callkaro-cli-unofficial 0.1.0

package/dist/lib/browserAuth.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.browserAuth = browserAuth;
+const child_process_1 = require("child_process");
+const api_1 = require("./api");
+const config_1 = require("./config");
+const ui_1 = require("./ui");
+const types_1 = require("./types");
+/** Open a URL in the user's default browser (no extra dependency). */
+function openBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['', url] : [url];
+    try {
+        (0, child_process_1.spawn)(cmd, args, { stdio: 'ignore', detached: true, shell: process.platform === 'win32' }).unref();
+    }
+    catch {
+        /* fall back to the printed link below */
+    }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Browser sign-in handshake — no password is ever typed into the terminal.
+ *
+ * We start a session, open the web app at /cli-login?code=…, then poll until the
+ * page approves it. The poll secret never leaves this process, so the visible
+ * code alone can't be used to grab the token.
+ *
+ * `mode` only changes where we land the user first: sign-in vs sign-up (the web
+ * page offers Google and email on both).
+ */
+async function browserAuth(mode = 'login') {
+    const { api } = (0, config_1.getClient)();
+    let session;
+    try {
+        session = await api.browserStart();
+    }
+    catch (err) {
+        (0, ui_1.fail)(err instanceof Error ? err.message : 'Could not start browser login');
+        return null;
+    }
+    // Always land on /cli-login — that page owns the routing (it sends the user to
+    // /login or /signup if needed and returns here), so there is exactly one entry
+    // URL and no redirect-param handling duplicated in the CLI.
+    const url = `${(0, config_1.webUrl)()}/cli-login?code=${encodeURIComponent(session.code)}` +
+        (mode === 'signup' ? '&mode=signup' : '');
+    (0, ui_1.info)('Opening your browser to finish signing in…');
+    (0, ui_1.info)(`If it doesn't open, paste this link:\n  ${url}\n`);
+    openBrowser(url);
+    const deadline = Date.now() + (session.expiresInSeconds || 600) * 1000;
+    (0, ui_1.info)('Waiting for you to complete sign-in in the browser… (Ctrl+C to cancel)');
+    let transientFailures = 0;
+    while (Date.now() < deadline) {
+        await sleep(2000);
+        try {
+            const res = await api.browserPoll(session.code, session.pollSecret);
+            if (res.status === 'approved') {
+                // Stored under its own email only — never merged into the active
+                // account. No email, no save: a token filed under the wrong account
+                // would silently replace that account's session.
+                let user = res.user;
+                if (!user?.email && res.token) {
+                    try {
+                        const me = await new api_1.Api((0, config_1.backendUrl)(), (0, config_1.callUrl)(), res.token).me();
+                        user = me?.user || me;
+                    }
+                    catch {
+                        /* reported below */
+                    }
+                }
+                if (!res.token || !user?.email) {
+                    (0, ui_1.fail)('Sign-in was approved but the server did not return the account email, so nothing was saved. Run the command again.');
+                    return null;
+                }
+                (0, ui_1.success)((0, config_1.saveLogin)(user.email, { token: res.token, user }));
+                return user;
+            }
+            transientFailures = 0; // a clean "pending" clears the streak
+        }
+        catch (err) {
+            const status = err instanceof types_1.ApiError ? err.status : -1;
+            // A dropped connection or a server hiccup shouldn't end a sign-in the user
+            // is still completing — keep polling. Only definitive answers are fatal:
+            // 404 expired, 403 wrong secret, 400 already used.
+            const transient = status === 0 || status >= 500;
+            if (transient && ++transientFailures < 10)
+                continue;
+            (0, ui_1.fail)(err instanceof Error ? err.message : 'Browser login failed');
+            return null;
+        }
+    }
+    (0, ui_1.fail)('Timed out waiting for sign-in. Run the command again.');
+    return null;
+}

package/dist/lib/catalog.js

@@ -0,0 +1,136 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LLM_MODELS = exports.MURF_STYLES = exports.TRANSCRIBER_PROVIDERS = exports.VOICE_PROVIDERS = void 0;
+exports.applyLiveCatalog = applyLiveCatalog;
+exports.findVoiceProvider = findVoiceProvider;
+exports.findTranscriberProvider = findTranscriberProvider;
+exports.langMatches = langMatches;
+exports.visibleVoiceProviders = visibleVoiceProviders;
+exports.visibleTranscriberProviders = visibleTranscriberProviders;
+const catalog_json_1 = __importDefault(require("../data/catalog.json"));
+const hydrate = (p) => ({
+    name: p.name,
+    models: (p.models || []).map((m) => ({ name: m.name, languages: m.languages || [] })),
+    voiceSource: p.voiceSource === 'api' ? 'api' : p.voiceSource === 'static' ? 'static' : null,
+    languageKind: p.languageKind === 'array' ? 'array' : p.languageKind === 'string' ? 'string' : null,
+    languages: p.languages || [],
+    fields: p.fields || [],
+    gate: p.gate === 'admin' ? 'admin' : null,
+    notes: p.notes || null,
+    voices: p.voices || [],
+});
+const raw = catalog_json_1.default;
+exports.VOICE_PROVIDERS = raw.voice.map(hydrate);
+exports.TRANSCRIBER_PROVIDERS = raw.transcriber.map(hydrate);
+exports.MURF_STYLES = raw.murfStyles;
+/**
+ * Per-slot LLM model lists (`agent`, `post-call`, ...), keyed by slot name.
+ *
+ * These are scoped, not flat: `post-call` excludes `gpt-4o` and `o4-mini` while
+ * `agent` includes both, so a single list validates one field wrongly or the
+ * other. Kept beside the provider tables so `npm run catalog:check` compares all
+ * three against the server rather than leaving LLM models to a hand-written list.
+ */
+exports.LLM_MODELS = raw.llmModels || {};
+const norm = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, '');
+/** Live model entries arrive as plain strings; be tolerant of `{name}` too. */
+const modelName = (m) => typeof m === 'string' ? m : String(m?.name ?? m?.model ?? m?.id ?? '');
+/**
+ * Overlay the server's own model lists onto the built-in providers, in place.
+ *
+ * Mutating rather than reassigning matters: `agentUpdate.ts` and the voice and
+ * transcriber commands hold references to these exact Provider objects, so
+ * replacing the arrays would leave them validating against the stale copy.
+ *
+ * Only `models` is taken from the live payload. Everything else the CLI needs —
+ * `fields`, `gate`, `languageKind`, static `voices` — exists only in the bundle,
+ * so a provider present in both keeps that metadata and gains the live models.
+ *
+ * A provider the server no longer lists (Groq) is left in place but flagged, so
+ * `cku voices` can say it is not currently served rather than silently offering
+ * a dead choice.
+ */
+function applyLiveCatalog(catalogs) {
+    const summary = { voices: 0, transcribers: 0 };
+    const overlay = (targets, live) => {
+        if (!Array.isArray(live) || !live.length)
+            return; // leave this list entirely alone
+        const byName = new Map(targets.map((p) => [norm(p.name), p]));
+        for (const entry of live) {
+            const name = String(entry?.provider ?? '');
+            if (!name)
+                continue;
+            const provider = byName.get(norm(name));
+            if (!provider)
+                continue; // a provider the bundle never saw; do not invent metadata
+            const models = (Array.isArray(entry.models) ? entry.models : [])
+                .map(modelName)
+                .filter(Boolean)
+                .map((n) => ({ name: n, languages: provider.models.find((m) => norm(m.name) === norm(n))?.languages || [] }));
+            // Keep the live list even when empty: Azure and Open AI legitimately have
+            // no selectable models, and falling back would resurrect withdrawn ones.
+            provider.models = models;
+            provider.servedBy = true;
+        }
+        // Anything not named in a list we actually received is no longer served.
+        // Runs here rather than at the end for both lists, so a call that omits one
+        // of them leaves that one untouched instead of flagging everything in it.
+        for (const p of targets) {
+            if (p.servedBy === undefined)
+                p.servedBy = false;
+        }
+    };
+    overlay(exports.VOICE_PROVIDERS, catalogs?.ttsProviders);
+    overlay(exports.TRANSCRIBER_PROVIDERS, catalogs?.sttProviders);
+    summary.voices = exports.VOICE_PROVIDERS.filter((p) => p.servedBy === true).length;
+    summary.transcribers = exports.TRANSCRIBER_PROVIDERS.filter((p) => p.servedBy === true).length;
+    return summary;
+}
+/**
+ * Case- and punctuation-insensitive lookup, so "elevenlabs", "Eleven Labs" and
+ * "eleven-labs" all resolve. Providers store the canonical spelling.
+ */
+function findVoiceProvider(name) {
+    const n = norm(name);
+    return exports.VOICE_PROVIDERS.find((p) => norm(p.name) === n);
+}
+function findTranscriberProvider(name) {
+    const n = norm(name);
+    return exports.TRANSCRIBER_PROVIDERS.find((p) => norm(p.name) === n);
+}
+/**
+ * Language match. Provider tables mix bare codes ('hi') and locales ('hi-IN'),
+ * so accept either direction: they agree, or one is the other's base code.
+ */
+function langMatches(query, providerLangs) {
+    const q = norm(query);
+    if (!q)
+        return true;
+    return providerLangs.some((lang) => {
+        const l = norm(lang);
+        return l === q || l.split('-')[0] === q || q.split('-')[0] === l.split('-')[0];
+    });
+}
+/**
+ * Providers visible for an account. `opts.all` includes admin-gated ones;
+ * otherwise they are hidden unless the account is authorized for them.
+ */
+function visibleVoiceProviders(opts = {}) {
+    if (opts.allowed && opts.allowed.length) {
+        return exports.VOICE_PROVIDERS.filter((p) => opts.allowed.some((a) => norm(a) === norm(p.name)));
+    }
+    if (opts.all)
+        return exports.VOICE_PROVIDERS;
+    return exports.VOICE_PROVIDERS.filter((p) => p.gate !== 'admin');
+}
+function visibleTranscriberProviders(opts = {}) {
+    if (opts.allowed && opts.allowed.length) {
+        return exports.TRANSCRIBER_PROVIDERS.filter((p) => opts.allowed.some((a) => norm(a) === norm(p.name)));
+    }
+    if (opts.all)
+        return exports.TRANSCRIBER_PROVIDERS;
+    return exports.TRANSCRIBER_PROVIDERS.filter((p) => p.gate !== 'admin');
+}

package/dist/lib/config.js

@@ -0,0 +1,354 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accountsDir = exports.OFFICIAL_SKILLS_REPO = exports.configPath = exports.CONFIG_DIR = void 0;
+exports.backendUrl = backendUrl;
+exports.callUrl = callUrl;
+exports.webUrl = webUrl;
+exports.skillsRepo = skillsRepo;
+exports.skillsRepoFor = skillsRepoFor;
+exports.skillsBranch = skillsBranch;
+exports.slugFor = slugFor;
+exports.activeAccount = activeAccount;
+exports.projectAccount = projectAccount;
+exports.setActiveAccount = setActiveAccount;
+exports.clearActiveAccount = clearActiveAccount;
+exports.bindProjectAccount = bindProjectAccount;
+exports.unbindProjectAccount = unbindProjectAccount;
+exports.accountSource = accountSource;
+exports.listAccounts = listAccounts;
+exports.loadAccount = loadAccount;
+exports.saveAccount = saveAccount;
+exports.saveDashboardSession = saveDashboardSession;
+exports.clearDashboardSession = clearDashboardSession;
+exports.removeAccount = removeAccount;
+exports.loadConfig = loadConfig;
+exports.clearSession = clearSession;
+exports.saveLogin = saveLogin;
+exports.getClient = getClient;
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const api_1 = require("./api");
+const endpoints_json_1 = __importDefault(require("../endpoints.json"));
+// Endpoints live in a committed, shipped file (NOT .env) — the platform's
+// packaging doesn't allow .env. Edit endpoints.json to change where the CLI
+// points: `backendUrl` for everything, `callUrl` for placing calls (the call
+// cloud may move independently later).
+//
+// The config dir is `callkaro-unofficial`, not `callkaro`, so this fork and
+// @callkaro-official/cli keep separate sessions. Sharing one file means the
+// last `ck` or `cku login` overwrites the other's token, and `ck logout` would
+// clear the fork's session too.
+//
+// CK_CONFIG_DIR relocates the whole thing, which is what the tests use to stay
+// out of the real ~/.config. It is read once at load: changing it mid-process
+// would leave `accountsDir` and `activePath` pointing at the old location.
+exports.CONFIG_DIR = process.env.CK_CONFIG_DIR || (0, path_1.join)((0, os_1.homedir)(), '.config', 'callkaro-unofficial');
+exports.configPath = (0, path_1.join)(exports.CONFIG_DIR, 'config.json');
+const trim = (u) => (u || '').replace(/\/+$/, '');
+/** Base URL for all backend operations (from endpoints.json). */
+function backendUrl() {
+    return trim(process.env.CK_BACKEND_URL || endpoints_json_1.default.backendUrl);
+}
+/** Base URL used to place calls — the "call cloud" (from endpoints.json). */
+function callUrl() {
+    return trim(endpoints_json_1.default.callUrl || endpoints_json_1.default.backendUrl);
+}
+/** Web app URL — where the browser is sent for sign-in (from endpoints.json). */
+function webUrl() {
+    return trim(endpoints_json_1.default.webUrl || endpoints_json_1.default.backendUrl);
+}
+/** GitHub repo holding this fork's skill pack — skills ship separately from the CLI. */
+function skillsRepo() {
+    return endpoints_json_1.default.skillsRepo || 'TejasLamba2006/callkaro-skills';
+}
+/** The upstream pack, for `cku skills install --official`. */
+exports.OFFICIAL_SKILLS_REPO = 'Mail-Daddy-AI/callkaro-skills';
+/** Which pack to fetch. `official` opts into upstream; default is this fork's. */
+function skillsRepoFor(official) {
+    return official ? exports.OFFICIAL_SKILLS_REPO : skillsRepo();
+}
+function skillsBranch() {
+    return endpoints_json_1.default.skillsBranch || 'main';
+}
+// ---------------------------------------------------------------------------
+// Multi-account
+// ---------------------------------------------------------------------------
+//
+// One file per account, so signing into a second account never disturbs the
+// first. The *selected* account is the only mutable state, and it lives in
+// `active.json` — a pointer, not a credential. Losing that file downgrades to
+// the single-account behaviour rather than losing sessions.
+//
+//   ~/.config/callkaro-unofficial/
+//     accounts/
+//       <slug>.json      one session each
+//     active.json         { "account": "<slug>" }
+//
+// A slug is the email with non-alphanumerics collapsed to '-', so
+// tejas@acme.com -> tejas-acme-com. The local part alone is not unique enough.
+exports.accountsDir = (0, path_1.join)(exports.CONFIG_DIR, 'accounts');
+const activePath = (0, path_1.join)(exports.CONFIG_DIR, 'active.json');
+/** Per-project binding file. Checked into git on purpose — a shared repo then
+ *  gives every clone the same account, without anyone running a setup step. */
+const PROJECT_CONFIG = '.cku.json';
+/** Filesystem-safe slug for an email address. */
+function slugFor(email) {
+    const slug = email.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+    return slug || 'account';
+}
+function readJson(path, fallback) {
+    if (!(0, fs_1.existsSync)(path))
+        return fallback;
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+function writeJson(path, value) {
+    (0, fs_1.mkdirSync)((0, path_1.join)(path, '..'), { recursive: true });
+    (0, fs_1.writeFileSync)(path, JSON.stringify(value, null, 2), { mode: 0o600 });
+    try {
+        (0, fs_1.chmodSync)(path, 0o600);
+    }
+    catch {
+        /* best effort on platforms without POSIX perms */
+    }
+}
+/**
+ * The account a command acts on. Resolution order:
+ *   1. CK_ACCOUNT env var — explicit, per-invocation
+ *   2. .cku.json in the current directory (or the nearest parent) — per-project
+ *   3. the global pointer in active.json
+ *   4. undefined — no session
+ *
+ * Step 2 is what makes parallel agents safe. Two agents working in two folders
+ * bound to two accounts each resolve their own binding, so neither can change
+ * what the other sees. The global pointer is only a fallback for when no
+ * project is bound, and it is the one thing two agents must not fight over —
+ * prefer `cku accounts bind` over `cku accounts use` for agent work.
+ *
+ * Callers should treat `undefined` as "no session" and say so, rather than
+ * assuming a single default account exists.
+ */
+function activeAccount() {
+    const override = process.env.CK_ACCOUNT;
+    if (override)
+        return slugFor(override);
+    return projectAccount() || globalAccount();
+}
+/** The account bound to the current directory, searching upwards for .cku.json. */
+function projectAccount() {
+    let dir = process.cwd();
+    // Stop at the filesystem root; also stop early if we hit the user's home, so
+    // a stray ~/.cku.json can't silently capture every project.
+    const stop = (0, os_1.homedir)();
+    for (;;) {
+        const candidate = (0, path_1.join)(dir, PROJECT_CONFIG);
+        if ((0, fs_1.existsSync)(candidate)) {
+            const { account } = readJson(candidate, {});
+            if (account)
+                return account;
+        }
+        if (dir === stop)
+            return undefined;
+        const parent = (0, path_1.dirname)(dir);
+        if (parent === dir)
+            return undefined; // reached the root
+        dir = parent;
+    }
+}
+/** Only the global pointer (active.json), ignoring CK_ACCOUNT and .cku.json. */
+function globalAccount() {
+    const { account } = readJson(activePath, {});
+    return account || undefined;
+}
+function setActiveAccount(email) {
+    const slug = slugFor(email);
+    writeJson(activePath, { account: slug });
+    return slug;
+}
+function clearActiveAccount() {
+    if ((0, fs_1.existsSync)(activePath))
+        writeJson(activePath, {});
+}
+/**
+ * Bind an account to the current directory only. Writes `.cku.json` here, so
+ * this folder — and anything under it — uses that account regardless of what
+ * the global pointer says.
+ */
+function bindProjectAccount(email, cwd = process.cwd()) {
+    const slug = slugFor(email);
+    writeJson((0, path_1.join)(cwd, PROJECT_CONFIG), { account: slug });
+    return slug;
+}
+/** Remove this directory's binding, falling back to the global pointer. */
+function unbindProjectAccount(cwd = process.cwd()) {
+    const path = (0, path_1.join)(cwd, PROJECT_CONFIG);
+    if (!(0, fs_1.existsSync)(path))
+        return false;
+    try {
+        (0, fs_1.unlinkSync)(path);
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+/** Where the current directory's binding came from — for `accounts status`. */
+function accountSource() {
+    if (process.env.CK_ACCOUNT)
+        return 'env';
+    if (projectAccount())
+        return 'project';
+    if (globalAccount())
+        return 'global';
+    return 'none';
+}
+/** Every stored account, newest first — signed-out ones included (no `token`),
+ *  so `logout` doesn't make an account vanish from `use`/`bind`/`remove`. */
+function listAccounts() {
+    if (!(0, fs_1.existsSync)(exports.accountsDir))
+        return [];
+    return (0, fs_1.readdirSync)(exports.accountsDir)
+        .filter((f) => f.endsWith('.json'))
+        .map((f) => readJson((0, path_1.join)(exports.accountsDir, f), {}))
+        .filter((a) => Boolean(a.email))
+        .sort((a, b) => String(b.savedAt || '').localeCompare(String(a.savedAt || '')));
+}
+function accountPath(slug) {
+    return (0, path_1.join)(exports.accountsDir, `${slug}.json`);
+}
+function loadAccount(slug) {
+    if (!slug)
+        return {};
+    return readJson(accountPath(slug), {});
+}
+/** Store a session for `email` and make it the active account. */
+function saveAccount(email, session) {
+    const slug = slugFor(email);
+    // Carry the dashboard session across. `saveLogin` passes only { token, user },
+    // so without this a later `cku login` would silently drop a dashboard session
+    // the account already holds.
+    const dashboard = session.dashboard ?? loadAccount(slug).dashboard;
+    writeJson(accountPath(slug), { ...session, email, savedAt: new Date().toISOString(), ...(dashboard ? { dashboard } : {}) });
+    setActiveAccount(email);
+    return slug;
+}
+/**
+ * Store the dashboard session on an account, keeping whatever else it holds.
+ * Merging matters: signing in to the dashboard must not disturb a `ck_` token
+ * already on that account, and adding a `ck_` token must not drop the
+ * dashboard session.
+ */
+function saveDashboardSession(email, dashboard) {
+    const slug = slugFor(email);
+    const current = loadAccount(slug);
+    // Built field by field rather than spread. A caller that accidentally passes a
+    // password (or anything else) must not have it written to disk — the guarantee
+    // that no password is ever persisted has to hold here, not at the call site.
+    const stored = {
+        email: dashboard.email || email,
+        token: dashboard.token,
+        savedAt: dashboard.savedAt || new Date().toISOString(),
+        ...(dashboard.sessionToken ? { sessionToken: dashboard.sessionToken } : {}),
+        ...(dashboard.userId ? { userId: dashboard.userId } : {}),
+        ...(dashboard.expiresAt ? { expiresAt: dashboard.expiresAt } : {}),
+    };
+    writeJson(accountPath(slug), { ...current, email, dashboard: stored, savedAt: new Date().toISOString() });
+    return slug;
+}
+/** Forget only the dashboard session; the `ck_` token is left alone. */
+function clearDashboardSession(email) {
+    const slug = slugFor(email);
+    const current = loadAccount(slug);
+    if (!current.dashboard)
+        return false;
+    const { dashboard, ...rest } = current;
+    writeJson(accountPath(slug), rest);
+    return true;
+}
+function removeAccount(slug) {
+    const path = accountPath(slug);
+    if (!(0, fs_1.existsSync)(path))
+        return false;
+    // Unlink rather than write an empty file: a tokenless account would still
+    // show up in the account list.
+    try {
+        (0, fs_1.unlinkSync)(path);
+    }
+    catch {
+        return false;
+    }
+    // The global pointer only: activeAccount() may be this folder's binding, and
+    // clearing on that would wipe an unrelated default (or miss a dangling one).
+    if (globalAccount() === slug)
+        clearActiveAccount();
+    return true;
+}
+// ---------------------------------------------------------------------------
+// Session resolution
+// ---------------------------------------------------------------------------
+/**
+ * The session in effect: CK_TOKEN wins outright (automation), otherwise the
+ * active account's stored token.
+ */
+function loadConfig() {
+    const envToken = process.env.CK_TOKEN;
+    if (envToken)
+        return { token: envToken };
+    return loadAccount(activeAccount());
+}
+/**
+ * Drop the effective account's token (and identity), keeping the account slot
+ * so it stays listed as signed out. Returns that account's email, if any.
+ *
+ * Under CK_TOKEN no stored account is in effect, so none is touched — clearing
+ * whichever one happens to be active would sign out an unrelated session.
+ */
+function clearSession() {
+    if (process.env.CK_TOKEN)
+        return undefined;
+    const slug = activeAccount();
+    if (!slug)
+        return undefined;
+    const path = accountPath(slug);
+    if (!(0, fs_1.existsSync)(path))
+        return undefined;
+    const { email, savedAt, dashboard } = loadAccount(slug);
+    // Dropping the ck_ token is what logout means. A dashboard session is a
+    // separate credential and is left in place — `cku firebase logout` removes it.
+    writeJson(path, { email, savedAt, ...(dashboard ? { dashboard } : {}) });
+    return email;
+}
+/**
+ * Store a fresh sign-in as its own account and return the line to print. Every
+ * login path goes through here: it saves ONLY the new session (never merging
+ * the active account's fields), and says honestly which account is in effect —
+ * saveAccount moves the global pointer, but CK_TOKEN, CK_ACCOUNT or a bound
+ * folder still win over it.
+ */
+function saveLogin(email, session) {
+    const slug = saveAccount(email, session);
+    const saved = `Signed in as ${email} — saved and set as the global default.\n`;
+    if (process.env.CK_TOKEN) {
+        return saved + '  CK_TOKEN is set and overrides every stored account; unset it to use this one.';
+    }
+    const effective = activeAccount();
+    if (effective === slug)
+        return `Signed in as ${email}. This is now the active account.`;
+    const current = loadAccount(effective).email || effective;
+    return accountSource() === 'env'
+        ? saved + `  This shell still uses ${current} via CK_ACCOUNT. Unset it, or set CK_ACCOUNT=${email}, to switch.`
+        : saved + `  This folder still uses ${current} via .cku.json. Run \`cku accounts bind ${email}\` to switch.`;
+}
+/** Build the API client from the endpoint URLs + resolved token. */
+function getClient() {
+    const cfg = loadConfig();
+    return { api: new api_1.Api(backendUrl(), callUrl(), cfg.token), cfg };
+}