@alexkroman1/aai-cli 5.10.1 → 5.12.0

package/dist/cli.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { i as installStdoutGuard, n as fail, o as writeLine, r as getOutputMode, t as CliError } from "./_output-CC300DzW.mjs";
-import { a as silenceOutput, n as log } from "./_ui-DfwfDbT-.mjs";
+import { n as log, o as silenceOutput } from "./_ui-u7T4YooX.mjs";
 import { a as errorMessage, l as resolveCwd, o as fileExists, t as AGENT_ENTRY } from "./_utils-8KKw-bzi.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { defineCommand, runMain } from "citty";
+import { defineCommand, runMain, showUsage } from "citty";
 //#region _cli-common.ts
 /** Shared arg definitions for citty commands. */
 const sharedArgs = {
@@ -55,11 +55,11 @@ function findUnknownFlags(rawArgs, argsDef) {
 * A flag's comparison key: dashes dropped and lower-cased, with a leading
 * `no` negation removed.
 *
-* citty accepts both `--allowMissingSecrets` and `--allow-missing-secrets` for
-* an arg declared as `allowMissingSecrets`, and the guest's in-sandbox Publish
-* spawns the kebab-case spelling. Comparing the literal text rejected
-* `--allow-missing-secrets` as unknown and broke Publish for every studio
-* user, so both sides are normalized to one key.
+* citty accepts both `--allowPreviewSlug` and `--allow-preview-slug` for an
+* arg declared as `allowPreviewSlug`, and the guest's in-sandbox Publish
+* spawns the kebab-case spelling. Comparing the literal text rejected the
+* kebab-case form as unknown and broke Publish for every studio user, so both
+* sides are normalized to one key.
 */
 function canonicalFlag(flag) {
 	return flag.replace(/^--?/, "").replace(/^no-/, "").replace(/-/g, "").toLowerCase();
@@ -166,7 +166,7 @@ const list = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = resolveCwd();
-			const { executeList } = await import("./studio-LNvXtWak.mjs");
+			const { executeList } = await import("./studio-Rl5Po2M6.mjs");
 			return executeList({
 				cwd,
 				server: args.server
@@ -201,7 +201,7 @@ const pull = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = resolveCwd();
-			const { executePull } = await import("./studio-LNvXtWak.mjs");
+			const { executePull } = await import("./studio-Rl5Po2M6.mjs");
 			return executePull({
 				cwd,
 				project: args.project,
@@ -229,7 +229,7 @@ const push = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executePush } = await import("./studio-LNvXtWak.mjs");
+			const { executePush } = await import("./studio-Rl5Po2M6.mjs");
 			return executePush({
 				cwd,
 				server: args.server,
@@ -259,7 +259,7 @@ const publish = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executePublish } = await import("./studio-LNvXtWak.mjs");
+			const { executePublish } = await import("./studio-Rl5Po2M6.mjs");
 			return executePublish({
 				cwd,
 				server: args.server,
@@ -286,6 +286,22 @@ function readCliVersion(dir) {
 	return "unknown";
 }
 const VERSION = readCliVersion(cliDir);
+/**
+* `aai secret put` for a subcommand, `aai` for the root — the name to put in
+* front of `--help` when telling someone which usage to read.
+*
+* `meta` is a `Resolvable`, so it can be a function or a promise; only the
+* plain-object form carries a name synchronously and anything else degrades
+* to the binary name rather than blocking the error path on a resolve.
+*/
+function commandPath(cmd, parent) {
+	const nameOf = (c) => {
+		const meta = c?.meta;
+		return meta && typeof meta === "object" && "name" in meta && typeof meta.name === "string" ? meta.name : void 0;
+	};
+	const path = [nameOf(parent), nameOf(cmd)].filter((n) => n !== void 0).join(" ");
+	return path.startsWith("aai") ? path : `aai ${path}`.trim();
+}
 const init = defineCommand({
 	meta: {
 		name: "init",
@@ -317,7 +333,7 @@ const init = defineCommand({
 	},
 	async run({ args }) {
 		await runCommand(args, async (mode) => {
-			const { executeInit } = await import("./init-GQsNWkLJ.mjs");
+			const { executeInit } = await import("./init-B-04lRSV.mjs");
 			return executeInit({
 				dir: args.dir,
 				force: args.force,
@@ -346,7 +362,7 @@ const dev = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeDev } = await import("./dev-CdeRcYiQ.mjs");
+			const { executeDev } = await import("./dev-DqIUtFfS.mjs");
 			return executeDev({
 				cwd,
 				port: args.port
@@ -362,8 +378,8 @@ const test = defineCommand({
 	args: { json: sharedArgs.json },
 	async run({ args }) {
 		await runCommand(args, async () => {
-			const cwd = await setup();
-			const { executeTest } = await import("./test-C-V98oC-.mjs");
+			const cwd = await setup({ agent: true });
+			const { executeTest } = await import("./test-BtOzTcXE.mjs");
 			return executeTest(cwd);
 		});
 	}
@@ -387,7 +403,7 @@ const build = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeBuild } = await import("./build-CACFbdQ4.mjs");
+			const { executeBuild } = await import("./build-BTOyN3H5.mjs");
 			return executeBuild({
 				cwd,
 				skipTests: args.skipTests,
@@ -396,6 +412,30 @@ const build = defineCommand({
 		});
 	}
 });
+const eject = defineCommand({
+	meta: {
+		name: "eject",
+		description: "Add the self-hosted server.mjs entrypoint to an older project"
+	},
+	args: {
+		force: {
+			type: "boolean",
+			alias: "f",
+			description: "Replace an existing server.mjs"
+		},
+		json: sharedArgs.json
+	},
+	async run({ args }) {
+		await runCommand(args, async () => {
+			const cwd = await setup({ agent: true });
+			const { executeEject } = await import("./eject-DSldO60O.mjs");
+			return executeEject({
+				cwd,
+				force: args.force
+			});
+		});
+	}
+});
 const deploy = defineCommand({
 	meta: {
 		name: "deploy",
@@ -405,10 +445,6 @@ const deploy = defineCommand({
 	args: {
 		server: sharedArgs.server,
 		json: sharedArgs.json,
-		allowMissingSecrets: {
-			type: "boolean",
-			description: "Deploy even when the agent's providers are missing credentials (the server warns instead of rejecting; set them afterwards with `aai secret put`)"
-		},
 		allowPreviewSlug: {
 			type: "boolean",
 			description: "Permit a `-preview`-suffixed slug (reserved for studio auto-previews; studio-internal — a slug you claim this way is subject to the preview reaper)"
@@ -421,11 +457,10 @@ const deploy = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup({ agent: true });
-			const { executeDeploy } = await import("./deploy-Ch0d_jje.mjs");
+			const { executeDeploy } = await import("./deploy-Df6e7YFn.mjs");
 			return executeDeploy({
 				cwd,
 				server: args.server,
-				allowMissingSecrets: args.allowMissingSecrets,
 				allowPreviewSlug: args.allowPreviewSlug,
 				skipTypecheck: args.skipTypecheck
 			});
@@ -444,7 +479,7 @@ const del = defineCommand({
 	async run({ args }) {
 		await runCommand(args, async () => {
 			const cwd = await setup();
-			const { executeDelete } = await import("./delete-DEZ7u3u4.mjs");
+			const { executeDelete } = await import("./delete-D3gZdSs-.mjs");
 			return executeDelete({
 				cwd,
 				server: args.server
@@ -475,7 +510,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async (mode) => {
 					const cwd = await setup();
-					const { executeSecretPut, NO_INPUT, readStdin } = await import("./secret-4_dYyrpA.mjs");
+					const { executeSecretPut, NO_INPUT, readStdin } = await import("./secret-LnFdg8SB.mjs");
 					const value = mode === "json" ? await readStdin() : void 0;
 					if (mode === "json" && !value) throw new CliError(...NO_INPUT);
 					return executeSecretPut(cwd, args.name, value, args.server);
@@ -499,7 +534,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async () => {
 					const cwd = await setup();
-					const { executeSecretDelete } = await import("./secret-4_dYyrpA.mjs");
+					const { executeSecretDelete } = await import("./secret-LnFdg8SB.mjs");
 					return executeSecretDelete(cwd, args.name, args.server);
 				});
 			}
@@ -516,7 +551,7 @@ const secret = defineCommand({
 			async run({ args }) {
 				await runCommand(args, async () => {
 					const cwd = await setup();
-					const { executeSecretList } = await import("./secret-4_dYyrpA.mjs");
+					const { executeSecretList } = await import("./secret-LnFdg8SB.mjs");
 					return executeSecretList(cwd, args.server);
 				});
 			}
@@ -551,7 +586,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageStatus } = await import("./storage-BTfErOOW.mjs");
+					const { executeStorageStatus } = await import("./storage-Cjj3Pv6i.mjs");
 					return executeStorageStatus(resolveStorageCwd(args.dir), args.server);
 				});
 			}
@@ -568,7 +603,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageEnable } = await import("./storage-BTfErOOW.mjs");
+					const { executeStorageEnable } = await import("./storage-Cjj3Pv6i.mjs");
 					return executeStorageEnable(resolveStorageCwd(args.dir), args.server);
 				});
 			}
@@ -590,7 +625,7 @@ const storage = defineCommand({
 			},
 			async run({ args }) {
 				await runCommand(args, async () => {
-					const { executeStorageDisable } = await import("./storage-BTfErOOW.mjs");
+					const { executeStorageDisable } = await import("./storage-Cjj3Pv6i.mjs");
 					return executeStorageDisable(resolveStorageCwd(args.dir), {
 						server: args.server,
 						force: args.force
@@ -611,7 +646,7 @@ const login = defineCommand({
 	},
 	async run({ args }) {
 		await runCommand(args, async () => {
-			const { executeLogin } = await import("./login-BeFUiU6M.mjs");
+			const { executeLogin } = await import("./login-CtimAsZk.mjs");
 			return executeLogin({ server: args.server });
 		});
 	}
@@ -624,7 +659,7 @@ const templates = defineCommand({
 	args: { json: sharedArgs.json },
 	async run({ args }) {
 		await runCommand(args, async (mode) => {
-			const { listTemplates } = await import("./_templates-BWJOiWOO.mjs");
+			const { listTemplates } = await import("./_templates-CKYDgGyY.mjs");
 			const names = await listTemplates();
 			if (mode === "human") {
 				for (const name of names) log.message(name);
@@ -648,6 +683,7 @@ const mainCommand = defineCommand({
 		dev,
 		test,
 		build,
+		eject,
 		list,
 		pull,
 		push,
@@ -677,6 +713,31 @@ if (process.env.VITEST !== "true") {
 		process.argv.splice(2, 0, "publish");
 	};
 	/**
+	* Render usage the way the active output mode allows.
+	*
+	* citty calls `showUsage` from two places: the `--help` path, and its
+	* `catch` for a `CLIError` (a missing positional, an unknown subcommand) —
+	* where it writes the usage block to STDOUT and the reason to stderr. That
+	* second one breaks JSON mode's contract of exactly one result line on
+	* stdout, and JSON mode is auto-detected on a pipe: `aai secret put --json`
+	* put a usage block where a script's `jq` expected a result, with no JSON
+	* emitted at all. Every other failure path in this CLI converges on one
+	* emitter and gets this right.
+	*
+	* `--help` is explicitly still the human block whatever the mode — piping
+	* it into a pager is the normal way to read it, and it is not an error.
+	* The specific reason keeps going to stderr as citty already writes it, so
+	* nothing is lost to a human watching the terminal.
+	*/
+	const usageForMode = async (cmd, parent) => {
+		const argv = process.argv.slice(2);
+		if (argv.includes("--help") || argv.includes("-h") || getOutputMode({}) === "human") {
+			await showUsage(cmd, parent);
+			return;
+		}
+		await writeLine(`${JSON.stringify(fail("usage", `Invalid arguments for \`${commandPath(cmd, parent)}\`.`, `Run \`${commandPath(cmd, parent)} --help\` to see the arguments it accepts.`))}\n`);
+	};
+	/**
 	* Refuse an unrecognized flag instead of ignoring it.
 	*
 	* citty drops one silently, so `aai push --serverr=http://x` exited 0 having
@@ -690,7 +751,7 @@ if (process.env.VITEST !== "true") {
 		log.info("Run `aai <command> --help` to see the options it accepts.");
 		process.exit(1);
 	};
-	runDefault().then(assertKnownFlags).then(() => runMain(mainCommand)).catch((err) => {
+	runDefault().then(assertKnownFlags).then(() => runMain(mainCommand, { showUsage: usageForMode })).catch((err) => {
 		log.error(errorMessage(err));
 		process.exitCode = 1;
 	});

package/dist/{delete-DEZ7u3u4.mjs → delete-D3gZdSs-.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
-import { c as writeProjectConfig } from "./_config-DMyolIk9.mjs";
-import { i as resolveDeployTarget, n as getServerInfo } from "./_agent-DS2PUJcl.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { l as writeProjectConfig } from "./_config-riTmrwxX.mjs";
+import { i as resolveDeployTarget, n as getServerInfo } from "./_agent-JGaAJ5j6.mjs";
 import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-B-upMGkc.mjs";
 //#region delete.ts
 async function runDelete(opts) {

package/dist/{deploy-Ch0d_jje.mjs → deploy-Df6e7YFn.mjs}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { n as log, t as fmtUrl } from "./_ui-DfwfDbT-.mjs";
+import { n as log, r as notify, t as fmtUrl } from "./_ui-u7T4YooX.mjs";
 import { a as errorMessage } from "./_utils-8KKw-bzi.mjs";
-import { t as buildAgentBundle } from "./_bundler-DC17suWN.mjs";
-import { s as updateProjectConfig } from "./_config-DMyolIk9.mjs";
+import { s as updateProjectConfig } from "./_config-riTmrwxX.mjs";
+import { i as evalWorkerConfig, t as buildAgentBundle } from "./_bundler-BvfPzf8J.mjs";
 import { t as resolveServerEnv } from "./_server-common-DX8Bfrf5.mjs";
-import { i as resolveDeployTarget } from "./_agent-DS2PUJcl.mjs";
-import { assertTypechecks } from "./_typecheck-gate-DB-PY0A3.mjs";
+import { i as resolveDeployTarget } from "./_agent-JGaAJ5j6.mjs";
+import { assertTypechecks } from "./_typecheck-gate-4v9UBZHh.mjs";
 import { n as apiRequest } from "./_api-client-B-upMGkc.mjs";
+import { i as projectNameFromDir } from "./_studio-CXoY_Hsg.mjs";
 import { gzipSync } from "node:zlib";
 //#region _deploy.ts
 async function runDeploy(opts) {
 	const body = gzipSync(JSON.stringify({
 		...opts.slug ? { slug: opts.slug } : {},
-		...opts.allowMissingSecrets ? { credentialPolicy: "warn" } : {},
 		...opts.allowPreviewSlug ? { allowPreviewSlug: true } : {},
 		env: opts.env,
 		worker: opts.bundle.worker,
 		clientFiles: opts.bundle.clientFiles
 	}));
-	const data = await apiRequest(`${opts.url}/deploy`, {
+	return { slug: (await apiRequest(`${opts.url}/deploy`, {
 		method: "POST",
 		body,
 		headers: {
@@ -32,11 +32,7 @@ async function runDeploy(opts) {
 		...opts.slug ? {} : { retry: 0 },
 		...opts.retryDelay !== void 0 ? { retryDelay: opts.retryDelay } : {},
 		...opts.fetch ? { fetch: opts.fetch } : {}
-	});
-	return {
-		slug: data.slug,
-		...data.warnings ? { warnings: data.warnings } : {}
-	};
+	})).slug };
 }
 //#endregion
 //#region deploy.ts
@@ -44,19 +40,24 @@ async function executeDeploy(opts) {
 	const { cwd } = opts;
 	const { config: projectConfig, serverUrl, apiKey } = await resolveDeployTarget(cwd, opts.server);
 	if (!opts.skipTypecheck) await assertTypechecks(cwd);
+	const preflightModule = import("./_preflight-BtfaYtbE.mjs");
 	const bundle = await buildAgentBundle(cwd, { minify: true });
-	const slug = projectConfig?.slug;
-	const env = await resolveServerEnv(cwd);
+	const slug = projectConfig?.slug ?? projectNameFromDir(cwd) ?? void 0;
+	const uploadEnv = {
+		ASSEMBLYAI_API_KEY: apiKey,
+		...await resolveServerEnv(cwd)
+	};
+	const { missingCredentialMessage, missingCredentials } = await preflightModule;
+	const config = await evalWorkerConfig(bundle.worker);
+	const missing = config ? missingCredentials(config, uploadEnv) : [];
+	const warnings = missing.length > 0 ? [missingCredentialMessage(missing)] : [];
+	for (const warning of warnings) notify("warn", warning);
 	log.step(`Deploying${slug ? ` ${slug}` : ""}…`);
 	const deployed = await runDeploy({
 		url: serverUrl,
 		bundle,
-		env: {
-			ASSEMBLYAI_API_KEY: apiKey,
-			...env
-		},
+		env: uploadEnv,
 		...slug ? { slug } : {},
-		...opts.allowMissingSecrets ? { allowMissingSecrets: true } : {},
 		...opts.allowPreviewSlug ? { allowPreviewSlug: true } : {},
 		apiKey
 	});
@@ -73,12 +74,11 @@ async function executeDeploy(opts) {
 			serverUrl
 		})}`);
 	}
-	for (const warning of deployed.warnings ?? []) log.warn(warning);
 	log.success(`Deployed ${fmtUrl(agentUrl)}`);
 	return ok({
 		slug: deployed.slug,
 		url: agentUrl,
-		...deployed.warnings ? { warnings: deployed.warnings } : {}
+		...warnings.length > 0 ? { warnings } : {}
 	});
 }
 //#endregion

package/dist/deploy.d.ts

@@ -7,8 +7,6 @@ type DeployData = {
 export declare function executeDeploy(opts: {
     cwd: string;
     server?: string | undefined;
-    /** See DeployOpts.allowMissingSecrets (`--allow-missing-secrets`). */
-    allowMissingSecrets?: boolean | undefined;
     /** See DeployOpts.allowPreviewSlug (`--allow-preview-slug`; studio-internal). */
     allowPreviewSlug?: boolean | undefined;
     /** `--skipTypecheck`: deploy without the tsc gate. */

package/dist/{dev-CdeRcYiQ.mjs → dev-DqIUtFfS.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { i as parsePort, n as log, r as notify, t as fmtUrl } from "./_ui-DfwfDbT-.mjs";
+import { a as parsePort, n as log, r as notify, t as fmtUrl } from "./_ui-u7T4YooX.mjs";
 import { i as errorDetail } from "./_utils-8KKw-bzi.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
@@ -12,7 +12,7 @@ import { styleText } from "node:util";
 async function executeDev(opts) {
 	const port = parsePort(opts.port);
 	const agentName = path.basename(path.resolve(opts.cwd));
-	const { startDevServer } = await import("./_dev-server-B3ivqyEd.mjs");
+	const { startDevServer } = await import("./_dev-server-BgXXSijx.mjs");
 	let cleanup;
 	let shuttingDown = false;
 	const onSignal = () => {

package/dist/eject-DSldO60O.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { a as errorMessage, c as readJson, d as writeJson, o as fileExists } from "./_utils-8KKw-bzi.mjs";
+import { scaffoldDir } from "./_templates-CKYDgGyY.mjs";
+import path from "node:path";
+import fs from "node:fs/promises";
+//#region eject.ts
+/**
+* `aai eject` — retrofit the self-hosted entrypoint into an existing project.
+*
+* Every project scaffolded from this CLI version onwards already has
+* `server.mjs` and an `npm start` script: the scaffold ships them, so
+* self-hosting is the default rather than something to opt into. This command
+* exists for the projects that predate that — `aai init` before it, or a
+* workspace pulled from a studio that was created earlier — where the files
+* are simply missing.
+*
+* It COPIES from the scaffold rather than writing its own contents. Two
+* definitions of "the self-hosted entrypoint" would drift, and the one nobody
+* runs locally is the one that would rot; this way an ejected project is
+* byte-identical to a freshly scaffolded one.
+*/
+/** The file `npm start` runs. Named once — the scaffold ships it under this name. */
+const SERVER_ENTRY = "server.mjs";
+/** The `scripts.start` value that runs {@link SERVER_ENTRY}. */
+const START_SCRIPT = `node ${SERVER_ENTRY}`;
+/**
+* Add `scripts.start` unless the project already declares one.
+*
+* An existing `start` is left alone even under `--force`: `--force` is about
+* replacing the entrypoint file, and silently rewriting the command a project
+* boots with is a different, larger act. The mismatch is reported instead, so
+* the choice stays the author's.
+*/
+async function ensureStartScript(cwd) {
+	const manifestPath = path.join(cwd, "package.json");
+	const manifest = await readJson(manifestPath);
+	if (!manifest) {
+		log.warn(`No package.json here — add "start": "${START_SCRIPT}" yourself to get \`npm start\`.`);
+		return false;
+	}
+	const existing = manifest.scripts?.start;
+	if (existing === START_SCRIPT) return false;
+	if (existing !== void 0) {
+		log.warn(`Kept your existing "start" script (${existing}) — run \`node ${SERVER_ENTRY}\`.`);
+		return false;
+	}
+	manifest.scripts = {
+		...manifest.scripts,
+		start: START_SCRIPT
+	};
+	await writeJson(manifestPath, manifest);
+	return true;
+}
+/**
+* A missing scaffold source means a broken install (or an `AAI_TEMPLATES_DIR`
+* pointed somewhere wrong), not anything the user did — so the message names
+* the file and where it was looked for.
+*
+* Built here and thrown by the caller, the shape `build.ts` uses for the same
+* reason: `useErrorCause` reads a `throw new Error` inside a `catch` as
+* dropping the cause, and cannot see that `CliError` takes its options fourth.
+*/
+function scaffoldMissingError(source, err) {
+	return new CliError("scaffold_missing", `Could not read the scaffold's ${SERVER_ENTRY} at ${source}: ${errorMessage(err)}`, "Reinstall @alexkroman1/aai-cli.", { cause: err });
+}
+async function executeEject(opts) {
+	const { cwd, force } = opts;
+	const target = path.join(cwd, SERVER_ENTRY);
+	const overwritten = await fileExists(target);
+	if (overwritten && !force) throw new CliError("server_exists", `${SERVER_ENTRY} already exists — this project can already be self-hosted.`, `Run \`npm start\`, or re-run with --force to replace it with the current scaffold's copy.`);
+	const source = path.join(scaffoldDir(), SERVER_ENTRY);
+	try {
+		await fs.copyFile(source, target);
+	} catch (err) {
+		throw scaffoldMissingError(source, err);
+	}
+	const addedStartScript = await ensureStartScript(cwd);
+	log.success(`Wrote ${SERVER_ENTRY}${overwritten ? " (replaced)" : ""}`);
+	if (await fileExists(path.join(cwd, "client.tsx"))) log.info("This project has a custom UI: run `aai build` first so it is served.");
+	log.info("Next: npm start (PORT and HOST override the 127.0.0.1:3000 default)");
+	return ok({
+		file: target,
+		overwritten,
+		addedStartScript
+	});
+}
+//#endregion
+export { executeEject };

package/dist/eject.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `aai eject` — retrofit the self-hosted entrypoint into an existing project.
+ *
+ * Every project scaffolded from this CLI version onwards already has
+ * `server.mjs` and an `npm start` script: the scaffold ships them, so
+ * self-hosting is the default rather than something to opt into. This command
+ * exists for the projects that predate that — `aai init` before it, or a
+ * workspace pulled from a studio that was created earlier — where the files
+ * are simply missing.
+ *
+ * It COPIES from the scaffold rather than writing its own contents. Two
+ * definitions of "the self-hosted entrypoint" would drift, and the one nobody
+ * runs locally is the one that would rot; this way an ejected project is
+ * byte-identical to a freshly scaffolded one.
+ */
+import { type CommandResult } from "./_output.ts";
+/** The file `npm start` runs. Named once — the scaffold ships it under this name. */
+export declare const SERVER_ENTRY = "server.mjs";
+/** The `scripts.start` value that runs {@link SERVER_ENTRY}. */
+export declare const START_SCRIPT = "node server.mjs";
+type EjectData = {
+    /** Absolute path of the entrypoint written. */
+    file: string;
+    /** True when an existing `server.mjs` was replaced (`--force`). */
+    overwritten: boolean;
+    /** True when `scripts.start` was added to package.json by this run. */
+    addedStartScript: boolean;
+};
+export declare function executeEject(opts: {
+    cwd: string;
+    force?: boolean | undefined;
+}): Promise<CommandResult<EjectData>>;
+export {};

package/dist/{init-GQsNWkLJ.mjs → init-B-04lRSV.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { n as log, o as unwrapCancel } from "./_ui-DfwfDbT-.mjs";
+import { n as log, s as unwrapCancel } from "./_ui-u7T4YooX.mjs";
 import { a as errorMessage, c as readJson, l as resolveCwd, o as fileExists, t as AGENT_ENTRY } from "./_utils-8KKw-bzi.mjs";
-import { r as isDevMode, t as getMonorepoRoot } from "./_agent-DS2PUJcl.mjs";
+import { r as isDevMode, t as getMonorepoRoot } from "./_agent-JGaAJ5j6.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
@@ -75,7 +75,7 @@ function resolveTargetDir(dir) {
 }
 /** Publish after init and return deploy metadata if successful. */
 async function tryPublish(cwd, server) {
-	const { executePublish } = await import("./studio-LNvXtWak.mjs");
+	const { executePublish } = await import("./studio-Rl5Po2M6.mjs");
 	try {
 		const result = await executePublish({
 			cwd,
@@ -94,7 +94,7 @@ async function tryPublish(cwd, server) {
 }
 /** Scaffold the project, optionally showing a spinner. */
 async function scaffoldProject(dir, cwd, template, silent) {
-	const { runInit } = await import("./_init-CYLvYU-B.mjs");
+	const { runInit } = await import("./_init-Ca5Eg5pn.mjs");
 	const s = silent ? void 0 : p.spinner();
 	s?.start(`Creating ${dir}`);
 	await runInit({

package/dist/{login-BeFUiU6M.mjs → login-CtimAsZk.mjs}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
-import { o as updateGlobalConfig, r as readGlobalConfig, t as approveServer } from "./_config-DMyolIk9.mjs";
-import { a as resolveServerUrl } from "./_agent-DS2PUJcl.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { o as updateGlobalConfig, r as readGlobalConfig, t as approveServer } from "./_config-riTmrwxX.mjs";
+import { a as resolveServerUrl } from "./_agent-JGaAJ5j6.mjs";
+import { linkConfirmationCode } from "@alexkroman1/aai/utils";
 import { spawn } from "node:child_process";
 import { setTimeout } from "node:timers/promises";
 import { randomBytes } from "node:crypto";
@@ -115,18 +116,6 @@ function openerFor(platform) {
 	]];
 	return ["xdg-open", []];
 }
-/**
-* Human-matchable confirmation derived from the link code — printed in the
-* terminal AND shown on the browser approval gate (aai-studio-client's
-* cli-link.ts derives the same value; keep the two in lockstep). Not a
-* secret: both ends already hold the full code. It exists so someone who
-* lands on an approval page they didn't cause has a concrete mismatch to
-* notice ("what terminal?") instead of a bare Approve button.
-*/
-function linkConfirmationCode(code) {
-	const head = code.slice(0, 8).toUpperCase();
-	return `${head.slice(0, 4)}-${head.slice(4)}`;
-}
 /** Best-effort: the link URL is always printed, so a failure is fine. */
 function defaultOpenBrowser(url) {
 	const [cmd, args] = openerFor(process.platform);

package/dist/login.d.ts

@@ -30,15 +30,6 @@ export type LoginDeps = {
     /** Test seam — never set outside tests. */
     timeoutMs?: number;
 };
-/**
- * Human-matchable confirmation derived from the link code — printed in the
- * terminal AND shown on the browser approval gate (aai-studio-client's
- * cli-link.ts derives the same value; keep the two in lockstep). Not a
- * secret: both ends already hold the full code. It exists so someone who
- * lands on an approval page they didn't cause has a concrete mismatch to
- * notice ("what terminal?") instead of a bare Approve button.
- */
-export declare function linkConfirmationCode(code: string): string;
 export declare function executeLogin(opts: {
     server?: string | undefined;
 }, deps?: LoginDeps): Promise<CommandResult<{

package/dist/project-config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The two on-disk formats a CLI invocation reads, as WRITERS other packages
+ * can call — the config home (`config.json`, which holds the API key) and a
+ * project's `.aai/project.json` pin.
+ *
+ * It exists for the studio guest. Publish materializes a workspace into a
+ * real project and then spawns this CLI against it
+ * (`aai-guest/studio-publish.ts`), which means writing both files first; it
+ * used to do that with `JSON.stringify`, so the shapes agreed by coincidence
+ * and nothing tied them to the schemas the CLI parses them back with. Two of
+ * this file's properties are not obvious from the JSON and were absent from
+ * the hand-written copies' successors-in-waiting: the config home is written
+ * 0600 through an atomic rename (so an older world-readable file is
+ * TIGHTENED rather than left), and the project pin is MERGED, never
+ * replaced — `.aai/project.json` also carries the studio link fields, and a
+ * writer that replaces the document drops them.
+ *
+ * Deliberately a thin re-export of `_config.ts` rather than a second
+ * implementation: the point is that there is one writer per format, not that
+ * there is a nicer one here.
+ */
+export type { GlobalConfig, ProjectConfig } from "./_config.ts";
+export { updateProjectConfig, writeGlobalConfig as writeConfigHome } from "./_config.ts";

package/dist/project-config.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { c as writeGlobalConfig, s as updateProjectConfig } from "./_config-riTmrwxX.mjs";
+export { updateProjectConfig, writeGlobalConfig as writeConfigHome };