@trillboards/cli 0.1.1 → 0.1.3

package/dist/commands/generated/{generated-device-heartbeat-get.d.ts → generated-csi-venue-occupancy.d.ts}

@@ -1,9 +1,9 @@
 import { BaseCommand } from '../../base-command.js';
-export default class Getdeviceheartbeat extends BaseCommand {
+export default class Csivenueoccupancy extends BaseCommand {
     static description: string;
     static examples: string[];
     static args: {
-        deviceId: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        screenId: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
         'api-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/generated/{generated-device-heartbeat-get.js → generated-csi-venue-occupancy.js}

@@ -1,26 +1,26 @@
-// AUTO-GENERATED from OpenAPI spec (device-api) -- do not edit manually
+// AUTO-GENERATED from OpenAPI spec (sdk-api) -- do not edit manually
 // Regenerate with: npm run generate
 import { Args } from '@oclif/core';
 import { BaseCommand } from '../../base-command.js';
 import { apiRequest } from '../../http.js';
 import { formatOutput } from '../../output.js';
-export default class Getdeviceheartbeat extends BaseCommand {
-    static description = "Read live device heartbeat state.";
-    static examples = [`$ trillboards generated device-heartbeat get`];
+export default class Csivenueoccupancy extends BaseCommand {
+    static description = "Real-time venue occupancy from WiFi CSI sensing.";
+    static examples = [`$ trillboards generated csi-venue-occupancy`];
     static args = {
-        deviceId: Args.string({ description: 'Device fingerprint or external device ID.', required: true }),
+        screenId: Args.string({ description: 'Mongo ObjectId of the screen / venue sensing node (24-char lowercase hex).', required: true }),
     };
     static flags = {
         ...BaseCommand.baseFlags,
     };
     async run() {
-        const { args, flags } = await this.parse(Getdeviceheartbeat);
+        const { args, flags } = await this.parse(Csivenueoccupancy);
         this.setParsedFlags(flags);
         const apiKey = this.getApiKey();
         if (!apiKey)
             this.error('Not logged in. Run: trillboards login');
-        let urlPath = '/v1/partner/device/{deviceId}/heartbeat';
-        urlPath = urlPath.replace('{deviceId}', args['deviceId']);
+        let urlPath = '/v2/csi/venue/{screenId}/occupancy';
+        urlPath = urlPath.replace('{screenId}', args['screenId']);
         const params = {};
         const result = await apiRequest('GET', urlPath, {
             apiKey,

package/dist/format-helpers.d.ts

@@ -15,6 +15,37 @@ export declare function colorize(text: string, color: keyof typeof ansi): string
  * Wrap text in an OSC-8 terminal hyperlink. Supporting terminals render `label` as a
  * clickable link to `url`; others just show the label (so always print the raw URL too).
  * OSC-8: ESC ] 8 ; ; <url> BEL <label> ESC ] 8 ; ; BEL
+ *
+ * ── THIS LINK IS UNTRACKED, AND CPA ATTRIBUTION ON IT IS REFUSED FOR NOW ──
+ *
+ * Both call sites (`render.ts` "Play sponsored video", `commands/ads/start.ts`)
+ * point straight at the destination — no interstitial, no token, no redirect —
+ * and `agent-hook.ts` appends `campaignLink` raw. A standing proposal was to turn
+ * this into a tracked click into an affiliate network (Impact / PartnerStack) and
+ * bill CPA on the conversion, with impressions as upside.
+ *
+ * The CLICK half is genuinely cheap and is NOT the blocker: the server already
+ * mints signed first-party beacons (`services/programmatic/agentDirectBeacon.js`
+ * → `attributionSignature.sign`), `event` is already a signed parameter, so a
+ * `click` variant is a small addition on a proven rail.
+ *
+ * The CPA half is what is refused, and it is refused on substrate, not effort:
+ *   - There is no affiliate relationship. Impact / PartnerStack appear nowhere in
+ *     `trillboard-api/`, `trillboards-cli/` or `trillboards-ads-sdk/` outside
+ *     marketing copy — no client, no credentials path, no postback receiver.
+ *   - There is no conversion ingestion path to land one in.
+ *     `services/constants/ingestionPaths.js` enumerates `agent_direct`,
+ *     `owned_direct`, `vast_event`, `proof_of_play`, `partner_sdk`. A conversion
+ *     is not an impression and must not be smuggled in as one — billing here is
+ *     impression-only via signed beacons, and `completed_impressions` is the
+ *     revenue SoR precisely because it counts plays, not outcomes.
+ *   - A terminal click produces NO callback to this process. The emulator opens
+ *     the URL; the CLI never learns it happened. So the whole design depends on a
+ *     server-side redirect that does not exist yet.
+ *
+ * Building an attestation-based payout rail against a network we have no contract
+ * with would mean inventing both the counterparty and the revenue definition. The
+ * prerequisite is a signed affiliate agreement, not more code.
  */
 export declare function osc8(url: string, label: string): string;
 /**

package/dist/format-helpers.js

@@ -20,6 +20,37 @@ export function colorize(text, color) {
  * Wrap text in an OSC-8 terminal hyperlink. Supporting terminals render `label` as a
  * clickable link to `url`; others just show the label (so always print the raw URL too).
  * OSC-8: ESC ] 8 ; ; <url> BEL <label> ESC ] 8 ; ; BEL
+ *
+ * ── THIS LINK IS UNTRACKED, AND CPA ATTRIBUTION ON IT IS REFUSED FOR NOW ──
+ *
+ * Both call sites (`render.ts` "Play sponsored video", `commands/ads/start.ts`)
+ * point straight at the destination — no interstitial, no token, no redirect —
+ * and `agent-hook.ts` appends `campaignLink` raw. A standing proposal was to turn
+ * this into a tracked click into an affiliate network (Impact / PartnerStack) and
+ * bill CPA on the conversion, with impressions as upside.
+ *
+ * The CLICK half is genuinely cheap and is NOT the blocker: the server already
+ * mints signed first-party beacons (`services/programmatic/agentDirectBeacon.js`
+ * → `attributionSignature.sign`), `event` is already a signed parameter, so a
+ * `click` variant is a small addition on a proven rail.
+ *
+ * The CPA half is what is refused, and it is refused on substrate, not effort:
+ *   - There is no affiliate relationship. Impact / PartnerStack appear nowhere in
+ *     `trillboard-api/`, `trillboards-cli/` or `trillboards-ads-sdk/` outside
+ *     marketing copy — no client, no credentials path, no postback receiver.
+ *   - There is no conversion ingestion path to land one in.
+ *     `services/constants/ingestionPaths.js` enumerates `agent_direct`,
+ *     `owned_direct`, `vast_event`, `proof_of_play`, `partner_sdk`. A conversion
+ *     is not an impression and must not be smuggled in as one — billing here is
+ *     impression-only via signed beacons, and `completed_impressions` is the
+ *     revenue SoR precisely because it counts plays, not outcomes.
+ *   - A terminal click produces NO callback to this process. The emulator opens
+ *     the URL; the CLI never learns it happened. So the whole design depends on a
+ *     server-side redirect that does not exist yet.
+ *
+ * Building an attestation-based payout rail against a network we have no contract
+ * with would mean inventing both the counterparty and the revenue definition. The
+ * prerequisite is a signed affiliate agreement, not more code.
  */
 export function osc8(url, label) {
     const ESC = String.fromCharCode(27); // \x1b

package/dist/pty-wrapper.d.ts

@@ -9,6 +9,48 @@
  *
  * This is the I/O glue — the decision logic (dead-time, capability, render commands,
  * fetch) all lives in unit-tested pure modules. Never lets ad logic break the agent.
+ *
+ * ── REFUSED: rendering the ad INSIDE the agent's own grid ──────────────────────
+ *
+ * There was a standing proposal to make this wrapper draw the ad in the coding
+ * agent's own terminal instead of on a side surface, by same-length byte-patching
+ * the agent binary and re-signing it with `codesign`, or by `DYLD_INSERT_LIBRARIES`
+ * interposing its write path. Both are technically achievable. Neither is being
+ * built, and the reason belongs here rather than in a tracking list, because this
+ * `onData` tee is exactly the code it would replace.
+ *
+ * 1. IT BREAKS THE THING IT INJECTS INTO. Patching a vendor's binary invalidates
+ *    that vendor's code signature. Re-signing it with OUR certificate makes us the
+ *    attesting party for someone else's software, and on macOS a re-signed binary
+ *    loses the notarization and the entitlements the original shipped with. A
+ *    DYLD interpose is the same trespass at runtime: it puts our code inside a
+ *    process the user trusts with their source tree and their credentials. An ad
+ *    surface is not a good enough reason to hold either of those.
+ *
+ * 2. THE FAIL-OPEN PROMISE CANNOT BE KEPT. Everything else here is safe because
+ *    it is ADDITIVE — `onData` copies bytes, it never rewrites them, so a bug in
+ *    ad logic cannot corrupt the agent's display. A compositor that reserves rows
+ *    inside the agent's grid has to rewrite cursor and scroll-region sequences it
+ *    does not own, and there is no version of that which degrades to "the agent
+ *    looks normal". "Behind a flag, fail-open" describes a fallback this design
+ *    does not have.
+ *
+ * The refusal rests on 1 and 2, which are properties of the technique itself.
+ *
+ * RETRACTED — "it would ship to nobody". An earlier version of this note gave a
+ * third reason: that `@trillboards/cli` was stuck at 0.1.1 and the whole Leg A
+ * surface was unpublished. That is FALSE, and it is recorded here because it is
+ * an easy thing to re-derive wrongly from `publish-cli.yml`'s skip-if-published
+ * branch. npm's `gitHead` for 0.1.1 is `01696a57`, that commit IS an ancestor of
+ * `production`, and there are ZERO commits to `trillboards-cli/` after it — so
+ * the published tarball is current and Leg A has been installable since
+ * 2026-06-21. Do not repeat the claim, and do not weigh distribution as an
+ * argument here at all: it would not save this design if it were true, and it is
+ * not true.
+ *
+ * If this is ever revisited, the prerequisite is a way to render inside another
+ * process that does not forge that process's signature and can genuinely fail
+ * open — not a better patching technique, and not a distribution milestone.
  */
 import type { VirtualScreenCreative } from './ads-client.js';
 import type { SurfaceCapabilities } from './capability.js';

package/dist/pty-wrapper.js

@@ -9,6 +9,48 @@
  *
  * This is the I/O glue — the decision logic (dead-time, capability, render commands,
  * fetch) all lives in unit-tested pure modules. Never lets ad logic break the agent.
+ *
+ * ── REFUSED: rendering the ad INSIDE the agent's own grid ──────────────────────
+ *
+ * There was a standing proposal to make this wrapper draw the ad in the coding
+ * agent's own terminal instead of on a side surface, by same-length byte-patching
+ * the agent binary and re-signing it with `codesign`, or by `DYLD_INSERT_LIBRARIES`
+ * interposing its write path. Both are technically achievable. Neither is being
+ * built, and the reason belongs here rather than in a tracking list, because this
+ * `onData` tee is exactly the code it would replace.
+ *
+ * 1. IT BREAKS THE THING IT INJECTS INTO. Patching a vendor's binary invalidates
+ *    that vendor's code signature. Re-signing it with OUR certificate makes us the
+ *    attesting party for someone else's software, and on macOS a re-signed binary
+ *    loses the notarization and the entitlements the original shipped with. A
+ *    DYLD interpose is the same trespass at runtime: it puts our code inside a
+ *    process the user trusts with their source tree and their credentials. An ad
+ *    surface is not a good enough reason to hold either of those.
+ *
+ * 2. THE FAIL-OPEN PROMISE CANNOT BE KEPT. Everything else here is safe because
+ *    it is ADDITIVE — `onData` copies bytes, it never rewrites them, so a bug in
+ *    ad logic cannot corrupt the agent's display. A compositor that reserves rows
+ *    inside the agent's grid has to rewrite cursor and scroll-region sequences it
+ *    does not own, and there is no version of that which degrades to "the agent
+ *    looks normal". "Behind a flag, fail-open" describes a fallback this design
+ *    does not have.
+ *
+ * The refusal rests on 1 and 2, which are properties of the technique itself.
+ *
+ * RETRACTED — "it would ship to nobody". An earlier version of this note gave a
+ * third reason: that `@trillboards/cli` was stuck at 0.1.1 and the whole Leg A
+ * surface was unpublished. That is FALSE, and it is recorded here because it is
+ * an easy thing to re-derive wrongly from `publish-cli.yml`'s skip-if-published
+ * branch. npm's `gitHead` for 0.1.1 is `01696a57`, that commit IS an ancestor of
+ * `production`, and there are ZERO commits to `trillboards-cli/` after it — so
+ * the published tarball is current and Leg A has been installable since
+ * 2026-06-21. Do not repeat the claim, and do not weigh distribution as an
+ * argument here at all: it would not save this design if it were true, and it is
+ * not true.
+ *
+ * If this is ever revisited, the prerequisite is a way to render inside another
+ * process that does not forge that process's signature and can genuinely fail
+ * open — not a better patching technique, and not a distribution milestone.
  */
 import { spawn as childSpawn } from 'node:child_process';
 import { createRequire } from 'node:module';