@alexkroman1/aai-cli 5.11.0 → 5.12.0

package/dist/{deploy-Ch0d_jje.mjs → deploy-Df6e7YFn.mjs}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { n as log, t as fmtUrl } from "./_ui-DfwfDbT-.mjs";
+import { n as log, r as notify, t as fmtUrl } from "./_ui-u7T4YooX.mjs";
 import { a as errorMessage } from "./_utils-8KKw-bzi.mjs";
-import { t as buildAgentBundle } from "./_bundler-DC17suWN.mjs";
-import { s as updateProjectConfig } from "./_config-DMyolIk9.mjs";
+import { s as updateProjectConfig } from "./_config-riTmrwxX.mjs";
+import { i as evalWorkerConfig, t as buildAgentBundle } from "./_bundler-BvfPzf8J.mjs";
 import { t as resolveServerEnv } from "./_server-common-DX8Bfrf5.mjs";
-import { i as resolveDeployTarget } from "./_agent-DS2PUJcl.mjs";
-import { assertTypechecks } from "./_typecheck-gate-DB-PY0A3.mjs";
+import { i as resolveDeployTarget } from "./_agent-JGaAJ5j6.mjs";
+import { assertTypechecks } from "./_typecheck-gate-4v9UBZHh.mjs";
 import { n as apiRequest } from "./_api-client-B-upMGkc.mjs";
+import { i as projectNameFromDir } from "./_studio-CXoY_Hsg.mjs";
 import { gzipSync } from "node:zlib";
 //#region _deploy.ts
 async function runDeploy(opts) {
 	const body = gzipSync(JSON.stringify({
 		...opts.slug ? { slug: opts.slug } : {},
-		...opts.allowMissingSecrets ? { credentialPolicy: "warn" } : {},
 		...opts.allowPreviewSlug ? { allowPreviewSlug: true } : {},
 		env: opts.env,
 		worker: opts.bundle.worker,
 		clientFiles: opts.bundle.clientFiles
 	}));
-	const data = await apiRequest(`${opts.url}/deploy`, {
+	return { slug: (await apiRequest(`${opts.url}/deploy`, {
 		method: "POST",
 		body,
 		headers: {
@@ -32,11 +32,7 @@ async function runDeploy(opts) {
 		...opts.slug ? {} : { retry: 0 },
 		...opts.retryDelay !== void 0 ? { retryDelay: opts.retryDelay } : {},
 		...opts.fetch ? { fetch: opts.fetch } : {}
-	});
-	return {
-		slug: data.slug,
-		...data.warnings ? { warnings: data.warnings } : {}
-	};
+	})).slug };
 }
 //#endregion
 //#region deploy.ts
@@ -44,19 +40,24 @@ async function executeDeploy(opts) {
 	const { cwd } = opts;
 	const { config: projectConfig, serverUrl, apiKey } = await resolveDeployTarget(cwd, opts.server);
 	if (!opts.skipTypecheck) await assertTypechecks(cwd);
+	const preflightModule = import("./_preflight-BtfaYtbE.mjs");
 	const bundle = await buildAgentBundle(cwd, { minify: true });
-	const slug = projectConfig?.slug;
-	const env = await resolveServerEnv(cwd);
+	const slug = projectConfig?.slug ?? projectNameFromDir(cwd) ?? void 0;
+	const uploadEnv = {
+		ASSEMBLYAI_API_KEY: apiKey,
+		...await resolveServerEnv(cwd)
+	};
+	const { missingCredentialMessage, missingCredentials } = await preflightModule;
+	const config = await evalWorkerConfig(bundle.worker);
+	const missing = config ? missingCredentials(config, uploadEnv) : [];
+	const warnings = missing.length > 0 ? [missingCredentialMessage(missing)] : [];
+	for (const warning of warnings) notify("warn", warning);
 	log.step(`Deploying${slug ? ` ${slug}` : ""}…`);
 	const deployed = await runDeploy({
 		url: serverUrl,
 		bundle,
-		env: {
-			ASSEMBLYAI_API_KEY: apiKey,
-			...env
-		},
+		env: uploadEnv,
 		...slug ? { slug } : {},
-		...opts.allowMissingSecrets ? { allowMissingSecrets: true } : {},
 		...opts.allowPreviewSlug ? { allowPreviewSlug: true } : {},
 		apiKey
 	});
@@ -73,12 +74,11 @@ async function executeDeploy(opts) {
 			serverUrl
 		})}`);
 	}
-	for (const warning of deployed.warnings ?? []) log.warn(warning);
 	log.success(`Deployed ${fmtUrl(agentUrl)}`);
 	return ok({
 		slug: deployed.slug,
 		url: agentUrl,
-		...deployed.warnings ? { warnings: deployed.warnings } : {}
+		...warnings.length > 0 ? { warnings } : {}
 	});
 }
 //#endregion

package/dist/deploy.d.ts

@@ -7,8 +7,6 @@ type DeployData = {
 export declare function executeDeploy(opts: {
     cwd: string;
     server?: string | undefined;
-    /** See DeployOpts.allowMissingSecrets (`--allow-missing-secrets`). */
-    allowMissingSecrets?: boolean | undefined;
     /** See DeployOpts.allowPreviewSlug (`--allow-preview-slug`; studio-internal). */
     allowPreviewSlug?: boolean | undefined;
     /** `--skipTypecheck`: deploy without the tsc gate. */

package/dist/{dev-CdeRcYiQ.mjs → dev-DqIUtFfS.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { i as parsePort, n as log, r as notify, t as fmtUrl } from "./_ui-DfwfDbT-.mjs";
+import { a as parsePort, n as log, r as notify, t as fmtUrl } from "./_ui-u7T4YooX.mjs";
 import { i as errorDetail } from "./_utils-8KKw-bzi.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
@@ -12,7 +12,7 @@ import { styleText } from "node:util";
 async function executeDev(opts) {
 	const port = parsePort(opts.port);
 	const agentName = path.basename(path.resolve(opts.cwd));
-	const { startDevServer } = await import("./_dev-server-B3ivqyEd.mjs");
+	const { startDevServer } = await import("./_dev-server-BgXXSijx.mjs");
 	let cleanup;
 	let shuttingDown = false;
 	const onSignal = () => {

package/dist/{eject-DSrAp8PL.mjs → eject-DSldO60O.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
 import { a as errorMessage, c as readJson, d as writeJson, o as fileExists } from "./_utils-8KKw-bzi.mjs";
-import { scaffoldDir } from "./_templates-DmdG-voA.mjs";
+import { scaffoldDir } from "./_templates-CKYDgGyY.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
 //#region eject.ts

package/dist/{init-BBAoRI_f.mjs → init-B-04lRSV.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { n as log, o as unwrapCancel } from "./_ui-DfwfDbT-.mjs";
+import { n as log, s as unwrapCancel } from "./_ui-u7T4YooX.mjs";
 import { a as errorMessage, c as readJson, l as resolveCwd, o as fileExists, t as AGENT_ENTRY } from "./_utils-8KKw-bzi.mjs";
-import { r as isDevMode, t as getMonorepoRoot } from "./_agent-DS2PUJcl.mjs";
+import { r as isDevMode, t as getMonorepoRoot } from "./_agent-JGaAJ5j6.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
@@ -75,7 +75,7 @@ function resolveTargetDir(dir) {
 }
 /** Publish after init and return deploy metadata if successful. */
 async function tryPublish(cwd, server) {
-	const { executePublish } = await import("./studio-DPDFKZ9i.mjs");
+	const { executePublish } = await import("./studio-Rl5Po2M6.mjs");
 	try {
 		const result = await executePublish({
 			cwd,
@@ -94,7 +94,7 @@ async function tryPublish(cwd, server) {
 }
 /** Scaffold the project, optionally showing a spinner. */
 async function scaffoldProject(dir, cwd, template, silent) {
-	const { runInit } = await import("./_init-5hHkHe-V.mjs");
+	const { runInit } = await import("./_init-Ca5Eg5pn.mjs");
 	const s = silent ? void 0 : p.spinner();
 	s?.start(`Creating ${dir}`);
 	await runInit({

package/dist/{login-BeFUiU6M.mjs → login-CtimAsZk.mjs}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
-import { o as updateGlobalConfig, r as readGlobalConfig, t as approveServer } from "./_config-DMyolIk9.mjs";
-import { a as resolveServerUrl } from "./_agent-DS2PUJcl.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { o as updateGlobalConfig, r as readGlobalConfig, t as approveServer } from "./_config-riTmrwxX.mjs";
+import { a as resolveServerUrl } from "./_agent-JGaAJ5j6.mjs";
+import { linkConfirmationCode } from "@alexkroman1/aai/utils";
 import { spawn } from "node:child_process";
 import { setTimeout } from "node:timers/promises";
 import { randomBytes } from "node:crypto";
@@ -115,18 +116,6 @@ function openerFor(platform) {
 	]];
 	return ["xdg-open", []];
 }
-/**
-* Human-matchable confirmation derived from the link code — printed in the
-* terminal AND shown on the browser approval gate (aai-studio-client's
-* cli-link.ts derives the same value; keep the two in lockstep). Not a
-* secret: both ends already hold the full code. It exists so someone who
-* lands on an approval page they didn't cause has a concrete mismatch to
-* notice ("what terminal?") instead of a bare Approve button.
-*/
-function linkConfirmationCode(code) {
-	const head = code.slice(0, 8).toUpperCase();
-	return `${head.slice(0, 4)}-${head.slice(4)}`;
-}
 /** Best-effort: the link URL is always printed, so a failure is fine. */
 function defaultOpenBrowser(url) {
 	const [cmd, args] = openerFor(process.platform);

package/dist/login.d.ts

@@ -30,15 +30,6 @@ export type LoginDeps = {
     /** Test seam — never set outside tests. */
     timeoutMs?: number;
 };
-/**
- * Human-matchable confirmation derived from the link code — printed in the
- * terminal AND shown on the browser approval gate (aai-studio-client's
- * cli-link.ts derives the same value; keep the two in lockstep). Not a
- * secret: both ends already hold the full code. It exists so someone who
- * lands on an approval page they didn't cause has a concrete mismatch to
- * notice ("what terminal?") instead of a bare Approve button.
- */
-export declare function linkConfirmationCode(code: string): string;
 export declare function executeLogin(opts: {
     server?: string | undefined;
 }, deps?: LoginDeps): Promise<CommandResult<{

package/dist/project-config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The two on-disk formats a CLI invocation reads, as WRITERS other packages
+ * can call — the config home (`config.json`, which holds the API key) and a
+ * project's `.aai/project.json` pin.
+ *
+ * It exists for the studio guest. Publish materializes a workspace into a
+ * real project and then spawns this CLI against it
+ * (`aai-guest/studio-publish.ts`), which means writing both files first; it
+ * used to do that with `JSON.stringify`, so the shapes agreed by coincidence
+ * and nothing tied them to the schemas the CLI parses them back with. Two of
+ * this file's properties are not obvious from the JSON and were absent from
+ * the hand-written copies' successors-in-waiting: the config home is written
+ * 0600 through an atomic rename (so an older world-readable file is
+ * TIGHTENED rather than left), and the project pin is MERGED, never
+ * replaced — `.aai/project.json` also carries the studio link fields, and a
+ * writer that replaces the document drops them.
+ *
+ * Deliberately a thin re-export of `_config.ts` rather than a second
+ * implementation: the point is that there is one writer per format, not that
+ * there is a nicer one here.
+ */
+export type { GlobalConfig, ProjectConfig } from "./_config.ts";
+export { updateProjectConfig, writeGlobalConfig as writeConfigHome } from "./_config.ts";

package/dist/project-config.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { c as writeGlobalConfig, s as updateProjectConfig } from "./_config-riTmrwxX.mjs";
+export { updateProjectConfig, writeGlobalConfig as writeConfigHome };

package/dist/scaffold/package.json

@@ -12,15 +12,15 @@
     "publish:agent": "aai publish"
   },
   "dependencies": {
-    "@alexkroman1/aai": "^5.11.0",
-    "@alexkroman1/aai-ui": "^5.11.0",
+    "@alexkroman1/aai": "^5.12.0",
+    "@alexkroman1/aai-ui": "^5.12.0",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "tailwindcss": "^4.0.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@alexkroman1/aai-cli": "^5.11.0",
+    "@alexkroman1/aai-cli": "^5.12.0",
     "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",

package/dist/{secret-4_dYyrpA.mjs → secret-LnFdg8SB.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { a as ok, n as fail } from "./_output-CC300DzW.mjs";
-import { n as log, o as unwrapCancel } from "./_ui-DfwfDbT-.mjs";
-import { t as slugRequest } from "./_slug-api-fRNNR8tz.mjs";
+import { n as log, s as unwrapCancel } from "./_ui-u7T4YooX.mjs";
+import { t as secretRequest } from "./_slug-api-DXm7s9X5.mjs";
 import * as p from "@clack/prompts";
 import { text } from "node:stream/consumers";
 //#region secret.ts
@@ -29,24 +29,24 @@ async function executeSecretPut(cwd, name, value, server) {
 		if (!result) return fail(...NO_INPUT);
 		secretValue = result;
 	}
-	const { slug } = await slugRequest(cwd, "/secret", {
+	const { target } = await secretRequest(cwd, "", {
 		method: "PUT",
 		body: { [name]: secretValue },
 		action: "secret"
 	}, server);
-	log.success(`Set ${name} for ${slug}`);
+	log.success(`Set ${name} for ${target}`);
 	return ok({ name });
 }
 async function executeSecretDelete(cwd, name, server) {
-	const { slug } = await slugRequest(cwd, `/secret/${encodeURIComponent(name)}`, {
+	const { target } = await secretRequest(cwd, `/${encodeURIComponent(name)}`, {
 		method: "DELETE",
 		action: "secret"
 	}, server);
-	log.success(`Deleted ${name} from ${slug}`);
+	log.success(`Deleted ${name} from ${target}`);
 	return ok({ name });
 }
 async function executeSecretList(cwd, server) {
-	const { data: { vars } } = await slugRequest(cwd, "/secret", { action: "secret" }, server);
+	const { data: { vars } } = await secretRequest(cwd, "", { action: "secret" }, server);
 	if (vars.length === 0) log.info("No secrets set. Use `aai secret put <name>` to add one.");
 	else {
 		log.message(`${vars.length} secret${vars.length === 1 ? "" : "s"}:`);

package/dist/{storage-BTfErOOW.mjs → storage-Cjj3Pv6i.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { a as ok, n as fail } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
-import { t as slugRequest } from "./_slug-api-fRNNR8tz.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { n as slugRequest } from "./_slug-api-DXm7s9X5.mjs";
 import * as p from "@clack/prompts";
 //#region storage.ts
 async function storageRequest(cwd, init, server) {

package/dist/{studio-DPDFKZ9i.mjs → studio-Rl5Po2M6.mjs}

@@ -1,181 +1,14 @@
 #!/usr/bin/env node
 import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
-import { n as log, t as fmtUrl } from "./_ui-DfwfDbT-.mjs";
-import { s as updateProjectConfig } from "./_config-DMyolIk9.mjs";
+import { n as log, t as fmtUrl } from "./_ui-u7T4YooX.mjs";
+import { s as updateProjectConfig } from "./_config-riTmrwxX.mjs";
 import { t as resolveServerEnv } from "./_server-common-DX8Bfrf5.mjs";
-import { i as resolveDeployTarget } from "./_agent-DS2PUJcl.mjs";
-import { layerScaffold } from "./_templates-DmdG-voA.mjs";
+import { i as resolveDeployTarget } from "./_agent-JGaAJ5j6.mjs";
+import { layerScaffold } from "./_templates-CKYDgGyY.mjs";
 import { n as apiRequest } from "./_api-client-B-upMGkc.mjs";
+import { a as publishStudioProject, i as projectNameFromDir, n as fetchStudioProject, o as pushStudioSource, r as listStudioProjects, s as studioProjectUrl, t as collectSourceFiles } from "./_studio-CXoY_Hsg.mjs";
 import path from "node:path";
-import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { PREVIEW_SLUG_SUFFIX, VALID_SLUG_RE } from "@alexkroman1/aai/utils";
-//#region _studio.ts
-/**
-* Internals of the studio-workspace commands (`aai list/pull/push/publish`):
-* the local source-file walk and the thin clients for the platform's
-* `/studio/projects` routes. The workspace is the single source of truth —
-* these helpers only move files between a local directory and the project's
-* workspace row; production deploys happen exclusively through the studio's
-* Publish route (which runs the deploy machinery in the project's sandbox).
-*/
-/**
-* Mirrors of the studio workspace caps (`aai-studio-server/studio-limits.ts`)
-* — by value, like `aai-guest/limits.ts`, since the CLI cannot depend on the
-* private server package. The server re-validates every push; these exist so
-* an oversized file is a named warning locally instead of a rejected upload.
-*/
-const MAX_STUDIO_FILE_BYTES = 256e3;
-/**
-* What never syncs to a workspace — the same set the guest's snapshot skips
-* (`aai-guest/studio-workspace-fs.ts`), plus what only exists locally:
-* secrets (`.env` rides the secret routes, never a workspace row) and
-* lockfiles (regenerated by install, noise in the studio editor).
-*/
-const IGNORED_DIRS = /* @__PURE__ */ new Set([
-	"node_modules",
-	".git",
-	"dist",
-	".aai"
-]);
-const IGNORED_FILES = [
-	/^\.env(\..+)?$/,
-	/^pnpm-lock\.yaml$/,
-	/^package-lock\.json$/,
-	/^yarn\.lock$/,
-	/^\.DS_Store$/
-];
-function isIgnoredFile(name) {
-	return IGNORED_FILES.some((re) => re.test(name));
-}
-/** Project-relative paths of every syncable file under `dir`, sorted. */
-async function walkProject(dir, current = dir) {
-	const out = [];
-	const entries = await readdir(current, { withFileTypes: true });
-	for (const entry of entries) {
-		if (entry.isSymbolicLink()) continue;
-		const abs = path.join(current, entry.name);
-		if (entry.isDirectory()) {
-			if (!IGNORED_DIRS.has(entry.name)) out.push(...await walkProject(dir, abs));
-		} else if (entry.isFile() && !isIgnoredFile(entry.name)) out.push(path.relative(dir, abs));
-	}
-	return out.sort((a, b) => a.localeCompare(b));
-}
-/**
-* Decode `buf` as UTF-8, or null when it isn't valid UTF-8.
-*
-* `fatal` makes an invalid sequence throw instead of becoming U+FFFD, which
-* is the whole point: a workspace is a JSON path→string map and cannot carry
-* arbitrary bytes, so a lossy read turned a pushed PNG into replacement
-* characters while reporting success — and a later `aai pull` wrote the
-* mangled version back over the local original. `ignoreBOM` keeps a leading
-* U+FEFF in the string; without it the decoder strips the BOM and the check
-* meant to stop corruption would quietly perform some of its own.
-*/
-const UTF8_STRICT = new TextDecoder("utf-8", {
-	fatal: true,
-	ignoreBOM: true
-});
-function decodeUtf8(buf) {
-	try {
-		return UTF8_STRICT.decode(buf);
-	} catch {
-		return null;
-	}
-}
-/**
-* Walk a local project into the path→content record a workspace stores —
-* the CLI-side twin of the guest's `snapshotWorkspace`: same ignored
-* directories, same caps, oversized and non-text files skipped with a
-* warning rather than failing the whole push.
-*/
-async function collectSourceFiles(dir) {
-	const paths = await walkProject(dir);
-	const files = {};
-	const warnings = [];
-	if (paths.length > 100) warnings.push(`Project has ${paths.length} files; only the first 100 sync to the studio.`);
-	const read = await Promise.all(paths.slice(0, 100).map(async (rel) => {
-		const abs = path.join(dir, rel);
-		const st = await stat(abs);
-		if (st.size > 256e3) return {
-			ok: false,
-			warning: `${rel} is ${st.size} bytes (max ${MAX_STUDIO_FILE_BYTES}) — not synced.`
-		};
-		const content = decodeUtf8(await readFile(abs));
-		if (content === null) return {
-			ok: false,
-			warning: `${rel} is not valid UTF-8 (binary file?) — not synced.`
-		};
-		return {
-			ok: true,
-			rel,
-			content
-		};
-	}));
-	for (const entry of read) {
-		if (!entry.ok) {
-			warnings.push(entry.warning);
-			continue;
-		}
-		files[entry.rel.split(path.sep).join("/")] = entry.content;
-	}
-	return {
-		files,
-		warnings
-	};
-}
-/**
-* A studio project name derived from a directory name, or null if unusable.
-*
-* A `-preview` suffix is deliberately unusable. Publishing a project deploys
-* it under the project's own name, so a `*-preview` project would claim a
-* slug the studio's orphan-preview sweep reaps hourly — deleting the agent,
-* its app-database schema, and its secrets on a schedule the user never
-* asked for. Refusing the name is recoverable (rename the directory); losing
-* a published agent to the reaper is not.
-*/
-function projectNameFromDir(dir) {
-	const name = path.basename(dir).toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/-{2,}/g, "-").replace(/^[-_]+|[-_]+$/g, "").slice(0, 64);
-	if (name.endsWith(PREVIEW_SLUG_SUFFIX)) return null;
-	return VALID_SLUG_RE.test(name) ? name : null;
-}
-/** The shareable studio URL for a project — what every command prints. */
-function studioProjectUrl(serverUrl, project) {
-	return `${serverUrl}/studio/chat/${project}`;
-}
-function listStudioProjects(serverUrl, apiKey) {
-	return apiRequest(`${serverUrl}/studio/projects`, {
-		apiKey,
-		action: "list"
-	}).then((res) => res.projects);
-}
-/** Fetch a project, or null when it doesn't exist (the push existence probe). */
-function fetchStudioProject(serverUrl, apiKey, project) {
-	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}`, {
-		apiKey,
-		action: "pull",
-		allow404: true
-	});
-}
-/** `PUT /studio/projects/:project/source` — the atomic whole-tree push. */
-function pushStudioSource(serverUrl, apiKey, project, body) {
-	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}/source`, {
-		apiKey,
-		action: "push",
-		method: "PUT",
-		body,
-		hints: { 409: "The studio has newer changes. Run `aai pull` to fetch them, or `aai push --force` to overwrite." }
-	});
-}
-/** `POST /studio/projects/:project/deploy` — Publish, in the project's sandbox. */
-function publishStudioProject(serverUrl, apiKey, project) {
-	return apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}/deploy`, {
-		apiKey,
-		action: "publish",
-		method: "POST",
-		retry: 0
-	});
-}
-//#endregion
+import { mkdir, readdir, writeFile } from "node:fs/promises";
 //#region studio.ts
 /**
 * The studio-workspace commands: `aai list`, `aai pull`, `aai push`,
@@ -310,11 +143,11 @@ async function executePush(opts) {
 * deploy time, which is why publish syncs them BEFORE deploying when the
 * slug is already known.
 */
-async function syncEnvSecrets(cwd, serverUrl, apiKey, slug) {
+async function syncEnvSecrets(cwd, serverUrl, apiKey, project) {
 	const env = await resolveServerEnv(cwd);
 	const names = Object.keys(env);
 	if (names.length === 0) return [];
-	await apiRequest(`${serverUrl}/${slug}/secret`, {
+	await apiRequest(`${serverUrl}/studio/projects/${encodeURIComponent(project)}/secret`, {
 		apiKey,
 		action: "secret",
 		method: "PUT",
@@ -325,13 +158,13 @@ async function syncEnvSecrets(cwd, serverUrl, apiKey, slug) {
 }
 async function executePublish(opts) {
 	if (!opts.skipTypecheck) {
-		const { assertTypechecks } = await import("./_typecheck-gate-DB-PY0A3.mjs");
+		const { assertTypechecks } = await import("./_typecheck-gate-4v9UBZHh.mjs");
 		await assertTypechecks(opts.cwd);
 	}
 	const pushed = await pushProject(opts);
 	const { project, serverUrl, apiKey } = pushed;
 	const hadSlug = pushed.slug !== void 0;
-	if (pushed.slug) await syncEnvSecrets(opts.cwd, serverUrl, apiKey, pushed.slug);
+	if (pushed.slug) await syncEnvSecrets(opts.cwd, serverUrl, apiKey, project);
 	log.step(`Publishing ${project} (builds in the project's sandbox)…`);
 	const result = await publishStudioProject(serverUrl, apiKey, project);
 	if (typeof result?.slug !== "string" || typeof result?.output !== "string") throw new CliError("bad_publish_response", `Unexpected response from the publish route at ${serverUrl}.`, "Check that --server points at an aai platform server, then try again.");

package/dist/{test-C-V98oC-.mjs → test-BtOzTcXE.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as ok, n as fail } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
 import { a as errorMessage, n as binFromPackageJson, r as errorCode } from "./_utils-8KKw-bzi.mjs";
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexkroman1/aai-cli",
-  "version": "5.11.0",
+  "version": "5.12.0",
   "type": "module",
   "bin": {
     "aai": "bin.mjs"
@@ -20,6 +20,11 @@
       "@dev/source": "./typecheck.ts",
       "types": "./dist/typecheck.d.ts",
       "import": "./dist/typecheck.mjs"
+    },
+    "./project-config": {
+      "@dev/source": "./project-config.ts",
+      "types": "./dist/project-config.d.ts",
+      "import": "./dist/project-config.mjs"
     }
   },
   "files": [
@@ -38,8 +43,8 @@
     "p-timeout": "^7.0.1",
     "vite": "^8.1.5",
     "zod": "^4.4.3",
-    "@alexkroman1/aai": "5.11.0",
-    "@alexkroman1/aai-ui": "5.11.0"
+    "@alexkroman1/aai": "5.12.0",
+    "@alexkroman1/aai-ui": "5.12.0"
   },
   "devDependencies": {
     "playwright": "^1.61.1",

package/dist/_slug-api-fRNNR8tz.mjs

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-import { n as getServerInfo } from "./_agent-DS2PUJcl.mjs";
-import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-B-upMGkc.mjs";
-//#region _slug-api.ts
-/**
-* Authenticated request against a deployed agent's slug-scoped resource
-* (`${serverUrl}/${slug}${resourcePath}`) — the one shape every per-agent
-* command (secret, storage) shares, including the standard "not deployed"
-* 404 hint.
-*
-* Its own module (rather than living beside `getServerInfo` in `_agent.ts`)
-* so tests can mock `_agent.ts`/`_api-client.ts` while this composition
-* stays real — an intra-module call would bypass those mocks.
-*/
-async function slugRequest(cwd, resourcePath, init, server) {
-	const { serverUrl, slug, apiKey } = await getServerInfo(cwd, server);
-	return {
-		data: await apiRequest(`${serverUrl}/${slug}${resourcePath}`, {
-			...init,
-			apiKey,
-			hints: { 404: HINT_NOT_DEPLOYED }
-		}),
-		slug
-	};
-}
-//#endregion
-export { slugRequest as t };