@sensigo/realm-cli 0.41.0 → 0.43.0

package/dist/lib/admission-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-context.d.ts","sourceRoot":"","sources":["../../src/lib/admission-context.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,YAAY,CAAC;AAE/D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,kBAAkB,KAAK,OAAO,CAAC;CAC/D;AAED,eAAO,MAAM,wBAAwB;;;;;0BAMpB,kBAAkB;;;;;;;EAckB,CAAC;AAEtD,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAEtF,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,uBAAuB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,oBAAoB,EAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,MAAM,CAMR;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAO7E"}

package/dist/lib/admission-context.js

@@ -0,0 +1,57 @@
+export const CONTEXT_DEPENDENT_CHECKS = [
+    {
+        id: 'agent_profile_resolution',
+        needs: 'source_dir',
+        label: 'agent-profile file resolution',
+        witness: 'resolveAgentProfiles(definition, workflowDir)',
+        applies: (d) => Object.values(d.steps).some((s) => s.agent_profile !== undefined),
+    },
+    {
+        id: 'project_extensions',
+        needs: 'trust_root',
+        label: 'project extensions (modules, manifest, config_schema)',
+        witness: undefined,
+        // ALWAYS applies: register's extensions pass is unconditional, and an extension-free
+        // workflow IS refused by an invalid manifest at its trust root (executed). Whether a
+        // manifest governs the copy is unknowable once the tree is gone — exactly what "not run"
+        // says.
+        applies: () => true,
+    },
+];
+/**
+ * The reason vocabulary — three shapes, keyed on the member's `needs` and, when the path was
+ * never recorded at all, on the record's `origin` (issue #524-class message-claim-truth
+ * correction — a #553 self-catch, not #524's own issue). "registered before v0.14" is true for
+ * a FILE-registered copy that predates `source_dir`/`trust_root` stamping — but a `create_workflow`
+ * copy (`origin: 'agent'`) never goes through the file loader and never records a source tree AT
+ * ALL, whatever version created it: `create-workflow.ts` stamps `origin: 'agent'` and nothing
+ * else path-shaped.
+ */
+export function notRunReason(needs, recorded, origin) {
+    if (recorded !== undefined)
+        return `${needs} ${recorded} no longer exists`;
+    if (origin === 'agent') {
+        return `no ${needs} recorded (created by create_workflow, which registers without a source tree)`;
+    }
+    return `no ${needs} recorded (registered before v0.14)`;
+}
+/**
+ * The always-on disclosure line for `validate --registered`:
+ *   `N check(s) not run: <label> (<reason>)[; <label> (<reason>)]`
+ * Each member renders beside its OWN reason, `; `-joined in member order — reasons are NEVER
+ * deduplicated (issue #553 correction C6): two members that happen to share a reason text (e.g.
+ * both "registered before v0.14") still each print their own label-and-reason pair, because
+ * collapsing them into one shared parenthetical reads as a single combined cause rather than two
+ * independent skips.
+ * Empty input → empty string (the caller prints nothing: every check ran).
+ */
+export function renderChecksNotRunLine(notRun) {
+    if (notRun.length === 0)
+        return '';
+    const parts = notRun.map((n) => {
+        const label = CONTEXT_DEPENDENT_CHECKS.find((c) => c.id === n.id)?.label ?? n.id;
+        return `${label} (${n.reason})`;
+    });
+    return `${notRun.length} ${notRun.length === 1 ? 'check' : 'checks'} not run: ${parts.join('; ')}`;
+}
+//# sourceMappingURL=admission-context.js.map

package/dist/lib/admission-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-context.js","sourceRoot":"","sources":["../../src/lib/admission-context.ts"],"names":[],"mappings":"AAgCA,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC;QACE,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,+BAA+B;QACtC,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,CAAC,CAAqB,EAAE,EAAE,CACjC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC;KACpE;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,uDAAuD;QAC9D,OAAO,EAAE,SAAS;QAClB,qFAAqF;QACrF,qFAAqF;QACrF,yFAAyF;QACzF,QAAQ;QACR,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;KACpB;CACkD,CAAC;AAUtD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,KAA2B,EAC3B,QAA4B,EAC5B,MAA0B;IAE1B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,mBAAmB,CAAC;IAC3E,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,KAAK,+EAA+E,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,KAAK,qCAAqC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QACjF,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACrG,CAAC"}

package/dist/lib/load-workflow-for-admission.d.ts

@@ -0,0 +1,69 @@
+import { type WorkflowDefinition, type LoaderWarning } from '@sensigo/realm';
+import { type LoadedProjectExtensions } from '../extensions/load-project-extensions.js';
+/**
+ * Tags a failure thrown by the extensions load inside `loadWorkflowForAdmission` so the
+ * callers' catches can say `Error loading extensions:` — the sentence run and validate already
+ * print for this class (issue #451) — without guessing from the message. The message is the
+ * original's, byte for byte (register-extensions.test.ts's broken-module cell matches on it
+ * THROUGH this wrapper), and the original rides along as `cause`.
+ *
+ * Minted at exactly the two throw paths out of the extensions block: the real-mode load's
+ * non-secrets failure, and the sentinel retry. The retry can never throw ManifestSecretsError
+ * itself (sentinel mode resolves every name without reading a source), so nothing is wrapped
+ * twice. A WorkflowError from the two-pass re-validation is thrown OUTSIDE the block and keeps
+ * the family split.
+ *
+ * Carries the workflow's own pass-1 loader warnings (issue #463 — the #424 carry shape on this
+ * vehicle) so the catch that renders the sentence can print them FIRST, instead of the author
+ * fixing the module, re-running, and only then learning about the typo. ABSENT, never `[]`: a
+ * construction that passes no warnings, or an empty list, leaves the field unset.
+ *
+ * Carries the pass-1 definition too (issue #553): validate's `--json` names `workflow_id` on
+ * this arm and computes the retry advisory from the definition before printing the sentence.
+ *
+ * @internal Exported for register.ts, watch.ts, validate.ts and for tests.
+ */
+export declare class ExtensionLoadError extends Error {
+    readonly warnings?: readonly LoaderWarning[];
+    readonly definition?: WorkflowDefinition;
+    constructor(original: unknown, warnings?: readonly LoaderWarning[], definition?: WorkflowDefinition);
+}
+/** @internal Exported for validate.ts. */
+export declare function admittedDefinitionOf(err: unknown): WorkflowDefinition | undefined;
+/**
+ * The project-extensions pass ALONE (issue #553 correction C2) — the real load, degrading to
+ * SENTINEL credentials with a loud, surface-keyed WARN pair when a secret source is unavailable,
+ * and the RAW error on any other failure (the caller decides how to wrap/report it; this function
+ * throws nothing `ExtensionLoadError`-shaped itself). This is the ONE mint site for "⚠ …with
+ * SENTINEL credentials — execution paths still require real secret resolution." — before this
+ * extraction it was minted here AND hand-typed a second time in `validate --registered`'s own
+ * extensions arm (the #444/#508 two-mints-of-one-string class); both callers now share it.
+ * `overrideModule` is `--extensions-module`: it must travel into BOTH loads (the real attempt and
+ * the sentinel retry) or a repair flag dies in its own retry (the #353/#466 flag-travel class).
+ */
+export declare function admitProjectExtensions(definition: WorkflowDefinition, opts: {
+    surface: 'register' | 'watch' | 'validate';
+    overrideModule?: string;
+}): Promise<LoadedProjectExtensions>;
+/**
+ * Loads and validates a workflow for admission — register, watch and validate all take exactly
+ * this path (issue #553). The file loader (agent-profile resolution included), then the
+ * UNCONDITIONAL project-extensions load (modules, manifest, config_schema two-pass), degrading
+ * to SENTINEL credentials with a loud WARN when a secret source is unavailable.
+ * Returns the definition alongside every accumulated LoaderWarning (issue #169) — pass-1's
+ * structural warnings plus the sentinel-credential warnings, if any — and the resolved manifest
+ * (validate's `Extensions:` line reports its counts). Prints NOTHING itself beyond the two
+ * sentinel ⚠ lines; every caller decides how to surface/act on warnings (register supports
+ * `--strict` + the dormant #170 reject; watch just prints and continues; validate reports).
+ * @throws on any validation or extension-load failure — nothing is persisted on throw.
+ *         Extension-load failures are tagged `ExtensionLoadError` (issue #451).
+ */
+export declare function loadWorkflowForAdmission(filePath: string, opts: {
+    overrideModule?: string;
+    surface: 'register' | 'watch' | 'validate';
+}): Promise<{
+    definition: WorkflowDefinition;
+    warnings: LoaderWarning[];
+    manifest: LoadedProjectExtensions['manifest'];
+}>;
+//# sourceMappingURL=load-workflow-for-admission.d.ts.map

package/dist/lib/load-workflow-for-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-workflow-for-admission.d.ts","sourceRoot":"","sources":["../../src/lib/load-workflow-for-admission.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,0CAA0C,CAAC;AAIlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;gBAGvC,QAAQ,EAAE,OAAO,EACjB,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,EACnC,UAAU,CAAC,EAAE,kBAAkB;CASlC;AAUD,0CAA0C;AAC1C,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAEjF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,kBAAkB,EAC9B,IAAI,EAAE;IAAE,OAAO,EAAE,UAAU,GAAG,OAAO,GAAG,UAAU,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5E,OAAO,CAAC,uBAAuB,CAAC,CAqBlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,GAAG,OAAO,GAAG,UAAU,CAAA;CAAE,GAC5E,OAAO,CAAC;IACT,UAAU,EAAE,kBAAkB,CAAC;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,QAAQ,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;CAC/C,CAAC,CAwBD"}

package/dist/lib/load-workflow-for-admission.js

@@ -0,0 +1,130 @@
+// The ONE admission path (issue #553): what `validate` blesses, `register` accepts, and what
+// `register` refuses, `validate` refuses — by construction, because both (and `watch`) call
+// this function and nothing else. Relocated from register.ts, where validate could not import
+// it without a cycle.
+import { loadWorkflowFromFileWithDiagnostics, } from '@sensigo/realm';
+import { loadProjectExtensions, } from '../extensions/load-project-extensions.js';
+import { ManifestSecretsError } from '../extensions/manifest-secrets.js';
+import { wrapSentinelWarnings } from './loader-warnings.js';
+/**
+ * Tags a failure thrown by the extensions load inside `loadWorkflowForAdmission` so the
+ * callers' catches can say `Error loading extensions:` — the sentence run and validate already
+ * print for this class (issue #451) — without guessing from the message. The message is the
+ * original's, byte for byte (register-extensions.test.ts's broken-module cell matches on it
+ * THROUGH this wrapper), and the original rides along as `cause`.
+ *
+ * Minted at exactly the two throw paths out of the extensions block: the real-mode load's
+ * non-secrets failure, and the sentinel retry. The retry can never throw ManifestSecretsError
+ * itself (sentinel mode resolves every name without reading a source), so nothing is wrapped
+ * twice. A WorkflowError from the two-pass re-validation is thrown OUTSIDE the block and keeps
+ * the family split.
+ *
+ * Carries the workflow's own pass-1 loader warnings (issue #463 — the #424 carry shape on this
+ * vehicle) so the catch that renders the sentence can print them FIRST, instead of the author
+ * fixing the module, re-running, and only then learning about the typo. ABSENT, never `[]`: a
+ * construction that passes no warnings, or an empty list, leaves the field unset.
+ *
+ * Carries the pass-1 definition too (issue #553): validate's `--json` names `workflow_id` on
+ * this arm and computes the retry advisory from the definition before printing the sentence.
+ *
+ * @internal Exported for register.ts, watch.ts, validate.ts and for tests.
+ */
+export class ExtensionLoadError extends Error {
+    warnings;
+    definition;
+    constructor(original, warnings, definition) {
+        super(original instanceof Error ? original.message : String(original), { cause: original });
+        this.name = 'ExtensionLoadError';
+        // The if-guard form on purpose: a ternary to `undefined` is a TS2412 under the repo's
+        // exactOptionalPropertyTypes (lane-executed, #463).
+        if (warnings !== undefined && warnings.length > 0)
+            this.warnings = [...warnings];
+        if (definition !== undefined)
+            this.definition = definition;
+    }
+}
+/**
+ * The pass-1 definition of a workflow whose pass-2 (config_schema) re-validation threw. The
+ * thrown WorkflowError is register's and watch's to render exactly as before — its identity,
+ * message and family are untouched — so the definition rides beside it rather than on it.
+ * validate's `--json` reads it back for `workflow_id` (issue #553, audit round 2 Q9).
+ */
+const admittedDefinitions = new WeakMap();
+/** @internal Exported for validate.ts. */
+export function admittedDefinitionOf(err) {
+    return typeof err === 'object' && err !== null ? admittedDefinitions.get(err) : undefined;
+}
+/**
+ * The project-extensions pass ALONE (issue #553 correction C2) — the real load, degrading to
+ * SENTINEL credentials with a loud, surface-keyed WARN pair when a secret source is unavailable,
+ * and the RAW error on any other failure (the caller decides how to wrap/report it; this function
+ * throws nothing `ExtensionLoadError`-shaped itself). This is the ONE mint site for "⚠ …with
+ * SENTINEL credentials — execution paths still require real secret resolution." — before this
+ * extraction it was minted here AND hand-typed a second time in `validate --registered`'s own
+ * extensions arm (the #444/#508 two-mints-of-one-string class); both callers now share it.
+ * `overrideModule` is `--extensions-module`: it must travel into BOTH loads (the real attempt and
+ * the sentinel retry) or a repair flag dies in its own retry (the #353/#466 flag-travel class).
+ */
+export async function admitProjectExtensions(definition, opts) {
+    const override = opts.overrideModule !== undefined ? { overrideModule: opts.overrideModule } : {};
+    // Full module load + duck validation + manifest construction BEFORE persisting. Secret sources
+    // may be unavailable at provisioning time: degrade to SENTINEL construction with a loud WARN
+    // (never silent, never a registration blocker); execution paths still require real resolution.
+    try {
+        return await loadProjectExtensions(definition, { ...override });
+    }
+    catch (err) {
+        // The guard is the degradation itself: only a secrets failure degrades, everything else is
+        // the caller's to tag and report. Dropping the conditional kills degradation —
+        // register-extensions.test.ts's sentinel control is the cell in this command's own home that
+        // sees it (the manifest E2E in extensions/ does too, one substring deep).
+        if (!(err instanceof ManifestSecretsError))
+            throw err;
+        console.warn(`⚠ ${err.message}`);
+        // Surface-keyed (issue #553): validate registers nothing, so "Registering" there is a false
+        // claim; register and watch keep their text byte for byte.
+        console.warn(`⚠ ${opts.surface === 'validate' ? 'Validating' : 'Registering'} with SENTINEL credentials — execution paths still require real secret resolution.`);
+        return await loadProjectExtensions(definition, { ...override, secretMode: 'sentinel' });
+    }
+}
+/**
+ * Loads and validates a workflow for admission — register, watch and validate all take exactly
+ * this path (issue #553). The file loader (agent-profile resolution included), then the
+ * UNCONDITIONAL project-extensions load (modules, manifest, config_schema two-pass), degrading
+ * to SENTINEL credentials with a loud WARN when a secret source is unavailable.
+ * Returns the definition alongside every accumulated LoaderWarning (issue #169) — pass-1's
+ * structural warnings plus the sentinel-credential warnings, if any — and the resolved manifest
+ * (validate's `Extensions:` line reports its counts). Prints NOTHING itself beyond the two
+ * sentinel ⚠ lines; every caller decides how to surface/act on warnings (register supports
+ * `--strict` + the dormant #170 reject; watch just prints and continues; validate reports).
+ * @throws on any validation or extension-load failure — nothing is persisted on throw.
+ *         Extension-load failures are tagged `ExtensionLoadError` (issue #451).
+ */
+export async function loadWorkflowForAdmission(filePath, opts) {
+    const { definition, warnings: pass1Warnings } = loadWorkflowFromFileWithDiagnostics(filePath);
+    let loaded;
+    try {
+        loaded = await admitProjectExtensions(definition, opts);
+    }
+    catch (err) {
+        throw new ExtensionLoadError(err, pass1Warnings, definition);
+    }
+    // Two-pass: re-validate with the resolved registry so step config is checked against
+    // each adapter's config_schema before the definition is persisted. Its warnings are proven
+    // identical to pass-1's (same content, registry only adds config_schema checks) — discarded
+    // here to avoid double-counting the same unknown key twice.
+    try {
+        loadWorkflowFromFileWithDiagnostics(filePath, loaded.registry);
+    }
+    catch (err) {
+        if (typeof err === 'object' && err !== null)
+            admittedDefinitions.set(err, definition);
+        throw err;
+    }
+    return {
+        definition,
+        warnings: [...pass1Warnings, ...wrapSentinelWarnings(loaded.sentinelWarnings)],
+        manifest: loaded.manifest,
+    };
+}
+//# sourceMappingURL=load-workflow-for-admission.js.map

package/dist/lib/load-workflow-for-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-workflow-for-admission.js","sourceRoot":"","sources":["../../src/lib/load-workflow-for-admission.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,4FAA4F;AAC5F,8FAA8F;AAC9F,sBAAsB;AACtB,OAAO,EACL,mCAAmC,GAGpC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,GAEtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,QAAQ,CAA4B;IACpC,UAAU,CAAsB;IAEzC,YACE,QAAiB,EACjB,QAAmC,EACnC,UAA+B;QAE/B,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,sFAAsF;QACtF,oDAAoD;QACpD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACjF,IAAI,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC7D,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAA8B,CAAC;AAEtE,0CAA0C;AAC1C,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA8B,EAC9B,IAA6E;IAE7E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,+FAA+F;IAC/F,6FAA6F;IAC7F,+FAA+F;IAC/F,IAAI,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC,UAAU,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2FAA2F;QAC3F,+EAA+E;QAC/E,6FAA6F;QAC7F,0EAA0E;QAC1E,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC;YAAE,MAAM,GAAG,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACjC,4FAA4F;QAC5F,2DAA2D;QAC3D,OAAO,CAAC,IAAI,CACV,KAAK,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,oFAAoF,CACpJ,CAAC;QACF,OAAO,MAAM,qBAAqB,CAAC,UAAU,EAAE,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,IAA6E;IAM7E,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC9F,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IACD,qFAAqF;IACrF,2FAA2F;IAC3F,4FAA4F;IAC5F,4DAA4D;IAC5D,IAAI,CAAC;QACH,mCAAmC,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACtF,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO;QACL,UAAU;QACV,QAAQ,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC9E,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC"}

package/dist/lib/loader-warnings.d.ts

@@ -1,12 +1,9 @@
-import { type WorkflowError, type LoaderWarning, type WarningCode } from '@sensigo/realm';
+import { type WorkflowError, type LoaderWarning, type WarningCode, type WorkflowDefinition } from '@sensigo/realm';
 /**
- * Prints every warning via the single renderLoaderWarning format source, correcting the
- * "— ignored" claim for any warning this boundary will actually refuse.
- *
- * Resolved against DEFAULT_POLICY, which is the policy the boundary-reject itself uses. A warning
- * that only fails under `--strict` still renders "— ignored" — see the report's design note; the
- * `--strict` path prints its own "failing due to --strict" line, so the author is not left
- * without an explanation.
+ * Prints every warning via the single renderLoaderWarning format source — no substitution (see
+ * the module header for why the former "— ignored" → "— REFUSED below" rewrite was deleted,
+ * issue #540). The `DEFAULT_POLICY` import above stays: `rejectOnErrorSeverity` and
+ * `failsStrict`, both exported from this module, still resolve against it.
  */
 export declare function printLoaderWarnings(warnings: readonly LoaderWarning[]): void;
 /**
@@ -27,7 +24,7 @@ export declare function failsStrict(warnings: LoaderWarning[]): boolean;
  * and both baked a two-space `⚠  ` into the message. The prefix now belongs to
  * `renderLoaderWarning` alone, so the message here is the input string verbatim.
  *
- * register's caller is `loadWorkflowForRegistration`, which `watch` also uses — so the strip
+ * register's caller is `loadWorkflowForAdmission`, which `watch` and `validate` also use — so the strip
  * reaches watch too, and there is no third caller.
  */
 export declare function wrapSentinelWarnings(sentinelWarnings: string[] | undefined): LoaderWarning[];
@@ -54,4 +51,24 @@ export declare function renderLoadFailure(err: WorkflowError | string): string;
  * the one-caller rule recorded on validate's exitOnLoadFailure.
  */
 export declare function renderEscalationLine(warnings: readonly LoaderWarning[]): string;
+/**
+ * The author-extension keys a definition carries, in authored order (issue #559).
+ *
+ * `x-` keys never mint a warning, so without this they would be the one thing realm accepts and
+ * says nothing about — silent acceptance is Docker Compose's contract and below realm's own
+ * disclosure ethos. The keys ARE in the definition (the loader's cast carries every top-level key
+ * through untouched), so this reads them straight off it.
+ */
+export declare function extensionKeysOf(definition: WorkflowDefinition): string[];
+/**
+ * The ONE mint of the extension-keys disclosure clause (issue #559) — `undefined` when there is
+ * nothing to disclose, so a caller composes `?? nothing`. Every consumer (validate's verdict
+ * tail, register's own line) renders through this so the noun and the phrase cannot drift
+ * between them.
+ *
+ * The phrase `carried, never read by realm` is minted HERE and nowhere else — the literal-count
+ * cell anchors on it rather than the bare words `extension key`, which recur in comments and in
+ * the plural form.
+ */
+export declare function renderExtensionKeysClause(keys: readonly string[]): string | undefined;
 //# sourceMappingURL=loader-warnings.d.ts.map

package/dist/lib/loader-warnings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader-warnings.d.ts","sourceRoot":"","sources":["../../src/lib/loader-warnings.ts"],"names":[],"mappings":"AAcA,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AAiBxB;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAS5E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,aAAa,EAAE,EACzB,MAAM,GAAE,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAkB,GAC7D,OAAO,CAET;AAWD,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,CAE9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,aAAa,EAAE,CAO5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,GAAG,MAAM,CAiBrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAW/E"}
+{"version":3,"file":"loader-warnings.d.ts","sourceRoot":"","sources":["../../src/lib/loader-warnings.ts"],"names":[],"mappings":"AA2BA,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAI5E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,aAAa,EAAE,EACzB,MAAM,GAAE,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAkB,GAC7D,OAAO,CAET;AAWD,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,CAE9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,aAAa,EAAE,CAO5F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,GAAG,MAAM,CAiBrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAW/E;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAExE;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAIrF"}

package/dist/lib/loader-warnings.js

@@ -3,45 +3,38 @@
 // printLoaderWarnings, and the dormant #170 boundary-reject is factored into ONE shared helper so
 // they can't drift.
 //
-// One deliberate exception (issue #450): the execution-LENIENT `realm workflow test` renders
-// through renderLoaderWarning directly. printLoaderWarnings rewrites `— ignored` to
-// `— REFUSED below` for the codes a boundary refuses, and `test` refuses nothing — it proceeds
-// and can pass, so `— ignored` is the true word there and the substitution would not be.
+// issue #540: printLoaderWarnings used to rewrite the mint's "— ignored" clause to
+// "— REFUSED below" for any warning the boundary resolves to 'error', on the theory that
+// "ignored" is false once a boundary is about to refuse the workflow over it. That substitution
+// is gone: "— ignored" is a true statement about what the PARSE did (the key was dropped) on
+// EVERY surface, including this one — the refusal is a separate fact, already stated per-key by
+// renderEscalationLine below. The substitution could also name the WRONG cause on any arm that
+// bypasses renderEscalationLine's own gate (see the "hard-error carry"/orphan-manifest/extensions-
+// failure comments in validate.ts and register.ts) and, being a first-occurrence unanchored
+// string replace, could corrupt author-controlled text that happened to contain the clause
+// (issue #525 item 1). See
+// `plans/issue-540/design-d2.md` for the full adjudication between this and issue #170's
+// (superseded) legibility argument for the substitution.
+//
+// One consequence, since `test` was never the exception any more (issue #450): with the
+// substitution gone, printLoaderWarnings is now behaviorally identical to
+// `renderLoaderWarning`'s plain-render loop that `realm workflow test` already used directly.
+// Whether the two call shapes should unify is its own question — filed as #542, not answered here.
 //
 // Precise as of issue #444: no command hand-rolls a ⚠ prefix for a LOADER WARNING. A few
 // adjacent one-off notices — register's sentinel lines, test's sentinel echo — still print their
 // own `⚠ ` directly, because they are plain strings rather than LoaderWarnings; they were
 // normalized to the same single-space grammar so a mixed block cannot recur.
-import { renderLoaderWarning, resolveSeverity, DEFAULT_POLICY, } from '@sensigo/realm';
+import { renderLoaderWarning, resolveSeverity, DEFAULT_POLICY, isExtensionKey, } from '@sensigo/realm';
 /**
- * The unknown-key warning is minted with "— ignored", which is true of the LENIENT loader
- * (run/agent/listen really do ignore the key and carry on) and false here: the only callers of
- * this function are validate/register/watch, and post-#170 those three REFUSE a workflow whose
- * warning resolves to 'error'. Printing "— ignored" one line above "escalated to an error" tells
- * the author the opposite of what is about to happen to them.
- *
- * Substituted at the RENDER, not the mint, precisely because the mint is shared with the lenient
- * path — where the original wording is true and worth keeping. The did-you-mean fragment is
- * untouched: it is the most useful half of the line and the reason the author can fix this in one
- * edit.
- */
-const IGNORED_CLAUSE = '— ignored';
-const REFUSED_CLAUSE = '— REFUSED below';
-/**
- * Prints every warning via the single renderLoaderWarning format source, correcting the
- * "— ignored" claim for any warning this boundary will actually refuse.
- *
- * Resolved against DEFAULT_POLICY, which is the policy the boundary-reject itself uses. A warning
- * that only fails under `--strict` still renders "— ignored" — see the report's design note; the
- * `--strict` path prints its own "failing due to --strict" line, so the author is not left
- * without an explanation.
+ * Prints every warning via the single renderLoaderWarning format source — no substitution (see
+ * the module header for why the former "— ignored" → "— REFUSED below" rewrite was deleted,
+ * issue #540). The `DEFAULT_POLICY` import above stays: `rejectOnErrorSeverity` and
+ * `failsStrict`, both exported from this module, still resolve against it.
  */
 export function printLoaderWarnings(warnings) {
     for (const w of warnings) {
-        const line = renderLoaderWarning(w);
-        console.warn(resolveSeverity(w.code, DEFAULT_POLICY) === 'error'
-            ? line.replace(IGNORED_CLAUSE, REFUSED_CLAUSE)
-            : line);
+        console.warn(renderLoaderWarning(w));
     }
 }
 /**
@@ -72,7 +65,7 @@ export function failsStrict(warnings) {
  * and both baked a two-space `⚠  ` into the message. The prefix now belongs to
  * `renderLoaderWarning` alone, so the message here is the input string verbatim.
  *
- * register's caller is `loadWorkflowForRegistration`, which `watch` also uses — so the strip
+ * register's caller is `loadWorkflowForAdmission`, which `watch` and `validate` also use — so the strip
  * reaches watch too, and there is no third caller.
  */
 export function wrapSentinelWarnings(sentinelWarnings) {
@@ -131,4 +124,31 @@ export function renderEscalationLine(warnings) {
     return (`Invalid: ${warnings.length} ${warnings.length === 1 ? 'warning' : 'warnings'}, ` +
         `${escalated.length} escalated to an error by policy: ${list}`);
 }
+/**
+ * The author-extension keys a definition carries, in authored order (issue #559).
+ *
+ * `x-` keys never mint a warning, so without this they would be the one thing realm accepts and
+ * says nothing about — silent acceptance is Docker Compose's contract and below realm's own
+ * disclosure ethos. The keys ARE in the definition (the loader's cast carries every top-level key
+ * through untouched), so this reads them straight off it.
+ */
+export function extensionKeysOf(definition) {
+    return Object.keys(definition).filter(isExtensionKey);
+}
+/**
+ * The ONE mint of the extension-keys disclosure clause (issue #559) — `undefined` when there is
+ * nothing to disclose, so a caller composes `?? nothing`. Every consumer (validate's verdict
+ * tail, register's own line) renders through this so the noun and the phrase cannot drift
+ * between them.
+ *
+ * The phrase `carried, never read by realm` is minted HERE and nowhere else — the literal-count
+ * cell anchors on it rather than the bare words `extension key`, which recur in comments and in
+ * the plural form.
+ */
+export function renderExtensionKeysClause(keys) {
+    if (keys.length === 0)
+        return undefined;
+    const noun = keys.length === 1 ? 'extension key' : 'extension keys';
+    return `${keys.length} ${noun} carried, never read by realm: ${keys.join(', ')}`;
+}
 //# sourceMappingURL=loader-warnings.js.map

package/dist/lib/loader-warnings.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader-warnings.js","sourceRoot":"","sources":["../../src/lib/loader-warnings.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,gGAAgG;AAChG,kGAAkG;AAClG,oBAAoB;AACpB,EAAE;AACF,6FAA6F;AAC7F,oFAAoF;AACpF,+FAA+F;AAC/F,yFAAyF;AACzF,EAAE;AACF,yFAAyF;AACzF,iGAAiG;AACjG,0FAA0F;AAC1F,6EAA6E;AAC7E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,cAAc,GAIf,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAkC;IACpE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CACV,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,KAAK,OAAO;YACjD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC;YAC9C,CAAC,CAAC,IAAI,CACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAyB,EACzB,SAAgD,cAAc;IAE9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAA0C,MAAM,CAAC,WAAW,CAC/E,MAAM,CAAC,IAAI,CAAC,cAAc,CAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACrC,CAAC;AAE3C,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAyB;IACnD,OAAO,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,gBAAsC;IACzE,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,oBAA6B;QACnC,QAAQ,EAAE,eAAe,CAAC,oBAAoB,CAAC;QAC/C,KAAK,EAAE,UAAmB;QAC1B,OAAO;KACR,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAA2B;IAC3D,6FAA6F;IAC7F,8FAA8F;IAC9F,6EAA6E;IAC7E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,EAAE,CAAC;IACvE,CAAC;IAED,4FAA4F;IAC5F,yFAAyF;IACzF,8FAA8F;IAC9F,uCAAuC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,sBAAsB,KAAK,CAAC,MAAM,UAAU,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkC;IACrE,4FAA4F;IAC5F,gCAAgC;IAChC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,SAAS;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;SACnE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,CACL,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI;QACjF,GAAG,SAAS,CAAC,MAAM,qCAAqC,IAAI,EAAE,CAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"loader-warnings.js","sourceRoot":"","sources":["../../src/lib/loader-warnings.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,gGAAgG;AAChG,kGAAkG;AAClG,oBAAoB;AACpB,EAAE;AACF,mFAAmF;AACnF,yFAAyF;AACzF,gGAAgG;AAChG,6FAA6F;AAC7F,gGAAgG;AAChG,+FAA+F;AAC/F,mGAAmG;AACnG,4FAA4F;AAC5F,2FAA2F;AAC3F,2BAA2B;AAC3B,yFAAyF;AACzF,yDAAyD;AACzD,EAAE;AACF,wFAAwF;AACxF,0EAA0E;AAC1E,8FAA8F;AAC9F,mGAAmG;AACnG,EAAE;AACF,yFAAyF;AACzF,iGAAiG;AACjG,0FAA0F;AAC1F,6EAA6E;AAC7E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,cAAc,GAKf,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAkC;IACpE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAyB,EACzB,SAAgD,cAAc;IAE9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAA0C,MAAM,CAAC,WAAW,CAC/E,MAAM,CAAC,IAAI,CAAC,cAAc,CAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACrC,CAAC;AAE3C,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,QAAyB;IACnD,OAAO,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,gBAAsC;IACzE,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,oBAA6B;QACnC,QAAQ,EAAE,eAAe,CAAC,oBAAoB,CAAC;QAC/C,KAAK,EAAE,UAAmB;QAC1B,OAAO;KACR,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAA2B;IAC3D,6FAA6F;IAC7F,8FAA8F;IAC9F,6EAA6E;IAC7E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,EAAE,CAAC;IACvE,CAAC;IAED,4FAA4F;IAC5F,yFAAyF;IACzF,8FAA8F;IAC9F,uCAAuC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,sBAAsB,KAAK,CAAC,MAAM,UAAU,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkC;IACrE,4FAA4F;IAC5F,gCAAgC;IAChC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,SAAS;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;SACnE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,CACL,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI;QACjF,GAAG,SAAS,CAAC,MAAM,qCAAqC,IAAI,EAAE,CAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAA8B;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAuB;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACpE,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,kCAAkC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACnF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sensigo/realm-cli",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "publishConfig": {
     "access": "public"
   },
@@ -64,9 +64,9 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@sensigo/realm": "^0.41.0",
-    "@sensigo/realm-mcp": "^0.41.0",
-    "@sensigo/realm-testing": "^0.41.0",
+    "@sensigo/realm": "^0.43.0",
+    "@sensigo/realm-mcp": "^0.43.0",
+    "@sensigo/realm-testing": "^0.43.0",
     "@modelcontextprotocol/sdk": "1.30.0",
     "chalk": "^5.0.0",
     "commander": "^15.0.0",