@plune-ai/cli 0.20.0 → 0.21.0

package/dist/cli.cjs

@@ -3644,6 +3644,477 @@ var init_run_lifecycle = __esm({
   }
 });
 
+// src/types/run-result-schema.ts
+function parseRunResult(value2) {
+  return runResultSchema.parse(value2);
+}
+var import_zod3, RUN_RESULT_SCHEMA_VERSION, binaryVerdictSchema, assertionResultRecordSchema2, usageSchema, runErrorSchema, rowResultSchema, summarySchema, evalResultSchema, runResultSchema;
+var init_run_result_schema = __esm({
+  "src/types/run-result-schema.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod3 = require("zod");
+    init_results();
+    RUN_RESULT_SCHEMA_VERSION = 1;
+    binaryVerdictSchema = import_zod3.z.object({
+      question: import_zod3.z.string().min(1),
+      passed: import_zod3.z.boolean()
+    });
+    assertionResultRecordSchema2 = import_zod3.z.object({
+      type: import_zod3.z.string(),
+      passed: import_zod3.z.boolean(),
+      score: import_zod3.z.number().optional(),
+      reason: import_zod3.z.string().optional(),
+      binaryVerdicts: import_zod3.z.array(binaryVerdictSchema).optional()
+    });
+    usageSchema = import_zod3.z.object({
+      input_tokens: import_zod3.z.number(),
+      output_tokens: import_zod3.z.number(),
+      cost_usd: import_zod3.z.number()
+    });
+    runErrorSchema = import_zod3.z.object({
+      code: import_zod3.z.string(),
+      message: import_zod3.z.string()
+    });
+    rowResultSchema = import_zod3.z.object({
+      vars: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
+      output: import_zod3.z.string().nullable(),
+      cached: import_zod3.z.boolean(),
+      usage: usageSchema.optional(),
+      latency_ms: import_zod3.z.number().optional(),
+      error: runErrorSchema.optional(),
+      assertions: import_zod3.z.array(assertionResultRecordSchema2),
+      /** ADR 0045. Optional and additive — the same enum the platform validates on `POST /v1/runs`. */
+      inconclusive: import_zod3.z.enum(ROW_INCONCLUSIVE).optional()
+    });
+    summarySchema = import_zod3.z.object({
+      total: import_zod3.z.number(),
+      passed: import_zod3.z.number(),
+      failed: import_zod3.z.number(),
+      errored: import_zod3.z.number(),
+      /** plune#1245. Optional and additive — a RunResult written before them validates unchanged. */
+      blocked: import_zod3.z.number().optional(),
+      skipped: import_zod3.z.number().optional(),
+      cost_usd: import_zod3.z.number(),
+      duration_ms: import_zod3.z.number()
+    });
+    evalResultSchema = import_zod3.z.object({
+      id: import_zod3.z.string(),
+      tags: import_zod3.z.array(import_zod3.z.string()),
+      rows: import_zod3.z.array(rowResultSchema),
+      passed: import_zod3.z.boolean()
+    });
+    runResultSchema = import_zod3.z.object({
+      schemaVersion: import_zod3.z.literal(RUN_RESULT_SCHEMA_VERSION),
+      plune_version: import_zod3.z.string(),
+      started_at: import_zod3.z.string(),
+      finished_at: import_zod3.z.string(),
+      config_hash: import_zod3.z.string(),
+      summary: summarySchema,
+      evals: import_zod3.z.array(evalResultSchema)
+    });
+  }
+});
+
+// src/cli/commands/sync.ts
+var sync_exports = {};
+__export(sync_exports, {
+  NotLoggedInError: () => NotLoggedInError,
+  SyncFileError: () => SyncFileError,
+  SyncHttpError: () => SyncHttpError,
+  SyncNetworkError: () => SyncNetworkError,
+  TokenRejectedError: () => TokenRejectedError,
+  handleSync: () => handleSync,
+  reportSyncFailure: () => reportSyncFailure
+});
+function readRun(cwd, file) {
+  const target = file !== void 0 ? path9.resolve(cwd, file) : path9.join(cwd, ".plune", "last-run.json");
+  let raw;
+  try {
+    raw = fs8.readFileSync(target, "utf8");
+  } catch {
+    throw new SyncFileError(
+      file !== void 0 ? `Run file not found: ${target}` : 'No run to sync. Run "plune run" first (or pass --file <path>).'
+    );
+  }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new SyncFileError(`Run file is not valid JSON: ${target}`);
+  }
+  try {
+    return parseRunResult(json);
+  } catch {
+    throw new SyncFileError(`Run file does not match the RunResult schema: ${target}`);
+  }
+}
+async function safeErrorDetail(res) {
+  try {
+    const body = await res.json();
+    return typeof body.error === "string" ? body.error : "";
+  } catch {
+    return "";
+  }
+}
+async function handleSync(deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const apiUrl = resolveApiUrl(deps.apiUrl);
+  const token = (deps.loadToken ?? loadToken)();
+  if (token === null) throw new NotLoggedInError();
+  const run = readRun(cwd, deps.file);
+  const doFetch = deps.fetchImpl ?? fetch;
+  const endpoint = `${apiUrl}/v1/runs`;
+  let res;
+  try {
+    res = await doFetch(endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+      body: JSON.stringify(run)
+    });
+  } catch {
+    throw new SyncNetworkError(apiUrl);
+  }
+  if (!res.ok) {
+    const detail = await safeErrorDetail(res);
+    if (res.status === 401) throw new TokenRejectedError();
+    throw new SyncHttpError(res.status, detail);
+  }
+  const body = await res.json().catch(() => ({}));
+  const id = typeof body.id === "string" ? body.id : "";
+  const result = { id, url: `${endpoint}/${id}` };
+  if (deps.failOnFailures === true) result.gate = gateExit(await readVerdict(doFetch, `${endpoint}/${id}/summary`, token));
+  return result;
+}
+async function readVerdict(doFetch, url, token) {
+  try {
+    const res = await doFetch(url, { method: "GET", headers: { authorization: `Bearer ${token}` } });
+    const body = await res.json().catch(() => void 0);
+    return res.ok ? { statusEvent: body?.run?.statusEvent, counts: body?.counts, notRun: body?.notRun } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function reportSyncFailure(err, write) {
+  if (err instanceof NotLoggedInError || err instanceof TokenRejectedError || err instanceof SyncFileError) {
+    write(err.message + "\n");
+    return 2;
+  }
+  if (err instanceof SyncNetworkError || err instanceof SyncHttpError) {
+    write(err.message + "\n");
+    return 1;
+  }
+  return null;
+}
+var fs8, path9, NotLoggedInError, TokenRejectedError, SyncFileError, SyncNetworkError, SyncHttpError;
+var init_sync = __esm({
+  "src/cli/commands/sync.ts"() {
+    "use strict";
+    init_cjs_shims();
+    fs8 = __toESM(require("fs"), 1);
+    path9 = __toESM(require("path"), 1);
+    init_run_result_schema();
+    init_api_url();
+    init_credentials();
+    init_gate();
+    NotLoggedInError = class extends Error {
+      constructor() {
+        super('Not logged in. Run "plune login" first, or set PLUNE_TOKEN.');
+        this.name = "NotLoggedInError";
+      }
+    };
+    TokenRejectedError = class extends Error {
+      constructor() {
+        super(
+          'Your API token was rejected (revoked or invalid). Run "plune login" with a fresh token.'
+        );
+        this.name = "TokenRejectedError";
+      }
+    };
+    SyncFileError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "SyncFileError";
+      }
+    };
+    SyncNetworkError = class extends Error {
+      constructor(apiUrl) {
+        super(
+          `Could not reach the Plune API at ${apiUrl}. Check your connection (or PLUNE_API_URL) and try again.`
+        );
+        this.name = "SyncNetworkError";
+      }
+    };
+    SyncHttpError = class extends Error {
+      constructor(status, detail) {
+        super(`Sync failed \u2014 the server returned HTTP ${status}${detail ? ` (${detail})` : ""}.`);
+        this.status = status;
+        this.name = "SyncHttpError";
+      }
+      status;
+    };
+  }
+});
+
+// src/cli/commands/plan.ts
+var plan_exports = {};
+__export(plan_exports, {
+  RunRefError: () => RunRefError,
+  formatGrep: () => formatGrep,
+  grepFragment: () => grepFragment,
+  handlePlanGrep: () => handlePlanGrep,
+  handleRunGrep: () => handleRunGrep,
+  runGrepSummary: () => runGrepSummary
+});
+function grepFragment(c) {
+  const pathTitle = c.externalKeys.find((k) => k.kind === "path-title")?.value;
+  const segments = pathTitle?.split("#") ?? [c.title];
+  return (segments.length > 1 ? segments.slice(1) : segments).flatMap((s) => s.split(/ [>›] /)).map(escape).join(BOUNDARY);
+}
+function formatGrep(cases) {
+  if (cases.length === 0) return "(?!)";
+  return cases.map(grepFragment).join("|");
+}
+async function safeErrorDetail2(res) {
+  try {
+    const body = await res.json();
+    return typeof body.error === "string" ? body.error : "";
+  } catch {
+    return "";
+  }
+}
+function platformGet(deps) {
+  const apiUrl = resolveApiUrl(deps.apiUrl);
+  const token = (deps.loadToken ?? loadToken)();
+  if (token === null) throw new NotLoggedInError();
+  const doFetch = deps.fetchImpl ?? fetch;
+  return async (path17) => {
+    let res;
+    try {
+      res = await doFetch(`${apiUrl}${path17}`, { headers: { authorization: `Bearer ${token}` } });
+    } catch {
+      throw new SyncNetworkError(apiUrl);
+    }
+    if (!res.ok) {
+      const detail = await safeErrorDetail2(res);
+      if (res.status === 401) throw new TokenRejectedError();
+      throw new SyncHttpError(res.status, detail);
+    }
+    return await res.json();
+  };
+}
+async function handlePlanGrep(deps) {
+  const get = platformGet(deps);
+  const { cases } = await get(
+    `/v1/plans/${encodeURIComponent(deps.planId)}/cases`
+  );
+  return { pattern: formatGrep(cases), cases: cases.length, keyed: keyedOf(cases) };
+}
+async function handleRunGrep(deps) {
+  const byKey = RUN_KEY.test(deps.run);
+  if (!byKey && !RUN_ID.test(deps.run)) {
+    throw new RunRefError(
+      `${JSON.stringify(deps.run)} is not a run \u2014 pass its id (a UUID, as in the run page's address) or its key (rk_ and ten hex, the PLUNE_RUN Plune shows).`,
+      2
+    );
+  }
+  const get = platformGet(deps);
+  let runId = deps.run;
+  if (byKey) {
+    const { runs } = await get(`/v1/runs?key=${deps.run}&limit=1`);
+    const run = runs[0];
+    if (run === void 0) {
+      throw new RunRefError(
+        `No run carries the key ${deps.run} \u2014 a key becomes a run's when the run is saved or launched in Plune.`,
+        1
+      );
+    }
+    runId = run.id;
+  }
+  const { cases } = await get(
+    `/v1/runs/${encodeURIComponent(runId)}/cases${deps.failed === true ? "?status=failed,broken" : ""}`
+  );
+  const automated = cases.filter((c) => c.type === "automated");
+  return {
+    pattern: formatGrep(automated),
+    cases: automated.length,
+    keyed: keyedOf(automated),
+    skipped: cases.length - automated.length
+  };
+}
+function runGrepSummary(out, failed) {
+  if (out.cases === 0) {
+    const none = failed ? "no automated case failed or broke in the run" : "the run holds no automated case";
+    return `plune: ${none} (${out.skipped} manual left out) \u2014 the pattern matches nothing.
+`;
+  }
+  const which = failed ? "that failed or broke in the run" : "of the run";
+  return `plune: ${out.cases} automated case(s) ${which}, ${out.keyed} with a test key, the rest by title; ${out.skipped} manual left out.
+`;
+}
+var escape, BOUNDARY, keyedOf, RUN_ID, RUN_KEY, RunRefError;
+var init_plan = __esm({
+  "src/cli/commands/plan.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_api_url();
+    init_credentials();
+    init_sync();
+    escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    BOUNDARY = "[ >#]+";
+    keyedOf = (cases) => cases.filter((c) => c.externalKeys.some((k) => k.kind === "path-title")).length;
+    RUN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    RUN_KEY = /^rk_[0-9a-f]{10}$/;
+    RunRefError = class extends Error {
+      constructor(message, exitCode) {
+        super(message);
+        this.exitCode = exitCode;
+        this.name = "RunRefError";
+      }
+      exitCode;
+    };
+  }
+});
+
+// src/cli/commands/cases.ts
+var cases_exports = {};
+__export(cases_exports, {
+  DEFAULT_CASES_FILE: () => DEFAULT_CASES_FILE,
+  DirtyFileError: () => DirtyFileError,
+  formatReport: () => formatReport,
+  handlePull: () => handlePull,
+  handlePush: () => handlePush,
+  reportCasesFailure: () => reportCasesFailure
+});
+function gitDirty(file) {
+  try {
+    const out = (0, import_node_child_process2.execFileSync)("git", ["status", "--porcelain", "--", file], {
+      cwd: path10.dirname(file),
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf8"
+    });
+    return out.trim() !== "";
+  } catch {
+    return false;
+  }
+}
+async function safeErrorDetail3(res) {
+  try {
+    const body = await res.json();
+    return typeof body.error === "string" ? body.error : "";
+  } catch {
+    return "";
+  }
+}
+function tokenOf(deps) {
+  const token = (deps.loadToken ?? loadToken)();
+  if (token === null) throw new NotLoggedInError();
+  return token;
+}
+async function handlePull(deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const apiUrl = resolveApiUrl(deps.apiUrl);
+  const token = tokenOf(deps);
+  const file = path10.resolve(cwd, deps.file ?? DEFAULT_CASES_FILE);
+  if (fs9.existsSync(file) && !deps.force && (deps.isDirty ?? gitDirty)(file))
+    throw new DirtyFileError(path10.relative(cwd, file) || file);
+  const doFetch = deps.fetchImpl ?? fetch;
+  const endpoint = deps.suiteId !== void 0 ? `${apiUrl}/v1/suites/${encodeURIComponent(deps.suiteId)}/markdown` : `${apiUrl}/v1/test-cases/markdown`;
+  let res;
+  try {
+    res = await doFetch(endpoint, { headers: { authorization: `Bearer ${token}` } });
+  } catch {
+    throw new SyncNetworkError(apiUrl);
+  }
+  if (!res.ok) {
+    const detail = await safeErrorDetail3(res);
+    if (res.status === 401) throw new TokenRejectedError();
+    throw new SyncHttpError(res.status, detail);
+  }
+  const text2 = await res.text();
+  fs9.mkdirSync(path10.dirname(file), { recursive: true });
+  fs9.writeFileSync(file, text2, "utf8");
+  return { file, cases: Number(res.headers.get("x-plune-cases") ?? "0") };
+}
+async function handlePush(deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const apiUrl = resolveApiUrl(deps.apiUrl);
+  const token = tokenOf(deps);
+  const file = path10.resolve(cwd, deps.file ?? DEFAULT_CASES_FILE);
+  let text2;
+  try {
+    text2 = fs9.readFileSync(file, "utf8");
+  } catch {
+    throw new SyncFileError(
+      `No document to push: ${file}. Run "plune pull" first (or pass a file).`
+    );
+  }
+  if (text2.trim() === "") throw new SyncFileError(`The document is empty: ${file}`);
+  const doFetch = deps.fetchImpl ?? fetch;
+  let res;
+  try {
+    res = await doFetch(`${apiUrl}/v1/test-cases/markdown${deps.dryRun ? "?dryRun=true" : ""}`, {
+      method: "POST",
+      headers: { "content-type": "text/markdown", authorization: `Bearer ${token}` },
+      body: text2
+    });
+  } catch {
+    throw new SyncNetworkError(apiUrl);
+  }
+  if (!res.ok) {
+    const detail = await safeErrorDetail3(res);
+    if (res.status === 401) throw new TokenRejectedError();
+    throw new SyncHttpError(res.status, detail);
+  }
+  return await res.json();
+}
+function formatReport(report) {
+  const verb = (past, future) => report.dryRun ? future : past;
+  const lines = [
+    `${report.dryRun ? "Dry run \u2014 nothing written." : "Pushed."} ${report.created.length} ${verb("created", "to create")} \xB7 ${report.updated.length} ${verb("updated", "to update")} \xB7 ${report.unchanged.length} unchanged \xB7 ${report.refused.length} refused` + (report.suites.created.length > 0 ? ` \xB7 ${report.suites.created.length} suite(s) ${verb("created", "to create")}` : "")
+  ];
+  for (const r of report.refused)
+    lines.push(`  refused  line ${r.line}  ${r.title || "(no title)"} \u2014 ${r.error}`);
+  for (const w of report.warnings)
+    lines.push(`  warning  ${w.line !== void 0 ? `line ${w.line}  ` : ""}${w.message}`);
+  return lines.join("\n") + "\n";
+}
+function reportCasesFailure(err, write) {
+  if (err instanceof DirtyFileError) {
+    write(err.message + "\n");
+    return 3;
+  }
+  if (err instanceof NotLoggedInError || err instanceof TokenRejectedError || err instanceof SyncFileError) {
+    write(err.message + "\n");
+    return 2;
+  }
+  if (err instanceof SyncNetworkError || err instanceof SyncHttpError) {
+    write(err.message + "\n");
+    return 1;
+  }
+  return null;
+}
+var import_node_child_process2, fs9, path10, DEFAULT_CASES_FILE, DirtyFileError;
+var init_cases = __esm({
+  "src/cli/commands/cases.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_child_process2 = require("child_process");
+    fs9 = __toESM(require("fs"), 1);
+    path10 = __toESM(require("path"), 1);
+    init_api_url();
+    init_credentials();
+    init_sync();
+    DEFAULT_CASES_FILE = path10.join("plune", "cases.md");
+    DirtyFileError = class extends Error {
+      constructor(file) {
+        super(`${file} has uncommitted changes; commit them or pass --force to overwrite.`);
+        this.name = "DirtyFileError";
+      }
+    };
+  }
+});
+
 // src/reporter-core/result-key.ts
 function resultKey(testId, retry) {
   const plain = `${testId}#${retry}`;
@@ -3662,33 +4133,33 @@ var init_result_key = __esm({
 
 // src/importers/attachments.ts
 function reportFolder(report) {
-  const folder = path9.dirname(path9.resolve(report));
+  const folder = path11.dirname(path11.resolve(report));
   try {
-    return fs8.realpathSync(folder);
+    return fs10.realpathSync(folder);
   } catch {
     return folder;
   }
 }
 function reportFolders(report) {
-  return { lexical: path9.dirname(path9.resolve(report)), real: reportFolder(report) };
+  return { lexical: path11.dirname(path11.resolve(report)), real: reportFolder(report) };
 }
 function within(folder, target) {
-  const rel = path9.relative(folder, target);
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${path9.sep}`) && !path9.isAbsolute(rel);
+  const rel = path11.relative(folder, target);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${path11.sep}`) && !path11.isAbsolute(rel);
 }
 function resolveAttachment(folder, ref, lexical = folder) {
   if (/^[\\/]{2}/.test(ref) || ref.includes("\0")) return { why: "outside" };
-  const face = path9.resolve(lexical, ref);
+  const face = path11.resolve(lexical, ref);
   if (!within(lexical, face) && !within(folder, face)) return { why: "outside" };
   let real;
   try {
-    real = fs8.realpathSync(path9.resolve(folder, ref));
+    real = fs10.realpathSync(path11.resolve(folder, ref));
   } catch {
     return { why: "absent" };
   }
   if (!within(folder, real)) return { why: "outside" };
   try {
-    return fs8.statSync(real).isFile() ? { file: real } : { why: "not-a-file" };
+    return fs10.statSync(real).isFile() ? { file: real } : { why: "not-a-file" };
   } catch {
     return { why: "absent" };
   }
@@ -3720,18 +4191,18 @@ function filesOfTest(test, folder, title, missing, options = {}) {
     }
     const real = found.file;
     if (!files.some((f) => f.path === real)) {
-      files.push({ name: printable(ref.split(/[\\/]/).pop() || path9.basename(real)), contentType: typeOfFile(real), path: real });
+      files.push({ name: printable(ref.split(/[\\/]/).pop() || path11.basename(real)), contentType: typeOfFile(real), path: real });
     }
   }
   return files;
 }
-var fs8, path9, MARKER, TYPES, typeOfFile, MARKERS_PER_TEST;
+var fs10, path11, MARKER, TYPES, typeOfFile, MARKERS_PER_TEST;
 var init_attachments = __esm({
   "src/importers/attachments.ts"() {
     "use strict";
     init_cjs_shims();
-    fs8 = __toESM(require("fs"), 1);
-    path9 = __toESM(require("path"), 1);
+    fs10 = __toESM(require("fs"), 1);
+    path11 = __toESM(require("path"), 1);
     init_failure_detail();
     MARKER = /^[ \t]*\[\[ATTACHMENT\|([^\r\n]*?)\]\][ \t]*$/gm;
     TYPES = {
@@ -3755,7 +4226,7 @@ var init_attachments = __esm({
       ".mp4": "video/mp4",
       ".har": "application/json"
     };
-    typeOfFile = (file) => TYPES[path9.extname(file).toLowerCase()] ?? "application/octet-stream";
+    typeOfFile = (file) => TYPES[path11.extname(file).toLowerCase()] ?? "application/octet-stream";
     MARKERS_PER_TEST = 100;
   }
 });
@@ -3763,7 +4234,7 @@ var init_attachments = __esm({
 // src/importers/allure.ts
 function isFolder(path17) {
   try {
-    return fs9.statSync(path17).isDirectory();
+    return fs11.statSync(path17).isDirectory();
   } catch {
     return false;
   }
@@ -3771,7 +4242,7 @@ function isFolder(path17) {
 function load(file, maxBytes) {
   let size;
   try {
-    size = fs9.statSync(file).size;
+    size = fs11.statSync(file).size;
   } catch (err) {
     throw new AllureReportError(`${printable(file)} \u2014 cannot read \u2014 ${printable(err instanceof Error ? err.message : String(err))}`);
   }
@@ -3780,7 +4251,7 @@ function load(file, maxBytes) {
   }
   let parsed;
   try {
-    parsed = JSON.parse(fs9.readFileSync(file, "utf8"));
+    parsed = JSON.parse(fs11.readFileSync(file, "utf8"));
   } catch (err) {
     throw new AllureReportError(`${printable(file)} \u2014 not JSON \u2014 ${printable(err instanceof Error ? err.message : String(err))}`);
   }
@@ -3837,9 +4308,9 @@ function readAllure(dir, missing = [], notes = [], maxBytes = MAX_JSON_BYTES) {
       `${printable(dir)} \u2014 no *-result.json files in it, so there is no Allure report to read. Point at the folder an Allure adapter wrote (pytest --alluredir, allure-results), or at a JUnit or Playwright JSON file.`
     );
   }
-  const { lexical, real: folder } = reportFolders(path10.join(dir, "_"));
-  const tests = resultNames.map((n) => load(path10.join(dir, n), maxBytes));
-  const containers = namesIn(dir, CONTAINER).map((n) => load(path10.join(dir, n), maxBytes));
+  const { lexical, real: folder } = reportFolders(path12.join(dir, "_"));
+  const tests = resultNames.map((n) => load(path12.join(dir, n), maxBytes));
+  const containers = namesIn(dir, CONTAINER).map((n) => load(path12.join(dir, n), maxBytes));
   const direct = /* @__PURE__ */ new Map();
   for (const c of containers) {
     for (const child of Array.isArray(c.children) ? c.children : []) {
@@ -3907,7 +4378,7 @@ function pendingOf(r, retry, ctx) {
     }
     if (files.some((f) => f.path === found.file)) return;
     const type = textOf(att.type).trim();
-    const name2 = printable(textOf(att.name) !== "" ? textOf(att.name) : path10.basename(found.file));
+    const name2 = printable(textOf(att.name) !== "" ? textOf(att.name) : path12.basename(found.file));
     files.push({ name: name2, contentType: type !== "" ? type : typeOfFile(found.file), path: found.file });
   };
   const holders = [];
@@ -3966,13 +4437,13 @@ function pendingOf(r, retry, ctx) {
     ...files.length > 0 ? { files } : {}
   };
 }
-var fs9, path10, SOURCE, TOKEN, AllureReportError, RESULT, CONTAINER, MAX_JSON_BYTES, MAX_DEPTH, MAX_TIME, namesIn, timeOf, textOf, labelOf, FAILED, declared, stopOf, compareText;
+var fs11, path12, SOURCE, TOKEN, AllureReportError, RESULT, CONTAINER, MAX_JSON_BYTES, MAX_DEPTH, MAX_TIME, namesIn, timeOf, textOf, labelOf, FAILED, declared, stopOf, compareText;
 var init_allure = __esm({
   "src/importers/allure.ts"() {
     "use strict";
     init_cjs_shims();
-    fs9 = __toESM(require("fs"), 1);
-    path10 = __toESM(require("path"), 1);
+    fs11 = __toESM(require("fs"), 1);
+    path12 = __toESM(require("path"), 1);
     init_failure_detail();
     init_result_key();
     init_attachments();
@@ -3989,7 +4460,7 @@ var init_allure = __esm({
     MAX_JSON_BYTES = 64 * 1024 * 1024;
     MAX_DEPTH = 256;
     MAX_TIME = 864e13;
-    namesIn = (dir, pattern) => fs9.readdirSync(dir, { withFileTypes: true }).filter((d) => d.isFile() && pattern.test(d.name)).map((d) => d.name).sort();
+    namesIn = (dir, pattern) => fs11.readdirSync(dir, { withFileTypes: true }).filter((d) => d.isFile() && pattern.test(d.name)).map((d) => d.name).sort();
     timeOf = (v) => typeof v === "number" && Math.abs(v) <= MAX_TIME ? v : void 0;
     textOf = (v) => typeof v === "string" ? v : "";
     labelOf = (r, name) => textOf(listOf(r.labels).find((l) => l.name === name)?.value);
@@ -4463,7 +4934,7 @@ async function handleRunImport(options) {
   } else {
     let source;
     try {
-      source = fs10.readFileSync(options.file, "utf8");
+      source = fs12.readFileSync(options.file, "utf8");
     } catch {
       throw new RunCommandError(`Cannot read ${options.file}.`);
     }
@@ -4594,12 +5065,12 @@ function describe(result, apiUrl) {
   if (result.runId !== null) lines.push(runUrl2(apiUrl, result.runId));
   return lines;
 }
-var fs10, NEXT;
+var fs12, NEXT;
 var init_run_import = __esm({
   "src/cli/commands/run-import.ts"() {
     "use strict";
     init_cjs_shims();
-    fs10 = __toESM(require("fs"), 1);
+    fs12 = __toESM(require("fs"), 1);
     init_session();
     init_failure_detail();
     init_importers();
@@ -4629,10 +5100,10 @@ function isRunResult(v) {
 }
 function handleReport(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const file = path11.join(cwd, ".plune", "last-run.json");
+  const file = path13.join(cwd, ".plune", "last-run.json");
   let raw;
   try {
-    raw = fs11.readFileSync(file, "utf8");
+    raw = fs13.readFileSync(file, "utf8");
   } catch {
     throw new ReportNotFoundError('No saved run found. Run "plune run" first.');
   }
@@ -4647,13 +5118,13 @@ function handleReport(opts = {}) {
   }
   return parsed;
 }
-var fs11, path11, ReportNotFoundError;
+var fs13, path13, ReportNotFoundError;
 var init_report = __esm({
   "src/cli/commands/report.ts"() {
     "use strict";
     init_cjs_shims();
-    fs11 = __toESM(require("fs"), 1);
-    path11 = __toESM(require("path"), 1);
+    fs13 = __toESM(require("fs"), 1);
+    path13 = __toESM(require("path"), 1);
     ReportNotFoundError = class extends Error {
       code = "NO_SAVED_RUN";
       constructor(message) {
@@ -4723,7 +5194,7 @@ function isRunResult2(v) {
 function loadRunResult(file, label) {
   let raw;
   try {
-    raw = fs12.readFileSync(file, "utf8");
+    raw = fs14.readFileSync(file, "utf8");
   } catch {
     throw new DiffInputError(`Cannot read ${label} run file: ${file}`);
   }
@@ -4743,12 +5214,12 @@ function handleDiff(opts) {
   const current = loadRunResult(opts.currentPath, "current");
   return diffRuns(baseline, current);
 }
-var fs12, DiffInputError;
+var fs14, DiffInputError;
 var init_diff2 = __esm({
   "src/cli/commands/diff.ts"() {
     "use strict";
     init_cjs_shims();
-    fs12 = __toESM(require("fs"), 1);
+    fs14 = __toESM(require("fs"), 1);
     init_diff();
     DiffInputError = class extends Error {
       code = "DIFF_INPUT";
@@ -4873,8 +5344,8 @@ async function runInitWizard(cwd) {
     process.exit(1);
     return;
   }
-  const outputPath = path12.join(cwd, "plune.yaml");
-  if (fs13.existsSync(outputPath)) {
+  const outputPath = path14.join(cwd, "plune.yaml");
+  if (fs15.existsSync(outputPath)) {
     const overwrite = await clack.confirm({
       message: "plune.yaml already exists. Overwrite?"
     });
@@ -4913,18 +5384,18 @@ async function runInitWizard(cwd) {
 `;
   const spin = clack.spinner();
   spin.start("Writing plune.yaml\u2026");
-  fs13.writeFileSync(outputPath, header + "\n" + (0, import_yaml2.stringify)(config), "utf8");
+  fs15.writeFileSync(outputPath, header + "\n" + (0, import_yaml2.stringify)(config), "utf8");
   spin.stop("plune.yaml created!");
   clack.outro("plune.yaml is ready.");
 }
-var clack, fs13, path12, import_yaml2;
+var clack, fs15, path14, import_yaml2;
 var init_wizard = __esm({
   "src/config/init/wizard.ts"() {
     "use strict";
     init_cjs_shims();
     clack = __toESM(require("@clack/prompts"), 1);
-    fs13 = __toESM(require("fs"), 1);
-    path12 = __toESM(require("path"), 1);
+    fs15 = __toESM(require("fs"), 1);
+    path14 = __toESM(require("path"), 1);
     import_yaml2 = require("yaml");
     init_errors();
   }
@@ -4932,21 +5403,21 @@ var init_wizard = __esm({
 
 // src/cli/templates/index.ts
 function writeTemplateFile(cwd, rel, content, force) {
-  const target = path13.join(cwd, rel);
-  if (!force && fs14.existsSync(target)) {
+  const target = path15.join(cwd, rel);
+  if (!force && fs16.existsSync(target)) {
     return "skipped";
   }
-  fs14.mkdirSync(path13.dirname(target), { recursive: true });
-  fs14.writeFileSync(target, content, "utf8");
+  fs16.mkdirSync(path15.dirname(target), { recursive: true });
+  fs16.writeFileSync(target, content, "utf8");
   return "written";
 }
-var fs14, path13, ENV_EXAMPLE_TPL, EXAMPLE_JSONL_TPL, PLUNE_YAML_TPL;
+var fs16, path15, ENV_EXAMPLE_TPL, EXAMPLE_JSONL_TPL, PLUNE_YAML_TPL;
 var init_templates = __esm({
   "src/cli/templates/index.ts"() {
     "use strict";
     init_cjs_shims();
-    fs14 = __toESM(require("fs"), 1);
-    path13 = __toESM(require("path"), 1);
+    fs16 = __toESM(require("fs"), 1);
+    path15 = __toESM(require("path"), 1);
     ENV_EXAMPLE_TPL = `# Copy this file to .env and replace the placeholders with your real keys.
 # .env is gitignored; .env.example is safe to commit.
 # Plune reads whichever key matches your configured provider.
@@ -5032,7 +5503,7 @@ __export(login_exports, {
   EmptyTokenError: () => EmptyTokenError,
   LoginHttpError: () => LoginHttpError,
   LoginNetworkError: () => LoginNetworkError,
-  TokenRejectedError: () => TokenRejectedError,
+  TokenRejectedError: () => TokenRejectedError2,
   handleLogin: () => handleLogin,
   reportLoginFailure: () => reportLoginFailure
 });
@@ -5051,12 +5522,12 @@ async function handleLogin(deps) {
     throw new LoginNetworkError(apiUrl);
   }
   await res.text().catch(() => "");
-  if (res.status === 401) throw new TokenRejectedError(apiUrl);
+  if (res.status === 401) throw new TokenRejectedError2(apiUrl);
   if (!res.ok) throw new LoginHttpError(res.status);
   return { path: saveToken(token), verified: true };
 }
 function reportLoginFailure(err, write) {
-  if (err instanceof EmptyTokenError || err instanceof TokenRejectedError) {
+  if (err instanceof EmptyTokenError || err instanceof TokenRejectedError2) {
     write(`${err.message}
 `);
     return 2;
@@ -5066,286 +5537,74 @@ function reportLoginFailure(err, write) {
 `);
     return 1;
   }
-  return null;
-}
-var EmptyTokenError, TokenRejectedError, LoginNetworkError, LoginHttpError;
-var init_login = __esm({
-  "src/cli/commands/login.ts"() {
-    "use strict";
-    init_cjs_shims();
-    init_api_url();
-    init_credentials();
-    EmptyTokenError = class extends Error {
-      constructor(apiUrl = resolveApiUrl()) {
-        super(
-          `No API token provided. ${whereToGetAToken(apiUrl)} Then pass --token <token> or pipe it via stdin.`
-        );
-        this.name = "EmptyTokenError";
-      }
-    };
-    TokenRejectedError = class extends Error {
-      constructor(apiUrl = resolveApiUrl()) {
-        super(`That API token was rejected (401). Nothing was saved. ${whereToGetAToken(apiUrl)}`);
-        this.name = "TokenRejectedError";
-      }
-    };
-    LoginNetworkError = class extends Error {
-      constructor(apiUrl) {
-        super(
-          `Could not reach the Plune API at ${apiUrl}, so the token was not checked and NOT saved. Try again, or use --skip-verify to save it without checking.`
-        );
-        this.name = "LoginNetworkError";
-      }
-    };
-    LoginHttpError = class extends Error {
-      constructor(status) {
-        super(
-          `The Plune API returned ${status} while checking the token, so it was NOT saved. Try again.`
-        );
-        this.name = "LoginHttpError";
-      }
-    };
-  }
-});
-
-// src/cli/commands/logout.ts
-var logout_exports = {};
-__export(logout_exports, {
-  handleLogout: () => handleLogout
-});
-function handleLogout() {
-  return clearToken();
-}
-var init_logout = __esm({
-  "src/cli/commands/logout.ts"() {
-    "use strict";
-    init_cjs_shims();
-    init_credentials();
-  }
-});
-
-// src/types/run-result-schema.ts
-function parseRunResult(value2) {
-  return runResultSchema.parse(value2);
-}
-var import_zod3, RUN_RESULT_SCHEMA_VERSION, binaryVerdictSchema, assertionResultRecordSchema2, usageSchema, runErrorSchema, rowResultSchema, summarySchema, evalResultSchema, runResultSchema;
-var init_run_result_schema = __esm({
-  "src/types/run-result-schema.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_zod3 = require("zod");
-    init_results();
-    RUN_RESULT_SCHEMA_VERSION = 1;
-    binaryVerdictSchema = import_zod3.z.object({
-      question: import_zod3.z.string().min(1),
-      passed: import_zod3.z.boolean()
-    });
-    assertionResultRecordSchema2 = import_zod3.z.object({
-      type: import_zod3.z.string(),
-      passed: import_zod3.z.boolean(),
-      score: import_zod3.z.number().optional(),
-      reason: import_zod3.z.string().optional(),
-      binaryVerdicts: import_zod3.z.array(binaryVerdictSchema).optional()
-    });
-    usageSchema = import_zod3.z.object({
-      input_tokens: import_zod3.z.number(),
-      output_tokens: import_zod3.z.number(),
-      cost_usd: import_zod3.z.number()
-    });
-    runErrorSchema = import_zod3.z.object({
-      code: import_zod3.z.string(),
-      message: import_zod3.z.string()
-    });
-    rowResultSchema = import_zod3.z.object({
-      vars: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()),
-      output: import_zod3.z.string().nullable(),
-      cached: import_zod3.z.boolean(),
-      usage: usageSchema.optional(),
-      latency_ms: import_zod3.z.number().optional(),
-      error: runErrorSchema.optional(),
-      assertions: import_zod3.z.array(assertionResultRecordSchema2),
-      /** ADR 0045. Optional and additive — the same enum the platform validates on `POST /v1/runs`. */
-      inconclusive: import_zod3.z.enum(ROW_INCONCLUSIVE).optional()
-    });
-    summarySchema = import_zod3.z.object({
-      total: import_zod3.z.number(),
-      passed: import_zod3.z.number(),
-      failed: import_zod3.z.number(),
-      errored: import_zod3.z.number(),
-      /** plune#1245. Optional and additive — a RunResult written before them validates unchanged. */
-      blocked: import_zod3.z.number().optional(),
-      skipped: import_zod3.z.number().optional(),
-      cost_usd: import_zod3.z.number(),
-      duration_ms: import_zod3.z.number()
-    });
-    evalResultSchema = import_zod3.z.object({
-      id: import_zod3.z.string(),
-      tags: import_zod3.z.array(import_zod3.z.string()),
-      rows: import_zod3.z.array(rowResultSchema),
-      passed: import_zod3.z.boolean()
-    });
-    runResultSchema = import_zod3.z.object({
-      schemaVersion: import_zod3.z.literal(RUN_RESULT_SCHEMA_VERSION),
-      plune_version: import_zod3.z.string(),
-      started_at: import_zod3.z.string(),
-      finished_at: import_zod3.z.string(),
-      config_hash: import_zod3.z.string(),
-      summary: summarySchema,
-      evals: import_zod3.z.array(evalResultSchema)
-    });
-  }
-});
-
-// src/cli/commands/sync.ts
-var sync_exports = {};
-__export(sync_exports, {
-  NotLoggedInError: () => NotLoggedInError,
-  SyncFileError: () => SyncFileError,
-  SyncHttpError: () => SyncHttpError,
-  SyncNetworkError: () => SyncNetworkError,
-  TokenRejectedError: () => TokenRejectedError2,
-  handleSync: () => handleSync,
-  reportSyncFailure: () => reportSyncFailure
-});
-function readRun(cwd, file) {
-  const target = file !== void 0 ? path14.resolve(cwd, file) : path14.join(cwd, ".plune", "last-run.json");
-  let raw;
-  try {
-    raw = fs15.readFileSync(target, "utf8");
-  } catch {
-    throw new SyncFileError(
-      file !== void 0 ? `Run file not found: ${target}` : 'No run to sync. Run "plune run" first (or pass --file <path>).'
-    );
-  }
-  let json;
-  try {
-    json = JSON.parse(raw);
-  } catch {
-    throw new SyncFileError(`Run file is not valid JSON: ${target}`);
-  }
-  try {
-    return parseRunResult(json);
-  } catch {
-    throw new SyncFileError(`Run file does not match the RunResult schema: ${target}`);
-  }
-}
-async function safeErrorDetail(res) {
-  try {
-    const body = await res.json();
-    return typeof body.error === "string" ? body.error : "";
-  } catch {
-    return "";
-  }
-}
-async function handleSync(deps = {}) {
-  const cwd = deps.cwd ?? process.cwd();
-  const apiUrl = resolveApiUrl(deps.apiUrl);
-  const token = (deps.loadToken ?? loadToken)();
-  if (token === null) throw new NotLoggedInError();
-  const run = readRun(cwd, deps.file);
-  const doFetch = deps.fetchImpl ?? fetch;
-  const endpoint = `${apiUrl}/v1/runs`;
-  let res;
-  try {
-    res = await doFetch(endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
-      body: JSON.stringify(run)
-    });
-  } catch {
-    throw new SyncNetworkError(apiUrl);
-  }
-  if (!res.ok) {
-    const detail = await safeErrorDetail(res);
-    if (res.status === 401) throw new TokenRejectedError2();
-    throw new SyncHttpError(res.status, detail);
-  }
-  const body = await res.json().catch(() => ({}));
-  const id = typeof body.id === "string" ? body.id : "";
-  const result = { id, url: `${endpoint}/${id}` };
-  if (deps.failOnFailures === true) result.gate = gateExit(await readVerdict(doFetch, `${endpoint}/${id}/summary`, token));
-  return result;
-}
-async function readVerdict(doFetch, url, token) {
-  try {
-    const res = await doFetch(url, { method: "GET", headers: { authorization: `Bearer ${token}` } });
-    const body = await res.json().catch(() => void 0);
-    return res.ok ? { statusEvent: body?.run?.statusEvent, counts: body?.counts, notRun: body?.notRun } : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function reportSyncFailure(err, write) {
-  if (err instanceof NotLoggedInError || err instanceof TokenRejectedError2 || err instanceof SyncFileError) {
-    write(err.message + "\n");
-    return 2;
-  }
-  if (err instanceof SyncNetworkError || err instanceof SyncHttpError) {
-    write(err.message + "\n");
-    return 1;
-  }
-  return null;
-}
-var fs15, path14, NotLoggedInError, TokenRejectedError2, SyncFileError, SyncNetworkError, SyncHttpError;
-var init_sync = __esm({
-  "src/cli/commands/sync.ts"() {
-    "use strict";
-    init_cjs_shims();
-    fs15 = __toESM(require("fs"), 1);
-    path14 = __toESM(require("path"), 1);
-    init_run_result_schema();
-    init_api_url();
-    init_credentials();
-    init_gate();
-    NotLoggedInError = class extends Error {
-      constructor() {
-        super('Not logged in. Run "plune login" first, or set PLUNE_TOKEN.');
-        this.name = "NotLoggedInError";
-      }
-    };
-    TokenRejectedError2 = class extends Error {
-      constructor() {
+  return null;
+}
+var EmptyTokenError, TokenRejectedError2, LoginNetworkError, LoginHttpError;
+var init_login = __esm({
+  "src/cli/commands/login.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_api_url();
+    init_credentials();
+    EmptyTokenError = class extends Error {
+      constructor(apiUrl = resolveApiUrl()) {
         super(
-          'Your API token was rejected (revoked or invalid). Run "plune login" with a fresh token.'
+          `No API token provided. ${whereToGetAToken(apiUrl)} Then pass --token <token> or pipe it via stdin.`
         );
-        this.name = "TokenRejectedError";
+        this.name = "EmptyTokenError";
       }
     };
-    SyncFileError = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "SyncFileError";
+    TokenRejectedError2 = class extends Error {
+      constructor(apiUrl = resolveApiUrl()) {
+        super(`That API token was rejected (401). Nothing was saved. ${whereToGetAToken(apiUrl)}`);
+        this.name = "TokenRejectedError";
       }
     };
-    SyncNetworkError = class extends Error {
+    LoginNetworkError = class extends Error {
       constructor(apiUrl) {
         super(
-          `Could not reach the Plune API at ${apiUrl}. Check your connection (or PLUNE_API_URL) and try again.`
+          `Could not reach the Plune API at ${apiUrl}, so the token was not checked and NOT saved. Try again, or use --skip-verify to save it without checking.`
         );
-        this.name = "SyncNetworkError";
+        this.name = "LoginNetworkError";
       }
     };
-    SyncHttpError = class extends Error {
-      constructor(status, detail) {
-        super(`Sync failed \u2014 the server returned HTTP ${status}${detail ? ` (${detail})` : ""}.`);
-        this.status = status;
-        this.name = "SyncHttpError";
+    LoginHttpError = class extends Error {
+      constructor(status) {
+        super(
+          `The Plune API returned ${status} while checking the token, so it was NOT saved. Try again.`
+        );
+        this.name = "LoginHttpError";
       }
-      status;
     };
   }
 });
 
+// src/cli/commands/logout.ts
+var logout_exports = {};
+__export(logout_exports, {
+  handleLogout: () => handleLogout
+});
+function handleLogout() {
+  return clearToken();
+}
+var init_logout = __esm({
+  "src/cli/commands/logout.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_credentials();
+  }
+});
+
 // src/cli/commands/cairn-artifact.ts
 async function findLatestCairnRun(runsDir = "runs") {
-  const entries = await fs16.readdir(runsDir, { withFileTypes: true }).catch(() => null);
+  const entries = await fs17.readdir(runsDir, { withFileTypes: true }).catch(() => null);
   if (entries === null) throw new NoCairnRunsError(runsDir);
   let newest;
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const dir = path15.join(runsDir, entry.name);
+    const dir = path16.join(runsDir, entry.name);
     try {
-      const report = await fs16.lstat(path15.join(dir, "report.json"));
+      const report = await fs17.lstat(path16.join(dir, "report.json"));
       if (!report.isFile()) continue;
       if (newest === void 0 || report.mtimeMs > newest.at) {
         newest = { dir, at: report.mtimeMs };
@@ -5358,13 +5617,13 @@ async function findLatestCairnRun(runsDir = "runs") {
 }
 async function readJson(file) {
   try {
-    return JSON.parse(await fs16.readFile(file, "utf8"));
+    return JSON.parse(await fs17.readFile(file, "utf8"));
   } catch {
     return void 0;
   }
 }
 async function defaultReadEvidence(dir) {
-  const raw = await readJson(path15.join(dir, "api-evidence.json"));
+  const raw = await readJson(path16.join(dir, "api-evidence.json"));
   if (!Array.isArray(raw)) return void 0;
   return raw.map((r) => {
     const rec = asRecord(r);
@@ -5407,7 +5666,7 @@ function casesFromApi(report, verdicts) {
   });
 }
 async function readCairnRun(dir, deps = {}) {
-  const raw = await readJson(path15.join(dir, "report.json"));
+  const raw = await readJson(path16.join(dir, "report.json"));
   if (raw === void 0) throw new CairnRunNotFoundError(dir);
   const report = asRecord(raw);
   if (report["schemaVersion"] !== SUPPORTED_ARTIFACT_VERSION) {
@@ -5437,20 +5696,20 @@ async function readCairnRun(dir, deps = {}) {
   return {
     schemaVersion: INGEST_SCHEMA_VERSION,
     run: {
-      runId: str(report["runId"], path15.basename(dir)),
+      runId: str(report["runId"], path16.basename(dir)),
       mode,
       target: str(report["url"], "unknown")
     },
     cases
   };
 }
-var fs16, path15, SUPPORTED_ARTIFACT_VERSION, INGEST_SCHEMA_VERSION, NoCairnRunsError, CairnRunNotFoundError, CairnRunVersionError, CairnRunPartialError, CairnEvidenceAmbiguousError, asRecord, str;
+var fs17, path16, SUPPORTED_ARTIFACT_VERSION, INGEST_SCHEMA_VERSION, NoCairnRunsError, CairnRunNotFoundError, CairnRunVersionError, CairnRunPartialError, CairnEvidenceAmbiguousError, asRecord, str;
 var init_cairn_artifact = __esm({
   "src/cli/commands/cairn-artifact.ts"() {
     "use strict";
     init_cjs_shims();
-    fs16 = __toESM(require("fs/promises"), 1);
-    path15 = __toESM(require("path"), 1);
+    fs17 = __toESM(require("fs/promises"), 1);
+    path16 = __toESM(require("path"), 1);
     SUPPORTED_ARTIFACT_VERSION = 1;
     INGEST_SCHEMA_VERSION = 1;
     NoCairnRunsError = class extends Error {
@@ -5505,7 +5764,7 @@ __export(ingest_exports, {
   handleIngest: () => handleIngest,
   reportIngestFailure: () => reportIngestFailure
 });
-async function safeErrorDetail2(res) {
+async function safeErrorDetail4(res) {
   try {
     const body = await res.json();
     return typeof body.error === "string" ? body.error : "";
@@ -5532,7 +5791,7 @@ async function handleIngest(deps) {
     throw new IngestNetworkError(apiUrl);
   }
   if (!res.ok) {
-    const detail = await safeErrorDetail2(res);
+    const detail = await safeErrorDetail4(res);
     if (res.status === 401) throw new IngestTokenRejectedError();
     throw new IngestHttpError(res.status, detail);
   }
@@ -5604,207 +5863,6 @@ var init_ingest = __esm({
   }
 });
 
-// src/cli/commands/cases.ts
-var cases_exports = {};
-__export(cases_exports, {
-  DEFAULT_CASES_FILE: () => DEFAULT_CASES_FILE,
-  DirtyFileError: () => DirtyFileError,
-  formatReport: () => formatReport,
-  handlePull: () => handlePull,
-  handlePush: () => handlePush,
-  reportCasesFailure: () => reportCasesFailure
-});
-function gitDirty(file) {
-  try {
-    const out = (0, import_node_child_process2.execFileSync)("git", ["status", "--porcelain", "--", file], {
-      cwd: path16.dirname(file),
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    });
-    return out.trim() !== "";
-  } catch {
-    return false;
-  }
-}
-async function safeErrorDetail3(res) {
-  try {
-    const body = await res.json();
-    return typeof body.error === "string" ? body.error : "";
-  } catch {
-    return "";
-  }
-}
-function tokenOf(deps) {
-  const token = (deps.loadToken ?? loadToken)();
-  if (token === null) throw new NotLoggedInError();
-  return token;
-}
-async function handlePull(deps = {}) {
-  const cwd = deps.cwd ?? process.cwd();
-  const apiUrl = resolveApiUrl(deps.apiUrl);
-  const token = tokenOf(deps);
-  const file = path16.resolve(cwd, deps.file ?? DEFAULT_CASES_FILE);
-  if (fs17.existsSync(file) && !deps.force && (deps.isDirty ?? gitDirty)(file))
-    throw new DirtyFileError(path16.relative(cwd, file) || file);
-  const doFetch = deps.fetchImpl ?? fetch;
-  const endpoint = deps.suiteId !== void 0 ? `${apiUrl}/v1/suites/${encodeURIComponent(deps.suiteId)}/markdown` : `${apiUrl}/v1/test-cases/markdown`;
-  let res;
-  try {
-    res = await doFetch(endpoint, { headers: { authorization: `Bearer ${token}` } });
-  } catch {
-    throw new SyncNetworkError(apiUrl);
-  }
-  if (!res.ok) {
-    const detail = await safeErrorDetail3(res);
-    if (res.status === 401) throw new TokenRejectedError2();
-    throw new SyncHttpError(res.status, detail);
-  }
-  const text2 = await res.text();
-  fs17.mkdirSync(path16.dirname(file), { recursive: true });
-  fs17.writeFileSync(file, text2, "utf8");
-  return { file, cases: Number(res.headers.get("x-plune-cases") ?? "0") };
-}
-async function handlePush(deps = {}) {
-  const cwd = deps.cwd ?? process.cwd();
-  const apiUrl = resolveApiUrl(deps.apiUrl);
-  const token = tokenOf(deps);
-  const file = path16.resolve(cwd, deps.file ?? DEFAULT_CASES_FILE);
-  let text2;
-  try {
-    text2 = fs17.readFileSync(file, "utf8");
-  } catch {
-    throw new SyncFileError(
-      `No document to push: ${file}. Run "plune pull" first (or pass a file).`
-    );
-  }
-  if (text2.trim() === "") throw new SyncFileError(`The document is empty: ${file}`);
-  const doFetch = deps.fetchImpl ?? fetch;
-  let res;
-  try {
-    res = await doFetch(`${apiUrl}/v1/test-cases/markdown${deps.dryRun ? "?dryRun=true" : ""}`, {
-      method: "POST",
-      headers: { "content-type": "text/markdown", authorization: `Bearer ${token}` },
-      body: text2
-    });
-  } catch {
-    throw new SyncNetworkError(apiUrl);
-  }
-  if (!res.ok) {
-    const detail = await safeErrorDetail3(res);
-    if (res.status === 401) throw new TokenRejectedError2();
-    throw new SyncHttpError(res.status, detail);
-  }
-  return await res.json();
-}
-function formatReport(report) {
-  const verb = (past, future) => report.dryRun ? future : past;
-  const lines = [
-    `${report.dryRun ? "Dry run \u2014 nothing written." : "Pushed."} ${report.created.length} ${verb("created", "to create")} \xB7 ${report.updated.length} ${verb("updated", "to update")} \xB7 ${report.unchanged.length} unchanged \xB7 ${report.refused.length} refused` + (report.suites.created.length > 0 ? ` \xB7 ${report.suites.created.length} suite(s) ${verb("created", "to create")}` : "")
-  ];
-  for (const r of report.refused)
-    lines.push(`  refused  line ${r.line}  ${r.title || "(no title)"} \u2014 ${r.error}`);
-  for (const w of report.warnings)
-    lines.push(`  warning  ${w.line !== void 0 ? `line ${w.line}  ` : ""}${w.message}`);
-  return lines.join("\n") + "\n";
-}
-function reportCasesFailure(err, write) {
-  if (err instanceof DirtyFileError) {
-    write(err.message + "\n");
-    return 3;
-  }
-  if (err instanceof NotLoggedInError || err instanceof TokenRejectedError2 || err instanceof SyncFileError) {
-    write(err.message + "\n");
-    return 2;
-  }
-  if (err instanceof SyncNetworkError || err instanceof SyncHttpError) {
-    write(err.message + "\n");
-    return 1;
-  }
-  return null;
-}
-var import_node_child_process2, fs17, path16, DEFAULT_CASES_FILE, DirtyFileError;
-var init_cases = __esm({
-  "src/cli/commands/cases.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_node_child_process2 = require("child_process");
-    fs17 = __toESM(require("fs"), 1);
-    path16 = __toESM(require("path"), 1);
-    init_api_url();
-    init_credentials();
-    init_sync();
-    DEFAULT_CASES_FILE = path16.join("plune", "cases.md");
-    DirtyFileError = class extends Error {
-      constructor(file) {
-        super(`${file} has uncommitted changes; commit them or pass --force to overwrite.`);
-        this.name = "DirtyFileError";
-      }
-    };
-  }
-});
-
-// src/cli/commands/plan.ts
-var plan_exports = {};
-__export(plan_exports, {
-  formatGrep: () => formatGrep,
-  grepFragment: () => grepFragment,
-  handlePlanGrep: () => handlePlanGrep
-});
-function grepFragment(c) {
-  const pathTitle = c.externalKeys.find((k) => k.kind === "path-title")?.value;
-  const segments = pathTitle?.split("#") ?? [c.title];
-  return (segments.length > 1 ? segments.slice(1) : segments).flatMap((s) => s.split(/ [>›] /)).map(escape).join(BOUNDARY);
-}
-function formatGrep(cases) {
-  if (cases.length === 0) return "(?!)";
-  return cases.map(grepFragment).join("|");
-}
-async function safeErrorDetail4(res) {
-  try {
-    const body = await res.json();
-    return typeof body.error === "string" ? body.error : "";
-  } catch {
-    return "";
-  }
-}
-async function handlePlanGrep(deps) {
-  const apiUrl = resolveApiUrl(deps.apiUrl);
-  const token = (deps.loadToken ?? loadToken)();
-  if (token === null) throw new NotLoggedInError();
-  const doFetch = deps.fetchImpl ?? fetch;
-  let res;
-  try {
-    res = await doFetch(`${apiUrl}/v1/plans/${encodeURIComponent(deps.planId)}/cases`, {
-      headers: { authorization: `Bearer ${token}` }
-    });
-  } catch {
-    throw new SyncNetworkError(apiUrl);
-  }
-  if (!res.ok) {
-    const detail = await safeErrorDetail4(res);
-    if (res.status === 401) throw new TokenRejectedError2();
-    throw new SyncHttpError(res.status, detail);
-  }
-  const { cases } = await res.json();
-  return {
-    pattern: formatGrep(cases),
-    cases: cases.length,
-    keyed: cases.filter((c) => c.externalKeys.some((k) => k.kind === "path-title")).length
-  };
-}
-var escape, BOUNDARY;
-var init_plan = __esm({
-  "src/cli/commands/plan.ts"() {
-    "use strict";
-    init_cjs_shims();
-    init_api_url();
-    init_credentials();
-    init_sync();
-    escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    BOUNDARY = "[ >#]+";
-  }
-});
-
 // src/cli.ts
 var cli_exports = {};
 __export(cli_exports, {
@@ -6014,6 +6072,32 @@ function createProgram() {
       await failRunCommand(err, verboseOf(command));
     }
   });
+  runCommand.command("grep").argument("<run>", "The run: its id, or its key (rk_\u2026) \u2014 the one PLUNE_RUN joins by").description(
+    "Print the run's automated cases as one --grep pattern for the runner (GET /v1/runs/:id/cases)"
+  ).option("--failed", "Only the cases whose latest result failed or broke \u2014 a muted failure does not count", false).action(async (run, options, command) => {
+    const verbose = verboseOf(command);
+    const { handleRunGrep: handleRunGrep2, runGrepSummary: runGrepSummary2, RunRefError: RunRefError2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
+    const { reportCasesFailure: reportCasesFailure2 } = await Promise.resolve().then(() => (init_cases(), cases_exports));
+    try {
+      const out = await handleRunGrep2({ run, failed: options.failed });
+      process.stdout.write(out.pattern + "\n");
+      process.stderr.write(runGrepSummary2(out, options.failed));
+    } catch (err) {
+      if (err instanceof RunRefError2) {
+        process.stderr.write(`plune: ${err.message}
+`);
+        process.exitCode = err.exitCode;
+        return;
+      }
+      const code = reportCasesFailure2(err, (s) => process.stderr.write(s));
+      if (code !== null) {
+        maybeStack(err, verbose);
+        process.exitCode = code;
+        return;
+      }
+      failUnexpected(err, verbose);
+    }
+  });
   runCommand.command("report").description("Send what the reporter could not \u2014 replays .plune/pending-results.jsonl").option("--file <path>", "The fallback file to replay").action(async (options, command) => {
     try {
       const { handleRunReport: handleRunReport2 } = await Promise.resolve().then(() => (init_run_lifecycle(), run_lifecycle_exports));