@labelbox/recursion-cli 0.0.0 → 0.0.41

package/dist/resolve.d.ts

@@ -0,0 +1,12 @@
+/** Read a global flag's value from argv (`--name value` or `--name=value`). */
+export declare function flagValue(argv: string[], name: string): string | undefined;
+/** `--api-key` wins over `LABELBOX_API_KEY`; undefined when neither is set. */
+export declare function resolveApiKey(argv: string[]): string | undefined;
+/**
+ * The base URL from the environment: the current `RECURSION_BASE_URL`, else the
+ * deprecated `RL_GYM_BASE_URL`. Shared by `resolveBaseUrl` here and the `rl skills`
+ * resolver so the precedence lives — and is tested — in one place.
+ */
+export declare function envBaseUrl(): string | undefined;
+/** `--base-url` wins over `RECURSION_BASE_URL` (or the deprecated `RL_GYM_BASE_URL`), falling back to the production host. */
+export declare function resolveBaseUrl(argv: string[]): string;

package/dist/resolve.js

@@ -0,0 +1,43 @@
+import process from 'node:process';
+import { DEFAULT_BASE_URL } from './manifest.js';
+// Resolving the API key + base URL from argv + env, before commander parses — the
+// live CLI needs both up front to fetch the command manifest the rest of the tree
+// is built from. Global flags precede the command (documented), so a flat argv scan
+// is sufficient and matches commander's later parse. Extracted from bin.ts so the
+// precedence is unit-testable (bin.ts runs `main()` on import).
+/** Read a global flag's value from argv (`--name value` or `--name=value`). */
+export function flagValue(argv, name) {
+    const eq = argv.find((arg) => arg.startsWith(`--${name}=`));
+    if (eq)
+        return eq.slice(name.length + 3);
+    const index = argv.indexOf(`--${name}`);
+    if (index >= 0) {
+        // The space-form value is the next token — but only if it isn't itself an
+        // option (`rl --api-key --quiet`): a dangling `--api-key` has no value, so we
+        // return undefined and let the env fallback apply rather than silently
+        // consuming `--quiet` as a bogus (non-empty) key. Values that legitimately
+        // start with `-` use the `--name=value` form above.
+        const next = argv[index + 1];
+        if (next !== undefined && !next.startsWith('-'))
+            return next;
+    }
+    return undefined;
+}
+/** `--api-key` wins over `LABELBOX_API_KEY`; undefined when neither is set. */
+export function resolveApiKey(argv) {
+    const { LABELBOX_API_KEY: envApiKey } = process.env;
+    return flagValue(argv, 'api-key') ?? envApiKey;
+}
+/**
+ * The base URL from the environment: the current `RECURSION_BASE_URL`, else the
+ * deprecated `RL_GYM_BASE_URL`. Shared by `resolveBaseUrl` here and the `rl skills`
+ * resolver so the precedence lives — and is tested — in one place.
+ */
+export function envBaseUrl() {
+    const { RECURSION_BASE_URL: recursionBaseUrl, RL_GYM_BASE_URL: legacyBaseUrl } = process.env;
+    return recursionBaseUrl ?? legacyBaseUrl;
+}
+/** `--base-url` wins over `RECURSION_BASE_URL` (or the deprecated `RL_GYM_BASE_URL`), falling back to the production host. */
+export function resolveBaseUrl(argv) {
+    return flagValue(argv, 'base-url') ?? envBaseUrl() ?? DEFAULT_BASE_URL;
+}

package/dist/run.d.ts

@@ -0,0 +1,39 @@
+import type { Manifest } from './manifest.js';
+import type { GrantedPermissions } from './permissions.js';
+export interface RunDeps {
+    /** Full argv including the node + script entries, as `parseAsync` expects. */
+    argv: string[];
+    /**
+     * Resolves the CLI version lazily. A thunk (not a plain string) so a throw from
+     * reading package.json happens *inside* `run()` — surfacing as a rejected promise
+     * bin.ts renders via `fail()`, not a raw stack trace before the promise exists.
+     */
+    version: () => string;
+    fetchManifest: (baseUrl: string, apiKey: string) => Promise<Manifest>;
+    /**
+     * Resolves the caller's granted permissions for the per-command gate. Never
+     * rejects — it resolves to `undefined` (fail-open) on any failure, so a
+     * permissions outage degrades to "gate nothing", never to a broken CLI.
+     */
+    fetchPermissions: (baseUrl: string, apiKey: string) => Promise<GrantedPermissions>;
+    stdout: (text: string) => void;
+    stderr: (text: string) => void;
+    /**
+     * Whether `scaffold`, `submit`, and `skills` are registered at all. See
+     * `ProgramContext.localCheckout` — the terminal entrypoint passes `true`, an
+     * embedding server passes `false`.
+     */
+    localCheckout: boolean;
+}
+/**
+ * Resolve `--version` and the no-key branches with no network, then fetch the
+ * manifest and build + run the command tree.
+ *
+ * **Never throws and never exits.** It returns the exit code the caller should
+ * use, having already rendered any failure to `deps.stderr`. That contract is
+ * what lets the MCP endpoint run one `rl` invocation in-process on behalf of an
+ * agent: a thrown error would become a 500 instead of a tool result, and a
+ * `process.exit` would take the API server down mid-request. `bin.ts` is the only
+ * caller that turns the returned code back into a real exit.
+ */
+export declare function run(deps: RunDeps): Promise<number>;

package/dist/run.js

@@ -0,0 +1,80 @@
+import { CommanderError } from 'commander';
+import { buildBaseProgram, buildProgram, formatError } from './program.js';
+import { resolveApiKey, resolveBaseUrl } from './resolve.js';
+// The CLI orchestration, extracted from bin.ts (which runs it on import) so it has a
+// seam for unit tests: the `--version` short-circuit and the no-key branches all
+// resolve *before* any network, and that "works offline / with no key" guarantee
+// lives only here. Dependencies (the manifest fetch + the output sink) are injected.
+const MISSING_KEY_MESSAGE = 'missing API key — set LABELBOX_API_KEY or pass --api-key (the CLI fetches its commands from the server)';
+/**
+ * Resolve `--version` and the no-key branches with no network, then fetch the
+ * manifest and build + run the command tree.
+ *
+ * **Never throws and never exits.** It returns the exit code the caller should
+ * use, having already rendered any failure to `deps.stderr`. That contract is
+ * what lets the MCP endpoint run one `rl` invocation in-process on behalf of an
+ * agent: a thrown error would become a 500 instead of a tool result, and a
+ * `process.exit` would take the API server down mid-request. `bin.ts` is the only
+ * caller that turns the returned code back into a real exit.
+ */
+export async function run(deps) {
+    try {
+        return await execute(deps);
+    }
+    catch (err) {
+        // Commander signals help and `--version` by throwing with exitCode 0 — the text
+        // has already gone to the sinks, so that is a success, not a failure. Its real
+        // errors (unknown command, bad option value) have likewise already been written
+        // by `writeErr`, so re-rendering them here would duplicate the message.
+        if (err instanceof CommanderError)
+            return err.exitCode;
+        deps.stderr(`error: ${formatError(err)}\n`);
+        return 1;
+    }
+}
+async function execute(deps) {
+    const args = deps.argv.slice(2);
+    // Resolve inside execute() (not in bin.ts at the call site) so a throw is caught
+    // by run()'s handler and rendered, not an uncaught synchronous crash.
+    const version = deps.version();
+    // `--version` is the one thing that works with no key and no network — resolve it
+    // before fetching the manifest the rest of the CLI is built from.
+    if (args.includes('--version') || args.includes('-V')) {
+        deps.stdout(`${version}\n`);
+        return 0;
+    }
+    // Pre-resolve auth (before commander parses) — threaded into the program so the
+    // manifest fetch and per-op dispatch use exactly one source.
+    const apiKey = resolveApiKey(args);
+    const baseUrl = resolveBaseUrl(args);
+    if (!apiKey) {
+        // Top-level help still prints (global flags + a hint); everything else needs the
+        // key, since the command tree itself comes from the gated manifest.
+        if (args.includes('--help') || args.includes('-h')) {
+            buildBaseProgram(version, deps)
+                .addHelpText('after', '\nSet LABELBOX_API_KEY (or pass --api-key) — the CLI fetches its commands from the server.')
+                .outputHelp();
+            return 0;
+        }
+        throw new Error(MISSING_KEY_MESSAGE);
+    }
+    // The manifest (command surface) and the caller's permissions (the per-command
+    // gate) are independent fetches — run them together. The permissions fetch
+    // never rejects (fail-open), so this can't turn a permissions outage into a
+    // CLI failure.
+    const [manifest, granted] = await Promise.all([
+        deps.fetchManifest(baseUrl, apiKey),
+        deps.fetchPermissions(baseUrl, apiKey),
+    ]);
+    const program = buildProgram(manifest, {
+        apiKey,
+        baseUrl,
+        version,
+        granted,
+        localCheckout: deps.localCheckout,
+        stdout: deps.stdout,
+        stderr: deps.stderr,
+    });
+    await program.parseAsync(deps.argv);
+    return 0;
+}

package/dist/skills.d.ts

@@ -0,0 +1,69 @@
+import type { Command } from 'commander';
+import { z } from 'zod';
+/** sha256 (hex) of the markdown with any injected `skill-version:` line removed. */
+export declare function skillVersionHash(text: string): string;
+/** The `skill-version` value stamped into a file's frontmatter, if present. */
+export declare function stampedVersion(content: string): string | undefined;
+export type SkillStatus = 'missing' | 'up-to-date' | 'out-of-date';
+/** Compare an installed file (or its absence) against the latest published version. */
+export declare function skillStatus(installed: string | undefined, latestVersion: string): SkillStatus;
+/**
+ * True if the installed file looks locally modified: its recomputed body hash
+ * doesn't match its own `skill-version` stamp, or it carries no stamp at all
+ * (unknown provenance). Such a file is never overwritten without `--force`.
+ */
+export declare function isHandEdited(installed: string): boolean;
+declare const SkillPayloadSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    content: z.ZodString;
+}, z.core.$strip>;
+type SkillPayload = z.infer<typeof SkillPayloadSchema>;
+declare const SkillSummarySchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strip>;
+type SkillSummary = z.infer<typeof SkillSummarySchema>;
+/**
+ * Fetch `{ name, version, content }` for a skill from `GET /v1/skills/<name>`.
+ *
+ * Exported only so `support-urls.test.ts` can assert its hand-written URL join
+ * against the committed spec, alongside the other support endpoints.
+ */
+export declare function fetchSkill(name: string, apiKey: string, baseUrl: string): Promise<SkillPayload>;
+/**
+ * Fetch the catalog of installable skills from `GET /skills`. The endpoint is now
+ * gated (the CLI always has a key — `bin.ts` requires one before any command), so
+ * the key is sent when present; it stays optional here only so the function is
+ * reusable in contexts that legitimately have none.
+ */
+export declare function listSkills(opts: {
+    apiKey?: string | undefined;
+    baseUrl: string;
+}): Promise<SkillSummary[]>;
+/** Programmatic core of `rl skills check` — fetch latest, read installed, compare. */
+export declare function checkSkill(name: string, opts: {
+    apiKey: string;
+    baseUrl: string;
+    skillFile?: string | undefined;
+}): Promise<{
+    status: SkillStatus;
+    latestVersion: string;
+}>;
+/** Raised when `install` refuses to clobber a locally-modified file (no `--force`). */
+export declare class HandEditedError extends Error {
+}
+/** Programmatic core of `rl skills install` — fetch latest and write it (guarded). */
+export declare function installSkill(name: string, opts: {
+    apiKey: string;
+    baseUrl: string;
+    skillFile?: string | undefined;
+    force?: boolean | undefined;
+}): Promise<{
+    path: string;
+    action: 'installed' | 'updated' | 'unchanged';
+    version: string;
+}>;
+/** Register the `skills check` / `skills install` command group on `program`. */
+export declare function addSkillsCommands(program: Command, docsHelpGroup: string): void;
+export {};

package/dist/skills.js

@@ -0,0 +1,256 @@
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import process from 'node:process';
+import { z } from 'zod';
+import { DEFAULT_BASE_URL, supportUrl } from './manifest.js';
+import { envBaseUrl } from './resolve.js';
+// ── bespoke `rl skills` group (hand-written, not spec-derived) ────────────────
+//
+// Keeps a downloaded Claude skill current. The platform serves each skill from
+// `GET /skills/:skillName` with a content-hash version; this group fetches that,
+// compares it to the installed `~/.claude/skills/<name>/SKILL.md`, and refreshes
+// it. The skill's own doctor preflight runs `rl skills check` each session and
+// refreshes via `rl skills install` when stale. Deliberately NOT an `@SdkRoute`
+// endpoint — that would auto-generate a colliding `rl skills` command.
+/** The skill installed by default when no name is given. */
+const DEFAULT_SKILL = 'recursion';
+// ── hash contract — MUST stay byte-identical to apps/recursion/api/src/skills/skill-hash.ts ──
+// (the two packages share no published runtime dependency). A committed fixture
+// pins the same hash in both test suites so the duplication can't drift.
+/** A single `skill-version:` line (with its trailing newline), anywhere in the text. */
+const SKILL_VERSION_LINE = /^skill-version:.*\r?\n/m;
+/** sha256 (hex) of the markdown with any injected `skill-version:` line removed. */
+export function skillVersionHash(text) {
+    return createHash('sha256').update(text.replace(SKILL_VERSION_LINE, ''), 'utf8').digest('hex');
+}
+/** The `skill-version` value stamped into a file's frontmatter, if present. */
+export function stampedVersion(content) {
+    return /^skill-version:[ \t]*(\S+)[ \t]*\r?$/m.exec(content)?.[1];
+}
+/** Compare an installed file (or its absence) against the latest published version. */
+export function skillStatus(installed, latestVersion) {
+    if (installed === undefined)
+        return 'missing';
+    return stampedVersion(installed) === latestVersion ? 'up-to-date' : 'out-of-date';
+}
+/**
+ * True if the installed file looks locally modified: its recomputed body hash
+ * doesn't match its own `skill-version` stamp, or it carries no stamp at all
+ * (unknown provenance). Such a file is never overwritten without `--force`.
+ */
+export function isHandEdited(installed) {
+    const stamped = stampedVersion(installed);
+    if (stamped === undefined)
+        return true;
+    return skillVersionHash(installed) !== stamped;
+}
+// Validate every API response at the I/O boundary with Zod (code-standards.md:
+// "Validate externally, type internally"). The backend owns the authoritative
+// schemas in skills.dto.ts; these are the minimal CLI-side mirrors.
+const SkillPayloadSchema = z.object({
+    name: z.string(),
+    version: z.string(),
+    content: z.string(),
+});
+const SkillSummarySchema = z.object({
+    name: z.string(),
+    description: z.string(),
+});
+/** Resolve the base URL for the skills endpoints (never throws — they are public). */
+function resolveBaseUrl(program) {
+    const { baseUrl } = program.opts();
+    // --base-url wins over the env vars; none set → the production proxy. Shares
+    // envBaseUrl() with resolve.ts so the RECURSION_BASE_URL / RL_GYM_BASE_URL
+    // precedence lives in one tested place.
+    return baseUrl ?? envBaseUrl() ?? DEFAULT_BASE_URL;
+}
+/** The configured API key (--api-key or LABELBOX_API_KEY), if any. */
+function apiKeyOrUndefined(program) {
+    const { apiKey } = program.opts();
+    const { LABELBOX_API_KEY: envApiKey } = process.env;
+    return apiKey ?? envApiKey;
+}
+function resolveAuth(program) {
+    const apiKey = apiKeyOrUndefined(program);
+    if (!apiKey) {
+        throw new Error('missing API key — set LABELBOX_API_KEY or pass --api-key');
+    }
+    return { apiKey, baseUrl: resolveBaseUrl(program) };
+}
+// Each `rl skills` fetch is bounded for the same reason as the manifest fetch
+// (see manifest.ts): a server that accepts the connection but never responds would
+// otherwise hang `rl skills check`/`install`/`list` indefinitely. The timeout makes
+// `fetch` reject so the caller surfaces a clear error rather than blocking forever.
+const SKILLS_FETCH_TIMEOUT_MS = 30_000;
+/**
+ * Fetch `{ name, version, content }` for a skill from `GET /v1/skills/<name>`.
+ *
+ * Exported only so `support-urls.test.ts` can assert its hand-written URL join
+ * against the committed spec, alongside the other support endpoints.
+ */
+export async function fetchSkill(name, apiKey, baseUrl) {
+    const url = supportUrl(baseUrl, `/skills/${encodeURIComponent(name)}`);
+    const res = await fetch(url, {
+        // biome-ignore lint/style/useNamingConvention: HTTP header names are not camelCase.
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(SKILLS_FETCH_TIMEOUT_MS),
+    });
+    if (res.status === 404) {
+        throw new Error(`unknown skill "${name}" (the platform has no skill by that name)`);
+    }
+    if (!res.ok) {
+        throw new Error(`could not fetch skill "${name}" — HTTP ${res.status}`);
+    }
+    const parsed = SkillPayloadSchema.safeParse(await res.json());
+    if (!parsed.success) {
+        throw new Error(`unexpected response shape from ${url}`);
+    }
+    return parsed.data;
+}
+/**
+ * Fetch the catalog of installable skills from `GET /skills`. The endpoint is now
+ * gated (the CLI always has a key — `bin.ts` requires one before any command), so
+ * the key is sent when present; it stays optional here only so the function is
+ * reusable in contexts that legitimately have none.
+ */
+export async function listSkills(opts) {
+    const url = supportUrl(opts.baseUrl, '/skills');
+    const res = await fetch(url, {
+        // biome-ignore lint/style/useNamingConvention: HTTP header names are not camelCase.
+        headers: opts.apiKey === undefined ? {} : { Authorization: `Bearer ${opts.apiKey}` },
+        signal: AbortSignal.timeout(SKILLS_FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+        throw new Error(`could not list skills — HTTP ${res.status}`);
+    }
+    const parsed = z.array(SkillSummarySchema).safeParse(await res.json());
+    if (!parsed.success) {
+        throw new Error(`unexpected response shape from ${url}`);
+    }
+    return parsed.data;
+}
+/** Global install path for a skill, unless `--skill-file` overrides it. */
+function installedPath(name, skillFile) {
+    return skillFile ?? join(homedir(), '.claude', 'skills', name, 'SKILL.md');
+}
+function readInstalled(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Programmatic core of `rl skills check` — fetch latest, read installed, compare. */
+export async function checkSkill(name, opts) {
+    const latest = await fetchSkill(name, opts.apiKey, opts.baseUrl);
+    const installed = readInstalled(installedPath(name, opts.skillFile));
+    return { status: skillStatus(installed, latest.version), latestVersion: latest.version };
+}
+/** Raised when `install` refuses to clobber a locally-modified file (no `--force`). */
+export class HandEditedError extends Error {
+}
+/** Programmatic core of `rl skills install` — fetch latest and write it (guarded). */
+export async function installSkill(name, opts) {
+    const latest = await fetchSkill(name, opts.apiKey, opts.baseUrl);
+    const path = installedPath(name, opts.skillFile);
+    const existing = readInstalled(path);
+    if (existing !== undefined && opts.force !== true && isHandEdited(existing)) {
+        throw new HandEditedError(`${path} looks hand-edited (its content no longer matches its skill-version stamp). ` +
+            'Refusing to overwrite — re-run with --force to replace it with the published version.');
+    }
+    // Already the published version — don't rewrite the file (no mtime churn) or
+    // claim a change happened; `install` run directly is then honest that nothing
+    // needs to take effect.
+    if (existing === latest.content) {
+        return { path, action: 'unchanged', version: latest.version };
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, latest.content);
+    return {
+        path,
+        action: existing === undefined ? 'installed' : 'updated',
+        version: latest.version,
+    };
+}
+/** Register the `skills check` / `skills install` command group on `program`. */
+export function addSkillsCommands(program, docsHelpGroup) {
+    const skills = program
+        .command('skills')
+        .helpGroup(docsHelpGroup)
+        .description('Install and update the downloadable Claude skills for this platform');
+    skills
+        .command('list')
+        .description('List the skills available to install')
+        .action(async () => {
+        try {
+            // The CLI always has a key by the time any command runs (bin.ts requires
+            // one), so pass it through; the endpoint is gated like everything else.
+            const available = await listSkills({
+                apiKey: apiKeyOrUndefined(program),
+                baseUrl: resolveBaseUrl(program),
+            });
+            if (available.length === 0) {
+                process.stdout.write('No skills are available.\n');
+                return;
+            }
+            const lines = available.map((s) => s.description ? `  ${s.name} — ${s.description}` : `  ${s.name}`);
+            process.stdout.write(`Installable skills (run \`rl skills install <name>\`):\n${lines.join('\n')}\n`);
+        }
+        catch (err) {
+            process.stderr.write(`error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    });
+    skills
+        .command('check [name]')
+        .description('Report whether the installed skill matches the latest published version')
+        .option('--skill-file <path>', 'Check this file instead of the global ~/.claude/skills path')
+        .action(async (name, opts) => {
+        const skill = name ?? DEFAULT_SKILL;
+        try {
+            const { apiKey, baseUrl } = resolveAuth(program);
+            const { status } = await checkSkill(skill, { apiKey, baseUrl, skillFile: opts.skillFile });
+            if (status === 'up-to-date') {
+                process.stdout.write(`${skill} is up to date.\n`);
+                return;
+            }
+            const lead = status === 'missing' ? 'is not installed' : 'is out of date';
+            process.stdout.write(`${skill} ${lead} — run \`rl skills install ${skill}\`.\n`);
+            process.exit(1);
+        }
+        catch (err) {
+            process.stderr.write(`error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    });
+    skills
+        .command('install [name]')
+        .description('Install or update a skill to the latest published version')
+        .option('--force', 'Overwrite even if the installed file looks hand-edited')
+        .option('--skill-file <path>', 'Write to this file instead of the global ~/.claude/skills path')
+        .action(async (name, opts) => {
+        const skill = name ?? DEFAULT_SKILL;
+        try {
+            const { apiKey, baseUrl } = resolveAuth(program);
+            const { path, action, version } = await installSkill(skill, {
+                apiKey,
+                baseUrl,
+                skillFile: opts.skillFile,
+                force: opts.force,
+            });
+            if (action === 'unchanged') {
+                process.stdout.write(`${skill} is already up to date (version ${version.slice(0, 12)}).\n`);
+                return;
+            }
+            process.stdout.write(`${action === 'installed' ? 'Installed' : 'Updated'} ${skill} → ${path} ` +
+                `(version ${version.slice(0, 12)}). Takes effect on the next /${skill}.\n`);
+        }
+        catch (err) {
+            process.stderr.write(`error: ${err instanceof Error ? err.message : String(err)}\n`);
+            process.exit(1);
+        }
+    });
+}

package/dist/version.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Read at runtime so the tag-only publish flow's stamped version is reported;
+ * local/dev builds will report the committed placeholder (0.0.0).
+ */
+export declare function readCliVersion(): string;

package/dist/version.js

@@ -0,0 +1,22 @@
+import { readFileSync } from 'node:fs';
+// Kept out of `program.ts` deliberately. This is the only place in the package that
+// touches `import.meta.url`. The backend is a CommonJS build and loads this package
+// through `require(esm)`, which needs Node >= 22.12 — a floor pinned by the
+// *backend's* `engines` (">= 24") and its `node:24` image, not by this package,
+// which declares none. So the embeddable chain has to stay clear of anything a CJS
+// consumer cannot reach. Nothing but the terminal entrypoint needs the version: the
+// program takes it as an input, so an embedder supplies its own.
+/**
+ * Read at runtime so the tag-only publish flow's stamped version is reported;
+ * local/dev builds will report the committed placeholder (0.0.0).
+ */
+export function readCliVersion() {
+    const parsed = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+    if (typeof parsed === 'object' &&
+        parsed !== null &&
+        'version' in parsed &&
+        typeof parsed.version === 'string') {
+        return parsed.version;
+    }
+    throw new Error('could not read the CLI version from package.json');
+}

package/package.json

@@ -1,11 +1,57 @@
 {
   "name": "@labelbox/recursion-cli",
-  "version": "0.0.0",
-  "description": "Placeholder so Trusted Publishing can be attached. Real versions come from CI.",
-  "license": "UNLICENSED",
+  "version": "0.0.41",
+  "type": "module",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Labelbox/recursion-platform.git"
   },
-  "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org" }
+  "bin": {
+    "rl": "./dist/bin.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "exports": {
+    "./program": {
+      "types": "./dist/program.d.ts",
+      "import": "./dist/program.js"
+    },
+    "./embed": {
+      "types": "./dist/embed.d.ts",
+      "default": "./dist/embed.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "embed": [
+        "./dist/embed.d.ts"
+      ],
+      "program": [
+        "./dist/program.d.ts"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "check": "yarn lint && tsc --noEmit",
+    "lint": "biome ci --error-on-warnings --config-path ./biome.json .",
+    "lint:fix": "biome check --config-path ./biome.json --write .",
+    "test": "vitest run",
+    "prepare": "yarn build",
+    "type-check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "commander": "^14.0.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.4.6",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
+  }
 }