@alexkroman1/aai-cli 5.5.1 → 5.6.0

package/dist/login.d.ts

@@ -1,31 +1,44 @@
 /**
- * `aai login` — email sign-in against the platform, ending with the
- * account's AssemblyAI API key stored in the global config (the same slot
- * `ensureApiKey` reads), so every other command is untouched by how the
- * key was acquired.
+ * `aai login` — link the CLI to an account that is ALREADY signed in to the
+ * browser studio, ending with the account's AssemblyAI API key stored in
+ * the global config (the same slot `ensureApiKey` reads), so every other
+ * command is untouched by how the key was acquired.
  *
- * Flow (the CLI mirror of the browser studio's two gates):
- * 1. `GET /studio/auth` names the login mode.
- *    - `supabase`: Supabase email OTP — `POST /auth/v1/otp` emails a
- *      one-time code, the user types it here, `POST /auth/v1/verify`
- *      returns the session. The magic LINK in the same email targets the
- *      browser; the CLI uses the code because a terminal has no redirect
- *      to land on. (The Supabase email template must include the
- *      `{{ .Token }}` code for this to work.)
- *    - `dev`: mint the same self-describing dev token the studio's local
- *      login mints — nothing is emailed anywhere.
- * 2. `GET /studio/account` — when no key is on file yet, prompt for one
- *    and `PUT /studio/account/key` (the same mandatory onboarding step
- *    the browser shows after sign-in).
- * 3. `GET /studio/account/key` — fetch the key and save it locally.
- *    Unlike the browser, the CLI needs the RAW key: `aai dev` runs the
- *    provider pipeline in-process on it.
+ * The CLI deliberately performs no sign-in of its own — it cannot create an
+ * account, and it never sees a session token. Device-link flow:
+ * 1. `GET /studio/auth` — fail fast when the server has no browser login
+ *    configured (nobody could ever approve the link).
+ * 2. Mint an unguessable one-shot code (32 random bytes, base64url) and
+ *    open the browser at `<server>/?cli-link=<code>`. The studio — where
+ *    the user signs in with GitHub (or the local-dev login) if they aren't
+ *    already — shows a "link the CLI to this account?" approval displaying
+ *    the same short confirmation code this terminal printed, so a phished
+ *    approval link has a visible mismatch (no terminal to match against).
+ * 3. Poll `POST /studio/cli-link/exchange` with the code. Approval grants
+ *    the code ONE exchange for the account's stored API key, which is
+ *    saved locally. An account with no stored key can't approve — the
+ *    studio's own onboarding gate runs first — so the CLI never sets keys.
  */
 import { type CommandResult } from "./_output.ts";
 export type LoginDeps = {
     /** Test seam — never set outside tests. */
     fetchFn?: typeof globalThis.fetch;
+    /** Test seam — never set outside tests. */
+    openBrowser?: (url: string) => void;
+    /** Test seam — never set outside tests. */
+    pollIntervalMs?: number;
+    /** Test seam — never set outside tests. */
+    timeoutMs?: number;
 };
+/**
+ * Human-matchable confirmation derived from the link code — printed in the
+ * terminal AND shown on the browser approval gate (aai-studio-client's
+ * cli-link.ts derives the same value; keep the two in lockstep). Not a
+ * secret: both ends already hold the full code. It exists so someone who
+ * lands on an approval page they didn't cause has a concrete mismatch to
+ * notice ("what terminal?") instead of a bare Approve button.
+ */
+export declare function linkConfirmationCode(code: string): string;
 export declare function executeLogin(opts: {
     server?: string | undefined;
 }, deps?: LoginDeps): Promise<CommandResult<{

package/dist/scaffold/package.json

@@ -8,18 +8,18 @@
     "dev": "aai dev",
     "build": "aai build",
     "test": "aai test",
-    "deploy": "aai deploy"
+    "publish:agent": "aai publish"
   },
   "dependencies": {
-    "@alexkroman1/aai": "^5.5.1",
-    "@alexkroman1/aai-ui": "^5.5.1",
+    "@alexkroman1/aai": "^5.6.0",
+    "@alexkroman1/aai-ui": "^5.6.0",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "tailwindcss": "^4.0.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@alexkroman1/aai-cli": "^5.5.1",
+    "@alexkroman1/aai-cli": "^5.6.0",
     "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",

package/dist/{secret-CGAIAbUx.mjs → secret-_bHo4rqt.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as unwrapCancel, n as log, s as fail, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { t as slugRequest } from "./_slug-api-DaqQJHk8.mjs";
+import { t as slugRequest } from "./_slug-api-dcaQ_Uho.mjs";
 import * as p from "@clack/prompts";
 import { text } from "node:stream/consumers";
 //#region secret.ts

package/dist/{storage-CnhOayhm.mjs → storage-MWiVx_mV.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { n as log, s as fail, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { t as slugRequest } from "./_slug-api-DaqQJHk8.mjs";
+import { t as slugRequest } from "./_slug-api-dcaQ_Uho.mjs";
 import * as p from "@clack/prompts";
 //#region storage.ts
 async function storageRequest(cwd, init, server) {

package/dist/studio-CsRn2J1a.mjs

@@ -0,0 +1,284 @@
+#!/usr/bin/env node
+import { n as log, o as CliError, t as fmtUrl, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { s as updateProjectConfig } from "./_config-PIC0nzRu.mjs";
+import { t as resolveServerEnv } from "./_server-common-CnaP_Urf.mjs";
+import { i as resolveDeployTarget } from "./_agent-BB1ZaZsX.mjs";
+import { layerScaffold } from "./_templates-jmjgdgcd.mjs";
+import { n as apiRequest } from "./_api-client-B6_uvuLs.mjs";
+import path from "node:path";
+import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { VALID_SLUG_RE } from "@alexkroman1/aai/utils";
+//#region _studio.ts
+/**
+* Internals of the studio-workspace commands (`aai list/pull/push/publish`):
+* the local source-file walk and the thin clients for the platform's
+* `/studio/projects` routes. The workspace is the single source of truth —
+* these helpers only move files between a local directory and the project's
+* workspace row; production deploys happen exclusively through the studio's
+* Publish route (which runs the deploy machinery in the project's sandbox).
+*/
+/**
+* Mirrors of the studio workspace caps (`aai-studio-server/studio-limits.ts`)
+* — by value, like `aai-guest/limits.ts`, since the CLI cannot depend on the
+* private server package. The server re-validates every push; these exist so
+* an oversized file is a named warning locally instead of a rejected upload.
+*/
+const MAX_STUDIO_FILE_BYTES = 256e3;
+/**
+* What never syncs to a workspace — the same set the guest's snapshot skips
+* (`aai-guest/studio-workspace-fs.ts`), plus what only exists locally:
+* secrets (`.env` rides the secret routes, never a workspace row) and
+* lockfiles (regenerated by install, noise in the studio editor).
+*/
+const IGNORED_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"dist",
+	".aai"
+]);
+const IGNORED_FILES = [
+	/^\.env(\..+)?$/,
+	/^pnpm-lock\.yaml$/,
+	/^package-lock\.json$/,
+	/^yarn\.lock$/,
+	/^\.DS_Store$/
+];
+function isIgnoredFile(name) {
+	return IGNORED_FILES.some((re) => re.test(name));
+}
+/** Project-relative paths of every syncable file under `dir`, sorted. */
+async function walkProject(dir, current = dir) {
+	const out = [];
+	const entries = await readdir(current, { withFileTypes: true });
+	for (const entry of entries) {
+		if (entry.isSymbolicLink()) continue;
+		const abs = path.join(current, entry.name);
+		if (entry.isDirectory()) {
+			if (!IGNORED_DIRS.has(entry.name)) out.push(...await walkProject(dir, abs));
+		} else if (entry.isFile() && !isIgnoredFile(entry.name)) out.push(path.relative(dir, abs));
+	}
+	return out.sort((a, b) => a.localeCompare(b));
+}
+/**
+* Walk a local project into the path→content record a workspace stores —
+* the CLI-side twin of the guest's `snapshotWorkspace`: same ignored
+* directories, same caps, oversized files skipped with a warning rather
+* than failing the whole push.
+*/
+async function collectSourceFiles(dir) {
+	const paths = await walkProject(dir);
+	const files = {};
+	const warnings = [];
+	if (paths.length > 100) warnings.push(`Project has ${paths.length} files; only the first 100 sync to the studio.`);
+	for (const rel of paths.slice(0, 100)) {
+		const abs = path.join(dir, rel);
+		const st = await stat(abs);
+		if (st.size > 256e3) {
+			warnings.push(`${rel} is ${st.size} bytes (max ${MAX_STUDIO_FILE_BYTES}) — not synced.`);
+			continue;
+		}
+		files[rel.split(path.sep).join("/")] = await readFile(abs, "utf-8");
+	}
+	return {
+		files,
+		warnings
+	};
+}
+/** A studio project name derived from a directory name, or null if unusable. */
+function projectNameFromDir(dir) {
+	const name = path.basename(dir).toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/-{2,}/g, "-").replace(/^[-_]+|[-_]+$/g, "").slice(0, 64);
+	return VALID_SLUG_RE.test(name) ? name : null;
+}
+/** The shareable studio URL for a project — what every command prints. */
+function studioProjectUrl(serverUrl, project) {
+	return `${serverUrl}/studio/chat/${project}`;
+}
+function listStudioProjects(serverUrl, apiKey) {
+	return apiRequest(`${serverUrl}/studio/projects`, {
+		apiKey,
+		action: "list"
+	}).then((res) => res.projects);
+}
+/** Fetch a project, or null when it doesn't exist (the push existence probe). */
+function fetchStudioProject(serverUrl, apiKey, project) {
+	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}`, {
+		apiKey,
+		action: "pull",
+		allow404: true
+	});
+}
+/** `PUT /studio/projects/:project/source` — the atomic whole-tree push. */
+function pushStudioSource(serverUrl, apiKey, project, body) {
+	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}/source`, {
+		apiKey,
+		action: "push",
+		method: "PUT",
+		body,
+		hints: { 409: "The studio has newer changes. Run `aai pull` to fetch them, or `aai push --force` to overwrite." }
+	});
+}
+/** `POST /studio/projects/:project/deploy` — Publish, in the project's sandbox. */
+function publishStudioProject(serverUrl, apiKey, project) {
+	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}/deploy`, {
+		apiKey,
+		action: "publish",
+		method: "POST",
+		retry: 0
+	});
+}
+//#endregion
+//#region studio.ts
+/**
+* The studio-workspace commands: `aai list`, `aai pull`, `aai push`,
+* `aai publish`.
+*
+* One model: a studio project's workspace and a local project directory are
+* the same file tree. `pull` materializes the workspace locally (completing
+* it into a runnable project with the scaffold), `push` replaces the
+* workspace with the local tree (fast-forward-checked, so studio edits are
+* never silently overwritten), and `publish` pushes then ships the
+* workspace to production through the studio's Publish route — the same
+* in-sandbox deploy the Publish button runs. There is no other path to
+* production.
+*/
+async function executeList(opts) {
+	const { serverUrl, apiKey } = await resolveDeployTarget(opts.cwd, opts.server);
+	const projects = await listStudioProjects(serverUrl, apiKey);
+	if (projects.length === 0) log.info("No studio projects yet. Push one with `aai push`, or create one in the studio.");
+	for (const name of projects) log.message(`${name}  ${fmtUrl(studioProjectUrl(serverUrl, name))}`);
+	return ok({ projects });
+}
+/** Write a pulled file map under `dir`, refusing paths that escape it. */
+async function materializeFiles(dir, files) {
+	for (const [rel, content] of Object.entries(files)) {
+		const abs = path.resolve(dir, rel);
+		if (abs !== dir && !abs.startsWith(dir + path.sep)) throw new Error(`Pulled file path escapes the project directory: ${rel}`);
+		await mkdir(path.dirname(abs), { recursive: true });
+		await writeFile(abs, content, "utf-8");
+	}
+}
+async function executePull(opts) {
+	const { serverUrl, apiKey } = await resolveDeployTarget(opts.cwd, opts.server);
+	const remote = await fetchStudioProject(serverUrl, apiKey, opts.project);
+	if (!remote) throw new CliError("not_found", `No studio project named "${opts.project}".`, "Run `aai list` to see your projects.");
+	const target = path.resolve(opts.cwd, opts.dir ?? opts.project);
+	if ((await readdir(target).catch(() => [])).length > 0 && !opts.force) throw new CliError("dir_not_empty", `${target} is not empty.`, "Pull into a fresh directory, or pass --force to overwrite files in place.");
+	await materializeFiles(target, remote.files);
+	await layerScaffold(target);
+	await updateProjectConfig(target, {
+		serverUrl,
+		studioProject: opts.project,
+		studioSourceHash: remote.sourceHash,
+		...remote.deployedSlug ? { slug: remote.deployedSlug } : {}
+	});
+	const count = Object.keys(remote.files).length;
+	log.success(`Pulled ${opts.project} (${count} files) into ${target}`);
+	log.info(`Next: cd ${opts.dir ?? opts.project} && pnpm install && aai dev`);
+	log.info(`Studio: ${fmtUrl(studioProjectUrl(serverUrl, opts.project))}`);
+	return ok({
+		project: opts.project,
+		dir: target,
+		files: count
+	});
+}
+/**
+* The shared push core: collect local source, resolve (or mint) the linked
+* project, sync atomically, record the new fast-forward token.
+*/
+async function pushProject(opts) {
+	const { config, serverUrl, apiKey } = await resolveDeployTarget(opts.cwd, opts.server);
+	const { files, warnings } = await collectSourceFiles(opts.cwd);
+	for (const warning of warnings) log.warn(warning);
+	if (Object.keys(files).length === 0) throw new Error("Nothing to push — this directory has no project files.");
+	let project = config?.studioProject;
+	let baseHash = config?.studioSourceHash;
+	let slug = config?.slug;
+	if (!project) {
+		project = slug ?? projectNameFromDir(opts.cwd) ?? void 0;
+		if (!project) throw new Error(`Can't derive a project name from ${path.basename(opts.cwd)} — rename the directory or run \`aai pull <project>\` to link an existing one.`);
+		const existing = await fetchStudioProject(serverUrl, apiKey, project);
+		if (existing && !opts.force) throw new CliError("project_exists", `Your studio already has a project named "${project}".`, `Run \`aai pull ${project}\` to link this directory to it, or \`aai push --force\` to overwrite it.`);
+		baseHash = existing?.sourceHash;
+		slug ??= existing?.deployedSlug;
+	}
+	const result = await pushStudioSource(serverUrl, apiKey, project, {
+		files,
+		...opts.force ? {} : { baseHash }
+	});
+	await updateProjectConfig(opts.cwd, {
+		serverUrl,
+		studioProject: project,
+		studioSourceHash: result.sourceHash,
+		...slug ? { slug } : {}
+	});
+	return {
+		project,
+		sourceHash: result.sourceHash,
+		created: result.created,
+		serverUrl,
+		apiKey,
+		slug
+	};
+}
+async function executePush(opts) {
+	const pushed = await pushProject(opts);
+	const url = studioProjectUrl(pushed.serverUrl, pushed.project);
+	log.success(`${pushed.created ? "Created" : "Synced"} studio project ${pushed.project} — ${fmtUrl(url)}`);
+	return ok({
+		project: pushed.project,
+		created: pushed.created,
+		url
+	});
+}
+/**
+* Mirror `.env` into the deployed agent's secrets (the same `/:slug/secret`
+* routes `aai secret` uses). Secrets are merged into the agent env at
+* deploy time, which is why publish syncs them BEFORE deploying when the
+* slug is already known.
+*/
+async function syncEnvSecrets(cwd, serverUrl, apiKey, slug) {
+	const env = await resolveServerEnv(cwd);
+	const names = Object.keys(env);
+	if (names.length === 0) return [];
+	await apiRequest(`${serverUrl}/${slug}/secret`, {
+		apiKey,
+		action: "secret",
+		method: "PUT",
+		body: env
+	});
+	log.info(`Synced ${names.length} secret${names.length === 1 ? "" : "s"} from .env`);
+	return names;
+}
+async function executePublish(opts) {
+	if (!opts.skipTypecheck) {
+		const { assertTypechecks } = await import("./_typecheck-gate-DvE8S3aQ.mjs");
+		await assertTypechecks(opts.cwd);
+	}
+	const pushed = await pushProject(opts);
+	const { project, serverUrl, apiKey } = pushed;
+	const hadSlug = pushed.slug !== void 0;
+	if (pushed.slug) await syncEnvSecrets(opts.cwd, serverUrl, apiKey, pushed.slug);
+	log.step(`Publishing ${project} (builds in the project's sandbox)…`);
+	const result = await publishStudioProject(serverUrl, apiKey, project);
+	if (result.output.trim()) log.message(result.output.trim());
+	await updateProjectConfig(opts.cwd, {
+		serverUrl,
+		slug: result.slug
+	});
+	if (!hadSlug) {
+		if ((await syncEnvSecrets(opts.cwd, serverUrl, apiKey, result.slug)).length > 0) log.info("They apply on the next `aai publish`.");
+	}
+	const agentUrl = `${serverUrl}/${result.slug}`;
+	const studioUrl = studioProjectUrl(serverUrl, project);
+	log.success(`Published ${fmtUrl(agentUrl)}`);
+	log.info(`Edit in studio: ${fmtUrl(studioUrl)}`);
+	return ok({
+		project,
+		slug: result.slug,
+		url: agentUrl,
+		studioUrl,
+		output: result.output
+	});
+}
+//#endregion
+export { executeList, executePublish, executePull, executePush };

package/dist/studio.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The studio-workspace commands: `aai list`, `aai pull`, `aai push`,
+ * `aai publish`.
+ *
+ * One model: a studio project's workspace and a local project directory are
+ * the same file tree. `pull` materializes the workspace locally (completing
+ * it into a runnable project with the scaffold), `push` replaces the
+ * workspace with the local tree (fast-forward-checked, so studio edits are
+ * never silently overwritten), and `publish` pushes then ships the
+ * workspace to production through the studio's Publish route — the same
+ * in-sandbox deploy the Publish button runs. There is no other path to
+ * production.
+ */
+import { type CommandResult } from "./_output.ts";
+export declare function executeList(opts: {
+    cwd: string;
+    server?: string | undefined;
+}): Promise<CommandResult<{
+    projects: string[];
+}>>;
+export declare function executePull(opts: {
+    cwd: string;
+    project: string;
+    dir?: string | undefined;
+    force?: boolean | undefined;
+    server?: string | undefined;
+}): Promise<CommandResult<{
+    project: string;
+    dir: string;
+    files: number;
+}>>;
+export declare function executePush(opts: {
+    cwd: string;
+    server?: string | undefined;
+    force?: boolean | undefined;
+}): Promise<CommandResult<{
+    project: string;
+    created: boolean;
+    url: string;
+}>>;
+export declare function executePublish(opts: {
+    cwd: string;
+    server?: string | undefined;
+    force?: boolean | undefined;
+    skipTypecheck?: boolean | undefined;
+}): Promise<CommandResult<{
+    project: string;
+    slug: string;
+    url: string;
+    studioUrl: string;
+    output: string;
+}>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexkroman1/aai-cli",
-  "version": "5.5.1",
+  "version": "5.6.0",
   "type": "module",
   "bin": {
     "aai": "dist/cli.mjs"
@@ -37,15 +37,15 @@
     "p-timeout": "^7.0.1",
     "vite": "^8.1.5",
     "zod": "^4.4.3",
-    "@alexkroman1/aai": "5.5.1",
-    "@alexkroman1/aai-ui": "5.5.1"
+    "@alexkroman1/aai": "5.6.0",
+    "@alexkroman1/aai-ui": "5.6.0"
   },
   "devDependencies": {
     "playwright": "^1.61.1",
     "tsdown": "^0.22.13",
     "verdaccio": "^6.8.0",
     "vitest": "^4.1.10",
-    "aai-templates": "0.3.3"
+    "aai-templates": "0.3.4"
   },
   "peerDependencies": {
     "vitest": "^4.1.10"

package/dist/delete-DXilFBb1.mjs

@@ -1,29 +0,0 @@
-#!/usr/bin/env node
-import { n as log, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { n as getServerInfo } from "./_agent-DMyOab9_.mjs";
-import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-MenP4-O7.mjs";
-//#region delete.ts
-async function runDelete(opts) {
-	await apiRequest(`${opts.url}/${opts.slug}`, {
-		method: "DELETE",
-		apiKey: opts.apiKey,
-		action: "delete",
-		hints: { 404: HINT_NOT_DEPLOYED },
-		...opts.fetch ? { fetch: opts.fetch } : {}
-	});
-}
-/** Execute delete and return structured result. */
-async function executeDelete(opts) {
-	const { cwd } = opts;
-	const { serverUrl, slug, apiKey } = await getServerInfo(cwd, opts.server);
-	log.step(`Deleting ${slug}`);
-	await runDelete({
-		url: serverUrl,
-		slug,
-		apiKey
-	});
-	log.success(`Deleted ${serverUrl}/${slug}`);
-	return ok({ slug });
-}
-//#endregion
-export { executeDelete };

package/dist/login-C59ZHzuO.mjs

@@ -1,109 +0,0 @@
-#!/usr/bin/env node
-import { a as unwrapCancel, n as log, o as CliError, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { i as readGlobalConfig, r as getConfigDir, s as writeGlobalConfig, t as approveServer } from "./_config-5AEqhh-O.mjs";
-import { a as resolveServerUrl } from "./_agent-DMyOab9_.mjs";
-import * as p from "@clack/prompts";
-//#region login.ts
-/**
-* `aai login` — email sign-in against the platform, ending with the
-* account's AssemblyAI API key stored in the global config (the same slot
-* `ensureApiKey` reads), so every other command is untouched by how the
-* key was acquired.
-*
-* Flow (the CLI mirror of the browser studio's two gates):
-* 1. `GET /studio/auth` names the login mode.
-*    - `supabase`: Supabase email OTP — `POST /auth/v1/otp` emails a
-*      one-time code, the user types it here, `POST /auth/v1/verify`
-*      returns the session. The magic LINK in the same email targets the
-*      browser; the CLI uses the code because a terminal has no redirect
-*      to land on. (The Supabase email template must include the
-*      `{{ .Token }}` code for this to work.)
-*    - `dev`: mint the same self-describing dev token the studio's local
-*      login mints — nothing is emailed anywhere.
-* 2. `GET /studio/account` — when no key is on file yet, prompt for one
-*    and `PUT /studio/account/key` (the same mandatory onboarding step
-*    the browser shows after sign-in).
-* 3. `GET /studio/account/key` — fetch the key and save it locally.
-*    Unlike the browser, the CLI needs the RAW key: `aai dev` runs the
-*    provider pipeline in-process on it.
-*/
-async function jsonBody(res, what) {
-	const body = await res.json().catch(() => null);
-	if (!res.ok) throw new CliError("login_failed", `${what} failed: ${body?.error ?? body?.msg ?? `HTTP ${res.status}`}`);
-	if (body === null) throw new CliError("login_failed", `${what} returned an invalid response`);
-	return body;
-}
-function requireTty() {
-	if (!process.stdin.isTTY) throw new CliError("login_interactive", "`aai login` is interactive and needs a TTY.", "Non-interactive setups can set the ASSEMBLYAI_API_KEY environment variable instead.");
-}
-/** The same self-describing token the studio's local-dev login mints. */
-function mintDevToken(email) {
-	return `dev.${Buffer.from(JSON.stringify({
-		id: `dev:${email}`,
-		email
-	})).toString("base64url").replace(/=+$/, "")}.dev`;
-}
-/** Supabase email OTP: send the code, prompt for it, verify to a session. */
-async function supabaseSession(auth, email, fetchFn) {
-	const base = auth.supabaseUrl.replace(/\/+$/, "");
-	const headers = {
-		apikey: auth.supabasePublishableKey,
-		"Content-Type": "application/json"
-	};
-	await jsonBody(await fetchFn(`${base}/auth/v1/otp`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify({
-			email,
-			create_user: true
-		})
-	}), "Sending the sign-in code");
-	log.info(`Sent a sign-in code to ${email}.`);
-	const code = unwrapCancel(await p.text({ message: "Enter the code from your email" }), "Login cancelled").trim();
-	const session = await jsonBody(await fetchFn(`${base}/auth/v1/verify`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify({
-			type: "email",
-			email,
-			token: code
-		})
-	}), "Verifying the code");
-	if (!session.access_token) throw new CliError("login_failed", "Verifying the code did not return a session.");
-	return session.access_token;
-}
-async function executeLogin(opts, deps = {}) {
-	const fetchFn = deps.fetchFn ?? globalThis.fetch;
-	requireTty();
-	const globalConfig = await readGlobalConfig();
-	const serverUrl = resolveServerUrl(opts.server, void 0, globalConfig.approvedServers ?? []);
-	if (opts.server) await approveServer(serverUrl);
-	const auth = await jsonBody(await fetchFn(`${serverUrl}/studio/auth`), "Reading the server's login configuration");
-	if (auth.mode === "none") throw new CliError("login_unavailable", "This server has no browser/email login configured.", "Set the ASSEMBLYAI_API_KEY environment variable, or run any platform command to be prompted for a key.");
-	const email = unwrapCancel(await p.text({ message: "Email address" }), "Login cancelled").trim();
-	const bearer = { Authorization: `Bearer ${auth.mode === "dev" ? mintDevToken(email) : await supabaseSession(auth, email, fetchFn)}` };
-	if (!(await jsonBody(await fetchFn(`${serverUrl}/studio/account`, { headers: bearer }), "Loading your account")).hasKey) {
-		const newKey = unwrapCancel(await p.password({ message: "Enter your AssemblyAI API key (stored with your account)" }), "Login cancelled").trim();
-		await jsonBody(await fetchFn(`${serverUrl}/studio/account/key`, {
-			method: "PUT",
-			headers: {
-				...bearer,
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify({ apiKey: newKey })
-		}), "Saving your API key");
-	}
-	const { apiKey } = await jsonBody(await fetchFn(`${serverUrl}/studio/account/key`, { headers: bearer }), "Fetching your API key");
-	const dir = getConfigDir();
-	await writeGlobalConfig(dir, {
-		...await readGlobalConfig(dir),
-		apiKey
-	});
-	log.success(`Signed in as ${email} — your API key is saved for future commands.`);
-	return ok({
-		email,
-		server: serverUrl
-	});
-}
-//#endregion
-export { executeLogin };