@kubb/cli 5.6.0 → 5.6.2

package/dist/{run-D8Wz_17X.cjs → run-BQgoSvvl.cjs}

@@ -1,8 +1,8 @@
 const require_agent = require("./agent-DElUuYuy.cjs");
 const require_errors = require("./errors-CMbMAwyW.cjs");
-const require_Telemetry = require("./Telemetry-bGdFBaGt.cjs");
-const require_output = require("./output-i3s5c4Xu.cjs");
-const require_config = require("./config-ByfJSj3q.cjs");
+const require_Telemetry = require("./Telemetry-CuO35YOL.cjs");
+const require_output = require("./output-gox62nKo.cjs");
+const require_config = require("./config-B2BlaYOU.cjs");
 const require_constants = require("./constants-CdxpgX3_.cjs");
 let node_util = require("node:util");
 let node_crypto = require("node:crypto");
@@ -10,7 +10,6 @@ let node_os = require("node:os");
 let node_process = require("node:process");
 node_process = require_agent.__toESM(node_process, 1);
 let tinyexec = require("tinyexec");
-let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 node_path = require_agent.__toESM(node_path, 1);
 let _kubb_core = require("@kubb/core");
@@ -36,68 +35,18 @@ function openInBrowser(target) {
 	(0, tinyexec.x)(node_process.default.platform === "darwin" ? "open" : "xdg-open", [target]).then(ignore, ignore);
 }
 //#endregion
-//#region ../../internals/utils/src/fs.ts
-/**
-* Resolves to `true` when the file or directory at `path` exists.
-* Uses `Bun.file().exists()` when running under Bun, `fs.access` otherwise.
-*
-* @example
-* ```ts
-* if (await exists('./kubb.config.ts')) {
-*   const content = await read('./kubb.config.ts')
-* }
-* ```
-*/
-async function exists(path) {
-	if (require_Telemetry.runtime.isBun) return Bun.file(path).exists();
-	return (0, node_fs_promises.access)(path).then(() => true, () => false);
-}
-/**
-* Reads the file at `path` as a UTF-8 string.
-* Uses `Bun.file().text()` when running under Bun, `fs.readFile` otherwise.
-*
-* @example
-* ```ts
-* const source = await read('./src/Pet.ts')
-* ```
-*/
-async function read(path) {
-	if (require_Telemetry.runtime.isBun) return Bun.file(path).text();
-	return (0, node_fs_promises.readFile)(path, { encoding: "utf8" });
-}
-/**
-* Recursively removes `path`. Silently succeeds when `path` does not exist.
-*
-* @example
-* ```ts
-* await clean('./dist')
-* ```
-*/
-async function clean(path) {
-	return (0, node_fs_promises.rm)(path, {
-		recursive: true,
-		force: true
-	});
-}
-//#endregion
 //#region src/runners/studio/credentials.ts
+const projectBase = (project = node_process.default.cwd()) => node_path.default.join("projects", (0, node_crypto.hash)("sha256", project));
 /**
-* Root for everything the CLI persists between runs: the paired credential, the machine secret,
-* the last Studio config, and the live-session registry. `KUBB_HOME` relocates all of it.
-*/
-function getKubbHome() {
-	return node_process.default.env.KUBB_HOME ?? node_path.default.join((0, node_os.homedir)(), ".kubb");
-}
-/**
-* Root for the credential and machine identity of the current project.
+* Root for the credential and machine identity of the current project, inside `KUBB_HOME`.
 *
 * Studio agents are project connections, so two projects on one machine must not share the same
 * persisted token or machine secret.
 */
 function getProjectKubbHome(project = node_process.default.cwd()) {
-	const projectId = (0, node_crypto.hash)("sha256", project);
-	return node_path.default.join(getKubbHome(), "projects", projectId);
+	return (0, _kubb_core.resolveKubbDir)(projectBase(project));
 }
+const projectStorage = () => (0, _kubb_core.kubbStorage)({ base: projectBase() });
 const CREDENTIALS_FILENAME = "credentials.json";
 /**
 * Absolute path of the stored credential, so callers can name it in output without rebuilding it.
@@ -111,32 +60,33 @@ function getCredentialsPath() {
 * overwrite it rather than the CLI dying on it.
 */
 async function readCredentials() {
-	const raw = await read(getCredentialsPath()).catch(() => null);
-	if (!raw) return null;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
+	const stored = await projectStorage().getItem(CREDENTIALS_FILENAME).catch(() => null);
+	return typeof stored?.token === "string" && stored.token !== "" ? stored : null;
 }
 /**
-* Writes the credential with owner-only permissions. The file holds a bearer token, so the mode
-* is set at creation time rather than left to the process umask or fixed up afterward, which
-* would leave the token briefly readable under the umask's default mode.
+* Writes the credential into the project folder, which only its owner can open.
 */
 async function writeCredentials(credentials) {
-	const file = getCredentialsPath();
-	await (0, node_fs_promises.mkdir)(node_path.default.dirname(file), {
-		recursive: true,
-		mode: 448
-	});
-	await (0, node_fs_promises.writeFile)(file, JSON.stringify(credentials, null, 2), { mode: 384 });
+	await projectStorage().setItem(CREDENTIALS_FILENAME, credentials);
 }
 /**
 * Forgets the stored credential. Succeeds when there was nothing to forget.
 */
 async function clearCredentials() {
-	await clean(getCredentialsPath());
+	await projectStorage().removeItem(CREDENTIALS_FILENAME);
+}
+/**
+* Reads this project's machine secret, creating it on first use. Pairing sends its hash, so pairing
+* the same project again rotates one agent's token instead of creating a second agent. It lives
+* apart from the credential, which {@link clearCredentials} deletes.
+*/
+async function getMachineId() {
+	const storage = projectStorage();
+	const stored = await storage.getItem("machine-secret").catch(() => null);
+	if (typeof stored === "string" && stored.trim()) return stored.trim();
+	const secret = (0, node_crypto.randomBytes)(32).toString("hex");
+	await storage.setItem("machine-secret", secret);
+	return secret;
 }
 //#endregion
 //#region src/runners/studio/run.ts
@@ -171,6 +121,7 @@ async function login({ studioUrl, autoOpen }, { signal, previousCredentials } =
 			type: "cli",
 			name: node_path.default.basename(node_process.default.cwd()),
 			hostname: (0, node_os.hostname)(),
+			machineId: await getMachineId(),
 			signal,
 			onCode: (session) => {
 				console.log(`\nOpen ${(0, node_util.styleText)("cyan", session.verification_uri)} and approve the code ${(0, node_util.styleText)("bold", session.user_code)}`);
@@ -328,68 +279,59 @@ async function connect(options, context = {}) {
 		events.once("SIGINT", stop);
 		events.once("SIGTERM", stop);
 	}
-	let hinted = false;
-	let reauthenticated = false;
 	try {
 		if (!context.prepared) {
-			const { getWorkerStatus } = await Promise.resolve().then(() => require("./background-R0T_7Szu.cjs"));
+			const { getWorkerStatus } = await Promise.resolve().then(() => require("./background-DF0hM01o.cjs"));
 			if ((await getWorkerStatus()).running) throw new Error("This project is running in the background. Run `kubb studio stop` first.");
 		}
 		const prepared = context.prepared ?? await prepareConnection(options, signal);
 		let { credentials, permissions } = prepared;
 		const { configPath } = prepared;
-		await (0, _kubb_studio.runConnection)({
-			credentials,
-			signal,
-			clientOptions: () => ({
+		let hinted = false;
+		let pairedAgain = false;
+		const hooks = new _kubb_core.Hookable();
+		require_config.setupReporters(hooks, {
+			logLevel: _kubb_core.logLevel[options.logLevel ?? "info"],
+			reporters: [_kubb_core.cliReporter],
+			...context.onState ? { logger: require_output.plainLogger } : {}
+		});
+		hooks.hook("studio:connected", async () => {
+			pairedAgain = false;
+			await context.onState?.("connected");
+			if (hinted || context.onState || options.logLevel === "silent") return;
+			hinted = true;
+			require_output.logBlock((0, node_util.styleText)("dim", "Press Ctrl+C to disconnect"));
+			require_output.logTip();
+		});
+		hooks.hook("studio:reconnecting", () => context.onState?.("reconnecting"));
+		for (;;) try {
+			await (0, _kubb_studio.connectAgent)({
+				token: credentials.token,
 				studioUrl: options.studioUrl,
 				configPath,
 				version: options.version,
 				root: node_process.default.cwd(),
 				permissions,
 				loadConfig: async () => (await loadConfigs(options)).config,
-				installLogger: async (hooks) => {
-					require_config.setupReporters(hooks, {
-						logLevel: _kubb_core.logLevel[options.logLevel ?? "info"],
-						reporters: [_kubb_core.cliReporter],
-						...context.onState ? { logger: require_output.plainLogger } : {}
-					});
-					hooks.hook("studio:connected", () => {
-						if (!hinted && !context.onState && options.logLevel !== "silent") require_output.logBlock((0, node_util.styleText)("dim", "Press Ctrl+C to disconnect"));
-						hinted = true;
-					});
-					hooks.hook("studio:ready", async () => {
-						await context.onState?.("connected");
-						if (!context.onState) require_output.logTip();
-					});
-					hooks.hook("studio:reconnecting", () => context.onState?.("reconnecting"));
-				}
-			}),
-			onTokenRejected: async ({ error, live }) => {
-				await context.onState?.("authentication required");
-				if (node_process.default.env.KUBB_AGENT_TOKEN) throw explainRejectedToken(error, "envToken");
-				if (!live) await clearCredentials();
-				if (reauthenticated) throw explainRejectedToken(error, "reauthExhausted");
-				if (context.onState || require_agent.isCIEnvironment() || !require_output.canUseTTY()) throw explainRejectedToken(error, "nonInteractive");
-				console.log((0, node_util.styleText)("yellow", live ? `${error.message} Studio needs you to approve access again.` : `${error.message} Pairing again...`));
-				if (live) await clearCredentials();
-				try {
-					credentials = await login(options, {
-						signal,
-						previousCredentials: credentials
-					});
-				} catch (error) {
-					if (error instanceof _kubb_studio.PairingCanceledError) {
-						if (live && options.logLevel !== "silent") require_output.logOutro("Disconnected");
-						return null;
-					}
-					throw error;
-				}
-				reauthenticated = true;
-				permissions = await resolvePermissions(options, credentials, configPath, !node_process.default.env.KUBB_AGENT_TOKEN);
-				return credentials;
-			}
-		});
+				hooks,
+				signal
+			});
+			break;
+		} catch (error) {
+			if (!(error instanceof _kubb_studio.InvalidAgentTokenError)) throw error;
+			await context.onState?.("authentication required");
+			if (node_process.default.env.KUBB_AGENT_TOKEN) throw explainRejectedToken(error, "envToken");
+			await clearCredentials();
+			if (pairedAgain) throw explainRejectedToken(error, "reauthExhausted");
+			if (context.onState || require_agent.isCIEnvironment() || !require_output.canUseTTY()) throw explainRejectedToken(error, "nonInteractive");
+			console.log((0, node_util.styleText)("yellow", `${error.message} Pairing again...`));
+			credentials = await login(options, {
+				signal,
+				previousCredentials: credentials
+			});
+			pairedAgain = true;
+			permissions = await resolvePermissions(options, credentials, configPath);
+		}
 		if (!context.onState && signal.aborted && options.logLevel !== "silent") require_output.logOutro("Disconnected");
 	} catch (error) {
 		if (!(error instanceof _kubb_studio.PairingCanceledError)) throw error;
@@ -401,8 +343,7 @@ async function connect(options, context = {}) {
 /**
 * Runs a Studio command with shared setup and telemetry reporting.
 */
-async function run(options, action, { block = false, json = false } = {}) {
-	(0, _kubb_studio.setStorage)((0, _kubb_studio.createFileStorage)(getProjectKubbHome()));
+async function run({ options, action, block = false, json = false }) {
 	const report = require_Telemetry.trackRun({
 		command: "studio",
 		hrStart: node_process.default.hrtime()
@@ -439,12 +380,6 @@ Object.defineProperty(exports, "createStudioOptions", {
 		return createStudioOptions;
 	}
 });
-Object.defineProperty(exports, "exists", {
-	enumerable: true,
-	get: function() {
-		return exists;
-	}
-});
 Object.defineProperty(exports, "formatPermissionRows", {
 	enumerable: true,
 	get: function() {
@@ -475,12 +410,6 @@ Object.defineProperty(exports, "prepareConnection", {
 		return prepareConnection;
 	}
 });
-Object.defineProperty(exports, "read", {
-	enumerable: true,
-	get: function() {
-		return read;
-	}
-});
 Object.defineProperty(exports, "readCredentials", {
 	enumerable: true,
 	get: function() {
@@ -494,4 +423,4 @@ Object.defineProperty(exports, "run", {
 	}
 });
 
-//# sourceMappingURL=run-D8Wz_17X.cjs.map
+//# sourceMappingURL=run-BQgoSvvl.cjs.map

package/dist/run-BQgoSvvl.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-BQgoSvvl.cjs","names":["isCIEnvironment","process","process","path","hash","resolveKubbDir","kubbStorage","randomBytes","defaultStudioUrl","createSpinner","pairAgent","path","process","hostname","styleText","PairingCanceledError","KUBB_CONFIG_FILENAME","isCIEnvironment","canUseTTY","prompts","getConfigs","Hookable","logLevelMap","cliReporter","plainLogger","connectAgent","InvalidAgentTokenError","trackRun","toError"],"sources":["../../../internals/utils/src/openInBrowser.ts","../src/runners/studio/credentials.ts","../src/runners/studio/run.ts"],"sourcesContent":["import process from 'node:process'\nimport { x } from 'tinyexec'\nimport { isCIEnvironment } from './isCIEnvironment.ts'\n\nconst ignore = () => {}\n\n/**\n * Opens a URL or local file in the default browser, unless running in CI.\n */\nexport function openInBrowser(target: string): void {\n  if (isCIEnvironment()) return\n\n  if (process.platform === 'win32') {\n    x('cmd', ['/c', 'start', '', target]).then(ignore, ignore)\n    return\n  }\n  x(process.platform === 'darwin' ? 'open' : 'xdg-open', [target]).then(ignore, ignore)\n}\n","import { hash, randomBytes } from 'node:crypto'\nimport path from 'node:path'\nimport process from 'node:process'\nimport { kubbStorage, resolveKubbDir } from '@kubb/core'\n\nconst projectBase = (project = process.cwd()) => path.join('projects', hash('sha256', project))\n\n/**\n * Root for the credential and machine identity of the current project, inside `KUBB_HOME`.\n *\n * Studio agents are project connections, so two projects on one machine must not share the same\n * persisted token or machine secret.\n */\nexport function getProjectKubbHome(project = process.cwd()): string {\n  return resolveKubbDir(projectBase(project))\n}\n\nconst projectStorage = () => kubbStorage({ base: projectBase() })\n\nconst CREDENTIALS_FILENAME = 'credentials.json'\n\n/**\n * Absolute path of the stored credential, so callers can name it in output without rebuilding it.\n */\nexport function getCredentialsPath(): string {\n  return path.join(getProjectKubbHome(), CREDENTIALS_FILENAME)\n}\n\nexport type Credentials = {\n  /**\n   * The Studio instance this machine paired with. A different `--url` means re-pairing.\n   */\n  studioUrl: string\n  /**\n   * Bearer token for this machine. Never logged, never printed.\n   */\n  token: string\n  agentId: string\n  agentSlug: string\n  /**\n   * Permissions the user has already granted, keyed by absolute project path, so the CLI asks\n   * once per project instead of on every run.\n   */\n  projects?: Record<string, { allowRead?: boolean; allowWrite?: boolean; allowConfigEdit?: boolean; allowExec?: boolean }>\n}\n\n/**\n * Reads the stored credential, or null when this machine has not paired yet or the file is\n * unreadable or corrupt. A bad file is treated as \"not paired\" so `kubb studio login` can\n * overwrite it rather than the CLI dying on it.\n */\nexport async function readCredentials(): Promise<Credentials | null> {\n  const stored = await projectStorage()\n    .getItem<Credentials>(CREDENTIALS_FILENAME)\n    .catch(() => null)\n\n  return typeof stored?.token === 'string' && stored.token !== '' ? stored : null\n}\n\n/**\n * Writes the credential into the project folder, which only its owner can open.\n */\nexport async function writeCredentials(credentials: Credentials): Promise<void> {\n  await projectStorage().setItem(CREDENTIALS_FILENAME, credentials)\n}\n\n/**\n * Forgets the stored credential. Succeeds when there was nothing to forget.\n */\nexport async function clearCredentials(): Promise<void> {\n  await projectStorage().removeItem(CREDENTIALS_FILENAME)\n}\n\n/**\n * Reads this project's machine secret, creating it on first use. Pairing sends its hash, so pairing\n * the same project again rotates one agent's token instead of creating a second agent. It lives\n * apart from the credential, which {@link clearCredentials} deletes.\n */\nexport async function getMachineId(): Promise<string> {\n  const storage = projectStorage()\n  const stored = await storage.getItem('machine-secret').catch(() => null)\n  if (typeof stored === 'string' && stored.trim()) return stored.trim()\n\n  const secret = randomBytes(32).toString('hex')\n  await storage.setItem('machine-secret', secret)\n\n  return secret\n}\n","import { hostname } from 'node:os'\nimport path from 'node:path'\nimport process from 'node:process'\nimport { styleText } from 'node:util'\nimport * as prompts from '@clack/prompts'\nimport { KUBB_CONFIG_FILENAME } from '@internals/shared'\nimport { isCIEnvironment, openInBrowser, toError } from '@internals/utils'\nimport type { CLIOptions, Config } from '@kubb/core'\nimport { cliReporter, Hookable, type KubbHooks, logLevel as logLevelMap } from '@kubb/core'\nimport { connectAgent, defaultStudioUrl, InvalidAgentTokenError, pairAgent, PairingCanceledError } from '@kubb/studio'\nimport { trackRun } from '../../Telemetry.ts'\nimport { plainLogger } from '../../loggers/plainLogger.ts'\nimport setupReporters from '../../loggers/reporters.ts'\nimport { createSpinner, logBlock, logIntro, logOutro, logTip } from '../../loggers/output.ts'\nimport { canUseTTY } from '../../utils/env.ts'\nimport { getConfigs } from '../../config.ts'\nimport { clearCredentials, type Credentials, getCredentialsPath, getMachineId, readCredentials, writeCredentials } from './credentials.ts'\nimport { version } from '../../../package.json'\n\ntype Permission = 'allowRead' | 'allowWrite' | 'allowConfigEdit' | 'allowExec'\n\nexport type StudioOptions = {\n  /**\n   * Current `@kubb/cli` version, reported to Studio and used for the telemetry payload.\n   */\n  version: string\n  configPath?: string\n  /**\n   * Base URL of the Studio instance, for a self-hosted deployment. Resolved before it reaches here,\n   * since stored credentials are bound to it.\n   */\n  studioUrl: string\n  /**\n   * What Studio may do in this project. Each flag grants outright; the rest are asked once per\n   * project through {@link resolvePermissions}.\n   */\n  permission: Record<Permission, boolean>\n  /**\n   * Whether to open the approval page in a browser during pairing.\n   */\n  autoOpen: boolean\n  logLevel?: CLIOptions['logLevel']\n}\n\nexport type SnapshotOptions = Pick<StudioOptions, 'configPath' | 'studioUrl' | 'logLevel'> & {\n  /**\n   * Organization CI API key. Falls back to `KUBB_TOKEN`.\n   */\n  token?: string\n  /**\n   * Stable identity for the CI agent. Falls back to CI auto-detection.\n   */\n  id?: string\n  /** Identity of another CI agent to also compare with. Falls back to CI auto-detection. */\n  baseId?: string\n  /**\n   * Package name for the generated tarball. Falls back to the nearest package.json.\n   */\n  name?: string\n  /**\n   * Package version for the generated tarball. Falls back to the nearest package.json.\n   */\n  packageVersion?: string\n  /**\n   * Print the result as one JSON object instead of a summary.\n   */\n  json?: boolean\n}\n\ntype StudioValues = {\n  config?: string\n  url?: string\n  allowRead: boolean\n  allowWrite: boolean\n  allowConfigEdit: boolean\n  allowExec: boolean\n  open?: boolean\n  logLevel?: CLIOptions['logLevel']\n}\n\nexport function createStudioOptions(values: StudioValues): StudioOptions {\n  return {\n    version,\n    configPath: values.config,\n    studioUrl: values.url ?? defaultStudioUrl,\n    permission: {\n      allowRead: values.allowRead,\n      allowWrite: values.allowWrite,\n      allowConfigEdit: values.allowConfigEdit,\n      allowExec: values.allowExec,\n    },\n    autoOpen: values.open ?? true,\n    logLevel: values.logLevel,\n  }\n}\n\ntype LoginOptions = {\n  /**\n   * Aborting this cancels an in-flight pairing request or poll and rejects with\n   * {@link PairingCanceledError}. Wired to `kubb studio`'s shutdown signal, so Ctrl+C during\n   * pairing cancels it instead of leaving the poll running.\n   */\n  signal?: AbortSignal\n  /**\n   * Credentials from before this login. When the fresh pairing resolves to the same agent on the\n   * same Studio, its saved project permissions carry forward instead of being asked again.\n   * Left out for an explicitly requested `kubb studio login`, which always starts clean.\n   */\n  previousCredentials?: Credentials | null\n}\n\n/**\n * Pairs this machine with Studio and stores the resulting token.\n *\n * The CLI holds a code and the browser approves it, rather than the user copying a token out of\n * the UI. The token comes back over the CLI's own HTTPS POST, so it never lands in a URL, a\n * server log, or a `Referer` header.\n */\nexport async function login({ studioUrl, autoOpen }: StudioOptions, { signal, previousCredentials }: LoginOptions = {}): Promise<Credentials> {\n  const spinner = createSpinner()\n  // The spinner only starts once a code is shown.\n  let waiting = false\n\n  try {\n    const { token, agent } = await pairAgent({\n      studioUrl,\n      type: 'cli',\n      name: path.basename(process.cwd()),\n      hostname: hostname(),\n      machineId: await getMachineId(),\n      signal,\n      onCode: (session) => {\n        console.log(`\\nOpen ${styleText('cyan', session.verification_uri)} and approve the code ${styleText('bold', session.user_code)}`)\n\n        if (autoOpen) {\n          openInBrowser(session.verification_uri_complete)\n        }\n\n        spinner.start('Waiting for approval')\n        waiting = true\n      },\n      onRetry: (error) => spinner.message(`Could not reach Kubb Studio, retrying: ${error.message}`),\n    })\n    spinner.stop(`Paired as ${agent.name}`)\n\n    const keepsIdentity = previousCredentials?.studioUrl === studioUrl && previousCredentials.agentId === agent.id\n    const credentials: Credentials = {\n      studioUrl,\n      token,\n      agentId: agent.id,\n      agentSlug: agent.slug,\n      ...(keepsIdentity && previousCredentials?.projects ? { projects: previousCredentials.projects } : {}),\n    }\n    await writeCredentials(credentials)\n\n    console.log(`Credentials stored in ${getCredentialsPath()}`)\n\n    return credentials\n  } catch (error) {\n    if (waiting) {\n      spinner.stop(error instanceof PairingCanceledError ? 'Pairing canceled' : 'Pairing failed')\n    }\n    throw error\n  }\n}\n\n/**\n * What each permission is asked as, in the order the questions appear.\n */\nconst PERMISSIONS: ReadonlyArray<{\n  key: Permission\n  /**\n   * Short label for status output and the connect summary.\n   */\n  label: string\n  question: (project: string, configPath: string) => string\n}> = [\n  {\n    key: 'allowRead',\n    label: 'read generated files',\n    question: () => 'Let Kubb Studio read the files a generation produced?',\n  },\n  { key: 'allowWrite', label: 'write generated files', question: (project) => `Let Kubb Studio write generated files into ${project}?` },\n  {\n    key: 'allowConfigEdit',\n    label: 'edit kubb.config.ts',\n    question: (_project, configPath) => `Let Kubb Studio change plugin options in ${configPath}?`,\n  },\n  {\n    key: 'allowExec',\n    label: 'run formatter, linter, postGenerate',\n    question: () => 'Let Kubb Studio run the formatter, the linter, and output.postGenerate?',\n  },\n]\n\n/**\n * One row per permission, for the connect banner and `kubb studio status`. A list rather than a\n * joined line: four labels this long read as one run-on sentence side by side.\n */\nexport function formatPermissionRows(granted: Record<Permission, boolean>): Array<string> {\n  return PERMISSIONS.map(({ key, label }) => `${granted[key] ? styleText('green', '✔') : styleText('red', '✘')} ${label}`)\n}\n\n/**\n * Resolves Studio permissions for the current project.\n * Flags win, saved answers are reused, and new answers are stored unless `persist` is false.\n */\nexport async function resolvePermissions(\n  options: StudioOptions,\n  credentials: Credentials,\n  configPath: string = KUBB_CONFIG_FILENAME,\n  /**\n   * Stores new answers in `~/.kubb/credentials.json`.\n   * Pass `false` for `KUBB_AGENT_TOKEN` sessions so a temporary token is not written back to disk.\n   */\n  persist = true,\n): Promise<Record<Permission, boolean>> {\n  const project = process.cwd()\n  const remembered = credentials.projects?.[project]\n  const granted: Record<Permission, boolean> = { allowRead: false, allowWrite: false, allowConfigEdit: false, allowExec: false }\n  const answers: Partial<Record<Permission, boolean>> = {}\n  prompts.updateSettings({ withGuide: true })\n\n  for (const { key, question } of PERMISSIONS) {\n    if (options.permission[key] || typeof remembered?.[key] === 'boolean') {\n      granted[key] = options.permission[key] || remembered?.[key] === true\n      continue\n    }\n\n    if (isCIEnvironment() || !canUseTTY()) {\n      granted[key] = false\n      continue\n    }\n\n    granted[key] = (await prompts.confirm({ message: question(project, configPath), initialValue: false })) === true\n    answers[key] = granted[key]\n  }\n  if (persist && Object.keys(answers).length) {\n    await writeCredentials({\n      ...credentials,\n      projects: { ...credentials.projects, [project]: { ...remembered, ...answers } },\n    })\n  }\n\n  return granted\n}\n\n/**\n * Loads the project's Kubb config the same way `kubb generate` does.\n * Returns the first config.\n */\nexport async function loadConfigs(options: Pick<StudioOptions, 'configPath' | 'logLevel'>): Promise<{ configPath: string; config: Config }> {\n  const { configPath, configs } = await getConfigs({ configPath: options.configPath, logLevel: options.logLevel })\n  const [config] = configs\n\n  if (!config) {\n    throw new Error('Config not defined, create a kubb.config.ts or pass it with --config')\n  }\n\n  // `getConfigs` resolves this to an absolute path. Relativized here, once, so the permission\n  // prompt and the path Studio receives over the wire both show the project-relative form instead\n  // of leaking the local filesystem layout.\n  return { configPath: path.relative(process.cwd(), configPath) || configPath, config }\n}\n\n/**\n * Why a rejected token could not be recovered automatically: it came from `KUBB_AGENT_TOKEN`, no\n * browser is available to re-pair with, or the token this run already re-paired for was rejected\n * again.\n */\ntype RejectedTokenReason = 'envToken' | 'nonInteractive' | 'reauthExhausted'\n\n/**\n * Explains a rejected token to the operator. Builds the error and nothing else, so each caller\n * decides what happens to the credentials.\n */\nfunction explainRejectedToken(error: InvalidAgentTokenError, reason: RejectedTokenReason): Error {\n  if (reason === 'envToken') {\n    return new Error(`${error.message} Pair again and update KUBB_AGENT_TOKEN.`)\n  }\n\n  if (reason === 'reauthExhausted') {\n    return new Error(`${error.message} Studio rejected the newly approved token too. Run \\`kubb studio login\\` and try again.`)\n  }\n\n  return new Error(`${error.message} Run \\`kubb studio login\\` to pair again.`)\n}\n\nexport type PreparedConnection = {\n  configPath: string\n  credentials: Credentials\n  permissions: StudioOptions['permission']\n}\n\n/** Validates the project and resolves pairing and permissions before starting its worker. */\nexport async function prepareConnection(options: StudioOptions, signal?: AbortSignal): Promise<PreparedConnection> {\n  const { configPath } = await loadConfigs(options)\n  const envToken = process.env.KUBB_AGENT_TOKEN\n  const stored = envToken ? null : await readCredentials()\n  const credentials = await (async () => {\n    if (envToken) return { studioUrl: options.studioUrl, token: envToken, agentId: '', agentSlug: '' }\n    if (stored?.studioUrl === options.studioUrl) return stored\n    if (isCIEnvironment()) {\n      throw new Error(`Not paired with ${options.studioUrl}. Set KUBB_AGENT_TOKEN, or run \\`kubb studio login\\` on a machine with a browser.`)\n    }\n    return login(options, { signal })\n  })()\n  const permissions = await resolvePermissions(options, credentials, configPath, !envToken)\n  return { configPath, credentials, permissions }\n}\n\nexport type WorkerState = 'starting' | 'connected' | 'reconnecting' | 'authentication required' | 'stopped'\n\n/** Runs the same project connection in the foreground or in a background worker. */\nexport async function connect(\n  options: StudioOptions,\n  context: {\n    prepared?: PreparedConnection\n    signal?: AbortSignal\n    onState?: (state: WorkerState) => void | Promise<void>\n  } = {},\n): Promise<void> {\n  const shutdown = new AbortController()\n  const signal = context.signal ?? shutdown.signal\n  const stop = () => shutdown.abort()\n  const events = process as unknown as NodeJS.EventEmitter\n  if (!context.signal) {\n    events.once('SIGINT', stop)\n    events.once('SIGTERM', stop)\n  }\n  try {\n    if (!context.prepared) {\n      const { getWorkerStatus } = await import('./background.ts')\n      const worker = await getWorkerStatus()\n      if (worker.running) throw new Error('This project is running in the background. Run `kubb studio stop` first.')\n    }\n    const prepared = context.prepared ?? (await prepareConnection(options, signal))\n    let { credentials, permissions } = prepared\n    const { configPath } = prepared\n    let hinted = false\n    // Set by a fresh pairing until it connects, so a token rejected right after approval fails the run instead of looping.\n    let pairedAgain = false\n\n    // The background worker writes to a log file, so it gets the plain logger rather than the\n    // animated one. The logger also covers the `studio:*` events and each generation run.\n    const hooks = new Hookable<KubbHooks>()\n    setupReporters(hooks, {\n      logLevel: logLevelMap[options.logLevel ?? 'info'],\n      reporters: [cliReporter],\n      ...(context.onState ? { logger: plainLogger } : {}),\n    })\n    hooks.hook('studio:connected', async () => {\n      pairedAgain = false\n      await context.onState?.('connected')\n      if (hinted || context.onState || options.logLevel === 'silent') return\n      hinted = true\n      logBlock(styleText('dim', 'Press Ctrl+C to disconnect'))\n      logTip()\n    })\n    hooks.hook('studio:reconnecting', () => context.onState?.('reconnecting'))\n\n    for (;;) {\n      try {\n        await connectAgent({\n          token: credentials.token,\n          studioUrl: options.studioUrl,\n          configPath,\n          version: options.version,\n          root: process.cwd(),\n          permissions,\n          loadConfig: async () => (await loadConfigs(options)).config,\n          hooks,\n          signal,\n        })\n        break\n      } catch (error) {\n        if (!(error instanceof InvalidAgentTokenError)) throw error\n        await context.onState?.('authentication required')\n        if (process.env.KUBB_AGENT_TOKEN) throw explainRejectedToken(error, 'envToken')\n        await clearCredentials()\n        if (pairedAgain) throw explainRejectedToken(error, 'reauthExhausted')\n        if (context.onState || isCIEnvironment() || !canUseTTY()) throw explainRejectedToken(error, 'nonInteractive')\n\n        console.log(styleText('yellow', `${error.message} Pairing again...`))\n        credentials = await login(options, { signal, previousCredentials: credentials })\n        pairedAgain = true\n        permissions = await resolvePermissions(options, credentials, configPath)\n      }\n    }\n    if (!context.onState && signal.aborted && options.logLevel !== 'silent') logOutro('Disconnected')\n  } catch (error) {\n    if (!(error instanceof PairingCanceledError)) throw error\n  } finally {\n    events.off('SIGINT', stop)\n    events.off('SIGTERM', stop)\n  }\n}\n\n/**\n * Runs a Studio command with shared setup and telemetry reporting.\n */\nexport async function run({\n  options,\n  action,\n  block = false,\n  json = false,\n}: {\n  options: Pick<StudioOptions, 'logLevel'>\n  action: () => Promise<unknown>\n  block?: boolean\n  json?: boolean\n}): Promise<void> {\n  const report = trackRun({ command: 'studio', hrStart: process.hrtime() })\n\n  try {\n    if (options.logLevel !== 'silent' && !json) {\n      logIntro({\n        warning: styleText('yellow', 'This feature is still under development, use with caution'),\n        block,\n      })\n    }\n\n    await action()\n\n    await report({ status: 'success' })\n  } catch (error) {\n    await report({ status: 'failed' })\n    console.error(toError(error).message)\n    process.exitCode = 1\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAIA,MAAM,eAAe,CAAC;;;;AAKtB,SAAgB,cAAc,QAAsB;CAClD,IAAIA,cAAAA,gBAAgB,GAAG;CAEvB,IAAIC,aAAAA,QAAQ,aAAa,SAAS;EAChC,CAAA,GAAA,SAAA,EAAA,CAAE,OAAO;GAAC;GAAM;GAAS;GAAI;EAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,MAAM;EACzD;CACF;CACA,CAAA,GAAA,SAAA,EAAA,CAAEA,aAAAA,QAAQ,aAAa,WAAW,SAAS,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,MAAM;AACtF;;;ACZA,MAAM,eAAe,UAAUC,aAAAA,QAAQ,IAAI,MAAMC,UAAAA,QAAK,KAAK,aAAA,GAAYC,YAAAA,KAAAA,CAAK,UAAU,OAAO,CAAC;;;;;;;AAQ9F,SAAgB,mBAAmB,UAAUF,aAAAA,QAAQ,IAAI,GAAW;CAClE,QAAA,GAAOG,WAAAA,eAAAA,CAAe,YAAY,OAAO,CAAC;AAC5C;AAEA,MAAM,wBAAA,GAAuBC,WAAAA,YAAAA,CAAY,EAAE,MAAM,YAAY,EAAE,CAAC;AAEhE,MAAM,uBAAuB;;;;AAK7B,SAAgB,qBAA6B;CAC3C,OAAOH,UAAAA,QAAK,KAAK,mBAAmB,GAAG,oBAAoB;AAC7D;;;;;;AAyBA,eAAsB,kBAA+C;CACnE,MAAM,SAAS,MAAM,eAAe,CAAC,CAClC,QAAqB,oBAAoB,CAAC,CAC1C,YAAY,IAAI;CAEnB,OAAO,OAAO,QAAQ,UAAU,YAAY,OAAO,UAAU,KAAK,SAAS;AAC7E;;;;AAKA,eAAsB,iBAAiB,aAAyC;CAC9E,MAAM,eAAe,CAAC,CAAC,QAAQ,sBAAsB,WAAW;AAClE;;;;AAKA,eAAsB,mBAAkC;CACtD,MAAM,eAAe,CAAC,CAAC,WAAW,oBAAoB;AACxD;;;;;;AAOA,eAAsB,eAAgC;CACpD,MAAM,UAAU,eAAe;CAC/B,MAAM,SAAS,MAAM,QAAQ,QAAQ,gBAAgB,CAAC,CAAC,YAAY,IAAI;CACvE,IAAI,OAAO,WAAW,YAAY,OAAO,KAAK,GAAG,OAAO,OAAO,KAAK;CAEpE,MAAM,UAAA,GAASI,YAAAA,YAAAA,CAAY,EAAE,CAAC,CAAC,SAAS,KAAK;CAC7C,MAAM,QAAQ,QAAQ,kBAAkB,MAAM;CAE9C,OAAO;AACT;;;ACPA,SAAgB,oBAAoB,QAAqC;CACvE,OAAO;EACL,SAAA,kBAAA;EACA,YAAY,OAAO;EACnB,WAAW,OAAO,OAAOC,aAAAA;EACzB,YAAY;GACV,WAAW,OAAO;GAClB,YAAY,OAAO;GACnB,iBAAiB,OAAO;GACxB,WAAW,OAAO;EACpB;EACA,UAAU,OAAO,QAAQ;EACzB,UAAU,OAAO;CACnB;AACF;;;;;;;;AAwBA,eAAsB,MAAM,EAAE,WAAW,YAA2B,EAAE,QAAQ,wBAAsC,CAAC,GAAyB;CAC5I,MAAM,UAAUC,eAAAA,cAAc;CAE9B,IAAI,UAAU;CAEd,IAAI;EACF,MAAM,EAAE,OAAO,UAAU,OAAA,GAAMC,aAAAA,UAAAA,CAAU;GACvC;GACA,MAAM;GACN,MAAMC,UAAAA,QAAK,SAASC,aAAAA,QAAQ,IAAI,CAAC;GACjC,WAAA,GAAUC,QAAAA,SAAAA,CAAS;GACnB,WAAW,MAAM,aAAa;GAC9B;GACA,SAAS,YAAY;IACnB,QAAQ,IAAI,WAAA,GAAUC,UAAAA,UAAAA,CAAU,QAAQ,QAAQ,gBAAgB,EAAE,yBAAA,GAAwBA,UAAAA,UAAAA,CAAU,QAAQ,QAAQ,SAAS,GAAG;IAEhI,IAAI,UACF,cAAc,QAAQ,yBAAyB;IAGjD,QAAQ,MAAM,sBAAsB;IACpC,UAAU;GACZ;GACA,UAAU,UAAU,QAAQ,QAAQ,0CAA0C,MAAM,SAAS;EAC/F,CAAC;EACD,QAAQ,KAAK,aAAa,MAAM,MAAM;EAEtC,MAAM,gBAAgB,qBAAqB,cAAc,aAAa,oBAAoB,YAAY,MAAM;EAC5G,MAAM,cAA2B;GAC/B;GACA;GACA,SAAS,MAAM;GACf,WAAW,MAAM;GACjB,GAAI,iBAAiB,qBAAqB,WAAW,EAAE,UAAU,oBAAoB,SAAS,IAAI,CAAC;EACrG;EACA,MAAM,iBAAiB,WAAW;EAElC,QAAQ,IAAI,yBAAyB,mBAAmB,GAAG;EAE3D,OAAO;CACT,SAAS,OAAO;EACd,IAAI,SACF,QAAQ,KAAK,iBAAiBC,aAAAA,uBAAuB,qBAAqB,gBAAgB;EAE5F,MAAM;CACR;AACF;;;;AAKA,MAAM,cAOD;CACH;EACE,KAAK;EACL,OAAO;EACP,gBAAgB;CAClB;CACA;EAAE,KAAK;EAAc,OAAO;EAAyB,WAAW,YAAY,8CAA8C,QAAQ;CAAG;CACrI;EACE,KAAK;EACL,OAAO;EACP,WAAW,UAAU,eAAe,4CAA4C,WAAW;CAC7F;CACA;EACE,KAAK;EACL,OAAO;EACP,gBAAgB;CAClB;AACF;;;;;AAMA,SAAgB,qBAAqB,SAAqD;CACxF,OAAO,YAAY,KAAK,EAAE,KAAK,YAAY,GAAG,QAAQ,QAAA,GAAOD,UAAAA,UAAAA,CAAU,SAAS,GAAG,KAAA,GAAIA,UAAAA,UAAAA,CAAU,OAAO,GAAG,EAAE,GAAG,OAAO;AACzH;;;;;AAMA,eAAsB,mBACpB,SACA,aACA,aAAqBE,kBAAAA,sBAKrB,UAAU,MAC4B;CACtC,MAAM,UAAUJ,aAAAA,QAAQ,IAAI;CAC5B,MAAM,aAAa,YAAY,WAAW;CAC1C,MAAM,UAAuC;EAAE,WAAW;EAAO,YAAY;EAAO,iBAAiB;EAAO,WAAW;CAAM;CAC7H,MAAM,UAAgD,CAAC;CACvD,eAAQ,eAAe,EAAE,WAAW,KAAK,CAAC;CAE1C,KAAK,MAAM,EAAE,KAAK,cAAc,aAAa;EAC3C,IAAI,QAAQ,WAAW,QAAQ,OAAO,aAAa,SAAS,WAAW;GACrE,QAAQ,OAAO,QAAQ,WAAW,QAAQ,aAAa,SAAS;GAChE;EACF;EAEA,IAAIK,cAAAA,gBAAgB,KAAK,CAACC,eAAAA,UAAU,GAAG;GACrC,QAAQ,OAAO;GACf;EACF;EAEA,QAAQ,OAAQ,MAAMC,eAAQ,QAAQ;GAAE,SAAS,SAAS,SAAS,UAAU;GAAG,cAAc;EAAM,CAAC,MAAO;EAC5G,QAAQ,OAAO,QAAQ;CACzB;CACA,IAAI,WAAW,OAAO,KAAK,OAAO,CAAC,CAAC,QAClC,MAAM,iBAAiB;EACrB,GAAG;EACH,UAAU;GAAE,GAAG,YAAY;IAAW,UAAU;IAAE,GAAG;IAAY,GAAG;GAAQ;EAAE;CAChF,CAAC;CAGH,OAAO;AACT;;;;;AAMA,eAAsB,YAAY,SAA0G;CAC1I,MAAM,EAAE,YAAY,YAAY,MAAMC,eAAAA,WAAW;EAAE,YAAY,QAAQ;EAAY,UAAU,QAAQ;CAAS,CAAC;CAC/G,MAAM,CAAC,UAAU;CAEjB,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,sEAAsE;CAMxF,OAAO;EAAE,YAAYT,UAAAA,QAAK,SAASC,aAAAA,QAAQ,IAAI,GAAG,UAAU,KAAK;EAAY;CAAO;AACtF;;;;;AAaA,SAAS,qBAAqB,OAA+B,QAAoC;CAC/F,IAAI,WAAW,YACb,uBAAO,IAAI,MAAM,GAAG,MAAM,QAAQ,yCAAyC;CAG7E,IAAI,WAAW,mBACb,uBAAO,IAAI,MAAM,GAAG,MAAM,QAAQ,wFAAwF;CAG5H,uBAAO,IAAI,MAAM,GAAG,MAAM,QAAQ,0CAA0C;AAC9E;;AASA,eAAsB,kBAAkB,SAAwB,QAAmD;CACjH,MAAM,EAAE,eAAe,MAAM,YAAY,OAAO;CAChD,MAAM,WAAWA,aAAAA,QAAQ,IAAI;CAC7B,MAAM,SAAS,WAAW,OAAO,MAAM,gBAAgB;CACvD,MAAM,cAAc,OAAO,YAAY;EACrC,IAAI,UAAU,OAAO;GAAE,WAAW,QAAQ;GAAW,OAAO;GAAU,SAAS;GAAI,WAAW;EAAG;EACjG,IAAI,QAAQ,cAAc,QAAQ,WAAW,OAAO;EACpD,IAAIK,cAAAA,gBAAgB,GAClB,MAAM,IAAI,MAAM,mBAAmB,QAAQ,UAAU,kFAAkF;EAEzI,OAAO,MAAM,SAAS,EAAE,OAAO,CAAC;CAClC,EAAA,CAAG;CAEH,OAAO;EAAE;EAAY;EAAa,aAAA,MADR,mBAAmB,SAAS,aAAa,YAAY,CAAC,QAAQ;CAC1C;AAChD;;AAKA,eAAsB,QACpB,SACA,UAII,CAAC,GACU;CACf,MAAM,WAAW,IAAI,gBAAgB;CACrC,MAAM,SAAS,QAAQ,UAAU,SAAS;CAC1C,MAAM,aAAa,SAAS,MAAM;CAClC,MAAM,SAASL,aAAAA;CACf,IAAI,CAAC,QAAQ,QAAQ;EACnB,OAAO,KAAK,UAAU,IAAI;EAC1B,OAAO,KAAK,WAAW,IAAI;CAC7B;CACA,IAAI;EACF,IAAI,CAAC,QAAQ,UAAU;GACrB,MAAM,EAAE,oBAAoB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,2BAAA,CAAA;GAElC,KAAI,MADiB,gBAAgB,EAAA,CAC1B,SAAS,MAAM,IAAI,MAAM,0EAA0E;EAChH;EACA,MAAM,WAAW,QAAQ,YAAa,MAAM,kBAAkB,SAAS,MAAM;EAC7E,IAAI,EAAE,aAAa,gBAAgB;EACnC,MAAM,EAAE,eAAe;EACvB,IAAI,SAAS;EAEb,IAAI,cAAc;EAIlB,MAAM,QAAQ,IAAIS,WAAAA,SAAoB;EACtC,eAAA,eAAe,OAAO;GACpB,UAAUC,WAAAA,SAAY,QAAQ,YAAY;GAC1C,WAAW,CAACC,WAAAA,WAAW;GACvB,GAAI,QAAQ,UAAU,EAAE,QAAQC,eAAAA,YAAY,IAAI,CAAC;EACnD,CAAC;EACD,MAAM,KAAK,oBAAoB,YAAY;GACzC,cAAc;GACd,MAAM,QAAQ,UAAU,WAAW;GACnC,IAAI,UAAU,QAAQ,WAAW,QAAQ,aAAa,UAAU;GAChE,SAAS;GACT,eAAA,UAAA,GAASV,UAAAA,UAAAA,CAAU,OAAO,4BAA4B,CAAC;GACvD,eAAA,OAAO;EACT,CAAC;EACD,MAAM,KAAK,6BAA6B,QAAQ,UAAU,cAAc,CAAC;EAEzE,SACE,IAAI;GACF,OAAA,GAAMW,aAAAA,aAAAA,CAAa;IACjB,OAAO,YAAY;IACnB,WAAW,QAAQ;IACnB;IACA,SAAS,QAAQ;IACjB,MAAMb,aAAAA,QAAQ,IAAI;IAClB;IACA,YAAY,aAAa,MAAM,YAAY,OAAO,EAAA,CAAG;IACrD;IACA;GACF,CAAC;GACD;EACF,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiBc,aAAAA,yBAAyB,MAAM;GACtD,MAAM,QAAQ,UAAU,yBAAyB;GACjD,IAAId,aAAAA,QAAQ,IAAI,kBAAkB,MAAM,qBAAqB,OAAO,UAAU;GAC9E,MAAM,iBAAiB;GACvB,IAAI,aAAa,MAAM,qBAAqB,OAAO,iBAAiB;GACpE,IAAI,QAAQ,WAAWK,cAAAA,gBAAgB,KAAK,CAACC,eAAAA,UAAU,GAAG,MAAM,qBAAqB,OAAO,gBAAgB;GAE5G,QAAQ,KAAA,GAAIJ,UAAAA,UAAAA,CAAU,UAAU,GAAG,MAAM,QAAQ,kBAAkB,CAAC;GACpE,cAAc,MAAM,MAAM,SAAS;IAAE;IAAQ,qBAAqB;GAAY,CAAC;GAC/E,cAAc;GACd,cAAc,MAAM,mBAAmB,SAAS,aAAa,UAAU;EACzE;EAEF,IAAI,CAAC,QAAQ,WAAW,OAAO,WAAW,QAAQ,aAAa,UAAU,eAAA,SAAS,cAAc;CAClG,SAAS,OAAO;EACd,IAAI,EAAE,iBAAiBC,aAAAA,uBAAuB,MAAM;CACtD,UAAU;EACR,OAAO,IAAI,UAAU,IAAI;EACzB,OAAO,IAAI,WAAW,IAAI;CAC5B;AACF;;;;AAKA,eAAsB,IAAI,EACxB,SACA,QACA,QAAQ,OACR,OAAO,SAMS;CAChB,MAAM,SAASY,kBAAAA,SAAS;EAAE,SAAS;EAAU,SAASf,aAAAA,QAAQ,OAAO;CAAE,CAAC;CAExE,IAAI;EACF,IAAI,QAAQ,aAAa,YAAY,CAAC,MACpC,eAAA,SAAS;GACP,UAAA,GAASE,UAAAA,UAAAA,CAAU,UAAU,2DAA2D;GACxF;EACF,CAAC;EAGH,MAAM,OAAO;EAEb,MAAM,OAAO,EAAE,QAAQ,UAAU,CAAC;CACpC,SAAS,OAAO;EACd,MAAM,OAAO,EAAE,QAAQ,SAAS,CAAC;EACjC,QAAQ,MAAMc,eAAAA,QAAQ,KAAK,CAAC,CAAC,OAAO;EACpC,aAAA,QAAA,WAAmB;CACrB;AACF"}

package/dist/{run-Dgph0WYk.js → run-B_0Vp1ZV.js}

@@ -1,20 +1,19 @@
 import "./rolldown-runtime-CRm0XQPb.js";
 import { t as toError } from "./errors-BQJzaUwP.js";
 import { i as isCIEnvironment } from "./agent-BPIqnEl2.js";
-import { i as runtime, n as trackRun, r as version } from "./Telemetry-RBcAjNxj.js";
+import { n as trackRun, r as version } from "./Telemetry-DqT0XYcN.js";
 import { t as KUBB_CONFIG_FILENAME } from "./constants-DHRspBTo.js";
-import { r as setupReporters, t as getConfigs } from "./config-8Xl4yZmw.js";
-import { g as plainLogger, o as logIntro, p as canUseTTY, r as logBlock, s as logOutro, t as createSpinner, u as logTip } from "./output-B6Ondw0g.js";
+import { r as setupReporters, t as getConfigs } from "./config-CCxOcwWu.js";
+import { g as plainLogger, o as logIntro, p as canUseTTY, r as logBlock, s as logOutro, t as createSpinner, u as logTip } from "./output-CnSY0tCG.js";
 import { styleText } from "node:util";
-import { hash } from "node:crypto";
-import { homedir, hostname } from "node:os";
+import { hash, randomBytes } from "node:crypto";
+import { hostname } from "node:os";
 import process from "node:process";
 import { x } from "tinyexec";
-import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { PairingCanceledError, createFileStorage, defaultStudioUrl, pairAgent, runConnection, setStorage } from "@kubb/studio";
+import { Hookable, cliReporter, kubbStorage, logLevel, resolveKubbDir } from "@kubb/core";
 import * as prompts from "@clack/prompts";
-import { cliReporter, logLevel } from "@kubb/core";
+import { InvalidAgentTokenError, PairingCanceledError, connectAgent, defaultStudioUrl, pairAgent } from "@kubb/studio";
 //#region ../../internals/utils/src/openInBrowser.ts
 const ignore = () => {};
 /**
@@ -34,68 +33,18 @@ function openInBrowser(target) {
 	x(process.platform === "darwin" ? "open" : "xdg-open", [target]).then(ignore, ignore);
 }
 //#endregion
-//#region ../../internals/utils/src/fs.ts
-/**
-* Resolves to `true` when the file or directory at `path` exists.
-* Uses `Bun.file().exists()` when running under Bun, `fs.access` otherwise.
-*
-* @example
-* ```ts
-* if (await exists('./kubb.config.ts')) {
-*   const content = await read('./kubb.config.ts')
-* }
-* ```
-*/
-async function exists(path) {
-	if (runtime.isBun) return Bun.file(path).exists();
-	return access(path).then(() => true, () => false);
-}
-/**
-* Reads the file at `path` as a UTF-8 string.
-* Uses `Bun.file().text()` when running under Bun, `fs.readFile` otherwise.
-*
-* @example
-* ```ts
-* const source = await read('./src/Pet.ts')
-* ```
-*/
-async function read(path) {
-	if (runtime.isBun) return Bun.file(path).text();
-	return readFile(path, { encoding: "utf8" });
-}
-/**
-* Recursively removes `path`. Silently succeeds when `path` does not exist.
-*
-* @example
-* ```ts
-* await clean('./dist')
-* ```
-*/
-async function clean(path) {
-	return rm(path, {
-		recursive: true,
-		force: true
-	});
-}
-//#endregion
 //#region src/runners/studio/credentials.ts
+const projectBase = (project = process.cwd()) => path.join("projects", hash("sha256", project));
 /**
-* Root for everything the CLI persists between runs: the paired credential, the machine secret,
-* the last Studio config, and the live-session registry. `KUBB_HOME` relocates all of it.
-*/
-function getKubbHome() {
-	return process.env.KUBB_HOME ?? path.join(homedir(), ".kubb");
-}
-/**
-* Root for the credential and machine identity of the current project.
+* Root for the credential and machine identity of the current project, inside `KUBB_HOME`.
 *
 * Studio agents are project connections, so two projects on one machine must not share the same
 * persisted token or machine secret.
 */
 function getProjectKubbHome(project = process.cwd()) {
-	const projectId = hash("sha256", project);
-	return path.join(getKubbHome(), "projects", projectId);
+	return resolveKubbDir(projectBase(project));
 }
+const projectStorage = () => kubbStorage({ base: projectBase() });
 const CREDENTIALS_FILENAME = "credentials.json";
 /**
 * Absolute path of the stored credential, so callers can name it in output without rebuilding it.
@@ -109,32 +58,33 @@ function getCredentialsPath() {
 * overwrite it rather than the CLI dying on it.
 */
 async function readCredentials() {
-	const raw = await read(getCredentialsPath()).catch(() => null);
-	if (!raw) return null;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
+	const stored = await projectStorage().getItem(CREDENTIALS_FILENAME).catch(() => null);
+	return typeof stored?.token === "string" && stored.token !== "" ? stored : null;
 }
 /**
-* Writes the credential with owner-only permissions. The file holds a bearer token, so the mode
-* is set at creation time rather than left to the process umask or fixed up afterward, which
-* would leave the token briefly readable under the umask's default mode.
+* Writes the credential into the project folder, which only its owner can open.
 */
 async function writeCredentials(credentials) {
-	const file = getCredentialsPath();
-	await mkdir(path.dirname(file), {
-		recursive: true,
-		mode: 448
-	});
-	await writeFile(file, JSON.stringify(credentials, null, 2), { mode: 384 });
+	await projectStorage().setItem(CREDENTIALS_FILENAME, credentials);
 }
 /**
 * Forgets the stored credential. Succeeds when there was nothing to forget.
 */
 async function clearCredentials() {
-	await clean(getCredentialsPath());
+	await projectStorage().removeItem(CREDENTIALS_FILENAME);
+}
+/**
+* Reads this project's machine secret, creating it on first use. Pairing sends its hash, so pairing
+* the same project again rotates one agent's token instead of creating a second agent. It lives
+* apart from the credential, which {@link clearCredentials} deletes.
+*/
+async function getMachineId() {
+	const storage = projectStorage();
+	const stored = await storage.getItem("machine-secret").catch(() => null);
+	if (typeof stored === "string" && stored.trim()) return stored.trim();
+	const secret = randomBytes(32).toString("hex");
+	await storage.setItem("machine-secret", secret);
+	return secret;
 }
 //#endregion
 //#region src/runners/studio/run.ts
@@ -169,6 +119,7 @@ async function login({ studioUrl, autoOpen }, { signal, previousCredentials } =
 			type: "cli",
 			name: path.basename(process.cwd()),
 			hostname: hostname(),
+			machineId: await getMachineId(),
 			signal,
 			onCode: (session) => {
 				console.log(`\nOpen ${styleText("cyan", session.verification_uri)} and approve the code ${styleText("bold", session.user_code)}`);
@@ -326,68 +277,59 @@ async function connect(options, context = {}) {
 		events.once("SIGINT", stop);
 		events.once("SIGTERM", stop);
 	}
-	let hinted = false;
-	let reauthenticated = false;
 	try {
 		if (!context.prepared) {
-			const { getWorkerStatus } = await import("./background-BqS01QDb.js");
+			const { getWorkerStatus } = await import("./background-O8hzI5Pg.js");
 			if ((await getWorkerStatus()).running) throw new Error("This project is running in the background. Run `kubb studio stop` first.");
 		}
 		const prepared = context.prepared ?? await prepareConnection(options, signal);
 		let { credentials, permissions } = prepared;
 		const { configPath } = prepared;
-		await runConnection({
-			credentials,
-			signal,
-			clientOptions: () => ({
+		let hinted = false;
+		let pairedAgain = false;
+		const hooks = new Hookable();
+		setupReporters(hooks, {
+			logLevel: logLevel[options.logLevel ?? "info"],
+			reporters: [cliReporter],
+			...context.onState ? { logger: plainLogger } : {}
+		});
+		hooks.hook("studio:connected", async () => {
+			pairedAgain = false;
+			await context.onState?.("connected");
+			if (hinted || context.onState || options.logLevel === "silent") return;
+			hinted = true;
+			logBlock(styleText("dim", "Press Ctrl+C to disconnect"));
+			logTip();
+		});
+		hooks.hook("studio:reconnecting", () => context.onState?.("reconnecting"));
+		for (;;) try {
+			await connectAgent({
+				token: credentials.token,
 				studioUrl: options.studioUrl,
 				configPath,
 				version: options.version,
 				root: process.cwd(),
 				permissions,
 				loadConfig: async () => (await loadConfigs(options)).config,
-				installLogger: async (hooks) => {
-					setupReporters(hooks, {
-						logLevel: logLevel[options.logLevel ?? "info"],
-						reporters: [cliReporter],
-						...context.onState ? { logger: plainLogger } : {}
-					});
-					hooks.hook("studio:connected", () => {
-						if (!hinted && !context.onState && options.logLevel !== "silent") logBlock(styleText("dim", "Press Ctrl+C to disconnect"));
-						hinted = true;
-					});
-					hooks.hook("studio:ready", async () => {
-						await context.onState?.("connected");
-						if (!context.onState) logTip();
-					});
-					hooks.hook("studio:reconnecting", () => context.onState?.("reconnecting"));
-				}
-			}),
-			onTokenRejected: async ({ error, live }) => {
-				await context.onState?.("authentication required");
-				if (process.env.KUBB_AGENT_TOKEN) throw explainRejectedToken(error, "envToken");
-				if (!live) await clearCredentials();
-				if (reauthenticated) throw explainRejectedToken(error, "reauthExhausted");
-				if (context.onState || isCIEnvironment() || !canUseTTY()) throw explainRejectedToken(error, "nonInteractive");
-				console.log(styleText("yellow", live ? `${error.message} Studio needs you to approve access again.` : `${error.message} Pairing again...`));
-				if (live) await clearCredentials();
-				try {
-					credentials = await login(options, {
-						signal,
-						previousCredentials: credentials
-					});
-				} catch (error) {
-					if (error instanceof PairingCanceledError) {
-						if (live && options.logLevel !== "silent") logOutro("Disconnected");
-						return null;
-					}
-					throw error;
-				}
-				reauthenticated = true;
-				permissions = await resolvePermissions(options, credentials, configPath, !process.env.KUBB_AGENT_TOKEN);
-				return credentials;
-			}
-		});
+				hooks,
+				signal
+			});
+			break;
+		} catch (error) {
+			if (!(error instanceof InvalidAgentTokenError)) throw error;
+			await context.onState?.("authentication required");
+			if (process.env.KUBB_AGENT_TOKEN) throw explainRejectedToken(error, "envToken");
+			await clearCredentials();
+			if (pairedAgain) throw explainRejectedToken(error, "reauthExhausted");
+			if (context.onState || isCIEnvironment() || !canUseTTY()) throw explainRejectedToken(error, "nonInteractive");
+			console.log(styleText("yellow", `${error.message} Pairing again...`));
+			credentials = await login(options, {
+				signal,
+				previousCredentials: credentials
+			});
+			pairedAgain = true;
+			permissions = await resolvePermissions(options, credentials, configPath);
+		}
 		if (!context.onState && signal.aborted && options.logLevel !== "silent") logOutro("Disconnected");
 	} catch (error) {
 		if (!(error instanceof PairingCanceledError)) throw error;
@@ -399,8 +341,7 @@ async function connect(options, context = {}) {
 /**
 * Runs a Studio command with shared setup and telemetry reporting.
 */
-async function run(options, action, { block = false, json = false } = {}) {
-	setStorage(createFileStorage(getProjectKubbHome()));
+async function run({ options, action, block = false, json = false }) {
 	const report = trackRun({
 		command: "studio",
 		hrStart: process.hrtime()
@@ -419,6 +360,6 @@ async function run(options, action, { block = false, json = false } = {}) {
 	}
 }
 //#endregion
-export { login as a, clearCredentials as c, exists as d, read as f, loadConfigs as i, getProjectKubbHome as l, createStudioOptions as n, prepareConnection as o, formatPermissionRows as r, run as s, connect as t, readCredentials as u };
+export { login as a, clearCredentials as c, loadConfigs as i, getProjectKubbHome as l, createStudioOptions as n, prepareConnection as o, formatPermissionRows as r, run as s, connect as t, readCredentials as u };
 
-//# sourceMappingURL=run-Dgph0WYk.js.map
+//# sourceMappingURL=run-B_0Vp1ZV.js.map