active.userCode,
+            verification_url: active.url,
+            expires_at: new Date(active.expiresAt).toISOString(),
+            next
+          });
+        } else {
+          io.out(next);
+        }
+        return { exitCode: EXIT_OK };
+      }
+      await sleep(interval * 1e3);
+    }
+  } catch (error) {
+    if (error instanceof CliRequestError) return { exitCode: EXIT_FAILED, error: error.message };
+    throw error;
+  }
+}
+async function finishLogin(tokens, login, { io, env, json, now }) {
+  const brand = cliBrand(env);
+  const workspace = tokens.workspace ?? {};
+  const user = tokens.user ?? {};
+  const id = typeof workspace.id === "string" && workspace.id ? workspace.id : "default";
+  const scope = typeof tokens.scope === "string" && tokens.scope ? tokens.scope : login.scope ?? "full";
+  const previous = loadConfig(env).workspaces?.[id];
+  let replacedKey = false;
+  if (previous?.apiKey) {
+    const response = await apiRequest(login.apiUrl, "/cli/session", { method: "DELETE", apiKey: previous.apiKey, env }).catch(() => null);
+    replacedKey = Boolean(response?.ok && response.body.revoked === true);
+  }
+  if (previous?.oauth) {
+    const oldRefresh = readRefreshToken(previous, login.apiUrl, env);
+    if (oldRefresh) await revokeRefreshToken(login.apiUrl, oldRefresh, env).catch(() => null);
+  }
+  const stored = storeRefreshToken({ apiUrl: login.apiUrl, workspaceId: id, refreshToken: tokens.refresh_token, scope }, env);
+  const saved = {
+    id,
+    name: typeof workspace.name === "string" && workspace.name ? workspace.name : "Workspace",
+    oauth: { ...stored, accessToken: tokens.access_token, accessTokenExpiresAt: now() + tokens.expires_in * 1e3 },
+    ...login.apiUrl !== defaultApiUrl(env) ? { apiUrl: login.apiUrl } : {},
+    email: typeof user.email === "string" ? user.email : null,
+    savedAt: new Date(now()).toISOString()
+  };
+  const config = updateConfig(({ pendingLogin: _drop, ...rest }) => ({
+    ...rest,
+    workspaces: { ...rest.workspaces ?? {}, [id]: saved },
+    current: id
+  }), env);
+  const others = savedWorkspaces(config).filter((entry) => entry.id !== id);
+  const envKey = envApiKey(env);
+  const envNote = envKey ? `${sourceLabel("env", env)} is set in this environment and is used instead of this sign-in until you unset it.` : null;
+  const where = storeLabel(saved.oauth, configPath(env), env);
+  if (json) {
+    printJson(io, {
+      status: "signed_in",
+      user: tokens.user ?? null,
+      workspace: { id: saved.id, name: saved.name },
+      scope,
+      refresh_token_store: stored.store,
+      config_path: configPath(env),
+      other_workspaces: others.map((entry) => ({ id: entry.id, name: entry.name })),
+      ...replacedKey ? { replaced_api_key: true } : {},
+      ...envNote ? { note: envNote } : {}
+    });
+    return { exitCode: EXIT_OK };
+  }
+  const lines = [
+    `Signed in${saved.email ? ` as ${saved.email}` : ""} to ${saved.name}.`,
+    `Access: ${scope === "full" ? "full" : scope.split(" ").join(", ")}. Tokens refresh on their own; the refresh token is in ${where}.`
+  ];
+  if (replacedKey) lines.push("The API key an earlier login saved was revoked; this sign-in replaces it.");
+  if (others.length) {
+    lines.push(
+      `Also signed in here: ${others.map((entry) => entry.name).join(", ")}. Switch with ${brand.bin} workspaces use <name>.`
+    );
+  }
+  if (envNote) lines.push(envNote);
+  lines.push(`Next: ${brand.bin} domains list`);
+  io.out(lines.join("\n"));
+  return { exitCode: EXIT_OK };
+}
+async function runLogoutCommand(argv, deps = {}) {
+  const io = deps.io ?? processIo;
+  const env = deps.env ?? process.env;
+  const brand = cliBrand(env);
+  const parsed = parseArgs(argv, { values: ["--workspace", "--base-url"], booleans: ["--json", "--all"] });
+  if (!parsed.ok) return { exitCode: EXIT_USAGE, error: `${parsed.error}
+Usage: ${brand.bin} logout [--workspace <name>] [--all]` };
+  const { args } = parsed;
+  const json = wantsJson(args, io);
+  const config = loadConfig(env);
+  const all = savedWorkspaces(config);
+  let targets;
+  if (args.booleans["--all"]) {
+    targets = all;
+  } else if (args.values["--workspace"]) {
+    const match = findSavedWorkspace(config, args.values["--workspace"]);
+    if (!match.ok) {
+      return { exitCode: EXIT_FAILED, error: `Not signed in to "${args.values["--workspace"]}" on this computer.` };
+    }
+    targets = [match.workspace];
+  } else {
+    const current = config.current ? config.workspaces?.[config.current] : all.length === 1 ? all[0] : void 0;
+    if (!current && all.length > 1) {
+      return {
+        exitCode: EXIT_USAGE,
+        error: `Signed in to ${all.length} workspaces and none is picked. Say which: ${brand.bin} logout --workspace <name>, or ${brand.bin} logout --all.`
+      };
+    }
+    targets = current ? [current] : [];
+  }
+  const results = [];
+  for (const workspace of targets) {
+    const apiUrl = trimUrl(args.values["--base-url"]) || explicitApiUrl(env) || trimUrl(workspace.apiUrl) || defaultApiUrl(env);
+    let revoked = false;
+    let warning;
+    try {
+      if (workspace.oauth) {
+        const refreshToken = readRefreshToken(workspace, apiUrl, env);
+        if (refreshToken) {
+          const response = await revokeRefreshToken(apiUrl, refreshToken, env);
+          revoked = response.ok;
+          if (!response.ok) warning = oauthErrorMessage(response, "Could not revoke the sign-in");
+        }
+        forgetRefreshToken(workspace, apiUrl, env);
+      } else if (workspace.apiKey) {
+        const response = await apiRequest(apiUrl, "/cli/session", { method: "DELETE", apiKey: workspace.apiKey, env });
+        revoked = response.ok && response.body.revoked === true;
+        if (!response.ok && response.status !== 401) warning = errorMessage(response, "Could not revoke the key");
+      }
+    } catch (error) {
+      warning = error instanceof Error ? error.message : String(error);
+    }
+    results.push({ id: workspace.id, name: workspace.name, revoked, ...warning ? { warning } : {} });
+  }
+  const removing = new Set(targets.map((workspace) => workspace.id));
+  const hadPending = Boolean(config.pendingLogin);
+  if (removing.size || hadPending) {
+    updateConfig((current) => {
+      const workspaces = Object.fromEntries(
+        Object.entries(current.workspaces ?? {}).filter(([id]) => !removing.has(id))
+      );
+      const { pendingLogin: _drop, current: picked, ...rest } = current;
+      return { ...rest, workspaces, ...picked && !removing.has(picked) ? { current: picked } : {} };
+    }, env);
+  }
+  const envNote = envApiKey(env) ? `${sourceLabel("env", env)} is still set in this environment, so commands keep using it.` : null;
+  if (json) {
+    printJson(io, { signed_out: results, config_path: configPath(env), ...envNote ? { note: envNote } : {} });
+    return { exitCode: EXIT_OK };
+  }
+  if (!results.length) {
+    io.out(`Not signed in on this computer.${envNote ? ` ${envNote}` : ""}`);
+    return { exitCode: EXIT_OK };
+  }
+  const lines = results.map((result) => {
+    const target = targets.find((workspace) => workspace.id === result.id);
+    const what = target?.oauth ? "the sign-in" : "the key";
+    const revokeHint = target?.oauth ? "Revoke it in Settings \u2192 CLIs & agents." : "Revoke it on the API keys page.";
+    return `Signed out of ${result.name}: ${result.revoked ? `${what} was revoked and` : `${what} was`} removed from this computer.${result.warning ? ` (Could not revoke it: ${result.warning} ${revokeHint})` : ""}`;
+  });
+  if (envNote) lines.push(envNote);
+  io.out(lines.join("\n"));
+  return { exitCode: EXIT_OK };
+}
+async function runWhoamiCommand(argv, deps = {}) {
+  const io = deps.io ?? processIo;
+  const env = deps.env ?? process.env;
+  const brand = cliBrand(env);
+  const parsed = parseArgs(argv, { values: [...COMMON_VALUE_FLAGS], booleans: [...COMMON_BOOLEAN_FLAGS] });
+  if (!parsed.ok) return { exitCode: EXIT_USAGE, error: `${parsed.error}
+Usage: ${brand.bin} whoami [--workspace <name>] [--json]` };
+  const { args } = parsed;
+  try {
+    const resolved = await resolveAuth(
+      { apiKey: args.values["--api-key"], baseUrl: args.values["--base-url"], workspace: args.values["--workspace"] },
+      env
+    );
+    if (!resolved.ok) return { exitCode: EXIT_FAILED, error: resolved.error };
+    const { auth } = resolved;
+    const response = await apiRequest(auth.baseUrl, "/cli/session", { apiKey: auth.apiKey, env });
+    if (!response.ok) {
+      const hint = response.status === 401 ? ` The credential was rejected; run ${brand.bin} login to sign in again.` : "";
+      return { exitCode: EXIT_FAILED, error: `${sentence(errorMessage(response, "Could not check the sign-in"))}${hint}` };
+    }
+    const session = response.body;
+    const source = sourceLabel(auth.source, env);
+    if (wantsJson(args, io)) {
+      printJson(io, { ...response.body, source, api_url: auth.baseUrl, config_path: configPath(env) });
+      return { exitCode: EXIT_OK };
+    }
+    const scope = session.scope ?? (session.key?.scope === "sending" ? "emails:send emails:read" : "full");
+    const credential = session.oauth ? `Signed in with OAuth: ${session.oauth.client_name ?? brand.product}${session.oauth.device_name ? ` on ${session.oauth.device_name}` : ""}, from ${source}` : `Key: ${session.key?.name ?? "?"} (${session.key?.prefix ?? "?"}\u2026), from ${source}`;
+    io.out(
+      [
+        session.user?.email ?? "(an API key; no person is recorded for it)",
+        `Workspace: ${session.workspace?.name ?? "?"} (${session.workspace?.id ?? "?"})`,
+        credential,
+        `Scopes: ${scope === "full" ? "full" : scope.split(" ").join(", ")}`,
+        ...session.allowed_domains?.length ? [`Sends only from: ${session.allowed_domains.join(", ")}`] : [],
+        ...auth.baseUrl !== defaultApiUrl(env) ? [`API: ${auth.baseUrl}`] : []
+      ].join("\n")
+    );
+    return { exitCode: EXIT_OK };
+  } catch (error) {
+    if (error instanceof CliRequestError) return { exitCode: EXIT_FAILED, error: error.message };
+    throw error;
+  }
+}
+
 // src/commands/keys/create.ts
 function readFlag16(args, flag) {
   const index = args.indexOf(flag);
@@ -1272,28 +2132,38 @@ function readFlag16(args, flag) {
 }
 async function runCreateKeyCommandWithClient(args, env = process.env) {
   const apiKey = readFlag16(args, "--api-key") || env.GROUNDMAIL_API_KEY;
-  const baseUrl = readFlag16(args, "--base-url");
+  const baseUrl = readFlag16(args, "--base-url") || defaultApiUrl(env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
   const name = readFlag16(args, "--name");
   const scope = readFlag16(args, "--scope");
   if (scope && scope !== "full" && scope !== "sending") {
-    return { exitCode: 1, error: "--scope must be full or sending" };
+    return { exitCode: 1, error: "--scope must be full or sending (or use --scopes for fine-grained scopes)" };
   }
-  const { Groundmail } = await import("groundmail");
-  const client = new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
+  const scopesFlag = readFlag16(args, "--scopes");
+  const scopes = scopesFlag !== void 0 ? parseScopeFlag(scopesFlag) : null;
+  if (scopes && !scopes.ok) return { exitCode: 1, error: scopes.error };
+  const domainsFlag = readFlag16(args, "--allowed-domains");
+  const allowedDomains = domainsFlag?.split(/[\s,]+/).map((domain) => domain.trim()).filter(Boolean);
   try {
-    const result = await client.apiKeys.create({
-      ...name ? { name } : {},
-      ...scope ? { scope } : {}
+    const response = await apiRequest(baseUrl, "/api-keys", {
+      apiKey,
+      env,
+      body: {
+        ...name ? { name } : {},
+        ...scope && !scopes ? { scope } : {},
+        ...scopes?.ok ? { scopes: scopes.scope.split(" ") } : {},
+        ...allowedDomains?.length ? { allowed_domains: allowedDomains } : {}
+      }
     });
-    console.log(JSON.stringify(result));
+    if (!response.ok) {
+      return { exitCode: 1, error: errorMessage(response, "Could not create the key") };
+    }
+    console.log(JSON.stringify(response.body));
     return { exitCode: 0 };
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error(message);
-    return { exitCode: 1, error: message };
+    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
 
@@ -1804,894 +2674,355 @@ async function runCreateCommand3(args, env = process.env) {
       ...html ? { html } : {},
       ...text ? { text } : {},
       ...alias ? { alias } : {},
-      ...category ? { category } : {},
-      ...unsubscribeEnabled ? { unsubscribe_enabled: true } : {}
-    });
-    console.log(JSON.stringify(result));
-    return { exitCode: 0 };
-  } catch (error) {
-    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
-  }
-}
-
-// src/commands/templates/update.ts
-var POSITIONAL_FLAGS11 = [
-  "--api-key",
-  "--base-url",
-  "--id",
-  "--alias",
-  "--set-alias",
-  "--name",
-  "--subject",
-  "--html",
-  "--text",
-  "--variable"
-];
-async function runUpdateCommand4(args, env = process.env) {
-  const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
-  if (!apiKey) {
-    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  }
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional12(args);
-  if (!idOrAlias) {
-    return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
-  }
-  const name = readFlag19(args, "--name");
-  const subject = readFlag19(args, "--subject");
-  const html = readFlag19(args, "--html");
-  const text = readFlag19(args, "--text");
-  const alias = readFlag19(args, "--set-alias");
-  const variables = readFlags3(args, "--variable");
-  const category = readFlag19(args, "--category");
-  const unsubscribeEnabled = args.includes("--unsubscribe-enabled");
-  const unsubscribeDisabled = args.includes("--no-unsubscribe-enabled");
-  if (!name && !subject && !html && !text && !alias && variables.length === 0 && !category && !unsubscribeEnabled && !unsubscribeDisabled) {
-    return {
-      exitCode: 1,
-      error: "Nothing to update. Pass --name, --subject, --html, --text, --set-alias, --category, --variable, or unsubscribe flags."
-    };
-  }
-  try {
-    const client = await createTemplatesClient(apiKey, options.baseUrl);
-    const result = await client.templates.update(idOrAlias, {
-      ...name ? { name } : {},
-      ...subject ? { subject } : {},
-      ...html ? { html } : {},
-      ...text ? { text } : {},
-      ...alias ? { alias } : {},
-      ...variables.length > 0 ? { variables } : {},
-      ...category ? { category } : {},
-      ...unsubscribeEnabled ? { unsubscribe_enabled: true } : {},
-      ...unsubscribeDisabled ? { unsubscribe_enabled: false } : {}
-    });
-    console.log(JSON.stringify(result));
-    return { exitCode: 0 };
-  } catch (error) {
-    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
-  }
-}
-function readFlags3(args, flag) {
-  const values = [];
-  for (let i = 0; i < args.length; i += 1) {
-    if (args[i] === flag && args[i + 1]) values.push(args[i + 1]);
-  }
-  return values;
-}
-function readFirstPositional12(args) {
-  for (let i = 0; i < args.length; i += 1) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-      if (POSITIONAL_FLAGS11.includes(arg)) i += 1;
-      continue;
-    }
-    return arg;
-  }
-  return void 0;
-}
-
-// src/commands/templates/from-starter.ts
-var POSITIONAL_FLAGS12 = ["--api-key", "--base-url", "--alias"];
-function readFirstPositional13(args) {
-  for (let i = 0; i < args.length; i += 1) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-      if (POSITIONAL_FLAGS12.includes(arg)) i += 1;
-      continue;
-    }
-    return arg;
-  }
-  return void 0;
-}
-async function runFromStarterCommand(args, env = process.env) {
-  const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
-  if (!apiKey) {
-    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  }
-  const alias = readFlag19(args, "--alias") || readFirstPositional13(args);
-  if (!alias) {
-    return {
-      exitCode: 1,
-      error: "Missing starter alias. Pass password-reset (or --alias welcome). List: groundmail templates starters"
-    };
-  }
-  try {
-    const client = await createTemplatesClient(apiKey, options.baseUrl);
-    console.log(JSON.stringify(await client.templates.fromStarter(alias)));
-    return { exitCode: 0 };
-  } catch (error) {
-    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
-  }
-}
-async function runListStartersCommand(args, env = process.env) {
-  const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
-  if (!apiKey) {
-    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  }
-  try {
-    const client = await createTemplatesClient(apiKey, options.baseUrl);
-    console.log(JSON.stringify(await client.templates.listStarters()));
-    return { exitCode: 0 };
-  } catch (error) {
-    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
-  }
-}
-
-// src/commands/templates/versions.ts
-var POSITIONAL_FLAGS13 = ["--api-key", "--base-url", "--id", "--alias", "--version", "--from", "--to"];
-function readFirstPositional14(args) {
-  for (let i = 0; i < args.length; i += 1) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-      if (POSITIONAL_FLAGS13.includes(arg)) i += 1;
-      continue;
-    }
-    return arg;
-  }
-  return void 0;
-}
-async function runVersionsCommand(args, env = process.env) {
-  const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
-  if (!apiKey) {
-    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  }
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
-  if (!idOrAlias) {
-    return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
-  }
-  try {
-    const client = await createTemplatesClient(apiKey, options.baseUrl);
-    console.log(JSON.stringify(await client.templates.listVersions(idOrAlias)));
-    return { exitCode: 0 };
-  } catch (error) {
-    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
-  }
-}
-async function runRestoreCommand(args, env = process.env) {
-  const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
-  if (!apiKey) {
-    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  }
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
-  const versionRaw = readFlag19(args, "--version");
-  const version2 = versionRaw ? Number.parseInt(versionRaw, 10) : NaN;
-  if (!idOrAlias || !Number.isFinite(version2) || version2 < 1) {
-    return {
-      exitCode: 1,
-      error: "Usage: groundmail templates restore --id <id|alias> --version <n>"
-    };
-  }
-  try {
-    const client = await createTemplatesClient(apiKey, options.baseUrl);
-    console.log(JSON.stringify(await client.templates.restoreVersion(idOrAlias, version2)));
+      ...category ? { category } : {},
+      ...unsubscribeEnabled ? { unsubscribe_enabled: true } : {}
+    });
+    console.log(JSON.stringify(result));
     return { exitCode: 0 };
   } catch (error) {
     return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
-async function runTestSendCommand(args, env = process.env) {
+
+// src/commands/templates/update.ts
+var POSITIONAL_FLAGS11 = [
+  "--api-key",
+  "--base-url",
+  "--id",
+  "--alias",
+  "--set-alias",
+  "--name",
+  "--subject",
+  "--html",
+  "--text",
+  "--variable"
+];
+async function runUpdateCommand4(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
   const apiKey = resolveApiKey7(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
-  const from = readFlag19(args, "--from");
-  const to = readFlag19(args, "--to");
-  if (!idOrAlias || !from || !to) {
+  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional12(args);
+  if (!idOrAlias) {
+    return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
+  }
+  const name = readFlag19(args, "--name");
+  const subject = readFlag19(args, "--subject");
+  const html = readFlag19(args, "--html");
+  const text = readFlag19(args, "--text");
+  const alias = readFlag19(args, "--set-alias");
+  const variables = readFlags3(args, "--variable");
+  const category = readFlag19(args, "--category");
+  const unsubscribeEnabled = args.includes("--unsubscribe-enabled");
+  const unsubscribeDisabled = args.includes("--no-unsubscribe-enabled");
+  if (!name && !subject && !html && !text && !alias && variables.length === 0 && !category && !unsubscribeEnabled && !unsubscribeDisabled) {
     return {
       exitCode: 1,
-      error: "Usage: groundmail templates test-send --id <id|alias> --from <email> --to <email>"
+      error: "Nothing to update. Pass --name, --subject, --html, --text, --set-alias, --category, --variable, or unsubscribe flags."
     };
   }
   try {
     const client = await createTemplatesClient(apiKey, options.baseUrl);
-    console.log(JSON.stringify(await client.templates.testSend(idOrAlias, { from, to })));
+    const result = await client.templates.update(idOrAlias, {
+      ...name ? { name } : {},
+      ...subject ? { subject } : {},
+      ...html ? { html } : {},
+      ...text ? { text } : {},
+      ...alias ? { alias } : {},
+      ...variables.length > 0 ? { variables } : {},
+      ...category ? { category } : {},
+      ...unsubscribeEnabled ? { unsubscribe_enabled: true } : {},
+      ...unsubscribeDisabled ? { unsubscribe_enabled: false } : {}
+    });
+    console.log(JSON.stringify(result));
     return { exitCode: 0 };
   } catch (error) {
     return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
-
-// src/commands/integrations/shared.ts
-function readFlag20(args, flag) {
-  const index = args.indexOf(flag);
-  if (index === -1) return void 0;
-  return args[index + 1];
-}
-function parseIntegrationsCommonArgs(args) {
-  return {
-    apiKey: readFlag20(args, "--api-key"),
-    baseUrl: readFlag20(args, "--base-url")
-  };
-}
-function resolveApiKey8(options, env) {
-  return options.apiKey || env.GROUNDMAIL_API_KEY || null;
+function readFlags3(args, flag) {
+  const values = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === flag && args[i + 1]) values.push(args[i + 1]);
+  }
+  return values;
 }
-async function createIntegrationsClient(apiKey, baseUrl) {
-  const { Groundmail } = await import("groundmail");
-  return new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
+function readFirstPositional12(args) {
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      if (POSITIONAL_FLAGS11.includes(arg)) i += 1;
+      continue;
+    }
+    return arg;
+  }
+  return void 0;
 }
 
-// src/commands/integrations/twilio.ts
-async function runTwilioStatusCommand(args, env = process.env) {
-  const options = parseIntegrationsCommonArgs(args);
-  const apiKey = resolveApiKey8(options, env);
-  if (!apiKey) {
-    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  }
-  try {
-    const client = await createIntegrationsClient(apiKey, options.baseUrl);
-    const result = await client.integrations.getTwilio();
-    console.log(JSON.stringify(result));
-    return { exitCode: 0 };
-  } catch (error) {
-    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
+// src/commands/templates/from-starter.ts
+var POSITIONAL_FLAGS12 = ["--api-key", "--base-url", "--alias"];
+function readFirstPositional13(args) {
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      if (POSITIONAL_FLAGS12.includes(arg)) i += 1;
+      continue;
+    }
+    return arg;
   }
+  return void 0;
 }
-async function runTwilioConnectCommand(args, env = process.env) {
-  const options = parseIntegrationsCommonArgs(args);
-  const apiKey = resolveApiKey8(options, env);
+async function runFromStarterCommand(args, env = process.env) {
+  const options = parseTemplatesCommonArgs(args);
+  const apiKey = resolveApiKey7(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const accountSid = readFlag20(args, "--account-sid") || env.TWILIO_ACCOUNT_SID || env.TWILIO_SID || "";
-  const authToken = readFlag20(args, "--auth-token") || env.TWILIO_AUTH_TOKEN || env.TWILIO_TOKEN || "";
-  const defaultFrom = readFlag20(args, "--from") || readFlag20(args, "--default-from") || env.TWILIO_DEFAULT_FROM || "";
-  const messagingServiceSid = readFlag20(args, "--messaging-service-sid") || readFlag20(args, "--messaging-sid") || env.TWILIO_MESSAGING_SERVICE_SID || "";
-  if (!accountSid.trim() || !authToken.trim()) {
-    return {
-      exitCode: 1,
-      error: "Required: --account-sid and --auth-token (or TWILIO_ACCOUNT_SID and TWILIO_AUTH_TOKEN)."
-    };
-  }
-  if (!defaultFrom.trim() && !messagingServiceSid.trim()) {
+  const alias = readFlag19(args, "--alias") || readFirstPositional13(args);
+  if (!alias) {
     return {
       exitCode: 1,
-      error: "Required: --from or --messaging-service-sid (or TWILIO_DEFAULT_FROM / TWILIO_MESSAGING_SERVICE_SID)."
+      error: "Missing starter alias. Pass password-reset (or --alias welcome). List: groundmail templates starters"
     };
   }
   try {
-    const client = await createIntegrationsClient(apiKey, options.baseUrl);
-    const result = await client.integrations.connectTwilio({
-      accountSid: accountSid.trim(),
-      authToken: authToken.trim(),
-      ...defaultFrom.trim() ? { defaultFrom: defaultFrom.trim() } : {},
-      ...messagingServiceSid.trim() ? { messagingServiceSid: messagingServiceSid.trim() } : {}
-    });
-    console.log(JSON.stringify(result));
+    const client = await createTemplatesClient(apiKey, options.baseUrl);
+    console.log(JSON.stringify(await client.templates.fromStarter(alias)));
     return { exitCode: 0 };
   } catch (error) {
     return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
-async function runTwilioDisconnectCommand(args, env = process.env) {
-  const options = parseIntegrationsCommonArgs(args);
-  const apiKey = resolveApiKey8(options, env);
+async function runListStartersCommand(args, env = process.env) {
+  const options = parseTemplatesCommonArgs(args);
+  const apiKey = resolveApiKey7(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
   try {
-    const client = await createIntegrationsClient(apiKey, options.baseUrl);
-    const result = await client.integrations.disconnectTwilio();
-    console.log(JSON.stringify(result));
+    const client = await createTemplatesClient(apiKey, options.baseUrl);
+    console.log(JSON.stringify(await client.templates.listStarters()));
     return { exitCode: 0 };
   } catch (error) {
     return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
 
-// src/commands/login.ts
-import { spawn } from "child_process";
-
-// src/session/args.ts
-var COMMON_VALUE_FLAGS = ["--api-key", "--base-url", "--workspace"];
-var COMMON_BOOLEAN_FLAGS = ["--json"];
-function parseArgs(argv, spec) {
-  const valueFlags = new Set(spec.values ?? []);
-  const booleanFlags = new Set(spec.booleans ?? []);
-  const values = {};
-  const booleans = {};
-  const positionals = [];
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--") {
-      positionals.push(...argv.slice(i + 1));
-      break;
-    }
-    if (!arg.startsWith("--") || arg === "-") {
-      positionals.push(arg);
-      continue;
-    }
-    const eq = arg.indexOf("=");
-    const name = eq === -1 ? arg : arg.slice(0, eq);
-    if (valueFlags.has(name)) {
-      const value = eq === -1 ? argv[i + 1] : arg.slice(eq + 1);
-      if (value === void 0 || eq === -1 && value.startsWith("--")) {
-        return { ok: false, error: `${name} needs a value.` };
-      }
-      values[name] = value;
-      if (eq === -1) i++;
-      continue;
-    }
-    if (booleanFlags.has(name) && eq === -1) {
-      booleans[name] = true;
-      continue;
-    }
-    const negated = name.startsWith("--no-") ? `--${name.slice("--no-".length)}` : null;
-    if (negated && booleanFlags.has(negated) && eq === -1) {
-      booleans[negated] = false;
-      continue;
-    }
-    const known = [...valueFlags, ...booleanFlags].sort().join(", ");
-    return { ok: false, error: `Unknown flag ${name}.${known ? ` This command takes: ${known}.` : ""}` };
-  }
-  return { ok: true, args: { values, booleans, positionals } };
-}
-function wantsJson(args, stdout = process.stdout) {
-  if (args.booleans["--json"] !== void 0) return args.booleans["--json"];
-  return !stdout.isTTY;
-}
-var EXIT_OK = 0;
-var EXIT_FAILED = 1;
-var EXIT_USAGE = 2;
-
-// src/session/brand.ts
-var GROUNDMAIL = {
-  bin: "groundmail",
-  product: "Groundmail",
-  configDirName: "groundmail",
-  keyEnvVar: "GROUNDMAIL_API_KEY",
-  npx: "npx -y groundmail-cli@latest"
-};
-function cliBrand(_env = process.env) {
-  return GROUNDMAIL;
-}
-var SDK_DEFAULT_API_URL = "https://api.groundmail.dev";
-var DEFAULT_API_URL_ENV = "GROUNDMAIL_DEFAULT_API_URL";
-function defaultApiUrl(env = process.env) {
-  return trimUrl(env[DEFAULT_API_URL_ENV]) || SDK_DEFAULT_API_URL;
-}
-function explicitApiUrl(env = process.env) {
-  return trimUrl(env.GROUNDMAIL_API_URL) || null;
-}
-function trimUrl(value) {
-  return (value ?? "").trim().replace(/\/+$/, "");
-}
-
-// src/session/config.ts
-import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-function configDir(env = process.env) {
-  const override = env.GROUNDMAIL_CONFIG_DIR?.trim();
-  if (override) return override;
-  const base = env.XDG_CONFIG_HOME?.trim() || (process.platform === "win32" ? env.APPDATA?.trim() || join(homedir(), "AppData", "Roaming") : "") || join(homedir(), ".config");
-  return join(base, cliBrand(env).configDirName);
-}
-function configPath(env = process.env) {
-  return join(configDir(env), "config.json");
-}
-function loadConfig(env = process.env) {
-  try {
-    const parsed = JSON.parse(readFileSync(configPath(env), "utf8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
-    const record = parsed;
-    const workspaces = {};
-    for (const [id, entry] of Object.entries(record.workspaces ?? {})) {
-      if (entry && typeof entry.apiKey === "string" && entry.apiKey && typeof entry.id === "string") {
-        workspaces[id] = entry;
-      }
+// src/commands/templates/versions.ts
+var POSITIONAL_FLAGS13 = ["--api-key", "--base-url", "--id", "--alias", "--version", "--from", "--to"];
+function readFirstPositional14(args) {
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      if (POSITIONAL_FLAGS13.includes(arg)) i += 1;
+      continue;
     }
-    return {
-      ...typeof record.current === "string" && workspaces[record.current] ? { current: record.current } : {},
-      workspaces,
-      ...record.pendingLogin && typeof record.pendingLogin.deviceCode === "string" ? { pendingLogin: record.pendingLogin } : {}
-    };
-  } catch {
-    return {};
+    return arg;
   }
+  return void 0;
 }
-function saveConfig(config, env = process.env) {
-  const file = configPath(env);
-  mkdirSync(dirname(file), { recursive: true, mode: 448 });
-  const tmp = `${file}.${process.pid}.tmp`;
-  writeFileSync(tmp, `${JSON.stringify(config, null, 2)}
-`, { mode: 384 });
-  renameSync(tmp, file);
+async function runVersionsCommand(args, env = process.env) {
+  const options = parseTemplatesCommonArgs(args);
+  const apiKey = resolveApiKey7(options, env);
+  if (!apiKey) {
+    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
+  }
+  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
+  if (!idOrAlias) {
+    return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
+  }
   try {
-    chmodSync(file, 384);
-  } catch {
+    const client = await createTemplatesClient(apiKey, options.baseUrl);
+    console.log(JSON.stringify(await client.templates.listVersions(idOrAlias)));
+    return { exitCode: 0 };
+  } catch (error) {
+    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
-function updateConfig(change, env = process.env) {
-  const next = change(loadConfig(env));
-  saveConfig(next, env);
-  return next;
-}
-function savedWorkspaces(config) {
-  return Object.values(config.workspaces ?? {}).sort((a, b) => a.name.localeCompare(b.name));
-}
-function findSavedWorkspace(config, wanted) {
-  const all = savedWorkspaces(config);
-  const key = wanted.trim();
-  const byId = all.find((workspace) => workspace.id === key);
-  if (byId) return { ok: true, workspace: byId };
-  const byName = all.filter((workspace) => workspace.name.trim().toLowerCase() === key.toLowerCase());
-  if (byName.length === 1) return { ok: true, workspace: byName[0] };
-  return { ok: false, reason: byName.length ? "ambiguous" : "none", matches: byName };
-}
-
-// src/session/credentials.ts
-function envApiKey(env = process.env) {
-  return env.GROUNDMAIL_API_KEY?.trim() || null;
-}
-function currentSavedWorkspace(config, env = process.env) {
-  const brand = cliBrand(env);
-  const all = savedWorkspaces(config);
-  if (config.current && config.workspaces?.[config.current]) {
-    return { ok: true, workspace: config.workspaces[config.current] };
+async function runRestoreCommand(args, env = process.env) {
+  const options = parseTemplatesCommonArgs(args);
+  const apiKey = resolveApiKey7(options, env);
+  if (!apiKey) {
+    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  if (all.length === 1) return { ok: true, workspace: all[0] };
-  if (all.length === 0) {
+  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
+  const versionRaw = readFlag19(args, "--version");
+  const version2 = versionRaw ? Number.parseInt(versionRaw, 10) : NaN;
+  if (!idOrAlias || !Number.isFinite(version2) || version2 < 1) {
     return {
-      ok: false,
-      reason: "none",
-      error: `Not signed in. Run: ${brand.bin} login (it prints a link to approve in the browser). Or set ${brand.keyEnvVar}.`
+      exitCode: 1,
+      error: "Usage: groundmail templates restore --id <id|alias> --version <n>"
     };
   }
-  return {
-    ok: false,
-    reason: "ambiguous",
-    error: `Signed in to ${all.length} workspaces on this computer and none is picked: ${all.map((workspace) => `"${workspace.name}"`).join(", ")}. Pick one: ${brand.bin} workspaces use <name>, or pass --workspace <name>.`
-  };
+  try {
+    const client = await createTemplatesClient(apiKey, options.baseUrl);
+    console.log(JSON.stringify(await client.templates.restoreVersion(idOrAlias, version2)));
+    return { exitCode: 0 };
+  } catch (error) {
+    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
+  }
 }
-function resolveAuth(flags, env = process.env, config = loadConfig(env)) {
-  const brand = cliBrand(env);
-  const flagUrl = trimUrl(flags.baseUrl) || null;
-  const urlFor = (workspace) => flagUrl || explicitApiUrl(env) || trimUrl(workspace?.apiUrl) || defaultApiUrl(env);
-  const flagKey = flags.apiKey?.trim();
-  if (flagKey) return { ok: true, auth: { apiKey: flagKey, baseUrl: urlFor(null), source: "flag", workspace: null } };
-  if (flags.workspace?.trim()) {
-    const match = findSavedWorkspace(config, flags.workspace);
-    if (!match.ok) {
-      const saved = savedWorkspaces(config);
-      return {
-        ok: false,
-        error: match.reason === "ambiguous" ? `More than one saved workspace is called "${flags.workspace}". Use its id: ${match.matches.map((w) => w.id).join(", ")}.` : `Not signed in to "${flags.workspace}" on this computer.${saved.length ? ` Signed in: ${saved.map((w) => `"${w.name}"`).join(", ")}.` : ""} To add it: ${brand.bin} login --workspace "${flags.workspace}".`
-      };
-    }
+async function runTestSendCommand(args, env = process.env) {
+  const options = parseTemplatesCommonArgs(args);
+  const apiKey = resolveApiKey7(options, env);
+  if (!apiKey) {
+    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
+  }
+  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
+  const from = readFlag19(args, "--from");
+  const to = readFlag19(args, "--to");
+  if (!idOrAlias || !from || !to) {
     return {
-      ok: true,
-      auth: { apiKey: match.workspace.apiKey, baseUrl: urlFor(match.workspace), source: "saved", workspace: match.workspace }
+      exitCode: 1,
+      error: "Usage: groundmail templates test-send --id <id|alias> --from <email> --to <email>"
     };
   }
-  const fromEnv = envApiKey(env);
-  if (fromEnv) return { ok: true, auth: { apiKey: fromEnv, baseUrl: urlFor(null), source: "env", workspace: null } };
-  const current = currentSavedWorkspace(config, env);
-  if (!current.ok) return { ok: false, error: current.error };
-  return {
-    ok: true,
-    auth: { apiKey: current.workspace.apiKey, baseUrl: urlFor(current.workspace), source: "saved", workspace: current.workspace }
-  };
-}
-function applySavedSession(argv, env = process.env, config) {
-  const hasFlag = (flag) => argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
-  let workspace = null;
-  let notice;
-  if (!hasFlag("--api-key") && !envApiKey(env)) {
-    const current = currentSavedWorkspace(config ?? loadConfig(env), env);
-    if (current.ok) {
-      workspace = current.workspace;
-      env.GROUNDMAIL_API_KEY = current.workspace.apiKey;
-    } else if (current.reason === "ambiguous") {
-      notice = current.error;
-    }
+  try {
+    const client = await createTemplatesClient(apiKey, options.baseUrl);
+    console.log(JSON.stringify(await client.templates.testSend(idOrAlias, { from, to })));
+    return { exitCode: 0 };
+  } catch (error) {
+    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
-  if (hasFlag("--base-url")) return { argv, notice };
-  const url = explicitApiUrl(env) || trimUrl(workspace?.apiUrl) || trimUrl(env.GROUNDMAIL_DEFAULT_API_URL);
-  return { argv: url ? [...argv, "--base-url", url] : argv, notice };
 }
 
-// package.json
-var version = "0.15.0";
-
-// src/user-agent.ts
-function buildUserAgent(own) {
-  return `${own.name}/${own.version} node/${process.versions.node}`;
+// src/commands/integrations/shared.ts
+function readFlag20(args, flag) {
+  const index = args.indexOf(flag);
+  if (index === -1) return void 0;
+  return args[index + 1];
 }
-function withUserAgent(init, userAgent) {
-  const headers = init?.headers;
-  if (headers instanceof Headers) {
-    const next = new Headers(headers);
-    if (!next.has("user-agent")) next.set("User-Agent", userAgent);
-    return { ...init, headers: next };
-  }
-  if (Array.isArray(headers)) {
-    const has2 = headers.some(([key]) => key.toLowerCase() === "user-agent");
-    return { ...init, headers: has2 ? headers : [...headers, ["User-Agent", userAgent]] };
-  }
-  const record = headers ?? {};
-  const has = Object.keys(record).some((key) => key.toLowerCase() === "user-agent");
-  return { ...init, headers: has ? record : { ...record, "User-Agent": userAgent } };
+function parseIntegrationsCommonArgs(args) {
+  return {
+    apiKey: readFlag20(args, "--api-key"),
+    baseUrl: readFlag20(args, "--base-url")
+  };
 }
-function fetchWithUserAgent(userAgent) {
-  return ((input, init) => globalThis.fetch(input, withUserAgent(init, userAgent)));
+function resolveApiKey8(options, env) {
+  return options.apiKey || env.GROUNDMAIL_API_KEY || null;
+}
+async function createIntegrationsClient(apiKey, baseUrl) {
+  const { Groundmail } = await import("groundmail");
+  return new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
 }
 
-// src/client-info.ts
-var CLI_PACKAGE = { name: "groundmail-cli", version };
-
-// src/session/http.ts
-var CliRequestError = class extends Error {
-};
-async function apiRequest(baseUrl, path, options = {}) {
-  const doFetch = fetchWithUserAgent(buildUserAgent(CLI_PACKAGE));
-  const url = `${baseUrl.replace(/\/+$/, "")}${path}`;
-  let response;
-  try {
-    response = await doFetch(url, {
-      method: options.method ?? (options.body === void 0 ? "GET" : "POST"),
-      headers: {
-        Accept: "application/json",
-        ...options.body === void 0 ? {} : { "Content-Type": "application/json" },
-        ...options.apiKey ? { Authorization: `Bearer ${options.apiKey}` } : {}
-      },
-      ...options.body === void 0 ? {} : { body: JSON.stringify(options.body) }
-    });
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    throw new CliRequestError(`Could not reach ${baseUrl}: ${reason}`);
+// src/commands/integrations/twilio.ts
+async function runTwilioStatusCommand(args, env = process.env) {
+  const options = parseIntegrationsCommonArgs(args);
+  const apiKey = resolveApiKey8(options, env);
+  if (!apiKey) {
+    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const text = await response.text();
-  let body = {};
   try {
-    const parsed = text ? JSON.parse(text) : {};
-    body = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : { value: parsed };
-  } catch {
-    body = { error: text.slice(0, 300) || `HTTP ${response.status}` };
+    const client = await createIntegrationsClient(apiKey, options.baseUrl);
+    const result = await client.integrations.getTwilio();
+    console.log(JSON.stringify(result));
+    return { exitCode: 0 };
+  } catch (error) {
+    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
-  return { ok: response.ok, status: response.status, body };
-}
-function sentence(text) {
-  return /[.!?…)]$/.test(text.trim()) ? text.trim() : `${text.trim()}.`;
 }
-function errorMessage(response, fallback) {
-  const error = response.body.error;
-  if (typeof error === "string" && error.trim()) return error.trim();
-  if (error && typeof error === "object") {
-    const message = error.message;
-    if (typeof message === "string" && message.trim()) return message.trim();
+async function runTwilioConnectCommand(args, env = process.env) {
+  const options = parseIntegrationsCommonArgs(args);
+  const apiKey = resolveApiKey8(options, env);
+  if (!apiKey) {
+    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  return `${fallback} (HTTP ${response.status}).`;
-}
-
-// src/session/io.ts
-var processIo = {
-  out: (text) => process.stdout.write(text.endsWith("\n") ? text : `${text}
-`),
-  err: (text) => process.stderr.write(text.endsWith("\n") ? text : `${text}
-`),
-  get isTTY() {
-    return Boolean(process.stdout.isTTY);
+  const accountSid = readFlag20(args, "--account-sid") || env.TWILIO_ACCOUNT_SID || env.TWILIO_SID || "";
+  const authToken = readFlag20(args, "--auth-token") || env.TWILIO_AUTH_TOKEN || env.TWILIO_TOKEN || "";
+  const defaultFrom = readFlag20(args, "--from") || readFlag20(args, "--default-from") || env.TWILIO_DEFAULT_FROM || "";
+  const messagingServiceSid = readFlag20(args, "--messaging-service-sid") || readFlag20(args, "--messaging-sid") || env.TWILIO_MESSAGING_SERVICE_SID || "";
+  if (!accountSid.trim() || !authToken.trim()) {
+    return {
+      exitCode: 1,
+      error: "Required: --account-sid and --auth-token (or TWILIO_ACCOUNT_SID and TWILIO_AUTH_TOKEN)."
+    };
+  }
+  if (!defaultFrom.trim() && !messagingServiceSid.trim()) {
+    return {
+      exitCode: 1,
+      error: "Required: --from or --messaging-service-sid (or TWILIO_DEFAULT_FROM / TWILIO_MESSAGING_SERVICE_SID)."
+    };
   }
-};
-function printJson(io, value) {
-  io.out(JSON.stringify(value, null, 2));
-}
-
-// src/commands/login.ts
-var realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function openInBrowser(url) {
-  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
   try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {
+    const client = await createIntegrationsClient(apiKey, options.baseUrl);
+    const result = await client.integrations.connectTwilio({
+      accountSid: accountSid.trim(),
+      authToken: authToken.trim(),
+      ...defaultFrom.trim() ? { defaultFrom: defaultFrom.trim() } : {},
+      ...messagingServiceSid.trim() ? { messagingServiceSid: messagingServiceSid.trim() } : {}
     });
-    child.unref();
-  } catch {
+    console.log(JSON.stringify(result));
+    return { exitCode: 0 };
+  } catch (error) {
+    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
-function sourceLabel(source, env) {
-  if (source === "flag") return "--api-key";
-  if (source === "env") return cliBrand(env).keyEnvVar;
-  return "saved login";
-}
-async function runLoginCommand(argv, deps = {}) {
-  const io = deps.io ?? processIo;
-  const env = deps.env ?? process.env;
-  const sleep = deps.sleep ?? realSleep;
-  const now = deps.now ?? Date.now;
-  const brand = cliBrand(env);
-  const parsed = parseArgs(argv, {
-    values: ["--base-url", "--workspace"],
-    booleans: ["--json", "--browser", "--wait", "--new"]
-  });
-  if (!parsed.ok) return { exitCode: EXIT_USAGE, error: `${parsed.error}
-Usage: ${brand.bin} login [--workspace <name>] [--new] [--no-browser] [--wait|--no-wait] [--json]` };
-  const { args } = parsed;
-  if (args.positionals.length) {
-    return { exitCode: EXIT_USAGE, error: `${brand.bin} login takes no arguments. To sign in to a workspace by name: ${brand.bin} login --workspace "<name>".` };
+async function runTwilioDisconnectCommand(args, env = process.env) {
+  const options = parseIntegrationsCommonArgs(args);
+  const apiKey = resolveApiKey8(options, env);
+  if (!apiKey) {
+    return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const json = wantsJson(args, io);
-  const wait = args.booleans["--wait"] ?? io.isTTY;
-  const browser = args.booleans["--browser"] ?? true;
-  const apiUrl = trimUrl(args.values["--base-url"]) || explicitApiUrl(env) || defaultApiUrl(env);
-  const workspaceHint = args.values["--workspace"]?.trim() || null;
   try {
-    const config = loadConfig(env);
-    let login = config.pendingLogin;
-    const resumed = Boolean(
-      !args.booleans["--new"] && login && login.apiUrl === apiUrl && login.expiresAt > now() + 5e3 && (login.workspace ?? null) === workspaceHint
-    );
-    if (!resumed && !workspaceHint && !args.booleans["--new"]) {
-      const current = currentSavedWorkspace(config, env);
-      if (current.ok && (trimUrl(current.workspace.apiUrl) || defaultApiUrl(env)) === apiUrl) {
-        const next = `To sign in to another workspace: ${brand.bin} login --workspace "<name>". To sign in as someone else: ${brand.bin} logout, then ${brand.bin} login.`;
-        if (json) {
-          printJson(io, {
-            status: "signed_in",
-            already: true,
-            workspace: { id: current.workspace.id, name: current.workspace.name },
-            email: current.workspace.email ?? null,
-            config_path: configPath(env),
-            next
-          });
-        } else {
-          io.out(`Already signed in${current.workspace.email ? ` as ${current.workspace.email}` : ""} to ${current.workspace.name}.
-${next}`);
-        }
-        return { exitCode: EXIT_OK };
-      }
-    }
-    if (!resumed) {
-      const start = await apiRequest(apiUrl, "/cli/login", { body: workspaceHint ? { workspace: workspaceHint } : {}, env });
-      if (!start.ok) return { exitCode: EXIT_FAILED, error: errorMessage(start, "Could not start the sign-in") };
-      const body = start.body;
-      if (typeof body.device_code !== "string" || typeof body.user_code !== "string" || typeof body.verification_url !== "string") {
-        return { exitCode: EXIT_FAILED, error: `Unexpected answer from ${apiUrl}/cli/login. Is --base-url right?` };
-      }
-      login = {
-        deviceCode: body.device_code,
-        userCode: body.user_code,
-        url: body.verification_url,
-        interval: Math.max(1, Number(body.interval) || 2),
-        expiresAt: now() + (Number(body.expires_in) || 600) * 1e3,
-        apiUrl,
-        workspace: workspaceHint
-      };
-      const pending = login;
-      updateConfig((current) => ({ ...current, pendingLogin: pending }), env);
-    }
-    const active = login;
-    const link = `${resumed ? "Still waiting for approval" : `Sign in to ${brand.product}`}: open this link and approve code ${active.userCode}
-  ${active.url}`;
-    if (!json) {
-      io.out(`${link}${wait ? "\nWaiting\u2026 (Ctrl-C to stop; run the same command again to pick up where you left off)" : ""}`);
-    } else if (wait) {
-      io.err(link);
-    }
-    if (browser && !resumed && !env.CI) (deps.openBrowser ?? openInBrowser)(active.url);
-    for (; ; ) {
-      const poll = await apiRequest(apiUrl, "/cli/login/token", { body: { device_code: active.deviceCode }, env });
-      if (!poll.ok) {
-        if (poll.status < 500 && poll.status !== 429) {
-          updateConfig(({ pendingLogin: _drop, ...rest }) => rest, env);
-        }
-        return { exitCode: EXIT_FAILED, error: errorMessage(poll, "The sign-in check failed") };
-      }
-      const status = poll.body.status;
-      if (status === "approved" && typeof poll.body.api_key === "string") {
-        return finishLogin(poll.body, active, { io, env, json });
-      }
-      if (status === "denied") {
-        updateConfig(({ pendingLogin: _drop, ...rest }) => rest, env);
-        return { exitCode: EXIT_FAILED, error: `The sign-in was canceled in the browser. Run ${brand.bin} login to start again.` };
-      }
-      if (status !== "pending") {
-        updateConfig(({ pendingLogin: _drop, ...rest }) => rest, env);
-        return { exitCode: EXIT_FAILED, error: `The sign-in code expired or was already used. Run ${brand.bin} login again.` };
-      }
-      if (!wait || now() + active.interval * 1e3 > active.expiresAt) {
-        const next = `Not signed in yet. Approve code ${active.userCode} in the browser, then run ${brand.bin} login again to finish.`;
-        if (json) {
-          printJson(io, {
-            status: "pending",
-            user_code: active.userCode,
-            verification_url: active.url,
-            expires_at: new Date(active.expiresAt).toISOString(),
-            next
-          });
-        } else {
-          io.out(next);
-        }
-        return { exitCode: EXIT_OK };
-      }
-      await sleep(active.interval * 1e3);
-    }
+    const client = await createIntegrationsClient(apiKey, options.baseUrl);
+    const result = await client.integrations.disconnectTwilio();
+    console.log(JSON.stringify(result));
+    return { exitCode: 0 };
   } catch (error) {
-    if (error instanceof CliRequestError) return { exitCode: EXIT_FAILED, error: error.message };
-    throw error;
+    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
-function finishLogin(body, login, { io, env, json }) {
+
+// src/commands/auth.ts
+async function runAuthCommand(subcommand, argv, deps = {}) {
+  const env = deps.env ?? process.env;
   const brand = cliBrand(env);
-  const workspace = body.workspace ?? {};
-  const user = body.user ?? {};
-  const key = body.key ?? {};
-  const id = typeof workspace.id === "string" && workspace.id ? workspace.id : "default";
-  const saved = {
-    id,
-    name: typeof workspace.name === "string" && workspace.name ? workspace.name : "Workspace",
-    apiKey: body.api_key,
-    ...typeof key.id === "string" ? { keyId: key.id } : {},
-    ...typeof key.prefix === "string" ? { keyPrefix: key.prefix } : {},
-    ...login.apiUrl !== defaultApiUrl(env) ? { apiUrl: login.apiUrl } : {},
-    email: typeof user.email === "string" ? user.email : null,
-    savedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const config = updateConfig(({ pendingLogin: _drop, ...rest }) => ({
-    ...rest,
-    workspaces: { ...rest.workspaces ?? {}, [id]: saved },
-    current: id
-  }), env);
-  const others = savedWorkspaces(config).filter((entry) => entry.id !== id);
-  const envKey = envApiKey(env);
-  const envNote = envKey ? `${sourceLabel("env", env)} is set in this environment and is used instead of the saved key until you unset it.` : null;
-  if (json) {
-    printJson(io, {
-      status: "signed_in",
-      user: body.user ?? null,
-      workspace: { id: saved.id, name: saved.name },
-      key: { id: saved.keyId ?? null, prefix: saved.keyPrefix ?? null },
-      config_path: configPath(env),
-      other_workspaces: others.map((entry) => ({ id: entry.id, name: entry.name })),
-      ...envNote ? { note: envNote } : {}
-    });
-    return { exitCode: EXIT_OK };
-  }
-  const lines = [
-    `Signed in${saved.email ? ` as ${saved.email}` : ""} to ${saved.name}. The API key is saved in ${configPath(env)}.`
-  ];
-  if (others.length) {
-    lines.push(
-      `Also signed in here: ${others.map((entry) => entry.name).join(", ")}. Switch with ${brand.bin} workspaces use <name>.`
-    );
-  }
-  if (envNote) lines.push(envNote);
-  lines.push(`Next: ${brand.bin} domains list`);
-  io.out(lines.join("\n"));
-  return { exitCode: EXIT_OK };
+  const usage = `Usage: ${brand.bin} auth token [--scope <scopes>] [--workspace <name>] [--json]`;
+  if (subcommand === "token") return printToken(argv, deps, usage);
+  return { exitCode: EXIT_USAGE, error: subcommand ? `Unknown: auth ${subcommand}.
+${usage}` : usage };
 }
-async function runLogoutCommand(argv, deps = {}) {
+async function printToken(argv, deps, usage) {
   const io = deps.io ?? processIo;
   const env = deps.env ?? process.env;
   const brand = cliBrand(env);
-  const parsed = parseArgs(argv, { values: ["--workspace", "--base-url"], booleans: ["--json", "--all"] });
+  const parsed = parseArgs(argv, { values: ["--scope", "--workspace"], booleans: ["--json"] });
   if (!parsed.ok) return { exitCode: EXIT_USAGE, error: `${parsed.error}
-Usage: ${brand.bin} logout [--workspace <name>] [--all]` };
+${usage}` };
   const { args } = parsed;
-  const json = wantsJson(args, io);
+  if (args.positionals.length) return { exitCode: EXIT_USAGE, error: usage };
+  const scopeFlag = args.values["--scope"] ? parseScopeFlag(args.values["--scope"]) : null;
+  if (scopeFlag && !scopeFlag.ok) return { exitCode: EXIT_USAGE, error: `${scopeFlag.error}
+${usage}` };
   const config = loadConfig(env);
-  const all = savedWorkspaces(config);
-  let targets;
-  if (args.booleans["--all"]) {
-    targets = all;
-  } else if (args.values["--workspace"]) {
-    const match = findSavedWorkspace(config, args.values["--workspace"]);
-    if (!match.ok) {
-      return { exitCode: EXIT_FAILED, error: `Not signed in to "${args.values["--workspace"]}" on this computer.` };
-    }
-    targets = [match.workspace];
-  } else {
-    const current = config.current ? config.workspaces?.[config.current] : all.length === 1 ? all[0] : void 0;
-    if (!current && all.length > 1) {
-      return {
-        exitCode: EXIT_USAGE,
-        error: `Signed in to ${all.length} workspaces and none is picked. Say which: ${brand.bin} logout --workspace <name>, or ${brand.bin} logout --all.`
-      };
-    }
-    targets = current ? [current] : [];
-  }
-  const results = [];
-  for (const workspace of targets) {
-    const apiUrl = trimUrl(args.values["--base-url"]) || explicitApiUrl(env) || trimUrl(workspace.apiUrl) || defaultApiUrl(env);
-    let revoked = false;
-    let warning;
-    try {
-      const response = await apiRequest(apiUrl, "/cli/session", { method: "DELETE", apiKey: workspace.apiKey, env });
-      revoked = response.ok && response.body.revoked === true;
-      if (!response.ok && response.status !== 401) warning = errorMessage(response, "Could not revoke the key");
-    } catch (error) {
-      warning = error instanceof Error ? error.message : String(error);
-    }
-    results.push({ id: workspace.id, name: workspace.name, revoked, ...warning ? { warning } : {} });
-  }
-  const removing = new Set(targets.map((workspace) => workspace.id));
-  const hadPending = Boolean(config.pendingLogin);
-  if (removing.size || hadPending) {
-    updateConfig((current) => {
-      const workspaces = Object.fromEntries(
-        Object.entries(current.workspaces ?? {}).filter(([id]) => !removing.has(id))
-      );
-      const { pendingLogin: _drop, current: picked, ...rest } = current;
-      return { ...rest, workspaces, ...picked && !removing.has(picked) ? { current: picked } : {} };
-    }, env);
-  }
-  const envNote = envApiKey(env) ? `${sourceLabel("env", env)} is still set in this environment, so commands keep using it.` : null;
-  if (json) {
-    printJson(io, { signed_out: results, config_path: configPath(env), ...envNote ? { note: envNote } : {} });
-    return { exitCode: EXIT_OK };
-  }
-  if (!results.length) {
-    io.out(`Not signed in on this computer.${envNote ? ` ${envNote}` : ""}`);
-    return { exitCode: EXIT_OK };
+  const picked = args.values["--workspace"] ? findSavedWorkspace(config, args.values["--workspace"]) : currentSavedWorkspace(config, env);
+  if (!picked.ok) {
+    const reason = "error" in picked ? picked.error : `Not signed in to "${args.values["--workspace"]}" on this computer. Run ${brand.bin} login --workspace "${args.values["--workspace"]}".`;
+    return { exitCode: EXIT_FAILED, error: reason };
+  }
+  const workspace = picked.workspace;
+  if (!workspace.oauth) {
+    const envNote = envApiKey(env) ? ` ${brand.keyEnvVar} is an API key already; use it as the Bearer token directly.` : "";
+    return {
+      exitCode: EXIT_FAILED,
+      error: `The saved sign-in for ${workspace.name} is an API key from an older ${brand.bin} login, not OAuth. Run ${brand.bin} login to switch to tokens.${envNote}`
+    };
   }
-  const lines = results.map(
-    (result) => `Signed out of ${result.name}: ${result.revoked ? "the key was revoked and" : "the key was"} removed from ${configPath(env)}.${result.warning ? ` (Could not revoke it: ${result.warning} Revoke it on the API keys page.)` : ""}`
-  );
-  if (envNote) lines.push(envNote);
-  io.out(lines.join("\n"));
-  return { exitCode: EXIT_OK };
-}
-async function runWhoamiCommand(argv, deps = {}) {
-  const io = deps.io ?? processIo;
-  const env = deps.env ?? process.env;
-  const brand = cliBrand(env);
-  const parsed = parseArgs(argv, { values: [...COMMON_VALUE_FLAGS], booleans: [...COMMON_BOOLEAN_FLAGS] });
-  if (!parsed.ok) return { exitCode: EXIT_USAGE, error: `${parsed.error}
-Usage: ${brand.bin} whoami [--workspace <name>] [--json]` };
-  const { args } = parsed;
-  const resolved = resolveAuth(
-    { apiKey: args.values["--api-key"], baseUrl: args.values["--base-url"], workspace: args.values["--workspace"] },
-    env
-  );
-  if (!resolved.ok) return { exitCode: EXIT_FAILED, error: resolved.error };
-  const { auth } = resolved;
   try {
-    const response = await apiRequest(auth.baseUrl, "/cli/session", { apiKey: auth.apiKey, env });
-    if (!response.ok) {
-      const hint = response.status === 401 ? ` The key was rejected; run ${brand.bin} login to sign in again.` : "";
-      return { exitCode: EXIT_FAILED, error: `${sentence(errorMessage(response, "Could not check the sign-in"))}${hint}` };
-    }
-    const session = response.body;
-    const source = sourceLabel(auth.source, env);
-    if (wantsJson(args, io)) {
-      printJson(io, { ...response.body, source, api_url: auth.baseUrl, config_path: configPath(env) });
-      return { exitCode: EXIT_OK };
+    const apiUrl = trimUrl(workspace.apiUrl) || defaultApiUrl(env);
+    const result = await accessTokenFor(workspace, apiUrl, {
+      scope: scopeFlag?.ok ? scopeFlag.scope : null,
+      env,
+      now: deps.now
+    });
+    if (!result.ok) return { exitCode: EXIT_FAILED, error: result.error };
+    if (args.booleans["--json"]) {
+      printJson(io, { access_token: result.token, token_type: "Bearer", scope: result.scope, workspace: { id: workspace.id, name: workspace.name } });
+    } else {
+      io.out(result.token);
     }
-    io.out(
-      [
-        session.user?.email ?? "(an API key; no person is recorded for it)",
-        `Workspace: ${session.workspace?.name ?? "?"} (${session.workspace?.id ?? "?"})`,
-        `Key: ${session.key?.name ?? "?"} (${session.key?.prefix ?? "?"}\u2026${session.key?.scope === "sending" ? ", sending only" : ""}), from ${source}`,
-        ...auth.baseUrl !== defaultApiUrl(env) ? [`API: ${auth.baseUrl}`] : []
-      ].join("\n")
-    );
     return { exitCode: EXIT_OK };
   } catch (error) {
     if (error instanceof CliRequestError) return { exitCode: EXIT_FAILED, error: error.message };
@@ -2783,9 +3114,10 @@ async function switchWorkspace(argv, deps) {
 // src/cli.ts
 function printUsage() {
   console.error("Usage:");
-  console.error("  groundmail login [--workspace <name>]   sign in through the browser (no key to copy)");
-  console.error("  groundmail logout [--workspace <name>|--all]");
+  console.error("  groundmail login [--scope <scopes>] [--workspace <name>]   sign in through the browser (OAuth; no key to copy)");
+  console.error("  groundmail logout [--workspace <name>|--all]   revokes the sign-in server-side");
   console.error("  groundmail whoami");
+  console.error("  groundmail auth token [--scope <scopes>]   print a short-lived access token (for agents and scripts)");
   console.error("  groundmail workspaces list");
   console.error("  groundmail workspaces use <name|id>");
   console.error("  groundmail domains add example.com");
@@ -2840,14 +3172,18 @@ function printUsage() {
   console.error('  groundmail templates duplicate --id tpl_\u2026 [--name "Copy"]');
   console.error("  groundmail templates delete --id tpl_\u2026");
   console.error("  groundmail keys list");
-  console.error("  groundmail keys create [--name Default] [--scope full|sending]");
+  console.error("  groundmail keys create [--name Default] [--scopes emails:send,domains:read] [--allowed-domains example.com]");
   console.error("  groundmail keys delete --id <api-key-id>");
   console.error("  groundmail integrations twilio status");
   console.error("  groundmail integrations twilio connect --account-sid AC\u2026 --auth-token \u2026 --from +15551234567");
   console.error("  groundmail integrations twilio disconnect");
   console.error("");
   console.error("Environment:");
-  console.error("  GROUNDMAIL_API_KEY=gm_\u2026   optional: `groundmail login` saves a key instead");
+  console.error("  GROUNDMAIL_API_KEY=gm_\u2026   optional (CI): wins over the `groundmail login` sign-in");
+  console.error("  GROUNDMAIL_NO_KEYCHAIN=1  keep the refresh token in the config file (0600) instead of the OS keychain");
+  console.error("");
+  console.error("Scopes: full, emails:send, emails:read, domains:read, domains:write, webhooks:write, templates:write,");
+  console.error("        suppressions:write, account:read");
   console.error("  TWILIO_ACCOUNT_SID=AC\u2026 TWILIO_AUTH_TOKEN=\u2026 TWILIO_DEFAULT_FROM=+1\u2026  (integrations twilio connect)");
   console.error("  CLOUDFLARE_API_TOKEN=\u2026            (optional local apply; else uses dashboard Integrations)");
   console.error("  VERCEL_API_TOKEN=\u2026 VERCEL_TEAM_ID=\u2026  (optional local apply; else uses dashboard Integrations)");
@@ -2868,7 +3204,8 @@ async function main() {
   if (command === "logout") await finish(await runLogoutCommand(args));
   if (command === "whoami") await finish(await runWhoamiCommand(args));
   if (command === "workspaces" || command === "workspace") await finish(await runWorkspacesCommand(subcommand, args.slice(1)));
-  const session = applySavedSession(process.argv.slice(4));
+  if (command === "auth") await finish(await runAuthCommand(subcommand, args.slice(1)));
+  const session = await applySavedSession(process.argv.slice(4));
   if (session.notice) console.error(session.notice);
   const rest = session.argv;
   if (command === "domains") {