@aisa-one/cli 0.3.0 → 0.5.1

package/dist/api.js

@@ -1,4 +1,5 @@
 import { BASE_URL } from "./constants.js";
+import { httpFetch, INFO_TIMEOUT_MS } from "./utils/http.js";
 import { getConfig } from "./config.js";
 /**
  * Derive every base path from one configured root.
@@ -55,10 +56,12 @@ export async function apiRequest(apiKey, endpoint, options = {}) {
         "x-aisa-source": "cli",
         ...extraHeaders,
     };
-    const res = await fetch(url, {
+    const res = await httpFetch(url, {
         method,
         headers,
         body: body ? JSON.stringify(body) : undefined,
+        idempotent: options.idempotent ?? method === "GET",
+        timeoutMs: options.timeoutMs,
     });
     if (!res.ok) {
         const text = await res.text();
@@ -90,10 +93,12 @@ export async function apiRequestRaw(apiKey, endpoint, options = {}) {
         "x-aisa-source": "cli",
         ...extraHeaders,
     };
-    return fetch(url, {
+    return httpFetch(url, {
         method,
         headers,
         body: body ? JSON.stringify(body) : undefined,
+        idempotent: options.idempotent ?? method === "GET",
+        timeoutMs: options.timeoutMs,
     });
 }
 /**
@@ -116,7 +121,13 @@ export async function publicRequest(path, options = {}) {
     const headers = { "x-aisa-source": "cli" };
     if (options.etag)
         headers["If-None-Match"] = options.etag;
-    const res = await fetch(`${resolveBases().info}/${path.replace(/^\/+/, "")}`, { headers });
+    // Catalog and pricing are unauthenticated GETs against a cache — retrying
+    // one is free, and failing one degrades every discovery command.
+    const res = await httpFetch(`${resolveBases().info}/${path.replace(/^\/+/, "")}`, {
+        headers,
+        idempotent: true,
+        timeoutMs: INFO_TIMEOUT_MS,
+    });
     if (res.status === 304)
         return { status: 304 };
     if (!res.ok)

package/dist/catalog.d.ts

@@ -47,7 +47,6 @@ export interface ProviderHealth {
     not_tested_count: number;
     checked_at?: string;
 }
-export declare const CATALOG_CONCURRENCY: number;
 export declare function getProviders(options?: {
     refresh?: boolean;
 }): Promise<CatalogProvider[]>;
@@ -59,29 +58,13 @@ export declare function getHealth(options?: {
 }): Promise<ProviderHealth[]>;
 /** Flatten a provider's groups — the group labels carry no meaning. */
 export declare function flatEndpoints(detail: CatalogDetail): CatalogEndpoint[];
-/** Strip the /apis/v1 prefix: what you'd pass to `aisa run`. */
+/** Strip the /apis/v1 prefix from a catalog path. */
 export declare function toRunPath(path: string): string;
 /**
  * The slug an endpoint is actually served under, which is not always the
  * provider id (provider `brave-search` serves `/apis/v1/brave/...`).
  */
 export declare function runSlugOf(detail: CatalogDetail): string | undefined;
-export interface EndpointRef {
-    provider: string;
-    endpoint: CatalogEndpoint;
-}
-/**
- * Load every provider's endpoints. Cold this is ~29 requests and several
- * hundred KB, so it runs through a bounded pool with progress reporting; warm
- * it is entirely local.
- */
-export declare function getAllEndpoints(options: {
-    refresh?: boolean;
-    onProgress?: (done: number, total: number) => void;
-}): Promise<{
-    endpoints: EndpointRef[];
-    failed: string[];
-}>;
 /**
  * Format a per-request price. Real values span $0.000001 to $0.08, so a fixed
  * number of decimals either rounds the cheap endpoints to $0.00 or pads the

package/dist/catalog.js

@@ -1,10 +1,8 @@
 import { publicRequest, cacheScope } from "./api.js";
 import { readCache, writeCache, touchCache } from "./cache.js";
-import { pool } from "./utils/pool.js";
 const CATEGORY_TTL_MS = 6 * 60 * 60 * 1000;
 const DETAIL_TTL_MS = 24 * 60 * 60 * 1000;
 const HEALTH_TTL_MS = 5 * 60 * 1000;
-export const CATALOG_CONCURRENCY = Number(process.env.AISA_CATALOG_CONCURRENCY) || 6;
 /** Fetch with disk caching and ETag revalidation; falls back to stale data offline. */
 async function cachedGet(path, cacheKey, ttlMs, refresh) {
     const cached = readCache(cacheKey);
@@ -51,7 +49,7 @@ export function flatEndpoints(detail) {
         .flatMap((g) => g.endpoints || [])
         .sort((a, b) => a.path.localeCompare(b.path));
 }
-/** Strip the /apis/v1 prefix: what you'd pass to `aisa run`. */
+/** Strip the /apis/v1 prefix from a catalog path. */
 export function toRunPath(path) {
     return path.replace(/^\/apis\/v1\//, "").replace(/^\/+/, "");
 }
@@ -63,27 +61,6 @@ export function runSlugOf(detail) {
     const first = flatEndpoints(detail)[0];
     return first ? toRunPath(first.path).split("/")[0] : undefined;
 }
-/**
- * Load every provider's endpoints. Cold this is ~29 requests and several
- * hundred KB, so it runs through a bounded pool with progress reporting; warm
- * it is entirely local.
- */
-export async function getAllEndpoints(options) {
-    const providers = await getProviders({ refresh: options.refresh });
-    const details = await pool(providers.map((p) => () => getProviderDetail(p.id, { refresh: options.refresh })), CATALOG_CONCURRENCY, options.onProgress);
-    const endpoints = [];
-    const failed = [];
-    details.forEach((detail, i) => {
-        if (!detail) {
-            failed.push(providers[i].id);
-            return;
-        }
-        for (const endpoint of flatEndpoints(detail)) {
-            endpoints.push({ provider: providers[i].id, endpoint });
-        }
-    });
-    return { endpoints, failed };
-}
 /**
  * Format a per-request price. Real values span $0.000001 to $0.08, so a fixed
  * number of decimals either rounds the cheap endpoints to $0.00 or pads the

package/dist/cli-error.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Expected CLI failures with a Unix exit code.
+ *
+ * wrap() maps these to process.exit(code) instead of the generic exit 1 used
+ * for unexpected throws. Exit 3 (partial batch) is usually set on
+ * process.exitCode after the response has already been written.
+ */
+export declare class CliError extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode: number);
+}
+export declare const EXIT_OK = 0;
+export declare const EXIT_TRANSPORT = 1;
+export declare const EXIT_USAGE = 2;
+export declare const EXIT_PARTIAL = 3;
+export declare function usageError(message: string): CliError;
+export declare function transportError(message: string): CliError;

package/dist/cli-error.js

@@ -0,0 +1,25 @@
+/**
+ * Expected CLI failures with a Unix exit code.
+ *
+ * wrap() maps these to process.exit(code) instead of the generic exit 1 used
+ * for unexpected throws. Exit 3 (partial batch) is usually set on
+ * process.exitCode after the response has already been written.
+ */
+export class CliError extends Error {
+    exitCode;
+    constructor(message, exitCode) {
+        super(message);
+        this.name = "CliError";
+        this.exitCode = exitCode;
+    }
+}
+export const EXIT_OK = 0;
+export const EXIT_TRANSPORT = 1;
+export const EXIT_USAGE = 2;
+export const EXIT_PARTIAL = 3;
+export function usageError(message) {
+    return new CliError(message, EXIT_USAGE);
+}
+export function transportError(message) {
+    return new CliError(message, EXIT_TRANSPORT);
+}

package/dist/cli-guidance.d.ts

@@ -0,0 +1,14 @@
+import { type RouterOperation } from "./router.js";
+/**
+ * Exact MCP operation identifiers → CLI command names.
+ * Human presentation only. Do not apply to --json or tool result payloads.
+ */
+export declare const MCP_CLI_MAP: Record<RouterOperation, {
+    identifier: string;
+    cli: string;
+    path: string;
+}>;
+/** Path after `aisa`, e.g. `search` — not a nested leaf like `api search`. */
+export declare function mcpForCommand(commandPath: string): (typeof MCP_CLI_MAP)[RouterOperation] | undefined;
+/** Project the four exact MCP identifiers onto CLI names. Other text is unchanged. */
+export declare function projectMcpIdentifiersToCli(text: string): string;

package/dist/cli-guidance.js

@@ -0,0 +1,55 @@
+import { ROUTER_PATHS } from "./router.js";
+/**
+ * Exact MCP operation identifiers → CLI command names.
+ * Human presentation only. Do not apply to --json or tool result payloads.
+ */
+export const MCP_CLI_MAP = {
+    search: {
+        identifier: "AISA_SEARCH_TOOL",
+        cli: "aisa search",
+        path: ROUTER_PATHS.search,
+    },
+    schema: {
+        identifier: "AISA_BATCH_GET_SCHEMA",
+        cli: "aisa schema",
+        path: ROUTER_PATHS.schema,
+    },
+    quote: {
+        identifier: "AISA_BATCH_QUOTE",
+        cli: "aisa quote",
+        path: ROUTER_PATHS.quote,
+    },
+    call: {
+        identifier: "AISA_BATCH_USE",
+        cli: "aisa call",
+        path: ROUTER_PATHS.call,
+    },
+};
+const REPLACEMENTS = Object.values(MCP_CLI_MAP)
+    .map(({ identifier, cli }) => ({
+    identifier,
+    cli,
+    pattern: new RegExp(`\\b${escapeRegExp(identifier)}\\b`, "g"),
+}))
+    .sort((a, b) => b.identifier.length - a.identifier.length);
+/** Path after `aisa`, e.g. `search` — not a nested leaf like `api search`. */
+export function mcpForCommand(commandPath) {
+    if (commandPath === "search" ||
+        commandPath === "schema" ||
+        commandPath === "quote" ||
+        commandPath === "call") {
+        return MCP_CLI_MAP[commandPath];
+    }
+    return undefined;
+}
+/** Project the four exact MCP identifiers onto CLI names. Other text is unchanged. */
+export function projectMcpIdentifiersToCli(text) {
+    let out = text;
+    for (const { pattern, cli } of REPLACEMENTS) {
+        out = out.replace(pattern, cli);
+    }
+    return out;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/dist/commands/account.d.ts

@@ -2,6 +2,23 @@ export declare function formatMicrosUSD(micros: number | string | bigint): strin
 export declare function balanceAction(options?: {
     json?: boolean;
 }): Promise<void>;
+/**
+ * `aisa topup [amount]` — open the console's billing page to add credit.
+ *
+ * Payment ends in a browser no matter what: card details must reach Stripe's
+ * hosted page, not us (PCI), and a bank's 3-D Secure step has nowhere else to
+ * run. So this command's job is to get the user to the right page, not to
+ * take a payment.
+ *
+ * With an amount it deep-links `?amount=`, which the billing page can prefill;
+ * without one the page is where the choice belongs. A future version can mint
+ * a Stripe checkout URL directly (backend already returns one from
+ * POST /api/billing/topups) and skip a hop — that needs the console API to
+ * accept the CLI's OAuth token, which it does not yet.
+ */
+export declare function topupAction(amount: string | undefined, options?: {
+    open?: boolean;
+}): void;
 export declare function usageAction(_options: {
     limit?: string;
     days?: string;

package/dist/commands/account.js

@@ -1,7 +1,9 @@
+import { run } from "../utils/exec.js";
 import chalk from "chalk";
 import { requireApiKey } from "../config.js";
 import { apiRequest } from "../api.js";
-import { formatJson, hint } from "../utils/display.js";
+import { formatJson, hint, info, error } from "../utils/display.js";
+import { CONSOLE_BILLING_URL } from "../constants.js";
 export function formatMicrosUSD(micros) {
     const value = typeof micros === "bigint" ? micros : BigInt(micros);
     const negative = value < 0n;
@@ -33,6 +35,48 @@ export async function balanceAction(options = {}) {
     else {
         console.log(`  API key limit:       ${formatMicrosUSD(balance.api_key.remaining_micros_usd)} remaining`);
     }
+    // Say it here rather than at the failed call: a balance read is exactly when
+    // someone can act on it.
+    if (Number(balance.account_balance_micros_usd) <= 0) {
+        hint("Out of credit — run 'aisa topup' to add some");
+    }
+}
+/**
+ * `aisa topup [amount]` — open the console's billing page to add credit.
+ *
+ * Payment ends in a browser no matter what: card details must reach Stripe's
+ * hosted page, not us (PCI), and a bank's 3-D Secure step has nowhere else to
+ * run. So this command's job is to get the user to the right page, not to
+ * take a payment.
+ *
+ * With an amount it deep-links `?amount=`, which the billing page can prefill;
+ * without one the page is where the choice belongs. A future version can mint
+ * a Stripe checkout URL directly (backend already returns one from
+ * POST /api/billing/topups) and skip a hop — that needs the console API to
+ * accept the CLI's OAuth token, which it does not yet.
+ */
+export function topupAction(amount, options = {}) {
+    let url = CONSOLE_BILLING_URL;
+    if (amount !== undefined) {
+        const value = Number(amount);
+        if (!Number.isFinite(value) || value <= 0) {
+            error(`Invalid amount: ${amount}`);
+            hint("Pass a positive number of US dollars, e.g. 'aisa topup 20'");
+            process.exitCode = 1;
+            return;
+        }
+        url = `${CONSOLE_BILLING_URL}?amount=${value}`;
+        info(`Opening the billing page to add ${formatMicrosUSD(BigInt(Math.round(value * 1_000_000)))}`);
+    }
+    else {
+        info("Opening the billing page — choose an amount there");
+    }
+    console.log(`  ${chalk.cyan(url)}`);
+    if (options.open === false)
+        return;
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    void run(cmd, [url], { timeout: 30_000 }).catch(() => { });
+    hint("Credit lands in your account as soon as the payment completes");
 }
 export async function usageAction(_options) {
     requireApiKey();

package/dist/commands/api.d.ts

@@ -11,14 +11,3 @@ export declare function apiShowAction(idOrSlug: string, path?: string, options?:
     all?: boolean;
     refresh?: boolean;
 }): Promise<void>;
-export declare function apiSearchAction(query: string, options: {
-    limit?: string;
-    provider?: string;
-    json?: boolean;
-    refresh?: boolean;
-}): Promise<void>;
-export declare function apiCodeAction(slug: string, path: string, options: {
-    lang?: string;
-    method?: string;
-    refresh?: boolean;
-}): Promise<void>;

package/dist/commands/api.js

@@ -2,8 +2,7 @@ import ora from "ora";
 import chalk from "chalk";
 import { error, formatJson, hint, table, truncate } from "../utils/display.js";
 import { API_CATEGORIES, categoryOf } from "../constants.js";
-import { resolveBases } from "../api.js";
-import { getProviders, getProviderDetail, getHealth, getAllEndpoints, flatEndpoints, toRunPath, runSlugOf, formatPrice, } from "../catalog.js";
+import { getProviders, getProviderDetail, getHealth, flatEndpoints, toRunPath, runSlugOf, formatPrice, } from "../catalog.js";
 const DEFAULT_ENDPOINT_LIMIT = 40;
 function statusBadge(status) {
     switch (status) {
@@ -69,7 +68,7 @@ export async function apiListAction(options) {
     console.log();
     console.log(chalk.gray(`  ${providers.length} APIs · ${total} endpoints`));
     hint("Details: aisa api show <api>");
-    hint("Search:  aisa api search <query>");
+    hint("Catalog paths and prices are browsing metadata, not a substitute for aisa schema or aisa quote.");
 }
 /** Resolve a provider by id, or by the URL slug its endpoints are served under. */
 async function findProvider(idOrSlug, refresh) {
@@ -89,7 +88,6 @@ async function findProvider(idOrSlug, refresh) {
 }
 function printEndpointDetail(detail, endpoint) {
     const runPath = toRunPath(endpoint.path);
-    const [slug, ...rest] = runPath.split("/");
     console.log(`\n  ${chalk.cyan.bold(endpoint.name || runPath)}`);
     if (endpoint.description)
         console.log(`  ${endpoint.description}`);
@@ -100,8 +98,8 @@ function printEndpointDetail(detail, endpoint) {
     if (params.length > 0) {
         console.log(`  Path params: ${params.join(", ")}`);
     }
-    console.log(`\n  ${chalk.gray(`aisa run ${slug} /${rest.join("/")}`)}`);
-    hint(`Code:  aisa api code ${slug} /${rest.join("/")}`);
+    console.log();
+    hint("Catalog paths and prices are browsing metadata, not a substitute for aisa schema or aisa quote.");
 }
 export async function apiShowAction(idOrSlug, path, options = {}) {
     const spinner = ora(`Loading ${idOrSlug}...`).start();
@@ -184,176 +182,9 @@ export async function apiShowAction(idOrSlug, path, options = {}) {
             console.log(chalk.gray(`\n  … ${endpoints.length - shown.length} more — pass --all to see them`));
         }
     }
-    const slug = runSlugOf(detail);
-    if (slug) {
+    if (runSlugOf(detail)) {
         console.log();
-        hint(`Call:   aisa run ${slug} <path>`);
         hint(`Detail: aisa api show ${detail.id} <path>`);
+        hint("Catalog paths and prices are browsing metadata, not a substitute for aisa schema or aisa quote.");
     }
 }
-export async function apiSearchAction(query, options) {
-    const limit = options.limit ? parseInt(options.limit) : 20;
-    const terms = query.toLowerCase().split(/\s+/).filter(Boolean);
-    const spinner = ora("Indexing catalog...").start();
-    let endpoints;
-    let failed = [];
-    if (options.provider) {
-        const detail = await getProviderDetail(options.provider, { refresh: options.refresh }).catch(() => undefined);
-        if (!detail) {
-            spinner.fail(`Unknown API "${options.provider}"`);
-            return;
-        }
-        endpoints = flatEndpoints(detail).map((endpoint) => ({ provider: detail.id, endpoint }));
-    }
-    else {
-        const result = await getAllEndpoints({
-            refresh: options.refresh,
-            onProgress: (done, total) => {
-                spinner.text = `Indexing catalog (${done}/${total})...`;
-            },
-        });
-        endpoints = result.endpoints;
-        failed = result.failed;
-    }
-    const providers = await getProviders({ refresh: options.refresh });
-    spinner.stop();
-    const matchesAll = (haystack) => terms.every((t) => haystack.includes(t));
-    // --provider means "restrict to one API", so provider-level hits have to be
-    // scoped too — otherwise `search brave --provider financial` reports brave.
-    const providerHits = providers
-        .filter((p) => !options.provider || p.id === options.provider)
-        .filter((p) => matchesAll(p.id.toLowerCase()));
-    const scored = endpoints
-        .map(({ provider, endpoint }) => {
-        const name = (endpoint.name || "").toLowerCase();
-        const path = toRunPath(endpoint.path).toLowerCase();
-        const desc = (endpoint.description || "").toLowerCase();
-        let score = 0;
-        if (matchesAll(name))
-            score = 3;
-        else if (matchesAll(path))
-            score = 2;
-        else if (matchesAll(desc))
-            score = 1;
-        return { provider, endpoint, score };
-    })
-        .filter((r) => r.score > 0)
-        .sort((a, b) => b.score - a.score || a.endpoint.path.localeCompare(b.endpoint.path));
-    if (options.json) {
-        console.log(formatJson({
-            providers: providerHits.map((p) => p.id),
-            endpoints: scored.slice(0, limit).map((r) => ({
-                provider: r.provider,
-                path: r.endpoint.path,
-                name: r.endpoint.name,
-                price: r.endpoint.pricing?.normal,
-            })),
-        }));
-        return;
-    }
-    if (providerHits.length === 0 && scored.length === 0) {
-        console.log(`  No matches for "${query}".`);
-        if (failed.length > 0) {
-            hint(`${failed.length} APIs could not be indexed: ${failed.join(", ")}`);
-        }
-        return;
-    }
-    if (providerHits.length > 0) {
-        console.log(chalk.bold(`\n  Matching APIs\n`));
-        for (const p of providerHits) {
-            console.log(`  ${chalk.cyan.bold(p.id)} ${chalk.gray(`${p.endpoint_count} endpoints · from ${formatPrice(p.pricing?.normal)}`)}`);
-        }
-    }
-    if (scored.length > 0) {
-        console.log(chalk.bold(`\n  Matching endpoints${scored.length > limit ? ` (${limit} of ${scored.length})` : ""}\n`));
-        for (const { endpoint } of scored.slice(0, limit)) {
-            const runPath = toRunPath(endpoint.path);
-            const [slug, ...rest] = runPath.split("/");
-            console.log(`  ${chalk.cyan(runPath)} ${chalk.gray(formatPrice(endpoint.pricing?.normal))}`);
-            if (endpoint.name)
-                console.log(`    ${chalk.gray(truncate(endpoint.name, 78))}`);
-            console.log(chalk.gray(`    aisa run ${slug} /${rest.join("/")}`));
-            console.log();
-        }
-    }
-    if (failed.length > 0) {
-        hint(`${failed.length} APIs unavailable and not searched: ${failed.join(", ")}`);
-    }
-}
-function generateCode(lang, url, method, note) {
-    const header = `# ${note}`;
-    switch (lang) {
-        case "curl":
-            return [
-                header,
-                `curl -X ${method} "${url}" \\`,
-                `  -H "Authorization: Bearer $AISA_API_KEY" \\`,
-                `  -H "Content-Type: application/json"`,
-            ].join("\n");
-        case "python":
-            return [
-                header,
-                `import os, requests`,
-                ``,
-                `resp = requests.${method.toLowerCase()}(`,
-                `    "${url}",`,
-                `    headers={"Authorization": f"Bearer {os.environ['AISA_API_KEY']}"},`,
-                method === "GET" ? `    params={},` : `    json={},`,
-                `)`,
-                `resp.raise_for_status()`,
-                `print(resp.json())`,
-            ].join("\n");
-        case "node":
-        case "typescript":
-            return [
-                `// ${note}`,
-                `const res = await fetch("${url}", {`,
-                `  method: "${method}",`,
-                `  headers: {`,
-                `    Authorization: \`Bearer \${process.env.AISA_API_KEY}\`,`,
-                `    "Content-Type": "application/json",`,
-                `  },`,
-                ...(method === "GET" ? [] : [`  body: JSON.stringify({}),`]),
-                `});`,
-                `console.log(await res.json());`,
-            ].join("\n");
-    }
-}
-export async function apiCodeAction(slug, path, options) {
-    const lang = (options.lang || "curl").toLowerCase();
-    if (!["curl", "python", "node", "typescript"].includes(lang)) {
-        error(`Unknown language: ${lang}. Valid: curl, python, node, typescript`);
-        return;
-    }
-    const cleanSlug = slug.replace(/^\/+|\/+$/g, "");
-    const cleanPath = path.replace(/^\/+/, "");
-    const runPath = toRunPath(`${cleanSlug}/${cleanPath}`);
-    const url = `${resolveBases().domain}/${runPath}`;
-    // Look the endpoint up when possible for validation and pricing, but never
-    // let a cold cache or an offline machine block code generation.
-    let endpoint;
-    try {
-        const { endpoints } = await getAllEndpoints({ refresh: options.refresh });
-        endpoint = endpoints.find((e) => toRunPath(e.endpoint.path) === runPath)?.endpoint;
-        if (!endpoint) {
-            hint(`No catalog entry for "${runPath}" — generating anyway`);
-            hint(`Search: aisa api search ${cleanPath.split("/")[0]}`);
-        }
-    }
-    catch {
-        // offline: generate without validation
-    }
-    // The catalog hardcodes GET server-side, so it is a hint rather than a fact.
-    const method = (options.method || "GET").toUpperCase();
-    const price = endpoint?.pricing?.normal;
-    const note = [
-        endpoint?.name || runPath,
-        price != null ? `${formatPrice(price)} per request` : undefined,
-        "method is advisory — pass --method to override",
-    ]
-        .filter(Boolean)
-        .join(" · ");
-    console.log();
-    console.log(generateCode(lang, url, method, note));
-    console.log();
-}

package/dist/commands/auth.d.ts

@@ -1,5 +1,6 @@
 export declare function loginAction(options: {
     key?: string;
-}): void;
+    browser?: boolean;
+}): Promise<void>;
 export declare function logoutAction(): void;
 export declare function whoamiAction(): void;

package/dist/commands/auth.js

@@ -1,16 +1,50 @@
 import chalk from "chalk";
-import { setApiKey, clearApiKey, getApiKey, getKeySource, maskKey } from "../config.js";
-import { success, error, info } from "../utils/display.js";
-import { ENV_VAR_NAME } from "../constants.js";
-export function loginAction(options) {
+import { setApiKey, clearApiKey, getApiKey, getKeySource, maskKey, AUTH_SETUP_GUIDANCE } from "../config.js";
+import { success, info } from "../utils/display.js";
+import { CONSOLE_URL, ENV_VAR_NAME } from "../constants.js";
+export async function loginAction(options) {
     const key = options.key || process.env[ENV_VAR_NAME];
-    if (!key) {
-        error(`Provide a key with --key or set ${ENV_VAR_NAME}`);
-        process.exit(1);
+    if (key) {
+        setApiKey(key);
+        success(`Authenticated: ${maskKey(key)}`);
+        await proveItWorks();
+        return;
+    }
+    // No key given: the browser sign-in is the front door, not an error.
+    //
+    // `--no-browser` leaves `browser` false; not passing it leaves it true,
+    // and passing that on as an explicit "yes" overrode the machine's own read
+    // of whether it has a browser at all — which is how a server ended up
+    // waiting for a click. Only the false case is the user speaking.
+    const { oauthLogin } = await import("./oauth-login.js");
+    await oauthLogin(options.browser === false ? { open: false } : {});
+    await proveItWorks();
+}
+/**
+ * Use the key we just stored, and show what came back.
+ *
+ * "Signed in — key stored" says a file was written. It does not say the key
+ * works, and those are different claims: a pasted key can be the wrong one, a
+ * minted one can belong to an account with no credit. Ending on a balance
+ * turns the question "did that work?" into something already answered on
+ * screen, which is what someone finishing a sign-in actually wants to know.
+ *
+ * Failure here is not a failed sign-in — the key is stored either way — so it
+ * says what it could not do and points at the command to retry with.
+ */
+async function proveItWorks() {
+    try {
+        const { balanceAction } = await import("./account.js");
+        await balanceAction();
+    }
+    catch (e) {
+        info(`Stored, but could not read your balance: ${e.message}`);
+        console.log(chalk.gray("  Try: aisa balance"));
     }
-    setApiKey(key);
-    success(`Authenticated: ${maskKey(key)}`);
-    console.log(chalk.gray("  Get your API key at https://console.aisa.one/api-keys"));
+    // Last line, and an address rather than a command: everything above is
+    // this machine, and the account behind it lives somewhere the terminal
+    // cannot show. Written out so it can be remembered, not just clicked.
+    console.log(chalk.gray(`  Account, usage and top-ups — ${chalk.cyan(CONSOLE_URL)}`));
 }
 export function logoutAction() {
     clearApiKey();
@@ -21,7 +55,7 @@ export function whoamiAction() {
     const source = getKeySource();
     if (!key) {
         info("Not authenticated.");
-        console.log(chalk.gray(`  Run "aisa login --key <key>" or set ${ENV_VAR_NAME}`));
+        console.log(chalk.gray(`  ${AUTH_SETUP_GUIDANCE}`));
         return;
     }
     console.log(`  Key:    ${maskKey(key)}`);

package/dist/commands/brand-logos.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Brand marks used by the T2 connect flow, inlined so the page stays
+ * self-contained. Sourced via icon-kit from Iconify (sets: thesvg-color,
+ * logos); each carries its own colours and ignores currentColor.
+ */
+export declare const BRAND_LOGOS: Record<string, string>;