@jmanuelcorral/openteam 0.16.0 → 0.16.2

package/dist/index.js

@@ -2,7 +2,8 @@ import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/index.ts
-import { dirname as dirname4 } from "node:path";
+import { readFile as readFile2 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname4 } from "node:path";
 import {
   tool as tool6
 } from "@opencode-ai/plugin";
@@ -2449,7 +2450,15 @@ function splitVirtualPath(path) {
 }
 
 // src/cli/graphOperator.ts
-var ALLOWED_GATE = { allowed: true, violations: [] };
+var ALLOWED_GATE = {
+  allowed: true,
+  violations: [],
+  advisories: []
+};
+var ALLOWED_EVALUATION = {
+  kind: "evaluated",
+  gate: ALLOWED_GATE
+};
 function journalRoot(config) {
   return config.graph?.journalRoot ?? DEFAULT_GRAPH_JOURNAL_ROOT;
 }
@@ -2539,7 +2548,7 @@ async function listWorktreeObservations(config, options) {
   })));
 }
 function createGraphOperator(options) {
-  const evaluateCutoverGate = options.evaluateCutoverGate ?? (async () => ALLOWED_GATE);
+  const evaluateCutoverGate = options.evaluateCutoverGate ?? (async () => ALLOWED_EVALUATION);
   const worktreeOptions = options.exec === undefined ? undefined : {
     exec: options.exec,
     repoRoot: options.repoRoot ?? process.cwd(),
@@ -4181,6 +4190,7 @@ function checkCertificate(status, name) {
 }
 function evaluateGraphGate(input) {
   const violations = [];
+  const advisories = [];
   const shadowV = checkCertificate(input.shadow, "shadow");
   if (shadowV !== undefined)
     violations.push(shadowV);
@@ -4189,7 +4199,7 @@ function evaluateGraphGate(input) {
     violations.push(releaseV);
   const soakV = checkCertificate(input.soak, "soak");
   if (soakV !== undefined)
-    violations.push(soakV);
+    advisories.push(soakV);
   if (input.migration === "pending") {
     violations.push({
       code: "migration-pending",
@@ -4209,7 +4219,8 @@ function evaluateGraphGate(input) {
   }
   return {
     allowed: violations.length === 0,
-    violations
+    violations,
+    advisories
   };
 }
 function isGateApplicable(mode) {
@@ -4298,6 +4309,36 @@ var SUPPORTED_OPENCODE_VERSIONS = [
   "1.18.18",
   "1.18.19"
 ];
+var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)/;
+function parseSemver(version) {
+  const normalized = version.trim().replace(/^[=^~v]+/, "");
+  const match = SEMVER_RE.exec(normalized);
+  if (match === null) {
+    throw new Error(`invalid semver: "${version}"`);
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
+}
+function isCertificateVersionCompatible(certifiedVersion, liveVersion) {
+  if (certifiedVersion === liveVersion) {
+    return true;
+  }
+  let certified;
+  let live;
+  try {
+    certified = parseSemver(certifiedVersion);
+    live = parseSemver(liveVersion);
+  } catch {
+    return false;
+  }
+  if (certified.major !== live.major || certified.minor !== live.minor) {
+    return false;
+  }
+  return live.patch >= certified.patch;
+}
 
 // src/graph/soakLedger.ts
 import { z as z15 } from "zod";
@@ -4556,8 +4597,8 @@ function parseShadowCertificate(value, opencodeVersion) {
   if (sha256Hex(canonicalCertificate(unsigned)) !== digest) {
     throw new ShadowCertificateError("digest-mismatch", "certificate digest does not cover the presented evidence");
   }
-  if (certificate.opencodeVersion !== opencodeVersion) {
-    throw new ShadowCertificateError("opencode-mismatch", `certified for "${certificate.opencodeVersion}", expected "${opencodeVersion}"`);
+  if (!isCertificateVersionCompatible(certificate.opencodeVersion, opencodeVersion)) {
+    throw new ShadowCertificateError("opencode-mismatch", `certified for "${certificate.opencodeVersion}", running "${opencodeVersion}" — evidence is accepted only on ${certificate.opencodeVersion} or a newer patch of the same minor line`);
   }
   return certificate;
 }
@@ -4741,8 +4782,8 @@ function parseReleaseCertificate(value, opencodeVersion, expectedShadowDigest) {
   if (sha256Hex(canonicalReleaseCertificate(unsigned)) !== digest) {
     throw new ReleaseCertificateError("digest-mismatch", "certificate digest does not cover the presented evidence");
   }
-  if (certificate.opencodeVersion !== opencodeVersion) {
-    throw new ReleaseCertificateError("opencode-mismatch", `certified for "${certificate.opencodeVersion}", expected "${opencodeVersion}"`);
+  if (!isCertificateVersionCompatible(certificate.opencodeVersion, opencodeVersion)) {
+    throw new ReleaseCertificateError("opencode-mismatch", `certified for "${certificate.opencodeVersion}", running "${opencodeVersion}" — evidence is accepted only on ${certificate.opencodeVersion} or a newer patch of the same minor line`);
   }
   return certificate;
 }
@@ -8344,7 +8385,7 @@ function legacyRosterFindings(audit) {
   }
   return findings;
 }
-function rosterHealthSection(audit, loadError, rosterRoleCount) {
+function rosterHealthSection(audit, loadError, rosterRoleCount, rosterMissing) {
   const auditFindings = audit?.findings ?? legacyRosterFindings(audit ?? {});
   const unparseable = auditFindings.find((finding) => finding.kind === "unparseable-roster");
   const unparseableMessage = loadError ?? unparseable?.message;
@@ -8357,6 +8398,14 @@ function rosterHealthSection(audit, loadError, rosterRoleCount) {
     ];
   }
   if (audit === undefined) {
+    if (rosterMissing === true) {
+      return [
+        "  roster health:",
+        `    ✗ ${OPENTEAM_ROSTER_PATH} does not exist — no team roster has been cast.`,
+        "      consequence: without a roster openteam cannot distribute work across roles, so every request is handled by a single agent and no work splitting happens.",
+        `      remedy: run \`openteam setup\` to cast a team and write the roster (${OPENTEAM_ROSTER_PATH}), then re-run \`openteam doctor\`.`
+      ];
+    }
     return [];
   }
   const missing = auditFindings.filter((finding) => finding.kind === "missing-guaranteed-role").map((finding) => finding.roleID);
@@ -8392,6 +8441,14 @@ function rosterHealthSection(audit, loadError, rosterRoleCount) {
   }
   return lines;
 }
+function orchestratorAgentSection() {
+  return [
+    "  orchestrator agent:",
+    `    ✗ ${ORCHESTRATOR_AGENT_PATH} does not exist — opencode has no openteam coordinator agent.`,
+    "      consequence: this is the primary agent that reads the roster and calls `openteam-orchestrate` to fan work out across roles; without it opencode has no openteam coordinator, so every request is handled by a single agent and no work splitting happens.",
+    `      remedy: run \`openteam setup\` to generate ${ORCHESTRATOR_AGENT_PATH}, then re-run \`openteam doctor\`.`
+  ];
+}
 function gitignoreSection(gitignore) {
   if (gitignore.missingRules.length === 0) {
     return [
@@ -8455,7 +8512,10 @@ function renderDoctor(input) {
   if (input.diagnostics !== undefined) {
     lines.push(...diagnosticsSection(input.diagnostics));
   }
-  lines.push(...rosterHealthSection(input.rosterAudit, input.rosterLoadError, input.rosterRoleCount));
+  lines.push(...rosterHealthSection(input.rosterAudit, input.rosterLoadError, input.rosterRoleCount, input.rosterMissing));
+  if (input.orchestratorAgentMissing === true) {
+    lines.push(...orchestratorAgentSection());
+  }
   if (input.gitignore !== undefined) {
     lines.push(...gitignoreSection(input.gitignore));
   }
@@ -8539,14 +8599,38 @@ function leaseLine(lease) {
   const state = lease.released ? "released" : "active";
   return `  lease:      ${lease.holder} → ${lease.runID} (${state})`;
 }
-function renderGraphStatus(snapshot) {
+function appendAdvisoryLines(lines, advisories) {
+  for (const advisory of advisories ?? []) {
+    lines.push(`    ⚠ advisory (non-blocking) ${advisory.code}: ${advisory.detail}`);
+  }
+}
+function appendEffectiveLines(lines, gate) {
+  switch (gate.kind) {
+    case "not-applicable":
+      return;
+    case "passed":
+      lines.push("  effective:  active");
+      appendAdvisoryLines(lines, gate.advisories);
+      return;
+    case "unevaluable":
+      lines.push("  effective:  unknown — could not evaluate the cutover gate");
+      lines.push(`    ${gate.reason}`);
+      return;
+    case "denied":
+      lines.push("  effective:  off — cutover gate denied");
+      for (const violation of gate.violations) {
+        lines.push(`    • ${violation.code}: ${violation.detail}`);
+      }
+      appendAdvisoryLines(lines, gate.advisories);
+  }
+}
+function renderGraphStatus(snapshot, gate = { kind: "not-applicable" }) {
   const lines = [
     "openteam graph status:",
-    `  config:     ${snapshot.effectiveMode} (source: ${snapshot.source})`,
-    leaseLine(snapshot.lease),
-    `  journal:    ${snapshot.journal}`,
-    `  effects:    ${snapshot.pendingEffects} pending, ${snapshot.unknownEffects} unknown`
+    `  config:     ${snapshot.effectiveMode} (source: ${snapshot.source})`
   ];
+  appendEffectiveLines(lines, gate);
+  lines.push(leaseLine(snapshot.lease), `  journal:    ${snapshot.journal}`, `  effects:    ${snapshot.pendingEffects} pending, ${snapshot.unknownEffects} unknown`);
   const needsReconciliation = isRecoveryRequired(snapshot.journal, snapshot.unknownEffects);
   if (needsReconciliation) {
     lines.push("  ⚠ Reconciliation required: journal or effects in an uncertain state.");
@@ -9990,8 +10074,7 @@ async function runAgents(deps, configPath, opencodeConfigPaths, configResolution
 async function runGraph(positionals, deps, configPath, configResolution) {
   const sub = positionals[1];
   if (sub === "status") {
-    const snapshot = await deps.readGraphSnapshot(configPath, configResolution);
-    return { exitCode: 0, stdout: renderGraphStatus(snapshot) };
+    return runGraphStatus(deps, configPath, configResolution);
   }
   if (sub === "cancel") {
     return runGraphCancel(positionals, deps, configPath, configResolution);
@@ -10046,7 +10129,9 @@ function renderGraphOutcome(outcome) {
 async function resolveOperatorGraphPolicy(config, operator) {
   let graph = resolveGraphConfig(config, "file");
   if (isGateApplicable(graph.effectiveMode)) {
-    graph = applyGraphGate(graph, await operator.evaluateCutoverGate());
+    const evaluation = await operator.evaluateCutoverGate(config);
+    const gate = evaluation.kind === "evaluated" ? evaluation.gate : { allowed: false, violations: [], advisories: [] };
+    graph = applyGraphGate(graph, gate);
   }
   return {
     graph,
@@ -10064,6 +10149,36 @@ function checkOperatorGate(policy) {
     stdout: renderLegacyGraphReason(decision2)
   };
 }
+async function runGraphStatus(deps, configPath, configResolution) {
+  const snapshot = await deps.readGraphSnapshot(configPath, configResolution);
+  if (!isGateApplicable(snapshot.effectiveMode)) {
+    return { exitCode: 0, stdout: renderGraphStatus(snapshot) };
+  }
+  const operator = deps.graphOperator;
+  if (operator === undefined) {
+    const gate2 = {
+      kind: "unevaluable",
+      reason: "graph operator ports are not configured"
+    };
+    return { exitCode: 0, stdout: renderGraphStatus(snapshot, gate2) };
+  }
+  const config = await deps.loadConfig(configPath, configResolution);
+  const evaluation = await operator.evaluateCutoverGate(config);
+  if (evaluation.kind === "unevaluable") {
+    const gate2 = {
+      kind: "unevaluable",
+      reason: evaluation.reason
+    };
+    return { exitCode: 0, stdout: renderGraphStatus(snapshot, gate2) };
+  }
+  const resolved = applyGraphGate(resolveGraphConfig(config, "file"), evaluation.gate);
+  const gate = resolved.gateDenied === true ? {
+    kind: "denied",
+    violations: resolved.gateViolations ?? [],
+    advisories: evaluation.gate.advisories
+  } : { kind: "passed", advisories: evaluation.gate.advisories };
+  return { exitCode: 0, stdout: renderGraphStatus(snapshot, gate) };
+}
 async function runGraphCancel(positionals, deps, configPath, configResolution) {
   const runID = positionals[2];
   if (runID === undefined || runID.trim() === "") {
@@ -10510,6 +10625,9 @@ async function runCli(argv, deps) {
         const summary = summarizeQueueWaits(queueEvents);
         queueWait = summary !== undefined ? { summary } : {};
       }
+      const rosterMissing = deps.loadRosterForDoctor !== undefined && roster === undefined && rosterLoadError === undefined;
+      const orchestratorAgentName = ORCHESTRATOR_AGENT_PATH.slice(ORCHESTRATOR_AGENT_PATH.lastIndexOf("/") + 1).replace(/\.md$/, "");
+      const orchestratorAgentMissing = !agentFiles.some((file) => file.name === orchestratorAgentName);
       return {
         exitCode: 0,
         stdout: renderDoctor({
@@ -10523,6 +10641,8 @@ async function runCli(argv, deps) {
           ...rosterAudit !== undefined ? { rosterAudit } : {},
           ...rosterRoleCount !== undefined ? { rosterRoleCount } : {},
           ...rosterLoadError !== undefined ? { rosterLoadError } : {},
+          ...rosterMissing ? { rosterMissing } : {},
+          ...orchestratorAgentMissing ? { orchestratorAgentMissing } : {},
           ...diagnostics !== undefined && diagnostics.length > 0 ? { diagnostics } : {},
           ...opencodeConfigError !== undefined ? { opencodeConfigError } : {},
           ...cacheEntries !== undefined ? { cacheEntries, cliVersion: deps.version } : {},
@@ -13387,7 +13507,7 @@ var createOtlpSpanExporter = (connection, config) => {
 // package.json
 var package_default = {
   name: "@jmanuelcorral/openteam",
-  version: "0.16.0",
+  version: "0.16.2",
   packageManager: "bun@1.3.14",
   description: "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
   license: "MIT",
@@ -13446,7 +13566,7 @@ var package_default = {
   sideEffects: false,
   scripts: {
     prebuild: "bun run clean",
-    build: "bun run build:js && bun run build:cli && bun run build:types",
+    build: "bun run build:js && bun run build:cli && bun run build:types && bun run build:certificates",
     "build:js": "bun build ./src/index.ts --target=node --format=esm --outfile=dist/index.js --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph",
     "build:cli": 'bun build ./src/cli.ts --target=node --format=esm --outfile=dist/cli.js --banner "#!/usr/bin/env node" --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @clack/prompts --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph',
     "build:types": "tsc -p tsconfig.build.json",
@@ -13455,6 +13575,7 @@ var package_default = {
     "test:cov": "bun test --coverage",
     "certify:shadow": "bun run scripts/certify-artifact.ts shadow",
     "certify:release": "bun run scripts/certify-artifact.ts release",
+    "build:certificates": "bun run certify:shadow && bun run certify:release && bun run scripts/bundle-certificates.ts",
     "coverage:check": "node scripts/check-coverage.mjs",
     typecheck: "tsc --noEmit",
     lint: "biome check .",
@@ -13563,9 +13684,16 @@ function warnSoakEvidenceRejections(result, warn) {
 var SHADOW_CERT_PATH = "artifacts/graph-shadow-certificate.json";
 var RELEASE_CERT_PATH = "artifacts/graph-release-certificate.json";
 var SOAK_CERT_PATH = "artifacts/graph-soak-certificate.json";
-async function readAndParseCertificate(storage, path4, parse2, digestExtractor) {
+async function readPackagedCertificate(path4) {
+  try {
+    return await readFile2(new URL(`./certificates/${basename2(path4)}`, import.meta.url), "utf8");
+  } catch {
+    return;
+  }
+}
+async function readAndParseCertificate(storage, path4, parse2, digestExtractor, fallbackRead) {
   try {
-    const content = await storage.read(path4);
+    const content = await storage.read(path4) ?? (fallbackRead === undefined ? undefined : await fallbackRead(path4));
     if (content === undefined) {
       return { status: "absent" };
     }
@@ -13733,24 +13861,30 @@ function createLazyOpencodeVersionReader(serverUrl, options = {}) {
     }
   };
 }
-async function buildGateInput(config, storage, opencodeVersion, warn) {
-  const shadow = await readAndParseCertificate(storage, SHADOW_CERT_PATH, (raw) => parseShadowCertificate(raw, opencodeVersion), (cert) => shadowCertificateBindingDigest(cert.evidence));
+async function buildGateInput(config, storage, opencodeVersion, warn, packagedRead = readPackagedCertificate) {
+  const shadow = await readAndParseCertificate(storage, SHADOW_CERT_PATH, (raw) => parseShadowCertificate(raw, opencodeVersion), (cert) => shadowCertificateBindingDigest(cert.evidence), packagedRead);
   const shadowDigest = shadow.status === "valid" ? shadow.digest : "0".repeat(64);
-  const release = await readAndParseCertificate(storage, RELEASE_CERT_PATH, (raw) => parseReleaseCertificate(raw, opencodeVersion, shadowDigest), (cert) => cert.digest);
+  const release = await readAndParseCertificate(storage, RELEASE_CERT_PATH, (raw) => parseReleaseCertificate(raw, opencodeVersion, shadowDigest), (cert) => cert.digest, packagedRead);
   let soakLedgerDigest = "0".repeat(64);
   try {
     const recorderPorts = recorderPortsFromStorage(storage);
     const chainRead = await readAllChains(recorderPorts, SOAK_EVIDENCE_DIR);
     warnSoakEvidenceRejections(chainRead, warn);
-    if (chainRead.chains.length > 0) {
-      soakLedgerDigest = canonicalLedger(chainRead.chains);
-    }
+    soakLedgerDigest = canonicalLedger(chainRead.chains);
   } catch {}
   const soak = await readAndParseCertificate(storage, SOAK_CERT_PATH, (raw) => parseSoakCertificate(raw, DEFAULT_SOAK_POLICY, soakLedgerDigest), (cert) => cert.digest);
   const migration = "complete";
   const operatorApproval = config.graph?.operatorApproval ?? false;
   return { shadow, release, soak, migration, operatorApproval };
 }
+var OPENCODE_VERSION_UNRESOLVED_REASON = "the opencode version is not determinable outside a running opencode session, " + "so the cutover gate cannot be verified here — the running plugin logs the " + "authoritative gate result and warns loudly on a real denial";
+async function evaluateCutoverGateForBoundary(config, storage, version) {
+  if (version === undefined) {
+    return { kind: "unevaluable", reason: OPENCODE_VERSION_UNRESOLVED_REASON };
+  }
+  const gateInput = await buildGateInput(config, storage, version, () => {});
+  return { kind: "evaluated", gate: evaluateGraphGate(gateInput) };
+}
 function recorderPortsFromStorage(storage) {
   return {
     fs: {
@@ -13838,7 +13972,7 @@ async function readStoredRosterForDoctor(storage) {
   }
 }
 var auditStoredRosterForDoctor = (roster, configuredRoles) => typeof roster === "string" ? auditRoster(roster, configuredRoles) : auditRoster(roster, configuredRoles);
-function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SESSIONS_DIR, storage = createFsStorageProvider(process.cwd()), fallbackSource = "options", rawOptions) {
+function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SESSIONS_DIR, storage = createFsStorageProvider(process.cwd()), fallbackSource = "options", rawOptions, resolveOpencodeVersion) {
   return {
     loadConfig: async (path4, resolution = { explicit: false }) => {
       const content = await readCliConfigFromStorage(storage, path4, resolution);
@@ -13912,7 +14046,8 @@ function createCliDeps(config, registry, telemetryPath, sessionsDir = DEFAULT_SE
     }),
     graphOperator: createGraphOperator({
       storage,
-      holder: "openteam-cli"
+      holder: "openteam-cli",
+      evaluateCutoverGate: async (gateConfig) => evaluateCutoverGateForBoundary(gateConfig, storage, resolveOpencodeVersion === undefined ? undefined : await resolveOpencodeVersion())
     }),
     configPath: DEFAULT_CONFIG_PATH,
     telemetryPath,
@@ -14042,7 +14177,14 @@ var server = async (ctx, rawOptions) => {
     injectMemory,
     onRoute: (sid, model) => sessionTracker.trackRoutedModel(sid, model)
   });
-  const cliDeps = createCliDeps(config, registry, telemetryPath, sessionsDir, storage, runtimeConfig.source, rawOptions);
+  const getOpencodeVersion = createLazyOpencodeVersionReader(ctx.serverUrl, {
+    client: ctx.client,
+    onFailure: createOpencodeVersionReadFailureLogger(MAX_LOGGED_OPENCODE_VERSION_FAILURE_CAUSES, diagnostics.warn("opencode-version-read-failed", { toast: false }))
+  });
+  const cliDeps = createCliDeps(config, registry, telemetryPath, sessionsDir, storage, runtimeConfig.source, rawOptions, async () => {
+    const version = await getOpencodeVersion();
+    return version === "unknown" ? undefined : version;
+  });
   const toolcalls = createToolcallTracker({ sink });
   const announcedSessions = new Set;
   const announceEndpoint = (sessionID) => {
@@ -14065,10 +14207,6 @@ var server = async (ctx, rawOptions) => {
   if (config.privacyMode === "forceLocalOnSensitive" && localDefault(config) === null) {
     warnInertPrivacySetting(runtimeConfig.searchedPaths, diagnostics.warn("privacy-inert"));
   }
-  const getOpencodeVersion = createLazyOpencodeVersionReader(ctx.serverUrl, {
-    client: ctx.client,
-    onFailure: createOpencodeVersionReadFailureLogger(MAX_LOGGED_OPENCODE_VERSION_FAILURE_CAUSES, diagnostics.warn("opencode-version-read-failed", { toast: false }))
-  });
   if (isGateApplicable(graphConfig.effectiveMode)) {
     const opencodeVersion = await getOpencodeVersion();
     const gateInput = await buildGateInput(config, storage, opencodeVersion, diagnostics.warn("soak-evidence-rejected", { toast: false }));
@@ -14227,12 +14365,14 @@ export {
   warnInertPrivacySetting,
   server,
   recorderPortsFromStorage,
+  readPackagedCertificate,
   readOpencodeVersion,
   logTelemetryWarning,
   logTelemetryError,
   logOpencodeServerUrl,
   logAvailabilityRefreshError,
   isMissingFile,
+  evaluateCutoverGateForBoundary,
   src_default as default,
   createOpencodeVersionReadFailureLogger,
   createLazyOpencodeVersionReader,
@@ -14240,5 +14380,6 @@ export {
   createCliDeps,
   buildGateInput,
   PACKAGE_VERSION,
+  OPENCODE_VERSION_UNRESOLVED_REASON,
   MAX_LOGGED_OPENCODE_VERSION_FAILURE_CAUSES
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jmanuelcorral/openteam",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "packageManager": "bun@1.3.14",
   "description": "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
   "license": "MIT",
@@ -59,7 +59,7 @@
   "sideEffects": false,
   "scripts": {
     "prebuild": "bun run clean",
-    "build": "bun run build:js && bun run build:cli && bun run build:types",
+    "build": "bun run build:js && bun run build:cli && bun run build:types && bun run build:certificates",
     "build:js": "bun build ./src/index.ts --target=node --format=esm --outfile=dist/index.js --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph",
     "build:cli": "bun build ./src/cli.ts --target=node --format=esm --outfile=dist/cli.js --banner \"#!/usr/bin/env node\" --external @opencode-ai/plugin --external @opencode-ai/sdk --external zod --external @clack/prompts --external @opentelemetry/api --external @opentelemetry/sdk-trace-base --external @opentelemetry/exporter-trace-otlp-http --external @opentelemetry/resources --external @langchain/langgraph",
     "build:types": "tsc -p tsconfig.build.json",
@@ -68,6 +68,7 @@
     "test:cov": "bun test --coverage",
     "certify:shadow": "bun run scripts/certify-artifact.ts shadow",
     "certify:release": "bun run scripts/certify-artifact.ts release",
+    "build:certificates": "bun run certify:shadow && bun run certify:release && bun run scripts/bundle-certificates.ts",
     "coverage:check": "node scripts/check-coverage.mjs",
     "typecheck": "tsc --noEmit",
     "lint": "biome check .",