@novedu/cli 0.18.0 → 0.19.0

package/dist/main.js

@@ -9,8 +9,8 @@ import { homedir } from "node:os";
 import { CryptoProvider, PublicClientApplication } from "@azure/msal-node";
 import { parse, stringify } from "yaml";
 import { z } from "zod";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import Handlebars from "handlebars";
+import { fileURLToPath, pathToFileURL } from "node:url";
 //#region src/auth.ts
 const DEFAULT_TENANT_ID = "91fc072c-edef-4f97-bdc5-cfb67718ae3a";
 const DEFAULT_CLIENT_ID = "4d44fc4b-0434-4981-9765-62e2074ceecb";
@@ -278,7 +278,11 @@ async function runApiRequest(options) {
 //#endregion
 //#region ../lib/llm/provider.ts
 const LLM_PROVIDERS = ["SCCH", "Azure Foundry"];
-const providerSchema = z.enum(LLM_PROVIDERS).default("SCCH").meta({ description: "The LLM provider serving the model. For Azure Foundry, model is the deployment name." });
+const DEFAULT_PROVIDER = "SCCH";
+const providerSchema = z.enum(LLM_PROVIDERS).default(DEFAULT_PROVIDER).meta({ description: "The LLM provider serving the model. For Azure Foundry, model is the deployment name." });
+function parseLenientProvider(value) {
+	return value === "SCCH" || value === "Azure Foundry" ? value : void 0;
+}
 //#endregion
 //#region ../lib/registry-schema.ts
 /** The fixed group names and the code module each one mints for. */
@@ -1041,36 +1045,131 @@ Purely local — already-issued access tokens stay valid until they expire
 	});
 }
 //#endregion
-//#region src/commands/reports.ts
-const SERVER_OPTION = ["--server <url>", "Novedu server base URL (defaults to the NOVEDU_SERVER env var, then production)"];
-function registerReports(program) {
-	const reports = program.command("reports").description("Triage student reports on the Novedu server");
-	reports.command("list").description("List reports (defaults to open reports on your own codes, like the web inbox)").option("--status <status>", "open (default), resolved or all").option("--reaction <reaction>", "filter by reaction: good, omg, bad or holysh").option("--search <q>", "contains-filter over description, reporter, code and note").option("--all", "include reports on codes created by other teachers").option(...SERVER_OPTION).action(async (options) => {
-		const params = new URLSearchParams();
-		if (options.status) params.set("status", options.status);
-		if (options.reaction) params.set("reaction", options.reaction);
-		if (options.search) params.set("q", options.search);
-		if (options.all) params.set("mine", "0");
-		const query = params.toString();
-		await runApiRequest({
-			server: options.server,
-			path: `/api/reports${query ? `?${query}` : ""}`
-		});
-	});
-	reports.command("show <id>").description("Show one report; a chat report embeds its conversation transcript").option(...SERVER_OPTION).action(async (id, options) => {
-		await runApiRequest({
-			server: options.server,
-			path: `/api/reports/${encodeURIComponent(id)}`
-		});
-	});
-	reports.command("resolve <id...>").description("Resolve one or more reports by id (bulk, in a single request)").option(...SERVER_OPTION).action(async (ids, options) => {
-		await runApiRequest({
-			server: options.server,
-			path: "/api/reports/resolve",
-			method: "POST",
-			body: { ids }
-		});
-	});
+//#region ../lib/coding-proxy.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Appends the teacher's instructions to the END of an existing system-message
+* `content`, handling both the string form and OpenAI's content-parts array form.
+* Falls back to the instructions alone when there is no usable existing content.
+*/
+function appendInstructions(existing, instructions) {
+	if (typeof existing === "string") return existing.trim() === "" ? instructions : `${existing}\n\n${instructions}`;
+	if (Array.isArray(existing)) return [...existing, {
+		type: "text",
+		text: instructions
+	}];
+	return instructions;
+}
+/**
+* Builds the upstream Chat Completions body from the client's body: PIN the model and
+* fold in the teacher's system prompt. The teacher's instructions are appended to the
+* END of the client's LAST system message, so the teacher has the final word: a client
+* cannot smuggle a later system message after the teacher's to override it. If the
+* client sent no system message, a leading one carrying only the teacher's instructions
+* is added. Everything else (messages, tools, tool_choice, temperature, stream, …)
+* passes through verbatim, so client-side tools and streaming are all preserved.
+*/
+function buildUpstreamChatBody(clientBody, opts) {
+	const clientMessages = Array.isArray(clientBody.messages) ? clientBody.messages : [];
+	const systemIndex = clientMessages.findLastIndex((m) => isRecord(m) && m.role === "system");
+	let messages;
+	if (systemIndex === -1) messages = [{
+		role: "system",
+		content: opts.instructions
+	}, ...clientMessages];
+	else {
+		const existing = clientMessages[systemIndex];
+		messages = [...clientMessages];
+		messages[systemIndex] = {
+			...existing,
+			content: appendInstructions(existing.content, opts.instructions)
+		};
+	}
+	const upstream = {
+		...clientBody,
+		model: opts.model,
+		messages
+	};
+	if (clientBody.stream === true) upstream.stream_options = {
+		...isRecord(clientBody.stream_options) ? clientBody.stream_options : {},
+		include_usage: true
+	};
+	return upstream;
+}
+//#endregion
+//#region ../lib/prompt-fragments/block.ts
+/**
+* The consumed/empty block a runtime loader leaves behind after resolving fragments
+* into its own field (`Quiz.instructionsPreamble`, or folded into writing/coding
+* `instructions`), so no stale unresolved block lingers as a second source of truth
+* on the loaded object.
+*/
+const EMPTY_FRAGMENT_BLOCK = {
+	fragment_files: [],
+	text_files: []
+};
+function readFragmentBlock(root) {
+	return {
+		fragment_files: Array.isArray(root.fragment_files) ? root.fragment_files : [],
+		text_files: Array.isArray(root.text_files) ? root.text_files : []
+	};
+}
+//#endregion
+//#region ../lib/coding-yaml.ts
+function asString$2(value) {
+	if (typeof value === "string") return value.trim() !== "" ? value : void 0;
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
+	if (typeof value === "boolean") return String(value);
+}
+/**
+* Parses and lightly validates a coding YAML. Returns a friendly error message
+* (not structured errors) when an essential field is missing — the proxy and the
+* student page surface it as a notice.
+*/
+function parseCoding(content) {
+	let doc;
+	try {
+		doc = parse(content);
+	} catch {
+		return {
+			ok: false,
+			message: "This coding activity could not be read — its YAML is not valid."
+		};
+	}
+	if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return {
+		ok: false,
+		message: "This coding activity is empty or malformed."
+	};
+	const root = doc;
+	const llm = root.llm;
+	const model = asString$2(llm?.model);
+	if (!model) return {
+		ok: false,
+		message: "This coding activity does not specify a model (llm.model)."
+	};
+	const provider = llm?.provider === void 0 ? DEFAULT_PROVIDER : parseLenientProvider(llm.provider);
+	if (!provider) return {
+		ok: false,
+		message: "This coding activity uses an unsupported llm.provider (use \"SCCH\" or \"Azure Foundry\")."
+	};
+	const instructions = asString$2(root.instructions);
+	if (!instructions) return {
+		ok: false,
+		message: "This coding activity has no instructions for the assistant."
+	};
+	return {
+		ok: true,
+		coding: {
+			id: asString$2(root.id) ?? "coding",
+			title: asString$2(root.title),
+			model,
+			provider,
+			instructions,
+			fragmentBlock: readFragmentBlock(root)
+		}
+	};
 }
 //#endregion
 //#region ../lib/prompt-fragments/assemble.ts
@@ -2152,134 +2251,1140 @@ async function loadAndCheckFragmentFile(url, fetchImpl, opts = {}) {
 	return checkFragmentFileValue(yaml.value, url);
 }
 //#endregion
-//#region ../lib/coding-schema.ts
-const CodingYamlSchema = z.strictObject({
-	id: z.string().min(1).meta({ description: "Short machine-readable activity id, e.g. beginner-typescript." }),
-	name: z.string().optional().meta({ description: "Optional human-readable label (not shown to the student)." }),
-	title: z.string().optional().meta({ description: "Optional label shown to the student on the /<code> connection page." }),
-	llm: z.strictObject({
-		model: z.string().min(1).meta({ description: "The model that answers. SERVER-ONLY and PINNED: the proxy always uses this model and ignores whatever model the coding agent sends." }),
-		provider: providerSchema
-	}).meta({
-		id: "llm",
-		description: "The pinned model and provider that answer coding requests."
-	}),
-	fragment_files: z.array(FragmentFileRefSchema).default([]).meta({ description: "Optional fragment libraries this activity pulls shared prompt fragments from." }),
-	text_files: z.array(TextFileRefSchema).default([]).meta({ description: "Optional plain-text files (markdown / source, e.g. a sample solution) embedded verbatim into instructions via {{file \"alias\"}} markers." }),
-	instructions: z.string().min(1).meta({ description: "The assistant's system prompt. SERVER-ONLY: never sent to the browser or the coding agent, and appended AFTER the coding tool's own prompt (so the teacher has the final word). Constrain the assistant to what your class has learned. When any fragment_files or text_files are declared it is a Handlebars template: place fragments inline with {{fragment \"alias.id\" …}} and embed text files with {{file \"alias\"}} (optionally {{file \"alias\" from=10 to=40}} for a line range; escape a literal {{ as \\{{)." })
-});
-//#endregion
-//#region ../lib/coding-validate.ts
+//#region ../lib/coding-resolve.ts
+const DEFAULT_SCHEMES$2 = ["http:", "https:"];
+function schemeAllowed$2(url, allowed) {
+	try {
+		return allowed.includes(new URL(url).protocol);
+	} catch {
+		return false;
+	}
+}
 /**
-* Extract metadata from an already-schema-validated coding value. Split from
-* `checkCodingValue` so `loadAndCheckCoding` can reuse the single `validate` it already
-* ran (no second parse of the same document against the same schema).
+* Resolve a leniently parsed coding activity into the runnable one. Per-request
+* streaming hot path: consistency over the referenced fragments only
+* (`validateLibraries: false`); no extra passes.
 */
-function checkCodingParsed(coding) {
+async function resolveCoding(coding, url, fetcher, opts = {}) {
+	const resolved = await assembleFragmentPrompt(coding.fragmentBlock, url, fetcher, {
+		validateLibraries: false,
+		allowedSchemes: opts.allowedSchemes ?? DEFAULT_SCHEMES$2
+	}, coding.instructions);
+	if (!resolved.ok) return {
+		ok: false,
+		message: "This coding activity's prompt fragments could not be loaded."
+	};
 	return {
 		ok: true,
-		codingId: coding.id,
-		model: coding.llm.model,
-		provider: coding.llm.provider,
-		title: coding.title ?? null,
-		warnings: []
+		coding: {
+			...coding,
+			fragmentBlock: EMPTY_FRAGMENT_BLOCK,
+			instructions: resolved.prompt
+		}
 	};
 }
 /**
-* Validate a coding FILE: scheme-gate + fetch + parse (shared `loadYaml`), then the
-* pure `checkCodingValue`. The web app passes the default http(s)-only schemes; the
-* CLI adds `file:` so a local coding YAML on disk validates too.
+* Fetch + lenient-parse + `resolveCoding`, all through the CALLER's fetcher — the
+* app-free counterpart of `loadCoding` (`lib/coding-fetch.ts`) used by the prompt dump
+* and the CLI, where there is no database and an activity may live on disk (`file:`).
 */
-async function loadAndCheckCoding(url, fetchImpl, opts = {}) {
-	const yaml = await loadYaml(url, fetchImpl, opts);
-	if (!yaml.ok) return {
+async function loadCodingFrom(url, fetcher, opts = {}) {
+	const allowedSchemes = opts.allowedSchemes ?? DEFAULT_SCHEMES$2;
+	if (!schemeAllowed$2(url, allowedSchemes)) return {
 		ok: false,
-		errors: [yaml.error],
-		warnings: []
+		message: `This coding activity's URL is not allowed: ${url}`
 	};
-	const valid = validate(yaml.value, CodingYamlSchema, "CODING_SCHEMA_ERROR", url);
-	if (!valid.ok) return {
+	try {
+		const res = await fetcher(url);
+		if (!res.ok) return res.status === 404 ? {
+			ok: false,
+			message: "This coding activity could not be found."
+		} : {
+			ok: false,
+			message: `This coding activity could not be loaded (HTTP ${res.status}).`
+		};
+		const parsed = parseCoding(await res.text());
+		if (!parsed.ok) return parsed;
+		return await resolveCoding(parsed.coding, url, fetcher, { allowedSchemes });
+	} catch {
+		return {
+			ok: false,
+			message: "This coding activity could not be loaded. Try again."
+		};
+	}
+}
+//#endregion
+//#region ../lib/quiz-types.ts
+/** The student-facing wording for a verdict — `partial` reads as "partly correct". */
+function verdictLabel(verdict) {
+	switch (verdict) {
+		case "correct": return "correct";
+		case "partial": return "partly correct";
+		case "incorrect": return "wrong";
+	}
+}
+//#endregion
+//#region ../lib/quiz-discussion-prompt.ts
+/**
+* The discussion chat's system prompt: the quiz-level `instructionsPreamble` (the
+* rendered `instructions` host text — shared safety/persona/language rules, the SAME
+* preamble the grader receives) followed by a default frame and the quiz's optional
+* `discussionInstructions`. The question/answer/verdict are the thread's seed messages,
+* recalled from memory, NOT repeated here.
+*
+* A compound quiz's imported questions each carry their SOURCE quiz's preamble
+* (`sourcePreamble`), but that applies to GRADING only (`buildGradingPrompt`): the
+* discussion prompt uses ONLY the compound file's own instructions — consistent with
+* every other include-level field (`llm`, `anonymous`, `shuffle`, ...), which the
+* compound file governs too. Mixing all chapters' preambles into one prompt would put
+* conflicting persona/language rules in force at once; the question/answer/verdict the
+* discussion needs are recalled from the thread's seed messages regardless.
+*/
+function buildDiscussionInstructions(quiz) {
+	const base = "You are helping a student understand a single quiz question. The conversation already contains the question, the student's submitted answer, and the verdict with feedback — use that context. Be concise and encouraging, and stay on this question.";
+	const frame = quiz.discussionInstructions ? `${base}\n\n${quiz.discussionInstructions.trim()}` : base;
+	return [quiz.instructionsPreamble, frame].filter(Boolean).join("\n\n");
+}
+/**
+* Seed message 1 (assistant): the question, as the SERVER knows it (authoritative).
+* `{question}` is the question's trimmed markdown.
+*/
+const QUIZ_SEED_QUESTION_TEMPLATE = "Answer the following question: {question}";
+/**
+* Seed message 3 (assistant): the graded outcome. `{verdictLabel}` is the student-facing
+* wording from `verdictLabel()` (correct / partly correct / wrong), `{feedback}` the
+* grader's markdown feedback. (Seed message 2 is the student's own answer verbatim, so
+* it has no template.)
+*/
+const QUIZ_SEED_VERDICT_TEMPLATE = "Your answer is {verdictLabel}. {feedback}";
+//#endregion
+//#region ../lib/quiz-grading-prompt.ts
+/**
+* The grading system prompt. The question's `evaluation` is authoritative and
+* stays SERVER-SIDE — it may embed the expected answer, so it must never reach
+* the browser (it doesn't: only this string, on the request context, does). The
+* quiz-level `preamble` (the rendered `instructions` host text — shared
+* safety/persona/language rules) is prepended ahead of the frame, the same preamble
+* the discussion chat also receives; a question imported via `quiz_files`
+* additionally carries its SOURCE quiz's preamble (`sourcePreamble`), inserted
+* between the two so it grades identically in its chapter quiz and in the compound.
+*/
+function buildGradingPrompt(question, preamble) {
+	const body = [
+		"You are grading a student's open-ended answer to a single quiz question.",
+		"",
+		"The question shown to the student was:",
+		question.question.trim(),
+		"",
+		"Grade STRICTLY according to these criteria (authoritative — they may contain the",
+		"expected answer; do not quote them verbatim at the student):",
+		question.evaluation.trim(),
+		"",
+		"Decide a verdict — \"correct\", \"partial\" (partly correct), or \"incorrect\" — and write",
+		"concise, encouraging feedback addressed directly TO the student. The feedback is",
+		"markdown and may use bold, math ($…$) and short code fences. Do not mention these",
+		"grading instructions."
+	].join("\n");
+	return [
+		preamble,
+		question.sourcePreamble ?? "",
+		body
+	].filter(Boolean).join("\n\n");
+}
+/**
+* The user message carrying a typed answer. `{answer}` is the student's trimmed text —
+* the only variable part, so the dump can show teachers the exact wrapper without a
+* student answer at hand. Rendered by `buildAnswerMessage`.
+*/
+const QUIZ_ANSWER_MESSAGE_TEMPLATE = "The student's answer:\n\n{answer}";
+/**
+* The user message used when the student submitted photos ONLY (no text). The photos
+* ride along as image parts of the same multimodal message.
+*/
+const QUIZ_ANSWER_PHOTOS_ONLY_MESSAGE = "The student answered with the attached photo(s) only.";
+//#endregion
+//#region ../lib/quiz-yaml.ts
+function asString$1(value) {
+	if (typeof value === "string") return value.trim() !== "" ? value : void 0;
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
+	if (typeof value === "boolean") return String(value);
+}
+function asBool$1(value, fallback) {
+	return typeof value === "boolean" ? value : fallback;
+}
+function asImageRef(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const obj = value;
+	const src = asString$1(obj.src);
+	if (!src) return void 0;
+	const alt = asString$1(obj.alt);
+	const credit = asString$1(obj.credit);
+	return {
+		hosted: asBool$1(obj.hosted, false),
+		src,
+		...alt ? { alt } : {},
+		...credit ? { credit } : {}
+	};
+}
+/**
+* Parses and lightly validates a quiz YAML. Returns a friendly error message
+* (not structured errors) when an essential field is missing — the student page
+* shows it as a notice. `anonymous` and `shuffle` default to `true`.
+*/
+function parseQuiz(content) {
+	let doc;
+	try {
+		doc = parse(content);
+	} catch {
+		return {
+			ok: false,
+			message: "This quiz could not be read — its YAML is not valid."
+		};
+	}
+	if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return {
 		ok: false,
-		errors: [valid.error],
-		warnings: []
+		message: "This quiz is empty or malformed."
 	};
-	const checked = checkCodingParsed(valid.data);
-	if (!checked.ok) return checked;
-	const assembled = await assembleFragmentPrompt({
-		fragment_files: valid.data.fragment_files,
-		text_files: valid.data.text_files
-	}, url, fetchImpl, {
-		allowedSchemes: opts.allowedSchemes,
-		validateLibraries: opts.validateLibraries ?? true
-	}, valid.data.instructions);
-	const warnings = [...checked.warnings, ...assembled.warnings];
-	if (!assembled.ok) return {
+	const root = doc;
+	const llm = root.llm;
+	const model = asString$1(llm?.model);
+	if (!model) return {
 		ok: false,
-		errors: assembled.errors,
-		warnings
+		message: "This quiz does not specify a model (llm.model)."
+	};
+	const provider = llm?.provider === void 0 ? DEFAULT_PROVIDER : parseLenientProvider(llm.provider);
+	if (!provider) return {
+		ok: false,
+		message: "This quiz uses an unsupported llm.provider (use \"SCCH\" or \"Azure Foundry\")."
+	};
+	const quizFiles = Array.isArray(root.quiz_files) ? root.quiz_files : [];
+	const rawQuestions = Array.isArray(root.questions) ? root.questions : [];
+	if (rawQuestions.length === 0 && quizFiles.length === 0) return {
+		ok: false,
+		message: "This quiz has no questions."
+	};
+	const questions = [];
+	const seenIds = /* @__PURE__ */ new Set();
+	for (const raw of rawQuestions) {
+		if (typeof raw !== "object" || raw === null) continue;
+		const q = raw;
+		const id = asString$1(q.id);
+		const question = asString$1(q.question);
+		const evaluation = asString$1(q.evaluation);
+		if (!id || !question || !evaluation || seenIds.has(id)) continue;
+		seenIds.add(id);
+		questions.push({
+			id,
+			title: asString$1(q.title),
+			question,
+			evaluation,
+			image: asImageRef(q.image),
+			...typeof q.imageInput === "boolean" ? { imageInput: q.imageInput } : {}
+		});
+	}
+	if (questions.length === 0 && quizFiles.length === 0) return {
+		ok: false,
+		message: "This quiz has no complete questions (each needs an id, question and evaluation)."
 	};
+	const rawCount = root.question_count;
+	const questionCount = typeof rawCount === "number" && Number.isInteger(rawCount) && rawCount >= 1 ? rawCount : void 0;
 	return {
-		...checked,
-		warnings
+		ok: true,
+		quiz: {
+			id: asString$1(root.id) ?? asString$1(root.name) ?? "quiz",
+			name: asString$1(root.name),
+			title: asString$1(root.title),
+			description: asString$1(root.description),
+			anonymous: asBool$1(root.anonymous, true),
+			shuffle: asBool$1(root.shuffle, true),
+			model,
+			provider,
+			questionCount,
+			imageInput: asBool$1(llm?.imageInput, false),
+			discussionInstructions: asString$1(root.discussion?.instructions),
+			instructions: asString$1(root.instructions),
+			fragmentBlock: readFragmentBlock(root),
+			quizFiles,
+			instructionsPreamble: "",
+			questions
+		}
 	};
 }
+/**
+* A question's EFFECTIVE photo-answers flag: the per-question override when set, the
+* quiz-level `llm.imageInput` otherwise. The ONE definition of that two-level rule —
+* re-exported by `lib/quiz-verify.ts` for the server actions (which re-derive it on
+* every request, never trusting the client), applied by `toPublicQuiz` below, and
+* reported per question by the prompt dump.
+*/
+function effectiveImageInput(quiz, question) {
+	return question.imageInput ?? quiz.imageInput;
+}
 //#endregion
-//#region ../lib/quiz-schema.ts
+//#region ../lib/quiz-resolve.ts
+const DEFAULT_SCHEMES$1 = ["http:", "https:"];
+function schemeAllowed$1(url, allowed) {
+	try {
+		return allowed.includes(new URL(url).protocol);
+	} catch {
+		return false;
+	}
+}
 /**
-* A live quiz include: alias + URL, mirroring `FragmentFileRefSchema` (same URL
-* contract). The alias prefixes every imported question id as `"<alias>/<id>"`, so
-* on top of the no-dot rule it may not contain a `/` either. Aliases live in their
-* OWN namespace (they never appear in `{{…}}` markers — only in question ids).
+* Renders ONE quiz document's `instructions` host text against its OWN fragment
+* block, relative to its OWN URL (`validateLibraries: false` — the hot path). Used
+* for each included source quiz, so an imported question's `sourcePreamble` is
+* exactly what its chapter quiz would grade with. (The root document renders its
+* two host texts — `instructions` + `discussion.instructions` — in `resolveQuiz`.)
 */
-const QuizFileRefSchema = z.strictObject({
-	id: z.string().regex(/^[^./]+$/, { message: "Alias must not contain a dot or a slash" }).meta({
-		pattern: "^[^./]+$",
-		description: "Local alias for this included quiz. Prefixes every imported question id as \"<alias>/<id>\", so it may not contain a dot or a slash."
-	}),
-	url: FragmentFileRefSchema.shape.url.meta({
-		pattern: "^(https?://|(?![A-Za-z][A-Za-z0-9+.-]*:).+)$",
-		description: "HTTP(S) URL or relative path to the included quiz file."
-	})
-}).meta({
-	id: "quizFileRef",
-	description: "A reference to another quiz file whose questions are included live."
-});
-/** An optional content image attached to a question (carries no secret). */
-const ImageRefSchema = z.strictObject({
-	hosted: z.boolean().optional().meta({
-		default: false,
-		description: "When true, src is an app-hosted image NAME resolved server-side; otherwise src is an absolute URL or a path relative to the quiz's own URL."
-	}),
-	src: z.string().min(1).meta({ description: "The hosted image name (when hosted) or the image URL / relative path." }),
-	alt: z.string().optional().meta({ description: "Accessible description shown if the image cannot be loaded." }),
-	credit: z.string().optional().meta({ description: "Optional attribution (\"Content Credentials\") shown small below the image." })
-}).meta({
-	id: "image",
-	description: "An optional content image attached to a question."
-});
+async function renderPreamble(quiz, url, fetcher, allowedSchemes) {
+	const resolved = await assembleFragmentPrompt(quiz.fragmentBlock, url, fetcher, {
+		validateLibraries: false,
+		allowedSchemes
+	}, quiz.instructions ?? "");
+	if (!resolved.ok) return { ok: false };
+	return {
+		ok: true,
+		preamble: resolved.prompt.trimEnd()
+	};
+}
 /**
-* One question. `id` keys the per-question stats (must be unique — see
-* `lib/quiz-validate.ts`); `question` is the Markdown shown to the student;
-* `evaluation` is the server-only grading prompt.
+* Absolutize an imported question's content image against the SOURCE quiz URL, so
+* a `./diagram.png` next to the chapter quiz still resolves from the compound quiz
+* (whose own `file_url` is elsewhere). Hosted NAMES and absolute URLs pass through
+* unchanged — they resolve the same from anywhere.
 */
-const QuizQuestionSchema = z.strictObject({
-	id: z.string().min(1).meta({ description: "Stable question id, unique within the quiz (the per-question stats key)." }),
-	title: z.string().optional().meta({ description: "Optional short label for the stats table and progress display." }),
-	question: z.string().min(1).meta({ description: "The Markdown shown to the student." }),
-	evaluation: z.string().min(1).meta({ description: "The grading prompt. SERVER-ONLY: never sent to the browser, so it may embed the expected answer and the grading rubric." }),
-	image: ImageRefSchema.optional(),
-	imageInput: z.boolean().optional().meta({ description: "Overrides the quiz-level llm.imageInput for this question only (photo answers on/off)." })
-}).meta({
-	id: "question",
-	description: "One open-ended, LLM-graded quiz question."
-});
-const QuizYamlSchema = z.strictObject({
-	id: z.string().min(1).meta({ description: "Short machine-readable quiz id, e.g. countries-basics. Used as the per-quiz identity." }),
-	name: z.string().optional().meta({ description: "Optional human-readable quiz title (used as a label)." }),
-	title: z.string().optional().meta({ description: "Optional greeting shown to students on the welcome screen instead of the default message." }),
-	description: z.string().optional().meta({ description: "Optional description shown to students below the welcome greeting (Markdown)." }),
-	anonymous: z.boolean().optional().meta({
-		default: true,
+function absolutizeImage(image, sourceUrl) {
+	if (!image || image.hosted === true || /^https?:\/\//i.test(image.src)) return image;
+	try {
+		return {
+			...image,
+			src: resolveFragmentUrl(image.src, sourceUrl)
+		};
+	} catch {
+		return image;
+	}
+}
+/** Resolve ONE `quiz_files` include into its namespaced, import-transformed questions. */
+async function resolveInclude(ref, baseUrl, fetcher, allowedSchemes) {
+	const alias = typeof ref?.id === "string" ? ref.id.trim() : "";
+	const rawUrl = typeof ref?.url === "string" ? ref.url.trim() : "";
+	if (!alias || /[./]/.test(alias) || !rawUrl) return {
+		ok: false,
+		message: "This quiz declares an invalid quiz_files entry."
+	};
+	let sourceUrl;
+	try {
+		sourceUrl = resolveFragmentUrl(rawUrl, baseUrl);
+	} catch {
+		return {
+			ok: false,
+			message: `The included quiz "${alias}" has an invalid URL.`
+		};
+	}
+	if (!schemeAllowed$1(sourceUrl, allowedSchemes)) return {
+		ok: false,
+		message: `The included quiz "${alias}" has an invalid URL.`
+	};
+	let body;
+	try {
+		const res = await fetcher(sourceUrl);
+		if (!res.ok) return {
+			ok: false,
+			message: `The included quiz "${alias}" could not be loaded.`
+		};
+		body = await res.text();
+	} catch {
+		return {
+			ok: false,
+			message: `The included quiz "${alias}" could not be loaded.`
+		};
+	}
+	const parsed = parseQuiz(body);
+	if (!parsed.ok) return {
+		ok: false,
+		message: `The included quiz "${alias}" is not a usable quiz file.`
+	};
+	if (parsed.quiz.quizFiles.length > 0) return {
+		ok: false,
+		message: `The included quiz "${alias}" itself includes other quizzes — includes cannot be nested.`
+	};
+	const preamble = await renderPreamble(parsed.quiz, sourceUrl, fetcher, allowedSchemes);
+	if (!preamble.ok) return {
+		ok: false,
+		message: `The included quiz "${alias}"'s prompt fragments could not be loaded.`
+	};
+	const source = parsed.quiz;
+	return {
+		ok: true,
+		questions: source.questions.map((q) => ({
+			...q,
+			id: `${alias}/${q.id}`,
+			imageInput: q.imageInput ?? source.imageInput,
+			image: absolutizeImage(q.image, sourceUrl),
+			...preamble.preamble ? { sourcePreamble: preamble.preamble } : {}
+		}))
+	};
+}
+/**
+* Resolve a leniently parsed quiz into the runnable one: render its two host texts,
+* then merge in every `quiz_files` include. `url` is the quiz's own URL (the base for
+* relative fragment/include refs); `fetcher` is the caller's network seam.
+*/
+async function resolveQuiz(quiz, url, fetcher, opts = {}) {
+	const allowedSchemes = opts.allowedSchemes ?? DEFAULT_SCHEMES$1;
+	const resolved = await assembleFragmentPrompts(quiz.fragmentBlock, url, fetcher, {
+		validateLibraries: false,
+		allowedSchemes
+	}, [quiz.instructions ?? "", quiz.discussionInstructions ?? ""]);
+	if (!resolved.ok) return {
+		ok: false,
+		message: "This quiz's prompt fragments could not be loaded."
+	};
+	const [instructionsPreamble = "", discussionInstructions = ""] = resolved.prompts;
+	const refs = quiz.quizFiles;
+	const aliases = /* @__PURE__ */ new Set();
+	for (const ref of refs) {
+		const alias = typeof ref?.id === "string" ? ref.id.trim() : "";
+		if (aliases.has(alias)) return {
+			ok: false,
+			message: `This quiz declares the included-quiz alias "${alias}" twice.`
+		};
+		aliases.add(alias);
+	}
+	const includes = await Promise.all(refs.map((ref) => resolveInclude(ref, url, fetcher, allowedSchemes)));
+	const imported = [];
+	for (const include of includes) {
+		if (!include.ok) return include;
+		imported.push(...include.questions);
+	}
+	const questions = [...quiz.questions, ...imported];
+	if (questions.length === 0) return {
+		ok: false,
+		message: "This quiz has no questions."
+	};
+	return {
+		ok: true,
+		quiz: {
+			...quiz,
+			fragmentBlock: EMPTY_FRAGMENT_BLOCK,
+			quizFiles: [],
+			instructionsPreamble: instructionsPreamble.trimEnd(),
+			discussionInstructions: discussionInstructions.trim() !== "" ? discussionInstructions.trimEnd() : void 0,
+			questions
+		}
+	};
+}
+/**
+* Fetch + lenient-parse + `resolveQuiz`, all through the CALLER's fetcher — the
+* app-free counterpart of `loadQuiz` (`lib/quiz-fetch.ts`) used by the prompt dump and
+* the CLI, where there is no database and a quiz may live on disk (`file:`).
+*/
+async function loadQuizFrom(url, fetcher, opts = {}) {
+	const allowedSchemes = opts.allowedSchemes ?? DEFAULT_SCHEMES$1;
+	if (!schemeAllowed$1(url, allowedSchemes)) return {
+		ok: false,
+		message: `This quiz's URL is not allowed: ${url}`
+	};
+	try {
+		const res = await fetcher(url);
+		if (!res.ok) return res.status === 404 ? {
+			ok: false,
+			message: "This quiz could not be found."
+		} : {
+			ok: false,
+			message: `This quiz could not be loaded (HTTP ${res.status}).`
+		};
+		const parsed = parseQuiz(await res.text());
+		if (!parsed.ok) return parsed;
+		return await resolveQuiz(parsed.quiz, url, fetcher, { allowedSchemes });
+	} catch {
+		return {
+			ok: false,
+			message: "This quiz could not be loaded. Try again."
+		};
+	}
+}
+//#endregion
+//#region ../lib/quiz-verdict-schema.ts
+const QUIZ_VERDICT_SCHEMA = z.object({
+	result: z.enum([
+		"correct",
+		"partial",
+		"incorrect"
+	]),
+	feedback: z.string()
+});
+//#endregion
+//#region ../lib/tutors/schemas.ts
+/**
+* An example question offered to students on the welcome screen: the `title` is
+* the clickable label, the `question` is the full text placed into the chat
+* input on click. Tutors may define any number; the UI samples at most 5.
+*/
+const ExampleQuestionSchema = z.strictObject({
+	title: z.string().min(1).meta({ description: "Short clickable label shown on the welcome screen." }),
+	question: z.string().min(1).meta({ description: "Full question text. Shown as a tooltip and placed into the chat input on click." })
+}).meta({
+	id: "exampleQuestion",
+	description: "An example question shown on the welcome screen."
+});
+const TutorSchema = z.strictObject({
+	id: z.string().meta({ description: "Short machine-readable tutor id, e.g. fractions-de." }),
+	name: z.string().meta({ description: "Human-readable tutor title." }),
+	title: z.string().optional().meta({ description: "Optional greeting shown to students on the empty chat instead of the default welcome message." }),
+	description: z.string().meta({ description: "Short description of what this tutor does. Shown to students below the welcome greeting." }),
+	exampleQuestions: z.array(ExampleQuestionSchema).optional().meta({ description: "Optional example questions shown to students below the description on the empty chat. Clicking one puts the question text into the chat input. At most 5 are shown; with more, a random 5 are picked per page load." }),
+	anonymous: z.boolean().optional().meta({
+		default: true,
+		description: "Chats are anonymous by default: no link between the signed-in student and their chat is stored. Set to false to record which student each chat belongs to."
+	}),
+	llm: z.strictObject({
+		model: z.string().meta({ description: "Model used for this tutor." }),
+		provider: providerSchema,
+		imageInput: z.boolean().optional().meta({
+			default: true,
+			description: "Image uploads are enabled by default. Set to false to hide the upload UI for text-only tutors or non-vision-capable models."
+		})
+	}).meta({
+		id: "llm",
+		description: "The model and provider that back this tutor."
+	}),
+	prompt: z.strictObject({
+		fragment_files: z.array(FragmentFileRefSchema).default([]).meta({ description: "Optional fragment libraries used by this tutor." }),
+		text_files: z.array(TextFileRefSchema).default([]).meta({ description: "Optional plain-text files (markdown / source) embedded verbatim via {{file \"alias\"}} markers." }),
+		tutor_instructions: z.string().meta({ description: "The tutor's system prompt. When any fragment_files or text_files are declared this is a Handlebars template: place fragments inline with {{fragment \"alias.id\" key=\"v\"}} markers and embed text files with {{file \"alias\"}} (optionally {{file \"alias\" from=10 to=40}} for a line range; escape a literal {{ as \\{{). For single-file tutors it is the whole prompt." })
+	}).meta({
+		id: "prompt",
+		description: "The tutor system prompt: a host template with inline fragment markers."
+	})
+});
+//#endregion
+//#region ../lib/tutors/load.ts
+async function loadAndBuildTutorPrompt(url, fetchImpl, opts = {}) {
+	const warnings = [];
+	const tutorYaml = await loadYaml(url, fetchImpl, opts);
+	if (!tutorYaml.ok) return {
+		ok: false,
+		errors: [tutorYaml.error],
+		warnings
+	};
+	const tutorValid = validate(tutorYaml.value, TutorSchema, "TUTOR_SCHEMA_ERROR", url);
+	if (!tutorValid.ok) return {
+		ok: false,
+		errors: [tutorValid.error],
+		warnings
+	};
+	const tutor = tutorValid.data;
+	const assembled = await assembleFragmentPrompt(tutor.prompt, url, fetchImpl, opts, tutor.prompt.tutor_instructions);
+	warnings.push(...assembled.warnings);
+	if (!assembled.ok) return {
+		ok: false,
+		errors: assembled.errors,
+		warnings
+	};
+	return {
+		ok: true,
+		id: tutor.id,
+		prompt: assembled.prompt,
+		model: tutor.llm.model,
+		provider: tutor.llm.provider,
+		imageInput: tutor.llm.imageInput ?? true,
+		anonymous: tutor.anonymous ?? true,
+		title: tutor.title,
+		description: tutor.description,
+		exampleQuestions: tutor.exampleQuestions ?? [],
+		warnings
+	};
+}
+//#endregion
+//#region ../lib/writing-yaml.ts
+function asString(value) {
+	if (typeof value === "string") return value.trim() !== "" ? value : void 0;
+	if (typeof value === "number") return Number.isFinite(value) ? String(value) : void 0;
+	if (typeof value === "boolean") return String(value);
+}
+function asBool(value, fallback) {
+	return typeof value === "boolean" ? value : fallback;
+}
+/**
+* Parses and lightly validates a writing YAML. Returns a friendly error message
+* (not structured errors) when an essential field is missing — the student page
+* shows it as a notice. `anonymous` DEFAULTS to `false` (the writing divergence).
+*/
+function parseWriting(content) {
+	let doc;
+	try {
+		doc = parse(content);
+	} catch {
+		return {
+			ok: false,
+			message: "This writing activity could not be read — its YAML is not valid."
+		};
+	}
+	if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return {
+		ok: false,
+		message: "This writing activity is empty or malformed."
+	};
+	const root = doc;
+	const llm = root.llm;
+	const model = asString(llm?.model);
+	if (!model) return {
+		ok: false,
+		message: "This writing activity does not specify a model (llm.model)."
+	};
+	const provider = llm?.provider === void 0 ? DEFAULT_PROVIDER : parseLenientProvider(llm.provider);
+	if (!provider) return {
+		ok: false,
+		message: "This writing activity uses an unsupported llm.provider (use \"SCCH\" or \"Azure Foundry\")."
+	};
+	const instructions = asString(root.instructions);
+	if (!instructions) return {
+		ok: false,
+		message: "This writing activity has no instructions for the assistant."
+	};
+	return {
+		ok: true,
+		writing: {
+			id: asString(root.id) ?? asString(root.name) ?? "writing",
+			name: asString(root.name) ?? "writing",
+			title: asString(root.title),
+			description: asString(root.description),
+			anonymous: asBool(root.anonymous, false),
+			model,
+			provider,
+			instructions,
+			fragmentBlock: readFragmentBlock(root),
+			placeholder: asString(root.placeholder)
+		}
+	};
+}
+//#endregion
+//#region ../lib/writing-resolve.ts
+const DEFAULT_SCHEMES = ["http:", "https:"];
+function schemeAllowed(url, allowed) {
+	try {
+		return allowed.includes(new URL(url).protocol);
+	} catch {
+		return false;
+	}
+}
+/**
+* Resolve a leniently parsed writing activity into the runnable one. `url` is the
+* activity's own URL (the base for relative fragment refs); `fetcher` the network seam.
+*/
+async function resolveWriting(writing, url, fetcher, opts = {}) {
+	const resolved = await assembleFragmentPrompt(writing.fragmentBlock, url, fetcher, {
+		validateLibraries: false,
+		allowedSchemes: opts.allowedSchemes ?? DEFAULT_SCHEMES
+	}, writing.instructions);
+	if (!resolved.ok) return {
+		ok: false,
+		message: "This writing activity's prompt fragments could not be loaded."
+	};
+	return {
+		ok: true,
+		writing: {
+			...writing,
+			fragmentBlock: EMPTY_FRAGMENT_BLOCK,
+			instructions: resolved.prompt
+		}
+	};
+}
+/**
+* Fetch + lenient-parse + `resolveWriting`, all through the CALLER's fetcher — the
+* app-free counterpart of `loadWriting` (`lib/writing-fetch.ts`) used by the prompt dump
+* and the CLI, where there is no database and an activity may live on disk (`file:`).
+*/
+async function loadWritingFrom(url, fetcher, opts = {}) {
+	const allowedSchemes = opts.allowedSchemes ?? DEFAULT_SCHEMES;
+	if (!schemeAllowed(url, allowedSchemes)) return {
+		ok: false,
+		message: `This writing activity's URL is not allowed: ${url}`
+	};
+	try {
+		const res = await fetcher(url);
+		if (!res.ok) return res.status === 404 ? {
+			ok: false,
+			message: "This writing activity could not be found."
+		} : {
+			ok: false,
+			message: `This writing activity could not be loaded (HTTP ${res.status}).`
+		};
+		const parsed = parseWriting(await res.text());
+		if (!parsed.ok) return parsed;
+		return await resolveWriting(parsed.writing, url, fetcher, { allowedSchemes });
+	} catch {
+		return {
+			ok: false,
+			message: "This writing activity could not be loaded. Try again."
+		};
+	}
+}
+//#endregion
+//#region ../lib/prompt-dump.ts
+const PROMPT_KINDS = [
+	"tutor",
+	"quiz",
+	"writing",
+	"coding"
+];
+/** Wrap a runtime loader's friendly message as the structured failure shape. */
+function loadFailed(message, url) {
+	return {
+		ok: false,
+		errors: [error("ACTIVITY_LOAD_FAILED", message, { url })]
+	};
+}
+/**
+* The verdict schema as plain JSON Schema, generated from the zod source of truth with
+* zod 4's native converter — the same mechanism `lib/schema-gen` uses for the authoring
+* schemas, so there is no second conversion story in the repo.
+*/
+function verdictResponseJsonSchema() {
+	return z.toJSONSchema(QUIZ_VERDICT_SCHEMA, { target: "draft-2020-12" });
+}
+/** The seam: one dumper per prompt-producing `FileKind`. */
+const promptDumpers = {
+	tutor: { async dump(url, fetcher, opts = {}) {
+		const result = await loadAndBuildTutorPrompt(url, fetcher, opts);
+		if (!result.ok) return {
+			ok: false,
+			errors: result.errors
+		};
+		return {
+			ok: true,
+			dump: {
+				kind: "tutor",
+				id: result.id,
+				llm: {
+					provider: result.provider,
+					model: result.model
+				},
+				system: result.prompt
+			}
+		};
+	} },
+	quiz: { async dump(url, fetcher, opts = {}) {
+		const loaded = await loadQuizFrom(url, fetcher, { allowedSchemes: opts.allowedSchemes });
+		if (!loaded.ok) return loadFailed(loaded.message, url);
+		const quiz = loaded.quiz;
+		return {
+			ok: true,
+			dump: {
+				kind: "quiz",
+				id: quiz.id,
+				llm: {
+					provider: quiz.provider,
+					model: quiz.model
+				},
+				grading: {
+					userMessageTemplate: QUIZ_ANSWER_MESSAGE_TEMPLATE,
+					userMessagePhotosOnly: QUIZ_ANSWER_PHOTOS_ONLY_MESSAGE,
+					responseSchema: verdictResponseJsonSchema(),
+					questions: quiz.questions.map((question) => ({
+						id: question.id,
+						...question.title ? { title: question.title } : {},
+						system: buildGradingPrompt(question, quiz.instructionsPreamble),
+						imageInput: effectiveImageInput(quiz, question)
+					}))
+				},
+				discussion: {
+					system: buildDiscussionInstructions(quiz),
+					seedMessages: {
+						question: QUIZ_SEED_QUESTION_TEMPLATE,
+						answer: "{answer}",
+						verdict: QUIZ_SEED_VERDICT_TEMPLATE
+					},
+					verdictLabels: {
+						correct: verdictLabel("correct"),
+						partial: verdictLabel("partial"),
+						incorrect: verdictLabel("incorrect")
+					}
+				}
+			}
+		};
+	} },
+	writing: { async dump(url, fetcher, opts = {}) {
+		const loaded = await loadWritingFrom(url, fetcher, { allowedSchemes: opts.allowedSchemes });
+		if (!loaded.ok) return loadFailed(loaded.message, url);
+		const writing = loaded.writing;
+		return {
+			ok: true,
+			dump: {
+				kind: "writing",
+				id: writing.id,
+				llm: {
+					provider: writing.provider,
+					model: writing.model
+				},
+				system: writing.instructions
+			}
+		};
+	} },
+	coding: { async dump(url, fetcher, opts = {}) {
+		const loaded = await loadCodingFrom(url, fetcher, { allowedSchemes: opts.allowedSchemes });
+		if (!loaded.ok) return loadFailed(loaded.message, url);
+		const coding = loaded.coding;
+		const upstream = buildUpstreamChatBody({ messages: [] }, {
+			instructions: coding.instructions,
+			model: coding.model
+		});
+		const system = (Array.isArray(upstream.messages) ? upstream.messages : []).find((m) => typeof m === "object" && m !== null && m.role === "system");
+		return {
+			ok: true,
+			dump: {
+				kind: "coding",
+				id: coding.id,
+				llm: {
+					provider: coding.provider,
+					model: coding.model
+				},
+				system: coding.instructions,
+				upstreamSystemMessage: typeof system?.content === "string" ? system.content : ""
+			}
+		};
+	} }
+};
+/** Dump the prompts of ONE activity file — the single entry point callers use. */
+function dumpPrompts(kind, url, fetcher, opts = {}) {
+	return promptDumpers[kind].dump(url, fetcher, opts);
+}
+/**
+* The dump's prompts as a flat, kind-agnostic list — what a summary renderer walks so it
+* never has to switch on the kind. Order is stable (and, for a quiz, question order).
+*/
+function promptSections(dump) {
+	switch (dump.kind) {
+		case "quiz": return [...dump.grading.questions.map((q) => ({
+			name: `grading: ${q.id}`,
+			text: q.system
+		})), {
+			name: "discussion",
+			text: dump.discussion.system
+		}];
+		case "coding": return [{
+			name: "system (injected upstream)",
+			text: dump.system
+		}];
+		default: return [{
+			name: "system",
+			text: dump.system
+		}];
+	}
+}
+//#endregion
+//#region src/file-fetcher.ts
+const cliFetcher = async (url) => {
+	if (url.startsWith("file:")) try {
+		const text = await readFile(fileURLToPath(url), "utf8");
+		return {
+			ok: true,
+			status: 200,
+			text: async () => text
+		};
+	} catch {
+		return {
+			ok: false,
+			status: 404,
+			text: async () => ""
+		};
+	}
+	return defaultFetcher(url);
+};
+//#endregion
+//#region src/format.ts
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code, s) => useColor ? `\x1b[${code}m${s}\x1b[0m` : s;
+const green = (s) => paint("32", s);
+const red = (s) => paint("31", s);
+const yellow = (s) => paint("33", s);
+const dim = (s) => paint("2", s);
+/** Append the context fields an error/warning carries, when present. */
+function context(item) {
+	const parts = [];
+	if (item.fileAlias) parts.push(`file=${item.fileAlias}`);
+	if (item.fragmentId) parts.push(`fragment=${item.fragmentId}`);
+	if ("questionId" in item && item.questionId) parts.push(`question=${item.questionId}`);
+	if (item.variable) parts.push(`variable=${item.variable}`);
+	if ("url" in item && item.url) parts.push(`url=${item.url}`);
+	if ("expectedType" in item && item.expectedType) parts.push(`expected=${item.expectedType}`);
+	if ("actualType" in item && item.actualType) parts.push(`actual=${item.actualType}`);
+	return parts.length ? dim(` (${parts.join(", ")})`) : "";
+}
+function renderWarnings(warnings) {
+	return warnings.map((w) => `  ${yellow("⚠")} ${yellow(w.code)} ${w.message}${context(w)}`);
+}
+/**
+* Render each error as a line, with any flattened Zod schema-issue detail
+* indented beneath it — so a generic "Document does not match the expected
+* structure" is followed by the actual field paths (e.g. `Unrecognized key:
+* "nae"`), matching what the web UI shows.
+*/
+function renderErrors(errors) {
+	const lines = [];
+	for (const e of errors) {
+		lines.push(`  ${red("✗")} ${red(e.code)} ${e.message}${context(e)}`);
+		if (e.zodIssues) for (const issue of formatZodIssues(e.zodIssues)) lines.push(`      ${dim(issue)}`);
+	}
+	return lines;
+}
+function formatResult(result, source) {
+	const lines = [];
+	if (result.ok) {
+		lines.push(green(`✔ Valid tutor`) + dim(` — ${source}`));
+		lines.push(`  model: ${result.model}`);
+		lines.push(`  system prompt: ${result.prompt.length} chars`);
+		lines.push(`  imageInput: ${result.imageInput}   anonymous: ${result.anonymous}` + (result.exampleQuestions.length ? `   exampleQuestions: ${result.exampleQuestions.length}` : ""));
+		if (result.warnings.length) {
+			lines.push("");
+			lines.push(yellow(`${result.warnings.length} warning(s):`));
+			lines.push(...renderWarnings(result.warnings));
+		}
+		return lines.join("\n");
+	}
+	lines.push(red(`✘ Invalid tutor`) + dim(` — ${source}`));
+	lines.push("");
+	lines.push(red(`${result.errors.length} error(s):`));
+	lines.push(...renderErrors(result.errors));
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/** Same renderer, for a standalone fragment-FILE check (`--kind fragment`). */
+function formatFragmentResult(result, source) {
+	const lines = [];
+	if (result.ok) {
+		lines.push(green(`✔ Valid fragment file`) + dim(` — ${source}`));
+		lines.push(`  id: ${result.fragmentFileId}`);
+		lines.push(`  fragments: ${result.fragmentIds.length}` + (result.fragmentIds.length ? ` (${result.fragmentIds.join(", ")})` : ""));
+		if (result.warnings.length) {
+			lines.push("");
+			lines.push(yellow(`${result.warnings.length} warning(s):`));
+			lines.push(...renderWarnings(result.warnings));
+		}
+		return lines.join("\n");
+	}
+	lines.push(red(`✘ Invalid fragment file`) + dim(` — ${source}`));
+	lines.push("");
+	lines.push(red(`${result.errors.length} error(s):`));
+	lines.push(...renderErrors(result.errors));
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/**
+* Shared tail for the quiz/writing renderers: on failure, the error list (with any
+* flattened Zod issues); plus any warnings on either branch.
+*/
+function renderFailureAndWarnings(result, label, source) {
+	const lines = [red(`✘ Invalid ${label}`) + dim(` — ${source}`), ""];
+	lines.push(red(`${result.errors.length} error(s):`));
+	lines.push(...renderErrors(result.errors));
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/** Renderer for a quiz check (`--kind quiz`). */
+function formatQuizResult(result, source) {
+	if (!result.ok) return renderFailureAndWarnings(result, "quiz", source);
+	const lines = [green(`✔ Valid quiz`) + dim(` — ${source}`)];
+	lines.push(`  id: ${result.quizId}`);
+	lines.push(`  model: ${result.model}`);
+	lines.push(`  questions: ${result.questionCount}   anonymous: ${result.anonymous}`);
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/** Renderer for a writing-activity check (`--kind writing`). */
+function formatWritingResult(result, source) {
+	if (!result.ok) return renderFailureAndWarnings(result, "writing activity", source);
+	const lines = [green(`✔ Valid writing activity`) + dim(` — ${source}`)];
+	lines.push(`  id: ${result.writingId}`);
+	lines.push(`  model: ${result.model}`);
+	lines.push(`  anonymous: ${result.anonymous}`);
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/**
+* Renderer for a coding-activity check (`--kind coding`). Coding is ALWAYS anonymous
+* (the API path carries no per-student identity), so — unlike quiz/writing — that is
+* shown as a fixed note, not a per-file value.
+*/
+function formatCodingResult(result, source) {
+	if (!result.ok) return renderFailureAndWarnings(result, "coding activity", source);
+	const lines = [green(`✔ Valid coding activity`) + dim(` — ${source}`)];
+	lines.push(`  id: ${result.codingId}`);
+	lines.push(`  model: ${result.model}`);
+	lines.push(`  anonymous: true ${dim("(always — the API path carries no identity)")}`);
+	if (result.warnings.length) {
+		lines.push("");
+		lines.push(yellow(`${result.warnings.length} warning(s):`));
+		lines.push(...renderWarnings(result.warnings));
+	}
+	return lines.join("\n");
+}
+/**
+* Renderer for a prompt dump (`prompts`). Kind-agnostic by construction: the envelope
+* (kind / id / provider+model) plus one line per prompt with its character count — the
+* sections come from `promptSections`, so a new kind needs no change here. `--json`
+* carries the prompt text itself.
+*/
+function formatPromptDump(dump, sections, source) {
+	const lines = [green(`✔ Prompts — ${dump.kind}`) + dim(` — ${source}`)];
+	lines.push(`  id: ${dump.id}`);
+	lines.push(`  provider: ${dump.llm.provider}   model: ${dump.llm.model}`);
+	lines.push(`  prompts: ${sections.length}`);
+	for (const section of sections) lines.push(`    ${section.name}: ${section.text.length} chars`);
+	lines.push("");
+	lines.push(dim("  Run again with --json for the full prompt text."));
+	return lines.join("\n");
+}
+//#endregion
+//#region ../lib/coding-schema.ts
+const CodingYamlSchema = z.strictObject({
+	id: z.string().min(1).meta({ description: "Short machine-readable activity id, e.g. beginner-typescript." }),
+	name: z.string().optional().meta({ description: "Optional human-readable label (not shown to the student)." }),
+	title: z.string().optional().meta({ description: "Optional label shown to the student on the /<code> connection page." }),
+	llm: z.strictObject({
+		model: z.string().min(1).meta({ description: "The model that answers. SERVER-ONLY and PINNED: the proxy always uses this model and ignores whatever model the coding agent sends." }),
+		provider: providerSchema
+	}).meta({
+		id: "llm",
+		description: "The pinned model and provider that answer coding requests."
+	}),
+	fragment_files: z.array(FragmentFileRefSchema).default([]).meta({ description: "Optional fragment libraries this activity pulls shared prompt fragments from." }),
+	text_files: z.array(TextFileRefSchema).default([]).meta({ description: "Optional plain-text files (markdown / source, e.g. a sample solution) embedded verbatim into instructions via {{file \"alias\"}} markers." }),
+	instructions: z.string().min(1).meta({ description: "The assistant's system prompt. SERVER-ONLY: never sent to the browser or the coding agent, and appended AFTER the coding tool's own prompt (so the teacher has the final word). Constrain the assistant to what your class has learned. When any fragment_files or text_files are declared it is a Handlebars template: place fragments inline with {{fragment \"alias.id\" …}} and embed text files with {{file \"alias\"}} (optionally {{file \"alias\" from=10 to=40}} for a line range; escape a literal {{ as \\{{)." })
+});
+//#endregion
+//#region ../lib/coding-validate.ts
+/**
+* Extract metadata from an already-schema-validated coding value. Split from
+* `checkCodingValue` so `loadAndCheckCoding` can reuse the single `validate` it already
+* ran (no second parse of the same document against the same schema).
+*/
+function checkCodingParsed(coding) {
+	return {
+		ok: true,
+		codingId: coding.id,
+		model: coding.llm.model,
+		provider: coding.llm.provider,
+		title: coding.title ?? null,
+		warnings: []
+	};
+}
+/**
+* Validate a coding FILE: scheme-gate + fetch + parse (shared `loadYaml`), then the
+* pure `checkCodingValue`. The web app passes the default http(s)-only schemes; the
+* CLI adds `file:` so a local coding YAML on disk validates too.
+*/
+async function loadAndCheckCoding(url, fetchImpl, opts = {}) {
+	const yaml = await loadYaml(url, fetchImpl, opts);
+	if (!yaml.ok) return {
+		ok: false,
+		errors: [yaml.error],
+		warnings: []
+	};
+	const valid = validate(yaml.value, CodingYamlSchema, "CODING_SCHEMA_ERROR", url);
+	if (!valid.ok) return {
+		ok: false,
+		errors: [valid.error],
+		warnings: []
+	};
+	const checked = checkCodingParsed(valid.data);
+	if (!checked.ok) return checked;
+	const assembled = await assembleFragmentPrompt({
+		fragment_files: valid.data.fragment_files,
+		text_files: valid.data.text_files
+	}, url, fetchImpl, {
+		allowedSchemes: opts.allowedSchemes,
+		validateLibraries: opts.validateLibraries ?? true
+	}, valid.data.instructions);
+	const warnings = [...checked.warnings, ...assembled.warnings];
+	if (!assembled.ok) return {
+		ok: false,
+		errors: assembled.errors,
+		warnings
+	};
+	return {
+		...checked,
+		warnings
+	};
+}
+//#endregion
+//#region ../lib/quiz-schema.ts
+/**
+* A live quiz include: alias + URL, mirroring `FragmentFileRefSchema` (same URL
+* contract). The alias prefixes every imported question id as `"<alias>/<id>"`, so
+* on top of the no-dot rule it may not contain a `/` either. Aliases live in their
+* OWN namespace (they never appear in `{{…}}` markers — only in question ids).
+*/
+const QuizFileRefSchema = z.strictObject({
+	id: z.string().regex(/^[^./]+$/, { message: "Alias must not contain a dot or a slash" }).meta({
+		pattern: "^[^./]+$",
+		description: "Local alias for this included quiz. Prefixes every imported question id as \"<alias>/<id>\", so it may not contain a dot or a slash."
+	}),
+	url: FragmentFileRefSchema.shape.url.meta({
+		pattern: "^(https?://|(?![A-Za-z][A-Za-z0-9+.-]*:).+)$",
+		description: "HTTP(S) URL or relative path to the included quiz file."
+	})
+}).meta({
+	id: "quizFileRef",
+	description: "A reference to another quiz file whose questions are included live."
+});
+/** An optional content image attached to a question (carries no secret). */
+const ImageRefSchema = z.strictObject({
+	hosted: z.boolean().optional().meta({
+		default: false,
+		description: "When true, src is an app-hosted image NAME resolved server-side; otherwise src is an absolute URL or a path relative to the quiz's own URL."
+	}),
+	src: z.string().min(1).meta({ description: "The hosted image name (when hosted) or the image URL / relative path." }),
+	alt: z.string().optional().meta({ description: "Accessible description shown if the image cannot be loaded." }),
+	credit: z.string().optional().meta({ description: "Optional attribution (\"Content Credentials\") shown small below the image." })
+}).meta({
+	id: "image",
+	description: "An optional content image attached to a question."
+});
+/**
+* One question. `id` keys the per-question stats (must be unique — see
+* `lib/quiz-validate.ts`); `question` is the Markdown shown to the student;
+* `evaluation` is the server-only grading prompt.
+*/
+const QuizQuestionSchema = z.strictObject({
+	id: z.string().min(1).meta({ description: "Stable question id, unique within the quiz (the per-question stats key)." }),
+	title: z.string().optional().meta({ description: "Optional short label for the stats table and progress display." }),
+	question: z.string().min(1).meta({ description: "The Markdown shown to the student." }),
+	evaluation: z.string().min(1).meta({ description: "The grading prompt. SERVER-ONLY: never sent to the browser, so it may embed the expected answer and the grading rubric." }),
+	image: ImageRefSchema.optional(),
+	imageInput: z.boolean().optional().meta({ description: "Overrides the quiz-level llm.imageInput for this question only (photo answers on/off)." })
+}).meta({
+	id: "question",
+	description: "One open-ended, LLM-graded quiz question."
+});
+const QuizYamlSchema = z.strictObject({
+	id: z.string().min(1).meta({ description: "Short machine-readable quiz id, e.g. countries-basics. Used as the per-quiz identity." }),
+	name: z.string().optional().meta({ description: "Optional human-readable quiz title (used as a label)." }),
+	title: z.string().optional().meta({ description: "Optional greeting shown to students on the welcome screen instead of the default message." }),
+	description: z.string().optional().meta({ description: "Optional description shown to students below the welcome greeting (Markdown)." }),
+	anonymous: z.boolean().optional().meta({
+		default: true,
 		description: "Quizzes are anonymous by default: answers are recorded for aggregate stats but not linked to a student. Set to false to attribute each attempt to the signed-in student."
 	}),
 	shuffle: z.boolean().optional().meta({
@@ -2466,118 +3571,37 @@ async function loadAndCheckQuiz(url, fetchImpl, opts = {}) {
 		errors: [valid.error],
 		warnings: []
 	};
-	const checked = checkQuizParsed(valid.data);
-	if (!checked.ok) return checked;
-	const assembled = await assembleFragmentPrompts({
-		fragment_files: valid.data.fragment_files,
-		text_files: valid.data.text_files
-	}, url, fetchImpl, {
-		allowedSchemes: opts.allowedSchemes,
-		validateLibraries: opts.validateLibraries ?? true
-	}, [valid.data.instructions ?? "", valid.data.discussion?.instructions ?? ""]);
-	const warnings = [...checked.warnings, ...assembled.warnings];
-	if (!assembled.ok) return {
-		ok: false,
-		errors: assembled.errors,
-		warnings
-	};
-	const includes = await Promise.all(valid.data.quiz_files.map((ref) => checkInclude(ref, url, fetchImpl, opts)));
-	const includeErrors = [];
-	let importedCount = 0;
-	for (const include of includes) {
-		warnings.push(...include.warnings);
-		if (include.ok) importedCount += include.questionCount;
-		else includeErrors.push(...include.errors);
-	}
-	if (includeErrors.length > 0) return {
-		ok: false,
-		errors: includeErrors,
-		warnings
-	};
-	return {
-		...checked,
-		questionCount: checked.questionCount + importedCount,
-		warnings
-	};
-}
-//#endregion
-//#region ../lib/tutors/schemas.ts
-/**
-* An example question offered to students on the welcome screen: the `title` is
-* the clickable label, the `question` is the full text placed into the chat
-* input on click. Tutors may define any number; the UI samples at most 5.
-*/
-const ExampleQuestionSchema = z.strictObject({
-	title: z.string().min(1).meta({ description: "Short clickable label shown on the welcome screen." }),
-	question: z.string().min(1).meta({ description: "Full question text. Shown as a tooltip and placed into the chat input on click." })
-}).meta({
-	id: "exampleQuestion",
-	description: "An example question shown on the welcome screen."
-});
-const TutorSchema = z.strictObject({
-	id: z.string().meta({ description: "Short machine-readable tutor id, e.g. fractions-de." }),
-	name: z.string().meta({ description: "Human-readable tutor title." }),
-	title: z.string().optional().meta({ description: "Optional greeting shown to students on the empty chat instead of the default welcome message." }),
-	description: z.string().meta({ description: "Short description of what this tutor does. Shown to students below the welcome greeting." }),
-	exampleQuestions: z.array(ExampleQuestionSchema).optional().meta({ description: "Optional example questions shown to students below the description on the empty chat. Clicking one puts the question text into the chat input. At most 5 are shown; with more, a random 5 are picked per page load." }),
-	anonymous: z.boolean().optional().meta({
-		default: true,
-		description: "Chats are anonymous by default: no link between the signed-in student and their chat is stored. Set to false to record which student each chat belongs to."
-	}),
-	llm: z.strictObject({
-		model: z.string().meta({ description: "Model used for this tutor." }),
-		provider: providerSchema,
-		imageInput: z.boolean().optional().meta({
-			default: true,
-			description: "Image uploads are enabled by default. Set to false to hide the upload UI for text-only tutors or non-vision-capable models."
-		})
-	}).meta({
-		id: "llm",
-		description: "The model and provider that back this tutor."
-	}),
-	prompt: z.strictObject({
-		fragment_files: z.array(FragmentFileRefSchema).default([]).meta({ description: "Optional fragment libraries used by this tutor." }),
-		text_files: z.array(TextFileRefSchema).default([]).meta({ description: "Optional plain-text files (markdown / source) embedded verbatim via {{file \"alias\"}} markers." }),
-		tutor_instructions: z.string().meta({ description: "The tutor's system prompt. When any fragment_files or text_files are declared this is a Handlebars template: place fragments inline with {{fragment \"alias.id\" key=\"v\"}} markers and embed text files with {{file \"alias\"}} (optionally {{file \"alias\" from=10 to=40}} for a line range; escape a literal {{ as \\{{). For single-file tutors it is the whole prompt." })
-	}).meta({
-		id: "prompt",
-		description: "The tutor system prompt: a host template with inline fragment markers."
-	})
-});
-//#endregion
-//#region ../lib/tutors/load.ts
-async function loadAndBuildTutorPrompt(url, fetchImpl, opts = {}) {
-	const warnings = [];
-	const tutorYaml = await loadYaml(url, fetchImpl, opts);
-	if (!tutorYaml.ok) return {
-		ok: false,
-		errors: [tutorYaml.error],
-		warnings
-	};
-	const tutorValid = validate(tutorYaml.value, TutorSchema, "TUTOR_SCHEMA_ERROR", url);
-	if (!tutorValid.ok) return {
-		ok: false,
-		errors: [tutorValid.error],
-		warnings
-	};
-	const tutor = tutorValid.data;
-	const assembled = await assembleFragmentPrompt(tutor.prompt, url, fetchImpl, opts, tutor.prompt.tutor_instructions);
-	warnings.push(...assembled.warnings);
+	const checked = checkQuizParsed(valid.data);
+	if (!checked.ok) return checked;
+	const assembled = await assembleFragmentPrompts({
+		fragment_files: valid.data.fragment_files,
+		text_files: valid.data.text_files
+	}, url, fetchImpl, {
+		allowedSchemes: opts.allowedSchemes,
+		validateLibraries: opts.validateLibraries ?? true
+	}, [valid.data.instructions ?? "", valid.data.discussion?.instructions ?? ""]);
+	const warnings = [...checked.warnings, ...assembled.warnings];
 	if (!assembled.ok) return {
 		ok: false,
 		errors: assembled.errors,
 		warnings
 	};
+	const includes = await Promise.all(valid.data.quiz_files.map((ref) => checkInclude(ref, url, fetchImpl, opts)));
+	const includeErrors = [];
+	let importedCount = 0;
+	for (const include of includes) {
+		warnings.push(...include.warnings);
+		if (include.ok) importedCount += include.questionCount;
+		else includeErrors.push(...include.errors);
+	}
+	if (includeErrors.length > 0) return {
+		ok: false,
+		errors: includeErrors,
+		warnings
+	};
 	return {
-		ok: true,
-		prompt: assembled.prompt,
-		model: tutor.llm.model,
-		provider: tutor.llm.provider,
-		imageInput: tutor.llm.imageInput ?? true,
-		anonymous: tutor.anonymous ?? true,
-		title: tutor.title,
-		description: tutor.description,
-		exampleQuestions: tutor.exampleQuestions ?? [],
+		...checked,
+		questionCount: checked.questionCount + importedCount,
 		warnings
 	};
 }
@@ -2663,173 +3687,6 @@ async function loadAndCheckWriting(url, fetchImpl, opts = {}) {
 	};
 }
 //#endregion
-//#region src/file-fetcher.ts
-const cliFetcher = async (url) => {
-	if (url.startsWith("file:")) try {
-		const text = await readFile(fileURLToPath(url), "utf8");
-		return {
-			ok: true,
-			status: 200,
-			text: async () => text
-		};
-	} catch {
-		return {
-			ok: false,
-			status: 404,
-			text: async () => ""
-		};
-	}
-	return defaultFetcher(url);
-};
-//#endregion
-//#region src/format.ts
-const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
-const paint = (code, s) => useColor ? `\x1b[${code}m${s}\x1b[0m` : s;
-const green = (s) => paint("32", s);
-const red = (s) => paint("31", s);
-const yellow = (s) => paint("33", s);
-const dim = (s) => paint("2", s);
-/** Append the context fields an error/warning carries, when present. */
-function context(item) {
-	const parts = [];
-	if (item.fileAlias) parts.push(`file=${item.fileAlias}`);
-	if (item.fragmentId) parts.push(`fragment=${item.fragmentId}`);
-	if ("questionId" in item && item.questionId) parts.push(`question=${item.questionId}`);
-	if (item.variable) parts.push(`variable=${item.variable}`);
-	if ("url" in item && item.url) parts.push(`url=${item.url}`);
-	if ("expectedType" in item && item.expectedType) parts.push(`expected=${item.expectedType}`);
-	if ("actualType" in item && item.actualType) parts.push(`actual=${item.actualType}`);
-	return parts.length ? dim(` (${parts.join(", ")})`) : "";
-}
-function renderWarnings(warnings) {
-	return warnings.map((w) => `  ${yellow("⚠")} ${yellow(w.code)} ${w.message}${context(w)}`);
-}
-/**
-* Render each error as a line, with any flattened Zod schema-issue detail
-* indented beneath it — so a generic "Document does not match the expected
-* structure" is followed by the actual field paths (e.g. `Unrecognized key:
-* "nae"`), matching what the web UI shows.
-*/
-function renderErrors(errors) {
-	const lines = [];
-	for (const e of errors) {
-		lines.push(`  ${red("✗")} ${red(e.code)} ${e.message}${context(e)}`);
-		if (e.zodIssues) for (const issue of formatZodIssues(e.zodIssues)) lines.push(`      ${dim(issue)}`);
-	}
-	return lines;
-}
-function formatResult(result, source) {
-	const lines = [];
-	if (result.ok) {
-		lines.push(green(`✔ Valid tutor`) + dim(` — ${source}`));
-		lines.push(`  model: ${result.model}`);
-		lines.push(`  system prompt: ${result.prompt.length} chars`);
-		lines.push(`  imageInput: ${result.imageInput}   anonymous: ${result.anonymous}` + (result.exampleQuestions.length ? `   exampleQuestions: ${result.exampleQuestions.length}` : ""));
-		if (result.warnings.length) {
-			lines.push("");
-			lines.push(yellow(`${result.warnings.length} warning(s):`));
-			lines.push(...renderWarnings(result.warnings));
-		}
-		return lines.join("\n");
-	}
-	lines.push(red(`✘ Invalid tutor`) + dim(` — ${source}`));
-	lines.push("");
-	lines.push(red(`${result.errors.length} error(s):`));
-	lines.push(...renderErrors(result.errors));
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/** Same renderer, for a standalone fragment-FILE check (`--kind fragment`). */
-function formatFragmentResult(result, source) {
-	const lines = [];
-	if (result.ok) {
-		lines.push(green(`✔ Valid fragment file`) + dim(` — ${source}`));
-		lines.push(`  id: ${result.fragmentFileId}`);
-		lines.push(`  fragments: ${result.fragmentIds.length}` + (result.fragmentIds.length ? ` (${result.fragmentIds.join(", ")})` : ""));
-		if (result.warnings.length) {
-			lines.push("");
-			lines.push(yellow(`${result.warnings.length} warning(s):`));
-			lines.push(...renderWarnings(result.warnings));
-		}
-		return lines.join("\n");
-	}
-	lines.push(red(`✘ Invalid fragment file`) + dim(` — ${source}`));
-	lines.push("");
-	lines.push(red(`${result.errors.length} error(s):`));
-	lines.push(...renderErrors(result.errors));
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/**
-* Shared tail for the quiz/writing renderers: on failure, the error list (with any
-* flattened Zod issues); plus any warnings on either branch.
-*/
-function renderFailureAndWarnings(result, label, source) {
-	const lines = [red(`✘ Invalid ${label}`) + dim(` — ${source}`), ""];
-	lines.push(red(`${result.errors.length} error(s):`));
-	lines.push(...renderErrors(result.errors));
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/** Renderer for a quiz check (`--kind quiz`). */
-function formatQuizResult(result, source) {
-	if (!result.ok) return renderFailureAndWarnings(result, "quiz", source);
-	const lines = [green(`✔ Valid quiz`) + dim(` — ${source}`)];
-	lines.push(`  id: ${result.quizId}`);
-	lines.push(`  model: ${result.model}`);
-	lines.push(`  questions: ${result.questionCount}   anonymous: ${result.anonymous}`);
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/** Renderer for a writing-activity check (`--kind writing`). */
-function formatWritingResult(result, source) {
-	if (!result.ok) return renderFailureAndWarnings(result, "writing activity", source);
-	const lines = [green(`✔ Valid writing activity`) + dim(` — ${source}`)];
-	lines.push(`  id: ${result.writingId}`);
-	lines.push(`  model: ${result.model}`);
-	lines.push(`  anonymous: ${result.anonymous}`);
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-/**
-* Renderer for a coding-activity check (`--kind coding`). Coding is ALWAYS anonymous
-* (the API path carries no per-student identity), so — unlike quiz/writing — that is
-* shown as a fixed note, not a per-file value.
-*/
-function formatCodingResult(result, source) {
-	if (!result.ok) return renderFailureAndWarnings(result, "coding activity", source);
-	const lines = [green(`✔ Valid coding activity`) + dim(` — ${source}`)];
-	lines.push(`  id: ${result.codingId}`);
-	lines.push(`  model: ${result.model}`);
-	lines.push(`  anonymous: true ${dim("(always — the API path carries no identity)")}`);
-	if (result.warnings.length) {
-		lines.push("");
-		lines.push(yellow(`${result.warnings.length} warning(s):`));
-		lines.push(...renderWarnings(result.warnings));
-	}
-	return lines.join("\n");
-}
-//#endregion
 //#region src/commands/validate.ts
 /** Every kind the `--kind` flag accepts (used for the option help + guard). */
 const VALIDATE_KINDS = [
@@ -2926,6 +3783,88 @@ function formatOutcome(outcome, source) {
 	}
 }
 //#endregion
+//#region src/commands/prompts.ts
+/**
+* The command's pure core: dump the prompts of a local file or public URL. `file:` is
+* allowed in addition to http(s) so an on-disk activity dumps (the web app deliberately
+* stays http(s)-only), and relative `fragment_files` / `quiz_files` resolve against the
+* activity's own location.
+*
+* This is the RUNTIME path — the lenient loaders the app runs when a student opens the
+* activity — so the output is what the model really receives. Use `validate` for the
+* strict authoring gate.
+*/
+function runPrompts(pathOrUrl, kind) {
+	return dumpPrompts(kind, toUrl(pathOrUrl), cliFetcher, { allowedSchemes: [
+		"http:",
+		"https:",
+		"file:"
+	] });
+}
+function registerPrompts(program) {
+	program.command("prompts").description("Print the exact LLM prompts a tutor (default), quiz, writing or coding YAML produces").argument("<pathOrUrl>", "path to a tutor, quiz, writing or coding YAML file, or a public http(s) URL").option("--kind <kind>", `what the file is: ${PROMPT_KINDS.map((k) => `'${k}'`).join(", ")} ('tutor' is the default)`, "tutor").option("--json", "print the full prompt dump as JSON").addHelpText("after", `
+Examples:
+  # The tutor's assembled system prompt (fragments resolved in place)
+  $ novedu-cli prompts ./activities/tutors/my-tutor.yaml
+
+  # Every grading prompt of a quiz, plus its discussion prompt, as JSON
+  $ novedu-cli prompts ./activities/quizzes/my-quiz.yaml --kind quiz --json
+
+  # A writing activity's coach prompt / a coding activity's injected system prompt
+  $ novedu-cli prompts ./activities/writings/my-writing.yaml --kind writing
+  $ novedu-cli prompts ./activities/coding/my-coding.yaml --kind coding
+
+  # One question's grading prompt, straight out of the JSON dump
+  $ novedu-cli prompts ./my-quiz.yaml --kind quiz --json | jq -r '.grading.questions[0].system'`).action(async (pathOrUrl, options) => {
+		if (options.kind !== void 0 && !PROMPT_KINDS.includes(options.kind)) {
+			console.error(`Invalid --kind "${options.kind}": expected ${PROMPT_KINDS.map((k) => `"${k}"`).join(", ")}.`);
+			process.exitCode = 1;
+			return;
+		}
+		const result = await runPrompts(pathOrUrl, options.kind ?? "tutor");
+		if (!result.ok) {
+			console.error(JSON.stringify({ errors: result.errors }, null, 2));
+			process.exitCode = 1;
+			return;
+		}
+		if (options.json) console.log(JSON.stringify(result.dump, null, 2));
+		else console.log(formatPromptDump(result.dump, promptSections(result.dump), pathOrUrl));
+		process.exitCode = 0;
+	});
+}
+//#endregion
+//#region src/commands/reports.ts
+const SERVER_OPTION = ["--server <url>", "Novedu server base URL (defaults to the NOVEDU_SERVER env var, then production)"];
+function registerReports(program) {
+	const reports = program.command("reports").description("Triage student reports on the Novedu server");
+	reports.command("list").description("List reports (defaults to open reports on your own codes, like the web inbox)").option("--status <status>", "open (default), resolved or all").option("--reaction <reaction>", "filter by reaction: good, omg, bad or holysh").option("--search <q>", "contains-filter over description, reporter, code and note").option("--all", "include reports on codes created by other teachers").option(...SERVER_OPTION).action(async (options) => {
+		const params = new URLSearchParams();
+		if (options.status) params.set("status", options.status);
+		if (options.reaction) params.set("reaction", options.reaction);
+		if (options.search) params.set("q", options.search);
+		if (options.all) params.set("mine", "0");
+		const query = params.toString();
+		await runApiRequest({
+			server: options.server,
+			path: `/api/reports${query ? `?${query}` : ""}`
+		});
+	});
+	reports.command("show <id>").description("Show one report; a chat report embeds its conversation transcript").option(...SERVER_OPTION).action(async (id, options) => {
+		await runApiRequest({
+			server: options.server,
+			path: `/api/reports/${encodeURIComponent(id)}`
+		});
+	});
+	reports.command("resolve <id...>").description("Resolve one or more reports by id (bulk, in a single request)").option(...SERVER_OPTION).action(async (ids, options) => {
+		await runApiRequest({
+			server: options.server,
+			path: "/api/reports/resolve",
+			method: "POST",
+			body: { ids }
+		});
+	});
+}
+//#endregion
 //#region src/commands/whoami.ts
 function registerWhoami(program) {
 	program.command("whoami").description("Show who is signed in by calling the Novedu server's /api/me").option("--server <url>", "Novedu server base URL (defaults to the NOVEDU_SERVER env var, then production)").action(async (options) => {
@@ -2966,6 +3905,7 @@ const { version } = JSON.parse(readFileSync(new URL("../package.json", import.me
 const program = new Command();
 program.name("novedu-cli").description("Command-line companion for the Novedu chat app").version(version);
 registerValidate(program);
+registerPrompts(program);
 registerLogin(program);
 registerLogout(program);
 registerWhoami(program);