@bongos/core 1.19.948 → 1.19.949

package/scripts/gds/build-cli-package.js

@@ -1,534 +0,0 @@
-#!/usr/bin/env node
-// scripts/gds/build-cli-package.js — generate the public, client-only `@cloudbongos/cli`
-// npm package from this repo (task 1003679, goal 1000054).
-//
-// WHY THIS EXISTS
-// The core ships as `@bongos/core`, which is PRIVATE. That makes the front door unusable for
-// anyone without a credential: a newcomer cannot install anything, so "take on a task" has no
-// terminal path at all and the web hall is the only way in. This script cuts the CLI *surface*
-// out of the core and emits a small, public, server-free package, so `npx @cloudbongos/cli
-// login <instance>` works from a bare laptop.
-//
-// WHAT IT IS NOT
-// It does NOT publish the core. No server, no routes, no auth middleware, no pool/db, no
-// provisioning. Publishing the core would bypass the ADR 0099 redaction pipeline; this package
-// carries a file list narrow enough to actually audit, and REDACTION_PATTERNS below fails the
-// build if instance identity leaks into it.
-//
-// WHY THE FILE LIST IS DECLARED, NOT COMPUTED
-// A static require-closure is unusable here. `src/module-api.js` is the published module doorway
-// (ADR 0083) and by design *names* every kernel capability, so any static walk that reaches a
-// module file appears to reach the whole server — even though the getters are lazy and never
-// resolve. The honest instrument is behaviour: FILES is declared, and tests/cli_package.mjs packs
-// the tarball, installs it into an empty directory with no repo present, and RUNS every verb.
-// If a real code path needs a file that isn't here, that test fails with MODULE_NOT_FOUND.
-//
-// Usage:
-//   node scripts/gds/build-cli-package.js [--out dist/cloudbongos-cli] [--version 0.1.0] [--quiet]
-
-'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const REPO_ROOT = path.join(__dirname, '..', '..');
-
-// The package's OWN version — deliberately independent of the core's. The core moves many times
-// a day (CI auto-patch, ADR 0161); the CLI's public contract should not.
-const PACKAGE_VERSION = '0.1.3';
-const PACKAGE_NAME = '@cloudbongos/cli';
-
-// ── What the package carries ────────────────────────────────────────────────────────────────
-// Every entry is repo-relative and copied verbatim. Grouped by why it's here, because the
-// grouping is the audit: anything that doesn't fit a group below does not belong in a public
-// client package.
-const FILES = [
-  // The shared CLI plumbing every verb goes through: session file, HTTP, error shapes.
-  'scripts/gds/cli-lib.js',
-  'scripts/gds/api.js',
-
-  // Account + sign-in. login.js is the whole point — GitHub device flow, no paste, no credential.
-  'scripts/gds/login.js',
-  'scripts/gds/reauth.js',
-  'scripts/gds/setup.js',
-  'scripts/gds/device-flow-help.js', // shared leaf: login.js + setup.js both require it (task 1003881)
-  'scripts/gds/onboarding-config.js', // lazy dep of setup.js
-  'scripts/gds/install-git-hooks.js', // lazy dep of setup.js
-  'scripts/gds/preflight.js',
-  'scripts/gds/surface.js',   // who the output is for: agent vs terminal (task 1003680)
-  'scripts/gds/plain-cards.js', // required by cli-lib + release; prints nothing on the terminal surface (task 1003989)
-  // The partial-checkout preflight (task 1003098). start/claim/ship require it
-  // ABOVE their first module require, so an absent file here breaks every verb in
-  // the published package -- which is exactly how tests/cli_package.mjs caught it.
-  // Pure: node builtins only, no repo, no network.
-  'scripts/gds/tree-preflight.js',
-
-  // Read the board and move your own work along.
-  'scripts/gds/start.js',
-  'scripts/gds/context-pack.js', // start.js renders through this
-  'scripts/gds/status.js',
-  // status.js resolves its default version at runtime instead of naming one
-  // (task 1004071) -- so the packaged CLI needs this too, or `bongos status`
-  // dies on a missing module. tests/cli_package.mjs caught exactly that.
-  'scripts/gds/version-select.js',
-  'scripts/gds/task.js',
-  'scripts/gds/recall.js',
-  'scripts/gds/cost.js',
-  'scripts/gds/release.js',
-  'scripts/gds/worktree-claim-guard.js', // release.js warns through it; pure, zero requires
-
-  // Module files the above touch. Each imports nothing from the kernel at load time.
-  'modules/lifecycle/task-classifier.js',
-  'modules/lifecycle/task-visuals.js',
-  // The criterion-ref vocabulary status.js resolves a `Cn` or a slug through
-  // (task 1004069). It is in modules/ because the WRITE path uses the same
-  // definition; it requires nothing, which is the whole reason it could be
-  // carved out of db-deps-criteria.js (that file needs a pool) and shipped here.
-  'modules/lifecycle/criterion-ref.js',
-  'modules/economy/reward-policy.js',
-
-  // The only core files in the package: config/branding readers and one constant table.
-  // src/module-api.js is here because task-classifier.js reads branding through the doorway
-  // (ADR 0083 forbids a module importing src/branding directly). Its `branding` getter resolves
-  // against src/branding.js, which ships; the other getters point at server files that do not,
-  // and no client path touches them — the smoke test is what proves that.
-  'src/branding.js',
-  'src/instance-config.js',
-  'src/module-seams.js',
-  'src/module-api.js',
-  'src/bongos/api-prefix.js',
-
-  // The generated typed API client (ADR 0118), which cli-lib.js reaches by a dynamic
-  // `import()` of this exact path. Vendored as a single file rather than depended on: it is not
-  // published to npm at all (task 1003742 — it was private, had zero consumers, and was removed),
-  // so there is nothing to declare a dependency ON. Vendoring was already the right call while it
-  // was merely private, since a public package cannot depend on a private one. index.mjs is
-  // self-contained and imports nothing; the sibling package.json is deliberately NOT shipped —
-  // a nested manifest only confuses packing.
-  'clients/bongos-client/index.mjs',
-
-  // Neutral branding defaults, so the CLI has sane strings with no instance checkout present.
-  'config/branding.neutral.json',
-];
-
-// Paths that must NEVER appear in the generated tree, whatever FILES says. A belt-and-braces
-// assertion against a future edit quietly widening the package back into the server.
-const FORBIDDEN_PREFIXES = [
-  'src/bongos/routes/',
-  'src/server',
-  'migrations/',
-  'infra/',
-  'public/',
-  'modules/hall-ui/',
-  '.github/',
-];
-const FORBIDDEN_BASENAMES = [
-  'pool.js', 'auth.js', 'db.js', 'server.js', 'serve-internal.js',
-  'logger.js', 'project-door.js', 'project-settings.js',
-];
-// src/bongos/ is the kernel. Exactly one file from it is allowed, and it imports nothing.
-const ALLOWED_SRC_BONGOS = new Set(['src/bongos/api-prefix.js']);
-
-// ── The verbs the package advertises ────────────────────────────────────────────────────────
-// `script` is resolved inside the package. Keep in lockstep with FILES.
-const VERBS = {
-  login:   { script: 'login.js',   group: 'account', summary: 'Sign in to an instance  (bongos login <url> — browser click, no paste)' },
-  reauth:  { script: 'reauth.js',  group: 'account', summary: 'Refresh your session' },
-  setup:   { script: 'setup.js',   group: 'account', summary: 'Finish builder setup on this instance (disciplines, consent)' },
-
-  start:   { script: 'start.js',   group: 'work', summary: 'List tasks you can claim right now' },
-  status:  { script: 'status.js',  group: 'work', summary: 'Version / criterion progress  (bongos status C8)', selfHelp: true },
-  task:    { script: 'task.js',    group: 'work', summary: 'Create or show a task', selfHelp: true },
-  recall:  { script: 'recall.js',  group: 'work', summary: 'Search the docs + project knowledge  (bongos recall "x")' },
-  cost:    { script: 'cost.js',    group: 'work', summary: 'Log a cost entry' },
-  release: { script: 'release.js', group: 'work', summary: 'Cancel a claim — task returns to ready' },
-
-  api:     { script: 'api.js',     group: 'work', summary: 'Call any instance endpoint  (bongos api GET /api/bongos/me)' },
-};
-
-// Verbs that exist in the full core CLI and are deliberately absent here. The dispatcher prints
-// the reason and the actual next step, because a newcomer hitting a bare "unknown command" learns
-// nothing — that silence is the exact failure this whole task is fixing.
-//
-// The next step used to be CONDITIONAL prose offering a cloud dev box first. The dev box was
-// retired (task 1003889), so the one unconditional route — a checkout of the project repo — is
-// now the only branch. ADR 0258's exclusion of claim/ship is UNCHANGED and deliberate: this is
-// the PRE-checkout CLI, and a claim that cannot materialise into a checkout is worse than one
-// that says where to go.
-const CHECKOUT_ONLY = {
-  claim:   'Claiming a task writes code, so it needs a real checkout and a worktree.',
-  ship:    'Shipping grades, merges and deploys from a real checkout.',
-  dev:     'Runs an instance locally — needs the instance repo.',
-  serve:   'Runs an instance on a host — needs the instance repo.',
-  module:  'Scaffolds a module into an instance repo.',
-  upgrade: 'Moves an instance to a new core version.',
-  onboard: 'Provisions new infrastructure — owner tooling, not in the public CLI.',
-  doctor:  'Checks a local checkout toolchain.',
-  exec:    'Runs a core script from inside the core package.',
-  'package-core': 'Packages the core — owner tooling.',
-};
-
-// ── Redaction gate ──────────────────────────────────────────────────────────────────────────
-// Generic shapes only. Instance-specific needles are discovered at build time from the host's
-// own config (below) so the core itself carries no instance identity — the ADR 0062 §7 split.
-const REDACTION_PATTERNS = [
-  { name: 'non-loopback IPv4', re: /\b(?!127\.|0\.0\.0\.0|255\.)(?:\d{1,3}\.){3}\d{1,3}\b/g },
-  { name: 'github token', re: /\bgh[pousr]_[A-Za-z0-9]{16,}/g },
-  { name: 'github fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
-  { name: 'npm token', re: /\bnpm_[A-Za-z0-9]{30,}/g },
-  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
-  { name: 'aws access key', re: /\bAKIA[0-9A-Z]{16}\b/g },
-];
-
-// Version strings (1.19.576) and dotted identifiers look like IPv4 to a loose regex; a real
-// address has four all-numeric octets each <= 255 and is not a semver.
-//
-// The documentation ranges (RFC 5737) and link-local are exempt: they can never name real
-// infrastructure, so they are the CORRECT thing to write in an example. Nothing else is
-// exempt — private ranges included, because an internal address still leaks topology and
-// deserves a human look before it goes public.
-const DOC_IPV4 = [/^192\.0\.2\./, /^198\.51\.100\./, /^203\.0\.113\./, /^169\.254\./];
-
-function isRealIPv4(s) {
-  const parts = s.split('.');
-  if (parts.length !== 4) return false;
-  if (!parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255)) return false;
-  return !DOC_IPV4.some((re) => re.test(s));
-}
-
-// The project's own public identity. `cloudbongos.com` is the flagship instance and the CLI's
-// documented default — the way `registry.npmjs.org` is baked into npm — so it is published on
-// purpose and must not trip the gate. Anything NOT on this list that comes out of an instance's
-// branding is treated as private identity and blocks the build.
-const PUBLIC_BY_DESIGN = new Set(['cloudbongos.com']);
-
-// Instance identity to refuse: the host's own domains and owner login, read from the instance's
-// committed branding if this checkout has one. Absent (a neutral core), the gate still runs the
-// generic patterns above.
-function instanceNeedles() {
-  const needles = new Set();
-  const add = (v) => {
-    if (typeof v !== 'string') return;
-    const s = v.trim().toLowerCase();
-    if (s.length > 3 && !PUBLIC_BY_DESIGN.has(s)) needles.add(s);
-  };
-  try {
-    const b = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'config', 'branding.json'), 'utf8'));
-    for (const v of Object.values(b.domains || {})) add(String(v).replace(/^https?:\/\//, '').replace(/\/.*$/, ''));
-    add(b.identity && b.identity.ownerLogin);
-    add(b.repo && b.repo.owner);
-  } catch (_) { /* neutral core: no instance branding, nothing to redact */ }
-  for (const extra of String(process.env.CLI_PACKAGE_FORBIDDEN || '').split(',')) add(extra);
-  return [...needles];
-}
-
-function scanRedaction(outDir, files) {
-  const needles = instanceNeedles();
-  const hits = [];
-  for (const rel of files) {
-    const abs = path.join(outDir, rel);
-    let text;
-    try { text = fs.readFileSync(abs, 'utf8'); } catch { continue; }
-    for (const { name, re } of REDACTION_PATTERNS) {
-      for (const m of text.matchAll(re)) {
-        if (name === 'non-loopback IPv4' && !isRealIPv4(m[0])) continue;
-        const line = text.slice(0, m.index).split('\n').length;
-        hits.push(`${rel}:${line}  ${name}: ${m[0]}`);
-      }
-    }
-    const lower = text.toLowerCase();
-    for (const n of needles) {
-      let i = lower.indexOf(n);
-      while (i !== -1) {
-        hits.push(`${rel}:${text.slice(0, i).split('\n').length}  instance identity: ${n}`);
-        i = lower.indexOf(n, i + n.length);
-      }
-    }
-  }
-  return hits;
-}
-
-// ── Generated files ─────────────────────────────────────────────────────────────────────────
-
-function dispatcherSource() {
-  const verbs = JSON.stringify(VERBS, null, 2).replace(/\n/g, '\n');
-  const checkout = JSON.stringify(CHECKOUT_ONLY, null, 2).replace(/\n/g, '\n');
-  return `#!/usr/bin/env node
-// bin/bongos.js — the public Cloud Bongos CLI.
-//
-// GENERATED by scripts/gds/build-cli-package.js in the Cloud Bongos core. Do not edit by hand:
-// edit the generator and rebuild.
-//
-// A thin dispatcher over the client scripts in this package. It spawns each with process.execPath
-// and forwards argv + the exit code; no auth or API logic lives here (that is cli-lib.js).
-
-'use strict';
-
-const path = require('node:path');
-const { spawnSync } = require('node:child_process');
-
-const PKG_ROOT = path.join(__dirname, '..');
-const SCRIPTS_DIR = path.join(PKG_ROOT, 'scripts', 'gds');
-const VERSION = require('../package.json').version;
-
-const VERBS = ${verbs};
-
-const CHECKOUT_ONLY = ${checkout};
-
-const GROUPS = [['account', 'Account & environment'], ['work', 'Work']];
-
-function helpText() {
-  const lines = ['bongos — the Cloud Bongos CLI', '', 'Usage:  bongos <command> [args]'];
-  lines.push('', 'First time here?');
-  lines.push('  bongos login https://your-instance.com    sign in with a browser click');
-  lines.push('  bongos start                              see what you can pick up');
-  for (const [key, label] of GROUPS) {
-    lines.push('', label + ':');
-    for (const [verb, def] of Object.entries(VERBS)) {
-      if (def.group !== key) continue;
-      lines.push('  ' + verb.padEnd(10) + ' ' + def.summary);
-    }
-  }
-  lines.push('', '  help        Show this help', '  version     Show the bongos version');
-  lines.push('');
-  lines.push('Writing code (claim, ship) happens in a checkout of the project repo,');
-  lines.push('where the full CLI is already installed.');
-  return lines.join('\\n');
-}
-
-function verbHelpText(verb, def) {
-  return [
-    'bongos ' + verb + ' — ' + def.summary,
-    '',
-    'Forwards to scripts/gds/' + def.script + '; extra arguments are passed through.',
-    'Run \`bongos help\` to see every command.',
-  ].join('\\n');
-}
-
-// Returns the exit code (does not call process.exit, so it stays testable).
-function main(argv) {
-  const args = argv.slice(2);
-  const verb = args[0];
-
-  if (!verb || verb === 'help' || verb === '--help' || verb === '-h') {
-    process.stdout.write(helpText() + '\\n');
-    return 0;
-  }
-  if (verb === 'version' || verb === '--version' || verb === '-v') {
-    process.stdout.write('bongos ' + VERSION + '\\n');
-    return 0;
-  }
-
-  if (CHECKOUT_ONLY[verb]) {
-    process.stderr.write(
-      'bongos: "' + verb + '" is not in the public CLI.\\n  ' + CHECKOUT_ONLY[verb] + '\\n\\n' +
-      'The route is a checkout of the project repo, where the full CLI\\n' +
-      '(including ' + verb + ') is installed. Ask the project owner for repo access.\\n'
-    );
-    return 2;
-  }
-
-  const def = VERBS[verb];
-  if (!def) {
-    process.stderr.write('bongos: unknown command "' + verb + '"\\n\\n' + helpText() + '\\n');
-    return 2;
-  }
-
-  if (!def.selfHelp && args.slice(1).some((a) => a === '--help' || a === '-h')) {
-    process.stdout.write(verbHelpText(verb, def) + '\\n');
-    return 0;
-  }
-
-  const target = path.join(SCRIPTS_DIR, def.script);
-  const spawnArgs = [target, ...(def.prefixArgs || []), ...args.slice(1)];
-  // Everyone reaching this package is a person at a terminal, so say so: scripts/gds/surface.js
-  // switches off the [otb-card] model directives and the /builder-* slash commands (task 1003680).
-  const res = spawnSync(process.execPath, spawnArgs, {
-    stdio: 'inherit',
-    env: { ...process.env, BONGOS_SURFACE: 'terminal' },
-  });
-  if (res.error) {
-    process.stderr.write('bongos: could not run ' + def.script + ': ' + res.error.message + '\\n');
-    return 1;
-  }
-  return res.status == null ? 1 : res.status;
-}
-
-if (require.main === module) process.exit(main(process.argv));
-module.exports = { main, helpText, VERBS, CHECKOUT_ONLY };
-`;
-}
-
-function packageJsonSource(version) {
-  // DERIVED from the manifest, never hand-listed. A hand-written `files` array silently drops
-  // whatever it forgets: the first build of this package copied clients/bongos-client/index.mjs
-  // correctly and then `npm pack` left it out, so the tarball installed and died on first use.
-  const roots = [...new Set(FILES.map((f) => f.split('/')[0] + '/'))].sort();
-  return JSON.stringify({
-    name: PACKAGE_NAME,
-    version,
-    description: 'The Cloud Bongos CLI — sign in to an instance and see what you can build. Client only: no server.',
-    bin: { bongos: 'bin/bongos.js' },
-    files: ['bin/', ...roots, 'README.md'],
-    engines: { node: '>=20' },
-    dependencies: { undici: '^6.19.8' },
-    keywords: ['cloud-bongos', 'cli', 'ai-agents', 'build-platform'],
-    license: 'AGPL-3.0-or-later',
-    // No `repository` field on purpose. The core repo is private today, so a repository URL
-    // would 404 for every user of a public package AND put the owner's login in it for nothing.
-    // Point it at the redacted public mirror once that lands (ADR 0099).
-    homepage: 'https://cloudbongos.com',
-    bugs: { url: 'https://cloudbongos.com/builders' },
-    publishConfig: { access: 'public' },
-  }, null, 2) + '\n';
-}
-
-function readmeSource(version) {
-  return `# ${PACKAGE_NAME}
-
-The [Cloud Bongos](https://cloudbongos.com) CLI. Sign in to an instance and see what you can
-pick up — from a terminal, with nothing installed.
-
-## Start here
-
-\`\`\`sh
-npx ${PACKAGE_NAME} login https://your-instance.com
-npx ${PACKAGE_NAME} start
-\`\`\`
-
-\`login\` opens your browser, you click once, and the session is written to
-\`~/.config/cloudbongos/\`. There is no token to copy and no password to set. If the instance
-gates admission, \`login\` files your access request and the owner approves it.
-
-Install it properly once you're past the first run:
-
-\`\`\`sh
-npm install -g ${PACKAGE_NAME}
-bongos start
-\`\`\`
-
-## Commands
-
-Run \`bongos help\` for the current list. In short: \`login\`, \`reauth\`, \`setup\` for your
-account; \`start\`, \`status\`, \`task\`, \`recall\`, \`cost\`, \`release\`, \`api\` for the work.
-
-\`bongos api\` is the escape hatch — it calls any endpoint on the instance as you, so anything
-the web hall can do is reachable from the terminal:
-
-\`\`\`sh
-bongos api GET /api/bongos/me
-\`\`\`
-
-## Writing code
-
-\`claim\` and \`ship\` need a real checkout, so they aren't in this package. Ask the project's
-owner for repo access and clone it — the full CLI is installed there, and every command in
-this package works the same way from inside it.
-
-## What this package is
-
-The client surface of the Cloud Bongos core, and nothing else — no server, no routes, no
-database, no provisioning. It is generated from the core by
-\`scripts/gds/build-cli-package.js\` and verified by installing the packed tarball into an empty
-directory and running every command.
-
-Version ${version} · AGPL-3.0-or-later
-`;
-}
-
-// ── Build ───────────────────────────────────────────────────────────────────────────────────
-
-function build(opts = {}) {
-  const outDir = path.resolve(REPO_ROOT, opts.out || 'dist/cloudbongos-cli');
-  const version = opts.version || PACKAGE_VERSION;
-  const log = opts.quiet ? () => {} : (m) => process.stdout.write(m + '\n');
-
-  // Refuse a file list that contradicts the package's whole premise, before copying anything.
-  const violations = [];
-  for (const rel of FILES) {
-    if (rel.startsWith('src/bongos/') && !ALLOWED_SRC_BONGOS.has(rel)) {
-      violations.push(`${rel} — src/bongos/ is the kernel; only ${[...ALLOWED_SRC_BONGOS].join(', ')} may ship`);
-    }
-    if (FORBIDDEN_PREFIXES.some((p) => rel.startsWith(p))) violations.push(`${rel} — forbidden path prefix`);
-    if (FORBIDDEN_BASENAMES.includes(path.basename(rel)) && !ALLOWED_SRC_BONGOS.has(rel)) {
-      violations.push(`${rel} — forbidden filename (server surface)`);
-    }
-    if (!fs.existsSync(path.join(REPO_ROOT, rel))) violations.push(`${rel} — missing from the repo`);
-  }
-  if (violations.length) {
-    const err = new Error('cli package manifest rejected:\n  ' + violations.join('\n  '));
-    err.violations = violations;
-    throw err;
-  }
-
-  // Dynamic `import()` of a relative path is invisible to any require()-based reasoning, and
-  // that is not hypothetical: cli-lib.js reaches the generated API client that way, and the
-  // first build shipped without it. Every relative import target in a shipped file must itself
-  // be shipped, or the package installs fine and dies on first use.
-  const unshipped = [];
-  for (const rel of FILES) {
-    if (!/\.(js|mjs|cjs)$/.test(rel)) continue;
-    const text = fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8');
-    for (const m of text.matchAll(/\bimport\(\s*['"](\.[^'"]+)['"]\s*\)/g)) {
-      // FILES holds POSIX repo-relative paths, so the resolved target is spelled the
-      // same way before the lookup — path.relative emits 'clients\bongos-client\…' on
-      // win32, which matched nothing and failed every build on Windows (task 1003529).
-      const target = path.relative(REPO_ROOT, path.resolve(path.dirname(path.join(REPO_ROOT, rel)), m[1]))
-        .split(path.sep).join('/');
-      if (!FILES.includes(target)) unshipped.push(`${rel} dynamically imports ${target}, which the manifest does not ship`);
-    }
-  }
-  if (unshipped.length) {
-    const err = new Error('cli package manifest incomplete:\n  ' + unshipped.join('\n  '));
-    err.violations = unshipped;
-    throw err;
-  }
-
-  fs.rmSync(outDir, { recursive: true, force: true });
-  fs.mkdirSync(outDir, { recursive: true });
-
-  for (const rel of FILES) {
-    const dest = path.join(outDir, rel);
-    fs.mkdirSync(path.dirname(dest), { recursive: true });
-    fs.copyFileSync(path.join(REPO_ROOT, rel), dest);
-  }
-
-  fs.mkdirSync(path.join(outDir, 'bin'), { recursive: true });
-  fs.writeFileSync(path.join(outDir, 'bin', 'bongos.js'), dispatcherSource(), { mode: 0o755 });
-  fs.writeFileSync(path.join(outDir, 'package.json'), packageJsonSource(version));
-  fs.writeFileSync(path.join(outDir, 'README.md'), readmeSource(version));
-
-  const generated = [...FILES, 'bin/bongos.js', 'package.json', 'README.md'];
-  const leaks = scanRedaction(outDir, generated);
-  if (leaks.length) {
-    const err = new Error(
-      'cli package redaction gate FAILED — refusing to emit:\n  ' + leaks.join('\n  ') +
-      '\n\nThis package is PUBLIC. Build it from the neutral core, not from an instance checkout' +
-      '\n(an instance\'s config/branding.json names its own domains and owner).'
-    );
-    err.leaks = leaks;
-    throw err;
-  }
-
-  const bytes = generated.reduce((n, rel) => {
-    try { return n + fs.statSync(path.join(outDir, rel)).size; } catch { return n; }
-  }, 0);
-
-  log(`${PACKAGE_NAME}@${version} → ${path.relative(REPO_ROOT, outDir)}`);
-  log(`  ${generated.length} files · ${(bytes / 1024).toFixed(0)} KB · ${Object.keys(VERBS).length} verbs · 1 dependency (undici)`);
-  log(`  redaction gate: clean (${instanceNeedles().length} instance needles checked)`);
-  return { outDir, version, files: generated, verbs: Object.keys(VERBS) };
-}
-
-module.exports = { build, FILES, VERBS, CHECKOUT_ONLY, FORBIDDEN_PREFIXES, FORBIDDEN_BASENAMES, ALLOWED_SRC_BONGOS, PACKAGE_NAME, PACKAGE_VERSION, scanRedaction, instanceNeedles };
-
-if (require.main === module) {
-  const argv = process.argv.slice(2);
-  const flag = (name) => { const i = argv.indexOf(name); return i === -1 ? null : argv[i + 1]; };
-  try {
-    build({ out: flag('--out'), version: flag('--version'), quiet: argv.includes('--quiet') });
-  } catch (err) {
-    process.stderr.write(String(err.message) + '\n');
-    process.exit(1);
-  }
-}