diff --git a/.gitignore b/.gitignore
index 2510994d..c2c09a6f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,7 @@ build/
 .coverage
 coverage.xml
 htmlcov/
+mutants/
 
 # Editor/agent local artifacts: keep personal settings local, but track the
 # team-shared bits (.claude/settings.json, agents/, skills/).
diff --git a/.importlinter b/.importlinter
new file mode 100644
index 00000000..08d091d1
--- /dev/null
+++ b/.importlinter
@@ -0,0 +1,64 @@
+[importlinter]
+root_package = aai_cli
+include_external_packages = True
+
+[importlinter:contract:1]
+name = Core modules do not import command modules
+type = forbidden
+source_modules =
+    aai_cli.agent
+    aai_cli.auth
+    aai_cli.client
+    aai_cli.code_gen
+    aai_cli.config
+    aai_cli.config_builder
+    aai_cli.context
+    aai_cli.environments
+    aai_cli.errors
+    aai_cli.follow
+    aai_cli.help_panels
+    aai_cli.help_text
+    aai_cli.init
+    aai_cli.llm
+    aai_cli.microphone
+    aai_cli.output
+    aai_cli.render
+    aai_cli.stdio
+    aai_cli.streaming
+    aai_cli.theme
+    aai_cli.transcribe_render
+    aai_cli.youtube
+forbidden_modules =
+    aai_cli.commands
+
+[importlinter:contract:2]
+name = Command modules are independent
+type = independence
+modules =
+    aai_cli.commands.account
+    aai_cli.commands.agent
+    aai_cli.commands.audit
+    aai_cli.commands.claude
+    aai_cli.commands.doctor
+    aai_cli.commands.init
+    aai_cli.commands.keys
+    aai_cli.commands.llm
+    aai_cli.commands.login
+    aai_cli.commands.samples
+    aai_cli.commands.sessions
+    aai_cli.commands.stream
+    aai_cli.commands.transcribe
+    aai_cli.commands.transcripts
+
+[importlinter:contract:3]
+name = Library layers do not depend on Rich rendering
+type = forbidden
+source_modules =
+    aai_cli.client
+    aai_cli.config
+    aai_cli.config_builder
+    aai_cli.environments
+    aai_cli.errors
+    aai_cli.llm
+forbidden_modules =
+    rich
diff --git a/aai_cli/agent/audio.py b/aai_cli/agent/audio.py
index 33c51823..4421d7fb 100644
--- a/aai_cli/agent/audio.py
+++ b/aai_cli/agent/audio.py
@@ -7,7 +7,7 @@
 from typing import Any
 
 from aai_cli.errors import CLIError
-from aai_cli.microphone import _default_rate, _resample, audio_missing_error
+from aai_cli.microphone import audio_missing_error, default_rate, resample_pcm16
 
 SAMPLE_RATE = 24000  # Voice Agent native PCM16 mono rate
 
@@ -19,7 +19,7 @@ def _output_default_rate(device: int | None = None) -> int:
     'paramErr' (-50) from forcing an unsupported one; agent audio (24 kHz) is
     resampled to it. Falls back to a safe default when the device can't be queried.
     """
-    return _default_rate("output", device)
+    return default_rate("output", device)
 
 
 class NullPlayer:
@@ -141,7 +141,7 @@ def start(self) -> None:
     def feed(self, pcm: bytes) -> None:
         """Queue target-rate PCM for playback, resampled to the device rate."""
         if self._device_rate != self._target:
-            pcm, self._out_state = _resample(
+            pcm, self._out_state = resample_pcm16(
                 pcm, self._out_state, src_rate=self._target, dst_rate=self._device_rate
             )
         with self._lock:
@@ -163,7 +163,7 @@ def capture_frames(self) -> Iterator[bytes]:
             if chunk is None:
                 return
             if self._device_rate != self._target:
-                chunk, state = _resample(
+                chunk, state = resample_pcm16(
                     chunk, state, src_rate=self._device_rate, dst_rate=self._target
                 )
             yield chunk
diff --git a/aai_cli/agent/session.py b/aai_cli/agent/session.py
index 1581be6b..44b96220 100644
--- a/aai_cli/agent/session.py
+++ b/aai_cli/agent/session.py
@@ -71,41 +71,41 @@ def dispatch(self, event: dict[str, Any]) -> None:
         if handler is not None:
             handler(self, event)
 
-    def _on_session_ready(self, _event: dict[str, Any]) -> None:
+    def on_session_ready(self, _event: dict[str, Any]) -> None:
         with self._lock:
             self.ready = True
         if self.ready_event is not None:
             self.ready_event.set()
         self.renderer.connected()
 
-    def _on_speech_started(self, _event: dict[str, Any]) -> None:
+    def on_speech_started(self, _event: dict[str, Any]) -> None:
         if self.full_duplex:
             self.player.flush()
 
-    def _on_user_delta(self, event: dict[str, Any]) -> None:
+    def on_user_delta(self, event: dict[str, Any]) -> None:
         self.renderer.user_partial(event.get("text", ""))
 
-    def _on_user_final(self, event: dict[str, Any]) -> None:
+    def on_user_final(self, event: dict[str, Any]) -> None:
         self._saw_user = True
         self.renderer.user_final(event.get("text", ""))
 
-    def _on_reply_started(self, _event: dict[str, Any]) -> None:
+    def on_reply_started(self, _event: dict[str, Any]) -> None:
         if not self.full_duplex:
             with self._lock:
                 self.muted = True
         self.renderer.reply_started()
 
-    def _on_reply_audio(self, event: dict[str, Any]) -> None:
+    def on_reply_audio(self, event: dict[str, Any]) -> None:
         data = event.get("data")
         if data:
             self.player.enqueue(base64.b64decode(data))
 
-    def _on_agent_transcript(self, event: dict[str, Any]) -> None:
+    def on_agent_transcript(self, event: dict[str, Any]) -> None:
         self.renderer.agent_transcript(
             event.get("text", ""), interrupted=bool(event.get("interrupted", False))
         )
 
-    def _on_reply_done(self, event: dict[str, Any]) -> None:
+    def on_reply_done(self, event: dict[str, Any]) -> None:
         if not self.full_duplex:
             with self._lock:
                 self.muted = False
@@ -117,7 +117,7 @@ def _on_reply_done(self, event: dict[str, Any]) -> None:
         if self.exit_after_reply and self._saw_user and not interrupted:
             self.finished = True
 
-    def _raise_error(self, event: dict[str, Any]) -> None:
+    def raise_error(self, event: dict[str, Any]) -> None:
         code = event.get("code", "")
         message = event.get("message") or code or "Voice agent error."
         if code in _AUTH_ERROR_CODES:
@@ -132,15 +132,15 @@ def _raise_error(self, event: dict[str, Any]) -> None:
 # Server event type -> the VoiceAgentSession method that handles it. Types absent
 # here (input.speech.stopped, tool.call, anything unrecognized) are ignored.
 _EVENT_HANDLERS: dict[str, Callable[[VoiceAgentSession, dict[str, Any]], None]] = {
-    "session.ready": VoiceAgentSession._on_session_ready,
-    "input.speech.started": VoiceAgentSession._on_speech_started,
-    "transcript.user.delta": VoiceAgentSession._on_user_delta,
-    "transcript.user": VoiceAgentSession._on_user_final,
-    "reply.started": VoiceAgentSession._on_reply_started,
-    "reply.audio": VoiceAgentSession._on_reply_audio,
-    "transcript.agent": VoiceAgentSession._on_agent_transcript,
-    "reply.done": VoiceAgentSession._on_reply_done,
-    "session.error": VoiceAgentSession._raise_error,
+    "session.ready": VoiceAgentSession.on_session_ready,
+    "input.speech.started": VoiceAgentSession.on_speech_started,
+    "transcript.user.delta": VoiceAgentSession.on_user_delta,
+    "transcript.user": VoiceAgentSession.on_user_final,
+    "reply.started": VoiceAgentSession.on_reply_started,
+    "reply.audio": VoiceAgentSession.on_reply_audio,
+    "transcript.agent": VoiceAgentSession.on_agent_transcript,
+    "reply.done": VoiceAgentSession.on_reply_done,
+    "session.error": VoiceAgentSession.raise_error,
 }
 
 
diff --git a/aai_cli/auth/ams.py b/aai_cli/auth/ams.py
index 4fd1bca9..7f611699 100644
--- a/aai_cli/auth/ams.py
+++ b/aai_cli/auth/ams.py
@@ -1,35 +1,60 @@
 from __future__ import annotations
 
-from typing import Any, cast
-
 import httpx2 as httpx
+from pydantic import TypeAdapter, ValidationError
 
 from aai_cli.auth import endpoints
 from aai_cli.errors import APIError, NotAuthenticated
 
 _TIMEOUT = 30.0
+_HTTP_ERROR_MIN_STATUS = 400
+_JSON_OBJECT: TypeAdapter[dict[str, object]] = TypeAdapter(dict[str, object])
+_JSON_OBJECTS: TypeAdapter[list[dict[str, object]]] = TypeAdapter(list[dict[str, object]])
 
 
 def _detail(resp: httpx.Response) -> str:
+    fallback = resp.text or f"HTTP {resp.status_code}"
     try:
-        body = resp.json()
-        if isinstance(body, dict) and "detail" in body:
-            return str(body["detail"])
-    except Exception:  # noqa: BLE001,S110 - non-JSON error body; pass is intentional
-        pass
-    return resp.text or f"HTTP {resp.status_code}"
+        body: object = resp.json()
+        mapping = _JSON_OBJECT.validate_python(body)
+        if "detail" in mapping:
+            return str(mapping["detail"])
+    except (TypeError, ValueError, ValidationError):
+        return fallback
+    return fallback
 
 
 def _raise_for_error(resp: httpx.Response) -> None:
     if resp.status_code in (401, 403):
         raise NotAuthenticated(f"AMS rejected the login ({resp.status_code}): {_detail(resp)}")
-    if resp.status_code >= 400:
+    if resp.status_code >= _HTTP_ERROR_MIN_STATUS:
         raise APIError(f"AMS request failed ({resp.status_code}): {_detail(resp)}")
 
 
-def _json_or_raise(resp: httpx.Response) -> Any:
+def _json_or_raise(resp: httpx.Response) -> object:
     _raise_for_error(resp)
-    return resp.json()
+    data: object = resp.json()
+    return data
+
+
+def _json_object_or_raise(resp: httpx.Response) -> dict[str, object]:
+    data = _json_or_raise(resp)
+    try:
+        return _JSON_OBJECT.validate_python(data)
+    except ValidationError as exc:
+        raise APIError(
+            f"AMS request returned unexpected JSON: expected object, got {type(data).__name__}."
+        ) from exc
+
+
+def _json_object_list_or_raise(resp: httpx.Response) -> list[dict[str, object]]:
+    data = _json_or_raise(resp)
+    try:
+        return _JSON_OBJECTS.validate_python(data)
+    except ValidationError as exc:
+        raise APIError(
+            f"AMS request returned unexpected JSON: expected list of objects, got {type(data).__name__}."
+        ) from exc
 
 
 def _client(session_jwt: str | None = None) -> httpx.Client:
@@ -38,17 +63,17 @@ def _client(session_jwt: str | None = None) -> httpx.Client:
     return httpx.Client(base_url=endpoints.ams_base(), timeout=_TIMEOUT, cookies=cookies)
 
 
-def discover(token: str) -> dict[str, Any]:
+def discover(token: str) -> dict[str, object]:
     """POST /v2/auth/discover with a discovery_oauth token -> {orgs, email, IST}."""
     with _client() as client:
         resp = client.post(
             "/v2/auth/discover",
             json={"token": token, "token_type": "discovery_oauth"},
         )
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
 
 
-def exchange(intermediate_session_token: str, organization_id: str) -> dict[str, Any]:
+def exchange(intermediate_session_token: str, organization_id: str) -> dict[str, object]:
     """POST /v2/auth/exchange -> SignedInResponse {account, session_jwt, session_token}."""
     with _client() as client:
         resp = client.post(
@@ -58,33 +83,33 @@ def exchange(intermediate_session_token: str, organization_id: str) -> dict[str,
                 "organization_id": organization_id,
             },
         )
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
 
 
-def list_projects(account_id: int, session_jwt: str) -> list[dict[str, Any]]:
+def list_projects(account_id: int, session_jwt: str) -> list[dict[str, object]]:
     """GET /v1/users/accounts/{id}/projects -> [{project, tokens[]}]."""
     with _client(session_jwt) as client:
         resp = client.get(f"/v1/users/accounts/{account_id}/projects")
-    return cast(list[dict[str, Any]], _json_or_raise(resp))
+    return _json_object_list_or_raise(resp)
 
 
 def create_token(
     account_id: int, project_id: int, token_name: str, session_jwt: str
-) -> dict[str, Any]:
+) -> dict[str, object]:
     """POST /v1/users/accounts/{id}/tokens -> TokenSchema incl. `api_key`."""
     with _client(session_jwt) as client:
         resp = client.post(
             f"/v1/users/accounts/{account_id}/tokens",
             json={"project_id": project_id, "token_name": token_name},
         )
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
 
 
-def get_balance(session_jwt: str) -> dict[str, Any]:
+def get_balance(session_jwt: str) -> dict[str, object]:
     """GET /v2/billing/balance -> {account_id, balance_in_cents, ...}."""
     with _client(session_jwt) as client:
         resp = client.get("/v2/billing/balance")
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
 
 
 def get_usage(
@@ -92,21 +117,21 @@ def get_usage(
     starting_on: str,
     ending_before: str,
     window_size: str | None = None,
-) -> dict[str, Any]:
+) -> dict[str, object]:
     """POST /v2/billing/usage (ISO dates) -> {usage_items: [...]}."""
-    body: dict[str, Any] = {"starting_on": starting_on, "ending_before": ending_before}
+    body: dict[str, object] = {"starting_on": starting_on, "ending_before": ending_before}
     if window_size:
         body["window_size"] = window_size
     with _client(session_jwt) as client:
         resp = client.post("/v2/billing/usage", json=body)
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
 
 
-def get_rate_limits(account_id: int, session_jwt: str) -> dict[str, Any]:
+def get_rate_limits(account_id: int, session_jwt: str) -> dict[str, object]:
     """GET /v1/users/accounts/{id}/rate-limits -> {rate_limits: [...]}."""
     with _client(session_jwt) as client:
         resp = client.get(f"/v1/users/accounts/{account_id}/rate-limits")
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
 
 
 def rename_token(account_id: int, token_id: int, token_name: str, session_jwt: str) -> None:
@@ -119,24 +144,28 @@ def rename_token(account_id: int, token_id: int, token_name: str, session_jwt: s
     _raise_for_error(resp)
 
 
-def list_streaming(session_jwt: str, **filters: Any) -> dict[str, Any]:
+def list_streaming(session_jwt: str, **filters: object) -> dict[str, object]:
     """GET /v1/users/streaming -> {page_details, data: [StreamingSessionSchema]}."""
-    params = {k: v for k, v in filters.items() if v is not None}
+    params = {
+        key: value for key, value in filters.items() if isinstance(value, str | int | float | bool)
+    }
     with _client(session_jwt) as client:
         resp = client.get("/v1/users/streaming", params=params)
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
 
 
-def get_streaming(session_id: str, session_jwt: str) -> dict[str, Any]:
+def get_streaming(session_id: str, session_jwt: str) -> dict[str, object]:
     """GET /v1/users/streaming/{session_id} -> StreamingSessionSchema."""
     with _client(session_jwt) as client:
         resp = client.get(f"/v1/users/streaming/{session_id}")
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
 
 
-def list_audit_logs(session_jwt: str, **filters: Any) -> dict[str, Any]:
+def list_audit_logs(session_jwt: str, **filters: object) -> dict[str, object]:
     """GET /v2/user/audit-logs -> {page_details, data: [AuditLogResponse]}."""
-    params = {k: v for k, v in filters.items() if v is not None}
+    params = {
+        key: value for key, value in filters.items() if isinstance(value, str | int | float | bool)
+    }
     with _client(session_jwt) as client:
         resp = client.get("/v2/user/audit-logs", params=params)
-    return cast(dict[str, Any], _json_or_raise(resp))
+    return _json_object_or_raise(resp)
diff --git a/aai_cli/auth/flow.py b/aai_cli/auth/flow.py
index f7c10226..d0f88e45 100644
--- a/aai_cli/auth/flow.py
+++ b/aai_cli/auth/flow.py
@@ -3,11 +3,10 @@
 import webbrowser
 from collections.abc import Mapping
 from dataclasses import dataclass
-from typing import Any
 
 from rich.markup import escape
 
-from aai_cli import output
+from aai_cli import jsonshape, output
 from aai_cli.auth import ams, discovery, endpoints, loopback
 from aai_cli.errors import APIError
 
@@ -23,18 +22,41 @@ class LoginResult:
     account_id: int
 
 
-def _require(mapping: Mapping[str, Any], key: str, what: str) -> Any:
+def _as_mapping(value: object) -> dict[str, object] | None:
+    return jsonshape.as_mapping(value)
+
+
+def _mapping_list(value: object) -> list[dict[str, object]]:
+    return jsonshape.mapping_list(value)
+
+
+def _require_int(mapping: Mapping[str, object], key: str, what: str) -> int:
+    value = _require(mapping, key, what)
+    if isinstance(value, bool):
+        raise APIError(
+            f"Login failed: the server response was missing {what}. Run 'aai login' again."
+        )
+    if isinstance(value, int):
+        return value
+    if isinstance(value, str):
+        try:
+            return int(value)
+        except ValueError as exc:
+            raise APIError(
+                f"Login failed: the server response was missing {what}. Run 'aai login' again."
+            ) from exc
+    raise APIError(f"Login failed: the server response was missing {what}. Run 'aai login' again.")
+
+
+def _require(mapping: Mapping[str, object], key: str, what: str) -> object:
     """Pull a required field out of an AMS response, or raise a clean APIError.
 
     AMS only returns HTTP errors for outright failures; a 200 with an unexpected
     shape would otherwise KeyError into an ugly traceback, so map that to the same
-    "run login again" message the rest of the flow uses. The return stays `Any`
-    because AMS JSON leaves are untyped and callers coerce them (int()/str()).
+    "run login again" message the rest of the flow uses. The return stays `object`
+    because AMS JSON leaves are narrowed by callers with int()/str().
     """
-    # Nested calls pass an `Any`-typed value that the type checker accepts as a
-    # Mapping but which may be a non-mapping at runtime (e.g. a malformed 200),
-    # so still guard with isinstance before calling .get.
-    value = mapping.get(key) if isinstance(mapping, dict) else None
+    value = mapping.get(key)
     if value is None:
         raise APIError(
             f"Login failed: the server response was missing {what}. Run 'aai login' again."
@@ -42,13 +64,25 @@ def _require(mapping: Mapping[str, Any], key: str, what: str) -> Any:
     return value
 
 
+def _require_mapping(mapping: Mapping[str, object], key: str, what: str) -> dict[str, object]:
+    value = _require(mapping, key, what)
+    mapped = _as_mapping(value)
+    if mapped is None:
+        raise APIError(
+            f"Login failed: the server response was missing {what}. Run 'aai login' again."
+        )
+    return mapped
+
+
 def _open_browser(url: str) -> None:
     """Open the system browser, falling back to printing the URL."""
-    output.console.print(f"Opening your browser to sign in:\n  [aai.url]{escape(url)}[/aai.url]")
+    output.error_console.print(
+        f"Opening your browser to sign in:\n  [aai.url]{escape(url)}[/aai.url]"
+    )
     try:
         webbrowser.open(url)
     except Exception:  # noqa: BLE001 - opening a browser is best-effort
-        output.console.print(
+        output.error_console.print(
             "[aai.muted]Could not open a browser; open the URL above manually.[/aai.muted]"
         )
 
@@ -57,7 +91,7 @@ def _capture() -> loopback.CallbackResult:
     return loopback.capture_callback()
 
 
-def _is_reusable_cli_token(token: dict[str, Any]) -> bool:
+def _is_reusable_cli_token(token: dict[str, object]) -> bool:
     """A live 'AssemblyAI CLI' token whose key the list actually exposes."""
     # List endpoints may key the display name as either "name" or "token_name"
     # (the latter matches the create payload); accept either so we don't mint a
@@ -79,10 +113,12 @@ def find_or_create_cli_key(account_id: int, session_jwt: str) -> str:
             suggestion="Create a project in the AssemblyAI dashboard, then run 'aai login' again.",
         )
     for entry in projects:
-        for token in entry.get("tokens", []):
+        for token in _mapping_list(entry.get("tokens")):
             if _is_reusable_cli_token(token):
                 return str(token["api_key"])
-    project_id = _require(_require(projects[0], "project", "a project"), "id", "a project id")
+    project_id = _require_int(
+        _require_mapping(projects[0], "project", "a project"), "id", "a project id"
+    )
     created = ams.create_token(account_id, project_id, endpoints.CLI_TOKEN_NAME, session_jwt)
     return str(_require(created, "api_key", "an API key"))
 
@@ -104,29 +140,34 @@ def run_login_flow() -> LoginResult:
         )
 
     disc = ams.discover(result.token)
-    organizations = disc.get("organizations") or []
+    organizations = _mapping_list(disc.get("organizations"))
     if not organizations:
         raise APIError(
             "Signed in, but this identity has no AssemblyAI account yet. "
             f"Create one at {endpoints.signup_url()}, then run 'aai login' again."
         )
     if len(organizations) > 1:
-        chosen = organizations[0].get("organization_name") or organizations[0].get(
-            "organization_id", "the first"
+        chosen = str(
+            organizations[0].get("organization_name")
+            or organizations[0].get("organization_id", "the first")
         )
-        output.console.print(
+        output.error_console.print(
             f"[aai.muted]Found {len(organizations)} organizations; signing in to "
             f"'{chosen}'.[/aai.muted]"
         )
-    organization_id = _require(organizations[0], "organization_id", "an organization id")
+    organization_id = str(_require(organizations[0], "organization_id", "an organization id"))
 
-    intermediate_session_token = _require(disc, "intermediate_session_token", "a session token")
+    intermediate_session_token = str(
+        _require(disc, "intermediate_session_token", "a session token")
+    )
     signed_in = ams.exchange(intermediate_session_token, organization_id)
-    session_jwt = _require(signed_in, "session_jwt", "a session token")
-    session_token = _require(signed_in, "session_token", "a session token")
+    session_jwt = str(_require(signed_in, "session_jwt", "a session token"))
+    session_token = str(_require(signed_in, "session_token", "a session token"))
     # `exchange` already returns the signed-in account, so read the id from it
     # rather than making a second GET /v1/auth round-trip.
-    account_id = int(_require(_require(signed_in, "account", "an account"), "id", "an account id"))
+    account_id = _require_int(
+        _require_mapping(signed_in, "account", "an account"), "id", "an account id"
+    )
     api_key = find_or_create_cli_key(account_id, session_jwt)
     return LoginResult(
         api_key=api_key,
diff --git a/aai_cli/auth/loopback.py b/aai_cli/auth/loopback.py
index 42cd889d..7042031d 100644
--- a/aai_cli/auth/loopback.py
+++ b/aai_cli/auth/loopback.py
@@ -46,7 +46,7 @@ def do_GET(self) -> None:  # stdlib API name
             self.wfile.write(_SUCCESS_HTML)
             done.set()
 
-        def log_message(self, *args: object) -> None:  # silence stderr logging
+        def log_message(self, format: str, *args: object) -> None:  # silence stderr logging
             pass
 
     try:
diff --git a/aai_cli/client.py b/aai_cli/client.py
index 5eaac4c9..3aa9d507 100644
--- a/aai_cli/client.py
+++ b/aai_cli/client.py
@@ -2,8 +2,8 @@
 
 import contextlib
 import json
-from collections.abc import Callable, Iterable, Iterator
-from typing import Any
+from collections.abc import Callable, Generator, Iterable
+from typing import Any, Literal, Protocol
 
 import assemblyai as aai
 from assemblyai.streaming.v3 import (
@@ -13,10 +13,28 @@
     StreamingParameters,
 )
 
-from aai_cli import environments, stdio
+from aai_cli import environments, jsonshape, stdio
 from aai_cli.errors import APIError, CLIError, UsageError, auth_failure, is_auth_failure
 
 SAMPLE_AUDIO_URL = "https://assembly.ai/wildfires.mp3"
+_StreamHandler = Callable[[Any, Any], object]
+
+
+class _StreamingClientLike(Protocol):
+    def on(self, event: StreamingEvents, handler: _StreamHandler) -> None: ...
+
+    def connect(self, params: StreamingParameters) -> None: ...
+
+    def stream(self, data: bytes | Generator[bytes, None, None] | Iterable[bytes]) -> None: ...
+
+    def disconnect(self, *, terminate: Literal[False, True] = False) -> None: ...
+
+
+def _make_streaming_client(api_key: str) -> _StreamingClientLike:
+    client: _StreamingClientLike = StreamingClient(
+        StreamingClientOptions(api_key=api_key, api_host=environments.active().streaming_host)
+    )
+    return client
 
 
 def resolve_audio_source(source: str | None, *, sample: bool) -> str:
@@ -40,7 +58,7 @@ def _configure(api_key: str) -> None:
 
 
 @contextlib.contextmanager
-def _sdk_errors(message: str) -> Iterator[None]:
+def _sdk_errors(message: str) -> Generator[None]:
     """Normalize SDK exceptions for one call: a rejected key becomes a single clean
     auth_failure(); any other error becomes APIError(f"{message}: {exc}").
 
@@ -124,11 +142,18 @@ def _transcript_text(transcript: Any) -> str:
     return str(getattr(transcript, "text", "") or "")
 
 
+def _objects(value: object) -> list[object]:
+    return jsonshape.object_list(value)
+
+
 def _render_utterances(transcript: Any) -> str:
-    utterances = getattr(transcript, "utterances", None) or []
+    utterances = _objects(getattr(transcript, "utterances", None))
     if not utterances:
         return _transcript_text(transcript)
-    return "\n".join(f"Speaker {u.speaker}: {u.text}" for u in utterances)
+    return "\n".join(
+        f"Speaker {getattr(utterance, 'speaker', '')}: {getattr(utterance, 'text', '')}"
+        for utterance in utterances
+    )
 
 
 def _export_srt(transcript: Any) -> str:
@@ -172,11 +197,9 @@ def stream_audio(
     Forwards Begin/Turn/Termination events to the callbacks; raises APIError on a stream error.
     `params` is a fully-built StreamingParameters (sample_rate/speech_model/etc).
     """
-    sc = StreamingClient(
-        StreamingClientOptions(api_key=api_key, api_host=environments.active().streaming_host)
-    )
+    sc = _make_streaming_client(api_key)
 
-    def _guard(cb: Callable[[Any], Any]) -> Callable[[Any, Any], None]:
+    def _guard(cb: Callable[[Any], Any]) -> _StreamHandler:
         # Event callbacks run on the SDK's reader thread. If the downstream pipe is
         # gone (e.g. a Ctrl-C'd `| aai llm`, or `| head`), writing a turn raises
         # BrokenPipeError there with no handler -> an ugly thread traceback. Swallow
@@ -191,13 +214,17 @@ def handler(_client: Any, event: Any) -> None:
         return handler
 
     errors: list[object] = []
+
+    def _record_error(_client: object, error: object) -> None:
+        errors.append(error)
+
     if on_begin is not None:
         sc.on(StreamingEvents.Begin, _guard(on_begin))
     if on_turn is not None:
         sc.on(StreamingEvents.Turn, _guard(on_turn))
     if on_termination is not None:
         sc.on(StreamingEvents.Termination, _guard(on_termination))
-    sc.on(StreamingEvents.Error, lambda _client, error: errors.append(error))
+    sc.on(StreamingEvents.Error, _record_error)
 
     with _sdk_errors("Could not start streaming session"):
         sc.connect(params)
diff --git a/aai_cli/commands/account.py b/aai_cli/commands/account.py
index 2e546662..435b561a 100644
--- a/aai_cli/commands/account.py
+++ b/aai_cli/commands/account.py
@@ -1,13 +1,15 @@
 from __future__ import annotations
 
+from collections.abc import Mapping
 from datetime import UTC, date, datetime, timedelta
-from typing import Any
 
 import typer
+from rich.console import Group
 from rich.markup import escape
 from rich.table import Table
+from rich.text import Text
 
-from aai_cli import help_panels, output
+from aai_cli import help_panels, jsonshape, output, timeparse
 from aai_cli.auth import ams
 from aai_cli.context import AppState, resolve_session, run_command
 from aai_cli.errors import UsageError
@@ -28,6 +30,90 @@ def _utc_day_start(day: str) -> str:
     return datetime(parsed.year, parsed.month, parsed.day, tzinfo=UTC).isoformat()
 
 
+def _parse_usage_timestamp(value: object) -> datetime | None:
+    return timeparse.parse_iso_utc(value)
+
+
+def _format_usage_day(value: object) -> str:
+    parsed = _parse_usage_timestamp(value)
+    if parsed is None:
+        return str(value or "")
+    return parsed.date().isoformat()
+
+
+def _usage_number(value: object) -> float:
+    if isinstance(value, bool):
+        return 0.0
+    if isinstance(value, int | float):
+        return float(value)
+    if isinstance(value, str):
+        try:
+            return float(value)
+        except ValueError:
+            return 0.0
+    return 0.0
+
+
+def _format_usage_number(value: object) -> str:
+    number = _usage_number(value)
+    if number.is_integer():
+        return f"{int(number):,}"
+    return f"{number:,.6f}".rstrip("0").rstrip(".")
+
+
+def _mapping_list(value: object) -> list[dict[str, object]]:
+    return jsonshape.mapping_list(value)
+
+
+def _usage_items(data: Mapping[str, object]) -> list[dict[str, object]]:
+    return _mapping_list(data.get("usage_items"))
+
+
+def _window_label(item: Mapping[str, object]) -> str:
+    start = _parse_usage_timestamp(item.get("start_timestamp"))
+    end = _parse_usage_timestamp(item.get("end_timestamp"))
+    if start is None or end is None:
+        return _format_usage_day(item.get("start_timestamp"))
+    if end.date() == start.date() + timedelta(days=1):
+        return start.date().isoformat()
+    return f"{start.date().isoformat()} to {end.date().isoformat()}"
+
+
+def _line_item_label(line_item: Mapping[str, object]) -> str:
+    label = next(
+        (
+            str(value)
+            for key in ("name", "product", "service", "feature", "model", "type", "description")
+            if (value := line_item.get(key))
+        ),
+        "",
+    )
+    value = next(
+        (
+            line_item[key]
+            for key in ("total", "quantity", "amount", "usage", "count")
+            if key in line_item
+        ),
+        None,
+    )
+    if label and value is not None:
+        return f"{label}: {_format_usage_number(value)}"
+    if label:
+        return label
+    if value is not None:
+        return _format_usage_number(value)
+    return ""
+
+
+def _line_items_summary(item: Mapping[str, object]) -> str:
+    labels = [
+        label
+        for line_item in _mapping_list(item.get("line_items"))
+        if (label := _line_item_label(line_item))
+    ]
+    return ", ".join(labels)
+
+
 app = typer.Typer(help="Account billing, usage, and limits.")
 
 
@@ -48,7 +134,7 @@ def balance(
     def body(state: AppState, json_mode: bool) -> None:
         _, jwt = resolve_session(state)
         data = ams.get_balance(jwt)
-        cents = data.get("balance_in_cents", 0) or 0
+        cents = _usage_number(data.get("balance_in_cents"))
         output.emit(
             data,
             lambda _d: f"Balance: [aai.success]${cents / 100:,.2f}[/aai.success]",
@@ -69,9 +155,12 @@ def body(state: AppState, json_mode: bool) -> None:
 )
 def usage(
     ctx: typer.Context,
-    start: str = typer.Option(None, "--start", help="Start date (YYYY-MM-DD). Default: 30d ago."),
-    end: str = typer.Option(None, "--end", help="End date (YYYY-MM-DD). Default: today."),
-    window: str = typer.Option(None, "--window", help="Window size, e.g. 'day' or 'month'."),
+    start: str | None = typer.Option(
+        None, "--start", help="Start date (YYYY-MM-DD). Default: 30d ago."
+    ),
+    end: str | None = typer.Option(None, "--end", help="End date (YYYY-MM-DD). Default: today."),
+    window: str | None = typer.Option(None, "--window", help="Window size, e.g. 'day' or 'month'."),
+    include_zero: bool = typer.Option(False, "--all", help="Include zero-usage windows."),
     json_out: bool = typer.Option(False, "--json", help="Output raw JSON."),
 ) -> None:
     """Show usage over a date range (defaults to the last 30 days)."""
@@ -83,15 +172,56 @@ def body(state: AppState, json_mode: bool) -> None:
         end_date = _utc_day_start(end or today.isoformat())
         data = ams.get_usage(jwt, start_date, end_date, window)
 
-        def render(d: dict[str, Any]) -> Table:
-            table = Table("window start", "window end", "total", header_style="aai.heading")
-            for item in d.get("usage_items", []):
-                table.add_row(
-                    escape(str(item["start_timestamp"])),
-                    escape(str(item["end_timestamp"])),
-                    f"{item['total']:,}",
+        def render(d: dict[str, object]) -> object:
+            items = _usage_items(d)
+            shown = (
+                items
+                if include_zero
+                else [item for item in items if _usage_number(item.get("total"))]
+            )
+            total = sum(_usage_number(item.get("total")) for item in items)
+            range_label = f"{_format_usage_day(start_date)} to {_format_usage_day(end_date)} (UTC)"
+            summary = Text(
+                f"Usage total: {_format_usage_number(total)} for {range_label}",
+                style="aai.heading",
+            )
+            if not shown:
+                if items:
+                    return Group(
+                        summary,
+                        Text("No usage in this range.", style="aai.muted"),
+                    )
+                return Group(
+                    summary,
+                    Text("No usage windows returned for this range.", style="aai.muted"),
                 )
-            return table
+
+            shown_with_breakdown = [(item, _line_items_summary(item)) for item in shown]
+            show_breakdown = any(summary for _, summary in shown_with_breakdown)
+            table = (
+                Table("period", "total", "breakdown", header_style="aai.heading")
+                if show_breakdown
+                else Table("period", "total", header_style="aai.heading")
+            )
+            hidden_count = len(items) - len(shown)
+            for item, breakdown in shown_with_breakdown:
+                row = [
+                    escape(_window_label(item)),
+                    _format_usage_number(item.get("total")),
+                ]
+                if show_breakdown:
+                    row.append(escape(breakdown))
+                table.add_row(*row)
+            if hidden_count:
+                return Group(
+                    summary,
+                    table,
+                    Text(
+                        f"Hidden: {hidden_count} zero-usage window(s). Use --all to show them.",
+                        style="aai.muted",
+                    ),
+                )
+            return Group(summary, table)
 
         output.emit(data, render, json_mode=json_mode)
 
@@ -116,10 +246,13 @@ def body(state: AppState, json_mode: bool) -> None:
         account_id, jwt = resolve_session(state)
         data = ams.get_rate_limits(account_id, jwt)
 
-        def render(d: dict[str, Any]) -> Table:
+        def render(d: dict[str, object]) -> Table:
             table = Table("service", "limit", header_style="aai.heading")
-            for limit in d.get("rate_limits", []):
-                table.add_row(escape(str(limit["service"])), f"{limit['magnitude']:,}")
+            for limit in _mapping_list(d.get("rate_limits")):
+                table.add_row(
+                    escape(str(limit.get("service", ""))),
+                    _format_usage_number(limit.get("magnitude")),
+                )
             return table
 
         output.emit(data, render, json_mode=json_mode)
diff --git a/aai_cli/commands/agent.py b/aai_cli/commands/agent.py
index d58f08ac..6dc81e6a 100644
--- a/aai_cli/commands/agent.py
+++ b/aai_cli/commands/agent.py
@@ -32,7 +32,7 @@
 )
 def agent(
     ctx: typer.Context,
-    source: str = typer.Argument(
+    source: str | None = typer.Argument(
         None, help="Audio file path or URL to speak to the agent. Omit to use the microphone."
     ),
     sample: bool = typer.Option(
@@ -42,7 +42,7 @@ def agent(
     system_prompt: str = typer.Option(
         DEFAULT_PROMPT, "--system-prompt", help="System prompt (the agent's persona)."
     ),
-    system_prompt_file: Path = typer.Option(
+    system_prompt_file: Path | None = typer.Option(
         None,
         "--system-prompt-file",
         help="Read the system prompt from a file (overrides --system-prompt).",
@@ -51,7 +51,7 @@ def agent(
     device: int | None = typer.Option(None, "--device", help="Microphone device index."),
     list_voices: bool = typer.Option(False, "--list-voices", help="Print known voices and exit."),
     json_out: bool = typer.Option(False, "--json", help="Emit newline-delimited JSON events."),
-    output_field: str = typer.Option(
+    output_field: str | None = typer.Option(
         None,
         "-o",
         "--output",
@@ -74,7 +74,7 @@ def agent(
         raise typer.Exit(code=0)
 
     def body(state: AppState, json_mode: bool) -> None:
-        text_mode, json_mode = output.stream_output_modes(output_field, json_mode)
+        text_mode, json_mode = output.stream_output_modes(output_field, json_mode=json_mode)
         if voice not in VOICES:
             raise UsageError(
                 f"Unknown voice {voice!r}.",
diff --git a/aai_cli/commands/audit.py b/aai_cli/commands/audit.py
index 6fb2b4eb..f8976478 100644
--- a/aai_cli/commands/audit.py
+++ b/aai_cli/commands/audit.py
@@ -1,22 +1,109 @@
 from __future__ import annotations
 
+from collections.abc import Mapping
+from datetime import datetime
+
 import typer
+from rich.console import Group
 from rich.markup import escape
 from rich.table import Table
+from rich.text import Text
 
-from aai_cli import help_panels, output
+from aai_cli import help_panels, jsonshape, output, timeparse
 from aai_cli.auth import ams
 from aai_cli.context import AppState, resolve_session, run_command
 from aai_cli.help_text import examples_epilog
 
 app = typer.Typer(help="View your account's audit log.")
 
+_LOGIN_ACTIONS = {"login", "login.succeeded", "login__succeeded"}
+_ACTION_LABELS = {
+    "account.create": "Account created",
+    "account.created": "Account created",
+    "account__created": "Account created",
+    "account.tos_accepted": "Terms accepted",
+    "account.tos.accepted": "Terms accepted",
+    "account__tos_accepted": "Terms accepted",
+    "account.upgrade": "Account upgraded",
+    "account.upgraded": "Account upgraded",
+    "account__upgraded": "Account upgraded",
+    "member.create": "Member created",
+    "member.created": "Member created",
+    "member__created": "Member created",
+    "token.create": "API key created",
+    "token.created": "API key created",
+    "token__created": "API key created",
+    "token.rename": "API key renamed",
+    "token.renamed": "API key renamed",
+    "token__renamed": "API key renamed",
+    "login": "Login",
+    "login.succeeded": "Login succeeded",
+    "login__succeeded": "Login succeeded",
+}
+
+
+def _normalize_action(action: object) -> str:
+    return str(action or "").replace("__", ".")
+
+
+def _format_action(action: object) -> str:
+    raw = str(action or "")
+    if raw in _ACTION_LABELS:
+        return _ACTION_LABELS[raw]
+    normalized = _normalize_action(raw)
+    if normalized in _ACTION_LABELS:
+        return _ACTION_LABELS[normalized]
+    return normalized.replace("_", " ").replace(".", " ").strip().capitalize() or "Unknown"
+
+
+def _is_login(entry: Mapping[str, object]) -> bool:
+    raw = str(entry.get("action_taken") or "")
+    return raw in _LOGIN_ACTIONS or _normalize_action(raw) in _LOGIN_ACTIONS
+
+
+def _parse_time(value: object) -> datetime | None:
+    parsed = timeparse.parse_iso_utc(value)
+    return None if parsed is None else parsed.replace(tzinfo=None)
+
+
+def _format_time(value: object) -> str:
+    parsed = _parse_time(value)
+    if parsed is None:
+        return str(value or "")
+    return parsed.strftime("%Y-%m-%d %H:%M:%S")
+
+
+def _actor_label(entry: Mapping[str, object]) -> str:
+    actor_type = str(entry.get("actor_type") or "system")
+    actor_id = entry.get("actor_id")
+    if actor_type == "system":
+        return "system" if actor_id is None else f"system #{actor_id}"
+    return actor_type if actor_id is None else f"{actor_type} #{actor_id}"
+
+
+def _resource_label(entry: Mapping[str, object]) -> str:
+    resource_type = entry.get("resource_type")
+    if not resource_type:
+        return ""
+    resource_id = entry.get("resource_id")
+    label = str(resource_type).replace("_", " ")
+    return label if not resource_id else f"{label} #{resource_id}"
+
+
+def _mapping_list(value: object) -> list[dict[str, object]]:
+    return jsonshape.mapping_list(value)
+
+
+def _audit_rows(payload: Mapping[str, object]) -> list[dict[str, object]]:
+    return _mapping_list(payload.get("data"))
+
 
 @app.command(
     rich_help_panel=help_panels.ACCOUNT,
     epilog=examples_epilog(
         [
             ("Recent audit-log entries", "aai audit --limit 20"),
+            ("Include login events", "aai audit --include-logins"),
             ("Filter by action", "aai audit --action token.create"),
         ]
     ),
@@ -24,8 +111,11 @@
 def audit(
     ctx: typer.Context,
     limit: int = typer.Option(20, "--limit", help="How many entries to show."),
-    action: str = typer.Option(None, "--action", help="Filter by action_taken."),
-    resource: str = typer.Option(None, "--resource", help="Filter by resource_type."),
+    action: str | None = typer.Option(None, "--action", help="Filter by raw action name."),
+    resource: str | None = typer.Option(None, "--resource", help="Filter by raw resource type."),
+    include_logins: bool = typer.Option(
+        False, "--include-logins", help="Show successful login events."
+    ),
     json_out: bool = typer.Option(False, "--json", help="Output raw JSON."),
 ) -> None:
     """List recent audit-log entries for your account."""
@@ -33,24 +123,43 @@ def audit(
     def body(state: AppState, json_mode: bool) -> None:
         _, jwt = resolve_session(state)
         payload = ams.list_audit_logs(jwt, limit=limit, action_taken=action, resource_type=resource)
-        rows = payload.get("data", [])
-
-        def render(data: list[dict[str, object]]) -> Table:
-            table = Table("time", "actor", "action", "resource", header_style="aai.heading")
-            for entry in data:
-                actor = str(entry["actor_type"])
-                actor_id = entry.get("actor_id")
-                if actor_id is not None:
-                    actor = f"{actor}:{actor_id}"
-                resource_label = entry.get("resource_type") or ""
-                resource_id = entry.get("resource_id")
-                if resource_label and resource_id:
-                    resource_label = f"{resource_label}:{resource_id}"
+        rows = _audit_rows(payload)
+
+        def render(data: list[dict[str, object]]) -> object:
+            hide_logins = not include_logins and action is None
+            shown = [entry for entry in data if not (hide_logins and _is_login(entry))]
+            hidden_logins = len(data) - len(shown)
+            if not shown:
+                message = (
+                    "No notable audit events in the recent log."
+                    if hidden_logins
+                    else "No audit events found."
+                )
+                if hidden_logins:
+                    return Group(
+                        Text(message, style="aai.muted"),
+                        Text(
+                            f"Hidden: {hidden_logins} login event(s). Use --include-logins to show them.",
+                            style="aai.muted",
+                        ),
+                    )
+                return Text(message, style="aai.muted")
+
+            table = Table("when (UTC)", "event", "resource", "actor", header_style="aai.heading")
+            for entry in shown:
                 table.add_row(
-                    escape(str(entry["log_time"])),
-                    escape(actor),
-                    escape(str(entry["action_taken"])),
-                    escape(str(resource_label)),
+                    escape(_format_time(entry.get("log_time"))),
+                    escape(_format_action(entry.get("action_taken"))),
+                    escape(_resource_label(entry)),
+                    escape(_actor_label(entry)),
+                )
+            if hidden_logins:
+                return Group(
+                    table,
+                    Text(
+                        f"Hidden: {hidden_logins} login event(s). Use --include-logins to show them.",
+                        style="aai.muted",
+                    ),
                 )
             return table
 
diff --git a/aai_cli/commands/claude.py b/aai_cli/commands/claude.py
index a9d50481..354e30a8 100644
--- a/aai_cli/commands/claude.py
+++ b/aai_cli/commands/claude.py
@@ -25,7 +25,7 @@
 _STEPS_HEADING = "AssemblyAI coding-agent setup:"
 
 
-def _run(cmd: list[str], *, timeout: float = 120) -> subprocess.CompletedProcess:
+def _run(cmd: list[str], *, timeout: float = 120) -> subprocess.CompletedProcess[str]:
     # stdin=DEVNULL so a child that would otherwise prompt (npx's "Ok to proceed?",
     # a `claude` confirmation) gets EOF and fails fast instead of hanging forever on
     # input the user can't see (its stdout is captured). timeout is a final backstop.
@@ -33,6 +33,7 @@ def _run(cmd: list[str], *, timeout: float = 120) -> subprocess.CompletedProcess
         return subprocess.run(
             cmd,
             capture_output=True,
+            check=False,
             text=True,
             stdin=subprocess.DEVNULL,
             timeout=timeout,
diff --git a/aai_cli/commands/doctor.py b/aai_cli/commands/doctor.py
index d7e53437..4f5bd8a1 100644
--- a/aai_cli/commands/doctor.py
+++ b/aai_cli/commands/doctor.py
@@ -2,7 +2,8 @@
 
 import shutil
 import sys
-from typing import TypedDict
+from collections.abc import Mapping, Sequence
+from typing import Protocol, TypedDict
 
 import typer
 from rich.markup import escape
@@ -25,6 +26,15 @@ class Check(TypedDict):
     fix: str | None
 
 
+class DoctorResult(TypedDict):
+    ok: bool
+    checks: list[Check]
+
+
+class _SoundDeviceModule(Protocol):
+    def query_devices(self) -> Sequence[Mapping[str, object]]: ...
+
+
 # Status -> (affordance symbol, render style). "fail" is a blocker; "warn" is
 # degraded-but-usable. Drives the per-check glyph in `_render`.
 _SYMBOL = {
@@ -112,10 +122,21 @@ def _check_ffmpeg() -> Check:
 
 def _probe_input_devices() -> int:
     """Number of available microphone (input) devices. Raises if audio is unavailable."""
-    import sounddevice as sd
-
+    sd = _sounddevice()
     devices = sd.query_devices()
-    return sum(1 for d in devices if d.get("max_input_channels", 0) > 0)
+    return sum(1 for device in devices if _input_channels(device) > 0)
+
+
+def _sounddevice() -> _SoundDeviceModule:
+    import sounddevice as module
+
+    sd: _SoundDeviceModule = module
+    return sd
+
+
+def _input_channels(device: Mapping[str, object]) -> int:
+    channels = device.get("max_input_channels")
+    return channels if isinstance(channels, int) else 0
 
 
 def _check_audio() -> Check:
@@ -175,8 +196,8 @@ def _check_coding_agent() -> Check:
     }
 
 
-def _render(data: dict[str, object]) -> str:
-    checks: list[Check] = data["checks"]  # type: ignore[assignment]
+def _render(data: DoctorResult) -> str:
+    checks = data["checks"]
     lines = [output.heading("Environment check")]
     for c in checks:
         symbol, style = _SYMBOL.get(c["status"], (theme.SYMBOL_HINT, "aai.muted"))
@@ -218,7 +239,8 @@ def body(state: AppState, json_mode: bool) -> None:
             _check_coding_agent(),
         ]
         ok = not any(c["status"] == "fail" for c in checks)
-        output.emit({"ok": ok, "checks": checks}, _render, json_mode=json_mode)
+        payload: DoctorResult = {"ok": ok, "checks": checks}
+        output.emit(payload, _render, json_mode=json_mode)
         if not ok:
             raise typer.Exit(code=1)
 
diff --git a/aai_cli/commands/init.py b/aai_cli/commands/init.py
index 97607054..a6dff8cb 100644
--- a/aai_cli/commands/init.py
+++ b/aai_cli/commands/init.py
@@ -71,8 +71,12 @@ def _resolve_dir(directory: str | None, template: str, *, here: bool) -> Path:
 )
 def init(
     ctx: typer.Context,
-    template: str = typer.Argument(None, help="Template to scaffold (omit to pick interactively)."),
-    directory: str = typer.Argument(None, help="Target directory (default: <template>-app)."),
+    template: str | None = typer.Argument(
+        None, help="Template to scaffold (omit to pick interactively)."
+    ),
+    directory: str | None = typer.Argument(
+        None, help="Target directory (default: <template>-app)."
+    ),
     no_install: bool = typer.Option(
         False, "--no-install", help="Scaffold only; don't install or launch."
     ),
diff --git a/aai_cli/commands/keys.py b/aai_cli/commands/keys.py
index 54fd2850..baba745a 100644
--- a/aai_cli/commands/keys.py
+++ b/aai_cli/commands/keys.py
@@ -4,7 +4,7 @@
 from rich.markup import escape
 from rich.table import Table
 
-from aai_cli import output
+from aai_cli import jsonshape, output
 from aai_cli.auth import ams
 from aai_cli.context import AppState, resolve_session, run_command
 from aai_cli.errors import APIError
@@ -13,6 +13,28 @@
 app = typer.Typer(help="List, create, and rename your AssemblyAI API keys.", no_args_is_help=True)
 
 
+def _mapping(value: object) -> dict[str, object] | None:
+    return jsonshape.as_mapping(value)
+
+
+def _mapping_list(value: object) -> list[dict[str, object]]:
+    return jsonshape.mapping_list(value)
+
+
+def _project_id(project: dict[str, object]) -> int | None:
+    value = project.get("id")
+    if isinstance(value, bool):
+        return None
+    if isinstance(value, int):
+        return value
+    if isinstance(value, str):
+        try:
+            return int(value)
+        except ValueError:
+            return None
+    return None
+
+
 @app.command(
     name="list",
     epilog=examples_epilog(
@@ -33,17 +55,18 @@ def body(state: AppState, json_mode: bool) -> None:
         projects = ams.list_projects(account_id, jwt)
         rows: list[dict[str, object]] = []
         for entry in projects:
-            project_name = entry["project"]["name"]
-            for token in entry.get("tokens", []):
-                rows.append(
-                    {
-                        "id": token["id"],
-                        "name": token["name"],
-                        "project": project_name,
-                        "key": output.mask_secret(str(token["api_key"])),
-                        "disabled": token["is_disabled"],
-                    }
-                )
+            project = _mapping(entry.get("project")) or {}
+            project_name = project.get("name", "")
+            rows.extend(
+                {
+                    "id": token.get("id", ""),
+                    "name": token.get("name") or token.get("token_name", ""),
+                    "project": project_name,
+                    "key": output.mask_secret(str(token.get("api_key", ""))),
+                    "disabled": bool(token.get("is_disabled")),
+                }
+                for token in _mapping_list(entry.get("tokens"))
+            )
 
         def render(data: list[dict[str, object]]) -> Table:
             table = Table("id", "name", "project", "key", "disabled", header_style="aai.heading")
@@ -73,7 +96,7 @@ def render(data: list[dict[str, object]]) -> Table:
 def create(
     ctx: typer.Context,
     name: str = typer.Option(..., "--name", help="A label for the new key."),
-    project_id: int = typer.Option(
+    project_id: int | None = typer.Option(
         None, "--project", help="Project id to create the key in (defaults to your first)."
     ),
     json_out: bool = typer.Option(False, "--json", help="Output raw JSON."),
@@ -87,7 +110,12 @@ def body(state: AppState, json_mode: bool) -> None:
             projects = ams.list_projects(account_id, jwt)
             if not projects:
                 raise APIError("Your account has no project to create a key in.")
-            pid = projects[0]["project"]["id"]
+            project = _mapping(projects[0].get("project"))
+            if project is None:
+                raise APIError("Your account has no project to create a key in.")
+            pid = _project_id(project)
+            if pid is None:
+                raise APIError("Your account has no project to create a key in.")
         created = ams.create_token(account_id, pid, name, jwt)
         output.emit(
             created,
diff --git a/aai_cli/commands/llm.py b/aai_cli/commands/llm.py
index a9407429..4ecd10e7 100644
--- a/aai_cli/commands/llm.py
+++ b/aai_cli/commands/llm.py
@@ -25,13 +25,13 @@
 )
 def llm(
     ctx: typer.Context,
-    prompt: str = typer.Argument(None, help="The prompt to send to the model."),
+    prompt: str | None = typer.Argument(None, help="The prompt to send to the model."),
     # Note: text piped on stdin is injected into the prompt (e.g. `cat notes | aai llm "summarize"`).
     model: str = typer.Option(gateway.DEFAULT_MODEL, "--model", help="LLM Gateway model."),
-    transcript_id: str = typer.Option(
+    transcript_id: str | None = typer.Option(
         None, "--transcript-id", help="Inject this transcript's text into the prompt."
     ),
-    system: str = typer.Option(None, "--system", help="Optional system prompt."),
+    system: str | None = typer.Option(None, "--system", help="Optional system prompt."),
     follow: bool = typer.Option(
         False,
         "--follow",
@@ -40,7 +40,7 @@ def llm(
         "the answer in place on every finalized turn (e.g. aai stream -o text | aai "
         'llm -f "summarize action items as I talk"). Ctrl-C to stop.',
     ),
-    output_field: str = typer.Option(
+    output_field: str | None = typer.Option(
         None,
         "-o",
         "--output",
@@ -67,6 +67,7 @@ def llm(
     def follow_body(state: AppState, json_mode: bool) -> None:
         if not prompt:
             raise UsageError("Provide a prompt to run over the streamed transcript.")
+        prompt_text = prompt
         if output_field is not None:
             raise UsageError(
                 "--output applies to one-shot mode; --follow renders a live panel "
@@ -86,7 +87,7 @@ def follow_body(state: AppState, json_mode: bool) -> None:
 
         def ask(transcript_text: str) -> str:
             messages = gateway.build_messages(
-                prompt, system=system, transcript_text=transcript_text
+                prompt_text, system=system, transcript_text=transcript_text
             )
             response = gateway.complete(
                 api_key, model=model, messages=messages, max_tokens=max_tokens
@@ -109,13 +110,14 @@ def body(state: AppState, json_mode: bool) -> None:
                 "Provide a prompt.",
                 suggestion="Or pass --list-models to see available models.",
             )
+        prompt_text = prompt
         output.validate_output_field(output_field, ("text", "json"))
         api_key = config.resolve_api_key(profile=state.profile)
         # Text piped on stdin becomes the content the prompt operates on, unless an
         # explicit --transcript-id is given (that injects server-side and takes priority).
         stdin_text = stdio.piped_stdin_text() if not transcript_id else None
         messages = gateway.build_messages(
-            prompt, system=system, transcript_id=transcript_id, transcript_text=stdin_text
+            prompt_text, system=system, transcript_id=transcript_id, transcript_text=stdin_text
         )
         response = gateway.complete(
             api_key,
@@ -127,7 +129,7 @@ def body(state: AppState, json_mode: bool) -> None:
         content = gateway.content_of(response)
         if output_field == "text":
             # Just the answer, raw — so `… | aai llm -o text "…" | next` composes cleanly.
-            print(content)
+            output.emit_text(content)
             return
         output.emit(
             {"model": model, "output": content, "usage": gateway.usage_of(response)},
diff --git a/aai_cli/commands/login.py b/aai_cli/commands/login.py
index 7b172bbe..db42bedd 100644
--- a/aai_cli/commands/login.py
+++ b/aai_cli/commands/login.py
@@ -24,7 +24,7 @@
 )
 def login(
     ctx: typer.Context,
-    api_key: str = typer.Option(None, "--api-key", help="Provide key non-interactively."),
+    api_key: str | None = typer.Option(None, "--api-key", help="Provide key non-interactively."),
     json_out: bool = typer.Option(False, "--json", help="Output raw JSON."),
 ) -> None:
     """Authenticate via your browser; stores a CLI API key."""
diff --git a/aai_cli/commands/sessions.py b/aai_cli/commands/sessions.py
index 6600a096..176da677 100644
--- a/aai_cli/commands/sessions.py
+++ b/aai_cli/commands/sessions.py
@@ -5,7 +5,7 @@
 from rich.table import Table
 from rich.text import Text
 
-from aai_cli import output, theme
+from aai_cli import jsonshape, output, theme
 from aai_cli.auth import ams
 from aai_cli.context import AppState, resolve_session, run_command
 from aai_cli.help_text import examples_epilog
@@ -27,6 +27,10 @@
 )
 
 
+def _session_rows(value: object) -> list[dict[str, object]]:
+    return jsonshape.mapping_list(value)
+
+
 @app.command(
     name="list",
     epilog=examples_epilog(
@@ -39,7 +43,9 @@
 def list_(
     ctx: typer.Context,
     limit: int = typer.Option(10, "--limit", help="How many sessions to show."),
-    status: str = typer.Option(None, "--status", help="Filter: created, completed, or error."),
+    status: str | None = typer.Option(
+        None, "--status", help="Filter: created, completed, or error."
+    ),
     json_out: bool = typer.Option(False, "--json", help="Output raw JSON."),
 ) -> None:
     """List recent streaming sessions."""
@@ -47,7 +53,7 @@ def list_(
     def body(state: AppState, json_mode: bool) -> None:
         _, jwt = resolve_session(state)
         payload = ams.list_streaming(jwt, limit=limit, status=status)
-        rows = payload.get("data", [])
+        rows = _session_rows(payload.get("data"))
 
         def render(data: list[dict[str, object]]) -> Table:
             table = Table(
diff --git a/aai_cli/commands/stream.py b/aai_cli/commands/stream.py
index 8705221b..a7ef890e 100644
--- a/aai_cli/commands/stream.py
+++ b/aai_cli/commands/stream.py
@@ -36,7 +36,7 @@
 )
 def stream(
     ctx: typer.Context,
-    source: str = typer.Argument(
+    source: str | None = typer.Argument(
         None,
         help="Audio file path, URL, or YouTube URL to stream. Omit to use the microphone.",
     ),
@@ -51,55 +51,67 @@ def stream(
     speech_model: str = typer.Option(
         DEFAULT_SPEECH_MODEL, "--speech-model", help="Streaming speech model."
     ),
-    encoding: str = typer.Option(None, "--encoding", help="pcm_s16le or pcm_mulaw."),
-    language_detection: bool = typer.Option(
+    encoding: str | None = typer.Option(None, "--encoding", help="pcm_s16le or pcm_mulaw."),
+    language_detection: bool | None = typer.Option(
         None, "--language-detection", help="Auto-detect the spoken language."
     ),
-    domain: str = typer.Option(None, "--domain", help="Domain preset (e.g. medical)."),
+    domain: str | None = typer.Option(None, "--domain", help="Domain preset (e.g. medical)."),
     # turn detection
-    end_of_turn_confidence_threshold: float = typer.Option(
+    end_of_turn_confidence_threshold: float | None = typer.Option(
         None, "--end-of-turn-confidence-threshold", help="0-1 end-of-turn confidence."
     ),
-    min_turn_silence: int = typer.Option(None, "--min-turn-silence", help="Min turn silence (ms)."),
-    max_turn_silence: int = typer.Option(None, "--max-turn-silence", help="Max turn silence (ms)."),
-    vad_threshold: float = typer.Option(None, "--vad-threshold", help="Voice-activity threshold."),
-    format_turns: bool = typer.Option(
+    min_turn_silence: int | None = typer.Option(
+        None, "--min-turn-silence", help="Min turn silence (ms)."
+    ),
+    max_turn_silence: int | None = typer.Option(
+        None, "--max-turn-silence", help="Max turn silence (ms)."
+    ),
+    vad_threshold: float | None = typer.Option(
+        None, "--vad-threshold", help="Voice-activity threshold."
+    ),
+    format_turns: bool | None = typer.Option(
         None, "--format-turns/--no-format-turns", help="Punctuate/format finalized turns."
     ),
-    include_partial_turns: bool = typer.Option(
+    include_partial_turns: bool | None = typer.Option(
         None, "--include-partial-turns", help="Emit partial turns."
     ),
     # features
-    keyterms_prompt: list[str] = typer.Option(
+    keyterms_prompt: list[str] | None = typer.Option(
         None, "--keyterms-prompt", help="Boost a key term (repeatable)."
     ),
-    filter_profanity: bool = typer.Option(None, "--filter-profanity", help="Mask profanity."),
-    speaker_labels: bool = typer.Option(None, "--speaker-labels", help="Label speakers."),
-    max_speakers: int = typer.Option(None, "--max-speakers", help="Max speakers."),
-    voice_focus: str = typer.Option(None, "--voice-focus", help="near_field or far_field."),
-    voice_focus_threshold: float = typer.Option(
+    filter_profanity: bool | None = typer.Option(
+        None, "--filter-profanity", help="Mask profanity."
+    ),
+    speaker_labels: bool | None = typer.Option(None, "--speaker-labels", help="Label speakers."),
+    max_speakers: int | None = typer.Option(None, "--max-speakers", help="Max speakers."),
+    voice_focus: str | None = typer.Option(None, "--voice-focus", help="near_field or far_field."),
+    voice_focus_threshold: float | None = typer.Option(
         None, "--voice-focus-threshold", help="Voice-focus threshold."
     ),
-    redact_pii: bool = typer.Option(None, "--redact-pii", help="Redact PII from turns."),
-    redact_pii_policy: str = typer.Option(
+    redact_pii: bool | None = typer.Option(None, "--redact-pii", help="Redact PII from turns."),
+    redact_pii_policy: str | None = typer.Option(
         None, "--redact-pii-policy", help="Comma-separated PII policies."
     ),
-    redact_pii_sub: str = typer.Option(None, "--redact-pii-sub", help="hash or entity_name."),
-    inactivity_timeout: int = typer.Option(
+    redact_pii_sub: str | None = typer.Option(
+        None, "--redact-pii-sub", help="hash or entity_name."
+    ),
+    inactivity_timeout: int | None = typer.Option(
         None, "--inactivity-timeout", help="Auto-close after N seconds idle."
     ),
-    webhook_url: str = typer.Option(None, "--webhook-url", help="Webhook URL."),
-    webhook_auth_header: str = typer.Option(
+    webhook_url: str | None = typer.Option(None, "--webhook-url", help="Webhook URL."),
+    webhook_auth_header: str | None = typer.Option(
         None, "--webhook-auth-header", help="Webhook auth header as NAME:VALUE."
     ),
     # escape hatch
-    config_kv: list[str] = typer.Option(
+    config_kv: list[str] | None = typer.Option(
         None, "--config", help="Set any StreamingParameters field as KEY=VALUE (repeatable)."
     ),
-    config_file: str = typer.Option(None, "--config-file", help="JSON file of streaming fields."),
+    config_file: str | None = typer.Option(
+        None, "--config-file", help="JSON file of streaming fields."
+    ),
     # existing
-    prompt: str = typer.Option(None, "--prompt", help="Bias the speech model (u3-pro)."),
-    llm_prompt: list[str] = typer.Option(
+    prompt: str | None = typer.Option(None, "--prompt", help="Bias the speech model (u3-pro)."),
+    llm_prompt: list[str] | None = typer.Option(
         None,
         "--llm",
         help="Run a prompt over the live transcript through LLM Gateway, refreshing the "
@@ -109,7 +121,7 @@ def stream(
     model: str = typer.Option(llm.DEFAULT_MODEL, "--model", help="LLM Gateway model."),
     max_tokens: int = typer.Option(llm.DEFAULT_MAX_TOKENS, "--max-tokens", help="Max tokens."),
     json_out: bool = typer.Option(False, "--json", help="Emit newline-delimited JSON events."),
-    output_field: str = typer.Option(
+    output_field: str | None = typer.Option(
         None,
         "-o",
         "--output",
@@ -128,7 +140,7 @@ def stream(
     """
 
     def body(state: AppState, json_mode: bool) -> None:
-        text_mode, json_mode = output.stream_output_modes(output_field, json_mode)
+        text_mode, json_mode = output.stream_output_modes(output_field, json_mode=json_mode)
 
         def make_flags(rate: int) -> dict[str, object]:
             flags: dict[str, object] = {
@@ -168,7 +180,7 @@ def make_flags(rate: int) -> dict[str, object]:
                 overrides=list(config_kv or []),
                 config_file=config_file,
             )
-            gateway = code_gen.gateway_options(llm_prompt, model, max_tokens)
+            gateway = code_gen.gateway_options(list(llm_prompt or []), model, max_tokens)
             output.print_code(code_gen.stream(merged, llm=gateway))
             return
 
@@ -190,7 +202,8 @@ def make_flags(rate: int) -> dict[str, object]:
         renderer = StreamRenderer(json_mode=json_mode, text_mode=text_mode)
         # In --llm mode the answer is rendered live by a FollowRenderer instead of the
         # raw turns; transcript accumulates the finalized turns we re-run the chain over.
-        follow = FollowRenderer(json_mode=json_mode) if llm_prompt else None
+        llm_prompts = list(llm_prompt or [])
+        follow = FollowRenderer(json_mode=json_mode) if llm_prompts else None
         transcript: list[str] = []
 
         def on_turn(event: object) -> None:
@@ -207,7 +220,7 @@ def on_turn(event: object) -> None:
             transcript.append(text)
             answer = llm.run_chain(
                 api_key,
-                list(llm_prompt),
+                llm_prompts,
                 transcript_text=" ".join(transcript),
                 model=model,
                 max_tokens=max_tokens,
diff --git a/aai_cli/commands/transcribe.py b/aai_cli/commands/transcribe.py
index 4e9e910d..261cb405 100644
--- a/aai_cli/commands/transcribe.py
+++ b/aai_cli/commands/transcribe.py
@@ -50,84 +50,118 @@ def _render_transform_steps(d: dict[str, Any]) -> str:
 )
 def transcribe(
     ctx: typer.Context,
-    source: str = typer.Argument(None, help="Audio file path, public URL, or YouTube URL."),
+    source: str | None = typer.Argument(None, help="Audio file path, public URL, or YouTube URL."),
     sample: bool = typer.Option(False, "--sample", help="Use the hosted wildfires.mp3 sample."),
     # model & language
-    speech_model: str = typer.Option(None, "--speech-model", help="best, nano, slam-1, universal."),
-    language_code: str = typer.Option(
+    speech_model: str | None = typer.Option(
+        None, "--speech-model", help="best, nano, slam-1, universal."
+    ),
+    language_code: str | None = typer.Option(
         None, "--language-code", help="Force a language (e.g. en_us)."
     ),
-    language_detection: bool = typer.Option(
+    language_detection: bool | None = typer.Option(
         None, "--language-detection", help="Auto-detect the spoken language."
     ),
-    keyterms_prompt: list[str] = typer.Option(
+    keyterms_prompt: list[str] | None = typer.Option(
         None, "--keyterms-prompt", help="Boost a key term (repeatable)."
     ),
-    temperature: float = typer.Option(None, "--temperature", help="Speech model temperature."),
-    prompt: str = typer.Option(None, "--prompt", help="Bias the speech model (u3-pro)."),
+    temperature: float | None = typer.Option(
+        None, "--temperature", help="Speech model temperature."
+    ),
+    prompt: str | None = typer.Option(None, "--prompt", help="Bias the speech model (u3-pro)."),
     # formatting
-    punctuate: bool = typer.Option(None, "--punctuate/--no-punctuate", help="Add punctuation."),
-    format_text: bool = typer.Option(None, "--format-text/--no-format-text", help="Format text."),
-    disfluencies: bool = typer.Option(None, "--disfluencies", help="Keep filler words."),
+    punctuate: bool | None = typer.Option(
+        None, "--punctuate/--no-punctuate", help="Add punctuation."
+    ),
+    format_text: bool | None = typer.Option(
+        None, "--format-text/--no-format-text", help="Format text."
+    ),
+    disfluencies: bool | None = typer.Option(None, "--disfluencies", help="Keep filler words."),
     # speakers & channels
     speaker_labels: bool = typer.Option(False, "--speaker-labels", help="Enable diarization."),
-    speakers_expected: int = typer.Option(None, "--speakers-expected", help="Hint speaker count."),
-    multichannel: bool = typer.Option(None, "--multichannel", help="Transcribe each channel."),
+    speakers_expected: int | None = typer.Option(
+        None, "--speakers-expected", help="Hint speaker count."
+    ),
+    multichannel: bool | None = typer.Option(
+        None, "--multichannel", help="Transcribe each channel."
+    ),
     # guardrails
-    redact_pii: bool = typer.Option(None, "--redact-pii", help="Redact PII from the transcript."),
-    redact_pii_policy: str = typer.Option(
+    redact_pii: bool | None = typer.Option(
+        None, "--redact-pii", help="Redact PII from the transcript."
+    ),
+    redact_pii_policy: str | None = typer.Option(
         None, "--redact-pii-policy", help="Comma-separated PII policies (e.g. person_name,...)."
     ),
-    redact_pii_sub: str = typer.Option(
+    redact_pii_sub: str | None = typer.Option(
         None, "--redact-pii-sub", help="Substitution: hash or entity_name."
     ),
-    redact_pii_audio: bool = typer.Option(None, "--redact-pii-audio", help="Also redact audio."),
-    filter_profanity: bool = typer.Option(None, "--filter-profanity", help="Mask profanity."),
-    content_safety: bool = typer.Option(None, "--content-safety", help="Detect sensitive content."),
-    content_safety_confidence: int = typer.Option(
+    redact_pii_audio: bool | None = typer.Option(
+        None, "--redact-pii-audio", help="Also redact audio."
+    ),
+    filter_profanity: bool | None = typer.Option(
+        None, "--filter-profanity", help="Mask profanity."
+    ),
+    content_safety: bool | None = typer.Option(
+        None, "--content-safety", help="Detect sensitive content."
+    ),
+    content_safety_confidence: int | None = typer.Option(
         None, "--content-safety-confidence", help="Confidence threshold 25-100."
     ),
-    speech_threshold: float = typer.Option(
+    speech_threshold: float | None = typer.Option(
         None, "--speech-threshold", help="Minimum speech proportion 0-1."
     ),
     # analysis
-    summarization: bool = typer.Option(None, "--summarization", help="Summarize the transcript."),
-    summary_model: str = typer.Option(
+    summarization: bool | None = typer.Option(
+        None, "--summarization", help="Summarize the transcript."
+    ),
+    summary_model: str | None = typer.Option(
         None, "--summary-model", help="informative/conversational/catchy."
     ),
-    summary_type: str = typer.Option(
+    summary_type: str | None = typer.Option(
         None, "--summary-type", help="bullets/gist/headline/paragraph."
     ),
-    auto_chapters: bool = typer.Option(None, "--auto-chapters", help="Generate chapters."),
-    sentiment_analysis: bool = typer.Option(
+    auto_chapters: bool | None = typer.Option(None, "--auto-chapters", help="Generate chapters."),
+    sentiment_analysis: bool | None = typer.Option(
         None, "--sentiment-analysis", help="Analyze sentiment."
     ),
-    entity_detection: bool = typer.Option(None, "--entity-detection", help="Detect entities."),
-    auto_highlights: bool = typer.Option(None, "--auto-highlights", help="Detect key phrases."),
-    topic_detection: bool = typer.Option(None, "--topic-detection", help="Detect IAB topics."),
+    entity_detection: bool | None = typer.Option(
+        None, "--entity-detection", help="Detect entities."
+    ),
+    auto_highlights: bool | None = typer.Option(
+        None, "--auto-highlights", help="Detect key phrases."
+    ),
+    topic_detection: bool | None = typer.Option(
+        None, "--topic-detection", help="Detect IAB topics."
+    ),
     # customization
-    word_boost: list[str] = typer.Option(None, "--word-boost", help="Boost a word (repeatable)."),
-    custom_spelling_file: str = typer.Option(
+    word_boost: list[str] | None = typer.Option(
+        None, "--word-boost", help="Boost a word (repeatable)."
+    ),
+    custom_spelling_file: str | None = typer.Option(
         None, "--custom-spelling-file", help="JSON map of custom spellings."
     ),
-    audio_start: int = typer.Option(None, "--audio-start", help="Start offset in ms."),
-    audio_end: int = typer.Option(None, "--audio-end", help="End offset in ms."),
+    audio_start: int | None = typer.Option(None, "--audio-start", help="Start offset in ms."),
+    audio_end: int | None = typer.Option(None, "--audio-end", help="End offset in ms."),
     # webhooks
-    webhook_url: str = typer.Option(None, "--webhook-url", help="Webhook URL for completion."),
-    webhook_auth_header: str = typer.Option(
+    webhook_url: str | None = typer.Option(
+        None, "--webhook-url", help="Webhook URL for completion."
+    ),
+    webhook_auth_header: str | None = typer.Option(
         None, "--webhook-auth-header", help="Webhook auth header as NAME:VALUE."
     ),
     # speech understanding
-    translate_to: list[str] = typer.Option(
+    translate_to: list[str] | None = typer.Option(
         None, "--translate-to", help="Translate transcript to a language (repeatable)."
     ),
     # escape hatch
-    config_kv: list[str] = typer.Option(
+    config_kv: list[str] | None = typer.Option(
         None, "--config", help="Set any TranscriptionConfig field as KEY=VALUE (repeatable)."
     ),
-    config_file: str = typer.Option(None, "--config-file", help="JSON file of config fields."),
+    config_file: str | None = typer.Option(
+        None, "--config-file", help="JSON file of config fields."
+    ),
     # llm gateway transform
-    llm_prompt: list[str] = typer.Option(
+    llm_prompt: list[str] | None = typer.Option(
         None,
         "--llm",
         help="Transform the finished transcript through LLM Gateway. Repeatable: each "
@@ -136,7 +170,7 @@ def transcribe(
     model: str = typer.Option(llm.DEFAULT_MODEL, "--model", help="LLM Gateway model."),
     max_tokens: int = typer.Option(llm.DEFAULT_MAX_TOKENS, "--max-tokens", help="Max tokens."),
     json_out: bool = typer.Option(False, "--json", help="Output raw JSON."),
-    output_field: str = typer.Option(
+    output_field: str | None = typer.Option(
         None,
         "-o",
         "--output",
@@ -210,7 +244,7 @@ def body(state: AppState, json_mode: bool) -> None:
             # transcribing or authenticating. Raw stdout so `--show-code > script.py`
             # yields a runnable file.
             audio = client.resolve_audio_source(source, sample=sample)
-            gateway = code_gen.gateway_options(llm_prompt, model, max_tokens)
+            gateway = code_gen.gateway_options(list(llm_prompt or []), model, max_tokens)
             output.print_code(code_gen.transcribe(merged, audio, llm_gateway=gateway))
             return
 
@@ -239,7 +273,7 @@ def body(state: AppState, json_mode: bool) -> None:
 
         if output_field is not None:
             # Raw single-field output for pipelines (overrides --json and analysis render).
-            print(client.select_transcript_field(transcript, output_field))
+            output.emit_text(client.select_transcript_field(transcript, output_field))
             return
 
         if llm_prompt:
diff --git a/aai_cli/commands/transcripts.py b/aai_cli/commands/transcripts.py
index e96f3716..8ba50252 100644
--- a/aai_cli/commands/transcripts.py
+++ b/aai_cli/commands/transcripts.py
@@ -24,7 +24,7 @@
 def get(
     ctx: typer.Context,
     transcript_id: str = typer.Argument(..., help="Transcript id."),
-    output_field: str = typer.Option(
+    output_field: str | None = typer.Option(
         None,
         "-o",
         "--output",
@@ -45,7 +45,7 @@ def body(state: AppState, json_mode: bool) -> None:
             )
         if output_field is not None:
             # Raw single-field output for pipelines (overrides --json), matching `transcribe`.
-            print(client.select_transcript_field(transcript, output_field))
+            output.emit_text(client.select_transcript_field(transcript, output_field))
             return
         output.emit(
             client.transcript_summary(transcript),
diff --git a/aai_cli/config.py b/aai_cli/config.py
index 312bff6d..c4e97d3f 100644
--- a/aai_cli/config.py
+++ b/aai_cli/config.py
@@ -13,12 +13,14 @@
 import keyring.errors  # keyring.errors is not re-exported by keyring/__init__
 import platformdirs
 import tomli_w
+from pydantic import TypeAdapter, ValidationError
 
 from aai_cli.errors import NotAuthenticated
 
 KEYRING_SERVICE = "assemblyai-cli"
 ENV_API_KEY = "ASSEMBLYAI_API_KEY"
 DEFAULT_PROFILE = "default"
+_JSON_OBJECT: TypeAdapter[dict[str, object]] = TypeAdapter(dict[str, object])
 
 _PROFILE_RE = re.compile(r"^[A-Za-z0-9_-]+$")
 
@@ -146,12 +148,17 @@ def get_session(profile: str) -> dict[str, str] | None:
     if not raw:
         return None
     try:
-        data = json.loads(raw)
-    except json.JSONDecodeError:
+        data: object = json.loads(raw)
+        mapping = _JSON_OBJECT.validate_python(data)
+    except (json.JSONDecodeError, ValidationError):
         return None
-    if not isinstance(data, dict) or "jwt" not in data:
+    if "jwt" not in mapping:
         return None
-    return data
+    jwt = mapping.get("jwt")
+    if not isinstance(jwt, str):
+        return None
+    token = mapping.get("token")
+    return {"jwt": jwt, "token": str(token or "")}
 
 
 def get_account_id(profile: str) -> int | None:
diff --git a/aai_cli/config_builder.py b/aai_cli/config_builder.py
index 513ae0e8..b156f1a7 100644
--- a/aai_cli/config_builder.py
+++ b/aai_cli/config_builder.py
@@ -8,9 +8,12 @@
 
 import assemblyai as aai
 from assemblyai.streaming.v3 import SpeechModel, StreamingParameters
+from pydantic import TypeAdapter, ValidationError
 
 from aai_cli.errors import UsageError
 
+_JSON_OBJECT: TypeAdapter[dict[str, object]] = TypeAdapter(dict[str, object])
+
 # The curated set of user-settable config fields per command. This is the authoritative
 # allow-list (deliberately a subset of the SDK models — e.g. output-only and internal
 # fields are excluded). The coercion KIND for each field is derived from the SDK model
@@ -255,18 +258,20 @@ def parse_config_overrides(fields: dict[str, str], pairs: list[str]) -> dict[str
 def load_config_file(path: str | Path, fields: dict[str, str]) -> dict[str, object]:
     """Load a JSON config file and validate its keys against `fields`."""
     try:
-        data = json.loads(Path(path).read_text())
+        data: object = json.loads(Path(path).read_text())
     except FileNotFoundError as exc:
         raise UsageError(f"Config file not found: {path}") from exc
     except json.JSONDecodeError as exc:
         raise UsageError(f"Config file is not valid JSON: {exc}") from exc
-    if not isinstance(data, dict):
-        raise UsageError("Config file must contain a JSON object.")
-    unknown = [k for k in data if k not in fields]
+    try:
+        config = _JSON_OBJECT.validate_python(data)
+    except ValidationError as exc:
+        raise UsageError("Config file must contain a JSON object.") from exc
+    unknown = [key for key in config if key not in fields]
     if unknown:
         valid = ", ".join(sorted(fields))
         raise UsageError(f"Unknown config field(s) {unknown}. Valid fields: {valid}.")
-    return data
+    return config
 
 
 def _merge(
@@ -356,14 +361,15 @@ def auth_header_flags(value: str | None) -> dict[str, object]:
 def load_custom_spelling(path: str) -> dict[str, object]:
     """Load a custom-spelling JSON map (e.g. {"AssemblyAI": ["assembly ai"]})."""
     try:
-        data = json.loads(Path(path).read_text())
+        data: object = json.loads(Path(path).read_text())
     except FileNotFoundError as exc:
         raise UsageError(f"Custom spelling file not found: {path}") from exc
     except json.JSONDecodeError as exc:
         raise UsageError(f"Custom spelling file is not valid JSON: {exc}") from exc
-    if not isinstance(data, dict):
-        raise UsageError("Custom spelling file must contain a JSON object.")
-    return data
+    try:
+        return _JSON_OBJECT.validate_python(data)
+    except ValidationError as exc:
+        raise UsageError("Custom spelling file must contain a JSON object.") from exc
 
 
 def translation_request(languages: list[str]) -> dict[str, object]:
diff --git a/aai_cli/context.py b/aai_cli/context.py
index 5888661b..f5127428 100644
--- a/aai_cli/context.py
+++ b/aai_cli/context.py
@@ -1,13 +1,16 @@
 from __future__ import annotations
 
+import os
 from collections.abc import Callable
 from dataclasses import dataclass
 
+import keyring.errors
 import typer
 
 from aai_cli import config, environments, output
+from aai_cli.auth import run_login_flow
 from aai_cli.environments import Environment
-from aai_cli.errors import CLIError
+from aai_cli.errors import REJECTED_KEY_MESSAGE, APIError, CLIError, NotAuthenticated
 
 
 @dataclass
@@ -84,14 +87,76 @@ def env_override_warning(state: AppState) -> str | None:
     return state.env_override_warning()
 
 
+def _persist_browser_login(state: AppState) -> None:
+    profile = state.resolve_profile()
+    env = environments.active().name
+    result = run_login_flow()
+    config.set_api_key(profile, result.api_key)
+    config.set_profile_env(profile, env)
+    config.set_session(
+        profile,
+        session_jwt=result.session_jwt,
+        session_token=result.session_token,
+        account_id=result.account_id,
+    )
+
+
+def _login_persistence_error(exc: object) -> APIError:
+    return APIError(
+        f"Signed in, but could not save the credentials locally: {exc}",
+        suggestion="Run 'aai login' again, or check your keyring/config permissions.",
+    )
+
+
+def _rerun_after_login_error() -> CLIError:
+    return CLIError(
+        "Signed in. Run the command again to continue.",
+        error_type="login_required",
+        exit_code=2,
+        suggestion="Run the same command again.",
+    )
+
+
+def _should_auto_login(ctx: typer.Context, err: NotAuthenticated) -> bool:
+    command_name = ctx.command.name if ctx.command else None
+    if command_name in {"login", "logout"}:
+        return False
+    # An invalid ASSEMBLYAI_API_KEY would still take precedence after browser login,
+    # so retrying cannot fix that case.
+    return not (os.environ.get(config.ENV_API_KEY) and err.message == REJECTED_KEY_MESSAGE)
+
+
 def run_command(
-    ctx: typer.Context, fn: Callable[[AppState, bool], None], *, json: bool = False
+    ctx: typer.Context,
+    fn: Callable[[AppState, bool], None],
+    *,
+    json: bool = False,
+    auto_login: bool = True,
 ) -> None:
     """Execute a command body, mapping CLIError to clean output + exit code."""
     state: AppState = ctx.obj
     json_mode = output.resolve_json(explicit=json)
     try:
         fn(state, json_mode)
+    except NotAuthenticated as err:
+        if not auto_login or not _should_auto_login(ctx, err):
+            output.emit_error(err, json_mode=json_mode)
+            raise typer.Exit(code=err.exit_code) from None
+        try:
+            output.error_console.print(
+                "[aai.muted]Not signed in; starting browser login.[/aai.muted]"
+            )
+            _persist_browser_login(state)
+        except CLIError as login_err:
+            output.emit_error(login_err, json_mode=json_mode)
+            raise typer.Exit(code=login_err.exit_code) from None
+        except (OSError, RuntimeError, keyring.errors.KeyringError) as exc:
+            persistence_err = _login_persistence_error(exc)
+            output.emit_error(persistence_err, json_mode=json_mode)
+            raise typer.Exit(code=persistence_err.exit_code) from None
+        rerun_err = _rerun_after_login_error()
+        output.emit_error(rerun_err, json_mode=json_mode)
+        raise typer.Exit(code=rerun_err.exit_code) from None
     except CLIError as err:
         output.emit_error(err, json_mode=json_mode)
         raise typer.Exit(code=err.exit_code) from None
diff --git a/aai_cli/errors.py b/aai_cli/errors.py
index 8f853145..fced4741 100644
--- a/aai_cli/errors.py
+++ b/aai_cli/errors.py
@@ -80,6 +80,7 @@ def __init__(self, message: str, *, suggestion: str | None = None) -> None:
 
 REJECTED_KEY_MESSAGE = "Your API key was rejected."
 REJECTED_KEY_SUGGESTION = "Run 'aai login' with a valid key, or set ASSEMBLYAI_API_KEY."
+_VOICE_AGENT_POLICY_VIOLATION_CODE = 1008
 
 
 def _has_auth_status_code(exc: object) -> bool:
@@ -94,7 +95,7 @@ def _has_auth_status_code(exc: object) -> bool:
     code = getattr(exc, "code", None)
     if code is None:
         code = getattr(getattr(exc, "rcvd", None), "code", None)
-    if code == 1008:
+    if code == _VOICE_AGENT_POLICY_VIOLATION_CODE:
         return True
     response = getattr(exc, "response", None)
     return getattr(response, "status_code", None) in (401, 403)
diff --git a/aai_cli/init/runner.py b/aai_cli/init/runner.py
index 9e3f4eda..11a1cba4 100644
--- a/aai_cli/init/runner.py
+++ b/aai_cli/init/runner.py
@@ -71,11 +71,11 @@ def wait_for_port(port: int, *, timeout: float = 30.0) -> bool:
     return False
 
 
-def run_setup(target: Path, *, use_uv: bool) -> subprocess.CompletedProcess:
+def run_setup(target: Path, *, use_uv: bool) -> subprocess.CompletedProcess[str]:
     """Run env-setup commands in order; return the first failure or the last success."""
-    last = subprocess.CompletedProcess(args=[], returncode=0, stdout="", stderr="")
+    last = subprocess.CompletedProcess[str](args=[], returncode=0, stdout="", stderr="")
     for cmd in env_setup_commands(target, use_uv=use_uv):
-        last = subprocess.run(cmd, cwd=target, capture_output=True, text=True)
+        last = subprocess.run(cmd, cwd=target, capture_output=True, check=False, text=True)
         if last.returncode != 0:
             return last
     return last
diff --git a/aai_cli/init/templates/agent/AGENTS.md b/aai_cli/init/templates/agent/AGENTS.md
new file mode 100644
index 00000000..a9cda2b4
--- /dev/null
+++ b/aai_cli/init/templates/agent/AGENTS.md
@@ -0,0 +1,32 @@
+# Agent Notes
+
+This is a buildless FastAPI + browser voice-agent starter. Run it with:
+
+```sh
+uvicorn api.index:app --reload --port 3000
+```
+
+## Map
+
+- `api/settings.py`: backend token host, token path, WebSocket path, and token expiry.
+- `api/index.py`: `/api/token` route. Keep `ASSEMBLYAI_API_KEY` here on the server.
+- `static/app.js`: Voice Agent session config, WebSocket lifecycle, UI state, and event handling.
+- `static/audio.js`: microphone pipeline, PCM conversion, playback queue, and barge-in helpers.
+- `static/styles.css`: visual styling only.
+- `index.html`: page structure and static asset links.
+
+## Change Points
+
+- Agent prompt, greeting, voice, audio formats, and microphone constraints: edit `SESSION_CONFIG` in `static/app.js`.
+- Backend token lifetime or non-production hosts: edit `api/settings.py`.
+- Transcript log rendering: edit `addTurn` in `static/app.js`.
+- Playback, barge-in, or PCM conversion: edit `static/audio.js`.
+
+## Invariants
+
+- Never expose `ASSEMBLYAI_API_KEY` or any server secret in `index.html` or `static/`.
+- Voice Agent token auth uses `Authorization: Bearer ...` in the backend. This differs from Streaming token auth.
+- Voice Agent `greeting` is spoken literally by TTS; write the exact words the user should hear.
+- `reply.audio` carries base64 PCM on the `data` field.
+- Keep the browser connected directly to AssemblyAI; do not proxy audio through FastAPI unless the user asks.
+- Keep the app buildless unless the user explicitly asks for a frontend toolchain.
diff --git a/aai_cli/init/templates/agent/README.md b/aai_cli/init/templates/agent/README.md
index e57a5548..fe1a477d 100644
--- a/aai_cli/init/templates/agent/README.md
+++ b/aai_cli/init/templates/agent/README.md
@@ -3,7 +3,8 @@
 Click connect and talk to a voice agent: speech in → LLM → speech out, with built-in
 turn detection, TTS, and barge-in. The browser connects **directly** to AssemblyAI's
 Voice Agent WebSocket using a one-time token minted by the backend, so your API key
-never reaches the client and no audio is proxied through your server.
+never reaches the client and no audio is proxied through your server. The app uses
+static HTML/CSS/JS with no frontend build step.
 
 ## Run locally
 
@@ -24,6 +25,6 @@ is needed.
 
 ## Ideas to extend
 
-- Change the `greeting`, `system_prompt`, or `voice` in `index.html`'s `session.update`.
+- Change the `greeting`, `systemPrompt`, or `voice` in `SESSION_CONFIG` (`static/app.js`).
 - Add tools (function calling) so the agent can look things up or take actions.
-- Tune `input.turn_detection` (`min_silence`/`max_silence`) for your use case.
+- Tune `input.turn_detection` (`min_silence`/`max_silence`) inside `SESSION_CONFIG`.
diff --git a/aai_cli/init/templates/agent/api/__init__.py b/aai_cli/init/templates/agent/api/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/aai_cli/init/templates/agent/api/index.py b/aai_cli/init/templates/agent/api/index.py
index 643a3e3d..948845cc 100644
--- a/aai_cli/init/templates/agent/api/index.py
+++ b/aai_cli/init/templates/agent/api/index.py
@@ -9,21 +9,18 @@
 
 from __future__ import annotations
 
-import os
 from pathlib import Path
 
 import httpx2
-from dotenv import load_dotenv
 from fastapi import FastAPI, HTTPException
 from fastapi.responses import FileResponse
+from fastapi.staticfiles import StaticFiles
 
-load_dotenv()
-API_KEY = os.environ.get("ASSEMBLYAI_API_KEY", "")
-# `aai init` writes this for you; defaults to production. (No scheme — host only.)
-AGENTS_HOST = os.environ.get("ASSEMBLYAI_AGENTS_HOST", "agents.assemblyai.com")
+from api import settings
 
 ROOT = Path(__file__).resolve().parent.parent
 app = FastAPI()
+app.mount("/static", StaticFiles(directory=ROOT / "static"), name="static")
 
 
 @app.get("/")
@@ -37,13 +34,16 @@ def token() -> dict[str, str]:
     # NOTE: the Voice Agent token uses Bearer auth (unlike the streaming token).
     try:
         resp = httpx2.get(
-            f"https://{AGENTS_HOST}/v1/token",
-            params={"expires_in_seconds": 60},
-            headers={"Authorization": f"Bearer {API_KEY}"},
+            f"https://{settings.AGENTS_HOST}{settings.TOKEN_PATH}",
+            params={"expires_in_seconds": settings.TOKEN_EXPIRES_IN_SECONDS},
+            headers={"Authorization": f"Bearer {settings.API_KEY}"},
         )
         resp.raise_for_status()
     except Exception as exc:  # missing/invalid key, network -> clean 502, not a 500
         raise HTTPException(
             status_code=502, detail=f"Could not mint voice-agent token: {exc}"
         ) from exc
-    return {"token": resp.json()["token"], "ws_url": f"wss://{AGENTS_HOST}/v1/ws"}
+    return {
+        "token": resp.json()["token"],
+        "ws_url": f"wss://{settings.AGENTS_HOST}{settings.WEBSOCKET_PATH}",
+    }
diff --git a/aai_cli/init/templates/agent/api/settings.py b/aai_cli/init/templates/agent/api/settings.py
new file mode 100644
index 00000000..5bce5990
--- /dev/null
+++ b/aai_cli/init/templates/agent/api/settings.py
@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+import os
+
+from dotenv import load_dotenv
+
+load_dotenv()
+
+API_KEY = os.environ.get("ASSEMBLYAI_API_KEY", "")
+# `aai init` writes this for you; defaults to production. Host only, no scheme.
+AGENTS_HOST = os.environ.get("ASSEMBLYAI_AGENTS_HOST", "agents.assemblyai.com")
+TOKEN_EXPIRES_IN_SECONDS = 60
+TOKEN_PATH = "/v1/token"
+WEBSOCKET_PATH = "/v1/ws"
diff --git a/aai_cli/init/templates/agent/index.html b/aai_cli/init/templates/agent/index.html
index d59935f0..99ff3ee4 100644
--- a/aai_cli/init/templates/agent/index.html
+++ b/aai_cli/init/templates/agent/index.html
@@ -4,31 +4,7 @@
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>Talk to a voice agent · AssemblyAI</title>
-  <style>
-    :root { --accent: #4338ca; --line: #e5e7eb; --muted: #6b7280; --bg: #f8fafc; }
-    * { box-sizing: border-box; }
-    body { font: 15px/1.6 -apple-system, system-ui, sans-serif; color: #111827;
-           background: var(--bg); margin: 0; padding: 48px 16px; }
-    main { max-width: 720px; margin: 0 auto; }
-    h1 { font-size: 22px; margin: 0 0 4px; }
-    .sub { color: var(--muted); margin: 0 0 24px; }
-    button { background: var(--accent); color: #fff; border: 0; border-radius: 9px;
-             padding: 11px 20px; font-size: 14px; font-weight: 600; cursor: pointer; }
-    button.live { background: #dc2626; }
-    #status { display: inline-block; margin-left: 12px; font-size: 13px; font-weight: 600;
-              padding: 5px 12px; border-radius: 999px; }
-    #status:empty { display: none; }
-    #status.live { background: #dcfce7; color: #166534; }
-    #status.idle { background: #f3f4f6; color: #4b5563; }
-    #status.error { background: #fee2e2; color: #991b1b; }
-    #log { margin-top: 24px; }
-    .turn { padding: 8px 0 8px 12px; border-left: 3px solid var(--line); margin: 8px 0; }
-    .turn.you { border-left-color: #0d9488; }
-    .turn.agent { border-left-color: var(--accent); }
-    .who { font-weight: 700; }
-    .turn.you .who { color: #0d9488; }
-    .turn.agent .who { color: var(--accent); }
-  </style>
+  <link rel="stylesheet" href="/static/styles.css" />
 </head>
 <body>
   <main>
@@ -41,151 +17,7 @@ <h1>🗣️ Talk to a voice agent</h1>
     <div id="log"></div>
   </main>
 
-  <script>
-    const connBtn = document.getElementById("conn");
-    const statusEl = document.getElementById("status");
-    const logEl = document.getElementById("log");
-
-    let ws = null, micStream = null, micCtx = null, micProc = null;
-    let playCtx = null, playHead = 0, sources = [];
-    let connected = false;
-
-    connBtn.addEventListener("click", () => (connected ? hangup() : connect().catch(fail)));
-    function setStatus(msg, state) { statusEl.textContent = msg; statusEl.className = state; }
-
-    async function connect() {
-      setStatus("Connecting…", "idle");
-      const res = await fetch("/api/token", { method: "POST" });
-      if (!res.ok) return fail(await res.text());
-      const { token, ws_url } = await res.json();
-
-      ws = new WebSocket(`${ws_url}?token=${encodeURIComponent(token)}`);
-      ws.onopen = () => {
-        ws.send(JSON.stringify({
-          type: "session.update",
-          session: {
-            system_prompt: "You are a friendly, concise voice assistant. Keep replies short and conversational.",
-            greeting: "Hi! I'm your AssemblyAI voice agent. What can I help you with?",
-            input: { format: { encoding: "audio/pcm" } },
-            output: { voice: "ivy", format: { encoding: "audio/pcm" } },
-          },
-        }));
-        startMic().catch(fail);
-      };
-      ws.onmessage = (e) => onEvent(JSON.parse(e.data));
-      ws.onerror = () => fail("WebSocket error");
-      ws.onclose = () => { if (connected) hangup(); };
-    }
-
-    async function startMic() {
-      micStream = await navigator.mediaDevices.getUserMedia({
-        audio: { echoCancellation: true, noiseSuppression: false },  // server runs its own voice focus
-      });
-      micCtx = new (window.AudioContext || window.webkitAudioContext)();
-      playCtx = new (window.AudioContext || window.webkitAudioContext)({ sampleRate: 24000 });
-      // Contexts can start suspended after the await above; resume so audio flows.
-      micCtx.resume();
-      playCtx.resume();
-      const source = micCtx.createMediaStreamSource(micStream);
-      micProc = micCtx.createScriptProcessor(4096, 1, 1);
-      source.connect(micProc);
-      micProc.connect(micCtx.destination);
-      micProc.onaudioprocess = (e) => {
-        if (!ws || ws.readyState !== WebSocket.OPEN) return;
-        const pcm = downsampleToPCM(e.inputBuffer.getChannelData(0), micCtx.sampleRate, 24000);
-        ws.send(JSON.stringify({ type: "input.audio", audio: bytesToB64(pcm) }));
-      };
-      connected = true;
-      connBtn.textContent = "■ Hang up";
-      connBtn.classList.add("live");
-      setStatus("● Connected — just talk", "live");
-    }
-
-    function onEvent(ev) {
-      switch (ev.type) {
-        case "transcript.user": return addTurn("you", "You", ev.text);
-        case "transcript.agent": return addTurn("agent", "Agent", ev.text);
-        case "reply.audio": return playChunk(ev.data);  // base64 PCM16 lives in `data`
-        case "input.speech.started": return bargeIn();  // user interrupted — drop queued agent audio
-        case "reply.done": if (ev.status === "interrupted") bargeIn(); return;
-        case "session.error": return fail(ev.message || "session error");
-      }
-    }
-
-    // --- agent audio playback (24 kHz PCM) -------------------------------
-    function playChunk(b64) {
-      const int16 = b64ToInt16(b64);
-      const buf = playCtx.createBuffer(1, int16.length, 24000);
-      const ch = buf.getChannelData(0);
-      for (let i = 0; i < int16.length; i++) ch[i] = int16[i] / 0x8000;
-      const src = playCtx.createBufferSource();
-      src.buffer = buf;
-      src.connect(playCtx.destination);
-      const startAt = Math.max(playCtx.currentTime, playHead);
-      src.start(startAt);
-      playHead = startAt + buf.duration;
-      sources.push(src);
-      src.onended = () => (sources = sources.filter((s) => s !== src));
-    }
-
-    function bargeIn() {
-      sources.forEach((s) => { try { s.stop(); } catch (_) {} });
-      sources = [];
-      playHead = 0;
-    }
-
-    function addTurn(cls, who, text) {
-      if (!text) return;
-      const div = document.createElement("div");
-      div.className = "turn " + cls;
-      div.innerHTML = `<span class="who">${who}:</span> `;
-      div.appendChild(document.createTextNode(text));
-      logEl.appendChild(div);
-      div.scrollIntoView({ block: "end" });
-    }
-
-    function hangup() {
-      connected = false;
-      connBtn.textContent = "● Connect";
-      connBtn.classList.remove("live");
-      setStatus("Disconnected", "idle");
-      bargeIn();
-      if (ws && ws.readyState === WebSocket.OPEN) ws.close();
-      if (micProc) micProc.disconnect();
-      if (micStream) micStream.getTracks().forEach((t) => t.stop());
-      if (micCtx) micCtx.close();
-      if (playCtx) playCtx.close();
-      ws = micProc = micStream = micCtx = playCtx = null;
-    }
-
-    function fail(msg) {
-      setStatus("Error: " + msg, "error");
-      if (connected) hangup();
-    }
-
-    // --- audio helpers ---------------------------------------------------
-    function downsampleToPCM(input, inRate, outRate) {
-      const ratio = inRate / outRate;
-      const outLen = Math.floor(input.length / ratio);
-      const out = new Int16Array(outLen);
-      for (let i = 0; i < outLen; i++) {
-        const s = Math.max(-1, Math.min(1, input[Math.floor(i * ratio)]));
-        out[i] = s < 0 ? s * 0x8000 : s * 0x7fff;
-      }
-      return out.buffer;
-    }
-    function bytesToB64(buf) {
-      let bin = "";
-      const bytes = new Uint8Array(buf);
-      for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
-      return btoa(bin);
-    }
-    function b64ToInt16(b64) {
-      const bin = atob(b64);
-      const bytes = new Uint8Array(bin.length);
-      for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
-      return new Int16Array(bytes.buffer);
-    }
-  </script>
+  <script src="/static/audio.js"></script>
+  <script src="/static/app.js"></script>
 </body>
 </html>
diff --git a/aai_cli/init/templates/agent/static/app.js b/aai_cli/init/templates/agent/static/app.js
new file mode 100644
index 00000000..aa57a55c
--- /dev/null
+++ b/aai_cli/init/templates/agent/static/app.js
@@ -0,0 +1,125 @@
+const SESSION_CONFIG = {
+  systemPrompt: "You are a friendly, concise voice assistant. Keep replies short and conversational.",
+  greeting: "Hi! I'm your AssemblyAI voice agent. What can I help you with?",
+  input: { format: { encoding: "audio/pcm" } },
+  output: { voice: "ivy", format: { encoding: "audio/pcm" } },
+  inputSampleRate: 24000,
+  outputSampleRate: 24000,
+  processorBufferSize: 4096,
+  microphone: { audio: { echoCancellation: true, noiseSuppression: false } },
+};
+
+const connBtn = document.getElementById("conn");
+const statusEl = document.getElementById("status");
+const logEl = document.getElementById("log");
+
+let ws = null;
+let micPipeline = null;
+let player = null;
+let connected = false;
+
+connBtn.addEventListener("click", () => (connected ? hangup() : connect().catch(fail)));
+
+function setStatus(message, state) {
+  statusEl.textContent = message;
+  statusEl.className = state;
+}
+
+async function connect() {
+  setStatus("Connecting...", "idle");
+  const res = await fetch("/api/token", { method: "POST" });
+  if (!res.ok) return fail(await res.text());
+  const { token, ws_url } = await res.json();
+
+  ws = new WebSocket(`${ws_url}?token=${encodeURIComponent(token)}`);
+  ws.onopen = () => {
+    ws.send(JSON.stringify({ type: "session.update", session: buildSessionConfig() }));
+    startMic().catch(fail);
+  };
+  ws.onmessage = (event) => onEvent(JSON.parse(event.data));
+  ws.onerror = () => fail("WebSocket error");
+  ws.onclose = () => {
+    if (connected) hangup();
+  };
+}
+
+function buildSessionConfig() {
+  return {
+    system_prompt: SESSION_CONFIG.systemPrompt,
+    greeting: SESSION_CONFIG.greeting,
+    input: SESSION_CONFIG.input,
+    output: SESSION_CONFIG.output,
+  };
+}
+
+async function startMic() {
+  const stream = await navigator.mediaDevices.getUserMedia(SESSION_CONFIG.microphone);
+  micPipeline = AudioHelpers.createMicrophonePipeline(stream, {
+    bufferSize: SESSION_CONFIG.processorBufferSize,
+  });
+  player = AudioHelpers.createPcmPlayer({ sampleRate: SESSION_CONFIG.outputSampleRate });
+  await player.resume();
+  await micPipeline.start((frame, sampleRate) => {
+    if (!ws || ws.readyState !== WebSocket.OPEN) return;
+    const pcm = AudioHelpers.downsampleToPCM(frame, sampleRate, SESSION_CONFIG.inputSampleRate);
+    ws.send(JSON.stringify({ type: "input.audio", audio: AudioHelpers.bytesToB64(pcm) }));
+  });
+
+  connected = true;
+  connBtn.textContent = "■ Hang up";
+  connBtn.classList.add("live");
+  setStatus("● Connected - just talk", "live");
+}
+
+function onEvent(event) {
+  switch (event.type) {
+    case "transcript.user":
+      return addTurn("you", "You", event.text);
+    case "transcript.agent":
+      return addTurn("agent", "Agent", event.text);
+    case "reply.audio":
+      return player.playBase64Chunk(event.data);
+    case "input.speech.started":
+      return bargeIn();
+    case "reply.done":
+      if (event.status === "interrupted") bargeIn();
+      return;
+    case "session.error":
+      return fail(event.message || "session error");
+  }
+}
+
+function bargeIn() {
+  if (player) player.stopQueuedAudio();
+}
+
+function addTurn(className, speaker, text) {
+  if (!text) return;
+  const turn = document.createElement("div");
+  turn.className = "turn " + className;
+  const who = document.createElement("span");
+  who.className = "who";
+  who.textContent = speaker + ": ";
+  turn.append(who, document.createTextNode(text));
+  logEl.appendChild(turn);
+  turn.scrollIntoView({ block: "end" });
+}
+
+function hangup() {
+  connected = false;
+  connBtn.textContent = "● Connect";
+  connBtn.classList.remove("live");
+  setStatus("Disconnected", "idle");
+  bargeIn();
+  if (ws && ws.readyState === WebSocket.OPEN) ws.close();
+  if (micPipeline) micPipeline.close();
+  if (player) player.close();
+  ws = null;
+  micPipeline = null;
+  player = null;
+}
+
+function fail(message) {
+  setStatus("Error: " + message, "error");
+  if (connected) hangup();
+}
diff --git a/aai_cli/init/templates/agent/static/audio.js b/aai_cli/init/templates/agent/static/audio.js
new file mode 100644
index 00000000..744ffc25
--- /dev/null
+++ b/aai_cli/init/templates/agent/static/audio.js
@@ -0,0 +1,100 @@
+function createMicrophonePipeline(stream, options = {}) {
+  const bufferSize = options.bufferSize || 4096;
+  const AudioContextClass = window.AudioContext || window.webkitAudioContext;
+  const audioCtx = new AudioContextClass();
+  const source = audioCtx.createMediaStreamSource(stream);
+  const processor = audioCtx.createScriptProcessor(bufferSize, 1, 1);
+
+  return {
+    audioCtx,
+    async start(onFrame) {
+      await audioCtx.resume();
+      source.connect(processor);
+      processor.connect(audioCtx.destination);
+      processor.onaudioprocess = (event) => {
+        onFrame(event.inputBuffer.getChannelData(0), audioCtx.sampleRate);
+      };
+    },
+    close() {
+      processor.disconnect();
+      stream.getTracks().forEach((track) => track.stop());
+      audioCtx.close();
+    },
+  };
+}
+
+function createPcmPlayer(options = {}) {
+  const sampleRate = options.sampleRate || 24000;
+  const AudioContextClass = window.AudioContext || window.webkitAudioContext;
+  const playCtx = new AudioContextClass({ sampleRate });
+  let playHead = 0;
+  let sources = [];
+
+  return {
+    async resume() {
+      await playCtx.resume();
+    },
+    playBase64Chunk(base64Audio) {
+      const int16 = b64ToInt16(base64Audio);
+      const buffer = playCtx.createBuffer(1, int16.length, sampleRate);
+      const channel = buffer.getChannelData(0);
+      for (let i = 0; i < int16.length; i++) channel[i] = int16[i] / 0x8000;
+
+      const source = playCtx.createBufferSource();
+      source.buffer = buffer;
+      source.connect(playCtx.destination);
+      const startAt = Math.max(playCtx.currentTime, playHead);
+      source.start(startAt);
+      playHead = startAt + buffer.duration;
+      sources.push(source);
+      source.onended = () => {
+        sources = sources.filter((item) => item !== source);
+      };
+    },
+    stopQueuedAudio() {
+      sources.forEach((source) => {
+        try {
+          source.stop();
+        } catch (_) {}
+      });
+      sources = [];
+      playHead = 0;
+    },
+    close() {
+      this.stopQueuedAudio();
+      playCtx.close();
+    },
+  };
+}
+
+function downsampleToPCM(input, inputRate, outputRate) {
+  const ratio = inputRate / outputRate;
+  const outputLength = Math.floor(input.length / ratio);
+  const output = new Int16Array(outputLength);
+  for (let i = 0; i < outputLength; i++) {
+    const sample = Math.max(-1, Math.min(1, input[Math.floor(i * ratio)]));
+    output[i] = sample < 0 ? sample * 0x8000 : sample * 0x7fff;
+  }
+  return output.buffer;
+}
+
+function bytesToB64(buffer) {
+  let binary = "";
+  const bytes = new Uint8Array(buffer);
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+
+function b64ToInt16(base64Audio) {
+  const binary = atob(base64Audio);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return new Int16Array(bytes.buffer);
+}
+
+window.AudioHelpers = {
+  createMicrophonePipeline,
+  createPcmPlayer,
+  downsampleToPCM,
+  bytesToB64,
+};
diff --git a/aai_cli/init/templates/agent/static/styles.css b/aai_cli/init/templates/agent/static/styles.css
new file mode 100644
index 00000000..c14fc1ee
--- /dev/null
+++ b/aai_cli/init/templates/agent/static/styles.css
@@ -0,0 +1,42 @@
+:root { --accent: #4338ca; --line: #e5e7eb; --muted: #6b7280; --bg: #f8fafc; }
+* { box-sizing: border-box; }
+body {
+  font: 15px/1.6 -apple-system, system-ui, sans-serif;
+  color: #111827;
+  background: var(--bg);
+  margin: 0;
+  padding: 48px 16px;
+}
+main { max-width: 720px; margin: 0 auto; }
+h1 { font-size: 22px; margin: 0 0 4px; }
+.sub { color: var(--muted); margin: 0 0 24px; }
+button {
+  background: var(--accent);
+  color: #fff;
+  border: 0;
+  border-radius: 8px;
+  padding: 11px 20px;
+  font-size: 14px;
+  font-weight: 600;
+  cursor: pointer;
+}
+button.live { background: #dc2626; }
+#status {
+  display: inline-block;
+  margin-left: 12px;
+  font-size: 13px;
+  font-weight: 600;
+  padding: 5px 12px;
+  border-radius: 999px;
+}
+#status:empty { display: none; }
+#status.live { background: #dcfce7; color: #166534; }
+#status.idle { background: #f3f4f6; color: #4b5563; }
+#status.error { background: #fee2e2; color: #991b1b; }
+#log { margin-top: 24px; }
+.turn { padding: 8px 0 8px 12px; border-left: 3px solid var(--line); margin: 8px 0; }
+.turn.you { border-left-color: #0d9488; }
+.turn.agent { border-left-color: var(--accent); }
+.who { font-weight: 700; }
+.turn.you .who { color: #0d9488; }
+.turn.agent .who { color: var(--accent); }
diff --git a/aai_cli/init/templates/stream/AGENTS.md b/aai_cli/init/templates/stream/AGENTS.md
new file mode 100644
index 00000000..5ee0cdee
--- /dev/null
+++ b/aai_cli/init/templates/stream/AGENTS.md
@@ -0,0 +1,30 @@
+# Agent Notes
+
+This is a buildless FastAPI + browser microphone starter. Run it with:
+
+```sh
+uvicorn api.index:app --reload --port 3000
+```
+
+## Map
+
+- `api/settings.py`: backend token host, token path, WebSocket path, and token expiry.
+- `api/index.py`: `/api/token` route. Keep `ASSEMBLYAI_API_KEY` here on the server.
+- `static/app.js`: browser state, WebSocket lifecycle, and Streaming API params.
+- `static/audio.js`: microphone pipeline and PCM downsampling helpers.
+- `static/styles.css`: visual styling only.
+- `index.html`: page structure and static asset links.
+
+## Change Points
+
+- Streaming model, sample rate, encoding, and turn formatting: edit `STREAMING_CONFIG` in `static/app.js`.
+- Backend token lifetime or non-production hosts: edit `api/settings.py`.
+- Caption rendering: edit `onMessage` in `static/app.js`.
+- Microphone/downsampling behavior: edit `static/audio.js`.
+
+## Invariants
+
+- Never expose `ASSEMBLYAI_API_KEY` or any server secret in `index.html` or `static/`.
+- Streaming token auth uses the raw API key in the backend `Authorization` header, not `Bearer`.
+- Keep the browser connected directly to AssemblyAI; do not proxy the audio stream through FastAPI unless the user asks.
+- Keep the app buildless unless the user explicitly asks for a frontend toolchain.
diff --git a/aai_cli/init/templates/stream/README.md b/aai_cli/init/templates/stream/README.md
index b618af19..fec5718f 100644
--- a/aai_cli/init/templates/stream/README.md
+++ b/aai_cli/init/templates/stream/README.md
@@ -3,7 +3,8 @@
 Click record and speak — your microphone streams to AssemblyAI's Streaming v3 API and
 transcribes in real time. The browser captures audio and connects **directly** to
 AssemblyAI using a one-time token minted by the backend, so your API key never reaches
-the client (and no audio is proxied through your server).
+the client (and no audio is proxied through your server). The app uses static
+HTML/CSS/JS with no frontend build step.
 
 ## Run locally
 
@@ -23,6 +24,6 @@ is needed. `vercel.json` routes the page and the function.
 
 ## Ideas to extend
 
-- Add `keyterms_prompt` or a `prompt` for domain vocabulary (the demo uses `u3-rt-pro`).
-- Add `format_turns`/punctuation toggles, or speaker labels (`speaker_labels=true`).
+- Add `keyterms_prompt` or a `prompt` for domain vocabulary in `STREAMING_CONFIG`.
+- Add `format_turns`/punctuation toggles, or speaker labels (`speaker_labels=true`) in `STREAMING_CONFIG`.
 - Persist the final transcript, or pipe each finalized turn into the LLM Gateway.
diff --git a/aai_cli/init/templates/stream/api/__init__.py b/aai_cli/init/templates/stream/api/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/aai_cli/init/templates/stream/api/index.py b/aai_cli/init/templates/stream/api/index.py
index 34d396e2..a78ad020 100644
--- a/aai_cli/init/templates/stream/api/index.py
+++ b/aai_cli/init/templates/stream/api/index.py
@@ -9,21 +9,18 @@
 
 from __future__ import annotations
 
-import os
 from pathlib import Path
 
 import httpx2
-from dotenv import load_dotenv
 from fastapi import FastAPI, HTTPException
 from fastapi.responses import FileResponse
+from fastapi.staticfiles import StaticFiles
 
-load_dotenv()
-API_KEY = os.environ.get("ASSEMBLYAI_API_KEY", "")
-# `aai init` writes this for you; defaults to production. (No scheme — host only.)
-STREAMING_HOST = os.environ.get("ASSEMBLYAI_STREAMING_HOST", "streaming.assemblyai.com")
+from api import settings
 
 ROOT = Path(__file__).resolve().parent.parent
 app = FastAPI()
+app.mount("/static", StaticFiles(directory=ROOT / "static"), name="static")
 
 
 @app.get("/")
@@ -37,13 +34,16 @@ def token() -> dict[str, str]:
     # NOTE: the streaming token uses the raw API key as Authorization (no 'Bearer').
     try:
         resp = httpx2.get(
-            f"https://{STREAMING_HOST}/v3/token",
-            params={"expires_in_seconds": 60},
-            headers={"Authorization": API_KEY},
+            f"https://{settings.STREAMING_HOST}{settings.TOKEN_PATH}",
+            params={"expires_in_seconds": settings.TOKEN_EXPIRES_IN_SECONDS},
+            headers={"Authorization": settings.API_KEY},
         )
         resp.raise_for_status()
     except Exception as exc:  # missing/invalid key, network -> clean 502, not a 500
         raise HTTPException(
             status_code=502, detail=f"Could not mint streaming token: {exc}"
         ) from exc
-    return {"token": resp.json()["token"], "ws_url": f"wss://{STREAMING_HOST}/v3/ws"}
+    return {
+        "token": resp.json()["token"],
+        "ws_url": f"wss://{settings.STREAMING_HOST}{settings.WEBSOCKET_PATH}",
+    }
diff --git a/aai_cli/init/templates/stream/api/settings.py b/aai_cli/init/templates/stream/api/settings.py
new file mode 100644
index 00000000..372c506e
--- /dev/null
+++ b/aai_cli/init/templates/stream/api/settings.py
@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+import os
+
+from dotenv import load_dotenv
+
+load_dotenv()
+
+API_KEY = os.environ.get("ASSEMBLYAI_API_KEY", "")
+# `aai init` writes this for you; defaults to production. Host only, no scheme.
+STREAMING_HOST = os.environ.get("ASSEMBLYAI_STREAMING_HOST", "streaming.assemblyai.com")
+TOKEN_EXPIRES_IN_SECONDS = 60
+TOKEN_PATH = "/v3/token"
+WEBSOCKET_PATH = "/v3/ws"
diff --git a/aai_cli/init/templates/stream/index.html b/aai_cli/init/templates/stream/index.html
index bfa09698..5fba1d40 100644
--- a/aai_cli/init/templates/stream/index.html
+++ b/aai_cli/init/templates/stream/index.html
@@ -4,29 +4,7 @@
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>Live captions · AssemblyAI</title>
-  <style>
-    :root { --accent: #4338ca; --line: #e5e7eb; --muted: #6b7280; --bg: #f8fafc; }
-    * { box-sizing: border-box; }
-    body { font: 15px/1.6 -apple-system, system-ui, sans-serif; color: #111827;
-           background: var(--bg); margin: 0; padding: 48px 16px; }
-    main { max-width: 720px; margin: 0 auto; }
-    h1 { font-size: 22px; margin: 0 0 4px; }
-    .sub { color: var(--muted); margin: 0 0 24px; }
-    button { background: var(--accent); color: #fff; border: 0; border-radius: 9px;
-             padding: 11px 20px; font-size: 14px; font-weight: 600; cursor: pointer; }
-    button.rec { background: #dc2626; }
-    button:disabled { opacity: .55; cursor: default; }
-    #status { display: inline-block; margin-left: 12px; font-size: 13px; font-weight: 600;
-              padding: 5px 12px; border-radius: 999px; }
-    #status:empty { display: none; }
-    #status.live { background: #fee2e2; color: #991b1b; }
-    #status.idle { background: #f3f4f6; color: #4b5563; }
-    #status.error { background: #fee2e2; color: #991b1b; }
-    .caption { margin-top: 24px; font-size: 19px; line-height: 1.7; min-height: 120px;
-               background: #fff; border: 1px solid var(--line); border-radius: 12px; padding: 18px; }
-    .final { color: #111827; }
-    .partial { color: var(--muted); }
-  </style>
+  <link rel="stylesheet" href="/static/styles.css" />
 </head>
 <body>
   <main>
@@ -39,99 +17,7 @@ <h1>🎙️ Live captions</h1>
     <div class="caption"><span id="final" class="final"></span><span id="partial" class="partial"></span></div>
   </main>
 
-  <script>
-    const recBtn = document.getElementById("rec");
-    const statusEl = document.getElementById("status");
-    const finalEl = document.getElementById("final");
-    const partialEl = document.getElementById("partial");
-
-    let ws = null;
-    let audioCtx = null;
-    let mediaStream = null;
-    let processor = null;
-    let recording = false;
-
-    recBtn.addEventListener("click", () => (recording ? stop() : start().catch(fail)));
-
-    function setStatus(msg, state) { statusEl.textContent = msg; statusEl.className = state; }
-
-    async function start() {
-      setStatus("Connecting…", "idle");
-      const res = await fetch("/api/token", { method: "POST" });
-      if (!res.ok) return fail(await res.text());
-      const { token, ws_url } = await res.json();
-
-      mediaStream = await navigator.mediaDevices.getUserMedia({ audio: true });
-      audioCtx = new (window.AudioContext || window.webkitAudioContext)();
-      const source = audioCtx.createMediaStreamSource(mediaStream);
-      processor = audioCtx.createScriptProcessor(4096, 1, 1);
-
-      const params = new URLSearchParams({
-        token,
-        sample_rate: "16000",
-        encoding: "pcm_s16le",
-        speech_model: "u3-rt-pro",
-        format_turns: "true",
-      });
-      ws = new WebSocket(`${ws_url}?${params}`);
-      ws.binaryType = "arraybuffer";
-
-      ws.onopen = () => {
-        recording = true;
-        recBtn.textContent = "■ Stop";
-        recBtn.classList.add("rec");
-        setStatus("● Live", "live");
-        source.connect(processor);
-        processor.connect(audioCtx.destination);
-        processor.onaudioprocess = (e) => {
-          if (ws && ws.readyState === WebSocket.OPEN) {
-            ws.send(downsampleTo16kPCM(e.inputBuffer.getChannelData(0), audioCtx.sampleRate));
-          }
-        };
-      };
-      ws.onmessage = (e) => onMessage(JSON.parse(e.data));
-      ws.onerror = () => fail("WebSocket error");
-      ws.onclose = () => { if (recording) stop(); };
-    }
-
-    function onMessage(msg) {
-      if (msg.type !== "Turn") return;
-      if (msg.end_of_turn) {
-        finalEl.textContent += (msg.transcript || "") + " ";
-        partialEl.textContent = "";
-      } else {
-        partialEl.textContent = msg.transcript || "";
-      }
-    }
-
-    function stop() {
-      recording = false;
-      recBtn.textContent = "● Record";
-      recBtn.classList.remove("rec");
-      setStatus("Stopped", "idle");
-      if (ws && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "Terminate" }));
-      if (processor) processor.disconnect();
-      if (mediaStream) mediaStream.getTracks().forEach((t) => t.stop());
-      if (audioCtx) audioCtx.close();
-      ws = processor = mediaStream = audioCtx = null;
-    }
-
-    // Web Audio gives Float32 at the device rate (often 48k); the API wants 16k PCM16.
-    function downsampleTo16kPCM(input, inRate) {
-      const ratio = inRate / 16000;
-      const outLen = Math.floor(input.length / ratio);
-      const out = new Int16Array(outLen);
-      for (let i = 0; i < outLen; i++) {
-        const s = Math.max(-1, Math.min(1, input[Math.floor(i * ratio)]));
-        out[i] = s < 0 ? s * 0x8000 : s * 0x7fff;
-      }
-      return out.buffer;
-    }
-
-    function fail(msg) {
-      setStatus("Error: " + msg, "error");
-      if (recording) stop();
-    }
-  </script>
+  <script src="/static/audio.js"></script>
+  <script src="/static/app.js"></script>
 </body>
 </html>
diff --git a/aai_cli/init/templates/stream/static/app.js b/aai_cli/init/templates/stream/static/app.js
new file mode 100644
index 00000000..5d2c653c
--- /dev/null
+++ b/aai_cli/init/templates/stream/static/app.js
@@ -0,0 +1,88 @@
+const STREAMING_CONFIG = {
+  sampleRate: 16000,
+  encoding: "pcm_s16le",
+  speechModel: "u3-rt-pro",
+  formatTurns: true,
+  processorBufferSize: 4096,
+};
+
+const recBtn = document.getElementById("rec");
+const statusEl = document.getElementById("status");
+const finalEl = document.getElementById("final");
+const partialEl = document.getElementById("partial");
+
+let ws = null;
+let audioPipeline = null;
+let recording = false;
+
+recBtn.addEventListener("click", () => (recording ? stop() : start().catch(fail)));
+
+function setStatus(message, state) {
+  statusEl.textContent = message;
+  statusEl.className = state;
+}
+
+async function start() {
+  setStatus("Connecting...", "idle");
+  const res = await fetch("/api/token", { method: "POST" });
+  if (!res.ok) return fail(await res.text());
+  const { token, ws_url } = await res.json();
+
+  const stream = await navigator.mediaDevices.getUserMedia({ audio: true });
+  audioPipeline = AudioHelpers.createMicrophonePipeline(stream, {
+    bufferSize: STREAMING_CONFIG.processorBufferSize,
+  });
+
+  const params = new URLSearchParams({
+    token,
+    sample_rate: String(STREAMING_CONFIG.sampleRate),
+    encoding: STREAMING_CONFIG.encoding,
+    speech_model: STREAMING_CONFIG.speechModel,
+    format_turns: String(STREAMING_CONFIG.formatTurns),
+  });
+  ws = new WebSocket(`${ws_url}?${params}`);
+  ws.binaryType = "arraybuffer";
+
+  ws.onopen = () => {
+    recording = true;
+    recBtn.textContent = "■ Stop";
+    recBtn.classList.add("rec");
+    setStatus("● Live", "live");
+    audioPipeline.connect((frame, sampleRate) => {
+      if (ws && ws.readyState === WebSocket.OPEN) {
+        ws.send(AudioHelpers.downsampleToPCM(frame, sampleRate, STREAMING_CONFIG.sampleRate));
+      }
+    });
+  };
+  ws.onmessage = (event) => onMessage(JSON.parse(event.data));
+  ws.onerror = () => fail("WebSocket error");
+  ws.onclose = () => {
+    if (recording) stop();
+  };
+}
+
+function onMessage(message) {
+  if (message.type !== "Turn") return;
+  if (message.end_of_turn) {
+    finalEl.textContent += (message.transcript || "") + " ";
+    partialEl.textContent = "";
+  } else {
+    partialEl.textContent = message.transcript || "";
+  }
+}
+
+function stop() {
+  recording = false;
+  recBtn.textContent = "● Record";
+  recBtn.classList.remove("rec");
+  setStatus("Stopped", "idle");
+  if (ws && ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: "Terminate" }));
+  if (audioPipeline) audioPipeline.close();
+  ws = null;
+  audioPipeline = null;
+}
+
+function fail(message) {
+  setStatus("Error: " + message, "error");
+  if (recording) stop();
+}
diff --git a/aai_cli/init/templates/stream/static/audio.js b/aai_cli/init/templates/stream/static/audio.js
new file mode 100644
index 00000000..eb93e03d
--- /dev/null
+++ b/aai_cli/init/templates/stream/static/audio.js
@@ -0,0 +1,39 @@
+function createMicrophonePipeline(stream, options = {}) {
+  const bufferSize = options.bufferSize || 4096;
+  const AudioContextClass = window.AudioContext || window.webkitAudioContext;
+  const audioCtx = new AudioContextClass();
+  const source = audioCtx.createMediaStreamSource(stream);
+  const processor = audioCtx.createScriptProcessor(bufferSize, 1, 1);
+
+  return {
+    audioCtx,
+    connect(onFrame) {
+      source.connect(processor);
+      processor.connect(audioCtx.destination);
+      processor.onaudioprocess = (event) => {
+        onFrame(event.inputBuffer.getChannelData(0), audioCtx.sampleRate);
+      };
+    },
+    close() {
+      processor.disconnect();
+      stream.getTracks().forEach((track) => track.stop());
+      audioCtx.close();
+    },
+  };
+}
+
+function downsampleToPCM(input, inputRate, outputRate) {
+  const ratio = inputRate / outputRate;
+  const outputLength = Math.floor(input.length / ratio);
+  const output = new Int16Array(outputLength);
+  for (let i = 0; i < outputLength; i++) {
+    const sample = Math.max(-1, Math.min(1, input[Math.floor(i * ratio)]));
+    output[i] = sample < 0 ? sample * 0x8000 : sample * 0x7fff;
+  }
+  return output.buffer;
+}
+
+window.AudioHelpers = {
+  createMicrophonePipeline,
+  downsampleToPCM,
+};
diff --git a/aai_cli/init/templates/stream/static/styles.css b/aai_cli/init/templates/stream/static/styles.css
new file mode 100644
index 00000000..bf689671
--- /dev/null
+++ b/aai_cli/init/templates/stream/static/styles.css
@@ -0,0 +1,48 @@
+:root { --accent: #4338ca; --line: #e5e7eb; --muted: #6b7280; --bg: #f8fafc; }
+* { box-sizing: border-box; }
+body {
+  font: 15px/1.6 -apple-system, system-ui, sans-serif;
+  color: #111827;
+  background: var(--bg);
+  margin: 0;
+  padding: 48px 16px;
+}
+main { max-width: 720px; margin: 0 auto; }
+h1 { font-size: 22px; margin: 0 0 4px; }
+.sub { color: var(--muted); margin: 0 0 24px; }
+button {
+  background: var(--accent);
+  color: #fff;
+  border: 0;
+  border-radius: 8px;
+  padding: 11px 20px;
+  font-size: 14px;
+  font-weight: 600;
+  cursor: pointer;
+}
+button.rec { background: #dc2626; }
+button:disabled { opacity: .55; cursor: default; }
+#status {
+  display: inline-block;
+  margin-left: 12px;
+  font-size: 13px;
+  font-weight: 600;
+  padding: 5px 12px;
+  border-radius: 999px;
+}
+#status:empty { display: none; }
+#status.live { background: #fee2e2; color: #991b1b; }
+#status.idle { background: #f3f4f6; color: #4b5563; }
+#status.error { background: #fee2e2; color: #991b1b; }
+.caption {
+  margin-top: 24px;
+  font-size: 19px;
+  line-height: 1.7;
+  min-height: 120px;
+  background: #fff;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  padding: 18px;
+}
+.final { color: #111827; }
+.partial { color: var(--muted); }
diff --git a/aai_cli/init/templates/transcribe/AGENTS.md b/aai_cli/init/templates/transcribe/AGENTS.md
new file mode 100644
index 00000000..928a66b1
--- /dev/null
+++ b/aai_cli/init/templates/transcribe/AGENTS.md
@@ -0,0 +1,29 @@
+# Agent Notes
+
+This is a buildless FastAPI + static HTML starter. Run it with:
+
+```sh
+uvicorn api.index:app --reload --port 3000
+```
+
+## Map
+
+- `api/settings.py`: backend customization for AssemblyAI config, sample URL, and LLM Gateway model.
+- `api/index.py`: server routes. Keep `ASSEMBLYAI_API_KEY` here on the server.
+- `static/app.js`: browser workflow, polling, tab rendering, and transcript Q&A UI.
+- `static/styles.css`: visual styling only.
+- `index.html`: page structure and static asset links.
+
+## Change Points
+
+- Transcription features: edit `TRANSCRIPTION_CONFIG_KWARGS` in `api/settings.py`.
+- Sample audio URL: edit `SAMPLE_URL` in `api/settings.py` and the matching input value in `index.html`.
+- LLM answer behavior: edit `LLM_MODEL` in `api/settings.py` or the `/api/ask` prompt in `api/index.py`.
+- Transcript display: edit renderer functions in `static/app.js`.
+
+## Invariants
+
+- Never expose `ASSEMBLYAI_API_KEY` or any server secret in `index.html` or `static/`.
+- Keep every browser `fetch("/api/...")` route registered in `api/index.py`.
+- Keep `/api/status/{transcript_id}` non-blocking; do not use SDK helpers that wait for completion in that polling route.
+- Keep the app buildless unless the user explicitly asks for a frontend toolchain.
diff --git a/aai_cli/init/templates/transcribe/README.md b/aai_cli/init/templates/transcribe/README.md
index b1338430..b85e90bd 100644
--- a/aai_cli/init/templates/transcribe/README.md
+++ b/aai_cli/init/templates/transcribe/README.md
@@ -2,7 +2,7 @@
 
 Transcribe an audio/video URL (defaults to a public sample) or upload a file, and
 see the transcript with speaker labels, chapters, sentiment, entities, and
-highlights. Built with FastAPI + a single HTML page.
+highlights. Built with FastAPI + static HTML/CSS/JS. There is no frontend build step.
 
 ## Run locally
 
@@ -23,4 +23,5 @@ No extra config — `vercel.json` routes the page and the `/api` function.
 
 - Show chapter summaries and highlight timestamps.
 - Add a waveform / audio player synced to the transcript.
-- Swap the analysis features in `CONFIG` (api/index.py).
+- Swap the analysis features in `TRANSCRIPTION_CONFIG_KWARGS` (`api/settings.py`).
+- Change transcript rendering in `static/app.js`.
diff --git a/aai_cli/init/templates/transcribe/api/__init__.py b/aai_cli/init/templates/transcribe/api/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/aai_cli/init/templates/transcribe/api/index.py b/aai_cli/init/templates/transcribe/api/index.py
index e5c55074..a932e053 100644
--- a/aai_cli/init/templates/transcribe/api/index.py
+++ b/aai_cli/init/templates/transcribe/api/index.py
@@ -6,13 +6,12 @@
   GET  /api/status/{id}      -> poll; returns the full transcript JSON when complete
   POST /api/ask              -> ask a question about a transcript via the LLM Gateway
 
-The browser (index.html) submits a URL or file, then polls status until done.
+The browser (index.html + static/app.js) submits a URL or file, then polls status.
 Your API key stays on the server — the browser never sees it.
 """
 
 from __future__ import annotations
 
-import os
 import tempfile
 import uuid
 from pathlib import Path
@@ -20,37 +19,24 @@
 import assemblyai as aai
 from assemblyai.api import get_transcript  # single non-blocking GET (see status())
 from assemblyai.client import Client
-from dotenv import load_dotenv
 from fastapi import Body, FastAPI, HTTPException, UploadFile
 from fastapi.responses import FileResponse
+from fastapi.staticfiles import StaticFiles
 from openai import OpenAI  # the LLM Gateway is OpenAI-compatible
 
-load_dotenv()
-API_KEY = os.environ.get("ASSEMBLYAI_API_KEY", "")
-aai.settings.api_key = API_KEY
+from api import settings
+
+aai.settings.api_key = settings.API_KEY
 # Target the same AssemblyAI environment the key was minted for. `aai init` writes
-# these for you; leave them unset to use the production defaults.
-if base_url := os.environ.get("ASSEMBLYAI_BASE_URL"):
-    aai.settings.base_url = base_url
-LLM_GATEWAY_URL = os.environ.get(
-    "ASSEMBLYAI_LLM_GATEWAY_URL", "https://llm-gateway.assemblyai.com/v1"
-)
-LLM_MODEL = "claude-haiku-4-5-20251001"
-
-# A public sample so you can try it instantly without uploading anything.
-SAMPLE_URL = "https://assembly.ai/wildfires.mp3"
-
-# Audio-intelligence features to showcase. Tweak these — that's the point of a starter.
-CONFIG = aai.TranscriptionConfig(
-    speaker_labels=True,
-    auto_chapters=True,
-    sentiment_analysis=True,
-    entity_detection=True,
-    auto_highlights=True,
-)
+# this for you; leave it unset to use the production default.
+if settings.ASSEMBLYAI_BASE_URL:
+    aai.settings.base_url = settings.ASSEMBLYAI_BASE_URL
+
+CONFIG = aai.TranscriptionConfig(**settings.TRANSCRIPTION_CONFIG_KWARGS)
 
 ROOT = Path(__file__).resolve().parent.parent
 app = FastAPI()
+app.mount("/static", StaticFiles(directory=ROOT / "static"), name="static")
 
 
 @app.get("/")
@@ -62,7 +48,7 @@ def _submit(audio: str) -> dict[str, str]:
     """Submit an audio reference (local file path or public URL); return its id."""
     try:
         transcript = aai.Transcriber().submit(audio, config=CONFIG)
-    except Exception as exc:  # missing/invalid key, network, etc. -> clean error, not a 500
+    except Exception as exc:  # missing/invalid key, network, etc. -> clean error
         raise HTTPException(
             status_code=502, detail=f"Could not start transcription: {exc}"
         ) from exc
@@ -83,22 +69,18 @@ async def transcribe(file: UploadFile) -> dict[str, str]:
 
 
 @app.post("/api/transcribe-url")
-def transcribe_url(url: str = Body(default=SAMPLE_URL, embed=True)) -> dict[str, str]:
+def transcribe_url(url: str = Body(default=settings.SAMPLE_URL, embed=True)) -> dict[str, str]:
     # AssemblyAI transcribes a public URL directly — no upload step needed.
-    return _submit(url.strip() or SAMPLE_URL)
+    return _submit(url.strip() or settings.SAMPLE_URL)
 
 
 @app.post("/api/ask")
 def ask(transcript_id: str = Body(...), question: str = Body(...)) -> dict[str, str]:
-    """Answer a question about a transcript via the LLM Gateway.
-
-    The gateway is OpenAI-compatible: pass `transcript_id` in `extra_body` and it
-    substitutes the `{{ transcript }}` tag with the transcript text server-side.
-    """
-    client = OpenAI(api_key=API_KEY, base_url=LLM_GATEWAY_URL)
+    """Answer a question about a transcript via the LLM Gateway."""
+    client = OpenAI(api_key=settings.API_KEY, base_url=settings.LLM_GATEWAY_URL)
     try:
         resp = client.chat.completions.create(
-            model=LLM_MODEL,
+            model=settings.LLM_MODEL,
             messages=[{"role": "user", "content": f"{question}\n\n{{{{ transcript }}}}"}],
             max_tokens=1000,
             extra_body={"transcript_id": transcript_id},
@@ -111,9 +93,7 @@ def ask(transcript_id: str = Body(...), question: str = Body(...)) -> dict[str,
 @app.get("/api/status/{transcript_id}")
 def status(transcript_id: str) -> dict[str, object]:
     # One non-blocking GET. NOTE: aai.Transcript.get_by_id() BLOCKS until the job
-    # finishes (it calls wait_for_completion) — wrong for a poll endpoint, and it
-    # would time out on serverless. api.get_transcript does a single request and
-    # uses the SDK's configured client (auth + region from aai.settings).
+    # finishes (it calls wait_for_completion), which is wrong for a poll endpoint.
     try:
         t = get_transcript(Client.get_default().http_client, transcript_id)
     except Exception as exc:  # missing key (ValueError), HTTP/network error -> clean 502
diff --git a/aai_cli/init/templates/transcribe/api/settings.py b/aai_cli/init/templates/transcribe/api/settings.py
new file mode 100644
index 00000000..6ee69e06
--- /dev/null
+++ b/aai_cli/init/templates/transcribe/api/settings.py
@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+import os
+
+from dotenv import load_dotenv
+
+load_dotenv()
+
+API_KEY = os.environ.get("ASSEMBLYAI_API_KEY", "")
+ASSEMBLYAI_BASE_URL = os.environ.get("ASSEMBLYAI_BASE_URL")
+LLM_GATEWAY_URL = os.environ.get(
+    "ASSEMBLYAI_LLM_GATEWAY_URL", "https://llm-gateway.assemblyai.com/v1"
+)
+LLM_MODEL = "claude-haiku-4-5-20251001"
+
+# Public sample so the app works immediately without uploading a local file.
+SAMPLE_URL = "https://assembly.ai/wildfires.mp3"
+
+# Main backend customization point. Add, remove, or tune AssemblyAI features here.
+TRANSCRIPTION_CONFIG_KWARGS = {
+    "speaker_labels": True,
+    "auto_chapters": True,
+    "sentiment_analysis": True,
+    "entity_detection": True,
+    "auto_highlights": True,
+}
diff --git a/aai_cli/init/templates/transcribe/index.html b/aai_cli/init/templates/transcribe/index.html
index 0ff894a3..5e9f1ed8 100644
--- a/aai_cli/init/templates/transcribe/index.html
+++ b/aai_cli/init/templates/transcribe/index.html
@@ -4,91 +4,7 @@
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>Transcribe a pre-recorded file · AssemblyAI</title>
-  <style>
-    :root { --accent: #4338ca; --line: #e5e7eb; --muted: #6b7280; --bg: #f8fafc; }
-    * { box-sizing: border-box; }
-    body {
-      font: 15px/1.6 -apple-system, system-ui, sans-serif; color: #111827;
-      background: var(--bg); margin: 0; padding: 48px 16px;
-    }
-    main { max-width: 760px; margin: 0 auto; }
-    h1 { font-size: 22px; margin: 0 0 4px; }
-    .sub { color: var(--muted); margin: 0 0 24px; }
-    .card { background: #fff; border: 1px solid var(--line); border-radius: 14px; padding: 20px; }
-    .row { display: flex; gap: 8px; }
-    input[type=url] {
-      flex: 1; min-width: 0; padding: 11px 13px; border: 1px solid var(--line);
-      border-radius: 9px; font-size: 14px;
-    }
-    input[type=url]:focus { outline: none; border-color: var(--accent); }
-    button {
-      background: var(--accent); color: #fff; border: 0; border-radius: 9px;
-      padding: 0 18px; font-size: 14px; font-weight: 600; cursor: pointer; white-space: nowrap;
-    }
-    button:disabled { opacity: .55; cursor: default; }
-    .or { display: flex; align-items: center; gap: 12px; color: var(--muted); font-size: 13px; margin: 16px 0; }
-    .or::before, .or::after { content: ""; flex: 1; height: 1px; background: var(--line); }
-    .upload {
-      display: block; text-align: center; padding: 16px; border: 1.5px dashed var(--line);
-      border-radius: 10px; color: var(--muted); cursor: pointer; font-size: 14px;
-    }
-    .upload:hover { border-color: var(--accent); color: var(--accent); }
-    #status {
-      display: inline-block; margin: 18px 0; padding: 6px 13px; border-radius: 999px;
-      font-size: 13px; font-weight: 600;
-    }
-    #status:empty { display: none; }
-    #status.working { background: #eef2ff; color: var(--accent); }
-    #status.done { background: #dcfce7; color: #166534; }
-    #status.error { background: #fee2e2; color: #991b1b; }
-
-    /* Ask the transcript (LLM Gateway) */
-    #ask { margin: 0 0 18px; }
-    #ask .q { display: flex; gap: 8px; }
-    #ask input { flex: 1; min-width: 0; padding: 11px 13px; border: 1px solid var(--line);
-                 border-radius: 9px; font-size: 14px; }
-    #ask input:focus { outline: none; border-color: var(--accent); }
-    .answer { margin-top: 12px; padding: 12px 14px; background: #f5f3ff; border-radius: 10px;
-              white-space: pre-wrap; color: #1e1b4b; }
-    .answer:empty { display: none; }
-
-    /* Tabs */
-    .tabs { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 14px; }
-    .tabs button {
-      background: #fff; color: #374151; border: 1px solid var(--line); border-radius: 999px;
-      padding: 6px 14px; font-size: 13px; font-weight: 600;
-    }
-    .tabs button.active { background: var(--accent); color: #fff; border-color: var(--accent); }
-    .time { color: var(--muted); font-variant-numeric: tabular-nums; font-size: 12px; }
-
-    /* Transcript / sentiment turns */
-    .turn { padding: 8px 0 8px 12px; border-left: 3px solid var(--line); margin: 8px 0; }
-    .spk { font-weight: 700; }
-    .turn .t { color: #374151; }
-
-    /* Chapters */
-    .chapter { padding: 12px 0; border-top: 1px solid var(--line); }
-    .chapter h4 { margin: 0 0 2px; font-size: 15px; }
-    .chapter p { margin: 4px 0 0; color: #374151; }
-
-    /* Entities */
-    .egroup { padding: 10px 0; border-top: 1px solid var(--line); }
-    .elabel { font-size: 11px; text-transform: uppercase; letter-spacing: .05em; color: var(--muted); }
-    .etag { display: inline-block; background: #eef2ff; color: var(--accent); border-radius: 999px;
-            padding: 2px 10px; margin: 4px 4px 0 0; font-size: 13px; }
-
-    /* Highlights */
-    .hl { display: flex; align-items: center; gap: 10px; padding: 8px 0; border-top: 1px solid var(--line); }
-    .hl .count { background: #eef2ff; color: var(--accent); border-radius: 999px; padding: 2px 9px;
-                 font-size: 12px; font-weight: 700; }
-
-    /* Sentiment pills */
-    .sent { font-size: 11px; font-weight: 700; border-radius: 999px; padding: 1px 8px; margin-left: 8px; }
-    .POSITIVE { background: #dcfce7; color: #166534; }
-    .NEGATIVE { background: #fee2e2; color: #991b1b; }
-    .NEUTRAL { background: #f3f4f6; color: #4b5563; }
-    pre { white-space: pre-wrap; margin: 0; font: inherit; }
-  </style>
+  <link rel="stylesheet" href="/static/styles.css" />
 </head>
 <body>
   <main>
@@ -112,7 +28,7 @@ <h1>🎧 Transcribe a pre-recorded file</h1>
 
     <div id="ask" class="card" hidden>
       <div class="q">
-        <input id="q" type="text" placeholder="Ask a question about this transcript…" />
+        <input id="q" type="text" placeholder="Ask a question about this transcript..." />
         <button id="askBtn">Ask</button>
       </div>
       <div id="answer" class="answer"></div>
@@ -122,177 +38,6 @@ <h1>🎧 Transcribe a pre-recorded file</h1>
     <div id="view"></div>
   </main>
 
-  <script>
-    const urlInput = document.getElementById("url");
-    const goBtn = document.getElementById("go");
-    const fileInput = document.getElementById("file");
-    const statusEl = document.getElementById("status");
-    const tabsEl = document.getElementById("tabs");
-    const viewEl = document.getElementById("view");
-    const askPanel = document.getElementById("ask");
-    const qInput = document.getElementById("q");
-    const askBtn = document.getElementById("askBtn");
-    const answerEl = document.getElementById("answer");
-
-    let currentId = null;  // transcript the Ask panel questions against
-
-    goBtn.addEventListener("click", () => transcribeUrl(urlInput.value.trim()));
-    urlInput.addEventListener("keydown", (e) => e.key === "Enter" && goBtn.click());
-    fileInput.addEventListener("change", () => fileInput.files[0] && transcribeFile(fileInput.files[0]));
-    askBtn.addEventListener("click", () => ask(qInput.value.trim()));
-    qInput.addEventListener("keydown", (e) => e.key === "Enter" && askBtn.click());
-
-    async function transcribeUrl(url) {
-      if (!url) return;
-      await start(() =>
-        fetch("/api/transcribe-url", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ url }),
-        })
-      );
-    }
-
-    async function transcribeFile(file) {
-      const body = new FormData();
-      body.append("file", file);
-      await start(() => fetch("/api/transcribe", { method: "POST", body }));
-    }
-
-    async function start(submit) {
-      busy(true);
-      tabsEl.innerHTML = viewEl.innerHTML = answerEl.textContent = "";
-      askPanel.hidden = true;
-      currentId = null;
-      speakerSeen = {};
-      setStatus("Uploading…", "working");
-      try {
-        const res = await submit();
-        if (!res.ok) return fail(await res.text());
-        await poll((await res.json()).id);
-      } catch (e) {
-        fail(e.message || String(e));  // network/parse errors don't leave the UI stuck
-      }
-    }
-
-    async function poll(id) {
-      setStatus("Transcribing…", "working");
-      const res = await fetch("/api/status/" + id);
-      if (!res.ok) return fail(await res.text());
-      const data = await res.json();
-      if (data.status !== "completed")
-        return void setTimeout(() => poll(id).catch((e) => fail(String(e))), 2000);
-      setStatus("✓ Done", "done");
-      busy(false);
-      currentId = id;
-      askPanel.hidden = false;  // transcript stays visible below; ask alongside it
-      explore(data.transcript);
-    }
-
-    async function ask(question) {
-      if (!question || !currentId) return;
-      askBtn.disabled = true;
-      answerEl.textContent = "Thinking…";
-      try {
-        const res = await fetch("/api/ask", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ transcript_id: currentId, question }),
-        });
-        const data = await res.json();
-        answerEl.textContent = res.ok ? data.answer : "Error: " + (data.detail || res.statusText);
-      } finally {
-        askBtn.disabled = false;
-      }
-    }
-
-    // --- speaker colors (reset each transcription via start()) -----------
-    const PALETTE = ["#4338ca", "#0d9488", "#b45309", "#be185d", "#15803d", "#7c3aed"];
-    let speakerSeen = {};
-    function speakerColor(spk) {
-      return (speakerSeen[spk] ??= PALETTE[Object.keys(speakerSeen).length % PALETTE.length]);
-    }
-
-    // --- build the tabbed explorer --------------------------------------
-    function explore(t) {
-      const views = {};
-      const turns = t.utterances || [];
-      views.Transcript = turns.length
-        ? turns.map((u) => turnHtml(u.speaker, u.text)).join("")
-        : `<pre>${esc(t.text || "")}</pre>`;
-
-      if (t.chapters?.length) views[`Chapters · ${t.chapters.length}`] = chaptersHtml(t.chapters);
-      if (t.sentiment_analysis_results?.length)
-        views.Sentiment = t.sentiment_analysis_results.map(sentimentHtml).join("");
-      if (t.entities?.length) views[`Entities · ${t.entities.length}`] = entitiesHtml(t.entities);
-      const hl = t.auto_highlights_result?.results || [];
-      if (hl.length) views.Highlights = highlightsHtml(hl);
-
-      tabsEl.innerHTML = "";
-      Object.keys(views).forEach((name, i) => {
-        const b = document.createElement("button");
-        b.textContent = name;
-        b.onclick = () => {
-          viewEl.innerHTML = views[name];
-          [...tabsEl.children].forEach((c) => c.classList.toggle("active", c === b));
-        };
-        tabsEl.appendChild(b);
-        if (i === 0) b.click();
-      });
-    }
-
-    function turnHtml(speaker, text, extra = "") {
-      const c = speakerColor(speaker);
-      return `<div class="turn" style="border-left-color:${c}">
-        <span class="spk" style="color:${c}">Speaker ${esc(speaker)}</span>${extra}
-        <div class="t">${esc(text)}</div></div>`;
-    }
-
-    function sentimentHtml(s) {
-      const pill = `<span class="sent ${s.sentiment}">${esc(s.sentiment)}</span>`;
-      return turnHtml(s.speaker || "?", s.text, pill);
-    }
-
-    function chaptersHtml(chapters) {
-      return chapters
-        .map(
-          (c) => `<div class="chapter">
-            <h4>${esc(c.headline || c.gist || "Chapter")}</h4>
-            <span class="time">${fmt(c.start)} – ${fmt(c.end)}</span>
-            <p>${esc(c.summary || c.gist || "")}</p></div>`
-        )
-        .join("");
-    }
-
-    function entitiesHtml(entities) {
-      const groups = {};
-      for (const e of entities) (groups[e.entity_type] ??= []).push(e.text);
-      return Object.entries(groups)
-        .map(
-          ([type, items]) => `<div class="egroup"><div class="elabel">${esc(type)}</div>
-            ${[...new Set(items)].map((x) => `<span class="etag">${esc(x)}</span>`).join("")}</div>`
-        )
-        .join("");
-    }
-
-    function highlightsHtml(results) {
-      return results
-        .sort((a, b) => b.rank - a.rank)
-        .map((h) => `<div class="hl"><span class="count">${h.count}×</span> ${esc(h.text)}</div>`)
-        .join("");
-    }
-
-    // --- helpers ---------------------------------------------------------
-    function fmt(ms) {
-      const s = Math.round((ms || 0) / 1000);
-      return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")}`;
-    }
-    function busy(on) { goBtn.disabled = on; }
-    function setStatus(msg, state) { statusEl.textContent = msg; statusEl.className = state; }
-    function fail(msg) { busy(false); setStatus("⚠ " + msg, "error"); }
-    function esc(s) {
-      return String(s ?? "").replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" }[c]));
-    }
-  </script>
+  <script src="/static/app.js"></script>
 </body>
 </html>
diff --git a/aai_cli/init/templates/transcribe/static/app.js b/aai_cli/init/templates/transcribe/static/app.js
new file mode 100644
index 00000000..0196047f
--- /dev/null
+++ b/aai_cli/init/templates/transcribe/static/app.js
@@ -0,0 +1,242 @@
+const APP_CONFIG = {
+  sampleUrl: "https://assembly.ai/wildfires.mp3",
+  pollIntervalMs: 2000,
+  speakerPalette: ["#4338ca", "#0d9488", "#b45309", "#be185d", "#15803d", "#7c3aed"],
+};
+
+const els = {
+  url: document.getElementById("url"),
+  go: document.getElementById("go"),
+  file: document.getElementById("file"),
+  status: document.getElementById("status"),
+  tabs: document.getElementById("tabs"),
+  view: document.getElementById("view"),
+  askPanel: document.getElementById("ask"),
+  question: document.getElementById("q"),
+  ask: document.getElementById("askBtn"),
+  answer: document.getElementById("answer"),
+};
+
+let currentId = null;
+let speakerSeen = {};
+
+els.go.addEventListener("click", () => transcribeUrl(els.url.value.trim()));
+els.url.addEventListener("keydown", (event) => {
+  if (event.key === "Enter") els.go.click();
+});
+els.file.addEventListener("change", () => {
+  if (els.file.files[0]) transcribeFile(els.file.files[0]);
+});
+els.ask.addEventListener("click", () => ask(els.question.value.trim()));
+els.question.addEventListener("keydown", (event) => {
+  if (event.key === "Enter") els.ask.click();
+});
+
+async function transcribeUrl(url) {
+  if (!url) return;
+  await start(() =>
+    fetch("/api/transcribe-url", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ url }),
+    })
+  );
+}
+
+async function transcribeFile(file) {
+  const body = new FormData();
+  body.append("file", file);
+  await start(() => fetch("/api/transcribe", { method: "POST", body }));
+}
+
+async function start(submit) {
+  busy(true);
+  currentId = null;
+  speakerSeen = {};
+  els.tabs.replaceChildren();
+  els.view.replaceChildren();
+  els.answer.textContent = "";
+  els.askPanel.hidden = true;
+  setStatus("Uploading...", "working");
+
+  try {
+    const res = await submit();
+    if (!res.ok) return fail(await res.text());
+    await poll((await res.json()).id);
+  } catch (error) {
+    fail(error.message || String(error));
+  }
+}
+
+async function poll(id) {
+  setStatus("Transcribing...", "working");
+  const res = await fetch("/api/status/" + encodeURIComponent(id));
+  if (!res.ok) return fail(await res.text());
+
+  const data = await res.json();
+  if (data.status !== "completed") {
+    window.setTimeout(() => poll(id).catch((error) => fail(String(error))), APP_CONFIG.pollIntervalMs);
+    return;
+  }
+
+  setStatus("Done", "done");
+  busy(false);
+  currentId = id;
+  els.askPanel.hidden = false;
+  explore(data.transcript);
+}
+
+async function ask(question) {
+  if (!question || !currentId) return;
+  els.ask.disabled = true;
+  els.answer.textContent = "Thinking...";
+  try {
+    const res = await fetch("/api/ask", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ transcript_id: currentId, question }),
+    });
+    const data = await res.json();
+    els.answer.textContent = res.ok ? data.answer : "Error: " + (data.detail || res.statusText);
+  } catch (error) {
+    els.answer.textContent = "Error: " + (error.message || String(error));
+  } finally {
+    els.ask.disabled = false;
+  }
+}
+
+function speakerColor(speaker) {
+  return (speakerSeen[speaker] ??=
+    APP_CONFIG.speakerPalette[Object.keys(speakerSeen).length % APP_CONFIG.speakerPalette.length]);
+}
+
+function explore(transcript) {
+  const views = [
+    { label: "Transcript", render: () => renderTranscript(transcript) },
+  ];
+
+  if (transcript.chapters?.length) {
+    views.push({ label: `Chapters - ${transcript.chapters.length}`, render: () => renderChapters(transcript.chapters) });
+  }
+  if (transcript.sentiment_analysis_results?.length) {
+    views.push({ label: "Sentiment", render: () => renderSentiment(transcript.sentiment_analysis_results) });
+  }
+  if (transcript.entities?.length) {
+    views.push({ label: `Entities - ${transcript.entities.length}`, render: () => renderEntities(transcript.entities) });
+  }
+  const highlights = transcript.auto_highlights_result?.results || [];
+  if (highlights.length) {
+    views.push({ label: "Highlights", render: () => renderHighlights(highlights) });
+  }
+
+  renderTabs(views);
+}
+
+function renderTabs(views) {
+  els.tabs.replaceChildren();
+  for (const [index, view] of views.entries()) {
+    const button = document.createElement("button");
+    button.textContent = view.label;
+    button.addEventListener("click", () => {
+      els.view.replaceChildren(view.render());
+      for (const child of els.tabs.children) child.classList.toggle("active", child === button);
+    });
+    els.tabs.appendChild(button);
+    if (index === 0) button.click();
+  }
+}
+
+function renderTranscript(transcript) {
+  const turns = transcript.utterances || [];
+  if (turns.length) {
+    return fragment(turns.map((turn) => turnNode(turn.speaker, turn.text)));
+  }
+  return element("pre", {}, transcript.text || "");
+}
+
+function renderSentiment(results) {
+  return fragment(results.map((item) => {
+    const pill = element("span", { className: "sent" }, item.sentiment || "");
+    if (["POSITIVE", "NEGATIVE", "NEUTRAL"].includes(item.sentiment)) {
+      pill.classList.add(item.sentiment);
+    }
+    return turnNode(item.speaker || "?", item.text, pill);
+  }));
+}
+
+function renderChapters(chapters) {
+  return fragment(chapters.map((chapter) => {
+    const node = element("div", { className: "chapter" });
+    node.append(
+      element("h4", {}, chapter.headline || chapter.gist || "Chapter"),
+      element("span", { className: "time" }, `${fmt(chapter.start)} - ${fmt(chapter.end)}`),
+      element("p", {}, chapter.summary || chapter.gist || "")
+    );
+    return node;
+  }));
+}
+
+function renderEntities(entities) {
+  const groups = {};
+  for (const entity of entities) {
+    (groups[entity.entity_type] ??= []).push(entity.text);
+  }
+  return fragment(Object.entries(groups).map(([type, items]) => {
+    const group = element("div", { className: "egroup" }, element("div", { className: "elabel" }, type));
+    for (const text of new Set(items)) {
+      group.appendChild(element("span", { className: "etag" }, text));
+    }
+    return group;
+  }));
+}
+
+function renderHighlights(results) {
+  return fragment([...results].sort((a, b) => b.rank - a.rank).map((highlight) =>
+    element("div", { className: "hl" }, element("span", { className: "count" }, `${highlight.count}x`), " ", highlight.text)
+  ));
+}
+
+function turnNode(speaker, text, extra = null) {
+  const color = speakerColor(speaker);
+  const node = element("div", { className: "turn" });
+  node.style.borderLeftColor = color;
+
+  const name = element("span", { className: "spk" }, `Speaker ${speaker}`);
+  name.style.color = color;
+  node.append(name);
+  if (extra) node.append(extra);
+  node.append(element("div", { className: "t" }, text));
+  return node;
+}
+
+function fmt(ms) {
+  const seconds = Math.round((ms || 0) / 1000);
+  return `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`;
+}
+
+function busy(on) {
+  els.go.disabled = on;
+}
+
+function setStatus(message, state) {
+  els.status.textContent = message;
+  els.status.className = state;
+}
+
+function fail(message) {
+  busy(false);
+  setStatus("Error: " + message, "error");
+}
+
+function element(tag, options = {}, ...children) {
+  const node = document.createElement(tag);
+  if (options.className) node.className = options.className;
+  node.append(...children.filter((child) => child !== null && child !== undefined));
+  return node;
+}
+
+function fragment(children) {
+  const node = document.createDocumentFragment();
+  node.append(...children);
+  return node;
+}
diff --git a/aai_cli/init/templates/transcribe/static/styles.css b/aai_cli/init/templates/transcribe/static/styles.css
new file mode 100644
index 00000000..3b481928
--- /dev/null
+++ b/aai_cli/init/templates/transcribe/static/styles.css
@@ -0,0 +1,117 @@
+:root { --accent: #4338ca; --line: #e5e7eb; --muted: #6b7280; --bg: #f8fafc; }
+* { box-sizing: border-box; }
+body {
+  font: 15px/1.6 -apple-system, system-ui, sans-serif;
+  color: #111827;
+  background: var(--bg);
+  margin: 0;
+  padding: 48px 16px;
+}
+main { max-width: 760px; margin: 0 auto; }
+h1 { font-size: 22px; margin: 0 0 4px; }
+.sub { color: var(--muted); margin: 0 0 24px; }
+.card { background: #fff; border: 1px solid var(--line); border-radius: 8px; padding: 20px; }
+.row { display: flex; gap: 8px; }
+input[type=url],
+#ask input {
+  flex: 1;
+  min-width: 0;
+  padding: 11px 13px;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  font-size: 14px;
+}
+input[type=url]:focus,
+#ask input:focus { outline: none; border-color: var(--accent); }
+button {
+  background: var(--accent);
+  color: #fff;
+  border: 0;
+  border-radius: 8px;
+  padding: 0 18px;
+  font-size: 14px;
+  font-weight: 600;
+  cursor: pointer;
+  white-space: nowrap;
+}
+button:disabled { opacity: .55; cursor: default; }
+.or {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  color: var(--muted);
+  font-size: 13px;
+  margin: 16px 0;
+}
+.or::before,
+.or::after { content: ""; flex: 1; height: 1px; background: var(--line); }
+.upload {
+  display: block;
+  text-align: center;
+  padding: 16px;
+  border: 1.5px dashed var(--line);
+  border-radius: 8px;
+  color: var(--muted);
+  cursor: pointer;
+  font-size: 14px;
+}
+.upload:hover { border-color: var(--accent); color: var(--accent); }
+#status {
+  display: inline-block;
+  margin: 18px 0;
+  padding: 6px 13px;
+  border-radius: 999px;
+  font-size: 13px;
+  font-weight: 600;
+}
+#status:empty { display: none; }
+#status.working { background: #eef2ff; color: var(--accent); }
+#status.done { background: #dcfce7; color: #166534; }
+#status.error { background: #fee2e2; color: #991b1b; }
+#ask { margin: 0 0 18px; }
+#ask .q { display: flex; gap: 8px; }
+.answer {
+  margin-top: 12px;
+  padding: 12px 14px;
+  background: #f5f3ff;
+  border-radius: 8px;
+  white-space: pre-wrap;
+  color: #1e1b4b;
+}
+.answer:empty { display: none; }
+.tabs { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 14px; }
+.tabs button {
+  background: #fff;
+  color: #374151;
+  border: 1px solid var(--line);
+  border-radius: 999px;
+  padding: 6px 14px;
+  font-size: 13px;
+  font-weight: 600;
+}
+.tabs button.active { background: var(--accent); color: #fff; border-color: var(--accent); }
+.time { color: var(--muted); font-variant-numeric: tabular-nums; font-size: 12px; }
+.turn { padding: 8px 0 8px 12px; border-left: 3px solid var(--line); margin: 8px 0; }
+.spk { font-weight: 700; }
+.turn .t { color: #374151; }
+.chapter { padding: 12px 0; border-top: 1px solid var(--line); }
+.chapter h4 { margin: 0 0 2px; font-size: 15px; }
+.chapter p { margin: 4px 0 0; color: #374151; }
+.egroup { padding: 10px 0; border-top: 1px solid var(--line); }
+.elabel { font-size: 11px; text-transform: uppercase; letter-spacing: .05em; color: var(--muted); }
+.etag {
+  display: inline-block;
+  background: #eef2ff;
+  color: var(--accent);
+  border-radius: 999px;
+  padding: 2px 10px;
+  margin: 4px 4px 0 0;
+  font-size: 13px;
+}
+.hl { display: flex; align-items: center; gap: 10px; padding: 8px 0; border-top: 1px solid var(--line); }
+.hl .count { background: #eef2ff; color: var(--accent); border-radius: 999px; padding: 2px 9px; font-size: 12px; font-weight: 700; }
+.sent { font-size: 11px; font-weight: 700; border-radius: 999px; padding: 1px 8px; margin-left: 8px; }
+.POSITIVE { background: #dcfce7; color: #166534; }
+.NEGATIVE { background: #fee2e2; color: #991b1b; }
+.NEUTRAL { background: #f3f4f6; color: #4b5563; }
+pre { white-space: pre-wrap; margin: 0; font: inherit; }
diff --git a/aai_cli/jsonshape.py b/aai_cli/jsonshape.py
new file mode 100644
index 00000000..44789836
--- /dev/null
+++ b/aai_cli/jsonshape.py
@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+from pydantic import TypeAdapter, ValidationError
+
+_JSON_OBJECT: TypeAdapter[dict[str, object]] = TypeAdapter(dict[str, object])
+_OBJECT_LIST: TypeAdapter[list[object]] = TypeAdapter(list[object])
+
+
+def as_mapping(value: object) -> dict[str, object] | None:
+    try:
+        return _JSON_OBJECT.validate_python(value)
+    except ValidationError:
+        return None
+
+
+def object_list(value: object) -> list[object]:
+    try:
+        return _OBJECT_LIST.validate_python(value)
+    except ValidationError:
+        return []
+
+
+def mapping_list(value: object) -> list[dict[str, object]]:
+    valid: list[dict[str, object]] = []
+    for item in object_list(value):
+        mapped = as_mapping(item)
+        if mapped is not None:
+            valid.append(mapped)
+    return valid
diff --git a/aai_cli/main.py b/aai_cli/main.py
index 2eefbd23..04dfc34c 100644
--- a/aai_cli/main.py
+++ b/aai_cli/main.py
@@ -98,8 +98,10 @@ def list_commands(self, ctx: ClickContext) -> list[str]:
 )
 def main(
     ctx: typer.Context,
-    profile: str = typer.Option(None, "--profile", "-p", help="Named credential profile."),
-    env: str = typer.Option(None, "--env", help="Backend environment (production, sandbox000)."),
+    profile: str | None = typer.Option(None, "--profile", "-p", help="Named credential profile."),
+    env: str | None = typer.Option(
+        None, "--env", help="Backend environment (production, sandbox000)."
+    ),
     sandbox: bool = typer.Option(False, "--sandbox", help="Shortcut for --env sandbox000."),
 ) -> None:
     if sandbox and env is None:
diff --git a/aai_cli/microphone.py b/aai_cli/microphone.py
index 6eff85c5..1ea500da 100644
--- a/aai_cli/microphone.py
+++ b/aai_cli/microphone.py
@@ -1,8 +1,8 @@
 from __future__ import annotations
 
 import warnings
-from collections.abc import Callable, Iterable, Iterator
-from typing import Any
+from collections.abc import Callable, Iterable, Iterator, Mapping
+from typing import Any, Protocol, cast
 
 from aai_cli.errors import CLIError
 
@@ -17,6 +17,24 @@
 _FALLBACK_RATE = 48000
 
 
+class _RawInputStream(Protocol):
+    def start(self) -> None: ...
+
+    def read(self, frames: int) -> tuple[bytes, object]: ...
+
+    def stop(self) -> None: ...
+
+    def close(self) -> None: ...
+
+
+class _SoundDeviceModule(Protocol):
+    RawInputStream: Callable[..., _RawInputStream]
+
+    def query_devices(
+        self, device: int | None = None, kind: str | None = None
+    ) -> Mapping[str, object]: ...
+
+
 def audio_missing_error() -> CLIError:
     """The shared 'sounddevice can't be imported' error for mic and speaker paths."""
     return CLIError(
@@ -27,30 +45,38 @@ def audio_missing_error() -> CLIError:
     )
 
 
-def _default_rate(kind: str, device: int | None = None) -> int:
+def _sounddevice() -> _SoundDeviceModule:
+    try:
+        import sounddevice as module
+    except ImportError as exc:
+        raise audio_missing_error() from exc
+    return cast("_SoundDeviceModule", module)
+
+
+def default_rate(kind: str, device: int | None = None) -> int:
     """A device's native sample rate for `kind` ("input" or "output").
 
     Opening a device at its own rate avoids CoreAudio 'paramErr' (-50) failures
     that happen when it's forced to an unsupported rate. Falls back to a safe
     default if the device can't be queried (no device, headless CI).
     """
+    sd = _sounddevice()
     try:
-        import sounddevice as sd
-    except ImportError as exc:
-        raise audio_missing_error() from exc
-    try:
-        rate = int(sd.query_devices(device, kind)["default_samplerate"])
+        raw_rate = sd.query_devices(device, kind).get("default_samplerate", _FALLBACK_RATE)
+        if not isinstance(raw_rate, str | int | float):
+            return _FALLBACK_RATE
+        rate = int(float(raw_rate))
     except Exception:  # noqa: BLE001 - any query failure -> safe fallback, never crash here
         return _FALLBACK_RATE
     return rate if rate > 0 else _FALLBACK_RATE
 
 
 def _device_default_rate(device: int | None = None) -> int:
-    """The input device's native sample rate (see `_default_rate`)."""
-    return _default_rate("input", device)
+    """The input device's native sample rate (see `default_rate`)."""
+    return default_rate("input", device)
 
 
-def _resample(chunk: bytes, state: Any, *, src_rate: int, dst_rate: int) -> tuple[bytes, Any]:
+def resample_pcm16(chunk: bytes, state: Any, *, src_rate: int, dst_rate: int) -> tuple[bytes, Any]:
     """Resample one PCM16 mono fragment from `src_rate` to `dst_rate`."""
     return audioop.ratecv(chunk, 2, 1, src_rate, dst_rate, state)
 
@@ -61,7 +87,7 @@ class _SoundDeviceMic:
     Yields ~100 ms blocks; closeable so MicrophoneSource can tear it down.
     """
 
-    def __init__(self, stream: Any, blocksize: int) -> None:
+    def __init__(self, stream: _RawInputStream, blocksize: int) -> None:
         self._stream = stream
         self._blocksize = blocksize
 
@@ -79,10 +105,7 @@ def close(self) -> None:
 
 def _default_mic_stream(*, sample_rate: int, device: int | None) -> Iterator[bytes]:
     """A sounddevice-backed PCM16 mic stream (imported lazily to keep startup fast)."""
-    try:
-        import sounddevice as sd
-    except ImportError as exc:
-        raise audio_missing_error() from exc
+    sd = _sounddevice()
 
     blocksize = max(1, sample_rate // 10)  # ~100 ms per read
     stream = sd.RawInputStream(
@@ -141,11 +164,12 @@ def __iter__(self) -> Iterator[bytes]:
         state: Any = None
         try:
             for chunk in stream:
+                out = chunk
                 if self.target_rate is not None and self.target_rate != self._capture_rate:
-                    chunk, state = _resample(
+                    out, state = resample_pcm16(
                         chunk, state, src_rate=self._capture_rate, dst_rate=self.target_rate
                     )
-                yield chunk
+                yield out
         finally:
             if callable(close):
                 close()
diff --git a/aai_cli/output.py b/aai_cli/output.py
index 55662d6c..469d1dd2 100644
--- a/aai_cli/output.py
+++ b/aai_cli/output.py
@@ -21,6 +21,7 @@
 error_console = theme.make_console(stderr=True)
 
 _AGENT_ENV_VARS = ("CI", "CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT")
+_MIN_MASKABLE_SECRET_LENGTH = 8
 
 
 def _stdout_is_tty() -> bool:
@@ -44,7 +45,7 @@ def validate_output_field(field: str | None, allowed: tuple[str, ...]) -> None:
         raise UsageError(f"Unknown --output {field!r}. Choose one of: {', '.join(allowed)}.")
 
 
-def stream_output_modes(field: str | None, json_mode: bool) -> tuple[bool, bool]:
+def stream_output_modes(field: str | None, *, json_mode: bool) -> tuple[bool, bool]:
     """Fold a streaming command's ``-o/--output`` into ``(text_mode, json_mode)``.
 
     Shared by `stream` and `agent`, whose renderers take the same two flags: `text`
@@ -58,7 +59,7 @@ def stream_output_modes(field: str | None, json_mode: bool) -> tuple[bool, bool]
 
 def mask_secret(value: str) -> str:
     """Render a secret (API key, token) for display: first 3 + last 4 chars, else ``***``."""
-    return f"{value[:3]}…{value[-4:]}" if len(value) > 7 else "***"
+    return f"{value[:3]}…{value[-4:]}" if len(value) >= _MIN_MASKABLE_SECRET_LENGTH else "***"
 
 
 def success(text: str) -> str:
@@ -103,6 +104,11 @@ def emit_ndjson(obj: object) -> None:
     print(json.dumps(obj, default=str), flush=True)
 
 
+def emit_text(text: str) -> None:
+    """Write one raw text value to stdout for pipe-friendly single-field output."""
+    print(text)
+
+
 def emit_error(err: CLIError, *, json_mode: bool) -> None:
     # Always to stderr, so stdout stays clean for `aai … | next-tool` pipelines.
     if json_mode:
diff --git a/aai_cli/render.py b/aai_cli/render.py
index 549e2773..37e9bd63 100644
--- a/aai_cli/render.py
+++ b/aai_cli/render.py
@@ -54,8 +54,8 @@ def _write(self, text: str) -> None:
         except BrokenPipeError:
             # Consumer (e.g. `| head`) went away — let the command stop cleanly.
             raise
-        except Exception:  # noqa: BLE001, S110 - other downstream write errors are non-fatal
-            pass
+        except OSError:
+            return
 
     # --- human output (Rich) ----------------------------------------------
     def _console_obj(self) -> Console:
diff --git a/aai_cli/steps.py b/aai_cli/steps.py
index 3172f223..0b516221 100644
--- a/aai_cli/steps.py
+++ b/aai_cli/steps.py
@@ -21,7 +21,7 @@ def render_steps(items: list[Step], *, heading: str) -> str:
     Shared by the multi-step commands (`aai init`, `aai claude`); each passes its
     own heading.
     """
-    lines = []
+    lines: list[str] = []
     for s in items:
         style = theme.status_style(s["status"])
         lines.append(
diff --git a/aai_cli/streaming/sources.py b/aai_cli/streaming/sources.py
index 87bdf437..820c592c 100644
--- a/aai_cli/streaming/sources.py
+++ b/aai_cli/streaming/sources.py
@@ -13,14 +13,17 @@
 from aai_cli.errors import APIError, CLIError
 
 TARGET_RATE = 16000
-CHUNK_BYTES = TARGET_RATE * 2 // 10  # 100 ms of 16-bit mono PCM
+PCM16_SAMPLE_WIDTH_BYTES = 2
+CHUNK_BYTES = TARGET_RATE * PCM16_SAMPLE_WIDTH_BYTES // 10  # 100 ms of 16-bit mono PCM
 
 
 def _is_streamable_wav(path: Path) -> bool:
     try:
         with wave.open(str(path), "rb") as w:
             return (
-                w.getnchannels() == 1 and w.getsampwidth() == 2 and w.getframerate() == TARGET_RATE
+                w.getnchannels() == 1
+                and w.getsampwidth() == PCM16_SAMPLE_WIDTH_BYTES
+                and w.getframerate() == TARGET_RATE
             )
     except (wave.Error, EOFError, OSError):
         return False
diff --git a/aai_cli/timeparse.py b/aai_cli/timeparse.py
new file mode 100644
index 00000000..5ce18760
--- /dev/null
+++ b/aai_cli/timeparse.py
@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+from datetime import UTC, date, datetime, time
+
+
+def parse_iso_utc(value: object) -> datetime | None:
+    if not isinstance(value, str) or not value:
+        return None
+    text = value[:-1] + "+00:00" if value.endswith("Z") else value
+    try:
+        parsed = (
+            datetime.fromisoformat(text)
+            if "T" in text
+            else datetime.combine(date.fromisoformat(text), time.min)
+        )
+    except ValueError:
+        return None
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=UTC)
+    return parsed.astimezone(UTC)
diff --git a/aai_cli/transcribe_render.py b/aai_cli/transcribe_render.py
index bd3058a7..318f993b 100644
--- a/aai_cli/transcribe_render.py
+++ b/aai_cli/transcribe_render.py
@@ -1,12 +1,12 @@
 from __future__ import annotations
 
 from collections import Counter
-from typing import Any
+from collections.abc import Mapping
 
 from rich.console import Console
 from rich.text import Text
 
-from aai_cli import theme
+from aai_cli import jsonshape, theme
 
 
 def _fmt_ms(ms: int) -> str:
@@ -18,12 +18,48 @@ def _enum_value(obj: object) -> str:
     return str(getattr(obj, "value", obj))
 
 
-def _nested(transcript: object, outer: str, inner: str) -> Any:
+def _nested(transcript: object, outer: str, inner: str) -> object | None:
     """Return ``transcript.<outer>.<inner>``, or None if either link is missing/falsy."""
     mid = getattr(transcript, outer, None)
     return getattr(mid, inner, None) if mid else None
 
 
+def _objects(value: object) -> list[object]:
+    return jsonshape.object_list(value)
+
+
+def _mapping(value: object) -> dict[str, object]:
+    return jsonshape.as_mapping(value) or {}
+
+
+def _int_value(value: object) -> int:
+    if isinstance(value, bool):
+        return 0
+    if isinstance(value, int):
+        return value
+    if isinstance(value, float):
+        return int(value)
+    if isinstance(value, str):
+        try:
+            return int(value)
+        except ValueError:
+            return 0
+    return 0
+
+
+def _float_value(value: object) -> float:
+    if isinstance(value, bool):
+        return 0.0
+    if isinstance(value, int | float):
+        return float(value)
+    if isinstance(value, str):
+        try:
+            return float(value)
+        except ValueError:
+            return 0.0
+    return 0.0
+
+
 def render_transcript_result(transcript: object, console: Console) -> None:
     """Print the transcript text, then a section per analysis feature present."""
     _render_text(transcript, console)
@@ -38,14 +74,15 @@ def render_transcript_result(transcript: object, console: Console) -> None:
 
 def _render_text(transcript: object, console: Console) -> None:
     """Print per-speaker utterances when present, else the flat transcript text."""
-    utterances = getattr(transcript, "utterances", None)
-    if isinstance(utterances, list) and utterances:
+    utterances = _objects(getattr(transcript, "utterances", None))
+    if utterances:
         line = Text()
         for i, u in enumerate(utterances):
             if i:
                 line.append("\n")
-            line.append(f"Speaker {u.speaker}: ", style=theme.speaker_style(u.speaker))
-            line.append(str(u.text))
+            speaker = getattr(u, "speaker", "")
+            line.append(f"Speaker {speaker}: ", style=theme.speaker_style(speaker))
+            line.append(str(getattr(u, "text", "")))
         console.print(line)
         return
     # Wrap in Text so transcript content with [brackets] is not parsed as Rich markup.
@@ -60,56 +97,62 @@ def _render_summary(transcript: object, console: Console) -> None:
 
 
 def _render_chapters(transcript: object, console: Console) -> None:
-    chapters = getattr(transcript, "chapters", None)
+    chapters = _objects(getattr(transcript, "chapters", None))
     if not chapters:
         return
     console.print("\n[bold]Chapters:[/bold]")
     for ch in chapters:
-        span = f"{_fmt_ms(ch.start)}-{_fmt_ms(ch.end)}"
-        console.print(f"  {span}  {ch.headline}")
+        span = f"{_fmt_ms(_int_value(getattr(ch, 'start', 0)))}-{_fmt_ms(_int_value(getattr(ch, 'end', 0)))}"
+        console.print(f"  {span}  {getattr(ch, 'headline', '')}")
 
 
 def _render_highlights(transcript: object, console: Console) -> None:
-    results = _nested(transcript, "auto_highlights", "results")
+    results = _objects(_nested(transcript, "auto_highlights", "results"))
     if not results:
         return
     console.print("\n[bold]Highlights:[/bold]")
     for h in results:
-        console.print(f"  ({h.count}x) {h.text}")
+        console.print(f"  ({getattr(h, 'count', '')}x) {getattr(h, 'text', '')}")
 
 
 def _render_sentiment(transcript: object, console: Console) -> None:
-    results = getattr(transcript, "sentiment_analysis", None)
+    results = _objects(getattr(transcript, "sentiment_analysis", None))
     if not results:
         return
-    counts = Counter(_enum_value(r.sentiment).lower() for r in results)
+    counts = Counter(_enum_value(getattr(r, "sentiment", "")).lower() for r in results)
     total = sum(counts.values()) or 1
     parts = [f"{pct * 100 // total}% {label}" for label, pct in counts.items()]
     console.print("\n[bold]Sentiment:[/bold] " + ", ".join(parts))
 
 
 def _render_entities(transcript: object, console: Console) -> None:
-    entities = getattr(transcript, "entities", None)
+    entities = _objects(getattr(transcript, "entities", None))
     if not entities:
         return
     console.print("\n[bold]Entities:[/bold]")
     for ent in entities:
-        console.print(f"  {_enum_value(ent.entity_type)}: {ent.text}")
+        console.print(
+            f"  {_enum_value(getattr(ent, 'entity_type', ''))}: {getattr(ent, 'text', '')}"
+        )
 
 
 def _render_topics(transcript: object, console: Console) -> None:
-    summary = _nested(transcript, "iab_categories", "summary")
+    summary = _mapping(_nested(transcript, "iab_categories", "summary"))
     if not summary:
         return
     console.print("\n[bold]Topics:[/bold]")
-    for label, relevance in sorted(summary.items(), key=lambda kv: kv[1], reverse=True):
-        console.print(f"  {label} ({float(relevance):.2f})")
+    items: Mapping[str, object] = summary
+    for label, relevance in sorted(items.items(), key=lambda kv: _float_value(kv[1]), reverse=True):
+        console.print(f"  {label} ({_float_value(relevance):.2f})")
 
 
 def _render_content_safety(transcript: object, console: Console) -> None:
-    summary = _nested(transcript, "content_safety", "summary")
+    summary = _mapping(_nested(transcript, "content_safety", "summary"))
     if not summary:
         return
     console.print("\n[bold]Content Safety:[/bold]")
-    for label, confidence in sorted(summary.items(), key=lambda kv: kv[1], reverse=True):
-        console.print(f"  {_enum_value(label)} ({float(confidence):.2f})")
+    items: Mapping[str, object] = summary
+    for label, confidence in sorted(
+        items.items(), key=lambda kv: _float_value(kv[1]), reverse=True
+    ):
+        console.print(f"  {_enum_value(label)} ({_float_value(confidence):.2f})")
diff --git a/pyproject.toml b/pyproject.toml
index 947508f5..84b401d7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -36,6 +36,7 @@ dependencies = [
     # which releases the lock may adopt, so no manual version cap is needed here.
     # (Plain httpx still arrives transitively via the assemblyai SDK.)
     "httpx2>=2.0.0",
+    "pydantic>=2.13.4",
     "platformdirs>=4.10.0",
     "tomli-w>=1.2.0",
     "websockets>=16.0",
@@ -74,8 +75,13 @@ dev = [
     "python-dotenv>=1.0.0",
     "python-multipart>=0.0.9",
     "syrupy>=4.0",
+    "httpx>=0.28.1",
     "xenon>=0.9.3",
     "diff-cover>=9.0.0",
+    "vulture>=2.14",
+    "deptry>=0.23.0",
+    "import-linter>=2.3",
+    "mutmut>=3.5.0",
 ]
 
 [tool.uv]
@@ -114,6 +120,12 @@ disallow_untyped_defs = true
 warn_unused_ignores = true
 warn_return_any = true
 no_implicit_optional = true
+strict_equality = true
+warn_redundant_casts = true
+warn_unreachable = true
+disallow_any_generics = true
+no_implicit_reexport = true
+extra_checks = true
 
 [[tool.mypy.overrides]]
 # Tests are type-checked too, but pytest functions don't need return annotations.
@@ -121,11 +133,14 @@ module = "tests.*"
 disallow_untyped_defs = false
 
 [tool.pyright]
-# Second type checker alongside mypy: pyright catches a different (and often
-# stricter) class of issues. Same source scope as mypy (files above).
-include = ["aai_cli", "tests"]
+# Second type checker alongside mypy: pyright catches a different class of
+# issues. Production code runs strict here; tests are checked in standard mode by
+# pyrightconfig.tests.json from scripts/check.sh so pytest fixtures/mocks don't
+# create thousands of low-value strict diagnostics.
+include = ["aai_cli"]
+exclude = ["aai_cli/init/templates/**"]
 pythonVersion = "3.11"
-typeCheckingMode = "basic"
+typeCheckingMode = "strict"
 # Third-party deps (assemblyai, sounddevice) ship no type stubs.
 reportMissingTypeStubs = false
 # Resolve imports against the uv-managed environment so the CLI and editors
@@ -142,16 +157,84 @@ target-version = "py311"
 # PGH/ERA/TRY/TD/FIX close the "make the error go away" escape hatches a coding agent
 # reaches for: blanket `# noqa`/`# type: ignore` (PGH), commented-out code (ERA),
 # exception anti-patterns (TRY), and untracked TODO/FIXME markers (TD/FIX).
+# A/N/FBT/PL/T20/PT/PIE/PERF/TCH add maintainability pressure: naming/shadowing,
+# boolean traps, pylint-style design issues, centralized raw output, pytest style,
+# small simplifications, performance footguns, and type-only import hygiene.
 select = ["E", "F", "I", "UP", "B", "BLE", "C4", "SIM", "RET", "PTH", "ARG", "S", "RUF",
-          "PGH", "ERA", "TRY", "TD", "FIX"]
+          "PGH", "ERA", "TRY", "TD", "FIX", "A", "N", "FBT", "PL", "T20", "PT", "PIE",
+          "PERF", "TCH"]
 # E501: line length is owned by the formatter.
 # B008: Typer uses function calls (typer.Option/Argument) as parameter defaults.
 # S603/S607: we intentionally shell out to `claude`/`npx` with controlled args.
 # TRY003: the CLIError hierarchy is built around descriptive messages passed at the
 #   raise site, so long messages there are deliberate, not an anti-pattern.
-ignore = ["E501", "B008", "S603", "S607", "TRY003"]
+# N818: NotAuthenticated is an established domain exception name.
+# PLC0415: optional/heavy runtime deps are imported lazily to keep startup fast.
+# TC001-TC003: the project intentionally keeps readable top-level type imports; TC006
+#   still enforces quoted runtime casts.
+ignore = ["E501", "B008", "S603", "S607", "TRY003", "N818", "PLC0415",
+          "TC001", "TC002", "TC003"]
+
+[tool.ruff.lint.pylint]
+max-args = 10
 
 [tool.ruff.lint.per-file-ignores]
 # Tests assert freely, use throwaway args/temp paths, and don't need pathlib/security lints.
 # TRY300: test helpers commonly `return` inside a try while asserting on the except path.
-"tests/**" = ["S101", "S105", "S106", "S107", "S108", "ARG001", "ARG002", "ARG005", "PTH123", "SIM117", "TRY300"]
+# Tests also keep literal exit codes, local imports, composite assertions, and fake
+# call signatures where those make the intent clearer than production-style indirection.
+"tests/**" = ["S101", "S105", "S106", "S107", "S108", "ARG001", "ARG002", "ARG005",
+              "PTH123", "SIM117", "TRY300", "FBT", "PLR2004", "PLC0415", "PLR0913",
+              "PLW1510", "N806", "N818", "PLW0108", "PT018", "TCH"]
+# Typer command functions naturally have many boolean options and broad signatures.
+"aai_cli/commands/**" = ["FBT001", "FBT003", "PLR0912", "PLR0913", "PLR0915"]
+# The root callback is also a Typer command signature.
+"aai_cli/main.py" = ["FBT001", "FBT003"]
+# Raw stdout/stderr writes are centralized here; command modules call output helpers.
+"aai_cli/output.py" = ["T201"]
+# The active environment is process-global startup state by design.
+"aai_cli/environments.py" = ["PLW0603"]
+# BaseHTTPRequestHandler.log_message requires a parameter named `format`.
+"aai_cli/auth/loopback.py" = ["A002"]
+# Template constants include URL path names such as TOKEN_PATH, not credentials.
+"aai_cli/init/templates/**" = ["S105"]
+
+[tool.vulture]
+paths = ["aai_cli", "tests"]
+min_confidence = 90
+ignore_decorators = ["@app.command", "@app.callback"]
+ignore_names = ["app", "capture_output", "download", "healthy", "ist", "memory_keyring", "org",
+                "refresh"]
+
+[tool.deptry]
+exclude = ["docs", "dist", ".venv", "aai_cli/init/templates"]
+
+[tool.deptry.package_module_name_map]
+audioop-lts = "audioop"
+
+[tool.deptry.per_rule_ignores]
+# The CLI templates carry their own requirements and are dependency-checked by
+# dedicated install tests, not by the root package metadata.
+DEP002 = ["fastapi", "python-dotenv", "python-multipart", "uvicorn"]
+DEP004 = ["fastapi", "httpx", "hypothesis", "pytest"]
+
+[tool.mutmut]
+paths_to_mutate = [
+    "aai_cli/auth/ams.py",
+    "aai_cli/config_builder.py",
+    "aai_cli/context.py",
+    "aai_cli/errors.py",
+    "aai_cli/output.py",
+]
+also_copy = ["aai_cli"]
+pytest_add_cli_args = ["--strict-config", "--strict-markers"]
+pytest_add_cli_args_test_selection = [
+    "tests/test_auth_ams.py",
+    "tests/test_ams_account.py",
+    "tests/test_config_builder.py",
+    "tests/test_context.py",
+    "tests/test_errors.py",
+    "tests/test_login.py",
+    "tests/test_output.py",
+]
+mutate_only_covered_lines = true
diff --git a/pyrightconfig.tests.json b/pyrightconfig.tests.json
new file mode 100644
index 00000000..20df830d
--- /dev/null
+++ b/pyrightconfig.tests.json
@@ -0,0 +1,8 @@
+{
+  "include": ["tests"],
+  "pythonVersion": "3.11",
+  "typeCheckingMode": "standard",
+  "reportMissingTypeStubs": false,
+  "venvPath": ".",
+  "venv": ".venv"
+}
diff --git a/scripts/check.sh b/scripts/check.sh
index 7b8de961..d5abd825 100755
--- a/scripts/check.sh
+++ b/scripts/check.sh
@@ -12,6 +12,22 @@ cd "$(dirname "$0")/.."
 # default (see [tool.uv] default-groups), so `uv run` already has pytest,
 # hypothesis, fastapi, etc. — no `--extra`/`--group` flag needed here.
 
+cleanup_generated_code_dir() {
+  if [[ -n "${generated_code_dir:-}" ]]; then
+    rm -rf "$generated_code_dir"
+  fi
+}
+
+cleanup_mutants_dir() {
+  rm -rf mutants
+}
+
+# Make reruns deterministic after an interrupted mutation run.
+cleanup_mutants_dir
+
+echo "==> uv lock freshness"
+uv lock --check
+
 echo "==> ruff check (src + tests)"
 uv run ruff check .
 
@@ -21,8 +37,20 @@ uv run ruff format --check .
 echo "==> mypy (src + tests)"
 uv run mypy  # files = ["aai_cli", "tests"] in pyproject.toml
 
-echo "==> pyright (src + tests)"
-uv run pyright  # include = ["aai_cli", "tests"] in [tool.pyright]
+echo "==> pyright (src strict)"
+uv run pyright  # include = ["aai_cli"] in [tool.pyright]
+
+echo "==> pyright (tests standard)"
+uv run pyright -p pyrightconfig.tests.json
+
+echo "==> vulture (dead-code gate, src + tests)"
+uv run vulture
+
+echo "==> deptry (dependency hygiene)"
+uv run deptry .
+
+echo "==> import-linter (architecture contracts)"
+uv run lint-imports
 
 echo "==> xenon (cyclomatic complexity gate, src only)"
 # Fail the build if any function gets too branchy. Grades map to cyclomatic
@@ -37,14 +65,25 @@ echo "==> markdownlint (docs/ is generated, so excluded)"
 markdownlint "**/*.md" --ignore docs --ignore node_modules --ignore .pytest_cache
 
 echo "==> shellcheck (install.sh)"
-# Static-lint the public install script. CI's ubuntu runner ships shellcheck;
+# Static-lint the public install script and this gate script. CI's ubuntu runner ships shellcheck;
 # locally it's skipped with a notice if not installed.
 if command -v shellcheck >/dev/null 2>&1; then
-  shellcheck install.sh
+  shellcheck install.sh scripts/check.sh
 else
   echo "   shellcheck not found; skipping (CI runs it)"
 fi
 
+echo "==> generated --show-code compile gate"
+generated_code_dir="$(mktemp -d)"
+trap cleanup_generated_code_dir EXIT
+uv run python scripts/generated_code_compile_gate.py "$generated_code_dir"
+uv run python -m compileall -q "$generated_code_dir"
+cleanup_generated_code_dir
+trap - EXIT
+
+echo "==> init template contract/import gate"
+uv run python scripts/template_contract_gate.py
+
 echo "==> pytest (with branch-coverage gate)"
 # Exclude e2e: they drive the CLI as a subprocess (uncounted by coverage) and need
 # a live API key. Exclude install (real per-template dep install, slow + network)
@@ -53,7 +92,7 @@ echo "==> pytest (with branch-coverage gate)"
 #   uv run pytest -m e2e
 #   uv run pytest -m install
 #   uv run pytest -m install_script
-uv run pytest -q -m "not e2e and not install and not install_script" --cov=aai_cli --cov-branch --cov-report=term-missing --cov-report=xml --cov-fail-under=90
+uv run pytest -q --strict-config --strict-markers -m "not e2e and not install and not install_script" --cov=aai_cli --cov-branch --cov-report=term-missing --cov-report=xml --cov-fail-under=90
 
 echo "==> diff-cover (patch coverage: every changed line must be tested)"
 # The 90% gate above is project-wide, so new code can ride on the existing suite and
@@ -67,6 +106,44 @@ else
   echo "   origin/main not found; skipping patch-coverage gate (CI provides it)"
 fi
 
+echo "==> no new static-analysis escape hatches"
+# Existing escape hatches are tolerated for now; new ones must be refactored away or
+# justified by changing this gate deliberately. Broad noqa/type-ignore/no-cover are
+# checked by added diff lines. `Any` and `cast(` are count-gated against origin/main
+# so mechanical edits to existing uses don't fail, but net-new uses do.
+if git rev-parse --verify --quiet origin/main >/dev/null; then
+  escape_hatches="$(git diff -U0 origin/main -- aai_cli tests \
+    | rg '^\+.*(# type: ignore|# noqa|pragma: no cover)' || true)"
+  if [[ -n "$escape_hatches" ]]; then
+    printf '%s\n' "$escape_hatches"
+    echo "New static-analysis ignore/no-cover escape hatch found; refactor it or update the gate explicitly."
+    exit 1
+  fi
+
+  base_any_count="$({ git grep -n "Any" origin/main -- aai_cli tests || true; } | wc -l | tr -d '[:space:]')"
+  work_any_count="$({ rg -n "Any" aai_cli tests || true; } | wc -l | tr -d '[:space:]')"
+  if (( work_any_count > base_any_count )); then
+    echo "New Any usage found: ${work_any_count} current vs ${base_any_count} on origin/main."
+    exit 1
+  fi
+
+  base_cast_count="$({ git grep -n "cast(" origin/main -- aai_cli tests || true; } | wc -l | tr -d '[:space:]')"
+  work_cast_count="$({ rg -n "cast\\(" aai_cli tests || true; } | wc -l | tr -d '[:space:]')"
+  if (( work_cast_count > base_cast_count )); then
+    echo "New cast() usage found: ${work_cast_count} current vs ${base_cast_count} on origin/main."
+    exit 1
+  fi
+else
+  echo "   origin/main not found; skipping escape-hatch diff gate (CI provides it)"
+fi
+
+echo "==> mutation testing (focused core modules)"
+cleanup_mutants_dir
+trap cleanup_mutants_dir EXIT
+uv run python scripts/mutation_gate.py
+cleanup_mutants_dir
+trap - EXIT
+
 echo "==> build + twine check (PyPI publish readiness)"
 # Build sdist + wheel into ./dist, then validate the metadata and README render
 # the way PyPI requires. --strict fails on any warning (e.g. a missing readme).
diff --git a/scripts/generated_code_compile_gate.py b/scripts/generated_code_compile_gate.py
new file mode 100644
index 00000000..862c7140
--- /dev/null
+++ b/scripts/generated_code_compile_gate.py
@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+from typer.testing import CliRunner
+
+from aai_cli.main import app
+
+_ARG_COUNT = 2
+_USAGE_EXIT = 2
+
+
+def _write_fixture(
+    runner: CliRunner,
+    out_dir: Path,
+    name: str,
+    args: tuple[str, ...],
+) -> None:
+    result = runner.invoke(app, list(args))
+    if result.exit_code != 0:
+        detail = result.output.strip() or str(result.exception)
+        raise RuntimeError(f"{name}: {' '.join(args)} failed: {detail}")
+    code = result.output
+    if not code.strip():
+        raise RuntimeError(f"{name}: {' '.join(args)} produced no code")
+    (out_dir / f"{name}.py").write_text(code, encoding="utf-8")
+
+
+def main() -> int:
+    if len(sys.argv) != _ARG_COUNT:
+        sys.stderr.write("usage: generated_code_compile_gate.py OUT_DIR\n")
+        return _USAGE_EXIT
+    out_dir = Path(sys.argv[1])
+    out_dir.mkdir(parents=True, exist_ok=True)
+
+    transcribe_config = out_dir / "transcribe-config.json"
+    transcribe_config.write_text(
+        json.dumps({"speaker_labels": True, "summarization": True, "word_boost": ["CLI"]}),
+        encoding="utf-8",
+    )
+    stream_config = out_dir / "stream-config.json"
+    stream_config.write_text(
+        json.dumps({"sample_rate": 16000, "format_turns": True, "keyterms_prompt": ["CLI"]}),
+        encoding="utf-8",
+    )
+    prompt_file = out_dir / "agent-prompt.txt"
+    prompt_file.write_text('Be terse, quote "edge cases", and handle newlines.\n', encoding="utf-8")
+
+    cases: tuple[tuple[str, tuple[str, ...]], ...] = (
+        ("transcribe-basic", ("transcribe", "audio.mp3", "--show-code")),
+        (
+            "transcribe-config-llm",
+            (
+                "transcribe",
+                "--sample",
+                "--config-file",
+                str(transcribe_config),
+                "--llm",
+                "summarize action items",
+                "--show-code",
+            ),
+        ),
+        ("stream-basic", ("stream", "--show-code")),
+        (
+            "stream-config-llm",
+            (
+                "stream",
+                "--config-file",
+                str(stream_config),
+                "--llm",
+                "summarize the finalized turns",
+                "--show-code",
+            ),
+        ),
+        (
+            "agent-basic",
+            ("agent", "--voice", "ivy", "--greeting", "Hello there", "--show-code"),
+        ),
+        (
+            "agent-prompt-file",
+            (
+                "agent",
+                "--voice",
+                "james",
+                "--system-prompt-file",
+                str(prompt_file),
+                "--show-code",
+            ),
+        ),
+    )
+
+    runner = CliRunner()
+    for name, args in cases:
+        _write_fixture(runner, out_dir, name, args)
+
+    sys.stdout.write(f"generated {len(cases)} show-code fixtures in {out_dir}\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/mutation_gate.py b/scripts/mutation_gate.py
new file mode 100644
index 00000000..59f68a56
--- /dev/null
+++ b/scripts/mutation_gate.py
@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+import fnmatch
+import os
+import shutil
+import subprocess
+import sys
+
+_MUTANTS_DIR = "mutants"
+_PASSING_STATUSES = {"killed", "caught by type check"}
+_SMOKE_MUTANTS = (
+    "aai_cli.auth.ams.x__json_or_raise__mutmut_*",
+    "aai_cli.config_builder.x__merge__mutmut_*",
+    "aai_cli.context.x__persist_browser_login__mutmut_*",
+    "aai_cli.errors.x_is_auth_failure__mutmut_*",
+    "aai_cli.output.x_mask_secret__mutmut_*",
+)
+
+
+def _run(cmd: list[str], *, capture: bool = False) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        cmd,
+        capture_output=capture,
+        check=False,
+        text=True,
+    )
+
+
+def _selected(name: str) -> bool:
+    return any(fnmatch.fnmatch(name, pattern) for pattern in _SMOKE_MUTANTS)
+
+
+def _bad_results(output: str) -> tuple[list[str], int]:
+    bad: list[str] = []
+    seen = 0
+    for line in output.splitlines():
+        stripped = line.strip()
+        if not stripped or ": " not in stripped:
+            continue
+        name, status = stripped.rsplit(": ", 1)
+        if not _selected(name):
+            continue
+        seen += 1
+        if status not in _PASSING_STATUSES:
+            bad.append(stripped)
+    return bad, seen
+
+
+def main() -> int:
+    shutil.rmtree(_MUTANTS_DIR, ignore_errors=True)
+    max_children = os.environ.get("MUTMUT_MAX_CHILDREN", "1")
+    run = _run(["mutmut", "run", "--max-children", max_children, *_SMOKE_MUTANTS], capture=True)
+    if run.returncode != 0:
+        if run.stdout:
+            sys.stdout.write(run.stdout)
+        if run.stderr:
+            sys.stderr.write(run.stderr)
+        return run.returncode
+
+    results = _run(["mutmut", "results", "--all", "true"], capture=True)
+    if results.returncode != 0:
+        if results.stdout:
+            sys.stdout.write(results.stdout)
+        if results.stderr:
+            sys.stderr.write(results.stderr)
+        return results.returncode
+
+    bad, seen = _bad_results(results.stdout)
+    if seen == 0:
+        sys.stderr.write("Mutation testing did not report any configured smoke mutants.\n")
+        return 1
+    if bad:
+        sys.stderr.write("\nMutation testing found surviving or untested mutants:\n")
+        for line in bad:
+            sys.stderr.write(f"  {line}\n")
+        return 1
+    sys.stdout.write(f"mutation smoke killed {seen} mutants\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/template_contract_gate.py b/scripts/template_contract_gate.py
new file mode 100644
index 00000000..116efd31
--- /dev/null
+++ b/scripts/template_contract_gate.py
@@ -0,0 +1,186 @@
+from __future__ import annotations
+
+import ast
+import importlib
+import json
+import re
+import subprocess
+import sys
+from contextlib import contextmanager
+from pathlib import Path
+
+from aai_cli.init import templates
+
+_ROOT = Path("aai_cli/init/templates")
+_REQUIRED_FILES = (
+    "api/index.py",
+    "api/__init__.py",
+    "api/settings.py",
+    "index.html",
+    "static/app.js",
+    "static/styles.css",
+    "vercel.json",
+    "requirements.txt",
+    "README.md",
+    "AGENTS.md",
+    "gitignore",
+    "env.example",
+)
+_LOCAL_IMPORTS = {"api"}
+_PKG_MAP = {"dotenv": "python-dotenv", "multipart": "python-multipart"}
+_STDLIB = set(sys.stdlib_module_names) | {"__future__"}
+
+
+def _fail(message: str) -> None:
+    raise RuntimeError(message)
+
+
+def _template_dirs() -> dict[str, Path]:
+    dirs = {path.name: path for path in _ROOT.iterdir() if path.is_dir()}
+    registered = set(templates.TEMPLATES)
+    shipped = set(dirs)
+    missing = registered - shipped
+    extra = shipped - registered
+    if missing:
+        _fail(f"registered templates missing directories: {sorted(missing)}")
+    if extra:
+        _fail(f"template directories not registered: {sorted(extra)}")
+    return {name: dirs[name] for name in templates.TEMPLATE_ORDER}
+
+
+def _required_files(template: str, path: Path) -> None:
+    for rel in _REQUIRED_FILES:
+        if not (path / rel).exists():
+            _fail(f"{template}: missing {rel}")
+    if template in {"stream", "agent"} and not (path / "static/audio.js").exists():
+        _fail(f"{template}: missing static/audio.js")
+
+
+def _html_static_refs(template: str, path: Path) -> None:
+    html = (path / "index.html").read_text(encoding="utf-8")
+    refs = set(re.findall(r'(?:href|src)=["\'](/static/[^"\']+)', html))
+    if not refs:
+        _fail(f"{template}: index.html should load static assets")
+    for ref in refs:
+        if not (path / ref.lstrip("/")).exists():
+            _fail(f"{template}: index.html references missing asset {ref!r}")
+
+
+def _frontend_routes(template: str, path: Path) -> None:
+    frontend = (path / "index.html").read_text(encoding="utf-8")
+    frontend += "\n".join(
+        asset.read_text(encoding="utf-8") for asset in (path / "static").glob("*.js")
+    )
+    fetched = set(re.findall(r'fetch\(\s*["\'`](/api/[^"\'`?]+)', frontend))
+    fetched |= set(re.findall(r'["\'`](/api/[A-Za-z0-9_\-/]+?)(?:/?\$\{|/?["\'`]\s*\+)', frontend))
+    backend = "\n".join(
+        source.read_text(encoding="utf-8") for source in (path / "api").glob("*.py")
+    )
+    registered = set(re.findall(r'@app\.\w+\(\s*["\']([^"\']+)["\']', backend))
+    registered_bases = {re.sub(r"/\{[^}]+\}$", "", route).rstrip("/") for route in registered}
+    for route in fetched:
+        base = route.rstrip("/")
+        if not any(
+            base == registered or base.startswith(registered + "/")
+            for registered in registered_bases
+        ):
+            _fail(
+                f"{template}: frontend fetches {route!r}, "
+                f"but backend routes are {sorted(registered_bases)}"
+            )
+
+
+def _requirements_cover_imports(template: str, path: Path) -> None:
+    imports: set[str] = set()
+    for source in (path / "api").glob("*.py"):
+        tree = ast.parse(source.read_text(encoding="utf-8"), filename=str(source))
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Import):
+                imports.add(node.names[0].name.split(".")[0])
+            elif isinstance(node, ast.ImportFrom) and node.level == 0 and node.module:
+                imports.add(node.module.split(".")[0])
+    third_party = imports - _STDLIB - _LOCAL_IMPORTS
+    reqs = (path / "requirements.txt").read_text(encoding="utf-8").lower()
+    for package in third_party:
+        dist = _PKG_MAP.get(package, package)
+        if dist not in reqs:
+            _fail(f"{template}: import {package!r} ({dist}) missing from requirements.txt")
+
+
+@contextmanager
+def _template_import_path(path: Path):
+    old_path = list(sys.path)
+    old_modules = {
+        name: module
+        for name, module in sys.modules.items()
+        if name == "api" or name.startswith("api.")
+    }
+    for name in old_modules:
+        sys.modules.pop(name, None)
+    sys.path.insert(0, str(path.resolve()))
+    try:
+        yield
+    finally:
+        for name in [name for name in sys.modules if name == "api" or name.startswith("api.")]:
+            sys.modules.pop(name, None)
+        sys.modules.update(old_modules)
+        sys.path[:] = old_path
+
+
+def _import_api(template: str, path: Path) -> None:
+    with _template_import_path(path):
+        module = importlib.import_module("api.index")
+    app = getattr(module, "app", None)
+    if app is None:
+        _fail(f"{template}: api/index.py does not export app")
+    routes = {getattr(route, "path", "") for route in getattr(app, "routes", [])}
+    if "/" not in routes:
+        _fail(f"{template}: FastAPI app does not register /")
+
+
+def _parse_json_files(template: str, path: Path) -> None:
+    for source in (path / "api").glob("*.py"):
+        ast.parse(source.read_text(encoding="utf-8"), filename=str(source))
+    try:
+        json.loads((path / "vercel.json").read_text(encoding="utf-8"))
+    except json.JSONDecodeError as exc:
+        _fail(f"{template}: vercel.json is invalid JSON: {exc}")
+
+
+def _untracked_template_files() -> None:
+    in_worktree = subprocess.run(
+        ["git", "rev-parse", "--is-inside-work-tree"],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    if in_worktree.returncode != 0:
+        return
+    result = subprocess.run(
+        ["git", "ls-files", "--others", "--exclude-standard", "--", str(_ROOT)],
+        capture_output=True,
+        check=False,
+        text=True,
+    )
+    if result.returncode != 0:
+        _fail(result.stderr.strip() or "could not inspect template git tracking")
+    files = [line for line in result.stdout.splitlines() if line]
+    if files:
+        _fail(f"template files are untracked and would be missing from a clean checkout: {files}")
+
+
+def main() -> int:
+    _untracked_template_files()
+    for template, path in _template_dirs().items():
+        _required_files(template, path)
+        _html_static_refs(template, path)
+        _frontend_routes(template, path)
+        _requirements_cover_imports(template, path)
+        _parse_json_files(template, path)
+        _import_api(template, path)
+    sys.stdout.write(f"validated {len(templates.TEMPLATE_ORDER)} init templates\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/__snapshots__/test_cli_output_snapshots.ambr b/tests/__snapshots__/test_cli_output_snapshots.ambr
index 4adbc48e..79b30d28 100644
--- a/tests/__snapshots__/test_cli_output_snapshots.ambr
+++ b/tests/__snapshots__/test_cli_output_snapshots.ambr
@@ -63,16 +63,19 @@
    List recent audit-log entries for your account.
   
   ╭─ Options ────────────────────────────────────────────────────────────────────╮
-  │ --limit           INTEGER  How many entries to show. [default: 20]           │
-  │ --action          TEXT     Filter by action_taken.                           │
-  │ --resource        TEXT     Filter by resource_type.                          │
-  │ --json                     Output raw JSON.                                  │
-  │ --help                     Show this message and exit.                       │
+  │ --limit                 INTEGER  How many entries to show. [default: 20]     │
+  │ --action                TEXT     Filter by raw action name.                  │
+  │ --resource              TEXT     Filter by raw resource type.                │
+  │ --include-logins                 Show successful login events.               │
+  │ --json                           Output raw JSON.                            │
+  │ --help                           Show this message and exit.                 │
   ╰──────────────────────────────────────────────────────────────────────────────╯
   
    Examples
    Recent audit-log entries
    $ aai audit --limit 20
+   Include login events
+   $ aai audit --include-logins
    Filter by action
    $ aai audit --action token.create
   
@@ -802,6 +805,7 @@
   │ --start         TEXT  Start date (YYYY-MM-DD). Default: 30d ago.             │
   │ --end           TEXT  End date (YYYY-MM-DD). Default: today.                 │
   │ --window        TEXT  Window size, e.g. 'day' or 'month'.                    │
+  │ --all                 Include zero-usage windows.                            │
   │ --json                Output raw JSON.                                       │
   │ --help                Show this message and exit.                            │
   ╰──────────────────────────────────────────────────────────────────────────────╯
diff --git a/tests/test_account_command.py b/tests/test_account_command.py
index 72f3612a..7894983d 100644
--- a/tests/test_account_command.py
+++ b/tests/test_account_command.py
@@ -4,6 +4,8 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
+from aai_cli.commands import account
 from aai_cli.main import app
 
 runner = CliRunner()
@@ -13,6 +15,12 @@ def _auth():
     config.set_session("default", session_jwt="jwt", session_token="tok", account_id=42)
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=42
+    )
+
+
 def _human(monkeypatch):
     monkeypatch.setattr("aai_cli.output.resolve_json", lambda *, explicit: explicit)
 
@@ -29,9 +37,17 @@ def test_balance_formats_dollars(monkeypatch):
     assert "$25.75" in result.output
 
 
-def test_balance_requires_session():
-    result = runner.invoke(app, ["balance"])
+def test_balance_without_session_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+    with patch(
+        "aai_cli.commands.account.ams.get_balance",
+        return_value={"account_id": 42, "balance_in_cents": 2575},
+    ) as get_balance:
+        result = runner.invoke(app, ["balance", "--json"])
     assert result.exit_code == 2
+    assert config.get_session("default") == {"jwt": "jwt", "token": "tok"}
+    get_balance.assert_not_called()
+    assert "Run the same command again" in result.output
 
 
 def test_usage_defaults_date_range_and_renders(monkeypatch):
@@ -81,6 +97,135 @@ def test_usage_renders_table_human(monkeypatch):
     assert "2026-05-01" in result.output and "12.5" in result.output
 
 
+def test_usage_helpers_handle_unparseable_values():
+    assert account._parse_usage_timestamp(None) is None
+    assert account._parse_usage_timestamp("") is None
+    assert account._parse_usage_timestamp("not-a-date") is None
+    assert account._format_usage_day(None) == ""
+    assert account._usage_number(True) == 0.0
+    assert account._usage_number("12.5") == 12.5
+    assert account._usage_number("bad") == 0.0
+    assert account._usage_number(object()) == 0.0
+
+
+def test_usage_helpers_format_windows_and_line_items():
+    assert account._usage_items({"usage_items": "bad"}) == []
+    assert account._usage_items({"usage_items": [{"total": 1}, "bad"]}) == [{"total": 1}]
+    assert account._window_label({"start_timestamp": "bad"}) == "bad"
+    assert (
+        account._window_label(
+            {
+                "start_timestamp": "2026-01-01T00:00:00Z",
+                "end_timestamp": "2026-01-03T00:00:00Z",
+            }
+        )
+        == "2026-01-01 to 2026-01-03"
+    )
+    assert account._line_item_label({"name": "minutes", "total": "12.500"}) == "minutes: 12.5"
+    assert account._line_item_label({"product": "streaming"}) == "streaming"
+    assert account._line_item_label({"quantity": 3}) == "3"
+    assert account._line_item_label({}) == ""
+    assert account._line_items_summary({"line_items": "bad"}) == ""
+
+
+def test_usage_human_renders_breakdown(monkeypatch):
+    _auth()
+    _human(monkeypatch)
+    payload = {
+        "usage_items": [
+            {
+                "start_timestamp": "2026-01-01T00:00:00Z",
+                "end_timestamp": "2026-01-02T00:00:00Z",
+                "total": 10,
+                "line_items": [{"name": "minutes", "total": 10}],
+            }
+        ]
+    }
+    with patch("aai_cli.commands.account.ams.get_usage", return_value=payload):
+        result = runner.invoke(app, ["usage"])
+    assert result.exit_code == 0
+    assert "breakdown" in result.output
+    assert "minutes: 10" in result.output
+
+
+def test_usage_human_summarizes_empty_range(monkeypatch):
+    _auth()
+    _human(monkeypatch)
+    with patch("aai_cli.commands.account.ams.get_usage", return_value={"usage_items": []}):
+        result = runner.invoke(app, ["usage"])
+    assert result.exit_code == 0
+    assert "No usage windows returned" in result.output
+
+
+def test_usage_human_hides_zero_windows_by_default(monkeypatch):
+    _auth()
+    _human(monkeypatch)
+    payload = {
+        "usage_items": [
+            {
+                "start_timestamp": "2026-01-01T00:00:00Z",
+                "end_timestamp": "2026-01-02T00:00:00Z",
+                "total": 0.0,
+                "line_items": [],
+            },
+            {
+                "start_timestamp": "2026-01-02T00:00:00Z",
+                "end_timestamp": "2026-01-03T00:00:00Z",
+                "total": 12.5,
+                "line_items": [],
+            },
+        ]
+    }
+    with patch("aai_cli.commands.account.ams.get_usage", return_value=payload):
+        result = runner.invoke(app, ["usage"])
+    assert result.exit_code == 0
+    assert "Usage total: 12.5" in result.output
+    assert "2026-01-01" not in result.output
+    assert "2026-01-02" in result.output
+    assert "Hidden: 1 zero-usage window" in result.output
+
+
+def test_usage_human_can_include_zero_windows(monkeypatch):
+    _auth()
+    _human(monkeypatch)
+    payload = {
+        "usage_items": [
+            {
+                "start_timestamp": "2026-01-01T00:00:00Z",
+                "end_timestamp": "2026-01-02T00:00:00Z",
+                "total": 0.0,
+                "line_items": [],
+            }
+        ]
+    }
+    with patch("aai_cli.commands.account.ams.get_usage", return_value=payload):
+        result = runner.invoke(app, ["usage", "--all"])
+    assert result.exit_code == 0
+    assert "2026-01-01" in result.output
+    assert "No usage in this range" not in result.output
+
+
+def test_usage_human_summarizes_all_zero_range(monkeypatch):
+    _auth()
+    _human(monkeypatch)
+    payload = {
+        "usage_items": [
+            {
+                "start_timestamp": "2026-01-01T00:00:00Z",
+                "end_timestamp": "2026-01-02T00:00:00Z",
+                "total": 0.0,
+                "line_items": [],
+            }
+        ]
+    }
+    with patch("aai_cli.commands.account.ams.get_usage", return_value=payload):
+        result = runner.invoke(app, ["usage"])
+    assert result.exit_code == 0
+    assert "Usage total: 0" in result.output
+    assert "No usage in this range" in result.output
+    assert "2026-01-01" not in result.output
+
+
 def test_usage_passes_explicit_dates():
     _auth()
     with patch(
@@ -108,7 +253,7 @@ def test_limits_renders_services(monkeypatch):
     _human(monkeypatch)
     with patch(
         "aai_cli.commands.account.ams.get_rate_limits",
-        return_value={"rate_limits": [{"service": "transcript", "magnitude": 200}]},
+        return_value={"rate_limits": ["bad", {"service": "transcript", "magnitude": 200}]},
     ):
         result = runner.invoke(app, ["limits"])
     assert result.exit_code == 0
diff --git a/tests/test_agent_command.py b/tests/test_agent_command.py
index 2e7dbcc3..d59e9518 100644
--- a/tests/test_agent_command.py
+++ b/tests/test_agent_command.py
@@ -3,11 +3,18 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
 from aai_cli.main import app
 
 runner = CliRunner()
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=7
+    )
+
+
 def test_agent_help_lists_command():
     result = runner.invoke(app, ["agent", "--help"])
     assert result.exit_code == 0
@@ -27,9 +34,18 @@ def fake_run_session(*a, **k):
     assert called["ran"] is False
 
 
-def test_agent_unauthenticated_exits_2():
-    result = runner.invoke(app, ["agent"])
+def test_agent_unauthenticated_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+    monkeypatch.setattr("aai_cli.commands.agent.FileSource", lambda src: f"filesrc:{src}")
+
+    def fake_run_session(api_key, **_kwargs):
+        raise AssertionError(f"agent session should not run after auto-login: {api_key}")
+
+    monkeypatch.setattr("aai_cli.commands.agent.run_session", fake_run_session)
+    result = runner.invoke(app, ["agent", "--sample", "--json"])
     assert result.exit_code == 2
+    assert config.get_api_key("default") == "sk_from_oauth"
+    assert "Run the same command again" in result.output
 
 
 def test_agent_drives_renderer_json(monkeypatch):
diff --git a/tests/test_audit_command.py b/tests/test_audit_command.py
index 85a94d88..cdd7c7dc 100644
--- a/tests/test_audit_command.py
+++ b/tests/test_audit_command.py
@@ -4,6 +4,8 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
+from aai_cli.commands import audit
 from aai_cli.main import app
 
 runner = CliRunner()
@@ -13,6 +15,12 @@ def _auth():
     config.set_session("default", session_jwt="jwt", session_token="tok", account_id=42)
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=42
+    )
+
+
 def _human(monkeypatch):
     monkeypatch.setattr("aai_cli.output.resolve_json", lambda *, explicit: explicit)
 
@@ -40,6 +48,13 @@ def test_audit_renders_rows():
     assert data[0]["action_taken"] == "token.create"
 
 
+def test_audit_rows_filter_invalid_items():
+    assert audit._audit_rows({"data": "bad"}) == []
+    assert audit._audit_rows({"data": [{"action_taken": "token.create"}, "bad"]}) == [
+        {"action_taken": "token.create"}
+    ]
+
+
 def test_audit_passes_filters():
     _auth()
     with patch(
@@ -59,10 +74,10 @@ def test_audit_human_mode_renders_table(monkeypatch):
         "data": [
             {
                 "id": 1,
-                "log_time": "2026-06-01T12:00:00Z",
+                "log_time": "2026-06-01T12:00:00.123456Z",
                 "actor_type": "member",
                 "actor_id": 7,
-                "action_taken": "token.create",
+                "action_taken": "token__created",
                 "resource_type": "token",
                 "resource_id": "10",
             },
@@ -70,7 +85,8 @@ def test_audit_human_mode_renders_table(monkeypatch):
                 "id": 2,
                 "log_time": "2026-06-01T12:01:00Z",
                 "actor_type": "member",
-                "action_taken": "login",
+                "actor_id": 7,
+                "action_taken": "login__succeeded",
                 "resource_type": None,
             },
         ]
@@ -78,9 +94,91 @@ def test_audit_human_mode_renders_table(monkeypatch):
     with patch("aai_cli.commands.audit.ams.list_audit_logs", return_value=payload):
         result = runner.invoke(app, ["audit"])
     assert result.exit_code == 0
-    assert "login" in result.output and "token.create" in result.output
+    assert "API key created" in result.output
+    assert "2026-06-01 12:00:00" in result.output
+    assert "token #10" in result.output
+    assert "member #7" in result.output
+    assert "Login succeeded" not in result.output
+    assert "Hidden: 1 login event" in result.output
+
+
+def test_audit_helpers_format_edge_cases():
+    assert audit._format_action("account__created") == "Account created"
+    assert audit._format_action("account__tos.accepted") == "Terms accepted"
+    assert audit._format_action("custom_event.name") == "Custom event name"
+    assert audit._format_action(None) == "Unknown"
+    assert audit._is_login({"action_taken": "login.succeeded"}) is True
+    assert audit._parse_time(None) is None
+    assert audit._parse_time("bad") is None
+    assert audit._format_time("2026-06-01T12:00:00") == "2026-06-01 12:00:00"
+    assert audit._format_time("bad") == "bad"
+    assert audit._actor_label({"actor_type": "system"}) == "system"
+    assert audit._actor_label({"actor_type": "system", "actor_id": 1}) == "system #1"
+    assert audit._resource_label({}) == ""
+    assert audit._resource_label({"resource_type": "api_token"}) == "api token"
+    assert audit._audit_rows({"data": "bad"}) == []
+
+
+def test_audit_human_empty_result(monkeypatch):
+    _auth()
+    _human(monkeypatch)
+    with patch("aai_cli.commands.audit.ams.list_audit_logs", return_value={"data": []}):
+        result = runner.invoke(app, ["audit"])
+    assert result.exit_code == 0
+    assert "No audit events found" in result.output
+
+
+def test_audit_can_include_login_events(monkeypatch):
+    _auth()
+    _human(monkeypatch)
+    payload = {
+        "data": [
+            {
+                "id": 1,
+                "log_time": "2026-06-01T12:01:00Z",
+                "actor_type": "member",
+                "actor_id": 7,
+                "action_taken": "login__succeeded",
+                "resource_type": "account",
+                "resource_id": "42",
+            }
+        ]
+    }
+    with patch("aai_cli.commands.audit.ams.list_audit_logs", return_value=payload):
+        result = runner.invoke(app, ["audit", "--include-logins"])
+    assert result.exit_code == 0
+    assert "Login succeeded" in result.output
+    assert "Hidden:" not in result.output
+
+
+def test_audit_summarizes_all_login_rows(monkeypatch):
+    _auth()
+    _human(monkeypatch)
+    payload = {
+        "data": [
+            {
+                "id": 1,
+                "log_time": "2026-06-01T12:01:00Z",
+                "actor_type": "member",
+                "actor_id": 7,
+                "action_taken": "login__succeeded",
+                "resource_type": "account",
+                "resource_id": "42",
+            }
+        ]
+    }
+    with patch("aai_cli.commands.audit.ams.list_audit_logs", return_value=payload):
+        result = runner.invoke(app, ["audit"])
+    assert result.exit_code == 0
+    assert "No notable audit events" in result.output
+    assert "Hidden: 1 login event" in result.output
 
 
-def test_audit_requires_session():
-    result = runner.invoke(app, ["audit"])
+def test_audit_without_session_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+    with patch("aai_cli.commands.audit.ams.list_audit_logs", return_value={"data": []}) as logs:
+        result = runner.invoke(app, ["audit", "--json"])
     assert result.exit_code == 2
+    assert config.get_session("default") == {"jwt": "jwt", "token": "tok"}
+    logs.assert_not_called()
+    assert "Run the same command again" in result.output
diff --git a/tests/test_auth_ams.py b/tests/test_auth_ams.py
index fedcfa42..a3e9baf4 100644
--- a/tests/test_auth_ams.py
+++ b/tests/test_auth_ams.py
@@ -78,6 +78,16 @@ def handler(request: httpx.Request) -> httpx.Response:
     assert "HTTP 500" in str(exc.value)
 
 
+def test_error_json_without_detail_falls_back_to_body_text(monkeypatch):
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(500, json={"message": "not the detail field"})
+
+    _patch_transport(monkeypatch, handler)
+    with pytest.raises(APIError) as exc:
+        ams.discover("x")
+    assert "not the detail field" in str(exc.value)
+
+
 def test_exchange_posts_ist_and_org(monkeypatch):
     seen = {}
 
@@ -105,11 +115,29 @@ def handler(request: httpx.Request) -> httpx.Response:
     _patch_transport(monkeypatch, handler)
     out = ams.list_projects(7, "sess_jwt")
     assert isinstance(out, list)
-    assert out[0]["project"]["id"] == 1
+    assert out[0]["project"] == {"id": 1}
     assert "/v1/users/accounts/7/projects" in seen["url"]
     assert "stytch_session_jwt=sess_jwt" in seen["cookie"]
 
 
+def test_discover_rejects_non_object_json(monkeypatch):
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json=["bad"])
+
+    _patch_transport(monkeypatch, handler)
+    with pytest.raises(APIError):
+        ams.discover("token")
+
+
+def test_list_projects_rejects_non_object_items(monkeypatch):
+    def handler(_request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json=[{"project": {"id": 1}}, "bad"])
+
+    _patch_transport(monkeypatch, handler)
+    with pytest.raises(APIError):
+        ams.list_projects(7, "sess_jwt")
+
+
 def test_create_token_posts_project_and_name(monkeypatch):
     seen = {}
 
diff --git a/tests/test_auth_flow.py b/tests/test_auth_flow.py
index 63286e92..fcdd237d 100644
--- a/tests/test_auth_flow.py
+++ b/tests/test_auth_flow.py
@@ -19,6 +19,23 @@ def test_find_or_create_reuses_existing_cli_key(monkeypatch):
     assert flow.find_or_create_cli_key(1, "jwt") == "sk_cli"
 
 
+def test_json_shape_helpers_filter_invalid_values():
+    assert flow._as_mapping("bad") is None
+    assert flow._mapping_list("bad") == []
+    assert flow._mapping_list([{"ok": 1}, "bad"]) == [{"ok": 1}]
+
+
+@pytest.mark.parametrize("value", [True, "bad", object()])
+def test_require_int_rejects_invalid_values(value):
+    with pytest.raises(APIError):
+        flow._require_int({"id": value}, "id", "an id")
+
+
+def test_require_mapping_rejects_non_object_value():
+    with pytest.raises(APIError):
+        flow._require_mapping({"project": "bad"}, "project", "a project")
+
+
 def test_find_or_create_creates_when_absent(monkeypatch):
     projects = [{"project": {"id": 7}, "tokens": []}]
     monkeypatch.setattr(flow.ams, "list_projects", lambda acct, jwt: projects)
@@ -170,8 +187,18 @@ def test_run_login_flow_multi_org_notes_selection(monkeypatch, capsys):
     monkeypatch.setattr(flow, "find_or_create_cli_key", lambda acct, jwt: "sk_final")
 
     assert flow.run_login_flow().api_key == "sk_final"
-    out = capsys.readouterr().out
-    assert "Acme" in out  # the chosen org is named rather than silently picked
+    err = capsys.readouterr().err
+    assert "Acme" in err  # the chosen org is named rather than silently picked
+
+
+def test_open_browser_prints_fallback_to_stderr(monkeypatch, capsys):
+    monkeypatch.setattr(flow.webbrowser, "open", lambda _url: (_ for _ in ()).throw(OSError()))
+
+    flow._open_browser("https://login.example")
+
+    err = capsys.readouterr().err
+    assert "https://login.example" in err
+    assert "Could not open a browser" in err
 
 
 def test_run_login_flow_missing_session_token_raises_api_error(monkeypatch):
diff --git a/tests/test_client.py b/tests/test_client.py
index bce99670..6b9b07ce 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -148,6 +148,13 @@ def test_select_transcript_field_utterances_falls_back_to_text_when_absent():
     assert client.select_transcript_field(t, "utterances") == "plain transcript"
 
 
+def test_select_transcript_field_utterances_ignores_non_list_value():
+    t = MagicMock()
+    t.utterances = "bad"
+    t.text = "plain transcript"
+    assert client.select_transcript_field(t, "utterances") == "plain transcript"
+
+
 def test_select_transcript_field_srt_uses_sdk():
     t = MagicMock()
     t.export_subtitles_srt.return_value = "1\n00:00:00,000 --> 00:00:02,000\nhello world\n"
@@ -246,10 +253,16 @@ def disconnect(self, terminate=False):
 def test_stream_audio_wires_handlers_and_streams(monkeypatch):
     monkeypatch.setattr(client, "StreamingClient", _FakeStreamingClient)
     turns = []
+    begins = []
     client.stream_audio(
-        "sk", [b"\x00"], params=_stream_params(), on_turn=lambda e: turns.append(e.transcript)
+        "sk",
+        [b"\x00"],
+        params=_stream_params(),
+        on_begin=lambda e: begins.append(e),
+        on_turn=lambda e: turns.append(e.transcript),
     )
     assert turns == ["hi"]
+    assert begins == []
     last = _FakeStreamingClient.last
     assert last is not None
     assert last.connected
diff --git a/tests/test_code_gen.py b/tests/test_code_gen.py
index 1667af6c..39968f49 100644
--- a/tests/test_code_gen.py
+++ b/tests/test_code_gen.py
@@ -260,16 +260,18 @@ class _Stub:
     """A transcript-shaped stub exposing every attribute the snippets read."""
 
     text: ClassVar[str] = "hello world"
-    utterances: ClassVar[list] = [type("U", (), {"speaker": "A", "text": "hi"})()]
+    utterances: ClassVar[list[object]] = [type("U", (), {"speaker": "A", "text": "hi"})()]
     summary: ClassVar[str] = "a summary"
-    chapters: ClassVar[list] = [type("C", (), {"headline": "intro"})()]
+    chapters: ClassVar[list[object]] = [type("C", (), {"headline": "intro"})()]
     auto_highlights: ClassVar[object] = type(
         "H", (), {"results": [type("R", (), {"count": 2, "text": "k"})()]}
     )()
-    sentiment_analysis: ClassVar[list] = [
+    sentiment_analysis: ClassVar[list[object]] = [
         type("S", (), {"sentiment": "POSITIVE", "text": "good"})()
     ]
-    entities: ClassVar[list] = [type("E", (), {"entity_type": "person_name", "text": "Ada"})()]
+    entities: ClassVar[list[object]] = [
+        type("E", (), {"entity_type": "person_name", "text": "Ada"})()
+    ]
     iab_categories: ClassVar[object] = type("I", (), {"summary": {"Tech": 0.9}})()
     content_safety: ClassVar[object] = type("CS", (), {"summary": {"profanity": 0.1}})()
 
diff --git a/tests/test_config.py b/tests/test_config.py
index d232d832..499c58bd 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -1,3 +1,5 @@
+import json
+
 import pytest
 
 from aai_cli import config
@@ -26,6 +28,15 @@ def test_resolve_falls_back_to_keyring():
     assert config.resolve_api_key() == "from_keyring"
 
 
+def test_get_session_rejects_non_string_jwt():
+    config.keyring.set_password(
+        config.KEYRING_SERVICE,
+        config._session_username("default"),
+        json.dumps({"jwt": 123, "token": "tok"}),
+    )
+    assert config.get_session("default") is None
+
+
 def test_resolve_raises_when_missing():
     with pytest.raises(NotAuthenticated):
         config.resolve_api_key()
diff --git a/tests/test_config_builder.py b/tests/test_config_builder.py
index abc0e309..98dc45c6 100644
--- a/tests/test_config_builder.py
+++ b/tests/test_config_builder.py
@@ -12,7 +12,7 @@ def _param_names(model_cls) -> set[str]:
     return set(getattr(model_cls, "model_fields", None) or model_cls.__fields__)
 
 
-def _dump(model) -> dict:
+def _dump(model) -> dict[str, object]:
     dumped = (
         model.model_dump(exclude_none=True)
         if hasattr(model, "model_dump")
@@ -138,7 +138,7 @@ def test_streaming_params_minimal():
 
 
 @pytest.mark.parametrize(
-    "field,raw,expected,extra",
+    ("field", "raw", "expected", "extra"),
     [
         ("punctuate", "false", False, []),
         ("multichannel", "true", True, []),
diff --git a/tests/test_context.py b/tests/test_context.py
index a120a493..225238e7 100644
--- a/tests/test_context.py
+++ b/tests/test_context.py
@@ -2,13 +2,14 @@
 from typer.testing import CliRunner
 
 from aai_cli import config, environments
+from aai_cli.auth.flow import LoginResult
 from aai_cli.context import AppState, env_override_warning, run_command
-from aai_cli.errors import NotAuthenticated
+from aai_cli.errors import APIError, NotAuthenticated, auth_failure
 
 runner = CliRunner()
 
 
-def _make_app(body):
+def _make_app(body, **run_options):
     app = typer.Typer()
 
     @app.callback()
@@ -17,7 +18,7 @@ def cb(ctx: typer.Context):
 
     @app.command()
     def go(ctx: typer.Context):
-        run_command(ctx, body)
+        run_command(ctx, body, **run_options)
 
     return app
 
@@ -26,8 +27,108 @@ def test_run_command_maps_cli_error_to_exit_code():
     def body(state, json_mode):
         raise NotAuthenticated()
 
+    result = runner.invoke(_make_app(body, auto_login=False), ["go"])
+    assert result.exit_code == 2
+
+
+def test_run_command_auto_logs_in_and_asks_for_rerun(monkeypatch):
+    monkeypatch.setattr(
+        "aai_cli.context.run_login_flow",
+        lambda: LoginResult(
+            api_key="sk_auto",
+            session_jwt="jwt_auto",
+            session_token="tok_auto",
+            account_id=42,
+        ),
+    )
+    calls = {"count": 0}
+
+    def body(state, json_mode):
+        calls["count"] += 1
+        raise NotAuthenticated()
+
     result = runner.invoke(_make_app(body), ["go"])
     assert result.exit_code == 2
+    assert calls["count"] == 1
+    assert config.get_session("default") == {"jwt": "jwt_auto", "token": "tok_auto"}
+    assert config.get_account_id("default") == 42
+    assert config.resolve_api_key() == "sk_auto"
+    assert "Run the same command again" in result.output
+
+
+def test_run_command_auto_login_persistence_failure_is_clean(monkeypatch):
+    monkeypatch.setattr(
+        "aai_cli.context.run_login_flow",
+        lambda: LoginResult(
+            api_key="sk_auto",
+            session_jwt="jwt_auto",
+            session_token="tok_auto",
+            account_id=42,
+        ),
+    )
+    monkeypatch.setattr(
+        "aai_cli.context.config.set_api_key",
+        lambda *_args: (_ for _ in ()).throw(OSError("keyring is unavailable")),
+    )
+
+    def body(state, json_mode):
+        raise NotAuthenticated()
+
+    result = runner.invoke(_make_app(body), ["go"])
+    assert result.exit_code == 1
+    assert "could not save the credentials" in result.output
+    assert "Traceback" not in result.output
+
+
+def test_run_command_auto_login_failure_is_clean(monkeypatch):
+    def fail_login():
+        raise APIError("Login timed out waiting for the browser.")
+
+    monkeypatch.setattr("aai_cli.context.run_login_flow", fail_login)
+
+    def body(state, json_mode):
+        raise NotAuthenticated()
+
+    result = runner.invoke(_make_app(body), ["go"])
+    assert result.exit_code == 1
+    assert "Login timed out" in result.output
+
+
+def test_run_command_skips_auto_login_for_rejected_env_key(monkeypatch):
+    monkeypatch.setenv(config.ENV_API_KEY, "sk_bad")
+    monkeypatch.setattr(
+        "aai_cli.context.run_login_flow",
+        lambda: (_ for _ in ()).throw(AssertionError("env key retry cannot be fixed")),
+    )
+
+    def body(state, json_mode):
+        raise auth_failure()
+
+    result = runner.invoke(_make_app(body), ["go"])
+    assert result.exit_code == 2
+
+
+def test_run_command_never_auto_logs_in_login_command(monkeypatch):
+    monkeypatch.setattr(
+        "aai_cli.context.run_login_flow",
+        lambda: (_ for _ in ()).throw(AssertionError("login command must not auto-login")),
+    )
+
+    app = typer.Typer()
+
+    @app.callback()
+    def cb(ctx: typer.Context):
+        ctx.obj = AppState()
+
+    @app.command(name="login")
+    def login_cmd(ctx: typer.Context):
+        def body(state, json_mode):
+            raise NotAuthenticated()
+
+        run_command(ctx, body)
+
+    result = runner.invoke(app, ["login"])
+    assert result.exit_code == 2
 
 
 def test_run_command_runs_body_on_success():
diff --git a/tests/test_doctor.py b/tests/test_doctor.py
index cabc7753..95205905 100644
--- a/tests/test_doctor.py
+++ b/tests/test_doctor.py
@@ -1,4 +1,6 @@
 import json
+import sys
+import types
 from collections import namedtuple
 
 import pytest
@@ -146,8 +148,22 @@ def boom():
     assert "PortAudio" in check["detail"]
 
 
+def test_probe_input_devices_counts_integer_input_channels(monkeypatch):
+    class FakeSoundDevice(types.ModuleType):
+        def query_devices(self):
+            return [
+                {"max_input_channels": 1},
+                {"max_input_channels": "bad"},
+                {"max_input_channels": 0},
+            ]
+
+    fake_sd = FakeSoundDevice("sounddevice")
+    monkeypatch.setitem(sys.modules, "sounddevice", fake_sd)
+    assert doctor._probe_input_devices() == 1
+
+
 def test_render_ok_payload_shows_ready():
-    payload = {
+    payload: doctor.DoctorResult = {
         "ok": True,
         "checks": [
             {"name": "python", "status": "ok", "affects": [], "detail": "3.12", "fix": None}
@@ -159,7 +175,7 @@ def test_render_ok_payload_shows_ready():
 
 
 def test_render_problem_payload_shows_fix_and_problem_banner():
-    payload = {
+    payload: doctor.DoctorResult = {
         "ok": False,
         "checks": [
             {
diff --git a/tests/test_init_runner.py b/tests/test_init_runner.py
index 4e62d919..f6cf2e58 100644
--- a/tests/test_init_runner.py
+++ b/tests/test_init_runner.py
@@ -110,7 +110,7 @@ def test_wait_for_port_returns_false_on_timeout(monkeypatch):
 def test_run_setup_returns_last_success(monkeypatch):
     ran = []
 
-    def fake_run(cmd, cwd, capture_output, text):
+    def fake_run(cmd, cwd, capture_output, check, text):
         ran.append(cmd)
         return subprocess.CompletedProcess(args=cmd, returncode=0, stdout="ok", stderr="")
 
@@ -123,7 +123,7 @@ def fake_run(cmd, cwd, capture_output, text):
 def test_run_setup_stops_at_first_failure(monkeypatch):
     ran = []
 
-    def fake_run(cmd, cwd, capture_output, text):
+    def fake_run(cmd, cwd, capture_output, check, text):
         ran.append(cmd)
         return subprocess.CompletedProcess(args=cmd, returncode=1, stdout="", stderr="boom")
 
diff --git a/tests/test_init_template_agent.py b/tests/test_init_template_agent.py
index dba6d71b..e443119a 100644
--- a/tests/test_init_template_agent.py
+++ b/tests/test_init_template_agent.py
@@ -1,4 +1,5 @@
-import importlib.util
+import importlib
+import sys
 from pathlib import Path
 from unittest.mock import MagicMock
 
@@ -7,12 +8,11 @@
 TEMPLATE_DIR = Path("aai_cli/init/templates/agent")
 
 
-def _load_app():
-    spec = importlib.util.spec_from_file_location("_tmpl_agent", TEMPLATE_DIR / "api" / "index.py")
-    assert spec and spec.loader  # spec_from_file_location is typed Optional
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
+def _load_app(monkeypatch):
+    for name in ("api.index", "api.settings", "api"):
+        sys.modules.pop(name, None)
+    monkeypatch.syspath_prepend(str(TEMPLATE_DIR))
+    return importlib.import_module("api.index")
 
 
 def _ok_response(token="tok-123"):
@@ -23,7 +23,7 @@ def _ok_response(token="tok-123"):
 
 
 def test_token_returns_token_and_agent_ws_url(monkeypatch):
-    mod = _load_app()
+    mod = _load_app(monkeypatch)
     monkeypatch.setattr(mod.httpx2, "get", lambda *a, **k: _ok_response())
     resp = TestClient(mod.app).post("/api/token")
     assert resp.status_code == 200
@@ -35,7 +35,7 @@ def test_token_returns_token_and_agent_ws_url(monkeypatch):
 def test_token_uses_bearer_authorization_header(monkeypatch):
     # The Voice Agent token uses Bearer auth (unlike the streaming token).
     monkeypatch.setenv("ASSEMBLYAI_API_KEY", "sk-test")
-    mod = _load_app()
+    mod = _load_app(monkeypatch)
     captured = {}
 
     def fake_get(url, params=None, headers=None):
@@ -50,13 +50,13 @@ def fake_get(url, params=None, headers=None):
 
 def test_page_reads_reply_audio_from_data_field():
     # reply.audio carries the base64 PCM in `data` (not `audio`); guard the regression.
-    html = (TEMPLATE_DIR / "index.html").read_text()
-    assert "reply.audio" in html
-    assert "ev.data" in html
+    app_js = (TEMPLATE_DIR / "static" / "app.js").read_text()
+    assert "reply.audio" in app_js
+    assert "event.data" in app_js
 
 
 def test_token_surfaces_error_as_502(monkeypatch):
-    mod = _load_app()
+    mod = _load_app(monkeypatch)
 
     def boom(*a, **k):
         raise RuntimeError("network down")
diff --git a/tests/test_init_template_contract.py b/tests/test_init_template_contract.py
index c64dc08b..bc9f1a8e 100644
--- a/tests/test_init_template_contract.py
+++ b/tests/test_init_template_contract.py
@@ -11,6 +11,7 @@
 # Map an import name to its PyPI distribution where they differ.
 _PKG_MAP = {"dotenv": "python-dotenv", "multipart": "python-multipart"}
 _STDLIB = {"os", "tempfile", "uuid", "pathlib", "__future__", "json", "typing"}
+_LOCAL_IMPORTS = {"api"}
 
 
 @pytest.fixture(params=TEMPLATE_DIRS, ids=lambda p: p.name)
@@ -21,16 +22,45 @@ def template_dir(request):
 def test_required_files_present(template_dir):
     for rel in (
         "api/index.py",
+        "api/__init__.py",
+        "api/settings.py",
         "index.html",
+        "static/app.js",
+        "static/styles.css",
         "vercel.json",
         "requirements.txt",
         "README.md",
+        "AGENTS.md",
         "gitignore",
         "env.example",
     ):
         assert (template_dir / rel).exists(), f"{template_dir.name} missing {rel}"
 
 
+def test_realtime_templates_have_audio_helpers(template_dir):
+    if template_dir.name in {"stream", "agent"}:
+        assert (template_dir / "static" / "audio.js").exists()
+
+
+def test_static_assets_referenced_by_html_exist(template_dir):
+    html = (template_dir / "index.html").read_text()
+    refs = set(re.findall(r'(?:href|src)=["\'](/static/[^"\']+)', html))
+    assert refs, f"{template_dir.name}: index.html should load static assets"
+    for ref in refs:
+        assert (template_dir / ref.lstrip("/")).exists(), (
+            f"{template_dir.name}: index.html references missing asset {ref!r}"
+        )
+
+
+def test_codex_edit_points_are_explicit(template_dir):
+    notes = (template_dir / "AGENTS.md").read_text()
+    app_js = (template_dir / "static" / "app.js").read_text()
+    assert "ASSEMBLYAI_API_KEY" in notes
+    assert "buildless" in notes
+    assert "static/app.js" in notes
+    assert "_CONFIG" in app_js
+
+
 def test_no_committed_dotenv_or_real_key(template_dir):
     assert not (template_dir / ".env").exists(), f"{template_dir.name} ships a real .env"
     assert "your_assemblyai_api_key_here" in (template_dir / "env.example").read_text()
@@ -38,11 +68,12 @@ def test_no_committed_dotenv_or_real_key(template_dir):
 
 def test_frontend_routes_exist_in_backend(template_dir):
     """Every /api path the page fetches must be a route the backend registers."""
-    html = (template_dir / "index.html").read_text()
-    fetched = set(re.findall(r'fetch\(\s*["\'`](/api/[^"\'`?]+)', html))
+    frontend = (template_dir / "index.html").read_text()
+    frontend += "\n".join(path.read_text() for path in (template_dir / "static").glob("*.js"))
+    fetched = set(re.findall(r'fetch\(\s*["\'`](/api/[^"\'`?]+)', frontend))
     # Also catch template-literal paths like fetch(`/api/status/${id}`) and "/api/x/" + id
-    fetched |= set(re.findall(r'["\'`](/api/[A-Za-z0-9_\-/]+?)(?:/?\$\{|/?["\'`]\s*\+)', html))
-    src = (template_dir / "api" / "index.py").read_text()
+    fetched |= set(re.findall(r'["\'`](/api/[A-Za-z0-9_\-/]+?)(?:/?\$\{|/?["\'`]\s*\+)', frontend))
+    src = "\n".join(path.read_text() for path in (template_dir / "api").glob("*.py"))
     registered = set(re.findall(r'@app\.\w+\(\s*["\']([^"\']+)["\']', src))
     registered_bases = {re.sub(r"/\{[^}]+\}$", "", r).rstrip("/") for r in registered}
     for path in fetched:
@@ -54,15 +85,16 @@ def test_frontend_routes_exist_in_backend(template_dir):
 
 
 def test_requirements_cover_backend_imports(template_dir):
-    """Every third-party import in api/index.py appears in requirements.txt."""
-    tree = ast.parse((template_dir / "api" / "index.py").read_text())
+    """Every third-party import in api/*.py appears in requirements.txt."""
     imports: set[str] = set()
-    for node in ast.walk(tree):
-        if isinstance(node, ast.Import):
-            imports.add(node.names[0].name.split(".")[0])
-        elif isinstance(node, ast.ImportFrom) and node.level == 0 and node.module:
-            imports.add(node.module.split(".")[0])
-    third_party = imports - _STDLIB
+    for path in (template_dir / "api").glob("*.py"):
+        tree = ast.parse(path.read_text())
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Import):
+                imports.add(node.names[0].name.split(".")[0])
+            elif isinstance(node, ast.ImportFrom) and node.level == 0 and node.module:
+                imports.add(node.module.split(".")[0])
+    third_party = imports - _STDLIB - _LOCAL_IMPORTS
     reqs = (template_dir / "requirements.txt").read_text().lower()
     for pkg in third_party:
         dist = _PKG_MAP.get(pkg, pkg)
diff --git a/tests/test_init_template_install.py b/tests/test_init_template_install.py
index ec3fc921..57cbd531 100644
--- a/tests/test_init_template_install.py
+++ b/tests/test_init_template_install.py
@@ -67,19 +67,18 @@ def test_template_installs_and_app_imports(template_dir: Path, tmp_path: Path) -
         f"{install.stderr}"
     )
 
-    # Import api/index.py with ONLY its declared deps present — no key needed, the
+    # Import api.index with ONLY its declared deps present — no key needed, the
     # module reads ASSEMBLYAI_API_KEY at import but defaults to "". A clean exit
     # proves the app boots from exactly what `aai init` ships to the user.
     boot = tmp_path / "boot.py"
     boot.write_text(
-        "import importlib.util, sys\n"
-        "spec = importlib.util.spec_from_file_location('tmpl', sys.argv[1])\n"
-        "mod = importlib.util.module_from_spec(spec)\n"
-        "spec.loader.exec_module(mod)\n"
+        "import importlib, sys\n"
+        "sys.path.insert(0, sys.argv[1])\n"
+        "mod = importlib.import_module('api.index')\n"
         "assert hasattr(mod, 'app'), 'template api/index.py does not export `app`'\n"
     )
     run = subprocess.run(
-        [str(py), str(boot), str(template_dir / "api" / "index.py")],
+        [str(py), str(boot), str(template_dir)],
         capture_output=True,
         text=True,
     )
diff --git a/tests/test_init_template_stream.py b/tests/test_init_template_stream.py
index 4f56fb20..a617e0f6 100644
--- a/tests/test_init_template_stream.py
+++ b/tests/test_init_template_stream.py
@@ -1,4 +1,5 @@
-import importlib.util
+import importlib
+import sys
 from pathlib import Path
 from unittest.mock import MagicMock
 
@@ -7,12 +8,11 @@
 TEMPLATE_DIR = Path("aai_cli/init/templates/stream")
 
 
-def _load_app():
-    spec = importlib.util.spec_from_file_location("_tmpl_stream", TEMPLATE_DIR / "api" / "index.py")
-    assert spec and spec.loader  # spec_from_file_location is typed Optional
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
+def _load_app(monkeypatch):
+    for name in ("api.index", "api.settings", "api"):
+        sys.modules.pop(name, None)
+    monkeypatch.syspath_prepend(str(TEMPLATE_DIR))
+    return importlib.import_module("api.index")
 
 
 def _ok_response(token="tok-123"):
@@ -23,7 +23,7 @@ def _ok_response(token="tok-123"):
 
 
 def test_token_returns_token_and_streaming_ws_url(monkeypatch):
-    mod = _load_app()
+    mod = _load_app(monkeypatch)
     monkeypatch.setattr(mod.httpx2, "get", lambda *a, **k: _ok_response())
     resp = TestClient(mod.app).post("/api/token")
     assert resp.status_code == 200
@@ -35,7 +35,7 @@ def test_token_returns_token_and_streaming_ws_url(monkeypatch):
 def test_token_uses_raw_authorization_header(monkeypatch):
     # The streaming token uses the raw key as Authorization (NOT Bearer).
     monkeypatch.setenv("ASSEMBLYAI_API_KEY", "sk-test")
-    mod = _load_app()
+    mod = _load_app(monkeypatch)
     captured = {}
 
     def fake_get(url, params=None, headers=None):
@@ -49,7 +49,7 @@ def fake_get(url, params=None, headers=None):
 
 
 def test_token_surfaces_error_as_502(monkeypatch):
-    mod = _load_app()
+    mod = _load_app(monkeypatch)
 
     def boom(*a, **k):
         raise RuntimeError("network down")
diff --git a/tests/test_init_template_transcribe.py b/tests/test_init_template_transcribe.py
index 31b12452..4d22b155 100644
--- a/tests/test_init_template_transcribe.py
+++ b/tests/test_init_template_transcribe.py
@@ -1,4 +1,4 @@
-import importlib.util
+import importlib
 import sys
 from pathlib import Path
 from unittest.mock import MagicMock
@@ -31,23 +31,25 @@ def _load_app(monkeypatch):
     monkeypatch.setitem(sys.modules, "assemblyai", fake_aai)
     monkeypatch.setitem(sys.modules, "assemblyai.api", fake_api)
     monkeypatch.setitem(sys.modules, "assemblyai.client", fake_client)
+    for name in ("api.index", "api.settings", "api"):
+        sys.modules.pop(name, None)
+    monkeypatch.syspath_prepend(str(TEMPLATE_DIR))
 
-    spec = importlib.util.spec_from_file_location(
-        "_tmpl_transcribe", TEMPLATE_DIR / "api" / "index.py"
-    )
-    assert spec and spec.loader  # spec_from_file_location is typed Optional
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
+    module = importlib.import_module("api.index")
     return module.app, fake_aai, fake_api
 
 
 def test_required_files_exist():
     for rel in (
         "api/index.py",
+        "api/settings.py",
         "index.html",
+        "static/app.js",
+        "static/styles.css",
         "vercel.json",
         "requirements.txt",
         "README.md",
+        "AGENTS.md",
         "gitignore",
         "env.example",
     ):
@@ -69,6 +71,8 @@ def test_base_url_env_is_applied(monkeypatch):
 def test_page_explores_all_features_and_speakers():
     # Guard the UI surface: each audio-intelligence view + per-speaker coloring stay wired.
     html = (TEMPLATE_DIR / "index.html").read_text()
+    app_js = (TEMPLATE_DIR / "static" / "app.js").read_text()
+    ui_src = html + app_js
     for token in (
         "chapters",
         "sentiment_analysis_results",
@@ -77,7 +81,7 @@ def test_page_explores_all_features_and_speakers():
         "speakerColor",
         "/api/ask",  # the LLM Gateway Q&A panel
     ):
-        assert token in html, token
+        assert token in ui_src, token
 
 
 def test_ask_calls_llm_gateway_with_transcript_id(monkeypatch):
diff --git a/tests/test_jsonshape.py b/tests/test_jsonshape.py
new file mode 100644
index 00000000..ea2a2fa8
--- /dev/null
+++ b/tests/test_jsonshape.py
@@ -0,0 +1,19 @@
+from aai_cli import jsonshape
+
+
+def test_as_mapping_accepts_json_objects_only():
+    assert jsonshape.as_mapping({"ok": 1}) == {"ok": 1}
+    assert jsonshape.as_mapping(["bad"]) is None
+
+
+def test_object_list_accepts_lists_only():
+    assert jsonshape.object_list([{"ok": 1}, "bad"]) == [{"ok": 1}, "bad"]
+    assert jsonshape.object_list({"bad": "shape"}) == []
+
+
+def test_mapping_list_filters_non_objects():
+    assert jsonshape.mapping_list([{"ok": 1}, "bad", {"also": "ok"}]) == [
+        {"ok": 1},
+        {"also": "ok"},
+    ]
+    assert jsonshape.mapping_list("bad") == []
diff --git a/tests/test_keys.py b/tests/test_keys.py
index 9f619642..da706add 100644
--- a/tests/test_keys.py
+++ b/tests/test_keys.py
@@ -4,6 +4,8 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
+from aai_cli.commands import keys
 from aai_cli.main import app
 
 runner = CliRunner()
@@ -13,6 +15,12 @@ def _auth():
     config.set_session("default", session_jwt="jwt", session_token="tok", account_id=42)
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=42
+    )
+
+
 def test_keys_list_flattens_tokens():
     _auth()
     projects = [
@@ -29,9 +37,47 @@ def test_keys_list_flattens_tokens():
     assert "sk_abcdef1234" not in result.output  # api key is masked
 
 
-def test_keys_list_requires_session():
-    result = runner.invoke(app, ["keys", "list"])
+def test_keys_shape_helpers_filter_invalid_values():
+    assert keys._mapping("bad") is None
+    assert keys._mapping_list("bad") == []
+    assert keys._mapping_list([{"id": 1}, "bad"]) == [{"id": 1}]
+    assert keys._project_id({"id": True}) is None
+    assert keys._project_id({"id": 7}) == 7
+    assert keys._project_id({"id": "8"}) == 8
+    assert keys._project_id({"id": "bad"}) is None
+    assert keys._project_id({"id": object()}) is None
+
+
+def test_keys_create_rejects_missing_default_project_object():
+    _auth()
+    with (
+        patch("aai_cli.commands.keys.ams.list_projects", return_value=[{"project": "bad"}]),
+        patch("aai_cli.commands.keys.ams.create_token") as create,
+    ):
+        result = runner.invoke(app, ["keys", "create", "--name", "ci"])
+    assert result.exit_code == 1
+    create.assert_not_called()
+
+
+def test_keys_create_rejects_default_project_without_int_id():
+    _auth()
+    with (
+        patch("aai_cli.commands.keys.ams.list_projects", return_value=[{"project": {"id": "bad"}}]),
+        patch("aai_cli.commands.keys.ams.create_token") as create,
+    ):
+        result = runner.invoke(app, ["keys", "create", "--name", "ci"])
+    assert result.exit_code == 1
+    create.assert_not_called()
+
+
+def test_keys_list_without_session_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+    with patch("aai_cli.commands.keys.ams.list_projects", return_value=[]) as list_projects:
+        result = runner.invoke(app, ["keys", "list", "--json"])
     assert result.exit_code == 2
+    assert config.get_session("default") == {"jwt": "jwt", "token": "tok"}
+    list_projects.assert_not_called()
+    assert "Run the same command again" in result.output
 
 
 def test_keys_create_prints_new_key():
@@ -54,6 +100,29 @@ def test_keys_create_prints_new_key():
     create.assert_called_once_with(42, 1, "ci", "jwt")
 
 
+def test_keys_list_falls_back_to_token_name_when_name_is_null():
+    _auth()
+    projects = [
+        {
+            "project": {"id": 1, "name": "Default"},
+            "tokens": [
+                {
+                    "id": 10,
+                    "name": None,
+                    "token_name": "AssemblyAI CLI",
+                    "api_key": "sk_abcdef1234",
+                    "is_disabled": False,
+                }
+            ],
+        }
+    ]
+    with patch("aai_cli.commands.keys.ams.list_projects", return_value=projects):
+        result = runner.invoke(app, ["keys", "list", "--json"])
+    assert result.exit_code == 0
+    data = json.loads(result.output)
+    assert data[0]["name"] == "AssemblyAI CLI"
+
+
 def test_keys_rename_calls_ams():
     _auth()
     with patch("aai_cli.commands.keys.ams.rename_token") as rename:
diff --git a/tests/test_llm_command.py b/tests/test_llm_command.py
index 8c3e718d..76d576a2 100644
--- a/tests/test_llm_command.py
+++ b/tests/test_llm_command.py
@@ -4,6 +4,7 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
 from aai_cli.main import app
 
 runner = CliRunner()
@@ -13,6 +14,12 @@ def _auth():
     config.set_api_key("default", "sk_live")
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=7
+    )
+
+
 def _payload(content="four"):
     # Mimics the OpenAI SDK response object the command reads via content_of/usage_of.
     # `usage` is a CompletionUsage-like model (model_dump), not a raw dict.
@@ -120,9 +127,17 @@ def test_llm_missing_prompt_exits_2(monkeypatch):
     assert result.exit_code == 2
 
 
-def test_llm_unauthenticated_exits_2():
-    result = runner.invoke(app, ["llm", "hello"])
+def test_llm_unauthenticated_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+
+    def fake_complete(api_key, *, model, messages, max_tokens, transcript_id=None):
+        raise AssertionError(f"LLM request should not run after auto-login: {api_key}")
+
+    monkeypatch.setattr("aai_cli.commands.llm.gateway.complete", fake_complete)
+    result = runner.invoke(app, ["llm", "hello", "--json"])
     assert result.exit_code == 2
+    assert config.get_api_key("default") == "sk_from_oauth"
+    assert "Run the same command again" in result.output
 
 
 def test_llm_follow_summarizes_each_turn(monkeypatch):
diff --git a/tests/test_login.py b/tests/test_login.py
index 340d5728..8ae0a4b3 100644
--- a/tests/test_login.py
+++ b/tests/test_login.py
@@ -47,9 +47,14 @@ def test_whoami_reports_authenticated():
     assert data["api_key"].startswith("sk_") and "…" in data["api_key"]
 
 
-def test_whoami_unauthenticated_exits_2():
-    result = runner.invoke(app, ["whoami"])
+def test_whoami_unauthenticated_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _fake_login_result)
+    with patch("aai_cli.commands.login.client.validate_key", return_value=True) as validate:
+        result = runner.invoke(app, ["whoami", "--json"])
     assert result.exit_code == 2
+    assert config.get_api_key("default") == "sk_from_oauth"
+    validate.assert_not_called()
+    assert "Run the same command again" in result.output
 
 
 def test_logout_clears_key():
diff --git a/tests/test_microphone.py b/tests/test_microphone.py
index a5426476..8d27c45a 100644
--- a/tests/test_microphone.py
+++ b/tests/test_microphone.py
@@ -180,6 +180,13 @@ def boom(*a, **k):
     assert _device_default_rate(None) == _FALLBACK_RATE
 
 
+def test_device_default_rate_falls_back_on_non_numeric_rate(monkeypatch):
+    fake_sd: Any = types.ModuleType("sounddevice")
+    fake_sd.query_devices = lambda device, kind: {"default_samplerate": object()}
+    monkeypatch.setitem(sys.modules, "sounddevice", fake_sd)
+    assert _device_default_rate(None) == _FALLBACK_RATE
+
+
 def test_sounddevice_mic_yields_bytes_then_stops_and_closes():
     stream = _FakeRawStream()
     mic = _SoundDeviceMic(stream, blocksize=1024)
diff --git a/tests/test_output.py b/tests/test_output.py
index 2afaf923..27fcaad1 100644
--- a/tests/test_output.py
+++ b/tests/test_output.py
@@ -32,6 +32,12 @@ def test_resolve_json_false_for_human(monkeypatch):
     assert output.resolve_json(explicit=False) is False
 
 
+def test_mask_secret_preserves_only_short_edges():
+    assert output.mask_secret("sk_1234567890") == "sk_…7890"
+    assert output.mask_secret("12345678") == "123…5678"
+    assert output.mask_secret("short") == "***"
+
+
 def test_emit_json_serializes(capsys):
     output.emit({"a": 1}, lambda d: "human", json_mode=True)
     out = capsys.readouterr().out
diff --git a/tests/test_sessions_command.py b/tests/test_sessions_command.py
index ea5400dc..88a093a3 100644
--- a/tests/test_sessions_command.py
+++ b/tests/test_sessions_command.py
@@ -4,6 +4,8 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
+from aai_cli.commands import sessions
 from aai_cli.main import app
 
 runner = CliRunner()
@@ -13,6 +15,12 @@ def _auth():
     config.set_session("default", session_jwt="jwt", session_token="tok", account_id=42)
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=42
+    )
+
+
 def _human(monkeypatch):
     monkeypatch.setattr("aai_cli.output.resolve_json", lambda *, explicit: explicit)
 
@@ -38,6 +46,11 @@ def test_sessions_list_renders_rows():
     assert data[0]["session_id"] == "s_1"
 
 
+def test_session_rows_filter_invalid_items():
+    assert sessions._session_rows("bad") == []
+    assert sessions._session_rows([{"session_id": "s_1"}, "bad"]) == [{"session_id": "s_1"}]
+
+
 def test_sessions_list_renders_table_human(monkeypatch):
     _auth()
     _human(monkeypatch)
@@ -84,6 +97,11 @@ def test_sessions_get_renders_detail(monkeypatch):
     assert "s_1" in result.output and "universal" in result.output
 
 
-def test_sessions_requires_session():
-    result = runner.invoke(app, ["sessions", "list"])
+def test_sessions_without_session_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+    with patch("aai_cli.commands.sessions.ams.list_streaming", return_value={"data": []}) as list_:
+        result = runner.invoke(app, ["sessions", "list", "--json"])
     assert result.exit_code == 2
+    assert config.get_session("default") == {"jwt": "jwt", "token": "tok"}
+    list_.assert_not_called()
+    assert "Run the same command again" in result.output
diff --git a/tests/test_stream_command.py b/tests/test_stream_command.py
index 6e64efdf..788a7cc0 100644
--- a/tests/test_stream_command.py
+++ b/tests/test_stream_command.py
@@ -4,6 +4,7 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
 from aai_cli.main import app
 
 runner = CliRunner()
@@ -19,6 +20,12 @@ def _drive_turns(
         on_turn(types.SimpleNamespace(transcript="hello world", end_of_turn=True))
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=7
+    )
+
+
 def test_stream_help_lists_command():
     result = runner.invoke(app, ["stream", "--help"])
     assert result.exit_code == 0
@@ -114,9 +121,17 @@ def fake(api_key, source, *, params, on_begin=None, **_kwargs):
     assert "Listening" not in result.output  # no mic -> no listening notice
 
 
-def test_stream_unauthenticated_exits_2():
-    result = runner.invoke(app, ["stream"])
+def test_stream_unauthenticated_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+
+    def fake_stream_audio(api_key, source, *, params, **_kwargs):
+        raise AssertionError(f"streaming should not start after auto-login: {api_key}")
+
+    monkeypatch.setattr("aai_cli.commands.stream.client.stream_audio", fake_stream_audio)
+    result = runner.invoke(app, ["stream", "--json"])
     assert result.exit_code == 2
+    assert config.get_api_key("default") == "sk_from_oauth"
+    assert "Run the same command again" in result.output
 
 
 def _capture_source(seen):
diff --git a/tests/test_timeparse.py b/tests/test_timeparse.py
new file mode 100644
index 00000000..2f6fd426
--- /dev/null
+++ b/tests/test_timeparse.py
@@ -0,0 +1,30 @@
+from datetime import UTC
+
+from aai_cli import timeparse
+
+
+def test_parse_iso_utc_normalizes_z_and_offsets():
+    parsed = timeparse.parse_iso_utc("2026-06-01T12:00:00-04:00")
+    assert parsed is not None
+    assert parsed.tzinfo is UTC
+    assert parsed.isoformat() == "2026-06-01T16:00:00+00:00"
+
+    zulu = timeparse.parse_iso_utc("2026-06-01T12:00:00Z")
+    assert zulu is not None
+    assert zulu.isoformat() == "2026-06-01T12:00:00+00:00"
+
+
+def test_parse_iso_utc_treats_dates_and_naive_datetimes_as_utc():
+    date_only = timeparse.parse_iso_utc("2026-06-01")
+    assert date_only is not None
+    assert date_only.isoformat() == "2026-06-01T00:00:00+00:00"
+
+    naive = timeparse.parse_iso_utc("2026-06-01T12:00:00")
+    assert naive is not None
+    assert naive.isoformat() == "2026-06-01T12:00:00+00:00"
+
+
+def test_parse_iso_utc_rejects_non_dates():
+    assert timeparse.parse_iso_utc(None) is None
+    assert timeparse.parse_iso_utc("") is None
+    assert timeparse.parse_iso_utc("not-a-date") is None
diff --git a/tests/test_transcribe.py b/tests/test_transcribe.py
index 8db7e846..80616a3b 100644
--- a/tests/test_transcribe.py
+++ b/tests/test_transcribe.py
@@ -4,6 +4,7 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
 from aai_cli.main import app
 
 runner = CliRunner()
@@ -13,6 +14,12 @@ def _auth():
     config.set_api_key("default", "sk_live")
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=7
+    )
+
+
 def _fake_transcript():
     t = MagicMock()
     t.id = "t_1"
@@ -71,9 +78,16 @@ def test_transcribe_json_output():
     assert '"id": "t_1"' in result.output
 
 
-def test_transcribe_unauthenticated_exits_2():
-    result = runner.invoke(app, ["transcribe", "--sample"])
+def test_transcribe_unauthenticated_runs_login_then_transcribes(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+    with patch(
+        "aai_cli.commands.transcribe.client.transcribe", return_value=_fake_transcript()
+    ) as tx:
+        result = runner.invoke(app, ["transcribe", "--sample"])
     assert result.exit_code == 2
+    assert config.get_api_key("default") == "sk_from_oauth"
+    tx.assert_not_called()
+    assert "Run the same command again" in result.output
 
 
 def test_transcribe_output_text_field():
diff --git a/tests/test_transcribe_render.py b/tests/test_transcribe_render.py
index 5ca473a7..4b4cb170 100644
--- a/tests/test_transcribe_render.py
+++ b/tests/test_transcribe_render.py
@@ -42,6 +42,21 @@ def test_renders_text_only_when_no_analysis():
     assert "Summary" not in out
 
 
+def test_render_helpers_handle_invalid_dynamic_values():
+    assert tr._mapping("bad") == {}
+    assert tr._int_value(True) == 0
+    assert tr._int_value(12) == 12
+    assert tr._int_value(12.9) == 12
+    assert tr._int_value("13") == 13
+    assert tr._int_value("bad") == 0
+    assert tr._int_value(object()) == 0
+    assert tr._float_value(True) == 0.0
+    assert tr._float_value(1) == 1.0
+    assert tr._float_value("1.5") == 1.5
+    assert tr._float_value("bad") == 0.0
+    assert tr._float_value(object()) == 0.0
+
+
 def test_renders_per_speaker_utterances():
     transcript = SimpleNamespace(
         text="flat",
diff --git a/tests/test_transcripts.py b/tests/test_transcripts.py
index ea539d85..844206a5 100644
--- a/tests/test_transcripts.py
+++ b/tests/test_transcripts.py
@@ -3,11 +3,18 @@
 from typer.testing import CliRunner
 
 from aai_cli import config
+from aai_cli.auth.flow import LoginResult
 from aai_cli.main import app
 
 runner = CliRunner()
 
 
+def _login_result():
+    return LoginResult(
+        api_key="sk_from_oauth", session_jwt="jwt", session_token="tok", account_id=7
+    )
+
+
 def test_get_prints_transcript_text():
     config.set_api_key("default", "sk_live")
     fake = MagicMock()
@@ -59,9 +66,15 @@ def test_list_renders_rows():
     assert "t1" in result.output and "t2" in result.output
 
 
-def test_list_unauthenticated_exits_2():
-    result = runner.invoke(app, ["transcripts", "list"])
+def test_list_unauthenticated_runs_login(monkeypatch):
+    monkeypatch.setattr("aai_cli.context.run_login_flow", _login_result)
+    rows = [{"id": "t1", "status": "completed"}]
+    with patch("aai_cli.commands.transcripts.client.list_transcripts", return_value=rows) as list_:
+        result = runner.invoke(app, ["transcripts", "list", "--json"])
     assert result.exit_code == 2
+    assert config.get_api_key("default") == "sk_from_oauth"
+    list_.assert_not_called()
+    assert "Run the same command again" in result.output
 
 
 def test_list_human_mode_renders_table(monkeypatch):
diff --git a/uv.lock b/uv.lock
index 7ce15bb7..7faf067d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -19,6 +19,7 @@ dependencies = [
     { name = "keyring" },
     { name = "openai" },
     { name = "platformdirs" },
+    { name = "pydantic" },
     { name = "questionary" },
     { name = "rich" },
     { name = "sounddevice" },
@@ -30,9 +31,13 @@ dependencies = [
 
 [package.dev-dependencies]
 dev = [
+    { name = "deptry" },
     { name = "diff-cover" },
     { name = "fastapi" },
+    { name = "httpx" },
     { name = "hypothesis" },
+    { name = "import-linter" },
+    { name = "mutmut" },
     { name = "mypy" },
     { name = "pre-commit" },
     { name = "pyright" },
@@ -43,6 +48,7 @@ dev = [
     { name = "ruff" },
     { name = "syrupy" },
     { name = "uvicorn" },
+    { name = "vulture" },
     { name = "xenon" },
 ]
 
@@ -54,6 +60,7 @@ requires-dist = [
     { name = "keyring", specifier = ">=25.7.0" },
     { name = "openai", specifier = ">=2.41.0" },
     { name = "platformdirs", specifier = ">=4.10.0" },
+    { name = "pydantic", specifier = ">=2.13.4" },
     { name = "questionary", specifier = ">=2.0.1" },
     { name = "rich", specifier = ">=15.0.0" },
     { name = "sounddevice", specifier = ">=0.5.5" },
@@ -65,9 +72,13 @@ requires-dist = [
 
 [package.metadata.requires-dev]
 dev = [
+    { name = "deptry", specifier = ">=0.23.0" },
     { name = "diff-cover", specifier = ">=9.0.0" },
     { name = "fastapi", specifier = ">=0.115.0" },
+    { name = "httpx", specifier = ">=0.28.1" },
     { name = "hypothesis", specifier = ">=6.155.1" },
+    { name = "import-linter", specifier = ">=2.3" },
+    { name = "mutmut", specifier = ">=3.5.0" },
     { name = "mypy", specifier = ">=2.1.0" },
     { name = "pre-commit", specifier = ">=4.6.0" },
     { name = "pyright", specifier = ">=1.1.409" },
@@ -78,6 +89,7 @@ dev = [
     { name = "ruff", specifier = ">=0.15.15" },
     { name = "syrupy", specifier = ">=4.0" },
     { name = "uvicorn", specifier = ">=0.30.0" },
+    { name = "vulture", specifier = ">=2.14" },
     { name = "xenon", specifier = ">=0.9.3" },
 ]
 
@@ -449,14 +461,14 @@ wheels = [
 
 [[package]]
 name = "click"
-version = "8.4.1"
+version = "8.1.8"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9b/98/518d8e5081007684232226f475082b30087d0f585e8457db087298259f49/click-8.4.1.tar.gz", hash = "sha256:918b5633eddf6b41c32d4f454bf0de810065c74e3f7dbf8ee5452f8be88d3e96", size = 353007, upload-time = "2026-05-22T04:08:37.769Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b9/2e/0090cbf739cee7d23781ad4b89a9894a41538e4fcf4c31dcdd705b78eb8b/click-8.1.8.tar.gz", hash = "sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a", size = 226593, upload-time = "2024-12-21T18:38:44.339Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c7/0d/67e5b4109ea4a837e80daa87c2c696711955e40449a97e8926672534def2/click-8.4.1-py3-none-any.whl", hash = "sha256:482be17c6991b8c19c5429a1e995d9b0efdbb63172824c41f99965dc0ade8ec2", size = 116639, upload-time = "2026-05-22T04:08:35.26Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/d4/7ebdbd03970677812aac39c869717059dbb71a4cfc033ca6e5221787892c/click-8.1.8-py3-none-any.whl", hash = "sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2", size = 98188, upload-time = "2024-12-21T18:38:41.666Z" },
 ]
 
 [[package]]
@@ -620,6 +632,36 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b4/e1/48cedb2fe63626e91ded1edad159e2a4fb8b6906c4425eb7749673077ce7/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:4defde8685ae324a9eb9d818717e93b4638ef67070ac9bc15b8ca85f63048355", size = 4666800, upload-time = "2026-05-04T22:59:27.474Z" },
 ]
 
+[[package]]
+name = "deptry"
+version = "0.25.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "click" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "packaging" },
+    { name = "requirements-parser" },
+    { name = "tomli", marker = "python_full_version < '3.15'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b8/b2/50ccc99362ae7757342978b7ecb3b98e47fade721fd617d74db1948ec3a1/deptry-0.25.1.tar.gz", hash = "sha256:45c8cd982c85cd4faae573ddff6920de7eec735336db6973f26a765ae7950f7d", size = 509748, upload-time = "2026-03-18T23:22:18.139Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/33/1d/b538dc635e873b25360d761cfe1fa0ccd7d6c69b698047e552f33401e60d/deptry-0.25.1-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:a4dd1148db24a1ddacfa8b840836c6019c2f864fcb7579dd089fd217606338c8", size = 1850319, upload-time = "2026-03-18T23:22:15.65Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/a9/511477a8f0ae4f6021d68a80bdca77e7ffb0722008dc24ee5d9ef49f5c88/deptry-0.25.1-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:c67c666d916ef12013c0772e40d78be0f21577a495d8d99ec5fcb18c332d393d", size = 1759259, upload-time = "2026-03-18T23:22:30.853Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/4b/c9f0bdda410912a6df79a789cb118fa29acae02a397794ead3c84adcda5c/deptry-0.25.1-cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:58d39279828dbf4efc1abb40bf50a71b21499c36759bed5a8d8a3c0e3149b091", size = 1872012, upload-time = "2026-03-18T23:22:19.145Z" },
+    { url = "https://files.pythonhosted.org/packages/72/9c/6f6f9125bac74b5d5d2af89536cbdb3fa159b6466aa097b74e7e85e8e030/deptry-0.25.1-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:14bfcc28b4326ed8c6abb30691b19077d4ef8613cfba6c37ef5b1f471775bf6f", size = 1926575, upload-time = "2026-03-18T23:22:11.269Z" },
+    { url = "https://files.pythonhosted.org/packages/52/48/2a5e705a7f898295966ade67bd1223e2af96da433e25b39f6b9483ba2c7b/deptry-0.25.1-cp310-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:555f5f9a487899ec9bf301eecba1745e14d212c4b354f4d3a5fd691e907366d3", size = 2050816, upload-time = "2026-03-18T23:22:27.439Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/c6/50f189a894e1f3bf21266299112c8a06cb731838976e1b9a9cadd0b4a86e/deptry-0.25.1-cp310-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:18d21b3545ab2bfec53f3f45c6f5f201d55f713323327f8d12674505469ae6b7", size = 2145416, upload-time = "2026-03-18T23:22:24.682Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/6a/3f82f7a06217778282bc4456af1b4ffb3bc4b2c8e7891d00e8323f9ad0b8/deptry-0.25.1-cp310-abi3-win_amd64.whl", hash = "sha256:b59a560cb7dffb21832a98bb80d33d614cfb5630ea36ce21833eabf4eae3df99", size = 1718489, upload-time = "2026-03-18T23:22:28.589Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/7f/cd6b3ac8cf95f2f1c5c7a74ff6452e9098af89a9b56607381f677880641e/deptry-0.25.1-cp310-abi3-win_arm64.whl", hash = "sha256:6efffd8116fb9d2c45a251382ce4ce1c38dbb17179f581ec9231ed5390f7fc12", size = 1647020, upload-time = "2026-03-18T23:22:23.311Z" },
+    { url = "https://files.pythonhosted.org/packages/46/e7/b554568a84197c0a4177b51c9880b55e9861de08d9acfd914a08148a1faa/deptry-0.25.1-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:30d64d4df1c08bc69de56cb0b4ec1f4cd9fa2e42582347d5b1eb25fd0e401745", size = 1846779, upload-time = "2026-03-18T23:22:21.887Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/63/38cf5ab4b81fcb1c58909ab0fe1ccc62b36f61c5f7d213a7d0474f620925/deptry-0.25.1-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:87bcd90f99a98bb059c7580bc315c3f87d97fe2db725530030bc974176834735", size = 1758420, upload-time = "2026-03-18T23:22:14.315Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/fb/234c333d5dfcc810bb3ca5b3b420355bdd759901c75e41f0441a9871a1cd/deptry-0.25.1-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:80f31eb5c520651b102568dd91f738222b250a3e44c9e95d4941322109b8d40a", size = 1870345, upload-time = "2026-03-18T23:22:29.734Z" },
+    { url = "https://files.pythonhosted.org/packages/59/62/cb63e5210d1ba36cf68cdc0e4fdea73e48f80ac3b7680228816f39ff696a/deptry-0.25.1-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:df88952a2bab7517ef23cb304b979199b28449e5d9db2e9ba9bc27a286ac852b", size = 1922759, upload-time = "2026-03-18T23:22:17.121Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/8c/e079c44ed98464930e83ca54ea5d40fec522d234e8428e06a1be7f6c7a9a/deptry-0.25.1-pp311-pypy311_pp73-musllinux_1_1_aarch64.whl", hash = "sha256:e6f7b8fa72932e51e86799b10dcd29381b2132dc799c790dca3b28ab08dffb28", size = 2049576, upload-time = "2026-03-18T23:22:12.797Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/f2/6a89ad9e5e8e9d37def57a28020d6d7fbcf900b2e5f4dfbbace349cdca91/deptry-0.25.1-pp311-pypy311_pp73-musllinux_1_1_x86_64.whl", hash = "sha256:e3fa3321078e11cd1ac3f10ce3ff0547731c53f9253b87c757a8749c76fe8fa9", size = 2144676, upload-time = "2026-03-18T23:22:26.319Z" },
+    { url = "https://files.pythonhosted.org/packages/04/9a/b3358690a1a47381d995c3d3587798ab2cd086baf4b839e35183599aa2e1/deptry-0.25.1-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:03c032c32492fde434736954fbcaff09c02bf207b0f793b77e9040300e34b344", size = 1715518, upload-time = "2026-03-18T23:22:20.486Z" },
+]
+
 [[package]]
 name = "diff-cover"
 version = "10.2.1"
@@ -678,6 +720,99 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/81/47/dd9a212ef6e343a6857485ffe25bba537304f1913bdbed446a23f7f592e1/filelock-3.29.0-py3-none-any.whl", hash = "sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258", size = 39812, upload-time = "2026-04-19T15:39:08.752Z" },
 ]
 
+[[package]]
+name = "grimp"
+version = "3.14"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/63/46/79764cfb61a3ac80dadae5d94fb10acdb7800e31fecf4113cf3d345e4952/grimp-3.14.tar.gz", hash = "sha256:645fbd835983901042dae4e1b24fde3a89bf7ac152f9272dd17a97e55cb4f871", size = 830882, upload-time = "2025-12-10T17:55:01.287Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/25/31/d4a86207c38954b6c3d859a1fc740a80b04bbe6e3b8a39f4e66f9633dfa4/grimp-3.14-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:f1c91e3fa48c2196bf62e3c71492140d227b2bfcd6d15e735cbc0b3e2d5308e0", size = 2185572, upload-time = "2025-12-10T17:53:41.287Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/61/ed4cba5bd75d37fe46e17a602f616619a9e4f74ad8adfcf560ce4b2a1697/grimp-3.14-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c6291c8f1690a9fe21b70923c60b075f4a89676541999e3d33084cbc69ac06a1", size = 2118002, upload-time = "2025-12-10T17:53:18.546Z" },
+    { url = "https://files.pythonhosted.org/packages/77/6a/688f6144d0b207d7845bd8ab403820a83630ce3c9420cbbc7c9e9282f9c0/grimp-3.14-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0ec312383935c2d09e4085c8435780ada2e13ebef14e105609c2988a02a5b2ce", size = 2283939, upload-time = "2025-12-10T17:52:06.228Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/98/4c540de151bf3fd58d6d7b3fe2269b6a6af6c61c915de1bc991802bfaff8/grimp-3.14-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:4f43cbf640e73ee703ad91639591046828d20103a1c363a02516e77a66a4ac07", size = 2233693, upload-time = "2025-12-10T17:52:18.938Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/7b/84b4b52b6c6dd5bf083cb1a72945748f56ea2e61768bbebf87e8d9d0ef75/grimp-3.14-cp311-cp311-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2a93c9fddccb9ff16f5c6b5fca44227f5f86cba7cffc145d2176119603d2d7c7", size = 2389745, upload-time = "2025-12-10T17:53:00.659Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/33/31b96907c7dd78953df5e1ce67c558bd6057220fa1203d28d52566315a2e/grimp-3.14-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5653a2769fdc062cb7598d12200352069c9c6559b6643af6ada3639edb98fcc3", size = 2569055, upload-time = "2025-12-10T17:52:33.556Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/24/ce1a8110f3d5b178153b903aafe54b6a9216588b5bff3656e30af43e9c29/grimp-3.14-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:071c7ddf5e5bb7b2fdf79aefdf6e1c237cd81c095d6d0a19620e777e85bf103c", size = 2358044, upload-time = "2025-12-10T17:52:47.545Z" },
+    { url = "https://files.pythonhosted.org/packages/05/7f/16d98c02287bc99884843478b9a68b04a2ef13b5cb8b9f36a9ca7daea75b/grimp-3.14-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7e01b7a4419f535b667dfdcb556d3815b52981474f791fb40d72607228389a31", size = 2310304, upload-time = "2025-12-10T17:53:09.679Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/8c/0fde9781b0f6b4f9227d485685f48f6bcc70b95af22e2f85ff7f416cbfc1/grimp-3.14-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c29682f336151d1d018d0c3aa9eeaa35734b970e4593fa396b901edca7ef5c79", size = 2463682, upload-time = "2025-12-10T17:53:49.185Z" },
+    { url = "https://files.pythonhosted.org/packages/51/cb/2baff301c2c2cc2792b6e225ea0784793ca587c81b97572be0bad122cfc8/grimp-3.14-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:a5c4fd71f363ea39e8aab0630010ced77a8de9789f27c0acdd0d7e6269d4a8ef", size = 2500573, upload-time = "2025-12-10T17:54:03.899Z" },
+    { url = "https://files.pythonhosted.org/packages/96/69/797e4242f42d6665da5fe22cb250cae3f14ece4cb22ad153e9cd97158179/grimp-3.14-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:766911e3ba0b13d833fdd03ad1f217523a8a2b2527b5507335f71dca1153183d", size = 2503005, upload-time = "2025-12-10T17:54:32.993Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/45/da1a27a6377807ca427cd56534231f0920e1895e16630204f382a0df14c5/grimp-3.14-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:154e84a2053e9f858ae48743de23a5ad4eb994007518c29371276f59b8419036", size = 2515776, upload-time = "2025-12-10T17:54:47.962Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/8d/b918a29ce98029cd7a9e33a584be43a93288d5283fb7ccef5b6b2ba39ede/grimp-3.14-cp311-cp311-win32.whl", hash = "sha256:3189c86c3e73016a1907ee3ba9f7a6ca037e3601ad09e60ce9bf12b88877f812", size = 1873189, upload-time = "2025-12-10T17:55:11.872Z" },
+    { url = "https://files.pythonhosted.org/packages/90/d7/2327c203f83a25766fbd62b0df3b24230d422b6e53518ff4d1c5e69793f1/grimp-3.14-cp311-cp311-win_amd64.whl", hash = "sha256:201f46a6a4e5ee9dfba4a2f7d043f7deab080d1d84233f4a1aee812678c25307", size = 2014277, upload-time = "2025-12-10T17:55:04.144Z" },
+    { url = "https://files.pythonhosted.org/packages/75/d6/a35ff62f35aa5fd148053506eddd7a8f2f6afaed31870dc608dd0eb38e4f/grimp-3.14-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:ffabc6940301214753bad89ec0bfe275892fa1f64b999e9a101f6cebfc777133", size = 2178573, upload-time = "2025-12-10T17:53:42.836Z" },
+    { url = "https://files.pythonhosted.org/packages/93/e2/bd2e80273da4d46110969fc62252e5372e0249feb872bc7fe76fdc7f1818/grimp-3.14-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:075d9a1c78d607792d0ed8d4d3d7754a621ef04c8a95eaebf634930dc9232bb2", size = 2110452, upload-time = "2025-12-10T17:53:19.831Z" },
+    { url = "https://files.pythonhosted.org/packages/44/c3/7307249c657d34dca9d250d73ba027d6cfe15a98fb3119b6e5210bc388b7/grimp-3.14-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:06ff52addeb20955a4d6aa097bee910573ffc9ef0d3c8a860844f267ad958156", size = 2283064, upload-time = "2025-12-10T17:52:07.673Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/d2/cae4cf32dc8d4188837cc4ab183300d655f898969b0f169e240f3b7c25be/grimp-3.14-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d10e0663e961fcbe8d0f54608854af31f911f164c96a44112d5173050132701f", size = 2235893, upload-time = "2025-12-10T17:52:20.418Z" },
+    { url = "https://files.pythonhosted.org/packages/04/92/3f58bc3064fc305dac107d08003ba65713a5bc89a6d327f1c06b30cce752/grimp-3.14-cp312-cp312-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4ab874d7ddddc7a1291259cf7c31a4e7b5c612e9da2e24c67c0eb1a44a624e67", size = 2393376, upload-time = "2025-12-10T17:53:02.397Z" },
+    { url = "https://files.pythonhosted.org/packages/06/b8/f476f30edf114f04cb58e8ae162cb4daf52bda0ab01919f3b5b7edb98430/grimp-3.14-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:54fec672ec83355636a852177f5a470c964bede0f6730f9ba3c7b5c8419c9eab", size = 2571342, upload-time = "2025-12-10T17:52:35.214Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/ae/2e44d3c4f591f95f86322a8f4dbb5aac17001d49e079f3a80e07e7caaf09/grimp-3.14-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:b9e221b5e8070a916c780e88c877fee2a61c95a76a76a2a076396e459511b0bb", size = 2359022, upload-time = "2025-12-10T17:52:49.063Z" },
+    { url = "https://files.pythonhosted.org/packages/69/ac/42b4d6bc0ea119ce2e91e1788feabf32c5433e9617dbb495c2a3d0dc7f12/grimp-3.14-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:eea6b495f9b4a8d82f5ce544921e76d0d12017f5d1ac3a3bd2f5ac88ab055b1c", size = 2309424, upload-time = "2025-12-10T17:53:11.069Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/c7/6a731989625c1790f4da7602dcbf9d6525512264e853cda77b3b3602d5e0/grimp-3.14-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:655e8d3f79cd99bb859e09c9dd633515150e9d850879ca71417d5ac31809b745", size = 2462754, upload-time = "2025-12-10T17:53:50.886Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/4d/3d1571c0a39a59dd68be4835f766da64fe64cbab0d69426210b716a8bdf0/grimp-3.14-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:a14f10b1b71c6c37647a76e6a49c226509648107abc0f48c1e3ecd158ba05531", size = 2501356, upload-time = "2025-12-10T17:54:06.014Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/d1/8950b8229095ebda5c54c8784e4d1f0a6e19423f2847289ef9751f878798/grimp-3.14-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:81685111ee24d3e25f8ed9e77ed00b92b58b2414e1a1c2937236026900972744", size = 2504631, upload-time = "2025-12-10T17:54:34.441Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/e6/23bed3da9206138d36d01890b656c7fb7adfb3a37daac8842d84d8777ade/grimp-3.14-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:ce8352a8ea0e27b143136ea086582fc6653419aa8a7c15e28ed08c898c42b185", size = 2514751, upload-time = "2025-12-10T17:54:49.384Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/45/6f1f55c97ee982f133ec5ccb22fc99bf5335aee70c208f4fb86cd833b8d5/grimp-3.14-cp312-cp312-win32.whl", hash = "sha256:3fc0f98b3c60d88e9ffa08faff3200f36604930972f8b29155f323b76ea25a06", size = 1875041, upload-time = "2025-12-10T17:55:13.326Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/cf/03ba01288e2a41a948bc8526f32c2eeaddd683ed34be1b895e31658d5a4c/grimp-3.14-cp312-cp312-win_amd64.whl", hash = "sha256:6bca77d1d50c8dc402c96af21f4e28e2f1e9938eeabd7417592a22bd83cde3c3", size = 2013868, upload-time = "2025-12-10T17:55:05.907Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/bd/d12a9c821b79ba31fc52243e564712b64140fc6d011c2bdbb483d9092a12/grimp-3.14-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:af8a625554beea84530b98cc471902155b5fc042b42dc47ec846fa3e32b0c615", size = 2178632, upload-time = "2025-12-10T17:53:44.55Z" },
+    { url = "https://files.pythonhosted.org/packages/96/8c/d6620dbc245149d5a5a7a9342733556ba91a672f358259c0ab31d889b56b/grimp-3.14-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0dd1942ffb419ad342f76b0c3d3d2d7f312b264ddc578179d13ce8d5acec1167", size = 2110288, upload-time = "2025-12-10T17:53:21.662Z" },
+    { url = "https://files.pythonhosted.org/packages/60/9d/ea51edc4eb295c99786040051c66466bfa235fd1def9f592057b36e03d0f/grimp-3.14-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:537f784ce9b4acf8657f0b9714ab69a6c72ffa752eccc38a5a85506103b1a194", size = 2282197, upload-time = "2025-12-10T17:52:09.304Z" },
+    { url = "https://files.pythonhosted.org/packages/28/6e/7db27818ced6a797f976ca55d981a3af5c12aec6aeda12d63965847cd028/grimp-3.14-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:78ab18c08770aa005bef67b873bc3946d33f65727e9f3e508155093db5fa57d6", size = 2235720, upload-time = "2025-12-10T17:52:21.806Z" },
+    { url = "https://files.pythonhosted.org/packages/37/26/0e3bbae4826bd6eaabf404738400414071e73ddb1e65bf487dcce17858c4/grimp-3.14-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:28ca58728c27e7292c99f964e6ece9295c2f9cfdefc37c18dea0679c783ffb6f", size = 2393023, upload-time = "2025-12-10T17:53:04.149Z" },
+    { url = "https://files.pythonhosted.org/packages/49/f2/7da91db5703da34c7ef4c7cddcbb1a8fc30cd85fe54756eba942c6fb27d8/grimp-3.14-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9b5577de29c6c5ae6e08d4ca0ac361b45dba323aa145796e6b320a6ea35414b7", size = 2571108, upload-time = "2025-12-10T17:52:36.523Z" },
+    { url = "https://files.pythonhosted.org/packages/25/5e/4d6278f18032c7208696edf8be24a4b5f7fad80acc20ffca737344bcecb5/grimp-3.14-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5d7d1f9f42306f455abcec34db877e4887ff15f2777a43491f7ccbd6936c449b", size = 2358531, upload-time = "2025-12-10T17:52:50.521Z" },
+    { url = "https://files.pythonhosted.org/packages/24/fb/231c32493161ac82f27af6a56965daefa0ec6030fdaf5b948ddd5d68d000/grimp-3.14-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:39bd5c9b7cef59ee30a05535e9cb4cbf45a3c503f22edce34d0aa79362a311a9", size = 2308831, upload-time = "2025-12-10T17:53:12.587Z" },
+    { url = "https://files.pythonhosted.org/packages/27/70/f6db325bf5efbbebc9c85cad0af865e821a12a0ba58ee309e938cbd5fedf/grimp-3.14-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7fec3116b4f780a1bc54176b19e6b9f2e36e2ef3164b8fc840660566af35df88", size = 2462138, upload-time = "2025-12-10T17:53:52.403Z" },
+    { url = "https://files.pythonhosted.org/packages/41/2e/cc3fe29cf07f70364018086840c228a190539ab8105147e34588db590792/grimp-3.14-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:0233a35a5bbb23688d63e1736b54415fa9994ace8dfeb7de8514ed9dee212968", size = 2501393, upload-time = "2025-12-10T17:54:22.486Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/eb/54cada9a726455148da23f64577b5cd164164d23a6449e3fa14551157356/grimp-3.14-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:e46b2fef0f1da7e7e2f8129eb93c7e79db716ff7810140a22ce5504e10ed86df", size = 2504514, upload-time = "2025-12-10T17:54:36.34Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/c7/e6afe4f0652df07e8762f61899d1202b73c22c559c804d0a09e5aab2ff17/grimp-3.14-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:3e6d9b50623ee1c3d2a1927ec3f5d408995ea1f92f3e91ed996c908bb40e856f", size = 2514018, upload-time = "2025-12-10T17:54:50.76Z" },
+    { url = "https://files.pythonhosted.org/packages/75/13/2b8550acc1f010301f02c4fe9664810929fd9277cd032ab608b8534a96fb/grimp-3.14-cp313-cp313-win32.whl", hash = "sha256:fd57c56f5833c99320ec77e8ba5508d56f6fb48ec8032a942f7931cc6ebb80ce", size = 1874922, upload-time = "2025-12-10T17:55:15.239Z" },
+    { url = "https://files.pythonhosted.org/packages/46/c7/bc9db5a54ef22972cd17d15ad80a8fee274a471bd3f02300405702d29ea5/grimp-3.14-cp313-cp313-win_amd64.whl", hash = "sha256:173307cf881a126fe5120b7bbec7d54384002e3c83dcd8c4df6ce7f0fee07c53", size = 2013705, upload-time = "2025-12-10T17:55:07.488Z" },
+    { url = "https://files.pythonhosted.org/packages/80/7e/02710bf5e50997168c84ac622b10dd41d35515efd0c67549945ad20996a0/grimp-3.14-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ebe29f8f13fbd7c314908ed535183a36e6db71839355b04869b27f23c58fa082", size = 2281868, upload-time = "2025-12-10T17:52:10.589Z" },
+    { url = "https://files.pythonhosted.org/packages/15/88/2e440c6762cc78bd50582e1b092357d2255f0852ccc6218d8db25170ab31/grimp-3.14-cp313-cp313t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:073d285b00100153fd86064c7726bb1b6d610df1356d33bb42d3fd8809cb6e72", size = 2230917, upload-time = "2025-12-10T17:52:23.212Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/bb/2e7dce129b88f07fc525fe5c97f28cfb7ed7b62c59386d39226b4d08969c/grimp-3.14-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f6d6efc37e1728bbfcd881b89467be5f7b046292597b3ebe5f8e44e89ea8b6cb", size = 2571371, upload-time = "2025-12-10T17:52:37.84Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/2b/8f1be8294af60c953687db7dec25525d87ed9c2aa26b66dcbe5244abaca2/grimp-3.14-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5337d65d81960b712574c41e85b480d4480bbb5c6f547c94e634f6c60d730889", size = 2356980, upload-time = "2025-12-10T17:52:52.004Z" },
+    { url = "https://files.pythonhosted.org/packages/35/ca/ead91e04b3ddd4774ae74601860ea0f0f21bcf6b970b6769ba9571eb2904/grimp-3.14-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:84a7fea63e352b325daa89b0b7297db411b7f0036f8d710c32f8e5090e1fc3ca", size = 2461540, upload-time = "2025-12-10T17:53:53.749Z" },
+    { url = "https://files.pythonhosted.org/packages/94/aa/f8a085ff73c37d6e6a37de9f58799a3fea9e16badf267aaef6f11c9a53a3/grimp-3.14-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:d0b19a3726377165fe1f7184a8af317734d80d32b371b6c5578747867ab53c0b", size = 2497925, upload-time = "2025-12-10T17:54:23.842Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/a3/db3c2d6df07fe74faf5a28fcf3b44fad2831d323ba4a3c2ff66b77a6520c/grimp-3.14-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:9caa4991f530750f88474a3f5ecf6ef9f0d064034889d92db00cfb4ecb78aa24", size = 2501794, upload-time = "2025-12-10T17:54:38.05Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/de/095f4e3765e7b60425a41e9fbd2b167f8b0acb957cc88c387f631778a09d/grimp-3.14-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:1876efc119b99332a5cc2b08a6bdaada2f0ad94b596f0372a497e2aa8bda4d94", size = 2515203, upload-time = "2025-12-10T17:54:52.555Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/5f/ee02a3a1237282d324f596a50923bf9d2cb1b1230ef2fef49fb4d3563c2c/grimp-3.14-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:3ccf03e65864d6bc7bf1c003c319f5330a7627b3677f31143f11691a088464c2", size = 2177150, upload-time = "2025-12-10T17:53:46.145Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/64/2a92889e5fc78e8ef5c548e6a5c6fed78b817eeb0253aca586c28108393a/grimp-3.14-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:9ecd58fa58a270e7523f8bec9e6452f4fdb9c21e4cd370640829f1e43fa87a69", size = 2109280, upload-time = "2025-12-10T17:53:23.345Z" },
+    { url = "https://files.pythonhosted.org/packages/69/02/5d0b9ab54821e7fbdeb02f3919fa2cb8b9f0c3869fa6e4b969a5766f0ffa/grimp-3.14-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0d75d1f8f7944978b39b08d870315174f1ffcd5123be6ccff8ce90467ace648a", size = 2283367, upload-time = "2025-12-10T17:52:11.875Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/96/a77c40c92faf7500f42ac019ab8de108b04ffe3db8ec8d6f90416d2322ce/grimp-3.14-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6f70bbb1dd6055d08d29e39a78a11c4118c1778b39d17cd8271e18e213524ca7", size = 2237125, upload-time = "2025-12-10T17:52:24.606Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/5e/3e1483721c83057bff921cf454dd5ff3e661ae1d2e63150a380382d116c2/grimp-3.14-cp314-cp314-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0f21b7c003626c902669dc26ede83a91220cf0a81b51b27128370998c2f247b4", size = 2391735, upload-time = "2025-12-10T17:53:05.619Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/cb/25fad4a174fe672d42f3e5616761a8120a3b03c8e9e2ae3f31159561968a/grimp-3.14-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:80d9f056415c936b45561310296374c4319b5df0003da802c84d2830a103792a", size = 2571388, upload-time = "2025-12-10T17:52:39.337Z" },
+    { url = "https://files.pythonhosted.org/packages/29/7e/456df7f6a765ce3f160eb32a0f64ed0c1c3cd39b518555dde02087f9b6e4/grimp-3.14-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:0332963cd63a45863775d4237e59dedf95455e0a1ea50c356be23100c5fc1d7c", size = 2359637, upload-time = "2025-12-10T17:52:53.341Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/98/3e5005ef21a4e2243f0da489aba86aaaff0bc11d5240d67113482cba88e0/grimp-3.14-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7f4144350d074f2058fe7c89230a26b34296b161f085b0471a692cb2fe27036f", size = 2308335, upload-time = "2025-12-10T17:53:13.893Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/03/4e055f756946d6f71ab7e9d1f8536a9e476777093dd7a050f40412d1a2b1/grimp-3.14-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e148e67975e92f90a8435b1b4c02180b9a3f3d725b7a188ba63793f1b1e445a0", size = 2463680, upload-time = "2025-12-10T17:53:55.507Z" },
+    { url = "https://files.pythonhosted.org/packages/26/b9/3c76b7c2e1587e4303a6eff6587c2117c3a7efe1b100cd13d8a4a5613572/grimp-3.14-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:1093f7770cb5f3ca6f99fb152f9c949381cc0b078dfdfe598c8ab99abaccda3b", size = 2502808, upload-time = "2025-12-10T17:54:25.383Z" },
+    { url = "https://files.pythonhosted.org/packages/20/80/ada10b85ad3125ebedea10256d9c568b6bf28339d2f79d2d196a7b94f633/grimp-3.14-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:a213f45ec69e9c2b28ffd3ba5ab12cc9859da17083ba4dc39317f2083b618111", size = 2504013, upload-time = "2025-12-10T17:54:39.762Z" },
+    { url = "https://files.pythonhosted.org/packages/05/45/7c369f749d50b0ceac23cd6874ca4695cc1359a96091c7010301e5c8b619/grimp-3.14-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5f003ac3f226d2437a49af0b6036f26edba57f8a32d329275dbde1b2b2a00a56", size = 2515043, upload-time = "2025-12-10T17:54:54.437Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/32/85135fe83826ce11ae56a340d32a1391b91eed94d25ce7bc318019f735de/grimp-3.14-cp314-cp314-win32.whl", hash = "sha256:eec81be65a18f4b2af014b1e97296cc9ee20d1115529bf70dd7e06f457eac30b", size = 1877509, upload-time = "2025-12-10T17:55:17.062Z" },
+    { url = "https://files.pythonhosted.org/packages/db/61/e4a2234edecb3bb3cff8963bc4ec5cc482a9e3c54f8df0946d7d90003830/grimp-3.14-cp314-cp314-win_amd64.whl", hash = "sha256:cd3bab6164f1d5e313678f0ab4bf45955afe7f5bdb0f2f481014aa9cca7e81ba", size = 2014364, upload-time = "2025-12-10T17:55:08.896Z" },
+    { url = "https://files.pythonhosted.org/packages/16/be/3d304443fbf1df4d60c09668846d0c8a605c6c95646226e41d8f5c3254da/grimp-3.14-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5b1df33de479be4d620f69633d1876858a8e64a79c07907d47cf3aaf896af057", size = 2281385, upload-time = "2025-12-10T17:52:13.668Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/13/493e2648dbb83b3fc517ee675e464beb0154551d726053c7982a3138c6a8/grimp-3.14-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:07096d4402e9d5a2c59c402ea3d601f4b7f99025f5e32f077468846fc8d3821b", size = 2231470, upload-time = "2025-12-10T17:52:26.104Z" },
+    { url = "https://files.pythonhosted.org/packages/80/84/e772b302385a6b7ec752c88f84ffe35c33d14076245ae27a635aed9c63a2/grimp-3.14-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:712bc28f46b354316af50c469c77953ba3d6cb4166a62b8fb086436a8b05d301", size = 2571579, upload-time = "2025-12-10T17:52:40.889Z" },
+    { url = "https://files.pythonhosted.org/packages/69/92/5b23aa7b89c5f4f2cfa636cbeaf33e784378a6b0a823d77a3448670dfacc/grimp-3.14-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:abe2bbef1cf8e27df636c02f60184319f138dee4f3a949405c21a4b491980397", size = 2356545, upload-time = "2025-12-10T17:52:54.887Z" },
+    { url = "https://files.pythonhosted.org/packages/15/af/bcf2116f4b1c3939ab35f9cdddd9ca59e953e57e9a0ac0c143deaf9f29cc/grimp-3.14-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:2f9ae3fabb7a7a8468ddc96acc84ecabd84f168e7ca508ee94d8f32ea9bd5de2", size = 2461022, upload-time = "2025-12-10T17:53:56.923Z" },
+    { url = "https://files.pythonhosted.org/packages/81/ce/1a076dce6bc22bca4b9ad5d1bbcd7e1023dcf7bf20ea9404c6462d78f049/grimp-3.14-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:efaf11ea73f7f12d847c54a5d6edcbe919e0369dce2d1aabae6c50792e16f816", size = 2498256, upload-time = "2025-12-10T17:54:27.214Z" },
+    { url = "https://files.pythonhosted.org/packages/45/ea/ac735bed202c1c5c019e611b92d3861779e0cfbe2d20fdb0dec94266d248/grimp-3.14-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:e089c9ab8aa755ff5af88c55891727783b4eb6b228e7bdf278e17209d954aa1e", size = 2502056, upload-time = "2025-12-10T17:54:41.537Z" },
+    { url = "https://files.pythonhosted.org/packages/80/8f/774ce522de6a7e70fbeceeaeb6fbe502f5dfb8365728fb3bb4cb23463da8/grimp-3.14-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:a424ad14d5deb56721ac24ab939747f72ab3d378d42e7d1f038317d33b052b77", size = 2515157, upload-time = "2025-12-10T17:54:55.874Z" },
+    { url = "https://files.pythonhosted.org/packages/65/cc/dbc00210d0324b8fc1242d8e857757c7e0b62ff0fc0c1bc8dcc42342da85/grimp-3.14-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7c8a8aab9b4310a7e69d7d845cac21cf14563aa0520ea322b948eadeae56d303", size = 2284804, upload-time = "2025-12-10T17:52:16.379Z" },
+    { url = "https://files.pythonhosted.org/packages/80/89/851d3d345342e9bcec3fe85d3997db29501fa59f958c1566bf3e24d9d7d9/grimp-3.14-pp311-pypy311_pp73-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:d781943b27e5875a41c8f9cfc80f8f0a349f864379192b8c3faa0e6a22593313", size = 2235176, upload-time = "2025-12-10T17:52:30.795Z" },
+    { url = "https://files.pythonhosted.org/packages/58/78/5f94702a8d5c121cafcdc9664de34c34f19d0d91a1127bf3946a2631f7a3/grimp-3.14-pp311-pypy311_pp73-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9630d4633607aff94d0ac84b9c64fef1382cdb05b00d9acbde47f8745e264871", size = 2391258, upload-time = "2025-12-10T17:53:06.906Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/a2/df8c79de5c9e227856d048cc1551c4742a5f97660c40304ac278bd48607f/grimp-3.14-pp311-pypy311_pp73-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7cb00e1bcca583668554a8e9e1e4229a1d11b0620969310aae40148829ff6a32", size = 2571443, upload-time = "2025-12-10T17:52:43.853Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/21/747b7ed9572bbdc34a76dfec12ce510e80164b1aa06d3b21b34994e5f567/grimp-3.14-pp311-pypy311_pp73-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3389da4ceaaa7f7de24a668c0afc307a9f95997bd90f81ec359a828a9bd1d270", size = 2357767, upload-time = "2025-12-10T17:52:57.84Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/e6/485c5e3b64933e71f72f0cc45b0d7130418a6a5a13cedc2e8411bd76f290/grimp-3.14-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cd7a32970ef97e42d4e7369397c7795287d84a736d788ccb90b6c14f0561d975", size = 2309069, upload-time = "2025-12-10T17:53:15.203Z" },
+    { url = "https://files.pythonhosted.org/packages/31/bd/12024a8cba1c77facc1422a7b48cd0d04c252fc9178fd6f99dc05a8af57b/grimp-3.14-pp311-pypy311_pp73-musllinux_1_2_aarch64.whl", hash = "sha256:fd1278623fa09f62abc0fd8a6500f31b421a1fd479980f44c2926020a0becf02", size = 2466429, upload-time = "2025-12-10T17:54:00.286Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/7f/0e5977887e1c8f00f84bb4125217534806ffdcef9cf52f3580aa3b151f4b/grimp-3.14-pp311-pypy311_pp73-musllinux_1_2_armv7l.whl", hash = "sha256:9cfa52c89333d3d8fe9dc782529e888270d060231c3783e036d424044671dde0", size = 2501190, upload-time = "2025-12-10T17:54:30.107Z" },
+    { url = "https://files.pythonhosted.org/packages/42/6b/06acb94b6d0d8c7277bb3e33f93224aa3be5b04643f853479d3bf7b23ace/grimp-3.14-pp311-pypy311_pp73-musllinux_1_2_i686.whl", hash = "sha256:48a5be4a12fca6587e6885b4fc13b9e242ab8bf874519292f0f13814aecf52cc", size = 2503440, upload-time = "2025-12-10T17:54:44.444Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/4d/2e531370d12e7a564f67f680234710bbc08554238a54991cd244feb61fb6/grimp-3.14-pp311-pypy311_pp73-musllinux_1_2_x86_64.whl", hash = "sha256:3fcc332466783a12a42cd317fd344c30fe734ba4fa2362efff132dc3f8d36da7", size = 2516525, upload-time = "2025-12-10T17:54:58.987Z" },
+]
+
 [[package]]
 name = "h11"
 version = "0.16.0"
@@ -773,16 +908,31 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/94/16/70255075a9859a0e3adb789b68ceb0e210dec03934245fd98d248226572f/idna-3.16-py3-none-any.whl", hash = "sha256:cc246e3a3f89580c3a951b5ad298ca4638078b2cdd4f115654332b5c26daded5", size = 74165, upload-time = "2026-05-22T00:16:16.698Z" },
 ]
 
+[[package]]
+name = "import-linter"
+version = "2.11"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "click" },
+    { name = "grimp" },
+    { name = "rich" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ba/66/55b697a17bb15c6cb88d97d73716813f5427281527b90f02cc0a600abc6e/import_linter-2.11.tar.gz", hash = "sha256:5abc3394797a54f9bae315e7242dc98715ba485f840ac38c6d3192c370d0085e", size = 1153682, upload-time = "2026-03-06T12:11:38.198Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e9/aa/2ed2c89543632ded7196e0d93dcc6c7fe87769e88391a648c4a298ea864a/import_linter-2.11-py3-none-any.whl", hash = "sha256:3dc54cae933bae3430358c30989762b721c77aa99d424f56a08265be0eeaa465", size = 637315, upload-time = "2026-03-06T12:11:36.599Z" },
+]
+
 [[package]]
 name = "importlib-metadata"
-version = "9.0.0"
+version = "8.7.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "zipp", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a9/01/15bb152d77b21318514a96f43af312635eb2500c96b55398d020c93d86ea/importlib_metadata-9.0.0.tar.gz", hash = "sha256:a4f57ab599e6a2e3016d7595cfd72eb4661a5106e787a95bcc90c7105b831efc", size = 56405, upload-time = "2026-03-20T06:42:56.999Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f3/49/3b30cad09e7771a4982d9975a8cbf64f00d4a1ececb53297f1d9a7be1b10/importlib_metadata-8.7.1.tar.gz", hash = "sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb", size = 57107, upload-time = "2025-12-21T10:00:19.278Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/38/3d/2d244233ac4f76e38533cfcb2991c9eb4c7bf688ae0a036d30725b8faafe/importlib_metadata-9.0.0-py3-none-any.whl", hash = "sha256:2d21d1cc5a017bd0559e36150c21c830ab1dc304dedd1b7ea85d20f45ef3edd7", size = 27789, upload-time = "2026-03-20T06:42:55.665Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/5e/f8e9a1d23b9c20a551a8a02ea3637b4642e22c2626e3a13a9a29cdea99eb/importlib_metadata-8.7.1-py3-none-any.whl", hash = "sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151", size = 27865, upload-time = "2025-12-21T10:00:18.329Z" },
 ]
 
 [[package]]
@@ -959,6 +1109,66 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/81/db/e655086b7f3a705df045bf0933bdd9c2f79bb3c97bfef1384598bb79a217/keyring-25.7.0-py3-none-any.whl", hash = "sha256:be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f", size = 39160, upload-time = "2025-11-16T16:26:08.402Z" },
 ]
 
+[[package]]
+name = "libcst"
+version = "1.8.6"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pyyaml", marker = "python_full_version != '3.13.*'" },
+    { name = "pyyaml-ft", marker = "python_full_version == '3.13.*'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/de/cd/337df968b38d94c5aabd3e1b10630f047a2b345f6e1d4456bd9fe7417537/libcst-1.8.6.tar.gz", hash = "sha256:f729c37c9317126da9475bdd06a7208eb52fcbd180a6341648b45a56b4ba708b", size = 891354, upload-time = "2025-11-03T22:33:30.621Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dc/15/95c2ecadc0fb4af8a7057ac2012a4c0ad5921b9ef1ace6c20006b56d3b5f/libcst-1.8.6-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:3649a813660fbffd7bc24d3f810b1f75ac98bd40d9d6f56d1f0ee38579021073", size = 2211289, upload-time = "2025-11-03T22:32:04.673Z" },
+    { url = "https://files.pythonhosted.org/packages/80/c3/7e1107acd5ed15cf60cc07c7bb64498a33042dc4821874aea3ec4942f3cd/libcst-1.8.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:0cbe17067055829607c5ba4afa46bfa4d0dd554c0b5a583546e690b7367a29b6", size = 2092927, upload-time = "2025-11-03T22:32:06.209Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/ff/0d2be87f67e2841a4a37d35505e74b65991d30693295c46fc0380ace0454/libcst-1.8.6-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:59a7e388c57d21d63722018978a8ddba7b176e3a99bd34b9b84a576ed53f2978", size = 2237002, upload-time = "2025-11-03T22:32:07.559Z" },
+    { url = "https://files.pythonhosted.org/packages/69/99/8c4a1b35c7894ccd7d33eae01ac8967122f43da41325223181ca7e4738fe/libcst-1.8.6-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:b6c1248cc62952a3a005792b10cdef2a4e130847be9c74f33a7d617486f7e532", size = 2301048, upload-time = "2025-11-03T22:32:08.869Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/8b/d1aa811eacf936cccfb386ae0585aa530ea1221ccf528d67144e041f5915/libcst-1.8.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:6421a930b028c5ef4a943b32a5a78b7f1bf15138214525a2088f11acbb7d3d64", size = 2300675, upload-time = "2025-11-03T22:32:10.579Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/6b/7b65cd41f25a10c1fef2389ddc5c2b2cc23dc4d648083fa3e1aa7e0eeac2/libcst-1.8.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:6d8b67874f2188399a71a71731e1ba2d1a2c3173b7565d1cc7ffb32e8fbaba5b", size = 2407934, upload-time = "2025-11-03T22:32:11.856Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/8b/401cfff374bb3b785adfad78f05225225767ee190997176b2a9da9ed9460/libcst-1.8.6-cp311-cp311-win_amd64.whl", hash = "sha256:b0d8c364c44ae343937f474b2e492c1040df96d94530377c2f9263fb77096e4f", size = 2119247, upload-time = "2025-11-03T22:32:13.279Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/17/085f59eaa044b6ff6bc42148a5449df2b7f0ba567307de7782fe85c39ee2/libcst-1.8.6-cp311-cp311-win_arm64.whl", hash = "sha256:5dcaaebc835dfe5755bc85f9b186fb7e2895dda78e805e577fef1011d51d5a5c", size = 2001774, upload-time = "2025-11-03T22:32:14.647Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/3c/93365c17da3d42b055a8edb0e1e99f1c60c776471db6c9b7f1ddf6a44b28/libcst-1.8.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:0c13d5bd3d8414a129e9dccaf0e5785108a4441e9b266e1e5e9d1f82d1b943c9", size = 2206166, upload-time = "2025-11-03T22:32:16.012Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/cb/7530940e6ac50c6dd6022349721074e19309eb6aa296e942ede2213c1a19/libcst-1.8.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f1472eeafd67cdb22544e59cf3bfc25d23dc94058a68cf41f6654ff4fcb92e09", size = 2083726, upload-time = "2025-11-03T22:32:17.312Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/cf/7e5eaa8c8f2c54913160671575351d129170db757bb5e4b7faffed022271/libcst-1.8.6-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:089c58e75cb142ec33738a1a4ea7760a28b40c078ab2fd26b270dac7d2633a4d", size = 2235755, upload-time = "2025-11-03T22:32:18.859Z" },
+    { url = "https://files.pythonhosted.org/packages/55/54/570ec2b0e9a3de0af9922e3bb1b69a5429beefbc753a7ea770a27ad308bd/libcst-1.8.6-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:c9d7aeafb1b07d25a964b148c0dda9451efb47bbbf67756e16eeae65004b0eb5", size = 2301473, upload-time = "2025-11-03T22:32:20.499Z" },
+    { url = "https://files.pythonhosted.org/packages/11/4c/163457d1717cd12181c421a4cca493454bcabd143fc7e53313bc6a4ad82a/libcst-1.8.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:207481197afd328aa91d02670c15b48d0256e676ce1ad4bafb6dc2b593cc58f1", size = 2298899, upload-time = "2025-11-03T22:32:21.765Z" },
+    { url = "https://files.pythonhosted.org/packages/35/1d/317ddef3669883619ef3d3395ea583305f353ef4ad87d7a5ac1c39be38e3/libcst-1.8.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:375965f34cc6f09f5f809244d3ff9bd4f6cb6699f571121cebce53622e7e0b86", size = 2408239, upload-time = "2025-11-03T22:32:23.275Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/a1/f47d8cccf74e212dd6044b9d6dbc223636508da99acff1d54786653196bc/libcst-1.8.6-cp312-cp312-win_amd64.whl", hash = "sha256:da95b38693b989eaa8d32e452e8261cfa77fe5babfef1d8d2ac25af8c4aa7e6d", size = 2119660, upload-time = "2025-11-03T22:32:24.822Z" },
+    { url = "https://files.pythonhosted.org/packages/19/d0/dd313bf6a7942cdf951828f07ecc1a7695263f385065edc75ef3016a3cb5/libcst-1.8.6-cp312-cp312-win_arm64.whl", hash = "sha256:bff00e1c766658adbd09a175267f8b2f7616e5ee70ce45db3d7c4ce6d9f6bec7", size = 1999824, upload-time = "2025-11-03T22:32:26.131Z" },
+    { url = "https://files.pythonhosted.org/packages/90/01/723cd467ec267e712480c772aacc5aa73f82370c9665162fd12c41b0065b/libcst-1.8.6-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7445479ebe7d1aff0ee094ab5a1c7718e1ad78d33e3241e1a1ec65dcdbc22ffb", size = 2206386, upload-time = "2025-11-03T22:32:27.422Z" },
+    { url = "https://files.pythonhosted.org/packages/17/50/b944944f910f24c094f9b083f76f61e3985af5a376f5342a21e01e2d1a81/libcst-1.8.6-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:4fc3fef8a2c983e7abf5d633e1884c5dd6fa0dcb8f6e32035abd3d3803a3a196", size = 2083945, upload-time = "2025-11-03T22:32:28.847Z" },
+    { url = "https://files.pythonhosted.org/packages/36/a1/bd1b2b2b7f153d82301cdaddba787f4a9fc781816df6bdb295ca5f88b7cf/libcst-1.8.6-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:1a3a5e4ee870907aa85a4076c914ae69066715a2741b821d9bf16f9579de1105", size = 2235818, upload-time = "2025-11-03T22:32:30.504Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/ab/f5433988acc3b4d188c4bb154e57837df9488cc9ab551267cdeabd3bb5e7/libcst-1.8.6-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:6609291c41f7ad0bac570bfca5af8fea1f4a27987d30a1fa8b67fe5e67e6c78d", size = 2301289, upload-time = "2025-11-03T22:32:31.812Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/57/89f4ba7a6f1ac274eec9903a9e9174890d2198266eee8c00bc27eb45ecf7/libcst-1.8.6-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:25eaeae6567091443b5374b4c7d33a33636a2d58f5eda02135e96fc6c8807786", size = 2299230, upload-time = "2025-11-03T22:32:33.242Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/36/0aa693bc24cce163a942df49d36bf47a7ed614a0cd5598eee2623bc31913/libcst-1.8.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:04030ea4d39d69a65873b1d4d877def1c3951a7ada1824242539e399b8763d30", size = 2408519, upload-time = "2025-11-03T22:32:34.678Z" },
+    { url = "https://files.pythonhosted.org/packages/db/18/6dd055b5f15afa640fb3304b2ee9df8b7f72e79513814dbd0a78638f4a0e/libcst-1.8.6-cp313-cp313-win_amd64.whl", hash = "sha256:8066f1b70f21a2961e96bedf48649f27dfd5ea68be5cd1bed3742b047f14acde", size = 2119853, upload-time = "2025-11-03T22:32:36.287Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/ed/5ddb2a22f0b0abdd6dcffa40621ada1feaf252a15e5b2733a0a85dfd0429/libcst-1.8.6-cp313-cp313-win_arm64.whl", hash = "sha256:c188d06b583900e662cd791a3f962a8c96d3dfc9b36ea315be39e0a4c4792ebf", size = 1999808, upload-time = "2025-11-03T22:32:38.1Z" },
+    { url = "https://files.pythonhosted.org/packages/25/d3/72b2de2c40b97e1ef4a1a1db4e5e52163fc7e7740ffef3846d30bc0096b5/libcst-1.8.6-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:c41c76e034a1094afed7057023b1d8967f968782433f7299cd170eaa01ec033e", size = 2190553, upload-time = "2025-11-03T22:32:39.819Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/20/983b7b210ccc3ad94a82db54230e92599c4a11b9cfc7ce3bc97c1d2df75c/libcst-1.8.6-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:5432e785322aba3170352f6e72b32bea58d28abd141ac37cc9b0bf6b7c778f58", size = 2074717, upload-time = "2025-11-03T22:32:41.373Z" },
+    { url = "https://files.pythonhosted.org/packages/13/f2/9e01678fedc772e09672ed99930de7355757035780d65d59266fcee212b8/libcst-1.8.6-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:85b7025795b796dea5284d290ff69de5089fc8e989b25d6f6f15b6800be7167f", size = 2225834, upload-time = "2025-11-03T22:32:42.716Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/0d/7bed847b5c8c365e9f1953da274edc87577042bee5a5af21fba63276e756/libcst-1.8.6-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:536567441182a62fb706e7aa954aca034827b19746832205953b2c725d254a93", size = 2287107, upload-time = "2025-11-03T22:32:44.549Z" },
+    { url = "https://files.pythonhosted.org/packages/02/f0/7e51fa84ade26c518bfbe7e2e4758b56d86a114c72d60309ac0d350426c4/libcst-1.8.6-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:2f04d3672bde1704f383a19e8f8331521abdbc1ed13abb349325a02ac56e5012", size = 2288672, upload-time = "2025-11-03T22:32:45.867Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/cd/15762659a3f5799d36aab1bc2b7e732672722e249d7800e3c5f943b41250/libcst-1.8.6-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:7f04febcd70e1e67917be7de513c8d4749d2e09206798558d7fe632134426ea4", size = 2392661, upload-time = "2025-11-03T22:32:47.232Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/6b/b7f9246c323910fcbe021241500f82e357521495dcfe419004dbb272c7cb/libcst-1.8.6-cp313-cp313t-win_amd64.whl", hash = "sha256:1dc3b897c8b0f7323412da3f4ad12b16b909150efc42238e19cbf19b561cc330", size = 2105068, upload-time = "2025-11-03T22:32:49.145Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/0b/4fd40607bc4807ec2b93b054594373d7fa3d31bb983789901afcb9bcebe9/libcst-1.8.6-cp313-cp313t-win_arm64.whl", hash = "sha256:44f38139fa95e488db0f8976f9c7ca39a64d6bc09f2eceef260aa1f6da6a2e42", size = 1985181, upload-time = "2025-11-03T22:32:50.597Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/60/4105441989e321f7ad0fd28ffccb83eb6aac0b7cfb0366dab855dcccfbe5/libcst-1.8.6-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:b188e626ce61de5ad1f95161b8557beb39253de4ec74fc9b1f25593324a0279c", size = 2204202, upload-time = "2025-11-03T22:32:52.311Z" },
+    { url = "https://files.pythonhosted.org/packages/67/2f/51a6f285c3a183e50cfe5269d4a533c21625aac2c8de5cdf2d41f079320d/libcst-1.8.6-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:87e74f7d7dfcba9efa91127081e22331d7c42515f0a0ac6e81d4cf2c3ed14661", size = 2083581, upload-time = "2025-11-03T22:32:54.269Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/64/921b1c19b638860af76cdb28bc81d430056592910b9478eea49e31a7f47a/libcst-1.8.6-cp314-cp314-manylinux_2_28_aarch64.whl", hash = "sha256:3a926a4b42015ee24ddfc8ae940c97bd99483d286b315b3ce82f3bafd9f53474", size = 2236495, upload-time = "2025-11-03T22:32:55.723Z" },
+    { url = "https://files.pythonhosted.org/packages/12/a8/b00592f9bede618cbb3df6ffe802fc65f1d1c03d48a10d353b108057d09c/libcst-1.8.6-cp314-cp314-manylinux_2_28_x86_64.whl", hash = "sha256:3f4fbb7f569e69fd9e89d9d9caa57ca42c577c28ed05062f96a8c207594e75b8", size = 2301466, upload-time = "2025-11-03T22:32:57.337Z" },
+    { url = "https://files.pythonhosted.org/packages/af/df/790d9002f31580fefd0aec2f373a0f5da99070e04c5e8b1c995d0104f303/libcst-1.8.6-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:08bd63a8ce674be431260649e70fca1d43f1554f1591eac657f403ff8ef82c7a", size = 2300264, upload-time = "2025-11-03T22:32:58.852Z" },
+    { url = "https://files.pythonhosted.org/packages/21/de/dc3f10e65bab461be5de57850d2910a02c24c3ddb0da28f0e6e4133c3487/libcst-1.8.6-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:e00e275d4ba95d4963431ea3e409aa407566a74ee2bf309a402f84fc744abe47", size = 2408572, upload-time = "2025-11-03T22:33:00.552Z" },
+    { url = "https://files.pythonhosted.org/packages/20/3b/35645157a7590891038b077db170d6dd04335cd2e82a63bdaa78c3297dfe/libcst-1.8.6-cp314-cp314-win_amd64.whl", hash = "sha256:fea5c7fa26556eedf277d4f72779c5ede45ac3018650721edd77fd37ccd4a2d4", size = 2193917, upload-time = "2025-11-03T22:33:02.354Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/a2/1034a9ba7d3e82f2c2afaad84ba5180f601aed676d92b76325797ad60951/libcst-1.8.6-cp314-cp314-win_arm64.whl", hash = "sha256:bb9b4077bdf8857b2483879cbbf70f1073bc255b057ec5aac8a70d901bb838e9", size = 2078748, upload-time = "2025-11-03T22:33:03.707Z" },
+    { url = "https://files.pythonhosted.org/packages/95/a1/30bc61e8719f721a5562f77695e6154e9092d1bdf467aa35d0806dcd6cea/libcst-1.8.6-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:55ec021a296960c92e5a33b8d93e8ad4182b0eab657021f45262510a58223de1", size = 2188980, upload-time = "2025-11-03T22:33:05.152Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/14/c660204532407c5628e3b615015a902ed2d0b884b77714a6bdbe73350910/libcst-1.8.6-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:ba9ab2b012fbd53b36cafd8f4440a6b60e7e487cd8b87428e57336b7f38409a4", size = 2074828, upload-time = "2025-11-03T22:33:06.864Z" },
+    { url = "https://files.pythonhosted.org/packages/82/e2/c497c354943dff644749f177ee9737b09ed811b8fc842b05709a40fe0d1b/libcst-1.8.6-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:c0a0cc80aebd8aa15609dd4d330611cbc05e9b4216bcaeabba7189f99ef07c28", size = 2225568, upload-time = "2025-11-03T22:33:08.354Z" },
+    { url = "https://files.pythonhosted.org/packages/86/ef/45999676d07bd6d0eefa28109b4f97124db114e92f9e108de42ba46a8028/libcst-1.8.6-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:42a4f68121e2e9c29f49c97f6154e8527cd31021809cc4a941c7270aa64f41aa", size = 2286523, upload-time = "2025-11-03T22:33:10.206Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/6c/517d8bf57d9f811862f4125358caaf8cd3320a01291b3af08f7b50719db4/libcst-1.8.6-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:8a434c521fadaf9680788b50d5c21f4048fa85ed19d7d70bd40549fbaeeecab1", size = 2288044, upload-time = "2025-11-03T22:33:11.628Z" },
+    { url = "https://files.pythonhosted.org/packages/83/ce/24d7d49478ffb61207f229239879845da40a374965874f5ee60f96b02ddb/libcst-1.8.6-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6a65f844d813ab4ef351443badffa0ae358f98821561d19e18b3190f59e71996", size = 2392605, upload-time = "2025-11-03T22:33:12.962Z" },
+    { url = "https://files.pythonhosted.org/packages/39/c3/829092ead738b71e96a4e96896c96f276976e5a8a58b4473ed813d7c962b/libcst-1.8.6-cp314-cp314t-win_amd64.whl", hash = "sha256:bdb14bc4d4d83a57062fed2c5da93ecb426ff65b0dc02ddf3481040f5f074a82", size = 2181581, upload-time = "2025-11-03T22:33:14.514Z" },
+    { url = "https://files.pythonhosted.org/packages/98/6d/5d6a790a02eb0d9d36c4aed4f41b277497e6178900b2fa29c35353aa45ed/libcst-1.8.6-cp314-cp314t-win_arm64.whl", hash = "sha256:819c8081e2948635cab60c603e1bbdceccdfe19104a242530ad38a36222cb88f", size = 2065000, upload-time = "2025-11-03T22:33:16.257Z" },
+]
+
 [[package]]
 name = "librt"
 version = "0.11.0"
@@ -1032,6 +1242,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ce/62/b40b382fa0c66fee1478073eb8db352a4a6beda4a1adccf1df911d8c289c/librt-0.11.0-cp314-cp314t-win_arm64.whl", hash = "sha256:dee008f20b542e3cd162ba338a7f9ec0f6d23d395f66fe8aeeec3c9d067ea253", size = 102572, upload-time = "2026-05-10T18:17:06.809Z" },
 ]
 
+[[package]]
+name = "linkify-it-py"
+version = "2.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "uc-micro-py" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/2e/c9/06ea13676ef354f0af6169587ae292d3e2406e212876a413bf9eece4eb23/linkify_it_py-2.1.0.tar.gz", hash = "sha256:43360231720999c10e9328dc3691160e27a718e280673d444c38d7d3aaa3b98b", size = 29158, upload-time = "2026-03-01T07:48:47.683Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b4/de/88b3be5c31b22333b3ca2f6ff1de4e863d8fe45aaea7485f591970ec1d3e/linkify_it_py-2.1.0-py3-none-any.whl", hash = "sha256:0d252c1594ecba2ecedc444053db5d3a9b7ec1b0dd929c8f1d74dce89f86c05e", size = 19878, upload-time = "2026-03-01T07:48:46.098Z" },
+]
+
 [[package]]
 name = "mando"
 version = "0.7.1"
@@ -1056,6 +1278,11 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b3/81/4da04ced5a082363ecfa159c010d200ecbd959ae410c10c0264a38cac0f5/markdown_it_py-4.2.0-py3-none-any.whl", hash = "sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a", size = 91687, upload-time = "2026-05-07T12:08:27.182Z" },
 ]
 
+[package.optional-dependencies]
+linkify = [
+    { name = "linkify-it-py" },
+]
+
 [[package]]
 name = "markupsafe"
 version = "3.0.3"
@@ -1130,6 +1357,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/70/bc/6f1c2f612465f5fa89b95bead1f44dcb607670fd42891d8fdcd5d039f4f4/markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa", size = 14146, upload-time = "2025-09-27T18:37:28.327Z" },
 ]
 
+[[package]]
+name = "mdit-py-plugins"
+version = "0.6.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "markdown-it-py" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/59/fc/f8d0863f8862f25602c0404d75568e89fb6b4109804645e5cdfb1be5cf56/mdit_py_plugins-0.6.1.tar.gz", hash = "sha256:a2bca0f039f39dbd35fb74ae1b5f998608c437463371f0ff7f49a19a17a114d0", size = 56114, upload-time = "2026-05-13T09:03:38.91Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a5/69/6da5581c6a7fede7dc261bf4e67d6adca4196f176b43288b55b3db395b6e/mdit_py_plugins-0.6.1-py3-none-any.whl", hash = "sha256:214c82fb2ac524472ab6a5bcab1de80f73b50443e187f401bfd77efbc7c6481d", size = 66663, upload-time = "2026-05-13T09:03:37.76Z" },
+]
+
 [[package]]
 name = "mdurl"
 version = "0.1.2"
@@ -1148,6 +1387,23 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/e8/3d/1087453384dbde46a8c7f9356eead2c58be8a7bf156bca40243377c85715/more_itertools-11.1.0-py3-none-any.whl", hash = "sha256:4b65538ae22f6fed0ce4874efd317463a7489796a0939fa66824dd542125a192", size = 72226, upload-time = "2026-05-22T14:14:28.824Z" },
 ]
 
+[[package]]
+name = "mutmut"
+version = "3.5.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "click" },
+    { name = "coverage" },
+    { name = "libcst" },
+    { name = "pytest" },
+    { name = "setproctitle" },
+    { name = "textual" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ac/0d/9ce4fc8b219504a336eb814c5a7ea8e379ad93ce05327ff3842aea93bf0b/mutmut-3.5.0.tar.gz", hash = "sha256:548186d4b0c494b7b9895db82871cb1f229b9271c9ff7cd633e348dd9afcc772", size = 36389, upload-time = "2026-02-22T18:46:41.824Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4f/23/ac475f6db39643946feb09290a2178d603d2b623034d56d3f5059cddb769/mutmut-3.5.0-py3-none-any.whl", hash = "sha256:f19f2dd2e977eb9dc17255d8cb11e24fbfc3191620fba3108cac25779c9d78c9", size = 34242, upload-time = "2026-02-22T18:46:43.113Z" },
+]
+
 [[package]]
 name = "mypy"
 version = "2.1.0"
@@ -1587,6 +1843,30 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f1/12/de94a39c2ef588c7e6455cfbe7343d3b2dc9d6b6b2f40c4c6565744c873d/pyyaml-6.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b", size = 149341, upload-time = "2025-09-25T21:32:56.828Z" },
 ]
 
+[[package]]
+name = "pyyaml-ft"
+version = "8.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/5e/eb/5a0d575de784f9a1f94e2b1288c6886f13f34185e13117ed530f32b6f8a8/pyyaml_ft-8.0.0.tar.gz", hash = "sha256:0c947dce03954c7b5d38869ed4878b2e6ff1d44b08a0d84dc83fdad205ae39ab", size = 141057, upload-time = "2025-06-10T15:32:15.613Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/68/ba/a067369fe61a2e57fb38732562927d5bae088c73cb9bb5438736a9555b29/pyyaml_ft-8.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8c1306282bc958bfda31237f900eb52c9bedf9b93a11f82e1aab004c9a5657a6", size = 187027, upload-time = "2025-06-10T15:31:48.722Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/c5/a3d2020ce5ccfc6aede0d45bcb870298652ac0cf199f67714d250e0cdf39/pyyaml_ft-8.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:30c5f1751625786c19de751e3130fc345ebcba6a86f6bddd6e1285342f4bbb69", size = 176146, upload-time = "2025-06-10T15:31:50.584Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/bb/23a9739291086ca0d3189eac7cd92b4d00e9fdc77d722ab610c35f9a82ba/pyyaml_ft-8.0.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3fa992481155ddda2e303fcc74c79c05eddcdbc907b888d3d9ce3ff3e2adcfb0", size = 746792, upload-time = "2025-06-10T15:31:52.304Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/c2/e8825f4ff725b7e560d62a3609e31d735318068e1079539ebfde397ea03e/pyyaml_ft-8.0.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cec6c92b4207004b62dfad1f0be321c9f04725e0f271c16247d8b39c3bf3ea42", size = 786772, upload-time = "2025-06-10T15:31:54.712Z" },
+    { url = "https://files.pythonhosted.org/packages/35/be/58a4dcae8854f2fdca9b28d9495298fd5571a50d8430b1c3033ec95d2d0e/pyyaml_ft-8.0.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:06237267dbcab70d4c0e9436d8f719f04a51123f0ca2694c00dd4b68c338e40b", size = 778723, upload-time = "2025-06-10T15:31:56.093Z" },
+    { url = "https://files.pythonhosted.org/packages/86/ed/fed0da92b5d5d7340a082e3802d84c6dc9d5fa142954404c41a544c1cb92/pyyaml_ft-8.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:8a7f332bc565817644cdb38ffe4739e44c3e18c55793f75dddb87630f03fc254", size = 758478, upload-time = "2025-06-10T15:31:58.314Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/69/ac02afe286275980ecb2dcdc0156617389b7e0c0a3fcdedf155c67be2b80/pyyaml_ft-8.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:7d10175a746be65f6feb86224df5d6bc5c049ebf52b89a88cf1cd78af5a367a8", size = 799159, upload-time = "2025-06-10T15:31:59.675Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/ac/c492a9da2e39abdff4c3094ec54acac9747743f36428281fb186a03fab76/pyyaml_ft-8.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:58e1015098cf8d8aec82f360789c16283b88ca670fe4275ef6c48c5e30b22a96", size = 158779, upload-time = "2025-06-10T15:32:01.029Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/9b/41998df3298960d7c67653669f37710fa2d568a5fc933ea24a6df60acaf6/pyyaml_ft-8.0.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:e64fa5f3e2ceb790d50602b2fd4ec37abbd760a8c778e46354df647e7c5a4ebb", size = 191331, upload-time = "2025-06-10T15:32:02.602Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/16/2710c252ee04cbd74d9562ebba709e5a284faeb8ada88fcda548c9191b47/pyyaml_ft-8.0.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:8d445bf6ea16bb93c37b42fdacfb2f94c8e92a79ba9e12768c96ecde867046d1", size = 182879, upload-time = "2025-06-10T15:32:04.466Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/40/ae8163519d937fa7bfa457b6f78439cc6831a7c2b170e4f612f7eda71815/pyyaml_ft-8.0.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8c56bb46b4fda34cbb92a9446a841da3982cdde6ea13de3fbd80db7eeeab8b49", size = 811277, upload-time = "2025-06-10T15:32:06.214Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/66/28d82dbff7f87b96f0eeac79b7d972a96b4980c1e445eb6a857ba91eda00/pyyaml_ft-8.0.0-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:dab0abb46eb1780da486f022dce034b952c8ae40753627b27a626d803926483b", size = 831650, upload-time = "2025-06-10T15:32:08.076Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/df/161c4566facac7d75a9e182295c223060373d4116dead9cc53a265de60b9/pyyaml_ft-8.0.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bd48d639cab5ca50ad957b6dd632c7dd3ac02a1abe0e8196a3c24a52f5db3f7a", size = 815755, upload-time = "2025-06-10T15:32:09.435Z" },
+    { url = "https://files.pythonhosted.org/packages/05/10/f42c48fa5153204f42eaa945e8d1fd7c10d6296841dcb2447bf7da1be5c4/pyyaml_ft-8.0.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:052561b89d5b2a8e1289f326d060e794c21fa068aa11255fe71d65baf18a632e", size = 810403, upload-time = "2025-06-10T15:32:11.051Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/d2/e369064aa51009eb9245399fd8ad2c562bd0bcd392a00be44b2a824ded7c/pyyaml_ft-8.0.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:3bb4b927929b0cb162fb1605392a321e3333e48ce616cdcfa04a839271373255", size = 835581, upload-time = "2025-06-10T15:32:12.897Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/28/26534bed77109632a956977f60d8519049f545abc39215d086e33a61f1f2/pyyaml_ft-8.0.0-cp313-cp313t-win_amd64.whl", hash = "sha256:de04cfe9439565e32f178106c51dd6ca61afaa2907d143835d501d84703d3793", size = 171579, upload-time = "2025-06-10T15:32:14.34Z" },
+]
+
 [[package]]
 name = "questionary"
 version = "2.1.1"
@@ -1627,6 +1907,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/a0/f4/c67b0b3f1b9245e8d266f0f112c500d50e5b4e83cb6f3b71b6528104182a/requests-2.34.2-py3-none-any.whl", hash = "sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0", size = 73075, upload-time = "2026-05-14T19:25:26.443Z" },
 ]
 
+[[package]]
+name = "requirements-parser"
+version = "0.13.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "packaging" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/95/96/fb6dbfebb524d5601d359a47c78fe7ba1eef90fc4096404aa60c9a906fbb/requirements_parser-0.13.0.tar.gz", hash = "sha256:0843119ca2cb2331de4eb31b10d70462e39ace698fd660a915c247d2301a4418", size = 22630, upload-time = "2025-05-21T13:42:05.464Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bd/60/50fbb6ffb35f733654466f1a90d162bcbea358adc3b0871339254fbc37b2/requirements_parser-0.13.0-py3-none-any.whl", hash = "sha256:2b3173faecf19ec5501971b7222d38f04cb45bb9d87d0ad629ca71e2e62ded14", size = 14782, upload-time = "2025-05-21T13:42:04.007Z" },
+]
+
 [[package]]
 name = "rich"
 version = "15.0.0"
@@ -1678,6 +1970,77 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b7/46/f5af3402b579fd5e11573ce652019a67074317e18c1935cc0b4ba9b35552/secretstorage-3.5.0-py3-none-any.whl", hash = "sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137", size = 15554, upload-time = "2025-11-23T19:02:51.545Z" },
 ]
 
+[[package]]
+name = "setproctitle"
+version = "1.3.7"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8d/48/49393a96a2eef1ab418b17475fb92b8fcfad83d099e678751b05472e69de/setproctitle-1.3.7.tar.gz", hash = "sha256:bc2bc917691c1537d5b9bca1468437176809c7e11e5694ca79a9ca12345dcb9e", size = 27002, upload-time = "2025-09-05T12:51:25.278Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/cd/1b7ba5cad635510720ce19d7122154df96a2387d2a74217be552887c93e5/setproctitle-1.3.7-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:a600eeb4145fb0ee6c287cb82a2884bd4ec5bbb076921e287039dcc7b7cc6dd0", size = 18085, upload-time = "2025-09-05T12:49:22.183Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/1a/b2da0a620490aae355f9d72072ac13e901a9fec809a6a24fc6493a8f3c35/setproctitle-1.3.7-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:97a090fed480471bb175689859532709e28c085087e344bca45cf318034f70c4", size = 13097, upload-time = "2025-09-05T12:49:23.322Z" },
+    { url = "https://files.pythonhosted.org/packages/18/2e/bd03ff02432a181c1787f6fc2a678f53b7dacdd5ded69c318fe1619556e8/setproctitle-1.3.7-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:1607b963e7b53e24ec8a2cb4e0ab3ae591d7c6bf0a160feef0551da63452b37f", size = 32191, upload-time = "2025-09-05T12:49:24.567Z" },
+    { url = "https://files.pythonhosted.org/packages/28/78/1e62fc0937a8549f2220445ed2175daacee9b6764c7963b16148119b016d/setproctitle-1.3.7-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a20fb1a3974e2dab857870cf874b325b8705605cb7e7e8bcbb915bca896f52a9", size = 33203, upload-time = "2025-09-05T12:49:25.871Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/3c/65edc65db3fa3df400cf13b05e9d41a3c77517b4839ce873aa6b4043184f/setproctitle-1.3.7-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f8d961bba676e07d77665204f36cffaa260f526e7b32d07ab3df6a2c1dfb44ba", size = 34963, upload-time = "2025-09-05T12:49:27.044Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/32/89157e3de997973e306e44152522385f428e16f92f3cf113461489e1e2ee/setproctitle-1.3.7-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:db0fd964fbd3a9f8999b502f65bd2e20883fdb5b1fae3a424e66db9a793ed307", size = 32398, upload-time = "2025-09-05T12:49:28.909Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/18/77a765a339ddf046844cb4513353d8e9dcd8183da9cdba6e078713e6b0b2/setproctitle-1.3.7-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:db116850fcf7cca19492030f8d3b4b6e231278e8fe097a043957d22ce1bdf3ee", size = 33657, upload-time = "2025-09-05T12:49:30.323Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/63/f0b6205c64d74d2a24a58644a38ec77bdbaa6afc13747e75973bf8904932/setproctitle-1.3.7-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:316664d8b24a5c91ee244460bdaf7a74a707adaa9e14fbe0dc0a53168bb9aba1", size = 31836, upload-time = "2025-09-05T12:49:32.309Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/51/e1277f9ba302f1a250bbd3eedbbee747a244b3cc682eb58fb9733968f6d8/setproctitle-1.3.7-cp311-cp311-win32.whl", hash = "sha256:b74774ca471c86c09b9d5037c8451fff06bb82cd320d26ae5a01c758088c0d5d", size = 12556, upload-time = "2025-09-05T12:49:33.529Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/7b/822a23f17e9003dfdee92cd72758441ca2a3680388da813a371b716fb07f/setproctitle-1.3.7-cp311-cp311-win_amd64.whl", hash = "sha256:acb9097213a8dd3410ed9f0dc147840e45ca9797785272928d4be3f0e69e3be4", size = 13243, upload-time = "2025-09-05T12:49:34.553Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/f0/2dc88e842077719d7384d86cc47403e5102810492b33680e7dadcee64cd8/setproctitle-1.3.7-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:2dc99aec591ab6126e636b11035a70991bc1ab7a261da428491a40b84376654e", size = 18049, upload-time = "2025-09-05T12:49:36.241Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/b4/50940504466689cda65680c9e9a1e518e5750c10490639fa687489ac7013/setproctitle-1.3.7-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:cdd8aa571b7aa39840fdbea620e308a19691ff595c3a10231e9ee830339dd798", size = 13079, upload-time = "2025-09-05T12:49:38.088Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/99/71630546b9395b095f4082be41165d1078204d1696c2d9baade3de3202d0/setproctitle-1.3.7-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:2906b6c7959cdb75f46159bf0acd8cc9906cf1361c9e1ded0d065fe8f9039629", size = 32932, upload-time = "2025-09-05T12:49:39.271Z" },
+    { url = "https://files.pythonhosted.org/packages/50/22/cee06af4ffcfb0e8aba047bd44f5262e644199ae7527ae2c1f672b86495c/setproctitle-1.3.7-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6915964a6dda07920a1159321dcd6d94fc7fc526f815ca08a8063aeca3c204f1", size = 33736, upload-time = "2025-09-05T12:49:40.565Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/00/a5949a8bb06ef5e7df214fc393bb2fb6aedf0479b17214e57750dfdd0f24/setproctitle-1.3.7-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:cff72899861c765bd4021d1ff1c68d60edc129711a2fdba77f9cb69ef726a8b6", size = 35605, upload-time = "2025-09-05T12:49:42.362Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/3a/50caca532a9343828e3bf5778c7a84d6c737a249b1796d50dd680290594d/setproctitle-1.3.7-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b7cb05bd446687ff816a3aaaf831047fc4c364feff7ada94a66024f1367b448c", size = 33143, upload-time = "2025-09-05T12:49:43.515Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/14/b843a251296ce55e2e17c017d6b9f11ce0d3d070e9265de4ecad948b913d/setproctitle-1.3.7-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:3a57b9a00de8cae7e2a1f7b9f0c2ac7b69372159e16a7708aa2f38f9e5cc987a", size = 34434, upload-time = "2025-09-05T12:49:45.31Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/b7/06145c238c0a6d2c4bc881f8be230bb9f36d2bf51aff7bddcb796d5eed67/setproctitle-1.3.7-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:d8828b356114f6b308b04afe398ed93803d7fca4a955dd3abe84430e28d33739", size = 32795, upload-time = "2025-09-05T12:49:46.419Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/dc/ef76a81fac9bf27b84ed23df19c1f67391a753eed6e3c2254ebcb5133f56/setproctitle-1.3.7-cp312-cp312-win32.whl", hash = "sha256:b0304f905efc845829ac2bc791ddebb976db2885f6171f4a3de678d7ee3f7c9f", size = 12552, upload-time = "2025-09-05T12:49:47.635Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/5b/a9fe517912cd6e28cf43a212b80cb679ff179a91b623138a99796d7d18a0/setproctitle-1.3.7-cp312-cp312-win_amd64.whl", hash = "sha256:9888ceb4faea3116cf02a920ff00bfbc8cc899743e4b4ac914b03625bdc3c300", size = 13247, upload-time = "2025-09-05T12:49:49.16Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/2f/fcedcade3b307a391b6e17c774c6261a7166aed641aee00ed2aad96c63ce/setproctitle-1.3.7-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:c3736b2a423146b5e62230502e47e08e68282ff3b69bcfe08a322bee73407922", size = 18047, upload-time = "2025-09-05T12:49:50.271Z" },
+    { url = "https://files.pythonhosted.org/packages/23/ae/afc141ca9631350d0a80b8f287aac79a76f26b6af28fd8bf92dae70dc2c5/setproctitle-1.3.7-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3384e682b158d569e85a51cfbde2afd1ab57ecf93ea6651fe198d0ba451196ee", size = 13073, upload-time = "2025-09-05T12:49:51.46Z" },
+    { url = "https://files.pythonhosted.org/packages/87/ed/0a4f00315bc02510395b95eec3d4aa77c07192ee79f0baae77ea7b9603d8/setproctitle-1.3.7-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:0564a936ea687cd24dffcea35903e2a20962aa6ac20e61dd3a207652401492dd", size = 33284, upload-time = "2025-09-05T12:49:52.741Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/e4/adf3c4c0a2173cb7920dc9df710bcc67e9bcdbf377e243b7a962dc31a51a/setproctitle-1.3.7-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a5d1cb3f81531f0eb40e13246b679a1bdb58762b170303463cb06ecc296f26d0", size = 34104, upload-time = "2025-09-05T12:49:54.416Z" },
+    { url = "https://files.pythonhosted.org/packages/52/4f/6daf66394152756664257180439d37047aa9a1cfaa5e4f5ed35e93d1dc06/setproctitle-1.3.7-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a7d159e7345f343b44330cbba9194169b8590cb13dae940da47aa36a72aa9929", size = 35982, upload-time = "2025-09-05T12:49:56.295Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/62/f2c0595403cf915db031f346b0e3b2c0096050e90e0be658a64f44f4278a/setproctitle-1.3.7-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:0b5074649797fd07c72ca1f6bff0406f4a42e1194faac03ecaab765ce605866f", size = 33150, upload-time = "2025-09-05T12:49:58.025Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/29/10dd41cde849fb2f9b626c846b7ea30c99c81a18a5037a45cc4ba33c19a7/setproctitle-1.3.7-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:61e96febced3f61b766115381d97a21a6265a0f29188a791f6df7ed777aef698", size = 34463, upload-time = "2025-09-05T12:49:59.424Z" },
+    { url = "https://files.pythonhosted.org/packages/71/3c/cedd8eccfaf15fb73a2c20525b68c9477518917c9437737fa0fda91e378f/setproctitle-1.3.7-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:047138279f9463f06b858e579cc79580fbf7a04554d24e6bddf8fe5dddbe3d4c", size = 32848, upload-time = "2025-09-05T12:50:01.107Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/3e/0a0e27d1c9926fecccfd1f91796c244416c70bf6bca448d988638faea81d/setproctitle-1.3.7-cp313-cp313-win32.whl", hash = "sha256:7f47accafac7fe6535ba8ba9efd59df9d84a6214565108d0ebb1199119c9cbbd", size = 12544, upload-time = "2025-09-05T12:50:15.81Z" },
+    { url = "https://files.pythonhosted.org/packages/36/1b/6bf4cb7acbbd5c846ede1c3f4d6b4ee52744d402e43546826da065ff2ab7/setproctitle-1.3.7-cp313-cp313-win_amd64.whl", hash = "sha256:fe5ca35aeec6dc50cabab9bf2d12fbc9067eede7ff4fe92b8f5b99d92e21263f", size = 13235, upload-time = "2025-09-05T12:50:16.89Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/a4/d588d3497d4714750e3eaf269e9e8985449203d82b16b933c39bd3fc52a1/setproctitle-1.3.7-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:10e92915c4b3086b1586933a36faf4f92f903c5554f3c34102d18c7d3f5378e9", size = 18058, upload-time = "2025-09-05T12:50:02.501Z" },
+    { url = "https://files.pythonhosted.org/packages/05/77/7637f7682322a7244e07c373881c7e982567e2cb1dd2f31bd31481e45500/setproctitle-1.3.7-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:de879e9c2eab637f34b1a14c4da1e030c12658cdc69ee1b3e5be81b380163ce5", size = 13072, upload-time = "2025-09-05T12:50:03.601Z" },
+    { url = "https://files.pythonhosted.org/packages/52/09/f366eca0973cfbac1470068d1313fa3fe3de4a594683385204ec7f1c4101/setproctitle-1.3.7-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:c18246d88e227a5b16248687514f95642505000442165f4b7db354d39d0e4c29", size = 34490, upload-time = "2025-09-05T12:50:04.948Z" },
+    { url = "https://files.pythonhosted.org/packages/71/36/611fc2ed149fdea17c3677e1d0df30d8186eef9562acc248682b91312706/setproctitle-1.3.7-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7081f193dab22df2c36f9fc6d113f3793f83c27891af8fe30c64d89d9a37e152", size = 35267, upload-time = "2025-09-05T12:50:06.015Z" },
+    { url = "https://files.pythonhosted.org/packages/88/a4/64e77d0671446bd5a5554387b69e1efd915274686844bea733714c828813/setproctitle-1.3.7-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9cc9b901ce129350637426a89cfd650066a4adc6899e47822e2478a74023ff7c", size = 37376, upload-time = "2025-09-05T12:50:07.484Z" },
+    { url = "https://files.pythonhosted.org/packages/89/bc/ad9c664fe524fb4a4b2d3663661a5c63453ce851736171e454fa2cdec35c/setproctitle-1.3.7-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:80e177eff2d1ec172188d0d7fd9694f8e43d3aab76a6f5f929bee7bf7894e98b", size = 33963, upload-time = "2025-09-05T12:50:09.056Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/01/a36de7caf2d90c4c28678da1466b47495cbbad43badb4e982d8db8167ed4/setproctitle-1.3.7-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:23e520776c445478a67ee71b2a3c1ffdafbe1f9f677239e03d7e2cc635954e18", size = 35550, upload-time = "2025-09-05T12:50:10.791Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/68/17e8aea0ed5ebc17fbf03ed2562bfab277c280e3625850c38d92a7b5fcd9/setproctitle-1.3.7-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:5fa1953126a3b9bd47049d58c51b9dac72e78ed120459bd3aceb1bacee72357c", size = 33727, upload-time = "2025-09-05T12:50:12.032Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/33/90a3bf43fe3a2242b4618aa799c672270250b5780667898f30663fd94993/setproctitle-1.3.7-cp313-cp313t-win32.whl", hash = "sha256:4a5e212bf438a4dbeece763f4962ad472c6008ff6702e230b4f16a037e2f6f29", size = 12549, upload-time = "2025-09-05T12:50:13.074Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/0e/50d1f07f3032e1f23d814ad6462bc0a138f369967c72494286b8a5228e40/setproctitle-1.3.7-cp313-cp313t-win_amd64.whl", hash = "sha256:cf2727b733e90b4f874bac53e3092aa0413fe1ea6d4f153f01207e6ce65034d9", size = 13243, upload-time = "2025-09-05T12:50:14.146Z" },
+    { url = "https://files.pythonhosted.org/packages/89/c7/43ac3a98414f91d1b86a276bc2f799ad0b4b010e08497a95750d5bc42803/setproctitle-1.3.7-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:80c36c6a87ff72eabf621d0c79b66f3bdd0ecc79e873c1e9f0651ee8bf215c63", size = 18052, upload-time = "2025-09-05T12:50:17.928Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/2c/dc258600a25e1a1f04948073826bebc55e18dbd99dc65a576277a82146fa/setproctitle-1.3.7-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:b53602371a52b91c80aaf578b5ada29d311d12b8a69c0c17fbc35b76a1fd4f2e", size = 13071, upload-time = "2025-09-05T12:50:19.061Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/26/8e3bb082992f19823d831f3d62a89409deb6092e72fc6940962983ffc94f/setproctitle-1.3.7-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:fcb966a6c57cf07cc9448321a08f3be6b11b7635be502669bc1d8745115d7e7f", size = 33180, upload-time = "2025-09-05T12:50:20.395Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/af/ae692a20276d1159dd0cf77b0bcf92cbb954b965655eb4a69672099bb214/setproctitle-1.3.7-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:46178672599b940368d769474fe13ecef1b587d58bb438ea72b9987f74c56ea5", size = 34043, upload-time = "2025-09-05T12:50:22.454Z" },
+    { url = "https://files.pythonhosted.org/packages/34/b2/6a092076324dd4dac1a6d38482bedebbff5cf34ef29f58585ec76e47bc9d/setproctitle-1.3.7-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7f9e9e3ff135cbcc3edd2f4cf29b139f4aca040d931573102742db70ff428c17", size = 35892, upload-time = "2025-09-05T12:50:23.937Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/1a/8836b9f28cee32859ac36c3df85aa03e1ff4598d23ea17ca2e96b5845a8f/setproctitle-1.3.7-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:14c7eba8d90c93b0e79c01f0bd92a37b61983c27d6d7d5a3b5defd599113d60e", size = 32898, upload-time = "2025-09-05T12:50:25.617Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/22/8fabdc24baf42defb599714799d8445fe3ae987ec425a26ec8e80ea38f8e/setproctitle-1.3.7-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:9e64e98077fb30b6cf98073d6c439cd91deb8ebbf8fc62d9dbf52bd38b0c6ac0", size = 34308, upload-time = "2025-09-05T12:50:26.827Z" },
+    { url = "https://files.pythonhosted.org/packages/15/1b/b9bee9de6c8cdcb3b3a6cb0b3e773afdb86bbbc1665a3bfa424a4294fda2/setproctitle-1.3.7-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:b91387cc0f02a00ac95dcd93f066242d3cca10ff9e6153de7ee07069c6f0f7c8", size = 32536, upload-time = "2025-09-05T12:50:28.5Z" },
+    { url = "https://files.pythonhosted.org/packages/37/0c/75e5f2685a5e3eda0b39a8b158d6d8895d6daf3ba86dec9e3ba021510272/setproctitle-1.3.7-cp314-cp314-win32.whl", hash = "sha256:52b054a61c99d1b72fba58b7f5486e04b20fefc6961cd76722b424c187f362ed", size = 12731, upload-time = "2025-09-05T12:50:43.955Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/ae/acddbce90d1361e1786e1fb421bc25baeb0c22ef244ee5d0176511769ec8/setproctitle-1.3.7-cp314-cp314-win_amd64.whl", hash = "sha256:5818e4080ac04da1851b3ec71e8a0f64e3748bf9849045180566d8b736702416", size = 13464, upload-time = "2025-09-05T12:50:45.057Z" },
+    { url = "https://files.pythonhosted.org/packages/01/6d/20886c8ff2e6d85e3cabadab6aab9bb90acaf1a5cfcb04d633f8d61b2626/setproctitle-1.3.7-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:6fc87caf9e323ac426910306c3e5d3205cd9f8dcac06d233fcafe9337f0928a3", size = 18062, upload-time = "2025-09-05T12:50:29.78Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/60/26dfc5f198715f1343b95c2f7a1c16ae9ffa45bd89ffd45a60ed258d24ea/setproctitle-1.3.7-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:6134c63853d87a4897ba7d5cc0e16abfa687f6c66fc09f262bb70d67718f2309", size = 13075, upload-time = "2025-09-05T12:50:31.604Z" },
+    { url = "https://files.pythonhosted.org/packages/21/9c/980b01f50d51345dd513047e3ba9e96468134b9181319093e61db1c47188/setproctitle-1.3.7-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:1403d2abfd32790b6369916e2313dffbe87d6b11dca5bbd898981bcde48e7a2b", size = 34744, upload-time = "2025-09-05T12:50:32.777Z" },
+    { url = "https://files.pythonhosted.org/packages/86/b4/82cd0c86e6d1c4538e1a7eb908c7517721513b801dff4ba3f98ef816a240/setproctitle-1.3.7-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e7c5bfe4228ea22373e3025965d1a4116097e555ee3436044f5c954a5e63ac45", size = 35589, upload-time = "2025-09-05T12:50:34.13Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/4f/9f6b2a7417fd45673037554021c888b31247f7594ff4bd2239918c5cd6d0/setproctitle-1.3.7-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:585edf25e54e21a94ccb0fe81ad32b9196b69ebc4fc25f81da81fb8a50cca9e4", size = 37698, upload-time = "2025-09-05T12:50:35.524Z" },
+    { url = "https://files.pythonhosted.org/packages/20/92/927b7d4744aac214d149c892cb5fa6dc6f49cfa040cb2b0a844acd63dcaf/setproctitle-1.3.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:96c38cdeef9036eb2724c2210e8d0b93224e709af68c435d46a4733a3675fee1", size = 34201, upload-time = "2025-09-05T12:50:36.697Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/0c/fd4901db5ba4b9d9013e62f61d9c18d52290497f956745cd3e91b0d80f90/setproctitle-1.3.7-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:45e3ef48350abb49cf937d0a8ba15e42cee1e5ae13ca41a77c66d1abc27a5070", size = 35801, upload-time = "2025-09-05T12:50:38.314Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/e3/54b496ac724e60e61cc3447f02690105901ca6d90da0377dffe49ff99fc7/setproctitle-1.3.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:1fae595d032b30dab4d659bece20debd202229fce12b55abab978b7f30783d73", size = 33958, upload-time = "2025-09-05T12:50:39.841Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/a8/c84bb045ebf8c6fdc7f7532319e86f8380d14bbd3084e6348df56bdfe6fd/setproctitle-1.3.7-cp314-cp314t-win32.whl", hash = "sha256:02432f26f5d1329ab22279ff863c83589894977063f59e6c4b4845804a08f8c2", size = 12745, upload-time = "2025-09-05T12:50:41.377Z" },
+    { url = "https://files.pythonhosted.org/packages/08/b6/3a5a4f9952972791a9114ac01dfc123f0df79903577a3e0a7a404a695586/setproctitle-1.3.7-cp314-cp314t-win_amd64.whl", hash = "sha256:cbc388e3d86da1f766d8fc2e12682e446064c01cea9f88a88647cfe7c011de6a", size = 13469, upload-time = "2025-09-05T12:50:42.67Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/5b/5e1c117ac84e3cefcf8d7a7f6b2461795a87e20869da065a5c087149060b/setproctitle-1.3.7-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:b1cac6a4b0252b8811d60b6d8d0f157c0fdfed379ac89c25a914e6346cf355a1", size = 12587, upload-time = "2025-09-05T12:51:21.195Z" },
+    { url = "https://files.pythonhosted.org/packages/73/02/b9eadc226195dcfa90eed37afe56b5dd6fa2f0e5220ab8b7867b8862b926/setproctitle-1.3.7-pp311-pypy311_pp73-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f1704c9e041f2b1dc38f5be4552e141e1432fba3dd52c72eeffd5bc2db04dc65", size = 14286, upload-time = "2025-09-05T12:51:22.61Z" },
+    { url = "https://files.pythonhosted.org/packages/28/26/1be1d2a53c2a91ec48fa2ff4a409b395f836798adf194d99de9c059419ea/setproctitle-1.3.7-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:b08b61976ffa548bd5349ce54404bf6b2d51bd74d4f1b241ed1b0f25bce09c3a", size = 13282, upload-time = "2025-09-05T12:51:24.094Z" },
+]
+
 [[package]]
 name = "shellingham"
 version = "1.5.4"
@@ -1755,6 +2118,23 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/4e/18/dc99a152bea18a898a8ac387bfeb9ec0829e0f5bed11cfec2e2ca189c5a2/syrupy-5.2.0-py3-none-any.whl", hash = "sha256:798cb493a6e20f4839e58ea8f10eb1b0d85684c676442f79786e219bf32618e6", size = 51828, upload-time = "2026-05-16T21:11:34.984Z" },
 ]
 
+[[package]]
+name = "textual"
+version = "8.2.7"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "markdown-it-py", extra = ["linkify"] },
+    { name = "mdit-py-plugins" },
+    { name = "platformdirs" },
+    { name = "pygments" },
+    { name = "rich" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/9b/7a/c519db0aba5024f86e71e9631810bfdd6866ed2c8695bd7fa34b90e7ef59/textual-8.2.7.tar.gz", hash = "sha256:658f568ff81e30ed43890c3e07520390e5cf1b4763822006e060656b0a88f105", size = 1859249, upload-time = "2026-05-19T10:52:49.531Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a8/f5/c1e18bc0707300a0e90204343abbf7d7acd6fb7ebe03a6d4893b99a234b8/textual-8.2.7-py3-none-any.whl", hash = "sha256:4caaa13a90bc4cf9c6c862c067ccd34fe84e9c161710a2a907a8026313b6bd73", size = 731129, upload-time = "2026-05-19T10:52:51.773Z" },
+]
+
 [[package]]
 name = "tomli"
 version = "2.4.1"
@@ -1866,6 +2246,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/dc/9b/47798a6c91d8bdb567fe2698fe81e0c6b7cb7ef4d13da4114b41d239f65d/typing_inspection-0.4.2-py3-none-any.whl", hash = "sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7", size = 14611, upload-time = "2025-10-01T02:14:40.154Z" },
 ]
 
+[[package]]
+name = "uc-micro-py"
+version = "2.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/78/67/9a363818028526e2d4579334460df777115bdec1bb77c08f9db88f6389f2/uc_micro_py-2.0.0.tar.gz", hash = "sha256:c53691e495c8db60e16ffc4861a35469b0ba0821fe409a8a7a0a71864d33a811", size = 6611, upload-time = "2026-03-01T06:31:27.526Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/61/73/d21edf5b204d1467e06500080a50f79d49ef2b997c79123a536d4a17d97c/uc_micro_py-2.0.0-py3-none-any.whl", hash = "sha256:3603a3859af53e5a39bc7677713c78ea6589ff188d70f4fee165db88e22b242c", size = 6383, upload-time = "2026-03-01T06:31:26.257Z" },
+]
+
 [[package]]
 name = "urllib3"
 version = "2.7.0"
@@ -1903,6 +2292,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/f4/34/a9dbe051de88a63eb7408ea66630bac38e72f7f6077d4be58737106860d9/virtualenv-21.3.3-py3-none-any.whl", hash = "sha256:7d5987d8369e098e41406efb780a3d4ca79280097293899e351a6407ee153ab3", size = 7594554, upload-time = "2026-05-13T18:01:27.815Z" },
 ]
 
+[[package]]
+name = "vulture"
+version = "2.16"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/66/3e/4d08c5903b2c0c70cad583c170cc4a663fc6a61e2ad00b711fcda61358cd/vulture-2.16.tar.gz", hash = "sha256:f8d9f6e2af03011664a3c6c240c9765b3f392917d3135fddca6d6a68d359f717", size = 52680, upload-time = "2026-03-25T14:41:27.141Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f5/be/f935130312330614811dae2ea9df3f395f6d63889eb6c2e68c14507152ee/vulture-2.16-py3-none-any.whl", hash = "sha256:6e0f1c312cef1c87856957e5c2ca9608834a7c794c2180477f30bf0e4cc58eee", size = 26993, upload-time = "2026-03-25T14:41:26.21Z" },
+]
+
 [[package]]
 name = "wcwidth"
 version = "0.7.0"