scaledthought 0.2.2 → 0.3.1

package/dist/index.js

@@ -553,7 +553,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "scaledthought",
-  version: "0.2.2",
+  version: "0.3.1",
   description: "Headless open-model inference, run by your agent. Prepaid, pay per token. US or Canada.",
   license: "MIT",
   keywords: [
@@ -631,9 +631,20 @@ function readDotEnv(cwd) {
   }
   return out;
 }
-var CREDITS_HINT = "This account has no credits for this request (inference is prepaid). Run `npx -y scaledthought@latest billing topup --amount-usd 5` (creating it charges nothing) and give your human its message_for_human. If it printed opened_in_browser: true, run `npx -y scaledthought@latest billing wait` in the same turn (again on topup_pending, up to 15 minutes): it returns as soon as they pay. Otherwise end your turn with the message and run billing wait once they're back. Then retry. Don't retry before that or create another account.";
+var CREDITS_HINT = "This account has no credits for this request (inference is prepaid). Run `npx -y scaledthought@0.3 billing topup --amount-usd 20` (creating it charges nothing) and give your human its message_for_human. If it printed opened_in_browser: true, run `npx -y scaledthought@0.3 billing wait` in the same turn (again on topup_pending, up to 15 minutes): it returns as soon as they pay. Otherwise end your turn with the message and run billing wait once they're back. Then retry. Don't retry before that or create another account.";
 var HINTS = {
-  no_key: "Run `npx -y scaledthought@latest init --region us|ca` in this directory, or set ST_API_KEY.",
+  no_key: "For an existing account run `npx -y scaledthought@0.3 login`; for a new one, `init --region us|ca`. Or set ST_API_KEY.",
+  key_exists: "This folder already has a key (ST_API_KEY in ./.env or the environment). Use it, or pass --force to replace it.",
+  authorization_pending: "Your human hasn't typed the code yet. If they have the page open, run `npx -y scaledthought@0.3 login --wait` again right away (codes last 10 minutes); otherwise remind them of the code and the URL.",
+  access_denied: "Your human denied the connection. Ask them before running login again.",
+  expired_token: "The code expired. Run `npx -y scaledthought@0.3 login` again for a new one.",
+  already_claimed: "This code was already used. Run `npx -y scaledthought@0.3 login` again for a new one.",
+  invalid_connect_code: "A connect line works once, for 15 minutes, and its code starts with stl_. Ask your human for a new line from the dashboard.",
+  too_many_failed_claims: "Too many failed connect-line claims in this region. Wait a few minutes, then retry.",
+  invalid_device_code: "Run `npx -y scaledthought@0.3 login` again for a new code.",
+  no_login_pending: "Run `npx -y scaledthought@0.3 login` first: it prints a code for your human.",
+  account_not_found: "Pass a saved account's id or exact name (see choose_account from `init`), or connect another with `login`.",
+  no_saved_accounts: "No account is saved on this machine. Run `npx -y scaledthought@0.3 login` to connect an existing one.",
   bad_key: "ST_API_KEY must look like st_{us|ca}_{live|test}_<40 chars>. Re-run init in a directory without one.",
   invalid_api_key: "The key is missing, revoked or mistyped. Check ST_API_KEY in .env; create a new one with `keys create`.",
   missing_api_key: "Send the key as `Authorization: Bearer $ST_API_KEY`.",
@@ -647,12 +658,12 @@ var HINTS = {
   credits_required_for_fine_tuning: `Fine-tuning is paid from prepaid credits. ${CREDITS_HINT}`,
   approval_required: "This change needs your human's approval. Send them the approval_url from `billing topup`; disabling or lowering auto-reload needs none.",
   daily_cap_exceeded: "An operator-set daily cap on this account is reached. It resets at 00:00 UTC. Tell your human.",
-  free_tier_limit: "Accounts that haven't bought credits have lower limits. The first credit purchase lifts them: run `billing topup --amount-usd 5` and show your human the approval_url.",
+  free_tier_limit: "Accounts that haven't bought credits have lower limits. The first credit purchase lifts them: run `billing topup --amount-usd 20` and show your human the approval_url.",
   free_tier_key_limit: "Accounts that haven't bought credits have at most 5 active keys. Revoke one with `keys revoke <id>`, or buy credits with `billing topup`.",
   too_many_pending_topups: "Two approval links are still unpaid. Ask your human to use one (see `billing status` pending_topups), or wait for them to expire.",
-  daily_topup_limit: "Top-ups are limited to $2,000 per account per rolling 24 hours (open links and auto-reloads included). Use a smaller amount (see available_usd) or wait.",
-  billing_upgrade_removed: "Run `billing topup --amount-usd 5` and show your human the approval_url.",
-  gone: "This endpoint was removed. For credits use `billing topup --amount-usd 5`.",
+  daily_topup_limit: "Top-ups are limited to $2,000 per account per rolling 24 hours (open links and auto-reloads included). Use a smaller amount (see available_usd) or wait. Need more than $2,000 a day? Invoiced prepayment: sales@scaledthought.com",
+  billing_upgrade_removed: "Run `billing topup --amount-usd 20` and show your human the approval_url.",
+  gone: "This endpoint was removed. For credits use `billing topup --amount-usd 20`.",
   fine_tuning_requires_self_hosted: "This base model can't be fine-tuned in your region (it isn't served on our own GPUs). Choose another base model.",
   rate_limit_exceeded: "Wait the number of seconds in retry_after, then retry.",
   session_limit_exceeded: "Too many realtime sessions are open on this key. Close one, then retry.",
@@ -905,8 +916,8 @@ async function speak(ctx, o) {
 
 // src/commands.ts
 import { spawn } from "node:child_process";
-import { chmodSync, existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync } from "node:fs";
-import { join as join3, resolve as resolve2 } from "node:path";
+import { chmodSync as chmodSync3, existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join5, resolve as resolve2 } from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
@@ -7887,6 +7898,179 @@ var AD_WRITE_CREDENTIAL_ENV = {
   microsoft: "AD_WRITE_MICROSOFT_CREDENTIALS"
 };
 var AD_WRITE_CREDENTIAL_ENV_NAMES = Object.values(AD_WRITE_CREDENTIAL_ENV);
+// ../../packages/growth/src/portfolio.ts
+var PORTFOLIO_LIMITS = {
+  weeklyBudgetMicros: 1e9,
+  founders: ["alexey-scaled-throught", "josh-scaledthought"],
+  effortDayMicros: 50000000
+};
+var FUNNEL_STAGES = ["click", "fetch", "signup", "activated", "paid"];
+var EXPERIMENT_KINDS = ["paid", "owned", "onboarding", "lifecycle", "community", "research"];
+var AGENT_ROLES = [
+  "growth-lead",
+  "analyst",
+  "onboarding",
+  "seo",
+  "paid-ads",
+  "landing",
+  "lifecycle",
+  "content",
+  "community",
+  "research",
+  "integrations",
+  "canada"
+];
+var EXPERIMENT_STATUSES = ["proposed", "approved", "running", "read", "killed", "scaled"];
+var EXPERIMENT_METRICS = [
+  "ctr",
+  "fetch_rate",
+  "agent_fetches",
+  "human_visits",
+  "signups",
+  "activation_rate",
+  "paid_rate",
+  "topup_request_rate",
+  "topup_completion_rate",
+  "cost_per_activated",
+  "cost_per_payer",
+  "onboarding_success_rate",
+  "time_to_first_call",
+  "npm_downloads",
+  "github_stars",
+  "registry_installs"
+];
+var SURFACE_TYPES = [
+  "page",
+  "copy",
+  "code",
+  "listing",
+  "cli",
+  "notice",
+  "ad",
+  "post",
+  "email",
+  "external",
+  "price"
+];
+var TIER2_SURFACES = new Set(["ad", "post", "email", "price", "listing", "external"]);
+var SURFACE_RE = new RegExp(`^(${SURFACE_TYPES.join("|")}):[^\\s*]+\\*?$`);
+var EXPERIMENT_ID_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var CAMPAIGN_ID_RE = /^gcm_[0-9A-HJKMNP-TV-Z]{26}$/;
+var Day = string2().refine(isDay, "a UTC day, YYYY-MM-DD");
+var Bps = number2().int().min(0).max(1e4);
+var Micros = number2().int().min(0);
+var DecisionRule = discriminatedUnion("kind", [
+  object({ kind: literal("p_better"), threshold: number2().min(0.5).max(0.999) }),
+  object({ kind: literal("rate_at_least"), bps: Bps }),
+  object({ kind: literal("cost_at_most"), micros: Micros })
+]);
+var ExperimentSpec = object({
+  id: string2().max(64).regex(EXPERIMENT_ID_RE, "kebab-case, the file name without .yaml"),
+  title: string2().min(5).max(120),
+  hypothesis: string2().min(20).max(600),
+  owner: _enum(AGENT_ROLES),
+  kind: _enum(EXPERIMENT_KINDS),
+  stage: _enum(FUNNEL_STAGES),
+  tier: union([literal(0), literal(1), literal(2)]),
+  status: _enum(EXPERIMENT_STATUSES),
+  created: Day,
+  surfaces: array(string2().regex(SURFACE_RE, "<type>:<target>, e.g. page:/docs/cursor")).min(1),
+  codes: array(CodeSchema).default([]),
+  metric: object({ primary: _enum(EXPERIMENT_METRICS), guardrail: _enum(EXPERIMENT_METRICS).optional() }),
+  design: object({
+    type: _enum(["ab", "single", "discovery", "synthetic"]),
+    variants: array(string2().min(1).max(40)).optional(),
+    arms: record(string2().min(1).max(40), array(CodeSchema).min(1)).optional()
+  }),
+  run: object({ from: Day, to: Day }).optional(),
+  decision: object({ read_on: Day, min_n: number2().int().min(1), rule: DecisionRule }),
+  budget: object({ weekly_micros: Micros }).default({ weekly_micros: 0 }),
+  estimate: object({
+    p_win_bps: Bps,
+    lift_bps: number2().int().min(1).max(1e5),
+    baseline_per_week: number2().min(0),
+    effort_days: number2().min(0).max(30)
+  }),
+  approval: object({ by: string2().optional(), on: Day.optional(), note: string2().min(3).max(300).optional() }).strict().optional(),
+  campaigns: array(string2().regex(CAMPAIGN_ID_RE, "a console campaign id, gcm_<ulid>")).max(10).default([]),
+  result: object({
+    read: Day,
+    outcome: _enum(["win", "loss", "inconclusive", "stopped"]),
+    summary: string2().min(10).max(1000)
+  }).optional()
+}).strict();
+
+// ../../packages/growth/src/campaigns.ts
+var KEYWORD_MATCH_TYPES = ["exact", "phrase", "broad"];
+var GOOGLE_AD_LIMITS = {
+  headline: 30,
+  description: 90,
+  path: 15,
+  headlinesMin: 3,
+  headlinesMax: 15,
+  descriptionsMin: 2,
+  descriptionsMax: 4,
+  keyword: 80,
+  keywordWords: 10,
+  adGroups: 20,
+  keywordsPerAdGroup: 200,
+  adsPerAdGroup: 3,
+  negativeKeywords: 500
+};
+var CampaignId = string2().regex(CAMPAIGN_ID_RE, "a campaign id, gcm_<ulid>");
+var Line = (max, what) => string2().trim().min(1).refine((s) => [...s].length <= max, `${what}: at most ${max} characters`);
+var Keyword = object({
+  text: Line(GOOGLE_AD_LIMITS.keyword, "keyword").refine((s) => s.split(/\s+/).length <= GOOGLE_AD_LIMITS.keywordWords, `keyword: at most ${GOOGLE_AD_LIMITS.keywordWords} words`),
+  match: _enum(KEYWORD_MATCH_TYPES)
+}).strict();
+var SearchAd = object({
+  headlines: array(Line(GOOGLE_AD_LIMITS.headline, "headline")).min(GOOGLE_AD_LIMITS.headlinesMin).max(GOOGLE_AD_LIMITS.headlinesMax),
+  descriptions: array(Line(GOOGLE_AD_LIMITS.description, "description")).min(GOOGLE_AD_LIMITS.descriptionsMin).max(GOOGLE_AD_LIMITS.descriptionsMax),
+  path1: Line(GOOGLE_AD_LIMITS.path, "path").optional(),
+  path2: Line(GOOGLE_AD_LIMITS.path, "path").optional()
+}).strict().refine((a) => !a.path2 || a.path1, "path2 needs path1");
+var AdGroup2 = object({
+  name: string2().trim().min(1).max(255),
+  keywords: array(Keyword).min(1).max(GOOGLE_AD_LIMITS.keywordsPerAdGroup),
+  ads: array(SearchAd).min(1).max(GOOGLE_AD_LIMITS.adsPerAdGroup),
+  negative_keywords: array(Keyword).max(GOOGLE_AD_LIMITS.negativeKeywords).default([])
+}).strict();
+var CampaignContent = object({
+  ad_groups: array(AdGroup2).min(1).max(GOOGLE_AD_LIMITS.adGroups),
+  negative_keywords: array(Keyword).max(GOOGLE_AD_LIMITS.negativeKeywords).default([])
+}).strict();
+var CAMPAIGN_NETWORKS = ["search", "search_partners", "display"];
+var CampaignTargeting = object({
+  locations: array(string2().trim().min(2).max(80)).min(1).max(50),
+  location_mode: _enum(["presence", "presence_or_interest"]).default("presence"),
+  languages: array(string2().trim().min(2).max(10)).min(1).max(20),
+  networks: array(_enum(CAMPAIGN_NETWORKS)).min(1).max(3).default(["search"])
+}).strict();
+var Day2 = string2().refine(isDay, "a UTC day, YYYY-MM-DD");
+var Budget = number2().int().positive().max(PORTFOLIO_LIMITS.weeklyBudgetMicros);
+var CAMPAIGN_FIELD_SHAPE = {
+  name: string2().trim().min(3).max(120),
+  code: CodeSchema,
+  experiment_id: string2().max(64).regex(EXPERIMENT_ID_RE).nullable(),
+  ad_account_id: string2().trim().min(1).max(64).nullable(),
+  final_url: string2().trim().max(200),
+  daily_budget_micros: Budget.nullable(),
+  weekly_budget_micros: Budget.nullable(),
+  run_from: Day2,
+  run_to: Day2,
+  targeting: CampaignTargeting,
+  content: CampaignContent,
+  notes: string2().trim().max(4000).nullable()
+};
+var CampaignFields = object({
+  ...CAMPAIGN_FIELD_SHAPE,
+  experiment_id: CAMPAIGN_FIELD_SHAPE.experiment_id.default(null),
+  ad_account_id: CAMPAIGN_FIELD_SHAPE.ad_account_id.default(null),
+  daily_budget_micros: CAMPAIGN_FIELD_SHAPE.daily_budget_micros.default(null),
+  weekly_budget_micros: CAMPAIGN_FIELD_SHAPE.weekly_budget_micros.default(null),
+  notes: CAMPAIGN_FIELD_SHAPE.notes.default(null)
+}).strict();
+var CampaignFieldsPatch = object(CAMPAIGN_FIELD_SHAPE).partial().strict();
 // ../../packages/growth/src/sinks/google.ts
 var GOOGLE_DATA_MANAGER_URL = "https://datamanager.googleapis.com/v1/events:ingest";
 var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
@@ -8197,35 +8381,9 @@ var PERMANENT_FIRST_PURCHASE_SKIPS = new Set([
   "account_not_active"
 ]);
 // ../../packages/growth/src/experiments.ts
-var EXPERIMENTS = {
-  "first-paying-customers": {
-    title: "First paying customers",
-    hypothesis: "Developers who use coding agents will pay for open models when their agent sets everything up from one pasted prompt.",
-    spend: { from: "2026-10-06", to: "2026-10-19" },
-    tailDays: 7,
-    payWindowDays: 14,
-    activationDays: 7,
-    passCostMicros: 20000000,
-    stopCostMicros: 40000000,
-    minPaidRateBps: 500,
-    lowPaidRateBps: 200,
-    minPayers: 12,
-    verdictMinSpendMicros: 300000000,
-    verdictMinActivations: 15,
-    pauseCheckDay: 10,
-    readMinMatured: 30,
-    excludedAccountIds: [],
-    messages: { A: "Agent", B: "Free", C: "Private" },
-    platforms: ["reddit", "google", "x", "ethicalads"],
-    plan: {
-      fetchPerClickBps: 2000,
-      activatedPerFetchBps: 7500,
-      paidPerActivatedBps: 500,
-      costPerPayerMicros: 333000000
-    }
-  }
-};
+var EXPERIMENTS = {};
 var EXPERIMENT_KEYS = Object.keys(EXPERIMENTS);
+var DEFAULT_EXPERIMENT_KEY = EXPERIMENT_KEYS[0] ?? null;
 var EXPERIMENT_PHASES = ["before", "spending", "reading_payment", "payment_read", "tail_read"];
 // ../../packages/growth/src/go-hits.ts
 var GO_HIT_KINDS = ["human", "agent"];
@@ -8286,13 +8444,13 @@ var EthicalAdsCredentials = object({
 var credentials3 = (creds) => parseCredentialsJson(creds[ENV7], EthicalAdsCredentials);
 var ethicalAdsApiAccount = (creds) => credentials3(creds).advertiser;
 var Num3 = union([number2(), string2()]).nullable().optional();
-var Day = object({ date: string2().optional(), index: string2().optional(), views: Num3, clicks: Num3, cost: Num3 });
+var Day3 = object({ date: string2().optional(), index: string2().optional(), views: Num3, clicks: Num3, cost: Num3 });
 var Report = object({
-  days: array(Day).default([]),
+  days: array(Day3).default([]),
   flights: array(object({
     name: string2().nullable().optional(),
     slug: string2(),
-    report: object({ days: array(Day).default([]) }).nullable().optional()
+    report: object({ days: array(Day3).default([]) }).nullable().optional()
   })).default([])
 });
 var dayOf2 = (d) => (d.date ?? d.index ?? "").slice(0, 10);
@@ -8938,102 +9096,8 @@ var ethicalAds2 = withApi(ethicalAds, "ethicalads", pullEthicalAds, ethicalAdsAp
 var microsoftAds2 = withApi(microsoftAds, "microsoft", pullMicrosoftAds, microsoftApiAccount);
 var linkedInAds2 = withApi(linkedInAds, "linkedin", pullLinkedInAds, linkedInApiAccount);
 var metaAds2 = withApi(metaAds, "meta", pullMetaAds, metaApiAccount);
-// ../../packages/growth/src/portfolio.ts
-var FUNNEL_STAGES = ["click", "fetch", "signup", "activated", "paid"];
-var EXPERIMENT_KINDS = ["paid", "owned", "onboarding", "lifecycle", "community", "research"];
-var AGENT_ROLES = [
-  "growth-lead",
-  "analyst",
-  "onboarding",
-  "seo",
-  "paid-ads",
-  "landing",
-  "lifecycle",
-  "content",
-  "community",
-  "research",
-  "integrations",
-  "canada"
-];
-var EXPERIMENT_STATUSES = ["proposed", "approved", "running", "read", "killed", "scaled"];
-var EXPERIMENT_METRICS = [
-  "ctr",
-  "fetch_rate",
-  "agent_fetches",
-  "human_visits",
-  "signups",
-  "activation_rate",
-  "paid_rate",
-  "topup_request_rate",
-  "topup_completion_rate",
-  "cost_per_activated",
-  "cost_per_payer",
-  "onboarding_success_rate",
-  "time_to_first_call",
-  "npm_downloads",
-  "github_stars",
-  "registry_installs"
-];
-var SURFACE_TYPES = [
-  "page",
-  "copy",
-  "code",
-  "listing",
-  "cli",
-  "notice",
-  "ad",
-  "post",
-  "email",
-  "external",
-  "price"
-];
-var TIER2_SURFACES = new Set(["ad", "post", "email", "price", "listing", "external"]);
-var SURFACE_RE = new RegExp(`^(${SURFACE_TYPES.join("|")}):[^\\s*]+\\*?$`);
-var EXPERIMENT_ID_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var Day2 = string2().refine(isDay, "a UTC day, YYYY-MM-DD");
-var Bps = number2().int().min(0).max(1e4);
-var Micros = number2().int().min(0);
-var DecisionRule = discriminatedUnion("kind", [
-  object({ kind: literal("p_better"), threshold: number2().min(0.5).max(0.999) }),
-  object({ kind: literal("rate_at_least"), bps: Bps }),
-  object({ kind: literal("cost_at_most"), micros: Micros })
-]);
-var ExperimentSpec = object({
-  id: string2().max(64).regex(EXPERIMENT_ID_RE, "kebab-case, the file name without .yaml"),
-  title: string2().min(5).max(120),
-  hypothesis: string2().min(20).max(600),
-  owner: _enum(AGENT_ROLES),
-  kind: _enum(EXPERIMENT_KINDS),
-  stage: _enum(FUNNEL_STAGES),
-  tier: union([literal(0), literal(1), literal(2)]),
-  status: _enum(EXPERIMENT_STATUSES),
-  created: Day2,
-  surfaces: array(string2().regex(SURFACE_RE, "<type>:<target>, e.g. page:/docs/cursor")).min(1),
-  codes: array(CodeSchema).default([]),
-  metric: object({ primary: _enum(EXPERIMENT_METRICS), guardrail: _enum(EXPERIMENT_METRICS).optional() }),
-  design: object({
-    type: _enum(["ab", "single", "discovery", "synthetic"]),
-    variants: array(string2().min(1).max(40)).optional(),
-    arms: record(string2().min(1).max(40), array(CodeSchema).min(1)).optional()
-  }),
-  run: object({ from: Day2, to: Day2 }).optional(),
-  decision: object({ read_on: Day2, min_n: number2().int().min(1), rule: DecisionRule }),
-  budget: object({ weekly_micros: Micros }).default({ weekly_micros: 0 }),
-  estimate: object({
-    p_win_bps: Bps,
-    lift_bps: number2().int().min(1).max(1e5),
-    baseline_per_week: number2().min(0),
-    effort_days: number2().min(0).max(30)
-  }),
-  approval: object({ by: string2(), on: Day2 }).optional(),
-  result: object({
-    read: Day2,
-    outcome: _enum(["win", "loss", "inconclusive", "stopped"]),
-    summary: string2().min(10).max(1000)
-  }).optional()
-}).strict();
 // ../../packages/growth/src/results-schema.ts
-var Day3 = string2().regex(/^\d{4}-\d{2}-\d{2}$/);
+var Day4 = string2().regex(/^\d{4}-\d{2}-\d{2}$/);
 var Micros2 = number2().int();
 var Count = number2().int().nonnegative();
 var Bps2 = number2().int();
@@ -9065,7 +9129,7 @@ var CodeResultRow = ResultRow.extend({
   channel: string2(),
   message: string2().nullable(),
   status: string2(),
-  paused_on: Day3.nullable(),
+  paused_on: Day4.nullable(),
   sample_ok: boolean2(),
   pause_suggested: boolean2(),
   leading: boolean2(),
@@ -9097,8 +9161,8 @@ var Scorecard = object({
   real_use: object({ eligible: Count, returned: Count, rate_bps: Bps2.nullable() })
 });
 var Read = object({
-  signups_from: Day3,
-  signups_to: Day3,
+  signups_from: Day4,
+  signups_to: Day4,
   scorecard: Scorecard,
   by_message: array(ResultRow),
   by_channel: array(ResultRow),
@@ -9120,7 +9184,7 @@ var RuleOutcome = _enum([
 ]);
 var Rule = object({
   id: RuleId,
-  date: Day3,
+  date: Day4,
   status: RuleStatus,
   outcome: RuleOutcome,
   codes: array(string2()),
@@ -9129,7 +9193,7 @@ var Rule = object({
 var PlatformFinality = object({
   platform: string2(),
   spend_micros: Micros2,
-  final_through: Day3.nullable(),
+  final_through: Day4.nullable(),
   last_import_at: string2().nullable(),
   last_import_source: _enum(["csv", "api", "manual"]).nullable()
 });
@@ -9154,13 +9218,13 @@ var Checks = object({
   }),
   spread: array(object({
     code: string2(),
-    paused_on: Day3,
+    paused_on: Day4,
     signups_after: Count,
     verdict_changes: boolean2()
   })),
   spend: object({
     final: boolean2(),
-    final_through: Day3.nullable(),
+    final_through: Day4.nullable(),
     platforms: array(PlatformFinality),
     unattributed_micros: Micros2,
     unattributed_rows: Count
@@ -9186,13 +9250,13 @@ var GrowthResults = object({
     key: string2(),
     title: string2(),
     hypothesis: string2(),
-    spend: object({ from: Day3, to: Day3 }),
+    spend: object({ from: Day4, to: Day4 }),
     dates: object({
-      pause_check: Day3,
-      cost_read: Day3,
-      payment_read: Day3,
-      tail_read: Day3,
-      tail_signups_to: Day3
+      pause_check: Day4,
+      cost_read: Day4,
+      payment_read: Day4,
+      tail_read: Day4,
+      tail_signups_to: Day4
     }),
     thresholds: object({
       pass_cost_micros: Micros2,
@@ -9213,7 +9277,7 @@ var GrowthResults = object({
       cost_per_payer_micros: Micros2
     })
   }),
-  as_of: Day3,
+  as_of: Day4,
   day: number2().int(),
   phase: _enum(EXPERIMENT_PHASES),
   read: Read,
@@ -9225,7 +9289,7 @@ var GrowthResults = object({
   decisions: array(GrowthDecision)
 });
 // ../../packages/schemas/src/legal.ts
-var TERMS_VERSION = "2026-10-10";
+var TERMS_VERSION = "2026-10-11";
 var LEGAL_SITE = "https://scaledthought.com";
 var LEGAL_PATHS = {
   index: "/legal",
@@ -9233,78 +9297,564 @@ var LEGAL_PATHS = {
   privacy: "/legal/privacy",
   acceptableUse: "/legal/acceptable-use",
   creditsAndRefunds: "/legal/credits-and-refunds",
-  subprocessors: "/legal/subprocessors",
   security: "/legal/security"
 };
 var TERMS_URL = `${LEGAL_SITE}${LEGAL_PATHS.terms}`;
 var PRIVACY_URL = `${LEGAL_SITE}${LEGAL_PATHS.privacy}`;
 var ACCEPTABLE_USE_URL = `${LEGAL_SITE}${LEGAL_PATHS.acceptableUse}`;
 var REFUND_POLICY_URL = `${LEGAL_SITE}${LEGAL_PATHS.creditsAndRefunds}`;
-var TERMS_NOTICE = `By creating this account you accept the ScaledThought Terms of Service (${TERMS_URL}) and Privacy Policy ` + `(${PRIVACY_URL}) on behalf of the person or organisation you act for, who is the customer.`;
+var TERMS_NOTICE = `Nothing has been accepted on your behalf. You accept the ScaledThought Terms of Service (${TERMS_URL}) and the ` + `Credits & Refunds policy (${REFUND_POLICY_URL}) yourself when you buy credits. Privacy Policy: ${PRIVACY_URL}.`;
 
-// src/commands.ts
-var NPX = "npx -y scaledthought@latest";
-var FIRST_TOPUP_USD = 5;
-var TOPUP_COMMAND = `${NPX} billing topup --amount-usd ${FIRST_TOPUP_USD}`;
-var WAIT_COMMAND = `${NPX} billing wait`;
-var WAIT_PATIENCE_MIN = 15;
-var CREDIT_STEPS = [
-  `Inference is prepaid and this account has no credits yet: completions return 402 insufficient_credits until your human pays. Do these first, in order:`,
-  `1. Run: ${TOPUP_COMMAND}. It opens the checkout page in your human's browser and prints approval_url, topup_id and message_for_human. Creating it charges nothing: don't ask first.`,
-  `2. If opened_in_browser is true, the checkout page (where your human accepts the Terms and pays $${FIRST_TOPUP_USD} by card) is already in front of them: tell them so with message_for_human and, in the same turn, run: ${WAIT_COMMAND}. It returns status "paid" with the new balance as soon as they pay; on topup_pending run it again, for up to ${WAIT_PATIENCE_MIN} minutes in all. Don't wait for them to say they've paid.`,
-  `3. If opened_in_browser is false (or it's still unpaid after ${WAIT_PATIENCE_MIN} minutes), end your turn with message_for_human: it holds the approval_url exactly as printed. When they're back, run ${WAIT_COMMAND}. Either way, don't retry the call and don't create another account.`,
-  "4. Then make the call below."
-];
-function nextSteps(model, needsCredits) {
-  return [
-    ...needsCredits ? CREDIT_STEPS : [],
-    model ? `Verify with one real completion: ${NPX} chat -m ${model} "Reply with OK" (or POST $ST_BASE_URL/chat/completions with that model)` : `No chat model is live in this region right now. Check again with: ${NPX} models --live`,
-    `Or let the router pick: ${NPX} chat -m auto "Reply with OK"`,
-    "Use it from code: any OpenAI SDK with base_url=$ST_BASE_URL and api_key=$ST_API_KEY (both are in .env)",
-    `Optional, connect MCP: ${NPX} mcp`,
-    ...needsCredits ? [] : [`More credits when needed: ${TOPUP_COMMAND} returns an approval_url for your human (inference is prepaid)`]
-  ];
+// src/connect.ts
+import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { hostname } from "node:os";
+import { basename as basename2, join as join4 } from "node:path";
+
+// src/credentials.ts
+import { spawnSync } from "node:child_process";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { join as join3 } from "node:path";
+var SERVICE = "scaledthought";
+var slot = (a) => `${a.region}:${a.account_id}`;
+var SLOT_RE = /^(us|ca):acct_[0-9A-Za-z]{1,40}$/;
+function writePrivate(file, data) {
+  writeFileSync(file, `${JSON.stringify(data, null, 2)}
+`, { mode: 384 });
+  chmodSync(file, 384);
 }
-var balanceOf = (b) => b && typeof b.balance_usd === "number" ? b.balance_usd : null;
-function termsOf(acct = {}) {
+function readJson(file, fallback) {
+  try {
+    return existsSync2(file) ? JSON.parse(readFileSync3(file, "utf8")) : fallback;
+  } catch {
+    return fallback;
+  }
+}
+function fileBackend(dir) {
+  const file = join3(dir, "credentials.json");
+  const all = () => readJson(file, {});
   return {
-    url: acct.terms_url ?? TERMS_URL,
-    version: acct.terms_version ?? TERMS_VERSION,
-    refund_policy_url: REFUND_POLICY_URL,
-    notice: acct.terms_notice ?? TERMS_NOTICE
+    where: "~/.config/scaledthought/credentials.json (0600)",
+    get: (s) => all()[s] ?? null,
+    set: (s, key) => {
+      writePrivate(file, { ...all(), [s]: key });
+      return true;
+    },
+    del: (s) => {
+      const a = all();
+      delete a[s];
+      writePrivate(file, a);
+    }
   };
 }
-async function liveSummary(ctx, region, balanceUsd) {
-  const live = await listModels(ctx, { live: true, region });
-  const suggested = live.find((m) => m.category !== "embedding" && m.modality === "chat")?.id ?? null;
-  const needsCredits = (balanceUsd ?? 0) <= 0;
+function keychainBackend() {
   return {
-    balance_usd: balanceUsd ?? 0,
-    needs_credits: needsCredits,
-    next_command: needsCredits ? TOPUP_COMMAND : `${NPX} chat -m ${suggested ?? "auto"} "Reply with OK"`,
-    newest_models: live.slice(0, 5),
-    suggested_model: suggested,
-    next_steps: nextSteps(suggested, needsCredits)
+    where: "macOS Keychain (service scaledthought)",
+    get: (s) => {
+      const r = spawnSync("security", ["find-generic-password", "-s", SERVICE, "-a", s, "-w"], { encoding: "utf8" });
+      return r.status === 0 ? r.stdout.trim() || null : null;
+    },
+    set: (s, key) => spawnSync("security", ["-i"], {
+      input: `add-generic-password -U -s ${SERVICE} -a ${s} -l ScaledThought -w ${key}
+`,
+      encoding: "utf8"
+    }).status === 0,
+    del: (s) => {
+      spawnSync("security", ["delete-generic-password", "-s", SERVICE, "-a", s], { encoding: "utf8" });
+    }
   };
 }
-function signupAttribution(region, opts) {
-  const warnings = [];
-  let source;
-  if (opts.source !== undefined) {
-    source = normalizeCode(opts.source) ?? undefined;
-    if (!source)
-      warnings.push("--source was not a campaign code (like a-rd) and was not sent. The account is created without it.");
-  }
-  let adClick;
-  if (opts.adClick !== undefined) {
-    if (region !== "us")
-      warnings.push("--ad-click is used only in the us region and was not sent.");
-    else {
-      const token = opts.adClick.trim().replace(/\)$/, "");
-      if (!AD_CLICK_TOKEN_RE.test(token))
-        warnings.push("--ad-click was not a valid ad-click token and was not sent.");
-      else
-        adClick = token;
+function secretToolBackend() {
+  return {
+    where: "the Secret Service keyring (secret-tool, service scaledthought)",
+    get: (s) => {
+      const r = spawnSync("secret-tool", ["lookup", "service", SERVICE, "account", s], { encoding: "utf8" });
+      return r.status === 0 ? r.stdout.trim() || null : null;
+    },
+    set: (s, key) => spawnSync("secret-tool", ["store", `--label=ScaledThought ${s}`, "service", SERVICE, "account", s], {
+      input: key,
+      encoding: "utf8"
+    }).status === 0,
+    del: (s) => {
+      spawnSync("secret-tool", ["clear", "service", SERVICE, "account", s], { encoding: "utf8" });
+    }
+  };
+}
+var has = (bin) => spawnSync(bin, ["--help"], { stdio: "ignore" }).error === undefined;
+function storeAt(dir, os) {
+  const indexFile = join3(dir, "accounts.json");
+  const file = fileBackend(dir);
+  const index = () => readJson(indexFile, []).filter((e) => SLOT_RE.test(slot(e)));
+  const ensureDir = () => mkdirSync(dir, { recursive: true, mode: 448 });
+  let where = os?.where ?? file.where;
+  return {
+    get where() {
+      return where;
+    },
+    list: () => index().map(({ in: _in, ...a }) => a),
+    getKey: (a) => {
+      const e = index().find((x) => slot(x) === slot(a));
+      if (!e)
+        return null;
+      return (e.in === "os" && os ? os.get(slot(a)) : file.get(slot(a))) ?? null;
+    },
+    save: (a, key) => {
+      ensureDir();
+      let into = "file";
+      if (os?.set(slot(a), key))
+        into = "os";
+      else
+        file.set(slot(a), key);
+      where = into === "os" && os ? os.where : file.where;
+      writePrivate(indexFile, [...index().filter((x) => slot(x) !== slot(a)), { ...a, in: into }]);
+    },
+    remove: (a) => {
+      const e = index().find((x) => slot(x) === slot(a));
+      if (!e)
+        return;
+      if (e.in === "os" && os)
+        os.del(slot(a));
+      else
+        file.del(slot(a));
+      writePrivate(indexFile, index().filter((x) => slot(x) !== slot(a)));
+    },
+    touch: (a) => {
+      const all = index();
+      const e = all.find((x) => slot(x) === slot(a));
+      if (!e)
+        return;
+      e.last_used_at = new Date().toISOString();
+      writePrivate(indexFile, all);
+    }
+  };
+}
+function machineStore(env, platform = process.platform) {
+  const mode = env.ST_CREDENTIAL_STORE;
+  const home = env.HOME || env.USERPROFILE;
+  if (mode === "off" || !home)
+    return null;
+  const dir = join3(env.XDG_CONFIG_HOME || join3(home, ".config"), "scaledthought");
+  let os = null;
+  if (mode !== "file") {
+    if (platform === "darwin" && existsSync2("/usr/bin/security"))
+      os = keychainBackend();
+    else if (platform === "linux" && env.DBUS_SESSION_BUS_ADDRESS && has("secret-tool"))
+      os = secretToolBackend();
+  }
+  return storeAt(dir, os);
+}
+
+// src/connect.ts
+var LOGIN_DIR = ".scaledthought";
+var LOGIN_FILE = join4(LOGIN_DIR, "login.json");
+var KEY_SAVED_TO = ".env (ST_API_KEY, ST_BASE_URL)";
+var CONNECT_CODE_RE = /^stl_[A-Za-z0-9_-]{22,64}$/;
+var PROJECT_SCOPES = ["inference", "read", "keys", "billing"];
+var storeOf = (ctx) => ctx.store !== undefined ? ctx.store : machineStore(ctx.env);
+function defaultClientLabel(env, host = hostname()) {
+  const keys = Object.keys(env).filter((k) => env[k] !== undefined && env[k] !== "");
+  const tool = env.CLAUDECODE ? "Claude Code" : keys.some((k) => k.startsWith("CODEX_")) ? "Codex" : keys.some((k) => k.startsWith("CURSOR_")) ? "Cursor" : "CLI";
+  return `${tool} on ${host.replace(/\.local$/, "")}`.slice(0, 80);
+}
+function readLoginState(cwd) {
+  const f = join4(cwd, LOGIN_FILE);
+  if (!existsSync3(f))
+    return null;
+  try {
+    const s = JSON.parse(readFileSync4(f, "utf8"));
+    return typeof s.device_code === "string" && (s.region === "us" || s.region === "ca") ? s : null;
+  } catch {
+    return null;
+  }
+}
+function writeLoginState(cwd, s) {
+  mkdirSync2(join4(cwd, LOGIN_DIR), { recursive: true, mode: 448 });
+  const f = join4(cwd, LOGIN_FILE);
+  writeFileSync2(f, `${JSON.stringify(s)}
+`, { mode: 384 });
+  chmodSync2(f, 384);
+  ensureIgnored(cwd, `${LOGIN_DIR}/`);
+}
+var clearLoginState = (cwd) => rmSync(join4(cwd, LOGIN_FILE), { force: true });
+function ensureIgnored(cwd, entry) {
+  const gi = join4(cwd, ".gitignore");
+  const text = existsSync3(gi) ? readFileSync4(gi, "utf8") : "";
+  const bare = entry.replace(/\/$/, "");
+  if (text.split(/\r?\n/).some((l) => [entry, bare, `/${entry}`, `/${bare}`].includes(l.trim())))
+    return;
+  const sep = text === "" || text.endsWith(`
+`) ? "" : `
+`;
+  writeFileSync2(gi, `${text}${sep}${entry}
+`);
+}
+function refuseExistingKey(ctx, force) {
+  if (force)
+    return;
+  const where = ctx.env.ST_API_KEY ? "the ST_API_KEY environment variable" : readDotEnv(ctx.cwd).ST_API_KEY ? "./.env" : null;
+  if (where)
+    throw new CliError("key_exists", `This folder already has a ScaledThought key (${where}). Nothing was changed.`);
+}
+function saveToStore(ctx, a, key, noSave) {
+  if (noSave)
+    return false;
+  const store = storeOf(ctx);
+  if (!store)
+    return false;
+  try {
+    store.save({ ...a, saved_at: new Date().toISOString() }, key);
+    return store.where;
+  } catch {
+    return false;
+  }
+}
+function finish(ctx, c, o) {
+  writeEnv(ctx.cwd, { ST_API_KEY: c.api_key, ST_BASE_URL: c.base_url });
+  ensureGitignored(ctx.cwd);
+  const saved = saveToStore(ctx, { region: c.region, account_id: c.account_id, account_name: c.account_name, base_url: c.base_url }, c.api_key, o.noSave);
+  clearLoginState(ctx.cwd);
+  return {
+    status: "connected",
+    account_id: c.account_id,
+    account_name: c.account_name,
+    region: c.region,
+    key_name: c.key_name,
+    key_saved_to: KEY_SAVED_TO,
+    saved_to_credential_store: saved !== false,
+    ...saved ? { credential_store: saved } : {}
+  };
+}
+var claim2 = (ctx, region, body) => api(ctx, "POST", "/v1/device/token", { auth: false, region, body });
+async function login(ctx, o = {}) {
+  refuseExistingKey(ctx, o.force);
+  const region = o.region ?? "us";
+  const label = (o.label ?? defaultClientLabel(ctx.env)).slice(0, 80);
+  const r = await api(ctx, "POST", "/v1/device/codes", { auth: false, region, body: { client_label: label, origin: "agent" } });
+  writeLoginState(ctx.cwd, {
+    device_code: r.device_code,
+    region,
+    origin: "agent",
+    user_code: r.user_code,
+    created_at: new Date().toISOString()
+  });
+  const noOpen = o.noOpen || ctx.env.ST_NO_BROWSER === "1";
+  const opened = !noOpen && await (o.open ?? openInBrowser)(r.verification_url);
+  return {
+    status: "pending",
+    user_code: r.user_code,
+    verification_url: r.verification_url,
+    opened_in_browser: opened,
+    expires_in: r.expires_in,
+    client_label: label,
+    message_for_human: opened ? `To connect this agent to your ScaledThought account, I've opened ${r.verification_url}. Sign in and type the code ${r.user_code}.` : `To connect this agent to your ScaledThought account, open ${r.verification_url}, sign in and type the code ${r.user_code}.`,
+    next_command: `${NPX} login --wait`,
+    next_steps: [
+      opened ? `Tell your human message_for_human, then in the same turn run: ${NPX} login --wait. On authorization_pending run it again, for up to 10 minutes in all.` : `Give your human message_for_human and end your turn. When they say they've typed the code, run: ${NPX} login --wait.`,
+      "Never put the code in a link: the human types it on the page."
+    ]
+  };
+}
+async function loginWait(ctx, o = {}) {
+  const s = readLoginState(ctx.cwd);
+  if (s?.origin !== "agent")
+    throw new CliError("no_login_pending", "No login is waiting in this folder.");
+  refuseExistingKey(ctx, o.force);
+  const deadline = Date.now() + (o.timeoutS ?? 90) * 1000;
+  for (;; ) {
+    try {
+      return finish(ctx, await claim2(ctx, s.region, { device_code: s.device_code }), o);
+    } catch (e) {
+      if (!(e instanceof CliError))
+        throw e;
+      if (e.code !== "authorization_pending") {
+        if (["expired_token", "access_denied", "already_claimed", "invalid_device_code"].includes(e.code))
+          clearLoginState(ctx.cwd);
+        throw e;
+      }
+      if (Date.now() >= deadline)
+        throw new CliError("authorization_pending", "Your human hasn't approved the code yet.", undefined, {
+          user_code: s.user_code ?? null
+        });
+    }
+    await new Promise((r) => setTimeout(r, o.pollMs ?? 5000));
+  }
+}
+async function loginWithCode(ctx, o) {
+  const code = o.code.trim();
+  if (!CONNECT_CODE_RE.test(code))
+    throw new CliError("invalid_connect_code", "That isn't a connect line's code (it starts with stl_). Copy the whole line from the dashboard.");
+  refuseExistingKey(ctx, o.force);
+  const region = o.region ?? "us";
+  const label = (o.label ?? defaultClientLabel(ctx.env)).slice(0, 80);
+  return finish(ctx, await claim2(ctx, region, { connect_code: code, client_label: label }), o);
+}
+var usdOf = (b) => b && typeof b.balance_usd === "number" ? b.balance_usd : null;
+var withKey = (ctx, key) => ({ ...ctx, env: { ...ctx.env, ST_API_KEY: key } });
+async function projectKey(ctx, store, a) {
+  const key = store.getKey(a);
+  if (!key || regionOfKey(key) !== a.region)
+    return null;
+  const folder = basename2(ctx.cwd) || "project";
+  const name = `project: ${folder}`.slice(0, 80);
+  let created;
+  try {
+    created = await api(withKey(ctx, key), "POST", "/v1/keys", {
+      body: {
+        name,
+        child: true,
+        scopes: PROJECT_SCOPES,
+        lives_in: `env:${hostname()}:${ctx.cwd}`.slice(0, 300)
+      }
+    });
+  } catch (e) {
+    if (e instanceof CliError && ["invalid_api_key", "key_expired", "account_suspended"].includes(e.code)) {
+      store.remove(a);
+      return null;
+    }
+    if (e instanceof CliError && (e.code === "insufficient_scope" || e.code === "scope_not_allowed")) {
+      writeEnv(ctx.cwd, { ST_API_KEY: key, ST_BASE_URL: a.base_url });
+      ensureGitignored(ctx.cwd);
+      store.touch(a);
+      return { key, key_id: null, key_name: "this machine's saved key (it can't make project keys)" };
+    }
+    throw e;
+  }
+  writeEnv(ctx.cwd, { ST_API_KEY: created.api_key, ST_BASE_URL: a.base_url });
+  ensureGitignored(ctx.cwd);
+  store.touch(a);
+  return { key: created.api_key, key_id: created.id, key_name: created.name };
+}
+var label = (a, balance) => balance == null ? a.account_name : `${a.account_name} ($${balance.toFixed(2)})`;
+async function reuseSavedAccount(ctx, o) {
+  const store = storeOf(ctx);
+  const saved = (store?.list() ?? []).filter((a) => !o.region || a.region === o.region);
+  if (!store || saved.length === 0) {
+    if (o.account)
+      throw new CliError("no_saved_accounts", `No account is saved on this machine${o.region ? ` in ${o.region}` : ""}.`);
+    return null;
+  }
+  let pick;
+  if (o.account) {
+    const want = o.account.trim().toLowerCase();
+    pick = saved.find((a) => a.account_id.toLowerCase() === want) ?? saved.find((a) => a.account_name.toLowerCase() === want);
+    if (!pick)
+      throw new CliError("account_not_found", `No saved account named or numbered "${o.account}".`, undefined, {
+        saved_accounts: saved.map((a) => ({ account_id: a.account_id, name: a.account_name, region: a.region }))
+      });
+  } else if (saved.length > 1) {
+    const rows = await Promise.all(saved.map(async (a) => {
+      const key = store.getKey(a);
+      const b = key ? await api(withKey(ctx, key), "GET", "/v1/billing").catch(() => null) : null;
+      return { a, balance: usdOf(b) };
+    }));
+    rows.sort((x, y) => (y.a.last_used_at ?? y.a.saved_at).localeCompare(x.a.last_used_at ?? x.a.saved_at));
+    const names = rows.map((r) => label(r.a, r.balance));
+    return {
+      status: "choose_account",
+      choose_account: rows.map((r) => ({
+        account_id: r.a.account_id,
+        name: r.a.account_name,
+        region: r.a.region,
+        balance_usd: r.balance,
+        last_used: (r.a.last_used_at ?? r.a.saved_at).slice(0, 10)
+      })),
+      message_for_human: `Which ScaledThought account should this repo use: ${names.slice(0, -1).join(", ")} or ${names.at(-1)}? Or a new one for separate billing?`,
+      next_steps: [
+        "Ask your human message_for_human and end your turn. Nothing was created.",
+        `Then run: ${NPX} init --account "<name or account_id>" (or ${NPX} init --new-account for a separate, new account).`
+      ]
+    };
+  } else
+    pick = saved[0];
+  const made = await projectKey(ctx, store, pick);
+  if (!made) {
+    if (o.account)
+      throw new CliError("account_not_found", `The key saved for ${pick.account_name} no longer works, so it was forgotten.`, `Connect it again with \`${NPX} login\`.`);
+    return reuseSavedAccount(ctx, o);
+  }
+  const billing = await api(withKey(ctx, made.key), "GET", "/v1/billing").catch(() => null);
+  return {
+    already_initialized: false,
+    reused_account: true,
+    account_id: pick.account_id,
+    account_name: pick.account_name,
+    region: pick.region,
+    base_url: pick.base_url,
+    key_name: made.key_name,
+    key_id: made.key_id,
+    key_saved_to: KEY_SAVED_TO,
+    saved_to_credential_store: true,
+    note: `This folder uses ${pick.account_name}, the account saved on this machine, with its own project key. To switch: ${NPX} use "<name>". For a separate account: ${NPX} init --new-account.`,
+    ...await liveSummary(withKey(ctx, made.key), pick.region, usdOf(billing))
+  };
+}
+async function afterNewAccount(ctx, a, o) {
+  const saved = saveToStore(ctx, {
+    region: a.region,
+    account_id: a.account_id,
+    account_name: a.name?.trim() || `Account ${a.account_id.slice(-6)}`,
+    base_url: a.base_url
+  }, a.api_key, o.noSave);
+  let existingCode = null;
+  try {
+    const r = await api(withKey(ctx, a.api_key), "POST", "/v1/device/codes", { body: { origin: "init", client_label: (o.label ?? defaultClientLabel(ctx.env)).slice(0, 80) } });
+    if (typeof r.device_code === "string") {
+      writeLoginState(ctx.cwd, {
+        device_code: r.device_code,
+        region: a.region,
+        origin: "init",
+        user_code: typeof r.user_code === "string" ? r.user_code : undefined,
+        new_account_id: a.account_id,
+        created_at: new Date().toISOString()
+      });
+      existingCode = typeof r.user_code === "string" ? r.user_code : null;
+    }
+  } catch {}
+  return { saved, existingCode };
+}
+function existingAccountCode(cwd) {
+  const s = readLoginState(cwd);
+  return s?.origin === "init" && s.user_code ? s.user_code : null;
+}
+var existingAccountHint = (code) => `If you already have a ScaledThought account, choose "Use it instead" on that page and type the code ${code}: I'll use that account and nothing is charged.`;
+async function useAccount(ctx, o) {
+  const store = storeOf(ctx);
+  const saved = store?.list() ?? [];
+  if (!store || saved.length === 0)
+    throw new CliError("no_saved_accounts", "No account is saved on this machine.");
+  const want = o.target.trim().toLowerCase();
+  const pick = saved.find((a) => a.account_id.toLowerCase() === want) ?? saved.find((a) => a.account_name.toLowerCase() === want);
+  if (!pick)
+    throw new CliError("account_not_found", `No saved account named or numbered "${o.target}".`, undefined, {
+      saved_accounts: saved.map((a) => ({ account_id: a.account_id, name: a.account_name, region: a.region }))
+    });
+  const oldKey = readDotEnv(ctx.cwd).ST_API_KEY;
+  if (oldKey) {
+    const cur = await api(withKey(ctx, oldKey), "GET", "/v1/account").catch(() => null);
+    if (cur?.account_id === pick.account_id)
+      return { status: "unchanged", account_id: pick.account_id, account_name: pick.account_name };
+  }
+  const made = await projectKey(ctx, store, pick);
+  if (!made)
+    throw new CliError("account_not_found", `The key saved for ${pick.account_name} no longer works, so it was forgotten.`, `Connect it again with \`${NPX} login --force\`.`);
+  let oldRevoked = false;
+  if (oldKey && !saved.some((a) => store.getKey(a) === oldKey)) {
+    oldRevoked = await api(withKey(ctx, oldKey), "DELETE", "/v1/keys/self").then(() => true, () => false);
+  }
+  return {
+    status: "switched",
+    account_id: pick.account_id,
+    account_name: pick.account_name,
+    region: pick.region,
+    key_name: made.key_name,
+    key_saved_to: KEY_SAVED_TO,
+    old_key_revoked: oldRevoked,
+    ...ctx.env.ST_API_KEY ? { warnings: ["ST_API_KEY is set in the environment and overrides ./.env: unset it to use the new key."] } : {}
+  };
+}
+async function connectedExisting(ctx, o = {}) {
+  const s = readLoginState(ctx.cwd);
+  if (s?.origin !== "init")
+    return null;
+  let c;
+  try {
+    c = await claim2(ctx, s.region, { device_code: s.device_code });
+  } catch (e) {
+    if (e instanceof CliError && ["expired_token", "access_denied", "already_claimed"].includes(e.code))
+      clearLoginState(ctx.cwd);
+    return null;
+  }
+  const done = finish(ctx, c, o);
+  const store = storeOf(ctx);
+  if (c.closed_account && store)
+    store.remove({ region: s.region, account_id: c.closed_account });
+  const billing = await api(withKey(ctx, c.api_key), "GET", "/v1/billing").catch(() => null);
+  const balance = usdOf(billing);
+  return {
+    status: "connected_existing",
+    account_id: c.account_id,
+    account_name: c.account_name,
+    balance_usd: balance,
+    key_name: c.key_name,
+    key_saved_to: KEY_SAVED_TO,
+    saved_to_credential_store: done.saved_to_credential_store,
+    closed_account: c.closed_account ? `${c.closed_account} (new, never paid)` : null,
+    message_for_human: `You already had an account, so I've connected to it instead: ${c.account_name}${balance == null ? "" : `, $${balance.toFixed(2)} left`}. Nothing was charged.`
+  };
+}
+async function readCodeFrom(stream) {
+  let text = "";
+  for await (const chunk of stream) {
+    text += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    if (text.includes(`
+`) || text.length > 4096)
+      break;
+  }
+  return /\bstl_[A-Za-z0-9_-]+/.exec(text)?.[0] ?? (text.split(/\r?\n/)[0] ?? "").trim();
+}
+
+// src/commands.ts
+var NPX = "npx -y scaledthought@0.3";
+var FIRST_TOPUP_USD = 20;
+var TOPUP_COMMAND = `${NPX} billing topup --amount-usd ${FIRST_TOPUP_USD}`;
+var WAIT_COMMAND = `${NPX} billing wait`;
+var WAIT_PATIENCE_MIN = 15;
+var CREDIT_STEPS = [
+  `Inference is prepaid and this account has no credits yet: completions return 402 insufficient_credits until your human pays. Do these first, in order:`,
+  `1. Run: ${TOPUP_COMMAND}. It opens the checkout page in your human's browser and prints approval_url, topup_id and message_for_human. Creating it charges nothing: don't ask first.`,
+  `2. If opened_in_browser is true, the funding page (where your human confirms $${FIRST_TOPUP_USD}, can turn on auto-reload, accepts the Terms and pays by card) is already in front of them: tell them so with message_for_human and, in the same turn, run: ${WAIT_COMMAND}. It returns status "paid" with the new balance as soon as they pay; on topup_pending run it again, for up to ${WAIT_PATIENCE_MIN} minutes in all. Don't wait for them to say they've paid.`,
+  `3. If opened_in_browser is false (or it's still unpaid after ${WAIT_PATIENCE_MIN} minutes), end your turn with message_for_human: it holds the approval_url exactly as printed. When they're back, run ${WAIT_COMMAND}. Either way, don't retry the call and don't create another account.`,
+  "4. Then make the call below."
+];
+function nextSteps(model, needsCredits) {
+  return [
+    ...needsCredits ? CREDIT_STEPS : [],
+    model ? `Verify with one real completion: ${NPX} chat -m ${model} "Reply with OK" (or POST $ST_BASE_URL/chat/completions with that model)` : `No chat model is live in this region right now. Check again with: ${NPX} models --live`,
+    `Or let the router pick: ${NPX} chat -m auto "Reply with OK"`,
+    "Use it from code: any OpenAI SDK with base_url=$ST_BASE_URL and api_key=$ST_API_KEY (both are in .env)",
+    `Optional, connect MCP: ${NPX} mcp`,
+    ...needsCredits ? [] : [`More credits when needed: ${TOPUP_COMMAND} returns an approval_url for your human (inference is prepaid)`]
+  ];
+}
+var balanceOf = (b) => b && typeof b.balance_usd === "number" ? b.balance_usd : null;
+function termsOf(acct = {}) {
+  return {
+    url: acct.terms_url ?? TERMS_URL,
+    version: acct.terms_version ?? TERMS_VERSION,
+    refund_policy_url: REFUND_POLICY_URL,
+    notice: acct.terms_notice ?? TERMS_NOTICE
+  };
+}
+async function liveSummary(ctx, region, balanceUsd) {
+  const live = await listModels(ctx, { live: true, region });
+  const suggested = live.find((m) => m.category !== "embedding" && m.modality === "chat")?.id ?? null;
+  const needsCredits = (balanceUsd ?? 0) <= 0;
+  return {
+    balance_usd: balanceUsd ?? 0,
+    needs_credits: needsCredits,
+    next_command: needsCredits ? TOPUP_COMMAND : `${NPX} chat -m ${suggested ?? "auto"} "Reply with OK"`,
+    newest_models: live.slice(0, 5),
+    suggested_model: suggested,
+    next_steps: nextSteps(suggested, needsCredits)
+  };
+}
+function signupAttribution(region, opts) {
+  const warnings = [];
+  let source;
+  if (opts.source !== undefined) {
+    source = normalizeCode(opts.source) ?? undefined;
+    if (!source)
+      warnings.push("--source was not a campaign code (like a-rd) and was not sent. The account is created without it.");
+  }
+  let adClick;
+  if (opts.adClick !== undefined) {
+    if (region !== "us")
+      warnings.push("--ad-click is used only in the us region and was not sent.");
+    else {
+      const token = opts.adClick.trim().replace(/\)$/, "");
+      if (!AD_CLICK_TOKEN_RE.test(token))
+        warnings.push("--ad-click was not a valid ad-click token and was not sent.");
+      else
+        adClick = token;
     }
   }
   return { source, ad_click: adClick, warnings };
@@ -9331,6 +9881,13 @@ async function init(ctx, opts) {
       ...ignored.length ? { warnings: [`${ignored.join(" and ")} apply only to a new account and were not sent.`] } : {}
     };
   }
+  if (opts.account && opts.newAccount)
+    throw new CliError("bad_argument", "Pass --account or --new-account, not both.");
+  if (!opts.newAccount) {
+    const reused = await reuseSavedAccount(ctx, { region: opts.region, account: opts.account });
+    if (reused)
+      return reused;
+  }
   const region = opts.region ?? "us";
   const attribution = signupAttribution(region, opts);
   const acct = await api(ctx, "POST", "/v1/accounts", {
@@ -9346,6 +9903,7 @@ async function init(ctx, opts) {
   });
   writeEnv(ctx.cwd, { ST_API_KEY: acct.api_key, ST_BASE_URL: acct.base_url });
   ensureGitignored(ctx.cwd);
+  const { saved, existingCode } = await afterNewAccount(ctx, { ...acct, name: opts.name }, { noSave: opts.noSave });
   const keyed = { ...ctx, env: { ...ctx.env, ST_API_KEY: acct.api_key } };
   const billing = await api(keyed, "GET", "/v1/billing").catch(() => null);
   return {
@@ -9354,6 +9912,11 @@ async function init(ctx, opts) {
     region: acct.region,
     base_url: acct.base_url,
     key_saved_to: ".env (ST_API_KEY, ST_BASE_URL)",
+    saved_to_credential_store: saved !== false,
+    ...saved ? {
+      credential_store: `${saved}: other folders on this machine reuse this account (init there makes a project key). Opt out with --no-save.`
+    } : {},
+    ...existingCode ? { existing_account_code: existingCode, existing_account_hint: existingAccountHint(existingCode) } : {},
     terms: termsOf(acct),
     ...attribution.source ? { source: acct.source ?? attribution.source } : {},
     ...await liveSummary(keyed, acct.region, balanceOf(billing)),
@@ -9361,26 +9924,26 @@ async function init(ctx, opts) {
   };
 }
 function writeEnv(cwd, vars) {
-  const f = join3(cwd, ".env");
+  const f = join5(cwd, ".env");
   const names = new Set(Object.keys(vars));
-  const kept = existsSync2(f) ? readFileSync3(f, "utf8").split(/\r?\n/).filter((l) => !names.has(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(l)?.[1] ?? "")) : [];
+  const kept = existsSync4(f) ? readFileSync5(f, "utf8").split(/\r?\n/).filter((l) => !names.has(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(l)?.[1] ?? "")) : [];
   while (kept.length && kept[kept.length - 1].trim() === "")
     kept.pop();
   const lines = [...kept, ...Object.entries(vars).map(([k, v]) => `${k}=${v}`)];
-  writeFileSync(f, `${lines.join(`
+  writeFileSync3(f, `${lines.join(`
 `)}
 `, { mode: 384 });
-  chmodSync(f, 384);
+  chmodSync3(f, 384);
 }
 function ensureGitignored(cwd) {
-  const gi = join3(cwd, ".gitignore");
-  const text = existsSync2(gi) ? readFileSync3(gi, "utf8") : "";
+  const gi = join5(cwd, ".gitignore");
+  const text = existsSync4(gi) ? readFileSync5(gi, "utf8") : "";
   if (/^\/?\.env\*?\s*$/m.test(text))
     return;
   const sep = text === "" || text.endsWith(`
 `) ? "" : `
 `;
-  writeFileSync(gi, `${text}${sep}.env
+  writeFileSync3(gi, `${text}${sep}.env
 `);
 }
 function isCatalogRow(m) {
@@ -9542,9 +10105,9 @@ async function chat(ctx, o) {
   };
 }
 var billingStatus = async (ctx) => withoutFreeFields(await api(ctx, "GET", "/v1/billing"));
-var TOPUP_LIMITS = { min_usd: 5, max_usd: 2000, daily_max_usd: 2000, auto_reload_monthly_max_usd: 1e4 };
+var TOPUP_LIMITS = { min_usd: 20, max_usd: 2000, daily_max_usd: 2000 };
 function checkTopupLimits(amountUsd, autoReload) {
-  const { min_usd, max_usd, daily_max_usd, auto_reload_monthly_max_usd } = TOPUP_LIMITS;
+  const { min_usd, max_usd, daily_max_usd } = TOPUP_LIMITS;
   const range = (flag, v, lo, hi) => {
     if (v < lo || v > hi)
       throw new CliError("bad_argument", `--${flag} must be between ${lo} and ${hi.toLocaleString("en-US")}, got ${v}.`, `Top-ups are $${min_usd} to $${max_usd.toLocaleString("en-US")} each, and at most $${daily_max_usd.toLocaleString("en-US")} per account per rolling 24 hours (auto-reloads included).`);
@@ -9553,9 +10116,9 @@ function checkTopupLimits(amountUsd, autoReload) {
   if (!autoReload)
     return;
   range("auto-reload-amount", autoReload.amount_usd, min_usd, max_usd);
-  range("auto-reload-below", autoReload.threshold_usd, 0.01, max_usd);
-  if (autoReload.monthly_limit_usd !== undefined)
-    range("auto-reload-monthly-max", autoReload.monthly_limit_usd, autoReload.amount_usd, auto_reload_monthly_max_usd);
+  range("auto-reload-below", autoReload.threshold_usd, 5, max_usd);
+  if (autoReload.monthly_limit_usd != null)
+    range("auto-reload-monthly-max", autoReload.monthly_limit_usd, autoReload.amount_usd, Number.POSITIVE_INFINITY);
 }
 var TOPUP_DONE = new Set(["paid", "expired", "failed", "canceled"]);
 function topupNextSteps(topupId, amountUsd, opened, autoReload) {
@@ -9595,32 +10158,87 @@ async function billingTopup(ctx, o) {
   });
   const noOpen = o.noOpen || ctx.env.ST_NO_BROWSER === "1";
   const opened = !noOpen && !!created.approval_url && await (o.open ?? openInBrowser)(created.approval_url);
+  const existing = existingAccountCode(ctx.cwd);
+  const message = messageForHuman(created.approval_url, o.amountUsd, o.autoReload, opened);
   return {
     status: "pending",
     ...created,
     opened_in_browser: opened,
-    message_for_human: messageForHuman(created.approval_url, o.amountUsd, o.autoReload, opened),
+    message_for_human: message && existing ? `${message}
+
+${existingAccountHint(existing)}` : message,
     next_steps: topupNextSteps(created.topup_id, o.amountUsd, opened, o.autoReload)
   };
 }
+async function billingAutoReloadSetup(ctx, o = {}) {
+  const body = {
+    ...o.thresholdUsd !== undefined ? { threshold_usd: o.thresholdUsd } : {},
+    ...o.amountUsd !== undefined ? { amount_usd: o.amountUsd } : {}
+  };
+  const created = await api(ctx, "POST", "/v1/billing/auto-reload/setup", {
+    body
+  });
+  const noOpen = o.noOpen || ctx.env.ST_NO_BROWSER === "1";
+  const opened = !noOpen && !!created.approval_url && await (o.open ?? openInBrowser)(created.approval_url);
+  const wait = `${WAIT_COMMAND} ${created.topup_id}`;
+  return {
+    status: "pending",
+    ...created,
+    opened_in_browser: opened,
+    message_for_human: setupMessageForHuman(created.approval_url, created.auto_reload, opened),
+    next_steps: [
+      opened ? `The page is already open in your human's browser: don't open it again. Tell them with message_for_human, then in the same turn run: ${wait}. It returns status "paid" once the card is saved and auto-reload is on; on topup_pending run it again, for up to ${WAIT_PATIENCE_MIN} minutes in all.` : `Give your human message_for_human now and end your turn there: it holds the approval_url exactly as printed. When they're back, run: ${wait}.`,
+      "Nothing is charged now. `billing auto-reload off` turns it off without approval."
+    ]
+  };
+}
 function messageForHuman(approvalUrl, amountUsd, autoReload, opened = false) {
   if (!approvalUrl)
     return null;
-  const reload = autoReload ? ` It also turns on auto-reload: $${autoReload.amount_usd} whenever the balance drops below $${autoReload.threshold_usd}${autoReload.monthly_limit_usd ? `, at most $${autoReload.monthly_limit_usd} a month` : ""}.` : "";
+  const reload = autoReload ? `Auto-reload is pre-selected there: $${autoReload.amount_usd} whenever the balance drops below $${autoReload.threshold_usd}, so I don't stall when credits run low; untick it if you'd rather not.` : "I recommend turning on auto-reload there, so I don't stall when credits run low.";
+  const rest = `${reload} Then you accept the Terms of Service and the Credits & Refunds policy and pay by card. Nothing is charged until you approve, and we email you a receipt.`;
   if (opened)
-    return `To finish the setup, I've opened the ScaledThought checkout page in your browser to buy $${amountUsd} of prepaid credits (USD). If it didn't open, use this link:
+    return `To finish the setup, I've opened the ScaledThought funding page in your browser for $${amountUsd} of prepaid credits (USD); you can change the amount there. If it didn't open, use this link:
 
 ${approvalUrl}
 
-On that page you accept the Terms of Service and the Credits & Refunds policy and pay by card. Nothing is charged until you approve.${reload} I'm watching for the payment and will carry on as soon as it goes through.`;
-  return `To finish the setup, please buy $${amountUsd} of prepaid ScaledThought credits (USD) here:
+${rest} I'm watching for the payment and will carry on as soon as it goes through.`;
+  return `To finish the setup, please add $${amountUsd} of prepaid ScaledThought credits (USD) here (you can change the amount):
 
 ${approvalUrl}
 
-On that page you accept the Terms of Service and the Credits & Refunds policy and pay by card. Nothing is charged until you approve.${reload} Tell me when it's done and I'll continue.`;
+${rest} Tell me when it's done and I'll continue.`;
+}
+function setupMessageForHuman(approvalUrl, terms, opened = false) {
+  if (!approvalUrl)
+    return null;
+  const what = `turn on auto-reload: whenever the balance drops below $${terms.threshold_usd}, $${terms.amount_usd} of prepaid credits (USD) is added from a card you save, so I don't stall when credits run low. You can change those amounts on the page. Nothing is charged now, and I can turn it off any time.`;
+  if (opened)
+    return `I've opened a ScaledThought page in your browser to ${what} If it didn't open, use this link:
+
+${approvalUrl}
+
+I'm watching and will carry on as soon as it's set up.`;
+  return `Please use this ScaledThought page to ${what}
+
+${approvalUrl}
+
+Tell me when it's done and I'll continue.`;
 }
 var WAIT_DEFAULT_S = 90;
 async function billingWait(ctx, o = {}) {
+  try {
+    return await billingWaitOnce(ctx, o);
+  } catch (e) {
+    if (e instanceof CliError && ["invalid_api_key", "topup_canceled", "account_suspended"].includes(e.code)) {
+      const switched = await connectedExisting(ctx, { noSave: o.noSave });
+      if (switched)
+        return switched;
+    }
+    throw e;
+  }
+}
+async function billingWaitOnce(ctx, o) {
   let id = o.topupId;
   if (id !== undefined && !/^top_[0-9A-Za-z]+$/.test(id))
     throw new CliError("bad_argument", `"${id}" is not a top-up id (top_...).`, "Use topup_id from `billing topup`.");
@@ -9666,7 +10284,7 @@ async function billingTopupAndWait(ctx, o) {
 var billingAutoReloadOff = (ctx) => api(ctx, "PATCH", "/v1/billing/auto-reload", { body: { enabled: false } });
 var billingTransactions = (ctx, o = {}) => api(ctx, "GET", `/v1/billing/transactions${o.cursor ? `?cursor=${encodeURIComponent(o.cursor)}` : ""}`);
 function billingUpgradeRemoved() {
-  throw new CliError("billing_upgrade_removed", "billing upgrade (monthly caps) was replaced by prepaid credits.", `Run \`${NPX} billing topup --amount-usd 5\` and send your human the approval_url. Optional auto-reload: add --auto-reload-below 2 --auto-reload-amount 10.`);
+  throw new CliError("billing_upgrade_removed", "billing upgrade (monthly caps) was replaced by prepaid credits.", `Run \`${NPX} billing topup --amount-usd 20\` and send your human the approval_url. They can turn on auto-reload on the same page.`);
 }
 var benchmarks = (ctx, id, region) => api(ctx, "GET", `/v1/models/${encodeURIComponent(id)}/benchmarks`, {
   auth: false,
@@ -9675,10 +10293,10 @@ var benchmarks = (ctx, id, region) => api(ctx, "GET", `/v1/models/${encodeURICom
 async function uploadJsonl(ctx, path, purpose) {
   const { key, region } = resolveKey(ctx);
   const file = resolve2(ctx.cwd, path);
-  if (!existsSync2(file))
+  if (!existsSync4(file))
     throw new CliError("file_not_found", `No file at ${path}.`, "Pass the path to a .jsonl file.");
   const form = new FormData;
-  form.set("file", new Blob([readFileSync3(file)], { type: "application/jsonl" }), path.split("/").pop() ?? "data.jsonl");
+  form.set("file", new Blob([readFileSync5(file)], { type: "application/jsonl" }), path.split("/").pop() ?? "data.jsonl");
   form.set("purpose", purpose);
   const res = await ctx.fetch(`${controlUrl(region, ctx.env)}/v1/files`, {
     method: "POST",
@@ -9733,9 +10351,9 @@ var VIDEO_WAIT_MS = 30 * 60000;
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function imageDataUrl(ctx, path) {
   const file = resolve2(ctx.cwd, path);
-  if (!existsSync2(file))
+  if (!existsSync4(file))
     throw new CliError("file_not_found", `No file at ${path}.`, "Pass the path to a PNG, JPEG or WebP image.");
-  const data = readFileSync3(file);
+  const data = readFileSync5(file);
   if (data.byteLength > 10 * 1024 * 1024)
     throw new CliError("input_reference_too_large", "Images are limited to 10 MiB.");
   const type = data[0] === 255 && data[1] === 216 ? "image/jpeg" : data[0] === 137 && data[1] === 80 ? "image/png" : data.subarray(8, 12).toString() === "WEBP" ? "image/webp" : null;
@@ -9771,7 +10389,7 @@ async function videoDownload(ctx, id, output, variant = "video") {
     throw await responseError(res);
   const data = Buffer.from(await res.arrayBuffer());
   const path = resolve2(ctx.cwd, output);
-  writeFileSync(path, data);
+  writeFileSync3(path, data);
   return {
     id,
     variant,
@@ -9876,9 +10494,23 @@ function mcpSetup(ctx) {
     openapi: `${controlUrl(region, ctx.env)}/openapi.json`
   };
 }
+var DASH_PAGES = ["overview", "billing", "keys", "members", "connect"];
+async function dashboardOpen(ctx, o = {}) {
+  if (o.page !== undefined && !DASH_PAGES.includes(o.page))
+    throw new CliError("bad_argument", `--page must be one of ${DASH_PAGES.join(", ")}.`, "e.g. --page billing");
+  const r = await api(ctx, "POST", "/v1/dashboard/link", { body: { ...o.page ? { page: o.page } : {}, ...o.email ? { email: o.email } : {} } });
+  const noOpen = o.noOpen || ctx.env.ST_NO_BROWSER === "1";
+  const opened = !noOpen && await (o.open ?? openInBrowser)(r.url);
+  return {
+    ...r,
+    opened_in_browser: opened,
+    message_for_human: opened ? r.message_for_human : r.message_for_human.replace("I've opened your ScaledThought dashboard.", `Your ScaledThought dashboard: ${r.url}`)
+  };
+}
+var membersList = (ctx) => api(ctx, "GET", "/v1/members");
 
 // src/decide.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { resolve as resolve3 } from "node:path";
 var DEFAULT_DECISION_MODEL = "open-jev-27b";
 var usage2 = (msg) => new CliError("usage_error", msg, 'Example: --question urgent:noul:"Is this urgent?" (see decide --help)');
@@ -9950,7 +10582,7 @@ function readState(ctx, o) {
   if (o.stateFile !== undefined) {
     let text;
     try {
-      text = readFileSync4(resolve3(ctx.cwd, o.stateFile), "utf8");
+      text = readFileSync6(resolve3(ctx.cwd, o.stateFile), "utf8");
     } catch {
       throw usage2("--state-file could not be read.");
     }
@@ -9967,7 +10599,7 @@ function decisionRequest(ctx, o) {
       throw usage2("--file holds the whole request; don't combine it with --state or --question.");
     let body;
     try {
-      body = JSON.parse(readFileSync4(resolve3(ctx.cwd, o.file), "utf8"));
+      body = JSON.parse(readFileSync6(resolve3(ctx.cwd, o.file), "utf8"));
     } catch {
       throw usage2("--file must be a readable JSON file.");
     }
@@ -10000,8 +10632,827 @@ async function decide2(ctx, body) {
   return { ...out, region: res.headers.get("x-st-region"), request_id: res.headers.get("x-st-request-id") };
 }
 
+// src/destinations/run.ts
+import { spawn as spawn2 } from "node:child_process";
+var TIMEOUT_MS2 = 120000;
+var spawnRunner = (cmd, args, opts) => new Promise((resolve, reject) => {
+  const child = spawn2(cmd, args, {
+    cwd: opts.cwd,
+    env: opts.env ? { ...process.env, ...opts.env } : process.env,
+    shell: false,
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true
+  });
+  let stdout = "";
+  let stderr = "";
+  const timer = setTimeout(() => child.kill("SIGTERM"), TIMEOUT_MS2);
+  child.stdout.on("data", (d) => {
+    stdout += d.toString("utf8");
+  });
+  child.stderr.on("data", (d) => {
+    stderr += d.toString("utf8");
+  });
+  child.on("error", (e) => {
+    clearTimeout(timer);
+    reject(e);
+  });
+  child.on("close", (code) => {
+    clearTimeout(timer);
+    resolve({ code: code ?? 1, stdout, stderr });
+  });
+  child.stdin.on("error", () => {});
+  child.stdin.end(opts.stdin ?? "");
+});
+var isMissing = (e) => e?.code === "ENOENT";
+function redact(text, secrets) {
+  let out = text;
+  for (const s of secrets)
+    if (s)
+      out = out.split(s).join("[redacted]");
+  return out.replace(/st_(ca|us)_(live|test)_[0-9A-Za-z]{8,}/g, "[redacted]");
+}
+async function probe(io, p, args, stdin) {
+  try {
+    return await io.run(p.cmd, args, { cwd: io.cwd, stdin });
+  } catch (e) {
+    if (isMissing(e))
+      throw missing(p);
+    throw new CliError("destination_failed", `Could not start ${p.cmd}.`, p.install);
+  }
+}
+async function exec(io, p, args, o = {}) {
+  const r = await probe(io, p, args, o.stdin);
+  if (r.code !== 0) {
+    const detail = redact(r.stderr || r.stdout, [...o.secrets ?? [], o.stdin ?? ""]).trim().slice(-300);
+    throw new CliError("destination_failed", `\`${o.shown ?? `${p.cmd} ${args.slice(0, 3).join(" ")}`}\` failed (exit code ${r.code}).`, p.login, detail ? { detail } : {});
+  }
+  return r.stdout;
+}
+function missing(p) {
+  return new CliError("destination_cli_missing", `\`${p.cmd}\` isn't installed or isn't on PATH.`, p.install);
+}
+var SAFE = /^[A-Za-z0-9_.@:+=][A-Za-z0-9_.@:+=-]*$/;
+var SAFE_SLASH = /^[A-Za-z0-9_.@:+=][A-Za-z0-9_.@:+=/-]*$/;
+var isSafeValue = (v, o = {}) => typeof v === "string" && v.length <= 120 && (o.slash ? SAFE_SLASH : SAFE).test(v);
+function safeValue(flag, v, o = {}) {
+  if (!isSafeValue(v, o))
+    throw new CliError("bad_argument", `--${flag} "${v.slice(0, 60)}" isn't a valid name${o.slash ? "" : " (no slashes)"}.`, "Use letters, digits and . _ - : @ (it must not start with -).");
+  return v;
+}
+
+// src/destinations/types.ts
+var PUT_FLAGS = [
+  "repo",
+  "env",
+  "app",
+  "project",
+  "worker",
+  "secret",
+  "aws-region",
+  "locations",
+  "namespace",
+  "context",
+  "config"
+];
+var keyName = (s) => s.length <= 80 ? s : `${s.slice(0, 79)}…`;
+
+// src/destinations/aws.ts
+var AWS = {
+  cmd: "aws",
+  install: "Install the AWS CLI and configure it: https://aws.amazon.com/cli/, then `aws configure` or `aws sso login`.",
+  login: "Check `aws sts get-caller-identity` and that you may manage Secrets Manager secrets in that region."
+};
+function target(region, secret) {
+  return {
+    livesIn: `aws:${region}/${secret}`,
+    keyName: keyName(`aws: ${region} / ${secret}`),
+    params: { region, secret }
+  };
+}
+var FROM_STDIN = ["--secret-string", "file:///dev/stdin"];
+var aws = {
+  id: "aws",
+  label: "AWS Secrets Manager",
+  flags: ["aws-region", "secret"],
+  async resolve(f, io) {
+    let region = f["aws-region"] ?? io.env.AWS_REGION ?? io.env.AWS_DEFAULT_REGION;
+    if (!region)
+      region = (await probe(io, AWS, ["configure", "get", "region"])).stdout.trim();
+    if (!region)
+      throw new CliError("bad_argument", "Which AWS region?", "Pass --aws-region, e.g. us-east-1.");
+    const secret = safeValue("secret", f.secret ?? "scaledthought/api-key", { slash: true });
+    return target(safeValue("aws-region", region), secret);
+  },
+  parse(rest) {
+    const i = rest.indexOf("/");
+    const region = rest.slice(0, i);
+    const secret = rest.slice(i + 1);
+    return i > 0 && isSafeValue(region) && isSafeValue(secret, { slash: true }) ? target(region, secret) : null;
+  },
+  async put(t, secret, io) {
+    const { region, secret: name } = t.params;
+    const exists = await probe(io, AWS, ["secretsmanager", "describe-secret", "--secret-id", name, "--region", region]);
+    const args = exists.code === 0 ? ["secretsmanager", "put-secret-value", "--secret-id", name, ...FROM_STDIN, "--region", region] : ["secretsmanager", "create-secret", "--name", name, ...FROM_STDIN, "--region", region];
+    const shown = `aws ${args.join(" ")}`;
+    await exec(io, AWS, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: (t) => `Read secret ${t.params.secret} in ${t.params.region} (AWSCURRENT); cached readers see it on refresh.`
+};
+
+// src/destinations/cloudflare.ts
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "node:fs";
+import { join as join6 } from "node:path";
+var WRANGLER = {
+  cmd: "wrangler",
+  install: "Install Wrangler and log in: npm i -g wrangler && wrangler login",
+  login: "Check `wrangler whoami` (log in with `wrangler login`) and the Worker name."
+};
+function target2(worker, env) {
+  return {
+    livesIn: `cloudflare:${worker}${env ? `/${env}` : ""}`,
+    keyName: keyName(`cloudflare: ${worker}${env ? ` / ${env}` : ""}`),
+    params: { worker, ...env ? { env } : {} }
+  };
+}
+function workerName(cwd) {
+  for (const f of ["wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
+    const p = join6(cwd, f);
+    if (!existsSync5(p))
+      continue;
+    const text = readFileSync7(p, "utf8");
+    const m = f.endsWith(".toml") ? /^\s*name\s*=\s*["']([^"']+)["']/m.exec(text) : /"name"\s*:\s*"([^"]+)"/.exec(text);
+    if (m)
+      return m[1];
+  }
+  return;
+}
+var cloudflare = {
+  id: "cloudflare",
+  label: "Cloudflare Workers",
+  flags: ["worker", "env"],
+  async resolve(f, io) {
+    const worker = f.worker ?? workerName(io.cwd);
+    if (!worker)
+      throw new CliError("bad_argument", "Which Worker?", "Pass --worker <name> (or run where wrangler.toml is).");
+    return target2(safeValue("worker", worker), f.env ? safeValue("env", f.env) : undefined);
+  },
+  parse(rest) {
+    const [worker, env, ...more] = rest.split("/");
+    if (!isSafeValue(worker) || more.length || env && !isSafeValue(env))
+      return null;
+    return target2(worker, env || undefined);
+  },
+  async put(t, secret, io) {
+    const args = ["secret", "put", "ST_API_KEY", "--name", t.params.worker];
+    if (t.params.env)
+      args.push("--env", t.params.env);
+    const shown = `wrangler ${args.join(" ")}`;
+    await exec(io, WRANGLER, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: () => "The Worker reads env.ST_API_KEY; Cloudflare deploys the new secret at once."
+};
+
+// src/destinations/doppler.ts
+var DOPPLER = {
+  cmd: "doppler",
+  install: "Install the Doppler CLI and log in: https://docs.doppler.com/docs/install-cli, then `doppler login`.",
+  login: "Check `doppler me` and the project and config names (`doppler setup` links a directory)."
+};
+function target3(project, config) {
+  return {
+    livesIn: `doppler:${project}/${config}`,
+    keyName: keyName(`doppler: ${project} / ${config}`),
+    params: { project, config }
+  };
+}
+var doppler = {
+  id: "doppler",
+  label: "Doppler",
+  flags: ["project", "config"],
+  async resolve(f, io) {
+    const get = async (what) => (await probe(io, DOPPLER, ["configure", "get", what, "--plain"])).stdout.trim();
+    const project = f.project ?? await get("project");
+    const config = f.config ?? await get("config");
+    if (!project || !config)
+      throw new CliError("bad_argument", "Which Doppler project and config?", "Pass --project and --config (or run `doppler setup` here).");
+    return target3(safeValue("project", project), safeValue("config", config));
+  },
+  parse(rest) {
+    const [project, config, ...more] = rest.split("/");
+    return isSafeValue(project) && isSafeValue(config) && !more.length ? target3(project, config) : null;
+  },
+  async put(t, secret, io) {
+    const args = ["secrets", "set", "ST_API_KEY", "--project", t.params.project, "--config", t.params.config];
+    const shown = `doppler ${args.join(" ")}`;
+    await exec(io, DOPPLER, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: () => "Apps started with `doppler run` get it on their next start."
+};
+
+// src/destinations/fly.ts
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
+import { join as join7 } from "node:path";
+var FLY = {
+  cmd: "fly",
+  install: "Install flyctl and log in: https://fly.io/docs/flyctl/install/, then `fly auth login`.",
+  login: "Check `fly auth whoami` (log in with `fly auth login`) and the app name."
+};
+var FLYCTL = { ...FLY, cmd: "flyctl" };
+var target4 = (app) => ({ livesIn: `fly:${app}`, keyName: keyName(`fly: ${app}`), params: { app } });
+function appFromToml(cwd) {
+  const f = join7(cwd, "fly.toml");
+  if (!existsSync6(f))
+    return;
+  return /^\s*app\s*=\s*["']([^"']+)["']/m.exec(readFileSync8(f, "utf8"))?.[1];
+}
+async function run(io, args, stdin, shown) {
+  try {
+    await exec(io, FLY, args, { stdin, shown });
+  } catch (e) {
+    if (e.code !== "destination_cli_missing")
+      throw e;
+    await exec(io, FLYCTL, args, { stdin, shown });
+  }
+}
+var fly = {
+  id: "fly",
+  label: "Fly.io",
+  flags: ["app"],
+  async resolve(f, io) {
+    const app = f.app ?? appFromToml(io.cwd);
+    if (!app)
+      throw new CliError("bad_argument", "Which Fly app?", "Pass --app <name> (or run where fly.toml is).");
+    return target4(safeValue("app", app));
+  },
+  parse: (rest) => isSafeValue(rest) ? target4(rest) : null,
+  async put(t, secret, io) {
+    const args = ["secrets", "import", "-a", t.params.app];
+    const shown = `fly ${args.join(" ")}`;
+    await run(io, args, `ST_API_KEY=${secret}
+`, shown);
+    return `${shown} (stdin)`;
+  },
+  next: () => "Fly restarts the app's machines with the new secret."
+};
+
+// src/destinations/gcp.ts
+var GCLOUD = {
+  cmd: "gcloud",
+  install: "Install the Google Cloud CLI and log in: https://cloud.google.com/sdk/docs/install, then `gcloud auth login`.",
+  login: "Check `gcloud auth list` and that you may manage Secret Manager secrets in the project."
+};
+var SECRET_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,254}$/;
+function target5(project, secret, locations) {
+  return {
+    livesIn: `gcp:${project}/${secret}`,
+    keyName: keyName(`gcp: ${project} / ${secret}`),
+    params: { project, secret, ...locations ? { locations } : {} }
+  };
+}
+var gcp = {
+  id: "gcp",
+  label: "Google Cloud Secret Manager",
+  flags: ["project", "secret", "locations"],
+  async resolve(f, io) {
+    let project = f.project;
+    if (!project) {
+      project = (await exec(io, GCLOUD, ["config", "get-value", "project"])).trim();
+      if (!project || project === "(unset)")
+        throw new CliError("bad_argument", "No Google Cloud project is set.", "Pass --project <id>.");
+    }
+    const secret = f.secret ?? "st-api-key";
+    if (!SECRET_RE.test(secret))
+      throw new CliError("bad_argument", "--secret may use letters, digits, _ and - only (Secret Manager ids).");
+    return target5(safeValue("project", project), secret, f.locations ? safeValue("locations", f.locations.replace(/\s/g, "")) : undefined);
+  },
+  parse(rest) {
+    const [project, secret, ...more] = rest.split("/");
+    return isSafeValue(project) && secret && SECRET_RE.test(secret) && !more.length ? target5(project, secret) : null;
+  },
+  async put(t, secret, io) {
+    const { project, secret: name } = t.params;
+    const exists = await probe(io, GCLOUD, ["secrets", "describe", name, "--project", project, "--format=value(name)"]);
+    const args = exists.code === 0 ? ["secrets", "versions", "add", name, "--project", project, "--data-file=-"] : [
+      "secrets",
+      "create",
+      name,
+      "--project",
+      project,
+      "--data-file=-",
+      ...t.params.locations ? ["--replication-policy=user-managed", `--locations=${t.params.locations}`] : ["--replication-policy=automatic"]
+    ];
+    const shown = `gcloud ${args.join(" ")}`;
+    await exec(io, GCLOUD, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: (t) => `Read secret ${t.params.secret}, version latest (anything pinned to a version needs updating).`
+};
+
+// src/destinations/github.ts
+var GH = {
+  cmd: "gh",
+  install: "Install the GitHub CLI and log in: https://cli.github.com, then `gh auth login`.",
+  login: "Check `gh auth status` (log in with `gh auth login`) and that you can manage the repo's secrets."
+};
+var APPS = { actions: "Actions", codespaces: "Codespaces", dependabot: "Dependabot" };
+var REPO_RE = /^[A-Za-z0-9_.][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/;
+var isApp = (v) => v !== undefined && Object.hasOwn(APPS, v);
+function target6(repo, app, env) {
+  return {
+    livesIn: `github:${repo}/${app}${env ? `/${env}` : ""}`,
+    keyName: keyName(`github: ${repo} (${APPS[app]}${env ? `, ${env}` : ""})`),
+    params: { repo, app, ...env ? { env } : {} }
+  };
+}
+var github = {
+  id: "github",
+  label: "GitHub",
+  flags: ["repo", "app", "env"],
+  async resolve(f, io) {
+    const app = f.app ?? "actions";
+    if (!isApp(app))
+      throw new CliError("bad_argument", "--app must be actions, codespaces or dependabot.");
+    if (f.env && app !== "actions")
+      throw new CliError("bad_argument", "--env (a deployment environment) works only with --app actions.");
+    const repo = f.repo ?? (await exec(io, GH, ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"])).trim();
+    if (!REPO_RE.test(repo))
+      throw new CliError("bad_argument", "--repo must look like owner/name.", "Pass --repo owner/name.");
+    return target6(repo, app, f.env ? safeValue("env", f.env) : undefined);
+  },
+  parse(rest) {
+    const [owner, name, app, env, ...more] = rest.split("/");
+    if (!owner || !name || !isApp(app) || more.length || !REPO_RE.test(`${owner}/${name}`))
+      return null;
+    if (env && !isSafeValue(env))
+      return null;
+    return target6(`${owner}/${name}`, app, env || undefined);
+  },
+  async put(t, secret, io) {
+    const args = ["secret", "set", "ST_API_KEY", "--repo", t.params.repo];
+    if (t.params.app !== "actions")
+      args.push("--app", t.params.app);
+    if (t.params.env)
+      args.push("--env", t.params.env);
+    const shown = `gh ${args.join(" ")}`;
+    await exec(io, GH, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: () => "Workflows read it as secrets.ST_API_KEY from their next run."
+};
+
+// src/destinations/k8s.ts
+var KUBECTL = {
+  cmd: "kubectl",
+  install: "Install kubectl and point it at your cluster: https://kubernetes.io/docs/tasks/tools/",
+  login: "Check `kubectl config current-context` and that you may create Secrets in the namespace."
+};
+var SECRET_RE2 = /^[a-z0-9]([-a-z0-9.]{0,251}[a-z0-9])?$/;
+function target7(context, namespace, secret) {
+  return {
+    livesIn: `k8s:${context}/${namespace}/${secret}`,
+    keyName: keyName(`k8s: ${namespace}/${secret} (${context})`),
+    params: { context, namespace, secret }
+  };
+}
+var k8s = {
+  id: "k8s",
+  label: "Kubernetes",
+  flags: ["context", "namespace", "secret"],
+  async resolve(f, io) {
+    const context = f.context ?? (await exec(io, KUBECTL, ["config", "current-context"])).trim();
+    if (!context)
+      throw new CliError("bad_argument", "No kubectl context is set.", "Pass --context <name>.");
+    let namespace = f.namespace;
+    if (!namespace) {
+      const r = await probe(io, KUBECTL, ["config", "view", "--minify", "-o", "jsonpath={..namespace}"]);
+      namespace = r.code === 0 && r.stdout.trim() ? r.stdout.trim() : "default";
+    }
+    const secret = f.secret ?? "scaledthought";
+    if (!SECRET_RE2.test(secret))
+      throw new CliError("bad_argument", "--secret must be a lowercase DNS name, e.g. scaledthought.");
+    return target7(safeValue("context", context, { slash: true }), safeValue("namespace", namespace), secret);
+  },
+  parse(rest) {
+    const parts = rest.split("/");
+    if (parts.length < 3)
+      return null;
+    const secret = parts.pop();
+    const namespace = parts.pop();
+    const context = parts.join("/");
+    if (!isSafeValue(context, { slash: true }) || !isSafeValue(namespace) || !SECRET_RE2.test(secret))
+      return null;
+    return target7(context, namespace, secret);
+  },
+  async put(t, secret, io) {
+    const where = ["--namespace", t.params.namespace, "--context", t.params.context];
+    const create = ["create", "secret", "generic", t.params.secret, "--from-file=ST_API_KEY=/dev/stdin"];
+    const manifest = await exec(io, KUBECTL, [...create, "--dry-run=client", "-o", "yaml", ...where], {
+      stdin: secret,
+      shown: `kubectl create secret generic ${t.params.secret}`
+    });
+    const apply = ["apply", "--server-side", "--force-conflicts", "--field-manager=scaledthought", "-f", "-", ...where];
+    await exec(io, KUBECTL, apply, {
+      stdin: manifest,
+      secrets: [secret, Buffer.from(secret).toString("base64")],
+      shown: "kubectl apply --server-side -f -"
+    });
+    return `kubectl ${create.join(" ")} --dry-run=client -o yaml | kubectl apply --server-side -f - (stdin)`;
+  },
+  next: (t) => `Pods read Secret ${t.params.secret} when they start: restart the ones that use it (kubectl rollout restart deployment/<name> -n ${t.params.namespace}).`
+};
+
+// src/destinations/vercel.ts
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "node:fs";
+import { join as join8 } from "node:path";
+var VERCEL = {
+  cmd: "vercel",
+  install: "Install the Vercel CLI and log in: npm i -g vercel && vercel login",
+  login: "Check `vercel whoami` (log in with `vercel login`) and that this directory is linked (`vercel link`)."
+};
+function target8(project, env) {
+  return {
+    livesIn: `vercel:${project}/${env}`,
+    keyName: keyName(`vercel: ${project} / ${env}`),
+    params: { project, env }
+  };
+}
+function linkedProject(cwd) {
+  const f = join8(cwd, ".vercel", "project.json");
+  if (!existsSync7(f))
+    return null;
+  try {
+    const j = JSON.parse(readFileSync9(f, "utf8"));
+    return { name: j.projectName, id: j.projectId };
+  } catch {
+    return null;
+  }
+}
+var NOT_LINKED = "Run this in the app's directory after `vercel link`.";
+var vercel = {
+  id: "vercel",
+  label: "Vercel",
+  flags: ["project", "env"],
+  async resolve(f, io) {
+    const env = safeValue("env", f.env ?? "production");
+    const linked = linkedProject(io.cwd);
+    if (!linked)
+      throw new CliError("not_linked", "This directory isn't linked to a Vercel project.", NOT_LINKED);
+    const project = f.project ?? linked.name ?? linked.id;
+    if (!project)
+      throw new CliError("not_linked", "Can't tell which Vercel project this is.", "Pass --project.");
+    if (f.project && linked.name && f.project !== linked.name)
+      throw new CliError("not_linked", `This directory is linked to Vercel project "${linked.name}", not "${f.project}".`, NOT_LINKED);
+    return target8(safeValue("project", project), env);
+  },
+  parse(rest) {
+    const [project, env, ...more] = rest.split("/");
+    return isSafeValue(project) && isSafeValue(env) && !more.length ? target8(project, env) : null;
+  },
+  async put(t, secret, io, mode) {
+    const linked = linkedProject(io.cwd);
+    if (!linked || linked.name !== t.params.project && linked.id !== t.params.project)
+      throw new CliError("not_linked", `Vercel project "${t.params.project}" isn't the one linked in this directory.`, `Run \`keys rotate <id> --push\` in the directory linked to "${t.params.project}".`);
+    if (mode === "replace")
+      await probe(io, VERCEL, ["env", "rm", "ST_API_KEY", t.params.env, "--yes"]);
+    const args = ["env", "add", "ST_API_KEY", t.params.env];
+    const shown = `vercel ${args.join(" ")}`;
+    await exec(io, VERCEL, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: (t) => `Vercel reads the new value on the next deployment: ${t.params.env === "production" ? "vercel --prod" : "vercel"}`
+};
+
+// src/destinations/index.ts
+var DESTINATIONS = Object.fromEntries([github, vercel, fly, cloudflare, gcp, aws, k8s, doppler].map((d) => [d.id, d]));
+function destination(id) {
+  const d = Object.hasOwn(DESTINATIONS, id) ? DESTINATIONS[id] : undefined;
+  if (!d)
+    throw new CliError("unknown_destination", `Unknown destination "${id}".`, `Use one of: ${Object.keys(DESTINATIONS).join(", ")}.`);
+  return d;
+}
+function fromLivesIn(livesIn) {
+  if (!livesIn)
+    return null;
+  const i = livesIn.indexOf(":");
+  if (i <= 0)
+    return null;
+  const id = livesIn.slice(0, i);
+  const dest = Object.hasOwn(DESTINATIONS, id) ? DESTINATIONS[id] : undefined;
+  const target = dest?.parse(livesIn.slice(i + 1));
+  return dest && target ? { dest, target } : null;
+}
+
+// src/everywhere.ts
+import { chmodSync as chmodSync4, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir, hostname as hostname2 } from "node:os";
+import { dirname as dirname2, join as join9 } from "node:path";
+var io = (ctx) => ({ run: ctx.runner ?? spawnRunner, cwd: ctx.cwd, env: ctx.env });
+async function mintChild(ctx, o) {
+  const k = await api(ctx, "POST", "/v1/keys", {
+    body: {
+      name: o.name,
+      child: true,
+      lives_in: o.livesIn,
+      daily_budget_usd: o.budgetUsd,
+      scopes: o.scopes,
+      expires_in: o.expiresIn
+    }
+  });
+  if (!k.api_key || !KEY_RE.test(k.api_key))
+    throw new CliError("bad_response", "The server didn't return the new key.", "Retry; if it persists, report it.");
+  return k;
+}
+async function revokeMinted(ctx, id) {
+  return api(ctx, "DELETE", `/v1/keys/${encodeURIComponent(id)}`).then(() => true, () => false);
+}
+async function failAfterMint(ctx, keyId, e) {
+  const revoked = await revokeMinted(ctx, keyId);
+  const err = e instanceof CliError ? e : new CliError("destination_failed", "Storing the key failed.", "Retry; if it persists, report it.");
+  throw new CliError(err.code, `${err.message} ${revoked ? "The new key was revoked; nothing else changed." : `Revoking the new key ${keyId} failed: run \`keys revoke ${keyId}\`.`}`, err.hint, { ...err.extra, key_id: keyId, key_revoked: revoked });
+}
+function checkFlags(dest, flags) {
+  const extra = Object.keys(flags).filter((f) => flags[f] !== undefined && !dest.flags.includes(f));
+  if (extra.length)
+    throw new CliError("usage_error", `keys put ${dest.id} doesn't take --${extra.join(", --")}.`, `It takes: ${dest.flags.map((f) => `--${f}`).join(", ") || "no destination flags"}.`);
+}
+async function keysPut(ctx, destId, o) {
+  const dest = destination(destId);
+  checkFlags(dest, o.flags);
+  const { region } = resolveKey(ctx);
+  const target = await dest.resolve(o.flags, io(ctx));
+  const k = await mintChild(ctx, {
+    name: o.name ?? target.keyName,
+    livesIn: target.livesIn,
+    budgetUsd: o.budgetUsd,
+    scopes: o.scopes,
+    expiresIn: o.expiresIn
+  });
+  let storedWith;
+  try {
+    storedWith = await dest.put(target, k.api_key, io(ctx), "new");
+  } catch (e) {
+    return failAfterMint(ctx, k.id, e);
+  }
+  return {
+    key_name: k.name,
+    key_id: k.id,
+    key_prefix: k.prefix,
+    lives_in: target.livesIn,
+    stored_with: storedWith,
+    daily_budget_usd: k.daily_budget_usd,
+    base_url: inferenceUrl(region, ctx.env),
+    next: `${dest.next?.(target) ?? ""} The app reads ST_API_KEY; its base URL is ${inferenceUrl(region, ctx.env)} (not a secret: set ST_BASE_URL as a plain variable if your code uses it).`.trim()
+  };
+}
+async function keysRotatePush(ctx, o) {
+  const grace = o.grace ?? "24h";
+  const { data } = await api(ctx, "GET", "/v1/keys");
+  let keys;
+  if (o.all)
+    keys = data.filter((k) => k.status === "active");
+  else {
+    const k = data.find((x) => x.id === o.id);
+    if (!k)
+      throw new CliError("key_not_found", `No key ${o.id} on this account.`, "See `keys list`.");
+    keys = [k];
+  }
+  const rotated = [];
+  const skipped = [];
+  const failed = [];
+  const next = new Set;
+  for (const k of keys) {
+    const found = fromLivesIn(k.lives_in);
+    if (!found) {
+      const tool = /^tool:([a-z0-9-]+):/.exec(k.lives_in ?? "")?.[1];
+      skipped.push({
+        name: k.name,
+        key_id: k.id,
+        lives_in: k.lives_in ?? null,
+        reason: !k.lives_in ? "no lives_in (not put anywhere by keys put)" : tool ? `a tool's config: run \`connect ${tool}\` again on that machine, then revoke this key` : k.lives_in.startsWith("env:") ? "a folder's ./.env (a project key from init, login or use): rotate it from that folder with `keys rotate`" : "lives_in isn't a destination keys put knows"
+      });
+      continue;
+    }
+    if (k.status !== "active") {
+      skipped.push({ name: k.name, key_id: k.id, lives_in: k.lives_in ?? null, reason: `key is ${k.status}` });
+      continue;
+    }
+    let r;
+    try {
+      r = await api(ctx, "POST", `/v1/keys/${encodeURIComponent(k.id)}/rotate`, { body: { grace } });
+    } catch (e) {
+      failed.push({ name: k.name, key_id: k.id, error: errorOf(e) });
+      continue;
+    }
+    if (!r.api_key) {
+      failed.push({ name: k.name, key_id: r.id, error: errorOf(null) });
+      continue;
+    }
+    const stops = { old_key_stops: `in ${grace}`, old_key_expires_at: r.rotated_from?.expires_at ?? "" };
+    try {
+      const pushed = await found.dest.put(found.target, r.api_key, io(ctx), "replace");
+      rotated.push({ name: r.name, key_id: r.id, pushed, ...stops });
+      const n = found.dest.next?.(found.target);
+      if (n)
+        next.add(n);
+    } catch (e) {
+      const err = errorOf(e);
+      failed.push({
+        name: r.name,
+        key_id: r.id,
+        ...stops,
+        error: {
+          ...err,
+          hint: `${err.hint ?? ""} The old key keeps working ${stops.old_key_stops}. Fix that, then run \`keys rotate ${r.id} --push --grace 0\`.`.trim()
+        }
+      });
+    }
+  }
+  return {
+    rotated,
+    skipped,
+    ...failed.length ? { failed } : {},
+    ...next.size ? { next: [...next] } : {}
+  };
+}
+function errorOf(e) {
+  if (e instanceof CliError)
+    return { code: e.code, message: e.message, hint: e.hint ?? null };
+  return { code: "internal_error", message: "Unexpected error.", hint: "Retry; if it persists, report it." };
+}
+var CONNECT_TOOLS = ["opencode", "aider", "continue", "cursor"];
+function machineName(raw = hostname2()) {
+  const n = raw.replace(/\.(local|lan|home)$/i, "").replace(/[^A-Za-z0-9.-]/g, "-").slice(0, 40);
+  return n || "this-machine";
+}
+async function liveChatModels(ctx) {
+  const { region } = resolveKey(ctx);
+  const res = await api(ctx, "GET", "/v1/models?modality=chat", {
+    auth: false,
+    region
+  }).catch(() => ({ data: [] }));
+  return (res.data ?? []).filter((m) => typeof m.id === "string" && m.live_in_region !== false && (m.modality ?? "chat") === "chat").map((m) => ({ id: m.id, context: typeof m.context === "number" ? m.context : null }));
+}
+function writePrivate2(path, text) {
+  mkdirSync3(dirname2(path), { recursive: true, mode: 448 });
+  writeFileSync4(path, text, { mode: 384 });
+  chmodSync4(path, 384);
+}
+function readJsonObject(path, what) {
+  if (!existsSync8(path))
+    return {};
+  try {
+    const v = JSON.parse(readFileSync10(path, "utf8"));
+    if (v && typeof v === "object" && !Array.isArray(v))
+      return v;
+  } catch {}
+  throw new CliError("config_unreadable", `${what} isn't plain JSON (comments or a syntax error). Nothing was changed.`, `Fix or move ${path}, then run connect again.`);
+}
+var PROVIDER_ID = "scaledthought";
+async function connect(ctx, tool, o = {}) {
+  if (!CONNECT_TOOLS.includes(tool))
+    throw new CliError("unknown_tool", `Unknown tool "${tool}".`, `Use one of: ${CONNECT_TOOLS.join(", ")}.`);
+  const { region } = resolveKey(ctx);
+  const baseUrl = inferenceUrl(region, ctx.env);
+  const models = await liveChatModels(ctx);
+  const model = o.model ?? models[0]?.id ?? "auto";
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(model))
+    throw new CliError("bad_argument", "--model isn't a model id.", "Pick one from `models --live`.");
+  const host = machineName();
+  const keyName = `${tool}: ${host}`;
+  const livesIn = `tool:${tool}:${host}`;
+  const t = tool;
+  if (t === "cursor" || t === "continue")
+    return instructions(t, baseUrl, model, models, keyName);
+  if (t === "aider") {
+    const existing = readDotEnv(ctx.cwd);
+    if (existing.OPENAI_API_KEY && !KEY_RE.test(existing.OPENAI_API_KEY))
+      throw new CliError("env_conflict", "./.env already has an OPENAI_API_KEY that isn't a ScaledThought key. Nothing was changed.", "Aider reads OPENAI_API_KEY from .env, so this would replace it. Run connect aider in another directory, or remove that line first.");
+    const k = await mintChild(ctx, { name: keyName, livesIn, budgetUsd: o.budgetUsd });
+    try {
+      writeEnv(ctx.cwd, { OPENAI_API_BASE: baseUrl, OPENAI_API_KEY: k.api_key, AIDER_MODEL: `openai/${model}` });
+      ensureGitignored(ctx.cwd);
+    } catch (e) {
+      return failAfterMint(ctx, k.id, e);
+    }
+    return {
+      tool,
+      key_name: k.name,
+      key_prefix: k.prefix,
+      lives_in: livesIn,
+      daily_budget_usd: k.daily_budget_usd,
+      configured: ".env (OPENAI_API_BASE, OPENAI_API_KEY, AIDER_MODEL), mode 0600, git-ignored",
+      model: `openai/${model}`,
+      models: ["auto", ...models.map((m) => m.id)],
+      next: "Run `aider` in this directory. Aider may warn that it doesn't know the model's context window; that's harmless."
+    };
+  }
+  const dataHome = ctx.env.XDG_DATA_HOME || join9(ctx.env.HOME || homedir(), ".local", "share");
+  const authPath = join9(dataHome, "opencode", "auth.json");
+  const configPath = join9(ctx.cwd, "opencode.json");
+  const config = readJsonObject(configPath, "opencode.json");
+  const auth = readJsonObject(authPath, authPath);
+  const providers = config.provider && typeof config.provider === "object" ? config.provider : {};
+  const modelEntries = { auto: { name: "auto (ScaledThought picks per request)" } };
+  for (const m of models)
+    modelEntries[m.id] = {
+      name: m.id,
+      ...m.context ? { limit: { context: m.context, output: Math.min(32768, Math.floor(m.context / 2)) } } : {}
+    };
+  if (!modelEntries[model])
+    modelEntries[model] = { name: model };
+  const k = await mintChild(ctx, { name: keyName, livesIn, budgetUsd: o.budgetUsd });
+  try {
+    const next = {
+      ...existsSync8(configPath) ? {} : { $schema: "https://opencode.ai/config.json" },
+      ...config,
+      provider: {
+        ...providers,
+        [PROVIDER_ID]: {
+          npm: "@ai-sdk/openai-compatible",
+          name: "ScaledThought",
+          options: { baseURL: baseUrl },
+          models: modelEntries
+        }
+      },
+      ...config.model ? {} : { model: `${PROVIDER_ID}/${model}` }
+    };
+    writePrivate2(configPath, `${JSON.stringify(next, null, 2)}
+`);
+    writePrivate2(authPath, `${JSON.stringify({ ...auth, [PROVIDER_ID]: { type: "api", key: k.api_key } }, null, 2)}
+`);
+  } catch (e) {
+    return failAfterMint(ctx, k.id, e);
+  }
+  return {
+    tool,
+    key_name: k.name,
+    key_prefix: k.prefix,
+    lives_in: livesIn,
+    daily_budget_usd: k.daily_budget_usd,
+    configured: `opencode.json (provider ${PROVIDER_ID}, base URL ${baseUrl}) + ${authPath} (key, mode 0600)`,
+    model: `${PROVIDER_ID}/${model}`,
+    models: Object.keys(modelEntries),
+    restart_needed: true,
+    next: `Restart OpenCode in this directory and pick a ${PROVIDER_ID}/… model (or ${PROVIDER_ID}/auto).`
+  };
+}
+function instructions(tool, baseUrl, model, models, name) {
+  const ids = ["auto", ...models.map((m) => m.id)];
+  if (tool === "cursor")
+    return {
+      tool,
+      configured: false,
+      key_minted: false,
+      why: "Cursor keeps its OpenAI key in its own settings store, which other programs can't write safely. A human sets it once.",
+      steps_for_human: [
+        `Cursor Settings → Models → API Keys: turn on "Override OpenAI Base URL" and enter ${baseUrl}`,
+        `In your own terminal (not through the agent) run: ${NPX} keys create --child --name "${name}" and paste the key it prints into "OpenAI API Key", then Verify.`,
+        `Add model names under Models: ${ids.join(", ")}`
+      ],
+      base_url: baseUrl,
+      models: ids,
+      restart_needed: false
+    };
+  const block = [
+    "models:",
+    `  - name: ScaledThought ${model}`,
+    "    provider: openai",
+    `    model: ${model}`,
+    `    apiBase: ${baseUrl}`,
+    `    apiKey: \${{ secrets.ST_API_KEY }}`,
+    "    defaultCompletionOptions:",
+    "      maxTokens: 32768",
+    "    roles: [chat, edit, apply]"
+  ].join(`
+`);
+  return {
+    tool,
+    configured: false,
+    key_minted: false,
+    why: "Continue's config.yaml is hand-edited YAML; this CLI won't rewrite it. The block below holds no secret: Continue reads ST_API_KEY from this workspace's .env.",
+    steps_for_human: [
+      "Open ~/.continue/config.yaml (Continue: Open configuration) and add this entry under models:",
+      "Reload Continue and pick the ScaledThought model."
+    ],
+    config_yaml: block,
+    base_url: baseUrl,
+    models: ids,
+    restart_needed: false
+  };
+}
+function putFlagsFrom(args) {
+  const out = {};
+  for (const f of PUT_FLAGS)
+    if (typeof args[f] === "string")
+      out[f] = args[f];
+  return out;
+}
+
 // src/realtime.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolve4 } from "node:path";
 var SAMPLE_RATE = 24000;
 var MAX_INPUT_SECONDS = 300;
@@ -10066,7 +11517,7 @@ async function realtime(ctx, o) {
     throw new CliError("unsupported_runtime", "This command needs a WebSocket client (Node.js 22 or newer).", "Upgrade Node.js to 22+.");
   let pcm;
   try {
-    pcm = readWav(readFileSync5(resolve4(ctx.cwd, o.input)));
+    pcm = readWav(readFileSync11(resolve4(ctx.cwd, o.input)));
   } catch (e) {
     if (e instanceof CliError)
       throw e;
@@ -10158,7 +11609,7 @@ async function realtime(ctx, o) {
   });
   const audio = Buffer.concat(out);
   const path = resolve4(ctx.cwd, o.output);
-  writeFileSync2(path, wavOf(audio));
+  writeFileSync5(path, wavOf(audio));
   return {
     model: o.model,
     region,
@@ -10189,7 +11640,7 @@ function out(data, args) {
   process.stdout.write(`${JSON.stringify(data, null, wantsJson(args) ? 0 : 2)}
 `);
 }
-var run = async (fn, args) => out(await fn(), args);
+var run2 = async (fn, args) => out(await fn(), args);
 function region(v) {
   if (v === undefined)
     return;
@@ -10208,7 +11659,7 @@ function num(flag, v) {
 var init2 = defineCommand({
   meta: {
     name: "init",
-    description: "Create an account, save ST_API_KEY and ST_BASE_URL to ./.env, list live models and the next steps (a new account has no credits: top up first). Idempotent. " + "Creating an account accepts the Terms of Service (scaledthought.com/legal/terms) for the human you act for."
+    description: "Create an account, save ST_API_KEY and ST_BASE_URL to ./.env, list live models and the next steps (a new account has no credits: top up first). Idempotent. " + "Creating an account accepts nothing for your human: they accept the Terms themselves when they buy credits."
   },
   args: {
     ...jsonFlag,
@@ -10222,16 +11673,90 @@ var init2 = defineCommand({
     "ad-click": {
       type: "string",
       description: "Signed ad-click token, from a prompt ending in `(ad click <token>)` that a human copied on a US campaign's landing page (optional; us region only). Opt out later with `account ad-measurement off`"
+    },
+    account: {
+      type: "string",
+      description: "Use this account saved on this machine (id or name, from choose_account) with a new project key, instead of creating one"
+    },
+    "new-account": {
+      type: "boolean",
+      description: "Create a new account even when one is saved on this machine (separate billing)"
+    },
+    save: {
+      type: "boolean",
+      default: true,
+      description: "Save the account's key in this machine's credential store so other folders reuse it (--no-save to opt out)"
     }
   },
-  run: ({ args }) => run(() => init(makeCtx(), {
+  run: ({ args }) => run2(() => init(makeCtx(), {
     region: region(args.region),
     name: args.name,
     email: args.email,
     source: args.source,
-    adClick: args["ad-click"]
+    adClick: args["ad-click"],
+    account: args.account,
+    newAccount: args["new-account"],
+    noSave: args.save === false
   }), args)
 });
+var login2 = defineCommand({
+  meta: {
+    name: "login",
+    description: "Connect this folder to an existing account: prints a code your human types on the dashboard (opened in their browser). Then `login --wait` saves a new key to ./.env. `login --code XXXX-XXXX` uses a connect line from the dashboard"
+  },
+  args: {
+    ...jsonFlag,
+    region: { type: "string", description: "The account's region: us (default) or ca" },
+    open: { type: "boolean", default: true, description: "Open the connect page (--no-open only prints it)" },
+    label: { type: "string", description: 'How this agent is named to the human (default "<tool> on <hostname>")' },
+    wait: {
+      type: "boolean",
+      description: "Wait (about 90 s) for your human to approve the code, then save the key. Run again on authorization_pending"
+    },
+    code: {
+      type: "string",
+      description: "A connect line's code from the dashboard (stl_…): already approved, works once. `--code -` reads it from stdin"
+    },
+    force: { type: "boolean", description: "Replace the key already in ./.env" },
+    save: {
+      type: "boolean",
+      default: true,
+      description: "Save the key in this machine's credential store (--no-save to opt out)"
+    },
+    "timeout-s": { type: "string", description: "With --wait: seconds to wait (default 90, at most 600)" }
+  },
+  run: async ({ args }) => {
+    const ctx = makeCtx();
+    const noSave = args.save === false;
+    const t = args["timeout-s"] === undefined ? undefined : num("timeout-s", args["timeout-s"]);
+    if (t !== undefined && t > 600)
+      throw new CliError("bad_argument", `--timeout-s must be at most 600, got ${t}.`, "Run login --wait again.");
+    await run2(async () => args.code ? loginWithCode(ctx, {
+      code: args.code === "-" ? await readCodeFrom(process.stdin) : args.code,
+      region: region(args.region),
+      label: args.label,
+      force: args.force,
+      noSave
+    }) : args.wait ? loginWait(ctx, { timeoutS: t, noSave, force: args.force }) : login(ctx, {
+      region: region(args.region),
+      label: args.label,
+      noOpen: args.open === false,
+      force: args.force,
+      noSave
+    }), args);
+  }
+});
+var use = defineCommand({
+  meta: {
+    name: "use",
+    description: "Point this folder at another account saved on this machine: a new project key in ./.env, and the folder's old project key revoked"
+  },
+  args: {
+    ...jsonFlag,
+    account: { type: "positional", required: true, description: "The account's name or id" }
+  },
+  run: ({ args }) => run2(() => useAccount(makeCtx(), { target: args.account }), args)
+});
 var models = defineCommand({
   meta: { name: "models", description: "List models with prices and benchmarks, newest first; or show one" },
   args: {
@@ -10250,7 +11775,7 @@ var models = defineCommand({
     },
     search: { type: "string", description: "Match id, name or lab" }
   },
-  run: ({ args }) => run(() => {
+  run: ({ args }) => run2(() => {
     const r = region(args.region);
     return args.id ? showModel(makeCtx(), args.id, r) : listModels(makeCtx(), {
       live: args.live,
@@ -10268,7 +11793,7 @@ var account2 = defineCommand({
   run: ({ args, rawArgs }) => {
     if (rawArgs.some((a) => ACCOUNT_SUBCOMMANDS.has(a)))
       return;
-    return run(() => account(makeCtx()), args);
+    return run2(() => account(makeCtx()), args);
   },
   subCommands: {
     delete: defineCommand({
@@ -10280,7 +11805,7 @@ var account2 = defineCommand({
         ...jsonFlag,
         confirm: { type: "string", required: true, description: "The account id (acct_...), to confirm" }
       },
-      run: ({ args }) => run(() => accountDelete(makeCtx(), { confirm: args.confirm }), args)
+      run: ({ args }) => run2(() => accountDelete(makeCtx(), { confirm: args.confirm }), args)
     }),
     "ad-measurement": defineCommand({
       meta: {
@@ -10291,7 +11816,7 @@ var account2 = defineCommand({
         ...jsonFlag,
         state: { type: "positional", required: true, description: "off or on" }
       },
-      run: ({ args }) => run(() => accountAdMeasurement(makeCtx(), args.state), args)
+      run: ({ args }) => run2(() => accountAdMeasurement(makeCtx(), args.state), args)
     })
   }
 });
@@ -10301,7 +11826,7 @@ var keys = defineCommand({
     list: defineCommand({
       meta: { name: "list", description: "Keys on this account (prefixes only)" },
       args: jsonFlag,
-      run: ({ args }) => run(() => keysList(makeCtx()), args)
+      run: ({ args }) => run2(() => keysList(makeCtx()), args)
     }),
     create: defineCommand({
       meta: { name: "create", description: "Create a key; the full key is printed once" },
@@ -10319,7 +11844,7 @@ var keys = defineCommand({
           description: "Sub-agent key: budget, scopes and expiry within your key's; revoked when your key is"
         }
       },
-      run: ({ args }) => run(() => keysCreate(makeCtx(), {
+      run: ({ args }) => run2(() => keysCreate(makeCtx(), {
         name: args.name,
         budgetUsd: num("budget-usd", args["budget-usd"]),
         expiresIn: args["expires-in"],
@@ -10327,23 +11852,89 @@ var keys = defineCommand({
         child: args.child
       }), args)
     }),
+    put: defineCommand({
+      meta: {
+        name: "put",
+        description: "Put a new child key straight into a platform's secret store as ST_API_KEY, through its own CLI on stdin (never printed). Records where it lives"
+      },
+      args: {
+        ...jsonFlag,
+        destination: {
+          type: "positional",
+          required: true,
+          description: `Where: ${Object.keys(DESTINATIONS).join(", ")}`
+        },
+        name: { type: "string", description: "Key name (default: named after the destination)" },
+        "budget-usd": { type: "string", description: "Hard daily budget in USD (default: none beyond your key's)" },
+        "expires-in": { type: "string", description: "Key lifetime, e.g. 30d (max 365d)" },
+        scopes: {
+          type: "string",
+          description: "Comma-separated scopes, a subset of your key's. Default inference,read"
+        },
+        repo: { type: "string", description: "github: owner/name (default: this directory's repo)" },
+        app: { type: "string", description: "github: actions|codespaces|dependabot (default actions); fly: app name" },
+        env: {
+          type: "string",
+          description: "github: deployment environment; vercel: production|preview|development (default production); cloudflare: Wrangler env"
+        },
+        project: { type: "string", description: "vercel (must match the linked project), gcp, doppler: project" },
+        worker: { type: "string", description: "cloudflare: Worker name (default: wrangler.toml's name)" },
+        secret: {
+          type: "string",
+          description: "gcp (default st-api-key), aws (default scaledthought/api-key), k8s (default scaledthought): secret name"
+        },
+        "aws-region": { type: "string", description: "aws: region (default: AWS_REGION or the CLI's)" },
+        locations: {
+          type: "string",
+          description: "gcp: user-managed replication locations, e.g. northamerica-northeast1"
+        },
+        namespace: { type: "string", description: "k8s: namespace (default: the context's)" },
+        context: { type: "string", description: "k8s: kubectl context (default: current)" },
+        config: { type: "string", description: "doppler: config, e.g. prd (default: this directory's)" }
+      },
+      run: ({ args }) => run2(() => keysPut(makeCtx(), args.destination, {
+        name: args.name,
+        budgetUsd: num("budget-usd", args["budget-usd"]),
+        expiresIn: args["expires-in"],
+        scopes: args.scopes?.split(",").map((x) => x.trim()).filter(Boolean),
+        flags: putFlagsFrom(args)
+      }), args)
+    }),
     rotate: defineCommand({
       meta: {
         name: "rotate",
-        description: "Replace a key: prints the new key once; the old key keeps working for --grace (default 24h, 0 to 7d)"
+        description: "Replace a key: prints the new key once; the old key keeps working for --grace (default 24h, 0 to 7d). With --push, puts the new key where the old one lives instead of printing it"
       },
       args: {
         ...jsonFlag,
-        id: { type: "positional", required: true, description: "Key id (key_…)" },
+        id: { type: "positional", required: false, description: "Key id (key_…); or --all with --push" },
         grace: { type: "string", description: "How long the old key keeps working: 0 to 7d (default 24h)" },
-        "expires-in": { type: "string", description: "New key's lifetime (default: the old key's)" }
+        "expires-in": { type: "string", description: "New key's lifetime (default: the old key's)" },
+        push: {
+          type: "boolean",
+          description: "Put each new key where the old one lives (its lives_in, from keys put); prints no keys"
+        },
+        all: { type: "boolean", description: "With --push: every active key that has a lives_in keys put can reach" }
       },
-      run: ({ args }) => run(() => keysRotate(makeCtx(), args.id, { grace: args.grace, expiresIn: args["expires-in"] }), args)
+      run: ({ args }) => run2(() => {
+        if (args.all && !args.push)
+          throw new CliError("usage_error", "--all needs --push (rotating every key never prints them).");
+        if (args.all && args.id)
+          throw new CliError("usage_error", "Pass a key id or --all, not both.");
+        if (!args.all && !args.id)
+          throw new CliError("usage_error", "Pass a key id (or --all --push).");
+        if (args.push) {
+          if (args["expires-in"])
+            throw new CliError("usage_error", "--expires-in can't be combined with --push.");
+          return keysRotatePush(makeCtx(), { id: args.id, all: args.all, grace: args.grace });
+        }
+        return keysRotate(makeCtx(), args.id, { grace: args.grace, expiresIn: args["expires-in"] });
+      }, args)
     }),
     revoke: defineCommand({
       meta: { name: "revoke", description: "Revoke a key by id (and its sub-agent keys)" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Key id (key_…)" } },
-      run: ({ args }) => run(() => keysRevoke(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => keysRevoke(makeCtx(), args.id), args)
     }),
     "revoke-self": defineCommand({
       meta: {
@@ -10351,7 +11942,7 @@ var keys = defineCommand({
         description: "Revoke the key you are using now (e.g. if it may have leaked). Irreversible"
       },
       args: jsonFlag,
-      run: ({ args }) => run(() => keysRevokeSelf(makeCtx()), args)
+      run: ({ args }) => run2(() => keysRevokeSelf(makeCtx()), args)
     })
   }
 });
@@ -10362,7 +11953,7 @@ var usage3 = defineCommand({
     days: { type: "string", default: "7", description: "Look-back window, 1-90" },
     by: { type: "string", default: "model", description: "model|day|key|modality" }
   },
-  run: ({ args }) => run(() => usage(makeCtx(), { days: num("days", args.days) ?? 7, by: args.by }), args)
+  run: ({ args }) => run2(() => usage(makeCtx(), { days: num("days", args.days) ?? 7, by: args.by }), args)
 });
 var chat2 = defineCommand({
   meta: { name: "chat", description: "Send one message. Use -m auto to let the router pick" },
@@ -10373,7 +11964,7 @@ var chat2 = defineCommand({
   },
   run: async ({ args }) => {
     const human = !wantsJson(args);
-    await run(async () => {
+    await run2(async () => {
       const r = await chat(makeCtx(), {
         model: args.model,
         prompt: args.prompt,
@@ -10436,7 +12027,7 @@ var speak2 = defineCommand({
     speed: { type: "string", description: "0.25 to 4 (default 1)" },
     instructions: { type: "string", description: "Delivery instructions for models that take them, optional" }
   },
-  run: ({ args }) => run(() => speak(makeCtx(), {
+  run: ({ args }) => run2(() => speak(makeCtx(), {
     text: args.text,
     output: args.output,
     model: args.model,
@@ -10459,7 +12050,7 @@ var decideCmd = defineCommand({
     question: { type: "string", alias: "q", description: "id:type:instructions[:criteria], repeatable" },
     file: { type: "string", description: "A JSON request: {state, questions, model?}" }
   },
-  run: ({ args }) => run(() => {
+  run: ({ args }) => run2(() => {
     const ctx = makeCtx();
     const raw = currentArgv;
     const questions = [];
@@ -10492,7 +12083,7 @@ var realtime2 = defineCommand({
     instructions: { type: "string", description: "System instructions for the session (optional)" },
     timeout: { type: "string", description: "Seconds to wait for the reply (default 120)" }
   },
-  run: ({ args }) => run(async () => {
+  run: ({ args }) => run2(async () => {
     const t = num("timeout", args.timeout);
     return realtime(makeCtx(), {
       model: args.model,
@@ -10510,7 +12101,7 @@ function autoReloadArgs(args) {
   if (below === undefined && amount === undefined && max === undefined)
     return;
   if (below === undefined || amount === undefined)
-    throw new CliError("bad_argument", "Auto-reload needs both --auto-reload-below and --auto-reload-amount.", "e.g. --auto-reload-below 2 --auto-reload-amount 10 [--auto-reload-monthly-max 50]");
+    throw new CliError("bad_argument", "Auto-reload needs both --auto-reload-below and --auto-reload-amount.", "e.g. --auto-reload-below 5 --auto-reload-amount 20");
   return { threshold_usd: below, amount_usd: amount, ...max !== undefined ? { monthly_limit_usd: max } : {} };
 }
 var billing = defineCommand({
@@ -10522,25 +12113,27 @@ var billing = defineCommand({
         description: "Credit balance, auto-reload, pending top-ups (with their approval links), recent transactions"
       },
       args: jsonFlag,
-      run: ({ args }) => run(() => billingStatus(makeCtx()), args)
+      run: ({ args }) => run2(() => billingStatus(makeCtx()), args)
     }),
     topup: defineCommand({
       meta: {
         name: "topup",
-        description: "Buy prepaid credits: opens the checkout page in your human's browser (approval_url); then run `billing wait`, which returns once they pay. Optional auto-reload"
+        description: "Buy prepaid credits: opens the funding page in your human's browser (approval_url), where they confirm the amount, can turn on auto-reload (recommended) and pay; then run `billing wait`, which returns once they pay"
       },
       args: {
         ...jsonFlag,
         "amount-usd": {
           type: "string",
-          required: true,
-          description: "Credits to buy in USD ($5 to $2,000; at most $2,000 per 24 h)"
+          description: "Credits to buy in USD (default 20; $20 to $2,000, at most $2,000 per 24 h). Your human can change it"
+        },
+        "auto-reload-below": {
+          type: "string",
+          description: "Suggest auto-reload (pre-selected on the page) when the balance drops below this (USD, at least 5)"
         },
-        "auto-reload-below": { type: "string", description: "Auto-reload when the balance drops below this (USD)" },
-        "auto-reload-amount": { type: "string", description: "Amount of each auto-reload (USD)" },
+        "auto-reload-amount": { type: "string", description: "Amount of each suggested auto-reload (USD)" },
         "auto-reload-monthly-max": {
           type: "string",
-          description: "Most auto-reload may charge per calendar month (USD, default 5x the amount)"
+          description: "Optional: most auto-reload may charge per calendar month (USD; default: no monthly limit)"
         },
         open: {
           type: "boolean",
@@ -10553,11 +12146,11 @@ var billing = defineCommand({
         }
       },
       run: async ({ args }) => {
-        const amountUsd = num("amount-usd", args["amount-usd"]);
+        const amountUsd = num("amount-usd", args["amount-usd"]) ?? 20;
         const autoReload = autoReloadArgs(args);
         checkTopupLimits(amountUsd, autoReload);
         const noOpen = args.open === false;
-        await run(() => args.wait ? billingTopupAndWait(makeCtx(), { amountUsd, autoReload, noOpen, onPending: (t) => out(t, args) }) : billingTopup(makeCtx(), { amountUsd, autoReload, noOpen }), args);
+        await run2(() => args.wait ? billingTopupAndWait(makeCtx(), { amountUsd, autoReload, noOpen, onPending: (t) => out(t, args) }) : billingTopup(makeCtx(), { amountUsd, autoReload, noOpen }), args);
       }
     }),
     wait: defineCommand({
@@ -10577,23 +12170,50 @@ var billing = defineCommand({
         const t = args["timeout-s"] === undefined ? undefined : num("timeout-s", args["timeout-s"]);
         if (t !== undefined && t > 600)
           throw new CliError("bad_argument", `--timeout-s must be at most 600, got ${t}.`, "Run wait again instead.");
-        await run(() => billingWait(makeCtx(), { topupId: args.topup_id || undefined, timeoutS: t }), args);
+        await run2(() => billingWait(makeCtx(), { topupId: args.topup_id || undefined, timeoutS: t }), args);
       }
     }),
     "auto-reload": defineCommand({
-      meta: { name: "auto-reload", description: "Turn auto-reload off (turning it on or up needs a topup approval)" },
+      meta: {
+        name: "auto-reload",
+        description: "Turn auto-reload on (a link your human approves; nothing is bought) or off (no approval)"
+      },
       subCommands: {
+        setup: defineCommand({
+          meta: {
+            name: "setup",
+            description: "Opens a page in your human's browser where they save a card and turn auto-reload on, buying nothing; then run `billing wait`"
+          },
+          args: {
+            ...jsonFlag,
+            below: {
+              type: "string",
+              description: "Reload when the balance drops below this (USD, default and minimum 5)"
+            },
+            amount: { type: "string", description: "Credits each reload adds (USD, default 20)" },
+            open: {
+              type: "boolean",
+              default: true,
+              description: "Open the page in the browser (--no-open only prints approval_url)"
+            }
+          },
+          run: ({ args }) => run2(() => billingAutoReloadSetup(makeCtx(), {
+            thresholdUsd: num("below", args.below),
+            amountUsd: num("amount", args.amount),
+            noOpen: args.open === false
+          }), args)
+        }),
         off: defineCommand({
           meta: { name: "off", description: "Disable auto-reload. No approval needed" },
           args: jsonFlag,
-          run: ({ args }) => run(() => billingAutoReloadOff(makeCtx()), args)
+          run: ({ args }) => run2(() => billingAutoReloadOff(makeCtx()), args)
         })
       }
     }),
     transactions: defineCommand({
       meta: { name: "transactions", description: "Credit ledger: purchases, auto-reloads, usage, batches, refunds" },
       args: { ...jsonFlag, cursor: { type: "string", description: "next_cursor from the previous page" } },
-      run: ({ args }) => run(() => billingTransactions(makeCtx(), { cursor: args.cursor }), args)
+      run: ({ args }) => run2(() => billingTransactions(makeCtx(), { cursor: args.cursor }), args)
     }),
     upgrade: defineCommand({
       meta: { name: "upgrade", description: "Removed: monthly caps became prepaid credits. Use billing topup" },
@@ -10612,34 +12232,34 @@ var batches = defineCommand({
         file: { type: "positional", required: true, description: "Path to requests.jsonl" },
         endpoint: { type: "string", default: "/v1/chat/completions", description: "Endpoint every line calls" }
       },
-      run: ({ args }) => run(() => batchCreate(makeCtx(), { path: args.file, endpoint: args.endpoint }), args)
+      run: ({ args }) => run2(() => batchCreate(makeCtx(), { path: args.file, endpoint: args.endpoint }), args)
     }),
     list: defineCommand({
       meta: { name: "list", description: "Your batches" },
       args: jsonFlag,
-      run: ({ args }) => run(() => batchList(makeCtx()), args)
+      run: ({ args }) => run2(() => batchList(makeCtx()), args)
     }),
     get: defineCommand({
       meta: { name: "get", description: "One batch" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Batch id" } },
-      run: ({ args }) => run(() => batchGet(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => batchGet(makeCtx(), args.id), args)
     }),
     results: defineCommand({
       meta: { name: "results", description: "Print the output lines of a finished batch" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Batch id" } },
-      run: ({ args }) => run(() => batchResults(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => batchResults(makeCtx(), args.id), args)
     }),
     cancel: defineCommand({
       meta: { name: "cancel", description: "Cancel a batch" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Batch id" } },
-      run: ({ args }) => run(() => batchCancel(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => batchCancel(makeCtx(), args.id), args)
     })
   }
 });
 var benchmarks2 = defineCommand({
   meta: { name: "benchmarks", description: "Our own benchmark results for a model" },
   args: { ...jsonFlag, ...regionFlag, id: { type: "positional", required: true, description: "Model id" } },
-  run: ({ args }) => run(() => benchmarks(makeCtx(), args.id, region(args.region)), args)
+  run: ({ args }) => run2(() => benchmarks(makeCtx(), args.id, region(args.region)), args)
 });
 var fineTune = defineCommand({
   meta: {
@@ -10656,7 +12276,7 @@ var fineTune = defineCommand({
         suffix: { type: "string", description: "Suffix for the fine-tuned model id" },
         epochs: { type: "string", description: "1-10, default 3" }
       },
-      run: ({ args }) => run(() => fineTuneCreate(makeCtx(), {
+      run: ({ args }) => run2(() => fineTuneCreate(makeCtx(), {
         path: args.file,
         model: args.model,
         suffix: args.suffix,
@@ -10666,27 +12286,27 @@ var fineTune = defineCommand({
     list: defineCommand({
       meta: { name: "list", description: "Your jobs" },
       args: jsonFlag,
-      run: ({ args }) => run(() => fineTuneList(makeCtx()), args)
+      run: ({ args }) => run2(() => fineTuneList(makeCtx()), args)
     }),
     get: defineCommand({
       meta: { name: "get", description: "One job" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Job id" } },
-      run: ({ args }) => run(() => fineTuneGet(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => fineTuneGet(makeCtx(), args.id), args)
     }),
     events: defineCommand({
       meta: { name: "events", description: "A job's progress events" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Job id" } },
-      run: ({ args }) => run(() => fineTuneEvents(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => fineTuneEvents(makeCtx(), args.id), args)
     }),
     cancel: defineCommand({
       meta: { name: "cancel", description: "Cancel a job" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Job id" } },
-      run: ({ args }) => run(() => fineTuneCancel(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => fineTuneCancel(makeCtx(), args.id), args)
     }),
     models: defineCommand({
       meta: { name: "models", description: "Your fine-tuned models" },
       args: jsonFlag,
-      run: ({ args }) => run(() => fineTuneModels(makeCtx()), args)
+      run: ({ args }) => run2(() => fineTuneModels(makeCtx()), args)
     })
   }
 });
@@ -10712,7 +12332,7 @@ var video = defineCommand({
         wait: { type: "boolean", description: "Wait until the video is ready" },
         output: { type: "string", alias: "o", description: "Save the MP4 here (waits for it)" }
       },
-      run: ({ args }) => run(() => videoCreate(makeCtx(), {
+      run: ({ args }) => run2(() => videoCreate(makeCtx(), {
         prompt: args.prompt,
         model: args.model,
         seconds: num("seconds", args.seconds),
@@ -10726,7 +12346,7 @@ var video = defineCommand({
     get: defineCommand({
       meta: { name: "get", description: "One video job: status, progress, cost" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Video id" } },
-      run: ({ args }) => run(() => videoGet(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => videoGet(makeCtx(), args.id), args)
     }),
     list: defineCommand({
       meta: { name: "list", description: "Your video jobs, newest first" },
@@ -10735,7 +12355,7 @@ var video = defineCommand({
         limit: { type: "string", description: "Page size, 1-100 (default 20)" },
         after: { type: "string", description: "Continue after this video id" }
       },
-      run: ({ args }) => run(() => videoList(makeCtx(), { limit: num("limit", args.limit), after: args.after }), args)
+      run: ({ args }) => run2(() => videoList(makeCtx(), { limit: num("limit", args.limit), after: args.after }), args)
     }),
     download: defineCommand({
       meta: { name: "download", description: "Save a finished video (or --thumbnail) to a file" },
@@ -10745,12 +12365,12 @@ var video = defineCommand({
         output: { type: "string", alias: "o", required: true, description: "File to write" },
         thumbnail: { type: "boolean", description: "Download the JPEG thumbnail instead" }
       },
-      run: ({ args }) => run(() => videoDownload(makeCtx(), args.id, args.output, args.thumbnail ? "thumbnail" : "video"), args)
+      run: ({ args }) => run2(() => videoDownload(makeCtx(), args.id, args.output, args.thumbnail ? "thumbnail" : "video"), args)
     }),
     delete: defineCommand({
       meta: { name: "delete", description: "Cancel (credits returned) or delete a video and its files" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Video id" } },
-      run: ({ args }) => run(() => videoDelete(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => videoDelete(makeCtx(), args.id), args)
     })
   }
 });
@@ -10760,7 +12380,7 @@ var status2 = defineCommand({
     description: "Per-model health in the region (last hour), plus your account's notices when a key is set"
   },
   args: { ...jsonFlag, ...regionFlag },
-  run: ({ args }) => run(() => status(makeCtx(), region(args.region)), args)
+  run: ({ args }) => run2(() => status(makeCtx(), region(args.region)), args)
 });
 var doctor2 = defineCommand({
   meta: {
@@ -10768,7 +12388,7 @@ var doctor2 = defineCommand({
     description: "Check this project's setup: key and region, account, credit, and notices to tell your human"
   },
   args: jsonFlag,
-  run: ({ args }) => run(() => doctor(makeCtx()), args)
+  run: ({ args }) => run2(() => doctor(makeCtx()), args)
 });
 var webhooks = defineCommand({
   meta: {
@@ -10786,27 +12406,68 @@ var webhooks = defineCommand({
           description: "Comma-separated events (default: all four)"
         }
       },
-      run: ({ args }) => run(() => webhooksAdd(makeCtx(), { url: args.url, events: args.events }), args)
+      run: ({ args }) => run2(() => webhooksAdd(makeCtx(), { url: args.url, events: args.events }), args)
     }),
     list: defineCommand({
       meta: { name: "list", description: "This account's webhook endpoints" },
       args: jsonFlag,
-      run: ({ args }) => run(() => webhooksList(makeCtx()), args)
+      run: ({ args }) => run2(() => webhooksList(makeCtx()), args)
     }),
     remove: defineCommand({
       meta: { name: "remove", description: "Delete an endpoint by id (whk_…)" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Webhook id" } },
-      run: ({ args }) => run(() => webhooksRemove(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => webhooksRemove(makeCtx(), args.id), args)
     })
   }
 });
+var connectTool = defineCommand({
+  meta: {
+    name: "connect",
+    description: "Point an OpenAI-compatible tool at ScaledThought: writes its config with the base URL and a new child key (never printed), or prints the steps when the tool's key store can't be written safely"
+  },
+  args: {
+    ...jsonFlag,
+    tool: { type: "positional", required: true, description: CONNECT_TOOLS.join(", ") },
+    model: { type: "string", description: "Default model (default: the newest live chat model)" },
+    "budget-usd": { type: "string", description: "Hard daily budget for the tool's key, in USD" }
+  },
+  run: ({ args }) => run2(() => connect(makeCtx(), args.tool, {
+    model: args.model,
+    budgetUsd: num("budget-usd", args["budget-usd"])
+  }), args)
+});
 var mcp = defineCommand({
   meta: {
     name: "mcp",
     description: "Print the `claude mcp add` command and JSON config for this account's MCP server"
   },
   args: jsonFlag,
-  run: ({ args }) => run(() => mcpSetup(makeCtx()), args)
+  run: ({ args }) => run2(() => mcpSetup(makeCtx()), args)
+});
+var dashboard = defineCommand({
+  meta: {
+    name: "dashboard",
+    description: "Open your human's ScaledThought dashboard (billing, keys, members, connect an agent) in their browser. No typing: if they're not signed in, one click emails them a link"
+  },
+  args: {
+    ...jsonFlag,
+    page: { type: "string", description: "overview (default), billing, keys, members or connect" },
+    email: {
+      type: "string",
+      description: "Set the owner's email (only before anyone has signed in; normally the first payer is the owner)"
+    },
+    open: { type: "boolean", default: true, description: "Open it in the browser (--no-open only prints the URL)" }
+  },
+  run: ({ args }) => run2(() => dashboardOpen(makeCtx(), {
+    page: args.page,
+    email: args.email,
+    noOpen: args.open === false
+  }), args)
+});
+var members2 = defineCommand({
+  meta: { name: "members", description: "Who can sign in to this account's dashboard (email, role, status)" },
+  args: jsonFlag,
+  run: ({ args }) => run2(() => membersList(makeCtx()), args)
 });
 var root = defineCommand({
   meta: {
@@ -10816,6 +12477,8 @@ var root = defineCommand({
   },
   subCommands: {
     init: init2,
+    login: login2,
+    use,
     models,
     benchmarks: benchmarks2,
     status: status2,
@@ -10833,7 +12496,10 @@ var root = defineCommand({
     video,
     webhooks,
     doctor: doctor2,
-    mcp
+    connect: connectTool,
+    mcp,
+    dashboard,
+    members: members2
   }
 });
 var NUMERIC_FLAGS = new Set([