@satanwagen/reviewkit 0.1.2 → 0.1.4

package/cli/emblema-sync.mjs

@@ -1,675 +0,0 @@
-#!/usr/bin/env node
-/**
- * reviewkit-emblema — local sync agent pairing a ReviewKit project with the
- * Emblema desktop app (contract v2, see docs/EMBLEMA_SYNC_PROTOCOL.md).
- *
- * Runs in the PROJECT directory (the repo whose site is being reviewed).
- * State lives in .reviewkit/emblema-sync.json. Zero dependencies: node http,
- * the global WebSocket client (node >= 21) and crypto.
- *
- * Commands:
- *   init    --origin <https://site> [--name X] [--sync-token T] [--sync-url U]
- *           [--routes /,/about] [--repo <abs path>] [--port N] [--intake-url U]
- *   key     print the current pairing key (emk_…)
- *   rotate  new secret — the old key stops authenticating immediately
- *   revoke  disable the pairing entirely (until the next rotate/init)
- *   serve   run the HTTP API + realtime bridge (rk-sync room -> Emblema intake)
- */
-
-import { randomBytes, randomUUID } from 'node:crypto';
-import { mkdirSync, readFileSync, realpathSync, renameSync, watch, writeFileSync } from 'node:fs';
-import { createServer } from 'node:http';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-export const KEY_PREFIX = 'emk_';
-export const CONTRACT_VERSION = 2;
-export const DEFAULT_API_PORT = 48770;
-const DEFAULT_SYNC_URL = 'wss://agropolio.fucking.style/rk-sync';
-const DEFAULT_INTAKE_URL = 'http://127.0.0.1:48752/intake/review';
-const RK_SYNC_PROTOCOL_VERSION = 1;
-const STATE_DIR = '.reviewkit';
-const STATE_FILE = 'emblema-sync.json';
-const PUSH_DEBOUNCE_MS = 300;
-
-/* ---------------- key + state (pure, tested) ---------------- */
-
-export function encodeKey({ id, name, url, secret }) {
-  const json = JSON.stringify({ v: CONTRACT_VERSION, id, name, url, secret });
-  return KEY_PREFIX + Buffer.from(json, 'utf8').toString('base64url');
-}
-
-export function decodeKey(key) {
-  if (typeof key !== 'string' || !key.startsWith(KEY_PREFIX)) return null;
-  try {
-    const parsed = JSON.parse(Buffer.from(key.slice(KEY_PREFIX.length), 'base64url').toString('utf8'));
-    if (parsed.v !== CONTRACT_VERSION) return null;
-    for (const field of ['id', 'name', 'url', 'secret']) {
-      if (typeof parsed[field] !== 'string' || parsed[field] === '') return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-
-/** ReviewKit item -> Emblema finding (contract v2 shape). */
-export function toFinding(item, seq) {
-  const payload = item.payload ?? {};
-  const titles = {
-    copy: () => `Rewrite: "${String(payload.before ?? '').slice(0, 60)}" → "${String(payload.after ?? '').slice(0, 60)}"`,
-    image: () => `Replace image${payload.description ? `: ${payload.description}` : ''}`,
-    comment: () => `Comment: ${String(payload.text ?? '').slice(0, 80)}`,
-    delete: () => `Remove element${payload.reason ? `: ${payload.reason}` : ''}`,
-    move: () => `Move element ${payload.direction ?? ''}`.trim(),
-    style: () => `Style: ${String(payload.description ?? '').slice(0, 80)}`,
-  };
-  const detailParts = [
-    `selector: ${item.target?.selector ?? '?'}`,
-    item.target?.textSnippet ? `text: "${item.target.textSnippet}"` : null,
-    Object.keys(payload).length > 0 ? `payload: ${JSON.stringify(payload)}` : null,
-    item.note ? `note: ${item.note}` : null,
-    item.author?.name ? `by: ${item.author.name}` : null,
-  ].filter(Boolean);
-  return {
-    id: item.id,
-    severity: item.priority === 'must' ? 'high' : 'low',
-    file: item.target?.sourceFile ?? item.route ?? '/',
-    line: item.target?.sourceLine ?? 0,
-    title: (titles[item.type] ?? (() => `${item.type} change`))(),
-    detail: detailParts.join('\n'),
-    status: item.status ?? 'open',
-    updatedAt: new Date().toISOString(),
-    _seq: seq,
-    _route: item.route ?? '/',
-    _raw: item,
-  };
-}
-
-/** Emblema status -> ReviewKit ItemStatus. `open` REOPENS a finding (a fix
-    was abandoned or resolved by mistake) — written into the room, so the
-    site pin reverts live. */
-export const STATUS_MAP = { open: 'open', accepted: 'accepted', dismissed: 'rejected', fixed: 'applied' };
-
-function statePath(cwd) {
-  return join(cwd, STATE_DIR, STATE_FILE);
-}
-
-function loadState(cwd) {
-  try {
-    return JSON.parse(readFileSync(statePath(cwd), 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-function saveState(cwd, state) {
-  const path = statePath(cwd);
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.tmp-${process.pid}`;
-  writeFileSync(tmp, JSON.stringify(state, null, 2), 'utf8');
-  renameSync(tmp, path);
-}
-
-function newSecret() {
-  return randomBytes(32).toString('hex');
-}
-
-/**
- * Current state for request handling: re-read from disk so `rotate`/`revoke`
- * run in another process take effect on the very next request. The directory
- * watcher in `serve` is best-effort only (rename-swap writes can slip past
- * fs.watch — live-verified: a cached secret kept authenticating after rotate
- * AND revoke); authentication must never trust a cached secret. Only lastAck
- * belongs to the running agent and is preserved from the cached state.
- */
-export function freshState(cwd, cached) {
-  const disk = loadState(cwd);
-  if (!disk) return cached;
-  return { ...disk, lastAck: cached?.lastAck ?? disk.lastAck ?? null };
-}
-
-function keyOf(state) {
-  return encodeKey({ id: state.id, name: state.name, url: state.url, secret: state.secret });
-}
-
-function reviewkitVersion() {
-  try {
-    const pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'));
-    return pkg.version ?? '0.0.0';
-  } catch {
-    return '0.0.0';
-  }
-}
-
-/* ---------------- CLI commands ---------------- */
-
-function parseFlags(argv) {
-  const flags = {};
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i].startsWith('--')) flags[argv[i].slice(2)] = argv[i + 1] ?? '';
-  }
-  return flags;
-}
-
-function cmdInit(cwd, flags) {
-  const existing = loadState(cwd);
-  const origin = flags.origin ?? existing?.settings?.origin;
-  if (!origin) {
-    console.error('init needs --origin <https://site-under-review> (the rk-sync room origin)');
-    process.exit(1);
-  }
-  const port = Number(flags.port ?? existing?.settings?.port ?? DEFAULT_API_PORT);
-  const state = {
-    v: CONTRACT_VERSION,
-    id: existing?.id ?? `rkp-${randomUUID()}`,
-    name: flags.name ?? existing?.name ?? resolve(cwd).split('/').filter(Boolean).pop(),
-    url: `http://127.0.0.1:${port}`,
-    secret: newSecret(),
-    revoked: false,
-    settings: {
-      origin,
-      routes: (flags.routes ?? existing?.settings?.routes?.join(',') ?? '/').split(',').map((r) => r.trim()).filter(Boolean),
-      syncUrl: flags['sync-url'] ?? existing?.settings?.syncUrl ?? DEFAULT_SYNC_URL,
-      syncToken: flags['sync-token'] ?? existing?.settings?.syncToken ?? '',
-      repoPath: flags.repo ?? existing?.settings?.repoPath ?? resolve(cwd),
-      intakeUrl: flags['intake-url'] ?? existing?.settings?.intakeUrl ?? DEFAULT_INTAKE_URL,
-      port,
-    },
-    lastAck: existing?.lastAck ?? null,
-  };
-  saveState(cwd, state);
-  ensureGitignored(cwd);
-  console.log(keyOf(state));
-}
-
-/** The state file carries the bearer secret — keep it out of git. Appends
-    `.reviewkit/` to an existing repo .gitignore (best-effort: no .gitignore
-    or unwritable tree just skips; init must never fail on this). */
-function ensureGitignored(cwd) {
-  const path = join(cwd, '.gitignore');
-  let current = '';
-  try {
-    current = readFileSync(path, 'utf8');
-  } catch {
-    return; // no .gitignore (likely no repo) — nothing to protect against
-  }
-  if (current.split(/\r?\n/).some((line) => line.trim().replace(/\/+$/, '') === STATE_DIR)) return;
-  try {
-    const sep = current === '' || current.endsWith('\n') ? '' : '\n';
-    writeFileSync(path, `${current}${sep}${STATE_DIR}/\n`, 'utf8');
-    log(`added ${STATE_DIR}/ to .gitignore (the sync state holds the pairing secret)`);
-  } catch {
-    /* read-only tree — the user manages ignores themselves */
-  }
-}
-
-function requireState(cwd) {
-  const state = loadState(cwd);
-  if (!state) {
-    console.error(`no ${STATE_DIR}/${STATE_FILE} here — run \`reviewkit-emblema init --origin …\` first`);
-    process.exit(1);
-  }
-  return state;
-}
-
-function cmdKey(cwd) {
-  const state = requireState(cwd);
-  if (state.revoked) {
-    console.error('pairing is revoked — `rotate` to issue a fresh key');
-    process.exit(1);
-  }
-  console.log(keyOf(state));
-}
-
-function cmdRotate(cwd) {
-  const state = requireState(cwd);
-  state.secret = newSecret();
-  state.revoked = false;
-  saveState(cwd, state);
-  console.log(keyOf(state));
-}
-
-function cmdRevoke(cwd) {
-  const state = requireState(cwd);
-  state.revoked = true;
-  saveState(cwd, state);
-  console.log('revoked — the key no longer authenticates (rotate to re-enable)');
-}
-
-/* ---------------- serve: HTTP API + realtime bridge ---------------- */
-
-export function cmdServe(cwd) {
-  let state = requireState(cwd);
-  const port = state.settings.port ?? DEFAULT_API_PORT;
-
-  // External `rotate`/`revoke` (CLI in another terminal) must take effect on
-  // the running agent. The watcher keeps the realtime push path fresh, but it
-  // is best-effort — the HTTP handler additionally calls adoptFromDisk() per
-  // request, because auth against a stale cached secret is a security hole.
-  const adoptFromDisk = () => {
-    const next = freshState(cwd, state);
-    if (next === state) return;
-    if (next.secret !== state.secret || next.revoked !== state.revoked) {
-      log(next.revoked ? 'pairing revoked (picked up from disk)' : 'key rotated (picked up from disk)');
-    }
-    state = next;
-  };
-  let watcher = null;
-  try {
-    let reloadTimer = null;
-    watcher = watch(join(cwd, STATE_DIR), () => {
-      if (reloadTimer) return;
-      reloadTimer = setTimeout(() => {
-        reloadTimer = null;
-        adoptFromDisk();
-      }, 150);
-    });
-  } catch {
-    /* watch unsupported — restart the agent after CLI rotate/revoke */
-  }
-
-  /** id -> finding; seq is a monotonically increasing cursor. */
-  const findings = new Map();
-  /** id -> seq at deletion time — tombstones so Emblema's poll learns about
-      removals instead of showing deleted comments forever. Cleared when the
-      same id comes back (undo / re-add). */
-  const deletedIds = new Map();
-  let seq = 0;
-  /** route -> live WebSocket (for status write-back). */
-  const sockets = new Map();
-  let pushTimer = null;
-  const pushQueue = new Map(); // id -> raw item
-
-  // Merge-write: only lastAck belongs to the running agent — a full dump
-  // would clobber a secret rotated by the CLI in another process.
-  const persistAck = () => {
-    const disk = loadState(cwd) ?? state;
-    disk.lastAck = state.lastAck;
-    saveState(cwd, disk);
-  };
-
-  const upsertItem = (item) => {
-    if (!item || typeof item.id !== 'string') return;
-    seq += 1;
-    deletedIds.delete(item.id);
-    findings.set(item.id, toFinding(item, seq));
-    queuePush(item);
-  };
-  // Tombstone unconditionally: a delete for an id this process never saw (a
-  // ghost row left in the Emblema tile by an older/restarted agent) must still
-  // be reportable under `deleted`, or the row can never be cleared.
-  const dropItem = (id) => {
-    // Already tombstoned and not live: nothing changed — don't churn the
-    // cursor (rooms replay their `deleted` list on every reconnect).
-    if (!findings.delete(id) && deletedIds.has(id)) return;
-    seq += 1;
-    deletedIds.set(id, seq);
-  };
-
-  /* -- realtime push to the Emblema intake (headers per contract v2) -- */
-  function queuePush(item) {
-    if (state.revoked) return;
-    pushQueue.set(item.id, item);
-    if (pushTimer) return;
-    pushTimer = setTimeout(() => {
-      pushTimer = null;
-      void flushPush();
-    }, PUSH_DEBOUNCE_MS);
-  }
-
-  async function flushPush() {
-    const items = [...pushQueue.values()];
-    pushQueue.clear();
-    if (items.length === 0 || state.revoked) return;
-    const body = {
-      v: 1,
-      source: 'review-kit',
-      batchId: `rk-batch-${Date.now().toString(36)}-${randomBytes(4).toString('hex')}`,
-      sentAt: new Date().toISOString(),
-      repoPath: state.settings.repoPath,
-      site: { origin: state.settings.origin, reviewUrl: state.settings.origin },
-      sessionAuthor: '',
-      items,
-    };
-    try {
-      const res = await fetch(state.settings.intakeUrl, {
-        method: 'POST',
-        headers: {
-          'content-type': 'application/json',
-          authorization: `Bearer ${state.secret}`,
-          'x-reviewkit-key-id': state.id,
-        },
-        body: JSON.stringify(body),
-      });
-      if (res.ok) {
-        state.lastAck = new Date().toISOString();
-        persistAck();
-        log(`push: ${items.length} item(s) → intake ok`);
-      } else {
-        log(`push: intake answered HTTP ${res.status}`);
-      }
-    } catch {
-      log('push: Emblema intake unreachable (will retry on next change)');
-    }
-  }
-
-  /* -- rk-sync rooms: one socket per configured route -- */
-  function connectRoom(route) {
-    if (!state.settings.syncToken) {
-      log('no syncToken configured — realtime bridge disabled (API still serves)');
-      return;
-    }
-    let ws;
-    let closed = false;
-    let attempts = 0;
-    const open = () => {
-      if (closed) return;
-      ws = new WebSocket(state.settings.syncUrl);
-      ws.onopen = () => {
-        attempts = 0;
-        ws.send(
-          JSON.stringify({
-            t: 'hello',
-            v: RK_SYNC_PROTOCOL_VERSION,
-            token: state.settings.syncToken,
-            room: { origin: state.settings.origin, route },
-            user: { id: `rk-emblema-${state.id.slice(0, 18)}`, name: 'Emblema sync', color: '#6b7280' },
-          }),
-        );
-      };
-      ws.onmessage = (event) => {
-        let msg;
-        try {
-          msg = JSON.parse(String(event.data));
-        } catch {
-          return;
-        }
-        switch (msg.t) {
-          case 'welcome': {
-            sockets.set(route, ws);
-            log(`room ${route}: joined (${(msg.items ?? []).length} items)`);
-            for (const item of msg.items ?? []) {
-              seq += 1;
-              deletedIds.delete(item.id);
-              findings.set(item.id, toFinding(item, seq));
-            }
-            for (const id of msg.deleted ?? []) dropItem(id);
-            break;
-          }
-          case 'item:add':
-            upsertItem(msg.item);
-            break;
-          case 'item:update': {
-            const existing = findings.get(msg.id)?._raw;
-            if (existing) upsertItem({ ...existing, ...msg.patch, id: msg.id });
-            break;
-          }
-          case 'item:status': {
-            const existing = findings.get(msg.id)?._raw;
-            if (existing) upsertItem({ ...existing, status: msg.status });
-            break;
-          }
-          case 'item:delete':
-            dropItem(msg.id);
-            break;
-          case 'ping':
-            ws.send(JSON.stringify({ t: 'pong' }));
-            break;
-          default:
-            break;
-        }
-      };
-      ws.onclose = () => {
-        sockets.delete(route);
-        if (closed) return;
-        const delay = Math.min(15000, 500 * 2 ** attempts++);
-        setTimeout(open, delay);
-      };
-      ws.onerror = () => {};
-    };
-    open();
-    return () => {
-      closed = true;
-      try {
-        ws?.close();
-      } catch {}
-    };
-  }
-
-  for (const route of state.settings.routes) connectRoom(route);
-
-  /* -- HTTP API -- */
-  const CORS = {
-    'access-control-allow-origin': '*',
-    'access-control-allow-methods': 'GET, POST, DELETE, OPTIONS',
-    'access-control-allow-headers': 'content-type, authorization, x-reviewkit-key-id',
-  };
-  const send = (res, status, body) => {
-    const text = JSON.stringify(body);
-    res.writeHead(status, { 'content-type': 'application/json', ...CORS });
-    res.end(text);
-  };
-
-  const server = createServer((req, res) => {
-    const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
-    if (req.method === 'OPTIONS') {
-      res.writeHead(204, CORS);
-      res.end();
-      return;
-    }
-
-    // SECURITY: adopt the current on-disk key material before answering any
-    // state or auth check — `rotate` and `revoke` from another process must
-    // apply on the very next request, never only after a watcher event.
-    adoptFromDisk();
-
-    // Local management (no bearer): same localhost trust model as the Emblema
-    // intake — these exist so the ReviewKit page UI can drive the pairing.
-    if (url.pathname.startsWith('/api/emblema/local/')) {
-      const op = url.pathname.slice('/api/emblema/local/'.length);
-      if (req.method === 'GET' && op === 'state') {
-        send(res, 200, {
-          ok: true,
-          paired: !state.revoked,
-          revoked: !!state.revoked,
-          id: state.id,
-          name: state.name,
-          url: state.url,
-          lastAck: state.lastAck ?? null,
-          findings: findings.size,
-          // Additive: realtime-bridge health for status UIs. "off" = no
-          // syncToken configured (bridge disabled by design), "connected" =
-          // at least one room socket joined, "connecting" = configured but
-          // not joined (booting, reconnect backoff, or a bad token).
-          realtime: !state.settings.syncToken
-            ? { state: 'off', rooms: 0 }
-            : { state: sockets.size > 0 ? 'connected' : 'connecting', rooms: sockets.size },
-        });
-        return;
-      }
-      if (req.method === 'POST' && (op === 'generate' || op === 'rotate')) {
-        state.secret = newSecret();
-        state.revoked = false;
-        saveState(cwd, state);
-        send(res, 200, { ok: true, key: keyOf(state) });
-        return;
-      }
-      if (req.method === 'GET' && op === 'key') {
-        if (state.revoked) return send(res, 410, { ok: false, error: 'revoked' });
-        send(res, 200, { ok: true, key: keyOf(state) });
-        return;
-      }
-      if (req.method === 'POST' && op === 'revoke') {
-        state.revoked = true;
-        saveState(cwd, state);
-        send(res, 200, { ok: true });
-        return;
-      }
-      send(res, 404, { ok: false, error: 'not found' });
-      return;
-    }
-
-    // Contract v2 endpoints — Bearer <secret> required.
-    if (!url.pathname.startsWith('/api/emblema/')) {
-      send(res, 404, { ok: false, error: 'not found' });
-      return;
-    }
-    const auth = String(req.headers.authorization ?? '');
-    const authorized = !state.revoked && auth.toLowerCase() === `bearer ${state.secret}`.toLowerCase();
-    if (!authorized) {
-      send(res, 401, { ok: false, error: state.revoked ? 'key revoked' : 'bad or missing bearer secret' });
-      return;
-    }
-    state.lastAck = new Date().toISOString();
-    persistAck();
-
-    if (req.method === 'GET' && url.pathname === '/api/emblema/handshake') {
-      send(res, 200, { ok: true, id: state.id, name: state.name, version: reviewkitVersion() });
-      return;
-    }
-    if (req.method === 'GET' && url.pathname === '/api/emblema/findings') {
-      const since = Number(url.searchParams.get('since') ?? 0) || 0;
-      const list = [...findings.values()]
-        .filter((f) => f._seq > since)
-        .sort((a, b) => a._seq - b._seq)
-        // route + target ride along (additive since contract v2.1): Emblema
-        // builds its human "what was clicked" label from target.tagName /
-        // textSnippet, which the flat finding shape does not carry.
-        .map(({ _seq, _route, _raw, ...pub }) => ({ ...pub, route: _route, target: _raw?.target ?? null }));
-      const deleted = [...deletedIds.entries()]
-        .filter(([, at]) => at > since)
-        .sort((a, b) => a[1] - b[1])
-        .map(([id]) => id);
-      send(res, 200, { cursor: String(seq), findings: list, deleted });
-      return;
-    }
-    const statusMatch = url.pathname.match(/^\/api\/emblema\/findings\/([^/]+)\/status$/);
-    if (req.method === 'POST' && statusMatch) {
-      let body = '';
-      req.on('data', (c) => {
-        body += c;
-        if (body.length > 4096) req.destroy();
-      });
-      req.on('end', () => {
-        let status;
-        try {
-          status = JSON.parse(body).status;
-        } catch {
-          return send(res, 400, { ok: false, error: 'invalid JSON' });
-        }
-        const mapped = STATUS_MAP[status];
-        if (!mapped) {
-          // Echo what arrived: the live 400s on `open` were an OLD installed
-          // agent, and a bare "must be …" message made that undiagnosable.
-          return send(res, 400, {
-            ok: false,
-            error: `status must be open|accepted|dismissed|fixed (received ${JSON.stringify(status ?? null)})`,
-            received: status ?? null,
-          });
-        }
-        const finding = findings.get(decodeURIComponent(statusMatch[1]));
-        if (!finding) return send(res, 404, { ok: false, error: 'unknown finding' });
-        const ws = sockets.get(finding._route);
-        if (ws && ws.readyState === 1) {
-          ws.send(JSON.stringify({ t: 'item:status', id: finding.id, status: mapped }));
-        }
-        upsertItem({ ...finding._raw, status: mapped });
-        send(res, 200, { ok: true });
-      });
-      return;
-    }
-    // DELETE /findings/{id} (POST …/delete for clients that cannot send DELETE).
-    // IDEMPOTENT: an unknown id still answers 200 and is tombstoned, so a ghost
-    // row left in the tile by an older/restarted agent can always be cleared.
-    // No body is read — the id is entirely in the path.
-    const deleteMatch =
-      (req.method === 'DELETE' && url.pathname.match(/^\/api\/emblema\/findings\/([^/]+)$/)) ||
-      (req.method === 'POST' && url.pathname.match(/^\/api\/emblema\/findings\/([^/]+)\/delete$/));
-    if (deleteMatch) {
-      const id = decodeURIComponent(deleteMatch[1]);
-      const finding = findings.get(id);
-      // Write-back first, while _route is still known: the site pin must
-      // disappear for every reviewer, not just in the tile.
-      const ws = finding && sockets.get(finding._route);
-      if (ws && ws.readyState === 1) ws.send(JSON.stringify({ t: 'item:delete', id }));
-      dropItem(id);
-      send(res, 200, { ok: true, id, known: !!finding });
-      return;
-    }
-    send(res, 404, { ok: false, error: 'not found' });
-  });
-
-  server.listen(port, '127.0.0.1', () => {
-    log(`API on ${state.url} (project "${state.name}", id ${state.id})`);
-    if (state.revoked) log('WARNING: pairing is revoked — rotate to issue a fresh key');
-  });
-
-  // Handle for tests: the server plus a teardown closing the dir watcher too.
-  // upsertItem/dropItem are exposed so the /findings tombstone contract can
-  // be exercised without a live rk-sync room.
-  return {
-    server,
-    upsertItem,
-    dropItem,
-    close() {
-      try {
-        watcher?.close();
-      } catch {
-        /* already closed */
-      }
-      server.close();
-    },
-  };
-}
-
-function log(message) {
-  console.log(`[reviewkit-emblema] ${message}`);
-}
-
-/* ---------------- entry ---------------- */
-
-// Realpath BOTH sides: npm links the bin as a symlink (node_modules/.bin/…)
-// and a file: install symlinks the whole package dir, while ESM resolves
-// import.meta.url to the real path — a lexical resolve() comparison made
-// every npx/bin invocation silently no-op with exit 0 (init "succeeded"
-// without writing anything, serve returned immediately).
-function realOrSelf(p) {
-  try {
-    return realpathSync(p);
-  } catch {
-    return resolve(p);
-  }
-}
-const isMain = process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url));
-if (isMain) {
-  const [command, ...rest] = process.argv.slice(2);
-  const cwd = process.cwd();
-  const flags = parseFlags(rest);
-  switch (command) {
-    case 'init':
-      cmdInit(cwd, flags);
-      break;
-    case 'key':
-      cmdKey(cwd);
-      break;
-    case 'rotate':
-      cmdRotate(cwd);
-      break;
-    case 'revoke':
-      cmdRevoke(cwd);
-      break;
-    case 'serve':
-      cmdServe(cwd);
-      break;
-    default:
-      console.log(`reviewkit-emblema <init|key|rotate|revoke|serve>
-  init   --origin <https://site> [--name X] [--sync-token T] [--sync-url U]
-         [--routes /,/about] [--repo <abs>] [--port N] [--intake-url U]
-  key    print the pairing key (emk_…) to paste into Emblema
-  rotate issue a new secret (old key stops working)
-  revoke disable the pairing
-  serve  run the local API + realtime bridge`);
-      process.exit(command ? 1 : 0);
-  }
-}