@alexkroman1/aai-cli 5.11.0 → 5.13.0

package/dist/{delete-DEZ7u3u4.mjs → delete-DCRX3d96.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
-import { c as writeProjectConfig } from "./_config-DMyolIk9.mjs";
-import { i as resolveDeployTarget, n as getServerInfo } from "./_agent-DS2PUJcl.mjs";
-import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-B-upMGkc.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { l as writeProjectConfig } from "./_config-CzwAWOWr.mjs";
+import { i as resolveDeployTarget, n as getServerInfo } from "./_agent-C8Jk-ZcP.mjs";
+import { n as apiRequest, t as HINT_NOT_DEPLOYED } from "./_api-client-BX8Qv51n.mjs";
 //#region delete.ts
 async function runDelete(opts) {
 	await apiRequest(`${opts.url}/${opts.slug}`, {

package/dist/{deploy-Ch0d_jje.mjs → deploy-DjsEV-40.mjs}

@@ -1,25 +1,26 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { n as log, t as fmtUrl } from "./_ui-DfwfDbT-.mjs";
-import { a as errorMessage } from "./_utils-8KKw-bzi.mjs";
-import { t as buildAgentBundle } from "./_bundler-DC17suWN.mjs";
-import { s as updateProjectConfig } from "./_config-DMyolIk9.mjs";
-import { t as resolveServerEnv } from "./_server-common-DX8Bfrf5.mjs";
-import { i as resolveDeployTarget } from "./_agent-DS2PUJcl.mjs";
-import { assertTypechecks } from "./_typecheck-gate-DB-PY0A3.mjs";
-import { n as apiRequest } from "./_api-client-B-upMGkc.mjs";
+import { n as log, r as notify, t as fmtUrl } from "./_ui-u7T4YooX.mjs";
+import { a as errorMessage$1 } from "./_utils-0DHbcqUb.mjs";
+import { s as updateProjectConfig } from "./_config-CzwAWOWr.mjs";
+import { i as evalWorkerConfig, t as buildAgentBundle } from "./_bundler-BuIyDdvs.mjs";
+import { t as resolveServerEnv } from "./_server-common-61fL__39.mjs";
+import { i as resolveDeployTarget } from "./_agent-C8Jk-ZcP.mjs";
+import { assertTypechecks } from "./_typecheck-gate-4v9UBZHh.mjs";
+import { n as apiRequest } from "./_api-client-BX8Qv51n.mjs";
+import { i as projectNameFromDir } from "./_studio-D2ciIhbi.mjs";
+import { omitUndefined } from "@alexkroman1/aai/utils";
 import { gzipSync } from "node:zlib";
 //#region _deploy.ts
 async function runDeploy(opts) {
 	const body = gzipSync(JSON.stringify({
 		...opts.slug ? { slug: opts.slug } : {},
-		...opts.allowMissingSecrets ? { credentialPolicy: "warn" } : {},
 		...opts.allowPreviewSlug ? { allowPreviewSlug: true } : {},
 		env: opts.env,
 		worker: opts.bundle.worker,
 		clientFiles: opts.bundle.clientFiles
 	}));
-	const data = await apiRequest(`${opts.url}/deploy`, {
+	return { slug: (await apiRequest(`${opts.url}/deploy`, {
 		method: "POST",
 		body,
 		headers: {
@@ -30,13 +31,9 @@ async function runDeploy(opts) {
 		action: "deploy",
 		hints: { 413: "Your bundle is too large. Try reducing dependencies or splitting your agent." },
 		...opts.slug ? {} : { retry: 0 },
-		...opts.retryDelay !== void 0 ? { retryDelay: opts.retryDelay } : {},
+		...omitUndefined({ retryDelay: opts.retryDelay }),
 		...opts.fetch ? { fetch: opts.fetch } : {}
-	});
-	return {
-		slug: data.slug,
-		...data.warnings ? { warnings: data.warnings } : {}
-	};
+	})).slug };
 }
 //#endregion
 //#region deploy.ts
@@ -44,19 +41,24 @@ async function executeDeploy(opts) {
 	const { cwd } = opts;
 	const { config: projectConfig, serverUrl, apiKey } = await resolveDeployTarget(cwd, opts.server);
 	if (!opts.skipTypecheck) await assertTypechecks(cwd);
+	const preflightModule = import("./_preflight-BtfaYtbE.mjs");
 	const bundle = await buildAgentBundle(cwd, { minify: true });
-	const slug = projectConfig?.slug;
-	const env = await resolveServerEnv(cwd);
+	const slug = projectConfig?.slug ?? projectNameFromDir(cwd) ?? void 0;
+	const uploadEnv = {
+		ASSEMBLYAI_API_KEY: apiKey,
+		...await resolveServerEnv(cwd)
+	};
+	const { missingCredentialMessage, missingCredentials } = await preflightModule;
+	const config = await evalWorkerConfig(bundle.worker);
+	const missing = config ? missingCredentials(config, uploadEnv) : [];
+	const warnings = missing.length > 0 ? [missingCredentialMessage(missing)] : [];
+	for (const warning of warnings) notify("warn", warning);
 	log.step(`Deploying${slug ? ` ${slug}` : ""}…`);
 	const deployed = await runDeploy({
 		url: serverUrl,
 		bundle,
-		env: {
-			ASSEMBLYAI_API_KEY: apiKey,
-			...env
-		},
+		env: uploadEnv,
 		...slug ? { slug } : {},
-		...opts.allowMissingSecrets ? { allowMissingSecrets: true } : {},
 		...opts.allowPreviewSlug ? { allowPreviewSlug: true } : {},
 		apiKey
 	});
@@ -67,18 +69,17 @@ async function executeDeploy(opts) {
 			serverUrl
 		});
 	} catch (err) {
-		log.warn(`Deployed as ${deployed.slug}, but couldn't save .aai/project.json: ${errorMessage(err)}\n  Write it manually so future deploys reuse this slug:
+		log.warn(`Deployed as ${deployed.slug}, but couldn't save .aai/project.json: ${errorMessage$1(err)}\n  Write it manually so future deploys reuse this slug:
   ${JSON.stringify({
 			slug: deployed.slug,
 			serverUrl
 		})}`);
 	}
-	for (const warning of deployed.warnings ?? []) log.warn(warning);
 	log.success(`Deployed ${fmtUrl(agentUrl)}`);
 	return ok({
 		slug: deployed.slug,
 		url: agentUrl,
-		...deployed.warnings ? { warnings: deployed.warnings } : {}
+		...warnings.length > 0 ? { warnings } : {}
 	});
 }
 //#endregion

package/dist/deploy.d.ts

@@ -7,8 +7,6 @@ type DeployData = {
 export declare function executeDeploy(opts: {
     cwd: string;
     server?: string | undefined;
-    /** See DeployOpts.allowMissingSecrets (`--allow-missing-secrets`). */
-    allowMissingSecrets?: boolean | undefined;
     /** See DeployOpts.allowPreviewSlug (`--allow-preview-slug`; studio-internal). */
     allowPreviewSlug?: boolean | undefined;
     /** `--skipTypecheck`: deploy without the tsc gate. */

package/dist/{dev-CdeRcYiQ.mjs → dev-CvPH5dbF.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { i as parsePort, n as log, r as notify, t as fmtUrl } from "./_ui-DfwfDbT-.mjs";
-import { i as errorDetail } from "./_utils-8KKw-bzi.mjs";
+import { a as parsePort, n as log, r as notify, t as fmtUrl } from "./_ui-u7T4YooX.mjs";
+import { i as errorDetail } from "./_utils-0DHbcqUb.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
 //#region dev.ts
@@ -12,7 +12,7 @@ import { styleText } from "node:util";
 async function executeDev(opts) {
 	const port = parsePort(opts.port);
 	const agentName = path.basename(path.resolve(opts.cwd));
-	const { startDevServer } = await import("./_dev-server-B3ivqyEd.mjs");
+	const { startDevServer } = await import("./_dev-server-Ch7K8e8i.mjs");
 	let cleanup;
 	let shuttingDown = false;
 	const onSignal = () => {

package/dist/{eject-DSrAp8PL.mjs → eject-LgBRfnbH.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
-import { a as errorMessage, c as readJson, d as writeJson, o as fileExists } from "./_utils-8KKw-bzi.mjs";
-import { scaffoldDir } from "./_templates-DmdG-voA.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { a as errorMessage, c as readJson, d as writeJson, o as fileExists } from "./_utils-0DHbcqUb.mjs";
+import { scaffoldDir } from "./_templates-B1kt3BGt.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
 //#region eject.ts

package/dist/{init-BBAoRI_f.mjs → init-BppxMR8r.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { a as ok } from "./_output-CC300DzW.mjs";
-import { n as log, o as unwrapCancel } from "./_ui-DfwfDbT-.mjs";
-import { a as errorMessage, c as readJson, l as resolveCwd, o as fileExists, t as AGENT_ENTRY } from "./_utils-8KKw-bzi.mjs";
-import { r as isDevMode, t as getMonorepoRoot } from "./_agent-DS2PUJcl.mjs";
+import { n as log, s as unwrapCancel } from "./_ui-u7T4YooX.mjs";
+import { a as errorMessage, c as readJson, l as resolveCwd, o as fileExists, t as AGENT_ENTRY } from "./_utils-0DHbcqUb.mjs";
+import { r as isDevMode, t as getMonorepoRoot } from "./_agent-C8Jk-ZcP.mjs";
 import path from "node:path";
 import { styleText } from "node:util";
 import * as p from "@clack/prompts";
@@ -75,7 +75,7 @@ function resolveTargetDir(dir) {
 }
 /** Publish after init and return deploy metadata if successful. */
 async function tryPublish(cwd, server) {
-	const { executePublish } = await import("./studio-DPDFKZ9i.mjs");
+	const { executePublish } = await import("./studio-GSFd4s5O.mjs");
 	try {
 		const result = await executePublish({
 			cwd,
@@ -94,7 +94,7 @@ async function tryPublish(cwd, server) {
 }
 /** Scaffold the project, optionally showing a spinner. */
 async function scaffoldProject(dir, cwd, template, silent) {
-	const { runInit } = await import("./_init-5hHkHe-V.mjs");
+	const { runInit } = await import("./_init-CbkrE2wq.mjs");
 	const s = silent ? void 0 : p.spinner();
 	s?.start(`Creating ${dir}`);
 	await runInit({

package/dist/{login-BeFUiU6M.mjs → login-BQQaxJhL.mjs}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { a as ok, t as CliError } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
-import { o as updateGlobalConfig, r as readGlobalConfig, t as approveServer } from "./_config-DMyolIk9.mjs";
-import { a as resolveServerUrl } from "./_agent-DS2PUJcl.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { o as updateGlobalConfig, r as readGlobalConfig, t as approveServer } from "./_config-CzwAWOWr.mjs";
+import { a as resolveServerUrl } from "./_agent-C8Jk-ZcP.mjs";
+import { linkConfirmationCode } from "@alexkroman1/aai/utils";
 import { spawn } from "node:child_process";
 import { setTimeout } from "node:timers/promises";
 import { randomBytes } from "node:crypto";
@@ -115,18 +116,6 @@ function openerFor(platform) {
 	]];
 	return ["xdg-open", []];
 }
-/**
-* Human-matchable confirmation derived from the link code — printed in the
-* terminal AND shown on the browser approval gate (aai-studio-client's
-* cli-link.ts derives the same value; keep the two in lockstep). Not a
-* secret: both ends already hold the full code. It exists so someone who
-* lands on an approval page they didn't cause has a concrete mismatch to
-* notice ("what terminal?") instead of a bare Approve button.
-*/
-function linkConfirmationCode(code) {
-	const head = code.slice(0, 8).toUpperCase();
-	return `${head.slice(0, 4)}-${head.slice(4)}`;
-}
 /** Best-effort: the link URL is always printed, so a failure is fine. */
 function defaultOpenBrowser(url) {
 	const [cmd, args] = openerFor(process.platform);

package/dist/login.d.ts

@@ -30,15 +30,6 @@ export type LoginDeps = {
     /** Test seam — never set outside tests. */
     timeoutMs?: number;
 };
-/**
- * Human-matchable confirmation derived from the link code — printed in the
- * terminal AND shown on the browser approval gate (aai-studio-client's
- * cli-link.ts derives the same value; keep the two in lockstep). Not a
- * secret: both ends already hold the full code. It exists so someone who
- * lands on an approval page they didn't cause has a concrete mismatch to
- * notice ("what terminal?") instead of a bare Approve button.
- */
-export declare function linkConfirmationCode(code: string): string;
 export declare function executeLogin(opts: {
     server?: string | undefined;
 }, deps?: LoginDeps): Promise<CommandResult<{

package/dist/project-config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The two on-disk formats a CLI invocation reads, as WRITERS other packages
+ * can call — the config home (`config.json`, which holds the API key) and a
+ * project's `.aai/project.json` pin.
+ *
+ * It exists for the studio guest. Publish materializes a workspace into a
+ * real project and then spawns this CLI against it
+ * (`aai-guest/studio-publish.ts`), which means writing both files first; it
+ * used to do that with `JSON.stringify`, so the shapes agreed by coincidence
+ * and nothing tied them to the schemas the CLI parses them back with. Two of
+ * this file's properties are not obvious from the JSON and were absent from
+ * the hand-written copies' successors-in-waiting: the config home is written
+ * 0600 through an atomic rename (so an older world-readable file is
+ * TIGHTENED rather than left), and the project pin is MERGED, never
+ * replaced — `.aai/project.json` also carries the studio link fields, and a
+ * writer that replaces the document drops them.
+ *
+ * Deliberately a thin re-export of `_config.ts` rather than a second
+ * implementation: the point is that there is one writer per format, not that
+ * there is a nicer one here.
+ */
+export type { GlobalConfig, ProjectConfig } from "./_config.ts";
+export { updateProjectConfig, writeGlobalConfig as writeConfigHome } from "./_config.ts";

package/dist/project-config.mjs

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { c as writeGlobalConfig, s as updateProjectConfig } from "./_config-CzwAWOWr.mjs";
+export { updateProjectConfig, writeGlobalConfig as writeConfigHome };

package/dist/scaffold/CLAUDE.md

@@ -205,9 +205,9 @@ that stage — the rest keep the default.
 from `@alexkroman1/aai`, next to `agent()`) selects AssemblyAI's
 speech-to-speech Voice Agent API: STT, the LLM loop, and TTS run
 service-side in one socket. Fewer moving parts, but you cannot choose the
-model, swap a provider, or tune a stage. There is no way to reach S2S by
-omission — only the `s2s` field selects it, and it is mutually exclusive
-with the `stt`/`llm`/`tts` triple.
+model or swap a provider. There is no way to reach S2S by omission — only
+the `s2s` field selects it, and it is mutually exclusive with the
+`stt`/`llm`/`tts` triple.
 
 ```ts
 import { agent, assemblyAIS2s } from "@alexkroman1/aai";
@@ -218,6 +218,33 @@ export default agent({
 });
 ```
 
+The descriptor takes three optional knobs, all forwarded only when set:
+
+```ts
+import { agent, assemblyAIS2s } from "@alexkroman1/aai";
+
+export default agent({
+  name: "My Agent",
+  sttPrompt: "Callers spell order numbers one character at a time.",
+  s2s: assemblyAIS2s({
+    voice: "michael",
+    languages: ["en"],
+    keyterms: ["Acme Rewards", "SKU"],
+  }),
+});
+```
+
+- `voice` — the agent's voice. Unset uses the service default.
+- `languages` — **leave it unset for multilingual calls**: unset means
+  "detect per turn", so pinning `["en"]` on a line that takes other
+  languages disables detection for every caller. Pin it when the line
+  really is monolingual — on a benchmark run that plus a transcription
+  prompt took a caller's spelled first name from 1 of 6 attempts correct
+  to 6 of 6.
+- `keyterms` — product names and proper nouns to bias transcription
+  toward. Use `sttPrompt` (above, and honoured in **both** modes) for
+  prose guidance and `keyterms` for a term list.
+
 **Prefer pipeline mode** — the default — unless the user specifically
 asks for the speech-to-speech API. Nearly every template ships this way, and
 it is what AssemblyAI Build defaults to. The host runs the LLM loop locally
@@ -444,6 +471,28 @@ ctx.messages: readonly Message[]               // conversation history [{role, c
 ctx.sessionId: string                          // unique session ID
 ctx.send(event: string, data: unknown): void   // push custom event to browser client (silently dropped over 64 KB JSON)
 ctx.generate(opts): Promise<{ text, object? }> // one-shot LLM call (host-side)
+                                               // with a `schema`, `object` is REQUIRED and typed by it
+ctx.signal: AbortSignal                        // aborts on barge-in, reset, session stop, or this call's timeout
+```
+
+**Pass `ctx.signal` to anything slow.** It is always present — no `?.`
+needed — and forwarding it is what makes a tool stop work the caller has
+already interrupted:
+
+```ts
+import { tool } from "@alexkroman1/aai";
+import { z } from "zod";
+
+export const lookup = tool({
+  description: "Look up an order",
+  inputSchema: z.object({ id: z.string() }),
+  execute: async ({ id }, ctx) => {
+    const res = await fetch(`https://api.example.com/orders/${id}`, {
+      signal: ctx.signal,
+    });
+    return await res.json();
+  },
+});
 ```
 
 **Typing `ctx.state` is optional.** `ctx.state` is untyped by default, and
@@ -632,9 +681,10 @@ export default agent({
 
 ## Built-in tools
 
-Enable via `builtinTools` in `agent()`. When `builtinTools` is omitted, the
-cognitive defaults (`think`, `remember`, `recall`, `calculate`) are enabled;
-set `builtinTools` explicitly (including `[]`) to override.
+Enable via `builtinTools` in `agent()`. **When `builtinTools` is omitted, none
+are enabled** — omitting the field and passing `[]` mean the same thing. Name
+the ones you want; a built-in is something an agent asks for rather than
+something it has to notice and switch off.
 
 | Tool | Description | Params |
 | --- | --- | --- |
@@ -643,10 +693,10 @@ set `builtinTools` explicitly (including `[]`) to override.
 | `get_page_design` | Fetch URL's raw HTML + CSS (style blocks and linked stylesheets) to study/mimic a site's design | `url` |
 | `fetch_json` | HTTP GET a JSON API | `url`, `headers?` |
 | `run_code` | Execute JS in the agent's sandbox — same authority as the agent's own tool code, output is what it logs (5s timeout) | `code` |
-| `think` | Private reasoning scratchpad, no side effects (on by default) | `thought` |
-| `remember` | Save a confirmed fact to session notes (on by default) | `key`, `value` |
-| `recall` | Read session notes saved with `remember` (on by default) | `key?` |
-| `calculate` | Safe arithmetic evaluator, no code execution (on by default) | `expression` |
+| `think` | Private reasoning scratchpad, no side effects | `thought` |
+| `remember` | Save a confirmed fact to session notes | `key`, `value` |
+| `recall` | Read session notes saved with `remember` | `key?` |
+| `calculate` | Safe arithmetic evaluator, no code execution | `expression` |
 
 **Every builtin in this table is a tool the MODEL calls — not a function
 your code can call.** Listing one in `builtinTools` adds it to the model's

package/dist/scaffold/package.json

@@ -12,15 +12,15 @@
     "publish:agent": "aai publish"
   },
   "dependencies": {
-    "@alexkroman1/aai": "^5.11.0",
-    "@alexkroman1/aai-ui": "^5.11.0",
+    "@alexkroman1/aai": "^5.13.0",
+    "@alexkroman1/aai-ui": "^5.13.0",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "tailwindcss": "^4.0.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@alexkroman1/aai-cli": "^5.11.0",
+    "@alexkroman1/aai-cli": "^5.13.0",
     "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",

package/dist/{secret-4_dYyrpA.mjs → secret-Ds9dvqAj.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { a as ok, n as fail } from "./_output-CC300DzW.mjs";
-import { n as log, o as unwrapCancel } from "./_ui-DfwfDbT-.mjs";
-import { t as slugRequest } from "./_slug-api-fRNNR8tz.mjs";
+import { n as log, s as unwrapCancel } from "./_ui-u7T4YooX.mjs";
+import { t as secretRequest } from "./_slug-api-D30zPmsn.mjs";
 import * as p from "@clack/prompts";
 import { text } from "node:stream/consumers";
 //#region secret.ts
@@ -29,24 +29,24 @@ async function executeSecretPut(cwd, name, value, server) {
 		if (!result) return fail(...NO_INPUT);
 		secretValue = result;
 	}
-	const { slug } = await slugRequest(cwd, "/secret", {
+	const { target } = await secretRequest(cwd, "", {
 		method: "PUT",
 		body: { [name]: secretValue },
 		action: "secret"
 	}, server);
-	log.success(`Set ${name} for ${slug}`);
+	log.success(`Set ${name} for ${target}`);
 	return ok({ name });
 }
 async function executeSecretDelete(cwd, name, server) {
-	const { slug } = await slugRequest(cwd, `/secret/${encodeURIComponent(name)}`, {
+	const { target } = await secretRequest(cwd, `/${encodeURIComponent(name)}`, {
 		method: "DELETE",
 		action: "secret"
 	}, server);
-	log.success(`Deleted ${name} from ${slug}`);
+	log.success(`Deleted ${name} from ${target}`);
 	return ok({ name });
 }
 async function executeSecretList(cwd, server) {
-	const { data: { vars } } = await slugRequest(cwd, "/secret", { action: "secret" }, server);
+	const { data: { vars } } = await secretRequest(cwd, "", { action: "secret" }, server);
 	if (vars.length === 0) log.info("No secrets set. Use `aai secret put <name>` to add one.");
 	else {
 		log.message(`${vars.length} secret${vars.length === 1 ? "" : "s"}:`);

package/dist/{storage-BTfErOOW.mjs → storage-DbrQSHFk.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { a as ok, n as fail } from "./_output-CC300DzW.mjs";
-import { n as log } from "./_ui-DfwfDbT-.mjs";
-import { t as slugRequest } from "./_slug-api-fRNNR8tz.mjs";
+import { n as log } from "./_ui-u7T4YooX.mjs";
+import { n as slugRequest } from "./_slug-api-D30zPmsn.mjs";
 import * as p from "@clack/prompts";
 //#region storage.ts
 async function storageRequest(cwd, init, server) {