@ultimat3/cli 23.0.0 → 25.0.0

package/src/generate-shadow.ts

@@ -0,0 +1,95 @@
+// A generator name whose type spelling the emitted code ALSO uses as a global or a local alias:
+// `x g resource promise` imports `type { Promise }` beside `Promise<Row>`, and `row` writes
+// `type Row = Row`. Decided on the planned files themselves, so a template that starts using
+// another global is covered the day it does — and the names that clash nowhere stay allowed.
+// The same for a VALUE: `x g job job` imports `{ job }` from `@ultimat3/jobs` and declares
+// `export const job = job(…)` beside it, which is TS2440 in the module the run just wrote.
+
+import { BadFlagError } from './errors';
+import type { Generator } from './generate-kinds';
+import type { GeneratedFile } from './templates';
+import { camel, kebab, names } from './templates/naming';
+
+/** The emitted file that imports `type` from the slice AND uses the same name as its own. */
+function shadowingFile(files: readonly GeneratedFile[], type: string): string | undefined {
+  // A pascal spelling is `[A-Za-z0-9]` only (`naming.ts`), so it splices into a pattern as is.
+  const imported = new RegExp(
+    `import\\s+(?:type\\s+)?\\{[^}]*\\b${type}\\b[^}]*\\}\\s+from\\s+'\\.`,
+  );
+  const reused = new RegExp(
+    `\\b${type}<|^\\s*(?:export\\s+)?(?:type\\s+${type}\\s*=|interface\\s+${type}\\b)`,
+    'm',
+  );
+  return files.find(
+    (file) =>
+      typeof file.contents === 'string' &&
+      /\.tsx?$/.test(file.path) &&
+      imported.test(file.contents) &&
+      reused.test(file.contents),
+  )?.path;
+}
+
+/** Refuses `name` when its type spelling would shadow a name the planned files rely on. */
+export function refuseShadowedTypes(
+  files: readonly GeneratedFile[],
+  kind: Generator,
+  name: string,
+): void {
+  const type = names(name).pascal;
+  const file = shadowingFile(files, type);
+  if (file === undefined) return;
+  const noun = kind.split(':').at(-1) ?? kind;
+  throw new BadFlagError({
+    flag: 'name',
+    command: `g ${kind}`,
+    reason: `"${name}" becomes the type ${type}, and ${file} imports it beside its own use of ${type} — the global or local type the template means is shadowed and the file does not compile`,
+    fix: ['x g', kind, `${kebab(name)}-${noun}`].join(' '),
+  });
+}
+
+/** A `{ … }` value import's local names — `type` specifiers and `import type` lines excluded. */
+const VALUE_IMPORT = /^import\s+\{([^}]*)\}\s+from\s+'[^']+';/gm;
+
+const importedValues = (source: string): readonly string[] =>
+  [...source.matchAll(VALUE_IMPORT)].flatMap((match) =>
+    (match[1] ?? '')
+      .split(',')
+      .map((specifier) => specifier.trim())
+      .filter((specifier) => specifier !== '' && !specifier.startsWith('type '))
+      .map((specifier) => specifier.split(/\s+as\s+/).at(-1) ?? specifier),
+  );
+
+/** The emitted file that imports `value` AND declares a binding of the same name. */
+function redeclaringFile(files: readonly GeneratedFile[], value: string): string | undefined {
+  // A camel spelling is `[A-Za-z0-9]` only (`naming.ts`), so it splices into a pattern as is.
+  const declared = new RegExp(
+    `^\\s*(?:export\\s+)?(?:const|let|var|function|class)\\s+${value}\\b`,
+    'm',
+  );
+  return files.find(
+    (file) =>
+      typeof file.contents === 'string' &&
+      /\.tsx?$/.test(file.path) &&
+      declared.test(file.contents) &&
+      importedValues(file.contents).includes(value),
+  )?.path;
+}
+
+/** Refuses `name` when its camel spelling is a value a planned file both imports and declares. */
+export function refuseShadowedValues(
+  files: readonly GeneratedFile[],
+  kind: Generator,
+  name: string,
+): void {
+  const value = camel(name);
+  if (value === '') return;
+  const file = redeclaringFile(files, value);
+  if (file === undefined) return;
+  const noun = kind.split(':').at(-1) ?? kind;
+  throw new BadFlagError({
+    flag: 'name',
+    command: `g ${kind}`,
+    reason: `"${name}" becomes the binding ${value}, and ${file} imports ${value} and declares its own — a module that declares a name it imports does not compile (TS2440)`,
+    fix: ['x g', kind, `${kebab(name)}-${noun}`].join(' '),
+  });
+}

package/src/generate-write.ts

@@ -102,7 +102,7 @@ export function containedPath(root: string, path: string): string {
       dir: base,
       // Command first, the caveat behind a `#`: the line runs verbatim and the shell drops the
       // rest. `x g <kind> <name>` pasted into bash is a redirect, not a command.
-      fix: `x g resource posts --dry-run   # name every file relative to the app root, no ".." segment`,
+      fix: `x g resource post --dry-run   # name every file relative to the app root, no ".." segment`,
     });
   return target;
 }
@@ -198,14 +198,56 @@ function planFile(
   return { kind: 'write', file, absolute, contents: file.contents };
 }
 
+/** Every file's plan, decided without touching the disk — the first of `writeFiles`' two passes. */
+async function planAll(
+  root: string,
+  files: readonly GeneratedFile[],
+  force: boolean,
+  invocation: string,
+): Promise<readonly WritePlan[]> {
+  const plans: WritePlan[] = [];
+  for (const file of files) {
+    const absolute = containedPath(root, file.path);
+    plans.push(
+      file.merge === 'json'
+        ? await planJsonMerge(file, absolute)
+        : planFile(file, absolute, force, invocation),
+    );
+  }
+  return plans;
+}
+
+const conflictsOf = (plans: readonly WritePlan[]): readonly Finding[] =>
+  plans.flatMap((plan) => (plan.kind === 'conflict' ? [plan.finding] : []));
+
+/**
+ * What `writeFiles` WOULD do, and nothing else: the paths it would write and the conflicts that
+ * would stop it. `x g --dry-run` answers with this — the bare file list said "would write 33"
+ * where the real run was `X_GENERATE_CONFLICT`, and listed slice modules the run skips as writes.
+ */
+export async function planWrites(
+  root: string,
+  files: readonly GeneratedFile[],
+  force: boolean,
+  invocation = 'x g <kind> <name>',
+): Promise<WriteReport> {
+  const plans = await planAll(root, files, force, invocation);
+  const conflicts = conflictsOf(plans);
+  if (conflicts.length > 0) return { written: [], conflicts };
+  return {
+    written: plans.flatMap((plan) => (plan.kind === 'write' ? [plan.file.path] : [])),
+    conflicts: [],
+  };
+}
+
 /**
  * Never clobbers, and never half-writes. A generator that overwrites is a generator nobody runs
  * twice; a generator that lands four of seven files and then reports a conflict is worse, because
  * the next run conflicts on the files the failed one wrote.
  *
  * Two passes, and the split is the point: the first decides — containment, existence, whether a
- * catalog can be merged into — and touches nothing, the second writes only when the first found
- * no conflict at all. Containment was already proven up front and the rest was not.
+ * catalog can be merged into — and touches nothing (`planWrites` is that pass alone), the second
+ * writes only when the first found no conflict at all.
  */
 export async function writeFiles(
   root: string,
@@ -218,16 +260,8 @@ export async function writeFiles(
    */
   invocation = 'x g <kind> <name>',
 ): Promise<WriteReport> {
-  const plans: WritePlan[] = [];
-  for (const file of files) {
-    const absolute = containedPath(root, file.path);
-    plans.push(
-      file.merge === 'json'
-        ? await planJsonMerge(file, absolute)
-        : planFile(file, absolute, force, invocation),
-    );
-  }
-  const conflicts = plans.flatMap((plan) => (plan.kind === 'conflict' ? [plan.finding] : []));
+  const plans = await planAll(root, files, force, invocation);
+  const conflicts = conflictsOf(plans);
   if (conflicts.length > 0) return { written: [], conflicts };
 
   const written: string[] = [];

package/src/gh-target.ts

@@ -76,18 +76,23 @@ const PR_VIEW = t.object({ number: t.number });
  * The pull request for the current branch. gh exits non-zero when there is none, with a message
  * that names the branch — so the refusal keeps gh's own sentence and adds the remedy gh has no
  * opinion about: name the number, or open the PR.
+ *
+ * No `--repo`: gh refuses `pr view --repo <slug>` without a number, url or branch before any
+ * network call, so that argv could never succeed. The checkout-scoped form resolves the branch's
+ * tracking remote itself — the same resolution `gh repo view` gave `resolveRepo`. `repo` names the
+ * pull request in the refusal only.
  */
 export async function resolvePrNumber(host: GhHost, repo: GhRepo): Promise<number> {
   try {
-    const viewed = await ghJson(
-      host,
-      ['pr', 'view', '--repo', repo.slug, '--json', 'number'],
-      PR_VIEW,
-      { label: 'gh pr view', fix: 'x pr review --pr 241 --json' },
-    );
+    const viewed = await ghJson(host, ['pr', 'view', '--json', 'number'], PR_VIEW, {
+      label: 'gh pr view',
+      fix: 'x pr review --pr 241 --json',
+    });
     return viewed.number;
   } catch (error) {
-    if (error instanceof GhFailedError) throw new PrNotFoundError({ detail: error.cause });
+    if (error instanceof GhFailedError) {
+      throw new PrNotFoundError({ detail: `${repo.slug}: ${error.cause}` });
+    }
     throw error;
   }
 }

package/src/hold.ts

@@ -48,6 +48,18 @@ export function holdUntilShutdown(
   release: () => Promise<void>,
   options: HoldOptions = {},
 ): () => Promise<void> {
+  return armHold(name, release, options).hold;
+}
+
+/** A hold whose handlers are already listening, and the way to give them back unheld. */
+interface ArmedHold {
+  readonly hold: () => Promise<void>;
+  /** Uninstall the handlers and the hook without waiting for any shutdown — a boot that failed. */
+  readonly disarm: () => void;
+}
+
+/** The signal handlers and the `accept` hook, installed NOW; the release waits for `hold()`. */
+function armHold(name: string, release: () => Promise<void>, options: HoldOptions): ArmedHold {
   const uninstall = installSignalHandlers({ exit: false });
   let unregister = (): void => {};
   // The hook's own `reason`, not a stopwatch of ours: `deadlineAt` is the instant core computed
@@ -64,7 +76,7 @@ export function holdUntilShutdown(
   });
 
   let held: Promise<void> | undefined;
-  return () => {
+  const hold = (): Promise<void> => {
     // Memoised: awaiting a hold twice must not release twice, and `dispatch` is not the only
     // caller a test can be.
     held ??= (async () => {
@@ -79,6 +91,49 @@ export function holdUntilShutdown(
     })();
     return held;
   };
+  return {
+    hold,
+    disarm: () => {
+      unregister();
+      uninstall();
+    },
+  };
+}
+
+/** What a boot answers once it is up: the app, and the hold that keeps the process on it. */
+export interface BootedHold<T> {
+  readonly app: T;
+  readonly hold: () => Promise<void>;
+}
+
+/**
+ * Boot under the drain's handlers, never ahead of them. `runRole` used to install them after the
+ * boot returned, while `startRoles` starts the worker claiming in the middle of it — so a SIGTERM
+ * landing between the two (a rollout replacing a pod still booting) met Bun's default and ended a
+ * process holding claimed jobs, each one stranded for a whole visibility timeout. Armed first, the
+ * same signal is a drain: whatever the boot has started hears core's phases (the worker stops
+ * claiming and hands back at its cut-off), and the release — the app's own `stop()` — runs once
+ * the boot has finished, so nothing it acquired after the signal is left running.
+ *
+ * A boot that throws gives the handlers back and rethrows its own error: the refusal is the
+ * finding, and handlers left installed would turn the next signal into a drain of nothing.
+ */
+export async function holdWhileBooting<T extends { stop(): Promise<void> }>(
+  name: string,
+  boot: () => Promise<T>,
+  options: HoldOptions = {},
+): Promise<BootedHold<T>> {
+  let booted: T | undefined;
+  const armed = armHold(name, async () => await booted?.stop(), options);
+  let app: T;
+  try {
+    app = await boot();
+  } catch (error) {
+    armed.disarm();
+    throw error;
+  }
+  booted = app;
+  return { app, hold: armed.hold };
 }
 
 /**

package/src/i18n-audit.ts

@@ -4,22 +4,23 @@
 
 // `node:` and not Bun: Bun exposes no existence check (`existsSync`, which is how a missing
 // `catalogs/` directory reads as "nothing shipped" instead of a throw) and no path API at all —
-// `join` builds the absolute path `Bun.file` reads, and `relative`/`sep` turn it back into the
+// `join` builds the absolute path `Bun.file` reads; `posixRelative` turns it back into the
 // root-relative POSIX shape every CLI-reported path is keyed by.
 import { existsSync } from 'node:fs';
-import { join, relative, sep } from 'node:path';
-import { renderThrowable } from '@ultimat3/core';
+import { join } from 'node:path';
+import { DEFAULT_LOCALE, renderThrowable } from '@ultimat3/core';
 import type { Catalog, Extraction, ExtractReport, Locale } from '@ultimat3/i18n';
 import {
   auditCatalogs,
   catalogInvalid,
   catalogKeys,
-  DEFAULT_LOCALE,
   extractFromFiles,
   loadCatalog,
   missingFrom,
   nestCatalog,
 } from '@ultimat3/i18n';
+import { isLoudMiss, loudMiss } from './i18n-registration';
+import { posixRelative } from './posix-path';
 import { eachSourceFile, isTest } from './source-files';
 import { CATALOG_ROOT, catalogPath } from './templates/locales';
 
@@ -28,16 +29,19 @@ import { CATALOG_ROOT, catalogPath } from './templates/locales';
  * glob set every text-scanning gate step already shares (`errors`, `filesize`) — a second glob
  * here would mean this command and `x verify` disagree on what "the app's source" is. Test files
  * are excluded: a fixture's `t('fixture.key')` is not a gap the shipped catalogs owe an answer to.
+ * So are `guards/`: gate tooling renders nothing, and its fix lines quote `t('…')` as an example.
  * `extractFromFiles` reads by absolute path, so its `file` label is rewritten back to the same
  * root-relative POSIX shape `app-load.ts` uses for every other CLI-reported path.
  */
+const isGuard = (file: string): boolean => file.startsWith('guards/');
+
 export async function scanSource(root: string): Promise<Extraction> {
   const files: string[] = [];
   for await (const file of eachSourceFile(root)) {
-    if (!isTest(file)) files.push(file);
+    if (!isTest(file) && !isGuard(file)) files.push(file);
   }
   const extraction = await extractFromFiles(files.map((file) => join(root, file)));
-  const toRelative = (file: string): string => relative(root, file).split(sep).join('/');
+  const toRelative = (file: string): string => posixRelative(root, file);
   return {
     usages: extraction.usages.map((usage) => ({ ...usage, file: toRelative(usage.file) })),
     dynamic: extraction.dynamic.map((entry) => ({ ...entry, file: toRelative(entry.file) })),
@@ -182,11 +186,23 @@ function sortCatalog(catalog: Catalog): Catalog {
 }
 
 /**
- * `x i18n add`'s seed: every key the default locale defines, values copied verbatim — an
- * untranslated string that renders is strictly better than a missing key that renders `⟦key⟧`.
+ * `x i18n add`'s seed, and `x i18n sync`'s source on a real merge: every key the default locale
+ * defines, each value copied INSIDE the CLI's
+ * one placeholder marker — `⟦Hello {name}⟧`. A bare copy rendered the default locale's string to
+ * every `fr` reader under a green gate, an untranslated catalog no audit could tell from a
+ * finished one. Marked, the source text still sits where the translation goes, the page shows the
+ * brackets, and `withPlaceholdersMissing` counts every key as missing (`X_CATALOG_MISSING_KEYS`)
+ * until a human replaces it. `loudMiss` is the marker's one spelling — a second one would be a
+ * placeholder this command writes and the gate cannot see.
  */
 export function seedCatalog(source: Catalog): Catalog {
-  return sortCatalog(source);
+  const marked: Record<string, string> = {};
+  for (const key of catalogKeys(source)) {
+    const value = source[key];
+    // A value already a placeholder stays one, as written — never `⟦⟦key⟧⟧`.
+    if (value !== undefined) marked[key] = isLoudMiss(value) ? value : loudMiss(value);
+  }
+  return marked;
 }
 
 export interface SyncResult {

package/src/i18n-index.ts

@@ -9,12 +9,11 @@
 // why: Bun has no synchronous existence check — `Bun.file(p).exists()` is async, and this decides
 // whether to write at all, before any await the caller could interleave with.
 import { existsSync } from 'node:fs';
+import { APP_CATALOGS_PATH } from '@ultimat3/i18n/app-catalogs';
 import { containedPath } from './generate-write';
 import type { Finding } from './output';
 import { CATALOG_ROOT, i18nIndex, localeEntry, localeImport } from './templates';
 
-export const I18N_INDEX_PATH = 'packages/i18n/src/index.ts';
-
 /** Every locale with a catalog on disk, sorted — the file names are the tags. */
 export async function catalogLocales(root: string): Promise<readonly string[]> {
   const catalogDir = containedPath(root, CATALOG_ROOT);
@@ -50,7 +49,7 @@ const importedLocales = (source: string): readonly string[] =>
  * overwritten: it was, on every `x g`, with a template hard-coding `default: 'en'`.
  */
 export async function syncI18nIndex(root: string): Promise<IndexSync> {
-  const indexAbsolute = containedPath(root, I18N_INDEX_PATH);
+  const indexAbsolute = containedPath(root, APP_CATALOGS_PATH);
   if (!existsSync(indexAbsolute)) return { registered: false, findings: [] };
   const current = await Bun.file(indexAbsolute).text();
   const onDisk = await catalogLocales(root);
@@ -83,7 +82,7 @@ function withLocales(source: string, locales: readonly string[]): string | undef
 
 const refusal = (locales: readonly string[]): Finding => ({
   code: 'X_CATALOG_UNREGISTERED',
-  cause: `${I18N_INDEX_PATH} is hand-written in a shape this writer cannot add ${locales.join(', ')} to, so those catalogs are on disk and not selectable`,
-  fix: `edit ${I18N_INDEX_PATH} — add ${locales.map(localeImport).join(' ')} and ${locales.map(localeEntry).join(', ')} to the locales passed to defineCatalogs`,
-  at: I18N_INDEX_PATH,
+  cause: `${APP_CATALOGS_PATH} is hand-written in a shape this writer cannot add ${locales.join(', ')} to, so those catalogs are on disk and not selectable`,
+  fix: `edit ${APP_CATALOGS_PATH} — add ${locales.map(localeImport).join(' ')} and ${locales.map(localeEntry).join(', ')} to the locales passed to defineCatalogs`,
+  at: APP_CATALOGS_PATH,
 });

package/src/i18n-registration.ts

@@ -18,12 +18,13 @@ import {
   pluralVariantsOf,
   registeredLocales,
 } from '@ultimat3/i18n';
+import { APP_CATALOGS_PATH } from '@ultimat3/i18n/app-catalogs';
 import { mountedAdminKeys } from './admin-catalog-keys';
+import type { LoadedApp } from './app-load';
 import { loadApp } from './app-load';
 import type { DuplicateProbe } from './duplicate-packages';
 import { duplicateCause, duplicateFinding, findDuplicateInstalls } from './duplicate-packages';
 import { auditApp } from './i18n-audit';
-import { I18N_INDEX_PATH } from './i18n-index';
 import type { Finding } from './output';
 import { findingFrom } from './output';
 import { CATALOG_ROOT, catalogPath } from './templates/locales';
@@ -37,10 +38,7 @@ const I18N_PKG = '@ultimat3/i18n';
  * can resolve `@ultimat3/*`. `loadApp` is the production value, and it is the same call
  * `serveApp` makes: asking a different loader than the server uses would prove nothing.
  */
-export type AppLoader = (root: string) => Promise<{
-  readonly findings: readonly Finding[];
-  readonly defaultLocale: string;
-}>;
+export type AppLoader = (root: string) => Promise<Pick<LoadedApp, 'findings' | 'locales'>>;
 
 export interface RegistrationInput {
   readonly root: string;
@@ -121,9 +119,9 @@ export async function checkRegistration(input: RegistrationInput): Promise<Regis
   let locales = gaps.length;
 
   if (Object.keys(input.catalogs).length === 0) {
-    const unresolved = unresolvedUsedKeys(input, app.defaultLocale);
+    const unresolved = unresolvedUsedKeys(input, app.locales.defaultLocale);
     if (unresolved.length > 0) {
-      findings.push(findingFrom(catalogsNeverRegistered(app.defaultLocale, unresolved)));
+      findings.push(findingFrom(catalogsNeverRegistered(app.locales.defaultLocale, unresolved)));
       unregistered += unresolved.length;
       locales += 1;
     }
@@ -182,7 +180,7 @@ function adminKeysFinding(locale: Locale, missing: readonly string[]): Finding {
  * the half that knows what an app's directories are.
  */
 async function indexSource(root: string): Promise<string | undefined> {
-  const file = Bun.file(join(root, I18N_INDEX_PATH));
+  const file = Bun.file(join(root, APP_CATALOGS_PATH));
   return (await file.exists()) ? file.text() : undefined;
 }
 
@@ -208,7 +206,7 @@ export function unregisteredFix(
   // report a registered locale as unregistered, which is the direction that costs trust.
   if (index.includes(`${CATALOG_ROOT.split('/').pop() ?? 'catalogs'}/${locale}.json`)) return {};
   return {
-    fix: `x i18n sync ${locale}   # re-derives ${I18N_INDEX_PATH} from the catalogs on disk`,
+    fix: `x i18n sync ${locale}   # re-derives ${APP_CATALOGS_PATH} from the catalogs on disk`,
   };
 }
 

package/src/import-scan.ts

@@ -42,12 +42,36 @@ export function scanRuntimeImports(file: ScannedFile): readonly string[] {
     .map((entry) => entry.path);
 }
 
+/**
+ * A type-position `import('…')` — `typeof import('@ultimat3/cli')`, `let x: import('a').B` — is no
+ * import statement, so the transpiler erases it whole and neither pass above sees it (K16: the tier
+ * rule passed one). Read off `masked`, the source with comments and string CONTENTS blanked and
+ * delimiters kept (`@ultimat3/core`'s `maskLiterals`): a match there is code, and the specifier is
+ * read back from `source` at the same offsets. Taken as an argument because this file is a leaf.
+ * A dynamic `import(x)` is reported too, which the runtime pass already holds — callers dedupe.
+ */
+const IMPORT_CALL = /(?<![\w$.])import\s*\(\s*(['"])/g;
+
+export function typePositionImports(source: string, masked: string): readonly string[] {
+  const found: string[] = [];
+  for (const match of masked.matchAll(IMPORT_CALL)) {
+    const quote = match[1] as string;
+    const open = match.index + match[0].length;
+    const close = masked.indexOf(quote, open);
+    if (close === -1) continue;
+    const specifier = source.slice(open, close);
+    if (specifier !== '' && !specifier.includes('\n')) found.push(specifier);
+  }
+  return found;
+}
+
 /**
  * Every specifier the file names, type-only ones included. Throws when the file does not parse —
  * a scan that answered `[]` there would read as a file importing nothing. The rewrite pass alone
- * is forgiving: a rewrite the parser refuses falls back to the runtime scan.
+ * is forgiving: a rewrite the parser refuses falls back to the runtime scan. Hand it `masked`
+ * (core's `maskLiterals(file.source)`) and a type-position `import('…')` is read as well.
  */
-export function scanAllImports(file: ScannedFile): readonly string[] {
+export function scanAllImports(file: ScannedFile, masked?: string): readonly string[] {
   const runtime = scanRuntimeImports(file);
   let typed: readonly string[] = [];
   try {
@@ -58,6 +82,7 @@ export function scanAllImports(file: ScannedFile): readonly string[] {
   } catch {
     typed = [];
   }
+  const inTypes = masked === undefined ? [] : typePositionImports(file.source, masked);
   // The rewritten pass first: it holds every import in SOURCE order, which callers report in.
-  return [...new Set([...typed, ...runtime])];
+  return [...new Set([...typed, ...inTypes, ...runtime])];
 }

package/src/index.ts

@@ -21,7 +21,7 @@ export { appManifest, writeAppManifest } from './app-manifest';
 export { requireAppRoot } from './app-root';
 export type { RouteStats } from './budgets';
 export { checkBudgets, FRAMEWORK_INLINE_SCRIPTS, FRAMEWORK_SCRIPTS } from './budgets';
-export { BUILD_ENTRY, BUILD_TARGETS, readTarget } from './cmd-build';
+export { BUILD_ENTRY, BUILD_TARGETS, BuildEntryMissingError, readTarget } from './cmd-build';
 export { dbCommand } from './cmd-db';
 export { planDeploy } from './cmd-deploy';
 export { startDev } from './cmd-dev';
@@ -69,10 +69,8 @@ export {
 export { checkErrorCodesThrown } from './error-unthrown';
 export {
   BadFlagError,
-  BuildEntryMissingError,
   BunVersionError,
   CatalogExistsError,
-  CliNotImplementedError,
   DeclarationUnknownError,
   ErrorCodeUnknownError,
   FixTargetUnknownError,
@@ -117,7 +115,6 @@ export { ICON_BASE_PATH, ICON_SOURCE } from './icon-assets';
 // `x build`'s and `x dev`'s wiring, and every name here is a semver promise forever.
 export type { IslandChunk, SharedChunk } from './island-bundle';
 export { buildIslands } from './island-bundle';
-export { JOB_STATES } from './jobs-report';
 export { renderJobTable } from './jobs-table';
 export { msg } from './messages';
 export { DEFAULT_METRICS_PORT, startMetricsEndpoint } from './metrics-endpoint';
@@ -125,7 +122,7 @@ export { parseMigrationSql, readMigrations } from './migrations';
 export type { CommandResult, Finding, JsonValue } from './output';
 export { exitCodeFor, findingFrom, render, renderFinding, renderHuman } from './output';
 export type { CommandSpec, FlagSpec, ParsedArgs } from './parse';
-export { flagBool, flagList, flagString, GLOBAL_FLAGS, nearest, parseArgs } from './parse';
+export { flagBool, flagList, flagString, GLOBAL_FLAGS, parseArgs } from './parse';
 export type { PrerenderedPage, PrerenderReport } from './prerender';
 export { DEFAULT_ORIGIN, isPrerenderable, prerenderSite } from './prerender';
 export type { PwaArtifacts } from './pwa-artifacts';
@@ -171,7 +168,6 @@ export { readVerifyFloor, skippedSuiteFinding, VERIFY_FLOOR_FILE } from './verif
 export type { HostCheck, StepOutcome, VerifyStep, VerifyStepName } from './verify-step';
 export { VERIFY_STEP_NAMES } from './verify-step';
 export type { TestType } from './verify-tests';
-export { TEST_TYPES } from './verify-tests';
 export {
   checkFileSizes,
   checkLockstep,