@myelinbridge/cli 0.4.0 → 0.6.1

package/bin/myelin.js

@@ -1,496 +1,616 @@
-#!/usr/bin/env node
-// @myelinbridge/cli — Partner Ingestion CLI (Partner API Phase 5, design §3.3).
-//
-//   export MYELIN_API_KEY=myl_live_…
-//   npx @myelinbridge/cli ping
-//   npx @myelinbridge/cli push ./run_042 --dataset onco1-wes --submit
-//
-// Exit codes: 0 ok · 1 error · 2 blocked (failing checks / locked delivery).
-// Every command accepts --json for machine-readable output.
-
-import { readdirSync, statSync, createReadStream, readFileSync } from 'node:fs'
-import { resolve, join, relative, sep, basename } from 'node:path'
-import process from 'node:process'
-
-const API_URL = (process.env.MYELIN_API_URL ?? 'https://myelinbridge.com/api/v1').replace(/\/$/, '')
-const KEY = process.env.MYELIN_API_KEY
-
-const argv = process.argv.slice(2)
-const JSON_MODE = argv.includes('--json')
-const args = argv.filter((a) => a !== '--json')
-const command = args[0]
-
-const out = (line) => { if (!JSON_MODE) console.log(line) }
-const emit = (obj) => { if (JSON_MODE) console.log(JSON.stringify(obj, null, 2)) }
-const die = (message, code = 1) => {
-  if (JSON_MODE) console.log(JSON.stringify({ error: message }))
-  else console.error(`✗ ${message}`)
-  process.exit(code)
-}
-
-function flag(name) {
-  return args.includes(`--${name}`)
-}
-function opt(name) {
-  const i = args.indexOf(`--${name}`)
-  return i >= 0 && args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : null
-}
-
-async function api(method, path, body, raw) {
-  const res = await fetch(API_URL + path, {
-    method,
-    headers: {
-      Authorization: `Bearer ${KEY}`,
-      ...(body && !raw ? { 'Content-Type': 'application/json' } : {}),
-    },
-    body: raw ? body : body ? JSON.stringify(body) : undefined,
-  }).catch((err) => die(`Cannot reach ${API_URL}: ${err.message}`))
-  let json = null
-  try { json = await res.json() } catch { /* non-JSON body */ }
-  return { status: res.status, json }
-}
-
-function expectOk(r, context) {
-  if (r.status >= 200 && r.status < 300) return r.json
-  const detail = r.json?.detail ?? `HTTP ${r.status}`
-  const code = r.json?.code ?? 'error'
-  const blocked = ['delivery_locked', 'submit_blocked', 'dataset_not_active', 'api_disabled', 'bridge_paused', 'sample_depth_locked'].includes(code)
-  die(`${context}: [${code}] ${detail}`, blocked ? 2 : 1)
-}
-
-// ——— dataset resolution (id or slug) ———
-async function resolveDataset(ref) {
-  if (/^[0-9a-f]{8}-[0-9a-f]{4}-/i.test(ref)) {
-    const r = await api('GET', `/datasets/${ref}`)
-    if (r.status === 200) return r.json.dataset
-    die(`Dataset ${ref} not found in this key's scope`)
-  }
-  const me = expectOk(await api('GET', '/me'), 'auth')
-  for (const p of me.projects) {
-    const r = expectOk(await api('GET', `/projects/${p.id}/datasets`), 'datasets')
-    const hit = r.datasets.find((d) => d.slug === ref || d.name === ref)
-    if (hit) return hit
-  }
-  die(`No dataset with slug or name "${ref}" in this key's scope`)
-}
-
-// ——— local manifest ———
-function walkDir(root) {
-  const files = []
-  const walk = (dir) => {
-    for (const entry of readdirSync(dir)) {
-      const full = join(dir, entry)
-      const st = statSync(full)
-      if (st.isDirectory()) walk(full)
-      else files.push({ abs: full, path: '/' + relative(root, full).split(sep).join('/'), size: st.size })
-    }
-  }
-  walk(root)
-  return files
-}
-
-function fmtBytes(n) {
-  if (n >= 1024 ** 3) return (n / 1024 ** 3).toFixed(1) + ' GB'
-  if (n >= 1024 ** 2) return (n / 1024 ** 2).toFixed(1) + ' MB'
-  if (n >= 1024) return (n / 1024).toFixed(1) + ' KB'
-  return n + ' B'
-}
-
-// Upload a file via S3 presigned multipart (SEC-TOKEN-01: no bearer token ever
-// reaches the client — declare tells us the part size, and each part gets a
-// short-lived presigned PUT URL scoped to exactly that one part of one object).
-// Resumable: the sign step reports parts that already landed, so a re-run skips
-// them. Returns { upload_id, parts: [{part_number, etag}] } for confirm.
-const SIGN_WINDOW = 1000 // ≤ the server's max_parts_per_sign
-
-async function readPart(absPath, start, end) {
-  const chunks = []
-  await new Promise((res, rej) => {
-    const s = createReadStream(absPath, { start, end }) // end inclusive
-    s.on('data', (c) => chunks.push(c))
-    s.on('end', res)
-    s.on('error', rej)
-  })
-  return Buffer.concat(chunks)
-}
-
-async function uploadFileMultipart(absPath, size, fileId, partSize, onPartDone) {
-  const numParts = Math.max(1, Math.ceil(size / partSize))
-  const allParts = Array.from({ length: numParts }, (_, i) => i + 1)
-  const etags = new Map() // part_number -> etag
-  let uploadId = null
-
-  for (let i = 0; i < allParts.length; i += SIGN_WINDOW) {
-    const window = allParts.slice(i, i + SIGN_WINDOW)
-    const j = expectOk(await api('POST', `/files/${fileId}/upload-parts`, { part_numbers: window }), 'sign upload parts')
-    uploadId = j.upload_id
-    for (const p of j.uploaded_parts) etags.set(p.part_number, p.etag) // already landed → skip
-    const urlByPart = new Map(j.urls.map((u) => [u.part_number, u.url]))
-
-    // upload the still-missing parts in this window, up to 4 concurrent.
-    // Presigned URLs expire (~30 min); on a rejection we re-sign that one part
-    // and retry once — cheap, since upload-parts is idempotent.
-    const missing = window.filter((n) => !etags.has(n))
-    const queue = [...missing]
-    const resign = async (partNo) => {
-      const j = expectOk(await api('POST', `/files/${fileId}/upload-parts`, { part_numbers: [partNo] }), 're-sign upload part')
-      const fresh = j.urls.find((u) => u.part_number === partNo)?.url
-      if (!fresh) die(`upload part ${partNo}: could not re-sign (already finalized?)`)
-      urlByPart.set(partNo, fresh)
-      return fresh
-    }
-    const workers = Array.from({ length: Math.min(4, queue.length) }, async () => {
-      for (;;) {
-        const partNo = queue.shift()
-        if (partNo === undefined) return
-        const start = (partNo - 1) * partSize
-        const end = Math.min(start + partSize, size) - 1
-        const bytes = await readPart(absPath, start, end)
-        let put = await fetch(urlByPart.get(partNo), { method: 'PUT', body: bytes }).catch(() => null)
-        if (!put || put.status === 403 || put.status === 401) {
-          put = await fetch(await resign(partNo), { method: 'PUT', body: bytes }).catch((e) => die(`upload part ${partNo}: ${e.message}`))
-        }
-        if (put.status !== 200) die(`upload part ${partNo}: HTTP ${put.status}`)
-        const etag = put.headers.get('etag')
-        if (!etag) die(`upload part ${partNo}: storage returned no ETag`)
-        etags.set(partNo, etag)
-        if (onPartDone) onPartDone()
-      }
-    })
-    await Promise.all(workers)
-  }
-
-  return { upload_id: uploadId, parts: allParts.map((n) => ({ part_number: n, etag: etags.get(n) })) }
-}
-
-// ——— commands ———
-
-async function cmdPing() {
-  const j = expectOk(await api('GET', '/ping'), 'ping')
-  emit(j)
-  out(`✓ key "${j.key.name}" (${j.key.prefix}…) · bridge ${j.bridge.name} · ${j.projects.length} project(s)`)
-}
-
-async function cmdProjects() {
-  const j = expectOk(await api('GET', '/projects'), 'projects')
-  emit(j)
-  for (const p of j.projects) out(`${p.code.padEnd(18)} ${p.status.padEnd(10)} ${p.title}`)
-}
-
-async function cmdDatasets() {
-  const me = expectOk(await api('GET', '/me'), 'auth')
-  const rows = []
-  for (const p of me.projects) {
-    const r = expectOk(await api('GET', `/projects/${p.id}/datasets`), 'datasets')
-    for (const d of r.datasets) {
-      rows.push({
-        project: p.code,
-        dataset: d.slug,
-        status: d.lifecycle_status,
-        quality_version: d.quality_check_version,
-        open_draft: d.open_draft_batch_id,
-        id: d.id,
-      })
-    }
-  }
-  emit({ datasets: rows })
-  if (!JSON_MODE) {
-    out('PROJECT'.padEnd(18) + 'DATASET'.padEnd(22) + 'STATUS'.padEnd(10) + 'YOUR MOVE?')
-    for (const r of rows) {
-      out(
-        r.project.padEnd(18) +
-          r.dataset.padEnd(22) +
-          r.status.padEnd(10) +
-          (r.open_draft ? 'yes — open draft to finish' : '—'),
-      )
-    }
-  }
-}
-
-// The delivery contract, before you deliver anything. Answers "what is expected
-// of me?" — which used to be discoverable only by submitting and being rejected.
-async function cmdContract() {
-  const dsRef = opt('dataset')
-  if (!dsRef) die('Usage: myelin contract --dataset <slug|id>')
-  const dataset = await resolveDataset(dsRef)
-  const j = expectOk(
-    await api('GET', `/datasets/${dataset.id}/quality-checks`),
-    'quality-checks',
-  )
-  emit(j)
-  if (JSON_MODE) return
-
-  if (!j.version) {
-    out(`${dataset.name}: no quality contract published yet — nothing is enforced.`)
-    return
-  }
-
-  const s = j.summary
-  out(`${dataset.name} — delivery contract v${j.version}`)
-  out(
-    `${s.total} checks · ${s.blocking} block validation · ` +
-      `${s.checkable_before_upload} checkable before upload` +
-      (s.needs_reviewer ? ` · ${s.needs_reviewer} reviewed by a person` : ''),
-  )
-  out('')
-
-  // Grouped by dimension so the contract reads as questions, not a flat list.
-  const byDim = new Map()
-  for (const c of j.checks) {
-    const key = c.dimension ?? 'review'
-    if (!byDim.has(key)) byDim.set(key, [])
-    byDim.get(key).push(c)
-  }
-  for (const d of s.dimensions) {
-    const items = byDim.get(d.key) ?? []
-    if (items.length === 0) continue
-    out(`${d.label.toUpperCase()} — ${d.question}`)
-    for (const c of items) {
-      const gate = c.severity === 'blocking' ? 'must' : 'should'
-      const when = c.runs_at === 'preflight' ? '' : ' (checked at submission)'
-      out(`  ${gate === 'must' ? '!' : '·'} ${c.assertion ?? c.name}${when}`)
-    }
-    out('')
-  }
-  const manual = byDim.get('review') ?? []
-  if (manual.length > 0) {
-    out('REVIEWER JUDGEMENT — decided by a person, not the engine')
-    for (const c of manual) out(`  · ${c.name}`)
-    out('')
-  }
-  out(`Run "myelin check <dir> --dataset ${dsRef}" to test ${s.checkable_before_upload} of these locally.`)
-}
-
-async function cmdCheck() {
-  const dir = args[1]
-  const dsRef = opt('dataset')
-  if (!dir || !dsRef) die('Usage: myelin check <dir> --dataset <slug|id>')
-  const root = resolve(dir)
-  const files = walkDir(root)
-  if (files.length === 0) die(`No files under ${root}`)
-  const dataset = await resolveDataset(dsRef)
-
-  out(`Evaluating ${files.length} files (${fmtBytes(files.reduce((s, f) => s + f.size, 0))}) against quality checks v${dataset.quality_check_version ?? '—'}…`)
-  const j = expectOk(
-    await api('POST', `/datasets/${dataset.id}/preflight`, {
-      files: files.map((f) => ({ path: f.path, size_bytes: f.size })),
-    }),
-    'preflight',
-  )
-  emit(j)
-  if (!JSON_MODE) {
-    for (const c of j.evaluated) {
-      const mark = c.verdict === 'passed' ? '✓' : c.verdict === 'flagged' ? '⚠' : '✗'
-      out(`${mark} ${c.check_type.padEnd(26)} ${c.verdict}${c.severity === 'blocking' && c.verdict === 'failed' ? ' — BLOCKING' : ''}`)
-      if (c.verdict !== 'passed' && c.remediation) out(`    hint: ${c.remediation}`)
-    }
-    for (const d of j.deferred) out(`… ${d.check_type.padEnd(26)} ${d.reason}`)
-    for (const m of j.manual) out(`○ ${m.name.padEnd(26)} ${m.reason}`)
-  }
-  if (j.blocking_failures > 0) {
-    out(`${j.blocking_failures} blocking issue(s). Fix before pushing to avoid a review round-trip.`)
-    process.exit(2)
-  }
-  out('All manifest-evaluable checks pass.')
-}
-
-async function cmdPush() {
-  const dir = args[1]
-  const dsRef = opt('dataset')
-  if (!dir || !dsRef) die('Usage: myelin push <dir> --dataset <slug|id> [--submit] [--replace]')
-  const root = resolve(dir)
-  const files = walkDir(root)
-  if (files.length === 0) die(`No files under ${root}`)
-  const dataset = await resolveDataset(dsRef)
-
-  // 1. create or resume the draft
-  const created = expectOk(await api('POST', `/datasets/${dataset.id}/batches`), 'create batch')
-  const batchId = created.batch_id
-  out(`Draft ${created.resumed ? 'resumed' : 'created'} (${batchId.slice(0, 8)}…).`)
-
-  // 2. declare in chunks of 500 — idempotent, so re-running skips what's done
-  const declared = []
-  let upload = null
-  for (let i = 0; i < files.length; i += 500) {
-    const slice = files.slice(i, i + 500)
-    const r = await api('POST', `/batches/${batchId}/files`, {
-      files: slice.map((f) => ({ path: f.path, size_bytes: f.size })),
-      replace: flag('replace'),
-    })
-    if (r.status !== 200 && r.status !== 409) expectOk(r, 'declare')
-    const conflicts = r.json.files.filter((f) => f.error)
-    if (conflicts.length > 0) {
-      for (const c of conflicts) out(`✗ ${c.path}: ${c.error}`)
-      die(`${conflicts.length} path conflict(s) — pass --replace to overwrite`, 2)
-    }
-    declared.push(...r.json.files)
-    upload = r.json.upload
-  }
-  const partSize = upload?.part_size ?? 64 * 1024 * 1024
-
-  // 3. upload the delta (anything not already 'uploaded') via S3 multipart,
-  //    2 files in parallel (each file uploads its parts 4-wide internally)
-  const byPath = new Map(files.map((f) => [f.path, f]))
-  const pending = declared.filter((d) => d.upload_state !== 'uploaded')
-  out(`Uploading ${pending.length}/${declared.length} files (${fmtBytes(pending.reduce((s, d) => s + (byPath.get(d.path)?.size ?? 0), 0))}) · resumable`)
-  let done = 0
-  const queue = [...pending]
-  const workers = Array.from({ length: Math.min(2, queue.length) }, async () => {
-    for (;;) {
-      const d = queue.shift()
-      if (!d) return
-      const local = byPath.get(d.path)
-      const { upload_id, parts } = await uploadFileMultipart(local.abs, local.size, d.file_id, partSize)
-      const c = await api('POST', `/files/${d.file_id}/confirm`, { upload_id, parts })
-      if (c.status !== 200) die(`confirm ${d.path}: [${c.json?.code}] ${c.json?.detail ?? c.status}`)
-      done++
-      out(`  ✓ ${d.path} (${done}/${pending.length})`)
-    }
-  })
-  await Promise.all(workers)
-  out('All files confirmed.')
-
-  // 4. optional submit
-  if (flag('submit')) {
-    const r = await api('POST', `/batches/${batchId}/submit`)
-    if (r.status !== 200) {
-      const code = r.json?.code ?? 'error'
-      die(`submit: [${code}] ${r.json?.detail ?? r.status}`, code === 'submit_blocked' ? 2 : 1)
-    }
-    const a = r.json.auto_checks
-    emit(r.json)
-    out(`Submitting… auto-checks: ${a.passed} passed, ${a.flagged} flagged, ${a.failed} failed.`)
-    out(`✓ Batch submitted for review. Track: myelin status ${batchId} --watch`)
-  } else {
-    emit({ batch_id: batchId, files: declared.length, submitted: false })
-    out(`Draft ready (not submitted). Submit with: myelin push ${dir} --dataset ${dsRef} --submit`)
-  }
-}
-
-async function cmdStatus() {
-  const ref = args[1]
-  if (!ref) die('Usage: myelin status <batch-id|display-name> [--watch]')
-
-  const findBatch = async () => {
-    if (/^[0-9a-f]{8}-[0-9a-f]{4}-/i.test(ref)) {
-      const r = await api('GET', `/batches/${ref}`)
-      if (r.status === 200) return r.json.batch
-      die(`Batch ${ref} not found in this key's scope`)
-    }
-    const list = expectOk(await api('GET', '/batches?limit=100'), 'batches')
-    const hit = list.batches.find((b) => b.display_name === ref)
-    if (!hit) die(`No batch named "${ref}" in this key's scope`)
-    return expectOk(await api('GET', `/batches/${hit.id}`), 'batch').batch
-  }
-
-  const print = async (batch) => {
-    emit({ batch })
-    out(`${batch.display_name}: ${batch.status} — ${batch.court === 'partner' ? 'your move.' : batch.court === 'reviewer' ? "reviewer's move." : batch.court === 'system' ? 'transferring…' : 'done.'}`)
-    if (batch.status === 'changes_requested') {
-      const f = expectOk(await api('GET', `/batches/${batch.id}/findings`), 'findings')
-      if (f.request_changes_comment) out(`  reviewer: "${f.request_changes_comment}"`)
-      for (const fr of f.file_reviews.filter((x) => x.verdict === 'failed')) {
-        out(`  ✗ ${fr.path}  (${fr.reviewer ?? 'reviewer'}: ${fr.comment ?? 'failed'})`)
-      }
-      for (const qf of f.quality_findings.filter((x) => x.verdict === 'failed')) {
-        out(`  ✗ ${qf.name ?? qf.rule_key}${qf.hint ? `: ${qf.hint}` : ''}`)
-      }
-    }
-    return batch
-  }
-
-  let batch = await print(await findBatch())
-  if (flag('watch')) {
-    const terminal = ['transferred', 'rejected', 'changes_requested', 'transfer_failed']
-    while (!terminal.includes(batch.status)) {
-      await new Promise((r) => setTimeout(r, 20_000))
-      const next = await findBatch()
-      if (next.status !== batch.status) batch = await print(next)
-    }
-  }
-}
-
-async function cmdSandbox() {
-  const file = args[1]
-  if (!file) die('Usage: myelin sandbox <file>')
-  const abs = resolve(file)
-  const size = statSync(abs).size
-  if (size > 4 * 1024 * 1024) die('Sandbox files should stay under ~4 MB — this verifies connectivity, not throughput.')
-
-  const me = expectOk(await api('GET', '/me'), 'auth')
-  const form = new FormData()
-  form.set('file', new File([readFileSync(abs)], basename(abs)))
-  const r = await api('POST', `/bridges/${me.bridge.id}/sandbox`, form, true)
-  const j = expectOk(r, 'sandbox')
-  emit(j)
-  out(`✓ Sandbox upload succeeded — the partner-side test transfer checklist item is satisfied for bridge "${me.bridge.name}".`)
-}
-
-async function cmdSampleDepth() {
-  const dsRef = opt('dataset')
-  const raw = args[1]
-  if (!dsRef || raw === undefined) {
-    die('Usage: myelin sample-depth <0-5> --dataset <slug|id>')
-  }
-  const depth = Number(raw)
-  if (!Number.isInteger(depth) || depth < 0 || depth > 5) {
-    die('sample-depth must be an integer between 0 and 5')
-  }
-  const dataset = await resolveDataset(dsRef)
-  const j = expectOk(
-    await api('POST', `/datasets/${dataset.id}/sample-depth`, { sample_depth: depth }),
-    'sample-depth',
-  )
-  emit(j)
-  if (!JSON_MODE) {
-    out(
-      j.changed
-        ? `Sample depth for ${dataset.name} set to ${j.sample_depth}.`
-        : `Sample depth for ${dataset.name} already ${j.sample_depth} — nothing to change.`,
-    )
-  }
-}
-
-function cmdHelp() {
-  console.log(`myelin — Partner Ingestion CLI
-
-Setup:
-  export MYELIN_API_KEY=myl_live_…        (create in Bridge → API)
-  export MYELIN_API_URL=…                 (optional; default https://myelinbridge.com/api/v1)
-
-Commands:
-  ping                                    verify the key; show bridge + projects
-  projects                                list scoped projects
-  datasets                                list datasets with "your move" hints
-  sample-depth <0-5> --dataset <slug|id>  declare the folder depth a sample sits at (locks after 1st submit)
-  contract --dataset <slug|id>            what this dataset expects of your delivery
-  check <dir> --dataset <slug|id>         preflight local files against quality rules (no upload)
-  push <dir> --dataset <slug|id>          create/resume a delivery and upload (resumable; re-run to resume)
-       [--submit] [--replace]
-  status <batch|name> [--watch]           review status + fix-loop findings
-  sandbox <file>                          partner-side test transfer (bridge activation)
-
-Every command accepts --json. Exit codes: 0 ok · 1 error · 2 blocked.`)
-}
-
-// ——— main ———
-if (!command || command === 'help' || command === '--help') {
-  cmdHelp()
-  process.exit(0)
-}
-if (!KEY) die('Set MYELIN_API_KEY (create a key in Bridge → API).')
-
-const commands = {
-  ping: cmdPing,
-  projects: cmdProjects,
-  datasets: cmdDatasets,
-  'sample-depth': cmdSampleDepth,
-  contract: cmdContract,
-  check: cmdCheck,
-  push: cmdPush,
-  status: cmdStatus,
-  sandbox: cmdSandbox,
-}
-const fn = commands[command]
-if (!fn) die(`Unknown command "${command}" — run: myelin help`)
-await fn()
+#!/usr/bin/env node
+// @myelinbridge/cli — Partner Ingestion CLI (Partner API Phase 5, design §3.3).
+//
+//   export MYELIN_API_KEY=myl_live_…
+//   npx @myelinbridge/cli ping
+//   npx @myelinbridge/cli push ./run_042 --dataset onco1-wes --submit
+//
+// Exit codes: 0 ok · 1 error · 2 blocked (failing checks / locked delivery).
+// Every command accepts --json for machine-readable output.
+
+import { readdirSync, statSync, createReadStream, readFileSync } from 'node:fs'
+import { resolve, join, relative, sep, basename } from 'node:path'
+import process from 'node:process'
+
+const API_URL = (process.env.MYELIN_API_URL ?? 'https://myelinbridge.com/api/v1').replace(/\/$/, '')
+const KEY = process.env.MYELIN_API_KEY
+
+// Extra headers sent with every API call — newline-separated "Name: value"
+// pairs in MYELIN_API_HEADER. For deployments fronted by something that
+// authenticates before Myelin does (a corporate gateway, an SSO-protected
+// preview environment). Never overrides Authorization.
+const EXTRA_HEADERS = Object.fromEntries(
+  (process.env.MYELIN_API_HEADER ?? '')
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const i = line.indexOf(':')
+      if (i < 1) return null
+      return [line.slice(0, i).trim(), line.slice(i + 1).trim()]
+    })
+    .filter(Boolean),
+)
+
+const argv = process.argv.slice(2)
+const JSON_MODE = argv.includes('--json')
+const args = argv.filter((a) => a !== '--json')
+const command = args[0]
+
+const out = (line) => { if (!JSON_MODE) console.log(line) }
+const emit = (obj) => { if (JSON_MODE) console.log(JSON.stringify(obj, null, 2)) }
+
+/** Thrown by die() to unwind to main; never reaches the user. */
+class CliExit extends Error {}
+
+// die() sets the exit code and unwinds rather than calling process.exit():
+// killing the process while an HTTP socket is still closing trips a libuv
+// assertion on Windows, which printed a C stack trace after a perfectly good
+// error message and replaced the documented exit code with 127. Node exits on
+// its own once the request settles — measured at ~130 ms, no keep-alive stall.
+const die = (message, code = 1) => {
+  if (JSON_MODE) console.log(JSON.stringify({ error: message }))
+  else console.error(`✗ ${message}`)
+  process.exitCode = code
+  throw new CliExit(message)
+}
+
+// Column widths come from the content. padEnd() alone silently ran a long
+// value into the next column — a 28-character dataset slug swallowed the
+// STATUS header's gutter. Pass headers = null for an unheadered list.
+function table(headers, rows) {
+  const cols = headers?.length ?? rows[0]?.length ?? 0
+  const widths = Array.from({ length: cols }, (_, i) =>
+    Math.max(headers?.[i]?.length ?? 0, 0, ...rows.map((r) => String(r[i] ?? '').length)),
+  )
+  const line = (cells) =>
+    cells
+      .map((c, i) => (i === cols - 1 ? String(c ?? '') : String(c ?? '').padEnd(widths[i])))
+      .join('  ')
+      .trimEnd()
+  return headers ? [line(headers), ...rows.map(line)] : rows.map(line)
+}
+
+function flag(name) {
+  return args.includes(`--${name}`)
+}
+function opt(name) {
+  const i = args.indexOf(`--${name}`)
+  return i >= 0 && args[i + 1] && !args[i + 1].startsWith('--') ? args[i + 1] : null
+}
+
+async function api(method, path, body, raw) {
+  const res = await fetch(API_URL + path, {
+    method,
+    headers: {
+      ...EXTRA_HEADERS,
+      Authorization: `Bearer ${KEY}`,
+      ...(body && !raw ? { 'Content-Type': 'application/json' } : {}),
+    },
+    body: raw ? body : body ? JSON.stringify(body) : undefined,
+  }).catch((err) => die(`Cannot reach ${API_URL}: ${err.message}`))
+  let json = null
+  try { json = await res.json() } catch { /* non-JSON body */ }
+  return { status: res.status, json }
+}
+
+function expectOk(r, context) {
+  if (r.status >= 200 && r.status < 300) return r.json
+  const detail = r.json?.detail ?? `HTTP ${r.status}`
+  const code = r.json?.code ?? 'error'
+  const blocked = ['delivery_locked', 'submit_blocked', 'dataset_not_active', 'api_disabled', 'bridge_paused', 'sample_depth_locked'].includes(code)
+  die(`${context}: [${code}] ${detail}`, blocked ? 2 : 1)
+}
+
+// ——— dataset resolution (id or slug) ———
+async function resolveDataset(ref) {
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-/i.test(ref)) {
+    const r = await api('GET', `/datasets/${ref}`)
+    if (r.status === 200) return r.json.dataset
+    die(`Dataset ${ref} not found in this key's scope`)
+  }
+  const me = expectOk(await api('GET', '/me'), 'auth')
+  for (const p of me.projects) {
+    const r = expectOk(await api('GET', `/projects/${p.id}/datasets`), 'datasets')
+    const hit = r.datasets.find((d) => d.slug === ref || d.name === ref)
+    if (hit) return hit
+  }
+  die(`No dataset with slug or name "${ref}" in this key's scope`)
+}
+
+// ——— local manifest ———
+function walkDir(root) {
+  const files = []
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry)
+      const st = statSync(full)
+      if (st.isDirectory()) walk(full)
+      else files.push({ abs: full, path: '/' + relative(root, full).split(sep).join('/'), size: st.size })
+    }
+  }
+  walk(root)
+  return files
+}
+
+function fmtBytes(n) {
+  if (n >= 1024 ** 3) return (n / 1024 ** 3).toFixed(1) + ' GB'
+  if (n >= 1024 ** 2) return (n / 1024 ** 2).toFixed(1) + ' MB'
+  if (n >= 1024) return (n / 1024).toFixed(1) + ' KB'
+  return n + ' B'
+}
+
+// Upload a file via S3 presigned multipart (SEC-TOKEN-01: no bearer token ever
+// reaches the client — declare tells us the part size, and each part gets a
+// short-lived presigned PUT URL scoped to exactly that one part of one object).
+// Resumable: the sign step reports parts that already landed, so a re-run skips
+// them. Returns { upload_id, parts: [{part_number, etag}] } for confirm.
+const SIGN_WINDOW = 1000 // ≤ the server's max_parts_per_sign
+
+async function readPart(absPath, start, end) {
+  const chunks = []
+  await new Promise((res, rej) => {
+    const s = createReadStream(absPath, { start, end }) // end inclusive
+    s.on('data', (c) => chunks.push(c))
+    s.on('end', res)
+    s.on('error', rej)
+  })
+  return Buffer.concat(chunks)
+}
+
+async function uploadFileMultipart(absPath, size, fileId, partSize, onPartDone) {
+  const numParts = Math.max(1, Math.ceil(size / partSize))
+  const allParts = Array.from({ length: numParts }, (_, i) => i + 1)
+  const etags = new Map() // part_number -> etag
+  let uploadId = null
+
+  for (let i = 0; i < allParts.length; i += SIGN_WINDOW) {
+    const window = allParts.slice(i, i + SIGN_WINDOW)
+    const j = expectOk(await api('POST', `/files/${fileId}/upload-parts`, { part_numbers: window }), 'sign upload parts')
+    uploadId = j.upload_id
+    for (const p of j.uploaded_parts) etags.set(p.part_number, p.etag) // already landed → skip
+    const urlByPart = new Map(j.urls.map((u) => [u.part_number, u.url]))
+
+    // upload the still-missing parts in this window, up to 4 concurrent.
+    // Presigned URLs expire (~30 min); on a rejection we re-sign that one part
+    // and retry once — cheap, since upload-parts is idempotent.
+    const missing = window.filter((n) => !etags.has(n))
+    const queue = [...missing]
+    const resign = async (partNo) => {
+      const j = expectOk(await api('POST', `/files/${fileId}/upload-parts`, { part_numbers: [partNo] }), 're-sign upload part')
+      const fresh = j.urls.find((u) => u.part_number === partNo)?.url
+      if (!fresh) die(`upload part ${partNo}: could not re-sign (already finalized?)`)
+      urlByPart.set(partNo, fresh)
+      return fresh
+    }
+    const workers = Array.from({ length: Math.min(4, queue.length) }, async () => {
+      for (;;) {
+        const partNo = queue.shift()
+        if (partNo === undefined) return
+        const start = (partNo - 1) * partSize
+        const end = Math.min(start + partSize, size) - 1
+        const bytes = await readPart(absPath, start, end)
+        let put = await fetch(urlByPart.get(partNo), { method: 'PUT', body: bytes }).catch(() => null)
+        if (!put || put.status === 403 || put.status === 401) {
+          put = await fetch(await resign(partNo), { method: 'PUT', body: bytes }).catch((e) => die(`upload part ${partNo}: ${e.message}`))
+        }
+        if (put.status !== 200) die(`upload part ${partNo}: HTTP ${put.status}`)
+        const etag = put.headers.get('etag')
+        if (!etag) die(`upload part ${partNo}: storage returned no ETag`)
+        etags.set(partNo, etag)
+        if (onPartDone) onPartDone()
+      }
+    })
+    await Promise.all(workers)
+  }
+
+  return { upload_id: uploadId, parts: allParts.map((n) => ({ part_number: n, etag: etags.get(n) })) }
+}
+
+// ——— commands ———
+
+async function cmdPing() {
+  const j = expectOk(await api('GET', '/ping'), 'ping')
+  emit(j)
+  out(`✓ key "${j.key.name}" (${j.key.prefix}…) · bridge ${j.bridge.name} · ${j.projects.length} project(s)`)
+}
+
+async function cmdProjects() {
+  const j = expectOk(await api('GET', '/projects'), 'projects')
+  emit(j)
+  for (const line of table(null, j.projects.map((p) => [p.code, p.status, p.title]))) out(line)
+}
+
+async function cmdDatasets() {
+  const me = expectOk(await api('GET', '/me'), 'auth')
+  const rows = []
+  for (const p of me.projects) {
+    const r = expectOk(await api('GET', `/projects/${p.id}/datasets`), 'datasets')
+    for (const d of r.datasets) {
+      rows.push({
+        project: p.code,
+        dataset: d.slug,
+        status: d.lifecycle_status,
+        quality_version: d.quality_check_version,
+        open_draft: d.open_draft_batch_id,
+        id: d.id,
+      })
+    }
+  }
+  emit({ datasets: rows })
+  if (!JSON_MODE) {
+    const lines = table(
+      ['PROJECT', 'DATASET', 'STATUS', 'YOUR MOVE?'],
+      rows.map((r) => [r.project, r.dataset, r.status, r.open_draft ? 'yes — open draft to finish' : '—']),
+    )
+    for (const line of lines) out(line)
+  }
+}
+
+// The delivery contract, before you deliver anything. Answers "what is expected
+// of me?" — which used to be discoverable only by submitting and being rejected.
+async function cmdContract() {
+  const dsRef = opt('dataset')
+  if (!dsRef) die('Usage: myelin contract --dataset <slug|id>')
+  const dataset = await resolveDataset(dsRef)
+  const j = expectOk(
+    await api('GET', `/datasets/${dataset.id}/quality-checks`),
+    'quality-checks',
+  )
+  emit(j)
+  if (JSON_MODE) return
+
+  if (!j.version) {
+    out(`${dataset.name}: no quality contract published yet — nothing is enforced.`)
+    return
+  }
+
+  const s = j.summary
+  out(`${dataset.name} — delivery contract v${j.version}`)
+  out(
+    `${s.total} checks · ${s.blocking} block validation · ` +
+      `${s.checkable_before_upload} checkable before upload` +
+      (s.needs_reviewer ? ` · ${s.needs_reviewer} reviewed by a person` : ''),
+  )
+  out('')
+
+  // Grouped by dimension so the contract reads as questions, not a flat list.
+  const byDim = new Map()
+  for (const c of j.checks) {
+    const key = c.dimension ?? 'review'
+    if (!byDim.has(key)) byDim.set(key, [])
+    byDim.get(key).push(c)
+  }
+  for (const d of s.dimensions) {
+    const items = byDim.get(d.key) ?? []
+    if (items.length === 0) continue
+    out(`${d.label.toUpperCase()} — ${d.question}`)
+    for (const c of items) {
+      const gate = c.severity === 'blocking' ? 'must' : 'should'
+      const when = c.runs_at === 'preflight' ? '' : ' (checked at submission)'
+      out(`  ${gate === 'must' ? '!' : '·'} ${c.assertion ?? c.name}${when}`)
+    }
+    out('')
+  }
+  const manual = byDim.get('review') ?? []
+  if (manual.length > 0) {
+    out('REVIEWER JUDGEMENT — decided by a person, not the engine')
+    for (const c of manual) out(`  · ${c.name}`)
+    out('')
+  }
+  out(`Run "myelin check <dir> --dataset ${dsRef}" to test ${s.checkable_before_upload} of these locally.`)
+}
+
+async function cmdCheck() {
+  const dir = args[1]
+  const dsRef = opt('dataset')
+  if (!dir || !dsRef) die('Usage: myelin check <dir> --dataset <slug|id>')
+  const root = resolve(dir)
+  const files = walkDir(root)
+  if (files.length === 0) die(`No files under ${root}`)
+  const dataset = await resolveDataset(dsRef)
+
+  out(`Evaluating ${files.length} files (${fmtBytes(files.reduce((s, f) => s + f.size, 0))}) against quality checks v${dataset.quality_check_version ?? '—'}…`)
+  const j = expectOk(
+    await api('POST', `/datasets/${dataset.id}/preflight`, {
+      files: files.map((f) => ({ path: f.path, size_bytes: f.size })),
+    }),
+    'preflight',
+  )
+  emit(j)
+  if (!JSON_MODE) {
+    // One width across all three lists so the verdicts line up, and the hint
+    // lines can still be interleaved under the check they belong to.
+    const w = Math.max(
+      0,
+      ...j.evaluated.map((c) => c.check_type.length),
+      ...j.deferred.map((d) => d.check_type.length),
+      ...j.manual.map((m) => m.name.length),
+    )
+    for (const c of j.evaluated) {
+      const mark = c.verdict === 'passed' ? '✓' : c.verdict === 'flagged' ? '⚠' : '✗'
+      out(`${mark} ${c.check_type.padEnd(w)}  ${c.verdict}${c.severity === 'blocking' && c.verdict === 'failed' ? ' — BLOCKING' : ''}`)
+      if (c.verdict !== 'passed' && c.remediation) out(`    hint: ${c.remediation}`)
+    }
+    for (const d of j.deferred) out(`… ${d.check_type.padEnd(w)}  ${d.reason}`)
+    for (const m of j.manual) out(`○ ${m.name.padEnd(w)}  ${m.reason}`)
+  }
+  if (j.blocking_failures > 0) {
+    out(`${j.blocking_failures} blocking issue(s). Fix before pushing to avoid a review round-trip.`)
+    process.exitCode = 2
+    return
+  }
+  out('All checks that run before upload pass.')
+}
+
+async function cmdPush() {
+  const dir = args[1]
+  const dsRef = opt('dataset')
+  if (!dir || !dsRef) die('Usage: myelin push <dir> --dataset <slug|id> [--submit] [--replace]')
+  const root = resolve(dir)
+  const files = walkDir(root)
+  if (files.length === 0) die(`No files under ${root}`)
+  const dataset = await resolveDataset(dsRef)
+
+  // 1. create or resume the draft
+  const created = expectOk(await api('POST', `/datasets/${dataset.id}/batches`), 'create batch')
+  const batchId = created.batch_id
+  out(`Draft ${created.resumed ? 'resumed' : 'created'} (${batchId.slice(0, 8)}…).`)
+
+  // 2. declare in chunks of 500 — idempotent, so re-running skips what's done
+  const declared = []
+  let upload = null
+  for (let i = 0; i < files.length; i += 500) {
+    const slice = files.slice(i, i + 500)
+    const r = await api('POST', `/batches/${batchId}/files`, {
+      files: slice.map((f) => ({ path: f.path, size_bytes: f.size })),
+      replace: flag('replace'),
+    })
+    if (r.status !== 200 && r.status !== 409) expectOk(r, 'declare')
+    const conflicts = r.json.files.filter((f) => f.error)
+    if (conflicts.length > 0) {
+      for (const c of conflicts) out(`✗ ${c.path}: ${c.error}`)
+      die(`${conflicts.length} path conflict(s) — pass --replace to overwrite`, 2)
+    }
+    declared.push(...r.json.files)
+    upload = r.json.upload
+  }
+  const partSize = upload?.part_size ?? 64 * 1024 * 1024
+
+  // 3. upload the delta (anything not already 'uploaded') via S3 multipart,
+  //    2 files in parallel (each file uploads its parts 4-wide internally)
+  const byPath = new Map(files.map((f) => [f.path, f]))
+  const pending = declared.filter((d) => d.upload_state !== 'uploaded')
+  out(`Uploading ${pending.length}/${declared.length} files (${fmtBytes(pending.reduce((s, d) => s + (byPath.get(d.path)?.size ?? 0), 0))}) · resumable`)
+  let done = 0
+  const queue = [...pending]
+  const workers = Array.from({ length: Math.min(2, queue.length) }, async () => {
+    for (;;) {
+      const d = queue.shift()
+      if (!d) return
+      const local = byPath.get(d.path)
+      const { upload_id, parts } = await uploadFileMultipart(local.abs, local.size, d.file_id, partSize)
+      const c = await api('POST', `/files/${d.file_id}/confirm`, { upload_id, parts })
+      if (c.status !== 200) die(`confirm ${d.path}: [${c.json?.code}] ${c.json?.detail ?? c.status}`)
+      done++
+      out(`  ✓ ${d.path} (${done}/${pending.length})`)
+    }
+  })
+  await Promise.all(workers)
+  out('All files confirmed.')
+
+  // 4. optional submit
+  if (flag('submit')) {
+    const r = await api('POST', `/batches/${batchId}/submit`)
+    if (r.status !== 200) {
+      const code = r.json?.code ?? 'error'
+      die(`submit: [${code}] ${r.json?.detail ?? r.status}`, code === 'submit_blocked' ? 2 : 1)
+    }
+    const a = r.json.auto_checks
+    emit(r.json)
+    out(`Submitting… auto-checks: ${a.passed} passed, ${a.flagged} flagged, ${a.failed} failed.`)
+    out(`✓ Batch submitted for review. Track: myelin status ${batchId} --watch`)
+  } else {
+    emit({ batch_id: batchId, files: declared.length, submitted: false })
+    out(`Draft ready (not submitted). Submit with: myelin push ${dir} --dataset ${dsRef} --submit`)
+  }
+}
+
+async function cmdStatus() {
+  const ref = args[1]
+  if (!ref) die('Usage: myelin status <batch-id|display-name> [--watch]')
+
+  const findBatch = async () => {
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-/i.test(ref)) {
+      const r = await api('GET', `/batches/${ref}`)
+      if (r.status === 200) return r.json.batch
+      die(`Batch ${ref} not found in this key's scope`)
+    }
+    const list = expectOk(await api('GET', '/batches?limit=100'), 'batches')
+    const hit = list.batches.find((b) => b.display_name === ref)
+    if (!hit) die(`No batch named "${ref}" in this key's scope`)
+    return expectOk(await api('GET', `/batches/${hit.id}`), 'batch').batch
+  }
+
+  const print = async (batch) => {
+    emit({ batch })
+    out(`${batch.display_name}: ${batch.status} — ${batch.court === 'partner' ? 'your move.' : batch.court === 'reviewer' ? "reviewer's move." : batch.court === 'system' ? 'transferring…' : 'done.'}`)
+    if (batch.status === 'changes_requested') {
+      const f = expectOk(await api('GET', `/batches/${batch.id}/findings`), 'findings')
+      if (f.request_changes_comment) out(`  reviewer: "${f.request_changes_comment}"`)
+      for (const fr of f.file_reviews.filter((x) => x.verdict === 'failed')) {
+        out(`  ✗ ${fr.path}  (${fr.reviewer ?? 'reviewer'}: ${fr.comment ?? 'failed'})`)
+      }
+      for (const qf of f.quality_findings.filter((x) => x.verdict === 'failed')) {
+        out(`  ✗ ${qf.name ?? qf.rule_key}${qf.hint ? `: ${qf.hint}` : ''}`)
+      }
+    }
+    return batch
+  }
+
+  let batch = await print(await findBatch())
+  if (flag('watch')) {
+    const terminal = ['transferred', 'rejected', 'changes_requested', 'transfer_failed']
+    while (!terminal.includes(batch.status)) {
+      await new Promise((r) => setTimeout(r, 20_000))
+      const next = await findBatch()
+      if (next.status !== batch.status) batch = await print(next)
+    }
+  }
+}
+
+async function cmdSandbox() {
+  const file = args[1]
+  if (!file) die('Usage: myelin sandbox <file>')
+  const abs = resolve(file)
+  const size = statSync(abs).size
+  if (size > 4 * 1024 * 1024) die('Sandbox files should stay under ~4 MB — this verifies connectivity, not throughput.')
+
+  const me = expectOk(await api('GET', '/me'), 'auth')
+  const form = new FormData()
+  form.set('file', new File([readFileSync(abs)], basename(abs)))
+  const r = await api('POST', `/bridges/${me.bridge.id}/sandbox`, form, true)
+  const j = expectOk(r, 'sandbox')
+  emit(j)
+  out(`✓ Sandbox upload succeeded — the partner-side test transfer checklist item is satisfied for bridge "${me.bridge.name}".`)
+}
+
+async function cmdSampleDepth() {
+  const dsRef = opt('dataset')
+  const raw = args[1]
+  if (!dsRef || raw === undefined) {
+    die('Usage: myelin sample-depth <0-5> --dataset <slug|id>')
+  }
+  const depth = Number(raw)
+  if (!Number.isInteger(depth) || depth < 0 || depth > 5) {
+    die('sample-depth must be an integer between 0 and 5')
+  }
+  const dataset = await resolveDataset(dsRef)
+  const j = expectOk(
+    await api('POST', `/datasets/${dataset.id}/sample-depth`, { sample_depth: depth }),
+    'sample-depth',
+  )
+  emit(j)
+  if (!JSON_MODE) {
+    out(
+      j.changed
+        ? `Sample depth for ${dataset.name} set to ${j.sample_depth}.`
+        : `Sample depth for ${dataset.name} already ${j.sample_depth} — nothing to change.`,
+    )
+  }
+}
+
+function cmdHelp() {
+  console.log(`myelin — Partner Ingestion CLI
+
+Setup:
+  export MYELIN_API_KEY=myl_live_…        (create in Bridge → API)
+  export MYELIN_API_URL=…                 (optional; default https://myelinbridge.com/api/v1)
+  export MYELIN_API_HEADER="Name: value"  (optional; extra headers, one per line —
+                                           for a gateway that authenticates ahead of Myelin)
+
+Commands:
+  ping                                    verify the key; show bridge + projects
+  projects                                list scoped projects
+  datasets                                list datasets with "your move" hints
+  sample-depth <0-5> --dataset <slug|id>  declare the folder depth a sample sits at (locks after 1st submit)
+  contract --dataset <slug|id>            what this dataset expects of your delivery
+  check <dir> --dataset <slug|id>         preflight local files against quality rules (no upload)
+  push <dir> --dataset <slug|id>          create/resume a delivery and upload (resumable; re-run to resume)
+       [--submit] [--replace]
+  status <batch|name> [--watch]           review status + fix-loop findings
+  sandbox <file>                          partner-side test transfer (bridge activation)
+
+Client-side commands (need a CLIENT key — Organisation → API keys):
+  deliveries [--project <id>]             what landed in your destination bucket
+             [--dataset <id>] [--since <iso>] [--limit <n>]
+  resolve <path|prefix|id>                what a path in your bucket actually is —
+                                          project, dataset, batch, file
+
+Every command accepts --json. Exit codes: 0 ok · 1 error · 2 blocked.`)
+}
+
+// ——— client-side commands (client keys only) ———
+//
+// These need a CLIENT key, minted by the client bridge owner in Bridge → API →
+// "Your read keys". A partner key gets 403 wrong_key_side, and the message says
+// so — the two sides deliberately do not silently degrade into each other.
+
+async function cmdDeliveries() {
+  const qs = new URLSearchParams()
+  const map = { project: 'project_id', dataset: 'dataset_id', since: 'since', limit: 'limit' }
+  for (const [flagName, param] of Object.entries(map)) {
+    const v = opt(flagName)
+    if (v) qs.set(param, v)
+  }
+  const query = qs.toString()
+  const j = expectOk(await api('GET', `/deliveries${query ? `?${query}` : ''}`), 'deliveries')
+  emit(j)
+  if (j.deliveries.length === 0) {
+    out('No deliveries yet in this key’s scope.')
+    return
+  }
+  const rows = j.deliveries.map((d) => [
+    d.project.code ?? d.project.id.slice(0, 8),
+    d.dataset.slug ?? d.dataset.id.slice(0, 8),
+    d.batch_name ?? '—',
+    String(d.file_count),
+    (d.transferred_at ?? '').slice(0, 10),
+    d.destination_root ?? '—',
+  ])
+  for (const line of table(['PROJECT', 'DATASET', 'BATCH', 'FILES', 'DELIVERED', 'LOCATION'], rows)) out(line)
+  if (j.next_cursor) out(`\n… more — re-run with --since ${j.next_cursor}`)
+}
+
+async function cmdResolve() {
+  const path = args[1]
+  if (!path || path.startsWith('--')) die('Usage: myelin resolve <path|prefix|id>')
+  const j = expectOk(await api('GET', `/deliveries/resolve?path=${encodeURIComponent(path)}`), 'resolve')
+  emit(j)
+  out(`${j.resolved} · ${j.query}`)
+  if (j.project) out(`  project   ${j.project.code} — ${j.project.title}`)
+  if (j.dataset) out(`  dataset   ${j.dataset.name}${j.dataset.label ? ` (${j.dataset.label})` : ''}`)
+  if (j.delivery) {
+    out(`  batch     ${j.delivery.batch_name ?? j.delivery.batch_id} · #${j.delivery.sequence_number ?? '?'}`)
+    out(`  validated ${j.delivery.validated_at ?? '—'} · delivered ${j.delivery.transferred_at ?? '—'}`)
+    if (j.delivery.manifest_path) out(`  manifest  ${j.delivery.manifest_path}`)
+  }
+  if (j.file) {
+    out(
+      `  file      ${j.file.filename} · ${j.file.size_bytes} bytes` +
+        (j.file.declared_checksum
+          ? ` · ${j.file.declared_checksum_algorithm}:${j.file.declared_checksum}`
+          : ''),
+    )
+  }
+}
+
+// ——— main ———
+if (!command || command === 'help' || command === '--help') {
+  cmdHelp()
+  process.exit(0)
+}
+
+const commands = {
+  ping: cmdPing,
+  projects: cmdProjects,
+  datasets: cmdDatasets,
+  'sample-depth': cmdSampleDepth,
+  contract: cmdContract,
+  check: cmdCheck,
+  push: cmdPush,
+  status: cmdStatus,
+  sandbox: cmdSandbox,
+  deliveries: cmdDeliveries,
+  resolve: cmdResolve,
+}
+try {
+  if (!KEY) die('Set MYELIN_API_KEY (create a key in Bridge → API).')
+  const fn = commands[command]
+  if (!fn) die(`Unknown command "${command}" — run: myelin help`)
+  await fn()
+} catch (err) {
+  // die() already printed and set the code; anything else is a real bug and
+  // deserves its stack.
+  if (!(err instanceof CliExit)) throw err
+}