@sovovs/bycli 2.0.0 → 2.1.0

package/dist/src/observation/redaction.js

@@ -10,7 +10,13 @@ const SENSITIVE_HEADER_NAMES = new Set([
     'x-xsrf-token',
 ]);
 const SENSITIVE_FIELD_PATTERN = /(password|passwd|pwd|token|secret|authorization|cookie|set-cookie|api[_-]?key|access[_-]?token|refresh[_-]?token|session[_-]?id|csrf|xsrf)/i;
-const SENSITIVE_URL_PARAMS = /([?&])(token|key|secret|password|auth|access_token|api_key|session_id|csrf|xsrf)=[^&]*/gi;
+const SENSITIVE_URL_PARAMS = /([?&])(token|key|secret|fingerprint|password|auth|access_token|api_key|session_id|csrf|xsrf)=[^&]*/gi;
+function hasFingerprintFieldSegment(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .split(/[-_.\s]+/)
+        .some((segment) => segment.toLowerCase() === 'fingerprint');
+}
 export function redactUrl(url) {
     return url.replace(SENSITIVE_URL_PARAMS, '$1$2=[REDACTED]');
 }
@@ -31,8 +37,8 @@ export function redactText(text, opts = {}) {
     const max = opts.maxStringLength ?? 50_000;
     let out = text
         .replace(/Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi, 'Bearer [REDACTED]')
-        .replace(/(["'])(password|passwd|pwd|token|secret|api_key|apikey|access_token|session_id)\1\s*:\s*(["'])(.*?)\3/gi, '$1$2$1:$3[REDACTED]$3')
-        .replace(/(token|secret|password|api_key|apikey|access_token|session_id)[=:]\s*['"]?[^'"\s,;}&]+['"]?/gi, '$1=[REDACTED]')
+        .replace(/(["'])(password|passwd|pwd|token|secret|fingerprint|api_key|apikey|access_token|session_id)\1\s*:\s*(["'])(.*?)\3/gi, '$1$2$1:$3[REDACTED]$3')
+        .replace(/(token|secret|fingerprint|password|api_key|apikey|access_token|session_id)\s*[=:]\s*['"]?[^'"\s,;}&]+['"]?/gi, '$1=[REDACTED]')
         .replace(/(cookie[=:]\s*)[^\n;]{3,}/gi, '$1[REDACTED]')
         .replace(/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, '[REDACTED_JWT]');
     if (out.length > max)
@@ -41,7 +47,7 @@ export function redactText(text, opts = {}) {
 }
 export function redactValue(value, opts = {}, keyHint, depth = 0) {
     const allow = new Set((opts.allowlist ?? []).map((key) => key.toLowerCase()));
-    if (keyHint && SENSITIVE_FIELD_PATTERN.test(keyHint) && !allow.has(keyHint.toLowerCase())) {
+    if (keyHint && (SENSITIVE_FIELD_PATTERN.test(keyHint) || hasFingerprintFieldSegment(keyHint)) && !allow.has(keyHint.toLowerCase())) {
         return DEFAULT_REDACTION;
     }
     if (typeof value === 'string') {

package/dist/src/recorder/runner/verify-runner-main.d.ts

@@ -11,10 +11,11 @@
  * adapters report not-yet (their Page must come from the daemon — M6b). The spawn /
  * input.json security / timeout / byte-cap mechanism lives in `runner-port.ts`.
  *
- * SECURITY (07:123-124): raw executionSeedArgs arrive via input.json (0600) and are used
- * as the adapter's call args; they are never echoed into the emitted result/started events.
+ * SECURITY (07:123-124): raw executionSeedArgs arrive via input.json (0600), then are
+ * defaulted, coerced, and validated before execution. Neither raw nor prepared arguments
+ * are echoed into the emitted result/started events.
  */
-import { type BrowserCliCommand, type CliCommand } from '../../registry.js';
+import { type BrowserCliCommand, type CliCommand, type ConditionalBrowserCliCommand } from '../../registry.js';
 import type { RunnerEvent, RunnerResultEvent } from '@sovovs/bycli-recorder-core';
 /** Parsed input.json (written by RunnerPort; raw seed args are execution-only). */
 export interface RunnerInput {
@@ -24,7 +25,7 @@ export interface RunnerInput {
     adapterPath: string;
     /** Browser profile contextId for browser adapters (M6b). Omitted → daemon default profile. */
     contextId?: string;
-    /** Raw seed args — used as the adapter call args, never echoed into events. */
+    /** Raw seed args — prepared before resolver/adapter calls and never echoed into events. */
     executionSeedArgs?: Record<string, unknown>;
     fixture?: 'ignore' | 'match' | 'update';
     trace?: 'off' | 'retain-on-failure' | 'always';
@@ -52,7 +53,7 @@ export declare function loadAdapterByName(adapterPath: string, name: string): Pr
  * default implementation connects BACK to the running daemon for one. Injectable so unit
  * tests can exercise executeAdapterForVerify without a real daemon/browser.
  */
-export type BrowserAdapterRunner = (command: BrowserCliCommand, opts: {
+export type BrowserAdapterRunner = (command: BrowserCliCommand | ConditionalBrowserCliCommand, opts: {
     seedArgs: Record<string, unknown>;
     contextId?: string;
     preNavUrl: string | null;

package/dist/src/recorder/runner/verify-runner-main.js

@@ -11,13 +11,15 @@
  * adapters report not-yet (their Page must come from the daemon — M6b). The spawn /
  * input.json security / timeout / byte-cap mechanism lives in `runner-port.ts`.
  *
- * SECURITY (07:123-124): raw executionSeedArgs arrive via input.json (0600) and are used
- * as the adapter's call args; they are never echoed into the emitted result/started events.
+ * SECURITY (07:123-124): raw executionSeedArgs arrive via input.json (0600), then are
+ * defaulted, coerced, and validated before execution. Neither raw nor prepared arguments
+ * are echoed into the emitted result/started events.
  */
 import * as fs from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { pathToFileURL } from 'node:url';
-import { getRegistry } from '../../registry.js';
+import { getRegistry, } from '../../registry.js';
+import { prepareCommandArgsOrThrowArgumentError } from '../../execution.js';
 // ── Lease cleanup on signal / orphan watchdog (Codex #4, #7) ────────────────
 // A browser adapter holds a daemon-side tab lease. If the parent SIGTERMs/cancels this child
 // (timeout/cancel) or this child is orphaned (parent crashed → no SIGTERM, and on win32 the reaper
@@ -131,9 +133,24 @@ export async function executeAdapterForVerify(command, opts) {
         return { ok: false, data: { stage: 'load', trace }, error: { code: 'runner_protocol_error', message: `adapter "${opts.name}" has no func` } };
     }
     try {
+        const preparedArgs = prepareCommandArgsOrThrowArgumentError(command, opts.seedArgs);
         let rows;
         if (command.browser === false) {
-            rows = await command.func(opts.seedArgs, false);
+            rows = await command.func(preparedArgs, false);
+        }
+        else if (command.browser === 'conditional') {
+            const browserRequired = Boolean(command.requiresBrowser(preparedArgs));
+            if (!browserRequired) {
+                rows = await command.func(null, preparedArgs, false);
+            }
+            else {
+                const runner = opts.browserRunner ?? defaultBrowserAdapterRunner;
+                rows = await runner(command, {
+                    seedArgs: preparedArgs,
+                    contextId: opts.contextId,
+                    preNavUrl: typeof command.navigateBefore === 'string' ? command.navigateBefore : null,
+                });
+            }
         }
         else {
             // M6b: browser adapter connects back to the daemon for a Page. navigateBefore is a
@@ -141,7 +158,7 @@ export async function executeAdapterForVerify(command, opts) {
             // `true`/`undefined` mean "adapter handles its own navigation".
             const runner = opts.browserRunner ?? defaultBrowserAdapterRunner;
             rows = await runner(command, {
-                seedArgs: opts.seedArgs,
+                seedArgs: preparedArgs,
                 contextId: opts.contextId,
                 preNavUrl: typeof command.navigateBefore === 'string' ? command.navigateBefore : null,
             });

package/dist/src/registry-api.d.ts

@@ -7,7 +7,7 @@
  * plugins are dynamically imported during discoverPlugins().
  */
 export { cli, Strategy, getRegistry, fullName, registerCommand } from './registry.js';
-export type { CliCommand, Arg, CliOptions, CommandArgs, SiteSessionMode } from './registry.js';
+export type { CliCommand, Arg, CliOptions, CommandArgs, SiteSessionMode, BrowserDeclaration, BrowserRequirementResolver, ConditionalBrowserCommandFunc, NormalizedBrowserRequirement, } from './registry.js';
 export type { IPage } from './types.js';
 export { onStartup, onBeforeExecute, onAfterExecute } from './hooks.js';
 export type { HookFn, HookContext, HookName } from './hooks.js';

package/dist/src/registry-api.types.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/registry-transaction.d.ts

@@ -0,0 +1,42 @@
+import type { CliCommand } from './registry.js';
+interface RegistrySlot {
+    present: boolean;
+    value: CliCommand | undefined;
+}
+export interface RegistryTransactionWrite {
+    key: string;
+    before: RegistrySlot;
+    after: RegistrySlot;
+    group: number;
+    beforeRevision: number;
+    afterRevision: number;
+}
+export interface RegistryTransaction {
+    readonly writes: RegistryTransactionWrite[];
+    readonly id: number;
+    active: boolean;
+    currentGroup: number | undefined;
+    finalized: boolean;
+    readonly finalizedGroups: Set<number>;
+}
+export declare function createRegistryTransaction(): RegistryTransaction;
+export declare function closeRegistryTransaction(transaction: RegistryTransaction): void;
+export declare function runRegistryTransaction<T>(transaction: RegistryTransaction, operation: () => Promise<T>): Promise<T>;
+export declare function withRegistryMutationGroup<T>(operation: () => T): T;
+export declare function recordRegistryMutation(key: string, before: RegistrySlot, after: RegistrySlot): void;
+/**
+ * Keys with revision ownership, including absent-key tombstones.
+ *
+ * Tombstones intentionally remain until a later mutation or rollback supersedes
+ * them. Pruning an absent revision while an overlapping transaction may still
+ * reference it would allow an older rollback to resurrect the key.
+ */
+export declare function registryMutationKeys(): string[];
+export declare function pruneRegistryMutationKey(key: string, registry: ReadonlyMap<string, CliCommand>): void;
+export declare function finalizeRegistryTransaction(transaction: RegistryTransaction, registry: ReadonlyMap<string, CliCommand>, groups?: ReadonlySet<number>): void;
+export declare function capturedRegistryValue(transaction: RegistryTransaction, key: string): RegistrySlot;
+export declare function capturedRegistryValues(transaction: RegistryTransaction): Map<string, CliCommand>;
+export declare function transactionGroupsForKey(transaction: RegistryTransaction, key: string): Set<number>;
+export declare function rollbackRegistryTransaction(transaction: RegistryTransaction, registry: Map<string, CliCommand>, groups?: ReadonlySet<number>): void;
+export declare function resetRegistryTransactionStateForTests(): void;
+export {};

package/dist/src/registry-transaction.js

@@ -0,0 +1,194 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+const TRANSACTION_STATE_KEY = Symbol.for('@sovovs/bycli/registry-transaction-state');
+const globalState = globalThis;
+const state = globalState[TRANSACTION_STATE_KEY] ??= {
+    storage: new AsyncLocalStorage(),
+    transactionCounter: 0,
+    groupCounter: 0,
+    revisionCounter: 0,
+    revisions: new Map(),
+    transactions: new Map(),
+    owners: new Map(),
+};
+state.transactions ??= new Map();
+state.owners ??= new Map();
+export function createRegistryTransaction() {
+    const transaction = {
+        writes: [],
+        id: ++state.transactionCounter,
+        active: false,
+        currentGroup: undefined,
+        finalized: false,
+        finalizedGroups: new Set(),
+    };
+    state.transactions.set(transaction.id, transaction);
+    return transaction;
+}
+export function closeRegistryTransaction(transaction) {
+    transaction.active = false;
+    transaction.currentGroup = undefined;
+}
+export async function runRegistryTransaction(transaction, operation) {
+    if (transaction.finalized) {
+        throw new Error('Adapter registration transaction is finalized');
+    }
+    transaction.active = true;
+    return state.storage.run(transaction, async () => {
+        try {
+            return await operation();
+        }
+        finally {
+            closeRegistryTransaction(transaction);
+        }
+    });
+}
+export function withRegistryMutationGroup(operation) {
+    const transaction = state.storage.getStore();
+    if (!transaction)
+        return operation();
+    if (!transaction.active) {
+        throw new Error('Adapter registration transaction is closed; delayed registration is not allowed');
+    }
+    const previousGroup = transaction.currentGroup;
+    transaction.currentGroup = ++state.groupCounter;
+    try {
+        return operation();
+    }
+    finally {
+        transaction.currentGroup = previousGroup;
+    }
+}
+export function recordRegistryMutation(key, before, after) {
+    const transaction = state.storage.getStore();
+    if (transaction && !transaction.active) {
+        throw new Error('Adapter registration transaction is closed; delayed registration is not allowed');
+    }
+    if (transaction?.finalized) {
+        throw new Error('Adapter registration transaction is finalized');
+    }
+    const beforeRevision = state.revisions.get(key) ?? 0;
+    const afterRevision = ++state.revisionCounter;
+    state.revisions.set(key, afterRevision);
+    if (!transaction)
+        return;
+    const group = transaction.currentGroup ?? ++state.groupCounter;
+    transaction.writes.push({
+        key,
+        before,
+        after,
+        group,
+        beforeRevision,
+        afterRevision,
+    });
+    const owners = state.owners.get(key) ?? new Set();
+    owners.add(transaction.id);
+    state.owners.set(key, owners);
+}
+/**
+ * Keys with revision ownership, including absent-key tombstones.
+ *
+ * Tombstones intentionally remain until a later mutation or rollback supersedes
+ * them. Pruning an absent revision while an overlapping transaction may still
+ * reference it would allow an older rollback to resurrect the key.
+ */
+export function registryMutationKeys() {
+    return [...state.revisions.keys()];
+}
+export function pruneRegistryMutationKey(key, registry) {
+    if (registry.has(key))
+        return;
+    if ((state.owners.get(key)?.size ?? 0) > 0)
+        return;
+    state.revisions.delete(key);
+}
+export function finalizeRegistryTransaction(transaction, registry, groups) {
+    if (transaction.active) {
+        throw new Error('Cannot finalize an active adapter registration transaction');
+    }
+    const selectedGroups = groups ?? new Set(transaction.writes.map(write => write.group));
+    const newGroups = new Set([...selectedGroups].filter(group => !transaction.finalizedGroups.has(group)));
+    const affectedKeys = new Set(transaction.writes
+        .filter(write => newGroups.has(write.group))
+        .map(write => write.key));
+    for (const group of newGroups)
+        transaction.finalizedGroups.add(group);
+    for (const key of affectedKeys) {
+        const stillOwned = transaction.writes.some(write => write.key === key && !transaction.finalizedGroups.has(write.group));
+        if (!stillOwned) {
+            const owners = state.owners.get(key);
+            owners?.delete(transaction.id);
+            if (owners?.size === 0)
+                state.owners.delete(key);
+        }
+        pruneRegistryMutationKey(key, registry);
+    }
+    const hasUnfinalizedWrites = transaction.writes.some(write => !transaction.finalizedGroups.has(write.group));
+    if (!hasUnfinalizedWrites) {
+        transaction.finalized = true;
+        state.transactions.delete(transaction.id);
+    }
+}
+export function capturedRegistryValue(transaction, key) {
+    for (let index = transaction.writes.length - 1; index >= 0; index -= 1) {
+        const write = transaction.writes[index];
+        if (write.key === key)
+            return write.after;
+    }
+    return { present: false, value: undefined };
+}
+export function capturedRegistryValues(transaction) {
+    const keys = new Set(transaction.writes.map(write => write.key));
+    const values = new Map();
+    for (const key of keys) {
+        const captured = capturedRegistryValue(transaction, key);
+        if (captured.present && captured.value)
+            values.set(key, captured.value);
+    }
+    return values;
+}
+export function transactionGroupsForKey(transaction, key) {
+    return new Set(transaction.writes.filter(write => write.key === key).map(write => write.group));
+}
+export function rollbackRegistryTransaction(transaction, registry, groups) {
+    const groupIds = [...new Set(transaction.writes.map(write => write.group))]
+        .filter(group => !transaction.finalizedGroups.has(group) && (!groups || groups.has(group)))
+        .sort((a, b) => b - a);
+    for (const group of groupIds) {
+        const writesByKey = new Map();
+        for (const write of transaction.writes) {
+            if (write.group !== group)
+                continue;
+            const writes = writesByKey.get(write.key) ?? [];
+            writes.push(write);
+            writesByKey.set(write.key, writes);
+        }
+        for (const writes of writesByKey.values()) {
+            const finalWrite = writes.at(-1);
+            if ((state.revisions.get(finalWrite.key) ?? 0) !== finalWrite.afterRevision)
+                continue;
+            for (let index = writes.length - 1; index >= 0; index -= 1) {
+                const write = writes[index];
+                if (write.before.present)
+                    Map.prototype.set.call(registry, write.key, write.before.value);
+                else
+                    Map.prototype.delete.call(registry, write.key);
+                if (write.beforeRevision === 0)
+                    state.revisions.delete(write.key);
+                else
+                    state.revisions.set(write.key, write.beforeRevision);
+            }
+        }
+    }
+    finalizeRegistryTransaction(transaction, registry, new Set(groupIds));
+}
+export function resetRegistryTransactionStateForTests() {
+    for (const transaction of state.transactions.values()) {
+        closeRegistryTransaction(transaction);
+        transaction.finalized = true;
+        for (const write of transaction.writes)
+            transaction.finalizedGroups.add(write.group);
+    }
+    state.transactions.clear();
+    state.owners.clear();
+    state.revisions.clear();
+}

package/dist/src/registry-transaction.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/registry.d.ts

@@ -20,7 +20,11 @@ export interface Arg {
     choices?: string[];
 }
 export type CommandArgs = Record<string, any>;
+export type BrowserRequirementResolver = (args: CommandArgs) => boolean;
+export type BrowserDeclaration = boolean | BrowserRequirementResolver;
+export type NormalizedBrowserRequirement = boolean | 'conditional';
 export type BrowserCommandFunc = (page: IPage, kwargs: CommandArgs, debug?: boolean) => Promise<unknown>;
+export type ConditionalBrowserCommandFunc = (page: IPage | null, kwargs: CommandArgs, debug?: boolean) => Promise<unknown>;
 export type NonBrowserCommandFunc = (kwargs: CommandArgs, debug?: boolean) => Promise<unknown>;
 export type CommandAccess = 'read' | 'write';
 export type SiteSessionMode = 'ephemeral' | 'persistent';
@@ -28,8 +32,9 @@ export type SiteSessionMode = 'ephemeral' | 'persistent';
  * 所有已注册 adapter command 的共享元数据和运行选项。
  *
  * 这里故意不包含 `browser` 和 `func` 这类执行形态字段，因为浏览器命令和
- * 非浏览器命令的执行签名不同。`BrowserCliCommand` 和 `NonBrowserCliCommand`
- * 会在 normalize 之后扩展这个共同底座，形成最终可执行的命令类型。
+ * 非浏览器命令、条件浏览器命令的执行签名不同。`BrowserCliCommand`、
+ * `NonBrowserCliCommand` 和 `ConditionalBrowserCliCommand` 会在 normalize 之后
+ * 扩展这个共同底座，形成最终可执行的命令类型。
  */
 interface BaseCliCommand {
     /** 站点或命名空间名称，对应命令中的 `<site>`，例如 `devto`、`brave`。 */
@@ -81,8 +86,8 @@ interface BaseCliCommand {
     defaultFormat?: 'table' | 'plain' | 'json' | 'yaml' | 'yml' | 'md' | 'markdown' | 'csv';
 }
 export interface BrowserCliCommand extends BaseCliCommand {
-    /** Browser commands receive an IPage. Omitted means true after normalization. */
-    browser?: true;
+    /** Browser commands receive an IPage. */
+    browser: true;
     func?: BrowserCommandFunc;
 }
 export interface NonBrowserCliCommand extends BaseCliCommand {
@@ -90,25 +95,50 @@ export interface NonBrowserCliCommand extends BaseCliCommand {
     browser: false;
     func?: NonBrowserCommandFunc;
 }
-export type CliCommand = BrowserCliCommand | NonBrowserCliCommand;
+export interface ConditionalBrowserCliCommand extends BaseCliCommand {
+    /** Browser use is resolved from the final command arguments at execution time. */
+    browser: 'conditional';
+    requiresBrowser: BrowserRequirementResolver;
+    func?: ConditionalBrowserCommandFunc;
+}
+export type CliCommand = BrowserCliCommand | NonBrowserCliCommand | ConditionalBrowserCliCommand;
 /**
  * `cli()` 注册 adapter 时使用的内部预归一化命令形态。
  *
  * adapter 作者传入的是 `CliOptions`，它的 TypeScript union 会保证公开调用点足够精确。
- * registry 内部会先把这些选项复制成这个更宽松的形态，再交给 `normalizeCommand()`
- * 根据 `strategy` 推导 `browser`、`navigateBefore` 等运行时意图，最后存成具体的
- * `CliCommand`。
+ * registry 内部会先把这些选项复制成对应的预归一化分支，再交给
+ * `normalizeCommand()` 根据 `strategy` 推导 `browser`、`navigateBefore` 等运行时意图，
+ * 最后存成具体的 `CliCommand`。
  */
-type RawCliCommand = BaseCliCommand & {
-    /** 预归一化阶段的浏览器需求标记；可省略，之后会由 strategy 推导。 */
-    browser?: boolean;
-    /** 预归一化阶段的执行函数；可能是浏览器签名，也可能是非浏览器签名。 */
-    func?: BrowserCommandFunc | NonBrowserCommandFunc;
+type RawCliCommandBase = Omit<BaseCliCommand, 'strategy'>;
+type RawBrowserCliCommand = RawCliCommandBase & {
+    func?: BrowserCommandFunc;
+} & ({
+    browser: true;
+    strategy?: Strategy;
+} | {
+    browser?: true;
+    strategy?: BrowserStrategy;
+});
+type RawNonBrowserCliCommand = RawCliCommandBase & {
+    func?: NonBrowserCommandFunc;
+} & ({
+    browser: false;
+    strategy?: Strategy;
+} | {
+    browser?: false;
+    strategy: Strategy.PUBLIC | Strategy.LOCAL;
+});
+type RawConditionalBrowserCliCommand = RawCliCommandBase & {
+    browser: BrowserRequirementResolver;
+    strategy?: Strategy;
+    func?: ConditionalBrowserCommandFunc;
 };
 /** Internal extension for lazy-loaded TS modules (not exposed in public API) */
 export type InternalCliCommand = CliCommand & {
     _lazy?: boolean;
     _modulePath?: string;
+    _hydrateBeforeBrowserRouting?: boolean;
 };
 type RequiredCliOptions = {
     site: string;
@@ -131,13 +161,25 @@ type NonBrowserCliOptions = Partial<Omit<NonBrowserCliCommand, 'args' | 'descrip
     strategy: Strategy.PUBLIC | Strategy.LOCAL;
     browser?: false;
 });
-export type CliOptions = BrowserCliOptions | NonBrowserCliOptions;
+type ConditionalBrowserCliOptions = Partial<Omit<ConditionalBrowserCliCommand, 'args' | 'description' | 'browser' | 'requiresBrowser'>> & RequiredCliOptions & {
+    browser: BrowserRequirementResolver;
+};
+export type CliOptions = BrowserCliOptions | NonBrowserCliOptions | ConditionalBrowserCliOptions;
 declare global {
     var __bycli_registry__: Map<string, CliCommand> | undefined;
 }
-export declare function cli(opts: CliOptions): CliCommand;
+export declare function cli(opts: ConditionalBrowserCliOptions): ConditionalBrowserCliCommand;
+export declare function cli(opts: NonBrowserCliOptions): NonBrowserCliCommand;
+export declare function cli(opts: BrowserCliOptions): BrowserCliCommand;
 export declare function getRegistry(): Map<string, CliCommand>;
 export declare function fullName(cmd: Pick<BaseCliCommand, 'site' | 'name'>): string;
 export declare function strategyLabel(cmd: CliCommand): string;
-export declare function registerCommand(cmd: RawCliCommand): void;
+/** Whether a command may use browser-backed execution for some invocation. */
+export declare function hasBrowserCapability(cmd: CliCommand): boolean;
+/** Stable human-readable label for the normalized browser requirement. */
+export declare function browserRequirementLabel(cmd: CliCommand): 'yes' | 'no' | 'conditional';
+export declare function registerCommand(cmd: RawConditionalBrowserCliCommand): void;
+export declare function registerCommand(cmd: RawNonBrowserCliCommand): void;
+export declare function registerCommand(cmd: RawBrowserCliCommand): void;
+export declare function registerCommand(cmd: CliCommand): void;
 export {};