@alexkroman1/aai-cli 5.5.1 → 5.6.0

package/dist/cli.mjs

@@ -5,7 +5,7 @@ import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { defineCommand, runMain } from "citty";
-//#region cli.ts
+//#region _cli-common.ts
 /** Shared arg definitions for citty commands. */
 const sharedArgs = {
 	server: {
@@ -23,21 +23,6 @@ const sharedArgs = {
 		description: "Output JSON (auto-detected in non-TTY)"
 	}
 };
-const cliDir = path.dirname(fileURLToPath(import.meta.url));
-/**
-* Read this CLI's own version from its package.json (source layout keeps it
-* next to cli.ts; dist layout one level up). A missing or corrupt file must
-* not brick every command over a cosmetic string — warn and fall back.
-*/
-function readCliVersion(dir) {
-	for (const candidate of [path.join(dir, "package.json"), path.join(dir, "..", "package.json")]) try {
-		const parsed = JSON.parse(readFileSync(candidate, "utf-8"));
-		if (typeof parsed.version === "string") return parsed.version;
-	} catch {}
-	process.stderr.write("warning: could not read aai's package.json — reporting version unknown\n");
-	return "unknown";
-}
-const VERSION = readCliVersion(cliDir);
 /** Shared command setup: resolve cwd, optionally require agent.ts. */
 async function setup(opts) {
 	const cwd = resolveCwd();
@@ -77,6 +62,140 @@ async function runCommand(args, fn) {
 	if (mode === "json") await writeLine(`${JSON.stringify(result)}\n`);
 	if (!result.ok) process.exit(1);
 }
+//#endregion
+//#region _studio-commands.ts
+const list = defineCommand({
+	meta: {
+		name: "list",
+		description: "List your studio projects"
+	},
+	args: {
+		server: sharedArgs.server,
+		json: sharedArgs.json
+	},
+	async run({ args }) {
+		await runCommand(args, async () => {
+			const cwd = resolveCwd();
+			const { executeList } = await import("./studio-CsRn2J1a.mjs");
+			return executeList({
+				cwd,
+				server: args.server
+			});
+		});
+	}
+});
+const pull = defineCommand({
+	meta: {
+		name: "pull",
+		description: "Pull a studio project into a local directory"
+	},
+	args: {
+		project: {
+			type: "positional",
+			description: "Studio project name (see `aai list`)",
+			required: true
+		},
+		dir: {
+			type: "positional",
+			description: "Target directory (default: the project name)",
+			required: false
+		},
+		force: {
+			type: "boolean",
+			alias: "f",
+			description: "Overwrite files in a non-empty directory"
+		},
+		server: sharedArgs.server,
+		json: sharedArgs.json
+	},
+	async run({ args }) {
+		await runCommand(args, async () => {
+			const cwd = resolveCwd();
+			const { executePull } = await import("./studio-CsRn2J1a.mjs");
+			return executePull({
+				cwd,
+				project: args.project,
+				dir: args.dir,
+				force: args.force,
+				server: args.server
+			});
+		});
+	}
+});
+const push = defineCommand({
+	meta: {
+		name: "push",
+		description: "Sync this project's source to its studio workspace"
+	},
+	args: {
+		force: {
+			type: "boolean",
+			alias: "f",
+			description: "Overwrite studio-side changes instead of failing the fast-forward check"
+		},
+		server: sharedArgs.server,
+		json: sharedArgs.json
+	},
+	async run({ args }) {
+		await runCommand(args, async () => {
+			const cwd = await setup({ agent: true });
+			const { executePush } = await import("./studio-CsRn2J1a.mjs");
+			return executePush({
+				cwd,
+				server: args.server,
+				force: args.force
+			});
+		});
+	}
+});
+const publish = defineCommand({
+	meta: {
+		name: "publish",
+		description: "Push to the studio and deploy to production (the studio's Publish button)"
+	},
+	args: {
+		force: {
+			type: "boolean",
+			alias: "f",
+			description: "Overwrite studio-side changes instead of failing the fast-forward check"
+		},
+		server: sharedArgs.server,
+		json: sharedArgs.json,
+		skipTypecheck: {
+			type: "boolean",
+			description: "Skip type checking before publishing"
+		}
+	},
+	async run({ args }) {
+		await runCommand(args, async () => {
+			const cwd = await setup({ agent: true });
+			const { executePublish } = await import("./studio-CsRn2J1a.mjs");
+			return executePublish({
+				cwd,
+				server: args.server,
+				force: args.force,
+				skipTypecheck: args.skipTypecheck
+			});
+		});
+	}
+});
+//#endregion
+//#region cli.ts
+const cliDir = path.dirname(fileURLToPath(import.meta.url));
+/**
+* Read this CLI's own version from its package.json (source layout keeps it
+* next to cli.ts; dist layout one level up). A missing or corrupt file must
+* not brick every command over a cosmetic string — warn and fall back.
+*/
+function readCliVersion(dir) {
+	for (const candidate of [path.join(dir, "package.json"), path.join(dir, "..", "package.json")]) try {
+		const parsed = JSON.parse(readFileSync(candidate, "utf-8"));
+		if (typeof parsed.version === "string") return parsed.version;
+	} catch {}
+	process.stderr.write("warning: could not read aai's package.json — reporting version unknown\n");
+	return "unknown";
+}
+const VERSION = readCliVersion(cliDir);
 const init = defineCommand({
 	meta: {
 		name: "init",
@@ -108,7 +227,7 @@ const init = defineCommand({
 	},
 	async run({ args }) {
 		await runCommand(args, async (mode) => {
-			const { executeInit } = await import("./init-DoU4_txp.mjs");
+			const { executeInit } = await import("./init-BGlOhIOl.mjs");
 			return executeInit({
 				dir: args.dir,
 				force: args.force,
@@ -137,7 +256,7 @@ const dev = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeDev } = await import("./dev-gVNdGFYY.mjs");
+			const { executeDev } = await import("./dev-C5P8amSg.mjs");
 			return executeDev({
 				cwd,
 				port: args.port
@@ -178,7 +297,7 @@ const build = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeBuild } = await import("./build-D_PgQOD4.mjs");
+			const { executeBuild } = await import("./build-BXwDB78d.mjs");
 			return executeBuild({
 				cwd,
 				skipTests: args.skipTests,
@@ -190,7 +309,8 @@ const build = defineCommand({
 const deploy = defineCommand({
 	meta: {
 		name: "deploy",
-		description: "Bundle and deploy to production"
+		description: "(internal) used by studio Publish",
+		hidden: true
 	},
 	args: {
 		server: sharedArgs.server,
@@ -199,6 +319,10 @@ const deploy = defineCommand({
 			type: "boolean",
 			description: "Deploy even when the agent's providers are missing credentials (the server warns instead of rejecting; set them afterwards with `aai secret put`)"
 		},
+		allowPreviewSlug: {
+			type: "boolean",
+			description: "Permit a `-preview`-suffixed slug (reserved for studio auto-previews; studio-internal — a slug you claim this way is subject to the preview reaper)"
+		},
 		skipTypecheck: {
 			type: "boolean",
 			description: "Skip type checking before deploy"
@@ -207,11 +331,12 @@ const deploy = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeDeploy } = await import("./deploy-1eaXcfUw.mjs");
+			const { executeDeploy } = await import("./deploy-D-O-Q_mW.mjs");
 			return executeDeploy({
 				cwd,
 				server: args.server,
 				allowMissingSecrets: args.allowMissingSecrets,
+				allowPreviewSlug: args.allowPreviewSlug,
 				skipTypecheck: args.skipTypecheck
 			});
 		});
@@ -220,7 +345,7 @@ const deploy = defineCommand({
 const del = defineCommand({
 	meta: {
 		name: "delete",
-		description: "Remove a deployed agent"
+		description: "Delete the studio project and its deployed agents"
 	},
 	args: {
 		server: sharedArgs.server,
@@ -229,7 +354,7 @@ const del = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup();
-			const { executeDelete } = await import("./delete-DXilFBb1.mjs");
+			const { executeDelete } = await import("./delete-BaHgd9cN.mjs");
 			return executeDelete({
 				cwd,
 				server: args.server
@@ -260,7 +385,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async (mode) => {
 					const cwd = await setup();
-					const { executeSecretPut, NO_INPUT, readStdin } = await import("./secret-CGAIAbUx.mjs");
+					const { executeSecretPut, NO_INPUT, readStdin } = await import("./secret-_bHo4rqt.mjs");
 					const value = mode === "json" ? await readStdin() : void 0;
 					if (mode === "json" && !value) throw new CliError(...NO_INPUT);
 					return executeSecretPut(cwd, args.name, value, args.server);
@@ -284,7 +409,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async () => {
 					const cwd = await setup();
-					const { executeSecretDelete } = await import("./secret-CGAIAbUx.mjs");
+					const { executeSecretDelete } = await import("./secret-_bHo4rqt.mjs");
 					return executeSecretDelete(cwd, args.name, args.server);
 				});
 			}
@@ -301,7 +426,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async () => {
 					const cwd = await setup();
-					const { executeSecretList } = await import("./secret-CGAIAbUx.mjs");
+					const { executeSecretList } = await import("./secret-_bHo4rqt.mjs");
 					return executeSecretList(cwd, args.server);
 				});
 			}
@@ -336,7 +461,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageStatus } = await import("./storage-CnhOayhm.mjs");
+					const { executeStorageStatus } = await import("./storage-MWiVx_mV.mjs");
 					return executeStorageStatus(resolveStorageCwd(args.dir), args.server);
 				});
 			}
@@ -353,7 +478,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageEnable } = await import("./storage-CnhOayhm.mjs");
+					const { executeStorageEnable } = await import("./storage-MWiVx_mV.mjs");
 					return executeStorageEnable(resolveStorageCwd(args.dir), args.server);
 				});
 			}
@@ -375,7 +500,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageDisable } = await import("./storage-CnhOayhm.mjs");
+					const { executeStorageDisable } = await import("./storage-MWiVx_mV.mjs");
 					return executeStorageDisable(resolveStorageCwd(args.dir), {
 						server: args.server,
 						force: args.force
@@ -388,7 +513,7 @@ const storage = defineCommand({
 const login = defineCommand({
 	meta: {
 		name: "login",
-		description: "Sign in with your email and save your API key"
+		description: "Link your signed-in browser account and save your API key"
 	},
 	args: {
 		server: sharedArgs.server,
@@ -396,7 +521,7 @@ const login = defineCommand({
 	},
 	async run({ args }) {
 		await runCommand(args, async () => {
-			const { executeLogin } = await import("./login-C59ZHzuO.mjs");
+			const { executeLogin } = await import("./login-B6IhXski.mjs");
 			return executeLogin({ server: args.server });
 		});
 	}
@@ -409,7 +534,7 @@ const templates = defineCommand({
 	args: { json: sharedArgs.json },
 	async run({ args }) {
 		await runCommand(args, async (mode) => {
-			const { listTemplates } = await import("./_templates-Bv8CR800.mjs");
+			const { listTemplates } = await import("./_templates-jmjgdgcd.mjs");
 			const names = await listTemplates();
 			if (mode === "human") {
 				for (const name of names) log.message(name);
@@ -433,6 +558,10 @@ const mainCommand = defineCommand({
 		dev,
 		test,
 		build,
+		list,
+		pull,
+		push,
+		publish,
 		deploy,
 		delete: del,
 		login,
@@ -450,12 +579,12 @@ if (process.env.VITEST !== "true") {
 			return;
 		}
 		if (process.stdin.isTTY && process.stdout.isTTY) {
-			if (await (await import("@clack/prompts")).confirm({ message: "Deploy this agent to production?" }) !== true) {
+			if (await (await import("@clack/prompts")).confirm({ message: "Publish this agent to production?" }) !== true) {
 				log.info("Cancelled. Run `aai --help` to see all commands.");
 				process.exit(0);
 			}
 		}
-		process.argv.splice(2, 0, "deploy");
+		process.argv.splice(2, 0, "publish");
 	};
 	runDefault().then(() => runMain(mainCommand)).catch((err) => {
 		log.error(errorMessage(err));

package/dist/delete-BaHgd9cN.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+import { n as log, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { i as resolveDeployTarget, n as getServerInfo } from "./_agent-BB1ZaZsX.mjs";
+import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-B6_uvuLs.mjs";
+//#region delete.ts
+async function runDelete(opts) {
+	await apiRequest(`${opts.url}/${opts.slug}`, {
+		method: "DELETE",
+		apiKey: opts.apiKey,
+		action: "delete",
+		hints: { 404: HINT_NOT_DEPLOYED },
+		...opts.fetch ? { fetch: opts.fetch } : {}
+	});
+}
+/**
+* Delete THE PROJECT. A studio-linked directory deletes its studio project
+* (`DELETE /studio/projects/:project`), which cascades server-side to the
+* workspace, chat, and the project's deployed + preview agents — the exact
+* delete the studio's own Delete button runs. A directory that only knows a
+* slug (no studio link) deletes that deployed agent directly.
+*/
+async function executeDelete(opts) {
+	const { cwd } = opts;
+	const { config, serverUrl, apiKey } = await resolveDeployTarget(cwd, opts.server);
+	if (config?.studioProject) {
+		const project = config.studioProject;
+		log.step(`Deleting studio project ${project} (and its deployed agents)`);
+		await apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}`, {
+			method: "DELETE",
+			apiKey,
+			action: "delete",
+			hints: { 404: "Run `aai list` to see your projects." }
+		});
+		log.success(`Deleted ${project}`);
+		return ok({
+			project,
+			...config.slug ? { slug: config.slug } : {}
+		});
+	}
+	const { slug } = await getServerInfo(cwd, opts.server);
+	log.step(`Deleting ${slug}`);
+	await runDelete({
+		url: serverUrl,
+		slug,
+		apiKey
+	});
+	log.success(`Deleted ${serverUrl}/${slug}`);
+	return ok({ slug });
+}
+//#endregion
+export { executeDelete };

package/dist/delete.d.ts

@@ -8,9 +8,16 @@ export type DeleteOpts = {
 };
 export declare function runDelete(opts: DeleteOpts): Promise<void>;
 type DeleteData = {
-    slug: string;
+    slug?: string;
+    project?: string;
 };
-/** Execute delete and return structured result. */
+/**
+ * Delete THE PROJECT. A studio-linked directory deletes its studio project
+ * (`DELETE /studio/projects/:project`), which cascades server-side to the
+ * workspace, chat, and the project's deployed + preview agents — the exact
+ * delete the studio's own Delete button runs. A directory that only knows a
+ * slug (no studio link) deletes that deployed agent directly.
+ */
 export declare function executeDelete(opts: {
     cwd: string;
     server?: string | undefined;

package/dist/{deploy-1eaXcfUw.mjs → deploy-D-O-Q_mW.mjs}

@@ -2,17 +2,18 @@
 import { n as log, t as fmtUrl, u as ok } from "./_ui-8kOEB-JH.mjs";
 import { a as errorMessage } from "./_utils-Ch0J4s6a.mjs";
 import { t as buildAgentBundle } from "./_bundler-Cjaxa2wi.mjs";
-import { c as writeProjectConfig } from "./_config-5AEqhh-O.mjs";
+import { s as updateProjectConfig } from "./_config-PIC0nzRu.mjs";
 import { t as resolveServerEnv } from "./_server-common-CnaP_Urf.mjs";
-import { i as resolveDeployTarget } from "./_agent-DMyOab9_.mjs";
-import { t as assertTypechecks } from "./_typecheck-gate-9IHWDnl1.mjs";
-import { n as apiRequest } from "./_api-client-MenP4-O7.mjs";
+import { i as resolveDeployTarget } from "./_agent-BB1ZaZsX.mjs";
+import { assertTypechecks } from "./_typecheck-gate-DvE8S3aQ.mjs";
+import { n as apiRequest } from "./_api-client-B6_uvuLs.mjs";
 import { gzipSync } from "node:zlib";
 //#region _deploy.ts
 async function runDeploy(opts) {
 	const body = gzipSync(JSON.stringify({
 		...opts.slug ? { slug: opts.slug } : {},
 		...opts.allowMissingSecrets ? { credentialPolicy: "warn" } : {},
+		...opts.allowPreviewSlug ? { allowPreviewSlug: true } : {},
 		env: opts.env,
 		worker: opts.bundle.worker,
 		clientFiles: opts.bundle.clientFiles
@@ -55,11 +56,12 @@ async function executeDeploy(opts) {
 		},
 		...slug ? { slug } : {},
 		...opts.allowMissingSecrets ? { allowMissingSecrets: true } : {},
+		...opts.allowPreviewSlug ? { allowPreviewSlug: true } : {},
 		apiKey
 	});
 	const agentUrl = `${serverUrl}/${deployed.slug}`;
 	try {
-		await writeProjectConfig(cwd, {
+		await updateProjectConfig(cwd, {
 			slug: deployed.slug,
 			serverUrl
 		});

package/dist/deploy.d.ts

@@ -9,6 +9,8 @@ export declare function executeDeploy(opts: {
     server?: string | undefined;
     /** See DeployOpts.allowMissingSecrets (`--allow-missing-secrets`). */
     allowMissingSecrets?: boolean | undefined;
+    /** See DeployOpts.allowPreviewSlug (`--allow-preview-slug`; studio-internal). */
+    allowPreviewSlug?: boolean | undefined;
     /** `--skipTypecheck`: deploy without the tsc gate. */
     skipTypecheck?: boolean | undefined;
 }): Promise<CommandResult<DeployData>>;

package/dist/{dev-gVNdGFYY.mjs → dev-C5P8amSg.mjs}

@@ -11,7 +11,7 @@ import { styleText } from "node:util";
 async function executeDev(opts) {
 	const port = parsePort(opts.port);
 	const agentName = path.basename(path.resolve(opts.cwd));
-	const { startDevServer } = await import("./_dev-server-vV05Fnki.mjs");
+	const { startDevServer } = await import("./_dev-server-CGptLIAm.mjs");
 	let cleanup;
 	let shuttingDown = false;
 	const onSignal = () => {

package/dist/{init-DoU4_txp.mjs → init-BGlOhIOl.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { a as unwrapCancel, n as log, u as ok } from "./_ui-8kOEB-JH.mjs";
 import { a as errorMessage, c as readJson, l as resolveCwd, o as fileExists, t as AGENT_ENTRY } from "./_utils-Ch0J4s6a.mjs";
-import { r as isDevMode, t as getMonorepoRoot } from "./_agent-DMyOab9_.mjs";
+import { r as isDevMode, t as getMonorepoRoot } from "./_agent-BB1ZaZsX.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
@@ -72,27 +72,28 @@ async function installDeps(cwd, silent) {
 function resolveTargetDir(dir) {
 	return path.resolve(resolveCwd(), dir);
 }
-/** Run deploy after init and return deploy metadata if successful. */
-async function tryDeploy(cwd, server) {
-	const { executeDeploy } = await import("./deploy-1eaXcfUw.mjs");
+/** Publish after init and return deploy metadata if successful. */
+async function tryPublish(cwd, server) {
+	const { executePublish } = await import("./studio-CsRn2J1a.mjs");
 	try {
-		const result = await executeDeploy({
+		const result = await executePublish({
 			cwd,
 			...server ? { server } : {}
 		});
 		return result.ok ? {
 			slug: result.data.slug,
-			url: result.data.url
+			url: result.data.url,
+			studioUrl: result.data.studioUrl
 		} : null;
 	} catch (err) {
-		log.warn(`Deploy failed: ${errorMessage(err)}`);
-		log.warn("Your project was still created — run `aai deploy` in it to retry.");
+		log.warn(`Publish failed: ${errorMessage(err)}`);
+		log.warn("Your project was still created — run `aai publish` in it to retry.");
 		return null;
 	}
 }
 /** Scaffold the project, optionally showing a spinner. */
 async function scaffoldProject(dir, cwd, template, silent) {
-	const { runInit } = await import("./_init-BZ9t_Kz-.mjs");
+	const { runInit } = await import("./_init-BPFM4uBH.mjs");
 	const s = silent ? void 0 : p.spinner();
 	s?.start(`Creating ${dir}`);
 	await runInit({
@@ -120,13 +121,13 @@ async function executeInit(opts, extra) {
 	let deployed = false;
 	let slug;
 	let url;
-	if (!installed) log.warn("Skipping deploy because dependencies were not installed.");
+	if (!installed) log.warn("Skipping publish because dependencies were not installed.");
 	else if (!opts.skipDeploy) {
-		const deployInfo = await tryDeploy(cwd, opts.server);
-		if (deployInfo) {
+		const published = await tryPublish(cwd, opts.server);
+		if (published) {
 			deployed = true;
-			slug = deployInfo.slug;
-			url = deployInfo.url;
+			slug = published.slug;
+			url = published.url;
 		}
 	}
 	if (!suppressUi) printPostInitInfo(cwd, monorepoRoot);

package/dist/login-B6IhXski.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import { n as log, o as CliError, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { c as writeGlobalConfig, i as readGlobalConfig, r as getConfigDir, t as approveServer } from "./_config-PIC0nzRu.mjs";
+import { a as resolveServerUrl } from "./_agent-BB1ZaZsX.mjs";
+import { spawn } from "node:child_process";
+import { setTimeout } from "node:timers/promises";
+import { randomBytes } from "node:crypto";
+//#region login.ts
+/**
+* `aai login` — link the CLI to an account that is ALREADY signed in to the
+* browser studio, ending with the account's AssemblyAI API key stored in
+* the global config (the same slot `ensureApiKey` reads), so every other
+* command is untouched by how the key was acquired.
+*
+* The CLI deliberately performs no sign-in of its own — it cannot create an
+* account, and it never sees a session token. Device-link flow:
+* 1. `GET /studio/auth` — fail fast when the server has no browser login
+*    configured (nobody could ever approve the link).
+* 2. Mint an unguessable one-shot code (32 random bytes, base64url) and
+*    open the browser at `<server>/?cli-link=<code>`. The studio — where
+*    the user signs in with GitHub (or the local-dev login) if they aren't
+*    already — shows a "link the CLI to this account?" approval displaying
+*    the same short confirmation code this terminal printed, so a phished
+*    approval link has a visible mismatch (no terminal to match against).
+* 3. Poll `POST /studio/cli-link/exchange` with the code. Approval grants
+*    the code ONE exchange for the account's stored API key, which is
+*    saved locally. An account with no stored key can't approve — the
+*    studio's own onboarding gate runs first — so the CLI never sets keys.
+*/
+const LINK_POLL_INTERVAL_MS = 2e3;
+const LINK_TIMEOUT_MS = 3e5;
+async function jsonBody(res, what) {
+	const body = await res.json().catch(() => null);
+	if (!res.ok) throw new CliError("login_failed", `${what} failed: ${body?.error ?? body?.msg ?? `HTTP ${res.status}`}`);
+	if (body === null) throw new CliError("login_failed", `${what} returned an invalid response`);
+	return body;
+}
+function requireTty() {
+	if (!process.stdin.isTTY) throw new CliError("login_interactive", "`aai login` is interactive and needs a TTY.", "Non-interactive setups can set the ASSEMBLYAI_API_KEY environment variable instead.");
+}
+function openerFor(platform) {
+	if (platform === "darwin") return ["open", []];
+	if (platform === "win32") return ["cmd", [
+		"/c",
+		"start",
+		""
+	]];
+	return ["xdg-open", []];
+}
+/**
+* Human-matchable confirmation derived from the link code — printed in the
+* terminal AND shown on the browser approval gate (aai-studio-client's
+* cli-link.ts derives the same value; keep the two in lockstep). Not a
+* secret: both ends already hold the full code. It exists so someone who
+* lands on an approval page they didn't cause has a concrete mismatch to
+* notice ("what terminal?") instead of a bare Approve button.
+*/
+function linkConfirmationCode(code) {
+	const head = code.slice(0, 8).toUpperCase();
+	return `${head.slice(0, 4)}-${head.slice(4)}`;
+}
+/** Best-effort: the link URL is always printed, so a failure is fine. */
+function defaultOpenBrowser(url) {
+	const [cmd, args] = openerFor(process.platform);
+	try {
+		const child = spawn(cmd, [...args, url], {
+			stdio: "ignore",
+			detached: true
+		});
+		child.on("error", () => {});
+		child.unref();
+	} catch {}
+}
+async function executeLogin(opts, deps = {}) {
+	const fetchFn = deps.fetchFn ?? globalThis.fetch;
+	requireTty();
+	const globalConfig = await readGlobalConfig();
+	const serverUrl = resolveServerUrl(opts.server, void 0, globalConfig.approvedServers ?? []);
+	if (opts.server) await approveServer(serverUrl);
+	if ((await jsonBody(await fetchFn(`${serverUrl}/studio/auth`), "Reading the server's login configuration")).mode === "none") throw new CliError("login_unavailable", "This server has no browser login configured, so there is no account to link.", "Set the ASSEMBLYAI_API_KEY environment variable, or run any platform command to be prompted for a key.");
+	const code = randomBytes(32).toString("base64url");
+	const linkUrl = `${serverUrl}/?cli-link=${code}`;
+	log.info(`Opening the browser to link your account…\n  ${linkUrl}`);
+	log.info(`Confirmation code: ${linkConfirmationCode(code)}`);
+	log.info("Approve the link in the browser (sign in there first if you need to) — the approval page shows the same code.");
+	(deps.openBrowser ?? defaultOpenBrowser)(linkUrl);
+	const pollInterval = deps.pollIntervalMs ?? LINK_POLL_INTERVAL_MS;
+	const deadline = Date.now() + (deps.timeoutMs ?? LINK_TIMEOUT_MS);
+	let granted;
+	for (;;) {
+		const res = await fetchFn(`${serverUrl}/studio/cli-link/exchange`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ code })
+		});
+		if (res.status !== 404) {
+			granted = await jsonBody(res, "Linking your account");
+			break;
+		}
+		if (Date.now() >= deadline) throw new CliError("login_timeout", "Timed out waiting for the link to be approved in the browser.", "Run `aai login` again and approve the link within five minutes.");
+		await setTimeout(pollInterval);
+	}
+	if (!granted.apiKey) throw new CliError("login_failed", "Linking your account did not return an API key.");
+	const dir = getConfigDir();
+	await writeGlobalConfig(dir, {
+		...await readGlobalConfig(dir),
+		apiKey: granted.apiKey
+	});
+	const email = granted.email ?? "your account";
+	log.success(`Linked ${email} — your API key is saved for future commands.`);
+	return ok({
+		email,
+		server: serverUrl
+	});
+}
+//#endregion
+export { executeLogin };