scaledthought 0.3.0 → 0.3.1

package/dist/index.js

@@ -553,7 +553,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "scaledthought",
-  version: "0.3.0",
+  version: "0.3.1",
   description: "Headless open-model inference, run by your agent. Prepaid, pay per token. US or Canada.",
   license: "MIT",
   keywords: [
@@ -661,7 +661,7 @@ var HINTS = {
   free_tier_limit: "Accounts that haven't bought credits have lower limits. The first credit purchase lifts them: run `billing topup --amount-usd 20` and show your human the approval_url.",
   free_tier_key_limit: "Accounts that haven't bought credits have at most 5 active keys. Revoke one with `keys revoke <id>`, or buy credits with `billing topup`.",
   too_many_pending_topups: "Two approval links are still unpaid. Ask your human to use one (see `billing status` pending_topups), or wait for them to expire.",
-  daily_topup_limit: "Top-ups are limited to $2,000 per account per rolling 24 hours (open links and auto-reloads included). Use a smaller amount (see available_usd) or wait.",
+  daily_topup_limit: "Top-ups are limited to $2,000 per account per rolling 24 hours (open links and auto-reloads included). Use a smaller amount (see available_usd) or wait. Need more than $2,000 a day? Invoiced prepayment: sales@scaledthought.com",
   billing_upgrade_removed: "Run `billing topup --amount-usd 20` and show your human the approval_url.",
   gone: "This endpoint was removed. For credits use `billing topup --amount-usd 20`.",
   fine_tuning_requires_self_hosted: "This base model can't be fine-tuned in your region (it isn't served on our own GPUs). Choose another base model.",
@@ -7898,6 +7898,179 @@ var AD_WRITE_CREDENTIAL_ENV = {
   microsoft: "AD_WRITE_MICROSOFT_CREDENTIALS"
 };
 var AD_WRITE_CREDENTIAL_ENV_NAMES = Object.values(AD_WRITE_CREDENTIAL_ENV);
+// ../../packages/growth/src/portfolio.ts
+var PORTFOLIO_LIMITS = {
+  weeklyBudgetMicros: 1e9,
+  founders: ["alexey-scaled-throught", "josh-scaledthought"],
+  effortDayMicros: 50000000
+};
+var FUNNEL_STAGES = ["click", "fetch", "signup", "activated", "paid"];
+var EXPERIMENT_KINDS = ["paid", "owned", "onboarding", "lifecycle", "community", "research"];
+var AGENT_ROLES = [
+  "growth-lead",
+  "analyst",
+  "onboarding",
+  "seo",
+  "paid-ads",
+  "landing",
+  "lifecycle",
+  "content",
+  "community",
+  "research",
+  "integrations",
+  "canada"
+];
+var EXPERIMENT_STATUSES = ["proposed", "approved", "running", "read", "killed", "scaled"];
+var EXPERIMENT_METRICS = [
+  "ctr",
+  "fetch_rate",
+  "agent_fetches",
+  "human_visits",
+  "signups",
+  "activation_rate",
+  "paid_rate",
+  "topup_request_rate",
+  "topup_completion_rate",
+  "cost_per_activated",
+  "cost_per_payer",
+  "onboarding_success_rate",
+  "time_to_first_call",
+  "npm_downloads",
+  "github_stars",
+  "registry_installs"
+];
+var SURFACE_TYPES = [
+  "page",
+  "copy",
+  "code",
+  "listing",
+  "cli",
+  "notice",
+  "ad",
+  "post",
+  "email",
+  "external",
+  "price"
+];
+var TIER2_SURFACES = new Set(["ad", "post", "email", "price", "listing", "external"]);
+var SURFACE_RE = new RegExp(`^(${SURFACE_TYPES.join("|")}):[^\\s*]+\\*?$`);
+var EXPERIMENT_ID_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var CAMPAIGN_ID_RE = /^gcm_[0-9A-HJKMNP-TV-Z]{26}$/;
+var Day = string2().refine(isDay, "a UTC day, YYYY-MM-DD");
+var Bps = number2().int().min(0).max(1e4);
+var Micros = number2().int().min(0);
+var DecisionRule = discriminatedUnion("kind", [
+  object({ kind: literal("p_better"), threshold: number2().min(0.5).max(0.999) }),
+  object({ kind: literal("rate_at_least"), bps: Bps }),
+  object({ kind: literal("cost_at_most"), micros: Micros })
+]);
+var ExperimentSpec = object({
+  id: string2().max(64).regex(EXPERIMENT_ID_RE, "kebab-case, the file name without .yaml"),
+  title: string2().min(5).max(120),
+  hypothesis: string2().min(20).max(600),
+  owner: _enum(AGENT_ROLES),
+  kind: _enum(EXPERIMENT_KINDS),
+  stage: _enum(FUNNEL_STAGES),
+  tier: union([literal(0), literal(1), literal(2)]),
+  status: _enum(EXPERIMENT_STATUSES),
+  created: Day,
+  surfaces: array(string2().regex(SURFACE_RE, "<type>:<target>, e.g. page:/docs/cursor")).min(1),
+  codes: array(CodeSchema).default([]),
+  metric: object({ primary: _enum(EXPERIMENT_METRICS), guardrail: _enum(EXPERIMENT_METRICS).optional() }),
+  design: object({
+    type: _enum(["ab", "single", "discovery", "synthetic"]),
+    variants: array(string2().min(1).max(40)).optional(),
+    arms: record(string2().min(1).max(40), array(CodeSchema).min(1)).optional()
+  }),
+  run: object({ from: Day, to: Day }).optional(),
+  decision: object({ read_on: Day, min_n: number2().int().min(1), rule: DecisionRule }),
+  budget: object({ weekly_micros: Micros }).default({ weekly_micros: 0 }),
+  estimate: object({
+    p_win_bps: Bps,
+    lift_bps: number2().int().min(1).max(1e5),
+    baseline_per_week: number2().min(0),
+    effort_days: number2().min(0).max(30)
+  }),
+  approval: object({ by: string2().optional(), on: Day.optional(), note: string2().min(3).max(300).optional() }).strict().optional(),
+  campaigns: array(string2().regex(CAMPAIGN_ID_RE, "a console campaign id, gcm_<ulid>")).max(10).default([]),
+  result: object({
+    read: Day,
+    outcome: _enum(["win", "loss", "inconclusive", "stopped"]),
+    summary: string2().min(10).max(1000)
+  }).optional()
+}).strict();
+
+// ../../packages/growth/src/campaigns.ts
+var KEYWORD_MATCH_TYPES = ["exact", "phrase", "broad"];
+var GOOGLE_AD_LIMITS = {
+  headline: 30,
+  description: 90,
+  path: 15,
+  headlinesMin: 3,
+  headlinesMax: 15,
+  descriptionsMin: 2,
+  descriptionsMax: 4,
+  keyword: 80,
+  keywordWords: 10,
+  adGroups: 20,
+  keywordsPerAdGroup: 200,
+  adsPerAdGroup: 3,
+  negativeKeywords: 500
+};
+var CampaignId = string2().regex(CAMPAIGN_ID_RE, "a campaign id, gcm_<ulid>");
+var Line = (max, what) => string2().trim().min(1).refine((s) => [...s].length <= max, `${what}: at most ${max} characters`);
+var Keyword = object({
+  text: Line(GOOGLE_AD_LIMITS.keyword, "keyword").refine((s) => s.split(/\s+/).length <= GOOGLE_AD_LIMITS.keywordWords, `keyword: at most ${GOOGLE_AD_LIMITS.keywordWords} words`),
+  match: _enum(KEYWORD_MATCH_TYPES)
+}).strict();
+var SearchAd = object({
+  headlines: array(Line(GOOGLE_AD_LIMITS.headline, "headline")).min(GOOGLE_AD_LIMITS.headlinesMin).max(GOOGLE_AD_LIMITS.headlinesMax),
+  descriptions: array(Line(GOOGLE_AD_LIMITS.description, "description")).min(GOOGLE_AD_LIMITS.descriptionsMin).max(GOOGLE_AD_LIMITS.descriptionsMax),
+  path1: Line(GOOGLE_AD_LIMITS.path, "path").optional(),
+  path2: Line(GOOGLE_AD_LIMITS.path, "path").optional()
+}).strict().refine((a) => !a.path2 || a.path1, "path2 needs path1");
+var AdGroup2 = object({
+  name: string2().trim().min(1).max(255),
+  keywords: array(Keyword).min(1).max(GOOGLE_AD_LIMITS.keywordsPerAdGroup),
+  ads: array(SearchAd).min(1).max(GOOGLE_AD_LIMITS.adsPerAdGroup),
+  negative_keywords: array(Keyword).max(GOOGLE_AD_LIMITS.negativeKeywords).default([])
+}).strict();
+var CampaignContent = object({
+  ad_groups: array(AdGroup2).min(1).max(GOOGLE_AD_LIMITS.adGroups),
+  negative_keywords: array(Keyword).max(GOOGLE_AD_LIMITS.negativeKeywords).default([])
+}).strict();
+var CAMPAIGN_NETWORKS = ["search", "search_partners", "display"];
+var CampaignTargeting = object({
+  locations: array(string2().trim().min(2).max(80)).min(1).max(50),
+  location_mode: _enum(["presence", "presence_or_interest"]).default("presence"),
+  languages: array(string2().trim().min(2).max(10)).min(1).max(20),
+  networks: array(_enum(CAMPAIGN_NETWORKS)).min(1).max(3).default(["search"])
+}).strict();
+var Day2 = string2().refine(isDay, "a UTC day, YYYY-MM-DD");
+var Budget = number2().int().positive().max(PORTFOLIO_LIMITS.weeklyBudgetMicros);
+var CAMPAIGN_FIELD_SHAPE = {
+  name: string2().trim().min(3).max(120),
+  code: CodeSchema,
+  experiment_id: string2().max(64).regex(EXPERIMENT_ID_RE).nullable(),
+  ad_account_id: string2().trim().min(1).max(64).nullable(),
+  final_url: string2().trim().max(200),
+  daily_budget_micros: Budget.nullable(),
+  weekly_budget_micros: Budget.nullable(),
+  run_from: Day2,
+  run_to: Day2,
+  targeting: CampaignTargeting,
+  content: CampaignContent,
+  notes: string2().trim().max(4000).nullable()
+};
+var CampaignFields = object({
+  ...CAMPAIGN_FIELD_SHAPE,
+  experiment_id: CAMPAIGN_FIELD_SHAPE.experiment_id.default(null),
+  ad_account_id: CAMPAIGN_FIELD_SHAPE.ad_account_id.default(null),
+  daily_budget_micros: CAMPAIGN_FIELD_SHAPE.daily_budget_micros.default(null),
+  weekly_budget_micros: CAMPAIGN_FIELD_SHAPE.weekly_budget_micros.default(null),
+  notes: CAMPAIGN_FIELD_SHAPE.notes.default(null)
+}).strict();
+var CampaignFieldsPatch = object(CAMPAIGN_FIELD_SHAPE).partial().strict();
 // ../../packages/growth/src/sinks/google.ts
 var GOOGLE_DATA_MANAGER_URL = "https://datamanager.googleapis.com/v1/events:ingest";
 var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
@@ -8208,35 +8381,9 @@ var PERMANENT_FIRST_PURCHASE_SKIPS = new Set([
   "account_not_active"
 ]);
 // ../../packages/growth/src/experiments.ts
-var EXPERIMENTS = {
-  "first-paying-customers": {
-    title: "First paying customers",
-    hypothesis: "Developers who use coding agents will pay for open models when their agent sets everything up from one pasted prompt.",
-    spend: { from: "2026-10-06", to: "2026-10-19" },
-    tailDays: 7,
-    payWindowDays: 14,
-    activationDays: 7,
-    passCostMicros: 20000000,
-    stopCostMicros: 40000000,
-    minPaidRateBps: 500,
-    lowPaidRateBps: 200,
-    minPayers: 12,
-    verdictMinSpendMicros: 300000000,
-    verdictMinActivations: 15,
-    pauseCheckDay: 10,
-    readMinMatured: 30,
-    excludedAccountIds: [],
-    messages: { A: "Agent", B: "Free", C: "Private" },
-    platforms: ["reddit", "google", "x", "ethicalads"],
-    plan: {
-      fetchPerClickBps: 2000,
-      activatedPerFetchBps: 7500,
-      paidPerActivatedBps: 500,
-      costPerPayerMicros: 333000000
-    }
-  }
-};
+var EXPERIMENTS = {};
 var EXPERIMENT_KEYS = Object.keys(EXPERIMENTS);
+var DEFAULT_EXPERIMENT_KEY = EXPERIMENT_KEYS[0] ?? null;
 var EXPERIMENT_PHASES = ["before", "spending", "reading_payment", "payment_read", "tail_read"];
 // ../../packages/growth/src/go-hits.ts
 var GO_HIT_KINDS = ["human", "agent"];
@@ -8297,13 +8444,13 @@ var EthicalAdsCredentials = object({
 var credentials3 = (creds) => parseCredentialsJson(creds[ENV7], EthicalAdsCredentials);
 var ethicalAdsApiAccount = (creds) => credentials3(creds).advertiser;
 var Num3 = union([number2(), string2()]).nullable().optional();
-var Day = object({ date: string2().optional(), index: string2().optional(), views: Num3, clicks: Num3, cost: Num3 });
+var Day3 = object({ date: string2().optional(), index: string2().optional(), views: Num3, clicks: Num3, cost: Num3 });
 var Report = object({
-  days: array(Day).default([]),
+  days: array(Day3).default([]),
   flights: array(object({
     name: string2().nullable().optional(),
     slug: string2(),
-    report: object({ days: array(Day).default([]) }).nullable().optional()
+    report: object({ days: array(Day3).default([]) }).nullable().optional()
   })).default([])
 });
 var dayOf2 = (d) => (d.date ?? d.index ?? "").slice(0, 10);
@@ -8949,102 +9096,8 @@ var ethicalAds2 = withApi(ethicalAds, "ethicalads", pullEthicalAds, ethicalAdsAp
 var microsoftAds2 = withApi(microsoftAds, "microsoft", pullMicrosoftAds, microsoftApiAccount);
 var linkedInAds2 = withApi(linkedInAds, "linkedin", pullLinkedInAds, linkedInApiAccount);
 var metaAds2 = withApi(metaAds, "meta", pullMetaAds, metaApiAccount);
-// ../../packages/growth/src/portfolio.ts
-var FUNNEL_STAGES = ["click", "fetch", "signup", "activated", "paid"];
-var EXPERIMENT_KINDS = ["paid", "owned", "onboarding", "lifecycle", "community", "research"];
-var AGENT_ROLES = [
-  "growth-lead",
-  "analyst",
-  "onboarding",
-  "seo",
-  "paid-ads",
-  "landing",
-  "lifecycle",
-  "content",
-  "community",
-  "research",
-  "integrations",
-  "canada"
-];
-var EXPERIMENT_STATUSES = ["proposed", "approved", "running", "read", "killed", "scaled"];
-var EXPERIMENT_METRICS = [
-  "ctr",
-  "fetch_rate",
-  "agent_fetches",
-  "human_visits",
-  "signups",
-  "activation_rate",
-  "paid_rate",
-  "topup_request_rate",
-  "topup_completion_rate",
-  "cost_per_activated",
-  "cost_per_payer",
-  "onboarding_success_rate",
-  "time_to_first_call",
-  "npm_downloads",
-  "github_stars",
-  "registry_installs"
-];
-var SURFACE_TYPES = [
-  "page",
-  "copy",
-  "code",
-  "listing",
-  "cli",
-  "notice",
-  "ad",
-  "post",
-  "email",
-  "external",
-  "price"
-];
-var TIER2_SURFACES = new Set(["ad", "post", "email", "price", "listing", "external"]);
-var SURFACE_RE = new RegExp(`^(${SURFACE_TYPES.join("|")}):[^\\s*]+\\*?$`);
-var EXPERIMENT_ID_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var Day2 = string2().refine(isDay, "a UTC day, YYYY-MM-DD");
-var Bps = number2().int().min(0).max(1e4);
-var Micros = number2().int().min(0);
-var DecisionRule = discriminatedUnion("kind", [
-  object({ kind: literal("p_better"), threshold: number2().min(0.5).max(0.999) }),
-  object({ kind: literal("rate_at_least"), bps: Bps }),
-  object({ kind: literal("cost_at_most"), micros: Micros })
-]);
-var ExperimentSpec = object({
-  id: string2().max(64).regex(EXPERIMENT_ID_RE, "kebab-case, the file name without .yaml"),
-  title: string2().min(5).max(120),
-  hypothesis: string2().min(20).max(600),
-  owner: _enum(AGENT_ROLES),
-  kind: _enum(EXPERIMENT_KINDS),
-  stage: _enum(FUNNEL_STAGES),
-  tier: union([literal(0), literal(1), literal(2)]),
-  status: _enum(EXPERIMENT_STATUSES),
-  created: Day2,
-  surfaces: array(string2().regex(SURFACE_RE, "<type>:<target>, e.g. page:/docs/cursor")).min(1),
-  codes: array(CodeSchema).default([]),
-  metric: object({ primary: _enum(EXPERIMENT_METRICS), guardrail: _enum(EXPERIMENT_METRICS).optional() }),
-  design: object({
-    type: _enum(["ab", "single", "discovery", "synthetic"]),
-    variants: array(string2().min(1).max(40)).optional(),
-    arms: record(string2().min(1).max(40), array(CodeSchema).min(1)).optional()
-  }),
-  run: object({ from: Day2, to: Day2 }).optional(),
-  decision: object({ read_on: Day2, min_n: number2().int().min(1), rule: DecisionRule }),
-  budget: object({ weekly_micros: Micros }).default({ weekly_micros: 0 }),
-  estimate: object({
-    p_win_bps: Bps,
-    lift_bps: number2().int().min(1).max(1e5),
-    baseline_per_week: number2().min(0),
-    effort_days: number2().min(0).max(30)
-  }),
-  approval: object({ by: string2(), on: Day2 }).optional(),
-  result: object({
-    read: Day2,
-    outcome: _enum(["win", "loss", "inconclusive", "stopped"]),
-    summary: string2().min(10).max(1000)
-  }).optional()
-}).strict();
 // ../../packages/growth/src/results-schema.ts
-var Day3 = string2().regex(/^\d{4}-\d{2}-\d{2}$/);
+var Day4 = string2().regex(/^\d{4}-\d{2}-\d{2}$/);
 var Micros2 = number2().int();
 var Count = number2().int().nonnegative();
 var Bps2 = number2().int();
@@ -9076,7 +9129,7 @@ var CodeResultRow = ResultRow.extend({
   channel: string2(),
   message: string2().nullable(),
   status: string2(),
-  paused_on: Day3.nullable(),
+  paused_on: Day4.nullable(),
   sample_ok: boolean2(),
   pause_suggested: boolean2(),
   leading: boolean2(),
@@ -9108,8 +9161,8 @@ var Scorecard = object({
   real_use: object({ eligible: Count, returned: Count, rate_bps: Bps2.nullable() })
 });
 var Read = object({
-  signups_from: Day3,
-  signups_to: Day3,
+  signups_from: Day4,
+  signups_to: Day4,
   scorecard: Scorecard,
   by_message: array(ResultRow),
   by_channel: array(ResultRow),
@@ -9131,7 +9184,7 @@ var RuleOutcome = _enum([
 ]);
 var Rule = object({
   id: RuleId,
-  date: Day3,
+  date: Day4,
   status: RuleStatus,
   outcome: RuleOutcome,
   codes: array(string2()),
@@ -9140,7 +9193,7 @@ var Rule = object({
 var PlatformFinality = object({
   platform: string2(),
   spend_micros: Micros2,
-  final_through: Day3.nullable(),
+  final_through: Day4.nullable(),
   last_import_at: string2().nullable(),
   last_import_source: _enum(["csv", "api", "manual"]).nullable()
 });
@@ -9165,13 +9218,13 @@ var Checks = object({
   }),
   spread: array(object({
     code: string2(),
-    paused_on: Day3,
+    paused_on: Day4,
     signups_after: Count,
     verdict_changes: boolean2()
   })),
   spend: object({
     final: boolean2(),
-    final_through: Day3.nullable(),
+    final_through: Day4.nullable(),
     platforms: array(PlatformFinality),
     unattributed_micros: Micros2,
     unattributed_rows: Count
@@ -9197,13 +9250,13 @@ var GrowthResults = object({
     key: string2(),
     title: string2(),
     hypothesis: string2(),
-    spend: object({ from: Day3, to: Day3 }),
+    spend: object({ from: Day4, to: Day4 }),
     dates: object({
-      pause_check: Day3,
-      cost_read: Day3,
-      payment_read: Day3,
-      tail_read: Day3,
-      tail_signups_to: Day3
+      pause_check: Day4,
+      cost_read: Day4,
+      payment_read: Day4,
+      tail_read: Day4,
+      tail_signups_to: Day4
     }),
     thresholds: object({
       pass_cost_micros: Micros2,
@@ -9224,7 +9277,7 @@ var GrowthResults = object({
       cost_per_payer_micros: Micros2
     })
   }),
-  as_of: Day3,
+  as_of: Day4,
   day: number2().int(),
   phase: _enum(EXPERIMENT_PHASES),
   read: Read,
@@ -9236,7 +9289,7 @@ var GrowthResults = object({
   decisions: array(GrowthDecision)
 });
 // ../../packages/schemas/src/legal.ts
-var TERMS_VERSION = "2026-10-10";
+var TERMS_VERSION = "2026-10-11";
 var LEGAL_SITE = "https://scaledthought.com";
 var LEGAL_PATHS = {
   index: "/legal",
@@ -9244,7 +9297,6 @@ var LEGAL_PATHS = {
   privacy: "/legal/privacy",
   acceptableUse: "/legal/acceptable-use",
   creditsAndRefunds: "/legal/credits-and-refunds",
-  subprocessors: "/legal/subprocessors",
   security: "/legal/security"
 };
 var TERMS_URL = `${LEGAL_SITE}${LEGAL_PATHS.terms}`;
@@ -9392,7 +9444,6 @@ function machineStore(env, platform = process.platform) {
 }
 
 // src/connect.ts
-var NPX = "npx -y scaledthought@0.3";
 var LOGIN_DIR = ".scaledthought";
 var LOGIN_FILE = join4(LOGIN_DIR, "login.json");
 var KEY_SAVED_TO = ".env (ST_API_KEY, ST_BASE_URL)";
@@ -9742,10 +9793,10 @@ async function readCodeFrom(stream) {
 }
 
 // src/commands.ts
-var NPX2 = "npx -y scaledthought@0.3";
+var NPX = "npx -y scaledthought@0.3";
 var FIRST_TOPUP_USD = 20;
-var TOPUP_COMMAND = `${NPX2} billing topup --amount-usd ${FIRST_TOPUP_USD}`;
-var WAIT_COMMAND = `${NPX2} billing wait`;
+var TOPUP_COMMAND = `${NPX} billing topup --amount-usd ${FIRST_TOPUP_USD}`;
+var WAIT_COMMAND = `${NPX} billing wait`;
 var WAIT_PATIENCE_MIN = 15;
 var CREDIT_STEPS = [
   `Inference is prepaid and this account has no credits yet: completions return 402 insufficient_credits until your human pays. Do these first, in order:`,
@@ -9757,10 +9808,10 @@ var CREDIT_STEPS = [
 function nextSteps(model, needsCredits) {
   return [
     ...needsCredits ? CREDIT_STEPS : [],
-    model ? `Verify with one real completion: ${NPX2} chat -m ${model} "Reply with OK" (or POST $ST_BASE_URL/chat/completions with that model)` : `No chat model is live in this region right now. Check again with: ${NPX2} models --live`,
-    `Or let the router pick: ${NPX2} chat -m auto "Reply with OK"`,
+    model ? `Verify with one real completion: ${NPX} chat -m ${model} "Reply with OK" (or POST $ST_BASE_URL/chat/completions with that model)` : `No chat model is live in this region right now. Check again with: ${NPX} models --live`,
+    `Or let the router pick: ${NPX} chat -m auto "Reply with OK"`,
     "Use it from code: any OpenAI SDK with base_url=$ST_BASE_URL and api_key=$ST_API_KEY (both are in .env)",
-    `Optional, connect MCP: ${NPX2} mcp`,
+    `Optional, connect MCP: ${NPX} mcp`,
     ...needsCredits ? [] : [`More credits when needed: ${TOPUP_COMMAND} returns an approval_url for your human (inference is prepaid)`]
   ];
 }
@@ -9780,7 +9831,7 @@ async function liveSummary(ctx, region, balanceUsd) {
   return {
     balance_usd: balanceUsd ?? 0,
     needs_credits: needsCredits,
-    next_command: needsCredits ? TOPUP_COMMAND : `${NPX2} chat -m ${suggested ?? "auto"} "Reply with OK"`,
+    next_command: needsCredits ? TOPUP_COMMAND : `${NPX} chat -m ${suggested ?? "auto"} "Reply with OK"`,
     newest_models: live.slice(0, 5),
     suggested_model: suggested,
     next_steps: nextSteps(suggested, needsCredits)
@@ -10222,7 +10273,7 @@ async function billingTopupAndWait(ctx, o) {
   let t = created;
   while (!TOPUP_DONE.has(t.status ?? "")) {
     if (Date.now() > deadline)
-      throw new CliError("topup_wait_timeout", `Top-up ${id} is still ${t.status}.`, `The link may still work. Check later with: ${NPX2} billing status`, { topup_id: id });
+      throw new CliError("topup_wait_timeout", `Top-up ${id} is still ${t.status}.`, `The link may still work. Check later with: ${NPX} billing status`, { topup_id: id });
     await new Promise((r) => setTimeout(r, o.pollMs ?? 3000));
     t = await api(ctx, "GET", `/v1/billing/topups/${encodeURIComponent(id)}`);
   }
@@ -10233,7 +10284,7 @@ async function billingTopupAndWait(ctx, o) {
 var billingAutoReloadOff = (ctx) => api(ctx, "PATCH", "/v1/billing/auto-reload", { body: { enabled: false } });
 var billingTransactions = (ctx, o = {}) => api(ctx, "GET", `/v1/billing/transactions${o.cursor ? `?cursor=${encodeURIComponent(o.cursor)}` : ""}`);
 function billingUpgradeRemoved() {
-  throw new CliError("billing_upgrade_removed", "billing upgrade (monthly caps) was replaced by prepaid credits.", `Run \`${NPX2} billing topup --amount-usd 20\` and send your human the approval_url. They can turn on auto-reload on the same page.`);
+  throw new CliError("billing_upgrade_removed", "billing upgrade (monthly caps) was replaced by prepaid credits.", `Run \`${NPX} billing topup --amount-usd 20\` and send your human the approval_url. They can turn on auto-reload on the same page.`);
 }
 var benchmarks = (ctx, id, region) => api(ctx, "GET", `/v1/models/${encodeURIComponent(id)}/benchmarks`, {
   auth: false,
@@ -10581,8 +10632,827 @@ async function decide2(ctx, body) {
   return { ...out, region: res.headers.get("x-st-region"), request_id: res.headers.get("x-st-request-id") };
 }
 
+// src/destinations/run.ts
+import { spawn as spawn2 } from "node:child_process";
+var TIMEOUT_MS2 = 120000;
+var spawnRunner = (cmd, args, opts) => new Promise((resolve, reject) => {
+  const child = spawn2(cmd, args, {
+    cwd: opts.cwd,
+    env: opts.env ? { ...process.env, ...opts.env } : process.env,
+    shell: false,
+    stdio: ["pipe", "pipe", "pipe"],
+    windowsHide: true
+  });
+  let stdout = "";
+  let stderr = "";
+  const timer = setTimeout(() => child.kill("SIGTERM"), TIMEOUT_MS2);
+  child.stdout.on("data", (d) => {
+    stdout += d.toString("utf8");
+  });
+  child.stderr.on("data", (d) => {
+    stderr += d.toString("utf8");
+  });
+  child.on("error", (e) => {
+    clearTimeout(timer);
+    reject(e);
+  });
+  child.on("close", (code) => {
+    clearTimeout(timer);
+    resolve({ code: code ?? 1, stdout, stderr });
+  });
+  child.stdin.on("error", () => {});
+  child.stdin.end(opts.stdin ?? "");
+});
+var isMissing = (e) => e?.code === "ENOENT";
+function redact(text, secrets) {
+  let out = text;
+  for (const s of secrets)
+    if (s)
+      out = out.split(s).join("[redacted]");
+  return out.replace(/st_(ca|us)_(live|test)_[0-9A-Za-z]{8,}/g, "[redacted]");
+}
+async function probe(io, p, args, stdin) {
+  try {
+    return await io.run(p.cmd, args, { cwd: io.cwd, stdin });
+  } catch (e) {
+    if (isMissing(e))
+      throw missing(p);
+    throw new CliError("destination_failed", `Could not start ${p.cmd}.`, p.install);
+  }
+}
+async function exec(io, p, args, o = {}) {
+  const r = await probe(io, p, args, o.stdin);
+  if (r.code !== 0) {
+    const detail = redact(r.stderr || r.stdout, [...o.secrets ?? [], o.stdin ?? ""]).trim().slice(-300);
+    throw new CliError("destination_failed", `\`${o.shown ?? `${p.cmd} ${args.slice(0, 3).join(" ")}`}\` failed (exit code ${r.code}).`, p.login, detail ? { detail } : {});
+  }
+  return r.stdout;
+}
+function missing(p) {
+  return new CliError("destination_cli_missing", `\`${p.cmd}\` isn't installed or isn't on PATH.`, p.install);
+}
+var SAFE = /^[A-Za-z0-9_.@:+=][A-Za-z0-9_.@:+=-]*$/;
+var SAFE_SLASH = /^[A-Za-z0-9_.@:+=][A-Za-z0-9_.@:+=/-]*$/;
+var isSafeValue = (v, o = {}) => typeof v === "string" && v.length <= 120 && (o.slash ? SAFE_SLASH : SAFE).test(v);
+function safeValue(flag, v, o = {}) {
+  if (!isSafeValue(v, o))
+    throw new CliError("bad_argument", `--${flag} "${v.slice(0, 60)}" isn't a valid name${o.slash ? "" : " (no slashes)"}.`, "Use letters, digits and . _ - : @ (it must not start with -).");
+  return v;
+}
+
+// src/destinations/types.ts
+var PUT_FLAGS = [
+  "repo",
+  "env",
+  "app",
+  "project",
+  "worker",
+  "secret",
+  "aws-region",
+  "locations",
+  "namespace",
+  "context",
+  "config"
+];
+var keyName = (s) => s.length <= 80 ? s : `${s.slice(0, 79)}…`;
+
+// src/destinations/aws.ts
+var AWS = {
+  cmd: "aws",
+  install: "Install the AWS CLI and configure it: https://aws.amazon.com/cli/, then `aws configure` or `aws sso login`.",
+  login: "Check `aws sts get-caller-identity` and that you may manage Secrets Manager secrets in that region."
+};
+function target(region, secret) {
+  return {
+    livesIn: `aws:${region}/${secret}`,
+    keyName: keyName(`aws: ${region} / ${secret}`),
+    params: { region, secret }
+  };
+}
+var FROM_STDIN = ["--secret-string", "file:///dev/stdin"];
+var aws = {
+  id: "aws",
+  label: "AWS Secrets Manager",
+  flags: ["aws-region", "secret"],
+  async resolve(f, io) {
+    let region = f["aws-region"] ?? io.env.AWS_REGION ?? io.env.AWS_DEFAULT_REGION;
+    if (!region)
+      region = (await probe(io, AWS, ["configure", "get", "region"])).stdout.trim();
+    if (!region)
+      throw new CliError("bad_argument", "Which AWS region?", "Pass --aws-region, e.g. us-east-1.");
+    const secret = safeValue("secret", f.secret ?? "scaledthought/api-key", { slash: true });
+    return target(safeValue("aws-region", region), secret);
+  },
+  parse(rest) {
+    const i = rest.indexOf("/");
+    const region = rest.slice(0, i);
+    const secret = rest.slice(i + 1);
+    return i > 0 && isSafeValue(region) && isSafeValue(secret, { slash: true }) ? target(region, secret) : null;
+  },
+  async put(t, secret, io) {
+    const { region, secret: name } = t.params;
+    const exists = await probe(io, AWS, ["secretsmanager", "describe-secret", "--secret-id", name, "--region", region]);
+    const args = exists.code === 0 ? ["secretsmanager", "put-secret-value", "--secret-id", name, ...FROM_STDIN, "--region", region] : ["secretsmanager", "create-secret", "--name", name, ...FROM_STDIN, "--region", region];
+    const shown = `aws ${args.join(" ")}`;
+    await exec(io, AWS, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: (t) => `Read secret ${t.params.secret} in ${t.params.region} (AWSCURRENT); cached readers see it on refresh.`
+};
+
+// src/destinations/cloudflare.ts
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "node:fs";
+import { join as join6 } from "node:path";
+var WRANGLER = {
+  cmd: "wrangler",
+  install: "Install Wrangler and log in: npm i -g wrangler && wrangler login",
+  login: "Check `wrangler whoami` (log in with `wrangler login`) and the Worker name."
+};
+function target2(worker, env) {
+  return {
+    livesIn: `cloudflare:${worker}${env ? `/${env}` : ""}`,
+    keyName: keyName(`cloudflare: ${worker}${env ? ` / ${env}` : ""}`),
+    params: { worker, ...env ? { env } : {} }
+  };
+}
+function workerName(cwd) {
+  for (const f of ["wrangler.toml", "wrangler.json", "wrangler.jsonc"]) {
+    const p = join6(cwd, f);
+    if (!existsSync5(p))
+      continue;
+    const text = readFileSync7(p, "utf8");
+    const m = f.endsWith(".toml") ? /^\s*name\s*=\s*["']([^"']+)["']/m.exec(text) : /"name"\s*:\s*"([^"]+)"/.exec(text);
+    if (m)
+      return m[1];
+  }
+  return;
+}
+var cloudflare = {
+  id: "cloudflare",
+  label: "Cloudflare Workers",
+  flags: ["worker", "env"],
+  async resolve(f, io) {
+    const worker = f.worker ?? workerName(io.cwd);
+    if (!worker)
+      throw new CliError("bad_argument", "Which Worker?", "Pass --worker <name> (or run where wrangler.toml is).");
+    return target2(safeValue("worker", worker), f.env ? safeValue("env", f.env) : undefined);
+  },
+  parse(rest) {
+    const [worker, env, ...more] = rest.split("/");
+    if (!isSafeValue(worker) || more.length || env && !isSafeValue(env))
+      return null;
+    return target2(worker, env || undefined);
+  },
+  async put(t, secret, io) {
+    const args = ["secret", "put", "ST_API_KEY", "--name", t.params.worker];
+    if (t.params.env)
+      args.push("--env", t.params.env);
+    const shown = `wrangler ${args.join(" ")}`;
+    await exec(io, WRANGLER, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: () => "The Worker reads env.ST_API_KEY; Cloudflare deploys the new secret at once."
+};
+
+// src/destinations/doppler.ts
+var DOPPLER = {
+  cmd: "doppler",
+  install: "Install the Doppler CLI and log in: https://docs.doppler.com/docs/install-cli, then `doppler login`.",
+  login: "Check `doppler me` and the project and config names (`doppler setup` links a directory)."
+};
+function target3(project, config) {
+  return {
+    livesIn: `doppler:${project}/${config}`,
+    keyName: keyName(`doppler: ${project} / ${config}`),
+    params: { project, config }
+  };
+}
+var doppler = {
+  id: "doppler",
+  label: "Doppler",
+  flags: ["project", "config"],
+  async resolve(f, io) {
+    const get = async (what) => (await probe(io, DOPPLER, ["configure", "get", what, "--plain"])).stdout.trim();
+    const project = f.project ?? await get("project");
+    const config = f.config ?? await get("config");
+    if (!project || !config)
+      throw new CliError("bad_argument", "Which Doppler project and config?", "Pass --project and --config (or run `doppler setup` here).");
+    return target3(safeValue("project", project), safeValue("config", config));
+  },
+  parse(rest) {
+    const [project, config, ...more] = rest.split("/");
+    return isSafeValue(project) && isSafeValue(config) && !more.length ? target3(project, config) : null;
+  },
+  async put(t, secret, io) {
+    const args = ["secrets", "set", "ST_API_KEY", "--project", t.params.project, "--config", t.params.config];
+    const shown = `doppler ${args.join(" ")}`;
+    await exec(io, DOPPLER, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: () => "Apps started with `doppler run` get it on their next start."
+};
+
+// src/destinations/fly.ts
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
+import { join as join7 } from "node:path";
+var FLY = {
+  cmd: "fly",
+  install: "Install flyctl and log in: https://fly.io/docs/flyctl/install/, then `fly auth login`.",
+  login: "Check `fly auth whoami` (log in with `fly auth login`) and the app name."
+};
+var FLYCTL = { ...FLY, cmd: "flyctl" };
+var target4 = (app) => ({ livesIn: `fly:${app}`, keyName: keyName(`fly: ${app}`), params: { app } });
+function appFromToml(cwd) {
+  const f = join7(cwd, "fly.toml");
+  if (!existsSync6(f))
+    return;
+  return /^\s*app\s*=\s*["']([^"']+)["']/m.exec(readFileSync8(f, "utf8"))?.[1];
+}
+async function run(io, args, stdin, shown) {
+  try {
+    await exec(io, FLY, args, { stdin, shown });
+  } catch (e) {
+    if (e.code !== "destination_cli_missing")
+      throw e;
+    await exec(io, FLYCTL, args, { stdin, shown });
+  }
+}
+var fly = {
+  id: "fly",
+  label: "Fly.io",
+  flags: ["app"],
+  async resolve(f, io) {
+    const app = f.app ?? appFromToml(io.cwd);
+    if (!app)
+      throw new CliError("bad_argument", "Which Fly app?", "Pass --app <name> (or run where fly.toml is).");
+    return target4(safeValue("app", app));
+  },
+  parse: (rest) => isSafeValue(rest) ? target4(rest) : null,
+  async put(t, secret, io) {
+    const args = ["secrets", "import", "-a", t.params.app];
+    const shown = `fly ${args.join(" ")}`;
+    await run(io, args, `ST_API_KEY=${secret}
+`, shown);
+    return `${shown} (stdin)`;
+  },
+  next: () => "Fly restarts the app's machines with the new secret."
+};
+
+// src/destinations/gcp.ts
+var GCLOUD = {
+  cmd: "gcloud",
+  install: "Install the Google Cloud CLI and log in: https://cloud.google.com/sdk/docs/install, then `gcloud auth login`.",
+  login: "Check `gcloud auth list` and that you may manage Secret Manager secrets in the project."
+};
+var SECRET_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,254}$/;
+function target5(project, secret, locations) {
+  return {
+    livesIn: `gcp:${project}/${secret}`,
+    keyName: keyName(`gcp: ${project} / ${secret}`),
+    params: { project, secret, ...locations ? { locations } : {} }
+  };
+}
+var gcp = {
+  id: "gcp",
+  label: "Google Cloud Secret Manager",
+  flags: ["project", "secret", "locations"],
+  async resolve(f, io) {
+    let project = f.project;
+    if (!project) {
+      project = (await exec(io, GCLOUD, ["config", "get-value", "project"])).trim();
+      if (!project || project === "(unset)")
+        throw new CliError("bad_argument", "No Google Cloud project is set.", "Pass --project <id>.");
+    }
+    const secret = f.secret ?? "st-api-key";
+    if (!SECRET_RE.test(secret))
+      throw new CliError("bad_argument", "--secret may use letters, digits, _ and - only (Secret Manager ids).");
+    return target5(safeValue("project", project), secret, f.locations ? safeValue("locations", f.locations.replace(/\s/g, "")) : undefined);
+  },
+  parse(rest) {
+    const [project, secret, ...more] = rest.split("/");
+    return isSafeValue(project) && secret && SECRET_RE.test(secret) && !more.length ? target5(project, secret) : null;
+  },
+  async put(t, secret, io) {
+    const { project, secret: name } = t.params;
+    const exists = await probe(io, GCLOUD, ["secrets", "describe", name, "--project", project, "--format=value(name)"]);
+    const args = exists.code === 0 ? ["secrets", "versions", "add", name, "--project", project, "--data-file=-"] : [
+      "secrets",
+      "create",
+      name,
+      "--project",
+      project,
+      "--data-file=-",
+      ...t.params.locations ? ["--replication-policy=user-managed", `--locations=${t.params.locations}`] : ["--replication-policy=automatic"]
+    ];
+    const shown = `gcloud ${args.join(" ")}`;
+    await exec(io, GCLOUD, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: (t) => `Read secret ${t.params.secret}, version latest (anything pinned to a version needs updating).`
+};
+
+// src/destinations/github.ts
+var GH = {
+  cmd: "gh",
+  install: "Install the GitHub CLI and log in: https://cli.github.com, then `gh auth login`.",
+  login: "Check `gh auth status` (log in with `gh auth login`) and that you can manage the repo's secrets."
+};
+var APPS = { actions: "Actions", codespaces: "Codespaces", dependabot: "Dependabot" };
+var REPO_RE = /^[A-Za-z0-9_.][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/;
+var isApp = (v) => v !== undefined && Object.hasOwn(APPS, v);
+function target6(repo, app, env) {
+  return {
+    livesIn: `github:${repo}/${app}${env ? `/${env}` : ""}`,
+    keyName: keyName(`github: ${repo} (${APPS[app]}${env ? `, ${env}` : ""})`),
+    params: { repo, app, ...env ? { env } : {} }
+  };
+}
+var github = {
+  id: "github",
+  label: "GitHub",
+  flags: ["repo", "app", "env"],
+  async resolve(f, io) {
+    const app = f.app ?? "actions";
+    if (!isApp(app))
+      throw new CliError("bad_argument", "--app must be actions, codespaces or dependabot.");
+    if (f.env && app !== "actions")
+      throw new CliError("bad_argument", "--env (a deployment environment) works only with --app actions.");
+    const repo = f.repo ?? (await exec(io, GH, ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"])).trim();
+    if (!REPO_RE.test(repo))
+      throw new CliError("bad_argument", "--repo must look like owner/name.", "Pass --repo owner/name.");
+    return target6(repo, app, f.env ? safeValue("env", f.env) : undefined);
+  },
+  parse(rest) {
+    const [owner, name, app, env, ...more] = rest.split("/");
+    if (!owner || !name || !isApp(app) || more.length || !REPO_RE.test(`${owner}/${name}`))
+      return null;
+    if (env && !isSafeValue(env))
+      return null;
+    return target6(`${owner}/${name}`, app, env || undefined);
+  },
+  async put(t, secret, io) {
+    const args = ["secret", "set", "ST_API_KEY", "--repo", t.params.repo];
+    if (t.params.app !== "actions")
+      args.push("--app", t.params.app);
+    if (t.params.env)
+      args.push("--env", t.params.env);
+    const shown = `gh ${args.join(" ")}`;
+    await exec(io, GH, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: () => "Workflows read it as secrets.ST_API_KEY from their next run."
+};
+
+// src/destinations/k8s.ts
+var KUBECTL = {
+  cmd: "kubectl",
+  install: "Install kubectl and point it at your cluster: https://kubernetes.io/docs/tasks/tools/",
+  login: "Check `kubectl config current-context` and that you may create Secrets in the namespace."
+};
+var SECRET_RE2 = /^[a-z0-9]([-a-z0-9.]{0,251}[a-z0-9])?$/;
+function target7(context, namespace, secret) {
+  return {
+    livesIn: `k8s:${context}/${namespace}/${secret}`,
+    keyName: keyName(`k8s: ${namespace}/${secret} (${context})`),
+    params: { context, namespace, secret }
+  };
+}
+var k8s = {
+  id: "k8s",
+  label: "Kubernetes",
+  flags: ["context", "namespace", "secret"],
+  async resolve(f, io) {
+    const context = f.context ?? (await exec(io, KUBECTL, ["config", "current-context"])).trim();
+    if (!context)
+      throw new CliError("bad_argument", "No kubectl context is set.", "Pass --context <name>.");
+    let namespace = f.namespace;
+    if (!namespace) {
+      const r = await probe(io, KUBECTL, ["config", "view", "--minify", "-o", "jsonpath={..namespace}"]);
+      namespace = r.code === 0 && r.stdout.trim() ? r.stdout.trim() : "default";
+    }
+    const secret = f.secret ?? "scaledthought";
+    if (!SECRET_RE2.test(secret))
+      throw new CliError("bad_argument", "--secret must be a lowercase DNS name, e.g. scaledthought.");
+    return target7(safeValue("context", context, { slash: true }), safeValue("namespace", namespace), secret);
+  },
+  parse(rest) {
+    const parts = rest.split("/");
+    if (parts.length < 3)
+      return null;
+    const secret = parts.pop();
+    const namespace = parts.pop();
+    const context = parts.join("/");
+    if (!isSafeValue(context, { slash: true }) || !isSafeValue(namespace) || !SECRET_RE2.test(secret))
+      return null;
+    return target7(context, namespace, secret);
+  },
+  async put(t, secret, io) {
+    const where = ["--namespace", t.params.namespace, "--context", t.params.context];
+    const create = ["create", "secret", "generic", t.params.secret, "--from-file=ST_API_KEY=/dev/stdin"];
+    const manifest = await exec(io, KUBECTL, [...create, "--dry-run=client", "-o", "yaml", ...where], {
+      stdin: secret,
+      shown: `kubectl create secret generic ${t.params.secret}`
+    });
+    const apply = ["apply", "--server-side", "--force-conflicts", "--field-manager=scaledthought", "-f", "-", ...where];
+    await exec(io, KUBECTL, apply, {
+      stdin: manifest,
+      secrets: [secret, Buffer.from(secret).toString("base64")],
+      shown: "kubectl apply --server-side -f -"
+    });
+    return `kubectl ${create.join(" ")} --dry-run=client -o yaml | kubectl apply --server-side -f - (stdin)`;
+  },
+  next: (t) => `Pods read Secret ${t.params.secret} when they start: restart the ones that use it (kubectl rollout restart deployment/<name> -n ${t.params.namespace}).`
+};
+
+// src/destinations/vercel.ts
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "node:fs";
+import { join as join8 } from "node:path";
+var VERCEL = {
+  cmd: "vercel",
+  install: "Install the Vercel CLI and log in: npm i -g vercel && vercel login",
+  login: "Check `vercel whoami` (log in with `vercel login`) and that this directory is linked (`vercel link`)."
+};
+function target8(project, env) {
+  return {
+    livesIn: `vercel:${project}/${env}`,
+    keyName: keyName(`vercel: ${project} / ${env}`),
+    params: { project, env }
+  };
+}
+function linkedProject(cwd) {
+  const f = join8(cwd, ".vercel", "project.json");
+  if (!existsSync7(f))
+    return null;
+  try {
+    const j = JSON.parse(readFileSync9(f, "utf8"));
+    return { name: j.projectName, id: j.projectId };
+  } catch {
+    return null;
+  }
+}
+var NOT_LINKED = "Run this in the app's directory after `vercel link`.";
+var vercel = {
+  id: "vercel",
+  label: "Vercel",
+  flags: ["project", "env"],
+  async resolve(f, io) {
+    const env = safeValue("env", f.env ?? "production");
+    const linked = linkedProject(io.cwd);
+    if (!linked)
+      throw new CliError("not_linked", "This directory isn't linked to a Vercel project.", NOT_LINKED);
+    const project = f.project ?? linked.name ?? linked.id;
+    if (!project)
+      throw new CliError("not_linked", "Can't tell which Vercel project this is.", "Pass --project.");
+    if (f.project && linked.name && f.project !== linked.name)
+      throw new CliError("not_linked", `This directory is linked to Vercel project "${linked.name}", not "${f.project}".`, NOT_LINKED);
+    return target8(safeValue("project", project), env);
+  },
+  parse(rest) {
+    const [project, env, ...more] = rest.split("/");
+    return isSafeValue(project) && isSafeValue(env) && !more.length ? target8(project, env) : null;
+  },
+  async put(t, secret, io, mode) {
+    const linked = linkedProject(io.cwd);
+    if (!linked || linked.name !== t.params.project && linked.id !== t.params.project)
+      throw new CliError("not_linked", `Vercel project "${t.params.project}" isn't the one linked in this directory.`, `Run \`keys rotate <id> --push\` in the directory linked to "${t.params.project}".`);
+    if (mode === "replace")
+      await probe(io, VERCEL, ["env", "rm", "ST_API_KEY", t.params.env, "--yes"]);
+    const args = ["env", "add", "ST_API_KEY", t.params.env];
+    const shown = `vercel ${args.join(" ")}`;
+    await exec(io, VERCEL, args, { stdin: secret, shown });
+    return `${shown} (stdin)`;
+  },
+  next: (t) => `Vercel reads the new value on the next deployment: ${t.params.env === "production" ? "vercel --prod" : "vercel"}`
+};
+
+// src/destinations/index.ts
+var DESTINATIONS = Object.fromEntries([github, vercel, fly, cloudflare, gcp, aws, k8s, doppler].map((d) => [d.id, d]));
+function destination(id) {
+  const d = Object.hasOwn(DESTINATIONS, id) ? DESTINATIONS[id] : undefined;
+  if (!d)
+    throw new CliError("unknown_destination", `Unknown destination "${id}".`, `Use one of: ${Object.keys(DESTINATIONS).join(", ")}.`);
+  return d;
+}
+function fromLivesIn(livesIn) {
+  if (!livesIn)
+    return null;
+  const i = livesIn.indexOf(":");
+  if (i <= 0)
+    return null;
+  const id = livesIn.slice(0, i);
+  const dest = Object.hasOwn(DESTINATIONS, id) ? DESTINATIONS[id] : undefined;
+  const target = dest?.parse(livesIn.slice(i + 1));
+  return dest && target ? { dest, target } : null;
+}
+
+// src/everywhere.ts
+import { chmodSync as chmodSync4, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir, hostname as hostname2 } from "node:os";
+import { dirname as dirname2, join as join9 } from "node:path";
+var io = (ctx) => ({ run: ctx.runner ?? spawnRunner, cwd: ctx.cwd, env: ctx.env });
+async function mintChild(ctx, o) {
+  const k = await api(ctx, "POST", "/v1/keys", {
+    body: {
+      name: o.name,
+      child: true,
+      lives_in: o.livesIn,
+      daily_budget_usd: o.budgetUsd,
+      scopes: o.scopes,
+      expires_in: o.expiresIn
+    }
+  });
+  if (!k.api_key || !KEY_RE.test(k.api_key))
+    throw new CliError("bad_response", "The server didn't return the new key.", "Retry; if it persists, report it.");
+  return k;
+}
+async function revokeMinted(ctx, id) {
+  return api(ctx, "DELETE", `/v1/keys/${encodeURIComponent(id)}`).then(() => true, () => false);
+}
+async function failAfterMint(ctx, keyId, e) {
+  const revoked = await revokeMinted(ctx, keyId);
+  const err = e instanceof CliError ? e : new CliError("destination_failed", "Storing the key failed.", "Retry; if it persists, report it.");
+  throw new CliError(err.code, `${err.message} ${revoked ? "The new key was revoked; nothing else changed." : `Revoking the new key ${keyId} failed: run \`keys revoke ${keyId}\`.`}`, err.hint, { ...err.extra, key_id: keyId, key_revoked: revoked });
+}
+function checkFlags(dest, flags) {
+  const extra = Object.keys(flags).filter((f) => flags[f] !== undefined && !dest.flags.includes(f));
+  if (extra.length)
+    throw new CliError("usage_error", `keys put ${dest.id} doesn't take --${extra.join(", --")}.`, `It takes: ${dest.flags.map((f) => `--${f}`).join(", ") || "no destination flags"}.`);
+}
+async function keysPut(ctx, destId, o) {
+  const dest = destination(destId);
+  checkFlags(dest, o.flags);
+  const { region } = resolveKey(ctx);
+  const target = await dest.resolve(o.flags, io(ctx));
+  const k = await mintChild(ctx, {
+    name: o.name ?? target.keyName,
+    livesIn: target.livesIn,
+    budgetUsd: o.budgetUsd,
+    scopes: o.scopes,
+    expiresIn: o.expiresIn
+  });
+  let storedWith;
+  try {
+    storedWith = await dest.put(target, k.api_key, io(ctx), "new");
+  } catch (e) {
+    return failAfterMint(ctx, k.id, e);
+  }
+  return {
+    key_name: k.name,
+    key_id: k.id,
+    key_prefix: k.prefix,
+    lives_in: target.livesIn,
+    stored_with: storedWith,
+    daily_budget_usd: k.daily_budget_usd,
+    base_url: inferenceUrl(region, ctx.env),
+    next: `${dest.next?.(target) ?? ""} The app reads ST_API_KEY; its base URL is ${inferenceUrl(region, ctx.env)} (not a secret: set ST_BASE_URL as a plain variable if your code uses it).`.trim()
+  };
+}
+async function keysRotatePush(ctx, o) {
+  const grace = o.grace ?? "24h";
+  const { data } = await api(ctx, "GET", "/v1/keys");
+  let keys;
+  if (o.all)
+    keys = data.filter((k) => k.status === "active");
+  else {
+    const k = data.find((x) => x.id === o.id);
+    if (!k)
+      throw new CliError("key_not_found", `No key ${o.id} on this account.`, "See `keys list`.");
+    keys = [k];
+  }
+  const rotated = [];
+  const skipped = [];
+  const failed = [];
+  const next = new Set;
+  for (const k of keys) {
+    const found = fromLivesIn(k.lives_in);
+    if (!found) {
+      const tool = /^tool:([a-z0-9-]+):/.exec(k.lives_in ?? "")?.[1];
+      skipped.push({
+        name: k.name,
+        key_id: k.id,
+        lives_in: k.lives_in ?? null,
+        reason: !k.lives_in ? "no lives_in (not put anywhere by keys put)" : tool ? `a tool's config: run \`connect ${tool}\` again on that machine, then revoke this key` : k.lives_in.startsWith("env:") ? "a folder's ./.env (a project key from init, login or use): rotate it from that folder with `keys rotate`" : "lives_in isn't a destination keys put knows"
+      });
+      continue;
+    }
+    if (k.status !== "active") {
+      skipped.push({ name: k.name, key_id: k.id, lives_in: k.lives_in ?? null, reason: `key is ${k.status}` });
+      continue;
+    }
+    let r;
+    try {
+      r = await api(ctx, "POST", `/v1/keys/${encodeURIComponent(k.id)}/rotate`, { body: { grace } });
+    } catch (e) {
+      failed.push({ name: k.name, key_id: k.id, error: errorOf(e) });
+      continue;
+    }
+    if (!r.api_key) {
+      failed.push({ name: k.name, key_id: r.id, error: errorOf(null) });
+      continue;
+    }
+    const stops = { old_key_stops: `in ${grace}`, old_key_expires_at: r.rotated_from?.expires_at ?? "" };
+    try {
+      const pushed = await found.dest.put(found.target, r.api_key, io(ctx), "replace");
+      rotated.push({ name: r.name, key_id: r.id, pushed, ...stops });
+      const n = found.dest.next?.(found.target);
+      if (n)
+        next.add(n);
+    } catch (e) {
+      const err = errorOf(e);
+      failed.push({
+        name: r.name,
+        key_id: r.id,
+        ...stops,
+        error: {
+          ...err,
+          hint: `${err.hint ?? ""} The old key keeps working ${stops.old_key_stops}. Fix that, then run \`keys rotate ${r.id} --push --grace 0\`.`.trim()
+        }
+      });
+    }
+  }
+  return {
+    rotated,
+    skipped,
+    ...failed.length ? { failed } : {},
+    ...next.size ? { next: [...next] } : {}
+  };
+}
+function errorOf(e) {
+  if (e instanceof CliError)
+    return { code: e.code, message: e.message, hint: e.hint ?? null };
+  return { code: "internal_error", message: "Unexpected error.", hint: "Retry; if it persists, report it." };
+}
+var CONNECT_TOOLS = ["opencode", "aider", "continue", "cursor"];
+function machineName(raw = hostname2()) {
+  const n = raw.replace(/\.(local|lan|home)$/i, "").replace(/[^A-Za-z0-9.-]/g, "-").slice(0, 40);
+  return n || "this-machine";
+}
+async function liveChatModels(ctx) {
+  const { region } = resolveKey(ctx);
+  const res = await api(ctx, "GET", "/v1/models?modality=chat", {
+    auth: false,
+    region
+  }).catch(() => ({ data: [] }));
+  return (res.data ?? []).filter((m) => typeof m.id === "string" && m.live_in_region !== false && (m.modality ?? "chat") === "chat").map((m) => ({ id: m.id, context: typeof m.context === "number" ? m.context : null }));
+}
+function writePrivate2(path, text) {
+  mkdirSync3(dirname2(path), { recursive: true, mode: 448 });
+  writeFileSync4(path, text, { mode: 384 });
+  chmodSync4(path, 384);
+}
+function readJsonObject(path, what) {
+  if (!existsSync8(path))
+    return {};
+  try {
+    const v = JSON.parse(readFileSync10(path, "utf8"));
+    if (v && typeof v === "object" && !Array.isArray(v))
+      return v;
+  } catch {}
+  throw new CliError("config_unreadable", `${what} isn't plain JSON (comments or a syntax error). Nothing was changed.`, `Fix or move ${path}, then run connect again.`);
+}
+var PROVIDER_ID = "scaledthought";
+async function connect(ctx, tool, o = {}) {
+  if (!CONNECT_TOOLS.includes(tool))
+    throw new CliError("unknown_tool", `Unknown tool "${tool}".`, `Use one of: ${CONNECT_TOOLS.join(", ")}.`);
+  const { region } = resolveKey(ctx);
+  const baseUrl = inferenceUrl(region, ctx.env);
+  const models = await liveChatModels(ctx);
+  const model = o.model ?? models[0]?.id ?? "auto";
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(model))
+    throw new CliError("bad_argument", "--model isn't a model id.", "Pick one from `models --live`.");
+  const host = machineName();
+  const keyName = `${tool}: ${host}`;
+  const livesIn = `tool:${tool}:${host}`;
+  const t = tool;
+  if (t === "cursor" || t === "continue")
+    return instructions(t, baseUrl, model, models, keyName);
+  if (t === "aider") {
+    const existing = readDotEnv(ctx.cwd);
+    if (existing.OPENAI_API_KEY && !KEY_RE.test(existing.OPENAI_API_KEY))
+      throw new CliError("env_conflict", "./.env already has an OPENAI_API_KEY that isn't a ScaledThought key. Nothing was changed.", "Aider reads OPENAI_API_KEY from .env, so this would replace it. Run connect aider in another directory, or remove that line first.");
+    const k = await mintChild(ctx, { name: keyName, livesIn, budgetUsd: o.budgetUsd });
+    try {
+      writeEnv(ctx.cwd, { OPENAI_API_BASE: baseUrl, OPENAI_API_KEY: k.api_key, AIDER_MODEL: `openai/${model}` });
+      ensureGitignored(ctx.cwd);
+    } catch (e) {
+      return failAfterMint(ctx, k.id, e);
+    }
+    return {
+      tool,
+      key_name: k.name,
+      key_prefix: k.prefix,
+      lives_in: livesIn,
+      daily_budget_usd: k.daily_budget_usd,
+      configured: ".env (OPENAI_API_BASE, OPENAI_API_KEY, AIDER_MODEL), mode 0600, git-ignored",
+      model: `openai/${model}`,
+      models: ["auto", ...models.map((m) => m.id)],
+      next: "Run `aider` in this directory. Aider may warn that it doesn't know the model's context window; that's harmless."
+    };
+  }
+  const dataHome = ctx.env.XDG_DATA_HOME || join9(ctx.env.HOME || homedir(), ".local", "share");
+  const authPath = join9(dataHome, "opencode", "auth.json");
+  const configPath = join9(ctx.cwd, "opencode.json");
+  const config = readJsonObject(configPath, "opencode.json");
+  const auth = readJsonObject(authPath, authPath);
+  const providers = config.provider && typeof config.provider === "object" ? config.provider : {};
+  const modelEntries = { auto: { name: "auto (ScaledThought picks per request)" } };
+  for (const m of models)
+    modelEntries[m.id] = {
+      name: m.id,
+      ...m.context ? { limit: { context: m.context, output: Math.min(32768, Math.floor(m.context / 2)) } } : {}
+    };
+  if (!modelEntries[model])
+    modelEntries[model] = { name: model };
+  const k = await mintChild(ctx, { name: keyName, livesIn, budgetUsd: o.budgetUsd });
+  try {
+    const next = {
+      ...existsSync8(configPath) ? {} : { $schema: "https://opencode.ai/config.json" },
+      ...config,
+      provider: {
+        ...providers,
+        [PROVIDER_ID]: {
+          npm: "@ai-sdk/openai-compatible",
+          name: "ScaledThought",
+          options: { baseURL: baseUrl },
+          models: modelEntries
+        }
+      },
+      ...config.model ? {} : { model: `${PROVIDER_ID}/${model}` }
+    };
+    writePrivate2(configPath, `${JSON.stringify(next, null, 2)}
+`);
+    writePrivate2(authPath, `${JSON.stringify({ ...auth, [PROVIDER_ID]: { type: "api", key: k.api_key } }, null, 2)}
+`);
+  } catch (e) {
+    return failAfterMint(ctx, k.id, e);
+  }
+  return {
+    tool,
+    key_name: k.name,
+    key_prefix: k.prefix,
+    lives_in: livesIn,
+    daily_budget_usd: k.daily_budget_usd,
+    configured: `opencode.json (provider ${PROVIDER_ID}, base URL ${baseUrl}) + ${authPath} (key, mode 0600)`,
+    model: `${PROVIDER_ID}/${model}`,
+    models: Object.keys(modelEntries),
+    restart_needed: true,
+    next: `Restart OpenCode in this directory and pick a ${PROVIDER_ID}/… model (or ${PROVIDER_ID}/auto).`
+  };
+}
+function instructions(tool, baseUrl, model, models, name) {
+  const ids = ["auto", ...models.map((m) => m.id)];
+  if (tool === "cursor")
+    return {
+      tool,
+      configured: false,
+      key_minted: false,
+      why: "Cursor keeps its OpenAI key in its own settings store, which other programs can't write safely. A human sets it once.",
+      steps_for_human: [
+        `Cursor Settings → Models → API Keys: turn on "Override OpenAI Base URL" and enter ${baseUrl}`,
+        `In your own terminal (not through the agent) run: ${NPX} keys create --child --name "${name}" and paste the key it prints into "OpenAI API Key", then Verify.`,
+        `Add model names under Models: ${ids.join(", ")}`
+      ],
+      base_url: baseUrl,
+      models: ids,
+      restart_needed: false
+    };
+  const block = [
+    "models:",
+    `  - name: ScaledThought ${model}`,
+    "    provider: openai",
+    `    model: ${model}`,
+    `    apiBase: ${baseUrl}`,
+    `    apiKey: \${{ secrets.ST_API_KEY }}`,
+    "    defaultCompletionOptions:",
+    "      maxTokens: 32768",
+    "    roles: [chat, edit, apply]"
+  ].join(`
+`);
+  return {
+    tool,
+    configured: false,
+    key_minted: false,
+    why: "Continue's config.yaml is hand-edited YAML; this CLI won't rewrite it. The block below holds no secret: Continue reads ST_API_KEY from this workspace's .env.",
+    steps_for_human: [
+      "Open ~/.continue/config.yaml (Continue: Open configuration) and add this entry under models:",
+      "Reload Continue and pick the ScaledThought model."
+    ],
+    config_yaml: block,
+    base_url: baseUrl,
+    models: ids,
+    restart_needed: false
+  };
+}
+function putFlagsFrom(args) {
+  const out = {};
+  for (const f of PUT_FLAGS)
+    if (typeof args[f] === "string")
+      out[f] = args[f];
+  return out;
+}
+
 // src/realtime.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolve4 } from "node:path";
 var SAMPLE_RATE = 24000;
 var MAX_INPUT_SECONDS = 300;
@@ -10647,7 +11517,7 @@ async function realtime(ctx, o) {
     throw new CliError("unsupported_runtime", "This command needs a WebSocket client (Node.js 22 or newer).", "Upgrade Node.js to 22+.");
   let pcm;
   try {
-    pcm = readWav(readFileSync7(resolve4(ctx.cwd, o.input)));
+    pcm = readWav(readFileSync11(resolve4(ctx.cwd, o.input)));
   } catch (e) {
     if (e instanceof CliError)
       throw e;
@@ -10739,7 +11609,7 @@ async function realtime(ctx, o) {
   });
   const audio = Buffer.concat(out);
   const path = resolve4(ctx.cwd, o.output);
-  writeFileSync4(path, wavOf(audio));
+  writeFileSync5(path, wavOf(audio));
   return {
     model: o.model,
     region,
@@ -10770,7 +11640,7 @@ function out(data, args) {
   process.stdout.write(`${JSON.stringify(data, null, wantsJson(args) ? 0 : 2)}
 `);
 }
-var run = async (fn, args) => out(await fn(), args);
+var run2 = async (fn, args) => out(await fn(), args);
 function region(v) {
   if (v === undefined)
     return;
@@ -10818,7 +11688,7 @@ var init2 = defineCommand({
       description: "Save the account's key in this machine's credential store so other folders reuse it (--no-save to opt out)"
     }
   },
-  run: ({ args }) => run(() => init(makeCtx(), {
+  run: ({ args }) => run2(() => init(makeCtx(), {
     region: region(args.region),
     name: args.name,
     email: args.email,
@@ -10861,7 +11731,7 @@ var login2 = defineCommand({
     const t = args["timeout-s"] === undefined ? undefined : num("timeout-s", args["timeout-s"]);
     if (t !== undefined && t > 600)
       throw new CliError("bad_argument", `--timeout-s must be at most 600, got ${t}.`, "Run login --wait again.");
-    await run(async () => args.code ? loginWithCode(ctx, {
+    await run2(async () => args.code ? loginWithCode(ctx, {
       code: args.code === "-" ? await readCodeFrom(process.stdin) : args.code,
       region: region(args.region),
       label: args.label,
@@ -10885,7 +11755,7 @@ var use = defineCommand({
     ...jsonFlag,
     account: { type: "positional", required: true, description: "The account's name or id" }
   },
-  run: ({ args }) => run(() => useAccount(makeCtx(), { target: args.account }), args)
+  run: ({ args }) => run2(() => useAccount(makeCtx(), { target: args.account }), args)
 });
 var models = defineCommand({
   meta: { name: "models", description: "List models with prices and benchmarks, newest first; or show one" },
@@ -10905,7 +11775,7 @@ var models = defineCommand({
     },
     search: { type: "string", description: "Match id, name or lab" }
   },
-  run: ({ args }) => run(() => {
+  run: ({ args }) => run2(() => {
     const r = region(args.region);
     return args.id ? showModel(makeCtx(), args.id, r) : listModels(makeCtx(), {
       live: args.live,
@@ -10923,7 +11793,7 @@ var account2 = defineCommand({
   run: ({ args, rawArgs }) => {
     if (rawArgs.some((a) => ACCOUNT_SUBCOMMANDS.has(a)))
       return;
-    return run(() => account(makeCtx()), args);
+    return run2(() => account(makeCtx()), args);
   },
   subCommands: {
     delete: defineCommand({
@@ -10935,7 +11805,7 @@ var account2 = defineCommand({
         ...jsonFlag,
         confirm: { type: "string", required: true, description: "The account id (acct_...), to confirm" }
       },
-      run: ({ args }) => run(() => accountDelete(makeCtx(), { confirm: args.confirm }), args)
+      run: ({ args }) => run2(() => accountDelete(makeCtx(), { confirm: args.confirm }), args)
     }),
     "ad-measurement": defineCommand({
       meta: {
@@ -10946,7 +11816,7 @@ var account2 = defineCommand({
         ...jsonFlag,
         state: { type: "positional", required: true, description: "off or on" }
       },
-      run: ({ args }) => run(() => accountAdMeasurement(makeCtx(), args.state), args)
+      run: ({ args }) => run2(() => accountAdMeasurement(makeCtx(), args.state), args)
     })
   }
 });
@@ -10956,7 +11826,7 @@ var keys = defineCommand({
     list: defineCommand({
       meta: { name: "list", description: "Keys on this account (prefixes only)" },
       args: jsonFlag,
-      run: ({ args }) => run(() => keysList(makeCtx()), args)
+      run: ({ args }) => run2(() => keysList(makeCtx()), args)
     }),
     create: defineCommand({
       meta: { name: "create", description: "Create a key; the full key is printed once" },
@@ -10974,7 +11844,7 @@ var keys = defineCommand({
           description: "Sub-agent key: budget, scopes and expiry within your key's; revoked when your key is"
         }
       },
-      run: ({ args }) => run(() => keysCreate(makeCtx(), {
+      run: ({ args }) => run2(() => keysCreate(makeCtx(), {
         name: args.name,
         budgetUsd: num("budget-usd", args["budget-usd"]),
         expiresIn: args["expires-in"],
@@ -10982,23 +11852,89 @@ var keys = defineCommand({
         child: args.child
       }), args)
     }),
+    put: defineCommand({
+      meta: {
+        name: "put",
+        description: "Put a new child key straight into a platform's secret store as ST_API_KEY, through its own CLI on stdin (never printed). Records where it lives"
+      },
+      args: {
+        ...jsonFlag,
+        destination: {
+          type: "positional",
+          required: true,
+          description: `Where: ${Object.keys(DESTINATIONS).join(", ")}`
+        },
+        name: { type: "string", description: "Key name (default: named after the destination)" },
+        "budget-usd": { type: "string", description: "Hard daily budget in USD (default: none beyond your key's)" },
+        "expires-in": { type: "string", description: "Key lifetime, e.g. 30d (max 365d)" },
+        scopes: {
+          type: "string",
+          description: "Comma-separated scopes, a subset of your key's. Default inference,read"
+        },
+        repo: { type: "string", description: "github: owner/name (default: this directory's repo)" },
+        app: { type: "string", description: "github: actions|codespaces|dependabot (default actions); fly: app name" },
+        env: {
+          type: "string",
+          description: "github: deployment environment; vercel: production|preview|development (default production); cloudflare: Wrangler env"
+        },
+        project: { type: "string", description: "vercel (must match the linked project), gcp, doppler: project" },
+        worker: { type: "string", description: "cloudflare: Worker name (default: wrangler.toml's name)" },
+        secret: {
+          type: "string",
+          description: "gcp (default st-api-key), aws (default scaledthought/api-key), k8s (default scaledthought): secret name"
+        },
+        "aws-region": { type: "string", description: "aws: region (default: AWS_REGION or the CLI's)" },
+        locations: {
+          type: "string",
+          description: "gcp: user-managed replication locations, e.g. northamerica-northeast1"
+        },
+        namespace: { type: "string", description: "k8s: namespace (default: the context's)" },
+        context: { type: "string", description: "k8s: kubectl context (default: current)" },
+        config: { type: "string", description: "doppler: config, e.g. prd (default: this directory's)" }
+      },
+      run: ({ args }) => run2(() => keysPut(makeCtx(), args.destination, {
+        name: args.name,
+        budgetUsd: num("budget-usd", args["budget-usd"]),
+        expiresIn: args["expires-in"],
+        scopes: args.scopes?.split(",").map((x) => x.trim()).filter(Boolean),
+        flags: putFlagsFrom(args)
+      }), args)
+    }),
     rotate: defineCommand({
       meta: {
         name: "rotate",
-        description: "Replace a key: prints the new key once; the old key keeps working for --grace (default 24h, 0 to 7d)"
+        description: "Replace a key: prints the new key once; the old key keeps working for --grace (default 24h, 0 to 7d). With --push, puts the new key where the old one lives instead of printing it"
       },
       args: {
         ...jsonFlag,
-        id: { type: "positional", required: true, description: "Key id (key_…)" },
+        id: { type: "positional", required: false, description: "Key id (key_…); or --all with --push" },
         grace: { type: "string", description: "How long the old key keeps working: 0 to 7d (default 24h)" },
-        "expires-in": { type: "string", description: "New key's lifetime (default: the old key's)" }
+        "expires-in": { type: "string", description: "New key's lifetime (default: the old key's)" },
+        push: {
+          type: "boolean",
+          description: "Put each new key where the old one lives (its lives_in, from keys put); prints no keys"
+        },
+        all: { type: "boolean", description: "With --push: every active key that has a lives_in keys put can reach" }
       },
-      run: ({ args }) => run(() => keysRotate(makeCtx(), args.id, { grace: args.grace, expiresIn: args["expires-in"] }), args)
+      run: ({ args }) => run2(() => {
+        if (args.all && !args.push)
+          throw new CliError("usage_error", "--all needs --push (rotating every key never prints them).");
+        if (args.all && args.id)
+          throw new CliError("usage_error", "Pass a key id or --all, not both.");
+        if (!args.all && !args.id)
+          throw new CliError("usage_error", "Pass a key id (or --all --push).");
+        if (args.push) {
+          if (args["expires-in"])
+            throw new CliError("usage_error", "--expires-in can't be combined with --push.");
+          return keysRotatePush(makeCtx(), { id: args.id, all: args.all, grace: args.grace });
+        }
+        return keysRotate(makeCtx(), args.id, { grace: args.grace, expiresIn: args["expires-in"] });
+      }, args)
     }),
     revoke: defineCommand({
       meta: { name: "revoke", description: "Revoke a key by id (and its sub-agent keys)" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Key id (key_…)" } },
-      run: ({ args }) => run(() => keysRevoke(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => keysRevoke(makeCtx(), args.id), args)
     }),
     "revoke-self": defineCommand({
       meta: {
@@ -11006,7 +11942,7 @@ var keys = defineCommand({
         description: "Revoke the key you are using now (e.g. if it may have leaked). Irreversible"
       },
       args: jsonFlag,
-      run: ({ args }) => run(() => keysRevokeSelf(makeCtx()), args)
+      run: ({ args }) => run2(() => keysRevokeSelf(makeCtx()), args)
     })
   }
 });
@@ -11017,7 +11953,7 @@ var usage3 = defineCommand({
     days: { type: "string", default: "7", description: "Look-back window, 1-90" },
     by: { type: "string", default: "model", description: "model|day|key|modality" }
   },
-  run: ({ args }) => run(() => usage(makeCtx(), { days: num("days", args.days) ?? 7, by: args.by }), args)
+  run: ({ args }) => run2(() => usage(makeCtx(), { days: num("days", args.days) ?? 7, by: args.by }), args)
 });
 var chat2 = defineCommand({
   meta: { name: "chat", description: "Send one message. Use -m auto to let the router pick" },
@@ -11028,7 +11964,7 @@ var chat2 = defineCommand({
   },
   run: async ({ args }) => {
     const human = !wantsJson(args);
-    await run(async () => {
+    await run2(async () => {
       const r = await chat(makeCtx(), {
         model: args.model,
         prompt: args.prompt,
@@ -11091,7 +12027,7 @@ var speak2 = defineCommand({
     speed: { type: "string", description: "0.25 to 4 (default 1)" },
     instructions: { type: "string", description: "Delivery instructions for models that take them, optional" }
   },
-  run: ({ args }) => run(() => speak(makeCtx(), {
+  run: ({ args }) => run2(() => speak(makeCtx(), {
     text: args.text,
     output: args.output,
     model: args.model,
@@ -11114,7 +12050,7 @@ var decideCmd = defineCommand({
     question: { type: "string", alias: "q", description: "id:type:instructions[:criteria], repeatable" },
     file: { type: "string", description: "A JSON request: {state, questions, model?}" }
   },
-  run: ({ args }) => run(() => {
+  run: ({ args }) => run2(() => {
     const ctx = makeCtx();
     const raw = currentArgv;
     const questions = [];
@@ -11147,7 +12083,7 @@ var realtime2 = defineCommand({
     instructions: { type: "string", description: "System instructions for the session (optional)" },
     timeout: { type: "string", description: "Seconds to wait for the reply (default 120)" }
   },
-  run: ({ args }) => run(async () => {
+  run: ({ args }) => run2(async () => {
     const t = num("timeout", args.timeout);
     return realtime(makeCtx(), {
       model: args.model,
@@ -11165,7 +12101,7 @@ function autoReloadArgs(args) {
   if (below === undefined && amount === undefined && max === undefined)
     return;
   if (below === undefined || amount === undefined)
-    throw new CliError("bad_argument", "Auto-reload needs both --auto-reload-below and --auto-reload-amount.", "e.g. --auto-reload-below 5 --auto-reload-amount 10");
+    throw new CliError("bad_argument", "Auto-reload needs both --auto-reload-below and --auto-reload-amount.", "e.g. --auto-reload-below 5 --auto-reload-amount 20");
   return { threshold_usd: below, amount_usd: amount, ...max !== undefined ? { monthly_limit_usd: max } : {} };
 }
 var billing = defineCommand({
@@ -11177,7 +12113,7 @@ var billing = defineCommand({
         description: "Credit balance, auto-reload, pending top-ups (with their approval links), recent transactions"
       },
       args: jsonFlag,
-      run: ({ args }) => run(() => billingStatus(makeCtx()), args)
+      run: ({ args }) => run2(() => billingStatus(makeCtx()), args)
     }),
     topup: defineCommand({
       meta: {
@@ -11214,7 +12150,7 @@ var billing = defineCommand({
         const autoReload = autoReloadArgs(args);
         checkTopupLimits(amountUsd, autoReload);
         const noOpen = args.open === false;
-        await run(() => args.wait ? billingTopupAndWait(makeCtx(), { amountUsd, autoReload, noOpen, onPending: (t) => out(t, args) }) : billingTopup(makeCtx(), { amountUsd, autoReload, noOpen }), args);
+        await run2(() => args.wait ? billingTopupAndWait(makeCtx(), { amountUsd, autoReload, noOpen, onPending: (t) => out(t, args) }) : billingTopup(makeCtx(), { amountUsd, autoReload, noOpen }), args);
       }
     }),
     wait: defineCommand({
@@ -11234,7 +12170,7 @@ var billing = defineCommand({
         const t = args["timeout-s"] === undefined ? undefined : num("timeout-s", args["timeout-s"]);
         if (t !== undefined && t > 600)
           throw new CliError("bad_argument", `--timeout-s must be at most 600, got ${t}.`, "Run wait again instead.");
-        await run(() => billingWait(makeCtx(), { topupId: args.topup_id || undefined, timeoutS: t }), args);
+        await run2(() => billingWait(makeCtx(), { topupId: args.topup_id || undefined, timeoutS: t }), args);
       }
     }),
     "auto-reload": defineCommand({
@@ -11261,7 +12197,7 @@ var billing = defineCommand({
               description: "Open the page in the browser (--no-open only prints approval_url)"
             }
           },
-          run: ({ args }) => run(() => billingAutoReloadSetup(makeCtx(), {
+          run: ({ args }) => run2(() => billingAutoReloadSetup(makeCtx(), {
             thresholdUsd: num("below", args.below),
             amountUsd: num("amount", args.amount),
             noOpen: args.open === false
@@ -11270,14 +12206,14 @@ var billing = defineCommand({
         off: defineCommand({
           meta: { name: "off", description: "Disable auto-reload. No approval needed" },
           args: jsonFlag,
-          run: ({ args }) => run(() => billingAutoReloadOff(makeCtx()), args)
+          run: ({ args }) => run2(() => billingAutoReloadOff(makeCtx()), args)
         })
       }
     }),
     transactions: defineCommand({
       meta: { name: "transactions", description: "Credit ledger: purchases, auto-reloads, usage, batches, refunds" },
       args: { ...jsonFlag, cursor: { type: "string", description: "next_cursor from the previous page" } },
-      run: ({ args }) => run(() => billingTransactions(makeCtx(), { cursor: args.cursor }), args)
+      run: ({ args }) => run2(() => billingTransactions(makeCtx(), { cursor: args.cursor }), args)
     }),
     upgrade: defineCommand({
       meta: { name: "upgrade", description: "Removed: monthly caps became prepaid credits. Use billing topup" },
@@ -11296,34 +12232,34 @@ var batches = defineCommand({
         file: { type: "positional", required: true, description: "Path to requests.jsonl" },
         endpoint: { type: "string", default: "/v1/chat/completions", description: "Endpoint every line calls" }
       },
-      run: ({ args }) => run(() => batchCreate(makeCtx(), { path: args.file, endpoint: args.endpoint }), args)
+      run: ({ args }) => run2(() => batchCreate(makeCtx(), { path: args.file, endpoint: args.endpoint }), args)
     }),
     list: defineCommand({
       meta: { name: "list", description: "Your batches" },
       args: jsonFlag,
-      run: ({ args }) => run(() => batchList(makeCtx()), args)
+      run: ({ args }) => run2(() => batchList(makeCtx()), args)
     }),
     get: defineCommand({
       meta: { name: "get", description: "One batch" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Batch id" } },
-      run: ({ args }) => run(() => batchGet(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => batchGet(makeCtx(), args.id), args)
     }),
     results: defineCommand({
       meta: { name: "results", description: "Print the output lines of a finished batch" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Batch id" } },
-      run: ({ args }) => run(() => batchResults(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => batchResults(makeCtx(), args.id), args)
     }),
     cancel: defineCommand({
       meta: { name: "cancel", description: "Cancel a batch" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Batch id" } },
-      run: ({ args }) => run(() => batchCancel(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => batchCancel(makeCtx(), args.id), args)
     })
   }
 });
 var benchmarks2 = defineCommand({
   meta: { name: "benchmarks", description: "Our own benchmark results for a model" },
   args: { ...jsonFlag, ...regionFlag, id: { type: "positional", required: true, description: "Model id" } },
-  run: ({ args }) => run(() => benchmarks(makeCtx(), args.id, region(args.region)), args)
+  run: ({ args }) => run2(() => benchmarks(makeCtx(), args.id, region(args.region)), args)
 });
 var fineTune = defineCommand({
   meta: {
@@ -11340,7 +12276,7 @@ var fineTune = defineCommand({
         suffix: { type: "string", description: "Suffix for the fine-tuned model id" },
         epochs: { type: "string", description: "1-10, default 3" }
       },
-      run: ({ args }) => run(() => fineTuneCreate(makeCtx(), {
+      run: ({ args }) => run2(() => fineTuneCreate(makeCtx(), {
         path: args.file,
         model: args.model,
         suffix: args.suffix,
@@ -11350,27 +12286,27 @@ var fineTune = defineCommand({
     list: defineCommand({
       meta: { name: "list", description: "Your jobs" },
       args: jsonFlag,
-      run: ({ args }) => run(() => fineTuneList(makeCtx()), args)
+      run: ({ args }) => run2(() => fineTuneList(makeCtx()), args)
     }),
     get: defineCommand({
       meta: { name: "get", description: "One job" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Job id" } },
-      run: ({ args }) => run(() => fineTuneGet(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => fineTuneGet(makeCtx(), args.id), args)
     }),
     events: defineCommand({
       meta: { name: "events", description: "A job's progress events" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Job id" } },
-      run: ({ args }) => run(() => fineTuneEvents(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => fineTuneEvents(makeCtx(), args.id), args)
     }),
     cancel: defineCommand({
       meta: { name: "cancel", description: "Cancel a job" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Job id" } },
-      run: ({ args }) => run(() => fineTuneCancel(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => fineTuneCancel(makeCtx(), args.id), args)
     }),
     models: defineCommand({
       meta: { name: "models", description: "Your fine-tuned models" },
       args: jsonFlag,
-      run: ({ args }) => run(() => fineTuneModels(makeCtx()), args)
+      run: ({ args }) => run2(() => fineTuneModels(makeCtx()), args)
     })
   }
 });
@@ -11396,7 +12332,7 @@ var video = defineCommand({
         wait: { type: "boolean", description: "Wait until the video is ready" },
         output: { type: "string", alias: "o", description: "Save the MP4 here (waits for it)" }
       },
-      run: ({ args }) => run(() => videoCreate(makeCtx(), {
+      run: ({ args }) => run2(() => videoCreate(makeCtx(), {
         prompt: args.prompt,
         model: args.model,
         seconds: num("seconds", args.seconds),
@@ -11410,7 +12346,7 @@ var video = defineCommand({
     get: defineCommand({
       meta: { name: "get", description: "One video job: status, progress, cost" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Video id" } },
-      run: ({ args }) => run(() => videoGet(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => videoGet(makeCtx(), args.id), args)
     }),
     list: defineCommand({
       meta: { name: "list", description: "Your video jobs, newest first" },
@@ -11419,7 +12355,7 @@ var video = defineCommand({
         limit: { type: "string", description: "Page size, 1-100 (default 20)" },
         after: { type: "string", description: "Continue after this video id" }
       },
-      run: ({ args }) => run(() => videoList(makeCtx(), { limit: num("limit", args.limit), after: args.after }), args)
+      run: ({ args }) => run2(() => videoList(makeCtx(), { limit: num("limit", args.limit), after: args.after }), args)
     }),
     download: defineCommand({
       meta: { name: "download", description: "Save a finished video (or --thumbnail) to a file" },
@@ -11429,12 +12365,12 @@ var video = defineCommand({
         output: { type: "string", alias: "o", required: true, description: "File to write" },
         thumbnail: { type: "boolean", description: "Download the JPEG thumbnail instead" }
       },
-      run: ({ args }) => run(() => videoDownload(makeCtx(), args.id, args.output, args.thumbnail ? "thumbnail" : "video"), args)
+      run: ({ args }) => run2(() => videoDownload(makeCtx(), args.id, args.output, args.thumbnail ? "thumbnail" : "video"), args)
     }),
     delete: defineCommand({
       meta: { name: "delete", description: "Cancel (credits returned) or delete a video and its files" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Video id" } },
-      run: ({ args }) => run(() => videoDelete(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => videoDelete(makeCtx(), args.id), args)
     })
   }
 });
@@ -11444,7 +12380,7 @@ var status2 = defineCommand({
     description: "Per-model health in the region (last hour), plus your account's notices when a key is set"
   },
   args: { ...jsonFlag, ...regionFlag },
-  run: ({ args }) => run(() => status(makeCtx(), region(args.region)), args)
+  run: ({ args }) => run2(() => status(makeCtx(), region(args.region)), args)
 });
 var doctor2 = defineCommand({
   meta: {
@@ -11452,7 +12388,7 @@ var doctor2 = defineCommand({
     description: "Check this project's setup: key and region, account, credit, and notices to tell your human"
   },
   args: jsonFlag,
-  run: ({ args }) => run(() => doctor(makeCtx()), args)
+  run: ({ args }) => run2(() => doctor(makeCtx()), args)
 });
 var webhooks = defineCommand({
   meta: {
@@ -11470,27 +12406,43 @@ var webhooks = defineCommand({
           description: "Comma-separated events (default: all four)"
         }
       },
-      run: ({ args }) => run(() => webhooksAdd(makeCtx(), { url: args.url, events: args.events }), args)
+      run: ({ args }) => run2(() => webhooksAdd(makeCtx(), { url: args.url, events: args.events }), args)
     }),
     list: defineCommand({
       meta: { name: "list", description: "This account's webhook endpoints" },
       args: jsonFlag,
-      run: ({ args }) => run(() => webhooksList(makeCtx()), args)
+      run: ({ args }) => run2(() => webhooksList(makeCtx()), args)
     }),
     remove: defineCommand({
       meta: { name: "remove", description: "Delete an endpoint by id (whk_…)" },
       args: { ...jsonFlag, id: { type: "positional", required: true, description: "Webhook id" } },
-      run: ({ args }) => run(() => webhooksRemove(makeCtx(), args.id), args)
+      run: ({ args }) => run2(() => webhooksRemove(makeCtx(), args.id), args)
     })
   }
 });
+var connectTool = defineCommand({
+  meta: {
+    name: "connect",
+    description: "Point an OpenAI-compatible tool at ScaledThought: writes its config with the base URL and a new child key (never printed), or prints the steps when the tool's key store can't be written safely"
+  },
+  args: {
+    ...jsonFlag,
+    tool: { type: "positional", required: true, description: CONNECT_TOOLS.join(", ") },
+    model: { type: "string", description: "Default model (default: the newest live chat model)" },
+    "budget-usd": { type: "string", description: "Hard daily budget for the tool's key, in USD" }
+  },
+  run: ({ args }) => run2(() => connect(makeCtx(), args.tool, {
+    model: args.model,
+    budgetUsd: num("budget-usd", args["budget-usd"])
+  }), args)
+});
 var mcp = defineCommand({
   meta: {
     name: "mcp",
     description: "Print the `claude mcp add` command and JSON config for this account's MCP server"
   },
   args: jsonFlag,
-  run: ({ args }) => run(() => mcpSetup(makeCtx()), args)
+  run: ({ args }) => run2(() => mcpSetup(makeCtx()), args)
 });
 var dashboard = defineCommand({
   meta: {
@@ -11506,7 +12458,7 @@ var dashboard = defineCommand({
     },
     open: { type: "boolean", default: true, description: "Open it in the browser (--no-open only prints the URL)" }
   },
-  run: ({ args }) => run(() => dashboardOpen(makeCtx(), {
+  run: ({ args }) => run2(() => dashboardOpen(makeCtx(), {
     page: args.page,
     email: args.email,
     noOpen: args.open === false
@@ -11515,7 +12467,7 @@ var dashboard = defineCommand({
 var members2 = defineCommand({
   meta: { name: "members", description: "Who can sign in to this account's dashboard (email, role, status)" },
   args: jsonFlag,
-  run: ({ args }) => run(() => membersList(makeCtx()), args)
+  run: ({ args }) => run2(() => membersList(makeCtx()), args)
 });
 var root = defineCommand({
   meta: {
@@ -11544,6 +12496,7 @@ var root = defineCommand({
     video,
     webhooks,
     doctor: doctor2,
+    connect: connectTool,
     mcp,
     dashboard,
     members: members2