@aisa-one/cli 0.3.0 → 0.5.1

package/dist/utils/install-method.js

@@ -0,0 +1,48 @@
+import { fileURLToPath } from "node:url";
+const PACKAGE = "@aisa-one/cli";
+/**
+ * Read the verdict off a path.
+ *
+ * Separate from the caller so it can be tested against the shapes each
+ * manager produces without installing five package managers.
+ */
+export function classifyPath(p) {
+    const s = p.replace(/\\/g, "/");
+    // npx first: its cache sits under the npm cache directory, so a test for
+    // node_modules alone would call it an npm install.
+    if (/\/_npx\//.test(s))
+        return "npx";
+    if (/\/\.bun\//.test(s))
+        return "bun";
+    // pnpm's global root, and its content-addressed store — a global install
+    // links into node_modules/.pnpm rather than copying.
+    if (/\/pnpm\/|\/\.pnpm\//.test(s))
+        return "pnpm";
+    if (/\/\.yarn\/|\/yarn\/(global|link)\//.test(s))
+        return "yarn";
+    // Anything still inside a node_modules for this package is a plain install;
+    // outside one, it is a checkout being run from its own dist.
+    if (s.includes(`/node_modules/${PACKAGE}/`))
+        return "npm";
+    if (/\/node_modules\//.test(s))
+        return "npm";
+    return "source";
+}
+const COMMAND = {
+    npm: `npm install -g ${PACKAGE}@latest`,
+    pnpm: `pnpm add -g ${PACKAGE}@latest`,
+    bun: `bun add -g ${PACKAGE}@latest`,
+    yarn: `yarn global add ${PACKAGE}@latest`,
+};
+/** Where this process is running from, and what would update it. */
+export function detectInstall(from = import.meta.url) {
+    let path;
+    try {
+        path = fileURLToPath(from);
+    }
+    catch {
+        path = from;
+    }
+    const kind = classifyPath(path);
+    return { kind, path, command: COMMAND[kind] };
+}

package/dist/utils/journal.d.ts

@@ -0,0 +1,57 @@
+export type Mark = "step" | "ok" | "warn" | "fail" | "info" | "write" | "cmd" | "choice";
+export declare class Journal {
+    private readonly quiet;
+    private file;
+    constructor(quiet?: boolean);
+    /** Keep the newest few runs; a config log is small but not eternal. */
+    private prune;
+    get path(): string | null;
+    /** A section heading — the phases of a run, in the order they happen. */
+    section(title: string): void;
+    line(mark: Mark, text: string, detail?: string): void;
+    /** An indented continuation under the previous line. */
+    note(text: string): void;
+    /**
+     * Detail belonging to the line above it, on screen and in the log.
+     *
+     * Deeper than note(): a note continues its line at the same level, while
+     * this is subordinate to it — a client's own output, quoted under our
+     * summary of what it did. Level with the parent's text it read as the next
+     * item in the list, which is exactly how an inherited stdout looked before
+     * it was captured.
+     */
+    sub(text: string): void;
+    /** A command the user can copy and run later. */
+    command(cmd: string, why?: string): void;
+    /**
+     * A ruled line on its own, for a moment that deserves separating from
+     * whatever an agent session just left on the screen.
+     */
+    rule(): void;
+    /**
+     * The last thing a run says. Everything above is what happened; these are
+     * the commands worth remembering, so they get a rule above them, an arrow
+     * each and the brightest ink on the screen — a reader who scrolled away
+     * and came back should land on them. One entry is the common case; a
+     * fresh install or a new wrapper command earns a second line above the
+     * standing "run this again" one, most useful first.
+       *
+     * A blank line closes it, so the shell prompt that follows is not stuck to
+     * the last thing we asked the reader to remember.
+     */
+    encore(items: Array<{
+        cmd: string;
+        why: string;
+    }>): void;
+    /**
+     * Log-only: detail worth having in a bug report, noise in a terminal.
+     *
+     * Indented past the line above rather than level with it. At three spaces
+     * it started in the same column as its parent's text, which reads as the
+     * next item in a list rather than as detail belonging to the one before —
+     * and once it is properly indented the bullet has nothing left to do.
+     */
+    record(text: string): void;
+    private emit;
+    private write;
+}

package/dist/utils/journal.js

@@ -0,0 +1,188 @@
+import { appendFileSync, mkdirSync, readdirSync, statSync, unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import chalk from "chalk";
+import { cells } from "./width.js";
+/**
+ * The console transcript of a connect run, and its log file.
+ *
+ * Two audiences, one stream. In the terminal a user should be able to read
+ * back what they chose in the browser, what was checked, what was written
+ * where, and which commands they now have — the page is transient, the
+ * scrollback is not, and someone who reads it has learned how to do the same
+ * thing by hand next time. On disk the same lines (without colour) go to
+ * ~/.aisa/logs/connect-<stamp>.log, so a user hitting trouble can send one
+ * file that says exactly what happened. Configuration runs are rare, so the
+ * logs stay small; the last few are kept and older ones dropped.
+ */
+const KEEP_LOGS = 20;
+/**
+ * One column of structure on the left, one glyph of outcome on the right.
+ *
+ * Every reporting line used to open with its own status emoji — ✅ ⚠️ ❌ ℹ️ —
+ * four different shapes in the first column, which is the column the eye uses
+ * to find the shape of the section. The result was that the *structure* was
+ * unreadable: you could not see at a glance that five lines are one list,
+ * because no two of them started the same way.
+ *
+ * So the left column says "here is a line" and nothing else, and the outcome
+ * moves to the end where it belongs — you read what happened, then whether it
+ * worked. Lines with no outcome to report simply end.
+ *
+ * A plain bullet, the same one "What you chose" already used. An arrow was
+ * tried here first and read as clutter: it points, and there is nothing for
+ * it to point at when every line in the log starts with one.
+ *
+ * `step` keeps its own mark: a heading is not a result, and giving it the
+ * same opener would say it was.
+ *
+ * Every icon is padded to two columns. ✅ was two wide and ▸ was one, so the
+ * text in a section of headings started one column left of the text in a
+ * section of results — a misalignment nobody could name but everybody saw.
+ *
+ * And every one carries the section indent. A heading at the left margin
+ * with its lines also at the left margin is not a section, it is a run of
+ * text with a bolder line every so often; four spaces is what makes the
+ * heading own what follows it. Everything else here indents from the same
+ * step, so a note sits under its line and a captured transcript sits under
+ * that.
+ */
+const MARKS = {
+    step: { icon: "    ▸", paint: (s) => chalk.bold(s) },
+    ok: { icon: "    •", paint: (s) => s, tail: chalk.green("✓"), tailPlain: "✓" },
+    warn: { icon: "    •", paint: (s) => chalk.yellow(s), tail: chalk.yellow("⚠"), tailPlain: "⚠" },
+    fail: { icon: "    •", paint: (s) => chalk.red(s), tail: chalk.red("✗"), tailPlain: "✗" },
+    info: { icon: "    •", paint: (s) => s },
+    // No tail: the whole "What changed on this machine" section is things that
+    // happened, and a tick on every line of it would say once per line what the
+    // heading already said.
+    write: { icon: "    •", paint: (s) => s },
+    cmd: { icon: "    ⌨️", paint: (s) => s },
+    choice: { icon: "    •", paint: (s) => s },
+};
+export class Journal {
+    quiet;
+    file = null;
+    constructor(quiet = false) {
+        this.quiet = quiet;
+        try {
+            const dir = join(homedir(), ".aisa", "logs");
+            mkdirSync(dir, { recursive: true });
+            // Local time in the name, like the lines inside: a user reading the
+            // directory should recognise "the run I did after lunch".
+            const d = new Date();
+            const two = (n) => String(n).padStart(2, "0");
+            const stamp = `${d.getFullYear()}${two(d.getMonth() + 1)}${two(d.getDate())}` +
+                `-${two(d.getHours())}${two(d.getMinutes())}${two(d.getSeconds())}`;
+            this.file = join(dir, `connect-${stamp}.log`);
+            this.prune(dir);
+        }
+        catch {
+            this.file = null; // a log we cannot write is a feature we do not get
+        }
+    }
+    /** Keep the newest few runs; a config log is small but not eternal. */
+    prune(dir) {
+        try {
+            const logs = readdirSync(dir)
+                .filter((f) => f.startsWith("connect-") && f.endsWith(".log"))
+                .map((f) => ({ f, t: statSync(join(dir, f)).mtimeMs }))
+                .sort((a, b) => b.t - a.t);
+            for (const old of logs.slice(KEEP_LOGS))
+                unlinkSync(join(dir, old.f));
+        }
+        catch {
+            /* pruning is a courtesy */
+        }
+    }
+    get path() {
+        return this.file;
+    }
+    /** A section heading — the phases of a run, in the order they happen. */
+    section(title) {
+        this.emit("", `\n${chalk.bold.underline(title)}`, `\n== ${title}`);
+    }
+    line(mark, text, detail) {
+        const m = MARKS[mark];
+        const plain = (detail ? `${text} — ${detail}` : text) + (m.tailPlain ? ` ${m.tailPlain}` : "");
+        this.emit(m.icon, `${m.icon} ${m.paint(text)}${detail ? chalk.gray(` — ${detail}`) : ""}${m.tail ? ` ${m.tail}` : ""}`, `${m.icon} ${plain}`);
+    }
+    /** An indented continuation under the previous line. */
+    note(text) {
+        this.emit("", chalk.gray(`       ${text}`), `       ${text}`);
+    }
+    /**
+     * Detail belonging to the line above it, on screen and in the log.
+     *
+     * Deeper than note(): a note continues its line at the same level, while
+     * this is subordinate to it — a client's own output, quoted under our
+     * summary of what it did. Level with the parent's text it read as the next
+     * item in the list, which is exactly how an inherited stdout looked before
+     * it was captured.
+     */
+    sub(text) {
+        this.emit("", chalk.gray(`          ${text}`), `          ${text}`);
+    }
+    /** A command the user can copy and run later. */
+    command(cmd, why) {
+        this.emit("", `    ${chalk.cyan(cmd)}${why ? chalk.gray(`   ${why}`) : ""}`, `    $ ${cmd}${why ? `   # ${why}` : ""}`);
+    }
+    /**
+     * A ruled line on its own, for a moment that deserves separating from
+     * whatever an agent session just left on the screen.
+     */
+    rule() {
+        const line = "\u2500".repeat(70);
+        this.emit("", `\n${chalk.gray(line)}`, `\n${line}`);
+    }
+    /**
+     * The last thing a run says. Everything above is what happened; these are
+     * the commands worth remembering, so they get a rule above them, an arrow
+     * each and the brightest ink on the screen — a reader who scrolled away
+     * and came back should land on them. One entry is the common case; a
+     * fresh install or a new wrapper command earns a second line above the
+     * standing "run this again" one, most useful first.
+       *
+     * A blank line closes it, so the shell prompt that follows is not stuck to
+     * the last thing we asked the reader to remember.
+     */
+    encore(items) {
+        // Columns, not characters: the rule under these lines has to be as long
+        // as the longest of them, and a Chinese `why` is twice the width its
+        // length claims.
+        const width = Math.min(70, Math.max(...items.map((i) => cells(i.cmd) + cells(i.why) + 8)));
+        const rule = "─".repeat(width);
+        this.emit("", `\n${chalk.gray(rule)}`, `\n${rule}`);
+        for (const { cmd, why } of items) {
+            this.emit("👉", `👉 ${chalk.bold.cyan(cmd)}  ${chalk.bold(why)}`, `👉 ${cmd}  ${why}`);
+        }
+        this.emit("", "", "");
+    }
+    /**
+     * Log-only: detail worth having in a bug report, noise in a terminal.
+     *
+     * Indented past the line above rather than level with it. At three spaces
+     * it started in the same column as its parent's text, which reads as the
+     * next item in a list rather than as detail belonging to the one before —
+     * and once it is properly indented the bullet has nothing left to do.
+     */
+    record(text) {
+        this.write(`          ${text}`);
+    }
+    emit(_icon, pretty, plain) {
+        if (!this.quiet)
+            console.log(pretty);
+        this.write(plain);
+    }
+    write(plain) {
+        if (!this.file)
+            return;
+        try {
+            const t = new Date().toTimeString().slice(0, 8);
+            appendFileSync(this.file, `${t} ${plain}\n`, "utf-8");
+        }
+        catch {
+            this.file = null;
+        }
+    }
+}

package/dist/utils/key-check.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Does the stored key still work?
+ *
+ * `connect` used to ask only whether a key existed, and a key that exists is
+ * not a key that works: one revoked from the console, or belonging to an
+ * account that was deleted, sits in ~/.aisa/key looking exactly like a good
+ * one. The run then skipped the sign-in step, wrote that dead key into every
+ * MCP entry and into the agent's provider settings, and the first thing the
+ * user saw was their agent failing to authenticate — long after the setup had
+ * declared itself finished.
+ *
+ * Three answers, not two. "Cannot tell" has to be its own verdict: a laptop
+ * on a flaky connection must not be told its key is bad and pushed through a
+ * sign-in it does not need. The retries that separate the two are already in
+ * httpFetch — an idempotent GET is attempted three times with backoff, and
+ * 401/403 are deliberately not retryable because a rejected key does not
+ * become accepted on the second ask.
+ */
+export type KeyVerdict = "ok" | "invalid" | "unreachable";
+export declare function verifyKey(key: string | undefined): Promise<KeyVerdict>;

package/dist/utils/key-check.js

@@ -0,0 +1,24 @@
+import { apiRequestRaw } from "../api.js";
+/** Small: this runs while the user is watching, not in the background. */
+const TIMEOUT_MS = 8_000;
+export async function verifyKey(key) {
+    if (!key)
+        return "invalid";
+    try {
+        const res = await apiRequestRaw(key, "credits/balance", {
+            idempotent: true,
+            timeoutMs: TIMEOUT_MS,
+        });
+        if (res.ok)
+            return "ok";
+        // The gateway rejected the credential itself. Nothing about the network
+        // would change this answer.
+        if (res.status === 401 || res.status === 403)
+            return "invalid";
+        return "unreachable";
+    }
+    catch {
+        // Every attempt failed at the network level. The key may well be fine.
+        return "unreachable";
+    }
+}

package/dist/utils/update-check.d.ts

@@ -0,0 +1,23 @@
+/** Compares dotted numeric versions ("0.3.0" < "0.10.0"); non-numeric parts sort as 0. */
+export declare function isNewer(candidate: string, current: string): boolean;
+export interface CheckForUpdateOptions {
+    /** Injectable for tests; defaults to a real npm-registry lookup. */
+    fetchLatest?: () => Promise<string | undefined>;
+    current?: string;
+}
+/** Returns the newer version string if one is available, otherwise undefined. */
+export declare function checkForUpdate(options?: CheckForUpdateOptions): Promise<string | undefined>;
+/** Mark it said, for a surface that prints its own line (connect does). */
+export declare function markUpdateAnnounced(): void;
+export interface AnnounceOptions {
+    current?: string;
+    /** Injectable for tests, all of them. */
+    isTTY?: boolean;
+    updatable?: boolean;
+    lookup?: () => Promise<string | undefined>;
+    write?: (line: string) => void;
+}
+/** Returns the line it printed, or undefined when it stayed quiet. */
+export declare function announceUpdate(o?: AnnounceOptions): Promise<string | undefined>;
+/** Tests only: the once-per-process latch has to be resettable. */
+export declare function resetUpdateAnnouncement(): void;

package/dist/utils/update-check.js

@@ -0,0 +1,116 @@
+import { readCache, writeCache } from "../cache.js";
+import { VERSION } from "../constants.js";
+import { detectInstall } from "./install-method.js";
+/**
+ * Throttled, best-effort check for a newer published version.
+ *
+ * `connect` already makes a network call before it does anything else
+ * (fetchLiveServers), so piggybacking one more cheap lookup costs nothing —
+ * but only once a day: the npm-registry hit is cached like the API catalog
+ * and skills index (see cache.ts), so every other run within the window
+ * reads the last answer off disk instead of asking again.
+ *
+ * Never throws and never blocks longer than FETCH_TIMEOUT_MS. Offline, a
+ * timeout, or a non-200 all resolve to "nothing to report" rather than an
+ * error — a stale local install is not this function's problem to surface
+ * loudly, just to mention.
+ */
+const CACHE_KEY = "update-check";
+const CHECK_TTL_MS = 24 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 1_500;
+const PACKAGE = "@aisa-one/cli";
+/** Compares dotted numeric versions ("0.3.0" < "0.10.0"); non-numeric parts sort as 0. */
+export function isNewer(candidate, current) {
+    const a = candidate.split(".").map((p) => parseInt(p, 10) || 0);
+    const b = current.split(".").map((p) => parseInt(p, 10) || 0);
+    for (let i = 0; i < Math.max(a.length, b.length); i++) {
+        const x = a[i] ?? 0;
+        const y = b[i] ?? 0;
+        if (x !== y)
+            return x > y;
+    }
+    return false;
+}
+async function defaultFetchLatest() {
+    const res = await fetch(`https://registry.npmjs.org/${PACKAGE}/latest`, {
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        return undefined;
+    const json = (await res.json());
+    return json.version;
+}
+/** Returns the newer version string if one is available, otherwise undefined. */
+export async function checkForUpdate(options = {}) {
+    const current = options.current ?? VERSION;
+    const fetchLatest = options.fetchLatest ?? defaultFetchLatest;
+    const cached = readCache(CACHE_KEY);
+    if (cached?.fresh) {
+        return isNewer(cached.data.latest, current) ? cached.data.latest : undefined;
+    }
+    try {
+        const latest = await fetchLatest();
+        if (!latest)
+            return cached && isNewer(cached.data.latest, current) ? cached.data.latest : undefined;
+        writeCache(CACHE_KEY, { latest }, CHECK_TTL_MS);
+        return isNewer(latest, current) ? latest : undefined;
+    }
+    catch {
+        return cached && isNewer(cached.data.latest, current) ? cached.data.latest : undefined;
+    }
+}
+/**
+ * Say it once, at the end of whatever command the user actually ran.
+ *
+ * The check already existed but only `connect` ever read it, and `connect` is
+ * the command a person runs once. Everyone who then lived in `chat`, `run`
+ * and `twitter` for a month was never told a release had happened.
+ *
+ * Three things keep it from becoming noise:
+ *
+ *  · Nothing is printed unless stdout is a terminal. Most commands here emit
+ *    JSON, and a friendly line appended to a pipe is corrupted output.
+ *  · Nothing is printed for a copy that cannot be updated — npx is current by
+ *    definition, and a working copy is updated with git.
+ *  · The lookup is read from the day-old cache, not the network. A stale
+ *    cache is refreshed within a tight budget and simply skipped if the
+ *    registry is slow: no command pays for this at the moment it exits.
+ */
+const ANNOUNCE_BUDGET_MS = 700;
+let announced = false;
+/** Mark it said, for a surface that prints its own line (connect does). */
+export function markUpdateAnnounced() {
+    announced = true;
+}
+/** Returns the line it printed, or undefined when it stayed quiet. */
+export async function announceUpdate(o = {}) {
+    if (announced)
+        return undefined;
+    announced = true;
+    const current = o.current ?? VERSION;
+    if (!(o.isTTY ?? process.stdout.isTTY))
+        return undefined;
+    if (process.env.AISA_NO_UPDATE_NOTICE)
+        return undefined;
+    if (!(o.updatable ?? Boolean(detectInstall().command)))
+        return undefined;
+    let latest;
+    try {
+        latest = await Promise.race([
+            (o.lookup ?? (() => checkForUpdate({ current })))(),
+            new Promise((r) => setTimeout(() => r(undefined), ANNOUNCE_BUDGET_MS)),
+        ]);
+    }
+    catch {
+        return undefined;
+    }
+    if (!latest)
+        return undefined;
+    const line = `\nA newer aisa is out — ${current} → ${latest}. Run \u001b[1maisa update\u001b[0m\n`;
+    (o.write ?? ((l) => process.stdout.write(l)))(line);
+    return line;
+}
+/** Tests only: the once-per-process latch has to be resettable. */
+export function resetUpdateAnnouncement() {
+    announced = false;
+}

package/dist/utils/width.d.ts

@@ -0,0 +1,32 @@
+/**
+ * How wide a string is on a terminal.
+ *
+ * There were three answers to this in the CLI and two of them were wrong, in
+ * two different ways:
+ *
+ *  · `prompt.ts` counted characters, so a painted label was charged for its
+ *    own escape sequences. `dim(" (recommended)")` is fourteen visible
+ *    columns carried in twenty-three characters, and a four-row menu was cut
+ *    to "Add AIsa beside it (recomme…" because of it.
+ *  · `journal.ts` used `.length`, which is right for the English it happens
+ *    to be given today and wrong the first time a Chinese string reaches it.
+ *  · `connect-terminal.ts` had the only correct one, and only by never being
+ *    handed anything painted.
+ *
+ * Two things are true of a terminal and neither is character count: a CJK
+ * glyph occupies two columns in one character, and an escape sequence
+ * occupies none in several. One implementation, used by all of them.
+ */
+export declare function stripAnsi(text: string): string;
+/** Columns the string occupies once printed. */
+export declare function cells(text: string): number;
+/**
+ * Cut to a column count, keeping colour intact.
+ *
+ * Escape sequences are copied through without being charged for, so a cut
+ * never lands inside one — a half-written escape is not a shorter string,
+ * it is a terminal printing `[1m` at the user.
+ */
+export declare function truncate(text: string, width: number): string;
+/** Pad to a column count, counting what is printed rather than what is stored. */
+export declare function padTo(text: string, width: number): string;

package/dist/utils/width.js

@@ -0,0 +1,73 @@
+/**
+ * How wide a string is on a terminal.
+ *
+ * There were three answers to this in the CLI and two of them were wrong, in
+ * two different ways:
+ *
+ *  · `prompt.ts` counted characters, so a painted label was charged for its
+ *    own escape sequences. `dim(" (recommended)")` is fourteen visible
+ *    columns carried in twenty-three characters, and a four-row menu was cut
+ *    to "Add AIsa beside it (recomme…" because of it.
+ *  · `journal.ts` used `.length`, which is right for the English it happens
+ *    to be given today and wrong the first time a Chinese string reaches it.
+ *  · `connect-terminal.ts` had the only correct one, and only by never being
+ *    handed anything painted.
+ *
+ * Two things are true of a terminal and neither is character count: a CJK
+ * glyph occupies two columns in one character, and an escape sequence
+ * occupies none in several. One implementation, used by all of them.
+ */
+/** SGR sequences — the only escapes this CLI emits. */
+const ANSI = /\[[0-9;]*m/g;
+/**
+ * The ranges that take two columns.
+ *
+ * Hangul jamo, CJK radicals through the Yi syllabary (which contains the
+ * ideographs themselves), Hangul syllables, compatibility ideographs,
+ * vertical forms, and fullwidth ASCII.
+ */
+const WIDE = /[ᄀ-ᅟ⺀-꓏가-힣豈-﫿︰-﹏＀-｠￠-￦]/;
+export function stripAnsi(text) {
+    return text.replace(ANSI, "");
+}
+/** Columns the string occupies once printed. */
+export function cells(text) {
+    let n = 0;
+    for (const ch of stripAnsi(text))
+        n += WIDE.test(ch) ? 2 : 1;
+    return n;
+}
+/**
+ * Cut to a column count, keeping colour intact.
+ *
+ * Escape sequences are copied through without being charged for, so a cut
+ * never lands inside one — a half-written escape is not a shorter string,
+ * it is a terminal printing `[1m` at the user.
+ */
+export function truncate(text, width) {
+    let out = "";
+    let w = 0;
+    let i = 0;
+    while (i < text.length) {
+        if (text.charCodeAt(i) === 0x1b) {
+            const end = text.indexOf("m", i);
+            if (end !== -1) {
+                out += text.slice(i, end + 1);
+                i = end + 1;
+                continue;
+            }
+        }
+        const ch = String.fromCodePoint(text.codePointAt(i));
+        const cw = WIDE.test(ch) ? 2 : 1;
+        if (w + cw > width)
+            return out + "…";
+        out += ch;
+        w += cw;
+        i += ch.length;
+    }
+    return out;
+}
+/** Pad to a column count, counting what is printed rather than what is stored. */
+export function padTo(text, width) {
+    return text + " ".repeat(Math.max(0, width - cells(text)));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aisa-one/cli",
-  "version": "0.3.0",
+  "version": "0.5.1",
   "description": "CLI for the AIsa unified AI infrastructure platform - one API key for 80+ LLMs and 900+ endpoints across finance, search, social, and video APIs",
   "type": "module",
   "main": "dist/index.js",
@@ -8,7 +8,9 @@
   "files": [
     "dist",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "LICENSE",
+    "vscode-extension/aisa-vscode.vsix"
   ],
   "bin": {
     "aisa": "dist/index.js"
@@ -20,7 +22,8 @@
     "start": "node dist/index.js",
     "test": "vitest run",
     "test:watch": "vitest",
-    "prepublishOnly": "npm run build"
+    "package:smoke": "node scripts/package-smoke.mjs",
+    "prepack": "npm run build"
   },
   "engines": {
     "node": ">=18"
@@ -32,7 +35,8 @@
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "conf": "^12.0.0",
-    "ora": "^8.0.1"
+    "ora": "^8.0.1",
+    "smol-toml": "^1.8.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/vscode-extension/README.md

@@ -0,0 +1,6 @@
+# AIsa for VS Code
+
+Adds AIsa's models (Claude, GPT, DeepSeek, Kimi, GLM, Qwen) to VS Code chat
+using the key `aisa login` stored in `~/.aisa/key`. Installed by
+`aisa connect`; nothing to paste. Run **AIsa: Set up AIsa models in chat**
+from the command palette to re-provision after rotating your key.

package/dist/commands/finance.d.ts

@@ -1,17 +0,0 @@
-export declare function stockAction(symbol: string, options: {
-    field?: string;
-    raw?: boolean;
-}): Promise<void>;
-export declare function cryptoAction(symbol: string, options: {
-    period?: string;
-    raw?: boolean;
-    id?: string;
-    source?: string;
-}): Promise<void>;
-export declare function screenerAction(options: {
-    sector?: string;
-    minMarketCap?: string;
-    filter?: string[];
-    limit?: string;
-    raw?: boolean;
-}): Promise<void>;