@agiledigital/pingone-aic-script-tester 0.1.0

package/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agile Digital
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,274 @@
+# rhino-local TypeScript package
+
+Two jobs, one package:
+
+1. Generate the **scripted-decision mock binding surface** from the captured AM
+   contexts metadata at `docs/api/bindings/scripted-decision-next.json`.
+2. Talk to the long-lived host-JVM runner so tests can eval scripts without
+   starting a JVM per case.
+
+The generator emits presence, not behaviour: every method throws
+`rhino-local: not mocked: <binding>.<method> arity=N overload=[…]` until the
+handwritten overlay in `src/bindings/rhino/runtime.cjs` replaces it. A mock
+that returned `undefined` would turn a missing feature into a passing test.
+
+Implemented (still fail-loud for missing fixtures and for every method the
+overlay does not replace): `nodeState` get/putShared/putTransient/isDefined,
+legacy `sharedState`/`transientState` when `given.engine === "legacy"`,
+request maps, `outcome` / `action.goTo`, `logger`, `openidm`, `httpClient`,
+`callbacksBuilder` (the six authenticate-response types), `systemEnv`,
+`idRepository.getIdentity`, next-gen `require()` (CommonJS eval of seeded
+library bodies; a missing id throws naming `given.libraries`), legacy
+`JavaImporter` + `Action.send(HiddenValueCallback)`. End-to-end cases live
+in `cases/`.
+
+## Using the installed package
+
+```sh
+npm install --save-dev @agiledigital/pingone-aic-script-tester vitest zod
+```
+
+**Requirements**:
+
+- Node 24.
+- A Java 25 **runtime**. The runner classes are prebuilt, so no `javac` is
+  needed. Use `AIC_SCRIPT_TESTER_JAVA_HOME` or `JAVA_HOME`, else `java` on `PATH`.
+- `vitest` and `zod`, as peer dependencies.
+
+The first run downloads the Rhino jar from Maven Central and checks it by
+SHA-256. On a machine without access, point `AIC_SCRIPT_TESTER_RHINO_JAR` at a copy
+instead. `npx aic-script-tester-fetch-jar` fills the cache ahead of time.
+
+A suite runs on the local lane by default:
+
+```ts
+import { describe, expect, it } from "vitest";
+import { z } from "zod";
+import { defineSuite, useLease } from "@agiledigital/pingone-aic-script-tester";
+
+const suite = defineSuite({
+  name: "greet",
+  script: 'if (nodeState.get("userId") === "alice") { action.goTo("known"); } else { action.goTo("unknown"); }',
+  outcomes: ["known", "unknown"],
+  inputs: z.object({ userId: z.string() }),
+});
+
+describe("greet", () => {
+  const lease = useLease(suite);
+  it("knows alice", async () => {
+    const run = await lease.run({ userId: "alice" }).expect({ outcome: "known" });
+    expect(run.verdict.summary).toBe("");
+  });
+});
+```
+
+To run the same suite against a tenant, spread `aicWhenEnabled("<unique-id>")`
+into the `useLease` options, then run with `AIC_SCRIPT_TESTER_AIC=1`. The tenant
+comes from the first of these that is configured:
+
+1. a `provider` passed in the options;
+2. a provider registered with `setTenantProvider()`, typically from a Vitest
+   `setupFiles` module;
+3. the environment: `AIC_SCRIPT_TESTER_TENANT_URL` (https, no path), plus either
+   `AIC_SCRIPT_TESTER_SA_ID` with `AIC_SCRIPT_TESTER_SA_JWK` or `AIC_SCRIPT_TESTER_SA_JWK_FILE`,
+   plus optional `AIC_SCRIPT_TESTER_LOG_KEY_ID` and `AIC_SCRIPT_TESTER_LOG_KEY_SECRET`;
+4. the `aic` CLI (`AIC_BIN`).
+
+A partial environment configuration is an error rather than a fallthrough.
+
+```ts
+// test/tenant.setup.ts — list it in vitest.config's test.setupFiles
+import { setTenantProvider, tokenCallbackProvider } from "@agiledigital/pingone-aic-script-tester/aic";
+
+setTenantProvider(
+  tokenCallbackProvider({
+    baseUrl: "https://tenant.example.com",
+    // Called again with reason "rejected" after a 401; don't return the same token.
+    getToken: async ({ reason }) => fetchBearerSomehow(reason),
+    // Optional, and needed only for aic-script-tester-show-log.
+    logKeys: { id: process.env.LOG_KEY_ID!, secret: process.env.LOG_KEY_SECRET! },
+  })
+);
+```
+
+**State.** Failure records, the log view and environment profiles can all
+contain tenant data. They go to `<project>/.aic-script-tester/`, which writes its own
+`*` `.gitignore`; the files are `0600`. `<project>` is the nearest ancestor with
+a `.git`. `AIC_SCRIPT_TESTER_PROJECT` overrides the project and `AIC_SCRIPT_TESTER_STATE_DIR`
+overrides the directory.
+
+**Bins.** Both commands that talk to a tenant take
+`--provider-module <file>`. That is the same setup module, or any module whose
+default export is a `TenantProvider`. It exists because a bin runs in its own
+process, where the Vitest registration does not reach.
+
+- `aic-script-tester-pull-profile [--tenant <name>]` writes
+  `.aic-script-tester/profiles/<tenant>.json`. It prints only counts.
+- `aic-script-tester-show-log [--stdout]` fetches the logs of recorded failures. It
+  writes them to `.aic-script-tester/failures/latest-logs.json`, and opens that in
+  `$LOGS_EDITOR` or `$EDITOR` if one is set. `--stdout` prints them instead;
+  don't use it in CI.
+
+**Entry points:**
+
+| Import | What it provides |
+| --- | --- |
+| `.` | the harness |
+| `./case` | case definition and judging |
+| `./aic` | providers and `setTenantProvider` |
+| `./profile` | `pullProfile` and the profile store |
+| `./diagnostics` | failure records, `runShowLog` and `loadProviderModule` |
+| `./bindings` | the bindings runtime |
+| `./runner` | `RhinoRunner` |
+
+More detail lives in this repository's `docs/rhino-local-harness.md`, which is
+not shipped with the package.
+
+## JVM runner client
+
+`src/runner.ts` launches Java 25 from `AIC_SCRIPT_TESTER_JAVA_HOME` or `JAVA_HOME`
+(`shell.nix` provides `temurin-bin-25`) and speaks line-delimited JSON.
+`AIC_SCRIPT_TESTER_JVM` selects `host` (default), `container`, or `both`; the latter
+lanes require Docker and the AM image. The cache defaults to
+`~/.cache/aic-script-tester`; `AIC_SCRIPT_TESTER_CACHE` overrides it. Correlate by job `id`
+— do not assume the JVM answers in order. A crashed JVM rejects every pending
+job rather than hanging. `close()` ends stdin and waits for the process;
+`afterAll` should call it.
+
+Job shape (open enough to carry later mock bindings):
+
+- `source` / `sourceName` — author's script; `sourceName` is Rhino's source
+  name, so a parse error names the author's file and line, not `<eval>`
+- `globals` — JSON values placed in ENGINE_SCOPE Bindings
+- `preamble` — evaluated first so concatenating mocks into `source` is not
+  needed (that would shift line numbers)
+- `timeoutMs` — per-job; AM's `Error("Interrupt.")` past the instruction
+  observer. Omit for the runner's 10s harness default; `0` is AM's no-timeout
+
+Outcomes are machine-readable and distinct: `ok`, `compile_error`,
+`runtime_error`, `timeout`.
+
+## Artefacts
+
+Committed under `generated/`:
+
+- `scripted-decision-mocks.cjs` — evaluated inside AM's Rhino as part of the
+  script-under-test's scope
+- `scripted-decision-mocks.d.ts` — TypeScript types for case authors
+
+They are committed on purpose. Regenerating after Ping adds a method produces a
+diff of the surface, which is the point of generating rather than hand-writing.
+
+## Re-run
+
+From this directory (Node 24):
+
+```bash
+npm install
+npm run generate
+npm test
+npm run typecheck
+npm run lint
+npm run lint:am
+npm run measure   # JVM startup + per-job timings
+npm run show-log  # fetch AIC logs for a failed test (needs `aic login`)
+```
+
+When a test that hit the AIC lane fails, `useLease` appends a JSONL record to
+`.aic-script-tester/failures/failures.jsonl`. `npm run show-log` lists those records
+newest first and fetches their logs from the tenant provider: the `aic` CLI's
+`aic logs tx`, or the log API when log keys are configured. It fetches the
+stem first, so one call covers a whole authenticate chain, and it never issues
+a range query. It writes the logs to the 0600 view described above.
+
+## Per-file AIC lease
+
+Opt a suite into automatic local-versus-AIC checking through `useLease`:
+
+```ts
+const lease = useLease(suite, {
+  aic: {
+    id: "resolve-identity",
+    realm: "alpha",
+    unsupported: "fail",
+  },
+});
+```
+
+`id` is a stable, repository-chosen lease identity. The adapter opens one
+deterministically named journey before the file, replaces and confirms its
+subject script for each run, invokes it, and deletes the graph after the file.
+`realm` defaults to `alpha` and seeds the same realm into the local lane;
+`tenant` selects an AIC context, and `project` selects the CLI project and
+binary location. Both are optional and otherwise use the current defaults.
+The returned `RunResult.conformance` contains the per-pass AIC verdict,
+disagreements, and observation gaps. A file may have only one AIC-enabled
+`useLease`; split different scripts or outcome vocabularies into separate test
+files.
+
+Unsupported input fails by default. `unsupported: "skip"` is the explicit
+opt-out for a suite that must retain skip behaviour. Step and final `check()`
+hooks replay against a tenant-backed `IdmHandle` at their matching response
+boundaries. Suite `cleanup()` runs afterwards in a `finally`, before fixture
+deletion, even if a check throws. The remote handle returns full materialized
+tenant records rather than projecting them to the local mock's shape, so assert
+the fields a check needs instead of whole-record equality. An AIC-only throw is
+reported as a lane disagreement naming the remote hook.
+
+Object-form queries reject values that cannot be represented faithfully as the
+measured CREST `eq` filter (quotes, nulls, arrays/objects, control characters,
+and non-finite numbers) before making a request. Unknown fields are not
+preflighted because AIC reports them as a successful zero-row query.
+
+Every AM write is followed by a confirming read. A process lock excludes the
+same lease on one host, and an identifier-only journal makes stale owned
+resources discoverable after process death. Simultaneous use of the same
+`aic.id` on different hosts is unsupported because no atomic AM create
+precondition has been established. Generated subject and session-minter source
+can contain test seeds while a lease is open; never put credentials or real
+secrets in them.
+
+For capacity planning only, the design estimate uses `O` distinct subject
+outcomes after adding `true` and `false`, and `R = 2O + 3` graph resources. For
+`N` one-pass cases without managed fixtures or sessions, the base call count is
+`2 + 4R + 3N`: two CLI session calls, three calls per resource at
+open, one delete per resource at close, and three calls per case. At the
+smallest `R = 9`, that is an estimated `38 + 3N`, or 68 calls for ten cases.
+Each `IdmHandle` read, encodable query, or delete in checks/cleanup adds one REST
+call. Each additional outcome adds an estimated eight file-lifetime calls.
+Step chains, managed fixtures, session minting, and credential refresh add
+calls too.
+
+`runAicChain()` remains the one-shot compatibility facade for external callers.
+It provisions and deletes a throwaway graph per call. `useLease()` uses the
+pre-opened file runner and does not route through that facade.
+
+`npm run generate` reads the captured JSON (offline; it does not call the
+tenant) and overwrites the two artefacts. Completeness tests fail if the
+artefacts drift from the JSON, if a method is dropped, or if you forget to
+regenerate after changing the emitter.
+
+## The `.cjs` is AM-safe JavaScript
+
+The generated mock is **not** Node. AM's Rhino 1.7.14 rejects or silently
+miscompiles a large slice of ES2015; the rules are runtime-verified in
+`docs/api/12-script-bindings-matrix.md` and encoded in
+`src/scripts/templates/am/eslint.config.js`. The emitter stays inside that
+subset:
+
+- `var` at top level; **no `let`**; **no top-level `const`** (parses, then
+  reads back `undefined` in a scripted-decision script)
+- **no `for...of`**, object shorthand, destructuring, or default parameters
+- **no `Map` / `Set` / `Symbol` / `Promise` / `WeakMap` / `WeakSet`**
+- `function () { … arguments … }` for methods (no rest parameters)
+- `const` _inside a function_ is allowed; this file just does not need it
+
+`npm run lint:am` runs those Rhino rules over `generated/*.cjs`. The generator
+itself is ordinary TypeScript and has no such limits.
+
+## What the JSON does not name
+
+Empty-`elements` bindings (`requestHeaders`, `requestParameters`,
+`requestCookies`, `locales`) are emitted as `{}` — a seam a test case seeds
+directly. Scalar bindings (`realm`, `scriptName`, `cookieName`) start as
+`"__rhino-local-unseeded__"`; `resumedFromSuspend` starts as `false`.

package/dist/bin/fetch-jar.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/fetch-jar.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * Download and verify the pinned Rhino jar into the cache, and print its path.
+ *
+ *   npx aic-script-tester-fetch-jar
+ *
+ * For machines that will run offline later, or CI images that pre-seed a
+ * cache. The jar is not bundled with the package (it is MPL-2.0 and 1.4 MB);
+ * a machine that cannot reach Maven Central can point AIC_SCRIPT_TESTER_RHINO_JAR at
+ * a copy instead, which is verified by the same SHA-256.
+ */
+import { ensureRhinoJar } from "../src/jvm.js";
+process.stdout.write(`${await ensureRhinoJar()}\n`);

package/dist/bin/pull-profile.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/pull-profile.js

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+/**
+ * Pull an environment's managed-object schema into a harness profile.
+ *
+ *   aic-script-tester-pull-profile [--tenant <name>] [--provider-module <file>]
+ *
+ * The tenant and bearer come from the configured tenant provider: the module
+ * named by `--provider-module`, else the AIC_SCRIPT_TESTER_TENANT_URL environment,
+ * else the current `aic` context. The bearer is never written to disk.
+ *
+ * Only counts are printed. The object names are the tenant's business
+ * vocabulary, and the tenant's name defaults to its hostname; both belong in
+ * the profile, not in a terminal or CI log.
+ */
+import { dirname, join } from "node:path";
+import { parseArgs } from "node:util";
+import { pullProfile } from "../src/profile/pull.js";
+import { loadProviderModule } from "../src/provider-module.js";
+try {
+    const { values } = parseArgs({
+        options: {
+            tenant: { type: "string" },
+            "provider-module": { type: "string" },
+        },
+    });
+    if (values["provider-module"] !== undefined) {
+        await loadProviderModule(values["provider-module"]);
+    }
+    const { profile, path } = await pullProfile(values.tenant !== undefined ? { tenant: values.tenant } : {});
+    const names = Object.keys(profile.objects);
+    const fields = names.reduce((total, name) => total + Object.keys(profile.objects[name].properties).length, 0);
+    console.log(`pulled   ${profile.pulledAt}`);
+    console.log(`objects  ${names.length} (${fields} properties)`);
+    // The file is named after the tenant, whose name defaults to its hostname.
+    console.log(`written  ${join(dirname(path), "<tenant>.json")}`);
+}
+catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+}

package/dist/bin/show-log.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/show-log.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+/**
+ * List failed AIC-lane tests and fetch their logs.
+ *
+ *   aic-script-tester-show-log [--stdout] [--provider-module <file>]
+ *
+ * The logs are written to `.aic-script-tester/failures/latest-logs.json` (0600) and
+ * opened in LOGS_EDITOR or EDITOR; `--stdout` prints them instead. Logs come
+ * from the configured tenant provider (see `--provider-module`), which must
+ * have log access: log keys, or the `aic` CLI. Fetches one transaction at a
+ * time — never a range query.
+ */
+import { parseArgs } from "node:util";
+import { createDefaultIo, runShowLog } from "../src/harness/show-log.js";
+import { loadProviderModule } from "../src/provider-module.js";
+try {
+    const { values } = parseArgs({
+        options: {
+            stdout: { type: "boolean", default: false },
+            "provider-module": { type: "string" },
+        },
+    });
+    if (values["provider-module"] !== undefined) {
+        await loadProviderModule(values["provider-module"]);
+    }
+    process.exitCode = await runShowLog(createDefaultIo(), { stdout: values.stdout });
+}
+catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+}

package/dist/classes/.complete

@@ -0,0 +1,12 @@
+2f4387af5b2f111c
+ed27b76cb8af30b744db60bc39392239b55e1925de636eefe9f8cd78b76c386c  AmClassShutter.class
+0249ef274d91e63f807f6e444c64801e3a4bbd6377fa48b51d9d04df46e842c6  AmContextFactory$ObservedContext.class
+d015aab82d1d78ea19b6c3c8737c60e54f6f446a2373c77999e950197a3bb242  AmContextFactory.class
+6fa95dff1410b7b26c1535b311c5d0c9282f21fb95bf6bde56467d909aad7040  AmScopes.class
+8e4ae16e1e3cec5e9a5b0cc8a38ee6b984a63515466df658c39149a147c9a7c6  HostOps.class
+cd137064284ce0fc178ab49787fa98acaf3ebb56197d66bbe03db19760ae174a  JsValues.class
+bf3e72ca050d36e94eebb0cedaa0b76e9f7441b990f90de1df01e16a6c0a4da9  Json$Parser.class
+64e78f7b28bbdea862c2e69b63768a66c6b85bd4ac48810483aa1264399a0ee8  Json.class
+bb691e612fb76272f33c30da85b37f232dc8cd25e2e74b31bf7f8d2412a020f9  LanguageVersions.class
+e36527b3528630aac978fcd8d88ce457d4f384462a8e45c1560680e33c3ac5a3  Runner.class
+0dec344634df70ced0ab093567d22c597968701c5aa102d9ee1a3345684695d4  ScriptContextScope.class