@alexkroman1/aai-cli 6.10.1 → 7.0.0

package/dist/{_agent-DpH2pBJd.mjs → _agent-BTwZJu4P.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { a as serverOrigin, i as readProjectConfig, n as ensureApiKey, r as readGlobalConfig, t as approveServer } from "./_config-D_s09e7g.mjs";
+import { a as serverOrigin, i as readProjectConfig, n as ensureApiKey, r as readGlobalConfig, t as approveServer } from "./_config-CmJOFsAP.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { VALID_SLUG_RE } from "@alexkroman1/aai/utils";
+import { VALID_SLUG_RE } from "@alexkroman1/aai/internal";
 //#region _agent.ts
 const DEFAULT_SERVER = "https://alexkroman--aai-server-web-server.modal.run";
 const DEFAULT_DEV_SERVER = "http://localhost:8080";

package/dist/{_bundler-C2BDwU7r.mjs → _bundler-B4RqNF5Z.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { f as validateAgentExport } from "./_utils-B8QmtFhK.mjs";
-import { t as buildClient } from "./client-bundler-BEIqgOtd.mjs";
-import { n as buildWorkflows, t as buildWorker } from "./worker-bundler-CGD4r8Kc.mjs";
+import { t as buildClient } from "./client-bundler-CWnG42cU.mjs";
+import { n as buildWorkflows, t as buildWorker } from "./worker-bundler-COxnqstQ.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { omitUndefined } from "@alexkroman1/aai/utils";

package/dist/_dev-env.d.ts

@@ -9,9 +9,13 @@
  * (who may connect, where it binds, whether it restarts), so they are read from
  * the environment on purpose and must never leak into `ctx.env`.
  *
- * Split out of `_dev-server.ts` purely to keep that module under the
- * file-length cap; it is the only consumer.
+ * `createDevLogger` sits here for the second half of that reason rather than
+ * the first: it is not a control variable, it READS one — the same auto-
+ * detected JSON mode — to decide where the runtime's diagnostics go. Both
+ * were split out of `_dev-server.ts` to keep it under the file-length cap,
+ * and `_dev-server.ts` is the only consumer of either.
  */
+import type { Logger } from "@alexkroman1/aai-runtime";
 /**
  * The env handed to `createServer` for host-mode connections: provider
  * credentials plus the `AAI_ALLOW_HOST` gate read straight from the shell
@@ -36,3 +40,19 @@ export declare function devBindHost(): string | undefined;
  * as a provider failure several records deep.
  */
 export declare function devWatchEnabled(): boolean;
+/**
+ * The logger the dev server's runtime writes through.
+ *
+ * The SDK's default logger is console-backed and `console.log` is STDOUT, so
+ * in JSON mode the runtime's own diagnostics — the multi-line "Session mode
+ * resolved" dump at startup, every later warning — landed on stdout ahead of
+ * the single result line `aai dev` promises there. JSON mode is AUTO-DETECTED
+ * on a pipe, so that is the normal case rather than an opt-in one:
+ * `aai dev > dev.log`, a process supervisor, a container. It is the same
+ * hazard `notify` exists for, one layer down: `silenceOutput()` only reaches
+ * this CLI's own `log`, and the runtime is not using it.
+ *
+ * Human mode keeps the console logger exactly as it was — a TTY has nothing
+ * to parse, and stdout is where people are already reading these.
+ */
+export declare function createDevLogger(silenced: boolean): Logger;

package/dist/{_dev-server-LLLWnFBs.mjs → _dev-server-CiKFH9qw.mjs}

@@ -1,37 +1,25 @@
 #!/usr/bin/env node
 import { i as outputSilenced, r as notify } from "./_ui-u7T4YooX.mjs";
 import { i as errorCode, o as errorMessage$1 } from "./_utils-B8QmtFhK.mjs";
-import { n as fallbackHtmlPlugin } from "./client-bundler-BEIqgOtd.mjs";
+import { n as fallbackHtmlPlugin } from "./client-bundler-CWnG42cU.mjs";
 import { t as DEDUPED_PEERS } from "./_vite-env-BNveawd1.mjs";
-import { n as buildWorkflows, t as buildWorker } from "./worker-bundler-CGD4r8Kc.mjs";
-import { n as ensureApiKey } from "./_config-D_s09e7g.mjs";
-import { n as createWorkerEvaluator } from "./_bundler-C2BDwU7r.mjs";
+import { n as buildWorkflows, t as buildWorker } from "./worker-bundler-COxnqstQ.mjs";
+import { n as ensureApiKey } from "./_config-CmJOFsAP.mjs";
+import { n as createWorkerEvaluator } from "./_bundler-B4RqNF5Z.mjs";
 import { t as resolveServerEnv } from "./_server-common-6e0QI4mq.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { omitUndefined } from "@alexkroman1/aai/utils";
 import { createCoalescingRunner, sleep } from "@alexkroman1/aai/internal";
-import { WORKFLOW_API_PREFIX, configureWorkflowWorld, consoleLogger, createRuntime, createServer, createWorkflowSurface, handleWorkflowRequest, publishStepEnv, requiredProviderEnvVars, startWorkflowWorldIfDeclared, withHostCredentialFallback } from "@alexkroman1/aai/runtime";
+import { agentConfigWarnings } from "@alexkroman1/aai/manifest";
+import { WORKFLOW_API_PREFIX, createRuntime, createServer, requiredProviderEnvVars, withHostCredentialFallback } from "@alexkroman1/aai-runtime";
+import { configureWorkflowWorld, consoleLogger, createWorkflowSurface, handleWorkflowRequest, publishStepEnv, startWorkflowWorldIfDeclared } from "@alexkroman1/aai-runtime/internal";
 import { defaultClientDir } from "@alexkroman1/aai-ui/client-dir";
 import { watch } from "chokidar";
 import getPort, { portNumbers } from "get-port";
 import pDebounce from "p-debounce";
 //#region _dev-env.ts
 /**
-* The dev server's CONTROL variables — the three things read straight from the
-* shell rather than from the agent's `.env`.
-*
-* That distinction is the reason these live together. `resolveServerEnv` builds
-* `ctx.env` from `.env`-declared keys only, deliberately, so an agent cannot
-* come to depend on a shell variable that will not exist after deploy. These
-* three are not agent config at all — they configure the *dev server process*
-* (who may connect, where it binds, whether it restarts), so they are read from
-* the environment on purpose and must never leak into `ctx.env`.
-*
-* Split out of `_dev-server.ts` purely to keep that module under the
-* file-length cap; it is the only consumer.
-*/
-/**
 * The env handed to `createServer` for host-mode connections: provider
 * credentials plus the `AAI_ALLOW_HOST` gate read straight from the shell
 * (it is a control variable, not something an agent declares in `.env`).
@@ -66,6 +54,33 @@ function devBindHost() {
 function devWatchEnabled() {
 	return /^(1|true|yes|on)$/i.test(process.env.AAI_DEV_WATCH?.trim() ?? "");
 }
+/**
+* The logger the dev server's runtime writes through.
+*
+* The SDK's default logger is console-backed and `console.log` is STDOUT, so
+* in JSON mode the runtime's own diagnostics — the multi-line "Session mode
+* resolved" dump at startup, every later warning — landed on stdout ahead of
+* the single result line `aai dev` promises there. JSON mode is AUTO-DETECTED
+* on a pipe, so that is the normal case rather than an opt-in one:
+* `aai dev > dev.log`, a process supervisor, a container. It is the same
+* hazard `notify` exists for, one layer down: `silenceOutput()` only reaches
+* this CLI's own `log`, and the runtime is not using it.
+*
+* Human mode keeps the console logger exactly as it was — a TTY has nothing
+* to parse, and stdout is where people are already reading these.
+*/
+function createDevLogger(silenced) {
+	if (!silenced) return consoleLogger;
+	const write = (msg, ctx) => {
+		process.stderr.write(`${msg}${ctx === void 0 ? "" : ` ${JSON.stringify(ctx)}`}\n`);
+	};
+	return {
+		info: write,
+		warn: write,
+		error: write,
+		debug: () => void 0
+	};
+}
 //#endregion
 //#region _dev-restart.ts
 /**
@@ -237,6 +252,7 @@ async function resolveAgentEnv(root, agentDef) {
 	const hasShellKey = Boolean(process.env.ASSEMBLYAI_API_KEY);
 	if (required.includes("ASSEMBLYAI_API_KEY") && !env.ASSEMBLYAI_API_KEY && !hasShellKey) env.ASSEMBLYAI_API_KEY = await ensureApiKey();
 	for (const warning of agentEnvWarnings(agentDef, env)) notify("warn", warning);
+	for (const warning of agentConfigWarnings(agentDef)) notify("warn", warning);
 	return env;
 }
 /**
@@ -260,9 +276,11 @@ async function resolveAgentEnv(root, agentDef) {
 * without starting a builder.
 */
 async function loadWorker(cwd, evaluate) {
+	const workflows = await buildWorkflows(cwd);
+	for (const warning of workflows?.warnings ?? []) notify("warn", warning);
 	return evaluate(await buildWorker(cwd, {
 		runtime: false,
-		workflows: await buildWorkflows(cwd)
+		workflows
 	}));
 }
 /**
@@ -284,33 +302,6 @@ function isIgnoredPath(dir, filePath) {
 	});
 }
 /**
-* The logger the dev server's runtime writes through.
-*
-* The SDK's default logger is console-backed and `console.log` is STDOUT, so
-* in JSON mode the runtime's own diagnostics — the multi-line "Session mode
-* resolved" dump at startup, every later warning — landed on stdout ahead of
-* the single result line `aai dev` promises there. JSON mode is AUTO-DETECTED
-* on a pipe, so that is the normal case rather than an opt-in one:
-* `aai dev > dev.log`, a process supervisor, a container. It is the same
-* hazard `notify` exists for, one layer down: `silenceOutput()` only reaches
-* this CLI's own `log`, and the runtime is not using it.
-*
-* Human mode keeps the console logger exactly as it was — a TTY has nothing
-* to parse, and stdout is where people are already reading these.
-*/
-function createDevLogger(silenced) {
-	if (!silenced) return consoleLogger;
-	const write = (msg, ctx) => {
-		process.stderr.write(`${msg}${ctx === void 0 ? "" : ` ${JSON.stringify(ctx)}`}\n`);
-	};
-	return {
-		info: write,
-		warn: write,
-		error: write,
-		debug: () => void 0
-	};
-}
-/**
 * Watch the agent directory for changes and call `onChange` when detected.
 * Debounces to avoid rapid restarts. Uses chokidar for reliable recursive
 * watching across platforms (raw `fs.watch` misses events on Linux).

package/dist/_dev-server.d.ts

@@ -7,7 +7,6 @@
  * client SPA HMR.
  */
 import type { AgentDef } from "@alexkroman1/aai";
-import { type Logger } from "@alexkroman1/aai/runtime";
 import { type FSWatcher } from "chokidar";
 import { type EvaluatedWorker } from "./_bundler.ts";
 /**
@@ -55,22 +54,6 @@ export declare function loadWorker(cwd: string, evaluate: (code: string) => Prom
  * restart the server with the new values.
  */
 export declare function isIgnoredPath(dir: string, filePath: string): boolean;
-/**
- * The logger the dev server's runtime writes through.
- *
- * The SDK's default logger is console-backed and `console.log` is STDOUT, so
- * in JSON mode the runtime's own diagnostics — the multi-line "Session mode
- * resolved" dump at startup, every later warning — landed on stdout ahead of
- * the single result line `aai dev` promises there. JSON mode is AUTO-DETECTED
- * on a pipe, so that is the normal case rather than an opt-in one:
- * `aai dev > dev.log`, a process supervisor, a container. It is the same
- * hazard `notify` exists for, one layer down: `silenceOutput()` only reaches
- * this CLI's own `log`, and the runtime is not using it.
- *
- * Human mode keeps the console logger exactly as it was — a TTY has nothing
- * to parse, and stdout is where people are already reading these.
- */
-export declare function createDevLogger(silenced: boolean): Logger;
 /**
  * Watch the agent directory for changes and call `onChange` when detected.
  * Debounces to avoid rapid restarts. Uses chokidar for reliable recursive

package/dist/{_init-C57bWAQ8.mjs → _init-CE4HKdgV.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { c as isEexist, l as readJson, p as writeJson } from "./_utils-B8QmtFhK.mjs";
-import { r as isDevMode, t as getMonorepoRoot } from "./_agent-DpH2pBJd.mjs";
-import { REPO_URL, downloadAndMergeTemplate } from "./_templates-Dxb_P2Wz.mjs";
+import { r as isDevMode, t as getMonorepoRoot } from "./_agent-BTwZJu4P.mjs";
+import { REPO_URL, downloadAndMergeTemplate } from "./_templates-FI3xPEMj.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
 //#region _init.ts
@@ -46,6 +46,7 @@ aai secret delete MY_KEY # Remove a secret
 const WORKSPACE_PKG_DIRS = {
 	"@alexkroman1/aai": "aai",
 	"@alexkroman1/aai-cli": "aai-cli",
+	"@alexkroman1/aai-runtime": "aai-runtime",
 	"@alexkroman1/aai-ui": "aai-ui"
 };
 /** Rewrite workspace deps to link: paths so pnpm links to local source. */

package/dist/{_preflight-BtfaYtbE.mjs → _preflight-Co1G9Jww.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { requiredProviderEnvVars } from "@alexkroman1/aai/runtime";
+import { requiredProviderEnvVars } from "@alexkroman1/aai-runtime";
 //#region _preflight.ts
 /**
 * The deploy-time credential preflight — the classic dev/prod failure, caught

package/dist/_preflight.d.ts

@@ -22,7 +22,7 @@
  * accuracy, and a false rejection is worse than a false warning: it blocks a
  * deploy that would have worked.
  */
-import { requiredProviderEnvVars } from "@alexkroman1/aai/runtime";
+import { requiredProviderEnvVars } from "@alexkroman1/aai-runtime";
 /**
  * The config shape read out of a bundle's `__aaiConfig` export: the provider
  * descriptors the credential derivation needs, plus the agent's declared

package/dist/{_slug-api-BxrsJXVI.mjs → _slug-api-nRFaBEPJ.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { n as getServerInfo } from "./_agent-DpH2pBJd.mjs";
-import { l as HINT_NOT_DEPLOYED, s as studioProjectApiUrl, u as apiRequest } from "./_studio-U3jhKlA3.mjs";
+import { n as getServerInfo } from "./_agent-BTwZJu4P.mjs";
+import { l as HINT_NOT_DEPLOYED, s as studioProjectApiUrl, u as apiRequest } from "./_studio-DR5yzZ1T.mjs";
 //#region _slug-api.ts
 /**
 * Authenticated request against a deployed agent's slug-scoped resource

package/dist/{_studio-U3jhKlA3.mjs → _studio-DR5yzZ1T.mjs}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { t as CliError } from "./_output-CKkmWs7i.mjs";
 import path from "node:path";
-import { MAX_SLUG_LENGTH, PREVIEW_SLUG_SUFFIX, VALID_SLUG_RE, isRecord, omitUndefined } from "@alexkroman1/aai/utils";
+import { isRecord, omitUndefined } from "@alexkroman1/aai/utils";
+import { MAX_SLUG_LENGTH, PREVIEW_SLUG_SUFFIX, VALID_SLUG_RE } from "@alexkroman1/aai/internal";
 import { FetchError, ofetch } from "ofetch";
 import { slugifyName } from "@alexkroman1/aai/slugify";
 import { isLocalOnlyFile, snapshotWorkspaceFiles } from "@alexkroman1/aai/workspace-files";

package/dist/{_templates-Dxb_P2Wz.mjs → _templates-FI3xPEMj.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { o as errorMessage$1 } from "./_utils-B8QmtFhK.mjs";
-import { t as getMonorepoRoot } from "./_agent-DpH2pBJd.mjs";
+import { t as getMonorepoRoot } from "./_agent-BTwZJu4P.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { isRecord } from "@alexkroman1/aai/utils";

package/dist/_workflow-scan.d.ts

@@ -0,0 +1,108 @@
+/**
+ * What the BUILT flow bundle carries — the two scans that read it, and the
+ * checks over them.
+ *
+ * Split out of `workflow-bundler.ts` when that file crossed the 500-line cap,
+ * along the seam the two scans already share: both read the same artifact after
+ * the builder has written it, both attribute a line to a module through
+ * esbuild's `// <path>` headers, and neither has anything to do with
+ * CONFIGURING the build. One of them fails the build (a `require` the workflow
+ * VM cannot answer) and the other warns (a call that replays differently), which
+ * is the only real difference between them.
+ *
+ * Internal: `workflow-bundler.ts` is the surface the studio and the CLI's own
+ * build call, and it re-exports nothing from here that they need.
+ *
+ * @module _workflow-scan
+ */
+/** One `require` the workflow VM cannot answer, and the module it was written for. */
+export type VmRequireSite = {
+    /** The module specifier — `node:child_process`. */
+    specifier: string;
+    /** The bundled file esbuild attributed it to, or `undefined` when it said none. */
+    module: string | undefined;
+};
+/**
+ * Find the Node builtins a flow bundle would `require` at load.
+ *
+ * The flow bundle is compiled in a `node:vm` `Script` whose context has
+ * `module` and `exports` and **no `require`**, so one of these is a run that
+ * dies at replay with `ReferenceError: require is not defined` — never a build
+ * failure, and never a symptom before the first run. The WDK's own builder
+ * bundles everything for exactly this reason and carries
+ * `createNodeModuleErrorPlugin` to reject a builtin import at build time.
+ *
+ * That plugin has two blind spots this scan covers, and both are the DEPLOYED
+ * shape rather than an exotic one:
+ *
+ * - It reports a violation only when it can point at the import LINE in a
+ *   first-party file, matched with a single-line regex — so a multi-line
+ *   `import {\n  x,\n} from "pkg"` finds nothing and the builtin is marked
+ *   external in silence.
+ * - It resolves that file against `process.cwd()`, which is not the project
+ *   being built when the studio builds a workspace, so the read fails and the
+ *   same silent path is taken.
+ *
+ * Both were reproduced. What reaches the VM either way is
+ * `var import_node_child_process = require("node:child_process");` at the top
+ * of the bundle, i.e. every run of every workflow in the project fails, and the
+ * stack names a line of generated code inside a dependency.
+ *
+ * Restricted to builtin specifiers deliberately: those are the only ones this
+ * builder leaves external (it marks nothing else so, precisely so nothing can
+ * need a `require`), and a narrow set is what keeps the scan from reading the
+ * text of a prompt as a violation.
+ *
+ * @internal
+ */
+export declare function findVmRequires(workflowCode: string): VmRequireSite[];
+/** One replay-unsafe call the flow bundle carries, and where it came from. */
+export type ReplayUnsafeSite = {
+    /** The call, as written — `Date.now(`. */
+    call: string;
+    /** What it does on a replay, and what to do instead. */
+    fix: string;
+    /** The project file esbuild attributed it to. */
+    module: string;
+};
+/**
+ * Replay-unsafe calls the flow bundle carries, attributed to the project's OWN
+ * `workflows/` files.
+ *
+ * Attribution is the whole design. The bundle inlines every non-external
+ * dependency a workflow module imports — zod, a markdown parser, whatever — and
+ * third-party code is full of `Date.now()` on paths a workflow never reaches, so
+ * a scan of the bundle's text reports a library and blocks a correct project.
+ * esbuild writes a `// <path>` header per module (the same one
+ * {@link findVmRequires} reads), so lines can be charged to the file they were
+ * written in, and only the project's own workflow sources are read.
+ *
+ * Scanning the BUNDLE rather than the sources is what makes a `"use step"` body
+ * exempt for free: the workflow-mode transform has already removed them, so
+ * what is left is the part that really does replay.
+ *
+ * @internal
+ */
+export declare function findReplayUnsafeCalls(workflowCode: string): ReplayUnsafeSite[];
+/**
+ * The warning `aai build` and `aai dev` print for a replay-unsafe call.
+ *
+ * A WARNING and not a build failure, deliberately. The attribution above makes
+ * the scan accurate about which FILE a call is in, and it cannot know whether a
+ * plain function in a `workflows/` module is reached from a body (where the
+ * rule bites) or only from a step (where it does not) — so the one thing it
+ * must not do is refuse a correct project. A silent build was the actual
+ * problem; a line naming the file solves it without that risk.
+ */
+export declare function replayWarnings(workflowCode: string): string[];
+/**
+ * Fail the build when the flow bundle carries a `require` — see
+ * {@link findVmRequires} for what that means and why nothing upstream catches it.
+ *
+ * The message has to name the MODULE as well as the specifier, because the
+ * import that caused it is not in the file an author is looking at: only a
+ * `"use step"` body is stripped from this bundle, so a value a `workflows/`
+ * module holds at module scope — an exported helper, a constant — keeps its
+ * import, and that import's whole graph rides into the VM.
+ */
+export declare function assertNoVmRequires(workflowCode: string): void;

package/dist/{build-Dfza2pRI.mjs → build-6jfaakgc.mjs}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { a as ok, t as CliError } from "./_output-CKkmWs7i.mjs";
-import { n as log } from "./_ui-u7T4YooX.mjs";
-import { r as evalWorkerBundle, t as buildAgentBundle } from "./_bundler-C2BDwU7r.mjs";
+import { n as log, r as notify } from "./_ui-u7T4YooX.mjs";
+import { r as evalWorkerBundle, t as buildAgentBundle } from "./_bundler-B4RqNF5Z.mjs";
 import { assertTypechecks } from "./_typecheck-gate-BXvUNnfs.mjs";
 import { classifyVitestError, runVitest } from "./test-9kPKJI-w.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
+import { agentConfigWarnings } from "@alexkroman1/aai/manifest";
 //#region build.ts
 /**
 * `aai build` — bundle the agent without deploying, behind the same gates
@@ -47,7 +48,9 @@ async function executeBuild(opts) {
 	}
 	if (!opts.skipTypecheck) await assertTypechecks(cwd);
 	const bundle = await buildAgentBundle(cwd, { minify: true });
+	for (const warning of bundle.workflows?.warnings ?? []) notify("warn", warning);
 	const agentDef = await evalWorkerBundle(bundle.worker);
+	for (const warning of agentConfigWarnings(agentDef)) notify("warn", warning);
 	const worker = path.join(cwd, WORKER_ARTIFACT_REL);
 	await fs.mkdir(path.dirname(worker), { recursive: true });
 	await fs.writeFile(worker, bundle.worker, "utf-8");

package/dist/cli.mjs

@@ -250,7 +250,7 @@ const list = defineExec({
 	},
 	cwd: "any",
 	async run({ args, cwd }) {
-		const { executeList } = await import("./studio-BCNUpDgP.mjs");
+		const { executeList } = await import("./studio--MUV0cid.mjs");
 		return executeList({
 			cwd,
 			server: args.server
@@ -283,7 +283,7 @@ const pull = defineExec({
 	},
 	cwd: "any",
 	async run({ args, cwd }) {
-		const { executePull } = await import("./studio-BCNUpDgP.mjs");
+		const { executePull } = await import("./studio--MUV0cid.mjs");
 		return executePull({
 			cwd,
 			project: args.project,
@@ -309,7 +309,7 @@ const push = defineExec({
 	},
 	cwd: "agent",
 	async run({ args, cwd }) {
-		const { executePush } = await import("./studio-BCNUpDgP.mjs");
+		const { executePush } = await import("./studio--MUV0cid.mjs");
 		return executePush({
 			cwd,
 			server: args.server,
@@ -337,7 +337,7 @@ const publish = defineExec({
 	},
 	cwd: "agent",
 	async run({ args, cwd }) {
-		const { executePublish } = await import("./studio-BCNUpDgP.mjs");
+		const { executePublish } = await import("./studio--MUV0cid.mjs");
 		return executePublish({
 			cwd,
 			server: args.server,
@@ -404,7 +404,7 @@ const workflow = defineCommand({
 			args: workflowArgs,
 			cwd: WORKFLOW_CWD,
 			async run({ args, cwd }) {
-				const { executeWorkflowList } = await import("./workflow-CFpxOFfQ.mjs");
+				const { executeWorkflowList } = await import("./workflow-D2AQf2Pl.mjs");
 				return executeWorkflowList(cwd, {
 					server: args.server,
 					token: args.token
@@ -430,7 +430,7 @@ const workflow = defineCommand({
 			},
 			cwd: WORKFLOW_CWD,
 			async run({ args, cwd }) {
-				const { executeWorkflowRuns } = await import("./workflow-CFpxOFfQ.mjs");
+				const { executeWorkflowRuns } = await import("./workflow-D2AQf2Pl.mjs");
 				const limit = args.limit === void 0 ? void 0 : Number(args.limit);
 				if (limit !== void 0 && !Number.isFinite(limit)) throw new CliError("bad_limit", "--limit must be a number");
 				return executeWorkflowRuns(cwd, args.workflow, {
@@ -451,7 +451,7 @@ const workflow = defineCommand({
 			},
 			cwd: WORKFLOW_CWD,
 			async run({ args, cwd }) {
-				const { executeWorkflowShow } = await import("./workflow-CFpxOFfQ.mjs");
+				const { executeWorkflowShow } = await import("./workflow-D2AQf2Pl.mjs");
 				return executeWorkflowShow(cwd, args.runId, {
 					server: args.server,
 					token: args.token
@@ -469,7 +469,7 @@ const workflow = defineCommand({
 			},
 			cwd: WORKFLOW_CWD,
 			async run({ args, cwd }) {
-				const { executeWorkflowCancel } = await import("./workflow-CFpxOFfQ.mjs");
+				const { executeWorkflowCancel } = await import("./workflow-D2AQf2Pl.mjs");
 				return executeWorkflowCancel(cwd, args.runId, {
 					server: args.server,
 					token: args.token
@@ -545,7 +545,7 @@ const init = defineExec({
 	},
 	cwd: "none",
 	async run({ args, mode }) {
-		const { executeInit } = await import("./init-l6xfU4xX.mjs");
+		const { executeInit } = await import("./init-CpJVjEg0.mjs");
 		return executeInit({
 			dir: args.dir,
 			force: args.force,
@@ -572,7 +572,7 @@ const dev = defineExec({
 	},
 	cwd: "agent",
 	async run({ args, cwd }) {
-		const { executeDev } = await import("./dev-Uq5ujP8a.mjs");
+		const { executeDev } = await import("./dev-B59JIfWO.mjs");
 		return executeDev({
 			cwd,
 			port: args.port
@@ -609,7 +609,7 @@ const build = defineExec({
 	},
 	cwd: "agent",
 	async run({ args, cwd }) {
-		const { executeBuild } = await import("./build-Dfza2pRI.mjs");
+		const { executeBuild } = await import("./build-6jfaakgc.mjs");
 		return executeBuild({
 			cwd,
 			skipTests: args.skipTests,
@@ -632,7 +632,7 @@ const eject = defineExec({
 	},
 	cwd: "agent",
 	async run({ args, cwd }) {
-		const { executeEject } = await import("./eject-31gjtaHF.mjs");
+		const { executeEject } = await import("./eject-C9WJyyr2.mjs");
 		return executeEject({
 			cwd,
 			force: args.force
@@ -659,7 +659,7 @@ const deploy = defineExec({
 	},
 	cwd: "agent",
 	async run({ args, cwd }) {
-		const { executeDeploy } = await import("./deploy-B8lubiRT.mjs");
+		const { executeDeploy } = await import("./deploy-DvYeD8ia.mjs");
 		return executeDeploy({
 			cwd,
 			server: args.server,
@@ -679,7 +679,7 @@ const del = defineExec({
 	},
 	cwd: "any",
 	async run({ args, cwd }) {
-		const { executeDelete } = await import("./delete-vbpjGzqs.mjs");
+		const { executeDelete } = await import("./delete-Dl_LSfvI.mjs");
 		return executeDelete({
 			cwd,
 			server: args.server
@@ -708,7 +708,7 @@ const secret = defineCommand({
 			},
 			cwd: "any",
 			async run({ args, mode, cwd }) {
-				const { executeSecretPut, NO_INPUT, readStdin } = await import("./secret-BuMuFR4B.mjs");
+				const { executeSecretPut, NO_INPUT, readStdin } = await import("./secret-CVvSLIDV.mjs");
 				const value = mode === "json" ? await readStdin() : void 0;
 				if (mode === "json" && !value) throw new CliError(...NO_INPUT);
 				return executeSecretPut(cwd, args.name, value, args.server);
@@ -730,7 +730,7 @@ const secret = defineCommand({
 			},
 			cwd: "any",
 			async run({ args, cwd }) {
-				const { executeSecretDelete } = await import("./secret-BuMuFR4B.mjs");
+				const { executeSecretDelete } = await import("./secret-CVvSLIDV.mjs");
 				return executeSecretDelete(cwd, args.name, args.server);
 			}
 		}),
@@ -745,7 +745,7 @@ const secret = defineCommand({
 			},
 			cwd: "any",
 			async run({ args, cwd }) {
-				const { executeSecretList } = await import("./secret-BuMuFR4B.mjs");
+				const { executeSecretList } = await import("./secret-CVvSLIDV.mjs");
 				return executeSecretList(cwd, args.server);
 			}
 		})
@@ -772,7 +772,7 @@ const storageStatus = defineExec({
 	},
 	cwd: "any",
 	async run({ args, cwd }) {
-		const { executeStorageStatus } = await import("./storage-DzRZ-eCw.mjs");
+		const { executeStorageStatus } = await import("./storage-BvUrnvM3.mjs");
 		return executeStorageStatus(resolveStorageCwd(cwd, args.dir), args.server);
 	}
 });
@@ -788,7 +788,7 @@ const storageEnable = defineExec({
 	},
 	cwd: "any",
 	async run({ args, cwd }) {
-		const { executeStorageEnable } = await import("./storage-DzRZ-eCw.mjs");
+		const { executeStorageEnable } = await import("./storage-BvUrnvM3.mjs");
 		return executeStorageEnable(resolveStorageCwd(cwd, args.dir), args.server);
 	}
 });
@@ -809,7 +809,7 @@ const storageDisable = defineExec({
 	},
 	cwd: "any",
 	async run({ args, cwd }) {
-		const { executeStorageDisable } = await import("./storage-DzRZ-eCw.mjs");
+		const { executeStorageDisable } = await import("./storage-BvUrnvM3.mjs");
 		return executeStorageDisable(resolveStorageCwd(cwd, args.dir), {
 			server: args.server,
 			force: args.force
@@ -833,7 +833,7 @@ const logs = defineExec({
 	},
 	cwd: "any",
 	async run({ args, cwd }) {
-		const { executeLogs } = await import("./logs-BWVGSjLR.mjs");
+		const { executeLogs } = await import("./logs-9q-psa4q.mjs");
 		return executeLogs(resolveStorageCwd(cwd, args.dir), {
 			server: args.server,
 			follow: args.follow
@@ -876,7 +876,7 @@ const mainCommand = defineCommand({
 			},
 			cwd: "none",
 			async run({ args }) {
-				const { executeLogin } = await import("./login-C71-qz8F.mjs");
+				const { executeLogin } = await import("./login-BBuM1sxH.mjs");
 				return executeLogin({ server: args.server });
 			}
 		}),
@@ -892,7 +892,7 @@ const mainCommand = defineCommand({
 			args: { json: sharedArgs.json },
 			cwd: "none",
 			async run({ mode }) {
-				const { listTemplates } = await import("./_templates-Dxb_P2Wz.mjs");
+				const { listTemplates } = await import("./_templates-FI3xPEMj.mjs");
 				const names = await listTemplates();
 				if (mode === "human") {
 					for (const name of names) log.message(name);
@@ -958,8 +958,13 @@ if (process.env.VITEST !== "true") {
 	const assertKnownFlags = async () => {
 		const unknown = await unknownFlagsForArgv(mainCommand, process.argv.slice(2));
 		if (unknown.length === 0) return;
-		log.error(`Unknown ${unknown.length === 1 ? "option" : "options"}: ${unknown.join(", ")}`);
-		log.info("Run `aai <command> --help` to see the options it accepts.");
+		const label = `Unknown ${unknown.length === 1 ? "option" : "options"}: ${unknown.join(", ")}`;
+		const hint = "Run `aai <command> --help` to see the options it accepts.";
+		if (getOutputMode({}) === "json") await writeLine(`${JSON.stringify(fail("usage", label, hint))}\n`);
+		else {
+			log.error(label);
+			log.info(hint);
+		}
 		process.exit(1);
 	};
 	runDefault().then(assertKnownFlags).then(() => runMain(mainCommand, { showUsage: usageForMode })).catch((err) => {

package/dist/{client-bundler-BEIqgOtd.mjs → client-bundler-CWnG42cU.mjs}

@@ -3,8 +3,9 @@ import { o as errorMessage$1, s as fileExists } from "./_utils-B8QmtFhK.mjs";
 import { n as withPreservedNodeEnv, t as DEDUPED_PEERS } from "./_vite-env-BNveawd1.mjs";
 import { existsSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { isTextAssetPath, omitUndefined } from "@alexkroman1/aai/utils";
+import { omitUndefined } from "@alexkroman1/aai/utils";
 import fs from "node:fs/promises";
+import { isTextAssetPath } from "@alexkroman1/aai/internal";
 import { build } from "vite";
 //#region _default-html.ts
 /**

package/dist/client-bundler.mjs

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import { t as buildClient } from "./client-bundler-BEIqgOtd.mjs";
+import { t as buildClient } from "./client-bundler-CWnG42cU.mjs";
 export { buildClient };