@novedu/cli 0.17.0 → 0.19.0

package/dist/main.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { Command } from "commander";
+import { readFile, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
 import { CryptoProvider, PublicClientApplication } from "@azure/msal-node";
-import { readFile } from "node:fs/promises";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import Handlebars from "handlebars";
-import { parse } from "yaml";
+import { parse, stringify } from "yaml";
 import { z } from "zod";
+import Handlebars from "handlebars";
+import { fileURLToPath, pathToFileURL } from "node:url";
 //#region src/auth.ts
 const DEFAULT_TENANT_ID = "91fc072c-edef-4f97-bdc5-cfb67718ae3a";
 const DEFAULT_CLIENT_ID = "4d44fc4b-0434-4981-9765-62e2074ceecb";
@@ -174,8 +174,16 @@ async function acquireByDeviceCode(pca, onMessage) {
 * The one call every API command makes: a silently-acquired access token for
 * the Authorization header. Throws NotSignedInError when interactive login is
 * required first.
+*
+* `NOVEDU_TOKEN` short-circuits the MSAL cache with a caller-supplied bearer
+* token. It exists for TESTS and CI (the CLI integration suite runs the real
+* binary against a fake API, with no browser to sign in) — the token is still
+* validated by the server on every request, so this weakens nothing; it only
+* removes the interactive step. Not a substitute for `login` in normal use.
 */
 async function getAccessToken() {
+	const override = process.env.NOVEDU_TOKEN?.trim();
+	if (override) return override;
 	const result = await acquireSilent(buildPca());
 	if (!result) throw new NotSignedInError();
 	return result.accessToken;
@@ -206,20 +214,30 @@ function failJson(value) {
 * network, non-2xx) it prints the JSON error to stderr per the contract —
 * server error bodies (`{ message }` — incl. the generic 401/403 — or
 * `{ errors }`) passed through VERBATIM — marks the process failed, and
-* returns `{ ok: false }`. On success it returns the parsed payload WITHOUT
-* printing, so multi-step commands (`images upload`) can consume intermediate
-* responses silently. No client-side pre-validation: the server runs the
-* identical pipeline; offline checking is the `validate` command's job.
+* returns `{ ok: false, error }` with that same payload. On success it returns
+* the parsed payload WITHOUT printing, so multi-step commands (`images upload`)
+* can consume intermediate responses silently. No client-side pre-validation:
+* the server runs the identical pipeline; offline checking is the `validate`
+* command's job.
+*
+* `quiet` suppresses both the stderr print and the exit-code marking and hands
+* the failure payload back instead — for commands that make MANY requests and
+* report the outcome themselves (`codes sync`, where one entry's rejection must
+* not abort the run).
 */
 async function performApiRequest(options) {
+	const fail = (value) => {
+		if (!options.quiet) failJson(value);
+		return {
+			ok: false,
+			error: value
+		};
+	};
 	let token;
 	try {
 		token = await getAccessToken();
 	} catch (error) {
-		if (error instanceof NotSignedInError) {
-			failJson({ message: error.message });
-			return { ok: false };
-		}
+		if (error instanceof NotSignedInError) return fail({ message: error.message });
 		throw error;
 	}
 	const server = resolveServerUrl(options.server);
@@ -234,8 +252,7 @@ async function performApiRequest(options) {
 			body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
 		});
 	} catch (error) {
-		failJson({ message: `Could not reach ${server}: ${error instanceof Error ? error.message : error}` });
-		return { ok: false };
+		return fail({ message: `Could not reach ${server}: ${error instanceof Error ? error.message : error}` });
 	}
 	let payload;
 	try {
@@ -243,10 +260,7 @@ async function performApiRequest(options) {
 	} catch {
 		payload = void 0;
 	}
-	if (!response.ok) {
-		failJson(payload ?? { message: `${server} rejected the request: HTTP ${response.status}` });
-		return { ok: false };
-	}
+	if (!response.ok) return fail(payload ?? { message: `${server} rejected the request: HTTP ${response.status}` });
 	return {
 		ok: true,
 		payload
@@ -262,8 +276,570 @@ async function runApiRequest(options) {
 	if (result.ok) printJson(result.payload ?? null);
 }
 //#endregion
+//#region ../lib/llm/provider.ts
+const LLM_PROVIDERS = ["SCCH", "Azure Foundry"];
+const DEFAULT_PROVIDER = "SCCH";
+const providerSchema = z.enum(LLM_PROVIDERS).default(DEFAULT_PROVIDER).meta({ description: "The LLM provider serving the model. For Azure Foundry, model is the deployment name." });
+function parseLenientProvider(value) {
+	return value === "SCCH" || value === "Azure Foundry" ? value : void 0;
+}
+//#endregion
+//#region ../lib/registry-schema.ts
+/** The fixed group names and the code module each one mints for. */
+const GROUP_MODULES = {
+	quizzes: "quiz",
+	tutors: "tutor",
+	writing: "writing",
+	coding: "coding"
+};
+const GROUP_NAMES = Object.keys(GROUP_MODULES);
+/** Registry keys share the lock file's flat namespace, so they stay URL/YAML-plain. */
+const KEY_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+const EXPLICIT_OFFSET = /(?:Z|[+-]\d{2}:?\d{2})$/;
+function timestampField(field) {
+	return z.string().refine((value) => EXPLICIT_OFFSET.test(value) && !Number.isNaN(Date.parse(value)), `${field} must be an ISO 8601 datetime with an explicit offset or Z, e.g. 2026-09-01T08:00:00+02:00`).refine((value) => {
+		const parsed = Date.parse(value);
+		return Number.isNaN(parsed) || parsed % 1e3 === 0;
+	}, `${field} must not carry sub-second precision — the server stores whole seconds`);
+}
+const providerField = z.enum(LLM_PROVIDERS, { error: "must be \"SCCH\" or \"Azure Foundry\"" });
+/**
+* One registry entry. Unknown extra properties are ACCEPTED and ignored so authors can
+* annotate freely and a newer registry keeps working with an older CLI — which is why
+* this is a `looseObject` and the generated JSON Schema does NOT flag a misspelled field.
+*/
+const RegistryEntrySchema = z.looseObject({
+	file: z.string().trim().min(1).optional().meta({ description: "Path to the activity YAML, resolved against `base-url`. Give exactly one of `file` or `url`." }),
+	url: z.string().trim().min(1).optional().meta({ description: "Absolute http(s) URL of the activity YAML. Give exactly one of `file` or `url`." }),
+	start: timestampField("start").optional().meta({ description: "Start of the code's validity window, ISO 8601 with an explicit offset or Z (e.g. 2026-09-01T08:00:00+02:00), whole seconds." }),
+	end: timestampField("end").optional().meta({ description: "End of the code's validity window, same format as `start`, and must be after it." }),
+	note: z.string().trim().max(200, `note must be at most 200 characters`).optional().meta({ description: `Note shown in the codes list, at most 200 characters. No effect on behaviour.` }),
+	llm: z.looseObject({
+		provider: providerField.meta({ description: "LLM provider override for this code. Required when `llm` is present." }),
+		model: z.string().trim().min(1).max(256).meta({ description: "Model id (for Azure Foundry, the deployment name). Required when `llm` is present." })
+	}).optional().meta({ description: "Per-code LLM override replacing the activity YAML's own `llm:`. Provider and model must be given together." })
+}).refine((entry) => entry.file === void 0 !== (entry.url === void 0), "give exactly one of `file` (relative to base-url) or `url` (absolute)").meta({
+	id: "registryEntry",
+	description: "One activity: where its YAML lives, plus the parameters its code is minted with."
+});
+/** A group holds `key: entry` pairs; an empty group (`quizzes:` with nothing under it) is fine. */
+function groupOf(group) {
+	return z.record(z.string().regex(KEY_PATTERN).max(64), RegistryEntrySchema).nullable().optional().meta({ description: `Activities minted as \`${GROUP_MODULES[group]}\` codes, keyed by the name your material references.` });
+}
+z.looseObject({
+	"base-url": z.string().optional().meta({ description: "Base URL each entry's `file` is resolved against. Must end with a slash. Only needed when an entry uses `file`." }),
+	activities: z.strictObject(Object.fromEntries(GROUP_NAMES.map((group) => [group, groupOf(group)]))).meta({ description: "The activities, grouped by the kind of code each one is minted as." })
+});
+//#endregion
+//#region src/registry.ts
+const rootSchema = z.looseObject({
+	"base-url": z.string().optional(),
+	activities: z.record(z.string(), z.unknown(), { error: "activities must be a mapping of activity groups" })
+});
+function issue(code, path, message) {
+	return {
+		code,
+		path,
+		message
+	};
+}
+/** Turns zod's issue list into registry issues rooted at `basePath`. */
+function schemaIssues(error, basePath) {
+	return error.issues.map((item) => issue("REGISTRY_SCHEMA_ERROR", [basePath, ...item.path.map(String)].filter(Boolean).join("."), item.message));
+}
+/** A plain YAML mapping — the shape both a group and an entry must have. */
+function isMapping(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Parses and validates a registry document, resolving every entry's file URL.
+* Returns ALL issues found rather than the first — a registry is edited by hand,
+* so one run should surface every problem.
+*/
+function parseRegistry(text) {
+	let document;
+	try {
+		document = parse(text);
+	} catch (error) {
+		return {
+			ok: false,
+			errors: [issue("REGISTRY_PARSE_ERROR", "", `Invalid YAML: ${error instanceof Error ? error.message : String(error)}`)]
+		};
+	}
+	const root = rootSchema.safeParse(document ?? {});
+	if (!root.success) return {
+		ok: false,
+		errors: schemaIssues(root.error, "")
+	};
+	const errors = [];
+	const entries = [];
+	const seenKeys = /* @__PURE__ */ new Map();
+	const baseUrlText = root.data["base-url"];
+	let baseUrl;
+	if (baseUrlText !== void 0) {
+		const parsed = safeHttpUrl(baseUrlText);
+		if (!parsed) errors.push(issue("REGISTRY_SCHEMA_ERROR", "base-url", "must be an http(s) URL"));
+		else if (!parsed.endsWith("/")) errors.push(issue("REGISTRY_SCHEMA_ERROR", "base-url", "must end with a slash — it is resolved against, not concatenated with, each entry's `file`"));
+		else baseUrl = parsed;
+	}
+	for (const [groupName, groupValue] of Object.entries(root.data.activities)) {
+		const groupPath = `activities.${groupName}`;
+		if (!(groupName in GROUP_MODULES)) {
+			errors.push(issue("REGISTRY_SCHEMA_ERROR", groupPath, `unknown activity group — use one of ${GROUP_NAMES.join(", ")}`));
+			continue;
+		}
+		if (groupValue === null || groupValue === void 0) continue;
+		if (!isMapping(groupValue)) {
+			errors.push(issue("REGISTRY_SCHEMA_ERROR", groupPath, "must be a mapping of key → entry"));
+			continue;
+		}
+		const module = GROUP_MODULES[groupName];
+		for (const [key, value] of Object.entries(groupValue)) {
+			if (value !== null && !isMapping(value)) continue;
+			const entryPath = `${groupPath}.${key}`;
+			if (value === null) {
+				errors.push(issue("REGISTRY_SCHEMA_ERROR", entryPath, "entry has no fields — check the indentation of the lines below it"));
+				continue;
+			}
+			if (!KEY_PATTERN.test(key) || key.length > 64) {
+				errors.push(issue("REGISTRY_SCHEMA_ERROR", entryPath, `invalid key — use lowercase letters, digits and hyphens (max 64 characters)`));
+				continue;
+			}
+			const previousGroup = seenKeys.get(key);
+			if (previousGroup) {
+				errors.push(issue("REGISTRY_SCHEMA_ERROR", entryPath, `duplicate key — already defined under activities.${previousGroup}; keys are unique across all groups`));
+				continue;
+			}
+			seenKeys.set(key, groupName);
+			const parsed = RegistryEntrySchema.safeParse(value);
+			if (!parsed.success) {
+				errors.push(...schemaIssues(parsed.error, entryPath));
+				continue;
+			}
+			const entry = parsed.data;
+			if (entry.start && entry.end && Date.parse(entry.end) <= Date.parse(entry.start)) {
+				errors.push(issue("REGISTRY_SCHEMA_ERROR", `${entryPath}.end`, "must be after `start`"));
+				continue;
+			}
+			let fileUrl;
+			if (entry.url !== void 0) {
+				fileUrl = safeHttpUrl(entry.url);
+				if (!fileUrl) {
+					errors.push(issue("REGISTRY_SCHEMA_ERROR", `${entryPath}.url`, "must be an absolute http(s) URL"));
+					continue;
+				}
+			} else if (baseUrl === void 0) {
+				errors.push(issue("REGISTRY_SCHEMA_ERROR", `${entryPath}.file`, baseUrlText === void 0 ? "`file` is relative, but the registry has no `base-url`" : "`file` cannot be resolved — fix `base-url`"));
+				continue;
+			} else {
+				fileUrl = safeHttpUrl(entry.file ?? "", baseUrl);
+				if (!fileUrl) {
+					errors.push(issue("REGISTRY_SCHEMA_ERROR", `${entryPath}.file`, "does not resolve to an http(s) URL against `base-url`"));
+					continue;
+				}
+			}
+			entries.push({
+				key,
+				module,
+				fileUrl,
+				validFrom: entry.start ?? null,
+				validUntil: entry.end ?? null,
+				note: entry.note ?? null,
+				llm: entry.llm ? {
+					provider: entry.llm.provider,
+					model: entry.llm.model
+				} : null
+			});
+		}
+	}
+	return errors.length > 0 ? {
+		ok: false,
+		errors
+	} : {
+		ok: true,
+		entries
+	};
+}
+/**
+* Normalizes a (possibly relative) URL the way `validateCodeRequest` does —
+* `URL.href` — so a resolved entry compares byte-identical to the `file_url` the
+* server stored. Returns undefined for anything that is not http(s).
+*/
+function safeHttpUrl(value, base) {
+	let url;
+	try {
+		url = new URL(value.trim(), base);
+	} catch {
+		return;
+	}
+	return url.protocol === "http:" || url.protocol === "https:" ? url.href : void 0;
+}
+/** Reads and validates a registry file; a read failure is reported like a schema issue. */
+async function loadRegistry(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch (error) {
+		return {
+			ok: false,
+			errors: [issue("REGISTRY_READ_ERROR", "", `Could not read ${path}: ${error instanceof Error ? error.message : String(error)}`)]
+		};
+	}
+	return parseRegistry(text);
+}
+/** The lock file that belongs to a registry: `<name>.yaml` → `<name>.lock.yaml`. */
+function defaultLockPath(registryPath) {
+	return `${registryPath.replace(/\.ya?ml$/i, "")}.lock.yaml`;
+}
+//#endregion
+//#region src/sync.ts
+/**
+* Narrows the `GET /api/codes` payload to the fields matching needs, dropping
+* anything unrecognizable. The CLI never fails on an unexpected extra field —
+* the server may grow the shape at any time.
+*/
+function parseServerCodes(payload) {
+	if (!Array.isArray(payload)) return [];
+	const codes = [];
+	for (const row of payload) {
+		if (typeof row !== "object" || row === null) continue;
+		const value = row;
+		if (typeof value.code !== "string" || typeof value.fileUrl !== "string") continue;
+		if (typeof value.module !== "string") continue;
+		const llm = value.llm;
+		codes.push({
+			code: value.code,
+			url: typeof value.url === "string" ? value.url : null,
+			module: value.module,
+			fileUrl: value.fileUrl,
+			note: typeof value.note === "string" ? value.note : null,
+			validFrom: typeof value.validFrom === "string" ? value.validFrom : null,
+			validUntil: typeof value.validUntil === "string" ? value.validUntil : null,
+			llm: typeof llm === "object" && llm !== null ? {
+				provider: String(llm.provider ?? ""),
+				model: String(llm.model ?? "")
+			} : null,
+			createdAt: typeof value.createdAt === "string" ? value.createdAt : null
+		});
+	}
+	return codes;
+}
+/**
+* Window bounds compare as INSTANTS, not as strings: the registry may spell a
+* moment `+02:00` while the server always answers in `Z`. An absent bound (null)
+* only matches an absent one.
+*/
+function sameInstant(a, b) {
+	if (a === null || b === null) return a === b;
+	const left = Date.parse(a);
+	const right = Date.parse(b);
+	return !Number.isNaN(left) && left === right;
+}
+function sameLlm(a, b) {
+	if (a === null || b === null) return a === b;
+	return a.provider === b.provider && a.model === b.model;
+}
+/**
+* The codes that ARE this entry: same activity URL, module and availability
+* window, same LLM override. `note` is deliberately excluded — it is a label for
+* the teacher, not part of the code's behavior, so editing it must not fork a
+* new code. Newest first, so the caller reuses the most recent one.
+*/
+function matchEntry(entry, codes) {
+	return codes.filter((code) => code.fileUrl === entry.fileUrl && code.module === entry.module && sameInstant(code.validFrom, entry.validFrom) && sameInstant(code.validUntil, entry.validUntil) && sameLlm(entry.llm, code.llm)).sort((a, b) => Date.parse(b.createdAt ?? "") - Date.parse(a.createdAt ?? "") || 0);
+}
+/**
+* Picks ONE code per registry key out of the pool, so a key's code never moves
+* while a matching code exists.
+*
+* Two entries may legitimately describe the same activity with the same window —
+* one quiz linked from two chapters, each wanting its own statistics — and both
+* then match both of the codes that minted for them. Taking "the newest match"
+* per entry independently would hand BOTH keys the same code, strand the other,
+* and flip the assignment whenever a newer code appeared: a key's published code
+* would move under the students already using it, and two consecutive runs of an
+* unchanged registry would write different lock files. Selection therefore
+* claims: every key that still matches the code it already has keeps it (all of
+* them, before any key takes a free one), then each remaining key takes the
+* newest code nobody has claimed.
+*/
+function selectMatches(entries, codes, previousLock) {
+	const candidates = /* @__PURE__ */ new Map();
+	for (const entry of entries) candidates.set(entry.key, matchEntry(entry, codes));
+	const selected = /* @__PURE__ */ new Map();
+	const claimed = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		const previous = previousLock[entry.key];
+		if (!previous || claimed.has(previous)) continue;
+		const kept = candidates.get(entry.key)?.find((code) => code.code === previous);
+		if (!kept) continue;
+		selected.set(entry.key, kept);
+		claimed.add(kept.code);
+	}
+	for (const entry of entries) {
+		if (selected.has(entry.key)) continue;
+		const free = candidates.get(entry.key)?.find((code) => !claimed.has(code.code));
+		if (!free) continue;
+		selected.set(entry.key, free);
+		claimed.add(free.code);
+	}
+	return selected;
+}
+/** The mint body for an entry — exactly what `POST /api/codes` accepts. */
+function mintBody(entry) {
+	return {
+		module: entry.module,
+		fileUrl: entry.fileUrl,
+		...entry.validFrom === null ? {} : { validFrom: entry.validFrom },
+		...entry.validUntil === null ? {} : { validUntil: entry.validUntil },
+		...entry.note === null ? {} : { note: entry.note },
+		...entry.llm === null ? {} : { llm: entry.llm }
+	};
+}
+/**
+* Advisory findings for one run: codes the registry no longer describes but that
+* still exist for one of its activities (a parameter change mints a NEW code —
+* the old one is never touched), several codes matching one entry, and lock keys
+* that have left the registry. Nothing here is an error; superseded codes stay
+* live until a teacher deletes them in the web app.
+*/
+function collectWarnings(results, serverCodes, previousLock) {
+	const warnings = [];
+	const claimed = /* @__PURE__ */ new Set();
+	const inUse = new Set(results.filter((result) => result.action === "reused").map((result) => result.code));
+	for (const result of results) {
+		if (result.action !== "reused") continue;
+		const matches = matchEntry(result.entry, serverCodes);
+		for (const match of matches) claimed.add(match.code);
+		const spare = matches.filter((match) => match.code !== result.code && !inUse.has(match.code));
+		if (spare.length > 0) warnings.push({
+			type: "duplicate",
+			key: result.entry.key,
+			codes: matches.map((match) => match.code),
+			message: `${result.entry.key}: ${matches.length} codes match this entry — using ${result.code}; unused: ${spare.map((match) => match.code).join(", ")}`
+		});
+		const matched = matches.find((match) => match.code === result.code);
+		if (matched && (matched.note ?? "") !== (result.entry.note ?? "")) warnings.push({
+			type: "note",
+			key: result.entry.key,
+			codes: [matched.code],
+			message: `${result.entry.key}: the existing code's note differs from the registry's — a note is never re-applied to a minted code`
+		});
+	}
+	const activities = new Set(results.map((result) => `${result.entry.module} ${result.entry.fileUrl}`));
+	const superseded = serverCodes.filter((code) => !claimed.has(code.code) && activities.has(`${code.module} ${code.fileUrl}`));
+	for (const code of superseded) warnings.push({
+		type: "superseded",
+		codes: [code.code],
+		message: `${code.code}: an older code for ${code.fileUrl} no longer matches any registry entry — it still works; delete it in the web app when the class has moved on`
+	});
+	const keys = new Set(results.map((result) => result.entry.key));
+	for (const key of Object.keys(previousLock)) {
+		if (keys.has(key)) continue;
+		warnings.push({
+			type: "orphaned",
+			key,
+			codes: [previousLock[key] ?? ""],
+			message: `${key}: in the lock file but no longer in the registry — dropped from the lock; the code ${previousLock[key]} still exists`
+		});
+	}
+	return warnings;
+}
+/**
+* The lock content for a run. An entry that FAILED this run keeps the code the
+* previous lock had for it: a transient server error must never break the
+* consumer's build. A failed entry with no previous code is simply absent.
+*/
+function buildLockCodes(results, previousLock) {
+	const codes = {};
+	for (const result of results) {
+		const code = result.code ?? previousLock[result.entry.key];
+		if (code) codes[result.entry.key] = code;
+	}
+	return codes;
+}
+/** The single top-level key of a lock file — namespaced so it can be merged into other metadata. */
+const LOCK_ROOT_KEY = "activity-codes";
+/** Serializes the lock file: keys sorted, so a re-run produces a byte-identical file. */
+function serializeLock(codes, registryFileName) {
+	const sorted = {};
+	for (const key of Object.keys(codes).sort()) sorted[key] = codes[key];
+	return [
+		"# Generated by @novedu/cli — do not edit.",
+		`# Regenerate with: novedu-cli codes sync ${registryFileName}`,
+		stringify({ [LOCK_ROOT_KEY]: sorted })
+	].join("\n");
+}
+/** Reads a lock file's `activity-codes` map; anything unusable yields an empty map. */
+function parseLock(text) {
+	let document;
+	try {
+		document = parse(text);
+	} catch {
+		return {};
+	}
+	if (typeof document !== "object" || document === null) return {};
+	const map = document[LOCK_ROOT_KEY];
+	if (typeof map !== "object" || map === null) return {};
+	const codes = {};
+	for (const [key, value] of Object.entries(map)) if (typeof value === "string" && value) codes[key] = value;
+	return codes;
+}
+/**
+* The human-readable report: one line per entry (action, key, code, share URL or
+* the server's complaint), then the advisory findings, then a summary. Returned
+* as lines so the command decides where they go.
+*/
+function formatSyncReport(results, warnings, options) {
+	const width = Math.max(0, ...results.map((result) => result.entry.key.length));
+	const label = (action) => (options.dryRun && action === "minted" ? "would mint" : action).padEnd(9);
+	const lines = [`${options.registryFileName}: ${results.length} ${results.length === 1 ? "entry" : "entries"}`];
+	for (const result of results) {
+		const detail = result.action === "failed" ? describeError(result.error) : result.url ?? result.code ?? "(not minted — dry run)";
+		lines.push(`  ${label(result.action)} ${result.entry.key.padEnd(width)}  ${result.code ? `${result.code}  ` : ""}${detail}`);
+	}
+	if (warnings.length > 0) {
+		lines.push("", "Notes:");
+		for (const warning of warnings) lines.push(`  - ${warning.message}`);
+	}
+	const counts = {
+		reused: 0,
+		minted: 0,
+		failed: 0
+	};
+	for (const result of results) counts[result.action] += 1;
+	lines.push("", `${counts.reused} reused, ${counts.minted} ${options.dryRun ? "to mint" : "minted"}, ${counts.failed} failed`);
+	return lines;
+}
+/** A one-line rendering of the server's failure payload for the report. */
+function describeError(error) {
+	if (typeof error !== "object" || error === null) return String(error ?? "unknown error");
+	const value = error;
+	if (typeof value.message === "string") return value.message;
+	if (Array.isArray(value.errors)) return value.errors.map((item) => {
+		if (typeof item !== "object" || item === null) return String(item);
+		const detail = item;
+		return [detail.code, detail.message].filter(Boolean).join(": ");
+	}).join("; ");
+	return JSON.stringify(error);
+}
+//#endregion
 //#region src/commands/codes.ts
 const SERVER_OPTION$3 = ["--server <url>", "Novedu server base URL (defaults to the NOVEDU_SERVER env var, then production)"];
+/**
+* Reconciles a registry file with the server and rewrites its lock file: match
+* every entry against the caller's existing codes (URL + module + window + LLM
+* override), mint what has no match, and report the rest. Existing codes are
+* never modified or deleted — changed parameters produce a NEW code and the old
+* one is reported as superseded (docs/registry.md).
+*/
+async function runSync(registryFile, options) {
+	const registry = await loadRegistry(registryFile);
+	if (!registry.ok) {
+		failJson({
+			message: `${registryFile} is not a usable activity registry.`,
+			errors: registry.errors
+		});
+		return;
+	}
+	const lockPath = options.lock ?? defaultLockPath(registryFile);
+	const previousLock = await readLock(lockPath);
+	const listed = await performApiRequest({
+		server: options.server,
+		path: "/api/codes"
+	});
+	if (!listed.ok) return;
+	const serverCodes = parseServerCodes(listed.payload);
+	const results = [];
+	const selected = selectMatches(registry.entries, serverCodes, previousLock);
+	for (const entry of registry.entries) {
+		const match = selected.get(entry.key);
+		if (match) {
+			results.push({
+				entry,
+				action: "reused",
+				code: match.code,
+				url: match.url ?? void 0
+			});
+			continue;
+		}
+		if (options.dryRun) {
+			results.push({
+				entry,
+				action: "minted"
+			});
+			continue;
+		}
+		const created = await performApiRequest({
+			server: options.server,
+			path: "/api/codes",
+			method: "POST",
+			body: mintBody(entry),
+			quiet: true
+		});
+		if (!created.ok) {
+			results.push({
+				entry,
+				action: "failed",
+				error: created.error
+			});
+			continue;
+		}
+		const minted = created.payload;
+		if (typeof minted?.code !== "string" || minted.code === "") {
+			results.push({
+				entry,
+				action: "failed",
+				error: { message: "the server accepted the request but returned no code" }
+			});
+			continue;
+		}
+		results.push({
+			entry,
+			action: "minted",
+			code: minted.code,
+			url: typeof minted.url === "string" ? minted.url : void 0
+		});
+	}
+	const warnings = collectWarnings(results, serverCodes, previousLock);
+	const failed = results.filter((result) => result.action === "failed").length;
+	if (options.json) printJson({
+		...options.dryRun ? { dryRun: true } : {},
+		entries: results.map((result) => ({
+			key: result.entry.key,
+			module: result.entry.module,
+			fileUrl: result.entry.fileUrl,
+			action: result.action,
+			...result.code ? { code: result.code } : {},
+			...result.url ? { url: result.url } : {},
+			...result.action === "failed" ? { error: result.error } : {}
+		})),
+		warnings
+	});
+	else for (const line of formatSyncReport(results, warnings, {
+		registryFileName: basename(registryFile),
+		dryRun: Boolean(options.dryRun)
+	})) console.log(line);
+	if (!options.dryRun) {
+		const lock = serializeLock(buildLockCodes(results, previousLock), basename(registryFile));
+		try {
+			await writeFile(lockPath, lock, "utf8");
+		} catch (error) {
+			failJson({ message: `Could not write the lock file ${lockPath}: ${error instanceof Error ? error.message : error}` });
+			return;
+		}
+		if (!options.json) console.log(`Lock file: ${lockPath}`);
+	}
+	if (failed > 0) process.exitCode = 1;
+}
+/** The lock file's previous content; a missing or unreadable lock is simply empty. */
+async function readLock(lockPath) {
+	try {
+		return parseLock(await readFile(lockPath, "utf8"));
+	} catch {
+		return {};
+	}
+}
 function registerCodes(program) {
 	const codes = program.command("codes").description("Manage activity codes on the Novedu server");
 	codes.command("create").description("Create a code for an activity YAML (validated server-side before storing)").requiredOption("--module <module>", "activity module: tutor, quiz, writing or coding").requiredOption("--file <url>", "public http(s) URL of the activity YAML").option("--start <iso>", "window start, ISO 8601 with explicit offset (e.g. 2026-07-07T08:00:00Z)").option("--end <iso>", "window end, ISO 8601 with explicit offset").option("--note <text>", "note shown in the codes list").option("--llm-provider <provider>", "LLM override provider (\"SCCH\" or \"Azure Foundry\"; needs --llm-model)").option("--llm-model <model>", "LLM override model id (needs --llm-provider)").option(...SERVER_OPTION$3).action(async (options) => {
@@ -295,6 +871,9 @@ function registerCodes(program) {
 			path: `/api/codes${query ? `?${query}` : ""}`
 		});
 	});
+	codes.command("sync").description("Reconcile an activity registry file with the server and write its lock file").argument("<registry-file>", "path to the hand-written activity registry YAML").option("--lock <path>", "lock file path (default: the registry path with .lock.yaml)").option("--dry-run", "report what would happen; mint nothing and write no lock file").option("--json", "machine-readable report on stdout instead of the per-entry lines").option(...SERVER_OPTION$3).action(async (registryFile, options) => {
+		await runSync(registryFile, options);
+	});
 }
 //#endregion
 //#region src/commands/files.ts
@@ -466,36 +1045,131 @@ Purely local — already-issued access tokens stay valid until they expire
 	});
 }
 //#endregion
-//#region src/commands/reports.ts
-const SERVER_OPTION = ["--server <url>", "Novedu server base URL (defaults to the NOVEDU_SERVER env var, then production)"];
-function registerReports(program) {
-	const reports = program.command("reports").description("Triage student reports on the Novedu server");
-	reports.command("list").description("List reports (defaults to open reports on your own codes, like the web inbox)").option("--status <status>", "open (default), resolved or all").option("--reaction <reaction>", "filter by reaction: good, omg, bad or holysh").option("--search <q>", "contains-filter over description, reporter, code and note").option("--all", "include reports on codes created by other teachers").option(...SERVER_OPTION).action(async (options) => {
-		const params = new URLSearchParams();
-		if (options.status) params.set("status", options.status);
-		if (options.reaction) params.set("reaction", options.reaction);
-		if (options.search) params.set("q", options.search);
-		if (options.all) params.set("mine", "0");
-		const query = params.toString();
-		await runApiRequest({
-			server: options.server,
-			path: `/api/reports${query ? `?${query}` : ""}`
-		});
-	});
-	reports.command("show <id>").description("Show one report; a chat report embeds its conversation transcript").option(...SERVER_OPTION).action(async (id, options) => {
-		await runApiRequest({
-			server: options.server,
-			path: `/api/reports/${encodeURIComponent(id)}`
-		});
-	});
-	reports.command("resolve <id...>").description("Resolve one or more reports by id (bulk, in a single request)").option(...SERVER_OPTION).action(async (ids, options) => {
-		await runApiRequest({
-			server: options.server,
-			path: "/api/reports/resolve",
-			method: "POST",
-			body: { ids }
-		});
-	});
+//#region ../lib/coding-proxy.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Appends the teacher's instructions to the END of an existing system-message
+* `content`, handling both the string form and OpenAI's content-parts array form.
+* Falls back to the instructions alone when there is no usable existing content.
+*/
+function appendInstructions(existing, instructions) {
+	if (typeof existing === "string") return existing.trim() === "" ? instructions : `${existing}\n\n${instructions}`;
+	if (Array.isArray(existing)) return [...existing, {
+		type: "text",
+		text: instructions
+	}];
+	return instructions;
+}
+/**
+* Builds the upstream Chat Completions body from the client's body: PIN the model and
+* fold in the teacher's system prompt. The teacher's instructions are appended to the
+* END of the client's LAST system message, so the teacher has the final word: a client
+* cannot smuggle a later system message after the teacher's to override it. If the
+* client sent no system message, a leading one carrying only the teacher's instructions
+* is added. Everything else (messages, tools, tool_choice, temperature, stream, …)
+* passes through verbatim, so client-side tools and streaming are all preserved.
+*/
+function buildUpstreamChatBody(clientBody, opts) {
+	const clientMessages = Array.isArray(clientBody.messages) ? clientBody.messages : [];
+	const systemIndex = clientMessages.findLastIndex((m) => isRecord(m) && m.role === "system");
+	let messages;
+	if (systemIndex === -1) messages = [{
+		role: "system",
+		content: opts.instructions
+	}, ...clientMessages];
+	else {
+		const existing = clientMessages[systemIndex];
+		messages = [...clientMessages];
+		messages[systemIndex] = {
+			...existing,
+			content: appendInstructions(existing.content, opts.instructions)
+		};
+	}
+	const upstream = {
+		...clientBody,
+		model: opts.model,
+		messages
+	};
+	if (clientBody.stream === true) upstream.stream_options = {
+		...isRecord(clientBody.stream_options) ? clientBody.stream_options : {},
+		include_usage: true
+	};
+	return upstream;
+}
+//#endregion
+//#region ../lib/prompt-fragments/block.ts
+/**
+* The consumed/empty block a runtime loader leaves behind after resolving fragments
+* into its own field (`Quiz.instructionsPreamble`, or folded into writing/coding
+* `instructions`), so no stale unresolved block lingers as a second source of truth
+* on the loaded object.
+*/
+const EMPTY_FRAGMENT_BLOCK = {
+	fragment_files: [],
+	text_files: []
+};
+function readFragmentBlock(root) {
+	return {
+		fragment_files: Array.isArray(root.fragment_files) ? root.fragment_files : [],
+		text_files: Array.isArray(root.text_files) ? root.text_files : []
+	};
+}
+//#endregion
+//#region ../lib/coding-yaml.ts
+function asString$2(value) {
+	if (typeof value === "string") return value.trim() !== "" ? value : void 0;
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
+	if (typeof value === "boolean") return String(value);
+}
+/**
+* Parses and lightly validates a coding YAML. Returns a friendly error message
+* (not structured errors) when an essential field is missing — the proxy and the
+* student page surface it as a notice.
+*/
+function parseCoding(content) {
+	let doc;
+	try {
+		doc = parse(content);
+	} catch {
+		return {
+			ok: false,
+			message: "This coding activity could not be read — its YAML is not valid."
+		};
+	}
+	if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return {
+		ok: false,
+		message: "This coding activity is empty or malformed."
+	};
+	const root = doc;
+	const llm = root.llm;
+	const model = asString$2(llm?.model);
+	if (!model) return {
+		ok: false,
+		message: "This coding activity does not specify a model (llm.model)."
+	};
+	const provider = llm?.provider === void 0 ? DEFAULT_PROVIDER : parseLenientProvider(llm.provider);
+	if (!provider) return {
+		ok: false,
+		message: "This coding activity uses an unsupported llm.provider (use \"SCCH\" or \"Azure Foundry\")."
+	};
+	const instructions = asString$2(root.instructions);
+	if (!instructions) return {
+		ok: false,
+		message: "This coding activity has no instructions for the assistant."
+	};
+	return {
+		ok: true,
+		coding: {
+			id: asString$2(root.id) ?? "coding",
+			title: asString$2(root.title),
+			model,
+			provider,
+			instructions,
+			fragmentBlock: readFragmentBlock(root)
+		}
+	};
 }
 //#endregion
 //#region ../lib/prompt-fragments/assemble.ts
@@ -1576,28 +2250,1033 @@ async function loadAndCheckFragmentFile(url, fetchImpl, opts = {}) {
 	};
 	return checkFragmentFileValue(yaml.value, url);
 }
-const providerSchema = z.enum(["SCCH", "Azure Foundry"]).default("SCCH").meta({ description: "The LLM provider serving the model. For Azure Foundry, model is the deployment name." });
-//#endregion
-//#region ../lib/coding-schema.ts
-const CodingYamlSchema = z.strictObject({
-	id: z.string().min(1).meta({ description: "Short machine-readable activity id, e.g. beginner-typescript." }),
-	name: z.string().optional().meta({ description: "Optional human-readable label (not shown to the student)." }),
-	title: z.string().optional().meta({ description: "Optional label shown to the student on the /<code> connection page." }),
-	llm: z.strictObject({
-		model: z.string().min(1).meta({ description: "The model that answers. SERVER-ONLY and PINNED: the proxy always uses this model and ignores whatever model the coding agent sends." }),
-		provider: providerSchema
-	}).meta({
-		id: "llm",
-		description: "The pinned model and provider that answer coding requests."
-	}),
-	fragment_files: z.array(FragmentFileRefSchema).default([]).meta({ description: "Optional fragment libraries this activity pulls shared prompt fragments from." }),
-	text_files: z.array(TextFileRefSchema).default([]).meta({ description: "Optional plain-text files (markdown / source, e.g. a sample solution) embedded verbatim into instructions via {{file \"alias\"}} markers." }),
-	instructions: z.string().min(1).meta({ description: "The assistant's system prompt. SERVER-ONLY: never sent to the browser or the coding agent, and appended AFTER the coding tool's own prompt (so the teacher has the final word). Constrain the assistant to what your class has learned. When any fragment_files or text_files are declared it is a Handlebars template: place fragments inline with {{fragment \"alias.id\" …}} and embed text files with {{file \"alias\"}} (optionally {{file \"alias\" from=10 to=40}} for a line range; escape a literal {{ as \\{{)." })
-});
 //#endregion
-//#region ../lib/coding-validate.ts
-/**
-* Extract metadata from an already-schema-validated coding value. Split from
+//#region ../lib/coding-resolve.ts
+const DEFAULT_SCHEMES$2 = ["http:", "https:"];
+function schemeAllowed$2(url, allowed) {
+	try {
+		return allowed.includes(new URL(url).protocol);
+	} catch {
+		return false;
+	}
+}
+/**
+* Resolve a leniently parsed coding activity into the runnable one. Per-request
+* streaming hot path: consistency over the referenced fragments only
+* (`validateLibraries: false`); no extra passes.
+*/
+async function resolveCoding(coding, url, fetcher, opts = {}) {
+	const resolved = await assembleFragmentPrompt(coding.fragmentBlock, url, fetcher, {
+		validateLibraries: false,
+		allowedSchemes: opts.allowedSchemes ?? DEFAULT_SCHEMES$2
+	}, coding.instructions);
+	if (!resolved.ok) return {
+		ok: false,
+		message: "This coding activity's prompt fragments could not be loaded."
+	};
+	return {
+		ok: true,
+		coding: {
+			...coding,
+			fragmentBlock: EMPTY_FRAGMENT_BLOCK,
+			instructions: resolved.prompt
+		}
+	};
+}
+/**
+* Fetch + lenient-parse + `resolveCoding`, all through the CALLER's fetcher — the
+* app-free counterpart of `loadCoding` (`lib/coding-fetch.ts`) used by the prompt dump
+* and the CLI, where there is no database and an activity may live on disk (`file:`).
+*/
+async function loadCodingFrom(url, fetcher, opts = {}) {
+	const allowedSchemes = opts.allowedSchemes ?? DEFAULT_SCHEMES$2;
+	if (!schemeAllowed$2(url, allowedSchemes)) return {
+		ok: false,
+		message: `This coding activity's URL is not allowed: ${url}`
+	};
+	try {
+		const res = await fetcher(url);
+		if (!res.ok) return res.status === 404 ? {
+			ok: false,
+			message: "This coding activity could not be found."
+		} : {
+			ok: false,
+			message: `This coding activity could not be loaded (HTTP ${res.status}).`
+		};
+		const parsed = parseCoding(await res.text());
+		if (!parsed.ok) return parsed;
+		return await resolveCoding(parsed.coding, url, fetcher, { allowedSchemes });
+	} catch {
+		return {
+			ok: false,
+			message: "This coding activity could not be loaded. Try again."
+		};
+	}
+}
+//#endregion
+//#region ../lib/quiz-types.ts
+/** The student-facing wording for a verdict — `partial` reads as "partly correct". */
+function verdictLabel(verdict) {
+	switch (verdict) {
+		case "correct": return "correct";
+		case "partial": return "partly correct";
+		case "incorrect": return "wrong";
+	}
+}
+//#endregion
+//#region ../lib/quiz-discussion-prompt.ts
+/**
+* The discussion chat's system prompt: the quiz-level `instructionsPreamble` (the
+* rendered `instructions` host text — shared safety/persona/language rules, the SAME
+* preamble the grader receives) followed by a default frame and the quiz's optional
+* `discussionInstructions`. The question/answer/verdict are the thread's seed messages,
+* recalled from memory, NOT repeated here.
+*
+* A compound quiz's imported questions each carry their SOURCE quiz's preamble
+* (`sourcePreamble`), but that applies to GRADING only (`buildGradingPrompt`): the
+* discussion prompt uses ONLY the compound file's own instructions — consistent with
+* every other include-level field (`llm`, `anonymous`, `shuffle`, ...), which the
+* compound file governs too. Mixing all chapters' preambles into one prompt would put
+* conflicting persona/language rules in force at once; the question/answer/verdict the
+* discussion needs are recalled from the thread's seed messages regardless.
+*/
+function buildDiscussionInstructions(quiz) {
+	const base = "You are helping a student understand a single quiz question. The conversation already contains the question, the student's submitted answer, and the verdict with feedback — use that context. Be concise and encouraging, and stay on this question.";
+	const frame = quiz.discussionInstructions ? `${base}\n\n${quiz.discussionInstructions.trim()}` : base;
+	return [quiz.instructionsPreamble, frame].filter(Boolean).join("\n\n");
+}
+/**
+* Seed message 1 (assistant): the question, as the SERVER knows it (authoritative).
+* `{question}` is the question's trimmed markdown.
+*/
+const QUIZ_SEED_QUESTION_TEMPLATE = "Answer the following question: {question}";
+/**
+* Seed message 3 (assistant): the graded outcome. `{verdictLabel}` is the student-facing
+* wording from `verdictLabel()` (correct / partly correct / wrong), `{feedback}` the
+* grader's markdown feedback. (Seed message 2 is the student's own answer verbatim, so
+* it has no template.)
+*/
+const QUIZ_SEED_VERDICT_TEMPLATE = "Your answer is {verdictLabel}. {feedback}";
+//#endregion
+//#region ../lib/quiz-grading-prompt.ts
+/**
+* The grading system prompt. The question's `evaluation` is authoritative and
+* stays SERVER-SIDE — it may embed the expected answer, so it must never reach
+* the browser (it doesn't: only this string, on the request context, does). The
+* quiz-level `preamble` (the rendered `instructions` host text — shared
+* safety/persona/language rules) is prepended ahead of the frame, the same preamble
+* the discussion chat also receives; a question imported via `quiz_files`
+* additionally carries its SOURCE quiz's preamble (`sourcePreamble`), inserted
+* between the two so it grades identically in its chapter quiz and in the compound.
+*/
+function buildGradingPrompt(question, preamble) {
+	const body = [
+		"You are grading a student's open-ended answer to a single quiz question.",
+		"",
+		"The question shown to the student was:",
+		question.question.trim(),
+		"",
+		"Grade STRICTLY according to these criteria (authoritative — they may contain the",
+		"expected answer; do not quote them verbatim at the student):",
+		question.evaluation.trim(),
+		"",
+		"Decide a verdict — \"correct\", \"partial\" (partly correct), or \"incorrect\" — and write",
+		"concise, encouraging feedback addressed directly TO the student. The feedback is",
+		"markdown and may use bold, math ($…$) and short code fences. Do not mention these",
+		"grading instructions."
+	].join("\n");
+	return [
+		preamble,
+		question.sourcePreamble ?? "",
+		body
+	].filter(Boolean).join("\n\n");
+}
+/**
+* The user message carrying a typed answer. `{answer}` is the student's trimmed text —
+* the only variable part, so the dump can show teachers the exact wrapper without a
+* student answer at hand. Rendered by `buildAnswerMessage`.
+*/
+const QUIZ_ANSWER_MESSAGE_TEMPLATE = "The student's answer:\n\n{answer}";
+/**
+* The user message used when the student submitted photos ONLY (no text). The photos
+* ride along as image parts of the same multimodal message.
+*/
+const QUIZ_ANSWER_PHOTOS_ONLY_MESSAGE = "The student answered with the attached photo(s) only.";
+//#endregion
+//#region ../lib/quiz-yaml.ts
+function asString$1(value) {
+	if (typeof value === "string") return value.trim() !== "" ? value : void 0;
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
+	if (typeof value === "boolean") return String(value);
+}
+function asBool$1(value, fallback) {
+	return typeof value === "boolean" ? value : fallback;
+}
+function asImageRef(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const obj = value;
+	const src = asString$1(obj.src);
+	if (!src) return void 0;
+	const alt = asString$1(obj.alt);
+	const credit = asString$1(obj.credit);
+	return {
+		hosted: asBool$1(obj.hosted, false),
+		src,
+		...alt ? { alt } : {},
+		...credit ? { credit } : {}
+	};
+}
+/**
+* Parses and lightly validates a quiz YAML. Returns a friendly error message
+* (not structured errors) when an essential field is missing — the student page
+* shows it as a notice. `anonymous` and `shuffle` default to `true`.
+*/
+function parseQuiz(content) {
+	let doc;
+	try {
+		doc = parse(content);
+	} catch {
+		return {
+			ok: false,
+			message: "This quiz could not be read — its YAML is not valid."
+		};
+	}
+	if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return {
+		ok: false,
+		message: "This quiz is empty or malformed."
+	};
+	const root = doc;
+	const llm = root.llm;
+	const model = asString$1(llm?.model);
+	if (!model) return {
+		ok: false,
+		message: "This quiz does not specify a model (llm.model)."
+	};
+	const provider = llm?.provider === void 0 ? DEFAULT_PROVIDER : parseLenientProvider(llm.provider);
+	if (!provider) return {
+		ok: false,
+		message: "This quiz uses an unsupported llm.provider (use \"SCCH\" or \"Azure Foundry\")."
+	};
+	const quizFiles = Array.isArray(root.quiz_files) ? root.quiz_files : [];
+	const rawQuestions = Array.isArray(root.questions) ? root.questions : [];
+	if (rawQuestions.length === 0 && quizFiles.length === 0) return {
+		ok: false,
+		message: "This quiz has no questions."
+	};
+	const questions = [];
+	const seenIds = /* @__PURE__ */ new Set();
+	for (const raw of rawQuestions) {
+		if (typeof raw !== "object" || raw === null) continue;
+		const q = raw;
+		const id = asString$1(q.id);
+		const question = asString$1(q.question);
+		const evaluation = asString$1(q.evaluation);
+		if (!id || !question || !evaluation || seenIds.has(id)) continue;
+		seenIds.add(id);
+		questions.push({
+			id,
+			title: asString$1(q.title),
+			question,
+			evaluation,
+			image: asImageRef(q.image),
+			...typeof q.imageInput === "boolean" ? { imageInput: q.imageInput } : {}
+		});
+	}
+	if (questions.length === 0 && quizFiles.length === 0) return {
+		ok: false,
+		message: "This quiz has no complete questions (each needs an id, question and evaluation)."
+	};
+	const rawCount = root.question_count;
+	const questionCount = typeof rawCount === "number" && Number.isInteger(rawCount) && rawCount >= 1 ? rawCount : void 0;
+	return {
+		ok: true,
+		quiz: {
+			id: asString$1(root.id) ?? asString$1(root.name) ?? "quiz",
+			name: asString$1(root.name),
+			title: asString$1(root.title),
+			description: asString$1(root.description),
+			anonymous: asBool$1(root.anonymous, true),
+			shuffle: asBool$1(root.shuffle, true),
+			model,
+			provider,
+			questionCount,
+			imageInput: asBool$1(llm?.imageInput, false),
+			discussionInstructions: asString$1(root.discussion?.instructions),
+			instructions: asString$1(root.instructions),
+			fragmentBlock: readFragmentBlock(root),
+			quizFiles,
+			instructionsPreamble: "",
+			questions
+		}
+	};
+}
+/**
+* A question's EFFECTIVE photo-answers flag: the per-question override when set, the
+* quiz-level `llm.imageInput` otherwise. The ONE definition of that two-level rule —
+* re-exported by `lib/quiz-verify.ts` for the server actions (which re-derive it on
+* every request, never trusting the client), applied by `toPublicQuiz` below, and
+* reported per question by the prompt dump.
+*/
+function effectiveImageInput(quiz, question) {
+	return question.imageInput ?? quiz.imageInput;
+}
+//#endregion
+//#region ../lib/quiz-resolve.ts
+const DEFAULT_SCHEMES$1 = ["http:", "https:"];
+function schemeAllowed$1(url, allowed) {
+	try {
+		return allowed.includes(new URL(url).protocol);
+	} catch {
+		return false;
+	}
+}
+/**
+* Renders ONE quiz document's `instructions` host text against its OWN fragment
+* block, relative to its OWN URL (`validateLibraries: false` — the hot path). Used
+* for each included source quiz, so an imported question's `sourcePreamble` is
+* exactly what its chapter quiz would grade with. (The root document renders its
+* two host texts — `instructions` + `discussion.instructions` — in `resolveQuiz`.)
+*/
+async function renderPreamble(quiz, url, fetcher, allowedSchemes) {
+	const resolved = await assembleFragmentPrompt(quiz.fragmentBlock, url, fetcher, {
+		validateLibraries: false,
+		allowedSchemes
+	}, quiz.instructions ?? "");
+	if (!resolved.ok) return { ok: false };
+	return {
+		ok: true,
+		preamble: resolved.prompt.trimEnd()
+	};
+}
+/**
+* Absolutize an imported question's content image against the SOURCE quiz URL, so
+* a `./diagram.png` next to the chapter quiz still resolves from the compound quiz
+* (whose own `file_url` is elsewhere). Hosted NAMES and absolute URLs pass through
+* unchanged — they resolve the same from anywhere.
+*/
+function absolutizeImage(image, sourceUrl) {
+	if (!image || image.hosted === true || /^https?:\/\//i.test(image.src)) return image;
+	try {
+		return {
+			...image,
+			src: resolveFragmentUrl(image.src, sourceUrl)
+		};
+	} catch {
+		return image;
+	}
+}
+/** Resolve ONE `quiz_files` include into its namespaced, import-transformed questions. */
+async function resolveInclude(ref, baseUrl, fetcher, allowedSchemes) {
+	const alias = typeof ref?.id === "string" ? ref.id.trim() : "";
+	const rawUrl = typeof ref?.url === "string" ? ref.url.trim() : "";
+	if (!alias || /[./]/.test(alias) || !rawUrl) return {
+		ok: false,
+		message: "This quiz declares an invalid quiz_files entry."
+	};
+	let sourceUrl;
+	try {
+		sourceUrl = resolveFragmentUrl(rawUrl, baseUrl);
+	} catch {
+		return {
+			ok: false,
+			message: `The included quiz "${alias}" has an invalid URL.`
+		};
+	}
+	if (!schemeAllowed$1(sourceUrl, allowedSchemes)) return {
+		ok: false,
+		message: `The included quiz "${alias}" has an invalid URL.`
+	};
+	let body;
+	try {
+		const res = await fetcher(sourceUrl);
+		if (!res.ok) return {
+			ok: false,
+			message: `The included quiz "${alias}" could not be loaded.`
+		};
+		body = await res.text();
+	} catch {
+		return {
+			ok: false,
+			message: `The included quiz "${alias}" could not be loaded.`
+		};
+	}
+	const parsed = parseQuiz(body);
+	if (!parsed.ok) return {
+		ok: false,
+		message: `The included quiz "${alias}" is not a usable quiz file.`
+	};
+	if (parsed.quiz.quizFiles.length > 0) return {
+		ok: false,
+		message: `The included quiz "${alias}" itself includes other quizzes — includes cannot be nested.`
+	};
+	const preamble = await renderPreamble(parsed.quiz, sourceUrl, fetcher, allowedSchemes);
+	if (!preamble.ok) return {
+		ok: false,
+		message: `The included quiz "${alias}"'s prompt fragments could not be loaded.`
+	};
+	const source = parsed.quiz;
+	return {
+		ok: true,
+		questions: source.questions.map((q) => ({
+			...q,
+			id: `${alias}/${q.id}`,
+			imageInput: q.imageInput ?? source.imageInput,
+			image: absolutizeImage(q.image, sourceUrl),
+			...preamble.preamble ? { sourcePreamble: preamble.preamble } : {}
+		}))
+	};
+}
+/**
+* Resolve a leniently parsed quiz into the runnable one: render its two host texts,
+* then merge in every `quiz_files` include. `url` is the quiz's own URL (the base for
+* relative fragment/include refs); `fetcher` is the caller's network seam.
+*/
+async function resolveQuiz(quiz, url, fetcher, opts = {}) {
+	const allowedSchemes = opts.allowedSchemes ?? DEFAULT_SCHEMES$1;
+	const resolved = await assembleFragmentPrompts(quiz.fragmentBlock, url, fetcher, {
+		validateLibraries: false,
+		allowedSchemes
+	}, [quiz.instructions ?? "", quiz.discussionInstructions ?? ""]);
+	if (!resolved.ok) return {
+		ok: false,
+		message: "This quiz's prompt fragments could not be loaded."
+	};
+	const [instructionsPreamble = "", discussionInstructions = ""] = resolved.prompts;
+	const refs = quiz.quizFiles;
+	const aliases = /* @__PURE__ */ new Set();
+	for (const ref of refs) {
+		const alias = typeof ref?.id === "string" ? ref.id.trim() : "";
+		if (aliases.has(alias)) return {
+			ok: false,
+			message: `This quiz declares the included-quiz alias "${alias}" twice.`
+		};
+		aliases.add(alias);
+	}
+	const includes = await Promise.all(refs.map((ref) => resolveInclude(ref, url, fetcher, allowedSchemes)));
+	const imported = [];
+	for (const include of includes) {
+		if (!include.ok) return include;
+		imported.push(...include.questions);
+	}
+	const questions = [...quiz.questions, ...imported];
+	if (questions.length === 0) return {
+		ok: false,
+		message: "This quiz has no questions."
+	};
+	return {
+		ok: true,
+		quiz: {
+			...quiz,
+			fragmentBlock: EMPTY_FRAGMENT_BLOCK,
+			quizFiles: [],
+			instructionsPreamble: instructionsPreamble.trimEnd(),
+			discussionInstructions: discussionInstructions.trim() !== "" ? discussionInstructions.trimEnd() : void 0,
+			questions
+		}
+	};
+}
+/**
+* Fetch + lenient-parse + `resolveQuiz`, all through the CALLER's fetcher — the
+* app-free counterpart of `loadQuiz` (`lib/quiz-fetch.ts`) used by the prompt dump and
+* the CLI, where there is no database and a quiz may live on disk (`file:`).
+*/
+async function loadQuizFrom(url, fetcher, opts = {}) {
+	const allowedSchemes = opts.allowedSchemes ?? DEFAULT_SCHEMES$1;
+	if (!schemeAllowed$1(url, allowedSchemes)) return {
+		ok: false,
+		message: `This quiz's URL is not allowed: ${url}`
+	};
+	try {
+		const res = await fetcher(url);
+		if (!res.ok) return res.status === 404 ? {
+			ok: false,
+			message: "This quiz could not be found."
+		} : {
+			ok: false,
+			message: `This quiz could not be loaded (HTTP ${res.status}).`
+		};
+		const parsed = parseQuiz(await res.text());
+		if (!parsed.ok) return parsed;
+		return await resolveQuiz(parsed.quiz, url, fetcher, { allowedSchemes });
+	} catch {
+		return {
+			ok: false,
+			message: "This quiz could not be loaded. Try again."
+		};
+	}
+}
+//#endregion
+//#region ../lib/quiz-verdict-schema.ts
+const QUIZ_VERDICT_SCHEMA = z.object({
+	result: z.enum([
+		"correct",
+		"partial",
+		"incorrect"
+	]),
+	feedback: z.string()
+});
+//#endregion
+//#region ../lib/tutors/schemas.ts
+/**
+* An example question offered to students on the welcome screen: the `title` is
+* the clickable label, the `question` is the full text placed into the chat
+* input on click. Tutors may define any number; the UI samples at most 5.
+*/
+const ExampleQuestionSchema = z.strictObject({
+	title: z.string().min(1).meta({ description: "Short clickable label shown on the welcome screen." }),
+	question: z.string().min(1).meta({ description: "Full question text. Shown as a tooltip and placed into the chat input on click." })
+}).meta({
+	id: "exampleQuestion",
+	description: "An example question shown on the welcome screen."
+});
+const TutorSchema = z.strictObject({
+	id: z.string().meta({ description: "Short machine-readable tutor id, e.g. fractions-de." }),
+	name: z.string().meta({ description: "Human-readable tutor title." }),
+	title: z.string().optional().meta({ description: "Optional greeting shown to students on the empty chat instead of the default welcome message." }),
+	description: z.string().meta({ description: "Short description of what this tutor does. Shown to students below the welcome greeting." }),
+	exampleQuestions: z.array(ExampleQuestionSchema).optional().meta({ description: "Optional example questions shown to students below the description on the empty chat. Clicking one puts the question text into the chat input. At most 5 are shown; with more, a random 5 are picked per page load." }),
+	anonymous: z.boolean().optional().meta({
+		default: true,
+		description: "Chats are anonymous by default: no link between the signed-in student and their chat is stored. Set to false to record which student each chat belongs to."
+	}),
+	llm: z.strictObject({
+		model: z.string().meta({ description: "Model used for this tutor." }),
+		provider: providerSchema,
+		imageInput: z.boolean().optional().meta({
+			default: true,
+			description: "Image uploads are enabled by default. Set to false to hide the upload UI for text-only tutors or non-vision-capable models."
+		})
+	}).meta({
+		id: "llm",
+		description: "The model and provider that back this tutor."
+	}),
+	prompt: z.strictObject({
+		fragment_files: z.array(FragmentFileRefSchema).default([]).meta({ description: "Optional fragment libraries used by this tutor." }),
+		text_files: z.array(TextFileRefSchema).default([]).meta({ description: "Optional plain-text files (markdown / source) embedded verbatim via {{file \"alias\"}} markers." }),
+		tutor_instructions: z.string().meta({ description: "The tutor's system prompt. When any fragment_files or text_files are declared this is a Handlebars template: place fragments inline with {{fragment \"alias.id\" key=\"v\"}} markers and embed text files with {{file \"alias\"}} (optionally {{file \"alias\" from=10 to=40}} for a line range; escape a literal {{ as \\{{). For single-file tutors it is the whole prompt." })
+	}).meta({
+		id: "prompt",
+		description: "The tutor system prompt: a host template with inline fragment markers."
+	})
+});
+//#endregion
+//#region ../lib/tutors/load.ts
+async function loadAndBuildTutorPrompt(url, fetchImpl, opts = {}) {
+	const warnings = [];
+	const tutorYaml = await loadYaml(url, fetchImpl, opts);
+	if (!tutorYaml.ok) return {
+		ok: false,
+		errors: [tutorYaml.error],
+		warnings
+	};
+	const tutorValid = validate(tutorYaml.value, TutorSchema, "TUTOR_SCHEMA_ERROR", url);
+	if (!tutorValid.ok) return {
+		ok: false,
+		errors: [tutorValid.error],
+		warnings
+	};
+	const tutor = tutorValid.data;
+	const assembled = await assembleFragmentPrompt(tutor.prompt, url, fetchImpl, opts, tutor.prompt.tutor_instructions);
+	warnings.push(...assembled.warnings);
+	if (!assembled.ok) return {
+		ok: false,
+		errors: assembled.errors,
+		warnings
+	};
+	return {
+		ok: true,
+		id: tutor.id,
+		prompt: assembled.prompt,
+		model: tutor.llm.model,
+		provider: tutor.llm.provider,
+		imageInput: tutor.llm.imageInput ?? true,
+		anonymous: tutor.anonymous ?? true,
+		title: tutor.title,
+		description: tutor.description,
+		exampleQuestions: tutor.exampleQuestions ?? [],
+		warnings
+	};
+}
+//#endregion
+//#region ../lib/writing-yaml.ts
+function asString(value) {
+	if (typeof value === "string") return value.trim() !== "" ? value : void 0;
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
+	if (typeof value === "boolean") return String(value);
+}
+function asBool(value, fallback) {
+	return typeof value === "boolean" ? value : fallback;
+}
+/**
+* Parses and lightly validates a writing YAML. Returns a friendly error message
+* (not structured errors) when an essential field is missing — the student page
+* shows it as a notice. `anonymous` DEFAULTS to `false` (the writing divergence).
+*/
+function parseWriting(content) {
+	let doc;
+	try {
+		doc = parse(content);
+	} catch {
+		return {
+			ok: false,
+			message: "This writing activity could not be read — its YAML is not valid."
+		};
+	}
+	if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return {
+		ok: false,
+		message: "This writing activity is empty or malformed."
+	};
+	const root = doc;
+	const llm = root.llm;
+	const model = asString(llm?.model);
+	if (!model) return {
+		ok: false,
+		message: "This writing activity does not specify a model (llm.model)."
+	};
+	const provider = llm?.provider === void 0 ? DEFAULT_PROVIDER : parseLenientProvider(llm.provider);
+	if (!provider) return {
+		ok: false,
+		message: "This writing activity uses an unsupported llm.provider (use \"SCCH\" or \"Azure Foundry\")."
+	};
+	const instructions = asString(root.instructions);
+	if (!instructions) return {
+		ok: false,
+		message: "This writing activity has no instructions for the assistant."
+	};
+	return {
+		ok: true,
+		writing: {
+			id: asString(root.id) ?? asString(root.name) ?? "writing",
+			name: asString(root.name) ?? "writing",
+			title: asString(root.title),
+			description: asString(root.description),
+			anonymous: asBool(root.anonymous, false),
+			model,
+			provider,
+			instructions,
+			fragmentBlock: readFragmentBlock(root),
+			placeholder: asString(root.placeholder)
+		}
+	};
+}
+//#endregion
+//#region ../lib/writing-resolve.ts
+const DEFAULT_SCHEMES = ["http:", "https:"];
+function schemeAllowed(url, allowed) {
+	try {
+		return allowed.includes(new URL(url).protocol);
+	} catch {
+		return false;
+	}
+}
+/**
+* Resolve a leniently parsed writing activity into the runnable one. `url` is the
+* activity's own URL (the base for relative fragment refs); `fetcher` the network seam.
+*/
+async function resolveWriting(writing, url, fetcher, opts = {}) {
+	const resolved = await assembleFragmentPrompt(writing.fragmentBlock, url, fetcher, {
+		validateLibraries: false,
+		allowedSchemes: opts.allowedSchemes ?? DEFAULT_SCHEMES
+	}, writing.instructions);
+	if (!resolved.ok) return {
+		ok: false,
+		message: "This writing activity's prompt fragments could not be loaded."
+	};
+	return {
+		ok: true,
+		writing: {
+			...writing,
+			fragmentBlock: EMPTY_FRAGMENT_BLOCK,
+			instructions: resolved.prompt
+		}
+	};
+}
+/**
+* Fetch + lenient-parse + `resolveWriting`, all through the CALLER's fetcher — the
+* app-free counterpart of `loadWriting` (`lib/writing-fetch.ts`) used by the prompt dump
+* and the CLI, where there is no database and an activity may live on disk (`file:`).
+*/
+async function loadWritingFrom(url, fetcher, opts = {}) {
+	const allowedSchemes = opts.allowedSchemes ?? DEFAULT_SCHEMES;
+	if (!schemeAllowed(url, allowedSchemes)) return {
+		ok: false,
+		message: `This writing activity's URL is not allowed: ${url}`
+	};
+	try {
+		const res = await fetcher(url);
+		if (!res.ok) return res.status === 404 ? {
+			ok: false,
+			message: "This writing activity could not be found."
+		} : {
+			ok: false,
+			message: `This writing activity could not be loaded (HTTP ${res.status}).`
+		};
+		const parsed = parseWriting(await res.text());
+		if (!parsed.ok) return parsed;
+		return await resolveWriting(parsed.writing, url, fetcher, { allowedSchemes });
+	} catch {
+		return {
+			ok: false,
+			message: "This writing activity could not be loaded. Try again."
+		};
+	}
+}
+//#endregion
+//#region ../lib/prompt-dump.ts
+const PROMPT_KINDS = [
+	"tutor",
+	"quiz",
+	"writing",
+	"coding"
+];
+/** Wrap a runtime loader's friendly message as the structured failure shape. */
+function loadFailed(message, url) {
+	return {
+		ok: false,
+		errors: [error("ACTIVITY_LOAD_FAILED", message, { url })]
+	};
+}
+/**
+* The verdict schema as plain JSON Schema, generated from the zod source of truth with
+* zod 4's native converter — the same mechanism `lib/schema-gen` uses for the authoring
+* schemas, so there is no second conversion story in the repo.
+*/
+function verdictResponseJsonSchema() {
+	return z.toJSONSchema(QUIZ_VERDICT_SCHEMA, { target: "draft-2020-12" });
+}
+/** The seam: one dumper per prompt-producing `FileKind`. */
+const promptDumpers = {
+	tutor: { async dump(url, fetcher, opts = {}) {
+		const result = await loadAndBuildTutorPrompt(url, fetcher, opts);
+		if (!result.ok) return {
+			ok: false,
+			errors: result.errors
+		};
+		return {
+			ok: true,
+			dump: {
+				kind: "tutor",
+				id: result.id,
+				llm: {
+					provider: result.provider,
+					model: result.model
+				},
+				system: result.prompt
+			}
+		};
+	} },
+	quiz: { async dump(url, fetcher, opts = {}) {
+		const loaded = await loadQuizFrom(url, fetcher, { allowedSchemes: opts.allowedSchemes });
+		if (!loaded.ok) return loadFailed(loaded.message, url);
+		const quiz = loaded.quiz;
+		return {
+			ok: true,
+			dump: {
+				kind: "quiz",
+				id: quiz.id,
+				llm: {
+					provider: quiz.provider,
+					model: quiz.model
+				},
+				grading: {
+					userMessageTemplate: QUIZ_ANSWER_MESSAGE_TEMPLATE,
+					userMessagePhotosOnly: QUIZ_ANSWER_PHOTOS_ONLY_MESSAGE,
+					responseSchema: verdictResponseJsonSchema(),
+					questions: quiz.questions.map((question) => ({
+						id: question.id,
+						...question.title ? { title: question.title } : {},
+						system: buildGradingPrompt(question, quiz.instructionsPreamble),
+						imageInput: effectiveImageInput(quiz, question)
+					}))
+				},
+				discussion: {
+					system: buildDiscussionInstructions(quiz),
+					seedMessages: {
+						question: QUIZ_SEED_QUESTION_TEMPLATE,
+						answer: "{answer}",
+						verdict: QUIZ_SEED_VERDICT_TEMPLATE
+					},
+					verdictLabels: {
+						correct: verdictLabel("correct"),
+						partial: verdictLabel("partial"),
+						incorrect: verdictLabel("incorrect")
+					}
+				}
+			}
+		};
+	} },
+	writing: { async dump(url, fetcher, opts = {}) {
+		const loaded = await loadWritingFrom(url, fetcher, { allowedSchemes: opts.allowedSchemes });
+		if (!loaded.ok) return loadFailed(loaded.message, url);
+		const writing = loaded.writing;
+		return {
+			ok: true,
+			dump: {
+				kind: "writing",
+				id: writing.id,
+				llm: {
+					provider: writing.provider,
+					model: writing.model
+				},
+				system: writing.instructions
+			}
+		};
+	} },
+	coding: { async dump(url, fetcher, opts = {}) {
+		const loaded = await loadCodingFrom(url, fetcher, { allowedSchemes: opts.allowedSchemes });
+		if (!loaded.ok) return loadFailed(loaded.message, url);
+		const coding = loaded.coding;
+		const upstream = buildUpstreamChatBody({ messages: [] }, {
+			instructions: coding.instructions,
+			model: coding.model
+		});
+		const system = (Array.isArray(upstream.messages) ? upstream.messages : []).find((m) => typeof m === "object" && m !== null && m.role === "system");
+		return {
+			ok: true,
+			dump: {
+				kind: "coding",
+				id: coding.id,
+				llm: {
+					provider: coding.provider,
+					model: coding.model
+				},
+				system: coding.instructions,
+				upstreamSystemMessage: typeof system?.content === "string" ? system.content : ""
+			}
+		};
+	} }
+};
+/** Dump the prompts of ONE activity file — the single entry point callers use. */
+function dumpPrompts(kind, url, fetcher, opts = {}) {
+	return promptDumpers[kind].dump(url, fetcher, opts);
+}
+/**
+* The dump's prompts as a flat, kind-agnostic list — what a summary renderer walks so it
+* never has to switch on the kind. Order is stable (and, for a quiz, question order).
+*/
+function promptSections(dump) {
+	switch (dump.kind) {
+		case "quiz": return [...dump.grading.questions.map((q) => ({
+			name: `grading: ${q.id}`,
+			text: q.system
+		})), {
+			name: "discussion",
+			text: dump.discussion.system
+		}];
+		case "coding": return [{
+			name: "system (injected upstream)",
+			text: dump.system
+		}];
+		default: return [{
+			name: "system",
+			text: dump.system
+		}];
+	}
+}
+//#endregion
+//#region src/file-fetcher.ts
+const cliFetcher = async (url) => {
+	if (url.startsWith("file:")) try {
+		const text = await readFile(fileURLToPath(url), "utf8");
+		return {
+			ok: true,
+			status: 200,
+			text: async () => text
+		};
+	} catch {
+		return {
+			ok: false,
+			status: 404,
+			text: async () => ""
+		};
+	}
+	return defaultFetcher(url);
+};
+//#endregion
+//#region src/format.ts
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code, s) => useColor ? `\x1b[${code}m${s}\x1b[0m` : s;
+const green = (s) => paint("32", s);
+const red = (s) => paint("31", s);
+const yellow = (s) => paint("33", s);
+const dim = (s) => paint("2", s);
+/** Append the context fields an error/warning carries, when present. */
+function context(item) {
+	const parts = [];
+	if (item.fileAlias) parts.push(`file=${item.fileAlias}`);
+	if (item.fragmentId) parts.push(`fragment=${item.fragmentId}`);
+	if ("questionId" in item && item.questionId) parts.push(`question=${item.questionId}`);
+	if (item.variable) parts.push(`variable=${item.variable}`);
+	if ("url" in item && item.url) parts.push(`url=${item.url}`);
+	if ("expectedType" in item && item.expectedType) parts.push(`expected=${item.expectedType}`);
+	if ("actualType" in item && item.actualType) parts.push(`actual=${item.actualType}`);
+	return parts.length ? dim(` (${parts.join(", ")})`) : "";
+}
+function renderWarnings(warnings) {
+	return warnings.map((w) => `  ${yellow("⚠")} ${yellow(w.code)} ${w.message}${context(w)}`);
+}
+/**
+* Render each error as a line, with any flattened Zod schema-issue detail
+* indented beneath it — so a generic "Document does not match the expected
+* structure" is followed by the actual field paths (e.g. `Unrecognized key:
+* "nae"`), matching what the web UI shows.
+*/
+function renderErrors(errors) {
+	const lines = [];
+	for (const e of errors) {
+		lines.push(`  ${red("✗")} ${red(e.code)} ${e.message}${context(e)}`);
+		if (e.zodIssues) for (const issue of formatZodIssues(e.zodIssues)) lines.push(`      ${dim(issue)}`);
+	}
+	return lines;
+}
+function formatResult(result, source) {
+	const lines = [];
+	if (result.ok) {
+		lines.push(green(`✔ Valid tutor`) + dim(` — ${source}`));
+		lines.push(`  model: ${result.model}`);
+		lines.push(`  system prompt: ${result.prompt.length} chars`);
+		lines.push(`  imageInput: ${result.imageInput}   anonymous: ${result.anonymous}` + (result.exampleQuestions.length ? `   exampleQuestions: ${result.exampleQuestions.length}` : ""));
+		if (result.warnings.length) {
+			lines.push("");
+			lines.push(yellow(`${result.warnings.length} warning(s):`));
+			lines.push(...renderWarnings(result.warnings));
+		}
+		return lines.join("\n");
+	}
+	lines.push(red(`✘ Invalid tutor`) + dim(` — ${source}`));
+	lines.push("");
+	lines.push(red(`${result.errors.length} error(s):`));
+	lines.push(...renderErrors(result.errors));
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/** Same renderer, for a standalone fragment-FILE check (`--kind fragment`). */
+function formatFragmentResult(result, source) {
+	const lines = [];
+	if (result.ok) {
+		lines.push(green(`✔ Valid fragment file`) + dim(` — ${source}`));
+		lines.push(`  id: ${result.fragmentFileId}`);
+		lines.push(`  fragments: ${result.fragmentIds.length}` + (result.fragmentIds.length ? ` (${result.fragmentIds.join(", ")})` : ""));
+		if (result.warnings.length) {
+			lines.push("");
+			lines.push(yellow(`${result.warnings.length} warning(s):`));
+			lines.push(...renderWarnings(result.warnings));
+		}
+		return lines.join("\n");
+	}
+	lines.push(red(`✘ Invalid fragment file`) + dim(` — ${source}`));
+	lines.push("");
+	lines.push(red(`${result.errors.length} error(s):`));
+	lines.push(...renderErrors(result.errors));
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/**
+* Shared tail for the quiz/writing renderers: on failure, the error list (with any
+* flattened Zod issues); plus any warnings on either branch.
+*/
+function renderFailureAndWarnings(result, label, source) {
+	const lines = [red(`✘ Invalid ${label}`) + dim(` — ${source}`), ""];
+	lines.push(red(`${result.errors.length} error(s):`));
+	lines.push(...renderErrors(result.errors));
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/** Renderer for a quiz check (`--kind quiz`). */
+function formatQuizResult(result, source) {
+	if (!result.ok) return renderFailureAndWarnings(result, "quiz", source);
+	const lines = [green(`✔ Valid quiz`) + dim(` — ${source}`)];
+	lines.push(`  id: ${result.quizId}`);
+	lines.push(`  model: ${result.model}`);
+	lines.push(`  questions: ${result.questionCount}   anonymous: ${result.anonymous}`);
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/** Renderer for a writing-activity check (`--kind writing`). */
+function formatWritingResult(result, source) {
+	if (!result.ok) return renderFailureAndWarnings(result, "writing activity", source);
+	const lines = [green(`✔ Valid writing activity`) + dim(` — ${source}`)];
+	lines.push(`  id: ${result.writingId}`);
+	lines.push(`  model: ${result.model}`);
+	lines.push(`  anonymous: ${result.anonymous}`);
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/**
+* Renderer for a coding-activity check (`--kind coding`). Coding is ALWAYS anonymous
+* (the API path carries no per-student identity), so — unlike quiz/writing — that is
+* shown as a fixed note, not a per-file value.
+*/
+function formatCodingResult(result, source) {
+	if (!result.ok) return renderFailureAndWarnings(result, "coding activity", source);
+	const lines = [green(`✔ Valid coding activity`) + dim(` — ${source}`)];
+	lines.push(`  id: ${result.codingId}`);
+	lines.push(`  model: ${result.model}`);
+	lines.push(`  anonymous: true ${dim("(always — the API path carries no identity)")}`);
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/**
+* Renderer for a prompt dump (`prompts`). Kind-agnostic by construction: the envelope
+* (kind / id / provider+model) plus one line per prompt with its character count — the
+* sections come from `promptSections`, so a new kind needs no change here. `--json`
+* carries the prompt text itself.
+*/
+function formatPromptDump(dump, sections, source) {
+	const lines = [green(`✔ Prompts — ${dump.kind}`) + dim(` — ${source}`)];
+	lines.push(`  id: ${dump.id}`);
+	lines.push(`  provider: ${dump.llm.provider}   model: ${dump.llm.model}`);
+	lines.push(`  prompts: ${sections.length}`);
+	for (const section of sections) lines.push(`    ${section.name}: ${section.text.length} chars`);
+	lines.push("");
+	lines.push(dim("  Run again with --json for the full prompt text."));
+	return lines.join("\n");
+}
+//#endregion
+//#region ../lib/coding-schema.ts
+const CodingYamlSchema = z.strictObject({
+	id: z.string().min(1).meta({ description: "Short machine-readable activity id, e.g. beginner-typescript." }),
+	name: z.string().optional().meta({ description: "Optional human-readable label (not shown to the student)." }),
+	title: z.string().optional().meta({ description: "Optional label shown to the student on the /<code> connection page." }),
+	llm: z.strictObject({
+		model: z.string().min(1).meta({ description: "The model that answers. SERVER-ONLY and PINNED: the proxy always uses this model and ignores whatever model the coding agent sends." }),
+		provider: providerSchema
+	}).meta({
+		id: "llm",
+		description: "The pinned model and provider that answer coding requests."
+	}),
+	fragment_files: z.array(FragmentFileRefSchema).default([]).meta({ description: "Optional fragment libraries this activity pulls shared prompt fragments from." }),
+	text_files: z.array(TextFileRefSchema).default([]).meta({ description: "Optional plain-text files (markdown / source, e.g. a sample solution) embedded verbatim into instructions via {{file \"alias\"}} markers." }),
+	instructions: z.string().min(1).meta({ description: "The assistant's system prompt. SERVER-ONLY: never sent to the browser or the coding agent, and appended AFTER the coding tool's own prompt (so the teacher has the final word). Constrain the assistant to what your class has learned. When any fragment_files or text_files are declared it is a Handlebars template: place fragments inline with {{fragment \"alias.id\" …}} and embed text files with {{file \"alias\"}} (optionally {{file \"alias\" from=10 to=40}} for a line range; escape a literal {{ as \\{{)." })
+});
+//#endregion
+//#region ../lib/coding-validate.ts
+/**
+* Extract metadata from an already-schema-validated coding value. Split from
 * `checkCodingValue` so `loadAndCheckCoding` can reuse the single `validate` it already
 * ran (no second parse of the same document against the same schema).
 */
@@ -1892,118 +3571,37 @@ async function loadAndCheckQuiz(url, fetchImpl, opts = {}) {
 		errors: [valid.error],
 		warnings: []
 	};
-	const checked = checkQuizParsed(valid.data);
-	if (!checked.ok) return checked;
-	const assembled = await assembleFragmentPrompts({
-		fragment_files: valid.data.fragment_files,
-		text_files: valid.data.text_files
-	}, url, fetchImpl, {
-		allowedSchemes: opts.allowedSchemes,
-		validateLibraries: opts.validateLibraries ?? true
-	}, [valid.data.instructions ?? "", valid.data.discussion?.instructions ?? ""]);
-	const warnings = [...checked.warnings, ...assembled.warnings];
-	if (!assembled.ok) return {
-		ok: false,
-		errors: assembled.errors,
-		warnings
-	};
-	const includes = await Promise.all(valid.data.quiz_files.map((ref) => checkInclude(ref, url, fetchImpl, opts)));
-	const includeErrors = [];
-	let importedCount = 0;
-	for (const include of includes) {
-		warnings.push(...include.warnings);
-		if (include.ok) importedCount += include.questionCount;
-		else includeErrors.push(...include.errors);
-	}
-	if (includeErrors.length > 0) return {
-		ok: false,
-		errors: includeErrors,
-		warnings
-	};
-	return {
-		...checked,
-		questionCount: checked.questionCount + importedCount,
-		warnings
-	};
-}
-//#endregion
-//#region ../lib/tutors/schemas.ts
-/**
-* An example question offered to students on the welcome screen: the `title` is
-* the clickable label, the `question` is the full text placed into the chat
-* input on click. Tutors may define any number; the UI samples at most 5.
-*/
-const ExampleQuestionSchema = z.strictObject({
-	title: z.string().min(1).meta({ description: "Short clickable label shown on the welcome screen." }),
-	question: z.string().min(1).meta({ description: "Full question text. Shown as a tooltip and placed into the chat input on click." })
-}).meta({
-	id: "exampleQuestion",
-	description: "An example question shown on the welcome screen."
-});
-const TutorSchema = z.strictObject({
-	id: z.string().meta({ description: "Short machine-readable tutor id, e.g. fractions-de." }),
-	name: z.string().meta({ description: "Human-readable tutor title." }),
-	title: z.string().optional().meta({ description: "Optional greeting shown to students on the empty chat instead of the default welcome message." }),
-	description: z.string().meta({ description: "Short description of what this tutor does. Shown to students below the welcome greeting." }),
-	exampleQuestions: z.array(ExampleQuestionSchema).optional().meta({ description: "Optional example questions shown to students below the description on the empty chat. Clicking one puts the question text into the chat input. At most 5 are shown; with more, a random 5 are picked per page load." }),
-	anonymous: z.boolean().optional().meta({
-		default: true,
-		description: "Chats are anonymous by default: no link between the signed-in student and their chat is stored. Set to false to record which student each chat belongs to."
-	}),
-	llm: z.strictObject({
-		model: z.string().meta({ description: "Model used for this tutor." }),
-		provider: providerSchema,
-		imageInput: z.boolean().optional().meta({
-			default: true,
-			description: "Image uploads are enabled by default. Set to false to hide the upload UI for text-only tutors or non-vision-capable models."
-		})
-	}).meta({
-		id: "llm",
-		description: "The model and provider that back this tutor."
-	}),
-	prompt: z.strictObject({
-		fragment_files: z.array(FragmentFileRefSchema).default([]).meta({ description: "Optional fragment libraries used by this tutor." }),
-		text_files: z.array(TextFileRefSchema).default([]).meta({ description: "Optional plain-text files (markdown / source) embedded verbatim via {{file \"alias\"}} markers." }),
-		tutor_instructions: z.string().meta({ description: "The tutor's system prompt. When any fragment_files or text_files are declared this is a Handlebars template: place fragments inline with {{fragment \"alias.id\" key=\"v\"}} markers and embed text files with {{file \"alias\"}} (optionally {{file \"alias\" from=10 to=40}} for a line range; escape a literal {{ as \\{{). For single-file tutors it is the whole prompt." })
-	}).meta({
-		id: "prompt",
-		description: "The tutor system prompt: a host template with inline fragment markers."
-	})
-});
-//#endregion
-//#region ../lib/tutors/load.ts
-async function loadAndBuildTutorPrompt(url, fetchImpl, opts = {}) {
-	const warnings = [];
-	const tutorYaml = await loadYaml(url, fetchImpl, opts);
-	if (!tutorYaml.ok) return {
-		ok: false,
-		errors: [tutorYaml.error],
-		warnings
-	};
-	const tutorValid = validate(tutorYaml.value, TutorSchema, "TUTOR_SCHEMA_ERROR", url);
-	if (!tutorValid.ok) return {
-		ok: false,
-		errors: [tutorValid.error],
-		warnings
-	};
-	const tutor = tutorValid.data;
-	const assembled = await assembleFragmentPrompt(tutor.prompt, url, fetchImpl, opts, tutor.prompt.tutor_instructions);
-	warnings.push(...assembled.warnings);
+	const checked = checkQuizParsed(valid.data);
+	if (!checked.ok) return checked;
+	const assembled = await assembleFragmentPrompts({
+		fragment_files: valid.data.fragment_files,
+		text_files: valid.data.text_files
+	}, url, fetchImpl, {
+		allowedSchemes: opts.allowedSchemes,
+		validateLibraries: opts.validateLibraries ?? true
+	}, [valid.data.instructions ?? "", valid.data.discussion?.instructions ?? ""]);
+	const warnings = [...checked.warnings, ...assembled.warnings];
 	if (!assembled.ok) return {
 		ok: false,
 		errors: assembled.errors,
 		warnings
 	};
+	const includes = await Promise.all(valid.data.quiz_files.map((ref) => checkInclude(ref, url, fetchImpl, opts)));
+	const includeErrors = [];
+	let importedCount = 0;
+	for (const include of includes) {
+		warnings.push(...include.warnings);
+		if (include.ok) importedCount += include.questionCount;
+		else includeErrors.push(...include.errors);
+	}
+	if (includeErrors.length > 0) return {
+		ok: false,
+		errors: includeErrors,
+		warnings
+	};
 	return {
-		ok: true,
-		prompt: assembled.prompt,
-		model: tutor.llm.model,
-		provider: tutor.llm.provider,
-		imageInput: tutor.llm.imageInput ?? true,
-		anonymous: tutor.anonymous ?? true,
-		title: tutor.title,
-		description: tutor.description,
-		exampleQuestions: tutor.exampleQuestions ?? [],
+		...checked,
+		questionCount: checked.questionCount + importedCount,
 		warnings
 	};
 }
@@ -2089,173 +3687,6 @@ async function loadAndCheckWriting(url, fetchImpl, opts = {}) {
 	};
 }
 //#endregion
-//#region src/file-fetcher.ts
-const cliFetcher = async (url) => {
-	if (url.startsWith("file:")) try {
-		const text = await readFile(fileURLToPath(url), "utf8");
-		return {
-			ok: true,
-			status: 200,
-			text: async () => text
-		};
-	} catch {
-		return {
-			ok: false,
-			status: 404,
-			text: async () => ""
-		};
-	}
-	return defaultFetcher(url);
-};
-//#endregion
-//#region src/format.ts
-const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
-const paint = (code, s) => useColor ? `\x1b[${code}m${s}\x1b[0m` : s;
-const green = (s) => paint("32", s);
-const red = (s) => paint("31", s);
-const yellow = (s) => paint("33", s);
-const dim = (s) => paint("2", s);
-/** Append the context fields an error/warning carries, when present. */
-function context(item) {
-	const parts = [];
-	if (item.fileAlias) parts.push(`file=${item.fileAlias}`);
-	if (item.fragmentId) parts.push(`fragment=${item.fragmentId}`);
-	if ("questionId" in item && item.questionId) parts.push(`question=${item.questionId}`);
-	if (item.variable) parts.push(`variable=${item.variable}`);
-	if ("url" in item && item.url) parts.push(`url=${item.url}`);
-	if ("expectedType" in item && item.expectedType) parts.push(`expected=${item.expectedType}`);
-	if ("actualType" in item && item.actualType) parts.push(`actual=${item.actualType}`);
-	return parts.length ? dim(` (${parts.join(", ")})`) : "";
-}
-function renderWarnings(warnings) {
-	return warnings.map((w) => `  ${yellow("⚠")} ${yellow(w.code)} ${w.message}${context(w)}`);
-}
-/**
-* Render each error as a line, with any flattened Zod schema-issue detail
-* indented beneath it — so a generic "Document does not match the expected
-* structure" is followed by the actual field paths (e.g. `Unrecognized key:
-* "nae"`), matching what the web UI shows.
-*/
-function renderErrors(errors) {
-	const lines = [];
-	for (const e of errors) {
-		lines.push(`  ${red("✗")} ${red(e.code)} ${e.message}${context(e)}`);
-		if (e.zodIssues) for (const issue of formatZodIssues(e.zodIssues)) lines.push(`      ${dim(issue)}`);
-	}
-	return lines;
-}
-function formatResult(result, source) {
-	const lines = [];
-	if (result.ok) {
-		lines.push(green(`✔ Valid tutor`) + dim(` — ${source}`));
-		lines.push(`  model: ${result.model}`);
-		lines.push(`  system prompt: ${result.prompt.length} chars`);
-		lines.push(`  imageInput: ${result.imageInput}   anonymous: ${result.anonymous}` + (result.exampleQuestions.length ? `   exampleQuestions: ${result.exampleQuestions.length}` : ""));
-		if (result.warnings.length) {
-			lines.push("");
-			lines.push(yellow(`${result.warnings.length} warning(s):`));
-			lines.push(...renderWarnings(result.warnings));
-		}
-		return lines.join("\n");
-	}
-	lines.push(red(`✘ Invalid tutor`) + dim(` — ${source}`));
-	lines.push("");
-	lines.push(red(`${result.errors.length} error(s):`));
-	lines.push(...renderErrors(result.errors));
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/** Same renderer, for a standalone fragment-FILE check (`--kind fragment`). */
-function formatFragmentResult(result, source) {
-	const lines = [];
-	if (result.ok) {
-		lines.push(green(`✔ Valid fragment file`) + dim(` — ${source}`));
-		lines.push(`  id: ${result.fragmentFileId}`);
-		lines.push(`  fragments: ${result.fragmentIds.length}` + (result.fragmentIds.length ? ` (${result.fragmentIds.join(", ")})` : ""));
-		if (result.warnings.length) {
-			lines.push("");
-			lines.push(yellow(`${result.warnings.length} warning(s):`));
-			lines.push(...renderWarnings(result.warnings));
-		}
-		return lines.join("\n");
-	}
-	lines.push(red(`✘ Invalid fragment file`) + dim(` — ${source}`));
-	lines.push("");
-	lines.push(red(`${result.errors.length} error(s):`));
-	lines.push(...renderErrors(result.errors));
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/**
-* Shared tail for the quiz/writing renderers: on failure, the error list (with any
-* flattened Zod issues); plus any warnings on either branch.
-*/
-function renderFailureAndWarnings(result, label, source) {
-	const lines = [red(`✘ Invalid ${label}`) + dim(` — ${source}`), ""];
-	lines.push(red(`${result.errors.length} error(s):`));
-	lines.push(...renderErrors(result.errors));
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/** Renderer for a quiz check (`--kind quiz`). */
-function formatQuizResult(result, source) {
-	if (!result.ok) return renderFailureAndWarnings(result, "quiz", source);
-	const lines = [green(`✔ Valid quiz`) + dim(` — ${source}`)];
-	lines.push(`  id: ${result.quizId}`);
-	lines.push(`  model: ${result.model}`);
-	lines.push(`  questions: ${result.questionCount}   anonymous: ${result.anonymous}`);
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/** Renderer for a writing-activity check (`--kind writing`). */
-function formatWritingResult(result, source) {
-	if (!result.ok) return renderFailureAndWarnings(result, "writing activity", source);
-	const lines = [green(`✔ Valid writing activity`) + dim(` — ${source}`)];
-	lines.push(`  id: ${result.writingId}`);
-	lines.push(`  model: ${result.model}`);
-	lines.push(`  anonymous: ${result.anonymous}`);
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/**
-* Renderer for a coding-activity check (`--kind coding`). Coding is ALWAYS anonymous
-* (the API path carries no per-student identity), so — unlike quiz/writing — that is
-* shown as a fixed note, not a per-file value.
-*/
-function formatCodingResult(result, source) {
-	if (!result.ok) return renderFailureAndWarnings(result, "coding activity", source);
-	const lines = [green(`✔ Valid coding activity`) + dim(` — ${source}`)];
-	lines.push(`  id: ${result.codingId}`);
-	lines.push(`  model: ${result.model}`);
-	lines.push(`  anonymous: true ${dim("(always — the API path carries no identity)")}`);
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-//#endregion
 //#region src/commands/validate.ts
 /** Every kind the `--kind` flag accepts (used for the option help + guard). */
 const VALIDATE_KINDS = [
@@ -2352,6 +3783,88 @@ function formatOutcome(outcome, source) {
 	}
 }
 //#endregion
+//#region src/commands/prompts.ts
+/**
+* The command's pure core: dump the prompts of a local file or public URL. `file:` is
+* allowed in addition to http(s) so an on-disk activity dumps (the web app deliberately
+* stays http(s)-only), and relative `fragment_files` / `quiz_files` resolve against the
+* activity's own location.
+*
+* This is the RUNTIME path — the lenient loaders the app runs when a student opens the
+* activity — so the output is what the model really receives. Use `validate` for the
+* strict authoring gate.
+*/
+function runPrompts(pathOrUrl, kind) {
+	return dumpPrompts(kind, toUrl(pathOrUrl), cliFetcher, { allowedSchemes: [
+		"http:",
+		"https:",
+		"file:"
+	] });
+}
+function registerPrompts(program) {
+	program.command("prompts").description("Print the exact LLM prompts a tutor (default), quiz, writing or coding YAML produces").argument("<pathOrUrl>", "path to a tutor, quiz, writing or coding YAML file, or a public http(s) URL").option("--kind <kind>", `what the file is: ${PROMPT_KINDS.map((k) => `'${k}'`).join(", ")} ('tutor' is the default)`, "tutor").option("--json", "print the full prompt dump as JSON").addHelpText("after", `
+Examples:
+  # The tutor's assembled system prompt (fragments resolved in place)
+  $ novedu-cli prompts ./activities/tutors/my-tutor.yaml
+
+  # Every grading prompt of a quiz, plus its discussion prompt, as JSON
+  $ novedu-cli prompts ./activities/quizzes/my-quiz.yaml --kind quiz --json
+
+  # A writing activity's coach prompt / a coding activity's injected system prompt
+  $ novedu-cli prompts ./activities/writings/my-writing.yaml --kind writing
+  $ novedu-cli prompts ./activities/coding/my-coding.yaml --kind coding
+
+  # One question's grading prompt, straight out of the JSON dump
+  $ novedu-cli prompts ./my-quiz.yaml --kind quiz --json | jq -r '.grading.questions[0].system'`).action(async (pathOrUrl, options) => {
+		if (options.kind !== void 0 && !PROMPT_KINDS.includes(options.kind)) {
+			console.error(`Invalid --kind "${options.kind}": expected ${PROMPT_KINDS.map((k) => `"${k}"`).join(", ")}.`);
+			process.exitCode = 1;
+			return;
+		}
+		const result = await runPrompts(pathOrUrl, options.kind ?? "tutor");
+		if (!result.ok) {
+			console.error(JSON.stringify({ errors: result.errors }, null, 2));
+			process.exitCode = 1;
+			return;
+		}
+		if (options.json) console.log(JSON.stringify(result.dump, null, 2));
+		else console.log(formatPromptDump(result.dump, promptSections(result.dump), pathOrUrl));
+		process.exitCode = 0;
+	});
+}
+//#endregion
+//#region src/commands/reports.ts
+const SERVER_OPTION = ["--server <url>", "Novedu server base URL (defaults to the NOVEDU_SERVER env var, then production)"];
+function registerReports(program) {
+	const reports = program.command("reports").description("Triage student reports on the Novedu server");
+	reports.command("list").description("List reports (defaults to open reports on your own codes, like the web inbox)").option("--status <status>", "open (default), resolved or all").option("--reaction <reaction>", "filter by reaction: good, omg, bad or holysh").option("--search <q>", "contains-filter over description, reporter, code and note").option("--all", "include reports on codes created by other teachers").option(...SERVER_OPTION).action(async (options) => {
+		const params = new URLSearchParams();
+		if (options.status) params.set("status", options.status);
+		if (options.reaction) params.set("reaction", options.reaction);
+		if (options.search) params.set("q", options.search);
+		if (options.all) params.set("mine", "0");
+		const query = params.toString();
+		await runApiRequest({
+			server: options.server,
+			path: `/api/reports${query ? `?${query}` : ""}`
+		});
+	});
+	reports.command("show <id>").description("Show one report; a chat report embeds its conversation transcript").option(...SERVER_OPTION).action(async (id, options) => {
+		await runApiRequest({
+			server: options.server,
+			path: `/api/reports/${encodeURIComponent(id)}`
+		});
+	});
+	reports.command("resolve <id...>").description("Resolve one or more reports by id (bulk, in a single request)").option(...SERVER_OPTION).action(async (ids, options) => {
+		await runApiRequest({
+			server: options.server,
+			path: "/api/reports/resolve",
+			method: "POST",
+			body: { ids }
+		});
+	});
+}
+//#endregion
 //#region src/commands/whoami.ts
 function registerWhoami(program) {
 	program.command("whoami").description("Show who is signed in by calling the Novedu server's /api/me").option("--server <url>", "Novedu server base URL (defaults to the NOVEDU_SERVER env var, then production)").action(async (options) => {
@@ -2392,6 +3905,7 @@ const { version } = JSON.parse(readFileSync(new URL("../package.json", import.me
 const program = new Command();
 program.name("novedu-cli").description("Command-line companion for the Novedu chat app").version(version);
 registerValidate(program);
+registerPrompts(program);
 registerLogin(program);
 registerLogout(program);
 registerWhoami(program);