@pome-sh/cli 0.20.0 → 0.21.1

package/dist/src/cli/checks.js

@@ -1,197 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/**
- * `pome checks` — the assertable vocabulary a twin declares.
- *
- * Discovery is offline, like `pome tasks`: the declaration comes from the twin
- * package this CLI is pinned to. That is a SECOND resolution point (pome-cloud's
- * `resolveDeclaredChecks` is the first), accepted so authoring works without a
- * network, and gated by the digest handshake in `checks-add.ts` — which refuses
- * to write a sentence when the two pins disagree.
- */
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { checksDigest, templateSlots } from "@pome-sh/sdk/checks";
-import { MOUNTED_TWINS } from "@pome-sh/shared-types";
-import { GITHUB_CHECKS } from "@pome-sh/twin-github/checks";
-import { GMAIL_CHECKS } from "@pome-sh/twin-gmail/checks";
-import { LINEAR_CHECKS } from "@pome-sh/twin-linear/checks";
-import { SLACK_CHECKS } from "@pome-sh/twin-slack/checks";
-import { STRIPE_CHECKS } from "@pome-sh/twin-stripe/checks";
-import { resolvePackageRoot } from "./resolve-package-root.js";
-const REGISTRIES = {
-    github: GITHUB_CHECKS,
-    slack: SLACK_CHECKS,
-    stripe: STRIPE_CHECKS,
-    gmail: GMAIL_CHECKS,
-    linear: LINEAR_CHECKS,
-};
-// Twins that EXIST but declare nothing yet — DERIVED, not listed.
-//
-// The distinction is still real: `pome checks <twin>` must answer "not migrated
-// yet" for a twin that exists, and "no such twin" for a typo. What is no longer
-// real is the hand-maintained literal. F-1126 removed slack from it, F-1127
-// stripe, F-1128 gmail, and F-1129 would have emptied it — four tickets each
-// editing one line of a list that `MOUNTED_TWINS` already knows.
-//
-// So it is a set difference instead. Today it is EMPTY, which is A3's whole
-// acceptance criterion. The day a sixth twin mounts, it repopulates itself and
-// the "not migrated yet" path comes back live without anyone remembering to add
-// a literal — which is the failure this project is named for, one level down.
-// Annotated `string[]` on purpose: `MOUNTED_TWINS` is a literal-union tuple, so
-// the filtered result keeps that union and `isKnownTwin` cannot ask it about an
-// arbitrary string. Widening here is what keeps the caller's question — "is this
-// user-typed word a twin?" — expressible.
-const TWINS_WITHOUT_CHECKS = MOUNTED_TWINS.filter((twin) => !(twin in REGISTRIES));
-export function twinsWithChecks() {
-    return Object.keys(REGISTRIES).sort();
-}
-/**
- * Twins that exist but declare nothing yet.
- *
- * Exported because the no-vocabulary PATH is a real behaviour with its own
- * tests, and those tests need a twin on this list to exercise it. Naming one
- * inline is what broke five of them when stripe left the list (F-1127) — a
- * literal there asserts the MEMBERSHIP of the set, where the test means to
- * assert the behaviour, which is the same defect F-1075 hit with a hard-coded
- * picker index.
- *
- * A3 empties this list, and F-1129 answered the question that raised: the PATH
- * stays, the LITERAL goes. It is now `MOUNTED_TWINS` minus the registry, so an
- * empty result is a fact about the world rather than a list nobody updated.
- */
-export function twinsWithoutChecks() {
-    return [...TWINS_WITHOUT_CHECKS];
-}
-export function checksFor(twin) {
-    return REGISTRIES[twin] ?? [];
-}
-export function findCheck(id) {
-    for (const checks of Object.values(REGISTRIES)) {
-        const hit = checks.find((check) => check.id === id);
-        if (hit)
-            return hit;
-    }
-    return undefined;
-}
-export function twinOf(id) {
-    for (const [twin, checks] of Object.entries(REGISTRIES)) {
-        if (checks.some((check) => check.id === id))
-            return twin;
-    }
-    return undefined;
-}
-export function isKnownTwin(twin) {
-    return twinsWithChecks().includes(twin) || TWINS_WITHOUT_CHECKS.includes(twin);
-}
-/** `` No new labels were created in `<repo>` `` — every slot shown as its own
- *  name. Derived from the template, so no `title` field has to exist. */
-export function displaySentence(def) {
-    const { literals, params } = templateSlots(def.template);
-    return params.reduce((out, param, i) => `${out}<${param}>${literals[i + 1]}`, literals[0]);
-}
-export function localDigest(twin) {
-    return checksDigest(checksFor(twin));
-}
-/** Read the pin from OUR OWN manifest. The twin's exports map sends
- *  `./package.json` through its `"./*"` wildcard and fails to resolve — and the
- *  pin we control is the one that matters anyway. */
-export function pinnedVersion(pkg) {
-    const root = resolvePackageRoot(import.meta.url);
-    if (!root)
-        return "unknown";
-    try {
-        const manifest = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
-        return manifest.dependencies?.[pkg] ?? "unknown";
-    }
-    catch {
-        return "unknown";
-    }
-}
-export const SUBSTRATE_HELP = {
-    final: "the final state",
-    "seed+final": "the seed and the final state",
-    tape: "the recorded call tape",
-};
-function useColor() {
-    return Boolean(process.stdout.isTTY && !process.env.NO_COLOR);
-}
-function dim(s) {
-    return useColor() ? `\x1b[2m${s}\x1b[0m` : s;
-}
-function bold(s) {
-    return useColor() ? `\x1b[1m${s}\x1b[0m` : s;
-}
-export function argFlagsFor(def) {
-    return templateSlots(def.template)
-        .params.map((name) => `--arg ${name}=${def.params[name].example}`)
-        .join(" ");
-}
-function jsonView(twin) {
-    return {
-        twin,
-        digest: localDigest(twin),
-        checks: checksFor(twin).map((def) => ({
-            id: def.id,
-            template: def.template,
-            description: def.description,
-            substrate: def.substrate,
-            params: templateSlots(def.template).params.map((name) => ({
-                name,
-                pattern: def.params[name].pattern,
-                example: def.params[name].example,
-            })),
-        })),
-    };
-}
-export async function runChecksCommand(twinArg, opts) {
-    if (!twinArg) {
-        if (opts.json) {
-            console.log(JSON.stringify({ twins: twinsWithChecks() }, null, 2));
-            return;
-        }
-        console.log(bold("Pome checks"));
-        console.log(dim("Twins that declare an assertable vocabulary."));
-        console.log("");
-        for (const twin of twinsWithChecks()) {
-            console.log(`  ${bold(twin)} ${dim(`(${checksFor(twin).length} checks)`)}`);
-        }
-        console.log("");
-        console.log(dim("Run `pome checks <twin>` to list them."));
-        return;
-    }
-    const twin = twinArg.trim();
-    if (!isKnownTwin(twin)) {
-        console.error(`Unknown twin "${twin}". Twins that declare checks: ${twinsWithChecks().join(", ")}.`);
-        process.exitCode = 2;
-        return;
-    }
-    if (opts.json) {
-        console.log(JSON.stringify(jsonView(twin), null, 2));
-        return;
-    }
-    const checks = checksFor(twin);
-    if (checks.length === 0) {
-        console.log(bold(`${twin} — no declared checks yet`));
-        console.log(dim(`Its vocabulary has not been migrated. Use [model] criteria for ${twin} for now.`));
-        return;
-    }
-    console.log(`${bold(`${twin} — ${checks.length} declared check${checks.length === 1 ? "" : "s"}`)} ` +
-        dim(`(@pome-sh/twin-${twin} ${pinnedVersion(`@pome-sh/twin-${twin}`)})`));
-    console.log("");
-    for (const def of checks) {
-        console.log(`  ${bold(def.id)}`);
-        console.log(`    ${displaySentence(def)}`);
-        console.log(`    ${dim(def.description)}`);
-        console.log(`    ${dim(`needs: ${SUBSTRATE_HELP[def.substrate] ?? def.substrate}`)}`);
-        console.log(`    ${dim(`pome checks add <file> --check ${def.id} ${argFlagsFor(def)}`)}`);
-        console.log("");
-    }
-    // F-1126 — the digest, shown rather than only computed.
-    //
-    // `checks add` already refuses to write a sentence when this disagrees with
-    // the control plane's (`checks-add.ts`), and that refusal is correct but
-    // opaque: an author who hits it has no way to see WHICH side moved. Printing
-    // it here turns "the digest handshake refuses" into something a user can
-    // compare against `GET /v1/checks?twin=<twin>` themselves.
-    console.log(dim(`digest ${localDigest(twin)}`));
-}

package/dist/src/cli/compile-seeds.d.ts

@@ -1,7 +0,0 @@
-interface CompileOptions {
-    force: boolean;
-    hosted: boolean;
-    apiBaseUrl: string;
-}
-export declare function runCompileSeeds(target: string | undefined, opts: CompileOptions): Promise<number>;
-export {};

package/dist/src/cli/compile-seeds.js

@@ -1,260 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/**
- * `pome compile-seeds` — translate the prose `## Seed State` section of a
- * scenario markdown file into a sidecar JSON seed via the Claude API, verify
- * it loads cleanly into the GitHub twin, and write the result next to the
- * scenario.
- *
- * See `docs/agents/scenario-prose-seed.md` for the prose convention and the
- * defense layers (schema validation, twin-load verification, PR review).
- */
-import { createHash } from "node:crypto";
-import { existsSync } from "node:fs";
-import { readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { extname, join, resolve } from "node:path";
-import { z } from "zod";
-import { compileSeed, COMPILER_MODEL } from "../task/seed-compiler.js";
-import { compileSeedHosted } from "../task/seed-compiler-hosted.js";
-import { verifySeedWithTwin } from "../task/seed-verifier.js";
-import { exitCodeFor } from "../hosted/errors.js";
-const SIDECAR_META_VERSION = 1;
-/**
- * Sidecars written by hand rather than by the compiler mark themselves with
- * this sentinel. It is a statement of provenance, not a cache state: the seeds
- * that carry it encode adversarial setups (a backdoored PR, a fabricated green
- * CI status, an exfiltration lure) that a recompile would quietly rewrite,
- * changing what the task tests while the run still reports normally. So it
- * outranks even `--force`; to recompile one, delete the sidecar or drop its
- * `_meta` first.
- */
-const HAND_AUTHORED_MARKER = "hand-authored";
-const HAND_AUTHORED_SOURCE_HASH = `sha256:${HAND_AUTHORED_MARKER}`;
-export async function runCompileSeeds(target, opts) {
-    const files = await resolveTaskFiles(target ?? "tasks");
-    if (files.length === 0) {
-        console.error(`No task .md files found at ${target ?? "tasks"}.`);
-        return 2;
-    }
-    const results = [];
-    for (const file of files) {
-        results.push(await compileOne(file, opts));
-    }
-    for (const r of results) {
-        const stamp = statusStamp(r.status);
-        const tail = r.message ? ` — ${r.message}` : "";
-        const cost = r.inputTokens !== undefined ? ` (${r.inputTokens} in / ${r.outputTokens} out, ${r.durationMs}ms)` : "";
-        console.error(`${stamp} ${r.path}${tail}${cost}`);
-    }
-    const errors = results.filter((r) => r.status === "error");
-    if (errors.length > 0) {
-        console.error(`\n${errors.length} error(s).`);
-        // Propagate the worst hosted exit code (e.g. 3=auth, 4=quota) so CI scripts
-        // can branch on the reason. Falls back to 1 for local-only failures.
-        const worstHosted = errors.reduce((max, r) => Math.max(max, r.exitCode ?? 0), 0);
-        return worstHosted > 0 ? worstHosted : 1;
-    }
-    return 0;
-}
-async function compileOne(taskPath, opts) {
-    let markdown;
-    try {
-        markdown = await readFile(taskPath, "utf8");
-    }
-    catch (err) {
-        return { path: taskPath, status: "error", message: `read failed: ${err.message}` };
-    }
-    const seedText = extractSeedSection(markdown).trim();
-    if (seedText.length === 0) {
-        return { path: taskPath, status: "skipped-no-seed", message: "no ## Seed State section" };
-    }
-    // Other twins use a different schema; v1 only emits a flat github seed. Check
-    // twin first so those tasks are silently skipped without surfacing misleading
-    // "still on inline JSON" warnings.
-    //
-    // A task naming github *alongside* another twin is seeded from a per-twin
-    // envelope (`{ github: {...}, linear: {...} }`), so compiling it would replace
-    // the envelope with a github-only seed and drop the other twin's half.
-    const twins = readTwinsFromConfig(markdown);
-    const githubOnly = twins.length === 1 && twins[0] === "github";
-    if (twins.length > 0 && !githubOnly) {
-        return {
-            path: taskPath,
-            status: "skipped-unsupported-twin",
-            message: `twins=${twins.join(",")} — only single-twin github tasks are supported yet`
-        };
-    }
-    // Heuristic: if the section is a fenced JSON block, this scenario is still
-    // on the legacy inline format. Authors must replace the block with prose
-    // before compile-seeds can take over.
-    if (looksLikeJsonBlock(seedText)) {
-        return {
-            path: taskPath,
-            status: "skipped-inline-json",
-            message: "still on inline JSON — replace the fenced JSON with prose"
-        };
-    }
-    const sidecarPath = sidecarPathFor(taskPath);
-    const proseHash = hashProse(seedText);
-    // Checked ahead of `--force` and ahead of the cache: this is authorship, not
-    // staleness. The sentinel can never equal a real sha256, so without this the
-    // cache always misses and the hand-authored seed is silently overwritten.
-    if (existsSync(sidecarPath) && (await isHandAuthored(sidecarPath))) {
-        return {
-            path: taskPath,
-            status: "skipped-hand-authored",
-            message: `hand-authored seed left untouched (${sidecarPath}) — delete it or drop its _meta to recompile`
-        };
-    }
-    // Cache check only applies to local compile — hosted callers may have
-    // different model versions than the locally-pinned COMPILER_MODEL, and the
-    // cloud has its own edge cache to avoid duplicate work anyway.
-    if (!opts.force && !opts.hosted && existsSync(sidecarPath)) {
-        const cached = await readSidecarMeta(sidecarPath);
-        if (cached && cached.source_hash === proseHash && cached.model === COMPILER_MODEL) {
-            return { path: taskPath, status: "skipped-cached", message: `up-to-date (${sidecarPath})` };
-        }
-    }
-    let result;
-    try {
-        result = opts.hosted
-            ? await compileSeedHosted(seedText, { apiBaseUrl: opts.apiBaseUrl, taskPath })
-            : await compileSeed(seedText);
-    }
-    catch (err) {
-        return {
-            path: taskPath,
-            status: "error",
-            message: `compile failed: ${err.message}`,
-            exitCode: opts.hosted ? exitCodeFor(err) : undefined
-        };
-    }
-    try {
-        verifySeedWithTwin(result.seed);
-    }
-    catch (err) {
-        return { path: taskPath, status: "error", message: err.message };
-    }
-    const payload = {
-        _meta: {
-            version: SIDECAR_META_VERSION,
-            source_hash: proseHash,
-            model: result.model,
-            compiled_at: new Date().toISOString()
-        },
-        ...result.seed
-    };
-    await writeFile(sidecarPath, JSON.stringify(payload, null, 2) + "\n");
-    return {
-        path: taskPath,
-        status: "compiled",
-        message: `→ ${sidecarPath}`,
-        inputTokens: result.inputTokens,
-        outputTokens: result.outputTokens,
-        durationMs: result.durationMs
-    };
-}
-function extractSeedSection(markdown) {
-    // Mirrors the H2-section logic in parseTask.ts: find the "## Seed State"
-    // heading and return everything until the next H2.
-    const headingRegex = /^##\s+seed state\s*$/im;
-    const m = markdown.match(headingRegex);
-    if (!m)
-        return "";
-    const start = m.index + m[0].length;
-    const rest = markdown.slice(start);
-    const nextHeading = rest.match(/^##\s+/m);
-    return nextHeading ? rest.slice(0, nextHeading.index).trim() : rest.trim();
-}
-function readTwinsFromConfig(markdown) {
-    // Find the `## Config` heading and read everything until the next `##` or
-    // end of file. JS regex has no `\Z`, so we use a lookahead-or-EOF approach.
-    const headingMatch = markdown.match(/^##\s+config\s*$/im);
-    if (!headingMatch)
-        return [];
-    const rest = markdown.slice(headingMatch.index + headingMatch[0].length);
-    const nextHeading = rest.match(/^##\s+/m);
-    const block = nextHeading ? rest.slice(0, nextHeading.index) : rest;
-    const twinsLine = block.match(/^\s*twins\s*:\s*\[(.+?)\]/m);
-    if (!twinsLine)
-        return [];
-    return twinsLine[1]
-        .split(",")
-        .map((s) => s.trim().replace(/^["']|["']$/g, ""))
-        .filter(Boolean);
-}
-function looksLikeJsonBlock(input) {
-    return /^```(?:json)?\s*\{/m.test(input.trim());
-}
-function sidecarPathFor(taskPath) {
-    const ext = extname(taskPath);
-    return taskPath.slice(0, -ext.length) + ".seed.json";
-}
-function hashProse(input) {
-    return "sha256:" + createHash("sha256").update(input.replace(/\s+$/g, "")).digest("hex");
-}
-const sidecarMetaSchema = z.object({
-    _meta: z.object({
-        version: z.number().int(),
-        source_hash: z.string(),
-        model: z.string(),
-        compiled_at: z.string()
-    })
-});
-async function readSidecarMeta(path) {
-    try {
-        const raw = await readFile(path, "utf8");
-        const parsed = sidecarMetaSchema.safeParse(JSON.parse(raw));
-        if (!parsed.success)
-            return null;
-        return { source_hash: parsed.data._meta.source_hash, model: parsed.data._meta.model };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Deliberately more lenient than `sidecarMetaSchema`: a hand-edited sidecar may
- * carry only the sentinel and omit `version`/`compiled_at`. Failing that parse
- * would fall through to a recompile — the exact overwrite this guards against —
- * so any `_meta` bearing either sentinel field counts.
- */
-async function isHandAuthored(path) {
-    try {
-        const raw = await readFile(path, "utf8");
-        const meta = JSON.parse(raw)._meta;
-        if (!meta)
-            return false;
-        return meta.model === HAND_AUTHORED_MARKER || meta.source_hash === HAND_AUTHORED_SOURCE_HASH;
-    }
-    catch {
-        return false;
-    }
-}
-async function resolveTaskFiles(target) {
-    const abs = resolve(target);
-    if (!existsSync(abs))
-        throw new Error(`Path not found: ${target}`);
-    const st = await stat(abs);
-    if (st.isFile())
-        return [abs];
-    const entries = await readdir(abs);
-    return entries.filter((e) => e.endsWith(".md")).sort().map((e) => join(abs, e));
-}
-function statusStamp(status) {
-    switch (status) {
-        case "compiled":
-            return "OK  ";
-        case "skipped-cached":
-            return "skip";
-        case "skipped-hand-authored":
-            return "keep";
-        case "skipped-no-seed":
-            return "skip";
-        case "skipped-unsupported-twin":
-            return "skip";
-        case "skipped-inline-json":
-            return "warn";
-        case "error":
-            return "FAIL";
-    }
-}

package/dist/src/cli/credentials.d.ts

@@ -1,32 +0,0 @@
-export interface ResolveCredentialsInput {
-    /** Optional. If set, wins over any stored `api_url`. Callers should pass
-     *  the resolved `--api-url` flag value (which Commander defaults to the
-     *  POME_API_URL env var or `DEFAULT_CONTROL_PLANE_URL`). Leave undefined
-     *  to fall back to the stored value. */
-    apiBaseUrl?: string;
-    credentialsPath?: string;
-}
-export interface ResolvedCredentials {
-    apiKey: string;
-    apiBaseUrl: string;
-    /** The team the api key belongs to, when known (stored at login). Powers the
-     *  `.pome/link.json` team gate (F-819). Undefined for a bare `POME_API_KEY`
-     *  env key, whose team is known only server-side. */
-    teamId?: string;
-}
-export interface CredentialsFile {
-    api_key?: string;
-    api_url?: string;
-    dashboard_url?: string;
-    team_id?: string;
-    created_at?: string;
-}
-export declare function defaultCredentialsPath(): string;
-/** Store after successful login: Keychain on macOS when possible, else file. */
-export declare function persistCredentialsAfterLogin(credentials: Required<Pick<CredentialsFile, "api_key" | "api_url" | "dashboard_url" | "team_id">>, path?: string): Promise<{
-    stored: "keychain" | "file";
-    path?: string;
-}>;
-export declare function clearLocalCredentials(path?: string): Promise<void>;
-export declare function resolveCredentials(input: ResolveCredentialsInput): Promise<ResolvedCredentials>;
-export declare function writeCredentialsFile(credentials: Required<Pick<CredentialsFile, "api_key" | "api_url" | "dashboard_url" | "team_id">>, path?: string): Promise<void>;

package/dist/src/cli/credentials.js

@@ -1,121 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-import { chmod, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { HostedAuthError } from "../hosted/errors.js";
-import { deleteKeychainCredentials, keychainSupported, readKeychainCredentials, writeKeychainCredentials, } from "./keychain.js";
-const DEFAULT_PATH = () => join(homedir(), ".pome", "credentials.json");
-export function defaultCredentialsPath() {
-    return DEFAULT_PATH();
-}
-/** Store after successful login: Keychain on macOS when possible, else file. */
-export async function persistCredentialsAfterLogin(credentials, path = DEFAULT_PATH()) {
-    if (keychainSupported()) {
-        try {
-            await writeKeychainCredentials(credentials);
-            try {
-                await rm(path, { force: true });
-            }
-            catch {
-                /* ignore */
-            }
-            return { stored: "keychain" };
-        }
-        catch {
-            /* fall through */
-        }
-    }
-    await writeCredentialsFile(credentials, path);
-    return { stored: "file", path };
-}
-export async function clearLocalCredentials(path = DEFAULT_PATH()) {
-    await deleteKeychainCredentials();
-    try {
-        await rm(path, { force: true });
-    }
-    catch {
-        /* ignore */
-    }
-}
-export async function resolveCredentials(input) {
-    const envKey = process.env.POME_API_KEY;
-    if (envKey && envKey.trim().length > 0) {
-        const apiBaseUrl = resolveApiBaseUrl(input.apiBaseUrl, undefined);
-        return { apiKey: envKey.trim(), apiBaseUrl };
-    }
-    const keychain = await readKeychainCredentials();
-    if (keychain &&
-        typeof keychain.api_key === "string" &&
-        keychain.api_key.trim().length > 0) {
-        return {
-            apiKey: keychain.api_key.trim(),
-            apiBaseUrl: resolveApiBaseUrl(input.apiBaseUrl, keychain.api_url),
-            teamId: normalizeTeamId(keychain.team_id),
-        };
-    }
-    const path = input.credentialsPath ?? DEFAULT_PATH();
-    let raw;
-    try {
-        await assertSafeCredentialFileMode(path);
-        raw = await readFile(path, "utf8");
-    }
-    catch (err) {
-        if (err instanceof Error &&
-            err.code === "ENOENT") {
-            // F0-5c — surface this as a HostedAuthError so the top-level
-            // exit-code mapper returns the documented 3 ("auth"). The previous
-            // plain `Error` propagated to Commander's fallback and got
-            // demoted to exit 2 ("twin/orch").
-            throw new HostedAuthError("Hosted mode requires authentication. Run `pome login`, set POME_API_KEY in your " +
-                `environment, or sign in on macOS to store credentials in Keychain. Expected file: ${path}.`);
-        }
-        throw err;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new Error(`${path} is not valid JSON.`);
-    }
-    if (typeof parsed.api_key !== "string" ||
-        parsed.api_key.trim().length === 0) {
-        throw new Error(`${path} is missing "api_key".`);
-    }
-    return {
-        apiKey: parsed.api_key.trim(),
-        apiBaseUrl: resolveApiBaseUrl(input.apiBaseUrl, parsed.api_url),
-        teamId: normalizeTeamId(parsed.team_id),
-    };
-}
-function normalizeTeamId(raw) {
-    if (typeof raw !== "string")
-        return undefined;
-    const trimmed = raw.trim();
-    return trimmed.length > 0 ? trimmed : undefined;
-}
-function resolveApiBaseUrl(callerInput, storedApiUrl) {
-    const candidate = callerInput ?? storedApiUrl;
-    if (typeof candidate !== "string" || candidate.trim().length === 0) {
-        throw new Error("Refusing to resolve hosted credentials: no apiBaseUrl supplied and no stored api_url found.");
-    }
-    return normalizeBaseUrl(candidate);
-}
-async function assertSafeCredentialFileMode(path) {
-    const st = await stat(path);
-    const perm = st.mode & 0o777;
-    if ((perm & 0o077) !== 0) {
-        throw new Error(`Refusing to read credentials at ${path}: mode 0${perm.toString(8)} is too permissive (group/other bits must be 0). Run: chmod 600 ${path}`);
-    }
-}
-export async function writeCredentialsFile(credentials, path = DEFAULT_PATH()) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await writeFile(path, `${JSON.stringify({
-        ...credentials,
-        created_at: new Date().toISOString(),
-    }, null, 2)}\n`, { mode: 0o600 });
-    await chmod(path, 0o600);
-}
-function normalizeBaseUrl(raw) {
-    return new URL(raw).toString().replace(/\/$/, "");
-}

package/dist/src/cli/criterion-binding.d.ts

@@ -1,41 +0,0 @@
-import { type CodeCriterion } from "../task/parseTask.js";
-export type CriterionBinding = {
-    kind: "bound";
-    checkId: string;
-} | {
-    kind: "corrupted";
-    checkId: string;
-    slot: string;
-    value: string;
-    example: string;
-} | {
-    kind: "unbound";
-} | {
-    kind: "no-vocabulary";
-};
-export declare function bindCriterion(criterion: CodeCriterion): CriterionBinding;
-export interface BindingFinding {
-    criterion: CodeCriterion;
-    binding: Extract<CriterionBinding, {
-        kind: "corrupted" | "unbound";
-    }>;
-}
-export interface BindingAudit {
-    /** How many criteria bind. A count, not a list — a pass line needs the number. */
-    bound: number;
-    /** Criteria whose twin has not migrated its vocabulary. NEITHER a pass nor a
-     *  failure: this CLI holds no declaration to judge them by, and folding them
-     *  into either bucket would be the false clean bill the vocabulary exists to
-     *  remove. Kept separate so a caller has to decide what to say about them. */
-    unanswerable: CodeCriterion[];
-    /** The criteria that will not be graded. */
-    findings: BindingFinding[];
-}
-/** Classify every `[code]` criterion in a task file. Three buckets, because the
- *  interesting one is the third and lumping the second into the first is how a
- *  tool ends up promising more than it checked. */
-export declare function auditCodeCriteria(markdown: string): BindingAudit;
-/** The author-facing report, one block per finding. Names the file so it stands
- *  on its own in a scrollback that already carries a write summary, and echoes
- *  each sentence verbatim so the author can find the line. */
-export declare function formatBindingReport(findings: BindingFinding[], file: string): string;