tutticode 0.1.1 → 0.2.0

package/dist/tutticode.cjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/* tutticode v0.1.1 | https://tuttidaw.com */
+/* tutticode v0.2.0 | https://tuttidaw.com */
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -2310,7 +2310,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash2 } = require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash3 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2865,8 +2865,8 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes2(16).toString("base64");
-      const request = isSecure ? https.request : http.request;
+      const key = randomBytes4(16).toString("base64");
+      const request2 = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
       opts.createConnection = opts.createConnection || (isSecure ? tlsConnect : netConnect);
@@ -2944,12 +2944,12 @@ var require_websocket = __commonJS({
         if (opts.auth && !options.headers.authorization) {
           options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");
         }
-        req = websocket._req = request(opts);
+        req = websocket._req = request2(opts);
         if (websocket._redirects) {
           websocket.emit("redirect", websocket.url, req);
         }
       } else {
-        req = websocket._req = request(opts);
+        req = websocket._req = request2(opts);
       }
       if (opts.timeout) {
         req.on("timeout", () => {
@@ -2998,7 +2998,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3387,7 +3387,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter4 = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash2 } = require("crypto");
+    var { createHash: createHash3 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3702,7 +3702,7 @@ var require_websocket_server = __commonJS({
         }
         if (this._state > RUNNING)
           return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3791,12 +3791,703 @@ var require_websocket_server = __commonJS({
 });
 
 // src/bin.ts
-var import_node_path9 = require("node:path");
+var import_node_path12 = require("node:path");
 
 // src/cli.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs11 = require("node:fs");
 var import_node_readline2 = require("node:readline");
 
+// ../../node_modules/.pnpm/uqr@0.1.3/node_modules/uqr/dist/index.mjs
+var QrCodeDataType = /* @__PURE__ */ ((QrCodeDataType2) => {
+  QrCodeDataType2[QrCodeDataType2["Border"] = -1] = "Border";
+  QrCodeDataType2[QrCodeDataType2["Data"] = 0] = "Data";
+  QrCodeDataType2[QrCodeDataType2["Function"] = 1] = "Function";
+  QrCodeDataType2[QrCodeDataType2["Position"] = 2] = "Position";
+  QrCodeDataType2[QrCodeDataType2["Timing"] = 3] = "Timing";
+  QrCodeDataType2[QrCodeDataType2["Alignment"] = 4] = "Alignment";
+  return QrCodeDataType2;
+})(QrCodeDataType || {});
+var LOW = [0, 1];
+var MEDIUM = [1, 0];
+var QUARTILE = [2, 3];
+var HIGH = [3, 2];
+var EccMap = {
+  L: LOW,
+  M: MEDIUM,
+  Q: QUARTILE,
+  H: HIGH
+};
+var NUMERIC_REGEX = /^\d*$/;
+var ALPHANUMERIC_REGEX = /^[A-Z0-9 $%*+./:-]*$/;
+var ALPHANUMERIC_CHARSET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-./:";
+var MIN_VERSION = 1;
+var MAX_VERSION = 40;
+var PENALTY_N1 = 3;
+var PENALTY_N2 = 3;
+var PENALTY_N3 = 40;
+var PENALTY_N4 = 10;
+var ECC_CODEWORDS_PER_BLOCK = [
+  // Version: (note that index 0 is for padding, and is set to an illegal value)
+  // 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40    Error correction level
+  [-1, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28, 28, 28, 30, 30, 26, 28, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+  // Low
+  [-1, 10, 16, 26, 18, 24, 16, 18, 22, 22, 26, 30, 22, 22, 24, 24, 28, 28, 26, 26, 26, 26, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28],
+  // Medium
+  [-1, 13, 22, 18, 26, 18, 24, 18, 22, 20, 24, 28, 26, 24, 20, 30, 24, 28, 28, 26, 30, 28, 30, 30, 30, 30, 28, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+  // Quartile
+  [-1, 17, 28, 22, 16, 22, 28, 26, 26, 24, 28, 24, 28, 22, 24, 24, 30, 28, 28, 26, 28, 30, 24, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30]
+  // High
+];
+var NUM_ERROR_CORRECTION_BLOCKS = [
+  // Version: (note that index 0 is for padding, and is set to an illegal value)
+  // 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40    Error correction level
+  [-1, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8, 8, 9, 9, 10, 12, 12, 12, 13, 14, 15, 16, 17, 18, 19, 19, 20, 21, 22, 24, 25],
+  // Low
+  [-1, 1, 1, 1, 2, 2, 4, 4, 4, 5, 5, 5, 8, 9, 9, 10, 10, 11, 13, 14, 16, 17, 17, 18, 20, 21, 23, 25, 26, 28, 29, 31, 33, 35, 37, 38, 40, 43, 45, 47, 49],
+  // Medium
+  [-1, 1, 1, 2, 2, 4, 4, 6, 6, 8, 8, 8, 10, 12, 16, 12, 17, 16, 18, 21, 20, 23, 23, 25, 27, 29, 34, 34, 35, 38, 40, 43, 45, 48, 51, 53, 56, 59, 62, 65, 68],
+  // Quartile
+  [-1, 1, 1, 2, 4, 4, 4, 5, 6, 8, 8, 11, 11, 16, 16, 18, 16, 19, 21, 25, 25, 25, 34, 30, 32, 35, 37, 40, 42, 45, 48, 51, 54, 57, 60, 63, 66, 70, 74, 77, 81]
+  // High
+];
+var QrCode = class {
+  /* -- Constructor (low level) and fields -- */
+  // Creates a new QR Code with the given version number,
+  // error correction level, data codeword bytes, and mask number.
+  // This is a low-level API that most users should not use directly.
+  // A mid-level API is the encodeSegments() function.
+  constructor(version, ecc, dataCodewords, msk) {
+    this.version = version;
+    this.ecc = ecc;
+    if (version < MIN_VERSION || version > MAX_VERSION)
+      throw new RangeError("Version value out of range");
+    if (msk < -1 || msk > 7)
+      throw new RangeError("Mask value out of range");
+    this.size = version * 4 + 17;
+    const row = Array.from({ length: this.size }).fill(false);
+    for (let i = 0; i < this.size; i++) {
+      this.modules.push(row.slice());
+      this.types.push(row.map(() => 0));
+    }
+    this.drawFunctionPatterns();
+    const allCodewords = this.addEccAndInterleave(dataCodewords);
+    this.drawCodewords(allCodewords);
+    if (msk === -1) {
+      let minPenalty = 1e9;
+      for (let i = 0; i < 8; i++) {
+        this.applyMask(i);
+        this.drawFormatBits(i);
+        const penalty = this.getPenaltyScore();
+        if (penalty < minPenalty) {
+          msk = i;
+          minPenalty = penalty;
+        }
+        this.applyMask(i);
+      }
+    }
+    this.mask = msk;
+    this.applyMask(msk);
+    this.drawFormatBits(msk);
+  }
+  /* -- Fields -- */
+  // The width and height of this QR Code, measured in modules, between
+  // 21 and 177 (inclusive). This is equal to version * 4 + 17.
+  size;
+  // The index of the mask pattern used in this QR Code, which is between 0 and 7 (inclusive).
+  // Even if a QR Code is created with automatic masking requested (mask = -1),
+  // the resulting object still has a mask value between 0 and 7.
+  mask;
+  // The modules of this QR Code (false = light, true = dark).
+  // Immutable after constructor finishes. Accessed through getModule().
+  modules = [];
+  types = [];
+  /* -- Accessor methods -- */
+  // Returns the color of the module (pixel) at the given coordinates, which is false
+  // for light or true for dark. The top left corner has the coordinates (x=0, y=0).
+  // If the given coordinates are out of bounds, then false (light) is returned.
+  getModule(x, y) {
+    return x >= 0 && x < this.size && y >= 0 && y < this.size && this.modules[y][x];
+  }
+  /* -- Private helper methods for constructor: Drawing function modules -- */
+  // Reads this object's version field, and draws and marks all function modules.
+  drawFunctionPatterns() {
+    for (let i = 0; i < this.size; i++) {
+      this.setFunctionModule(6, i, i % 2 === 0, QrCodeDataType.Timing);
+      this.setFunctionModule(i, 6, i % 2 === 0, QrCodeDataType.Timing);
+    }
+    this.drawFinderPattern(3, 3);
+    this.drawFinderPattern(this.size - 4, 3);
+    this.drawFinderPattern(3, this.size - 4);
+    const alignPatPos = this.getAlignmentPatternPositions();
+    const numAlign = alignPatPos.length;
+    for (let i = 0; i < numAlign; i++) {
+      for (let j = 0; j < numAlign; j++) {
+        if (!(i === 0 && j === 0 || i === 0 && j === numAlign - 1 || i === numAlign - 1 && j === 0))
+          this.drawAlignmentPattern(alignPatPos[i], alignPatPos[j]);
+      }
+    }
+    this.drawFormatBits(0);
+    this.drawVersion();
+  }
+  // Draws two copies of the format bits (with its own error correction code)
+  // based on the given mask and this object's error correction level field.
+  drawFormatBits(mask) {
+    const data = this.ecc[1] << 3 | mask;
+    let rem = data;
+    for (let i = 0; i < 10; i++)
+      rem = rem << 1 ^ (rem >>> 9) * 1335;
+    const bits = (data << 10 | rem) ^ 21522;
+    for (let i = 0; i <= 5; i++)
+      this.setFunctionModule(8, i, getBit(bits, i));
+    this.setFunctionModule(8, 7, getBit(bits, 6));
+    this.setFunctionModule(8, 8, getBit(bits, 7));
+    this.setFunctionModule(7, 8, getBit(bits, 8));
+    for (let i = 9; i < 15; i++)
+      this.setFunctionModule(14 - i, 8, getBit(bits, i));
+    for (let i = 0; i < 8; i++)
+      this.setFunctionModule(this.size - 1 - i, 8, getBit(bits, i));
+    for (let i = 8; i < 15; i++)
+      this.setFunctionModule(8, this.size - 15 + i, getBit(bits, i));
+    this.setFunctionModule(8, this.size - 8, true);
+  }
+  // Draws two copies of the version bits (with its own error correction code),
+  // based on this object's version field, iff 7 <= version <= 40.
+  drawVersion() {
+    if (this.version < 7)
+      return;
+    let rem = this.version;
+    for (let i = 0; i < 12; i++)
+      rem = rem << 1 ^ (rem >>> 11) * 7973;
+    const bits = this.version << 12 | rem;
+    for (let i = 0; i < 18; i++) {
+      const color = getBit(bits, i);
+      const a = this.size - 11 + i % 3;
+      const b = Math.floor(i / 3);
+      this.setFunctionModule(a, b, color);
+      this.setFunctionModule(b, a, color);
+    }
+  }
+  // Draws a 9*9 finder pattern including the border separator,
+  // with the center module at (x, y). Modules can be out of bounds.
+  drawFinderPattern(x, y) {
+    for (let dy = -4; dy <= 4; dy++) {
+      for (let dx = -4; dx <= 4; dx++) {
+        const dist = Math.max(Math.abs(dx), Math.abs(dy));
+        const xx = x + dx;
+        const yy = y + dy;
+        if (xx >= 0 && xx < this.size && yy >= 0 && yy < this.size)
+          this.setFunctionModule(xx, yy, dist !== 2 && dist !== 4, QrCodeDataType.Position);
+      }
+    }
+  }
+  // Draws a 5*5 alignment pattern, with the center module
+  // at (x, y). All modules must be in bounds.
+  drawAlignmentPattern(x, y) {
+    for (let dy = -2; dy <= 2; dy++) {
+      for (let dx = -2; dx <= 2; dx++) {
+        this.setFunctionModule(
+          x + dx,
+          y + dy,
+          Math.max(Math.abs(dx), Math.abs(dy)) !== 1,
+          QrCodeDataType.Alignment
+        );
+      }
+    }
+  }
+  // Sets the color of a module and marks it as a function module.
+  // Only used by the constructor. Coordinates must be in bounds.
+  setFunctionModule(x, y, isDark, type = QrCodeDataType.Function) {
+    this.modules[y][x] = isDark;
+    this.types[y][x] = type;
+  }
+  /* -- Private helper methods for constructor: Codewords and masking -- */
+  // Returns a new byte string representing the given data with the appropriate error correction
+  // codewords appended to it, based on this object's version and error correction level.
+  addEccAndInterleave(data) {
+    const ver = this.version;
+    const ecl = this.ecc;
+    if (data.length !== getNumDataCodewords(ver, ecl))
+      throw new RangeError("Invalid argument");
+    const numBlocks = NUM_ERROR_CORRECTION_BLOCKS[ecl[0]][ver];
+    const blockEccLen = ECC_CODEWORDS_PER_BLOCK[ecl[0]][ver];
+    const rawCodewords = Math.floor(getNumRawDataModules(ver) / 8);
+    const numShortBlocks = numBlocks - rawCodewords % numBlocks;
+    const shortBlockLen = Math.floor(rawCodewords / numBlocks);
+    const blocks = [];
+    const rsDiv = reedSolomonComputeDivisor(blockEccLen);
+    for (let i = 0, k = 0; i < numBlocks; i++) {
+      const dat = data.slice(k, k + shortBlockLen - blockEccLen + (i < numShortBlocks ? 0 : 1));
+      k += dat.length;
+      const ecc = reedSolomonComputeRemainder(dat, rsDiv);
+      if (i < numShortBlocks)
+        dat.push(0);
+      blocks.push(dat.concat(ecc));
+    }
+    const result = [];
+    for (let i = 0; i < blocks[0].length; i++) {
+      blocks.forEach((block, j) => {
+        if (i !== shortBlockLen - blockEccLen || j >= numShortBlocks)
+          result.push(block[i]);
+      });
+    }
+    return result;
+  }
+  // Draws the given sequence of 8-bit codewords (data and error correction) onto the entire
+  // data area of this QR Code. Function modules need to be marked off before this is called.
+  drawCodewords(data) {
+    if (data.length !== Math.floor(getNumRawDataModules(this.version) / 8))
+      throw new RangeError("Invalid argument");
+    let i = 0;
+    for (let right = this.size - 1; right >= 1; right -= 2) {
+      if (right === 6)
+        right = 5;
+      for (let vert = 0; vert < this.size; vert++) {
+        for (let j = 0; j < 2; j++) {
+          const x = right - j;
+          const upward = (right + 1 & 2) === 0;
+          const y = upward ? this.size - 1 - vert : vert;
+          if (!this.types[y][x] && i < data.length * 8) {
+            this.modules[y][x] = getBit(data[i >>> 3], 7 - (i & 7));
+            i++;
+          }
+        }
+      }
+    }
+  }
+  // XORs the codeword modules in this QR Code with the given mask pattern.
+  // The function modules must be marked and the codeword bits must be drawn
+  // before masking. Due to the arithmetic of XOR, calling applyMask() with
+  // the same mask value a second time will undo the mask. A final well-formed
+  // QR Code needs exactly one (not zero, two, etc.) mask applied.
+  applyMask(mask) {
+    if (mask < 0 || mask > 7)
+      throw new RangeError("Mask value out of range");
+    for (let y = 0; y < this.size; y++) {
+      for (let x = 0; x < this.size; x++) {
+        let invert;
+        switch (mask) {
+          case 0:
+            invert = (x + y) % 2 === 0;
+            break;
+          case 1:
+            invert = y % 2 === 0;
+            break;
+          case 2:
+            invert = x % 3 === 0;
+            break;
+          case 3:
+            invert = (x + y) % 3 === 0;
+            break;
+          case 4:
+            invert = (Math.floor(x / 3) + Math.floor(y / 2)) % 2 === 0;
+            break;
+          case 5:
+            invert = x * y % 2 + x * y % 3 === 0;
+            break;
+          case 6:
+            invert = (x * y % 2 + x * y % 3) % 2 === 0;
+            break;
+          case 7:
+            invert = ((x + y) % 2 + x * y % 3) % 2 === 0;
+            break;
+          default:
+            throw new Error("Unreachable");
+        }
+        if (!this.types[y][x] && invert)
+          this.modules[y][x] = !this.modules[y][x];
+      }
+    }
+  }
+  // Calculates and returns the penalty score based on state of this QR Code's current modules.
+  // This is used by the automatic mask choice algorithm to find the mask pattern that yields the lowest score.
+  getPenaltyScore() {
+    let result = 0;
+    for (let y = 0; y < this.size; y++) {
+      let runColor = false;
+      let runX = 0;
+      const runHistory = [0, 0, 0, 0, 0, 0, 0];
+      for (let x = 0; x < this.size; x++) {
+        if (this.modules[y][x] === runColor) {
+          runX++;
+          if (runX === 5)
+            result += PENALTY_N1;
+          else if (runX > 5)
+            result++;
+        } else {
+          this.finderPenaltyAddHistory(runX, runHistory);
+          if (!runColor)
+            result += this.finderPenaltyCountPatterns(runHistory) * PENALTY_N3;
+          runColor = this.modules[y][x];
+          runX = 1;
+        }
+      }
+      result += this.finderPenaltyTerminateAndCount(runColor, runX, runHistory) * PENALTY_N3;
+    }
+    for (let x = 0; x < this.size; x++) {
+      let runColor = false;
+      let runY = 0;
+      const runHistory = [0, 0, 0, 0, 0, 0, 0];
+      for (let y = 0; y < this.size; y++) {
+        if (this.modules[y][x] === runColor) {
+          runY++;
+          if (runY === 5)
+            result += PENALTY_N1;
+          else if (runY > 5)
+            result++;
+        } else {
+          this.finderPenaltyAddHistory(runY, runHistory);
+          if (!runColor)
+            result += this.finderPenaltyCountPatterns(runHistory) * PENALTY_N3;
+          runColor = this.modules[y][x];
+          runY = 1;
+        }
+      }
+      result += this.finderPenaltyTerminateAndCount(runColor, runY, runHistory) * PENALTY_N3;
+    }
+    for (let y = 0; y < this.size - 1; y++) {
+      for (let x = 0; x < this.size - 1; x++) {
+        const color = this.modules[y][x];
+        if (color === this.modules[y][x + 1] && color === this.modules[y + 1][x] && color === this.modules[y + 1][x + 1]) {
+          result += PENALTY_N2;
+        }
+      }
+    }
+    let dark = 0;
+    for (const row of this.modules)
+      dark = row.reduce((sum, color) => sum + (color ? 1 : 0), dark);
+    const total = this.size * this.size;
+    const k = Math.ceil(Math.abs(dark * 20 - total * 10) / total) - 1;
+    result += k * PENALTY_N4;
+    return result;
+  }
+  /* -- Private helper functions -- */
+  // Returns an ascending list of positions of alignment patterns for this version number.
+  // Each position is in the range [0,177), and are used on both the x and y axes.
+  // This could be implemented as lookup table of 40 variable-length lists of integers.
+  getAlignmentPatternPositions() {
+    if (this.version === 1) {
+      return [];
+    } else {
+      const numAlign = Math.floor(this.version / 7) + 2;
+      const step = this.version === 32 ? 26 : Math.ceil((this.version * 4 + 4) / (numAlign * 2 - 2)) * 2;
+      const result = [6];
+      for (let pos = this.size - 7; result.length < numAlign; pos -= step)
+        result.splice(1, 0, pos);
+      return result;
+    }
+  }
+  // Can only be called immediately after a light run is added, and
+  // returns either 0, 1, or 2. A helper function for getPenaltyScore().
+  finderPenaltyCountPatterns(runHistory) {
+    const n = runHistory[1];
+    const core = n > 0 && runHistory[2] === n && runHistory[3] === n * 3 && runHistory[4] === n && runHistory[5] === n;
+    return (core && runHistory[0] >= n * 4 && runHistory[6] >= n ? 1 : 0) + (core && runHistory[6] >= n * 4 && runHistory[0] >= n ? 1 : 0);
+  }
+  // Must be called at the end of a line (row or column) of modules. A helper function for getPenaltyScore().
+  finderPenaltyTerminateAndCount(currentRunColor, currentRunLength, runHistory) {
+    if (currentRunColor) {
+      this.finderPenaltyAddHistory(currentRunLength, runHistory);
+      currentRunLength = 0;
+    }
+    currentRunLength += this.size;
+    this.finderPenaltyAddHistory(currentRunLength, runHistory);
+    return this.finderPenaltyCountPatterns(runHistory);
+  }
+  // Pushes the given value to the front and drops the last value. A helper function for getPenaltyScore().
+  finderPenaltyAddHistory(currentRunLength, runHistory) {
+    if (runHistory[0] === 0)
+      currentRunLength += this.size;
+    runHistory.pop();
+    runHistory.unshift(currentRunLength);
+  }
+};
+function appendBits(val, len, bb) {
+  if (len < 0 || len > 31 || val >>> len !== 0)
+    throw new RangeError("Value out of range");
+  for (let i = len - 1; i >= 0; i--)
+    bb.push(val >>> i & 1);
+}
+function getBit(x, i) {
+  return (x >>> i & 1) !== 0;
+}
+var QrSegment = class {
+  // Creates a new QR Code segment with the given attributes and data.
+  // The character count (numChars) must agree with the mode and the bit buffer length,
+  // but the constraint isn't checked. The given bit buffer is cloned and stored.
+  constructor(mode, numChars, bitData) {
+    this.mode = mode;
+    this.numChars = numChars;
+    this.bitData = bitData;
+    if (numChars < 0)
+      throw new RangeError("Invalid argument");
+    this.bitData = bitData.slice();
+  }
+  /* -- Methods -- */
+  // Returns a new copy of the data bits of this segment.
+  getData() {
+    return this.bitData.slice();
+  }
+};
+var MODE_NUMERIC = [1, 10, 12, 14];
+var MODE_ALPHANUMERIC = [2, 9, 11, 13];
+var MODE_BYTE = [4, 8, 16, 16];
+function numCharCountBits(mode, ver) {
+  return mode[Math.floor((ver + 7) / 17) + 1];
+}
+function makeBytes(data) {
+  const bb = [];
+  for (const b of data)
+    appendBits(b, 8, bb);
+  return new QrSegment(MODE_BYTE, data.length, bb);
+}
+function makeNumeric(digits) {
+  if (!isNumeric(digits))
+    throw new RangeError("String contains non-numeric characters");
+  const bb = [];
+  for (let i = 0; i < digits.length; ) {
+    const n = Math.min(digits.length - i, 3);
+    appendBits(Number.parseInt(digits.substring(i, i + n), 10), n * 3 + 1, bb);
+    i += n;
+  }
+  return new QrSegment(MODE_NUMERIC, digits.length, bb);
+}
+function makeAlphanumeric(text) {
+  if (!isAlphanumeric(text))
+    throw new RangeError("String contains unencodable characters in alphanumeric mode");
+  const bb = [];
+  let i;
+  for (i = 0; i + 2 <= text.length; i += 2) {
+    let temp = ALPHANUMERIC_CHARSET.indexOf(text.charAt(i)) * 45;
+    temp += ALPHANUMERIC_CHARSET.indexOf(text.charAt(i + 1));
+    appendBits(temp, 11, bb);
+  }
+  if (i < text.length)
+    appendBits(ALPHANUMERIC_CHARSET.indexOf(text.charAt(i)), 6, bb);
+  return new QrSegment(MODE_ALPHANUMERIC, text.length, bb);
+}
+function makeSegments(text) {
+  if (text === "")
+    return [];
+  else if (isNumeric(text))
+    return [makeNumeric(text)];
+  else if (isAlphanumeric(text))
+    return [makeAlphanumeric(text)];
+  else
+    return [makeBytes(toUtf8ByteArray(text))];
+}
+function isNumeric(text) {
+  return NUMERIC_REGEX.test(text);
+}
+function isAlphanumeric(text) {
+  return ALPHANUMERIC_REGEX.test(text);
+}
+function getTotalBits(segs, version) {
+  let result = 0;
+  for (const seg of segs) {
+    const ccbits = numCharCountBits(seg.mode, version);
+    if (seg.numChars >= 1 << ccbits)
+      return Number.POSITIVE_INFINITY;
+    result += 4 + ccbits + seg.bitData.length;
+  }
+  return result;
+}
+function toUtf8ByteArray(str) {
+  str = encodeURI(str);
+  const result = [];
+  for (let i = 0; i < str.length; i++) {
+    if (str.charAt(i) !== "%") {
+      result.push(str.charCodeAt(i));
+    } else {
+      result.push(Number.parseInt(str.substring(i + 1, i + 3), 16));
+      i += 2;
+    }
+  }
+  return result;
+}
+function getNumRawDataModules(ver) {
+  if (ver < MIN_VERSION || ver > MAX_VERSION)
+    throw new RangeError("Version number out of range");
+  let result = (16 * ver + 128) * ver + 64;
+  if (ver >= 2) {
+    const numAlign = Math.floor(ver / 7) + 2;
+    result -= (25 * numAlign - 10) * numAlign - 55;
+    if (ver >= 7)
+      result -= 36;
+  }
+  return result;
+}
+function getNumDataCodewords(ver, ecl) {
+  return Math.floor(getNumRawDataModules(ver) / 8) - ECC_CODEWORDS_PER_BLOCK[ecl[0]][ver] * NUM_ERROR_CORRECTION_BLOCKS[ecl[0]][ver];
+}
+function reedSolomonComputeDivisor(degree) {
+  if (degree < 1 || degree > 255)
+    throw new RangeError("Degree out of range");
+  const result = [];
+  for (let i = 0; i < degree - 1; i++)
+    result.push(0);
+  result.push(1);
+  let root = 1;
+  for (let i = 0; i < degree; i++) {
+    for (let j = 0; j < result.length; j++) {
+      result[j] = reedSolomonMultiply(result[j], root);
+      if (j + 1 < result.length)
+        result[j] ^= result[j + 1];
+    }
+    root = reedSolomonMultiply(root, 2);
+  }
+  return result;
+}
+function reedSolomonComputeRemainder(data, divisor) {
+  const result = divisor.map((_) => 0);
+  for (const b of data) {
+    const factor = b ^ result.shift();
+    result.push(0);
+    divisor.forEach((coef, i) => result[i] ^= reedSolomonMultiply(coef, factor));
+  }
+  return result;
+}
+function reedSolomonMultiply(x, y) {
+  if (x >>> 8 !== 0 || y >>> 8 !== 0)
+    throw new RangeError("Byte out of range");
+  let z = 0;
+  for (let i = 7; i >= 0; i--) {
+    z = z << 1 ^ (z >>> 7) * 285;
+    z ^= (y >>> i & 1) * x;
+  }
+  return z;
+}
+function encodeSegments(segs, ecl, minVersion = 1, maxVersion = 40, mask = -1, boostEcl = true) {
+  if (!(MIN_VERSION <= minVersion && minVersion <= maxVersion && maxVersion <= MAX_VERSION) || mask < -1 || mask > 7) {
+    throw new RangeError("Invalid value");
+  }
+  let version;
+  let dataUsedBits;
+  for (version = minVersion; ; version++) {
+    const dataCapacityBits2 = getNumDataCodewords(version, ecl) * 8;
+    const usedBits = getTotalBits(segs, version);
+    if (usedBits <= dataCapacityBits2) {
+      dataUsedBits = usedBits;
+      break;
+    }
+    if (version >= maxVersion)
+      throw new RangeError("Data too long");
+  }
+  for (const newEcl of [MEDIUM, QUARTILE, HIGH]) {
+    if (boostEcl && dataUsedBits <= getNumDataCodewords(version, newEcl) * 8)
+      ecl = newEcl;
+  }
+  const bb = [];
+  for (const seg of segs) {
+    appendBits(seg.mode[0], 4, bb);
+    appendBits(seg.numChars, numCharCountBits(seg.mode, version), bb);
+    for (const b of seg.getData())
+      bb.push(b);
+  }
+  const dataCapacityBits = getNumDataCodewords(version, ecl) * 8;
+  appendBits(0, Math.min(4, dataCapacityBits - bb.length), bb);
+  appendBits(0, (8 - bb.length % 8) % 8, bb);
+  for (let padByte = 236; bb.length < dataCapacityBits; padByte ^= 236 ^ 17)
+    appendBits(padByte, 8, bb);
+  const dataCodewords = Array.from({ length: Math.ceil(bb.length / 8) }, () => 0);
+  bb.forEach((b, i) => dataCodewords[i >>> 3] |= b << 7 - (i & 7));
+  return new QrCode(version, ecl, dataCodewords, mask);
+}
+function encode(data, options) {
+  const {
+    ecc = "L",
+    boostEcc = false,
+    minVersion = 1,
+    maxVersion = 40,
+    maskPattern = -1,
+    border = 1
+  } = options || {};
+  const segment = typeof data === "string" ? makeSegments(data) : Array.isArray(data) ? [makeBytes(data)] : void 0;
+  if (!segment)
+    throw new Error(`uqr only supports encoding string and binary data, but got: ${typeof data}`);
+  const qr = encodeSegments(
+    segment,
+    EccMap[ecc],
+    minVersion,
+    maxVersion,
+    maskPattern,
+    boostEcc
+  );
+  const result = addBorder({
+    version: qr.version,
+    maskPattern: qr.mask,
+    size: qr.size,
+    data: qr.modules,
+    types: qr.types
+  }, border);
+  if (options?.invert)
+    result.data = result.data.map((row) => row.map((mod) => !mod));
+  options?.onEncoded?.(result);
+  return result;
+}
+function addBorder(input, border = 1) {
+  if (!border)
+    return input;
+  const { size } = input;
+  const newSize = size + border * 2;
+  input.size = newSize;
+  input.data.forEach((row) => {
+    for (let i = 0; i < border; i++) {
+      row.unshift(false);
+      row.push(false);
+    }
+  });
+  for (let i = 0; i < border; i++) {
+    input.data.unshift(Array.from({ length: newSize }, (_) => false));
+    input.data.push(Array.from({ length: newSize }, (_) => false));
+  }
+  const b = QrCodeDataType.Border;
+  input.types.forEach((row) => {
+    for (let i = 0; i < border; i++) {
+      row.unshift(b);
+      row.push(b);
+    }
+  });
+  for (let i = 0; i < border; i++) {
+    input.types.unshift(Array.from({ length: newSize }, (_) => b));
+    input.types.push(Array.from({ length: newSize }, (_) => b));
+  }
+  return input;
+}
+function getDataAt(data, x, y, defaults = false) {
+  if (x < 0 || y < 0 || x >= data.length || y >= data.length)
+    return defaults;
+  return data[y][x];
+}
+function renderUnicodeCompact(data, options = {}) {
+  const palette = {
+    WHITE_ALL: "\u2588",
+    WHITE_BLACK: "\u2580",
+    BLACK_WHITE: "\u2584",
+    BLACK_ALL: " "
+  };
+  const result = encode(data, options);
+  const WHITE = false;
+  const BLACK = true;
+  const at = (x, y) => getDataAt(result.data, x, y, true);
+  const lines = [];
+  let line = "";
+  for (let row = 0; row < result.size; row += 2) {
+    for (let col = 0; col < result.size; col++) {
+      if (at(col, row) === WHITE && at(col, row + 1) === WHITE)
+        line += palette.WHITE_ALL;
+      else if (at(col, row) === WHITE && at(col, row + 1) === BLACK)
+        line += palette.WHITE_BLACK;
+      else if (at(col, row) === BLACK && at(col, row + 1) === WHITE)
+        line += palette.BLACK_WHITE;
+      else
+        line += palette.BLACK_ALL;
+    }
+    lines.push(line);
+    line = "";
+  }
+  return lines.join("\n");
+}
+
 // ../tutticode-protocol/src/messages.ts
 var BRIDGE_PROTOCOL = 1;
 var BRIDGE_PATH = "/bridge";
@@ -3884,6 +4575,42 @@ function isFrameHeader(value) {
   return typeof v.id === "string" && typeof v.part === "string" && Number.isInteger(v.seq) && v.seq >= 0 && typeof v.last === "boolean";
 }
 
+// ../tutticode-protocol/src/auth.ts
+var TUTTICODE_SCOPE = "tutticode";
+var TUTTICODE_RESOURCE_PATH = "/api/tutticode";
+function tutticodeResourceUrl(origin) {
+  return `${origin}${TUTTICODE_RESOURCE_PATH}`;
+}
+var TUTTICODE_CLIENT_ID = "tutticode-cli";
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var TUTTICODE_OAUTH_PATHS = {
+  token: "/api/oauth/token",
+  revoke: "/api/oauth/revoke",
+  deviceAuthorization: "/api/oauth/device_authorization",
+  /** Browser pages (lane B). */
+  login: "/code/login",
+  activate: "/code/activate",
+  /** The terms of use page (the site has no `/terms`; it redirects here). */
+  terms: "/page/terms-of-use"
+};
+function tutticodeTermsUrl(origin) {
+  return `${origin}${TUTTICODE_OAUTH_PATHS.terms}`;
+}
+var TUTTICODE_LOGIN_HINT_COMMAND = "tutticode login --device --no-wait";
+var DEFAULT_TUTTICODE_LIMITS = {
+  enforce: false,
+  anonMaxSeconds: 60,
+  anonWatermarkAfterSeconds: 30,
+  watermarkGapSeconds: 3,
+  signedInMaxSeconds: 300,
+  signedInDailyRenders: 1e3,
+  minCliVersion: "0.2.0"
+};
+var VERSION = /^(\d{1,6})\.(\d{1,6})\.(\d{1,6})(?:-[0-9A-Za-z.-]{1,32})?$/;
+function isCliVersion(v) {
+  return typeof v === "string" && VERSION.test(v);
+}
+
 // ../tutticode-protocol/src/validate.ts
 var BRIDGE_MAX_CODE_CHARS = 2e5;
 var FORMATS = ["wav", "flac", "mp3"];
@@ -3932,11 +4659,28 @@ function validRender(m) {
     return "lufs must be -40..-5";
   if (!optional(m.truePeak, (v) => finite(v) && v >= -12 && v <= 0))
     return "truePeak must be -12..0";
-  for (const key of ["stems", "analyze", "limit"])
+  for (const key of ["stems", "analyze", "limit", "brandTag"])
     if (!optional(m[key], (v) => typeof v === "boolean"))
       return `${key} must be a boolean`;
   return void 0;
 }
+var MAX_TOKEN_CHARS = 4096;
+var TOKEN = /^[A-Za-z0-9._~+/=-]+$/;
+var INSTALL_ID = /^[A-Za-z0-9_-]{16,64}$/;
+function validAuth(m) {
+  if (!optional(
+    m.accessToken,
+    (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_TOKEN_CHARS && TOKEN.test(v)
+  ))
+    return "auth.accessToken must be a token string";
+  if (typeof m.installId !== "string" || !INSTALL_ID.test(m.installId))
+    return "auth.installId must be 16..64 characters of [A-Za-z0-9_-]";
+  if (!isCliVersion(m.cliVersion))
+    return "auth.cliVersion must be major.minor.patch";
+  if (m.client !== "cli" && m.client !== "mcp")
+    return "auth.client must be cli or mcp";
+  return void 0;
+}
 function validateCommand(raw) {
   if (!isObject(raw))
     return { ok: false, reason: "not an object" };
@@ -3955,6 +4699,19 @@ function validateCommand(raw) {
       return validCode(raw.code) ? { ok: true, value: raw } : { ok: false, reason: "open needs code" };
     case "cancel":
       return isId(raw.id) ? { ok: true, value: raw } : { ok: false, reason: "cancel needs an id" };
+    case "auth": {
+      const reason = validAuth(raw);
+      if (reason)
+        return { ok: false, reason };
+      const auth = {
+        type: "auth",
+        ...raw.accessToken !== void 0 ? { accessToken: raw.accessToken } : {},
+        installId: raw.installId,
+        cliVersion: raw.cliVersion,
+        client: raw.client
+      };
+      return { ok: true, value: auth };
+    }
     default:
       return { ok: false, reason: `unknown command type ${String(raw.type)}` };
   }
@@ -3971,6 +4728,8 @@ function validateMessage(raw) {
   if (raw.type === "error") {
     if (typeof raw.code !== "string" || typeof raw.message !== "string")
       return { ok: false, reason: "error needs code and message" };
+    if (!optional(raw.limit, validLimit))
+      return { ok: false, reason: "error.limit must be {name, value, signedInValue}" };
     return { ok: true, value: raw };
   }
   if (!isId(raw.id))
@@ -3983,6 +4742,9 @@ function validateMessage(raw) {
     return { ok: false, reason: "rendered needs meta" };
   return { ok: true, value: raw };
 }
+function validLimit(v) {
+  return isObject(v) && v.name === "length" && inRange(v.value, 0, MAX_RENDER_SECONDS) && inRange(v.signedInValue, 0, MAX_RENDER_SECONDS);
+}
 function bridgePageUrl(origin, locale, port, token) {
   return `${origin}/${locale}/code/bridge#p=${port}&t=${encodeURIComponent(token)}`;
 }
@@ -4070,6 +4832,12 @@ function validateRenderMeta(raw, expect) {
     return no("meta.analysis must be an object");
   if (typeof raw.engineVersion !== "string" || raw.engineVersion.length > MAX_VERSION_CHARS)
     return no("meta.engineVersion malformed");
+  let watermark;
+  if (raw.watermark !== void 0) {
+    watermark = validWatermark(raw.watermark, raw.seconds);
+    if (!watermark)
+      return no("meta.watermark must be {reason, at: ascending seconds within the render, removeWith}");
+  }
   if (typeof raw.editUrl !== "string" || raw.editUrl.length > MAX_EDIT_URL_CHARS || !expect.origins.includes(urlOrigin(raw.editUrl) ?? ""))
     return no("meta.editUrl must be a link on the TuttiDAW site");
   return {
@@ -4092,10 +4860,28 @@ function validateRenderMeta(raw, expect) {
       ...raw.analysis !== void 0 ? { analysis: raw.analysis } : {},
       check: raw.check,
       editUrl: raw.editUrl,
-      engineVersion: raw.engineVersion
+      engineVersion: raw.engineVersion,
+      ...watermark ? { watermark } : {}
     }
   };
 }
+var MAX_WATERMARKS = 200;
+function validWatermark(v, seconds) {
+  if (!isObject(v) || v.reason !== "anonymous")
+    return void 0;
+  if (typeof v.removeWith !== "string" || !v.removeWith || v.removeWith.length > 64)
+    return void 0;
+  if (!Array.isArray(v.at) || v.at.length === 0 || v.at.length > MAX_WATERMARKS)
+    return void 0;
+  const at = v.at;
+  for (let i = 0; i < at.length; i++) {
+    if (!inRange(at[i], 0, seconds))
+      return void 0;
+    if (i > 0 && at[i] <= at[i - 1])
+      return void 0;
+  }
+  return { reason: "anonymous", at: [...at], removeWith: v.removeWith };
+}
 function urlOrigin(url) {
   try {
     const parsed = new URL(url);
@@ -4105,22 +4891,677 @@ function urlOrigin(url) {
   }
 }
 
+// src/credentials.ts
+var import_node_child_process = require("node:child_process");
+var import_node_crypto = require("node:crypto");
+var import_node_fs2 = require("node:fs");
+var import_node_os2 = require("node:os");
+var import_node_path2 = require("node:path");
+
+// src/env.ts
+var import_node_fs = require("node:fs");
+var import_node_os = require("node:os");
+var import_node_path = require("node:path");
+var VERSION2 = true ? "0.2.0" : readPackageVersion();
+function envBrowserArgs() {
+  const args = process.env.TUTTICODE_BROWSER_ARGS?.split(" ").filter(Boolean);
+  return args?.length ? args : void 0;
+}
+function stateDir() {
+  const dir = process.env.TUTTICODE_HOME || (0, import_node_path.join)((0, import_node_os.homedir)(), ".tutticode");
+  (0, import_node_fs.mkdirSync)(dir, { recursive: true, mode: 448 });
+  return dir;
+}
+var assetsDir;
+function skillsDir() {
+  return process.env.TUTTICODE_SKILLS_DIR || assetsDir || // Running from the sources (tests): the app's public skills.
+  (0, import_node_path.join)(__dirname, "..", "..", "..", "public", "skills");
+}
+function setSkillsDir(dir) {
+  assetsDir = dir;
+}
+var LOG_ROLL_BYTES = 2 * 1024 * 1024;
+function createLogger(name, verbose) {
+  let file2;
+  try {
+    const dir = (0, import_node_path.join)(stateDir(), "logs");
+    (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+    file2 = (0, import_node_path.join)(dir, `${name}.log`);
+    if (((0, import_node_fs.statSync)(file2, { throwIfNoEntry: false })?.size ?? 0) > LOG_ROLL_BYTES)
+      (0, import_node_fs.renameSync)(file2, `${file2}.1`);
+  } catch {
+    file2 = void 0;
+  }
+  return (level2, message) => {
+    const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${level2} [${process.pid}] ${message}`;
+    if (verbose || level2 === "error")
+      process.stderr.write(`tutticode: ${message}
+`);
+    if (!file2)
+      return;
+    try {
+      (0, import_node_fs.appendFileSync)(file2, `${line}
+`);
+    } catch {
+    }
+  };
+}
+
+// src/credentials.ts
+var CREDENTIALS_FILE = "credentials";
+function credentialsPath() {
+  return (0, import_node_path2.join)(stateDir(), CREDENTIALS_FILE);
+}
+var EMPTY = { version: 1, accounts: {} };
+function readCredentials(path = credentialsPath()) {
+  let raw;
+  try {
+    if ((0, import_node_fs2.lstatSync)(path, { throwIfNoEntry: false })?.isSymbolicLink())
+      return EMPTY;
+    raw = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+  } catch {
+    return EMPTY;
+  }
+  if (!isObject2(raw) || raw.version !== 1 || !isObject2(raw.accounts))
+    return EMPTY;
+  const accounts = {};
+  for (const [origin, entry] of Object.entries(raw.accounts))
+    if (validAccount(entry))
+      accounts[origin] = entry;
+  return { version: 1, accounts };
+}
+function readAccount(origin) {
+  return readCredentials().accounts[origin];
+}
+function validAccount(v) {
+  return isObject2(v) && v.kind === "login" && typeof v.accessToken === "string" && typeof v.refreshToken === "string" && typeof v.accessTokenExpiresAt === "string" && typeof v.clientId === "string" && typeof v.scope === "string";
+}
+var isObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function writeCredentials(file2) {
+  const path = credentialsPath();
+  if (!Object.keys(file2.accounts).length) {
+    (0, import_node_fs2.rmSync)(path, { force: true });
+    return;
+  }
+  writePrivateFile(path, `${JSON.stringify(file2, null, 2)}
+`);
+}
+function saveAccount(origin, account) {
+  return withCredentialsLock(() => {
+    const accounts = { ...readCredentials().accounts };
+    if (account)
+      accounts[origin] = account;
+    else
+      delete accounts[origin];
+    writeCredentials({ version: 1, accounts });
+  });
+}
+var PrivateDirError = class extends Error {
+};
+var privateDirs = /* @__PURE__ */ new Map();
+var fileId = (st) => `${st.dev}:${st.ino}`;
+function refusal(dir, why) {
+  return new PrivateDirError(
+    `${dir} ${why}, so tutticode will not keep a sign-in there. Point TUTTICODE_HOME at a folder you own that only you can use (or unset it for ~/.tutticode).`
+  );
+}
+function ensurePrivateDir(dir = stateDir()) {
+  const known = privateDirs.get(dir);
+  const now = (0, import_node_fs2.lstatSync)(dir, { bigint: true, throwIfNoEntry: false });
+  if (known && now && fileId(now) === known)
+    return dir;
+  privateDirs.set(dir, checkPrivateDir(dir, true));
+  return dir;
+}
+function checkPrivateDir(dir, fix) {
+  const st = (0, import_node_fs2.lstatSync)(dir, { bigint: true, throwIfNoEntry: false });
+  if (!st)
+    throw refusal(dir, "does not exist");
+  if (st.isSymbolicLink())
+    throw refusal(dir, "is a symbolic link or a junction");
+  if (!st.isDirectory())
+    throw refusal(dir, "is not a folder");
+  const id = process.platform === "win32" ? checkWindowsDir(dir, fix) : checkPosixDir(dir, fix);
+  if (id !== fileId(st))
+    throw refusal(dir, "was replaced while it was checked");
+  return id;
+}
+function checkPosixDir(dir, fix) {
+  let fd;
+  try {
+    fd = (0, import_node_fs2.openSync)(
+      dir,
+      import_node_fs2.constants.O_RDONLY | import_node_fs2.constants.O_DIRECTORY | import_node_fs2.constants.O_NOFOLLOW
+    );
+  } catch {
+    throw refusal(dir, "was replaced while it was checked");
+  }
+  try {
+    let st = (0, import_node_fs2.fstatSync)(fd, { bigint: true });
+    if (process.getuid && st.uid !== BigInt(process.getuid()))
+      throw refusal(dir, "belongs to another user");
+    if (fix && st.mode & BigInt(63)) {
+      try {
+        (0, import_node_fs2.fchmodSync)(fd, 448);
+      } catch {
+        throw refusal(dir, "cannot be made private (chmod 0700 failed)");
+      }
+      st = (0, import_node_fs2.fstatSync)(fd, { bigint: true });
+    }
+    if (st.mode & BigInt(63))
+      throw refusal(dir, "is open to other users");
+    return fileId(st);
+  } finally {
+    (0, import_node_fs2.closeSync)(fd);
+  }
+}
+var WINDOWS_OWNERS = /* @__PURE__ */ new Set(["SY", "BA", "S-1-5-18", "S-1-5-32-544"]);
+function checkWindowsDir(dir, fix) {
+  const sid = currentUserSid();
+  const inspect = () => {
+    const sec = windowsSecurity(dir);
+    if (!sid || !sec)
+      throw refusal(dir, "has an owner or access list tutticode cannot check");
+    if (sec.reparse)
+      throw refusal(dir, "is a symbolic link or a junction");
+    if (sec.owner !== sid && !WINDOWS_OWNERS.has(sec.owner))
+      throw refusal(dir, `belongs to another user (${sec.owner})`);
+    return { access: daclAccess(sec.sddl, sid), protected: sec.protected };
+  };
+  let state = inspect();
+  if (fix && (!state.access.ok || !state.protected)) {
+    if (!restrictDirAcl(dir))
+      throw refusal(dir, "could not be limited to your user (icacls failed)");
+    state = inspect();
+  }
+  if (!state.access.ok)
+    throw refusal(dir, `is ${state.access.detail}`);
+  return fileId((0, import_node_fs2.lstatSync)(dir, { bigint: true }));
+}
+function writePrivateFile(path, text) {
+  const dir = (0, import_node_path2.dirname)(path);
+  ensurePrivateDir(dir);
+  const checked = privateDirs.get(dir);
+  const target = (0, import_node_fs2.lstatSync)(path, { throwIfNoEntry: false });
+  if (target && !target.isFile())
+    throw new PrivateDirError(
+      `${path} is not a plain file (a link, a junction or a folder), so tutticode will not write the sign-in through it. Remove it and try again.`
+    );
+  const changed = () => new PrivateDirError(
+    `${dir} changed while the sign-in was being written (replaced, or its owner or access list changed); nothing was written.`
+  );
+  const tmp = `${path}.${(0, import_node_crypto.randomBytes)(6).toString("hex")}.tmp`;
+  const tmpId = () => {
+    const st = (0, import_node_fs2.lstatSync)(tmp, { bigint: true, throwIfNoEntry: false });
+    return st && fileId(st);
+  };
+  const fd = (0, import_node_fs2.openSync)(
+    tmp,
+    import_node_fs2.constants.O_WRONLY | import_node_fs2.constants.O_CREAT | import_node_fs2.constants.O_EXCL | (import_node_fs2.constants.O_NOFOLLOW ?? 0),
+    384
+  );
+  let open2 = true;
+  try {
+    const written = fileId((0, import_node_fs2.fstatSync)(fd, { bigint: true }));
+    if (tmpId() !== written)
+      throw changed();
+    (0, import_node_fs2.writeFileSync)(fd, text);
+    (0, import_node_fs2.fsyncSync)(fd);
+    (0, import_node_fs2.closeSync)(fd);
+    open2 = false;
+    if (checkPrivateDir(dir, false) !== checked || tmpId() !== written)
+      throw changed();
+    if (process.platform === "win32" && !checkFileAccess(tmp)?.ok)
+      throw new PrivateDirError(
+        `Could not confirm that ${tmp} is private to your user; nothing was written.`
+      );
+    renameWithRetry(tmp, path);
+  } catch (e) {
+    if (open2)
+      (0, import_node_fs2.closeSync)(fd);
+    (0, import_node_fs2.rmSync)(tmp, { force: true });
+    throw e;
+  }
+}
+function renameWithRetry(from, to) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      (0, import_node_fs2.renameSync)(from, to);
+      return;
+    } catch (e) {
+      const code = e.code;
+      if (attempt >= 20 || code !== "EPERM" && code !== "EBUSY")
+        throw e;
+      sleepSync(25);
+    }
+  }
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+var system32 = (exe) => (0, import_node_path2.join)(process.env.SystemRoot ?? "C:\\Windows", "System32", exe);
+var userSid;
+function currentUserSid() {
+  if (userSid !== void 0)
+    return userSid;
+  const out = (0, import_node_child_process.spawnSync)(
+    system32("whoami.exe"),
+    ["/user", "/fo", "csv", "/nh"],
+    {
+      encoding: "utf8",
+      windowsHide: true
+    }
+  ).stdout;
+  userSid = /"(S-1-[0-9-]+)"/.exec(out ?? "")?.[1] ?? null;
+  return userSid;
+}
+function icaclsUser() {
+  const sid = currentUserSid();
+  return sid ? `*${sid}` : process.env.USERDOMAIN ? `${process.env.USERDOMAIN}\\${process.env.USERNAME}` : process.env.USERNAME ?? "";
+}
+var icacls = (args) => (0, import_node_child_process.spawnSync)(system32("icacls.exe"), args, {
+  encoding: "utf8",
+  windowsHide: true
+}).status === 0;
+function restrictDirAcl(dir) {
+  const user = icaclsUser();
+  return !!user && icacls([
+    dir,
+    "/inheritance:r",
+    "/grant:r",
+    `${user}:(OI)(CI)F`,
+    "*S-1-5-18:(OI)(CI)F",
+    "*S-1-5-32-544:(OI)(CI)F"
+  ]);
+}
+var PS_SECURITY = "$p = $env:TUTTICODE_ACL_PATH; $a = [int][IO.File]::GetAttributes($p); $s = (New-Object System.Security.AccessControl.DirectorySecurity($p, 'Owner,Access')).GetSecurityDescriptorSddlForm('Owner,Access'); [Console]::Out.Write([string]$a + [char]10 + $s)";
+function windowsSecurity(path) {
+  const out = (0, import_node_child_process.spawnSync)(
+    system32("WindowsPowerShell\\v1.0\\powershell.exe"),
+    ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", PS_SECURITY],
+    {
+      encoding: "utf8",
+      windowsHide: true,
+      env: { ...process.env, TUTTICODE_ACL_PATH: path }
+    }
+  );
+  if (out.status !== 0)
+    return void 0;
+  const m = /^(\d+)\r?\n(O:(S-1-[0-9-]+|[A-Z]{2})D:[^\r\n]*)/.exec(
+    out.stdout ?? ""
+  );
+  if (!m)
+    return void 0;
+  return {
+    owner: m[3],
+    sddl: m[2],
+    protected: /D:[A-Z]*P/.test(m[2]),
+    // FILE_ATTRIBUTE_REPARSE_POINT
+    reparse: (Number(m[1]) & 1024) !== 0
+  };
+}
+var ALLOWED_SIDS = /* @__PURE__ */ new Set(["SY", "BA", "OW", "S-1-5-18", "S-1-5-32-544"]);
+function sddlAllowTrustees(sddl) {
+  const trustees = [];
+  for (const ace of sddl.matchAll(/\(([^)]*)\)/g)) {
+    const fields = ace[1].split(";");
+    if (fields[0] === "A" && fields[5])
+      trustees.push(fields[5]);
+  }
+  return trustees;
+}
+function checkFileAccess(path) {
+  const st = (0, import_node_fs2.lstatSync)(path);
+  if (st.isSymbolicLink())
+    return { ok: false, detail: "a symbolic link or a junction" };
+  if (process.platform !== "win32") {
+    const mode = st.mode & 511;
+    return mode & 63 ? { ok: false, detail: `mode ${mode.toString(8).padStart(4, "0")}` } : { ok: true, detail: "mode 0600" };
+  }
+  const sid = currentUserSid();
+  if (!sid)
+    return void 0;
+  const dump = (0, import_node_path2.join)((0, import_node_os2.tmpdir)(), `tutticode-acl-${process.pid}.tmp`);
+  try {
+    const saved = (0, import_node_child_process.spawnSync)(system32("icacls.exe"), [path, "/save", dump], {
+      windowsHide: true
+    });
+    if (saved.status !== 0)
+      return void 0;
+    return daclAccess((0, import_node_fs2.readFileSync)(dump).toString("utf16le"), sid);
+  } finally {
+    (0, import_node_fs2.rmSync)(dump, { force: true });
+  }
+}
+function daclAccess(sddl, sid) {
+  const others = sddlAllowTrustees(sddl).filter(
+    (t) => t !== sid && !ALLOWED_SIDS.has(t)
+  );
+  return others.length ? { ok: false, detail: `also readable by ${others.join(", ")}` } : { ok: true, detail: "only you can read it" };
+}
+function fixFileAccess(path) {
+  if (process.platform !== "win32") {
+    (0, import_node_fs2.chmodSync)(path, 384);
+    return true;
+  }
+  writePrivateFile(path, (0, import_node_fs2.readFileSync)(path, "utf8"));
+  return checkFileAccess(path)?.ok ?? false;
+}
+var LOCK_STALE_MS = 3e4;
+async function withCredentialsLock(fn, options = {}) {
+  const lock = (0, import_node_path2.join)(stateDir(), `${CREDENTIALS_FILE}.lock`);
+  const staleMs = options.staleMs ?? LOCK_STALE_MS;
+  for (; ; ) {
+    if (takeLock(lock, staleMs))
+      break;
+    await new Promise((r2) => setTimeout(r2, options.pollMs ?? 100));
+  }
+  try {
+    return await fn();
+  } finally {
+    (0, import_node_fs2.rmSync)(lock, { force: true });
+  }
+}
+function takeLock(lock, staleMs) {
+  const mtime = (0, import_node_fs2.statSync)(lock, { throwIfNoEntry: false })?.mtimeMs;
+  if (mtime !== void 0 && Date.now() - mtime > staleMs)
+    (0, import_node_fs2.rmSync)(lock, { force: true });
+  try {
+    const fd = (0, import_node_fs2.openSync)(lock, "wx", 384);
+    (0, import_node_fs2.writeSync)(fd, String(process.pid));
+    (0, import_node_fs2.closeSync)(fd);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var INSTALL_ID2 = /^[A-Za-z0-9_-]{16,64}$/;
+function installId() {
+  const path = (0, import_node_path2.join)(stateDir(), "install-id");
+  try {
+    const id2 = (0, import_node_fs2.readFileSync)(path, "utf8").trim();
+    if (INSTALL_ID2.test(id2))
+      return id2;
+  } catch {
+  }
+  const id = (0, import_node_crypto.randomBytes)(16).toString("base64url");
+  try {
+    (0, import_node_fs2.writeFileSync)(path, `${id}
+`, { mode: 384, flag: "wx" });
+  } catch (e) {
+    if (e.code === "EEXIST")
+      try {
+        const theirs = (0, import_node_fs2.readFileSync)(path, "utf8").trim();
+        if (INSTALL_ID2.test(theirs))
+          return theirs;
+        (0, import_node_fs2.writeFileSync)(path, `${id}
+`, { mode: 384 });
+      } catch {
+      }
+  }
+  return id;
+}
+function deviceName() {
+  const os = process.platform === "win32" ? "Windows" : process.platform === "darwin" ? "macOS" : process.platform === "linux" ? "Linux" : process.platform;
+  return `${(0, import_node_os2.hostname)()} (${os})`.slice(0, 100);
+}
+
+// src/account.ts
+var REFRESH_MARGIN_MS = 5 * 60 * 1e3;
+var ACCOUNT_PATH = "/studio/account";
+var SIGN_IN_EXPIRED = "Your TuttiCode sign-in expired after a year: run `tutticode login`.";
+var OAuthError = class extends Error {
+  constructor(error, message, status, body = {}) {
+    super(message);
+    this.error = error;
+    this.status = status;
+    this.body = body;
+  }
+  /** `TUTTICODE_TOKEN_EXPIRED` etc. when the server sent one. */
+  get code() {
+    return typeof this.body.code === "string" ? this.body.code : void 0;
+  }
+};
+var ApiUnreachable = class extends Error {
+};
+async function request(origin, path, init, deps) {
+  try {
+    return await (deps.fetch ?? fetch)(`${origin}${path}`, {
+      ...init,
+      redirect: "error",
+      signal: AbortSignal.timeout(deps.timeoutMs ?? 15e3)
+    });
+  } catch (e) {
+    throw new ApiUnreachable(
+      `${origin} did not answer (${e.message}).`
+    );
+  }
+}
+async function jsonBody(response) {
+  try {
+    const body = await response.json();
+    return typeof body === "object" && body !== null ? body : {};
+  } catch {
+    return {};
+  }
+}
+async function postOAuth(origin, path, params, deps = {}) {
+  const response = await request(
+    origin,
+    path,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify({ client_id: TUTTICODE_CLIENT_ID, ...params })
+    },
+    deps
+  );
+  const body = await jsonBody(response);
+  if (response.ok)
+    return body;
+  if (response.status >= 500)
+    throw new ApiUnreachable(`${origin} answered ${response.status}.`);
+  const error = typeof body.error === "string" ? body.error : "invalid_request";
+  if (response.status === 429 && error !== "slow_down")
+    throw new ApiUnreachable(`${origin} is rate limiting (429).`);
+  throw new OAuthError(
+    error,
+    typeof body.error_description === "string" ? body.error_description : error,
+    response.status,
+    body
+  );
+}
+function tokenResponse(body) {
+  if (typeof body.access_token !== "string" || typeof body.refresh_token !== "string" || typeof body.expires_in !== "number")
+    throw new ApiUnreachable("The token endpoint sent no tokens.");
+  return body;
+}
+function storedAccount(tokens, now, base = {}) {
+  return {
+    kind: "login",
+    clientId: TUTTICODE_CLIENT_ID,
+    ...base,
+    accessToken: tokens.access_token,
+    accessTokenExpiresAt: new Date(
+      now + tokens.expires_in * 1e3
+    ).toISOString(),
+    refreshToken: tokens.refresh_token,
+    // A refresh never extends the year; keep the first end we learnt.
+    grantExpiresAt: base.grantExpiresAt ?? (tokens.refresh_token_expires_in ? new Date(now + tokens.refresh_token_expires_in * 1e3).toISOString() : void 0),
+    scope: tokens.scope || TUTTICODE_SCOPE,
+    createdAt: base.createdAt ?? new Date(now).toISOString()
+  };
+}
+var TOKEN2 = /^[A-Za-z0-9._~+/=-]{1,4096}$/;
+function envToken() {
+  const token = process.env.TUTTICODE_TOKEN?.trim();
+  return token && TOKEN2.test(token) ? token : void 0;
+}
+var expiresWithin = (iso, ms, now) => !iso || !(Date.parse(iso) - now > ms);
+async function resolveToken(origin, deps = {}, options = {}) {
+  const pat = options.envToken === false ? void 0 : envToken();
+  if (pat)
+    return { kind: "pat", accessToken: pat };
+  const now = deps.now ?? Date.now;
+  const stored = readAccount(origin);
+  if (!stored)
+    return { kind: "anonymous" };
+  if (stored.grantExpiresAt && Date.parse(stored.grantExpiresAt) <= now())
+    return { kind: "anonymous", ended: SIGN_IN_EXPIRED };
+  if (!expiresWithin(stored.accessTokenExpiresAt, REFRESH_MARGIN_MS, now()))
+    return { kind: "login", accessToken: stored.accessToken };
+  return withCredentialsLock(async () => {
+    const current = readAccount(origin);
+    if (!current)
+      return { kind: "anonymous" };
+    if (!expiresWithin(current.accessTokenExpiresAt, REFRESH_MARGIN_MS, now()))
+      return { kind: "login", accessToken: current.accessToken };
+    try {
+      const tokens = tokenResponse(
+        await postOAuth(
+          origin,
+          TUTTICODE_OAUTH_PATHS.token,
+          { grant_type: "refresh_token", refresh_token: current.refreshToken },
+          deps
+        )
+      );
+      writeCredentials({
+        version: 1,
+        accounts: {
+          ...readCredentials().accounts,
+          [origin]: storedAccount(tokens, now(), current)
+        }
+      });
+      return { kind: "login", accessToken: tokens.access_token };
+    } catch (e) {
+      if (e instanceof OAuthError)
+        return {
+          kind: "anonymous",
+          ended: e.code === "TUTTICODE_TOKEN_EXPIRED" ? SIGN_IN_EXPIRED : "Your TuttiCode sign-in is no longer valid (signed out on the account page, or replaced): run `tutticode login`."
+        };
+      return { kind: "login", accessToken: current.accessToken };
+    }
+  });
+}
+function bridgeAuth(token, client) {
+  return {
+    ...token.accessToken ? { accessToken: token.accessToken } : {},
+    installId: installId(),
+    cliVersion: VERSION2,
+    client
+  };
+}
+async function accountState(origin, deps = {}, options = {}) {
+  const token = await resolveToken(origin, deps, options);
+  if (!token.accessToken || token.kind === "anonymous")
+    return token.ended ? {
+      state: "rejected",
+      tokenKind: "login",
+      code: "TUTTICODE_TOKEN_EXPIRED",
+      message: token.ended
+    } : { state: "anonymous" };
+  const tokenKind = token.kind;
+  let response;
+  try {
+    response = await request(
+      origin,
+      "/api/tutticode/me",
+      {
+        headers: {
+          Authorization: `Bearer ${token.accessToken}`,
+          Accept: "application/json"
+        }
+      },
+      deps
+    );
+  } catch (e) {
+    return { state: "unreachable", tokenKind, message: e.message };
+  }
+  const body = await jsonBody(response);
+  if (response.ok && isMe(body))
+    return { state: "signed-in", tokenKind, me: body };
+  if (response.status === 401 || response.status === 403)
+    return {
+      state: "rejected",
+      tokenKind,
+      ...typeof body.code === "string" ? { code: body.code } : {},
+      message: typeof body.message === "string" ? body.message : `The server refused the ${tokenKind === "pat" ? "TUTTICODE_TOKEN" : "sign-in"} (${response.status}).`
+    };
+  return {
+    state: "unreachable",
+    tokenKind,
+    message: `${origin}/api/tutticode/me answered ${response.status}.`
+  };
+}
+function isMe(v) {
+  const user = v.user;
+  return typeof user === "object" && user !== null && typeof user.email === "string" && typeof v.plan === "string" && typeof v.limits === "object" && v.limits !== null;
+}
+function accountLimits(state) {
+  if (state.state === "signed-in")
+    return {
+      maxSeconds: state.me.limits.maxSeconds,
+      watermarkAfterSeconds: null
+    };
+  return {
+    maxSeconds: DEFAULT_TUTTICODE_LIMITS.anonMaxSeconds,
+    watermarkAfterSeconds: DEFAULT_TUTTICODE_LIMITS.anonWatermarkAfterSeconds
+  };
+}
+var LOGIN_HINT = {
+  command: TUTTICODE_LOGIN_HINT_COMMAND,
+  note: "A free account lifts the limits. Run the command, ask the user to open the link it prints and approve the code; keep working meanwhile."
+};
+function signedInAs(me) {
+  return `${me.user.email} (TuttiCode, ${me.plan.toLowerCase()})`;
+}
+async function revokeToken(origin, token, deps = {}) {
+  try {
+    const response = await request(
+      origin,
+      TUTTICODE_OAUTH_PATHS.revoke,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          token,
+          client_id: TUTTICODE_CLIENT_ID
+        }).toString()
+      },
+      deps
+    );
+    return response.status < 500;
+  } catch {
+    return false;
+  }
+}
+
 // src/args.ts
 var import_node_util = require("node:util");
 
 // src/output.ts
-var import_node_fs = require("node:fs");
-var import_node_path = require("node:path");
+var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
 var EXIT_OK = 0;
 var EXIT_CODE_ERRORS = 1;
 var EXIT_BRIDGE = 2;
 var EXIT_USAGE = 3;
+var EXIT_ANONYMOUS = 4;
+var EXIT_LIMIT = 5;
+var EXIT_UPGRADE = 6;
 var CODE_ERRORS = /* @__PURE__ */ new Set(["compile", "too-long", "clip"]);
 function exitCodeFor(outcome) {
   switch (outcome.kind) {
     case "checked":
       return outcome.report.ok ? EXIT_OK : EXIT_CODE_ERRORS;
     case "error":
+      if (outcome.code === "limit")
+        return EXIT_LIMIT;
+      if (outcome.code === "upgrade")
+        return EXIT_UPGRADE;
       return CODE_ERRORS.has(outcome.code) ? EXIT_CODE_ERRORS : EXIT_BRIDGE;
     default:
       return EXIT_OK;
@@ -4135,29 +5576,29 @@ function safeFileStem(label) {
   return RESERVED_NAMES.test(cleaned) ? `${cleaned}_` : cleaned;
 }
 function formatFromPath(path) {
-  const ext = (0, import_node_path.extname)(path).slice(1).toLowerCase();
+  const ext = (0, import_node_path3.extname)(path).slice(1).toLowerCase();
   return ext === "wav" || ext === "flac" || ext === "mp3" ? ext : void 0;
 }
 var FORMATS2 = ["wav", "flac", "mp3"];
 function writeFileNoFollow(path, bytes) {
   try {
-    if ((0, import_node_fs.lstatSync)(path).isSymbolicLink())
+    if ((0, import_node_fs3.lstatSync)(path).isSymbolicLink())
       throw new Error(`Refusing to write through the symbolic link ${path}.`);
   } catch (e) {
     if (e.code !== "ENOENT")
       throw e;
   }
-  const fd = (0, import_node_fs.openSync)(
+  const fd = (0, import_node_fs3.openSync)(
     path,
-    import_node_fs.constants.O_WRONLY | import_node_fs.constants.O_CREAT | import_node_fs.constants.O_TRUNC | // POSIX only (undefined on Windows): fail rather than follow a link
+    import_node_fs3.constants.O_WRONLY | import_node_fs3.constants.O_CREAT | import_node_fs3.constants.O_TRUNC | // POSIX only (undefined on Windows): fail rather than follow a link
     // swapped in after the check above.
-    (import_node_fs.constants.O_NOFOLLOW ?? 0)
+    (import_node_fs3.constants.O_NOFOLLOW ?? 0)
   );
   try {
     for (let at = 0; at < bytes.length; )
-      at += (0, import_node_fs.writeSync)(fd, bytes, at, bytes.length - at);
+      at += (0, import_node_fs3.writeSync)(fd, bytes, at, bytes.length - at);
   } finally {
-    (0, import_node_fs.closeSync)(fd);
+    (0, import_node_fs3.closeSync)(fd);
   }
 }
 function writeRender(meta, parts, out, stemsDir) {
@@ -4168,30 +5609,30 @@ function writeRender(meta, parts, out, stemsDir) {
   const mix = parts.get(MIX_PART);
   if (!mix)
     throw new Error("The render has no mix.");
-  const mixPath = (0, import_node_path.resolve)(out);
-  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(mixPath), { recursive: true });
+  const mixPath = (0, import_node_path3.resolve)(out);
+  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(mixPath), { recursive: true });
   writeFileNoFollow(mixPath, mix);
   const stems = {};
   if (meta.stems.length) {
-    const requested = (0, import_node_path.resolve)(
-      stemsDir ?? mixPath.slice(0, mixPath.length - (0, import_node_path.extname)(mixPath).length) + ".stems"
+    const requested = (0, import_node_path3.resolve)(
+      stemsDir ?? mixPath.slice(0, mixPath.length - (0, import_node_path3.extname)(mixPath).length) + ".stems"
     );
-    (0, import_node_fs.mkdirSync)(requested, { recursive: true });
-    const dir = (0, import_node_fs.realpathSync)(requested);
+    (0, import_node_fs3.mkdirSync)(requested, { recursive: true });
+    const dir = (0, import_node_fs3.realpathSync)(requested);
     const used = new Set(
-      [requested, dir].includes((0, import_node_path.dirname)(mixPath)) ? [(0, import_node_path.basename)(mixPath).toLowerCase()] : []
+      [requested, dir].includes((0, import_node_path3.dirname)(mixPath)) ? [(0, import_node_path3.basename)(mixPath).toLowerCase()] : []
     );
     for (const label of meta.stems) {
       const bytes = parts.get(stemPart(label));
       if (!bytes)
         continue;
       const base = safeFileStem(label);
-      let file = `${base}.${meta.format}`;
-      for (let n = 2; used.has(file.toLowerCase()); n++)
-        file = `${base}-${n}.${meta.format}`;
-      used.add(file.toLowerCase());
-      const path = (0, import_node_path.resolve)(dir, file);
-      if ((0, import_node_path.dirname)(path) !== dir || (0, import_node_path.basename)(path) !== file)
+      let file2 = `${base}.${meta.format}`;
+      for (let n = 2; used.has(file2.toLowerCase()); n++)
+        file2 = `${base}-${n}.${meta.format}`;
+      used.add(file2.toLowerCase());
+      const path = (0, import_node_path3.resolve)(dir, file2);
+      if ((0, import_node_path3.dirname)(path) !== dir || (0, import_node_path3.basename)(path) !== file2)
         throw new Error(`Refusing to write a stem outside ${dir}.`);
       writeFileNoFollow(path, bytes);
       stems[label] = path;
@@ -4200,11 +5641,11 @@ function writeRender(meta, parts, out, stemsDir) {
   return { mix: mixPath, stems };
 }
 var fixed = (n, digits = 1) => Number.isFinite(n) ? n.toFixed(digits) : String(n);
-function formatDiagnostics(report, file) {
+function formatDiagnostics(report, file2) {
   const lines = [];
   for (const d of report.diagnostics) {
     lines.push(
-      `${file}:${d.line}:${d.col} ${d.severity} ${d.code}  ${d.message}`
+      `${file2}:${d.line}:${d.col} ${d.severity} ${d.code}  ${d.message}`
     );
     if (d.snippet)
       lines.push(`    ${d.snippet}`);
@@ -4231,92 +5672,46 @@ function formatRenderSummary(meta, files) {
     `Wrote ${files.mix} (${fixed(meta.seconds)} s, ${meta.bars} bars at ${fixed(
       meta.bpm,
       0
-    )} BPM, ${fixed(meta.lufs)} LUFS, ${fixed(meta.truePeak)} dBTP${gain}${limited})`
+    )} BPM, ${fixed(meta.lufs)} LUFS, ${fixed(
+      meta.truePeak
+    )} dBTP${gain}${limited})`
   ];
   for (const warning of meta.warnings ?? [])
     lines.push(`Note: ${warning}`);
   const stems = Object.values(files.stems);
   if (stems.length)
-    lines.push(`Stems: ${stems.length} files in ${(0, import_node_path.dirname)(stems[0])}`);
+    lines.push(`Stems: ${stems.length} files in ${(0, import_node_path3.dirname)(stems[0])}`);
   lines.push(`Edit in TuttiDAW: ${meta.editUrl}`);
   return lines;
 }
+var WATERMARK_LINE = "Voice tag 'register at TuttiDAW' mixed in throughout this render (renders over 30 s without sign-in); the stats include it. Remove it: tutticode login (free)";
+
+// src/server.ts
+var import_node_crypto2 = require("node:crypto");
+var import_node_http = require("node:http");
+
+// ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/wrapper.mjs
+var import_stream = __toESM(require_stream(), 1);
+var import_extension = __toESM(require_extension(), 1);
+var import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
+var import_receiver = __toESM(require_receiver(), 1);
+var import_sender = __toESM(require_sender(), 1);
+var import_subprotocol = __toESM(require_subprotocol(), 1);
+var import_websocket = __toESM(require_websocket(), 1);
+var import_websocket_server = __toESM(require_websocket_server(), 1);
+var wrapper_default = import_websocket.default;
 
 // src/server.ts
-var import_node_crypto = require("node:crypto");
-var import_node_http = require("node:http");
-
-// ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/wrapper.mjs
-var import_stream = __toESM(require_stream(), 1);
-var import_extension = __toESM(require_extension(), 1);
-var import_permessage_deflate = __toESM(require_permessage_deflate(), 1);
-var import_receiver = __toESM(require_receiver(), 1);
-var import_sender = __toESM(require_sender(), 1);
-var import_subprotocol = __toESM(require_subprotocol(), 1);
-var import_websocket = __toESM(require_websocket(), 1);
-var import_websocket_server = __toESM(require_websocket_server(), 1);
-var wrapper_default = import_websocket.default;
-
-// src/env.ts
-var import_node_fs2 = require("node:fs");
-var import_node_os = require("node:os");
-var import_node_path2 = require("node:path");
-var VERSION = true ? "0.1.1" : readPackageVersion();
-function envBrowserArgs() {
-  const args = process.env.TUTTICODE_BROWSER_ARGS?.split(" ").filter(Boolean);
-  return args?.length ? args : void 0;
-}
-function stateDir() {
-  const dir = process.env.TUTTICODE_HOME || (0, import_node_path2.join)((0, import_node_os.homedir)(), ".tutticode");
-  (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
-  return dir;
-}
-var assetsDir;
-function skillsDir() {
-  return process.env.TUTTICODE_SKILLS_DIR || assetsDir || // Running from the sources (tests): the app's public skills.
-  (0, import_node_path2.join)(__dirname, "..", "..", "..", "public", "skills");
-}
-function setSkillsDir(dir) {
-  assetsDir = dir;
-}
-var LOG_ROLL_BYTES = 2 * 1024 * 1024;
-function createLogger(name, verbose) {
-  let file;
-  try {
-    const dir = (0, import_node_path2.join)(stateDir(), "logs");
-    (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
-    file = (0, import_node_path2.join)(dir, `${name}.log`);
-    if (((0, import_node_fs2.statSync)(file, { throwIfNoEntry: false })?.size ?? 0) > LOG_ROLL_BYTES)
-      (0, import_node_fs2.renameSync)(file, `${file}.1`);
-  } catch {
-    file = void 0;
-  }
-  return (level2, message) => {
-    const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${level2} [${process.pid}] ${message}`;
-    if (verbose || level2 === "error")
-      process.stderr.write(`tutticode: ${message}
-`);
-    if (!file)
-      return;
-    try {
-      (0, import_node_fs2.appendFileSync)(file, `${line}
-`);
-    } catch {
-    }
-  };
-}
-
-// src/server.ts
 var CONTROL_PATH = "/control";
 function newToken() {
-  return (0, import_node_crypto.randomBytes)(16).toString("base64url");
+  return (0, import_node_crypto2.randomBytes)(16).toString("base64url");
 }
 function tokensEqual(expected, presented) {
   if (typeof presented !== "string")
     return false;
   const a = Buffer.from(expected);
   const b = Buffer.from(presented);
-  return a.length === b.length && (0, import_node_crypto.timingSafeEqual)(a, b);
+  return a.length === b.length && (0, import_node_crypto2.timingSafeEqual)(a, b);
 }
 function normalizeOrigin(value) {
   try {
@@ -4408,7 +5803,7 @@ var BridgeServer = class {
       return res.end(
         JSON.stringify({
           name: "tutticode",
-          version: VERSION,
+          version: VERSION2,
           protocol: BRIDGE_PROTOCOL
         })
       );
@@ -4472,6 +5867,21 @@ function pathOf(req) {
 // src/args.ts
 var UsageError = class extends Error {
 };
+var accountOptions = {
+  origin: { type: "string" },
+  locale: { type: "string" },
+  verbose: { type: "boolean", short: "v" }
+};
+function accountFlags(values) {
+  const origin = values.origin;
+  if (origin !== void 0 && !normalizeOrigin(origin))
+    throw new UsageError(`--origin must be an http(s) origin (got ${origin}).`);
+  return {
+    origin,
+    locale: values.locale,
+    verbose: !!values.verbose
+  };
+}
 var bridgeOptions = {
   origin: { type: "string" },
   "dev-origin": { type: "string", multiple: true },
@@ -4598,7 +6008,8 @@ function parseCli(argv) {
     case "doctor": {
       const { values, positionals } = parse(rest, {
         ...bridgeOptions,
-        json: { type: "boolean" }
+        json: { type: "boolean" },
+        fix: { type: "boolean" }
       });
       if (values.help)
         return { name: "help", topic: "doctor" };
@@ -4607,9 +6018,56 @@ function parseCli(argv) {
       return {
         name: "doctor",
         json: !!values.json,
+        fix: !!values.fix,
         bridge: bridgeFlags(values)
       };
     }
+    case "login": {
+      const { values, positionals } = parse(rest, {
+        ...accountOptions,
+        device: { type: "boolean" },
+        "no-wait": { type: "boolean" },
+        json: { type: "boolean" }
+      });
+      if (values.help)
+        return { name: "help", topic: "login" };
+      if (positionals.length)
+        throw new UsageError("login takes no arguments.");
+      const noWait = !!values["no-wait"];
+      if (values.json && !noWait)
+        throw new UsageError("--json goes with --device --no-wait.");
+      return {
+        name: "login",
+        // Only the device grant can finish without this process.
+        device: !!values.device || noWait,
+        noWait,
+        json: !!values.json,
+        account: accountFlags(values)
+      };
+    }
+    case "logout": {
+      const { values, positionals } = parse(rest, accountOptions);
+      if (values.help)
+        return { name: "help", topic: "logout" };
+      if (positionals.length)
+        throw new UsageError("logout takes no arguments.");
+      return { name: "logout", account: accountFlags(values) };
+    }
+    case "whoami": {
+      const { values, positionals } = parse(rest, {
+        ...accountOptions,
+        json: { type: "boolean" }
+      });
+      if (values.help)
+        return { name: "help", topic: "whoami" };
+      if (positionals.length)
+        throw new UsageError("whoami takes no arguments.");
+      return {
+        name: "whoami",
+        json: !!values.json,
+        account: accountFlags(values)
+      };
+    }
     case "setup": {
       const { values, positionals } = parse(rest, {
         yes: { type: "boolean", short: "y" },
@@ -4654,6 +6112,8 @@ function parseCli(argv) {
     }
     case "__daemon":
       return { name: "daemon", config: rest[0] ?? "" };
+    case "__login-poll":
+      return { name: "login-poll", file: rest[0] ?? "" };
     default:
       throw new UsageError(`Unknown command ${name}. Run tutticode --help.`);
   }
@@ -4677,11 +6137,12 @@ function parseRender(rest) {
     "true-peak": { type: "string" },
     limit: { type: "boolean" },
     "no-analyze": { type: "boolean" },
+    "no-brand-tag": { type: "boolean" },
     json: { type: "boolean" }
   });
   if (values.help)
     return { name: "help", topic: "render" };
-  const file = oneFile(positionals, "render");
+  const file2 = oneFile(positionals, "render");
   const out = values.out;
   if (!out)
     throw new UsageError(
@@ -4731,11 +6192,12 @@ function parseRender(rest) {
     ...optional2("lufs", number(values, "lufs", -40, -5)),
     ...optional2("truePeak", number(values, "true-peak", -12, 0)),
     ...values.limit ? { limit: true } : {},
-    ...values["no-analyze"] ? { analyze: false } : {}
+    ...values["no-analyze"] ? { analyze: false } : {},
+    ...values["no-brand-tag"] ? { brandTag: false } : {}
   };
   return {
     name: "render",
-    file,
+    file: file2,
     out,
     stemsDir: values.stems,
     json: !!values.json,
@@ -4755,10 +6217,19 @@ Usage:
   tutticode open <file|->             open the program in TuttiCode
   tutticode mcp                       MCP stdio server (code_check, code_render, ...)
   tutticode doctor                    is everything in place?
+  tutticode login                     sign in (free): longer renders, no voice tag
+  tutticode logout                    sign out on this computer
+  tutticode whoami                    who renders, with which limits
   tutticode setup                     optional browser policy + skills
   tutticode skills install            install the agent skills
 
-Exit codes: 0 ok, 1 errors in the code, 2 bridge/browser problem, 3 usage.
+Once TuttiDAW switches its limits on (being rolled out), renders without
+sign-in are limited to 60 s, and renders over 30 s carry a spoken "register
+at TuttiDAW" tag. TUTTICODE_TOKEN (an access token from the
+account page) signs in CI.
+
+Exit codes: 0 ok, 1 errors in the code, 2 bridge/browser problem, 3 usage,
+4 not signed in (whoami), 5 over a limit without sign-in, 6 upgrade tutticode.
 Run tutticode <command> --help for its flags.`,
   check: `tutticode check <file|-> [--bpm N] [--json] [bridge flags]
 
@@ -4782,6 +6253,8 @@ program has errors.`,
   --limit                              true-peak limiter instead of failing
                                        (clip) or lowering; reported
   --no-analyze                         skip the per-voice analysis
+  --no-brand-tag                       no "Made with TuttiCode" file metadata
+                                       (signed in only; TUTTICODE_BRAND_TAG=0)
   --json                               print the RenderMeta + written files
   --timeout S                          give up after S seconds (default 600)`,
   open: `tutticode open <file|-> [bridge flags]
@@ -4791,11 +6264,34 @@ Opens the program in a visible TuttiCode tab (tuttidaw.com/code). With
   mcp: `tutticode mcp [bridge flags]
 
 MCP stdio server: code_check, code_render, code_compare, code_open,
-code_reference; resources = the TuttiCode skill references.
+code_reference, code_account; resources = the TuttiCode skill references.
+Signs the page in like the CLI (tutticode login, or TUTTICODE_TOKEN).
   claude mcp add tutticode -- tutticode mcp`,
-  doctor: `tutticode doctor [--json] [bridge flags]
+  doctor: `tutticode doctor [--json] [--fix] [bridge flags]
+
+Checks the browser, the page and the connection, prints the engine version
+and who renders (signed in / anonymous, the credentials file's permissions).
+--fix makes the credentials file private again.`,
+  login: `tutticode login [--device [--no-wait] [--json]] [--origin <url>] [--locale <l>]
+
+Signs in with a free TuttiDAW account: renders up to 5 minutes, no voice tag.
+Opens your browser; approve there and come back. The sign-in can only render
+with TuttiCode (it cannot open your projects, account or billing) and lasts a
+year.
+  --device     no browser here (SSH, a server): prints a code to approve at
+               tuttidaw.com/code/activate on any device
+  --no-wait    with --device: print the code and return at once; tutticode
+               finishes the sign-in in the background once it is approved.
+               For agents: tutticode login --device --no-wait --json
+Needs a terminal unless --no-wait.`,
+  logout: `tutticode logout [--origin <url>]
+
+Signs this computer out (revokes its sign-in) and deletes the stored
+credentials. Other devices and access tokens: the account page.`,
+  whoami: `tutticode whoami [--json] [--origin <url>]
 
-Checks the browser, the page and the connection, and prints the engine version.`,
+Who renders: the masked email, plan, limits and today's usage. Exit 0 signed
+in, 4 not signed in, 2 when the sign-in was rejected.`,
   setup: `tutticode setup [--yes] [--undo] [--no-skills]
 
 Optionally lets tuttidaw.com reach tutticode in your everyday Chrome / Edge
@@ -4817,10 +6313,10 @@ agent found under your home directory).`,
 };
 
 // src/browser.ts
-var import_node_child_process = require("node:child_process");
-var import_node_fs3 = require("node:fs");
-var import_node_os2 = require("node:os");
-var import_node_path3 = require("node:path");
+var import_node_child_process2 = require("node:child_process");
+var import_node_fs4 = require("node:fs");
+var import_node_os3 = require("node:os");
+var import_node_path4 = require("node:path");
 
 // src/cdp.ts
 var import_node_events = require("node:events");
@@ -4925,8 +6421,8 @@ var CdpClient = class extends import_node_events.EventEmitter {
 var hostPlatform = () => ({
   platform: process.platform,
   env: process.env,
-  home: (0, import_node_os2.homedir)(),
-  exists: import_node_fs3.existsSync
+  home: (0, import_node_os3.homedir)(),
+  exists: import_node_fs4.existsSync
 });
 function browserCandidates(p = hostPlatform()) {
   if (p.platform === "win32") {
@@ -4938,20 +6434,20 @@ function browserCandidates(p = hostPlatform()) {
     return [
       ...roots.map((r2) => ({
         kind: "chrome",
-        path: (0, import_node_path3.join)(r2, "Google", "Chrome", "Application", "chrome.exe")
+        path: (0, import_node_path4.join)(r2, "Google", "Chrome", "Application", "chrome.exe")
       })),
       ...roots.map((r2) => ({
         kind: "edge",
-        path: (0, import_node_path3.join)(r2, "Microsoft", "Edge", "Application", "msedge.exe")
+        path: (0, import_node_path4.join)(r2, "Microsoft", "Edge", "Application", "msedge.exe")
       }))
     ];
   }
   if (p.platform === "darwin") {
-    const apps = ["/Applications", (0, import_node_path3.join)(p.home, "Applications")];
+    const apps = ["/Applications", (0, import_node_path4.join)(p.home, "Applications")];
     return [
       ...apps.map((a) => ({
         kind: "chrome",
-        path: (0, import_node_path3.join)(
+        path: (0, import_node_path4.join)(
           a,
           "Google Chrome.app",
           "Contents",
@@ -4961,7 +6457,7 @@ function browserCandidates(p = hostPlatform()) {
       })),
       ...apps.map((a) => ({
         kind: "edge",
-        path: (0, import_node_path3.join)(
+        path: (0, import_node_path4.join)(
           a,
           "Microsoft Edge.app",
           "Contents",
@@ -4971,7 +6467,7 @@ function browserCandidates(p = hostPlatform()) {
       })),
       ...apps.map((a) => ({
         kind: "chromium",
-        path: (0, import_node_path3.join)(a, "Chromium.app", "Contents", "MacOS", "Chromium")
+        path: (0, import_node_path4.join)(a, "Chromium.app", "Contents", "MacOS", "Chromium")
       }))
     ];
   }
@@ -4985,7 +6481,7 @@ function browserCandidates(p = hostPlatform()) {
     ["chromium", "chromium-browser"]
   ];
   return names.flatMap(
-    ([kind, name]) => dirs.map((d) => ({ kind, path: (0, import_node_path3.join)(d, name) }))
+    ([kind, name]) => dirs.map((d) => ({ kind, path: (0, import_node_path4.join)(d, name) }))
   );
 }
 function findBrowser(wanted, p = hostPlatform()) {
@@ -5004,7 +6500,7 @@ function findBrowser(wanted, p = hostPlatform()) {
 }
 function openExternal(url) {
   const [command, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-  const child = (0, import_node_child_process.spawn)(command, args, {
+  const child = (0, import_node_child_process2.spawn)(command, args, {
     detached: true,
     stdio: "ignore",
     windowsHide: true
@@ -5106,7 +6602,7 @@ var HeadlessBrowser = class {
       }
     }
     if (this.tempProfile) {
-      (0, import_node_fs3.rmSync)(this.tempProfile, { recursive: true, force: true });
+      (0, import_node_fs4.rmSync)(this.tempProfile, { recursive: true, force: true });
       this.tempProfile = void 0;
     }
   }
@@ -5114,8 +6610,8 @@ var HeadlessBrowser = class {
     await this.close();
     this.consoleLines = [];
     const { browser, log } = this.options;
-    const shared = this.options.profileDir ?? (0, import_node_path3.join)(stateDir(), "browser-profile");
-    (0, import_node_fs3.mkdirSync)(shared, { recursive: true });
+    const shared = this.options.profileDir ?? (0, import_node_path4.join)(stateDir(), "browser-profile");
+    (0, import_node_fs4.mkdirSync)(shared, { recursive: true });
     try {
       this.cdp = await this.spawnBrowser(shared);
     } catch (e) {
@@ -5123,7 +6619,7 @@ var HeadlessBrowser = class {
         "warn",
         `shared browser profile unavailable (${e.message}); using a temporary one`
       );
-      this.tempProfile = (0, import_node_fs3.mkdtempSync)((0, import_node_path3.join)((0, import_node_os2.tmpdir)(), "tutticode-profile-"));
+      this.tempProfile = (0, import_node_fs4.mkdtempSync)((0, import_node_path4.join)((0, import_node_os3.tmpdir)(), "tutticode-profile-"));
       this.cdp = await this.spawnBrowser(this.tempProfile);
     }
     this.cdp.on("event", (event) => this.onEvent(event));
@@ -5159,7 +6655,7 @@ var HeadlessBrowser = class {
       "about:blank"
     ];
     return new Promise((resolve3, reject) => {
-      const child = (0, import_node_child_process.spawn)(browser.path, args, {
+      const child = (0, import_node_child_process2.spawn)(browser.path, args, {
         // fd 3: commands to the browser, fd 4: its replies and events.
         stdio: ["ignore", "ignore", "pipe", "pipe", "pipe"],
         windowsHide: true
@@ -5276,7 +6772,7 @@ function remoteDebuggingFree(args) {
 var delay = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function killTree(child) {
   if (process.platform === "win32" && child.pid)
-    (0, import_node_child_process.spawnSync)("taskkill", ["/T", "/F", "/PID", String(child.pid)], {
+    (0, import_node_child_process2.spawnSync)("taskkill", ["/T", "/F", "/PID", String(child.pid)], {
       windowsHide: true
     });
   else
@@ -5284,18 +6780,19 @@ function killTree(child) {
 }
 
 // src/daemon.ts
-var import_node_child_process2 = require("node:child_process");
-var import_node_crypto3 = require("node:crypto");
-var import_node_fs4 = require("node:fs");
-var import_node_path4 = require("node:path");
+var import_node_child_process3 = require("node:child_process");
+var import_node_crypto4 = require("node:crypto");
+var import_node_fs5 = require("node:fs");
+var import_node_path5 = require("node:path");
 
 // src/session.ts
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 var import_node_events3 = require("node:events");
 
 // src/page-link.ts
 var import_node_events2 = require("node:events");
 var HELLO_TIMEOUT_MS = 15e3;
+var AUTH_TIMEOUT_MS = 1e4;
 var CANCEL_GRACE_MS = 5e3;
 function maxPartBytes(meta) {
   return Math.ceil((meta.seconds + 1) * meta.sampleRate) * 2 * 4 + 1024 * 1024;
@@ -5349,6 +6846,16 @@ var PageLink = class extends import_node_events2.EventEmitter {
   drain;
   closedReason;
   readyPromise;
+  /** The token ('' = anonymous) of the last `auth` the page took. */
+  authKey;
+  authStatus;
+  /** The page refused `auth` itself: stop sending it. */
+  authUnsupported = false;
+  /** The page's last `error auth` message. */
+  authError;
+  /** Tokens the page refused -> its message. */
+  refused = /* @__PURE__ */ new Map();
+  authWait;
   get open() {
     return this.closedReason === void 0;
   }
@@ -5360,6 +6867,73 @@ var PageLink = class extends import_node_events2.EventEmitter {
   get busy() {
     return !!this.current || !!this.drain;
   }
+  /**
+   * Sends `auth` unless this socket already carries the same token, and
+   * waits for the page's verdict. A token the page refuses is dropped: the
+   * socket signs in anonymously and the status says why. Never rejects.
+   */
+  async authenticate(auth, timeoutMs = AUTH_TIMEOUT_MS) {
+    if (this.authUnsupported)
+      return { signedIn: false, unsupported: true };
+    const refused = auth.accessToken && this.refused.get(auth.accessToken);
+    if (refused) {
+      const { accessToken: _dropped2, ...anonymous2 } = auth;
+      return {
+        ...await this.authenticate(anonymous2, timeoutMs),
+        rejected: refused
+      };
+    }
+    const key = auth.accessToken ?? "";
+    if (this.authKey === key && this.authStatus)
+      return this.authStatus;
+    this.authError = void 0;
+    const answer = await this.sendAuth(auth, timeoutMs);
+    if (answer !== "hello") {
+      if (answer !== "closed") {
+        this.authUnsupported = true;
+        this.log(
+          "warn",
+          answer === "protocol" ? "the page does not know auth: rendering anonymously" : "the page did not answer auth: rendering anonymously"
+        );
+      }
+      return { signedIn: false, unsupported: true };
+    }
+    const signedIn = !!this.hello?.signedIn;
+    if (!auth.accessToken || signedIn) {
+      this.authKey = key;
+      return this.authStatus = { signedIn };
+    }
+    const rejected = this.authError ?? "The page did not accept the sign-in.";
+    this.log("warn", `page refused the sign-in: ${rejected}`);
+    this.refused.set(auth.accessToken, rejected);
+    const { accessToken: _dropped, ...anonymous } = auth;
+    const again = await this.sendAuth(anonymous, timeoutMs);
+    if (again === "hello") {
+      this.authKey = "";
+      this.authStatus = { signedIn: !!this.hello?.signedIn };
+    }
+    return { signedIn: again === "hello" && !!this.hello?.signedIn, rejected };
+  }
+  sendAuth(auth, timeoutMs) {
+    if (!this.open)
+      return Promise.resolve("closed");
+    return new Promise((resolve3) => {
+      const done = (answer) => {
+        clearTimeout(timer);
+        this.off("close", onClose);
+        this.authWait = void 0;
+        resolve3(answer);
+      };
+      const onClose = () => done("closed");
+      const timer = setTimeout(() => done("timeout"), timeoutMs);
+      this.once("close", onClose);
+      this.authWait = (answer) => {
+        if (answer !== "auth")
+          done(answer);
+      };
+      this.send({ type: "auth", ...auth });
+    });
+  }
   /** Runs one command. Never rejects: failures are an `error` outcome. */
   async run(command, options) {
     if (!this.open)
@@ -5475,8 +7049,13 @@ var PageLink = class extends import_node_events2.EventEmitter {
   }
   onMessage(message) {
     if (message.type === "hello") {
-      if (this.hello)
+      if (this.hello) {
+        if (message.protocol === BRIDGE_PROTOCOL) {
+          this.hello = message;
+          this.authWait?.("hello");
+        }
         return;
+      }
       if (message.protocol !== BRIDGE_PROTOCOL) {
         const why = `The page speaks bridge protocol ${message.protocol}, this tutticode speaks ${BRIDGE_PROTOCOL}: update tutticode (npm i -g tutticode@latest).`;
         this.emit("bad-hello", why);
@@ -5496,6 +7075,20 @@ var PageLink = class extends import_node_events2.EventEmitter {
       return;
     }
     const running = this.current;
+    if (message.type === "error" && id === void 0 && message.code === "auth") {
+      this.log("warn", `page error auth: ${message.message}`);
+      this.authError = message.message;
+      if (this.authKey) {
+        this.authKey = void 0;
+        this.authStatus = void 0;
+      }
+      this.authWait?.("auth");
+      return;
+    }
+    if (message.type === "error" && id === void 0 && this.authWait) {
+      this.log("warn", `page error ${message.code}: ${message.message}`);
+      return this.authWait("protocol");
+    }
     if (message.type === "error" && id === void 0) {
       this.log("warn", `page error ${message.code}: ${message.message}`);
       return this.fail(message.code, message.message, message.report);
@@ -5531,7 +7124,8 @@ var PageLink = class extends import_node_events2.EventEmitter {
           kind: "error",
           code: message.code,
           message: message.message,
-          ...message.report ? { report: message.report } : {}
+          ...message.report ? { report: message.report } : {},
+          ...message.limit ? { limit: message.limit } : {}
         });
       case "done": {
         if (!running.meta)
@@ -5663,7 +7257,13 @@ var Session = class extends import_node_events3.EventEmitter {
     const job = this.queue.then(async () => {
       try {
         const link = await this.ensurePage(options.signal);
-        return await link.run(command, options);
+        if (!options.auth)
+          return await link.run(command, options);
+        const auth = await link.authenticate(
+          options.auth,
+          this.options.authTimeoutMs
+        );
+        return { ...await link.run(command, options), auth };
       } catch (e) {
         if (e instanceof BridgeError)
           return { kind: "error", code: e.code, message: e.message };
@@ -5811,14 +7411,14 @@ Page console:
 // src/daemon.ts
 function daemonKey(config) {
   const { verbose: _verbose, ...identity } = config;
-  return (0, import_node_crypto3.createHash)("sha256").update(
+  return (0, import_node_crypto4.createHash)("sha256").update(
     JSON.stringify({
       ...identity,
       devOrigins: [...config.devOrigins ?? []].sort()
     })
   ).digest("hex").slice(0, 12);
 }
-var daemonFile = (key) => (0, import_node_path4.join)(stateDir(), `daemon-${key}.json`);
+var daemonFile = (key) => (0, import_node_path5.join)(stateDir(), `daemon-${key}.json`);
 async function runDaemon(config, log) {
   const controlToken = newToken();
   let active = 0;
@@ -5846,22 +7446,22 @@ async function runDaemon(config, log) {
   const session = new Session(options);
   const port = await session.start();
   const key = daemonKey(config);
-  const file = {
+  const file2 = {
     pid: process.pid,
     port,
     token: controlToken,
-    version: VERSION
+    version: VERSION2
   };
-  (0, import_node_fs4.writeFileSync)(daemonFile(key), JSON.stringify(file), { mode: 384 });
+  (0, import_node_fs5.writeFileSync)(daemonFile(key), JSON.stringify(file2), { mode: 384 });
   log("info", `daemon ${key} listening on 127.0.0.1:${port} (${config.mode})`);
   const shutdown = async (why) => {
     log("info", `daemon exiting: ${why}`);
     try {
       const current = JSON.parse(
-        (0, import_node_fs4.readFileSync)(daemonFile(key), "utf8")
+        (0, import_node_fs5.readFileSync)(daemonFile(key), "utf8")
       );
       if (current.pid === process.pid)
-        (0, import_node_fs4.rmSync)(daemonFile(key), { force: true });
+        (0, import_node_fs5.rmSync)(daemonFile(key), { force: true });
     } catch {
     }
     await session.close();
@@ -5882,14 +7482,14 @@ function serveControl(socket, session, setStatusSink) {
       socket.send(JSON.stringify(value));
   };
   socket.once("message", async (data) => {
-    let request;
+    let request2;
     try {
-      request = JSON.parse(String(data));
+      request2 = JSON.parse(String(data));
     } catch {
       return socket.close(1008, "bad request");
     }
     setStatusSink((message) => send({ type: "status", message }));
-    if (request.type === "info") {
+    if (request2.type === "info") {
       try {
         await session.ensurePage(abort.signal);
         send({
@@ -5912,28 +7512,33 @@ function serveControl(socket, session, setStatusSink) {
       }
       return socket.close(1e3);
     }
-    if (request.type !== "run" || !request.command)
+    if (request2.type !== "run" || !request2.command)
       return socket.close(1008, "bad request");
-    const outcome = await session.run(request.command, {
-      timeoutMs: request.timeoutMs ?? 6e5,
+    const outcome = await session.run(request2.command, {
+      timeoutMs: request2.timeoutMs ?? 6e5,
       signal: abort.signal,
-      onProgress: (progress) => send(progress)
+      onProgress: (progress) => send(progress),
+      ...request2.auth ? { auth: request2.auth } : {}
     });
     if (outcome.kind === "rendered") {
-      const id = request.command.type === "open" ? "open" : request.command.id;
+      const id = request2.command.type === "open" ? "open" : request2.command.id;
       for (const [part, bytes] of outcome.parts)
         for (const frame of frameParts(id, part, bytes))
           socket.send(frame);
       send({
         type: "result",
-        outcome: { kind: "rendered", meta: outcome.meta }
+        outcome: {
+          kind: "rendered",
+          meta: outcome.meta,
+          ...outcome.auth ? { auth: outcome.auth } : {}
+        }
       });
     } else
       send({ type: "result", outcome });
     socket.close(1e3);
   });
 }
-async function runViaDaemon(options, command, timeoutMs, callbacks = {}) {
+async function runViaDaemon(options, command, timeoutMs, callbacks = {}, auth) {
   let socket;
   try {
     socket = await connectDaemon(options);
@@ -5942,7 +7547,7 @@ async function runViaDaemon(options, command, timeoutMs, callbacks = {}) {
   }
   return controlCall(
     socket,
-    { type: "run", command, timeoutMs },
+    { type: "run", command, timeoutMs, ...auth ? { auth } : {} },
     callbacks
   );
 }
@@ -5955,7 +7560,7 @@ async function daemonInfo(options, callbacks = {}) {
   }
   return controlCall(socket, { type: "info" }, callbacks);
 }
-function controlCall(socket, request, callbacks) {
+function controlCall(socket, request2, callbacks) {
   return new Promise((resolve3) => {
     const assembler = new PartAssembler();
     const parts = /* @__PURE__ */ new Map();
@@ -6014,7 +7619,7 @@ function controlCall(socket, request, callbacks) {
       })
     );
     socket.on("error", () => void 0);
-    socket.send(JSON.stringify(request));
+    socket.send(JSON.stringify(request2));
   });
 }
 function openControlSocket(port, token, timeoutMs = 3e3) {
@@ -6031,7 +7636,7 @@ function openControlSocket(port, token, timeoutMs = 3e3) {
 }
 function readDaemonFile(key) {
   try {
-    return JSON.parse((0, import_node_fs4.readFileSync)(daemonFile(key), "utf8"));
+    return JSON.parse((0, import_node_fs5.readFileSync)(daemonFile(key), "utf8"));
   } catch {
     return void 0;
   }
@@ -6043,7 +7648,7 @@ async function connectDaemon({
 }) {
   const key = daemonKey(config);
   const existing = readDaemonFile(key);
-  if (existing && existing.version === VERSION) {
+  if (existing && existing.version === VERSION2) {
     try {
       return await openControlSocket(existing.port, existing.token);
     } catch {
@@ -6053,11 +7658,11 @@ async function connectDaemon({
       );
     }
   }
-  const lock = (0, import_node_path4.join)(stateDir(), `daemon-${key}.lock`);
-  const owner = (0, import_node_crypto3.randomUUID)();
-  if (takeLock(lock, owner)) {
+  const lock = (0, import_node_path5.join)(stateDir(), `daemon-${key}.lock`);
+  const owner = (0, import_node_crypto4.randomUUID)();
+  if (takeLock2(lock, owner)) {
     try {
-      const child = (0, import_node_child_process2.spawn)(
+      const child = (0, import_node_child_process3.spawn)(
         process.execPath,
         [
           entry,
@@ -6070,19 +7675,19 @@ async function connectDaemon({
       log("info", `spawned daemon ${key} (pid ${child.pid})`);
       return await waitForDaemon(key, existing?.pid, child.pid);
     } finally {
-      (0, import_node_fs4.rmSync)(lock, { force: true });
+      (0, import_node_fs5.rmSync)(lock, { force: true });
     }
   }
   return waitForDaemon(key, existing?.pid);
 }
-function takeLock(lock, owner) {
+function takeLock2(lock, owner) {
   try {
-    const age = Date.now() - ((0, import_node_fs4.statSync)(lock, { throwIfNoEntry: false })?.mtimeMs ?? 0);
+    const age = Date.now() - ((0, import_node_fs5.statSync)(lock, { throwIfNoEntry: false })?.mtimeMs ?? 0);
     if (age > 2e4)
-      (0, import_node_fs4.rmSync)(lock, { force: true });
-    const fd = (0, import_node_fs4.openSync)(lock, "wx");
-    (0, import_node_fs4.writeFileSync)(fd, owner);
-    (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.rmSync)(lock, { force: true });
+    const fd = (0, import_node_fs5.openSync)(lock, "wx");
+    (0, import_node_fs5.writeFileSync)(fd, owner);
+    (0, import_node_fs5.closeSync)(fd);
     return true;
   } catch {
     return false;
@@ -6091,10 +7696,10 @@ function takeLock(lock, owner) {
 async function waitForDaemon(key, stalePid, newPid) {
   const deadline = Date.now() + 15e3;
   while (Date.now() < deadline) {
-    const file = readDaemonFile(key);
-    if (file && file.pid !== stalePid && (newPid === void 0 || file.pid === newPid) && file.version === VERSION) {
+    const file2 = readDaemonFile(key);
+    if (file2 && file2.pid !== stalePid && (newPid === void 0 || file2.pid === newPid) && file2.version === VERSION2) {
       try {
-        return await openControlSocket(file.port, file.token);
+        return await openControlSocket(file2.port, file2.token);
       } catch {
       }
     }
@@ -6105,6 +7710,370 @@ async function waitForDaemon(key, stalePid, newPid) {
   );
 }
 
+// src/login.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_crypto5 = require("node:crypto");
+var import_node_fs6 = require("node:fs");
+var import_node_http2 = require("node:http");
+var import_node_path6 = require("node:path");
+var LoginError = class extends Error {
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+};
+var LOOPBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+function sitePage(origin, locale, path) {
+  return `${origin}${locale === "en" ? "" : `/${locale}`}${path}`;
+}
+function pkcePair() {
+  const verifier = (0, import_node_crypto5.randomBytes)(32).toString("base64url");
+  const challenge = (0, import_node_crypto5.createHash)("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function loginUrl(options) {
+  const url = new URL(
+    sitePage(options.origin, options.locale, TUTTICODE_OAUTH_PATHS.login)
+  );
+  url.search = new URLSearchParams({
+    client_id: TUTTICODE_CLIENT_ID,
+    redirect_uri: options.redirectUri,
+    code_challenge: options.challenge,
+    code_challenge_method: "S256",
+    state: options.state,
+    scope: TUTTICODE_SCOPE,
+    resource: tutticodeResourceUrl(options.origin),
+    device_name: options.deviceName
+  }).toString();
+  return url.toString();
+}
+var page = (title, text) => `<!doctype html><meta charset="utf-8"><title>${title}</title><p>${text}</p>`;
+async function startLoopback(options) {
+  let resolveCode;
+  let rejectCode;
+  const code = new Promise((resolve3, reject) => {
+    resolveCode = resolve3;
+    rejectCode = reject;
+  });
+  code.catch(() => void 0);
+  let settled = false;
+  const finish = (fn) => {
+    if (settled)
+      return;
+    settled = true;
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", onAbort);
+    fn();
+    setImmediate(() => server.close());
+  };
+  const server = (0, import_node_http2.createServer)((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (req.method !== "GET" || url.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
+    }
+    const params = url.searchParams;
+    if (settled || params.get("state") !== options.state) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(
+        page(
+          "TuttiCode",
+          "This sign-in link does not belong to the running tutticode login. Run tutticode login again."
+        )
+      );
+      return;
+    }
+    const error = params.get("error");
+    if (error) {
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(page("TuttiCode", "Sign-in cancelled. You can close this tab."));
+      finish(
+        () => rejectCode(
+          error === "access_denied" ? new LoginError(
+            "denied",
+            "The sign-in was cancelled in the browser."
+          ) : new LoginError("server", `The sign-in failed (${error}).`)
+        )
+      );
+      return;
+    }
+    if (normalizeOrigin(params.get("iss") ?? "") !== options.issuer) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(page("TuttiCode", "Sign-in refused: unexpected issuer."));
+      finish(
+        () => rejectCode(
+          new LoginError(
+            "issuer",
+            `The sign-in came back from ${params.get("iss") ?? "an unnamed issuer"}, not ${options.issuer}.`
+          )
+        )
+      );
+      return;
+    }
+    const value = params.get("code");
+    if (!value) {
+      res.writeHead(400).end();
+      return;
+    }
+    res.writeHead(302, { Location: options.doneUrl }).end();
+    finish(() => resolveCode(value));
+  });
+  const onAbort = () => finish(() => rejectCode(new LoginError("cancelled", "Sign-in cancelled.")));
+  const timer = setTimeout(
+    () => finish(
+      () => rejectCode(
+        new LoginError(
+          "timeout",
+          `No answer from the browser within ${Math.round(
+            (options.timeoutMs ?? LOOPBACK_TIMEOUT_MS) / 6e4
+          )} minutes.`
+        )
+      )
+    ),
+    options.timeoutMs ?? LOOPBACK_TIMEOUT_MS
+  );
+  options.signal?.addEventListener("abort", onAbort, { once: true });
+  await new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve3);
+  });
+  const port = server.address().port;
+  return {
+    port,
+    redirectUri: `http://127.0.0.1:${port}/callback`,
+    code,
+    close: () => finish(() => rejectCode(new LoginError("cancelled", "Closed.")))
+  };
+}
+async function loopbackLogin(options) {
+  const { verifier, challenge } = pkcePair();
+  const state = (0, import_node_crypto5.randomBytes)(24).toString("base64url");
+  const loopback = await startLoopback({
+    state,
+    issuer: options.origin,
+    doneUrl: sitePage(options.origin, options.locale, "/code/login/done"),
+    timeoutMs: options.timeoutMs,
+    signal: options.signal
+  });
+  const url = loginUrl({
+    origin: options.origin,
+    locale: options.locale,
+    redirectUri: loopback.redirectUri,
+    challenge,
+    state,
+    deviceName: options.deviceName
+  });
+  options.onUrl?.(url);
+  try {
+    await options.openBrowser(url);
+  } catch {
+  }
+  const code = await loopback.code;
+  return exchange(options.origin, options, {
+    grant_type: "authorization_code",
+    code,
+    code_verifier: verifier,
+    redirect_uri: loopback.redirectUri,
+    resource: tutticodeResourceUrl(options.origin)
+  });
+}
+async function exchange(origin, deps, params) {
+  try {
+    return tokenResponse(
+      await postOAuth(origin, TUTTICODE_OAUTH_PATHS.token, params, deps)
+    );
+  } catch (e) {
+    if (e instanceof OAuthError)
+      throw new LoginError("server", `The sign-in failed: ${e.message}`);
+    throw e;
+  }
+}
+async function startDeviceLogin(origin, deviceName2, deps = {}) {
+  let body;
+  try {
+    body = await postOAuth(
+      origin,
+      TUTTICODE_OAUTH_PATHS.deviceAuthorization,
+      {
+        scope: TUTTICODE_SCOPE,
+        resource: tutticodeResourceUrl(origin),
+        device_name: deviceName2
+      },
+      deps
+    );
+  } catch (e) {
+    if (e instanceof OAuthError)
+      throw new LoginError(
+        "server",
+        e.error === "slow_down" ? "Too many sign-in attempts from this network: try again in an hour." : `The sign-in could not start: ${e.message}`
+      );
+    throw e;
+  }
+  if (typeof body.device_code !== "string" || typeof body.user_code !== "string" || typeof body.verification_uri !== "string")
+    throw new LoginError("server", "The server sent no device code.");
+  return {
+    deviceCode: body.device_code,
+    userCode: body.user_code,
+    verificationUri: body.verification_uri,
+    ...typeof body.verification_uri_complete === "string" ? { verificationUriComplete: body.verification_uri_complete } : {},
+    expiresIn: positive(body.expires_in, 600),
+    interval: positive(body.interval, 5)
+  };
+}
+var positive = (v, fallback) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : fallback;
+var SLOW_DOWN_STEP_S = 5;
+async function pollDeviceToken(origin, device, options = {}) {
+  const now = options.now ?? Date.now;
+  const sleep = options.sleep ?? ((ms) => new Promise((r2) => setTimeout(r2, ms)));
+  const deadline = now() + device.expiresIn * 1e3;
+  let interval = device.interval;
+  for (; ; ) {
+    await sleep(interval * 1e3);
+    if (options.signal?.aborted)
+      throw new LoginError("cancelled", "Sign-in cancelled.");
+    if (options.stillWanted && !options.stillWanted())
+      throw new LoginError("cancelled", "A newer sign-in replaced this one.");
+    if (now() >= deadline)
+      throw new LoginError(
+        "expired",
+        "The code expired before it was approved: run tutticode login --device again."
+      );
+    try {
+      return tokenResponse(
+        await postOAuth(
+          origin,
+          TUTTICODE_OAUTH_PATHS.token,
+          {
+            grant_type: DEVICE_CODE_GRANT_TYPE,
+            device_code: device.deviceCode
+          },
+          options
+        )
+      );
+    } catch (e) {
+      if (!(e instanceof OAuthError))
+        continue;
+      switch (e.error) {
+        case "authorization_pending":
+          continue;
+        case "slow_down": {
+          const named = Number(e.body.interval);
+          interval = Number.isFinite(named) && named > interval ? named : interval + SLOW_DOWN_STEP_S;
+          continue;
+        }
+        case "access_denied":
+          throw new LoginError("denied", "The sign-in was declined.");
+        case "expired_token":
+          throw new LoginError(
+            "expired",
+            "The code expired before it was approved: run tutticode login --device again."
+          );
+        default:
+          throw new LoginError("server", `The sign-in failed: ${e.message}`);
+      }
+    }
+  }
+}
+async function completeLogin(origin, tokens, deviceName2, deps = {}) {
+  const now = (deps.now ?? Date.now)();
+  const previous = readAccount(origin);
+  try {
+    await saveAccount(origin, storedAccount(tokens, now, { deviceName: deviceName2 }));
+  } catch (e) {
+    await revokeToken(origin, tokens.refresh_token, {
+      ...deps,
+      timeoutMs: 5e3
+    });
+    throw e;
+  }
+  const state = await accountState(origin, deps, { envToken: false });
+  if (state.state === "signed-in") {
+    const me = state.me;
+    const current = readAccount(origin);
+    if (current?.accessToken === tokens.access_token)
+      await saveAccount(origin, {
+        ...current,
+        userId: me.user.id,
+        email: me.user.email,
+        nickname: me.user.nickname,
+        plan: me.plan,
+        ...me.expiresAt ? { grantExpiresAt: me.expiresAt } : {},
+        ...me.deviceName ? { deviceName: me.deviceName } : {}
+      });
+  }
+  if (previous && previous.refreshToken !== tokens.refresh_token)
+    await revokeToken(origin, previous.refreshToken, {
+      ...deps,
+      timeoutMs: 5e3
+    });
+  return state;
+}
+function pendingLoginPath(origin) {
+  const key = (0, import_node_crypto5.createHash)("sha256").update(origin).digest("hex").slice(0, 12);
+  return (0, import_node_path6.join)(stateDir(), `login-pending-${key}.json`);
+}
+function writePendingLogin(pending) {
+  const path = pendingLoginPath(pending.origin);
+  writePrivateFile(path, JSON.stringify(pending));
+  return path;
+}
+function readPendingLogin(path) {
+  try {
+    const value = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    return typeof value.deviceCode === "string" && typeof value.origin === "string" ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function pendingLogin(origin, now = Date.now()) {
+  const pending = readPendingLogin(pendingLoginPath(origin));
+  return pending && Date.parse(pending.expiresAt) > now ? pending : void 0;
+}
+function spawnLoginPoller(entry, file2) {
+  const child = (0, import_node_child_process4.spawn)(process.execPath, [entry, "__login-poll", file2], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true
+  });
+  child.unref();
+}
+async function runLoginPoller(file2, log, deps = {}) {
+  const pending = readPendingLogin(file2);
+  if (!pending) {
+    log("warn", "login poller: no pending sign-in");
+    return false;
+  }
+  const remaining = Math.max(
+    1,
+    Math.round((Date.parse(pending.expiresAt) - Date.now()) / 1e3)
+  );
+  try {
+    const tokens = await pollDeviceToken(
+      pending.origin,
+      {
+        deviceCode: pending.deviceCode,
+        expiresIn: remaining,
+        interval: pending.interval
+      },
+      {
+        ...deps,
+        stillWanted: () => readPendingLogin(file2)?.deviceCode === pending.deviceCode
+      }
+    );
+    const state = await completeLogin(
+      pending.origin,
+      tokens,
+      pending.deviceName,
+      deps
+    );
+    log("info", `login poller: signed in (${state.state})`);
+    return true;
+  } catch (e) {
+    log("info", `login poller: ${e.message}`);
+    return false;
+  } finally {
+    if (readPendingLogin(file2)?.deviceCode === pending.deviceCode)
+      (0, import_node_fs6.rmSync)(file2, { force: true });
+  }
+}
+
 // src/mcp.ts
 var import_node_readline = require("node:readline");
 
@@ -6114,13 +8083,13 @@ var JSON_RPC_INVALID_REQUEST = -32600;
 var JSON_RPC_METHOD_NOT_FOUND = -32601;
 var JSON_RPC_INVALID_PARAMS = -32602;
 var JSON_RPC_INTERNAL_ERROR = -32603;
-var isObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var isId2 = (v) => typeof v === "string" || typeof v === "number" && Number.isFinite(v);
 function classifyMessage(raw) {
-  if (!isObject2(raw) || raw.jsonrpc !== "2.0") {
+  if (!isObject3(raw) || raw.jsonrpc !== "2.0") {
     return {
       kind: "invalid",
-      id: isObject2(raw) && isId2(raw.id) ? raw.id : null,
+      id: isObject3(raw) && isId2(raw.id) ? raw.id : null,
       reason: "Not a JSON-RPC 2.0 message"
     };
   }
@@ -6134,7 +8103,7 @@ function classifyMessage(raw) {
       reason: "Missing method"
     };
   }
-  if (raw.params !== void 0 && !isObject2(raw.params)) {
+  if (raw.params !== void 0 && !isObject3(raw.params)) {
     return {
       kind: "invalid",
       id: isId2(raw.id) ? raw.id : null,
@@ -6317,22 +8286,22 @@ function createMcpServer(options) {
 }
 
 // src/reference.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path5 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path7 = require("node:path");
 var URI_PREFIX = "tutticode://skills/";
 var cache;
 function loadReference(dir = skillsDir()) {
   if (cache?.dir === dir)
     return cache.docs;
   const docs = [];
-  if ((0, import_node_fs5.existsSync)(dir))
-    for (const skill of (0, import_node_fs5.readdirSync)(dir).sort()) {
-      const root = (0, import_node_path5.join)(dir, skill);
-      if (!(0, import_node_fs5.statSync)(root).isDirectory() || !(0, import_node_fs5.existsSync)((0, import_node_path5.join)(root, "SKILL.md")))
+  if ((0, import_node_fs7.existsSync)(dir))
+    for (const skill of (0, import_node_fs7.readdirSync)(dir).sort()) {
+      const root = (0, import_node_path7.join)(dir, skill);
+      if (!(0, import_node_fs7.statSync)(root).isDirectory() || !(0, import_node_fs7.existsSync)((0, import_node_path7.join)(root, "SKILL.md")))
         continue;
-      for (const file of walk(root)) {
-        const path = (0, import_node_path5.relative)(root, file).split(import_node_path5.sep).join("/");
-        const text = (0, import_node_fs5.readFileSync)(file, "utf8").replace(/\r\n/g, "\n");
+      for (const file2 of walk(root)) {
+        const path = (0, import_node_path7.relative)(root, file2).split(import_node_path7.sep).join("/");
+        const text = (0, import_node_fs7.readFileSync)(file2, "utf8").replace(/\r\n/g, "\n");
         docs.push({
           uri: `${URI_PREFIX}${skill}/${path}`,
           skill,
@@ -6346,9 +8315,9 @@ function loadReference(dir = skillsDir()) {
   return docs;
 }
 function walk(dir) {
-  return (0, import_node_fs5.readdirSync)(dir).sort().flatMap((name) => {
-    const path = (0, import_node_path5.join)(dir, name);
-    if ((0, import_node_fs5.statSync)(path).isDirectory())
+  return (0, import_node_fs7.readdirSync)(dir).sort().flatMap((name) => {
+    const path = (0, import_node_path7.join)(dir, name);
+    if ((0, import_node_fs7.statSync)(path).isDirectory())
       return walk(path);
     return name.endsWith(".md") ? [path] : [];
   });
@@ -6428,8 +8397,8 @@ function count(haystack, needle) {
 }
 
 // src/tools.ts
-var import_node_os3 = require("node:os");
-var import_node_path6 = require("node:path");
+var import_node_os4 = require("node:os");
+var import_node_path8 = require("node:path");
 
 // ../mcp-protocol/src/code-tools.ts
 var CODE_CHECK_TOOL = "code_check";
@@ -6986,7 +8955,9 @@ function codeFragment(code) {
 // src/tools.ts
 var CODE_OPEN_TOOL = "code_open";
 var CODE_REFERENCE_TOOL = "code_reference";
-var BACKEND_NOTE = "Runs locally: tutticode renders in your own browser with the tuttidaw.com/code engine (free, no account).";
+var CODE_ACCOUNT_TOOL = "code_account";
+var BACKEND_NOTE = "Runs locally: tutticode renders in your own browser with the tuttidaw.com/code engine (free).";
+var LIMITS_NOTE = `Once TuttiDAW switches its limits on (being rolled out; until then nothing is cut or tagged), renders without sign-in are limited to ${DEFAULT_TUTTICODE_LIMITS.anonMaxSeconds} s (error code "limit") and renders over ${DEFAULT_TUTTICODE_LIMITS.anonWatermarkAfterSeconds} s carry a spoken "register at TuttiDAW" tag, reported as \`watermark\`: it is not part of the program and is in the stats; never change the code to remove it, tell the user once that \`tutticode login\` (free) removes it.`;
 var codeProperty2 = codeCheckTool.inputSchema.properties.code;
 var renderProperties2 = {
   code: codeProperty2,
@@ -7064,6 +9035,10 @@ var renderProperties2 = {
   stemsDir: {
     type: "string",
     description: "Folder for the stems (default: next to out, <name>.stems)."
+  },
+  brandTag: {
+    type: "boolean",
+    description: 'false: no "Made with TuttiCode" metadata tag in the files. Honoured only when signed in (default true).'
   }
 };
 var localCheckTool = {
@@ -7073,7 +9048,7 @@ var localCheckTool = {
 var localRenderTool = {
   name: "code_render",
   title: "Render TuttiCode to a file",
-  description: `Render a TuttiCode program to an audio file on this computer (the same instruments and effects as tuttidaw.com/code) and measure it: integrated LUFS, true peak, octave bands, stereo width, groove, key, silence, per-bar loudness and each voice's level. Returns the written file paths (audio is never inlined), the beat grid (seconds of each bar and beat, for syncing cuts) and an editUrl - give it to the user so they can open the program in TuttiDAW and keep editing. Lengths up to ${BRIDGE_MAX_SECONDS} s. Call code_check first. ${BACKEND_NOTE}`,
+  description: `Render a TuttiCode program to an audio file on this computer (the same instruments and effects as tuttidaw.com/code) and measure it: integrated LUFS, true peak, octave bands, stereo width, groove, key, silence, per-bar loudness and each voice's level. Returns the written file paths (audio is never inlined), the beat grid (seconds of each bar and beat, for syncing cuts) and an editUrl - give it to the user so they can open the program in TuttiDAW and keep editing. Lengths up to ${BRIDGE_MAX_SECONDS} s. Call code_check first. ${LIMITS_NOTE} ${BACKEND_NOTE}`,
   inputSchema: {
     type: "object",
     properties: renderProperties2,
@@ -7152,14 +9127,30 @@ var codeReferenceTool = {
     openWorldHint: false
   }
 };
+var codeAccountTool = {
+  name: CODE_ACCOUNT_TOOL,
+  title: "TuttiCode sign-in and limits",
+  description: "Who renders and with which limits: signedIn, plan, limits.maxSeconds (longest render) and limits.watermarkAfterSeconds (renders longer than this carry a spoken tag; null = never), usageToday, and when not signed in a loginHint. Use it to plan within the limits (keep an anonymous draft at or under watermarkAfterSeconds). Never starts a sign-in: to sign in, run the loginHint command and ask the user to approve the code it prints.",
+  inputSchema: {
+    type: "object",
+    properties: {},
+    additionalProperties: false
+  },
+  annotations: {
+    readOnlyHint: true,
+    idempotentHint: true,
+    openWorldHint: true
+  }
+};
 var LOCAL_TOOLS = [
   localCheckTool,
   localRenderTool,
   localCompareTool,
   codeOpenTool,
-  codeReferenceTool
+  codeReferenceTool,
+  codeAccountTool
 ];
-var MCP_INSTRUCTIONS = `tutticode turns TuttiCode (a superset of Strudel) into audio on this computer, rendering in the user's browser with the tuttidaw.com/code engine. Loop: write code -> code_check (fix every error) -> code_render (files + statistics) -> read the stats / code_compare -> revise. Use code_reference when unsure of a function. Always give the user the editUrl from code_render so they can keep editing in TuttiDAW.`;
+var MCP_INSTRUCTIONS = `tutticode turns TuttiCode (a superset of Strudel) into audio on this computer, rendering in the user's browser with the tuttidaw.com/code engine. Loop: write code -> code_check (fix every error) -> code_render (files + statistics) -> read the stats / code_compare -> revise. Use code_reference when unsure of a function. Always give the user the editUrl from code_render so they can keep editing in TuttiDAW. code_account says whether renders are signed in and their limits. On a "limit" error, tell the user its message in one sentence and carry on within the limit; a \`watermark\` in a report is the anonymous voice tag, not part of the program: do not change the code to remove it.`;
 var MAX_STORED = 64;
 var CHECK_TIMEOUT_MS = 9e4;
 var RENDER_TIMEOUT_MS = 15 * 6e4;
@@ -7178,7 +9169,7 @@ function createToolHandler(deps) {
   async function check2(args, signal) {
     const command = {
       type: "check",
-      id: (0, import_node_crypto2.randomUUID)(),
+      id: (0, import_node_crypto3.randomUUID)(),
       code: args.code,
       ...args.bpm !== void 0 ? { bpm: args.bpm } : {}
     };
@@ -7210,7 +9201,7 @@ function createToolHandler(deps) {
         `format ${String(args.format)} does not match out ${out}.`
       );
     const format = args.format ?? outFormat ?? "wav";
-    const id = (0, import_node_crypto2.randomUUID)();
+    const id = (0, import_node_crypto3.randomUUID)();
     const length = lengths.length ? { [lengths[0]]: args[lengths[0]] } : void 0;
     const command = {
       type: "render",
@@ -7230,7 +9221,8 @@ function createToolHandler(deps) {
       "tail",
       "lufs",
       "truePeak",
-      "limit"
+      "limit",
+      "brandTag"
     ])
       if (args[key] !== void 0)
         command[key] = args[key];
@@ -7244,8 +9236,8 @@ function createToolHandler(deps) {
     });
     if (outcome.kind !== "rendered")
       return errorResult(outcome);
-    const path = out ?? (0, import_node_path6.join)(
-      deps.outDir ?? (0, import_node_path6.join)((0, import_node_os3.tmpdir)(), "tutticode"),
+    const path = out ?? (0, import_node_path8.join)(
+      deps.outDir ?? (0, import_node_path8.join)((0, import_node_os4.tmpdir)(), "tutticode"),
       `render-${id.slice(0, 8)}.${format}`
     );
     const files = writeRender(
@@ -7254,10 +9246,15 @@ function createToolHandler(deps) {
       path,
       typeof args.stemsDir === "string" ? args.stemsDir : void 0
     );
-    remember(id, { meta: outcome.meta, analysis: outcome.meta.analysis });
+    remember(id, {
+      meta: outcome.meta,
+      analysis: outcome.meta.analysis,
+      watermark: outcome.meta.watermark
+    });
     const { meta } = outcome;
     return {
       id,
+      watermarked: !!meta.watermark,
       report: {
         id,
         kind: "render",
@@ -7285,7 +9282,9 @@ function createToolHandler(deps) {
         beatTimes: meta.beatTimes,
         check: meta.check,
         ...meta.analysis ? { analysis: meta.analysis } : {},
-        engineVersion: meta.engineVersion
+        engineVersion: meta.engineVersion,
+        ...meta.watermark ? { watermark: meta.watermark, watermarkNote: WATERMARK_LINE } : {},
+        ...signInNote(outcome.auth)
       }
     };
   }
@@ -7325,9 +9324,11 @@ function createToolHandler(deps) {
       return invalid("Give goals or againstRenderId.");
     let analysis;
     let rendered;
+    let tagged = target === "render" && !!renders.get(String(args.againstRenderId))?.watermark;
     if (args.renderId !== void 0) {
       if (args.code !== void 0)
         return invalid("Give renderId or code, not both.");
+      tagged ||= !!renders.get(String(args.renderId))?.watermark;
       analysis = renders.get(String(args.renderId))?.analysis;
       if (!analysis)
         return invalid(
@@ -7345,16 +9346,34 @@ function createToolHandler(deps) {
       rendered = await render2(renderArgs, signal);
       if (!("report" in rendered))
         return rendered;
+      tagged ||= rendered.watermarked;
       analysis = rendered.report.analysis;
       if (!analysis)
         return invalid("The render came back without an analysis.");
     } else
       return invalid("Give renderId or code.");
     const result = compareAnalysis(analysis, goals, target);
+    const note = tagged ? { watermarkNote: WATERMARK_LINE } : {};
     return textResult(
-      rendered && "report" in rendered ? { ...rendered.report, compare: result } : { id: args.renderId, compare: result }
+      rendered && "report" in rendered ? { ...rendered.report, compare: result, ...note } : { id: args.renderId, compare: result, ...note }
     );
   }
+  async function account() {
+    const state = deps.account ? await deps.account() : { state: "anonymous" };
+    const signedIn = state.state === "signed-in";
+    return textResult({
+      signedIn,
+      tokenKind: signedIn ? state.tokenKind : "anonymous",
+      ...signedIn ? {
+        plan: state.me.plan,
+        usageToday: state.me.usageToday,
+        expiresAt: state.me.expiresAt
+      } : {},
+      limits: accountLimits(state),
+      ...signedIn ? {} : { loginHint: LOGIN_HINT },
+      ...state.state === "rejected" || state.state === "unreachable" ? { problem: state.message } : {}
+    });
+  }
   return async function callTool(name, args, signal) {
     switch (name) {
       case "code_check":
@@ -7389,6 +9408,8 @@ function createToolHandler(deps) {
       }
       case CODE_REFERENCE_TOOL:
         return reference(args);
+      case CODE_ACCOUNT_TOOL:
+        return account();
       default:
         return invalid(`Unknown tool ${name}.`);
     }
@@ -7422,12 +9443,26 @@ function errorResult(outcome) {
     return invalid(`Unexpected ${outcome.kind}.`);
   return textResult(
     {
-      error: { code: outcome.code, message: outcome.message },
-      ...outcome.report ? { report: outcome.report } : {}
+      error: {
+        code: outcome.code,
+        message: outcome.message,
+        ...outcome.limit ? { limit: outcome.limit } : {}
+      },
+      ...outcome.code === "limit" ? { loginHint: LOGIN_HINT } : {},
+      ...outcome.report ? { report: outcome.report } : {},
+      ...signInNote(outcome.auth)
     },
     true
   );
 }
+function signInNote(auth) {
+  return auth?.rejected ? {
+    signIn: {
+      rejected: auth.rejected,
+      note: "This ran without sign-in. Tell the user to run `tutticode login` again."
+    }
+  } : {};
+}
 var GOAL_KEYS = {
   style: (v) => typeof v === "string" && v.length > 0 && v.length <= 64,
   lufs: (v) => num(v, -70, 0),
@@ -7469,10 +9504,11 @@ function serveMcpStdio(options) {
     backend: options.backend,
     styles: options.styles,
     codeLink: options.codeLink,
-    canShow: options.canShow
+    canShow: options.canShow,
+    account: options.account
   });
   const server = createMcpServer({
-    serverInfo: { name: "tutticode", title: "TuttiCode", version: VERSION },
+    serverInfo: { name: "tutticode", title: "TuttiCode", version: VERSION2 },
     instructions: MCP_INSTRUCTIONS,
     listTools: () => [...LOCAL_TOOLS],
     callTool: (name, args, ctx) => callTool(name, args, ctx.signal),
@@ -7510,7 +9546,7 @@ function serveMcpStdio(options) {
     });
   });
 }
-function sessionBackend(create) {
+function sessionBackend(create, auth) {
   const sessions = /* @__PURE__ */ new Map();
   const get = (mode) => {
     let session = sessions.get(mode);
@@ -7521,21 +9557,57 @@ function sessionBackend(create) {
     return session;
   };
   return {
-    backend: (command, { mode, signal, timeoutMs }) => get(mode).run(command, { signal, timeoutMs }),
+    backend: async (command, { mode, signal, timeoutMs }) => {
+      const signIn = await auth?.();
+      const outcome = await get(mode).run(command, {
+        signal,
+        timeoutMs,
+        ...signIn ? { auth: signIn.auth } : {}
+      });
+      return signIn?.ended ? {
+        ...outcome,
+        auth: { signedIn: false, ...outcome.auth, rejected: signIn.ended }
+      } : outcome;
+    },
     close: async () => {
       await Promise.all([...sessions.values()].map((s) => s.close()));
     }
   };
 }
 
+// src/notices.ts
+var import_node_fs8 = require("node:fs");
+var import_node_path9 = require("node:path");
+var file = () => (0, import_node_path9.join)(stateDir(), "notices.json");
+function read() {
+  try {
+    const value = JSON.parse((0, import_node_fs8.readFileSync)(file(), "utf8"));
+    return typeof value === "object" && value !== null ? value : {};
+  } catch {
+    return {};
+  }
+}
+function firstTime(key, period, now = /* @__PURE__ */ new Date()) {
+  const shown = read();
+  const today = now.toISOString().slice(0, 10);
+  const last = shown[key];
+  if (last && (period === "install" || last === today))
+    return false;
+  try {
+    (0, import_node_fs8.writeFileSync)(file(), JSON.stringify({ ...shown, [key]: today }));
+  } catch {
+  }
+  return true;
+}
+
 // src/setup.ts
-var import_node_child_process3 = require("node:child_process");
-var import_node_fs6 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_child_process5 = require("node:child_process");
+var import_node_fs9 = require("node:fs");
+var import_node_path10 = require("node:path");
 var POLICY_NAME = "LocalNetworkAccessAllowedForUrls";
 var POLICY_URL = "https://tuttidaw.com";
 var exec = (command, args) => {
-  const r2 = (0, import_node_child_process3.spawnSync)(command, args, { encoding: "utf8", windowsHide: true });
+  const r2 = (0, import_node_child_process5.spawnSync)(command, args, { encoding: "utf8", windowsHide: true });
   return { status: r2.status, stdout: r2.stdout ?? "" };
 };
 var WINDOWS_KEYS = [
@@ -7650,16 +9722,16 @@ function policySteps(undo, platform = process.platform, run = exec) {
       };
     });
   return LINUX_POLICY_FILES.map(
-    (file) => undo ? {
-      describe: `delete ${file}`,
+    (file2) => undo ? {
+      describe: `delete ${file2}`,
       run() {
-        (0, import_node_fs6.rmSync)(file, { force: true });
+        (0, import_node_fs9.rmSync)(file2, { force: true });
       }
     } : {
-      describe: `write ${file} (${POLICY_NAME}: ["${POLICY_URL}"])`,
+      describe: `write ${file2} (${POLICY_NAME}: ["${POLICY_URL}"])`,
       run() {
-        (0, import_node_fs6.mkdirSync)((0, import_node_path7.dirname)(file), { recursive: true });
-        (0, import_node_fs6.writeFileSync)(file, linuxPolicyJson());
+        (0, import_node_fs9.mkdirSync)((0, import_node_path10.dirname)(file2), { recursive: true });
+        (0, import_node_fs9.writeFileSync)(file2, linuxPolicyJson());
       }
     }
   );
@@ -7675,22 +9747,22 @@ for your user. It allows nothing else, and you can see it at chrome://policy
 (edge://policy). Undo any time with: tutticode setup --undo`;
 
 // src/skills.ts
-var import_node_fs7 = require("node:fs");
-var import_node_os4 = require("node:os");
-var import_node_path8 = require("node:path");
-function targetDir(target, home = (0, import_node_os4.homedir)()) {
-  return (0, import_node_path8.join)(home, `.${target}`, "skills");
+var import_node_fs10 = require("node:fs");
+var import_node_os5 = require("node:os");
+var import_node_path11 = require("node:path");
+function targetDir(target, home = (0, import_node_os5.homedir)()) {
+  return (0, import_node_path11.join)(home, `.${target}`, "skills");
 }
 function shippedSkills(dir = skillsDir()) {
-  if (!(0, import_node_fs7.existsSync)(dir))
+  if (!(0, import_node_fs10.existsSync)(dir))
     return [];
-  return (0, import_node_fs7.readdirSync)(dir).filter(
-    (name) => (0, import_node_fs7.statSync)((0, import_node_path8.join)(dir, name)).isDirectory() && (0, import_node_fs7.existsSync)((0, import_node_path8.join)(dir, name, "SKILL.md"))
+  return (0, import_node_fs10.readdirSync)(dir).filter(
+    (name) => (0, import_node_fs10.statSync)((0, import_node_path11.join)(dir, name)).isDirectory() && (0, import_node_fs10.existsSync)((0, import_node_path11.join)(dir, name, "SKILL.md"))
   ).sort();
 }
-function defaultTargets(home = (0, import_node_os4.homedir)()) {
+function defaultTargets(home = (0, import_node_os5.homedir)()) {
   const found = ["claude", "copilot", "codex"].filter(
-    (t) => (0, import_node_fs7.existsSync)((0, import_node_path8.join)(home, `.${t}`))
+    (t) => (0, import_node_fs10.existsSync)((0, import_node_path11.join)(home, `.${t}`))
   );
   return found.length ? [...found] : ["claude"];
 }
@@ -7701,9 +9773,9 @@ function installSkills(destinations, source = skillsDir()) {
   const installed = [];
   for (const destination of destinations) {
     for (const skill of skills) {
-      const path = (0, import_node_path8.resolve)(destination, skill);
-      (0, import_node_fs7.rmSync)(path, { recursive: true, force: true });
-      (0, import_node_fs7.cpSync)((0, import_node_path8.join)(source, skill), path, { recursive: true });
+      const path = (0, import_node_path11.resolve)(destination, skill);
+      (0, import_node_fs10.rmSync)(path, { recursive: true, force: true });
+      (0, import_node_fs10.cpSync)((0, import_node_path11.join)(source, skill), path, { recursive: true });
       installed.push({ skill, path });
     }
   }
@@ -7946,7 +10018,19 @@ var afrobeats = {
       p90: [-8.9, -1.9, -2.9, -4.9, -6.9, -8.9, -9.9, -11.9, -12.9, -17.9],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor: brief gentle kick-to-bass duck only where the two overlap; retain the bounce.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 80,
+          depthDb: 2
+        }
+      ],
+      note: "Clears the kick, no pumping; keep the bounce."
+    },
     reverb: "EQ Eight into light Compressor on vocal; Reverb short room for percussion and a darker plate for voice.",
     delay: "Echo dotted eighth on guitar or phrase endings; filter repeats away from the lead vocal.",
     stereo: "Center kick, bass and lead vocal; spread the guitar and shaker without widening the sub.",
@@ -8731,7 +10815,19 @@ var boomBap = {
       p90: [-12.2, -3.2, -2.2, -4.2, -6.2, -8.2, -9.2, -12.2, -16.2, -23.2],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor only to clear bass on the strongest kicks; no obvious EDM pumping.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 70,
+          depthDb: 2
+        }
+      ],
+      note: "Clears the kick, no EDM pumping."
+    },
     reverb: "Redux lightly on the sample, Saturator for body, EQ Eight to trim hiss; short Reverb on snare, rap mostly dry.",
     delay: "Echo throws on selected rhyme endings, not across the whole verse.",
     stereo: "Centered kick/snare/bass/vocal; sample can be narrow with wider hook answers.",
@@ -9238,11 +11334,11 @@ var cinematic = {
       p90: [-11.4, -4.4, -3.4, -3.4, -5.4, -7.4, -8.4, -10.4, -12.4, -18.4],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor can briefly clear pad/sub for impacts; avoid audible dance pumping unless the cue is explicitly electronic.",
+    sidechain: null,
     reverb: "EQ Eight before Hybrid Reverb keeps the hall clear; different predelays establish near piano and distant orchestra.",
     delay: "Echo can extend a pulse, but sync it so the ostinato does not become an accidental flam.",
     stereo: "Strings and upper brass broad, low drums/bass centered; keep dialogue space in the middle when scoring picture.",
-    lowEnd: "Saturator on low-drum substitutes adds weight; highpass reverb. Limiter catches isolated impacts, not the entire crescendo. Delivery loudness follows the actual brief."
+    lowEnd: "Saturator on low-drum substitutes adds weight; highpass reverb. Thin pad/sub under impacts, no dance pumping. Limiter catches isolated impacts, not the entire crescendo. Delivery loudness follows the brief."
   },
   arrangement: {
     variationEveryBars: 4,
@@ -10593,7 +12689,7 @@ var disco = {
       p90: [-12.1, -3.1, -2.1, -5.1, -7.1, -8.1, -9.1, -10.1, -11.1, -17.1],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Little or none for the live-band feel; shorten bass notes before ducking.",
+    sidechain: null,
     reverb: "Reverb plate on strings and vocal, small room on drums.",
     delay: "Quiet Echo slap on vocal; avoid busy feedback against guitar sixteenths.",
     stereo: "Strings wide, rhythm guitar to one side with keys answering; bass and kick centered.",
@@ -10912,14 +13008,34 @@ var drumAndBass = {
     "Climbing Keys G Minor 140 bpm"
   ],
   mix: {
-    lufs: { min: -8, max: -5 },
+    lufs: { min: -9, max: -7 },
     tonalBalance: {
       p10: [-14.5, -9, -9.5, -12.5, -15, -16, -16.5, -17, -19, -25.5],
       p50: [-9.5, -5, -6.5, -9.5, -12, -13, -13.5, -14, -15, -20.5],
       p90: [-4.5, -1, -3.5, -6.5, -9, -10, -10.5, -11, -11, -15.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Pads/reese ducked by kick AND snare; the sub ducked only by the kick.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass", "pad"],
+          ratio: 4,
+          attackMs: 0.5,
+          releaseMs: 100,
+          depthDb: 4
+        },
+        {
+          trigger: "snare",
+          targets: ["pad"],
+          ratio: 3,
+          attackMs: 0.5,
+          releaseMs: 120,
+          depthDb: 3
+        }
+      ],
+      note: "Pads duck to kick and snare; the sub only to the kick."
+    },
     reverb: "Short, bright snare reverb; big wash on breakdown pads/vocals.",
     delay: "1/4 or 1/8 dotted on vocals; delay throws into drops.",
     stereo: "Sub and kick mono, reese mids wide, breaks slightly wide, pads very wide.",
@@ -11194,7 +13310,7 @@ var dubstep = {
   },
   starterClips: ["Dub Halftime 136 bpm", "Halftime Pattern 136 bpm"],
   mix: {
-    lufs: { min: -10, max: -6 },
+    lufs: { min: -10, max: -8 },
     tonalBalance: {
       p10: [
         -11.1,
@@ -11212,7 +13328,19 @@ var dubstep = {
       p90: [-1.1, -0.1, -5.1, -9.1, -11.1, -11.1, -11.1, -13.1, -15.1, -21.1],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor ducks sub briefly for the kick; a separate gentle duck on mid-bass can expose the huge snare.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 4,
+          attackMs: 0.5,
+          releaseMs: 60,
+          depthDb: 4
+        }
+      ],
+      note: "The sub ducks briefly for the kick only."
+    },
     reverb: "Dark Reverb on snare and isolated bells; no reverb on the clean sub.",
     delay: "Dub-style Echo throws into the gaps, filtered and automated before the next bass call.",
     stereo: "Sub and kick mono; widen only the upper bass layer and atmospheric answers.",
@@ -11857,7 +13985,7 @@ var funk = {
       p90: [-13.5, -3.5, -2.5, -4.5, -6.5, -7.5, -8.5, -10.5, -12.5, -19.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Usually none: note lengths and rests make space before compression.",
+    sidechain: null,
     reverb: "Short Reverb room; keep guitar scratches and bass dry.",
     delay: "Brief Echo slap on a horn or vocal answer only.",
     stereo: "Bass, snare and lead centered; guitar and clav answer from opposite sides.",
@@ -11874,7 +14002,7 @@ var funk = {
       {
         kind: "breakdown",
         where: "Middle",
-        how: "Expose drums and bass; reintroduce clav before horns."
+        how: "Expose the drums (and bass, in a bass feature); reintroduce clav before horns."
       },
       {
         kind: "variation",
@@ -12120,7 +14248,7 @@ var futureBass = {
   },
   starterClips: [],
   mix: {
-    lufs: { min: -10, max: -7 },
+    lufs: { min: -10, max: -8 },
     tonalBalance: {
       p10: [
         -17.8,
@@ -12138,7 +14266,27 @@ var futureBass = {
       p90: [-7.8, -1.8, -4.8, -6.8, -6.8, -6.8, -7.8, -8.8, -9.8, -14.8],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor keyed by kick ducks chord stacks strongly; release follows the swell, usually around an eighth note. Keep the sub duck shorter.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["chords", "pad"],
+          ratio: 8,
+          attackMs: 0.5,
+          releaseMs: 200,
+          depthDb: 8
+        },
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 4,
+          attackMs: 0.5,
+          releaseMs: 80,
+          depthDb: 4
+        }
+      ],
+      note: "Chord stacks pump hard, release follows the swell; the sub duck is shorter."
+    },
     reverb: "EQ Eight clears chord low mids, Saturator adds body, Chorus-Ensemble widens upper layers, then Reverb; keep dry transients in front.",
     delay: "Echo dotted eighth on vocal chops; automate throws into gaps rather than washing out the next chord.",
     stereo: "Wide chords and chops above a centered sub/kick/snare; mono-check detuned layers.",
@@ -12410,7 +14558,19 @@ var gospel = {
       p90: [-13.1, -5.1, -4.1, -4.1, -5.1, -6.1, -7.1, -9.1, -11.1, -17.1],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Only gentle Compressor ducking where bass masks the kick; no dance pumping.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 80,
+          depthDb: 1.5
+        }
+      ],
+      note: "Only where bass masks the kick; no dance pumping."
+    },
     reverb: "EQ Eight then Compressor on lead/choir; shared Reverb hall with enough predelay to keep consonants clear.",
     delay: "Low Echo throws behind the leader; do not repeat over the choir response.",
     stereo: "Lead center, choir spread, organ behind the words; retain mono bass.",
@@ -12464,7 +14624,7 @@ var guofengPop = {
   feel: {
     kind: "straight",
     swingPercent: 50,
-    note: "Soft even-16th R&B-pop beat; the Chinese colour comes from the melody (pentatonic, slides, grace notes) and woodblock-like rim, not the kick and snare."
+    note: "Soft even-16th R&B-pop beat; the Chinese colour is in the melody (pentatonic, slides, grace notes) and woodblock-like rim."
   },
   keys: ["D major", "E major", "G major", "B minor", "E minor"],
   forms: [
@@ -12769,7 +14929,7 @@ var guofengPop = {
     reverb: "Large hall on flute, zither and vocal (the misty space is the style), pre-delay for clear words; drums dry.",
     delay: "Dotted-1/8 Echo on flute and plucks; vocal throws on line ends.",
     stereo: "Zither and strings wide, flute off-centre, vocal centred on top.",
-    lowEnd: "Soft and round; high-pass plucks and flute ~150 Hz. Chain: vocal EQ Eight > Compressor > Hybrid Reverb; master Glue Compressor > Limiter."
+    lowEnd: "Soft and round; high-pass plucks and flute ~150 Hz. Chain: vocal EQ Eight > Compressor > Hybrid Reverb; gentle master Glue."
   },
   arrangement: {
     variationEveryBars: 8,
@@ -12797,7 +14957,7 @@ var guofengPop = {
     ]
   },
   references: ["Jay Chou", "JJ Lin", "Silence Wang", "Henry Huo", "Isaac Hong"],
-  why: "Guofeng is C-pop with a Chinese accent: a pop/R&B beat and pop chords under an ornamented pentatonic melody and classical imagery; the instrumental hook announces the style. No Chinese instrument samples yet: Koto / Eastern Harp stand in for guzheng, Flute Mellow / Indian Flute for dizi, Violin Strings with slides for erhu."
+  why: "Guofeng is C-pop with a Chinese accent: pop/R&B beat and chords under an ornamented pentatonic melody and classical imagery. No Chinese instrument samples yet: Koto / Eastern Harp stand in for guzheng, Flute Mellow / Indian Flute for dizi, Violin Strings with slides for erhu."
 };
 
 // ../../src/components/editor-ai/style/cards/house.ts
@@ -13095,14 +15255,34 @@ var house = {
     "House 90s C Minor 128 bpm"
   ],
   mix: {
-    lufs: { min: -9, max: -7 },
+    lufs: { min: -10, max: -8 },
     tonalBalance: {
       p10: [-15.5, -8.5, -9, -12, -14.5, -16, -17, -18, -20, -26.5],
       p50: [-10.5, -4.5, -6, -9, -11.5, -13, -14, -15, -16, -21.5],
       p90: [-5.5, -0.5, -3, -6, -8.5, -10, -11, -12, -12, -16.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Pads/chords ducked by the kick (medium, fast release ~1/8); bass light or none.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["chords", "pad"],
+          ratio: 4,
+          attackMs: 1,
+          releaseMs: 200,
+          depthDb: 5
+        },
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 80,
+          depthDb: 2
+        }
+      ],
+      note: "Chords/pads pump (release ~1/8); the offbeat bass only lightly."
+    },
     reverb: "Short plate on clap, large hall on breakdown pads/vocals.",
     delay: "1/8 dotted or 3/16 on stabs and vocals, filtered.",
     stereo: "Kick, bass, clap centered; hats/shaker/perc spread wide.",
@@ -13734,7 +15914,7 @@ var jpopAnime = {
     "Downwards A Minor 141 bpm"
   ],
   mix: {
-    lufs: { min: -9, max: -6 },
+    lufs: { min: -10, max: -8 },
     tonalBalance: {
       p10: [-20.5, -12, -9.5, -10.5, -12, -13, -14, -15, -18, -26],
       p50: [-15.5, -8, -6.5, -7.5, -9, -10, -11, -12, -14, -21],
@@ -13745,7 +15925,7 @@ var jpopAnime = {
     reverb: "Bright plate on vocal and snare, hall on strings.",
     delay: "Dotted-1/8 vocal delay tucked under.",
     stereo: "Doubled guitars hard L/R, strings wide, vocal centred on top.",
-    lowEnd: "Tight kick and bass; high-pass guitars ~100 Hz. Chain: guitars Amp > Cabinet; vocal Compressor > EQ Eight > Reverb; master Glue Compressor > Limiter, loud."
+    lowEnd: "Tight kick and bass; high-pass guitars ~100 Hz. Chain: guitars Amp > Cabinet; vocal Compressor > EQ Eight > Reverb; master Glue Compressor > one Limiter (ceiling -1 dBTP)."
   },
   arrangement: {
     variationEveryBars: 4,
@@ -13803,19 +15983,19 @@ var kpop = {
     "\uCF00\uC774\uD31D",
     "\uC544\uC774\uB3CC"
   ],
-  summary: "Idol dance-pop, 95-130 BPM, genre per section: rap verse, pre-chorus build, EDM/trap chorus, dance break, key-up end.",
+  summary: "Idol dance-pop, 95-130 BPM, genre per section: rap verse, build, EDM/trap chorus, dance break, key-up end.",
   tempo: { min: 95, max: 130, typical: 120 },
   meter: "4/4",
   feel: {
     kind: "straight",
     swingPercent: 50,
-    note: "Quantized, punchy; rap/trap parts go half-time with 32nd hat rolls."
+    note: "Quantized; trap parts half-time with 32nd hat rolls."
   },
   keys: ["F# minor", "C# minor", "G minor", "A minor", "Eb major"],
   forms: [
     {
       id: "title-track",
-      name: "Title track: (V/Pre/Chorus/Post) x2, Bridge, Dance Break, key up",
+      name: "Title track, key-up end",
       sections: [
         {
           name: "Intro",
@@ -13835,9 +16015,9 @@ var kpop = {
         {
           name: "Pre-Chorus",
           bars: 8,
-          energy: 0.65,
+          energy: 0.55,
           roles: ["drums", "bass", "chords", "pad", "vocal", "fx"],
-          drums: "verse",
+          drums: "build",
           bass: "pulse"
         },
         {
@@ -13867,9 +16047,9 @@ var kpop = {
         {
           name: "Pre-Chorus",
           bars: 8,
-          energy: 0.7,
+          energy: 0.6,
           roles: ["drums", "bass", "chords", "pad", "vocal", "fx"],
-          drums: "verse",
+          drums: "build",
           bass: "pulse"
         },
         {
@@ -13915,7 +16095,7 @@ var kpop = {
     },
     {
       id: "beat-switch",
-      name: "Beat switch: rap open, trap chorus, dance-groove last chorus",
+      name: "Beat switch: trap chorus, dance last chorus",
       sections: [
         {
           name: "Intro",
@@ -13935,8 +16115,9 @@ var kpop = {
         {
           name: "Pre-Chorus",
           bars: 8,
-          energy: 0.65,
-          roles: ["chords", "pad", "vocal", "fx"]
+          energy: 0.6,
+          roles: ["drums", "chords", "pad", "vocal", "fx"],
+          drums: "build"
         },
         {
           name: "Chorus",
@@ -13981,6 +16162,7 @@ var kpop = {
           kick: "X..x..x.X.x.....X..x..x.X.....o.",
           snare: "....X.......X.......X.......X...",
           clap: "....x.......x.......x.......x...",
+          snap: "....g.......g..o....g.......g...",
           hatClosed: "o.x.o.xxo.x.o.x.o.x.o.xxo.x.o...",
           hatOpen: "..............................x."
         }
@@ -14014,18 +16196,29 @@ var kpop = {
           kick: "X..X..X...X.X...",
           snare: "....X.......X...",
           clap: "....x..x....x..x",
+          snap: "....x.......x...",
           hatClosed: "..x...x...x...x."
         }
+      },
+      {
+        id: "build",
+        name: "Build: kick out, snare 4ths > 8ths > 16ths",
+        stepsPerBeat: 4,
+        lanes: {
+          snare: "o...o...o...o...x.x.x.x.xxxxXXXX",
+          clap: "....o.......o.......x.......x...",
+          hatClosed: "oooooooooooooooooxoxoxoxxxxxXXXX"
+        }
       }
     ],
     fills: [
       {
         id: "riser-roll",
         everyBars: 8,
-        stepsPerBeat: 4,
-        steps: 8,
-        lanes: { snare: "x.x.xxxx", clap: "......XX" },
-        note: "Pre-chorus end: snare roll, kick out."
+        stepsPerBeat: 8,
+        steps: 24,
+        lanes: { snare: "o.o.x.x.xxxxXXXX........" },
+        note: "Snare roll, kick out, last beat silent."
       },
       {
         id: "drop-gap",
@@ -14037,8 +16230,8 @@ var kpop = {
       }
     ],
     rules: [
-      "One groove per section: verse, trap rap, dance chorus, jersey dance break.",
-      "Stack snare+clap(+snap); tight, sample-replaced; hits mark choreography."
+      "One groove per section (verse, build, trap, chorus, jersey).",
+      "Stack snare+clap+snap; hits mark choreography."
     ]
   },
   bass: {
@@ -14067,7 +16260,7 @@ var kpop = {
         velocity: 110
       }
     ],
-    notes: "Synth bass on the dance kick; distorted 808 with slides in rap/trap; out in the bridge."
+    notes: "Synth bass on the dance kick; 808 in rap/trap."
   },
   harmony: {
     modes: [
@@ -14086,7 +16279,7 @@ var kpop = {
         chords: ["i", "bVII", "bVI", "V"],
         weight: 2,
         barsPerChord: 1,
-        use: "major V pulls into the hook"
+        use: "major V into the hook"
       },
       {
         chords: ["IVmaj7", "V", "iii7", "vi"],
@@ -14102,28 +16295,24 @@ var kpop = {
       }
     ],
     extensions: ["add9", "maj7", "7", "sus4"],
-    voicing: "Close synth/brass stabs, pumping offbeats in the chorus; open piano+strings in the bridge.",
-    harmonicRhythm: "1 chord/bar; rap and dance break vamp; last chorus up 1-2 semitones."
+    voicing: "Close synth/brass stabs; open piano+strings in the bridge.",
+    harmonicRhythm: "1 chord/bar; rap and dance break vamp."
   },
   melody: {
     range: { low: 57, high: 79 },
     density: "dense",
     notesPerBar: [4, 12],
-    rhythm: "16th verses and rap; chorus repeats a short (often English) title word; post-chorus chant or chop.",
+    rhythm: "16th verses and rap; a short title word repeats in the chorus.",
     motifs: [
       "One-word title hook repeated 4x",
       "Pre-chorus climbs to a held note",
-      "Post-chorus: wordless synth or vocal-chop riff"
+      "Post-chorus vocal-chop riff"
     ]
   },
   palette: {
     drums: {
-      keywords: ["punchy kick", "clap", "snap", "trap hats"],
-      presets: [
-        "drumrack:Crystal Clear Kit",
-        "drumrack:Street Mind Kit",
-        "drumrack:707 Core Kit"
-      ]
+      keywords: ["punchy kick", "snap", "trap hats"],
+      presets: ["drumrack:Street Mind Kit", "drumrack:Clint West Kit"]
     },
     bass: {
       keywords: ["808", "synth bass", "sub"],
@@ -14143,29 +16332,40 @@ var kpop = {
     },
     lead: {
       keywords: ["vocal chop", "pluck", "saw lead"],
-      presets: ["wavetable:Formant Vox", "meld:PolyPlucks"]
+      presets: ["sampler:Vocal Chop Ah", "meld:PolyPlucks"]
     },
     fx: { keywords: ["riser", "impact", "downlifter", "reverse cymbal"] }
   },
   starterClips: [
     "Pop Riddim 124 bpm",
-    "Dancehall Trap 113 bpm",
     "LD Core Kit Pop 120 bpm",
     "Uplifting Club Vamp F Min 127 bpm"
   ],
   mix: {
-    lufs: { min: -9, max: -6.5 },
+    lufs: { min: -11, max: -9 },
     tonalBalance: {
       p10: [-16.5, -9, -8.5, -11, -13, -14.5, -15.5, -16.5, -19, -26.5],
       p50: [-11.5, -5.5, -5.5, -8, -10, -11.5, -12.5, -13.5, -15, -21.5],
       p90: [-6.5, -1.5, -2.5, -5, -7, -8.5, -9.5, -10.5, -11, -16.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Kick ducks pads/stabs (Compressor sidechain) and the 808.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["pad", "chords", "bass"],
+          ratio: 4,
+          attackMs: 1,
+          releaseMs: 150,
+          depthDb: 5
+        }
+      ],
+      note: "Chorus pump; measured dip >= 1 dB."
+    },
     reverb: "Bright vocal plate, dry rap; hall only in the bridge.",
-    delay: "Dotted-1/8 throws on hook words and ad-libs.",
-    stereo: "Wide doubles and gang vocals in the chorus; rap centred.",
-    lowEnd: "Mono sub; Saturator on the 808; Glue Compressor + Limiter on the master."
+    delay: "Dotted-1/8 throws on hook words.",
+    stereo: "Wide gang vocals in the chorus; rap centred.",
+    lowEnd: "Mono sub; Saturator on the 808; gentle master Glue, 1 dB true-peak headroom."
   },
   arrangement: {
     variationEveryBars: 4,
@@ -14173,7 +16373,7 @@ var kpop = {
       {
         kind: "build",
         where: "Pre-chorus",
-        how: "Kick out, snare roll, Auto Filter sweep, riser."
+        how: "Kick out (build pattern), snare roll, Auto Filter sweep, riser; 4-6 dB under the chorus; last beat silent."
       },
       {
         kind: "breakdown",
@@ -14183,7 +16383,7 @@ var kpop = {
       {
         kind: "drop",
         where: "Dance break",
-        how: "Instrumental beat switch for the choreography."
+        how: "Instrumental beat switch."
       },
       {
         kind: "key-change",
@@ -14193,7 +16393,7 @@ var kpop = {
     ]
   },
   references: ["BTS", "BLACKPINK", "TWICE", "Stray Kids", "NewJeans"],
-  why: "A showcase: each section features another member and genre, so the groove keeps switching while one simple title hook holds the song together; builds, stops and the dance break frame the choreography."
+  why: "The groove switches genre per section while one short title hook holds the song; builds, stops and the dance break frame the choreography."
 };
 
 // ../../src/components/editor-ai/style/cards/lofi-hip-hop.ts
@@ -14466,7 +16666,19 @@ var lofiHipHop = {
       p90: [-8.5, -2.5, -2, -4, -6, -8.5, -11.5, -15.5, -19.5, -28.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: null,
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["keys", "pad"],
+          ratio: 3,
+          attackMs: 5,
+          releaseMs: 180,
+          depthDb: 3
+        }
+      ],
+      note: "Gentle breathing: keys and pad dip with the kick."
+    },
     reverb: "Small dark room on drums, short plate on keys; low wet levels.",
     delay: "Tape-style 1/8 dotted on chops/lead, low feedback, filtered repeats.",
     stereo: "Drums mostly mono; keys and textures wide.",
@@ -14853,7 +17065,19 @@ var mandopopUptempo = {
       p90: [-8, -2.5, -3, -5, -6.5, -8, -9, -10.5, -11.5, -17],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Light kick ducking on pads and stabs in the chorus.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["pad", "chords"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 150,
+          depthDb: 3
+        }
+      ],
+      note: "Light pump, chorus only."
+    },
     reverb: "Plate on vocal and snare; hall only on the breakdown.",
     delay: "1/8 vocal echo under the chorus; 1/4 throws.",
     stereo: "Vocal loud and centred; doubles wide in the chorus.",
@@ -14915,7 +17139,7 @@ var modernPop = {
   feel: {
     kind: "straight",
     swingPercent: 50,
-    note: "Tight and quantized; small swing (swing16-54) only on hats if it feels stiff."
+    note: "Tight, quantized; swing16-54 on hats only if stiff."
   },
   keys: ["C major", "G major", "D major", "A minor", "F# minor"],
   forms: [
@@ -15118,13 +17342,13 @@ var modernPop = {
         stepsPerBeat: 4,
         steps: 4,
         lanes: {},
-        note: "One beat of silence before the chorus (alternative to the snare build)."
+        note: "A silent beat before the chorus."
       }
     ],
     rules: [
       "Pre-chorus builds: snare 8ths -> 16ths over the last 2 bars, or pull the kick out.",
       "Chorus adds a layer the verse lacks (claps, open hats, tambourine).",
-      "Keep velocities consistent; pop drums are tight, punchy and sample-replaced."
+      "Tight, consistent velocities; punchy, sample-replaced."
     ]
   },
   bass: {
@@ -15146,7 +17370,7 @@ var modernPop = {
         velocity: 104
       }
     ],
-    notes: "Synth or picked bass doubling the kick on the chorus; plays roots, octave pops for lift."
+    notes: "Synth or picked bass doubling the chorus kick; roots, octave pops for lift."
   },
   harmony: {
     modes: [
@@ -15182,7 +17406,7 @@ var modernPop = {
       }
     ],
     extensions: ["add9", "sus2", "sus4", "maj7"],
-    voicing: "Open triads with added 9ths; pads hold, piano/guitar plays 8th-note pulses; the chorus voicing moves up an octave.",
+    voicing: "Open triads with add9; pads hold, piano/guitar pulses 8ths; chorus voicing an octave up.",
     harmonicRhythm: "1 chord per bar; same loop through verse and chorus, with energy doing the work."
   },
   melody: {
@@ -15251,11 +17475,23 @@ var modernPop = {
       p90: [-7.5, -2, -2.5, -5, -7, -8.5, -10, -11.5, -12.5, -18.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Light kick ducking on pads/synths in dance-pop; none in ballads.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["pad", "chords"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 150,
+          depthDb: 3
+        }
+      ],
+      note: "Light pump in dance-pop; none in ballads."
+    },
     reverb: "Vocal plate, short room on drums; long reverb only as throws.",
     delay: "1/4 and 1/8 vocal throws at phrase ends.",
-    stereo: "Doubles/backing vocals and synths wide in the chorus, narrower verse; low end mono.",
-    lowEnd: "Kick and bass locked; highpass everything else around 100-150 Hz."
+    stereo: "Doubles and synths wide in the chorus, narrower verse; low end mono.",
+    lowEnd: "Kick and bass locked; highpass the rest at 100-150 Hz."
   },
   arrangement: {
     variationEveryBars: 8,
@@ -15294,7 +17530,7 @@ var modernPop = {
     "The Weeknd",
     "Ed Sheeran"
   ],
-  why: "Pop is built around one memorable hook. The chords barely change; the song gets its arc from contrast - sparse verses, a pre-chorus that builds tension, and a chorus that is louder, wider and higher. Every 8 bars something new arrives so attention never drops."
+  why: "One memorable hook over barely-changing chords; the arc comes from contrast: sparse verses, a building pre-chorus, a louder, wider, higher chorus, something new every 8 bars."
 };
 
 // ../../src/components/editor-ai/style/cards/neo-soul.ts
@@ -15524,7 +17760,19 @@ var neoSoul = {
       p90: [-12.5, -3.5, -2.5, -3.5, -5.5, -8.5, -10.5, -13.5, -16.5, -23.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Minimal kick-to-bass Compressor only if held notes mask the kick; avoid obvious pumping.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 80,
+          depthDb: 1.5
+        }
+      ],
+      note: "Only if held bass masks the kick; no audible pumping."
+    },
     reverb: "Short dark Reverb room around the band; longer vocal plate audible only between phrases.",
     delay: "Filtered Echo throws on selected vocal endings.",
     stereo: "Keep lead and bass close and centered; electric piano medium-wide, backing vocals wider.",
@@ -15796,7 +18044,7 @@ var reggae = {
       p90: [-9.1, -1.1, -2.1, -5.1, -8.1, -10.1, -12.1, -14.1, -17.1, -23.1],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Usually none; bass and sparse kick should coexist by arrangement and EQ Eight, not audible pumping.",
+    sidechain: null,
     reverb: "Reverb on rim/organ for a short spring-like splash; EQ Eight cuts lows on the wet return.",
     delay: "Echo filtered tape-style throws; automate sends on isolated words or rim hits, then mute the dry source for dub space.",
     stereo: "Bass, kick and vocal centered; skank/organ apart; dub returns may travel wider.",
@@ -16060,7 +18308,19 @@ var reggaeton = {
       p90: [-6.6, -0.6, -3.6, -6.6, -8.6, -9.6, -9.6, -10.6, -11.6, -16.6],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor briefly ducks sub under kick; release before the next tresillo accent.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 4,
+          attackMs: 0.5,
+          releaseMs: 60,
+          depthDb: 3
+        }
+      ],
+      note: "Released before the next tresillo accent."
+    },
     reverb: "EQ Eight and Compressor keep the vocal forward; short Reverb on snare, little on bass.",
     delay: "Echo on hook endings with filtered repeats, ducked or muted under the next line.",
     stereo: "Center kick, snare, sub and lead; widen supporting plucks and vocal doubles only.",
@@ -16109,7 +18369,7 @@ var rnb = {
     kind: "swing",
     swingPercent: 57,
     grooveId: "swing16-57",
-    note: "Laid back: swung 16th hats and ghosts, snare a hair late, kick on the grid. Often programmed at double tempo with the snare on 3 - same feel."
+    note: "Laid back: swung 16th hats and ghosts, snare a hair late, kick on the grid (double-time, snare on 3: same feel)."
   },
   keys: ["Eb major", "Ab major", "Db major", "F minor", "C minor"],
   forms: [
@@ -16250,7 +18510,7 @@ var rnb = {
         stepsPerBeat: 4,
         lanes: {
           kick: "X.........x.....",
-          clap: "....x.......x...",
+          snap: "....x.......x...",
           hatClosed: "x..x..x.o..x..x."
         }
       }
@@ -16337,7 +18597,7 @@ var rnb = {
       { chords: ["vi9", "ii9", "Imaj7", "IVmaj7"], weight: 1, barsPerChord: 1 }
     ],
     extensions: ["maj7", "maj9", "9", "11", "13", "7sus4"],
-    voicing: "Rootless 4-note keys voicings (3-5-7-9 or 7-9-3-5) around middle C, spread pads above; chords often land a 16th early.",
+    voicing: "Rootless 4-note keys (3-5-7-9 or 7-9-3-5) around middle C, pads above; chords often land a 16th early.",
     harmonicRhythm: "1 chord per bar, or a 2-chord vamp of 2 bars each."
   },
   melody: {
@@ -16406,11 +18666,23 @@ var rnb = {
       p90: [-5.5, -1, -4, -6.5, -8, -9.5, -10.5, -12, -13, -18.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Duck the sub under the kick when both sustain, or let the 808 be the kick.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 80,
+          depthDb: 3
+        }
+      ],
+      note: "Where kick and sub sustain together; or let the 808 be the kick."
+    },
     reverb: "Plate on the lead vocal, long hall on ad-libs and stacks; drums mostly dry.",
     delay: "1/4 and dotted-1/8 vocal throws, filtered; ping-pong on ad-libs.",
     stereo: "Lead vocal centred and intimate, harmony stack and keys wide.",
-    lowEnd: "The sub (30-60 Hz) carries the weight; Roar or Pedal adds harmonics so it reads on phones. Chain: vocal EQ Eight > Compressor > Reverb/Echo; keys Chorus; master Glue Compressor > Limiter."
+    lowEnd: "The sub (30-60 Hz) carries the weight; Roar or Pedal adds harmonics so it reads on phones. Chain: vocal EQ Eight > Compressor > Reverb/Echo; keys Chorus; gentle master Glue."
   },
   arrangement: {
     variationEveryBars: 4,
@@ -16443,7 +18715,7 @@ var rnb = {
     ]
   },
   references: ["SZA", "H.E.R.", "Daniel Caesar", "David Tao", "Khalil Fong"],
-  why: "R&B feels intimate because it leaves space: a slow, laid-back beat, a deep sub, and lush 7th and 9th chords that never fully resolve. The voice is the star, with runs, stacked harmonies and ad-libs; the beat stays simple so every vocal detail is heard."
+  why: "R&B is intimate because it leaves space: a laid-back beat, a deep sub, 7th/9th chords that never fully resolve. The voice is the star (runs, stacks, ad-libs); the beat stays simple."
 };
 
 // ../../src/components/editor-ai/style/cards/synth-pop.ts
@@ -16711,7 +18983,19 @@ var synthPop = {
       p90: [-12.3, -3.3, -3.3, -5.3, -6.3, -6.3, -7.3, -9.3, -12.3, -18.3],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Light Compressor duck on the pad if necessary; vocal phrasing, not kick pumping, drives the song.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["pad"],
+          ratio: 2,
+          attackMs: 2,
+          releaseMs: 150,
+          depthDb: 2
+        }
+      ],
+      note: "Barely there: phrasing, not pumping, drives the song."
+    },
     reverb: "Reverb plate on snare/vocal; Gate the snare return for a short retro bloom.",
     delay: "Echo eighths or slap on the hook, ducked below lead words.",
     stereo: "Chorus-Ensemble on pads; center the lead vocal, bass and main hook.",
@@ -16997,7 +19281,19 @@ var synthwave = {
       p90: [-10.2, -2.2, -2.2, -5.2, -7.2, -8.2, -9.2, -11.2, -14.2, -20.2],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor ducks bass and pads lightly to each kick; a breath, not a modern EDM vacuum.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass", "pad"],
+          ratio: 3,
+          attackMs: 2,
+          releaseMs: 160,
+          depthDb: 3
+        }
+      ],
+      note: "A breath, not an EDM vacuum."
+    },
     reverb: "Reverb into Gate on the snare return; broad hall on pads.",
     delay: "Echo dotted eighth on arp gaps, lowpassed feedback.",
     stereo: "Chorus-Ensemble widens pads; lead and snare stay focused, sub mono.",
@@ -17284,7 +19580,19 @@ var techno = {
       p90: [-3.5, 0, -3.5, -7.5, -10.5, -11.5, -12.5, -13.5, -14.5, -20.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor ducks the rumble return strongly from the dry kick, recovering before the next beat.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 6,
+          attackMs: 0.5,
+          releaseMs: 150,
+          depthDb: 8
+        }
+      ],
+      note: "The rumble ducks hard, back before the next kick."
+    },
     reverb: "Separate Reverb rumble return, then EQ Eight to remove highs and subsonic build-up; dry kick remains clear.",
     delay: "Filtered dotted-eighth Echo on stabs; automate feedback at boundaries.",
     stereo: "Kick and rumble mono; higher percussion and dub reflections can spread.",
@@ -17544,14 +19852,26 @@ var trance = {
   },
   starterClips: ["909 Core Kit Off Hat 125 bpm", "Techno Heavy 133 bpm"],
   mix: {
-    lufs: { min: -9, max: -6 },
+    lufs: { min: -10, max: -8 },
     tonalBalance: {
       p10: [-18, -9, -9, -13, -15, -15, -15, -16, -19, -26],
       p50: [-13, -5, -6, -10, -12, -12, -12, -13, -15, -21],
       p90: [-8, -1, -3, -7, -9, -9, -9, -10, -11, -16],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Compressor ducks bass, pad and lead reverb to the kick; release recovers into the offbeat.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass", "pad"],
+          ratio: 4,
+          attackMs: 1,
+          releaseMs: 140,
+          depthDb: 5
+        }
+      ],
+      note: "Bass and pad recover into the offbeat."
+    },
     reverb: "Long Reverb hall in breakdowns; highpass the return and reduce it at the drop.",
     delay: "Echo dotted eighth on the lead, filtered so the dry hook stays legible.",
     stereo: "Wide detuned lead and pad above the lows; kick/sub mono. Check the hook in mono.",
@@ -17857,14 +20177,26 @@ var trap = {
     "Sinister Run G Min 142 bpm"
   ],
   mix: {
-    lufs: { min: -9, max: -6 },
+    lufs: { min: -10, max: -8 },
     tonalBalance: {
       p10: [-12.5, -8, -10, -13, -15.5, -17, -18, -19, -21.5, -28.5],
       p50: [-7.5, -4, -7, -10, -12.5, -14, -15, -16, -17.5, -23.5],
       p90: [-2.5, 0, -4, -7, -9.5, -11, -12, -13, -13.5, -18.5],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Duck the 808 by the kick (fast, short) or arrange them never to clash.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 4,
+          attackMs: 0.5,
+          releaseMs: 50,
+          depthDb: 4
+        }
+      ],
+      note: "Fast and short, or arrange 808 and kick never to clash."
+    },
     reverb: "Big dark reverb on the melody; vocal upfront and nearly dry (short room, de-essed); drums dry.",
     delay: "1/4 or 1/8 throws on vocal ends and melody.",
     stereo: "Melody/pads wide, 808/kick/clap mono, hats slightly off-center.",
@@ -18151,7 +20483,19 @@ var ukGarage = {
       p90: [-5.7, -0.7, -2.7, -6.7, -9.7, -10.7, -10.7, -11.7, -12.7, -17.7],
       source: TONAL_BALANCE_SOURCE
     },
-    sidechain: "Short Compressor duck only where kick meets bass; keep the long gaps full.",
+    sidechain: {
+      ducks: [
+        {
+          trigger: "kick",
+          targets: ["bass"],
+          ratio: 3,
+          attackMs: 1,
+          releaseMs: 60,
+          depthDb: 2
+        }
+      ],
+      note: "Clears the kick; keep the long gaps full."
+    },
     reverb: "Small Reverb room on clap/rim; a darker longer return for isolated vocal chops.",
     delay: "Filtered Echo dotted eighth on chops; silence the feedback before busy hook entries.",
     stereo: "Vocal chops and hats can answer left/right; kick, snare and sub stay centered.",
@@ -18274,14 +20618,16 @@ async function dispatch(command, io) {
       const text = HELP[command.topic ?? "main"] ?? HELP.main;
       io.stdout.write(
         `${text}
-${command.topic && command.topic !== "setup" && command.topic !== "skills" ? `
+${command.topic && !["setup", "skills", "login", "logout", "whoami"].includes(
+          command.topic
+        ) ? `
 ${HELP.bridge}
 ` : ""}`
       );
       return EXIT_OK;
     }
     case "version":
-      io.stdout.write(`${VERSION}
+      io.stdout.write(`${VERSION2}
 `);
       return EXIT_OK;
     case "check":
@@ -18294,6 +20640,15 @@ ${HELP.bridge}
       return mcp(command.bridge, io);
     case "doctor":
       return doctor(command, io);
+    case "login":
+      return login(command, io);
+    case "logout":
+      return logout(command.account, io);
+    case "whoami":
+      return whoami(command, io);
+    case "login-poll":
+      await runLoginPoller(command.file, createLogger("login", false));
+      return EXIT_OK;
     case "setup":
       return setup(command, io);
     case "skills-install": {
@@ -18356,33 +20711,62 @@ async function runJob(job, flags, mode, io, timeoutS) {
   const onSigint = () => abort.abort();
   process.once("SIGINT", onSigint);
   const onProgress = progressPrinter(io, flags.verbose);
+  const auth = await jobAuth(accountOrigin(flags.origin), "cli", log);
+  if (auth.ended)
+    io.stderr.write(`tutticode: ${auth.ended}
+`);
   try {
+    let outcome;
     if (flags.noDaemon || io.openPage || !io.entry) {
       const session = newSession(flags, mode, io, log);
       try {
-        return await session.run(job, {
+        outcome = await session.run(job, {
           timeoutMs: timeoutS * 1e3,
           signal: abort.signal,
-          onProgress
+          onProgress,
+          auth: auth.auth
         });
       } finally {
         await session.close();
       }
-    }
-    return await runViaDaemon(
-      { config: daemonConfig(flags, mode), entry: io.entry, log },
-      job,
-      timeoutS * 1e3,
-      {
-        signal: abort.signal,
-        onProgress,
-        onStatus: statusWriter(flags, mode, io)
-      }
-    );
+    } else
+      outcome = await runViaDaemon(
+        { config: daemonConfig(flags, mode), entry: io.entry, log },
+        job,
+        timeoutS * 1e3,
+        {
+          signal: abort.signal,
+          onProgress,
+          onStatus: statusWriter(flags, mode, io)
+        },
+        auth.auth
+      );
+    if (outcome.auth?.rejected)
+      io.stderr.write(`tutticode: ${rejectedLine(outcome.auth)}
+`);
+    return outcome;
   } finally {
     process.removeListener("SIGINT", onSigint);
   }
 }
+function accountOrigin(origin) {
+  return normalizeOrigin(origin ?? "") ?? BRIDGE_ORIGINS[0];
+}
+async function jobAuth(origin, client, log) {
+  try {
+    const token = await resolveToken(origin);
+    return {
+      auth: bridgeAuth(token, client),
+      ...token.ended ? { ended: token.ended } : {}
+    };
+  } catch (e) {
+    log("warn", `sign-in unavailable: ${e.message}`);
+    return { auth: bridgeAuth({ kind: "anonymous" }, client) };
+  }
+}
+function rejectedLine(auth) {
+  return `the page did not accept your sign-in (${auth.rejected}); this ran without sign-in. Run \`tutticode login\`.`;
+}
 function progressPrinter(io, verbose) {
   let last = "";
   return (p) => {
@@ -18395,27 +20779,32 @@ function progressPrinter(io, verbose) {
     last = line;
   };
 }
-async function readProgram(file, io) {
-  if (file === "-") {
+async function readProgram(file2, io) {
+  if (file2 === "-") {
     const chunks = [];
     for await (const chunk of io.stdin)
       chunks.push(Buffer.from(chunk));
     return Buffer.concat(chunks).toString("utf8");
   }
   try {
-    return (0, import_node_fs8.readFileSync)(file, "utf8");
+    return (0, import_node_fs11.readFileSync)(file2, "utf8");
   } catch (e) {
     throw new UsageError(
-      `Cannot read ${file}: ${e.code ?? e.message}`
+      `Cannot read ${file2}: ${e.code ?? e.message}`
     );
   }
 }
-function printError(outcome, json, file, io) {
+function printError(outcome, json, file2, io) {
   if (json)
     io.stdout.write(
       `${JSON.stringify(
         {
-          error: { code: outcome.code, message: outcome.message },
+          error: {
+            code: outcome.code,
+            message: outcome.message,
+            ...outcome.limit ? { limit: outcome.limit } : {}
+          },
+          ...outcome.code === "limit" ? { loginHint: { command: TUTTICODE_LOGIN_HINT_COMMAND } } : {},
           ...outcome.report ? { report: outcome.report } : {}
         },
         null,
@@ -18424,7 +20813,7 @@ function printError(outcome, json, file, io) {
 `
     );
   if (outcome.report)
-    for (const line of formatDiagnostics(outcome.report, file))
+    for (const line of formatDiagnostics(outcome.report, file2))
       io.stderr.write(`${line}
 `);
   io.stderr.write(`tutticode: ${outcome.code}: ${outcome.message}
@@ -18436,7 +20825,7 @@ async function check(command, io) {
   const outcome = await runJob(
     {
       type: "check",
-      id: (0, import_node_crypto2.randomUUID)(),
+      id: (0, import_node_crypto3.randomUUID)(),
       code,
       ...command.bpm !== void 0 ? { bpm: command.bpm } : {}
     },
@@ -18467,8 +20856,15 @@ async function check(command, io) {
 }
 async function render(command, io) {
   const code = await readProgram(command.file, io);
+  const brandTagOff = command.options.brandTag === false || process.env.TUTTICODE_BRAND_TAG === "0";
   const outcome = await runJob(
-    { type: "render", id: (0, import_node_crypto2.randomUUID)(), code, ...command.options },
+    {
+      type: "render",
+      id: (0, import_node_crypto3.randomUUID)(),
+      code,
+      ...command.options,
+      ...brandTagOff ? { brandTag: false } : {}
+    },
     command.bridge,
     modeFor(command.bridge, io),
     io,
@@ -18499,6 +20895,27 @@ async function render(command, io) {
       io.stdout.write(`${line}
 `);
   }
+  if (outcome.meta.watermark)
+    io.stderr.write(`${WATERMARK_LINE}
+`);
+  const anonymous = outcome.auth ? !outcome.auth.signedIn : false;
+  if (anonymous && brandTagOff && firstTime("brand-tag-anonymous", "install"))
+    io.stderr.write(
+      'The "Made with TuttiCode" file tag can be turned off after `tutticode login`.\n'
+    );
+  if (anonymous && io.interactive) {
+    if (firstTime("terms", "install"))
+      io.stderr.write(
+        `TuttiCode renders are subject to ${tutticodeTermsUrl(
+          accountOrigin(command.bridge.origin)
+        )}
+`
+      );
+    if (firstTime("sign-in-hint", "day"))
+      io.stderr.write(
+        "Sign in free for longer renders without the voice tag: tutticode login\n"
+      );
+  }
   return EXIT_OK;
 }
 async function open(command, io) {
@@ -18537,15 +20954,17 @@ ${url}
 }
 async function mcp(flags, io) {
   const log = createLogger("mcp", flags.verbose);
+  const origin = accountOrigin(flags.origin);
   const { backend, close } = sessionBackend(
     (mode) => newSession(
       flags,
       flags.show ? "show" : mode,
       { ...io, stderr: process.stderr },
       log
-    )
+    ),
+    () => jobAuth(origin, "mcp", log)
   );
-  log("info", `mcp server ${VERSION} starting`);
+  log("info", `mcp server ${VERSION2} starting`);
   await serveMcpStdio({
     input: io.stdin,
     output: io.stdout,
@@ -18558,7 +20977,8 @@ async function mcp(flags, io) {
       code
     ),
     // --headless: no window, not even for code_open
-    canShow: flags.show !== false
+    canShow: flags.show !== false,
+    account: () => accountState(origin)
   });
   await close();
   return EXIT_OK;
@@ -18642,14 +21062,313 @@ async function doctor(command, io) {
         )}) in ${info.browser.version ?? "the browser"}` : `${info.browser.version ?? "the browser"} accepted no Local Network Access grant (it may not enforce it)`
       );
   }
+  await accountChecks(accountOrigin(flags.origin), command.fix, add);
   const ok = results.every((r2) => r2.ok || r2.check === "local network access");
   if (command.json)
     io.stdout.write(
-      `${JSON.stringify({ ok, version: VERSION, checks: results }, null, 2)}
+      `${JSON.stringify({ ok, version: VERSION2, checks: results }, null, 2)}
 `
     );
   return ok ? EXIT_OK : EXIT_BRIDGE;
 }
+async function accountChecks(origin, fix, add) {
+  const state = await accountState(origin);
+  switch (state.state) {
+    case "signed-in":
+      add(
+        "account",
+        true,
+        `signed in as ${signedInAs(state.me)}${state.tokenKind === "pat" ? " with TUTTICODE_TOKEN" : ""}`
+      );
+      break;
+    case "anonymous":
+      add("account", true, `not signed in: ${anonymousLimitsText()}`);
+      break;
+    case "rejected":
+      add(
+        "account",
+        false,
+        `sign-in rejected (${state.message}): run tutticode login`
+      );
+      break;
+    case "unreachable":
+      add("account", false, `could not check the sign-in: ${state.message}`);
+  }
+  if (envToken())
+    add(
+      "token override",
+      true,
+      "TUTTICODE_TOKEN is set: it wins over the stored sign-in"
+    );
+  const path = credentialsPath();
+  if (!(0, import_node_fs11.existsSync)(path))
+    return;
+  let access = checkFileAccess(path);
+  if (fix && access && !access.ok) {
+    try {
+      fixFileAccess(path);
+    } catch (e) {
+      if (!(e instanceof PrivateDirError))
+        throw e;
+      add("credentials folder", false, e.message);
+    }
+    access = checkFileAccess(path);
+  }
+  if (!access)
+    add("credentials file", true, `${path} (permissions not checked)`);
+  else
+    add(
+      "credentials file",
+      access.ok,
+      access.ok ? `${path}: ${access.detail}` : `${path} is too open (${access.detail}): run tutticode doctor --fix`
+    );
+}
+function anonymousLimitsText() {
+  const limits = accountLimits({ state: "anonymous" });
+  return `renders up to ${limits.maxSeconds} s, a voice tag over ${limits.watermarkAfterSeconds} s (sign in free: tutticode login)`;
+}
+async function login(command, io) {
+  const origin = accountOrigin(command.account.origin);
+  const locale = command.account.locale ?? "en";
+  ensurePrivateDir();
+  if (!command.noWait && !io.interactive) {
+    io.stderr.write(
+      `tutticode: login needs a person: run it in a terminal, or use ${TUTTICODE_LOGIN_HINT_COMMAND}
+`
+    );
+    return EXIT_USAGE;
+  }
+  if (envToken())
+    io.stderr.write(
+      "Note: TUTTICODE_TOKEN is set; it wins over this sign-in until you unset it.\n"
+    );
+  const name = deviceName();
+  const abort = new AbortController();
+  const onSigint = () => abort.abort();
+  process.once("SIGINT", onSigint);
+  try {
+    let tokens;
+    if (!command.device) {
+      const remote = !io.openBrowser && (!!process.env.SSH_CONNECTION || process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY);
+      tokens = await loopbackLogin({
+        origin,
+        locale,
+        deviceName: name,
+        signal: abort.signal,
+        openBrowser: io.openBrowser ?? (remote ? () => void 0 : openExternal),
+        onUrl: (url) => io.stderr.write(
+          remote ? `No browser can be opened here. Open this link in a browser on this computer:
+${url}
+Or sign in with a code on any device: tutticode login --device
+` : `Opening your browser to sign in. If it does not open, go to:
+${url}
+`
+        )
+      });
+    } else {
+      const device = await startDeviceLogin(origin, name);
+      const complete = device.verificationUriComplete ?? device.verificationUri;
+      if (command.noWait) {
+        const file2 = writePendingLogin({
+          origin,
+          deviceCode: device.deviceCode,
+          userCode: device.userCode,
+          verificationUri: device.verificationUri,
+          ...device.verificationUriComplete ? { verificationUriComplete: device.verificationUriComplete } : {},
+          expiresAt: new Date(
+            Date.now() + device.expiresIn * 1e3
+          ).toISOString(),
+          interval: device.interval,
+          deviceName: name
+        });
+        if (io.spawnLoginPoller)
+          io.spawnLoginPoller(file2);
+        else if (io.entry)
+          spawnLoginPoller(io.entry, file2);
+        else
+          throw new Error("Cannot start the background sign-in.");
+        if (command.json)
+          io.stdout.write(
+            `${JSON.stringify(
+              {
+                verificationUri: device.verificationUri,
+                verificationUriComplete: complete,
+                userCode: device.userCode,
+                expiresIn: device.expiresIn
+              },
+              null,
+              2
+            )}
+`
+          );
+        else
+          io.stdout.write(
+            `To sign in, open ${complete}
+(or open ${device.verificationUri} and enter the code ${device.userCode})
+within ${Math.round(
+              device.expiresIn / 60
+            )} minutes. tutticode finishes the sign-in in the background once it is approved; until then renders run without sign-in.
+`
+          );
+        return EXIT_OK;
+      }
+      io.stderr.write(
+        `To sign in, open ${device.verificationUri} on any device and enter the code
+
+    ${device.userCode}
+
+or open ${complete}
+or scan it with a phone:
+
+${renderUnicodeCompact(
+          complete,
+          { border: 1 }
+        )}
+
+Waiting for approval (the code expires in ${Math.round(
+          device.expiresIn / 60
+        )} minutes)...
+`
+      );
+      tokens = await pollDeviceToken(origin, device, {
+        ...io.loginPoll,
+        signal: abort.signal
+      });
+    }
+    const state = await completeLogin(origin, tokens, name);
+    io.stdout.write(
+      state.state === "signed-in" ? `Signed in as ${signedInAs(state.me)}
+` : "Signed in.\n"
+    );
+    return EXIT_OK;
+  } catch (e) {
+    if (e instanceof LoginError || e instanceof ApiUnreachable) {
+      io.stderr.write(`tutticode: ${e.message}
+`);
+      return EXIT_BRIDGE;
+    }
+    throw e;
+  } finally {
+    process.removeListener("SIGINT", onSigint);
+  }
+}
+async function logout(flags, io) {
+  const origin = accountOrigin(flags.origin);
+  const accountPage = `${origin}${ACCOUNT_PATH}`;
+  (0, import_node_fs11.rmSync)(pendingLoginPath(origin), { force: true });
+  if (envToken())
+    io.stderr.write(
+      `TUTTICODE_TOKEN is set: it keeps signing tutticode in until you unset it. Revoke it on the account page: ${accountPage}
+`
+    );
+  const stored = readAccount(origin);
+  if (!stored) {
+    io.stdout.write(`Not signed in on this computer (${origin}).
+`);
+    return EXIT_OK;
+  }
+  const revoked = await revokeToken(origin, stored.refreshToken);
+  await saveAccount(origin, void 0);
+  if (!revoked)
+    io.stderr.write(
+      `Warning: ${origin} could not be reached to end the sign-in; it is deleted here. Revoke this device on the account page: ${accountPage}
+`
+    );
+  io.stdout.write(
+    `Signed out${stored.email ? ` (${stored.email})` : ""}. Other devices and access tokens: ${accountPage}
+`
+  );
+  return EXIT_OK;
+}
+async function whoami(command, io) {
+  const origin = accountOrigin(command.account.origin);
+  const state = await accountState(origin);
+  const pending = state.state === "signed-in" ? void 0 : pendingLogin(origin);
+  if (command.json)
+    io.stdout.write(`${JSON.stringify(whoamiJson(state, pending), null, 2)}
+`);
+  else
+    for (const line of whoamiLines(state, pending))
+      io.stdout.write(`${line}
+`);
+  if (state.state === "signed-in")
+    return EXIT_OK;
+  return state.state === "anonymous" ? EXIT_ANONYMOUS : EXIT_BRIDGE;
+}
+function whoamiJson(state, pending) {
+  const pendingJson = pending ? {
+    pendingLogin: {
+      userCode: pending.userCode,
+      verificationUri: pending.verificationUri,
+      expiresAt: pending.expiresAt
+    }
+  } : {};
+  switch (state.state) {
+    case "signed-in": {
+      const { me } = state;
+      return {
+        signedIn: true,
+        tokenKind: state.tokenKind,
+        user: me.user,
+        plan: me.plan,
+        limits: me.limits,
+        usageToday: me.usageToday,
+        expiresAt: me.expiresAt,
+        deviceName: me.deviceName,
+        ...me.termsUpdate ? { termsUpdate: me.termsUpdate } : {}
+      };
+    }
+    case "anonymous":
+      return {
+        signedIn: false,
+        tokenKind: "anonymous",
+        limits: accountLimits(state),
+        loginHint: LOGIN_HINT,
+        ...pendingJson
+      };
+    default:
+      return {
+        signedIn: false,
+        tokenKind: state.tokenKind,
+        error: {
+          code: state.state === "rejected" ? state.code ?? "rejected" : "unreachable",
+          message: state.message
+        },
+        ...pendingJson
+      };
+  }
+}
+function whoamiLines(state, pending) {
+  const waiting = pending ? [
+    `A sign-in is waiting for approval: open ${pending.verificationUriComplete ?? pending.verificationUri} (code ${pending.userCode}).`
+  ] : [];
+  switch (state.state) {
+    case "signed-in": {
+      const { me } = state;
+      const until = me.expiresAt ? `, until ${me.expiresAt.slice(0, 10)}` : "";
+      const lines = [
+        `Signed in as ${signedInAs(me)}${me.user.nickname ? ` - ${me.user.nickname}` : ""}`,
+        state.tokenKind === "pat" ? `With TUTTICODE_TOKEN (an access token)${until}` : `Signed-in device: ${me.deviceName ?? "this computer"}${until}`,
+        `Limits: renders up to ${me.limits.maxSeconds} s, no voice tag`,
+        `Today: ${me.usageToday.renders} render${me.usageToday.renders === 1 ? "" : "s"}, ${Math.round(me.usageToday.seconds)} s of audio`
+      ];
+      if (me.termsUpdate && firstTime(`terms-update:${me.termsUpdate}`, "install"))
+        lines.push(
+          `The TuttiCode terms changed: ${me.termsUpdate} (the next tutticode login accepts them)`
+        );
+      return lines;
+    }
+    case "anonymous":
+      return [`Not signed in: ${anonymousLimitsText()}.`, ...waiting];
+    case "rejected":
+      return [
+        state.message.includes("tutticode login") ? state.message : `Your sign-in was rejected (${state.message}). Run tutticode login.`,
+        ...waiting
+      ];
+    case "unreachable":
+      return [`Could not check the sign-in: ${state.message}`];
+  }
+}
 async function setup(command, io) {
   const steps = policySteps(command.undo);
   if (command.undo) {
@@ -18727,7 +21446,7 @@ function askOnTerminal(io) {
 }
 
 // src/bin.ts
-setSkillsDir((0, import_node_path9.join)(__dirname, "skills"));
+setSkillsDir((0, import_node_path12.join)(__dirname, "skills"));
 main(process.argv.slice(2), {
   stdout: process.stdout,
   stderr: process.stderr,