@vincentt-xr/cli 0.15.2 → 0.17.0

package/dist/domain/wire.js

@@ -0,0 +1,174 @@
+// The f16 custom-domain wire shapes, and the ONE parser every renderer reads
+// through.
+//
+// EVERY field is read defensively, for the reason lib/diagnostics.ts and
+// library/wire.ts both record: the CLI and the API are versioned separately on a
+// creator's machine, so a field a renderer reads unguarded is a field whose
+// removal from the API crashes the command. A missing optional field degrades to
+// a missing LINE, never to an exception.
+//
+// Two fields are read with more care than the rest, and the care is the point:
+//
+//   • `records` is PRINTED VERBATIM. No client constructs a record
+//     (implementation.md § Wire fields). The parser therefore carries values
+//     through untouched and derives exactly one thing — the relative name — which
+//     it derives from the FQDN the API sent rather than by assembling a name from
+//     parts.
+//   • `observed` is A STRING, NEVER STRUCTURED. The wire says so explicitly, and
+//     the reason is that structure invites a client to re-render and lose the
+//     fidelity that is the whole point of the diagnosis ruling. It is read as a
+//     string and printed as a string; there is no parse step to lose it in.
+/**
+ * The closed state enum (implementation.md § Wire fields).
+ *
+ * `DomainState` is a union of the seven the API can send. An unrecognized state
+ * is NOT coerced into one of these — `parseDomain` keeps the raw string, because
+ * a newer API sending an eighth state must render as itself rather than as a
+ * plausible neighbour. Rendering a state we do not know as `pending` would tell a
+ * creator nothing is wrong when something might be.
+ */
+export const DOMAIN_STATES = [
+    "pending",
+    "verified",
+    "live",
+    "failing",
+    "held",
+    "cert_failed",
+    "detached",
+];
+export function isDomainState(s) {
+    return DOMAIN_STATES.includes(s);
+}
+/**
+ * The closed findings enum (how-it-works.md Scenario 4). Each member carries an
+ * `observed` string.
+ *
+ * The severity is NOT on the wire as a field the CLI trusts blindly — see
+ * `findingSeverity` in copy.ts, which maps the enum to blocking/advisory. That
+ * mapping lives with the copy because the exit code follows the glyph, and the
+ * glyph is a copy decision.
+ */
+// TAKEN FROM THE PRODUCER, not from the design record's prose: these are the
+// exact strings `domain.DomainFinding` emits (api internal/domain/customdomain.go).
+// The record's Scenario 4 describes the same set in narrative form and does not
+// spell every constant, so the Go constants are authoritative for the wire.
+export const FINDING_CODES = [
+    "TOKEN_MISSING",
+    "TOKEN_MISMATCH",
+    "TOKEN_STALE_PRESENT",
+    "WRONG_RECORD_TYPE",
+    "CNAME_WRONG_TARGET",
+    "CONFLICTING_RECORDS",
+    "UNEXPECTED_AAAA",
+    "PROXY_IN_FRONT",
+    "CAA_BLOCKS_ISSUANCE",
+    "STALE_ACME_CHALLENGE",
+    // D-44. The producer spells this WITHOUT a `CERT_` prefix; an earlier draft of
+    // this client invented one and would have rendered the finding as an unknown
+    // code — printing it, but with the enum string as its title and no remedy.
+    "VALIDATION_RECORD_GONE",
+    "MALFORMED_ZONE",
+];
+/**
+ * D-44's finding, as a NAMED CONSTANT rather than a literal at each site.
+ *
+ * Two places branch on it — the severity table and the record re-print — and
+ * they were briefly spelled differently, which printed the finding while
+ * silently omitting the record that IS its remedy. A shared symbol makes that
+ * particular disagreement unexpressible.
+ */
+export const VALIDATION_RECORD_GONE = "VALIDATION_RECORD_GONE";
+function str(o, k) {
+    return typeof o[k] === "string" ? o[k] : undefined;
+}
+function num(o, k) {
+    return typeof o[k] === "number" ? o[k] : undefined;
+}
+function obj(raw) {
+    return typeof raw === "object" && raw !== null ? raw : {};
+}
+/**
+ * Parse one record. `type`, `name` and `value` are all required: a record
+ * missing any of the three cannot be created at a registrar, and printing a
+ * partial row would send a creator to paste a blank into a form.
+ */
+export function parseRecord(raw) {
+    const o = obj(raw);
+    const type = str(o, "type");
+    const name = str(o, "name");
+    const value = str(o, "value");
+    if (!type || !name || !value)
+        return undefined;
+    return { type, name, value, ttl: num(o, "ttl") };
+}
+/**
+ * Parse one finding. A finding with no `observed` is DROPPED rather than
+ * rendered, because the shape's whole contract is that it reports what was seen
+ * — and a finding that restates the instructions is the thing the design refuses.
+ * Dropping is visible: `parseDomain` counts what it dropped.
+ */
+export function parseFinding(raw) {
+    const o = obj(raw);
+    const code = str(o, "code");
+    const observed = str(o, "observed");
+    if (!code || observed === undefined)
+        return undefined;
+    return {
+        code,
+        observed,
+        expected: str(o, "expected"),
+        severity: str(o, "severity"),
+    };
+}
+/**
+ * Parse a domain row.
+ *
+ * `domain` is the only structurally required field: without a hostname there is
+ * nothing to render a row about. Everything else degrades to an absent line.
+ */
+export function parseDomain(raw) {
+    const o = obj(raw);
+    const domain = str(o, "domain");
+    if (!domain)
+        return undefined;
+    const rawRecords = Array.isArray(o.records) ? o.records : [];
+    const records = rawRecords
+        .map(parseRecord)
+        .filter((r) => r !== undefined);
+    const rawFindings = Array.isArray(o.findings) ? o.findings : [];
+    const findings = rawFindings
+        .map(parseFinding)
+        .filter((f) => f !== undefined);
+    const rawState = str(o, "state") ?? "";
+    // `holdsAt` is null unless `failing`. A JSON null must read as ABSENT, not as
+    // the string "null" — `str` already refuses a non-string, which is the guard.
+    return {
+        domain: {
+            domain,
+            rawState,
+            state: isDomainState(rawState) ? rawState : undefined,
+            projectId: str(o, "projectId"),
+            projectName: str(o, "projectName"),
+            records,
+            findings,
+            holdsAt: str(o, "holdsAt"),
+            attachedAt: str(o, "attachedAt"),
+            permanentAddress: str(o, "permanentAddress"),
+        },
+        droppedFindings: rawFindings.length - findings.length,
+    };
+}
+/** Parse the list envelope. A row that cannot be parsed is skipped, never faked. */
+export function parseDomainList(raw) {
+    const o = obj(raw);
+    const rows = Array.isArray(o.domains) ? o.domains : [];
+    return {
+        domains: rows
+            .map(parseDomain)
+            .filter((p) => p !== undefined)
+            .map((p) => p.domain),
+        count: num(o, "count"),
+        limit: num(o, "limit"),
+        planName: str(o, "planName"),
+    };
+}

package/dist/dx/command.d.ts

@@ -2,6 +2,7 @@ import type { ConsentDecision } from "./consent.js";
 import type { Enablement } from "./enablement.js";
 import type { JournalEntry } from "./journal.js";
 import type { WireReport } from "./send.js";
+import { type BuiltWith } from "../platform/resolve.js";
 export interface DxDeps {
     entries: () => JournalEntry[];
     print: (line: string) => void;
@@ -159,13 +160,21 @@ export interface DxSendDeps extends DxDeps {
         apiUrl: string;
         pat: string;
     }) => Promise<Enablement>;
+    /**
+     * The version set. Injectable so a fixed set — or a REJECTING promise, the arm
+     * proving a fault omits — can be driven with no filesystem. Defaults to the one
+     * shared resolver against `cwd`.
+     */
+    builtWith?: () => Promise<BuiltWith | undefined>;
+    cwd?: string;
 }
 /**
  * `vincentt dx --send`.
  *
- * The order is the consent model and is not an implementation detail: find the
- * friction, BUILD the payload, SHOW it in full, ask, and only then send. A
- * creator who cannot see what leaves their machine before it leaves has not
- * agreed to anything.
+ * The order is the consent model and is not an implementation detail. A creator
+ * who cannot see what leaves their machine before it leaves has not agreed to
+ * anything:
+ *
+ *     friction → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
  */
 export declare function dxSendCommand(deps: DxSendDeps, options: DxOptions): Promise<number>;

package/dist/dx/command.js

@@ -2,6 +2,7 @@ import { findClusters, rankClusters } from "./clusters.js";
 import { enablementLine } from "./enablement.js";
 import { journalEnabled, journalPath, readJournal } from "./journal.js";
 import { buildReport, renderPayload } from "./send.js";
+import { resolveBuiltWith } from "../platform/resolve.js";
 const DEFAULT_DAYS = 7;
 export function parseDxOptions(args) {
     const i = args.indexOf("--days");
@@ -321,10 +322,11 @@ export async function dxDisableCommand(deps) {
 /**
  * `vincentt dx --send`.
  *
- * The order is the consent model and is not an implementation detail: find the
- * friction, BUILD the payload, SHOW it in full, ask, and only then send. A
- * creator who cannot see what leaves their machine before it leaves has not
- * agreed to anything.
+ * The order is the consent model and is not an implementation detail. A creator
+ * who cannot see what leaves their machine before it leaves has not agreed to
+ * anything:
+ *
+ *     friction → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
  */
 export async function dxSendCommand(deps, options) {
     if (!deps.enabled()) {
@@ -416,7 +418,26 @@ export async function dxSendCommand(deps, options) {
         deps.print("Not signed in. Run `vincentt login` to send a report.");
         return 1;
     }
-    const report = buildReport(clusters, deps.cliVersion(), options.note);
+    // RESOLVED AFTER THE GATE AND IMMEDIATELY BEFORE THE BUILD.
+    //
+    // This is deliberately the INVERSE of publish, which resolves AFTER its
+    // confirmation (`publish/command.ts`), and the two must not be "unified": on
+    // publish the version set is never shown, so resolving before the prompt would
+    // mean a REFUSED publish had read the creator's `node_modules` for nothing.
+    // Here the set IS part of what is being consented to, so a value not resolved
+    // cannot be shown and a value not shown cannot be consented to. One rule covers
+    // both: resolve at the last moment before the value is needed, and never
+    // earlier. On publish that moment is the POST; here it is the SHOW.
+    //
+    // The gate is already passed, so a refused send has read nothing at all.
+    //
+    // The `.catch` belongs HERE and not in the resolver: the resolver's `undefined`
+    // already means "nothing to say", so swallowing inside it would make a genuine
+    // fault indistinguishable from a legitimate empty tree inside the sole
+    // producer. At this call site the meaning is exact — a fault yields the same
+    // omission an empty project yields, and neither can fail a send.
+    const builtWith = await (deps.builtWith ?? (() => resolveBuiltWith(deps.cwd ?? process.cwd())))().catch(() => undefined);
+    const report = buildReport(clusters, deps.cliVersion(), options.note, builtWith);
     // Above the payload, on the unattended path only: name that this is enabled,
     // how old the grant is, WHERE it was granted, and that nothing is going to ask.
     const unattended = !interactive && enablement.enabled;

package/dist/dx/report.d.ts

@@ -21,6 +21,7 @@
  */
 import type { Enablement } from "./enablement.js";
 import type { JournalEntry } from "./journal.js";
+import { type BuiltWith } from "../platform/resolve.js";
 /** An observation as it goes on the wire. Mirrors the API's dxObservationRequest. */
 export interface WireObservation {
     note: string;
@@ -29,6 +30,14 @@ export interface WireObservation {
 export interface WireObservationReport {
     cliVersion: string;
     platform: string;
+    /**
+     * What the CLI resolved on this machine at report time. On the ROOT, not on
+     * the observation: it is a fact about the machine that produced the report,
+     * not about any one carrier, and putting it per-carrier would both be false
+     * and multiply it on the wire by the carrier count. Absent when nothing
+     * resolved.
+     */
+    builtWith?: BuiltWith;
     findings: never[];
     observations: WireObservation[];
 }
@@ -62,14 +71,28 @@ export declare function parseReportOptions(args: string[]): ReportOptions;
  * this run, and none of those is a reason to refuse to send what someone typed.
  */
 export declare function lastContext(entries: JournalEntry[]): string | undefined;
-export declare function buildObservationReport(note: string, cliVersion: string, context?: string): WireObservationReport;
+/**
+ * The wire payload. PURE and SYNCHRONOUS, which is the property its tests rest
+ * on — `builtWith` is a PARAMETER, not a dep, so the async resolution and the
+ * `.catch(() => undefined)` that makes a fault an omission stay the caller's.
+ */
+export declare function buildObservationReport(note: string, cliVersion: string, context?: string, builtWith?: BuiltWith): WireObservationReport;
 /**
  * Render the payload for the creator to read BEFORE it is sent.
  *
- * As in `send.ts`, this is the payload formatted, not a summary of it. The note
- * warning is unconditional here, where it is conditional there: an observation
- * is ALWAYS a note, so there is no path through this screen that does not need
- * it.
+ * As in `send.ts`, this is the payload formatted, WITH EXACTLY ONE FIELD
+ * SUMMARIZED: `builtWith` renders as a single `versions:` line at its own
+ * position inside the block, and no second field may join it. The exemption's
+ * reasoning and the three properties bounding it live in
+ * `platform/versionSummary.ts` rather than being restated at each screen, so the
+ * two cannot come to describe it differently.
+ *
+ * `renderPayload` (`send.ts`) is the other consent screen and carries the
+ * identical exemption. NEITHER MAY BE UPDATED WITHOUT THE OTHER.
+ *
+ * The note warning is unconditional here, where it is conditional there: an
+ * observation is ALWAYS a note, so there is no path through this screen that
+ * does not need it.
  */
 export declare function renderObservation(report: WireObservationReport): string[];
 export interface ReportDeps {
@@ -92,11 +115,20 @@ export interface ReportDeps {
         apiUrl: string;
         pat: string;
     }) => Promise<Enablement>;
+    /**
+     * The version set. Injectable so a fixed set — or a REJECTING promise, the arm
+     * proving a fault omits — can be driven with no filesystem. Defaults to the one
+     * shared resolver against `cwd`.
+     */
+    builtWith?: () => Promise<BuiltWith | undefined>;
+    cwd?: string;
 }
 /**
  * `vincentt report`.
  *
- * Same order as `dx --send`, for the same reason: build the payload, SHOW it,
- * ask, and only then send.
+ * Same order as `dx --send`, for the same reason — a creator who cannot see what
+ * leaves their machine before it leaves has not agreed to anything:
+ *
+ *     bound-check → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
  */
 export declare function reportCommand(deps: ReportDeps, options: ReportOptions): Promise<number>;

package/dist/dx/report.js

@@ -1,5 +1,7 @@
 import { enablementLine } from "./enablement.js";
 import { DXSendError, platformTag } from "./send.js";
+import { resolveBuiltWith } from "../platform/resolve.js";
+import { renderPayloadWithVersionSummary, summarizeBuiltWith, versionDisclosureLines, } from "../platform/versionSummary.js";
 /** Matches the server's MaxDXNote. Checked here so a refusal costs no round trip. */
 export const MAX_NOTE = 2000;
 /**
@@ -39,38 +41,64 @@ export function lastContext(entries) {
     }
     return undefined;
 }
-export function buildObservationReport(note, cliVersion, context) {
+/**
+ * The wire payload. PURE and SYNCHRONOUS, which is the property its tests rest
+ * on — `builtWith` is a PARAMETER, not a dep, so the async resolution and the
+ * `.catch(() => undefined)` that makes a fault an omission stay the caller's.
+ */
+export function buildObservationReport(note, cliVersion, context, builtWith) {
     const o = { note: note.trim() };
     if (context !== undefined && context !== "")
         o.context = context;
-    return {
-        cliVersion,
-        platform: platformTag(),
-        // Always present and always empty: the server accepts a report with either
-        // carrier, and sending the key explicitly says "no findings" rather than
-        // leaving the shape to be inferred from an absent field.
-        findings: [],
-        observations: [o],
-    };
+    // THE SUMMARY IS THE AUTHORITY ON WHETHER THE FIELD IS SENT — a version set the
+    // consent screen cannot render may not go on the wire. See
+    // `summarizeBuiltWith`.
+    const sendable = summarizeBuiltWith(builtWith);
+    // Always present and always empty: the server accepts a report with either
+    // carrier, and sending the key explicitly says "no findings" rather than
+    // leaving the shape to be inferred from an absent field.
+    //
+    // `builtWith` sits between `platform` and `findings` — the position the consent
+    // screen summarizes it at, and a sibling of the other two machine facts.
+    return sendable === undefined
+        ? { cliVersion, platform: platformTag(), findings: [], observations: [o] }
+        : {
+            cliVersion,
+            platform: platformTag(),
+            builtWith: sendable,
+            findings: [],
+            observations: [o],
+        };
 }
 /**
  * Render the payload for the creator to read BEFORE it is sent.
  *
- * As in `send.ts`, this is the payload formatted, not a summary of it. The note
- * warning is unconditional here, where it is conditional there: an observation
- * is ALWAYS a note, so there is no path through this screen that does not need
- * it.
+ * As in `send.ts`, this is the payload formatted, WITH EXACTLY ONE FIELD
+ * SUMMARIZED: `builtWith` renders as a single `versions:` line at its own
+ * position inside the block, and no second field may join it. The exemption's
+ * reasoning and the three properties bounding it live in
+ * `platform/versionSummary.ts` rather than being restated at each screen, so the
+ * two cannot come to describe it differently.
+ *
+ * `renderPayload` (`send.ts`) is the other consent screen and carries the
+ * identical exemption. NEITHER MAY BE UPDATED WITHOUT THE OTHER.
+ *
+ * The note warning is unconditional here, where it is conditional there: an
+ * observation is ALWAYS a note, so there is no path through this screen that
+ * does not need it.
  */
 export function renderObservation(report) {
     return [
         "This is what would be sent:",
         "",
-        ...JSON.stringify(report, null, 2)
-            .split("\n")
-            .map((l) => `  ${l}`),
+        ...renderPayloadWithVersionSummary(report, report.builtWith).map((l) => `  ${l}`),
         "",
         "  YOUR NOTE IS SENT EXACTLY AS WRITTEN — check it for paths, URLs,",
         "  tokens, or customer names before sending.",
+        // Entry 2: it explains the one anomalous line above, so it sits directly
+        // under the warning where the reader's eye lands next — above the context
+        // line, which would otherwise make them hunt for the explanation.
+        ...versionDisclosureLines(report.builtWith),
         "  The context line is the shape of your last command, with values removed.",
         "  Your journal stays on this machine.",
     ];
@@ -78,8 +106,10 @@ export function renderObservation(report) {
 /**
  * `vincentt report`.
  *
- * Same order as `dx --send`, for the same reason: build the payload, SHOW it,
- * ask, and only then send.
+ * Same order as `dx --send`, for the same reason — a creator who cannot see what
+ * leaves their machine before it leaves has not agreed to anything:
+ *
+ *     bound-check → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
  */
 export async function reportCommand(deps, options) {
     const note = options.note.trim();
@@ -126,7 +156,28 @@ export async function reportCommand(deps, options) {
         return 1;
     }
     const context = options.noContext ? undefined : lastContext(deps.entries());
-    const report = buildObservationReport(note, deps.cliVersion(), context);
+    // RESOLVED AFTER THE GATE AND IMMEDIATELY BEFORE THE BUILD.
+    //
+    // This is deliberately the INVERSE of publish, which resolves AFTER its
+    // confirmation (`publish/command.ts`), and the two must not be "unified": on
+    // publish the version set is never shown, so it rides along with bytes the
+    // creator already decided to upload and resolving before the prompt would mean
+    // a REFUSED publish had read their `node_modules` for nothing. Here the set IS
+    // part of what is being consented to, so a value not resolved cannot be shown
+    // and a value not shown cannot be consented to — resolving after the ask would
+    // transmit a field the creator never saw. One rule covers both: resolve at the
+    // last moment before the value is needed, and never earlier. On publish that
+    // moment is the POST; here it is the SHOW.
+    //
+    // The gate is already passed, so a refused report has read nothing at all.
+    //
+    // The `.catch` belongs HERE and not in the resolver: the resolver's `undefined`
+    // already means "nothing to say", so swallowing inside it would make a genuine
+    // fault indistinguishable from a legitimate empty tree inside the sole
+    // producer. At this call site the meaning is exact — a fault yields the same
+    // omission an empty project yields, and neither can fail a report.
+    const builtWith = await (deps.builtWith ?? (() => resolveBuiltWith(deps.cwd ?? process.cwd())))().catch(() => undefined);
+    const report = buildObservationReport(note, deps.cliVersion(), context, builtWith);
     const unattended = !interactive && enablement.enabled;
     if (unattended) {
         const line = enablementLine(enablement, deps.now());

package/dist/dx/send.d.ts

@@ -16,6 +16,7 @@
  * that needs server-side scrubbing was built wrong.
  */
 import type { Cluster } from "./clusters.js";
+import type { BuiltWith } from "../platform/resolve.js";
 /** A finding as it goes on the wire. Mirrors the API's dxFindingRequest. */
 export interface WireFinding {
     kind: "error" | "repetition";
@@ -29,6 +30,13 @@ export interface WireFinding {
 export interface WireReport {
     cliVersion: string;
     platform: string;
+    /**
+     * What the CLI resolved on this machine at send time. A sibling of
+     * `cliVersion` and `platform` at the ROOT: it is a fact about the machine that
+     * produced the report, exactly as those two are, and it describes the whole
+     * report rather than any one finding. Absent when nothing resolved.
+     */
+    builtWith?: BuiltWith;
     findings: WireFinding[];
 }
 /**
@@ -45,14 +53,24 @@ export declare function platformTag(): string;
  * function reads counts and timings, never values. If a future journal field
  * carries content, it must not be added to this mapping without the same
  * scrutiny the skeleton got.
+ *
+ * `builtWith` is a PARAMETER, not a dep: this function stays synchronous and
+ * pure, which is the property its tests rest on. The async resolution — and the
+ * `.catch(() => undefined)` that makes a fault an omission — is the caller's.
  */
-export declare function buildReport(clusters: Cluster[], cliVersion: string, note?: string): WireReport;
+export declare function buildReport(clusters: Cluster[], cliVersion: string, note?: string, builtWith?: BuiltWith): WireReport;
 /**
  * Render the payload for the creator to read BEFORE it is sent.
  *
- * This is not a summary of the payload — it is the payload, formatted. A preview
- * that paraphrased what would be sent would be exactly the wrong thing to show
- * someone deciding whether to send it.
+ * This is the payload, formatted, WITH EXACTLY ONE FIELD SUMMARIZED: `builtWith`
+ * renders as a single `versions:` line at its own position inside the block.
+ * Every other field is its literal bytes, and no second field may join it. The
+ * exemption's reasoning and the three properties that bound it are in
+ * `platform/versionSummary.ts` — read there rather than restated here, so the two
+ * consent screens cannot come to describe it differently.
+ *
+ * `renderObservation` (`report.ts`) is the other consent screen and carries the
+ * identical exemption. NEITHER MAY BE UPDATED WITHOUT THE OTHER.
  */
 export declare function renderPayload(report: WireReport): string[];
 export interface SendResult {

package/dist/dx/send.js

@@ -1,3 +1,4 @@
+import { renderPayloadWithVersionSummary, summarizeBuiltWith, versionDisclosureLines, } from "../platform/versionSummary.js";
 /**
  * The server bounds a report at 50 findings and refuses the whole thing past
  * that, so the worst clusters are sent rather than the request rejected. They
@@ -16,8 +17,12 @@ export function platformTag() {
  * function reads counts and timings, never values. If a future journal field
  * carries content, it must not be added to this mapping without the same
  * scrutiny the skeleton got.
+ *
+ * `builtWith` is a PARAMETER, not a dep: this function stays synchronous and
+ * pure, which is the property its tests rest on. The async resolution — and the
+ * `.catch(() => undefined)` that makes a fault an omission — is the caller's.
  */
-export function buildReport(clusters, cliVersion, note) {
+export function buildReport(clusters, cliVersion, note, builtWith) {
     const findings = clusters.slice(0, MAX_SENT_FINDINGS).map((c) => {
         const classes = [
             ...new Set(c.entries.map((e) => e.err).filter((e) => e !== null)),
@@ -38,23 +43,35 @@ export function buildReport(clusters, cliVersion, note) {
     if (note !== undefined && note.trim() !== "" && findings.length > 0) {
         findings[0].note = note.trim();
     }
-    return { cliVersion, platform: platformTag(), findings };
+    // THE SUMMARY IS THE AUTHORITY ON WHETHER THE FIELD IS SENT. A version set the
+    // summary cannot render is one the creator would never see, and a field shown
+    // nowhere may not go on the wire — see `summarizeBuiltWith`.
+    const sendable = summarizeBuiltWith(builtWith);
+    // `builtWith` sits between `platform` and `findings`, which is where the
+    // consent screen renders its summary and where the api reads it.
+    return sendable === undefined
+        ? { cliVersion, platform: platformTag(), findings }
+        : { cliVersion, platform: platformTag(), builtWith: sendable, findings };
 }
 /**
  * Render the payload for the creator to read BEFORE it is sent.
  *
- * This is not a summary of the payload — it is the payload, formatted. A preview
- * that paraphrased what would be sent would be exactly the wrong thing to show
- * someone deciding whether to send it.
+ * This is the payload, formatted, WITH EXACTLY ONE FIELD SUMMARIZED: `builtWith`
+ * renders as a single `versions:` line at its own position inside the block.
+ * Every other field is its literal bytes, and no second field may join it. The
+ * exemption's reasoning and the three properties that bound it are in
+ * `platform/versionSummary.ts` — read there rather than restated here, so the two
+ * consent screens cannot come to describe it differently.
+ *
+ * `renderObservation` (`report.ts`) is the other consent screen and carries the
+ * identical exemption. NEITHER MAY BE UPDATED WITHOUT THE OTHER.
  */
 export function renderPayload(report) {
     const hasNote = report.findings.some((f) => f.note !== undefined && f.note !== "");
     const lines = [
         "This is what would be sent:",
         "",
-        ...JSON.stringify(report, null, 2)
-            .split("\n")
-            .map((l) => `  ${l}`),
+        ...renderPayloadWithVersionSummary(report, report.builtWith).map((l) => `  ${l}`),
         "",
     ];
     // The generated fields carry shape only. The NOTE does not, and saying
@@ -67,6 +84,10 @@ export function renderPayload(report) {
     else {
         lines.push("  No paths, no flag values, no error messages, and nothing about which", "  project this was.");
     }
+    // Entry 2 of the disclosure stack: it explains the one anomalous line on the
+    // screen above, so it goes directly under the scope sentence a reader's eye
+    // lands on next. Absent entirely when nothing resolved.
+    lines.push(...versionDisclosureLines(report.builtWith));
     lines.push("  Your journal stays on this machine.");
     return lines;
 }

package/dist/dx/skeleton.js

@@ -20,9 +20,24 @@ const ELIDED = "<v>";
  * on-disk journal and any report built from it. Lowercase kebab-case is exactly
  * what slugs and project names are made of, so no character-class check catches
  * this — only a list of the verbs that actually exist.
+ *
+ * THIS SET MUST COVER EVERY DISPATCHED VERB, and a missing one is not a leak but
+ * a mis-bucketing: `journal.ts` records `verbOf(argv)`, which answers `<verb>`
+ * for anything absent here, so every invocation of a missing verb clusters under
+ * the placeholder and its friction is invisible. That also broke `lastContext()`
+ * — `report.ts` skips entries whose verb is `report`, which never matched while
+ * `report` was absent, so the context line a creator consents to could be the
+ * skeleton of their own `report` invocation rather than the command before it.
+ *
+ * Adding a verb CANNOT widen what a positional carries: `skeleton()` consults
+ * this set only when `out.length === 0`, so it reaches the FIRST token only, and
+ * every later positional is elided regardless. The historical leak lived in the
+ * first token.
  */
 const KNOWN_VERBS = new Set([
+    "assets",
     "create",
+    "domain",
     "dx",
     "feedback",
     "init",
@@ -31,9 +46,12 @@ const KNOWN_VERBS = new Set([
     "logout",
     "logs",
     "network",
+    "outdated",
     "preview",
+    "projects",
     "publish",
     "relay",
+    "report",
     "trace",
     "unlink",
     "version",
@@ -56,6 +74,7 @@ const KNOWN_FLAGS = new Set([
     "--json",
     "--limit",
     "--name",
+    "--no-context",
     "--no-install",
     "--no-qr",
     "--note",