@cef-ai/cli 2.9.0 → 3.0.0

package/README.md

@@ -25,7 +25,7 @@ invoke it via `pnpm exec cef <subcommand>`.
 | `cef inspect <agentDir>` | shipped | Read a built `manifest.json`, run the bundle in `node:vm`, and report the handler names exposed on `__handlers` plus any routing targets the manifest references but the bundle doesn't expose. |
 | `cef publish` | shipped | POST a built agent's card to the marketplace API (`--as-pubkey`, `--access-token`/`$CEF_ACCESS_TOKEN` — the same CLI access token `cef deploy` uses). |
 | `cef push` | shipped | Upload an agent to DDC. `--kind internal` (the default) uploads a built agent's `bundle.js` (+ widget dirs) and stamps the manifest's bundle ref — directly into a bucket you control (`--bucket`), or through vault-api into an organization vault's scope (`--vault <id> --vault-scope <scope>`). `--kind external` registers an agent that runs **outside** the platform, from its [A2A](https://agent2agent.info) Agent Card: fetches the card, derives a manifest (`kind: "external"`, `a2aCard: <url>`, no bundle) and writes it to the same bucket registry. External flags: `--card <url>`, `--alias`, `--agent-version`, `--scope`, `--idle-timeout`. |
-| `cef eval <sub>` | shipped | Workflow evaluations, one workflow at a time (`--workflow`, default: the one `cef.config.ts` or `dist/` declares). `datasets`, `create <dataset>`, `pull <dataset>` / `push <dataset>` (repo `datasets/<dataset>/` ↔ the agent service's bucket; `push --cut`, `--force`, `--prune`, `--restore`; `pull --force`), `run <dataset>` (`--workflow-version`, `--dataset-version`, `--repeats`, `--baseline`, `--resume`), `experiments [dataset]`, `compare <a> <b>`, `migrate`. Needs `--as-pubkey`/`$CEF_AS_PUBKEY` and the owner's wallet (`--keystore`/`--password` or `--secret-phrase`) or an S3 key pair (`--access-key` + `--secret`); `run` also needs `--access-token`/`$CEF_ACCESS_TOKEN`. See [`@cef-ai/eval`](../eval/README.md). |
+| `cef eval <sub>` | shipped | Workflow evaluations, one workflow at a time (`--workflow`, default: the one `cef.config.ts` or `dist/` declares). `datasets`, `create <dataset>`, `pull <dataset>` / `push <dataset>` (repo `datasets/<dataset>/` ↔ the vault; `push --cut`, `--force`, `--prune`, `--restore`; `pull --force`), `run <dataset>` (`--workflow-version`, `--dataset-version`, `--repeats`, `--baseline`, `--resume`), `experiments [dataset]`, `compare <a> <b>`. Evaluations live in the vault the workflow runs in (`--vault`/`$CEF_VAULT_ID`, default the wallet's own), in its scope (`--scope`, default its `requiredScopes`); needs a wallet (`--keystore`/`--password` or `--secret-phrase`) or `--access-token`/`$CEF_ACCESS_TOKEN`, and the vault's grant on that scope. `run` also needs `--as-pubkey`/`$CEF_AS_PUBKEY`. See [`@cef-ai/eval`](../eval/README.md). |
 | `cef test` | stub | Placeholder — use `vitest` directly with `@cef-ai/testing` until the integrated runner lands. |
 | `cef dev` | stub | Placeholder — pending the packaged platform image. |
 

package/dist/commands/eval.d.ts

@@ -1,5 +1,5 @@
 import type { Command } from "commander";
-import { type Case, type DatasetSummary, type EvalStore, type Experiment, type ExperimentComparison, type ExperimentProgress, type Header, type Limits, type MigrationReport, type ResultCompatibility, type ResultField, type WorkflowTarget } from "@cef-ai/eval";
+import { type Case, type DatasetSummary, type EvalStore, type Experiment, type ExperimentComparison, type ExperimentProgress, type Header, type Limits, type ResultCompatibility, type ResultField, type WorkflowTarget } from "@cef-ai/eval";
 import { type LocalWorkflowOptions } from "../lib/eval-workflow.js";
 export declare const VERSIONS_FILE = ".versions.json";
 /** Where datasets live in a workflow's folder. */
@@ -25,7 +25,7 @@ export interface PulledState {
 }
 /**
  * Read the repo dir: header and every case file, each checked. A header written
- * by hand need not carry `createdAt` (the bucket's wins on push) nor
+ * by hand need not carry `createdAt` (the vault's wins on push) nor
  * `workflowId` (the folder's workflow is meant); a `baselineId` in it is
  * ignored — the baseline is chosen on the platform.
  */
@@ -44,7 +44,7 @@ export declare function evalCreate(opts: {
 export interface PullResult {
     dir: string;
     cases: number;
-    /** Case files removed: pulled before, no longer live in the bucket. */
+    /** Case files removed: pulled before, no longer live in the vault. */
     removed: string[];
     /** Case files the last pull never wrote (new, unpushed cases) — left untouched. */
     localOnly: string[];
@@ -54,14 +54,14 @@ export interface PullResult {
  * Bucket → repo dir.
  *
  * A case file is removed only when the LAST PULL wrote it (its id is in
- * `.versions.json`) and it is no longer live in the bucket — deleted or
+ * `.versions.json`) and it is no longer live in the vault — deleted or
  * archived there since. A file the last pull did not write is a case someone
  * is adding in the repo and has not pushed yet; it is reported, never touched.
  *
  * UNPUSHED EDITS ARE NOT OVERWRITTEN. Before writing anything, every case file
  * pull would rewrite or remove is compared with what the last pull/push left
  * there (the hash in `.versions.json`; for an older file without hashes, the
- * pulled revision's content) and with what the bucket now holds. A file that
+ * pulled revision's content) and with what the vault now holds. A file that
  * matches neither was edited locally and not pushed: the pull is refused
  * unless `force`.
  */
@@ -81,11 +81,11 @@ export interface PushResult {
         rev: number;
     }>;
     unchanged: string[];
-    /** Deleted or archived in the bucket, put back by `restore` before the repo's version was written. */
+    /** Deleted or archived in the vault, put back by `restore` before the repo's version was written. */
     restored: string[];
-    /** Pulled, then removed from the repo dir; still live in the bucket. Deleted with `prune`. */
+    /** Pulled, then removed from the repo dir; still live in the vault. Deleted with `prune`. */
     missingLocally: string[];
-    /** Live in the bucket but never pulled (added there since). Kept; `prune` never touches them. */
+    /** Live in the vault but never pulled (added there since). Kept; `prune` never touches them. */
     notPulled: string[];
     deleted: string[];
     cut?: {
@@ -94,19 +94,19 @@ export interface PushResult {
     };
 }
 /**
- * Repo dir → bucket.
+ * Repo dir → vault.
  *
- * EVERY CHECK BEFORE ANY WRITE, so a refused push leaves the bucket exactly as
+ * EVERY CHECK BEFORE ANY WRITE, so a refused push leaves the vault exactly as
  * it was — header included:
- *   - a repo case that is deleted or archived in the bucket is refused unless
+ *   - a repo case that is deleted or archived in the vault is refused unless
  *     `restore` (an explicit undelete/unarchive, then the repo's version is
  *     written as a new revision). `force` does NOT imply it: overwriting an
  *     edit and resurrecting a case someone removed are different decisions.
- *   - a case edited in the bucket since the pull, whose content differs from
+ *   - a case edited in the vault since the pull, whose content differs from
  *     the repo's, is a conflict unless `force`.
  *   - `prune` deletes only cases the last pull wrote and the repo has since
- *     dropped; a case edited in the bucket since that pull is a conflict
- *     unless `force`. Cases added in the bucket after the pull are never
+ *     dropped; a case edited in the vault since that pull is a conflict
+ *     unless `force`. Cases added in the vault after the pull are never
  *     pruned — the repo never knew them.
  */
 export declare function evalPush(opts: {
@@ -173,9 +173,6 @@ export declare function evalCompare(opts: {
     base: string;
     candidate: string;
 }): Promise<ExperimentComparison>;
-export declare function evalMigrate(opts: {
-    store: EvalStore;
-}): Promise<MigrationReport>;
 /**
  * The Result a workflow version declares, read off its graph:
  *   - the live deployment row's `params.graph` when the version is the live
@@ -208,7 +205,6 @@ export declare function formatDatasetDiff(c: Pick<ExperimentComparison, "dataset
 export declare function formatResultCheck(r: ResultCheck): string[];
 export declare function formatCompatibility(r: ResultCompatibility, version: string): string[];
 export declare function formatComparison(c: ExperimentComparison): string;
-export declare function formatMigration(r: MigrationReport): string;
 export declare function addEvalCommands(program: Command, opts: {
     onError: (e: unknown) => never;
     fetchImpl?: typeof fetch;

package/dist/commands/eval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eval.d.ts","sourceRoot":"","sources":["../../src/commands/eval.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EA8BL,KAAK,IAAI,EACT,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,KAAK,MAAM,EAEX,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAatB,OAAO,EAAiC,KAAK,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAOnG,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAC9C,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvF;AAkCD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/F,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC;CAChC,CAAC,CAuBD;AAQD,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mFAAmF;IACnF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,EAAE,WAAW,CAAC;CACpB;AAiCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiEtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sGAAsG;IACtG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8FAA8F;IAC9F,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iGAAiG;IACjG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkItB;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC9C,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBtB;AAED,+EAA+E;AAC/E,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAG/B;AAED,gHAAgH;AAChH,MAAM,MAAM,WAAW,GACnB;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,mBAAmB,CAAA;CAAE,GACrG;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,uEAAuE;AACvE,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE,GAAG,OAAO,CAAC,WAAW,CAAC,CAKvB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAU5H;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAEtF;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;IACvE,KAAK,EAAE,oBAAoB,CAAC;CAC7B,GAAG,OAAO,CAAC;IAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAYnE;AAMD,iCAAiC;AACjC,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM,CAKvG;AAMD,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,CAQ7D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAWjF;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAiBtD;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,GAAG,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAW5G;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,EAAE,CAM1D;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrF;AAKD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,GAAG,MAAM,CA8BhE;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAS1D;AAsHD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GACrF,IAAI,CAoMN"}
+{"version":3,"file":"eval.d.ts","sourceRoot":"","sources":["../../src/commands/eval.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EA6BL,KAAK,IAAI,EACT,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,KAAK,MAAM,EAEX,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAYtB,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,yBAAyB,CAAC;AAOjC,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAC9C,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvF;AAkCD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/F,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC;CAChC,CAAC,CAuBD;AAQD,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mFAAmF;IACnF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,EAAE,WAAW,CAAC;CACpB;AAiCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,UAAU,CAAC,CAiEtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qGAAqG;IACrG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6FAA6F;IAC7F,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,gGAAgG;IAChG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAgBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkItB;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC9C,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBtB;AAED,+EAA+E;AAC/E,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAG/B;AAED,gHAAgH;AAChH,MAAM,MAAM,WAAW,GACnB;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,mBAAmB,CAAA;CAAE,GACrG;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,uEAAuE;AACvE,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE,GAAG,OAAO,CAAC,WAAW,CAAC,CAKvB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAU5H;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;IACvE,KAAK,EAAE,oBAAoB,CAAC;CAC7B,GAAG,OAAO,CAAC;IAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAYnE;AAMD,iCAAiC;AACjC,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM,CAKvG;AAMD,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,CAQ7D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAWjF;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAiBtD;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,GAAG,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAW5G;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,EAAE,CAM1D;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrF;AAKD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,GAAG,MAAM,CA8BhE;AAqGD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GACrF,IAAI,CA6MN"}

package/dist/commands/eval.js

@@ -3,12 +3,11 @@
  *
  *   cef eval datasets                                    list the workflow's datasets
  *   cef eval create <dataset>                            create one
- *   cef eval pull <dataset> [--dir datasets] [--force]   bucket → repo dir (refuses to overwrite unpushed edits)
- *   cef eval push <dataset> [--dir datasets] [--cut note] repo dir → bucket (new revisions for changed cases)
+ *   cef eval pull <dataset> [--dir datasets] [--force]   vault → repo dir (refuses to overwrite unpushed edits)
+ *   cef eval push <dataset> [--dir datasets] [--cut note] repo dir → vault (new revisions for changed cases)
  *   cef eval run <dataset> [--dataset-version N] [--workflow-version v] [--repeats 3] [--concurrency 4] [--baseline exp]
  *   cef eval experiments [dataset]                       experiment history
  *   cef eval compare <a> <b>                             how experiment b differs from a
- *   cef eval migrate                                     copy v1 storage (evals/datasets/…) into the v2 layout
  *
  * Every command is about one workflow: `--workflow <id>`, by default the one
  * `cef.config.ts` (or the build output) in the current directory declares.
@@ -21,28 +20,27 @@
  *
  * Experiments are not in the repo; their results stay on the platform.
  *
- * The bucket keeps every revision; the repo holds the latest, so a git diff of a
+ * The vault keeps every revision; the repo holds the latest, so a git diff of a
  * case reads as the edit it is. `push` writes a new revision only for a case
- * whose content changed, and refuses one that changed in the bucket since it was
+ * whose content changed, and refuses one that changed in the vault since it was
  * pulled (someone edited it in ROC) unless `--force`, and one that is deleted or
  * archived there unless `--restore`. `pull` and `push --prune` only ever remove
  * what the last pull wrote (`.versions.json`), never a case the other side has
  * not seen. `pull` refuses to overwrite or remove a case file edited since the
  * last pull/push (its content matches neither what was pulled nor what the
- * bucket now holds) unless `--force`.
+ * vault now holds) unless `--force`.
  *
  * The functions below take an `EvalStore` (and a `WorkflowTarget` for `run`) so
  * they run unchanged against a memory store in tests.
  */
 import { mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { canonicalJson, checkResultCompatibility, compareExperiments, createDataset, cutVersion, deleteCase, findExperiment, getCaseRevision, getHeader, getVersion, listArchivedCaseIds, listCaseRevisions, listDatasets, listDeletedCaseIds, listExperiments, listRunRecords, listVersions, listWorkflows, loadWorkingSet, migrateLegacyLayout, parseCase, parseHeader, resultFieldsFromGraph, runExperiment, saveCase, sha256Hex, unarchiveCase, undeleteCase, updateHeader, } from "@cef-ai/eval";
-import { DelegationAuthProvider, WalletAuthProvider } from "@cef-ai/vault-sdk";
-import { Browse, Events, VaultHttpClient, Vaults } from "@cef-ai/vault-sdk/internal";
-import { loadWallet, resolveGatewayAccess } from "../lib/eval-auth.js";
-import { gatewayStore } from "../lib/eval-store.js";
+import { canonicalJson, checkResultCompatibility, compareExperiments, createDataset, cutVersion, deleteCase, findExperiment, getCaseRevision, getHeader, getVersion, listArchivedCaseIds, listCaseRevisions, listDatasets, listDeletedCaseIds, listExperiments, listRunRecords, listVersions, listWorkflows, loadWorkingSet, parseCase, parseHeader, resultFieldsFromGraph, runExperiment, saveCase, sha256Hex, unarchiveCase, undeleteCase, updateHeader, } from "@cef-ai/eval";
+import { Browse, Events } from "@cef-ai/vault-sdk/internal";
+import { loadWallet } from "../lib/eval-auth.js";
+import { openVault, vaultEvalStore } from "../lib/eval-vault.js";
 import { fetchOrchestrator, getDeploymentSet, nodeWorkflowTarget, workflowAgentId, } from "../lib/eval-target.js";
-import { localGraph, resolveWorkflowId } from "../lib/eval-workflow.js";
+import { DEFAULT_WORKFLOW_SCOPE, localGraph, localWorkflowScope, resolveWorkflowId, } from "../lib/eval-workflow.js";
 import { envConfig } from "../lib/env.js";
 /* ------------------------------------------------------------------------ */
 /* Repo dir                                                                  */
@@ -76,7 +74,7 @@ async function writeState(store, workflowId, dir, dataset, cases, hashes) {
 }
 /**
  * Read the repo dir: header and every case file, each checked. A header written
- * by hand need not carry `createdAt` (the bucket's wins on push) nor
+ * by hand need not carry `createdAt` (the vault's wins on push) nor
  * `workflowId` (the folder's workflow is meant); a `baselineId` in it is
  * ignored — the baseline is chosen on the platform.
  */
@@ -153,14 +151,14 @@ async function caseFileHash(file) {
  * Bucket → repo dir.
  *
  * A case file is removed only when the LAST PULL wrote it (its id is in
- * `.versions.json`) and it is no longer live in the bucket — deleted or
+ * `.versions.json`) and it is no longer live in the vault — deleted or
  * archived there since. A file the last pull did not write is a case someone
  * is adding in the repo and has not pushed yet; it is reported, never touched.
  *
  * UNPUSHED EDITS ARE NOT OVERWRITTEN. Before writing anything, every case file
  * pull would rewrite or remove is compared with what the last pull/push left
  * there (the hash in `.versions.json`; for an older file without hashes, the
- * pulled revision's content) and with what the bucket now holds. A file that
+ * pulled revision's content) and with what the vault now holds. A file that
  * matches neither was edited locally and not pushed: the pull is refused
  * unless `force`.
  */
@@ -211,13 +209,13 @@ export async function evalPull(opts) {
                 continue;
             if (local === (await lastSynced(id)))
                 continue;
-            edited.push(c ? id : `${id} (removed in the bucket)`);
+            edited.push(c ? id : `${id} (removed in the vault)`);
         }
     }
     if (edited.length) {
-        throw new Error(`[cef eval] these case files were edited since the last pull/push and differ from the bucket:\n  ${edited.join("\n  ")}\n`
+        throw new Error(`[cef eval] these case files were edited since the last pull/push and differ from the vault:\n  ${edited.join("\n  ")}\n`
             + "Nothing was written. Push them first (cef eval push), move the edits aside, "
-            + "or pull with --force to overwrite them with the bucket's version.");
+            + "or pull with --force to overwrite them with the vault's version.");
     }
     // The baseline stays on the platform: in git it would be stale the moment someone picks another in ROC.
     await writeFile(path.join(root, "header.json"), canonicalJson(withoutBaseline(header)));
@@ -242,19 +240,19 @@ async function latestRevision(store, workflowId, dataset, id) {
     return c ? { case: c, rev } : undefined;
 }
 /**
- * Repo dir → bucket.
+ * Repo dir → vault.
  *
- * EVERY CHECK BEFORE ANY WRITE, so a refused push leaves the bucket exactly as
+ * EVERY CHECK BEFORE ANY WRITE, so a refused push leaves the vault exactly as
  * it was — header included:
- *   - a repo case that is deleted or archived in the bucket is refused unless
+ *   - a repo case that is deleted or archived in the vault is refused unless
  *     `restore` (an explicit undelete/unarchive, then the repo's version is
  *     written as a new revision). `force` does NOT imply it: overwriting an
  *     edit and resurrecting a case someone removed are different decisions.
- *   - a case edited in the bucket since the pull, whose content differs from
+ *   - a case edited in the vault since the pull, whose content differs from
  *     the repo's, is a conflict unless `force`.
  *   - `prune` deletes only cases the last pull wrote and the repo has since
- *     dropped; a case edited in the bucket since that pull is a conflict
- *     unless `force`. Cases added in the bucket after the pull are never
+ *     dropped; a case edited in the vault since that pull is a conflict
+ *     unless `force`. Cases added in the vault after the pull are never
  *     pruned — the repo never knew them.
  */
 export async function evalPush(opts) {
@@ -275,15 +273,15 @@ export async function evalPush(opts) {
     const deleted = new Set(remoteHeader ? await listDeletedCaseIds(opts.store, wf, opts.dataset) : []);
     const archived = new Set(remoteHeader ? await listArchivedCaseIds(opts.store, wf, opts.dataset) : []);
     const pulled = local.state?.dataset === opts.dataset ? local.state.cases : {};
-    // 1. Repo cases the bucket's working set hides.
+    // 1. Repo cases the vault's working set hides.
     const hidden = local.cases.filter((c) => deleted.has(c.id) || archived.has(c.id));
     if (hidden.length && !opts.restore) {
-        throw new Error(`[cef eval] these cases are ${hidden.length === 1 ? "" : "each "}deleted or archived in the bucket, and still in the repo dir:\n  `
+        throw new Error(`[cef eval] these cases are ${hidden.length === 1 ? "" : "each "}deleted or archived in the vault, and still in the repo dir:\n  `
             + hidden.map((c) => `${c.id} (${deleted.has(c.id) ? "deleted" : "archived"})`).join("\n  ")
             + "\nNothing was written. Pull to drop them from the repo dir, give a case a new id to add it as a new case, "
             + "or push with --restore to undelete/unarchive them and write the repo's version.");
     }
-    // 2. Edits in the bucket since the pull.
+    // 2. Edits in the vault since the pull.
     const conflicts = [];
     for (const c of local.cases) {
         if (opts.force)
@@ -294,7 +292,7 @@ export async function evalPush(opts) {
         const base = has(pulled, c.id) ? pulled[c.id] : undefined;
         const editedRemotely = base === undefined || r.rev !== base;
         if (editedRemotely && canonicalJson(r.case) !== canonicalJson(c))
-            conflicts.push(`${c.id} (bucket r${r.rev}, pulled ${base === undefined ? "never" : `r${base}`})`);
+            conflicts.push(`${c.id} (vault r${r.rev}, pulled ${base === undefined ? "never" : `r${base}`})`);
     }
     // 3. What prune would delete.
     const localIds = new Set(local.cases.map((c) => c.id));
@@ -310,7 +308,7 @@ export async function evalPush(opts) {
         }
         missingLocally.push(id);
         if (opts.prune && !opts.force && r.rev !== pulled[id]) {
-            pruneConflicts.push(`${id} (removed from the repo, but bucket r${r.rev} was edited since the pull of r${pulled[id]})`);
+            pruneConflicts.push(`${id} (removed from the repo, but vault r${r.rev} was edited since the pull of r${pulled[id]})`);
         }
     }
     if (conflicts.length || pruneConflicts.length) {
@@ -318,13 +316,13 @@ export async function evalPush(opts) {
             "[cef eval] Nothing was written.",
             ...(conflicts.length
                 ? [
-                    `These cases changed in the bucket since they were pulled, and differ from the repo:\n  ${conflicts.join("\n  ")}`,
+                    `These cases changed in the vault since they were pulled, and differ from the repo:\n  ${conflicts.join("\n  ")}`,
                     "Pull first and redo the edit, or push with --force to write the repo's version over them as a new revision.",
                 ]
                 : []),
             ...(pruneConflicts.length
                 ? [
-                    `--prune would delete these cases, edited in the bucket since they were pulled:\n  ${pruneConflicts.join("\n  ")}`,
+                    `--prune would delete these cases, edited in the vault since they were pulled:\n  ${pruneConflicts.join("\n  ")}`,
                     "Pull to get the edited case back into the repo dir, or push with --prune --force to delete it, edit and all "
                         + "(--restore brings a deleted case back).",
                 ]
@@ -438,9 +436,6 @@ export async function evalCompare(opts) {
     };
     return compareExperiments(await load(opts.base), await load(opts.candidate));
 }
-export async function evalMigrate(opts) {
-    return migrateLegacyLayout(opts.store);
-}
 /**
  * The Result a workflow version declares, read off its graph:
  *   - the live deployment row's `params.graph` when the version is the live
@@ -568,17 +563,6 @@ export function formatComparison(c) {
         : "Every run unchanged.";
     return [head, ...(diff ? [diff] : []), counts, "", metrics, "", runs].join("\n");
 }
-export function formatMigration(r) {
-    if (r.alreadyMigrated)
-        return "Already migrated (evals/MIGRATED.json is there); nothing to do.";
-    return [
-        `✓ ${r.datasets.length ? `Copied ${plural(r.datasets.length, "dataset")}` : "No legacy datasets"}: `
-            + `${r.copied} keys written, ${r.existing} already in place`,
-        ...r.datasets.map((d) => `  ${d.dataset} → workflows/${d.workflowId}/ (${d.keys} keys, ${plural(d.experiments, "experiment")})`),
-        ...r.skipped.map((x) => `  skipped ${x.dataset}: ${x.reason}`),
-        ...(r.skipped.length ? ["Not marked migrated: fix the skipped datasets and run it again."] : []),
-    ].join("\n");
-}
 const int = (v, flag) => {
     if (v === undefined)
         return undefined;
@@ -599,14 +583,13 @@ const number = (v, flag) => {
 function withStoreOptions(cmd) {
     return cmd
         .option("--env <env>", "Environment: dev | stage | prod (default dev; overrides $CEF_ENV)")
-        .option("--as-pubkey <hex>", "Agent service pubkey — names the bucket ($CEF_AS_PUBKEY)")
-        .option("--keystore <file>", "Owner wallet keystore JSON, ed25519 ($CEF_KEYSTORE)")
+        .option("--keystore <file>", "Wallet keystore JSON, ed25519 ($CEF_KEYSTORE)")
         .option("--password <pw>", "Keystore password ($CEF_KEYSTORE_PASSWORD)")
-        .option("--secret-phrase <phrase>", "Owner wallet secret phrase, ed25519 ($CEF_SECRET_PHRASE)")
-        .option("--gateway <url>", "S3 gateway base URL ($CEF_EVAL_ENDPOINT; default from --env)")
-        .option("--bucket <name>", "Bucket override ($CEF_EVAL_BUCKET)")
-        .option("--access-key <id>", "Explicit S3 access key ($CEF_EVAL_KEY)")
-        .option("--secret <key>", "Explicit S3 secret ($CEF_EVAL_SECRET)")
+        .option("--secret-phrase <phrase>", "Wallet secret phrase, ed25519 ($CEF_SECRET_PHRASE)")
+        .option("--access-token <token>", "CLI access token, for the vault without a wallet and for the orchestrator ($CEF_ACCESS_TOKEN)")
+        .option("--vault <id>", "Vault the workflow runs in ($CEF_VAULT_ID; default: the wallet's own)")
+        .option("--scope <scope>", "Vault scope the workflow runs in (default: its requiredScopes, else \"default\")")
+        .option("--vault-api <url>", "vault-api base URL (default from --env)")
         .option("--json", "Print JSON instead of a table");
 }
 const WORKFLOW_HELP = "Workflow id (agent alias); default: the workflow cef.config.ts (or dist/) in this directory declares";
@@ -616,53 +599,58 @@ function withWorkflow(cmd) {
 function withDir(cmd) {
     return cmd.option("--dir <dir>", "Directory holding the workflow's datasets", DEFAULT_DATASETS_DIR);
 }
-async function openStore(o, wallet) {
-    return gatewayStore(await resolveGatewayAccess({ ...o, ...(o.gateway ? { endpoint: o.gateway } : {}) }, wallet));
-}
 /** The Node target: vault-api for events, the orchestrator for jobs and deployments. */
-async function openTarget(o, wallet, workflowId, fetchImpl) {
+function openTarget(o, vault, scope, workflowId, fetchImpl) {
     const env = envConfig(o.env);
     const asPubKey = o.asPubkey ?? process.env.CEF_AS_PUBKEY;
     if (!asPubKey)
         throw new Error("[cef eval] --as-pubkey (or $CEF_AS_PUBKEY) is required");
     const accessToken = o.accessToken ?? process.env.CEF_ACCESS_TOKEN;
-    const auth = wallet
-        ? new WalletAuthProvider(wallet)
-        : accessToken
-            ? new DelegationAuthProvider(accessToken)
-            : undefined;
-    if (!auth)
-        throw new Error("[cef eval] run needs a wallet (--keystore/--secret-phrase) or --access-token to reach the vault");
-    const http = new VaultHttpClient({ url: o.vaultApi ?? env.vault, auth, ...(fetchImpl ? { fetch: fetchImpl } : {}) });
-    const vaultId = o.vault ?? process.env.CEF_VAULT_ID ?? (await new Vaults(http).current()).vaultId;
-    const events = new Events(http);
-    const browse = new Browse(http);
+    const events = new Events(vault.http);
+    const browse = new Browse(vault.http);
     const orchestrator = fetchOrchestrator({
         endpoint: o.orchestrator ?? process.env.CEF_ENDPOINT ?? env.orchestrator,
         ...(accessToken ? { accessToken } : {}),
         ...(fetchImpl ? { fetchImpl } : {}),
     });
     const target = nodeWorkflowTarget({
-        vaultId,
+        vaultId: vault.vaultId,
         asPubKey,
         workflowId,
         orchestrator,
         vault: {
             async publish(ev) {
-                const res = await events.publish(vaultId, o.scope, ev);
+                const res = await events.publish(vault.vaultId, scope, ev);
                 const rejected = res.rejected ?? [];
                 if (rejected.length)
                     throw new Error(`the vault rejected ${ev.type}: ${rejected[0].reason}`);
             },
-            events: (context, cursor) => browse.listStreamEvents(vaultId, o.scope, context, { limit: 200, ...(cursor ? { cursor } : {}) }),
+            events: (context, cursor) => browse.listStreamEvents(vault.vaultId, scope, context, { limit: 200, ...(cursor ? { cursor } : {}) }),
         },
     });
-    return { target, orchestrator, agentId: workflowAgentId(asPubKey, workflowId), vaultId };
+    return { target, orchestrator, agentId: workflowAgentId(asPubKey, workflowId) };
 }
 const print = (json, data, text) => console.log(json ? JSON.stringify(data, null, 2) : text());
 export function addEvalCommands(program, opts) {
     const local = () => ({ cwd: opts.cwd?.() ?? process.cwd() });
     const workflowOf = (o) => resolveWorkflowId(o.workflow, local());
+    /**
+     * `--scope`, else the scope the workflow declares, else `default` — said on
+     * stderr, because a workflow that runs in another scope reads as an empty
+     * one there, with nothing else hinting why.
+     */
+    const scopeOf = async (o, workflowId) => {
+        const given = o.scope?.trim();
+        if (given)
+            return given;
+        const declared = workflowId ? await localWorkflowScope(workflowId, local()) : undefined;
+        if (declared)
+            return declared;
+        console.error(`${workflowId ? `No scope declared for workflow ${workflowId} in this project` : "No workflow found in this project"}; `
+            + `reading vault scope "${DEFAULT_WORKFLOW_SCOPE}". Pass --scope <name> if the workflow runs in another one.`);
+        return DEFAULT_WORKFLOW_SCOPE;
+    };
+    const openStore = async (o, workflowId) => vaultEvalStore(await openVault(o, undefined, opts.fetchImpl), await scopeOf(o, workflowId));
     const ev = program
         .command("eval")
         .description("Workflow evaluations: datasets, experiments, comparisons");
@@ -670,7 +658,7 @@ export function addEvalCommands(program, opts) {
         .action(async (o) => {
         try {
             const workflowId = await workflowOf(o).catch(() => undefined);
-            const store = await openStore(o);
+            const store = await openStore(o, workflowId);
             const list = [];
             for (const wf of workflowId ? [workflowId] : await listWorkflows(store))
                 list.push(...await listDatasets(store, wf));
@@ -700,7 +688,7 @@ export function addEvalCommands(program, opts) {
             set("maxCost", number(o.maxCost, "--max-cost"));
             const workflowId = await workflowOf(o);
             const header = await evalCreate({
-                store: await openStore(o), dataset, workflowId,
+                store: await openStore(o, workflowId), dataset, workflowId,
                 ...(o.description ? { description: o.description } : {}),
                 ...(Object.keys(limits).length ? { limits } : {}),
             });
@@ -715,7 +703,7 @@ export function addEvalCommands(program, opts) {
         .action(async (dataset, o) => {
         try {
             const workflowId = await workflowOf(o);
-            const r = await evalPull({ store: await openStore(o), workflowId, dataset, dir: o.dir, force: !!o.force });
+            const r = await evalPull({ store: await openStore(o, workflowId), workflowId, dataset, dir: o.dir, force: !!o.force });
             print(o.json, r, () => [
                 `✓ Pulled ${r.cases} case(s) into ${r.dir}`,
                 ...(r.removed.length ? [`  removed (no longer live): ${r.removed.join(", ")}`] : []),
@@ -727,16 +715,16 @@ export function addEvalCommands(program, opts) {
             opts.onError(e);
         }
     });
-    withDir(withWorkflow(ev.command("push <dataset>").description("Write the repo dir's cases to the bucket as new revisions")))
+    withDir(withWorkflow(ev.command("push <dataset>").description("Write the repo dir's cases to the vault as new revisions")))
         .option("--cut [note]", "Cut a new version after pushing (runs cut one automatically when the cases changed)")
-        .option("--force", "Write over cases that changed in the bucket since the last pull")
+        .option("--force", "Write over cases that changed in the vault since the last pull")
         .option("--prune", "Delete cases the last pull wrote and the repo dir has since removed")
-        .option("--restore", "Undelete/unarchive cases that are deleted or archived in the bucket but present in the repo dir")
+        .option("--restore", "Undelete/unarchive cases that are deleted or archived in the vault but present in the repo dir")
         .action(async (dataset, o) => {
         try {
             const workflowId = await workflowOf(o);
             const r = await evalPush({
-                store: await openStore(o), workflowId, dataset, dir: o.dir,
+                store: await openStore(o, workflowId), workflowId, dataset, dir: o.dir,
                 ...(o.cut !== undefined ? { cut: o.cut } : {}), force: !!o.force, prune: !!o.prune, restore: !!o.restore,
             });
             print(o.json, r, () => [
@@ -745,8 +733,8 @@ export function addEvalCommands(program, opts) {
                 ...r.updated.map((u) => `  ${u.id} → r${u.rev}`),
                 ...(r.added.length ? [`  added: ${r.added.join(", ")}`] : []),
                 ...(r.restored.length ? [`  restored (were deleted/archived): ${r.restored.join(", ")}`] : []),
-                ...(r.missingLocally.length ? [`  removed from the repo, still in the bucket (kept; --prune deletes): ${r.missingLocally.join(", ")}`] : []),
-                ...(r.notPulled.length ? [`  added in the bucket since the last pull (kept; pull to get them): ${r.notPulled.join(", ")}`] : []),
+                ...(r.missingLocally.length ? [`  removed from the repo, still in the vault (kept; --prune deletes): ${r.missingLocally.join(", ")}`] : []),
+                ...(r.notPulled.length ? [`  added in the vault since the last pull (kept; pull to get them): ${r.notPulled.join(", ")}`] : []),
                 ...(r.deleted.length ? [`  deleted: ${r.deleted.join(", ")}`] : []),
                 r.cut ? `✓ Cut v${r.cut.version} (${r.cut.cases} cases)` : null,
             ].filter((l) => l !== null).join("\n"));
@@ -766,11 +754,8 @@ export function addEvalCommands(program, opts) {
         .option("--baseline <exp>", "Experiment to compare against when done (default: the dataset's baseline)")
         .option("--resume <exp>", "Resume an experiment that did not finish")
         .option("--note <text>", "Note recorded on the experiment")
-        .option("--vault <id>", "Vault to run in ($CEF_VAULT_ID; default: the wallet's own)")
-        .option("--scope <scope>", "Vault scope to publish into", "default")
+        .option("--as-pubkey <hex>", "Agent service pubkey the workflow belongs to ($CEF_AS_PUBKEY)")
         .option("--orchestrator <url>", "Orchestrator base URL ($CEF_ENDPOINT; default from --env)")
-        .option("--vault-api <url>", "vault-api base URL (default from --env)")
-        .option("--access-token <token>", "CLI access token for the orchestrator ($CEF_ACCESS_TOKEN)")
         .action(async (dataset, o) => {
         try {
             // Numbers first, so a typo fails before any credential is minted or run started.
@@ -782,11 +767,14 @@ export function addEvalCommands(program, opts) {
             };
             const workflowId = await workflowOf(o);
             const wallet = await loadWallet(o);
-            const store = await openStore(o, wallet);
+            const vault = await openVault(o, wallet, opts.fetchImpl);
+            // One scope for both: the experiment's records and the runs it starts.
+            const scope = await scopeOf(o, workflowId);
+            const store = vaultEvalStore(vault, scope);
             const header = await getHeader(store, workflowId, dataset);
             if (!header)
                 throw new Error(`[cef eval] workflow "${workflowId}" has no dataset "${dataset}"`);
-            const { target, orchestrator, agentId } = await openTarget(o, wallet, workflowId, opts.fetchImpl);
+            const { target, orchestrator, agentId } = openTarget(o, vault, scope, workflowId, opts.fetchImpl);
             const liveRow = (await getDeploymentSet(orchestrator, agentId))?.deployments
                 .find((d) => d.targeting === "" && d.enabled !== false);
             const live = liveRow?.version ?? null;
@@ -827,7 +815,7 @@ export function addEvalCommands(program, opts) {
         .action(async (dataset, o) => {
         try {
             const workflowId = await workflowOf(o);
-            const store = await openStore(o);
+            const store = await openStore(o, workflowId);
             const list = await listExperiments(store, workflowId, dataset ? { dataset } : {});
             const baselineId = dataset ? (await getHeader(store, workflowId, dataset))?.baselineId : undefined;
             print(o.json, list, () => formatExperiments(list, baselineId));
@@ -836,25 +824,16 @@ export function addEvalCommands(program, opts) {
             opts.onError(e);
         }
     });
-    withStoreOptions(ev.command("compare <base> <candidate>").description("How one experiment differs from another"))
+    withWorkflow(ev.command("compare <base> <candidate>").description("How one experiment differs from another"))
         .action(async (base, candidate, o) => {
         try {
-            const c = await evalCompare({ store: await openStore(o), base, candidate });
+            const workflowId = await workflowOf(o).catch(() => undefined);
+            const c = await evalCompare({ store: await openStore(o, workflowId), base, candidate });
             print(o.json, c, () => formatComparison(c));
         }
         catch (e) {
             opts.onError(e);
         }
     });
-    withStoreOptions(ev.command("migrate").description("Copy v1 storage (evals/datasets/…) into the per-workflow layout"))
-        .action(async (o) => {
-        try {
-            const r = await evalMigrate({ store: await openStore(o) });
-            print(o.json, r, () => formatMigration(r));
-        }
-        catch (e) {
-            opts.onError(e);
-        }
-    });
 }
 //# sourceMappingURL=eval.js.map