@alexkroman1/aai-cli 5.5.1 → 5.7.0

package/dist/studio-sXvYUxr5.mjs

@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+import { n as log, o as CliError, t as fmtUrl, u as ok } from "./_ui-8kOEB-JH.mjs";
+import { s as updateProjectConfig } from "./_config-Y5V-5Krn.mjs";
+import { t as resolveServerEnv } from "./_server-common-CnaP_Urf.mjs";
+import { i as resolveDeployTarget } from "./_agent-2nVugrN3.mjs";
+import { layerScaffold } from "./_templates-Bt6u9_68.mjs";
+import { n as apiRequest } from "./_api-client-B-upMGkc.mjs";
+import path from "node:path";
+import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { PREVIEW_SLUG_SUFFIX, VALID_SLUG_RE } from "@alexkroman1/aai/utils";
+//#region _studio.ts
+/**
+* Internals of the studio-workspace commands (`aai list/pull/push/publish`):
+* the local source-file walk and the thin clients for the platform's
+* `/studio/projects` routes. The workspace is the single source of truth —
+* these helpers only move files between a local directory and the project's
+* workspace row; production deploys happen exclusively through the studio's
+* Publish route (which runs the deploy machinery in the project's sandbox).
+*/
+/**
+* Mirrors of the studio workspace caps (`aai-studio-server/studio-limits.ts`)
+* — by value, like `aai-guest/limits.ts`, since the CLI cannot depend on the
+* private server package. The server re-validates every push; these exist so
+* an oversized file is a named warning locally instead of a rejected upload.
+*/
+const MAX_STUDIO_FILE_BYTES = 256e3;
+/**
+* What never syncs to a workspace — the same set the guest's snapshot skips
+* (`aai-guest/studio-workspace-fs.ts`), plus what only exists locally:
+* secrets (`.env` rides the secret routes, never a workspace row) and
+* lockfiles (regenerated by install, noise in the studio editor).
+*/
+const IGNORED_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"dist",
+	".aai"
+]);
+const IGNORED_FILES = [
+	/^\.env(\..+)?$/,
+	/^pnpm-lock\.yaml$/,
+	/^package-lock\.json$/,
+	/^yarn\.lock$/,
+	/^\.DS_Store$/
+];
+function isIgnoredFile(name) {
+	return IGNORED_FILES.some((re) => re.test(name));
+}
+/** Project-relative paths of every syncable file under `dir`, sorted. */
+async function walkProject(dir, current = dir) {
+	const out = [];
+	const entries = await readdir(current, { withFileTypes: true });
+	for (const entry of entries) {
+		if (entry.isSymbolicLink()) continue;
+		const abs = path.join(current, entry.name);
+		if (entry.isDirectory()) {
+			if (!IGNORED_DIRS.has(entry.name)) out.push(...await walkProject(dir, abs));
+		} else if (entry.isFile() && !isIgnoredFile(entry.name)) out.push(path.relative(dir, abs));
+	}
+	return out.sort((a, b) => a.localeCompare(b));
+}
+/**
+* Decode `buf` as UTF-8, or null when it isn't valid UTF-8.
+*
+* `fatal` makes an invalid sequence throw instead of becoming U+FFFD, which
+* is the whole point: a workspace is a JSON path→string map and cannot carry
+* arbitrary bytes, so a lossy read turned a pushed PNG into replacement
+* characters while reporting success — and a later `aai pull` wrote the
+* mangled version back over the local original. `ignoreBOM` keeps a leading
+* U+FEFF in the string; without it the decoder strips the BOM and the check
+* meant to stop corruption would quietly perform some of its own.
+*/
+const UTF8_STRICT = new TextDecoder("utf-8", {
+	fatal: true,
+	ignoreBOM: true
+});
+function decodeUtf8(buf) {
+	try {
+		return UTF8_STRICT.decode(buf);
+	} catch {
+		return null;
+	}
+}
+/**
+* Walk a local project into the path→content record a workspace stores —
+* the CLI-side twin of the guest's `snapshotWorkspace`: same ignored
+* directories, same caps, oversized and non-text files skipped with a
+* warning rather than failing the whole push.
+*/
+async function collectSourceFiles(dir) {
+	const paths = await walkProject(dir);
+	const files = {};
+	const warnings = [];
+	if (paths.length > 100) warnings.push(`Project has ${paths.length} files; only the first 100 sync to the studio.`);
+	for (const rel of paths.slice(0, 100)) {
+		const abs = path.join(dir, rel);
+		const st = await stat(abs);
+		if (st.size > 256e3) {
+			warnings.push(`${rel} is ${st.size} bytes (max ${MAX_STUDIO_FILE_BYTES}) — not synced.`);
+			continue;
+		}
+		const content = decodeUtf8(await readFile(abs));
+		if (content === null) {
+			warnings.push(`${rel} is not valid UTF-8 (binary file?) — not synced.`);
+			continue;
+		}
+		files[rel.split(path.sep).join("/")] = content;
+	}
+	return {
+		files,
+		warnings
+	};
+}
+/**
+* A studio project name derived from a directory name, or null if unusable.
+*
+* A `-preview` suffix is deliberately unusable. Publishing a project deploys
+* it under the project's own name, so a `*-preview` project would claim a
+* slug the studio's orphan-preview sweep reaps hourly — deleting the agent,
+* its app-database schema, and its secrets on a schedule the user never
+* asked for. Refusing the name is recoverable (rename the directory); losing
+* a published agent to the reaper is not.
+*/
+function projectNameFromDir(dir) {
+	const name = path.basename(dir).toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/-{2,}/g, "-").replace(/^[-_]+|[-_]+$/g, "").slice(0, 64);
+	if (name.endsWith(PREVIEW_SLUG_SUFFIX)) return null;
+	return VALID_SLUG_RE.test(name) ? name : null;
+}
+/** The shareable studio URL for a project — what every command prints. */
+function studioProjectUrl(serverUrl, project) {
+	return `${serverUrl}/studio/chat/${project}`;
+}
+function listStudioProjects(serverUrl, apiKey) {
+	return apiRequest(`${serverUrl}/studio/projects`, {
+		apiKey,
+		action: "list"
+	}).then((res) => res.projects);
+}
+/** Fetch a project, or null when it doesn't exist (the push existence probe). */
+function fetchStudioProject(serverUrl, apiKey, project) {
+	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}`, {
+		apiKey,
+		action: "pull",
+		allow404: true
+	});
+}
+/** `PUT /studio/projects/:project/source` — the atomic whole-tree push. */
+function pushStudioSource(serverUrl, apiKey, project, body) {
+	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}/source`, {
+		apiKey,
+		action: "push",
+		method: "PUT",
+		body,
+		hints: { 409: "The studio has newer changes. Run `aai pull` to fetch them, or `aai push --force` to overwrite." }
+	});
+}
+/** `POST /studio/projects/:project/deploy` — Publish, in the project's sandbox. */
+function publishStudioProject(serverUrl, apiKey, project) {
+	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}/deploy`, {
+		apiKey,
+		action: "publish",
+		method: "POST",
+		retry: 0
+	});
+}
+//#endregion
+//#region studio.ts
+/**
+* The studio-workspace commands: `aai list`, `aai pull`, `aai push`,
+* `aai publish`.
+*
+* One model: a studio project's workspace and a local project directory are
+* the same file tree. `pull` materializes the workspace locally (completing
+* it into a runnable project with the scaffold), `push` replaces the
+* workspace with the local tree (fast-forward-checked, so studio edits are
+* never silently overwritten), and `publish` pushes then ships the
+* workspace to production through the studio's Publish route — the same
+* in-sandbox deploy the Publish button runs. There is no other path to
+* production.
+*/
+async function executeList(opts) {
+	const { serverUrl, apiKey } = await resolveDeployTarget(opts.cwd, opts.server);
+	const projects = await listStudioProjects(serverUrl, apiKey);
+	if (projects.length === 0) log.info("No studio projects yet. Push one with `aai push`, or create one in the studio.");
+	for (const name of projects) log.message(`${name}  ${fmtUrl(studioProjectUrl(serverUrl, name))}`);
+	return ok({ projects });
+}
+/** Write a pulled file map under `dir`, refusing paths that escape it. */
+async function materializeFiles(dir, files) {
+	for (const [rel, content] of Object.entries(files)) {
+		const abs = path.resolve(dir, rel);
+		if (abs !== dir && !abs.startsWith(dir + path.sep)) throw new Error(`Pulled file path escapes the project directory: ${rel}`);
+		await mkdir(path.dirname(abs), { recursive: true });
+		await writeFile(abs, content, "utf-8");
+	}
+}
+async function executePull(opts) {
+	const { serverUrl, apiKey } = await resolveDeployTarget(opts.cwd, opts.server);
+	const remote = await fetchStudioProject(serverUrl, apiKey, opts.project);
+	if (!remote) throw new CliError("not_found", `No studio project named "${opts.project}".`, "Run `aai list` to see your projects.");
+	const target = path.resolve(opts.cwd, opts.dir ?? opts.project);
+	if ((await readdir(target).catch(() => [])).length > 0 && !opts.force) throw new CliError("dir_not_empty", `${target} is not empty.`, "Pull into a fresh directory, or pass --force to overwrite files in place.");
+	await materializeFiles(target, remote.files);
+	await layerScaffold(target);
+	await updateProjectConfig(target, {
+		serverUrl,
+		studioProject: opts.project,
+		studioSourceHash: remote.sourceHash,
+		...remote.deployedSlug ? { slug: remote.deployedSlug } : {}
+	});
+	const count = Object.keys(remote.files).length;
+	log.success(`Pulled ${opts.project} (${count} files) into ${target}`);
+	log.info(`Next: cd ${opts.dir ?? opts.project} && pnpm install && aai dev`);
+	log.info(`Studio: ${fmtUrl(studioProjectUrl(serverUrl, opts.project))}`);
+	return ok({
+		project: opts.project,
+		dir: target,
+		files: count
+	});
+}
+/**
+* The shared push core: collect local source, resolve (or mint) the linked
+* project, sync atomically, record the new fast-forward token.
+*/
+async function pushProject(opts) {
+	const { config, serverUrl, apiKey } = await resolveDeployTarget(opts.cwd, opts.server);
+	const { files, warnings } = await collectSourceFiles(opts.cwd);
+	for (const warning of warnings) log.warn(warning);
+	if (Object.keys(files).length === 0) throw new Error("Nothing to push — this directory has no project files.");
+	let project = config?.studioProject;
+	let baseHash = config?.studioSourceHash;
+	let slug = config?.slug;
+	if (!project) {
+		project = slug ?? projectNameFromDir(opts.cwd) ?? void 0;
+		if (!project) throw new Error(`Can't derive a project name from ${path.basename(opts.cwd)} — rename the directory or run \`aai pull <project>\` to link an existing one.`);
+		const existing = await fetchStudioProject(serverUrl, apiKey, project);
+		if (existing && !opts.force) throw new CliError("project_exists", `Your studio already has a project named "${project}".`, `Run \`aai pull ${project}\` to link this directory to it, or \`aai push --force\` to overwrite it.`);
+		baseHash = existing?.sourceHash;
+		slug ??= existing?.deployedSlug;
+	}
+	const result = await pushStudioSource(serverUrl, apiKey, project, {
+		files,
+		...opts.force ? {} : { baseHash }
+	});
+	await updateProjectConfig(opts.cwd, {
+		serverUrl,
+		studioProject: project,
+		studioSourceHash: result.sourceHash,
+		...slug ? { slug } : {}
+	});
+	return {
+		project,
+		sourceHash: result.sourceHash,
+		created: result.created,
+		serverUrl,
+		apiKey,
+		slug,
+		warnings
+	};
+}
+async function executePush(opts) {
+	const pushed = await pushProject(opts);
+	const url = studioProjectUrl(pushed.serverUrl, pushed.project);
+	log.success(`${pushed.created ? "Created" : "Synced"} studio project ${pushed.project} — ${fmtUrl(url)}`);
+	return ok({
+		project: pushed.project,
+		created: pushed.created,
+		url,
+		...pushed.warnings.length > 0 ? { warnings: pushed.warnings } : {}
+	});
+}
+/**
+* Mirror `.env` into the deployed agent's secrets (the same `/:slug/secret`
+* routes `aai secret` uses). Secrets are merged into the agent env at
+* deploy time, which is why publish syncs them BEFORE deploying when the
+* slug is already known.
+*/
+async function syncEnvSecrets(cwd, serverUrl, apiKey, slug) {
+	const env = await resolveServerEnv(cwd);
+	const names = Object.keys(env);
+	if (names.length === 0) return [];
+	await apiRequest(`${serverUrl}/${slug}/secret`, {
+		apiKey,
+		action: "secret",
+		method: "PUT",
+		body: env
+	});
+	log.info(`Synced ${names.length} secret${names.length === 1 ? "" : "s"} from .env`);
+	return names;
+}
+async function executePublish(opts) {
+	if (!opts.skipTypecheck) {
+		const { assertTypechecks } = await import("./_typecheck-gate-DvE8S3aQ.mjs");
+		await assertTypechecks(opts.cwd);
+	}
+	const pushed = await pushProject(opts);
+	const { project, serverUrl, apiKey } = pushed;
+	const hadSlug = pushed.slug !== void 0;
+	if (pushed.slug) await syncEnvSecrets(opts.cwd, serverUrl, apiKey, pushed.slug);
+	log.step(`Publishing ${project} (builds in the project's sandbox)…`);
+	const result = await publishStudioProject(serverUrl, apiKey, project);
+	if (typeof result?.slug !== "string" || typeof result?.output !== "string") throw new CliError("bad_publish_response", `Unexpected response from the publish route at ${serverUrl}.`, "Check that --server points at an aai platform server, then try again.");
+	if (result.output.trim()) log.message(result.output.trim());
+	await updateProjectConfig(opts.cwd, {
+		serverUrl,
+		slug: result.slug
+	});
+	if (!hadSlug) {
+		if ((await syncEnvSecrets(opts.cwd, serverUrl, apiKey, result.slug)).length > 0) log.info("They apply on the next `aai publish`.");
+	}
+	const agentUrl = `${serverUrl}/${result.slug}`;
+	const studioUrl = studioProjectUrl(serverUrl, project);
+	log.success(`Published ${fmtUrl(agentUrl)}`);
+	log.info(`Edit in studio: ${fmtUrl(studioUrl)}`);
+	return ok({
+		project,
+		slug: result.slug,
+		url: agentUrl,
+		studioUrl,
+		output: result.output,
+		...pushed.warnings.length > 0 ? { warnings: pushed.warnings } : {}
+	});
+}
+//#endregion
+export { executeList, executePublish, executePull, executePush };

package/dist/studio.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The studio-workspace commands: `aai list`, `aai pull`, `aai push`,
+ * `aai publish`.
+ *
+ * One model: a studio project's workspace and a local project directory are
+ * the same file tree. `pull` materializes the workspace locally (completing
+ * it into a runnable project with the scaffold), `push` replaces the
+ * workspace with the local tree (fast-forward-checked, so studio edits are
+ * never silently overwritten), and `publish` pushes then ships the
+ * workspace to production through the studio's Publish route — the same
+ * in-sandbox deploy the Publish button runs. There is no other path to
+ * production.
+ */
+import { type CommandResult } from "./_output.ts";
+export declare function executeList(opts: {
+    cwd: string;
+    server?: string | undefined;
+}): Promise<CommandResult<{
+    projects: string[];
+}>>;
+export declare function executePull(opts: {
+    cwd: string;
+    project: string;
+    dir?: string | undefined;
+    force?: boolean | undefined;
+    server?: string | undefined;
+}): Promise<CommandResult<{
+    project: string;
+    dir: string;
+    files: number;
+}>>;
+export declare function executePush(opts: {
+    cwd: string;
+    server?: string | undefined;
+    force?: boolean | undefined;
+}): Promise<CommandResult<{
+    project: string;
+    created: boolean;
+    url: string;
+    warnings?: string[];
+}>>;
+export declare function executePublish(opts: {
+    cwd: string;
+    server?: string | undefined;
+    force?: boolean | undefined;
+    skipTypecheck?: boolean | undefined;
+}): Promise<CommandResult<{
+    project: string;
+    slug: string;
+    url: string;
+    studioUrl: string;
+    output: string;
+    warnings?: string[];
+}>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexkroman1/aai-cli",
-  "version": "5.5.1",
+  "version": "5.7.0",
   "type": "module",
   "bin": {
     "aai": "dist/cli.mjs"
@@ -37,15 +37,15 @@
     "p-timeout": "^7.0.1",
     "vite": "^8.1.5",
     "zod": "^4.4.3",
-    "@alexkroman1/aai": "5.5.1",
-    "@alexkroman1/aai-ui": "5.5.1"
+    "@alexkroman1/aai": "5.7.0",
+    "@alexkroman1/aai-ui": "5.7.0"
   },
   "devDependencies": {
     "playwright": "^1.61.1",
     "tsdown": "^0.22.13",
     "verdaccio": "^6.8.0",
     "vitest": "^4.1.10",
-    "aai-templates": "0.3.3"
+    "aai-templates": "0.3.4"
   },
   "peerDependencies": {
     "vitest": "^4.1.10"

package/dist/_api-client-MenP4-O7.mjs

@@ -1,49 +0,0 @@
-#!/usr/bin/env node
-import { FetchError, ofetch } from "ofetch";
-//#region _api-client.ts
-/**
-* Shared HTTP helper for platform API calls (deploy, delete, secrets).
-*
-* Built on ofetch: JSON bodies are serialized (with Content-Type set) and
-* responses parsed automatically, and transient failures (network errors,
-* 5xx/429) are retried before surfacing an error.
-*/
-const HINT_INVALID_API_KEY = "Your API key may be invalid. Run `aai` to re-enter your AssemblyAI API key.";
-/** 404 hint for requests scoped to a deployed agent's slug. */
-const HINT_NOT_DEPLOYED = "The agent may not be deployed. Check `.aai/project.json` for the correct slug.";
-/**
-* Send an authenticated request to the platform API and return the parsed
-* JSON response. Throws a descriptive error with status-specific hints on
-* failure (the 401 hint is always included; pass more via `hints`).
-*/
-async function apiRequest(url, opts) {
-	const client = opts.fetch ? ofetch.create({}, { fetch: opts.fetch }) : ofetch;
-	try {
-		return await client(url, {
-			method: opts.method ?? "GET",
-			headers: {
-				Authorization: `Bearer ${opts.apiKey}`,
-				...opts.headers
-			},
-			...opts.body !== void 0 ? { body: opts.body } : {},
-			retry: opts.retry ?? 2,
-			retryDelay: opts.retryDelay ?? 300
-		});
-	} catch (err) {
-		throw toApiError(err, url, opts);
-	}
-}
-/** Format an ofetch failure into a descriptive, action-centric error. */
-function toApiError(err, url, opts) {
-	if (err instanceof FetchError && err.statusCode !== void 0) {
-		const status = err.statusCode;
-		const body = typeof err.data === "string" ? err.data : JSON.stringify(err.data ?? "");
-		const hint = status === 401 ? HINT_INVALID_API_KEY : opts.hints?.[status];
-		return /* @__PURE__ */ new Error(`${opts.action} failed (HTTP ${status}): ${body}${hint ? `\n  ${hint}` : ""}`);
-	}
-	const hint = "Check your network connection and verify the server URL is correct.";
-	const cause = err instanceof FetchError && err.cause !== void 0 ? err.cause : err;
-	return new Error(`${opts.action} failed: could not reach ${url}\n  ${hint}`, { cause });
-}
-//#endregion
-export { apiRequest as n, HINT_NOT_DEPLOYED as t };

package/dist/delete-DXilFBb1.mjs

@@ -1,29 +0,0 @@
-#!/usr/bin/env node
-import { n as log, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { n as getServerInfo } from "./_agent-DMyOab9_.mjs";
-import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-MenP4-O7.mjs";
-//#region delete.ts
-async function runDelete(opts) {
-	await apiRequest(`${opts.url}/${opts.slug}`, {
-		method: "DELETE",
-		apiKey: opts.apiKey,
-		action: "delete",
-		hints: { 404: HINT_NOT_DEPLOYED },
-		...opts.fetch ? { fetch: opts.fetch } : {}
-	});
-}
-/** Execute delete and return structured result. */
-async function executeDelete(opts) {
-	const { cwd } = opts;
-	const { serverUrl, slug, apiKey } = await getServerInfo(cwd, opts.server);
-	log.step(`Deleting ${slug}`);
-	await runDelete({
-		url: serverUrl,
-		slug,
-		apiKey
-	});
-	log.success(`Deleted ${serverUrl}/${slug}`);
-	return ok({ slug });
-}
-//#endregion
-export { executeDelete };

package/dist/login-C59ZHzuO.mjs

@@ -1,109 +0,0 @@
-#!/usr/bin/env node
-import { a as unwrapCancel, n as log, o as CliError, u as ok } from "./_ui-8kOEB-JH.mjs";
-import { i as readGlobalConfig, r as getConfigDir, s as writeGlobalConfig, t as approveServer } from "./_config-5AEqhh-O.mjs";
-import { a as resolveServerUrl } from "./_agent-DMyOab9_.mjs";
-import * as p from "@clack/prompts";
-//#region login.ts
-/**
-* `aai login` — email sign-in against the platform, ending with the
-* account's AssemblyAI API key stored in the global config (the same slot
-* `ensureApiKey` reads), so every other command is untouched by how the
-* key was acquired.
-*
-* Flow (the CLI mirror of the browser studio's two gates):
-* 1. `GET /studio/auth` names the login mode.
-*    - `supabase`: Supabase email OTP — `POST /auth/v1/otp` emails a
-*      one-time code, the user types it here, `POST /auth/v1/verify`
-*      returns the session. The magic LINK in the same email targets the
-*      browser; the CLI uses the code because a terminal has no redirect
-*      to land on. (The Supabase email template must include the
-*      `{{ .Token }}` code for this to work.)
-*    - `dev`: mint the same self-describing dev token the studio's local
-*      login mints — nothing is emailed anywhere.
-* 2. `GET /studio/account` — when no key is on file yet, prompt for one
-*    and `PUT /studio/account/key` (the same mandatory onboarding step
-*    the browser shows after sign-in).
-* 3. `GET /studio/account/key` — fetch the key and save it locally.
-*    Unlike the browser, the CLI needs the RAW key: `aai dev` runs the
-*    provider pipeline in-process on it.
-*/
-async function jsonBody(res, what) {
-	const body = await res.json().catch(() => null);
-	if (!res.ok) throw new CliError("login_failed", `${what} failed: ${body?.error ?? body?.msg ?? `HTTP ${res.status}`}`);
-	if (body === null) throw new CliError("login_failed", `${what} returned an invalid response`);
-	return body;
-}
-function requireTty() {
-	if (!process.stdin.isTTY) throw new CliError("login_interactive", "`aai login` is interactive and needs a TTY.", "Non-interactive setups can set the ASSEMBLYAI_API_KEY environment variable instead.");
-}
-/** The same self-describing token the studio's local-dev login mints. */
-function mintDevToken(email) {
-	return `dev.${Buffer.from(JSON.stringify({
-		id: `dev:${email}`,
-		email
-	})).toString("base64url").replace(/=+$/, "")}.dev`;
-}
-/** Supabase email OTP: send the code, prompt for it, verify to a session. */
-async function supabaseSession(auth, email, fetchFn) {
-	const base = auth.supabaseUrl.replace(/\/+$/, "");
-	const headers = {
-		apikey: auth.supabasePublishableKey,
-		"Content-Type": "application/json"
-	};
-	await jsonBody(await fetchFn(`${base}/auth/v1/otp`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify({
-			email,
-			create_user: true
-		})
-	}), "Sending the sign-in code");
-	log.info(`Sent a sign-in code to ${email}.`);
-	const code = unwrapCancel(await p.text({ message: "Enter the code from your email" }), "Login cancelled").trim();
-	const session = await jsonBody(await fetchFn(`${base}/auth/v1/verify`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify({
-			type: "email",
-			email,
-			token: code
-		})
-	}), "Verifying the code");
-	if (!session.access_token) throw new CliError("login_failed", "Verifying the code did not return a session.");
-	return session.access_token;
-}
-async function executeLogin(opts, deps = {}) {
-	const fetchFn = deps.fetchFn ?? globalThis.fetch;
-	requireTty();
-	const globalConfig = await readGlobalConfig();
-	const serverUrl = resolveServerUrl(opts.server, void 0, globalConfig.approvedServers ?? []);
-	if (opts.server) await approveServer(serverUrl);
-	const auth = await jsonBody(await fetchFn(`${serverUrl}/studio/auth`), "Reading the server's login configuration");
-	if (auth.mode === "none") throw new CliError("login_unavailable", "This server has no browser/email login configured.", "Set the ASSEMBLYAI_API_KEY environment variable, or run any platform command to be prompted for a key.");
-	const email = unwrapCancel(await p.text({ message: "Email address" }), "Login cancelled").trim();
-	const bearer = { Authorization: `Bearer ${auth.mode === "dev" ? mintDevToken(email) : await supabaseSession(auth, email, fetchFn)}` };
-	if (!(await jsonBody(await fetchFn(`${serverUrl}/studio/account`, { headers: bearer }), "Loading your account")).hasKey) {
-		const newKey = unwrapCancel(await p.password({ message: "Enter your AssemblyAI API key (stored with your account)" }), "Login cancelled").trim();
-		await jsonBody(await fetchFn(`${serverUrl}/studio/account/key`, {
-			method: "PUT",
-			headers: {
-				...bearer,
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify({ apiKey: newKey })
-		}), "Saving your API key");
-	}
-	const { apiKey } = await jsonBody(await fetchFn(`${serverUrl}/studio/account/key`, { headers: bearer }), "Fetching your API key");
-	const dir = getConfigDir();
-	await writeGlobalConfig(dir, {
-		...await readGlobalConfig(dir),
-		apiKey
-	});
-	log.success(`Signed in as ${email} — your API key is saved for future commands.`);
-	return ok({
-		email,
-		server: serverUrl
-	});
-}
-//#endregion
-export { executeLogin };