@alexkroman1/aai-cli 6.11.0 → 8.0.0

package/README.md

@@ -14,6 +14,7 @@ npm i -g @alexkroman1/aai-cli   # or: npx @alexkroman1/aai-cli@latest
 | `aai templates` | List the shipped project templates |
 | `aai dev` | Local dev server: loads `agent.ts`, rebuilds on change, serves the browser client (`--port`) |
 | `aai test` | Run the project's vitest suite |
+| `aai eval` | Run the project's behaviour evals (`agent.eval.test.ts`) — a real session, a live model with a key, a scripted one without |
 | `aai build` | Bundle without deploying (type-checks first; `--skipTypecheck` opts out) |
 | `aai list` | List your studio projects |
 | `aai pull <project>` | Pull a studio project into a local directory, ready for `aai dev` |

package/dist/{_agent-DpH2pBJd.mjs → _agent-BTwZJu4P.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { a as serverOrigin, i as readProjectConfig, n as ensureApiKey, r as readGlobalConfig, t as approveServer } from "./_config-D_s09e7g.mjs";
+import { a as serverOrigin, i as readProjectConfig, n as ensureApiKey, r as readGlobalConfig, t as approveServer } from "./_config-CmJOFsAP.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { VALID_SLUG_RE } from "@alexkroman1/aai/utils";
+import { VALID_SLUG_RE } from "@alexkroman1/aai/internal";
 //#region _agent.ts
 const DEFAULT_SERVER = "https://alexkroman--aai-server-web-server.modal.run";
 const DEFAULT_DEV_SERVER = "http://localhost:8080";

package/dist/{_bundler-C2BDwU7r.mjs → _bundler-CDuYl5Gb.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { f as validateAgentExport } from "./_utils-B8QmtFhK.mjs";
-import { t as buildClient } from "./client-bundler-BEIqgOtd.mjs";
-import { n as buildWorkflows, t as buildWorker } from "./worker-bundler-CGD4r8Kc.mjs";
+import { t as buildClient } from "./client-bundler-CWnG42cU.mjs";
+import { n as buildWorkflows, t as buildWorker } from "./worker-bundler-CCVEDjm1.mjs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { omitUndefined } from "@alexkroman1/aai/utils";

package/dist/_dev-env.d.ts

@@ -9,9 +9,13 @@
  * (who may connect, where it binds, whether it restarts), so they are read from
  * the environment on purpose and must never leak into `ctx.env`.
  *
- * Split out of `_dev-server.ts` purely to keep that module under the
- * file-length cap; it is the only consumer.
+ * `createDevLogger` sits here for the second half of that reason rather than
+ * the first: it is not a control variable, it READS one — the same auto-
+ * detected JSON mode — to decide where the runtime's diagnostics go. Both
+ * were split out of `_dev-server.ts` to keep it under the file-length cap,
+ * and `_dev-server.ts` is the only consumer of either.
  */
+import type { Logger } from "@alexkroman1/aai-runtime";
 /**
  * The env handed to `createServer` for host-mode connections: provider
  * credentials plus the `AAI_ALLOW_HOST` gate read straight from the shell
@@ -36,3 +40,19 @@ export declare function devBindHost(): string | undefined;
  * as a provider failure several records deep.
  */
 export declare function devWatchEnabled(): boolean;
+/**
+ * The logger the dev server's runtime writes through.
+ *
+ * The SDK's default logger is console-backed and `console.log` is STDOUT, so
+ * in JSON mode the runtime's own diagnostics — the multi-line "Session mode
+ * resolved" dump at startup, every later warning — landed on stdout ahead of
+ * the single result line `aai dev` promises there. JSON mode is AUTO-DETECTED
+ * on a pipe, so that is the normal case rather than an opt-in one:
+ * `aai dev > dev.log`, a process supervisor, a container. It is the same
+ * hazard `notify` exists for, one layer down: `silenceOutput()` only reaches
+ * this CLI's own `log`, and the runtime is not using it.
+ *
+ * Human mode keeps the console logger exactly as it was — a TTY has nothing
+ * to parse, and stdout is where people are already reading these.
+ */
+export declare function createDevLogger(silenced: boolean): Logger;

package/dist/{_dev-server-LLLWnFBs.mjs → _dev-server-Me06wgeF.mjs}

@@ -1,37 +1,25 @@
 #!/usr/bin/env node
 import { i as outputSilenced, r as notify } from "./_ui-u7T4YooX.mjs";
 import { i as errorCode, o as errorMessage$1 } from "./_utils-B8QmtFhK.mjs";
-import { n as fallbackHtmlPlugin } from "./client-bundler-BEIqgOtd.mjs";
+import { n as fallbackHtmlPlugin } from "./client-bundler-CWnG42cU.mjs";
 import { t as DEDUPED_PEERS } from "./_vite-env-BNveawd1.mjs";
-import { n as buildWorkflows, t as buildWorker } from "./worker-bundler-CGD4r8Kc.mjs";
-import { n as ensureApiKey } from "./_config-D_s09e7g.mjs";
-import { n as createWorkerEvaluator } from "./_bundler-C2BDwU7r.mjs";
+import { n as buildWorkflows, t as buildWorker } from "./worker-bundler-CCVEDjm1.mjs";
+import { n as ensureApiKey } from "./_config-CmJOFsAP.mjs";
+import { n as createWorkerEvaluator } from "./_bundler-CDuYl5Gb.mjs";
 import { t as resolveServerEnv } from "./_server-common-6e0QI4mq.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { omitUndefined } from "@alexkroman1/aai/utils";
 import { createCoalescingRunner, sleep } from "@alexkroman1/aai/internal";
-import { WORKFLOW_API_PREFIX, configureWorkflowWorld, consoleLogger, createRuntime, createServer, createWorkflowSurface, handleWorkflowRequest, publishStepEnv, requiredProviderEnvVars, startWorkflowWorldIfDeclared, withHostCredentialFallback } from "@alexkroman1/aai/runtime";
+import { agentConfigWarnings } from "@alexkroman1/aai/manifest";
+import { WORKFLOW_API_PREFIX, createRuntime, createServer, requiredProviderEnvVars, withHostCredentialFallback } from "@alexkroman1/aai-runtime";
+import { configureWorkflowWorld, consoleLogger, createWorkflowSurface, handleWorkflowRequest, publishStepEnv, startWorkflowWorldIfDeclared } from "@alexkroman1/aai-runtime/internal";
 import { defaultClientDir } from "@alexkroman1/aai-ui/client-dir";
 import { watch } from "chokidar";
 import getPort, { portNumbers } from "get-port";
 import pDebounce from "p-debounce";
 //#region _dev-env.ts
 /**
-* The dev server's CONTROL variables — the three things read straight from the
-* shell rather than from the agent's `.env`.
-*
-* That distinction is the reason these live together. `resolveServerEnv` builds
-* `ctx.env` from `.env`-declared keys only, deliberately, so an agent cannot
-* come to depend on a shell variable that will not exist after deploy. These
-* three are not agent config at all — they configure the *dev server process*
-* (who may connect, where it binds, whether it restarts), so they are read from
-* the environment on purpose and must never leak into `ctx.env`.
-*
-* Split out of `_dev-server.ts` purely to keep that module under the
-* file-length cap; it is the only consumer.
-*/
-/**
 * The env handed to `createServer` for host-mode connections: provider
 * credentials plus the `AAI_ALLOW_HOST` gate read straight from the shell
 * (it is a control variable, not something an agent declares in `.env`).
@@ -66,6 +54,33 @@ function devBindHost() {
 function devWatchEnabled() {
 	return /^(1|true|yes|on)$/i.test(process.env.AAI_DEV_WATCH?.trim() ?? "");
 }
+/**
+* The logger the dev server's runtime writes through.
+*
+* The SDK's default logger is console-backed and `console.log` is STDOUT, so
+* in JSON mode the runtime's own diagnostics — the multi-line "Session mode
+* resolved" dump at startup, every later warning — landed on stdout ahead of
+* the single result line `aai dev` promises there. JSON mode is AUTO-DETECTED
+* on a pipe, so that is the normal case rather than an opt-in one:
+* `aai dev > dev.log`, a process supervisor, a container. It is the same
+* hazard `notify` exists for, one layer down: `silenceOutput()` only reaches
+* this CLI's own `log`, and the runtime is not using it.
+*
+* Human mode keeps the console logger exactly as it was — a TTY has nothing
+* to parse, and stdout is where people are already reading these.
+*/
+function createDevLogger(silenced) {
+	if (!silenced) return consoleLogger;
+	const write = (msg, ctx) => {
+		process.stderr.write(`${msg}${ctx === void 0 ? "" : ` ${JSON.stringify(ctx)}`}\n`);
+	};
+	return {
+		info: write,
+		warn: write,
+		error: write,
+		debug: () => void 0
+	};
+}
 //#endregion
 //#region _dev-restart.ts
 /**
@@ -237,6 +252,7 @@ async function resolveAgentEnv(root, agentDef) {
 	const hasShellKey = Boolean(process.env.ASSEMBLYAI_API_KEY);
 	if (required.includes("ASSEMBLYAI_API_KEY") && !env.ASSEMBLYAI_API_KEY && !hasShellKey) env.ASSEMBLYAI_API_KEY = await ensureApiKey();
 	for (const warning of agentEnvWarnings(agentDef, env)) notify("warn", warning);
+	for (const warning of agentConfigWarnings(agentDef)) notify("warn", warning);
 	return env;
 }
 /**
@@ -260,9 +276,11 @@ async function resolveAgentEnv(root, agentDef) {
 * without starting a builder.
 */
 async function loadWorker(cwd, evaluate) {
+	const workflows = await buildWorkflows(cwd);
+	for (const warning of workflows?.warnings ?? []) notify("warn", warning);
 	return evaluate(await buildWorker(cwd, {
 		runtime: false,
-		workflows: await buildWorkflows(cwd)
+		workflows
 	}));
 }
 /**
@@ -284,33 +302,6 @@ function isIgnoredPath(dir, filePath) {
 	});
 }
 /**
-* The logger the dev server's runtime writes through.
-*
-* The SDK's default logger is console-backed and `console.log` is STDOUT, so
-* in JSON mode the runtime's own diagnostics — the multi-line "Session mode
-* resolved" dump at startup, every later warning — landed on stdout ahead of
-* the single result line `aai dev` promises there. JSON mode is AUTO-DETECTED
-* on a pipe, so that is the normal case rather than an opt-in one:
-* `aai dev > dev.log`, a process supervisor, a container. It is the same
-* hazard `notify` exists for, one layer down: `silenceOutput()` only reaches
-* this CLI's own `log`, and the runtime is not using it.
-*
-* Human mode keeps the console logger exactly as it was — a TTY has nothing
-* to parse, and stdout is where people are already reading these.
-*/
-function createDevLogger(silenced) {
-	if (!silenced) return consoleLogger;
-	const write = (msg, ctx) => {
-		process.stderr.write(`${msg}${ctx === void 0 ? "" : ` ${JSON.stringify(ctx)}`}\n`);
-	};
-	return {
-		info: write,
-		warn: write,
-		error: write,
-		debug: () => void 0
-	};
-}
-/**
 * Watch the agent directory for changes and call `onChange` when detected.
 * Debounces to avoid rapid restarts. Uses chokidar for reliable recursive
 * watching across platforms (raw `fs.watch` misses events on Linux).

package/dist/_dev-server.d.ts

@@ -7,7 +7,6 @@
  * client SPA HMR.
  */
 import type { AgentDef } from "@alexkroman1/aai";
-import { type Logger } from "@alexkroman1/aai/runtime";
 import { type FSWatcher } from "chokidar";
 import { type EvaluatedWorker } from "./_bundler.ts";
 /**
@@ -55,22 +54,6 @@ export declare function loadWorker(cwd: string, evaluate: (code: string) => Prom
  * restart the server with the new values.
  */
 export declare function isIgnoredPath(dir: string, filePath: string): boolean;
-/**
- * The logger the dev server's runtime writes through.
- *
- * The SDK's default logger is console-backed and `console.log` is STDOUT, so
- * in JSON mode the runtime's own diagnostics — the multi-line "Session mode
- * resolved" dump at startup, every later warning — landed on stdout ahead of
- * the single result line `aai dev` promises there. JSON mode is AUTO-DETECTED
- * on a pipe, so that is the normal case rather than an opt-in one:
- * `aai dev > dev.log`, a process supervisor, a container. It is the same
- * hazard `notify` exists for, one layer down: `silenceOutput()` only reaches
- * this CLI's own `log`, and the runtime is not using it.
- *
- * Human mode keeps the console logger exactly as it was — a TTY has nothing
- * to parse, and stdout is where people are already reading these.
- */
-export declare function createDevLogger(silenced: boolean): Logger;
 /**
  * Watch the agent directory for changes and call `onChange` when detected.
  * Debounces to avoid rapid restarts. Uses chokidar for reliable recursive

package/dist/{_init-C57bWAQ8.mjs → _init-BhEfQ6Yi.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { c as isEexist, l as readJson, p as writeJson } from "./_utils-B8QmtFhK.mjs";
-import { r as isDevMode, t as getMonorepoRoot } from "./_agent-DpH2pBJd.mjs";
-import { REPO_URL, downloadAndMergeTemplate } from "./_templates-Dxb_P2Wz.mjs";
+import { r as isDevMode, t as getMonorepoRoot } from "./_agent-BTwZJu4P.mjs";
+import { REPO_URL, downloadAndMergeTemplate } from "./_templates-4WcKOjS5.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
 //#region _init.ts
@@ -46,6 +46,7 @@ aai secret delete MY_KEY # Remove a secret
 const WORKSPACE_PKG_DIRS = {
 	"@alexkroman1/aai": "aai",
 	"@alexkroman1/aai-cli": "aai-cli",
+	"@alexkroman1/aai-runtime": "aai-runtime",
 	"@alexkroman1/aai-ui": "aai-ui"
 };
 /** Rewrite workspace deps to link: paths so pnpm links to local source. */

package/dist/{_preflight-BtfaYtbE.mjs → _preflight-Co1G9Jww.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { requiredProviderEnvVars } from "@alexkroman1/aai/runtime";
+import { requiredProviderEnvVars } from "@alexkroman1/aai-runtime";
 //#region _preflight.ts
 /**
 * The deploy-time credential preflight — the classic dev/prod failure, caught

package/dist/_preflight.d.ts

@@ -22,7 +22,7 @@
  * accuracy, and a false rejection is worse than a false warning: it blocks a
  * deploy that would have worked.
  */
-import { requiredProviderEnvVars } from "@alexkroman1/aai/runtime";
+import { requiredProviderEnvVars } from "@alexkroman1/aai-runtime";
 /**
  * The config shape read out of a bundle's `__aaiConfig` export: the provider
  * descriptors the credential derivation needs, plus the agent's declared

package/dist/_resource-commands.d.ts

@@ -0,0 +1,23 @@
+export declare const secret: import("citty").CommandDef<import("citty").ArgsDef>;
+export declare const logs: import("citty").CommandDef<{
+    readonly dir: {
+        readonly type: "positional";
+        readonly description: "Project directory";
+        readonly required: false;
+    };
+    readonly follow: {
+        readonly type: "boolean";
+        readonly alias: "f";
+        readonly description: "Keep printing new output";
+    };
+    readonly server: {
+        readonly type: "string";
+        readonly alias: "s";
+        readonly description: "Platform server URL";
+    };
+    readonly json: {
+        readonly type: "boolean";
+        readonly description: "Output JSON (auto-detected in non-TTY)";
+    };
+}>;
+export declare const storage: import("citty").CommandDef<import("citty").ArgsDef>;

package/dist/{_slug-api-BxrsJXVI.mjs → _slug-api-z-USxPtL.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { n as getServerInfo } from "./_agent-DpH2pBJd.mjs";
-import { l as HINT_NOT_DEPLOYED, s as studioProjectApiUrl, u as apiRequest } from "./_studio-U3jhKlA3.mjs";
+import { n as getServerInfo } from "./_agent-BTwZJu4P.mjs";
+import { l as HINT_NOT_DEPLOYED, s as studioProjectApiUrl, u as apiRequest } from "./_studio-DR5yzZ1T.mjs";
 //#region _slug-api.ts
 /**
 * Authenticated request against a deployed agent's slug-scoped resource
@@ -13,6 +13,18 @@ import { l as HINT_NOT_DEPLOYED, s as studioProjectApiUrl, u as apiRequest } fro
 * stays real — an intra-module call would bypass those mocks.
 */
 /**
+* The request itself — one definition so the "not deployed" 404 hint this
+* module exists to attach cannot be present on one route and missing on the
+* other. Only the URL differs between the two callers.
+*/
+function deployedAgentRequest(url, init, apiKey) {
+	return apiRequest(url, {
+		...init,
+		apiKey,
+		hints: { 404: HINT_NOT_DEPLOYED }
+	});
+}
+/**
 * A SECRET request, routed to the project when this directory is linked to
 * one and to the bare slug otherwise.
 *
@@ -27,22 +39,14 @@ import { l as HINT_NOT_DEPLOYED, s as studioProjectApiUrl, u as apiRequest } fro
 async function secretRequest(cwd, resourcePath, init, server) {
 	const { serverUrl, slug, apiKey, studioProject } = await getServerInfo(cwd, server);
 	return {
-		data: await apiRequest(studioProject ? `${studioProjectApiUrl(serverUrl, studioProject)}/secret${resourcePath}` : `${serverUrl}/${slug}/secret${resourcePath}`, {
-			...init,
-			apiKey,
-			hints: { 404: HINT_NOT_DEPLOYED }
-		}),
+		data: await deployedAgentRequest(`${studioProject ? studioProjectApiUrl(serverUrl, studioProject) : `${serverUrl}/${slug}`}/secret${resourcePath}`, init, apiKey),
 		target: studioProject ?? slug
 	};
 }
 async function slugRequest(cwd, resourcePath, init, server) {
 	const { serverUrl, slug, apiKey } = await getServerInfo(cwd, server);
 	return {
-		data: await apiRequest(`${serverUrl}/${slug}${resourcePath}`, {
-			...init,
-			apiKey,
-			hints: { 404: HINT_NOT_DEPLOYED }
-		}),
+		data: await deployedAgentRequest(`${serverUrl}/${slug}${resourcePath}`, init, apiKey),
 		slug
 	};
 }

package/dist/_slug-api.d.ts

@@ -9,6 +9,8 @@
  * stays real — an intra-module call would bypass those mocks.
  */
 import { type ApiRequestOptions } from "./_api-client.ts";
+/** What both requests below pass through to the API client. */
+type SlugRequestInit = Pick<ApiRequestOptions, "method" | "body" | "action">;
 /**
  * A SECRET request, routed to the project when this directory is linked to
  * one and to the bare slug otherwise.
@@ -21,11 +23,12 @@ import { type ApiRequestOptions } from "./_api-client.ts";
  * user's own `aai publish` had created. An unlinked directory has one agent
  * and keeps the per-slug route, which is the platform primitive underneath.
  */
-export declare function secretRequest<T = unknown>(cwd: string, resourcePath: string, init: Pick<ApiRequestOptions, "method" | "body" | "action">, server?: string): Promise<{
+export declare function secretRequest<T = unknown>(cwd: string, resourcePath: string, init: SlugRequestInit, server?: string): Promise<{
     data: T;
     target: string;
 }>;
-export declare function slugRequest<T = unknown>(cwd: string, resourcePath: string, init: Pick<ApiRequestOptions, "method" | "body" | "action">, server?: string): Promise<{
+export declare function slugRequest<T = unknown>(cwd: string, resourcePath: string, init: SlugRequestInit, server?: string): Promise<{
     data: T;
     slug: string;
 }>;
+export {};

package/dist/{_studio-U3jhKlA3.mjs → _studio-DR5yzZ1T.mjs}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { t as CliError } from "./_output-CKkmWs7i.mjs";
 import path from "node:path";
-import { MAX_SLUG_LENGTH, PREVIEW_SLUG_SUFFIX, VALID_SLUG_RE, isRecord, omitUndefined } from "@alexkroman1/aai/utils";
+import { isRecord, omitUndefined } from "@alexkroman1/aai/utils";
+import { MAX_SLUG_LENGTH, PREVIEW_SLUG_SUFFIX, VALID_SLUG_RE } from "@alexkroman1/aai/internal";
 import { FetchError, ofetch } from "ofetch";
 import { slugifyName } from "@alexkroman1/aai/slugify";
 import { isLocalOnlyFile, snapshotWorkspaceFiles } from "@alexkroman1/aai/workspace-files";

package/dist/{_templates-Dxb_P2Wz.mjs → _templates-4WcKOjS5.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { o as errorMessage$1 } from "./_utils-B8QmtFhK.mjs";
-import { t as getMonorepoRoot } from "./_agent-DpH2pBJd.mjs";
+import { t as getMonorepoRoot } from "./_agent-BTwZJu4P.mjs";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import { isRecord } from "@alexkroman1/aai/utils";
@@ -120,10 +120,9 @@ async function readJsonFile(file) {
 * Directory holding the base scaffold — the files every project gets
 * underneath its template (package.json, tsconfig, `server.mjs`, …).
 *
-* Exported so `aai eject` can copy one file out of it rather than carrying a
-* second copy of that file's contents: the scaffold is the single definition
-* of the self-hosted entrypoint, and a project retrofitted with `eject` gets
-* byte-identical output to one `aai init` scaffolded.
+* The scaffold is the single definition of the self-hosted entrypoint, so a
+* caller needing one of its files resolves it here rather than carrying a
+* second copy of that file's contents.
 */
 function scaffoldDir() {
 	return path.join(resolveTemplatesDir(), "scaffold");
@@ -164,4 +163,4 @@ async function downloadAndMergeTemplate(template, targetDir) {
 	await layerScaffold(targetDir);
 }
 //#endregion
-export { REPO_URL, downloadAndMergeTemplate, layerScaffold, listTemplates, scaffoldDir };
+export { REPO_URL, downloadAndMergeTemplate, layerScaffold, listTemplates };

package/dist/_templates.d.ts

@@ -39,10 +39,9 @@ export declare function mergeScaffoldManifest(existing: Manifest, scaffold: Mani
  * Directory holding the base scaffold — the files every project gets
  * underneath its template (package.json, tsconfig, `server.mjs`, …).
  *
- * Exported so `aai eject` can copy one file out of it rather than carrying a
- * second copy of that file's contents: the scaffold is the single definition
- * of the self-hosted entrypoint, and a project retrofitted with `eject` gets
- * byte-identical output to one `aai init` scaffolded.
+ * The scaffold is the single definition of the self-hosted entrypoint, so a
+ * caller needing one of its files resolves it here rather than carrying a
+ * second copy of that file's contents.
  */
 export declare function scaffoldDir(): string;
 /**

package/dist/_workflow-scan.d.ts

@@ -0,0 +1,108 @@
+/**
+ * What the BUILT flow bundle carries — the two scans that read it, and the
+ * checks over them.
+ *
+ * Split out of `workflow-bundler.ts` when that file crossed the 500-line cap,
+ * along the seam the two scans already share: both read the same artifact after
+ * the builder has written it, both attribute a line to a module through
+ * esbuild's `// <path>` headers, and neither has anything to do with
+ * CONFIGURING the build. One of them fails the build (a `require` the workflow
+ * VM cannot answer) and the other warns (a call that replays differently), which
+ * is the only real difference between them.
+ *
+ * Internal: `workflow-bundler.ts` is the surface the studio and the CLI's own
+ * build call, and it re-exports nothing from here that they need.
+ *
+ * @module _workflow-scan
+ */
+/** One `require` the workflow VM cannot answer, and the module it was written for. */
+export type VmRequireSite = {
+    /** The module specifier — `node:child_process`. */
+    specifier: string;
+    /** The bundled file esbuild attributed it to, or `undefined` when it said none. */
+    module: string | undefined;
+};
+/**
+ * Find the Node builtins a flow bundle would `require` at load.
+ *
+ * The flow bundle is compiled in a `node:vm` `Script` whose context has
+ * `module` and `exports` and **no `require`**, so one of these is a run that
+ * dies at replay with `ReferenceError: require is not defined` — never a build
+ * failure, and never a symptom before the first run. The WDK's own builder
+ * bundles everything for exactly this reason and carries
+ * `createNodeModuleErrorPlugin` to reject a builtin import at build time.
+ *
+ * That plugin has two blind spots this scan covers, and both are the DEPLOYED
+ * shape rather than an exotic one:
+ *
+ * - It reports a violation only when it can point at the import LINE in a
+ *   first-party file, matched with a single-line regex — so a multi-line
+ *   `import {\n  x,\n} from "pkg"` finds nothing and the builtin is marked
+ *   external in silence.
+ * - It resolves that file against `process.cwd()`, which is not the project
+ *   being built when the studio builds a workspace, so the read fails and the
+ *   same silent path is taken.
+ *
+ * Both were reproduced. What reaches the VM either way is
+ * `var import_node_child_process = require("node:child_process");` at the top
+ * of the bundle, i.e. every run of every workflow in the project fails, and the
+ * stack names a line of generated code inside a dependency.
+ *
+ * Restricted to builtin specifiers deliberately: those are the only ones this
+ * builder leaves external (it marks nothing else so, precisely so nothing can
+ * need a `require`), and a narrow set is what keeps the scan from reading the
+ * text of a prompt as a violation.
+ *
+ * @internal
+ */
+export declare function findVmRequires(workflowCode: string): VmRequireSite[];
+/** One replay-unsafe call the flow bundle carries, and where it came from. */
+export type ReplayUnsafeSite = {
+    /** The call, as written — `Date.now(`. */
+    call: string;
+    /** What it does on a replay, and what to do instead. */
+    fix: string;
+    /** The project file esbuild attributed it to. */
+    module: string;
+};
+/**
+ * Replay-unsafe calls the flow bundle carries, attributed to the project's OWN
+ * `workflows/` files.
+ *
+ * Attribution is the whole design. The bundle inlines every non-external
+ * dependency a workflow module imports — zod, a markdown parser, whatever — and
+ * third-party code is full of `Date.now()` on paths a workflow never reaches, so
+ * a scan of the bundle's text reports a library and blocks a correct project.
+ * esbuild writes a `// <path>` header per module (the same one
+ * {@link findVmRequires} reads), so lines can be charged to the file they were
+ * written in, and only the project's own workflow sources are read.
+ *
+ * Scanning the BUNDLE rather than the sources is what makes a `"use step"` body
+ * exempt for free: the workflow-mode transform has already removed them, so
+ * what is left is the part that really does replay.
+ *
+ * @internal
+ */
+export declare function findReplayUnsafeCalls(workflowCode: string): ReplayUnsafeSite[];
+/**
+ * The warning `aai build` and `aai dev` print for a replay-unsafe call.
+ *
+ * A WARNING and not a build failure, deliberately. The attribution above makes
+ * the scan accurate about which FILE a call is in, and it cannot know whether a
+ * plain function in a `workflows/` module is reached from a body (where the
+ * rule bites) or only from a step (where it does not) — so the one thing it
+ * must not do is refuse a correct project. A silent build was the actual
+ * problem; a line naming the file solves it without that risk.
+ */
+export declare function replayWarnings(workflowCode: string): string[];
+/**
+ * Fail the build when the flow bundle carries a `require` — see
+ * {@link findVmRequires} for what that means and why nothing upstream catches it.
+ *
+ * The message has to name the MODULE as well as the specifier, because the
+ * import that caused it is not in the file an author is looking at: only a
+ * `"use step"` body is stripped from this bundle, so a value a `workflows/`
+ * module holds at module scope — an exported helper, a constant — keeps its
+ * import, and that import's whole graph rides into the VM.
+ */
+export declare function assertNoVmRequires(workflowCode: string): void;

package/dist/{build-Dfza2pRI.mjs → build-BBxf8vom.mjs}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { a as ok, t as CliError } from "./_output-CKkmWs7i.mjs";
-import { n as log } from "./_ui-u7T4YooX.mjs";
-import { r as evalWorkerBundle, t as buildAgentBundle } from "./_bundler-C2BDwU7r.mjs";
+import { n as log, r as notify } from "./_ui-u7T4YooX.mjs";
+import { r as evalWorkerBundle, t as buildAgentBundle } from "./_bundler-CDuYl5Gb.mjs";
 import { assertTypechecks } from "./_typecheck-gate-BXvUNnfs.mjs";
-import { classifyVitestError, runVitest } from "./test-9kPKJI-w.mjs";
+import { classifyVitestError, runVitest } from "./test-BvyT6sAc.mjs";
 import path from "node:path";
 import fs from "node:fs/promises";
+import { agentConfigWarnings } from "@alexkroman1/aai/manifest";
 //#region build.ts
 /**
 * `aai build` — bundle the agent without deploying, behind the same gates
@@ -47,7 +48,9 @@ async function executeBuild(opts) {
 	}
 	if (!opts.skipTypecheck) await assertTypechecks(cwd);
 	const bundle = await buildAgentBundle(cwd, { minify: true });
+	for (const warning of bundle.workflows?.warnings ?? []) notify("warn", warning);
 	const agentDef = await evalWorkerBundle(bundle.worker);
+	for (const warning of agentConfigWarnings(agentDef)) notify("warn", warning);
 	const worker = path.join(cwd, WORKER_ARTIFACT_REL);
 	await fs.mkdir(path.dirname(worker), { recursive: true });
 	await fs.writeFile(worker, bundle.worker, "utf-8");