@cosyte/script-utils 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.4
+
+### Patch Changes
+
+- b9b2a7c: Every gate is now a bin, so a repository with no `package.json` can run it through npx: `cosyte-no-emdash`, `cosyte-attw`, `cosyte-phi-scan`, `cosyte-internal-refs`, `cosyte-readme`, `cosyte-claude-card`, `cosyte-agent-notes` and `cosyte-catalog`, each with `--help`, and `script-utils`, the dispatcher npx runs by the package's name (`npx -y @cosyte/script-utils@0.1 no-emdash`). The dash gate also matches every form the marketing and consulting scanner caught, in any case: the characters, URL encoding, the backslash-u escape (plain, braced and eight-digit), the braced backslash-x escape, the CSS escape, the Unicode name, and the named, decimal and hexadecimal HTML entities with or without the semicolon and with leading zeros. It now reads every tracked file's name as well as its content, and answers `--help`. A tracked file or name carrying one of the newly matched forms is refused where 0.1.3 printed OK.
+
 ## 0.1.3
 
 ### Patch Changes

package/README.md

@@ -247,6 +247,31 @@ Each shared gate runs from a repository's package script with no file of its own
   notes), with exit codes 0 clean, 1 hits, 2 the gate could not run. The file may not set
   `exitCodes`, `repoRoot` or `write`, which the command-line form owns.
 
+### The bins, for a repository with no package.json
+
+Every gate is also a bin (D56), so a repository with no `package.json`, or none that depends on this
+package, runs it through npx. `script-utils` is named after the package, so npx runs it by the
+package's name and it dispatches to the gate named first:
+
+```sh
+npx -y @cosyte/script-utils@0.1 no-emdash          # the dispatcher: script-utils <command>
+npx -y -p @cosyte/script-utils@0.1 cosyte-readme   # or one gate's own bin
+```
+
+| bin                    | `script-utils` command | the gate                                      |
+| ---------------------- | ---------------------- | --------------------------------------------- |
+| `cosyte-no-emdash`     | `no-emdash`            | the em and en dash gate, over files and names |
+| `cosyte-attw`          | `attw`                 | the attw publish gate, for the package here   |
+| `cosyte-phi-scan`      | `phi-scan`             | the PHI commit-gate                           |
+| `cosyte-internal-refs` | `internal-refs`        | the internal-reference gate                   |
+| `cosyte-readme`        | `readme`               | the README gate                               |
+| `cosyte-claude-card`   | `claude-card`          | the CLAUDE.md card checker                    |
+| `cosyte-agent-notes`   | `agent-notes`          | the agent-notes checker                       |
+| `cosyte-catalog`       | `catalog`              | the catalog check                             |
+
+Each runs over the working directory, takes the arguments its gate takes, exits with the gate's own
+code, and prints what it does with `--help`. `script-utils` with no command prints the list and exits 2.
+
 ### The em-dash gate, which is a file rather than a subpath
 
 This package also ships `check-no-emdash.sh`, the one implementation of the em-dash gate for every
@@ -275,9 +300,13 @@ A repository narrows WHAT IS SCANNED, and only that, through a tracked file at i
 `scripts/check-no-emdash.exclude`: one entry per line, `#` comments and blank lines ignored, an entry
 ending in `/` covering every tracked path beneath it, and every entry anchored at the repository
 root. An entry that matches no tracked path is refused rather than ignored, because an exclusion that
-has outlived its subject is a hole nobody is looking at. Nothing narrows WHAT IS MATCHED: the twelve
-banned forms are fixed in the gate. They are the em dash (U+2014) and the en dash (U+2013), each as
-the literal character, its URL encoding, its JS escape and three HTML entity spellings.
+has outlived its subject is a hole nobody is looking at; an excluded path's name is left out with its
+content. Nothing narrows WHAT IS MATCHED: the banned forms are fixed in the gate. They are the em
+dash (U+2014) and the en dash (U+2013), in any case, each as the literal character, its URL encoding,
+its backslash-u escape (plain, braced and eight-digit), its braced backslash-x escape, its CSS escape
+(plain and zero-padded), its Unicode name escape (a backslash, `N` and the character's name in braces), and its named, decimal and hexadecimal
+HTML entities, with or without the semicolon and with leading zeros. The default scan also reads
+every tracked file's NAME, because a name is copy too.
 
 ### The README gate
 

package/bin/cosyte-agent-notes.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// cosyte-agent-notes: the agent-notes checker for the repository in the working directory.
+// A bin of @cosyte/script-utils (D56), so a repository with no package.json can run it with
+// `npx -y -p @cosyte/script-utils cosyte-agent-notes`. It forwards every argument to the gate and exits with
+// the gate's own code; `--help` prints what it does and exits 0.
+
+import { runAgentNotesCheck } from "../agent-notes.js";
+
+const HELP = `cosyte-agent-notes: check a repository's agent notes and every pointer into them.
+
+  cosyte-agent-notes [--dir <repository root>]
+
+The notes are one file, documentation/agent-notes.md, and CLAUDE.md points into it as
+documentation/agent-notes.md#<anchor>. Every pointer in a tracked file must name a heading or an
+explicit anchor. Exit 0 clean, 1 a finding, 2 the check could not run.
+`;
+
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(HELP);
+} else {
+  process.exitCode = runAgentNotesCheck({ argv: args });
+}

package/bin/cosyte-attw.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// cosyte-attw: the attw publish gate for the package in the working directory.
+// A bin of @cosyte/script-utils (D56), so a repository with no package.json can run it with
+// `npx -y -p @cosyte/script-utils cosyte-attw`. It forwards every argument to the gate and exits with
+// the gate's own code; `--help` prints what it does and exits 0.
+
+import { runAttwCli } from "../attw.js";
+
+const HELP = `cosyte-attw: run the attw publish gate for the package in the working directory.
+
+  cosyte-attw [--no-definitely-typed]
+
+It runs this package's own node_modules/.bin/attw over the tarball npm would publish, with four
+nets attw lacks. scripts/attw.exclude names the resolutions the package leaves out, one per line:
+node10 selects attw's node16 profile, node10 with node16-cjs selects esm-only. Exit 0 every net
+passed; attw's own status when attw judged the package; 1 a refusal.
+`;
+
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(HELP);
+} else {
+  process.exitCode = runAttwCli(args);
+}

package/bin/cosyte-catalog.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// cosyte-catalog: the catalog check for the library in the working directory.
+// A bin of @cosyte/script-utils (D56), so a repository with no package.json can run it with
+// `npx -y -p @cosyte/script-utils cosyte-catalog`. It forwards every argument to the gate and exits with
+// the gate's own code; `--help` prints what it does and exits 0.
+
+import { runCatalogCheck } from "../catalog.js";
+
+const HELP = `cosyte-catalog: check that a library's package.json description is the catalog's.
+
+  cosyte-catalog [--dir <package directory>]
+
+The catalog is the one list of our libraries, generated in cosyte/config from each package.json.
+Exit 0 the description is the catalog's, 1 it is not (both values printed), 2 the package is not
+listed or package.json cannot be read.
+`;
+
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(HELP);
+} else {
+  process.exitCode = runCatalogCheck({ argv: args });
+}

package/bin/cosyte-claude-card.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// cosyte-claude-card: the CLAUDE.md card checker for the repository in the working directory.
+// A bin of @cosyte/script-utils (D56), so a repository with no package.json can run it with
+// `npx -y -p @cosyte/script-utils cosyte-claude-card`. It forwards every argument to the gate and exits with
+// the gate's own code; `--help` prints what it does and exits 0.
+
+import { runClaudeCardGate } from "../claude-card.js";
+
+const HELP = `cosyte-claude-card: check a repository's CLAUDE.md against the card spec.
+
+  cosyte-claude-card [--dir <repository root>]
+
+Gate, Hazard and Rules in order, at most 60 lines of at most 100 characters and 5,120 bytes, and an
+@AGENTS.md import when an AGENTS.md sits beside it. Exit 0 the card follows the spec, 1 a finding,
+2 CLAUDE.md could not be read.
+`;
+
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(HELP);
+} else {
+  process.exitCode = runClaudeCardGate({ argv: args });
+}

package/bin/cosyte-internal-refs.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// cosyte-internal-refs: the internal-reference gate over the repository in the working directory.
+// A bin of @cosyte/script-utils (D56), so a repository with no package.json can run it with
+// `npx -y -p @cosyte/script-utils cosyte-internal-refs`. It forwards every argument to the gate and exits with
+// the gate's own code; `--help` prints what it does and exits 0.
+
+import { runInternalRefsCli } from "../internal-refs.js";
+
+const HELP = `cosyte-internal-refs: run the internal-reference gate over the repository in the working directory.
+
+  cosyte-internal-refs [--config <path>]
+
+It refuses internal bookkeeping on a public surface: item identifiers, phase and wave language, ADR
+numbers, internal repo paths. The axes come from scripts/internal-refs.json (or --config). Exit 0
+clean, 1 hits, 2 the gate could not run.
+`;
+
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(HELP);
+} else {
+  process.exitCode = runInternalRefsCli(args);
+}

package/bin/cosyte-no-emdash.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+// cosyte-no-emdash: the em and en dash gate over the repository in the working directory.
+// A bin of @cosyte/script-utils (D56), so a repository with no package.json can run it with
+// `npx -y -p @cosyte/script-utils cosyte-no-emdash`. The gate is the shell script beside this
+// package's entry points; this runs it with bash, forwards every argument (`--help` included, which
+// the gate answers itself) and exits with its code.
+
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const gate = fileURLToPath(new URL("../check-no-emdash.sh", import.meta.url));
+const run = spawnSync("bash", [gate, ...process.argv.slice(2)], { stdio: "inherit" });
+if (run.error) {
+  process.stderr.write(`cosyte-no-emdash: could not run bash ${gate}: ${run.error.message}\n`);
+  process.exitCode = 1;
+} else {
+  process.exitCode = run.status ?? 1;
+}

package/bin/cosyte-phi-scan.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+// cosyte-phi-scan: the PHI commit-gate over the repository in the working directory.
+// A bin of @cosyte/script-utils (D56), so a repository with no package.json can run it with
+// `npx -y -p @cosyte/script-utils cosyte-phi-scan`. It forwards every argument to the gate and exits with
+// the gate's own code; `--help` prints what it does and exits 0.
+
+import { runPhiScanCli } from "../phi-scan.js";
+
+const HELP = `cosyte-phi-scan: run the PHI commit-gate over the repository in the working directory.
+
+  cosyte-phi-scan                 scan the whole repository
+  cosyte-phi-scan --staged        scan what is staged, Markdown excepted (the pre-commit route)
+  cosyte-phi-scan <path>...       scan these paths
+
+It carries the cross-cutting floor (a dashed SSN shape, an email at an undeclared domain) and
+reports a place and a rule, never the matched value. scripts/phi-allow-list.txt declares synthetic
+values, and scripts/phi-scan.exclude names literal tracked paths to leave out. Exit 0 clean, 1 hits,
+2 the scan could not account for something.
+`;
+
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(HELP);
+} else {
+  process.exitCode = runPhiScanCli(args);
+}

package/bin/cosyte-readme.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// cosyte-readme: the README gate for the library in the working directory.
+// A bin of @cosyte/script-utils (D56), so a repository with no package.json can run it with
+// `npx -y -p @cosyte/script-utils cosyte-readme`. It forwards every argument to the gate and exits with
+// the gate's own code; `--help` prints what it does and exits 0.
+
+import { runReadmeGate } from "../readme.js";
+
+const HELP = `cosyte-readme: check a library README against the house skeleton and npm's size limit.
+
+  cosyte-readme [--dir <package directory>]
+
+It reads README.md and package.json. Exit 0 the README follows the skeleton, 1 a finding (each
+names its line and rule), 2 the package could not be read.
+`;
+
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h")) {
+  process.stdout.write(HELP);
+} else {
+  process.exitCode = runReadmeGate({ argv: args });
+}

package/bin/script-utils.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// script-utils: one entry for every gate in @cosyte/script-utils (D56). npx runs the bin named
+// after the package, so `npx -y @cosyte/script-utils@<version> <command> [args]` reaches each gate
+// from a repository with no package.json. `<command> --help` is the gate's own help.
+
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const COMMANDS = {
+  "no-emdash": ["cosyte-no-emdash", "the em and en dash gate, over tracked files and their names"],
+  attw: ["cosyte-attw", "the attw publish gate, for the package here"],
+  "phi-scan": ["cosyte-phi-scan", "the PHI commit-gate, over the repository here"],
+  "internal-refs": [
+    "cosyte-internal-refs",
+    "the internal-reference gate, over the repository here",
+  ],
+  readme: ["cosyte-readme", "the README gate, for the library here"],
+  "claude-card": ["cosyte-claude-card", "the CLAUDE.md card checker"],
+  "agent-notes": ["cosyte-agent-notes", "the agent-notes checker"],
+  catalog: ["cosyte-catalog", "the catalog check, for the library here"],
+};
+
+const HELP = `script-utils: run one of the @cosyte/script-utils gates over the working directory.
+
+  script-utils <command> [arguments]
+  script-utils <command> --help
+
+${Object.entries(COMMANDS)
+  .map(([command, [bin, what]]) => `  ${command.padEnd(14)} ${what} (also the bin ${bin})`)
+  .join("\n")}
+`;
+
+const [command, ...rest] = process.argv.slice(2);
+if (command === undefined || command === "--help" || command === "-h") {
+  process.stdout.write(HELP);
+  process.exitCode = command === undefined ? 2 : 0;
+} else if (!(command in COMMANDS)) {
+  process.stderr.write(`script-utils: ${JSON.stringify(command)} is not a command.\n\n${HELP}`);
+  process.exitCode = 2;
+} else {
+  const bin = fileURLToPath(new URL(`./${COMMANDS[command][0]}.js`, import.meta.url));
+  const run = spawnSync(process.execPath, [bin, ...rest], { stdio: "inherit" });
+  process.exitCode = run.error ? 2 : (run.status ?? 2);
+}

package/check-no-emdash.sh

@@ -228,19 +228,32 @@ unset -f grep xargs sed awk 2>/dev/null || true
 # refuse_if_incomplete reads. That branch only refines wording, never the red.
 export LC_ALL=C.UTF-8
 
-# Matches U+2014 as the literal character and as its encodings: %E2%80%94 (URL), the
-# JS backslash-u escape, and the — / — / — HTML entities. The
-# escape is not theoretical in this repo: it is what the parser-template manifest
-# carried, and a literal-only sweep passed straight over it. Matches U+2013 the same
-# way: %E2%80%93, the backslash-u escape, and the – / – / – HTML
-# entities.
-#
-# THE MATCH VOCABULARY IS FROZEN at these twelve forms, six for each dash. A consumer
-# may narrow WHAT IS SCANNED through the declaration above; nothing may narrow WHAT IS
-# MATCHED, and widening it is a change every consuming repo inherits at once and is
-# specced as one. The en dash's six were that change (operator decision, 2026-11-07).
-PATTERN='\x{2014}|%E2%80%94|\\u2014|—|—|—'
-PATTERN+='|\x{2013}|%E2%80%93|\\u2013|–|–|–'
+# What counts as a dash, for U+2014 and U+2013 alike. Case never matters, so `—`
+# and `%e2%80%94` count too (D56: the forms the marketing and consulting scanner caught,
+# which this gate now matches so those repos lose nothing by moving to it):
+#
+#   the characters                       U+2014 U+2013
+#   HTML named entities, ; optional      — –
+#   HTML decimal references              — –    leading zeros and a missing ; too
+#   HTML hex references                  — –  leading zeros and a missing ; too
+#   URL encoding of the UTF-8 bytes      %E2%80%94 %E2%80%93
+#   backslash-u escapes (JS, JSON, Java, \u2014 \u{2014} \U00002014
+#     C#, Python, Rust, Swift)
+#   backslash-x escapes (PCRE, Perl)     \x{2014}
+#   CSS escapes                          \2014 \002014
+#   Unicode names (Python, Perl)         \N{EM DASH} \N{EN DASH}
+#
+# The lookaheads keep the near misses out: 𔃈 and the CSS escape \20140 name other
+# characters, and &mdashboard is not an entity. The escape forms are not theoretical: the
+# parser-template manifest once carried a backslash-u em dash, and a literal-only sweep
+# passed straight over it.
+#
+# A consumer may narrow WHAT IS SCANNED through the declaration above; nothing may narrow
+# WHAT IS MATCHED, and widening it is a change every consuming repo inherits at once. The
+# en dash's forms (operator decision, 2026-11-07) and these (D56) were such changes.
+PATTERN='(?i)\x{2014}|\x{2013}|&[mn]dash(?![a-z])|&#0*821[12](?![0-9])|&#x0*201[34](?![0-9a-f])'
+PATTERN+='|%E2%80%9[34]|\\u(?:0000)?201[34]|\\u\{0*201[34]\}|\\x\{0*201[34]\}'
+PATTERN+='|\\0{0,2}201[34](?![0-9a-f])|\\N\{E[MN] DASH\}'
 
 # The declaration's path, relative to the top level of the repo under scan. Deliberately
 # NOT relative to this file: in a consuming repo this file lives under `node_modules/`
@@ -281,10 +294,11 @@ SCAN_MODE=files
 
 refuse_arguments() {
   echo "ERROR: check-no-emdash - $1" >&2
-  echo "       The modes are: (no argument) to scan every tracked file; --stdin LABEL" >&2
-  echo "       to scan the text arriving on stdin; --list-scanned to write the paths the" >&2
-  echo "       default scan reads; --self-id to write the sha256 of the implementation" >&2
-  echo "       that is executing. Refusing to run rather than guess which was meant." >&2
+  echo "       The modes are: (no argument) to scan every tracked file and its name;" >&2
+  echo "       --stdin LABEL to scan the text arriving on stdin; --list-scanned to write the" >&2
+  echo "       paths the default scan reads; --self-id to write the sha256 of the" >&2
+  echo "       implementation that is executing; --help for this. Refusing to run rather" >&2
+  echo "       than guess which was meant." >&2
   exit 1
 }
 
@@ -324,6 +338,22 @@ case "${1:-}" in
       refuse_arguments "--self-id takes no further argument, and this was given: ${2}"
     fi
     ;;
+  --help | -h)
+    cat << 'USAGE'
+check-no-emdash: refuse the em dash (U+2014) and the en dash (U+2013), as the characters and
+in every encoded form, in the tracked files of the repository it runs in and in their names.
+
+  check-no-emdash.sh                 scan every tracked file and every tracked file name
+  check-no-emdash.sh --stdin LABEL   scan the text on stdin (a PR title, body, commit message)
+  check-no-emdash.sh --list-scanned  write the NUL-separated paths the default scan reads
+  check-no-emdash.sh --self-id       write the sha256 of the implementation that is executing
+
+A repository leaves paths out in scripts/check-no-emdash.exclude: one per line, an entry ending
+in / covers everything beneath it, # starts a comment. Exit 0 means the mode completed and found
+nothing banned; exit 1 means anything else.
+USAGE
+    exit 0
+    ;;
   *)
     refuse_arguments "unrecognised argument: ${1}"
     ;;
@@ -341,6 +371,7 @@ GITERR=$(mktemp)
 FILELIST=$(mktemp)
 SCANLIST=$(mktemp)
 PLAINLIST=$(mktemp)
+NAMELIST=$(mktemp)
 STDINBUF=$(mktemp)
 BINPROBE=$(mktemp)
 PROBEERR=$(mktemp)
@@ -353,8 +384,8 @@ PROBEERR=$(mktemp)
 # not lost with it.
 close_exit_vocabulary() {
   local code=$?
-  rm -f "$ERRLOG" "$GITERR" "$FILELIST" "$SCANLIST" "$PLAINLIST" "$STDINBUF" "$BINPROBE" \
-    "$PROBEERR"
+  rm -f "$ERRLOG" "$GITERR" "$FILELIST" "$SCANLIST" "$PLAINLIST" "$NAMELIST" "$STDINBUF" \
+    "$BINPROBE" "$PROBEERR"
   if [ "$code" -ne 0 ] && [ "$code" -ne 1 ]; then
     echo "ERROR: check-no-emdash - the run ended with status ${code}. This gate reports 0" >&2
     echo "       for a mode that completed clean and 1 for everything else, so it is" >&2
@@ -816,6 +847,7 @@ esac
 
 : > "$SCANLIST"
 : > "$PLAINLIST"
+: > "$NAMELIST"
 gitlinks=0
 scanned=0
 self_excluded=0
@@ -831,11 +863,16 @@ for i in "${!TRACKED[@]}"; do
 
   # What the repo declared it leaves out. Checked before the entry is opened, because an
   # excluded path is not read and its type on disk is therefore not this gate's business.
+  # It is not scanned at all, so its NAME is left out with its content.
   if is_excluded "$f"; then
     declared_excluded=$((declared_excluded + 1))
     continue
   fi
 
+  # A NAME IS COPY TOO (D56): every tracked path the declaration does not leave out has its
+  # name scanned, a gitlink's included, before any test of what is on disk.
+  printf '%s\0' "$f" >> "$NAMELIST"
+
   # `git ls-files` lists a submodule as a gitlink, which on disk is a REAL directory.
   # config has none today (checked: `git ls-files -s` lists no mode 160000 entry). The
   # skip is keyed on the INDEX MODE and never on the type on disk, because the two
@@ -886,12 +923,22 @@ if [ "$MODE" = list ]; then
   exit 0
 fi
 
+# File names first: NUL-separated in, one per line out. `-a` because a name is text whatever
+# bytes it holds, and the stderr capture refuses a name scan that could not complete.
+NAME_HITS=$(grep -z -a -P -e "$PATTERN" < "$NAMELIST" 2>> "$ERRLOG" | tr '\0' '\n' || true)
+refuse_if_incomplete
+
 HITS=$(xargs -0 -r grep -H -nP -e "$PATTERN" -- < "$SCANLIST" 2>> "$ERRLOG" || true)
 
 refuse_if_incomplete
 
+if [ -n "$NAME_HITS" ] && [ -n "$HITS" ]; then
+  fail_with_hits "the tracked file names and the tracked files listed above" \
+    "$NAME_HITS"$'\n'"$HITS"
+fi
+[ -n "$NAME_HITS" ] && fail_with_hits "the tracked file names listed above" "$NAME_HITS"
 [ -n "$HITS" ] && fail_with_hits "the tracked files listed above" "$HITS"
 
-echo "check-no-emdash: OK (no em or en dashes in ${scanned} of ${#TRACKED[@]} tracked file(s);" \
-  "${gitlinks} gitlink(s) skipped, ${self_excluded} excluded as the implementation under" \
-  "scan, ${declared_excluded} excluded by ${DECLARATION})"
+echo "check-no-emdash: OK (no em or en dashes in ${scanned} of ${#TRACKED[@]} tracked file(s)" \
+  "or their names; ${gitlinks} gitlink(s) skipped, ${self_excluded} excluded as the" \
+  "implementation under scan, ${declared_excluded} excluded by ${DECLARATION})"

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@cosyte/script-utils",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Zero-dependency helpers for the repo-local gate scripts in @cosyte/* repos.",
   "keywords": [
     "cli",
+    "bin",
     "entrypoint",
     "import-meta",
     "phi",
@@ -21,6 +22,17 @@
   "author": "Cosyte <hello@cosyte.com> (https://cosyte.com)",
   "type": "module",
   "main": "index.js",
+  "bin": {
+    "script-utils": "bin/script-utils.js",
+    "cosyte-no-emdash": "bin/cosyte-no-emdash.js",
+    "cosyte-attw": "bin/cosyte-attw.js",
+    "cosyte-phi-scan": "bin/cosyte-phi-scan.js",
+    "cosyte-internal-refs": "bin/cosyte-internal-refs.js",
+    "cosyte-readme": "bin/cosyte-readme.js",
+    "cosyte-claude-card": "bin/cosyte-claude-card.js",
+    "cosyte-agent-notes": "bin/cosyte-agent-notes.js",
+    "cosyte-catalog": "bin/cosyte-catalog.js"
+  },
   "types": "index.d.ts",
   "exports": {
     ".": {
@@ -75,6 +87,7 @@
     "agent-notes.js",
     "agent-notes.d.ts",
     "check-no-emdash.sh",
+    "bin",
     "README.md",
     "CHANGELOG.md"
   ],