@wasm-oj/cli 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JacobLinCool
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,16 @@
+# `@wasm-oj/cli`
+
+`woj` is the single local-first command-line interface for WASM-OJ. Local build,
+run, test, benchmark, and judge commands never use the network. Student and
+Organizer commands address explicit immutable resources on the configured
+server. `--offline` rejects every network-capable command before dispatch.
+
+```sh
+woj config set server https://example.invalid
+woj auth login
+woj problem pull <problem-version-id> --language cpp --locale zh-TW
+woj test
+woj submit --wait
+```
+
+Run `woj --help` to see the complete role-based command tree.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,302 @@
+# Third-party notices
+
+This file covers third-party software distributed by the WASM-OJ code and
+toolchain packages, including the content-addressed compiler and runtime assets
+mirrored under `public/toolchains`. The WASM-OJ source code is licensed under the MIT License in
+`LICENSE`; that license does not replace the terms of any component listed
+below.
+
+The canonical machine-readable component, distribution, source-revision, and
+license-file inventory is `licenses/components.json`. Its verifier binds every
+listed file to a SHA-256 digest and rejects unlisted toolchain or license files.
+
+## JavaScript runtime dependency
+
+### N-API keyring
+
+- Component: `@napi-rs/keyring` 1.3.0
+- Source revision: `Brooooooklyn/keyring-node@e46be75c3ba8d5fde6b88a17c6153b87ffe4b946`
+- Source: <https://github.com/Brooooooklyn/keyring-node/tree/e46be75c3ba8d5fde6b88a17c6153b87ffe4b946>
+- License: MIT
+- License material: `licenses/napi-rs-keyring-MIT.txt`
+
+The `woj` CLI stores remote access tokens in the operating system credential
+store through this native binding. It does not provide a plaintext fallback.
+
+### es-module-lexer
+
+- Component: `es-module-lexer` 2.3.1
+- npm integrity: `sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==`
+- Source revision: `guybedford/es-module-lexer@2b2e6209bac5c06c6ba457f9730014613e1128fb`
+- Source: <https://github.com/guybedford/es-module-lexer/tree/2b2e6209bac5c06c6ba457f9730014613e1128fb>
+- License: MIT
+- License material: `licenses/es-module-lexer-MIT.txt`
+
+WASM-OJ uses es-module-lexer inside the browser runner Worker to reject every
+static or dynamic transitive import before loading a content-pinned runtime
+driver plug-in.
+
+### fflate
+
+- Component: `fflate` 0.8.3
+- Source revision: `101arrowz/fflate@v0.8.3`
+- Source: <https://github.com/101arrowz/fflate/tree/v0.8.3>
+- License: MIT
+- License material: `licenses/fflate-MIT.txt`
+
+WASM-OJ uses fflate for bounded dependency archive extraction and to verify the
+canonical Go module `h1:` hash over module ZIP entries.
+
+### Wasmer JavaScript SDK
+
+- Component: `@wasmer/sdk` 0.10.0
+- npm integrity: `sha512-YQ+s5tGag6P/I8kp9BTH+XhjoS9UFvWiZJvnWEEovClHffhYToKhprWr4UJG7wLP7c/2HQpGkF7ZrjoUvKjdmA==`
+- Source revision: `wasmerio/wasmer-js@93b8b738ebd3ee57e118da0f0eb795b97d5b999e`
+- Locked Rust graph: `Cargo.lock` SHA-256
+  `d352926f3f05e3d4308c4e261711d07db568e5c2b4387067180f920da074791f`
+- Source: <https://github.com/wasmerio/wasmer-js/tree/93b8b738ebd3ee57e118da0f0eb795b97d5b999e>
+- License: MIT
+- License material: `licenses/wasmer-sdk-MIT.txt`,
+  `licenses/wasmer-sdk-dependencies.html`, and
+  `licenses/wasmer-sdk-dependencies.json`
+
+WASM-OJ consumes the official npm artifact without patching the installed
+package. The generated dependency report covers every package in the pinned
+normal Cargo dependency graph selected for `wasm32-unknown-unknown`; its compact
+inventory binds all 332 package identities and the exact HTML report digest.
+
+## Distributed toolchain assets
+
+### TypeScript-Go
+
+- Distributed asset: `typescript-7.0.2.wasm.gz.bin`
+- Compressed SHA-256: `06e58ce887d95d1895055699b8dc96a1cde7d1f2baa48de40f9b790e3271dc16`
+- Expanded Wasm SHA-256: `27c931087b3b0cc48804f3749b07eb710538c4ab175969db8a8ff680e6ec4fde`
+- Source revision: `microsoft/typescript-go@2bd066d87f5bafd315be9f40889d0a60b9e58e0b`
+- Source: <https://github.com/microsoft/typescript-go/tree/2bd066d87f5bafd315be9f40889d0a60b9e58e0b>
+- Build runtime: Go 1.26.3 standard library (`GOOS=wasip1`, `GOARCH=wasm`)
+- Licenses: TypeScript-Go Apache-2.0; Go standard library BSD-3-Clause
+- License and attribution material: `licenses/Apache-2.0.txt`,
+  `licenses/typescript-go-NOTICE.txt`, and
+  `licenses/go-BSD-3-Clause.txt`
+
+The TypeScript-Go notice is carried from the exact pinned source revision
+(normalized from CRLF to LF without changing its text). The Go license is from
+the exact `go1.26.3` source tag used by the reproducible build script.
+
+### Go compiler toolchain
+
+- Distributed assets: `go-1.26.5-wasip1.webc.gz.bin`,
+  `go-1.26.5-wasip1.stdlib.gz.bin`, and
+  `go-1.26.5-wasip1.manifest.json`
+- Source: <https://go.dev/dl/go1.26.5.src.tar.gz>
+- Source archive SHA-256:
+  `495be4bc87176ac567392e5b4116abd98466d33d7b49d41e764ccc6976b2dc42`
+- License: BSD-3-Clause
+- License material: `licenses/go-BSD-3-Clause.txt`
+
+WASM-OJ packages the standard Go `compile` and `link` commands plus the matching
+349-package `GOOS=wasip1 GOARCH=wasm` standard library. The stored license is
+byte-identical to `go/LICENSE` in the exact Go 1.26.5 source distribution.
+
+### Java compiler toolchain
+
+- Distributed assets: `java-teavm-0.13.1.wasi.compiler.webc.gz.bin`,
+  `java-teavm-0.13.1.compile-classlib.bin`, and
+  `java-teavm-0.13.1.runtime-classlib.bin`
+- TeaVM Java compiler source: <https://github.com/konsoletyper/teavm-javac/tree/7e4a44cf521694a4e326e33850dd8aec165eb5c9>
+- TeaVM core source: `konsoletyper/teavm@b3a245b7d9034ff35cdfab2def057a3d4f256efb`
+  plus the pinned WASI compiler and math-intrinsic patch
+- Compiler package compressed SHA-256:
+  `129f1f51d591e58954f88787d36396b856a9a68ba3ae9c9d14f20bd67c2c7722`
+- Compiler package expanded SHA-256:
+  `f8f86761cf31062565187e4a66f73b6903f257fe84c0ce70ea1cd28441b6c2e9`
+- Licenses: TeaVM Apache-2.0; OpenJDK class library GPL-2.0 with Classpath
+  Exception
+- License material: `licenses/Apache-2.0.txt` and
+  `licenses/openjdk-21-GPL-2.0-with-Classpath-exception.txt`
+
+The compiler emits standalone `wasip1` modules. The class-library archives are
+mounted only during compilation and are not included in submitted artifacts.
+
+### QuickJS-ng
+
+- Distributed asset: `quickjs-0.15.1.wasm.gz.bin`
+- Compressed SHA-256: `8c7f0588210490e7d77f198fc91f72c1b94787ab4c359c4786ca59a363c4f5e8`
+- Expanded Wasm SHA-256: `956bf2b3700690e1817034eb8e063cfd9781c66b4bffa244ef4f9445656ccfa1`
+- Source revision: `quickjs-ng/quickjs@fd0a0210b7be00957751871e7e01b8291268fc29`
+- Source: <https://github.com/quickjs-ng/quickjs/tree/fd0a0210b7be00957751871e7e01b8291268fc29>
+- Build SDK: [WASI SDK 24.0 release archive for arm64 macOS](https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-24/wasi-sdk-24.0-arm64-macos.tar.gz),
+  SHA-256 `aeae999396d5f5caa5ce419f52e83c35869d5fd21d40af80acba2c80f51b0b3a`
+- WASI SDK source revision: `WebAssembly/wasi-sdk@d2bea01edcc46f731156a817f710cdd9fc9c1c19`
+- LLVM and compiler-rt source revision: `llvm/llvm-project@26a1d6601d727a96f4301d0d8647b5a42760ae0c`
+- WASI libc source revision: `WebAssembly/wasi-libc@b9ef79d7dbd47c6c5bafdae760823467c2f60b70`
+- Sources: <https://github.com/WebAssembly/wasi-sdk/tree/d2bea01edcc46f731156a817f710cdd9fc9c1c19>,
+  <https://github.com/llvm/llvm-project/tree/26a1d6601d727a96f4301d0d8647b5a42760ae0c>, and
+  <https://github.com/WebAssembly/wasi-libc/tree/b9ef79d7dbd47c6c5bafdae760823467c2f60b70>
+- Licenses: QuickJS-ng and the WASM-OJ adapter MIT; LLVM compiler-rt
+  Apache-2.0 WITH LLVM-exception plus the third-party terms collected in its
+  license; WASI libc Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT, with
+  separately licensed dlmalloc, cloudlibc-derived, and musl-derived portions
+- License and attribution material: `licenses/quickjs-ng-MIT.txt`,
+  `licenses/wasi-sdk-24.0-Apache-2.0-LLVM-exception.txt`,
+  `licenses/wasi-sdk-24.0-compiler-rt-LICENSE.txt`,
+  `licenses/wasi-libc-b9ef79d-LICENSE.txt`,
+  `licenses/wasi-libc-b9ef79d-Apache-2.0.txt`,
+  `licenses/wasi-libc-b9ef79d-MIT.txt`,
+  `licenses/wasi-libc-b9ef79d-cloudlibc-BSD-2-Clause.txt`,
+  `licenses/wasi-libc-b9ef79d-dlmalloc-CC0-NOTICE.txt`, and
+  `licenses/wasi-libc-b9ef79d-emmalloc-NOTICE.txt`, and
+  `licenses/wasi-libc-b9ef79d-musl-MIT.txt`
+
+The reproducible build links `crt1-command.o`, `libm.a`,
+`libwasi-emulated-signal.a`, `libc.a`, and
+`libclang_rt.builtins-wasm32.a` from that one digest-verified SDK archive.
+Linker tracing confirms that the selected allocator is dlmalloc, not emmalloc.
+WASM-OJ distributes the resulting stripped Wasm runtime, not the host Clang, LLD,
+or strip executables. The build script nevertheless verifies those executables
+and every linked archive by SHA-256 before compiling.
+
+### Rust compiler and standard libraries
+
+- Distributed assets: `rust-1.91.1-dev.webc.gz.bin` and
+  `rust-1.91.1-dev.manifest.json`
+- Build source: `olimpiadi-informatica/wasm-compilers@ae62cab6adf0665377d19ffa39daeaf758290431`
+- Build artifact: GitHub Actions run `26545267884`, `rust.tar.br` SHA-256
+  `ba0096d05275954d852a3fb3a9c4c9438dad501f8e428b867c0b88cfa7301c14`
+- Linker payload: `@yowasp/clang@22.0.0-git20542-10`, npm archive SHA-256
+  `6230ea1afa9691fa065935cf68c01642ff9b31c183fe8ac64cdfda025df06009`;
+  its exact source revisions and license closure are recorded in the following
+  “Clang, LLD, libc++, and WASI libc” section
+- Rust source submodule: `rust-lang/rust@ed61e7d7e242494fb7057f2657300d9e77bb4fcb`
+- LLVM source submodule: `llvm/llvm-project@87f0227cb60147a26a1eeb4fb06e3b505e9c7261`
+- GCC source submodule: `gcc-mirror/gcc@ae91b5dd14920ff9671db8ff80c0d763d25f977f`
+- Source: <https://github.com/olimpiadi-informatica/wasm-compilers/tree/ae62cab6adf0665377d19ffa39daeaf758290431>
+- Build repository license: Apache-2.0
+- Rust license: MIT OR Apache-2.0; LLVM license: Apache-2.0 WITH LLVM-exception
+- `libloading` 0.8.8: ISC; Cargo.lock checksum
+  `07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667`
+- GCC libstdc++ runtime components: GPL-3.0 with GCC Runtime Library
+  Exception 3.1
+- License and attribution texts: `licenses/rust-MIT.txt`,
+  `licenses/Apache-2.0.txt`, `licenses/LLVM-exception.txt`,
+  `licenses/rust-COPYRIGHT.txt`, `licenses/rust-COPYRIGHT.html`,
+  `licenses/rust-COPYRIGHT-library.html`, `licenses/libloading-ISC.txt`,
+  `licenses/GPL-3.0.txt`, and
+  `licenses/GCC-Runtime-Library-Exception-3.1.txt`
+
+The pinned build repository contains its complete Rust/LLVM source revisions,
+the applied `rust.patch`, and the GitHub workflow used for the pinned artifact.
+That workflow builds libstdc++ from the pinned GCC submodule before building
+LLVM and rustc. The custom `rust.tar.br` omits Rust's generated binary-release
+notices, so WASM-OJ carries the complete `COPYRIGHT.html` and
+`COPYRIGHT-library.html` from the official Rust 1.91.1 release for the exact
+`ed61e7d7e` source revision. The official release archive used to source those
+notices is `rustc-1.91.1-x86_64-unknown-linux-gnu.tar.xz`, SHA-256
+`4b4c596fc5268435c310a79c2e231a5a3567572c930ac0740ef9e147e83baf4e`.
+
+WASM-OJ copies the matching `wasm32-wasip1-threads` sysroot, replaces rustc's
+WASI `random_get` and `clock_time_get` imports with deterministic internal
+implementations, and packages the transformed atom and sysroot together with
+the verified YoWASP LLVM linker atom and resources into one WebC. The provenance
+manifest records source-rustc, transformed-rustc, linker archive, linker core,
+and linker-resource SHA-256 digests. These transformations and the generated
+WebC do not relicense Rust or any third-party component identified by the exact
+Rust COPYRIGHT reports and YoWASP source closure carried here.
+
+### Clang, LLD, libc++, PCH, and WASI libc
+
+- Distributed assets: `clang-22.0.0-git20542-10.webc.gz.bin`, the matching
+  debug/release libc++ PCH payloads, and their admission manifest
+- Clang source artifact: `@yowasp/clang@22.0.0-git20542-10`, npm archive
+  SHA-256 `6230ea1afa9691fa065935cf68c01642ff9b31c183fe8ac64cdfda025df06009`
+- YoWASP source revision: `YoWASP/clang@944dd7c774954180e621cc8e12984023a7f8bcbe`
+- LLVM source revision: `YoWASP/llvm-project@97196c8eeb1d495fa43bb8af2fb26af5ef5b89fb`
+- WASI libc source revision: `WebAssembly/wasi-libc@ac020b86fd44bafe60aa4fa12f407d16e3731329`
+- Sources: <https://github.com/YoWASP/clang/tree/944dd7c774954180e621cc8e12984023a7f8bcbe>
+  and <https://github.com/YoWASP/llvm-project/tree/97196c8eeb1d495fa43bb8af2fb26af5ef5b89fb>
+- LLVM license: Apache-2.0 WITH LLVM-exception
+- WASI libc license: Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,
+  with separately licensed portions identified by the upstream notice
+- License and attribution texts: `licenses/LLVM-exception.txt`,
+  `licenses/Apache-2.0.txt`, `licenses/wasi-libc-ac020b86-LICENSE.txt`,
+  `licenses/wasi-libc-ac020b86-musl-fts-BSD-3-Clause.txt`,
+  `licenses/wasi-sdk-24.0-Apache-2.0-LLVM-exception.txt`,
+  `licenses/wasi-libc-b9ef79d-Apache-2.0.txt`,
+  `licenses/wasi-libc-b9ef79d-MIT.txt`,
+  `licenses/wasi-libc-b9ef79d-cloudlibc-BSD-2-Clause.txt`,
+  `licenses/wasi-libc-b9ef79d-dlmalloc-CC0-NOTICE.txt`,
+  `licenses/wasi-libc-b9ef79d-emmalloc-NOTICE.txt`, and
+  `licenses/wasi-libc-b9ef79d-musl-MIT.txt`
+
+The published npm manifest incorrectly says `ISC` and omits a license file.
+The exact source revision's root `LICENSE.txt` and npm README both explicitly
+license the package under Apache-2.0. WASM-OJ does not redistribute the npm
+JavaScript wrapper: the packaging script digest-verifies and extracts only the
+LLVM core and LLVM/WASI resource payload, whose complete upstream license terms
+are carried above. The common Apache, MIT, cloudlibc, dlmalloc, emmalloc, and
+musl terms are byte-identical between the pinned `ac020b86` and `b9ef79d7`
+source trees, so the inventory reuses the exact digest-bound `b9ef79d7` copies;
+the revision-specific root and musl-fts notices remain separate. The generated
+WebC and pinned command manifests do not relicense those payloads.
+
+### CPython 3.14.6 for WASI P1
+
+- Distributed assets: `python-3.14.6-wasip1.webc.gz.bin` and its provenance
+  manifest `python-3.14.6-wasip1.manifest.json`
+- Official source archive: <https://www.python.org/ftp/python/3.14.6/Python-3.14.6.tar.xz>,
+  SHA-256 `143b1dddefaec3bd2e21e3b839b34a2b7fb9842272883c576420d605e9f30c63`
+- Official SPDX document: <https://www.python.org/ftp/python/3.14.6/Python-3.14.6.tar.xz.spdx.json>,
+  SHA-256 `1f5d394856783fa77e1f1db280f84eabf693bffc1fb06a747f7116de9f99f3bd`
+- Expanded WebC SHA-256:
+  `454ffc53936aa13a0d7f4afbb5bd50ada339c8ebd04bbf27ea19e4104cf43207`
+- Distributed gzip SHA-256:
+  `218cd20ac4abb443e0700816010a615a345a43eae623a0232da2227135a6c7a6`
+- Provenance manifest SHA-256:
+  `054eccad04a7cee7ba1661062142ef0d639976850981eab8fc785f48eb26129e`
+- Deterministically exported `WOJFS002` runtime archive SHA-256:
+  `44d894f91487f20c2bb04fe496a9343db37d8720fb706472c2b4a7f3300db039`
+- CPython license: Python Software Foundation License Version 2 and the
+  historical notices reproduced with it
+- License text: `licenses/cpython-3.14.6-PSF-2.0.txt`
+- Bundled third-party source: Expat 2.8.1 (MIT), HACL* revision
+  `8ba599b2f6c9701b3dc961db895b0856a2210f76` (MIT), and libmpdec 2.5.1
+  (BSD-2-Clause); their exact notices are
+  `licenses/cpython-expat-2.8.1-MIT.txt`,
+  `licenses/cpython-hacl-star-8ba599b-MIT.txt`, and
+  `licenses/cpython-libmpdec-2.5.1-BSD-2-Clause.txt`.
+- Build toolchain: WASI SDK 24.0 revision
+  `d2bea01edcc46f731156a817f710cdd9fc9c1c19`, LLVM revision
+  `26a1d6601d727a96f4301d0d8647b5a42760ae0c`, and wasi-libc revision
+  `b9ef79d7dbd47c6c5bafdae760823467c2f60b70`.
+
+WASM-OJ compiles this package from the pinned official sources, disables
+`_socket`, removes test/development-only standard-library roots, canonicalizes
+build-only sysconfig paths, and packages the complete source SPDX document and
+applicable CPython, third-party, compiler-rt, WASI SDK, and wasi-libc notices
+inside the WebC. The build does not consume or redistribute the retired Wasmer
+Registry CPython/WASIX package, and WASM-OJ's MIT license does not apply to these
+third-party contents.
+
+## WASM-OJ runtime-core dependency closure
+
+The browser runner embeds `wasm-oj-runtime-core` and its locked normal
+dependency graph for the `wasm32-unknown-unknown` target with the `web` feature.
+The complete generated license report, including the selected license text for
+every dependency, is `licenses/runtime-core-dependencies.html`. Its compact,
+machine-verifiable package inventory and report digest are recorded in
+`licenses/runtime-core-dependencies.json`. Both files are generated with pinned
+`cargo-about` 0.9.1 and are verified against `crates/runtime-core/Cargo.lock`.
+
+## Vendored Rust crates
+
+WASM-OJ's source tree also contains patched source copies used to build the
+runtime and packaging tools:
+
+- `vendor/shared-buffer`: MIT OR Apache-2.0; see
+  `vendor/shared-buffer/LICENSE_MIT.md` and
+  `vendor/shared-buffer/LICENSE_APACHE.md`.
+- `vendor/virtual-fs`: MIT; see `vendor/virtual-fs/LICENSE`.
+
+These vendored sources are build inputs and are not included in the npm package
+allowlist.

package/bin/woj.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { main } from "../dist/index.js";
+
+process.exitCode = await main(process.argv.slice(2));

package/dist/index.d.ts

@@ -0,0 +1,286 @@
+import { JudgeResult, parseStandaloneProblemBundle, ToolchainDescriptor } from '@wasm-oj/core';
+
+declare const WOJ_CLI_VERSION = "0.2.0";
+/** Stable process exit codes. They are part of the public CLI contract. */
+declare const WOJ_EXIT: Readonly<{
+    readonly success: 0;
+    readonly unsuccessful: 1;
+    readonly usage: 2;
+    readonly authentication: 3;
+    readonly integrity: 4;
+    readonly conflict: 5;
+    readonly infrastructure: 6;
+    readonly localIntegrity: 7;
+}>;
+type WojExitCode = typeof WOJ_EXIT[keyof typeof WOJ_EXIT];
+type CommandBoundary = "local" | "remote" | "network";
+interface CommandSpec {
+    readonly path: readonly string[];
+    readonly summary: string;
+    readonly boundary: CommandBoundary;
+    readonly usage?: string;
+    readonly options?: Readonly<Record<string, "boolean" | "string" | "repeatable">>;
+}
+/** The complete Issue #42 command tree. Every leaf is dispatched explicitly. */
+declare const WOJ_COMMANDS: readonly CommandSpec[];
+declare function commandKey(path: readonly string[]): string;
+declare const COMMAND_BY_KEY: ReadonlyMap<string, CommandSpec>;
+
+declare class CliError extends Error {
+    readonly exitCode: WojExitCode;
+    readonly code: string;
+    constructor(message: string, options?: {
+        readonly exitCode?: WojExitCode;
+        readonly code?: string;
+        readonly cause?: unknown;
+    });
+}
+declare function usageError(message: string): CliError;
+declare function unavailableError(message: string, cause?: unknown): CliError;
+declare function asCliError(error: unknown): CliError;
+
+declare const WOJ_ACCESS_TOKEN: RegExp;
+declare function isWojAccessToken(value: unknown): value is string;
+interface TokenStore {
+    get(serverOrigin: string): Promise<string | undefined>;
+    set(serverOrigin: string, token: string): Promise<void>;
+    delete(serverOrigin: string): Promise<void>;
+}
+declare class OsKeychainTokenStore implements TokenStore {
+    private constructorPromise?;
+    private constructor_;
+    private entry;
+    get(serverOrigin: string): Promise<string | undefined>;
+    set(serverOrigin: string, token: string): Promise<void>;
+    delete(serverOrigin: string): Promise<void>;
+}
+declare class MemoryTokenStore implements TokenStore {
+    private readonly tokens;
+    get(serverOrigin: string): Promise<string | undefined>;
+    set(serverOrigin: string, token: string): Promise<void>;
+    delete(serverOrigin: string): Promise<void>;
+}
+
+declare class ApiError extends CliError {
+    readonly status: number;
+    readonly details?: unknown;
+    readonly verificationUrl?: string;
+    constructor(status: number, code: string, message: string, details?: unknown);
+}
+interface ApiRequestOptions {
+    readonly method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+    readonly body?: unknown;
+    readonly authenticated?: boolean | "optional";
+    readonly headers?: Readonly<Record<string, string>>;
+}
+interface RemoteClient {
+    readonly origin: string;
+    request(path: string, options?: ApiRequestOptions): Promise<unknown>;
+    requestBytes(path: string, options?: Omit<ApiRequestOptions, "body">): Promise<Uint8Array>;
+}
+declare class HttpRemoteClient implements RemoteClient {
+    private readonly tokenStore;
+    private readonly fetchImplementation;
+    readonly origin: string;
+    constructor(origin: string, tokenStore: TokenStore, fetchImplementation?: typeof fetch);
+    request(apiPath: string, options?: ApiRequestOptions): Promise<unknown>;
+    requestBytes(apiPath: string, options?: Omit<ApiRequestOptions, "body">): Promise<Uint8Array>;
+}
+
+interface BrowserOpener {
+    open(url: string): Promise<void>;
+}
+interface DeviceLoginOptions {
+    readonly deviceName: string;
+    readonly onVerification: (verificationUrl: string) => void;
+    readonly sleep?: (milliseconds: number) => Promise<void>;
+}
+declare function deviceLogin(client: RemoteClient, tokenStore: TokenStore, opener: BrowserOpener, options: DeviceLoginOptions): Promise<Record<string, unknown>>;
+
+declare const CONFIG_KEYS: readonly ["server", "runtime-directory", "cache-directory"];
+type ConfigKey = typeof CONFIG_KEYS[number];
+interface WojConfig {
+    readonly server?: string;
+    readonly "runtime-directory"?: string;
+    readonly "cache-directory"?: string;
+}
+interface ConfigStore {
+    read(): Promise<WojConfig>;
+    write(config: WojConfig): Promise<void>;
+}
+declare function defaultConfigDirectory(environment?: Readonly<Record<string, string | undefined>>, platform?: string): string;
+declare function defaultConfigPath(): string;
+declare function validateConfigValue(key: ConfigKey, value: string): string;
+declare function parseConfig(value: unknown): WojConfig;
+declare class JsonConfigStore implements ConfigStore {
+    readonly file: string;
+    constructor(file?: string);
+    read(): Promise<WojConfig>;
+    write(config: WojConfig): Promise<void>;
+}
+declare class MemoryConfigStore implements ConfigStore {
+    private value;
+    constructor(initial?: WojConfig);
+    read(): Promise<WojConfig>;
+    write(config: WojConfig): Promise<void>;
+}
+declare function isConfigKey(value: string): value is ConfigKey;
+
+interface LocalCommandResult {
+    readonly value: unknown;
+    readonly successful: boolean;
+}
+interface LocalRuntime {
+    build(root: string, config: WojConfig): Promise<LocalCommandResult>;
+    run(root: string, config: WojConfig, options: {
+        readonly stdin?: string;
+        readonly args: readonly string[];
+    }): Promise<LocalCommandResult>;
+    test(root: string, config: WojConfig, options: {
+        readonly cases: readonly string[];
+    }): Promise<LocalCommandResult>;
+    bench(root: string, config: WojConfig, options: {
+        readonly stdin?: string;
+        readonly iterations: number;
+    }): Promise<LocalCommandResult>;
+    inspectJudge(file: string): Promise<LocalCommandResult>;
+    verifyJudge(file: string, options: {
+        readonly sha256?: string;
+        readonly bytes?: number;
+    }): Promise<LocalCommandResult>;
+    executeJudge(root: string, config: WojConfig, file: string): Promise<LocalCommandResult>;
+    toolchainList(config: WojConfig): Promise<LocalCommandResult>;
+    toolchainInfo(config: WojConfig, id: string): Promise<LocalCommandResult>;
+    toolchainFetch(config: WojConfig, server: string, id: string, fetchImplementation?: typeof fetch): Promise<LocalCommandResult>;
+    toolchainVerify(config: WojConfig, id?: string): Promise<LocalCommandResult>;
+    toolchainPrune(config: WojConfig): Promise<LocalCommandResult>;
+    cacheStatus(config: WojConfig): Promise<LocalCommandResult>;
+    cachePrune(config: WojConfig): Promise<LocalCommandResult>;
+    cacheClear(config: WojConfig): Promise<LocalCommandResult>;
+    doctor(root: string, config: WojConfig): Promise<LocalCommandResult>;
+}
+declare function parsePublicProblem(bytes: Uint8Array): ReturnType<typeof parseStandaloneProblemBundle>;
+declare class NodeLocalRuntime implements LocalRuntime {
+    build(root: string, config: WojConfig): Promise<LocalCommandResult>;
+    run(root: string, config: WojConfig, options: {
+        readonly stdin?: string;
+        readonly args: readonly string[];
+    }): Promise<LocalCommandResult>;
+    test(root: string, config: WojConfig, options: {
+        readonly cases: readonly string[];
+    }): Promise<LocalCommandResult>;
+    bench(root: string, config: WojConfig, options: {
+        readonly stdin?: string;
+        readonly iterations: number;
+    }): Promise<LocalCommandResult>;
+    inspectJudge(file: string): Promise<LocalCommandResult>;
+    verifyJudge(file: string, options: {
+        readonly sha256?: string;
+        readonly bytes?: number;
+    }): Promise<LocalCommandResult>;
+    executeJudge(root: string, config: WojConfig, file: string): Promise<LocalCommandResult>;
+    toolchainList(config: WojConfig): Promise<LocalCommandResult>;
+    toolchainInfo(config: WojConfig, id: string): Promise<LocalCommandResult>;
+    toolchainFetch(config: WojConfig, server: string, id: string, fetchImplementation?: typeof fetch): Promise<LocalCommandResult>;
+    toolchainVerify(config: WojConfig, id?: string): Promise<LocalCommandResult>;
+    toolchainPrune(config: WojConfig): Promise<LocalCommandResult>;
+    cacheStatus(config: WojConfig): Promise<LocalCommandResult>;
+    cachePrune(config: WojConfig): Promise<LocalCommandResult>;
+    cacheClear(config: WojConfig): Promise<LocalCommandResult>;
+    doctor(root: string, config: WojConfig): Promise<LocalCommandResult>;
+}
+declare function judgeSucceeded(result: JudgeResult | undefined): boolean;
+
+interface ParsedCommand {
+    readonly spec: CommandSpec;
+    readonly positionals: readonly string[];
+    readonly options: Readonly<Record<string, string | boolean | readonly string[]>>;
+    readonly global: {
+        readonly offline: boolean;
+        readonly json: boolean;
+        readonly server?: string;
+    };
+}
+type ParseResult = {
+    readonly kind: "command";
+    readonly command: ParsedCommand;
+} | {
+    readonly kind: "help";
+    readonly prefix: readonly string[];
+} | {
+    readonly kind: "version";
+};
+declare function parseCli(arguments_: readonly string[]): ParseResult;
+
+interface CommandDependencies {
+    readonly cwd: string;
+    readonly configStore: ConfigStore;
+    readonly tokenStore: TokenStore;
+    readonly local: LocalRuntime;
+    readonly collectionCli: (arguments_: readonly string[]) => Promise<void>;
+    readonly remote: (origin: string) => RemoteClient;
+    readonly opener: BrowserOpener;
+    readonly sleep: (milliseconds: number) => Promise<void>;
+    readonly onNotice: (message: string) => void;
+}
+
+declare const CLI_TOOLCHAIN_DESCRIPTORS: readonly ToolchainDescriptor[];
+
+declare const WOJ_WORKSPACE_SCHEMA = "wasm-oj-cli-workspace-v1";
+declare const WORKSPACE_FILE = "woj.json";
+declare const LANGUAGES: readonly ["c", "cpp", "rust", "go", "python", "javascript", "typescript"];
+type WorkspaceLanguage = typeof LANGUAGES[number];
+interface PinnedProblem {
+    readonly problemVersionId: string;
+    readonly catalogPublicationId: string;
+    readonly serverOrigin: string;
+    readonly contentUrl: string;
+    readonly contentSha256: string;
+    readonly contentFile: "problem.json";
+    readonly locale: "zh-TW" | "en";
+    readonly contestId?: string;
+}
+interface WojWorkspace {
+    readonly schema: typeof WOJ_WORKSPACE_SCHEMA;
+    readonly name: string;
+    readonly language: WorkspaceLanguage;
+    readonly target: "wasip1" | "wasix";
+    readonly optimization: "debug" | "release";
+    readonly entry: string;
+    readonly sources: readonly string[];
+    readonly problem?: PinnedProblem;
+}
+declare function parseWorkspace(value: unknown): WojWorkspace;
+declare function readWorkspaceFileBytes(root: string, relative: string, maximumBytes: number): Promise<Uint8Array>;
+declare function readWorkspace(root?: string): Promise<WojWorkspace>;
+declare function writeWorkspace(root: string, workspace: WojWorkspace): Promise<void>;
+declare function createWorkspace(root: string, options: {
+    readonly name?: string;
+    readonly language?: string;
+    readonly target?: string;
+    readonly optimization?: string;
+    readonly entry?: string;
+    readonly force?: boolean;
+}): Promise<WojWorkspace>;
+declare function readWorkspaceSources(root: string, workspace: WojWorkspace): Promise<Readonly<Record<string, string>>>;
+
+interface CliIo {
+    readonly stdout: (text: string) => void;
+    readonly stderr: (text: string) => void;
+}
+interface WojCliDependencies {
+    readonly cwd?: string;
+    readonly configStore?: ConfigStore;
+    readonly tokenStore?: TokenStore;
+    readonly local?: LocalRuntime;
+    readonly collectionCli?: (arguments_: readonly string[]) => Promise<void>;
+    readonly remote?: (origin: string) => RemoteClient;
+    readonly opener?: BrowserOpener;
+    readonly sleep?: (milliseconds: number) => Promise<void>;
+    readonly io?: CliIo;
+}
+declare function runWojCli(arguments_: readonly string[], provided?: WojCliDependencies): Promise<WojExitCode>;
+declare function main(arguments_: readonly string[]): Promise<number>;
+
+export { ApiError, CLI_TOOLCHAIN_DESCRIPTORS, COMMAND_BY_KEY, CONFIG_KEYS, CliError, HttpRemoteClient, JsonConfigStore, LANGUAGES, MemoryConfigStore, MemoryTokenStore, NodeLocalRuntime, OsKeychainTokenStore, WOJ_ACCESS_TOKEN, WOJ_CLI_VERSION, WOJ_COMMANDS, WOJ_EXIT, WOJ_WORKSPACE_SCHEMA, WORKSPACE_FILE, asCliError, commandKey, createWorkspace, defaultConfigDirectory, defaultConfigPath, deviceLogin, isConfigKey, isWojAccessToken, judgeSucceeded, main, parseCli, parseConfig, parsePublicProblem, parseWorkspace, readWorkspace, readWorkspaceFileBytes, readWorkspaceSources, runWojCli, unavailableError, usageError, validateConfigValue, writeWorkspace };
+export type { ApiRequestOptions, BrowserOpener, CliIo, CommandBoundary, CommandDependencies, CommandSpec, ConfigKey, ConfigStore, LocalCommandResult, LocalRuntime, ParseResult, ParsedCommand, PinnedProblem, RemoteClient, TokenStore, WojCliDependencies, WojConfig, WojExitCode, WojWorkspace, WorkspaceLanguage };