@oscharko-dev/keiko 0.1.6 → 0.1.7

package/node_modules/ws/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "ws",
+  "version": "8.21.0",
+  "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
+  "keywords": [
+    "HyBi",
+    "Push",
+    "RFC-6455",
+    "WebSocket",
+    "WebSockets",
+    "real-time"
+  ],
+  "homepage": "https://github.com/websockets/ws",
+  "bugs": "https://github.com/websockets/ws/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/websockets/ws.git"
+  },
+  "author": "Einar Otto Stangvik <einaros@gmail.com> (http://2x.io)",
+  "license": "MIT",
+  "main": "index.js",
+  "exports": {
+    ".": {
+      "browser": "./browser.js",
+      "import": "./wrapper.mjs",
+      "require": "./index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "browser": "browser.js",
+  "engines": {
+    "node": ">=10.0.0"
+  },
+  "files": [
+    "browser.js",
+    "index.js",
+    "lib/*.js",
+    "wrapper.mjs"
+  ],
+  "scripts": {
+    "test": "nyc --reporter=lcov --reporter=text mocha --throw-deprecation test/*.test.js",
+    "integration": "mocha --throw-deprecation test/*.integration.js",
+    "lint": "eslint . && prettier --check --ignore-path .gitignore \"**/*.{json,md,yaml,yml}\""
+  },
+  "peerDependencies": {
+    "bufferutil": "^4.0.1",
+    "utf-8-validate": ">=5.0.2"
+  },
+  "peerDependenciesMeta": {
+    "bufferutil": {
+      "optional": true
+    },
+    "utf-8-validate": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "benchmark": "^2.1.4",
+    "bufferutil": "^4.0.1",
+    "eslint": "^10.0.1",
+    "eslint-config-prettier": "^10.0.1",
+    "eslint-plugin-prettier": "^5.0.0",
+    "globals": "^17.0.0",
+    "mocha": "^8.4.0",
+    "nyc": "^15.0.0",
+    "prettier": "^3.0.0",
+    "utf-8-validate": "^6.0.0"
+  }
+}

package/node_modules/ws/wrapper.mjs

@@ -0,0 +1,21 @@
+import createWebSocketStream from './lib/stream.js';
+import extension from './lib/extension.js';
+import PerMessageDeflate from './lib/permessage-deflate.js';
+import Receiver from './lib/receiver.js';
+import Sender from './lib/sender.js';
+import subprotocol from './lib/subprotocol.js';
+import WebSocket from './lib/websocket.js';
+import WebSocketServer from './lib/websocket-server.js';
+
+export {
+  createWebSocketStream,
+  extension,
+  PerMessageDeflate,
+  Receiver,
+  Sender,
+  subprotocol,
+  WebSocket,
+  WebSocketServer
+};
+
+export default WebSocket;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Enterprise model-agnostic developer-assist coding agent for regulated engineering workflows.",
   "type": "module",
   "license": "Apache-2.0",
@@ -8,6 +8,9 @@
     "node": ">=22"
   },
   "packageManager": "npm@10.9.8",
+  "workspaces": [
+    "packages/*"
+  ],
   "bin": {
     "keiko": "dist/cli/index.js"
   },
@@ -26,26 +29,35 @@
   ],
   "sideEffects": false,
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "build:packages": "npm --workspace @oscharko-dev/keiko-contracts run build && npm --workspace @oscharko-dev/keiko-security run build && npm --workspace @oscharko-dev/keiko-model-gateway run build && npm --workspace @oscharko-dev/keiko-workspace run build && npm --workspace @oscharko-dev/keiko-tools run build && npm --workspace @oscharko-dev/keiko-evidence run build && npm --workspace @oscharko-dev/keiko-harness run build && npm --workspace @oscharko-dev/keiko-workflows run build && npm --workspace @oscharko-dev/keiko-server run build && npm --workspace @oscharko-dev/keiko-cli run build",
+    "build": "npm run build:packages && tsc -p tsconfig.build.json",
+    "typecheck": "npm run build:packages && tsc -p tsconfig.json --noEmit",
     "lint": "eslint . --max-warnings=0",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
-    "ui:ci": "npm --prefix ui ci --ignore-scripts",
+    "test": "npm run build:packages && vitest run",
+    "test:coverage": "npm run build:packages && vitest run --coverage",
     "prepare:bin": "node scripts/ensure-bin-mode.mjs",
     "build:ui": "node scripts/build-ui.mjs",
     "check:package-surface": "node scripts/check-package-surface.mjs",
-    "prepack": "npm run clean && npm run build && npm run prepare:bin && npm run ui:ci && npm run build:ui && npm run check:package-surface",
-    "prepublishOnly": "npm run clean && npm run build && npm run prepare:bin && npm run ui:ci && npm run build:ui && npm run check:package-surface",
-    "clean": "rm -rf dist coverage"
+    "smoke:install": "node scripts/installable-package-smoke.mjs",
+    "check:workspace-supply-chain": "node scripts/check-workspace-supply-chain.mjs",
+    "arch:check": "depcruise --validate .dependency-cruiser.cjs src packages",
+    "arch:check:negative": "node scripts/arch-check-negative.mjs",
+    "prepack": "npm run clean && npm run build && npm run prepare:bin && npm run build:ui && npm run check:package-surface",
+    "prepublishOnly": "npm run clean && npm run build && npm run prepare:bin && npm run build:ui && npm run check:package-surface",
+    "clean": "rm -rf dist coverage packages/keiko-contracts/dist packages/keiko-security/dist packages/keiko-model-gateway/dist packages/keiko-workspace/dist packages/keiko-tools/dist packages/keiko-evidence/dist packages/keiko-harness/dist packages/keiko-workflows/dist packages/keiko-server/dist packages/keiko-cli/dist packages/keiko-ui/.next packages/keiko-ui/out"
+  },
+  "overrides": {
+    "postcss": "8.5.15",
+    "sharp": "npm:empty-npm-package@1.0.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/node": "^25.9.1",
     "@types/ws": "^8.18.1",
     "@vitest/coverage-v8": "^4.1.7",
+    "dependency-cruiser": "^17.4.3",
     "eslint": "^10.4.0",
     "eslint-config-prettier": "^10.1.8",
     "prettier": "^3.0.0",
@@ -54,6 +66,28 @@
     "vitest": "^4.1.7"
   },
   "dependencies": {
+    "@oscharko-dev/keiko-cli": "*",
+    "@oscharko-dev/keiko-contracts": "*",
+    "@oscharko-dev/keiko-evidence": "*",
+    "@oscharko-dev/keiko-harness": "*",
+    "@oscharko-dev/keiko-model-gateway": "*",
+    "@oscharko-dev/keiko-security": "*",
+    "@oscharko-dev/keiko-server": "*",
+    "@oscharko-dev/keiko-tools": "*",
+    "@oscharko-dev/keiko-workflows": "*",
+    "@oscharko-dev/keiko-workspace": "*",
     "ws": "^8.21.0"
-  }
+  },
+  "bundleDependencies": [
+    "@oscharko-dev/keiko-contracts",
+    "@oscharko-dev/keiko-security",
+    "@oscharko-dev/keiko-model-gateway",
+    "@oscharko-dev/keiko-workspace",
+    "@oscharko-dev/keiko-tools",
+    "@oscharko-dev/keiko-evidence",
+    "@oscharko-dev/keiko-harness",
+    "@oscharko-dev/keiko-workflows",
+    "@oscharko-dev/keiko-server",
+    "@oscharko-dev/keiko-cli"
+  ]
 }

package/dist/cli/context.d.ts

@@ -1,2 +0,0 @@
-import type { CliIo } from "./runner.js";
-export declare function runContextCli(args: readonly string[], io: CliIo): number;

package/dist/cli/context.js

@@ -1,102 +0,0 @@
-// `keiko context` — a DRY-RUN-BY-CONSTRUCTION repository-context summary. It detects a
-// workspace, builds a redacted structured summary (and a context pack when --task/--budget is
-// given), and prints a human table or JSON. It NEVER constructs an agent session and NEVER
-// calls a model: there is no import of the harness/gateway run path in this file.
-import { detectWorkspace } from "../workspace/detect.js";
-import { discoverWithStats } from "../workspace/discovery.js";
-import { buildContextPackFromFiles } from "../workspace/contextPack.js";
-import { buildWorkspaceSummary } from "../workspace/summary.js";
-import { WorkspaceError } from "../workspace/errors.js";
-import { DEFAULT_CONTEXT_REQUEST } from "../workspace/types.js";
-const USAGE = `Usage:
-  keiko context [--dir PATH] [--task TEXT] [--budget BYTES] [--json]
-
-Detects the workspace, prints a redacted context summary, and (with --task or
---budget) a deterministic context pack. Dry-run by construction: no model is called.
-`;
-// Returns the value of a `--flag value` pair, `undefined` if absent, or `null` if the flag is
-// present but missing its value (a usage error).
-function flagValue(args, name) {
-    const i = args.indexOf(name);
-    if (i === -1) {
-        return undefined;
-    }
-    const value = args[i + 1];
-    return value === undefined || value.startsWith("--") ? null : value;
-}
-function parseArgs(args) {
-    const dirRaw = flagValue(args, "--dir");
-    const taskRaw = flagValue(args, "--task");
-    const budgetRaw = flagValue(args, "--budget");
-    if (dirRaw === null || taskRaw === null || budgetRaw === null) {
-        return null;
-    }
-    if (budgetRaw !== undefined && !/^[1-9][0-9]*$/.test(budgetRaw)) {
-        return null;
-    }
-    const budget = budgetRaw === undefined ? undefined : Number.parseInt(budgetRaw, 10);
-    if (budget !== undefined && !Number.isSafeInteger(budget)) {
-        return null;
-    }
-    return { dir: dirRaw ?? ".", task: taskRaw, budget, json: args.includes("--json") };
-}
-function buildSummary(parsed) {
-    const workspace = detectWorkspace(parsed.dir);
-    const { files, stats } = discoverWithStats(workspace, DEFAULT_CONTEXT_REQUEST.discovery);
-    const wantsPack = parsed.task !== undefined || parsed.budget !== undefined;
-    if (!wantsPack) {
-        return buildWorkspaceSummary(workspace, undefined, stats);
-    }
-    const pack = buildContextPackFromFiles(workspace, {
-        ...DEFAULT_CONTEXT_REQUEST,
-        task: parsed.task,
-        budgetBytes: parsed.budget ?? DEFAULT_CONTEXT_REQUEST.budgetBytes,
-    }, files);
-    return buildWorkspaceSummary(workspace, pack, stats);
-}
-function renderContext(summary, io) {
-    const context = summary.context;
-    if (context === undefined) {
-        return;
-    }
-    io.out(`Context:   used=${String(context.usedBytes)}/${String(context.budgetBytes)} bytes, dropped=${String(context.droppedForBudget)}\n`);
-    io.out("PATH\tREASON\tSIZE\tEXCERPT-BYTES\tTRUNCATED\n");
-    for (const entry of context.entries) {
-        io.out(`${entry.path}\t${entry.selectionReason}\t${String(entry.sizeBytes)}\t${String(entry.excerptBytes)}\t${entry.truncated ? "yes" : "no"}\n`);
-    }
-}
-function renderText(summary, io) {
-    io.out(`Workspace: ${summary.root}\n`);
-    io.out(`Name:      ${summary.name ?? "(none)"}\n`);
-    io.out(`Version:   ${summary.version ?? "(none)"}\n`);
-    io.out(`Framework: ${summary.testFramework}\n`);
-    io.out(`Sources:   ${summary.sourceDirs.join(", ") || "(none)"}\n`);
-    io.out(`Tests:     ${summary.testDirs.join(", ") || "(none)"}\n`);
-    io.out(`Languages: ${summary.languages.join(", ")}\n`);
-    io.out(`Counts:    discovered=${String(summary.counts.discovered)} denied=${String(summary.counts.denied)} ignored=${String(summary.counts.ignored)}\n`);
-    renderContext(summary, io);
-}
-export function runContextCli(args, io) {
-    const parsed = parseArgs(args);
-    if (parsed === null) {
-        io.err(USAGE);
-        return 2;
-    }
-    try {
-        const summary = buildSummary(parsed);
-        if (parsed.json) {
-            io.out(`${JSON.stringify(summary, null, 2)}\n`);
-        }
-        else {
-            renderText(summary, io);
-        }
-        return 0;
-    }
-    catch (error) {
-        if (error instanceof WorkspaceError) {
-            io.err(`Error [${error.code}]: ${error.message}\n`);
-            return 1;
-        }
-        throw error;
-    }
-}

package/dist/cli/evaluate.d.ts

@@ -1,7 +0,0 @@
-import type { EnvSource } from "../gateway/config.js";
-import { type EvalRunnerDeps } from "../evaluations/index.js";
-import type { CliIo } from "./runner.js";
-export interface EvaluateDeps {
-    readonly runner?: EvalRunnerDeps | undefined;
-}
-export declare function runEvaluateCli(args: readonly string[], io: CliIo, env?: EnvSource, deps?: EvaluateDeps): Promise<number>;

package/dist/cli/evaluate.js

@@ -1,207 +0,0 @@
-// `keiko evaluate` — runs the evaluation harness (ADR-0012 D10). Offline (default, deterministic, no
-// network) replays each fixture's scripted transcript; --live builds a GatewayModelPort and fails
-// CLOSED (exit 1, names the required env vars) when no config/credentials resolve — it NEVER silently
-// falls back to offline. Dry-run-safe by construction: fixtures choose their own apply mode. Mirrors
-// runGenTestsCli structurally (injected CliIo + deps, testable without process.*). Exit 0 when all
-// applicable dimensions pass AND surface parity passes; 1 on dimension/parity failure or runtime
-// error; 2 on usage error (unknown flag, mutual exclusion, unknown suite/fixture name).
-import { writeFileSync } from "node:fs";
-import { GatewayError } from "../gateway/errors.js";
-import { redact } from "../gateway/redaction.js";
-import { createAuditRedactor, deepRedactStrings } from "../audit/index.js";
-import { fixtureByName, fixturesForSuite, isSuiteName, renderEvalSummary, runEvaluationSuite, } from "../evaluations/index.js";
-const USAGE = `Usage:
-  keiko evaluate [--suite <unit-tests|bug-investigation|all>] [--fixture <name>]
-                 [--live] [--model <id>] [--config PATH] [--json] [--output <path>]
-
-Runs the evaluation harness against the built-in fixtures. Offline by default
-(deterministic, no network); pass --live to evaluate against a configured model.
---suite and --fixture are mutually exclusive.
-`;
-function flagValue(args, name) {
-    const i = args.indexOf(name);
-    if (i === -1) {
-        return undefined;
-    }
-    const value = args[i + 1];
-    return value === undefined || value.startsWith("--") ? null : value;
-}
-const VALUE_FLAGS = ["--suite", "--fixture", "--model", "--config", "--output"];
-const BOOLEAN_FLAGS = ["--live", "--json"];
-function readValueFlags(args) {
-    const values = {};
-    for (const flag of VALUE_FLAGS) {
-        const value = flagValue(args, flag);
-        if (value === null) {
-            return null;
-        }
-        values[flag] = value;
-    }
-    return values;
-}
-function isValueFlag(value) {
-    return VALUE_FLAGS.includes(value);
-}
-function isBooleanFlag(value) {
-    return BOOLEAN_FLAGS.includes(value);
-}
-function findUsageError(args) {
-    for (let i = 0; i < args.length; i += 1) {
-        const arg = args[i];
-        if (arg === undefined) {
-            continue;
-        }
-        if (isValueFlag(arg)) {
-            const value = args[i + 1];
-            if (value === undefined || value.startsWith("--")) {
-                return `missing value for ${arg}`;
-            }
-            i += 1;
-            continue;
-        }
-        if (isBooleanFlag(arg)) {
-            continue;
-        }
-        return arg.startsWith("--") ? `unknown flag ${arg}` : `unexpected argument ${arg}`;
-    }
-    return undefined;
-}
-function parseArgs(args) {
-    const values = readValueFlags(args);
-    if (values === null) {
-        return null;
-    }
-    return {
-        suite: values["--suite"],
-        fixture: values["--fixture"],
-        live: args.includes("--live"),
-        model: values["--model"],
-        config: values["--config"],
-        json: args.includes("--json"),
-        output: values["--output"],
-    };
-}
-// Resolves the fixture set from --suite / --fixture, enforcing mutual exclusion and name validity.
-function selectFixtures(parsed) {
-    if (parsed.suite !== undefined && parsed.fixture !== undefined) {
-        return { usageError: "Error: --suite and --fixture are mutually exclusive.\n" };
-    }
-    if (parsed.fixture !== undefined) {
-        const fixture = fixtureByName(parsed.fixture);
-        return fixture === undefined
-            ? { usageError: `Error: unknown fixture "${parsed.fixture}".\n` }
-            : { fixtures: [fixture] };
-    }
-    const suite = parsed.suite ?? "all";
-    if (!isSuiteName(suite)) {
-        return { usageError: `Error: unknown suite "${suite}".\n` };
-    }
-    return { fixtures: fixturesForSuite(suite) };
-}
-// In live mode, deep-redact the scorecard before serialization so that any model content that
-// leaked into workflow report fields (e.g. fixture reasons) is scrubbed by the same audit
-// redactor applied at evidence-persist time. Offline scorecard is static harness text — safe as-is.
-function redactedScorecard(scorecard, live, env) {
-    if (!live) {
-        return scorecard;
-    }
-    const redactFn = createAuditRedactor({ additionalSecrets: keikoApiKeySecrets(env) }, env);
-    return deepRedactStrings(scorecard, redactFn);
-}
-function isKeikoApiKeyEnvName(name) {
-    return (name === "KEIKO_DEFAULT_API_KEY" ||
-        (name.startsWith("KEIKO_MODEL_") && name.endsWith("_API_KEY")));
-}
-function keikoApiKeySecrets(env) {
-    const secrets = [];
-    for (const [name, value] of Object.entries(env)) {
-        if (value !== undefined && isKeikoApiKeyEnvName(name)) {
-            secrets.push(value);
-        }
-    }
-    return secrets;
-}
-function writeScorecard(path, output) {
-    writeFileSync(path, `${JSON.stringify(output, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
-}
-function emit(scorecard, parsed, io, env) {
-    const output = redactedScorecard(scorecard, parsed.live, env);
-    if (parsed.output !== undefined) {
-        writeScorecard(parsed.output, output);
-    }
-    if (parsed.json) {
-        io.out(`${JSON.stringify(output, null, 2)}\n`);
-        return;
-    }
-    io.out(`${renderEvalSummary(scorecard)}\n`);
-}
-// Exit 0 only when every scored dimension passed (zero failures) AND surface parity passed.
-function exitCodeFor(scorecard) {
-    if (!scorecard.surfaceParity.allPassed) {
-        return 1;
-    }
-    return scorecard.dimensions.some((d) => d.failCount > 0) ? 1 : 0;
-}
-export async function runEvaluateCli(args, io, env = {}, deps = {}) {
-    if (args.includes("--help")) {
-        io.out(USAGE);
-        return 0;
-    }
-    const usageError = findUsageError(args);
-    if (usageError !== undefined) {
-        io.err(`Error: ${usageError}.\n${USAGE}`);
-        return 2;
-    }
-    const parsed = parseArgs(args);
-    if (parsed === null) {
-        io.err(USAGE);
-        return 2;
-    }
-    const selection = selectFixtures(parsed);
-    if ("usageError" in selection) {
-        io.err(selection.usageError);
-        return 2;
-    }
-    return runSuite(parsed, selection.fixtures, io, env, deps);
-}
-async function runSuite(parsed, fixtures, io, env, deps) {
-    try {
-        const scorecard = await runEvaluationSuite({
-            mode: parsed.live ? "live" : "offline",
-            fixtures,
-            ...(parsed.model === undefined ? {} : { modelIdOverride: parsed.model }),
-            ...(parsed.config === undefined ? {} : { configPath: parsed.config }),
-        }, 
-        // Provide Date.now as the default wall-clock so a real `keiko evaluate` prints the actual
-        // current time. Tests override this via deps.runner.now for deterministic evaluatedAt.
-        { env, now: Date.now, ...deps.runner });
-        emit(scorecard, parsed, io, env);
-        return exitCodeFor(scorecard);
-    }
-    catch (error) {
-        if (isOutputAlreadyExistsError(error)) {
-            io.err(`Error: output file already exists: ${parsed.output ?? "<unknown>"}\n`);
-            return 1;
-        }
-        return handleRunError(error, parsed, io);
-    }
-}
-function isOutputAlreadyExistsError(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        error.code === "EEXIST");
-}
-// Live-mode fail-closed: a GatewayError (incl. ConfigInvalidError) means no resolvable config or
-// credentials. Name the required env vars and exit 1 — never fall back to offline silently.
-function handleRunError(error, parsed, io) {
-    if (error instanceof GatewayError) {
-        io.err(`Error: model gateway configuration problem — ${redact(error.message)}\n` +
-            (parsed.live
-                ? "Live evaluation requires a configured provider. Pass --config PATH or set " +
-                    "KEIKO_CONFIG_FILE.\n"
-                : ""));
-        return 1;
-    }
-    throw error;
-}

package/dist/cli/evidence.d.ts

@@ -1,8 +0,0 @@
-import { type EvidenceStore } from "../audit/store.js";
-import type { EnvSource } from "../gateway/config.js";
-import type { CliIo } from "./runner.js";
-export interface EvidenceCliDeps {
-    readonly store?: EvidenceStore | undefined;
-    readonly env?: EnvSource | undefined;
-}
-export declare function runEvidenceCli(args: readonly string[], io: CliIo, deps?: EvidenceCliDeps): number;

package/dist/cli/evidence.js

@@ -1,88 +0,0 @@
-// `keiko evidence` — inspects previously written evidence manifests (ADR-0010 D9). `list` prints the
-// EvidenceListEntry[] (text or --json); `show <runId>` prints one EvidenceReport / full manifest
-// (--json). It reads ONLY the contained base dir via the EvidenceStore (default $KEIKO_EVIDENCE_DIR
-// or ./.keiko/evidence, overridable with --evidence-dir). Because manifests are redacted by
-// construction there is no un-redaction path. Exit 0 on success, 1 on a missing runId / read error,
-// 2 on usage (unknown or missing subcommand, invalid runId). Tests inject an in-memory store via deps
-// so no disk is touched.
-import { buildEvidenceReport, renderEvidenceReport } from "../audit/report.js";
-import { listEvidence, loadEvidence } from "../audit/index-api.js";
-import { createNodeEvidenceStore, resolveEvidenceDir } from "../audit/store.js";
-import { AuditError, InvalidRunIdError } from "../audit/errors.js";
-const USAGE = `Usage:
-  keiko evidence list [--evidence-dir PATH] [--json]
-  keiko evidence show <runId> [--evidence-dir PATH] [--json]
-
-Lists or shows redacted evidence manifests written by \`keiko run\`. Reads only the
-evidence base dir (default $KEIKO_EVIDENCE_DIR or ./.keiko/evidence; override with --evidence-dir).
-`;
-function flagValue(args, name) {
-    const i = args.indexOf(name);
-    if (i === -1) {
-        return undefined;
-    }
-    const value = args[i + 1];
-    return value === undefined || value.startsWith("--") ? undefined : value;
-}
-function resolveStore(args, deps) {
-    if (deps.store !== undefined) {
-        return deps.store;
-    }
-    return createNodeEvidenceStore(resolveEvidenceDir(flagValue(args, "--evidence-dir"), deps.env));
-}
-function renderListText(entries) {
-    if (entries.length === 0) {
-        return "No evidence manifests found.\n";
-    }
-    const rows = entries.map((e) => `${e.runId}  ${e.taskType}  ${e.outcome}  started=${String(e.startedAt)} finished=${String(e.finishedAt)}`);
-    return `${rows.join("\n")}\n`;
-}
-function runList(store, json, io) {
-    const entries = listEvidence(store);
-    io.out(json ? `${JSON.stringify(entries, null, 2)}\n` : renderListText(entries));
-    return 0;
-}
-function runShow(store, runId, json, io) {
-    const manifest = loadEvidence(store, runId);
-    if (manifest === undefined) {
-        io.err(`keiko evidence: no manifest for runId: ${runId}\n`);
-        return 1;
-    }
-    if (json) {
-        io.out(`${JSON.stringify(manifest, null, 2)}\n`);
-        return 0;
-    }
-    io.out(renderEvidenceReport(buildEvidenceReport(manifest, store.location?.(runId) ?? `${runId}.json`)));
-    return 0;
-}
-// Maps a thrown AuditError to an exit code: an invalid runId is a usage error (2), any other
-// audit/read failure is a runtime error (1). Messages are already redacted at construction.
-function exitForAuditError(error, io) {
-    io.err(`keiko evidence: ${error.message}\n`);
-    return error instanceof InvalidRunIdError ? 2 : 1;
-}
-export function runEvidenceCli(args, io, deps = {}) {
-    const sub = args[0];
-    const json = args.includes("--json");
-    try {
-        if (sub === "list") {
-            return runList(resolveStore(args, deps), json, io);
-        }
-        if (sub === "show") {
-            const runId = args[1];
-            if (runId === undefined || runId.startsWith("--")) {
-                io.err(`keiko evidence: show requires a <runId>.\n${USAGE}`);
-                return 2;
-            }
-            return runShow(resolveStore(args, deps), runId, json, io);
-        }
-        io.err(sub === undefined ? USAGE : `keiko evidence: unknown subcommand: ${sub}\n${USAGE}`);
-        return 2;
-    }
-    catch (error) {
-        if (error instanceof AuditError) {
-            return exitForAuditError(error, io);
-        }
-        throw error;
-    }
-}

package/dist/cli/gateway-config.d.ts

@@ -1,10 +0,0 @@
-import type { EnvSource } from "../gateway/index.js";
-export type ConfigPathResolution = {
-    readonly kind: "path";
-    readonly path: string;
-} | {
-    readonly kind: "missing-value";
-} | {
-    readonly kind: "not-configured";
-};
-export declare function resolveConfigPathFromArgs(args: readonly string[], env: EnvSource): ConfigPathResolution;

package/dist/cli/gen-tests.d.ts

@@ -1,7 +0,0 @@
-import { type EnvSource } from "../gateway/config.js";
-import type { ModelPort } from "../harness/ports.js";
-import type { CliIo } from "./runner.js";
-export interface GenTestsDeps {
-    readonly model?: ModelPort | undefined;
-}
-export declare function runGenTestsCli(args: readonly string[], io: CliIo, env?: EnvSource, deps?: GenTestsDeps): Promise<number>;