@sequenceholdings/studio-cli 0.1.13 → 0.1.21

package/dist/agents/commands.js

@@ -0,0 +1,218 @@
+import { getJson, postJson } from '../atlas-client.js';
+import { readConfig } from '../config.js';
+import { applyInChunks } from './apply-chunks.js';
+import { confirmYes } from '../prompt.js';
+import { buildContext, clientOptions, flagBool, printError, requestedEnvironment, } from '../functions/commands.js';
+import { compileAgentSource as compileSource, materializeAgentSource as materialize, } from './source.js';
+import { agentsInitCommand } from './scaffold.js';
+export { agentsInitCommand };
+const LOG = '[seq-studio]';
+export async function agentsValidateCommand(args) {
+    const { source } = await materialize({ args, requireEnvironment: false });
+    try {
+        const target = typeof args.flags.target === 'string' ? args.flags.target : undefined;
+        const bundle = await compileSource({
+            directory: source.dir,
+            targetEnvironment: target,
+            deployEnvironments: await deployEnvironmentNames(),
+        });
+        if (bundle.definitions.length === 0) {
+            console.error(`${LOG} no named agent.ts definitions found`);
+            return 1;
+        }
+        console.log(`${LOG} valid: ${bundle.definitions.length} definition${bundle.definitions.length === 1 ? '' : 's'}, bundle ${bundle.hash}`);
+        return 0;
+    }
+    finally {
+        await source.cleanup();
+    }
+}
+async function deploymentBundle({ args, source, context, }) {
+    const target = (typeof args.flags.target === 'string' ? args.flags.target : undefined) ??
+        context.env.name;
+    return compileSource({
+        directory: source.dir,
+        targetEnvironment: target,
+        deployEnvironments: await deployEnvironmentNames(),
+    });
+}
+/**
+ * Names the CLI can actually deploy to. A target outside both this set and the
+ * manifest's own vocabulary is a typo, not a selection.
+ */
+async function deployEnvironmentNames() {
+    try {
+        return Object.keys((await readConfig()).envs);
+    }
+    catch {
+        // Never let an unreadable config block a deploy — the guard is a safety
+        // net, and the manifest's own vocabulary still constrains the target.
+        return [];
+    }
+}
+function printPlan(plan) {
+    for (const entry of plan.entries) {
+        const marker = entry.action === 'create' ? '+' : entry.action === 'update' ? '~' : '=';
+        // Name the fields an update would rewrite, so an operator can tell an
+        // intended edit from unexpected drift before confirming an apply.
+        const fields = entry.changedFields?.length
+            ? `: ${entry.changedFields.join(', ')}`
+            : '';
+        console.log(`  ${marker} ${entry.name} (${entry.id}) ${entry.action}${fields}`);
+    }
+    console.log(`${LOG} plan: ${plan.summary.creates} create, ${plan.summary.updates} update, ${plan.summary.unchanged} unchanged`);
+}
+export async function agentsPlanCommand(args) {
+    const environment = requestedEnvironment(args);
+    if (!environment) {
+        const { source } = await materialize({ args, requireEnvironment: false });
+        try {
+            // Honor --target the same way validate does. Without this, offline plan
+            // silently compiles the unfiltered manifest set even when the caller
+            // asked for a specific environment's overrides.
+            const target = typeof args.flags.target === 'string' ? args.flags.target : undefined;
+            const bundle = await compileSource({
+                directory: source.dir,
+                targetEnvironment: target,
+                deployEnvironments: await deployEnvironmentNames(),
+            });
+            console.log(`${LOG} offline plan: ${bundle.definitions.length} valid definition${bundle.definitions.length === 1 ? '' : 's'}, bundle ${bundle.hash}`);
+            console.log(`${LOG} pass -e <env> for create/update/unchanged live diff`);
+            return bundle.definitions.length > 0 ? 0 : 1;
+        }
+        finally {
+            await source.cleanup();
+        }
+    }
+    const { source, context } = await materialize({
+        args,
+        requireEnvironment: true,
+    });
+    if (!context)
+        throw new Error('Missing deployment context');
+    try {
+        const bundle = await deploymentBundle({ args, source, context });
+        const plan = await postJson({
+            ...clientOptions(context),
+            path: '/api/agents/deploy/plan',
+            body: {
+                definitions: bundle.definitions,
+                bundleHash: bundle.hash,
+                source: source.provenance.gitCommit ?? 'local',
+            },
+        });
+        printPlan(plan);
+        return 0;
+    }
+    finally {
+        await source.cleanup();
+    }
+}
+export async function agentsApplyCommand(args) {
+    const { source, context } = await materialize({
+        args,
+        requireEnvironment: true,
+    });
+    if (!context)
+        throw new Error('Missing deployment context');
+    try {
+        const bundle = await deploymentBundle({ args, source, context });
+        const plan = await postJson({
+            ...clientOptions(context),
+            path: '/api/agents/deploy/plan',
+            body: {
+                definitions: bundle.definitions,
+                bundleHash: bundle.hash,
+                source: source.provenance.gitCommit ?? 'local',
+            },
+        });
+        printPlan(plan);
+        const preview = [
+            `${LOG} apply ${bundle.definitions.length} agent definitions to ${context.env.name}`,
+            `${LOG} bundle ${bundle.hash}`,
+            `${LOG} no agents will be deleted`,
+        ];
+        if (!(await confirmYes({ preview, confirmed: flagBool(args.flags, 'yes') }))) {
+            return 1;
+        }
+        const summary = await applyInChunks({
+            context,
+            definitions: bundle.definitions,
+            source: source.provenance.gitCommit ?? 'local',
+        });
+        console.log(`${LOG} applied: ${summary.created} created, ${summary.updated} updated, ${summary.unchanged} unchanged`);
+        return 0;
+    }
+    finally {
+        await source.cleanup();
+    }
+}
+export async function agentsListCommand(args) {
+    const context = await buildContext(args);
+    const agents = await getJson({
+        ...clientOptions(context),
+        path: '/api/agents/agents?view=list',
+    });
+    for (const agent of agents) {
+        console.log(`${agent.id}  ${agent.name}  managed=${agent.managedBy ?? 'user'}`);
+    }
+    return 0;
+}
+export async function agentsShowCommand(args) {
+    const id = args.positional[0];
+    if (!id) {
+        console.error('usage: seq-studio agents show <id> -e <env>');
+        return 1;
+    }
+    const context = await buildContext(args);
+    const agent = await getJson({
+        ...clientOptions(context),
+        path: `/api/agents/agents/${encodeURIComponent(id)}`,
+    });
+    console.log(JSON.stringify(agent, null, 2));
+    return 0;
+}
+export const AGENTS_USAGE = `usage:
+  seq-studio agents init <dir>                         scaffold a typed agent
+  seq-studio agents validate [--dir d] [--target app] offline compile + validation
+  seq-studio agents plan [--dir d] [-e <env>]          offline bundle plan or live diff
+  seq-studio agents apply [--dir d] -e <env> [--yes]  apply creates/updates; never deletes
+  seq-studio agents list -e <env>                      list visible agents
+  seq-studio agents show <id> -e <env>                 show one agent
+
+  Source: local --dir (default .), --repo agents/<name>, or --git-url <url>.
+  Use --ref for remote sources. --target selects the deployment APP_ENV when it
+  differs from the CLI environment alias (notably OpCo registrations).
+`;
+export async function runAgentsCommand(sub, args) {
+    try {
+        switch (sub) {
+            case 'init':
+                return await agentsInitCommand(args);
+            case 'validate':
+                return await agentsValidateCommand(args);
+            case 'plan':
+                return await agentsPlanCommand(args);
+            case 'apply':
+                return await agentsApplyCommand(args);
+            case 'list':
+                return await agentsListCommand(args);
+            case 'show':
+                return await agentsShowCommand(args);
+            case 'help':
+            case '--help':
+            case '-h':
+            case undefined:
+                console.log(AGENTS_USAGE);
+                return sub ? 0 : 1;
+            default:
+                console.error(`unknown agents command: ${sub}`);
+                console.error(AGENTS_USAGE);
+                return 1;
+        }
+    }
+    catch (error) {
+        printError(error);
+        return 1;
+    }
+}

package/dist/agents/scaffold.d.ts

@@ -0,0 +1,2 @@
+import type { ParsedArgs } from '../process/commands.js';
+export declare function agentsInitCommand(args: ParsedArgs): Promise<number>;

package/dist/agents/scaffold.js

@@ -0,0 +1,77 @@
+import { randomBytes } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { basename, join, resolve } from 'node:path';
+import { currentVersion } from '../update-check.js';
+const LOG = '[seq-studio]';
+const scaffoldSource = ({ id, name, }) => `import { defineAgent } from '@sequenceholdings/agent-spec'
+
+export const agent = defineAgent({
+  id: '${id}',
+  name: '${name}',
+  model: {
+    provider: 'anthropic',
+    name: 'claude-sonnet-4-6',
+  },
+  systemPrompt: 'Describe the agent role and operating instructions.',
+})
+`;
+export async function agentsInitCommand(args) {
+    const target = args.positional[0];
+    if (!target) {
+        console.error('usage: seq-studio agents init <dir>');
+        return 1;
+    }
+    const directory = resolve(target);
+    const file = join(directory, 'agent.ts');
+    if (existsSync(file)) {
+        console.error(`${LOG} ${file} already exists`);
+        return 1;
+    }
+    const name = basename(directory)
+        .split(/[-_]+/)
+        .filter(Boolean)
+        .map((part) => `${part[0]?.toUpperCase() ?? ''}${part.slice(1)}`)
+        .join(' ');
+    await mkdir(directory, { recursive: true });
+    await writeFile(file, scaffoldSource({ id: randomBytes(12).toString('hex'), name }));
+    await writeFile(join(directory, 'package.json'), `${JSON.stringify({
+        name: basename(directory),
+        version: '0.0.1',
+        private: true,
+        type: 'module',
+        scripts: { validate: 'seq-studio agents validate' },
+        dependencies: { '@sequenceholdings/agent-spec': '^0.1.0' },
+        devDependencies: {
+            '@sequenceholdings/studio-cli': `^${currentVersion()}`,
+        },
+    }, null, 2)}\n`);
+    await writeFile(join(directory, 'tsconfig.json'), `${JSON.stringify({
+        compilerOptions: {
+            target: 'ES2022',
+            module: 'NodeNext',
+            moduleResolution: 'NodeNext',
+            strict: true,
+            noEmit: true,
+        },
+        include: ['agent.ts'],
+    }, null, 2)}\n`);
+    await writeFile(join(directory, 'pnpm-workspace.yaml'), `packages:
+  - '.'
+
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - '@sequenceholdings/agent-spec'
+  - '@sequenceholdings/atlas-ui'
+  - '@sequenceholdings/lattice-form-renderer'
+  - '@sequenceholdings/artifact-studio'
+  - '@sequenceholdings/lattice'
+  - '@sequenceholdings/studio-cli'
+strictDepBuilds: true
+allowBuilds:
+  esbuild: true
+`);
+    console.log(`${LOG} scaffolded typed agent in ${directory}`);
+    console.log('Next: pnpm install && seq-studio agents validate');
+    return 0;
+}

package/dist/agents/source.d.ts

@@ -0,0 +1,18 @@
+import { type CompiledAgentBundle } from '@sequenceholdings/agent-spec/compiler';
+import { type ResolvedSource, type SourceSpec } from '@sequenceholdings/artifact-studio/source-resolver';
+import type { ParsedArgs } from '../process/commands.js';
+import { type CommandContext } from '../functions/commands.js';
+export declare function materializeAgentSource({ args, requireEnvironment, }: {
+    args: ParsedArgs;
+    requireEnvironment: boolean;
+}): Promise<{
+    spec: SourceSpec;
+    source: ResolvedSource;
+    context: CommandContext | null;
+}>;
+export declare function compileAgentSource({ directory, targetEnvironment, deployEnvironments, }: {
+    directory: string;
+    targetEnvironment?: string;
+    /** Registered deployment environments, so a real env absent from the manifest is not read as a typo. */
+    deployEnvironments?: readonly string[];
+}): Promise<CompiledAgentBundle>;

package/dist/agents/source.js

@@ -0,0 +1,121 @@
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { hashAgentBundle, } from '@sequenceholdings/agent-spec';
+import { agentDeployManifestSchema, assertKnownTargetEnvironment, compileAgentDirectory, selectAgentEntries, selectionStats, } from '@sequenceholdings/agent-spec/compiler';
+import { parseSourceSpec, resolveArtifactSource, } from '@sequenceholdings/artifact-studio/source-resolver';
+import { buildContext, clientOptions, requestedEnvironment, } from '../functions/commands.js';
+const MANIFEST = 'deploy-manifest.json';
+function sourceSpec(args) {
+    const dir = typeof args.flags.dir === 'string' ? args.flags.dir : undefined;
+    if (dir &&
+        (args.flags.repo !== undefined || args.flags['git-url'] !== undefined)) {
+        throw new Error('--dir cannot be combined with --repo / --git-url.');
+    }
+    return parseSourceSpec({
+        positional: dir ? [dir] : [],
+        flags: args.flags,
+    });
+}
+function sourceOptions(context) {
+    return {
+        ...(context.authMode ? { authMode: context.authMode } : {}),
+        ...clientOptions(context),
+    };
+}
+export async function materializeAgentSource({ args, requireEnvironment, }) {
+    const spec = sourceSpec(args);
+    const needsAuth = spec.kind !== 'local';
+    if (requireEnvironment && !requestedEnvironment(args)) {
+        throw new Error('Network commands require an explicit -e/--env.');
+    }
+    const context = needsAuth || requireEnvironment ? await buildContext(args) : null;
+    const source = await resolveArtifactSource(spec, context ? sourceOptions(context) : {});
+    return { spec, source, context };
+}
+async function readManifest(directory) {
+    const path = join(directory, MANIFEST);
+    if (!existsSync(path))
+        return null;
+    return agentDeployManifestSchema.parse(JSON.parse(await readFile(path, 'utf8')));
+}
+/**
+ * Refuse to deploy when a compiled export's id does not match the id the
+ * manifest keyed the environment override on. Without that check a mis-labeled
+ * agent.ts would silently deploy under a different identity and defeat tenant
+ * overrides.
+ *
+ * Every selected path is parsed in one pass. Compiling them one file at a
+ * time previously re-parsed each agent separately and dominated validate
+ * latency on a large fleet — paid again on plan, and twice more on apply,
+ * since apply plans before it writes.
+ */
+async function compileManifestEntries({ directory, entries, allowDuplicateIds = false, }) {
+    if (entries.length === 0) {
+        return { definitions: [], files: [], hash: hashAgentBundle({ definitions: [] }), sources: [] };
+    }
+    const compiled = await compileAgentDirectory({
+        rootDir: directory,
+        filePaths: entries.map((entry) => entry.path),
+        allowDuplicateIds,
+    });
+    const byFile = new Map();
+    for (const source of compiled.sources) {
+        const list = byFile.get(source.file) ?? [];
+        list.push(source.definition);
+        byFile.set(source.file, list);
+    }
+    const definitions = [];
+    for (const entry of entries) {
+        const exported = byFile.get(entry.path) ?? [];
+        if (exported.length !== 1) {
+            throw new Error(`Expected exactly one agent export in ${entry.path}, found ${exported.length}`);
+        }
+        const definition = exported[0];
+        if (!definition) {
+            throw new Error(`Expected exactly one agent export in ${entry.path}, found 0`);
+        }
+        if (definition.id !== entry.id) {
+            throw new Error(`Manifest id "${entry.id}" for ${entry.path} does not match exported id "${definition.id}"`);
+        }
+        definitions.push(definition);
+    }
+    return {
+        definitions,
+        files: compiled.files,
+        hash: hashAgentBundle({ definitions }),
+        sources: compiled.sources,
+    };
+}
+export async function compileAgentSource({ directory, targetEnvironment, deployEnvironments = [], }) {
+    const manifest = await readManifest(directory);
+    if (!manifest)
+        return compileAgentDirectory({ rootDir: directory });
+    if (targetEnvironment !== undefined) {
+        assertKnownTargetEnvironment({
+            manifest,
+            environment: targetEnvironment,
+            deployEnvironments,
+        });
+        // Selection is silent, so a target that matches nothing looks identical to
+        // a full deploy. Name the drop before the operator confirms an apply.
+        const { selected, skipped, total } = selectionStats({
+            manifest,
+            environment: targetEnvironment,
+        });
+        if (skipped > 0) {
+            console.log(`[seq-studio] target ${targetEnvironment}: ${selected} of ${total} agents selected, ${skipped} scoped to other environments`);
+        }
+    }
+    // With a target: last-wins by id (tenant overrides). Without: every distinct
+    // path, so validate still compiles override sources that lose a collapse.
+    const entries = selectAgentEntries({
+        manifest,
+        environment: targetEnvironment,
+    });
+    return compileManifestEntries({
+        directory,
+        entries,
+        allowDuplicateIds: targetEnvironment === undefined,
+    });
+}

package/dist/artifact/delegate.d.ts

@@ -7,8 +7,8 @@
  *   1. Resolve `--env` from `~/.config/lattice/config.toml`.
  *   2. Set `ARTIFACT_STUDIO_BASE_URL` so artifact-studio's API client
  *      uses the resolved URL (instead of its own built-in env map).
- *   3. Set `ARTIFACT_STUDIO_TOKEN` from the seqapi token file so auth
- *      is shared with the rest of `seq-studio`.
+ *   3. Install an internal token provider so auth is shared with the rest of
+ *      `seq-studio` without exposing the bearer in argv or environment.
  *   4. Forward all remaining argv to `runCli`.
  */
 export declare function runArtifactCommand(sub: string | undefined, rest: string[]): Promise<number>;

package/dist/artifact/delegate.js

@@ -7,11 +7,11 @@
  *   1. Resolve `--env` from `~/.config/lattice/config.toml`.
  *   2. Set `ARTIFACT_STUDIO_BASE_URL` so artifact-studio's API client
  *      uses the resolved URL (instead of its own built-in env map).
- *   3. Set `ARTIFACT_STUDIO_TOKEN` from the seqapi token file so auth
- *      is shared with the rest of `seq-studio`.
+ *   3. Install an internal token provider so auth is shared with the rest of
+ *      `seq-studio` without exposing the bearer in argv or environment.
  *   4. Forward all remaining argv to `runCli`.
  */
-import { getAccessToken, M2mTokenError, tryGetAccessToken } from '../auth.js';
+import { getAccessTokenWithMode, M2mTokenError, tryGetAccessTokenWithMode, } from '../auth.js';
 import { readConfig, resolveEnvWithDiscovery } from '../config.js';
 import { fetchCatalog, readCachedCatalog } from '../env-catalog.js';
 import { normalizeShortEnvFlag, readEnvFromArgv } from '../env-flags.js';
@@ -36,11 +36,13 @@ const ARTIFACT_USAGE = `usage:
   discovered after you authenticate).
 
   Source for build/plan/deploy: a local [dir] (default), a platform git-service
-  repo (--repo <ns>/<name>), or any git URL (--git-url <url>). --ref selects a
+  repo (--repo <ns>/<name>), or a public HTTPS git URL (--git-url <url>). --ref selects a
   branch/tag/commit (default: the repo's default branch).
 
-  --repo clones over smart-HTTP and requires ATLAS_GIT_PAT (a repo:read PAT —
-  seq-studio auth pat create, or Atlas → Settings → Tokens).
+  Interactive --repo builds clone over smart-HTTP and require ATLAS_GIT_PAT
+  (a repo:read PAT — seq-studio auth pat create, or Atlas → Settings → Tokens).
+  Headless M2M builds use JSON materialize and accept only platform-managed
+  --repo sources.
 
   Per-PR preview environments (https://studio-atlas-git-<slug>.preview.seqholdings.com):
     -e preview:<branch-or-slug>   compute the preview host from a branch name
@@ -53,23 +55,20 @@ const ARTIFACT_USAGE = `usage:
   Authenticate with: seq-studio login
 `;
 export async function runArtifactCommand(sub, rest) {
+    if (rest.some((arg) => arg === '--token' || arg.startsWith('--token='))) {
+        console.error('seq-studio artifact does not accept bearer tokens via --token. ' +
+            'Use `seq-studio login` interactively or configure the realm-specific ' +
+            'AUTH0_M2M_CLIENT_SECRET for headless automation.');
+        return 1;
+    }
+    // Never pass a legacy bearer environment variable into the embedded package.
+    delete process.env['ARTIFACT_STUDIO_TOKEN'];
     // Older artifact-studio versions exposed nested login/logout commands backed
     // by a separate token file. Keep those commands working, but route them to
     // seq-studio's shared token so every namespace uses the same identity.
     if (sub === 'login' || sub === 'logout') {
         if (rest.length > 0) {
-            if (sub === 'login' && rest.includes('--token')) {
-                // The legacy `artifact login --token <jwt>` persisted a bearer to
-                // artifact-studio's own token file — a store this unification retires.
-                console.error('seq-studio artifact login no longer stores a bearer token.\n' +
-                    'Scripted/headless options:\n' +
-                    '  - pass --token <jwt> directly to the artifact command (deploy/plan/whoami/...)\n' +
-                    '  - export ARTIFACT_STUDIO_TOKEN=<jwt> for the session\n' +
-                    '  - set AUTH0_M2M_CLIENT_SECRET for service-account (M2M) auth in CI');
-            }
-            else {
-                console.error(`seq-studio artifact ${sub} does not accept arguments.`);
-            }
+            console.error(`seq-studio artifact ${sub} does not accept arguments.`);
             return 1;
         }
         const auth = await import('../login.js');
@@ -133,51 +132,22 @@ export async function runArtifactCommand(sub, rest) {
     // without an explicit --env flag — the stored `.artifact-studio/config.json`
     // defaultEnv, `artifact env set <name>` — would otherwise fall back to
     // artifact-studio's built-in local-only map and fail on deployed envs.
-    const { envs } = await readConfig();
-    process.env['ARTIFACT_STUDIO_ENV_URLS'] = JSON.stringify(Object.fromEntries(Object.entries(envs).map(([name, { url }]) => [name, url])));
-    // An explicit `--token <jwt>` is the manual escape hatch and must win over
-    // everything, including a configured-but-failing M2M credential (which
-    // `tryGetAccessToken({ failClosedForM2m: true })` would otherwise turn into
-    // an abort before argv ever reaches artifact-studio). artifact-studio's
-    // `getOptionalToken` checks `flags.token` first, so when it's present we
-    // skip shared-token resolution entirely. Only the two-token `--token <jwt>`
-    // form counts: artifact-studio's parser does not split `--token=<jwt>`.
-    const hasExplicitToken = hasTokenFlag(argvForCli);
+    const routingConfig = await readConfig();
+    process.env['ARTIFACT_STUDIO_ENV_URLS'] = JSON.stringify(Object.fromEntries(Object.entries(routingConfig.envs).map(([name, { url }]) => [name, url])));
     // Lazy import so `process` / `doctor` commands don't pull in
     // artifact-studio's vite/react/tailwind dependency graph.
-    const { runCli: runArtifactStudio, setTokenProvider } = await import('@sequenceholdings/artifact-studio/cli');
-    if (!hasExplicitToken) {
-        // Share the seqapi token. `tryGetAccessToken` resolves an M2M
-        // service-account token when AUTH0_M2M_CLIENT_SECRET is set (headless /
-        // CI / cloud-agent path) and otherwise the cached interactive user
-        // token (see ../auth.ts). If neither is available, artifact-studio
-        // commands that need a token surface their own error — we don't force
-        // `seq-studio login` here because some commands (init, validate, build)
-        // work offline.
-        const token = await tryGetAccessToken({ failClosedForM2m: true });
-        if (token) {
-            process.env['ARTIFACT_STUDIO_TOKEN'] = token;
-        }
-        // The ARTIFACT_STUDIO_TOKEN env var above is captured once and never
-        // refreshes, so long-running commands (notably `artifact dev`) would start
-        // failing with "Authentication failed" once the initial token's TTL
-        // elapses. Hand artifact-studio a refreshing source — getAccessToken()
-        // mints a fresh access token via the Auth0 refresh grant when the cached
-        // one is near expiry — so a watch session survives indefinitely.
-        setTokenProvider(async () => {
-            if (process.env.AUTH0_M2M_CLIENT_SECRET?.trim()) {
-                // Fail closed for configured M2M failures so headless deploys never
-                // silently fall back to another cached identity.
-                return await getAccessToken();
-            }
-            try {
-                return await getAccessToken();
-            }
-            catch {
-                return null;
-            }
-        });
-    }
+    const { getConfiguredDefaultEnv, runCli: runArtifactStudio, setTokenProvider } = await import('@sequenceholdings/artifact-studio/cli');
+    const authEnvName = resolved?.name ?? (await getConfiguredDefaultEnv());
+    const targetUrl = resolved?.url ??
+        process.env['ARTIFACT_STUDIO_BASE_URL']?.trim() ??
+        (authEnvName ? routingConfig.envs[authEnvName]?.url : undefined);
+    setTokenProvider(({ allowInteractiveLogin }) => allowInteractiveLogin
+        ? getAccessTokenWithMode({ env: authEnvName, targetUrl })
+        : tryGetAccessTokenWithMode({
+            failClosedForM2m: true,
+            env: authEnvName,
+            targetUrl,
+        }));
     return runArtifactStudio([sub, ...argvForCli]);
 }
 /**
@@ -240,18 +210,6 @@ export function extractPreviewFlags(argv) {
     }
     return { rest, prNumber, envUrl };
 }
-/**
- * True when argv carries an explicit two-token `--token <jwt>` that
- * artifact-studio's parser will bind to `flags.token`. `--token=<jwt>` is
- * excluded because that parser stores it as a stray flag and never binds it.
- */
-function hasTokenFlag(argv) {
-    const index = argv.indexOf('--token');
-    if (index === -1)
-        return false;
-    const value = argv[index + 1];
-    return value !== undefined && !value.startsWith('--');
-}
 function splitInlineValue(arg) {
     const eq = arg.indexOf('=');
     if (arg.startsWith('--') && eq !== -1)