@wasm-oj/cli 0.2.0

package/dist/index.js

@@ -0,0 +1,3685 @@
+import { runCollectionCli } from "@wasm-oj/organizer";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { watch } from "node:fs";
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import { pathToFileURL } from "node:url";
+import { PROJECT_SOURCE_LIMITS, WASM_OJ_JUDGE_PACKAGE_MAX_BYTES, decodeJudgePackageForExecution, parseStandaloneProblemBundle, trustedJudgeSpec, validateJudgePackage } from "@wasm-oj/core";
+import { createServerEngine } from "@wasm-oj/server";
+//#region src/cli/contracts.ts
+var WOJ_CLI_VERSION = "0.2.0";
+/** Stable process exit codes. They are part of the public CLI contract. */
+var WOJ_EXIT = Object.freeze({
+	success: 0,
+	unsuccessful: 1,
+	usage: 2,
+	authentication: 3,
+	integrity: 4,
+	conflict: 5,
+	infrastructure: 6,
+	localIntegrity: 7
+});
+var local = (path, summary, usage, options) => ({
+	path: path.split(" "),
+	summary,
+	boundary: "local",
+	usage,
+	options
+});
+var remote = (path, summary, usage, options) => ({
+	path: path.split(" "),
+	summary,
+	boundary: "remote",
+	usage,
+	options
+});
+var network = (path, summary, usage, options) => ({
+	path: path.split(" "),
+	summary,
+	boundary: "network",
+	usage,
+	options
+});
+var paging = {
+	limit: "string",
+	cursor: "string"
+};
+var wait = { wait: "boolean" };
+var language = {
+	language: "string",
+	target: "string",
+	optimization: "string",
+	entry: "string"
+};
+/** The complete Issue #42 command tree. Every leaf is dispatched explicitly. */
+var WOJ_COMMANDS = Object.freeze([
+	remote("auth login", "Sign in through the browser device flow.", "", { "device-name": "string" }),
+	remote("auth logout", "Revoke the current CLI session."),
+	remote("auth status", "Show the signed-in account and roles."),
+	local("init", "Create a local woj workspace.", "[directory]", {
+		...language,
+		name: "string",
+		force: "boolean"
+	}),
+	local("build", "Compile the current workspace without network access."),
+	local("run", "Compile and run locally; makes no correctness claim.", "", {
+		input: "string",
+		text: "string",
+		arg: "repeatable"
+	}),
+	local("test", "Run only locally available public/sample cases.", "", { case: "repeatable" }),
+	local("bench", "Benchmark the local program.", "", {
+		iterations: "string",
+		stdin: "string"
+	}),
+	local("watch", "Re-run a local action after workspace files change.", "", { command: "string" }),
+	remote("problem list", "List public problem versions.", "", { locale: "string" }),
+	remote("problem show", "Show one public problem version.", "<problem-version-id>", {
+		locale: "string",
+		contest: "string"
+	}),
+	remote("problem pull", "Pull and pin one exact public problem version.", "<problem-version-id> [directory]", {
+		locale: "string",
+		language: "string",
+		contest: "string",
+		force: "boolean"
+	}),
+	remote("submit", "Create an Official Submit from the pinned workspace.", "", {
+		...language,
+		contest: "string",
+		wait: "boolean"
+	}),
+	remote("submission list", "List your Official Submits.", "", paging),
+	remote("submission show", "Show an Official Submit.", "<submission-id>"),
+	remote("submission watch", "Wait for an Official Submit to settle.", "<submission-id>", { interval: "string" }),
+	remote("submission cancel", "Cancel an unsettled Official Submit.", "<submission-id>"),
+	remote("submission source", "Download visible source for an Official Submit.", "<submission-id>"),
+	remote("submission policy", "Show the submission policy summary.", "<submission-id>"),
+	remote("contest list", "List visible contests."),
+	remote("contest show", "Show one contest.", "<contest-id>"),
+	remote("contest join", "Join an invite contest.", "<contest-id>", { "code-file": "string" }),
+	remote("contest problems", "List the exact problem versions in a contest.", "<contest-id>"),
+	remote("contest standings", "Show contest standings.", "<contest-id>", { limit: "string" }),
+	remote("performance frontier", "Show the verified performance frontier.", "<problem-version-id>", {
+		language: "string",
+		contest: "string"
+	}),
+	remote("performance evolution", "Show your verified performance evolution.", "<problem-version-id>", {
+		language: "string",
+		contest: "string"
+	}),
+	local("judge inspect", "Inspect a complete local judge package.", "<judge-package>"),
+	local("judge verify", "Verify a complete local judge package deterministically.", "<judge-package>", {
+		sha256: "string",
+		bytes: "string"
+	}),
+	local("judge execute", "Execute a source workspace against a complete local judge package.", "<judge-package>", {
+		source: "string",
+		all: "boolean"
+	}),
+	local("toolchain list", "List explicitly installed toolchains."),
+	local("toolchain info", "Show one installed toolchain.", "<toolchain-id>"),
+	network("toolchain fetch", "Fetch one pinned toolchain explicitly.", "<toolchain-id>"),
+	local("toolchain verify", "Verify installed toolchain bytes and digests.", "[toolchain-id]"),
+	local("toolchain prune", "Remove unreferenced toolchain assets.", "", { yes: "boolean" }),
+	remote("organizer repo list", "List authorized Organizer repositories."),
+	remote("organizer repo show", "Show one authorized Organizer repository.", "<repository-id>"),
+	local("organizer collection init", "Create a collection authoring skeleton.", "[directory]", { force: "boolean" }),
+	local("organizer collection build", "Build deterministic collection artifacts locally.", "[directory]", {
+		index: "string",
+		source: "string",
+		managed: "string",
+		"managed-source": "string"
+	}),
+	local("organizer collection verify", "Verify collection bytes locally without executing judge code.", "[directory]", {
+		index: "string",
+		source: "string",
+		managed: "string"
+	}),
+	remote("organizer collection list", "List Organizer collections."),
+	remote("organizer collection show", "Show one Organizer collection.", "<collection-id>"),
+	remote("organizer collection create", "Register one repository collection.", "", {
+		repo: "string",
+		index: "string"
+	}),
+	remote("organizer collection validate", "Resolve a ref once and statically validate the exact commit.", "<collection-id>", {
+		ref: "string",
+		...wait
+	}),
+	remote("organizer collection validation", "Show or watch a static validation.", "<validation-id>", {
+		watch: "boolean",
+		interval: "string"
+	}),
+	remote("organizer collection publish", "Publish one validated immutable revision.", "<revision-id>", {
+		mode: "string",
+		...wait
+	}),
+	remote("organizer collection publication", "Show or watch a publication job.", "<publication-job-id>", {
+		watch: "boolean",
+		interval: "string"
+	}),
+	remote("organizer collection activate", "Explicitly activate a published official-practice revision.", "<publication-id>"),
+	remote("organizer contest list", "List contests you organize."),
+	remote("organizer contest show", "Show one Organizer contest.", "<contest-id>"),
+	remote("organizer contest create", "Create a draft contest.", "", {
+		title: "string",
+		description: "string",
+		starts: "string",
+		ends: "string",
+		freeze: "string",
+		access: "string",
+		"invite-code-file": "string",
+		problem: "repeatable"
+	}),
+	remote("organizer contest update", "Update draft contest settings.", "<contest-id>", {
+		title: "string",
+		description: "string",
+		starts: "string",
+		ends: "string",
+		freeze: "string",
+		access: "string",
+		"invite-code-file": "string"
+	}),
+	remote("organizer contest add-problem", "Add an exact published problem version.", "<contest-id> <problem-version-id>"),
+	remote("organizer contest remove-problem", "Remove a problem from a draft contest.", "<contest-id> <problem-version-id>"),
+	remote("organizer contest publish", "Publish a draft contest.", "<contest-id>"),
+	remote("organizer contest archive", "Archive a contest.", "<contest-id>"),
+	remote("organizer contest participants", "List contest participants.", "<contest-id>", paging),
+	remote("organizer contest standings", "Show organizer-visible standings.", "<contest-id>", { limit: "string" }),
+	remote("organizer rejudge options", "List valid immutable rejudge endpoints.", "<problem-version-id>"),
+	remote("organizer rejudge start", "Start a rejudge batch.", "", {
+		from: "string",
+		to: "string",
+		...wait
+	}),
+	remote("organizer rejudge list", "List rejudge batches.", "", { limit: "string" }),
+	remote("organizer rejudge show", "Show one rejudge batch.", "<batch-id>"),
+	remote("organizer rejudge watch", "Wait for a rejudge batch to settle.", "<batch-id>", { interval: "string" }),
+	remote("organizer rejudge cancel", "Cancel an unsettled rejudge batch.", "<batch-id>"),
+	local("config list", "List non-secret CLI configuration."),
+	local("config get", "Read one configuration value.", "<key>"),
+	local("config set", "Set one configuration value.", "<key> <value>"),
+	local("config unset", "Remove one configuration value.", "<key>"),
+	local("cache status", "Show local cache usage."),
+	local("cache prune", "Prune unreferenced local cache entries.", "", { yes: "boolean" }),
+	local("cache clear", "Clear the local cache.", "", { yes: "boolean" }),
+	local("doctor", "Check explicit runtime, toolchain, workspace, auth, and server configuration."),
+	local("completion", "Print a shell completion script.", "<bash|zsh|fish>"),
+	local("version", "Print the woj CLI version.")
+]);
+function commandKey(path) {
+	return path.join(" ");
+}
+var COMMAND_BY_KEY = new Map(WOJ_COMMANDS.map((command) => [commandKey(command.path), command]));
+//#endregion
+//#region src/cli/errors.ts
+var CliError = class extends Error {
+	exitCode;
+	code;
+	constructor(message, options = {}) {
+		super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+		this.name = "CliError";
+		this.exitCode = options.exitCode ?? WOJ_EXIT.infrastructure;
+		this.code = options.code ?? "cli-error";
+	}
+};
+function usageError(message) {
+	return new CliError(message, {
+		exitCode: WOJ_EXIT.usage,
+		code: "usage"
+	});
+}
+function unavailableError(message, cause) {
+	return new CliError(message, {
+		exitCode: WOJ_EXIT.infrastructure,
+		code: "unavailable",
+		cause
+	});
+}
+function asCliError(error) {
+	if (error instanceof CliError) return error;
+	if (error instanceof Error) return new CliError(error.message, { cause: error });
+	return new CliError("The CLI failed with a non-Error value.");
+}
+//#endregion
+//#region src/cli/keychain.ts
+var SERVICE = "wasm-oj";
+var WOJ_ACCESS_TOKEN = /^[A-Za-z0-9_-]{43}$/;
+function isWojAccessToken(value) {
+	return typeof value === "string" && WOJ_ACCESS_TOKEN.test(value);
+}
+var OsKeychainTokenStore = class {
+	constructorPromise;
+	constructor_() {
+		this.constructorPromise ??= import("@napi-rs/keyring").then((module) => module.Entry).catch((error) => {
+			throw new CliError("The OS keychain adapter could not be loaded; woj will not store credentials in a file.", {
+				code: "keychain-unavailable",
+				exitCode: 7,
+				cause: error
+			});
+		});
+		return this.constructorPromise;
+	}
+	async entry(serverOrigin) {
+		return new (await (this.constructor_()))(SERVICE, new URL(serverOrigin).origin);
+	}
+	async get(serverOrigin) {
+		try {
+			return (await this.entry(serverOrigin)).getPassword() ?? void 0;
+		} catch (error) {
+			if (error instanceof CliError) throw error;
+			throw new CliError("The OS keychain could not read the woj credential.", {
+				code: "keychain-read-failed",
+				exitCode: 7,
+				cause: error
+			});
+		}
+	}
+	async set(serverOrigin, token) {
+		if (!isWojAccessToken(token)) throw new CliError("Refusing to store a malformed woj access token.", {
+			code: "access-token-invalid",
+			exitCode: 7
+		});
+		try {
+			(await this.entry(serverOrigin)).setPassword(token);
+		} catch (error) {
+			if (error instanceof CliError) throw error;
+			throw new CliError("The OS keychain could not store the woj credential.", {
+				code: "keychain-write-failed",
+				exitCode: 7,
+				cause: error
+			});
+		}
+	}
+	async delete(serverOrigin) {
+		try {
+			(await this.entry(serverOrigin)).deletePassword();
+		} catch (error) {
+			if (error instanceof CliError) throw error;
+			throw new CliError("The OS keychain could not delete the woj credential.", {
+				code: "keychain-delete-failed",
+				exitCode: 7,
+				cause: error
+			});
+		}
+	}
+};
+var MemoryTokenStore = class {
+	tokens = /* @__PURE__ */ new Map();
+	get(serverOrigin) {
+		return Promise.resolve(this.tokens.get(new URL(serverOrigin).origin));
+	}
+	set(serverOrigin, token) {
+		if (!isWojAccessToken(token)) throw new CliError("Refusing to store a malformed woj access token.", {
+			code: "access-token-invalid",
+			exitCode: 7
+		});
+		this.tokens.set(new URL(serverOrigin).origin, token);
+		return Promise.resolve();
+	}
+	delete(serverOrigin) {
+		this.tokens.delete(new URL(serverOrigin).origin);
+		return Promise.resolve();
+	}
+};
+//#endregion
+//#region src/cli/http.ts
+var MAX_JSON_BYTES = 8388608;
+var ApiError = class extends CliError {
+	status;
+	details;
+	verificationUrl;
+	constructor(status, code, message, details) {
+		super(message, {
+			exitCode: exitForApiError(status, code),
+			code
+		});
+		this.name = "ApiError";
+		this.status = status;
+		this.details = details;
+		this.verificationUrl = verificationUrlFrom(details);
+	}
+};
+function exitForApiError(status, code) {
+	if (status === 401 || status === 403 || code.includes("auth") || code.includes("role")) return 3;
+	if (status === 400 || code.includes("schema") || code.includes("digest") || code.includes("validation")) return 4;
+	if (status === 404 || status === 409 || status === 410 || status === 422) return 5;
+	return 6;
+}
+function verificationUrlFrom(details) {
+	if (!details || typeof details !== "object" || Array.isArray(details)) return void 0;
+	const candidate = details.verificationUrl;
+	return typeof candidate === "string" ? candidate : void 0;
+}
+function record$1(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+async function boundedBytes(response, maximum, label) {
+	if (!response.body) throw unavailableError(`Server ${label} response has no body.`);
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > maximum) {
+				await reader.cancel(`${label} response exceeds CLI limit`).catch(() => void 0);
+				throw new CliError(`Server ${label} response exceeds the CLI limit.`, {
+					exitCode: label === "JSON" ? 6 : 4,
+					code: "response-too-large"
+				});
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const output = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return output;
+}
+async function boundedJson(response) {
+	const contentType = response.headers.get("content-type") ?? "";
+	if (!/^application\/json(?:\s*;|$)/iu.test(contentType)) throw unavailableError(`Server returned non-JSON content (HTTP ${response.status}).`);
+	const declared = response.headers.get("content-length");
+	if (declared !== null && (!/^(?:0|[1-9][0-9]*)$/.test(declared) || Number(declared) > MAX_JSON_BYTES)) throw unavailableError("Server JSON response exceeds the CLI limit.");
+	const bytes = await boundedBytes(response, MAX_JSON_BYTES, "JSON");
+	let text;
+	try {
+		text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch (error) {
+		throw unavailableError("Server JSON response is not valid UTF-8.", error);
+	}
+	try {
+		return text ? JSON.parse(text) : null;
+	} catch (error) {
+		throw unavailableError("Server response is not valid JSON.", error);
+	}
+}
+var HttpRemoteClient = class {
+	tokenStore;
+	fetchImplementation;
+	origin;
+	constructor(origin, tokenStore, fetchImplementation = globalThis.fetch) {
+		this.tokenStore = tokenStore;
+		this.fetchImplementation = fetchImplementation;
+		this.origin = new URL(origin).origin;
+	}
+	async request(apiPath, options = {}) {
+		if (!apiPath.startsWith("/api/") || apiPath.includes("\\") || apiPath.includes("\0")) throw new CliError("Remote API path is invalid.", {
+			exitCode: 4,
+			code: "api-path-invalid"
+		});
+		const headers = new Headers({
+			accept: "application/json",
+			...options.headers
+		});
+		if (options.body !== void 0) headers.set("content-type", "application/json");
+		if (options.authenticated !== false) {
+			const token = await this.tokenStore.get(this.origin);
+			if (!token && options.authenticated !== "optional") throw new CliError(`Not signed in to ${this.origin}. Run 'woj auth login'.`, {
+				exitCode: 3,
+				code: "authentication-required"
+			});
+			if (token && !isWojAccessToken(token)) throw new CliError("The OS keychain contains a malformed woj credential.", {
+				exitCode: 7,
+				code: "access-token-invalid"
+			});
+			if (token) headers.set("authorization", `Bearer ${token}`);
+		}
+		let response;
+		try {
+			response = await this.fetchImplementation(new URL(apiPath, this.origin), {
+				method: options.method ?? (options.body === void 0 ? "GET" : "POST"),
+				headers,
+				redirect: "error",
+				...options.body === void 0 ? {} : { body: JSON.stringify(options.body) }
+			});
+		} catch (error) {
+			throw unavailableError(`Could not reach ${this.origin}.`, error);
+		}
+		const value = await boundedJson(response);
+		if (!response.ok) {
+			const envelope = record$1(value);
+			const error = record$1(envelope?.error);
+			const code = typeof error?.code === "string" ? error.code : `http-${response.status}`;
+			const message = typeof error?.message === "string" ? error.message : `Server request failed with HTTP ${response.status}.`;
+			throw new ApiError(response.status, code, message, error?.details ?? envelope?.details);
+		}
+		return value;
+	}
+	async requestBytes(apiPath, options = {}) {
+		if (!apiPath.startsWith("/api/") || apiPath.includes("\\") || apiPath.includes("\0")) throw new CliError("Remote API path is invalid.", {
+			exitCode: 4,
+			code: "api-path-invalid"
+		});
+		const headers = new Headers({
+			accept: "application/json",
+			...options.headers
+		});
+		if (options.authenticated !== false) {
+			const token = await this.tokenStore.get(this.origin);
+			if (!token && options.authenticated !== "optional") throw new CliError(`Not signed in to ${this.origin}. Run 'woj auth login'.`, {
+				exitCode: 3,
+				code: "authentication-required"
+			});
+			if (token && !isWojAccessToken(token)) throw new CliError("The OS keychain contains a malformed woj credential.", {
+				exitCode: 7,
+				code: "access-token-invalid"
+			});
+			if (token) headers.set("authorization", `Bearer ${token}`);
+		}
+		let response;
+		try {
+			response = await this.fetchImplementation(new URL(apiPath, this.origin), {
+				method: options.method ?? "GET",
+				headers,
+				redirect: "error"
+			});
+		} catch (error) {
+			throw unavailableError(`Could not reach ${this.origin}.`, error);
+		}
+		if (!response.ok) {
+			const envelope = record$1(await boundedJson(response));
+			const error = record$1(envelope?.error);
+			throw new ApiError(response.status, typeof error?.code === "string" ? error.code : `http-${response.status}`, typeof error?.message === "string" ? error.message : `Server request failed with HTTP ${response.status}.`, error?.details ?? envelope?.details);
+		}
+		const declared = response.headers.get("content-length");
+		if (declared !== null && (!/^(?:0|[1-9][0-9]*)$/.test(declared) || Number(declared) > MAX_JSON_BYTES)) throw new CliError("Problem content exceeds the CLI limit.", { exitCode: 4 });
+		const bytes = await boundedBytes(response, MAX_JSON_BYTES, "problem content");
+		if (bytes.byteLength < 1 || bytes.byteLength > MAX_JSON_BYTES) throw new CliError("Problem content is outside the CLI limit.", { exitCode: 4 });
+		return bytes;
+	}
+};
+//#endregion
+//#region src/cli/auth.ts
+var SystemBrowserOpener = class {
+	open(url) {
+		const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+		const arguments_ = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+		return new Promise((resolve, reject) => {
+			const child = spawn(command, arguments_, {
+				detached: true,
+				stdio: "ignore"
+			});
+			child.once("error", reject);
+			child.once("spawn", () => {
+				child.unref();
+				resolve();
+			});
+		});
+	}
+};
+function base64Url(bytes) {
+	return Buffer.from(bytes).toString("base64url");
+}
+function object$1(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new CliError(`${label} response has an invalid shape.`, { exitCode: 6 });
+	return value;
+}
+function exactObject(value, keys, label) {
+	const result = object$1(value, label);
+	if (JSON.stringify(Object.keys(result).sort()) !== JSON.stringify([...keys].sort())) throw new CliError(`${label} response has an invalid shape.`, {
+		exitCode: 6,
+		code: "server-response-invalid"
+	});
+	return result;
+}
+function requiredString(value, label) {
+	if (typeof value !== "string" || !value) throw new CliError(`${label} response field is invalid.`, { exitCode: 6 });
+	return value;
+}
+function exactBrowserUrl(origin, candidate, pathname, parameter, expected) {
+	let url;
+	try {
+		url = new URL(candidate);
+	} catch (error) {
+		throw new CliError("Server browser verification URL is invalid.", {
+			exitCode: 6,
+			code: "verification-url-invalid",
+			cause: error
+		});
+	}
+	const entries = [...url.searchParams.entries()];
+	if (url.origin !== new URL(origin).origin || url.username || url.password || url.hash || url.pathname !== pathname || entries.length !== 1 || entries[0]?.[0] !== parameter || entries[0]?.[1] !== expected) throw new CliError("Server browser verification URL failed origin or request binding.", {
+		exitCode: 6,
+		code: "verification-url-invalid"
+	});
+	return url.toString();
+}
+function turnstileVerificationUrl(clientOrigin, details) {
+	const values = exactObject(details, ["requestKey", "verificationUrl"], "Turnstile verification");
+	const requestKey = requiredString(values.requestKey, "requestKey");
+	if (!/^[0-9a-f]{64}$/.test(requestKey)) throw new CliError("Turnstile request key is invalid.", {
+		exitCode: 6,
+		code: "verification-url-invalid"
+	});
+	return exactBrowserUrl(clientOrigin, requiredString(values.verificationUrl, "verificationUrl"), "/auth/cli/turnstile", "requestKey", requestKey);
+}
+async function deviceLogin(client, tokenStore, opener, options) {
+	const codeVerifier = base64Url(randomBytes(32));
+	const codeChallenge = base64Url(createHash("sha256").update(codeVerifier).digest());
+	const started = exactObject(await client.request("/api/auth/cli/start", {
+		method: "POST",
+		authenticated: false,
+		body: {
+			codeChallenge,
+			deviceName: options.deviceName
+		}
+	}), [
+		"flowId",
+		"verificationUrl",
+		"expiresAt",
+		"pollIntervalSeconds"
+	], "CLI login start");
+	const flowId = requiredString(started.flowId, "flowId");
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(flowId)) throw new CliError("CLI login flow ID is invalid.", {
+		exitCode: 6,
+		code: "server-response-invalid"
+	});
+	const verificationUrl = exactBrowserUrl(client.origin, requiredString(started.verificationUrl, "verificationUrl"), "/auth/cli", "flow", flowId);
+	const expiresAt = Date.parse(requiredString(started.expiresAt, "expiresAt"));
+	const interval = Number(started.pollIntervalSeconds);
+	if (!Number.isFinite(expiresAt) || !Number.isInteger(interval) || interval < 1 || interval > 30) throw new CliError("CLI login timing response is invalid.", { exitCode: 6 });
+	options.onVerification(verificationUrl);
+	try {
+		await opener.open(verificationUrl);
+	} catch (error) {
+		throw new CliError(`Could not open the browser. Visit ${verificationUrl}`, {
+			exitCode: 6,
+			cause: error
+		});
+	}
+	const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+	while (Date.now() < expiresAt) {
+		await sleep(interval * 1e3);
+		try {
+			const exchanged = exactObject(await client.request("/api/auth/cli/token", {
+				method: "POST",
+				authenticated: false,
+				body: {
+					flowId,
+					codeVerifier
+				}
+			}), [
+				"accessToken",
+				"tokenType",
+				"expiresAt"
+			], "CLI login token");
+			const token = requiredString(exchanged.accessToken, "accessToken");
+			if (!isWojAccessToken(token)) throw new CliError("CLI login returned a malformed access token.", {
+				exitCode: 6,
+				code: "server-response-invalid"
+			});
+			if (exchanged.tokenType !== "Bearer") throw new CliError("CLI login token type is unsupported.", { exitCode: 6 });
+			const tokenExpiresAt = requiredString(exchanged.expiresAt, "expiresAt");
+			if (Number.isNaN(Date.parse(tokenExpiresAt)) || new Date(tokenExpiresAt).toISOString() !== tokenExpiresAt) throw new CliError("CLI login token expiry is invalid.", { exitCode: 6 });
+			await tokenStore.set(client.origin, token);
+			return {
+				authenticated: true,
+				server: client.origin,
+				expiresAt: tokenExpiresAt
+			};
+		} catch (error) {
+			if (error instanceof ApiError && error.status === 428 && error.code === "cli-login-pending") {
+				if (object$1(error.details, "CLI login pending").retryAfterSeconds !== interval) throw new CliError("CLI login retry interval changed unexpectedly.", {
+					exitCode: 6,
+					code: "server-response-invalid"
+				});
+				continue;
+			}
+			throw error;
+		}
+	}
+	throw new CliError("CLI login expired before browser approval.", {
+		exitCode: 3,
+		code: "login-expired"
+	});
+}
+//#endregion
+//#region src/cli/config.ts
+var CONFIG_KEYS = [
+	"server",
+	"runtime-directory",
+	"cache-directory"
+];
+function defaultConfigDirectory(environment = process.env, platform = process.platform) {
+	if (platform === "darwin") return path.join(os.homedir(), "Library", "Application Support", "woj");
+	if (platform === "win32") {
+		const appData = environment.APPDATA;
+		if (!appData) throw new CliError("APPDATA is required to locate woj configuration on Windows.");
+		return path.join(appData, "woj");
+	}
+	return path.join(environment.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "woj");
+}
+function defaultConfigPath() {
+	return path.join(defaultConfigDirectory(), "config.json");
+}
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function canonicalServer(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw usageError("server must be an absolute HTTPS origin.");
+	}
+	const loopback = url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "localhost";
+	if (url.protocol !== "https:" && !(loopback && url.protocol === "http:") || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw usageError("server must be an HTTPS origin (HTTP is accepted only for loopback development).");
+	return url.origin;
+}
+function validateConfigValue(key, value) {
+	if (!value || value.includes("\0")) throw usageError(`${key} cannot be empty.`);
+	if (key === "server") return canonicalServer(value);
+	return path.resolve(value);
+}
+function parseConfig(value) {
+	if (!isRecord(value)) throw new CliError("CLI configuration must be a JSON object.", {
+		exitCode: 4,
+		code: "config-invalid"
+	});
+	if (Object.keys(value).some((key) => !CONFIG_KEYS.includes(key))) throw new CliError("CLI configuration contains an unknown key.", {
+		exitCode: 4,
+		code: "config-invalid"
+	});
+	const output = {};
+	for (const key of CONFIG_KEYS) {
+		const candidate = value[key];
+		if (candidate !== void 0) {
+			if (typeof candidate !== "string") throw new CliError(`CLI configuration '${key}' must be a string.`, {
+				exitCode: 4,
+				code: "config-invalid"
+			});
+			try {
+				output[key] = validateConfigValue(key, candidate);
+			} catch (error) {
+				throw new CliError(`CLI configuration '${key}' is invalid.`, {
+					exitCode: 4,
+					code: "config-invalid",
+					cause: error
+				});
+			}
+		}
+	}
+	return output;
+}
+var JsonConfigStore = class {
+	file;
+	constructor(file = defaultConfigPath()) {
+		this.file = file;
+	}
+	async read() {
+		let source;
+		try {
+			source = await readFile(this.file, "utf8");
+		} catch (error) {
+			if (error.code === "ENOENT") return {};
+			throw error;
+		}
+		try {
+			return parseConfig(JSON.parse(source));
+		} catch (error) {
+			if (error instanceof SyntaxError) throw new CliError(`CLI configuration is not valid JSON: '${this.file}'.`, { cause: error });
+			throw error;
+		}
+	}
+	async write(config) {
+		const validated = parseConfig(config);
+		await mkdir(path.dirname(this.file), {
+			recursive: true,
+			mode: 448
+		});
+		const temporary = `${this.file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+		await writeFile(temporary, `${JSON.stringify(validated, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: 384,
+			flag: "wx"
+		});
+		await rename(temporary, this.file);
+	}
+};
+var MemoryConfigStore = class {
+	value;
+	constructor(initial = {}) {
+		this.value = parseConfig(initial);
+	}
+	read() {
+		return Promise.resolve({ ...this.value });
+	}
+	write(config) {
+		this.value = parseConfig(config);
+		return Promise.resolve();
+	}
+};
+function isConfigKey(value) {
+	return CONFIG_KEYS.includes(value);
+}
+//#endregion
+//#region src/path-safety.ts
+/** Resolve only the operating system's own temporary-directory alias. */
+async function canonicalizeSystemTemporaryPrefix(value) {
+	const absolute = path.resolve(value);
+	const temporary = path.resolve(os.tmpdir());
+	if (absolute !== temporary && !absolute.startsWith(`${temporary}${path.sep}`)) return absolute;
+	const canonicalTemporary = await realpath(temporary);
+	return path.join(canonicalTemporary, path.relative(temporary, absolute));
+}
+/** True only when the absolute path's existing components do not traverse links. */
+async function anchoredPathHasNoSymlink(value) {
+	const anchored = await canonicalizeSystemTemporaryPrefix(path.resolve(value));
+	const root = path.parse(anchored).root;
+	let current = root;
+	for (const segment of path.relative(root, anchored).split(path.sep).filter(Boolean)) {
+		current = path.join(current, segment);
+		try {
+			if ((await lstat(current)).isSymbolicLink()) return false;
+		} catch (error) {
+			if (error.code === "ENOENT") return true;
+			throw error;
+		}
+	}
+	return true;
+}
+//#endregion
+//#region src/cli/destinations.ts
+/**
+* Checks every declared write target before the first write. Force may replace
+* regular files, but never follows symlinks or writes through non-directories.
+*/
+async function assertSafeFileDestinations(root, relativeFiles, force) {
+	const absoluteRoot = path.resolve(root);
+	const anchoredRoot = await canonicalizeSystemTemporaryPrefix(absoluteRoot);
+	const filesystemRoot = path.parse(anchoredRoot).root;
+	const targets = relativeFiles.map((relative) => path.join(absoluteRoot, ...relative.split("/")));
+	const existing = [];
+	let anchored = filesystemRoot;
+	for (const segment of path.relative(filesystemRoot, anchoredRoot).split(path.sep).filter(Boolean)) {
+		anchored = path.join(anchored, segment);
+		try {
+			const metadata = await lstat(anchored);
+			if (metadata.isSymbolicLink() || !metadata.isDirectory()) throw new CliError(`Destination root component '${anchored}' must be a real directory.`, {
+				exitCode: 5,
+				code: "destination-symlink"
+			});
+		} catch (error) {
+			if (error.code === "ENOENT") break;
+			throw error;
+		}
+	}
+	for (const target of targets) {
+		const segments = path.relative(absoluteRoot, target).split(path.sep).filter(Boolean);
+		let current = absoluteRoot;
+		for (let index = -1; index < segments.length; index += 1) {
+			if (index >= 0) current = path.join(current, segments[index]);
+			try {
+				const metadata = await lstat(current);
+				if (metadata.isSymbolicLink()) throw new CliError(`Refusing symlink destination '${current}'.`, {
+					exitCode: 5,
+					code: "destination-symlink"
+				});
+				if (index === segments.length - 1) {
+					if (!metadata.isFile()) throw new CliError(`Destination '${current}' is not a regular file.`, {
+						exitCode: 5,
+						code: "destination-invalid"
+					});
+					if (!force) existing.push(path.relative(absoluteRoot, current));
+				} else if (!metadata.isDirectory()) throw new CliError(`Destination ancestor '${current}' is not a directory.`, {
+					exitCode: 5,
+					code: "destination-invalid"
+				});
+			} catch (error) {
+				if (error.code === "ENOENT") break;
+				throw error;
+			}
+		}
+	}
+	if (existing.length > 0) throw new CliError(`Refusing to overwrite existing files: ${[...new Set(existing)].sort().join(", ")}. Use --force to replace them.`, {
+		exitCode: 5,
+		code: "destination-exists"
+	});
+}
+//#endregion
+//#region src/cli/files.ts
+async function readProtectedTextFile(cwd, value, option, maximumBytes = 1024) {
+	if (value === void 0) return void 0;
+	const file = path.resolve(cwd, value);
+	if (!await anchoredPathHasNoSymlink(file)) throw usageError(`${option} must name a real, non-symlink file.`);
+	let metadata;
+	try {
+		metadata = await lstat(file);
+	} catch (error) {
+		throw new CliError(`${option} could not be read.`, {
+			exitCode: 7,
+			code: "protected-input-invalid",
+			cause: error
+		});
+	}
+	if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size < 1 || metadata.size > maximumBytes) throw usageError(`${option} must name a real file containing at most ${maximumBytes} bytes.`);
+	const bytes = new Uint8Array(await readFile(file));
+	let text;
+	try {
+		text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch (error) {
+		throw new CliError(`${option} is not valid UTF-8.`, {
+			exitCode: 7,
+			code: "protected-input-invalid",
+			cause: error
+		});
+	}
+	if (text.endsWith("\n")) text = text.slice(0, -1);
+	if (text.endsWith("\r")) text = text.slice(0, -1);
+	if (!text || /[\r\n\0]/u.test(text)) throw usageError(`${option} must contain exactly one non-empty line.`);
+	return text;
+}
+async function atomicWriteFile(file, contents) {
+	const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, contents, {
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, file);
+	} finally {
+		await rm(temporary, { force: true });
+	}
+}
+//#endregion
+//#region src/cli/toolchains.ts
+function profiles(languages, targets) {
+	return languages.flatMap((language) => targets.flatMap((target) => ["debug", "release"].map((optimization) => ({
+		language,
+		target,
+		optimization
+	}))));
+}
+function descriptor(input) {
+	return Object.freeze({
+		schema: "wasm-oj-v2/toolchain-package",
+		id: input.id,
+		version: input.version,
+		wasmOjContract: 2,
+		languages: Object.freeze([...input.languages]),
+		profiles: Object.freeze(profiles(input.languages, input.targets).map((profile) => Object.freeze(profile))),
+		assets: Object.freeze(input.assets.map((asset) => Object.freeze(asset)))
+	});
+}
+var CLI_TOOLCHAIN_DESCRIPTORS = Object.freeze([
+	descriptor({
+		id: "clang",
+		version: "22.0.0-git20542-10",
+		languages: ["c", "cpp"],
+		targets: ["wasip1", "wasix"],
+		assets: [
+			{
+				path: "/toolchains/clang-22.0.0-git20542-10.cc1-pins.json",
+				bytes: 7457,
+				sha256: "66c4604dccd3f89d8e1472bf4432367d7396cce4a01279b1a1db445f229dba72",
+				exportPath: "./assets/clang-22.0.0-git20542-10.cc1-pins.json"
+			},
+			{
+				path: "/toolchains/clang-22.0.0-git20542-10.cpp-debug.pch.gz.bin",
+				bytes: 13871086,
+				sha256: "a4152027d248412eca8aec3e7e23f6f7c81f95170cae9fd385bcf02e57e91fc9",
+				exportPath: "./assets/clang-22.0.0-git20542-10.cpp-debug.pch.gz.bin"
+			},
+			{
+				path: "/toolchains/clang-22.0.0-git20542-10.cpp-release.pch.gz.bin",
+				bytes: 13870913,
+				sha256: "18f4ca8ab8ca7888db572ba34146fc1acb213a7e7305000ea6285188f52f99f4",
+				exportPath: "./assets/clang-22.0.0-git20542-10.cpp-release.pch.gz.bin"
+			},
+			{
+				path: "/toolchains/clang-22.0.0-git20542-10.libcxx-pch.json",
+				bytes: 1987,
+				sha256: "d126c99e951a7302d4ea2b66da4ed64d3d74e9d319d562518867c8d8c97a06b8",
+				exportPath: "./assets/clang-22.0.0-git20542-10.libcxx-pch.json"
+			},
+			{
+				path: "/toolchains/clang-22.0.0-git20542-10.manifest.json",
+				bytes: 744,
+				sha256: "6382dcdfb6a2da49032a0e08da3b1fb490eb24432be85c3c12e3e871a5065273",
+				exportPath: "./assets/clang-22.0.0-git20542-10.manifest.json"
+			},
+			{
+				path: "/toolchains/clang-22.0.0-git20542-10.webc.gz.bin",
+				bytes: 27000264,
+				sha256: "7f10d90b8e52b270f04874641a1d0bf9e94e85b4f6c7573a774cebbc6d32552a",
+				exportPath: "./assets/clang-22.0.0-git20542-10.webc.gz.bin"
+			}
+		]
+	}),
+	descriptor({
+		id: "go",
+		version: "1.26.5",
+		languages: ["go"],
+		targets: ["wasip1"],
+		assets: [
+			{
+				path: "/toolchains/go-1.26.5-wasip1.manifest.json",
+				bytes: 67888,
+				sha256: "5d784e9ca640b9525e84b598c0beb97ca110ae908568ca45f6441a441d99a262",
+				exportPath: "./assets/go-1.26.5-wasip1.manifest.json"
+			},
+			{
+				path: "/toolchains/go-1.26.5-wasip1.stdlib.gz.bin",
+				bytes: 29300578,
+				sha256: "aeffc384fdc624544f174ba5fc3c22395717fdbc3c4387d677d20855b6be80d8",
+				exportPath: "./assets/go-1.26.5-wasip1.stdlib.gz.bin"
+			},
+			{
+				path: "/toolchains/go-1.26.5-wasip1.webc.gz.bin",
+				bytes: 12412445,
+				sha256: "70a7e359884b09b2e1a622d6ac5cd6e31c334aab519e6dd80dff5e040a9e09e4",
+				exportPath: "./assets/go-1.26.5-wasip1.webc.gz.bin"
+			}
+		]
+	}),
+	descriptor({
+		id: "java-teavm",
+		version: "teavm-0.13.1-wasi",
+		languages: ["java"],
+		targets: ["wasip1"],
+		assets: [
+			{
+				path: "/toolchains/java-teavm-0.13.1.compile-classlib.bin",
+				bytes: 1198350,
+				sha256: "acfe3fb09e5f2c0c7c8dc2339c66fcdadc1f8e1bf1c74be446926175ef770868",
+				exportPath: "./assets/java-teavm-0.13.1.compile-classlib.bin"
+			},
+			{
+				path: "/toolchains/java-teavm-0.13.1.runtime-classlib.bin",
+				bytes: 8798302,
+				sha256: "21a9394586e416af2fca4eb0ed08521cbc8924e1d1afaa07863a59a3cfae54ab",
+				exportPath: "./assets/java-teavm-0.13.1.runtime-classlib.bin"
+			},
+			{
+				path: "/toolchains/java-teavm-0.13.1.wasi.compiler.webc.gz.bin",
+				bytes: 6059335,
+				sha256: "129f1f51d591e58954f88787d36396b856a9a68ba3ae9c9d14f20bd67c2c7722",
+				exportPath: "./assets/java-teavm-0.13.1.wasi.compiler.webc.gz.bin"
+			}
+		]
+	}),
+	descriptor({
+		id: "javascript",
+		version: "typescript-7.0.2+quickjs-0.15.1",
+		languages: ["javascript", "typescript"],
+		targets: ["wasip1"],
+		assets: [{
+			path: "/toolchains/quickjs-0.15.1.wasm.gz.bin",
+			bytes: 384057,
+			sha256: "8c7f0588210490e7d77f198fc91f72c1b94787ab4c359c4786ca59a363c4f5e8",
+			exportPath: "./assets/quickjs-0.15.1.wasm.gz.bin"
+		}, {
+			path: "/toolchains/typescript-7.0.2.wasm.gz.bin",
+			bytes: 7113466,
+			sha256: "06e58ce887d95d1895055699b8dc96a1cde7d1f2baa48de40f9b790e3271dc16",
+			exportPath: "./assets/typescript-7.0.2.wasm.gz.bin"
+		}]
+	}),
+	descriptor({
+		id: "python",
+		version: "3.14.6",
+		languages: ["python"],
+		targets: ["wasip1"],
+		assets: [{
+			path: "/toolchains/python-3.14.6-wasip1.manifest.json",
+			bytes: 8257,
+			sha256: "054eccad04a7cee7ba1661062142ef0d639976850981eab8fc785f48eb26129e",
+			exportPath: "./assets/python-3.14.6-wasip1.manifest.json"
+		}, {
+			path: "/toolchains/python-3.14.6-wasip1.webc.gz.bin",
+			bytes: 5188678,
+			sha256: "218cd20ac4abb443e0700816010a615a345a43eae623a0232da2227135a6c7a6",
+			exportPath: "./assets/python-3.14.6-wasip1.webc.gz.bin"
+		}]
+	}),
+	descriptor({
+		id: "rust",
+		version: "1.91.1-dev",
+		languages: ["rust"],
+		targets: ["wasip1"],
+		assets: [{
+			path: "/toolchains/rust-1.91.1-dev.manifest.json",
+			bytes: 5974,
+			sha256: "d5bbdca994e61888679c5738cb9420649c0854ed0eb5d65468bc67d5d550bce1",
+			exportPath: "./assets/rust-1.91.1-dev.manifest.json"
+		}, {
+			path: "/toolchains/rust-1.91.1-dev.webc.gz.bin",
+			bytes: 74138827,
+			sha256: "cfbdadc67be1315e735aa55bdf8a5a0d00171982a023fefcf7ba586127753887",
+			exportPath: "./assets/rust-1.91.1-dev.webc.gz.bin"
+		}]
+	})
+]);
+//#endregion
+//#region src/cli/workspace.ts
+var WOJ_WORKSPACE_SCHEMA = "wasm-oj-cli-workspace-v1";
+var WORKSPACE_FILE = "woj.json";
+var LANGUAGES = [
+	"c",
+	"cpp",
+	"rust",
+	"go",
+	"python",
+	"javascript",
+	"typescript"
+];
+var SOURCE_BY_LANGUAGE = {
+	c: {
+		entry: "main.c",
+		source: "#include <stdio.h>\nint main(void) { return 0; }\n"
+	},
+	cpp: {
+		entry: "main.cpp",
+		source: "#include <iostream>\nint main() { return 0; }\n"
+	},
+	rust: {
+		entry: "main.rs",
+		source: "fn main() {}\n"
+	},
+	go: {
+		entry: "main.go",
+		source: "package main\nfunc main() {}\n"
+	},
+	python: {
+		entry: "main.py",
+		source: "def main():\n    pass\n\nif __name__ == \"__main__\":\n    main()\n"
+	},
+	javascript: {
+		entry: "main.js",
+		source: "function main() {}\nmain();\n"
+	},
+	typescript: {
+		entry: "main.ts",
+		source: "function main(): void {}\nmain();\n"
+	}
+};
+function record(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new CliError(`${label} must be an object.`);
+	return value;
+}
+function exactKeys(value, keys, label) {
+	const actual = Object.keys(value).sort();
+	const expected = [...keys].sort();
+	if (JSON.stringify(actual) !== JSON.stringify(expected)) throw new CliError(`${label} has an invalid shape.`);
+}
+function relativeFile(value, label) {
+	if (typeof value !== "string" || !value || value.startsWith("/") || value.includes("\\") || value.includes("\0") || value.split("/").some((part) => !part || part === "." || part === "..")) throw new CliError(`${label} must be a normalized relative POSIX file path.`);
+	return value;
+}
+function parseWorkspaceInternal(value) {
+	const workspace = record(value, "woj workspace");
+	exactKeys(workspace, [
+		"schema",
+		"name",
+		"language",
+		"target",
+		"optimization",
+		"entry",
+		"sources",
+		...workspace.problem === void 0 ? [] : ["problem"]
+	], "woj workspace");
+	if (workspace.schema !== "wasm-oj-cli-workspace-v1") throw new CliError(`Unsupported workspace schema '${String(workspace.schema)}'.`);
+	if (typeof workspace.name !== "string" || !workspace.name.trim() || workspace.name.length > 128) throw new CliError("Workspace name is invalid.");
+	if (!LANGUAGES.includes(workspace.language)) throw new CliError("Workspace language is unsupported.");
+	if (workspace.target !== "wasip1" && workspace.target !== "wasix") throw new CliError("Workspace target must be 'wasip1' or 'wasix'.");
+	if (workspace.optimization !== "debug" && workspace.optimization !== "release") throw new CliError("Workspace optimization is invalid.");
+	const entry = relativeFile(workspace.entry, "Workspace entry");
+	if (!Array.isArray(workspace.sources) || workspace.sources.length < 1 || workspace.sources.length > 256) throw new CliError("Workspace sources are invalid.");
+	const sources = workspace.sources.map((source) => relativeFile(source, "Workspace source"));
+	if (new Set(sources).size !== sources.length || !sources.includes(entry)) throw new CliError("Workspace sources must be unique and include the entry.");
+	let problem;
+	if (workspace.problem !== void 0) {
+		const pinned = record(workspace.problem, "Pinned problem");
+		exactKeys(pinned, [
+			"problemVersionId",
+			"catalogPublicationId",
+			"serverOrigin",
+			"contentUrl",
+			"contentSha256",
+			"contentFile",
+			"locale",
+			...pinned.contestId === void 0 ? [] : ["contestId"]
+		], "Pinned problem");
+		const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+		if (typeof pinned.problemVersionId !== "string" || !uuid.test(pinned.problemVersionId)) throw new CliError("Pinned problem version ID is invalid.");
+		if (typeof pinned.catalogPublicationId !== "string" || !uuid.test(pinned.catalogPublicationId)) throw new CliError("Pinned catalog publication ID is invalid.");
+		let serverOrigin;
+		try {
+			serverOrigin = new URL(String(pinned.serverOrigin)).origin;
+		} catch {
+			throw new CliError("Pinned server origin is invalid.");
+		}
+		if (serverOrigin !== pinned.serverOrigin) throw new CliError("Pinned server origin must be canonical.");
+		if (typeof pinned.contentUrl !== "string" || !pinned.contentUrl.startsWith("/api/problems/")) throw new CliError("Pinned content URL is invalid.");
+		if (typeof pinned.contentSha256 !== "string" || !/^[0-9a-f]{64}$/.test(pinned.contentSha256)) throw new CliError("Pinned problem digest is invalid.");
+		if (pinned.contentFile !== "problem.json") throw new CliError("Pinned problem content file is invalid.");
+		if (pinned.locale !== "zh-TW" && pinned.locale !== "en") throw new CliError("Pinned problem locale is invalid.");
+		if (pinned.contestId !== void 0 && (typeof pinned.contestId !== "string" || !uuid.test(pinned.contestId))) throw new CliError("Pinned contest ID is invalid.");
+		problem = {
+			problemVersionId: pinned.problemVersionId,
+			catalogPublicationId: pinned.catalogPublicationId,
+			serverOrigin,
+			contentUrl: pinned.contentUrl,
+			contentSha256: pinned.contentSha256,
+			contentFile: "problem.json",
+			locale: pinned.locale,
+			...pinned.contestId ? { contestId: pinned.contestId } : {}
+		};
+	}
+	return {
+		schema: WOJ_WORKSPACE_SCHEMA,
+		name: workspace.name.trim(),
+		language: workspace.language,
+		target: workspace.target,
+		optimization: workspace.optimization,
+		entry,
+		sources,
+		...problem ? { problem } : {}
+	};
+}
+function parseWorkspace(value) {
+	try {
+		return parseWorkspaceInternal(value);
+	} catch (error) {
+		if (error instanceof CliError) throw new CliError(error.message, {
+			exitCode: 4,
+			code: "workspace-invalid",
+			cause: error
+		});
+		throw error;
+	}
+}
+async function safeWorkspaceFile(root, relative, maximumBytes) {
+	const anchoredRoot = await canonicalizeSystemTemporaryPrefix(path.resolve(root));
+	const filesystemRoot = path.parse(anchoredRoot).root;
+	let current = filesystemRoot;
+	for (const segment of path.relative(filesystemRoot, anchoredRoot).split(path.sep).filter(Boolean)) {
+		current = path.join(current, segment);
+		const metadata = await lstat(current);
+		if (metadata.isSymbolicLink() || !metadata.isDirectory()) throw new CliError(`Workspace component '${current}' must be a real directory.`, {
+			exitCode: 7,
+			code: "workspace-source-integrity"
+		});
+	}
+	const segments = relative.split("/");
+	for (let index = 0; index < segments.length; index += 1) {
+		current = path.join(current, segments[index]);
+		const metadata = await lstat(current);
+		const final = index === segments.length - 1;
+		if (metadata.isSymbolicLink() || (final ? !metadata.isFile() : !metadata.isDirectory())) throw new CliError(`Workspace path '${relative}' has a symlink or invalid ancestor.`, {
+			exitCode: 7,
+			code: "workspace-source-integrity"
+		});
+		if (final && metadata.size > maximumBytes) throw new CliError(`Workspace file '${relative}' exceeds its byte limit.`, {
+			exitCode: 7,
+			code: "workspace-source-integrity"
+		});
+	}
+	return current;
+}
+async function readWorkspaceFileBytes(root, relative, maximumBytes) {
+	return new Uint8Array(await readFile(await safeWorkspaceFile(root, relative, maximumBytes)));
+}
+async function readWorkspace(root = process.cwd()) {
+	let source;
+	try {
+		const bytes = await readWorkspaceFileBytes(root, WORKSPACE_FILE, 1048576);
+		source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch (error) {
+		if (error.code === "ENOENT") throw usageError(`No ${WORKSPACE_FILE} exists in '${root}'. Run 'woj init'.`);
+		if (error instanceof TypeError) throw new CliError(`${WORKSPACE_FILE} is not valid UTF-8.`, {
+			exitCode: 4,
+			code: "workspace-invalid",
+			cause: error
+		});
+		throw error;
+	}
+	try {
+		return parseWorkspace(JSON.parse(source));
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new CliError(`${WORKSPACE_FILE} is not valid JSON.`, {
+			exitCode: 4,
+			code: "workspace-invalid",
+			cause: error
+		});
+		throw error;
+	}
+}
+async function writeWorkspace(root, workspace) {
+	const validated = parseWorkspace(workspace);
+	await mkdir(root, { recursive: true });
+	const file = path.join(root, WORKSPACE_FILE);
+	const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+	await writeFile(temporary, `${JSON.stringify(validated, null, 2)}\n`, {
+		encoding: "utf8",
+		flag: "wx"
+	});
+	await rename(temporary, file);
+}
+async function createWorkspace(root, options) {
+	const language = options.language ?? "cpp";
+	if (!LANGUAGES.includes(language)) throw usageError(`Unsupported language '${language}'.`);
+	if (options.target !== void 0 && options.target !== "wasip1" && options.target !== "wasix") throw usageError("--target must be 'wasip1' or 'wasix'.");
+	if (options.optimization !== void 0 && options.optimization !== "debug" && options.optimization !== "release") throw usageError("--optimization must be debug or release.");
+	const starter = SOURCE_BY_LANGUAGE[language];
+	const entry = options.entry ?? starter.entry;
+	const workspace = parseWorkspace({
+		schema: WOJ_WORKSPACE_SCHEMA,
+		name: options.name ?? path.basename(path.resolve(root)),
+		language,
+		target: options.target ?? "wasip1",
+		optimization: options.optimization ?? "debug",
+		entry,
+		sources: [entry]
+	});
+	await assertSafeFileDestinations(root, [WORKSPACE_FILE, entry], Boolean(options.force));
+	await mkdir(root, { recursive: true });
+	await mkdir(path.dirname(path.join(root, ...entry.split("/"))), { recursive: true });
+	await writeWorkspace(root, workspace);
+	await atomicWriteFile(path.join(root, entry), starter.source);
+	return workspace;
+}
+async function readWorkspaceSources(root, workspace) {
+	let totalBytes = 0;
+	const verified = [];
+	for (const relative of workspace.sources) {
+		const file = await safeWorkspaceFile(root, relative, PROJECT_SOURCE_LIMITS.bytesPerFile);
+		const metadata = await lstat(file);
+		totalBytes += metadata.size;
+		if (totalBytes > PROJECT_SOURCE_LIMITS.totalBytes) throw new CliError("Workspace sources exceed the aggregate limit.", {
+			exitCode: 7,
+			code: "workspace-source-integrity"
+		});
+		verified.push([relative, file]);
+	}
+	const entries = [];
+	for (const [relative, file] of verified) {
+		const bytes = new Uint8Array(await readFile(file));
+		let source;
+		try {
+			source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		} catch (error) {
+			throw new CliError(`Workspace source '${relative}' is not valid UTF-8.`, {
+				exitCode: 7,
+				code: "workspace-source-integrity",
+				cause: error
+			});
+		}
+		entries.push([relative, source]);
+	}
+	return Object.fromEntries(entries);
+}
+//#endregion
+//#region src/cli/local.ts
+var DESCRIPTORS = CLI_TOOLCHAIN_DESCRIPTORS;
+var CACHE_MARKER = ".woj-cache";
+var CACHE_MARKER_CONTENTS = "wasm-oj-cli-cache-v1\n";
+function cacheRoot(config) {
+	if (config["cache-directory"]) return config["cache-directory"];
+	if (process.platform === "darwin") return path.join(os.homedir(), "Library", "Caches", "woj");
+	if (process.platform === "win32") {
+		const root = process.env.LOCALAPPDATA;
+		if (!root) throw new CliError("LOCALAPPDATA is required to locate the woj cache on Windows.", { exitCode: 7 });
+		return path.join(root, "woj");
+	}
+	return path.join(process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache"), "woj");
+}
+async function ownedCacheRoot(config, create) {
+	const root = path.resolve(cacheRoot(config));
+	const anchoredRoot = await canonicalizeSystemTemporaryPrefix(root);
+	const parsed = path.parse(anchoredRoot);
+	const home = path.resolve(os.homedir());
+	const configDirectory = path.resolve(defaultConfigDirectory());
+	if (parsed.root === root || root === home || configDirectory === root || configDirectory.startsWith(`${root}${path.sep}`)) throw new CliError("The woj cache directory cannot be a filesystem, home, or CLI configuration root (or its ancestor).", {
+		exitCode: 7,
+		code: "cache-root-invalid"
+	});
+	let existingParent = parsed.root;
+	const components = path.relative(parsed.root, anchoredRoot).split(path.sep).filter(Boolean);
+	for (let index = 0; index < components.length; index += 1) {
+		const candidate = path.join(existingParent, components[index]);
+		try {
+			const componentMetadata = await lstat(candidate);
+			if (componentMetadata.isSymbolicLink() || !componentMetadata.isDirectory() && index < components.length - 1) throw new CliError(`Cache path component '${candidate}' must be a real directory.`, {
+				exitCode: 7,
+				code: "cache-root-invalid"
+			});
+			existingParent = candidate;
+		} catch (error) {
+			if (error.code === "ENOENT") break;
+			throw error;
+		}
+	}
+	let metadata;
+	try {
+		metadata = await lstat(root);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		if (!create) return void 0;
+		await mkdir(root, {
+			recursive: true,
+			mode: 448
+		});
+		const createdMetadata = await lstat(root);
+		const entries = await readdir(root);
+		if (!createdMetadata.isDirectory() || createdMetadata.isSymbolicLink() || entries.length > 0) throw new CliError(`Refusing to adopt cache directory '${root}'.`, {
+			exitCode: 7,
+			code: "cache-root-invalid"
+		});
+		await writeFile(path.join(root, CACHE_MARKER), CACHE_MARKER_CONTENTS, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		return root;
+	}
+	if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new CliError("The woj cache path must be a real directory.", {
+		exitCode: 7,
+		code: "cache-root-invalid"
+	});
+	const marker = path.join(root, CACHE_MARKER);
+	let markerMetadata;
+	try {
+		markerMetadata = await lstat(marker);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		const entries = await readdir(root);
+		if (!create || entries.length > 0) throw new CliError(`Refusing to use unowned cache directory '${root}'.`, {
+			exitCode: 7,
+			code: "cache-marker-missing"
+		});
+		await writeFile(marker, CACHE_MARKER_CONTENTS, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		return root;
+	}
+	if (!markerMetadata.isFile() || markerMetadata.isSymbolicLink()) throw new CliError(`Cache marker in '${root}' failed integrity verification.`, {
+		exitCode: 7,
+		code: "cache-marker-invalid"
+	});
+	let markerContents;
+	try {
+		markerContents = await readFile(marker, "utf8");
+	} catch (error) {
+		throw new CliError(`Cache marker in '${root}' could not be read.`, {
+			exitCode: 7,
+			code: "cache-marker-invalid",
+			cause: error
+		});
+	}
+	if (markerContents !== CACHE_MARKER_CONTENTS) throw new CliError(`Cache marker in '${root}' failed integrity verification.`, {
+		exitCode: 7,
+		code: "cache-marker-invalid"
+	});
+	return root;
+}
+function toolchainDirectory(config, descriptor) {
+	return path.join(cacheRoot(config), "toolchains", descriptor.id, descriptor.version);
+}
+async function safeCacheDirectory(root, segments, create) {
+	let current = root;
+	for (const segment of segments) {
+		current = path.join(current, segment);
+		let metadata;
+		try {
+			metadata = await lstat(current);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+			if (!create) return void 0;
+			try {
+				await mkdir(current, { mode: 448 });
+			} catch (mkdirError) {
+				if (mkdirError.code !== "EEXIST") throw mkdirError;
+			}
+			metadata = await lstat(current);
+		}
+		if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new CliError(`Cache component '${current}' must be a real directory.`, {
+			exitCode: 7,
+			code: "cache-path-integrity"
+		});
+	}
+	return current;
+}
+function descriptorById(id) {
+	const descriptor = DESCRIPTORS.find((candidate) => candidate.id === id);
+	if (!descriptor) throw usageError(`Unknown toolchain '${id}'.`);
+	return descriptor;
+}
+function sourceFor(config, descriptor) {
+	return {
+		kind: "server",
+		descriptor,
+		directory: pathToFileURL(`${toolchainDirectory(config, descriptor)}${path.sep}`)
+	};
+}
+async function sha256(file) {
+	const digest = createHash("sha256");
+	const handle = await open(file, "r");
+	try {
+		for await (const chunk of handle.createReadStream({ autoClose: false })) digest.update(chunk);
+	} finally {
+		await handle.close();
+	}
+	return digest.digest("hex");
+}
+async function verifyDescriptor(config, descriptor) {
+	const owned = await ownedCacheRoot(config, false);
+	if (!owned) throw new CliError(`Toolchain '${descriptor.id}' is not fetched. Run 'woj toolchain fetch ${descriptor.id}'.`, {
+		exitCode: 7,
+		code: "toolchain-missing"
+	});
+	const directory = await safeCacheDirectory(owned, [
+		"toolchains",
+		descriptor.id,
+		descriptor.version
+	], false);
+	if (!directory) throw new CliError(`Toolchain '${descriptor.id}' is not fetched. Run 'woj toolchain fetch ${descriptor.id}'.`, {
+		exitCode: 7,
+		code: "toolchain-missing"
+	});
+	for (const asset of descriptor.assets) {
+		const file = path.join(directory, path.basename(asset.path));
+		let metadata;
+		try {
+			metadata = await lstat(file);
+		} catch (error) {
+			if (error.code === "ENOENT") throw new CliError(`Toolchain '${descriptor.id}' is not fetched. Run 'woj toolchain fetch ${descriptor.id}'.`, {
+				exitCode: 7,
+				code: "toolchain-missing"
+			});
+			throw error;
+		}
+		if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size !== asset.bytes || await sha256(file) !== asset.sha256) throw new CliError(`Toolchain asset '${asset.path}' failed size or digest verification.`, {
+			exitCode: 7,
+			code: "toolchain-integrity"
+		});
+	}
+	return {
+		descriptor,
+		directory
+	};
+}
+function descriptorForLanguage(language) {
+	const matches = DESCRIPTORS.filter((descriptor) => descriptor.languages.includes(language));
+	if (matches.length !== 1) throw new CliError(`No unique toolchain provides language '${language}'.`, {
+		exitCode: 7,
+		code: "toolchain-unavailable"
+	});
+	return matches[0];
+}
+async function engineFor(root, config, workspace) {
+	if (!config["runtime-directory"]) throw new CliError("runtime-directory is not configured. Run 'woj config set runtime-directory <path>'.", {
+		exitCode: 7,
+		code: "runtime-missing"
+	});
+	const descriptor = descriptorForLanguage(workspace.language);
+	await verifyDescriptor(config, descriptor);
+	const owned = await ownedCacheRoot(config, true);
+	if (!owned) throw new CliError("The woj cache directory could not be created.", {
+		exitCode: 7,
+		code: "cache-root-invalid"
+	});
+	const engineCache = await safeCacheDirectory(owned, ["engine"], true);
+	if (!engineCache) throw new CliError("The engine cache directory could not be created.", {
+		exitCode: 7,
+		code: "cache-path-integrity"
+	});
+	for (const component of [
+		"runtime",
+		"artifacts",
+		"dependencies"
+	]) if (!await safeCacheDirectory(engineCache, [component], true)) throw new CliError(`The engine ${component} cache directory could not be created.`, {
+		exitCode: 7,
+		code: "cache-path-integrity"
+	});
+	try {
+		return await createServerEngine({
+			runtimeDirectory: config["runtime-directory"],
+			cacheDirectory: engineCache,
+			toolchains: [sourceFor(config, descriptor)]
+		});
+	} catch (error) {
+		throw new CliError("The configured local runtime distribution failed verification.", {
+			exitCode: 7,
+			code: "runtime-integrity",
+			cause: error
+		});
+	}
+}
+async function project(root) {
+	const workspace = await readWorkspace(root);
+	return {
+		workspace,
+		input: {
+			language: workspace.language,
+			entry: workspace.entry,
+			files: await readWorkspaceSources(root, workspace),
+			target: workspace.target,
+			optimization: workspace.optimization,
+			name: workspace.name
+		}
+	};
+}
+async function withEngine(root, config, workspace, action) {
+	const engine = await engineFor(root, config, workspace);
+	try {
+		return await action(engine);
+	} finally {
+		engine.dispose();
+	}
+}
+function buildProjection(build) {
+	return {
+		success: build.success,
+		diagnostics: build.diagnostics,
+		stdout: build.stdout,
+		stderr: build.stderr,
+		cacheHit: build.cacheHit,
+		artifact: build.artifact ? {
+			kind: build.artifact.kind,
+			size: build.artifact.size,
+			metadata: {
+				id: build.artifact.id,
+				language: build.artifact.language,
+				target: build.artifact.target,
+				optimization: build.artifact.optimization,
+				durationMs: build.artifact.durationMs
+			}
+		} : null
+	};
+}
+function parsePublicProblem(bytes) {
+	let value;
+	try {
+		value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch (error) {
+		throw new CliError("Pinned problem content is invalid UTF-8 JSON.", {
+			exitCode: 4,
+			code: "problem-content-invalid",
+			cause: error
+		});
+	}
+	const record = value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+	try {
+		if (record?.schema === "wasm-oj-platform/practice-problem-projection/v1") return parseStandaloneProblemBundle({
+			schema: "wasm-oj-browser-problem-v1",
+			problem: record.problem
+		});
+		if (record?.schema === "wasm-oj-platform/contest-public-problem-projection/v1") {
+			const problem = record.problem;
+			return {
+				...parseStandaloneProblemBundle({
+					schema: "wasm-oj-browser-problem-v1",
+					problem: {
+						...problem,
+						editorial: {
+							"zh-TW": "redacted",
+							en: "redacted"
+						}
+					}
+				}),
+				editorial: {
+					"zh-TW": "",
+					en: ""
+				}
+			};
+		}
+		return parseStandaloneProblemBundle(value);
+	} catch (error) {
+		throw new CliError(error instanceof Error ? error.message : "Pinned problem content has an invalid schema.", {
+			exitCode: 4,
+			code: "problem-content-invalid",
+			cause: error
+		});
+	}
+}
+async function pinnedProblem(root, workspace) {
+	if (!workspace.problem) throw usageError("This workspace has no pinned problem. Run 'woj problem pull'.");
+	let bytes;
+	try {
+		bytes = await readWorkspaceFileBytes(root, workspace.problem.contentFile, 8388608);
+	} catch (error) {
+		throw new CliError("Pinned problem content is missing or unsafe.", {
+			exitCode: 4,
+			code: "problem-content-integrity",
+			cause: error
+		});
+	}
+	if (createHash("sha256").update(bytes).digest("hex") !== workspace.problem.contentSha256) throw new CliError("Pinned problem bytes no longer match woj.json.", {
+		exitCode: 4,
+		code: "problem-content-integrity"
+	});
+	return parsePublicProblem(bytes);
+}
+async function directoryBytes(root) {
+	let total = 0;
+	const walk = async (directory) => {
+		let entries;
+		try {
+			entries = await readdir(directory, { withFileTypes: true });
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		for (const entry of entries) {
+			const file = path.join(directory, entry.name);
+			if (entry.isDirectory()) await walk(file);
+			else if (entry.isFile()) total += (await stat(file)).size;
+		}
+	};
+	await walk(root);
+	return total;
+}
+async function exactResponseBytes(response, expected, label) {
+	const declared = response.headers.get("content-length");
+	if (declared !== null && (!/^(?:0|[1-9][0-9]*)$/.test(declared) || Number(declared) !== expected)) throw new CliError(`Fetched toolchain asset '${label}' has the wrong Content-Length.`, {
+		exitCode: 7,
+		code: "toolchain-integrity"
+	});
+	if (!response.body) throw new CliError(`Fetched toolchain asset '${label}' has no body.`, { exitCode: 6 });
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > expected) {
+				await reader.cancel("toolchain asset exceeds its pinned size");
+				throw new CliError(`Fetched toolchain asset '${label}' exceeds its pinned size.`, {
+					exitCode: 7,
+					code: "toolchain-integrity"
+				});
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	if (total !== expected) throw new CliError(`Fetched toolchain asset '${label}' has the wrong size.`, {
+		exitCode: 7,
+		code: "toolchain-integrity"
+	});
+	const output = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return output;
+}
+var NodeLocalRuntime = class {
+	async build(root, config) {
+		const { workspace, input } = await project(root);
+		const build = await withEngine(root, config, workspace, (engine) => engine.compile(input));
+		return {
+			value: buildProjection(build),
+			successful: build.success
+		};
+	}
+	async run(root, config, options) {
+		const { workspace, input } = await project(root);
+		const result = await withEngine(root, config, workspace, (engine) => engine.execute(input, {
+			stdin: options.stdin ?? "",
+			args: options.args
+		}));
+		return {
+			value: {
+				build: buildProjection(result.build),
+				run: result.run ?? null
+			},
+			successful: Boolean(result.build.success && result.run?.termination === "exited" && result.run.code === 0)
+		};
+	}
+	async test(root, config, options) {
+		const { workspace, input } = await project(root);
+		const publicSamples = (await pinnedProblem(root, workspace)).judgeCases.filter((testCase) => testCase.kind === "sample");
+		if (new Set(options.cases).size !== options.cases.length) throw usageError("--case values must be unique.");
+		const samples = options.cases.length === 0 ? publicSamples : options.cases.map((id) => {
+			const sample = publicSamples.find((candidate) => candidate.id === id);
+			if (!sample) throw usageError(`Public sample case '${id}' does not exist in the pinned problem.`);
+			return sample;
+		});
+		const results = [];
+		let successful = true;
+		await withEngine(root, config, workspace, async (engine) => {
+			const build = await engine.compile(input);
+			if (!build.success || !build.artifact) {
+				results.push({ build: buildProjection(build) });
+				successful = false;
+				return;
+			}
+			for (const sample of samples) {
+				const run = await engine.run(build.artifact, { stdin: sample.input });
+				const accepted = run.termination === "exited" && run.code === 0 && run.stdout.replace(/[ \t]+$/gm, "").trimEnd() === sample.output.replace(/[ \t]+$/gm, "").trimEnd();
+				results.push({
+					id: sample.id,
+					accepted,
+					run
+				});
+				if (!accepted) successful = false;
+			}
+		});
+		return {
+			value: {
+				samples: results,
+				passed: successful
+			},
+			successful
+		};
+	}
+	async bench(root, config, options) {
+		const { workspace, input } = await project(root);
+		const durations = [];
+		let buildValue;
+		let successful = true;
+		await withEngine(root, config, workspace, async (engine) => {
+			const build = await engine.compile(input);
+			buildValue = buildProjection(build);
+			if (!build.success || !build.artifact) {
+				successful = false;
+				return;
+			}
+			for (let index = 0; index < options.iterations; index += 1) {
+				const run = await engine.run(build.artifact, { stdin: options.stdin ?? "" });
+				durations.push(run.durationMs);
+				if (run.termination !== "exited" || run.code !== 0) successful = false;
+			}
+		});
+		const sorted = [...durations].sort((left, right) => left - right);
+		return {
+			value: {
+				build: buildValue,
+				iterations: durations.length,
+				durationsMs: durations,
+				medianMs: sorted[Math.floor(sorted.length / 2)] ?? null
+			},
+			successful
+		};
+	}
+	async inspectJudge(file) {
+		let validated;
+		try {
+			const target = path.resolve(file);
+			const metadata = await lstat(target);
+			if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > WASM_OJ_JUDGE_PACKAGE_MAX_BYTES) throw new Error("Judge package must be a bounded regular file.");
+			validated = await validateJudgePackage(new Uint8Array(await readFile(target)));
+		} catch (error) {
+			throw new CliError(error instanceof Error ? error.message : "Judge package is invalid.", {
+				exitCode: 4,
+				code: "judge-package-invalid",
+				cause: error
+			});
+		}
+		return {
+			value: validated,
+			successful: true
+		};
+	}
+	async verifyJudge(file, options) {
+		let validated;
+		try {
+			const target = path.resolve(file);
+			const metadata = await lstat(target);
+			if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > WASM_OJ_JUDGE_PACKAGE_MAX_BYTES) throw new Error("Judge package must be a bounded regular file.");
+			validated = await validateJudgePackage(new Uint8Array(await readFile(target)), {
+				expectedBytes: options.bytes,
+				expectedSha256: options.sha256
+			});
+		} catch (error) {
+			throw new CliError(error instanceof Error ? error.message : "Judge package is invalid.", {
+				exitCode: 4,
+				code: "judge-package-invalid",
+				cause: error
+			});
+		}
+		return {
+			value: validated,
+			successful: true
+		};
+	}
+	async executeJudge(root, config, file) {
+		const { workspace, input } = await project(root);
+		let package_;
+		try {
+			const target = path.resolve(file);
+			const metadata = await lstat(target);
+			if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > WASM_OJ_JUDGE_PACKAGE_MAX_BYTES) throw new Error("Judge package must be a bounded regular file.");
+			package_ = await decodeJudgePackageForExecution(new Uint8Array(await readFile(target)));
+		} catch (error) {
+			throw new CliError(error instanceof Error ? error.message : "Judge package is invalid.", {
+				exitCode: 4,
+				code: "judge-package-invalid",
+				cause: error
+			});
+		}
+		const allowed = package_.allowedProfiles[workspace.language];
+		if (!allowed || allowed.target !== workspace.target || allowed.optimization !== workspace.optimization) throw new CliError("Workspace compile profile is not allowed by this judge package.", {
+			exitCode: 4,
+			code: "judge-profile-mismatch"
+		});
+		const result = await withEngine(root, config, workspace, (engine) => engine.judgeProject(input, trustedJudgeSpec(package_.judgeData, package_.judge)));
+		const accepted = Boolean(result.build.success && result.judge?.verdict === "accepted");
+		return {
+			value: {
+				build: buildProjection(result.build),
+				judge: result.judge ?? null
+			},
+			successful: accepted
+		};
+	}
+	async toolchainList(config) {
+		return {
+			value: { toolchains: await Promise.all(DESCRIPTORS.map(async (descriptor) => {
+				try {
+					await verifyDescriptor(config, descriptor);
+					return {
+						...descriptor,
+						fetched: true
+					};
+				} catch (error) {
+					if (error instanceof CliError && error.code === "toolchain-missing") return {
+						...descriptor,
+						fetched: false
+					};
+					throw error;
+				}
+			})) },
+			successful: true
+		};
+	}
+	async toolchainInfo(config, id) {
+		const descriptor = descriptorById(id);
+		let fetched = false;
+		try {
+			await verifyDescriptor(config, descriptor);
+			fetched = true;
+		} catch (error) {
+			if (!(error instanceof CliError) || error.code !== "toolchain-missing") throw error;
+		}
+		return {
+			value: {
+				...descriptor,
+				fetched,
+				directory: toolchainDirectory(config, descriptor)
+			},
+			successful: true
+		};
+	}
+	async toolchainFetch(config, server, id, fetchImplementation = globalThis.fetch) {
+		const descriptor = descriptorById(id);
+		const owned = await ownedCacheRoot(config, true);
+		if (!owned) throw new CliError("The woj cache directory could not be created.", {
+			exitCode: 7,
+			code: "cache-root-invalid"
+		});
+		const directory = await safeCacheDirectory(owned, [
+			"toolchains",
+			descriptor.id,
+			descriptor.version
+		], true);
+		if (!directory) throw new CliError("The toolchain cache directory could not be created.", {
+			exitCode: 7,
+			code: "cache-path-integrity"
+		});
+		for (const asset of descriptor.assets) {
+			let response;
+			try {
+				response = await fetchImplementation(new URL(asset.path, server), { redirect: "error" });
+			} catch (error) {
+				throw new CliError(`Could not fetch '${asset.path}'.`, {
+					exitCode: 6,
+					cause: error
+				});
+			}
+			if (!response.ok) throw new CliError(`Could not fetch '${asset.path}' (HTTP ${response.status}).`, { exitCode: 6 });
+			const bytes = await exactResponseBytes(response, asset.bytes, asset.path);
+			if (bytes.byteLength !== asset.bytes || createHash("sha256").update(bytes).digest("hex") !== asset.sha256) throw new CliError(`Fetched toolchain asset '${asset.path}' failed size or digest verification.`, {
+				exitCode: 7,
+				code: "toolchain-integrity"
+			});
+			const output = path.join(directory, path.basename(asset.path));
+			const temporary = `${output}.${process.pid}.${crypto.randomUUID()}.tmp`;
+			await writeFile(temporary, bytes, {
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, output);
+		}
+		await verifyDescriptor(config, descriptor);
+		return {
+			value: {
+				id: descriptor.id,
+				version: descriptor.version,
+				directory
+			},
+			successful: true
+		};
+	}
+	async toolchainVerify(config, id) {
+		const descriptors = id ? [descriptorById(id)] : DESCRIPTORS;
+		const verified = [];
+		for (const descriptor of descriptors) {
+			await verifyDescriptor(config, descriptor);
+			verified.push({
+				id: descriptor.id,
+				version: descriptor.version
+			});
+		}
+		return {
+			value: { verified },
+			successful: true
+		};
+	}
+	async toolchainPrune(config) {
+		const owned = await ownedCacheRoot(config, true);
+		if (!owned) throw new CliError("The woj cache directory could not be created.", {
+			exitCode: 7,
+			code: "cache-root-invalid"
+		});
+		const root = await safeCacheDirectory(owned, ["toolchains"], true);
+		if (!root) throw new CliError("The toolchain cache directory could not be created.", {
+			exitCode: 7,
+			code: "cache-path-integrity"
+		});
+		const keep = new Set(DESCRIPTORS.map((descriptor) => path.resolve(toolchainDirectory(config, descriptor))));
+		const removed = [];
+		let ids;
+		try {
+			ids = await readdir(root, { withFileTypes: true });
+		} catch (error) {
+			if (error.code === "ENOENT") return {
+				value: { removed },
+				successful: true
+			};
+			throw error;
+		}
+		for (const id of ids) {
+			if (id.isSymbolicLink() || !id.isDirectory()) throw new CliError(`Cache component '${path.join(root, id.name)}' must be a real directory.`, {
+				exitCode: 7,
+				code: "cache-path-integrity"
+			});
+			const idRoot = await safeCacheDirectory(root, [id.name], false);
+			if (!idRoot) continue;
+			const versions = await readdir(idRoot, { withFileTypes: true });
+			for (const version of versions) {
+				const candidate = path.resolve(idRoot, version.name);
+				if (version.isSymbolicLink() || !version.isDirectory()) throw new CliError(`Cache component '${candidate}' must be a real directory.`, {
+					exitCode: 7,
+					code: "cache-path-integrity"
+				});
+				if (await safeCacheDirectory(idRoot, [version.name], false) && !keep.has(candidate)) {
+					await rm(candidate, {
+						recursive: true,
+						force: false
+					});
+					removed.push(candidate);
+				}
+			}
+		}
+		return {
+			value: { removed },
+			successful: true
+		};
+	}
+	async cacheStatus(config) {
+		const root = await ownedCacheRoot(config, false);
+		return {
+			value: {
+				directory: cacheRoot(config),
+				bytes: root ? await directoryBytes(root) : 0
+			},
+			successful: true
+		};
+	}
+	async cachePrune(config) {
+		const root = await ownedCacheRoot(config, true);
+		if (!root) throw new CliError("The woj cache directory could not be created.", {
+			exitCode: 7,
+			code: "cache-root-invalid"
+		});
+		const engine = await safeCacheDirectory(root, ["engine"], false);
+		if (!engine) return {
+			value: { removed: [] },
+			successful: true
+		};
+		await rm(engine, {
+			recursive: true,
+			force: false
+		});
+		return {
+			value: { removed: engine },
+			successful: true
+		};
+	}
+	async cacheClear(config) {
+		const root = await ownedCacheRoot(config, true);
+		if (!root) throw new CliError("The woj cache directory could not be created.", {
+			exitCode: 7,
+			code: "cache-root-invalid"
+		});
+		await rm(root, {
+			recursive: true,
+			force: true
+		});
+		return {
+			value: { removed: root },
+			successful: true
+		};
+	}
+	async doctor(root, config) {
+		const checks = [];
+		checks.push({
+			name: "server",
+			ok: Boolean(config.server),
+			detail: config.server ?? "not configured"
+		});
+		checks.push({
+			name: "runtime",
+			ok: Boolean(config["runtime-directory"]),
+			detail: config["runtime-directory"] ?? "not configured"
+		});
+		try {
+			const workspace = await readWorkspace(root);
+			checks.push({
+				name: "workspace",
+				ok: true,
+				detail: `${workspace.language}/${workspace.target}/${workspace.optimization}`
+			});
+		} catch (error) {
+			checks.push({
+				name: "workspace",
+				ok: false,
+				detail: error instanceof Error ? error.message : "invalid"
+			});
+		}
+		for (const descriptor of DESCRIPTORS) try {
+			await verifyDescriptor(config, descriptor);
+			checks.push({
+				name: `toolchain:${descriptor.id}`,
+				ok: true,
+				detail: descriptor.version
+			});
+		} catch (error) {
+			checks.push({
+				name: `toolchain:${descriptor.id}`,
+				ok: false,
+				detail: error instanceof Error ? error.message : "invalid"
+			});
+		}
+		return {
+			value: { checks },
+			successful: checks.every((check) => check.ok)
+		};
+	}
+};
+function judgeSucceeded(result) {
+	return result?.verdict === "accepted";
+}
+//#endregion
+//#region src/cli/commands.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var TERMINAL_SUBMISSION_STATES = /* @__PURE__ */ new Set([
+	"completed",
+	"compile-error",
+	"judge-error",
+	"infrastructure-error",
+	"cancelled"
+]);
+var TERMINAL_VALIDATION_STATES = /* @__PURE__ */ new Set([
+	"valid",
+	"invalid",
+	"infrastructure-error"
+]);
+var TERMINAL_PUBLICATION_STATES = /* @__PURE__ */ new Set(["published", "failed"]);
+var TERMINAL_REJUDGE_STATES = /* @__PURE__ */ new Set([
+	"effective",
+	"failed",
+	"cancelled"
+]);
+function stringOption(command, name) {
+	const value = command.options[name];
+	if (value === void 0) return void 0;
+	if (typeof value !== "string") throw usageError(`--${name} requires one value.`);
+	return value;
+}
+function booleanOption(command, name) {
+	return command.options[name] === true;
+}
+function repeatableOption(command, name) {
+	const value = command.options[name];
+	if (value === void 0) return [];
+	if (!Array.isArray(value)) throw usageError(`--${name} is repeatable.`);
+	return value;
+}
+function localeOption(command) {
+	const locale = stringOption(command, "locale") ?? "zh-TW";
+	if (locale !== "zh-TW" && locale !== "en") throw usageError("--locale must be zh-TW or en.");
+	return locale;
+}
+async function runInput(command, cwd) {
+	const input = stringOption(command, "input");
+	const text = stringOption(command, "text");
+	if (input !== void 0 && text !== void 0) throw usageError("Use either --input or --text, not both.");
+	if (input === void 0) return text;
+	const file = path.resolve(cwd, input);
+	let metadata;
+	try {
+		metadata = await lstat(file);
+	} catch (error) {
+		throw new CliError("--input must name a readable UTF-8 file no larger than 8 MiB.", {
+			exitCode: 7,
+			code: "input-file-invalid",
+			cause: error
+		});
+	}
+	if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > 8388608) throw new CliError("--input must name a real UTF-8 file no larger than 8 MiB.", {
+		exitCode: 7,
+		code: "input-file-invalid"
+	});
+	const bytes = new Uint8Array(await readFile(file));
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch (error) {
+		throw new CliError("--input is not valid UTF-8.", {
+			exitCode: 7,
+			code: "input-file-invalid",
+			cause: error
+		});
+	}
+}
+function canonicalTimestamp(value, label) {
+	if (value === void 0) return void 0;
+	if (Number.isNaN(Date.parse(value)) || new Date(value).toISOString() !== value) throw usageError(`--${label} must be a canonical ISO timestamp.`);
+	return value;
+}
+function canonicalCursorTimestamp(value, label) {
+	if (Number.isNaN(Date.parse(value)) || new Date(value).toISOString() !== value) throw usageError(`${label} timestamp is invalid.`);
+	return value;
+}
+function normalizedRelativePath(value, label) {
+	if (!value || value.length > 512 || value.startsWith("/") || value.includes("\\") || value.includes("\0") || value.split("/").some((part) => !part || part === "." || part === "..")) throw usageError(`${label} must be a normalized relative POSIX path.`);
+	return value;
+}
+function exactPositionals(command, minimum, maximum = minimum) {
+	if (command.positionals.length < minimum || command.positionals.length > maximum) throw usageError(`Usage: woj ${command.spec.path.join(" ")}${command.spec.usage ? ` ${command.spec.usage}` : ""}`);
+	return command.positionals;
+}
+function uuid(value, label) {
+	if (!UUID.test(value)) throw usageError(`${label} must be a UUID.`);
+	return value;
+}
+function serverUuid(record, name, label = name) {
+	const value = field(record, name, label);
+	if (!UUID.test(value)) throw new CliError(`Server ${label} is not a UUID.`, {
+		exitCode: 6,
+		code: "server-response-invalid"
+	});
+	return value;
+}
+function positiveInteger(value, fallback, maximum, label) {
+	const parsed = Number(value ?? String(fallback));
+	if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > maximum) throw usageError(`${label} must be an integer from 1 to ${maximum}.`);
+	return parsed;
+}
+function boundedIntegerOption(command, name, maximum) {
+	const value = stringOption(command, name);
+	return value === void 0 ? void 0 : String(positiveInteger(value, 1, maximum, `--${name}`));
+}
+function query(parameters) {
+	const search = new URLSearchParams();
+	for (const [name, value] of Object.entries(parameters)) if (value !== void 0) search.set(name, value);
+	const suffix = search.toString();
+	return suffix ? `?${suffix}` : "";
+}
+function cursor(value, fields, label) {
+	if (value === void 0) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch (error) {
+		throw new CliError(`${label} must be the exact JSON nextCursor returned by the server.`, {
+			exitCode: 2,
+			code: "usage",
+			cause: error
+		});
+	}
+	const record = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+	if (!record || JSON.stringify(Object.keys(record).sort()) !== JSON.stringify([...fields].sort()) || fields.some((fieldName) => typeof record[fieldName] !== "string" || !record[fieldName])) throw usageError(`${label} must be the exact JSON nextCursor returned by the server.`);
+	return Object.fromEntries(fields.map((fieldName) => [fieldName, record[fieldName]]));
+}
+function object(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new CliError(`${label} has an invalid shape.`, {
+		exitCode: 6,
+		code: "server-response-invalid"
+	});
+	return value;
+}
+function array(value, label) {
+	if (!Array.isArray(value)) throw new CliError(`${label} has an invalid shape.`, {
+		exitCode: 6,
+		code: "server-response-invalid"
+	});
+	return value;
+}
+function localOutcome(result) {
+	return {
+		value: result.value,
+		exitCode: result.successful ? WOJ_EXIT.success : WOJ_EXIT.unsuccessful
+	};
+}
+async function configured(command, dependencies) {
+	const config = await dependencies.configStore.read();
+	const origin = command.global.server ?? config.server;
+	if (!origin) throw usageError("No server is configured. Pass --server or run 'woj config set server <origin>'.");
+	const canonical = new URL(validateConfigValue("server", origin)).origin;
+	return {
+		config,
+		origin: canonical,
+		client: dependencies.remote(canonical)
+	};
+}
+async function logout(origin, client, tokenStore) {
+	const token = await tokenStore.get(origin);
+	if (token === void 0) return {
+		value: {
+			authenticated: false,
+			server: origin
+		},
+		exitCode: 0
+	};
+	if (!isWojAccessToken(token)) {
+		await tokenStore.delete(origin);
+		return {
+			value: {
+				authenticated: false,
+				server: origin
+			},
+			exitCode: 0
+		};
+	}
+	let value;
+	try {
+		value = await client.request("/api/auth/logout", {
+			method: "POST",
+			body: {}
+		});
+	} catch (error) {
+		if (!(error instanceof ApiError && error.status === 401 && error.code === "authentication-required")) throw error;
+		await tokenStore.delete(origin);
+		return {
+			value: {
+				authenticated: false,
+				server: origin
+			},
+			exitCode: 0
+		};
+	}
+	const response = object(value, "logout response");
+	if (JSON.stringify(Object.keys(response).sort()) !== JSON.stringify(["ok"]) || response.ok !== true) throw new CliError("Server logout response has an invalid shape.", {
+		exitCode: 6,
+		code: "server-response-invalid"
+	});
+	await tokenStore.delete(origin);
+	return {
+		value: {
+			authenticated: false,
+			server: origin
+		},
+		exitCode: 0
+	};
+}
+function field(record, name, label = name) {
+	const value = record[name];
+	if (typeof value !== "string" || !value) throw new CliError(`Server ${label} is invalid.`, {
+		exitCode: 6,
+		code: "server-response-invalid"
+	});
+	return value;
+}
+function terminalSummary(value, envelope) {
+	return object(object(value, `${envelope} response`)[envelope], envelope);
+}
+async function watchResource(options) {
+	for (;;) {
+		const value = await options.client.request(options.path);
+		const resource = terminalSummary(value, options.envelope);
+		const state = typeof resource.state === "string" ? resource.state : typeof resource.status === "string" ? resource.status : void 0;
+		if (!state) throw new CliError(`${options.envelope} state is missing.`, { exitCode: 6 });
+		if (options.terminal.has(state)) return {
+			value,
+			exitCode: options.success.has(state) ? 0 : 1
+		};
+		await options.sleep(options.intervalMs);
+	}
+}
+async function submissionWatch(client, id, intervalMs, sleep) {
+	let cursor = 0;
+	for (;;) {
+		const value = object(await client.request(`/api/submissions/${id}/events?after=${cursor}`), "submission events");
+		if (Number.isSafeInteger(value.nextCursor) && value.nextCursor >= cursor) cursor = value.nextCursor;
+		const summary = object(value.summary, "submission summary");
+		const state = field(summary, "state", "submission state");
+		if (TERMINAL_SUBMISSION_STATES.has(state)) return {
+			value,
+			exitCode: state === "completed" && summary.verdict === "accepted" ? 0 : 1
+		};
+		await sleep(intervalMs);
+	}
+}
+async function retryTurnstile(action, dependencies, origin) {
+	let openedUrl;
+	for (let attempt = 0; attempt < 150; attempt += 1) try {
+		return await action();
+	} catch (error) {
+		if (!(error instanceof ApiError) || error.code !== "turnstile-required") throw error;
+		const verificationUrl = turnstileVerificationUrl(origin, error.details);
+		if (openedUrl !== void 0 && openedUrl !== verificationUrl) throw new CliError("Browser verification binding changed while retrying the same submission.", {
+			exitCode: 6,
+			code: "verification-url-invalid"
+		});
+		if (openedUrl === void 0) {
+			openedUrl = verificationUrl;
+			dependencies.onNotice(`Complete the browser verification: ${verificationUrl}`);
+			await dependencies.opener.open(verificationUrl);
+		}
+		await dependencies.sleep(2e3);
+	}
+	throw new CliError("Browser verification did not complete before the CLI deadline.", {
+		exitCode: 3,
+		code: "turnstile-expired"
+	});
+}
+async function exactPublicProblem(client, problemVersionId, contestId) {
+	const metadataPath = `/api/problems/${problemVersionId}${query({ contestId })}`;
+	const metadata = object(await client.request(metadataPath, { authenticated: contestId ? true : "optional" }), "problem metadata");
+	if (metadata.problemVersionId !== problemVersionId || metadata.schema !== "wasm-oj-platform/problem-content-pointer/v2") throw new CliError("Problem metadata identity is invalid.", { exitCode: 4 });
+	const content = object(metadata.content, "problem content pointer");
+	const contentUrl = field(content, "url", "problem content URL");
+	const contentSha256 = field(content, "sha256", "problem content digest");
+	if (!/^[0-9a-f]{64}$/.test(contentSha256) || !Number.isSafeInteger(content.bytes) || content.bytes < 1) throw new CliError("Problem content pointer is invalid.", { exitCode: 4 });
+	const bytes = await client.requestBytes(contentUrl, { authenticated: contestId ? true : "optional" });
+	if (bytes.byteLength !== content.bytes || createHash("sha256").update(bytes).digest("hex") !== contentSha256) throw new CliError("Downloaded problem bytes disagree with their immutable pointer.", {
+		exitCode: 4,
+		code: "problem-content-integrity"
+	});
+	return {
+		metadata,
+		content,
+		bytes,
+		problem: parsePublicProblem(bytes)
+	};
+}
+function localizedList(value, locale) {
+	const response = object(value, "problem list");
+	const collections = array(response.collections, "problem collections").map((collectionValue) => {
+		const collection = object(collectionValue, "problem collection");
+		const problems = array(collection.problems, "collection problems").map((problemValue) => {
+			const problem = object(problemValue, "problem summary");
+			const title = object(problem.title, "problem title")[locale];
+			const track = problem.track === null ? null : object(problem.track, "problem track")[locale];
+			if (typeof title !== "string" || track !== null && typeof track !== "string") throw new CliError("Problem localization is invalid.", { exitCode: 6 });
+			return {
+				...problem,
+				title,
+				track
+			};
+		});
+		return {
+			...collection,
+			problems
+		};
+	});
+	return {
+		...response,
+		locale,
+		collections
+	};
+}
+async function problemPull(command, dependencies, client) {
+	const [problemVersionId, directory = "."] = exactPositionals(command, 1, 2);
+	uuid(problemVersionId, "problem-version-id");
+	const contestId = stringOption(command, "contest");
+	if (contestId) uuid(contestId, "contest");
+	const locale = localeOption(command);
+	const language = stringOption(command, "language");
+	if (!language || !LANGUAGES.includes(language)) throw usageError("problem pull requires a supported --language.");
+	const { metadata, content, bytes, problem } = await exactPublicProblem(client, problemVersionId, contestId);
+	const catalogPublicationId = serverUuid(metadata, "catalogPublicationId", "catalogPublicationId");
+	const contentUrl = field(content, "url", "problem content URL");
+	const contentSha256 = field(content, "sha256", "problem content digest");
+	const profile = object(object(metadata.allowedProfiles, "allowedProfiles")[language], `allowedProfiles.${language}`);
+	if (profile.target !== "wasip1" && profile.target !== "wasix" || profile.optimization !== "debug" && profile.optimization !== "release") throw usageError(`Language '${language}' is not available for this problem version.`);
+	const template = problem.starterTemplates[language];
+	if (!template) throw usageError(`Problem has no starter template for '${language}'.`);
+	const root = path.resolve(dependencies.cwd, directory);
+	await assertSafeFileDestinations(root, [
+		"woj.json",
+		"problem.json",
+		...Object.keys(template.files)
+	], booleanOption(command, "force"));
+	await mkdir(root, { recursive: true });
+	for (const [relative, source] of Object.entries(template.files)) {
+		const file = path.join(root, ...relative.split("/"));
+		await mkdir(path.dirname(file), { recursive: true });
+		await atomicWriteFile(file, source);
+	}
+	await atomicWriteFile(path.join(root, "problem.json"), bytes);
+	await writeWorkspace(root, {
+		schema: WOJ_WORKSPACE_SCHEMA,
+		name: problem.id,
+		language,
+		target: profile.target,
+		optimization: profile.optimization,
+		entry: template.entry,
+		sources: Object.keys(template.files).sort(),
+		problem: {
+			problemVersionId,
+			catalogPublicationId,
+			serverOrigin: client.origin,
+			contentUrl,
+			contentSha256,
+			contentFile: "problem.json",
+			locale,
+			...contestId ? { contestId } : {}
+		}
+	});
+	return {
+		value: {
+			directory: root,
+			problemVersionId,
+			catalogPublicationId,
+			contentSha256,
+			language,
+			target: profile.target,
+			optimization: profile.optimization
+		},
+		exitCode: 0
+	};
+}
+async function submit(command, dependencies, client) {
+	exactPositionals(command, 0);
+	const workspace = await readWorkspace(dependencies.cwd);
+	if (!workspace.problem) throw usageError("Official Submit requires a workspace created by 'woj problem pull'.");
+	if (workspace.problem.serverOrigin !== client.origin) throw new CliError(`Pinned problem belongs to ${workspace.problem.serverOrigin}; refusing to submit it to ${client.origin}.`, {
+		exitCode: 5,
+		code: "server-origin-mismatch"
+	});
+	const language = stringOption(command, "language") ?? workspace.language;
+	const target = stringOption(command, "target") ?? workspace.target;
+	const optimization = stringOption(command, "optimization") ?? workspace.optimization;
+	const entry = stringOption(command, "entry") ?? workspace.entry;
+	if (!LANGUAGES.includes(language)) throw usageError("--language must name a supported language.");
+	if (target !== "wasip1" && target !== "wasix") throw usageError("--target must be wasip1 or wasix.");
+	if (optimization !== "debug" && optimization !== "release") throw usageError("--optimization must be debug or release.");
+	normalizedRelativePath(entry, "--entry");
+	if (!workspace.sources.includes(entry)) throw usageError("--entry must identify a source pinned in woj.json.");
+	if (language !== workspace.language || target !== workspace.target || optimization !== workspace.optimization) throw new CliError("Official Submit must use the exact compile profile pinned by problem pull.", {
+		exitCode: 5,
+		code: "profile-pin-mismatch"
+	});
+	const contestId = stringOption(command, "contest") ?? workspace.problem.contestId;
+	if (contestId !== void 0) uuid(contestId, "contest");
+	if (contestId !== workspace.problem.contestId) throw new CliError("Official Submit contest context must match the pinned workspace.", { exitCode: 5 });
+	const sources = await readWorkspaceSources(dependencies.cwd, workspace);
+	const body = {
+		problemVersionId: workspace.problem.problemVersionId,
+		...contestId ? { contestId } : {},
+		language,
+		target,
+		optimization,
+		entry,
+		sourceFiles: Object.entries(sources).sort(([left], [right]) => left.localeCompare(right)).map(([filePath, content]) => ({
+			path: filePath,
+			encoding: "utf8",
+			content
+		})),
+		idempotencyKey: `woj-submit-${randomUUID()}`
+	};
+	const created = await retryTurnstile(() => client.request("/api/submissions", {
+		method: "POST",
+		body
+	}), dependencies, client.origin);
+	if (!booleanOption(command, "wait")) return {
+		value: created,
+		exitCode: 0
+	};
+	return submissionWatch(client, serverUuid(object(created, "submission creation"), "submissionId"), 2e3, dependencies.sleep);
+}
+async function currentContestDraft(client, id) {
+	const value = object(await client.request(`/api/organizer/contests/${id}`), "Organizer contest");
+	const contest = object(value.contest, "contest");
+	const problems = array(value.problems, "contest problems");
+	const freezeAt = contest.freezeAt;
+	if (freezeAt !== null && freezeAt !== void 0 && typeof freezeAt !== "string") throw new CliError("Organizer contest freezeAt has an invalid shape.", {
+		exitCode: 6,
+		code: "server-response-invalid"
+	});
+	return {
+		current: value,
+		body: {
+			title: contest.title,
+			description: contest.description,
+			accessMode: contest.accessMode,
+			startsAt: contest.startsAt,
+			endsAt: contest.endsAt,
+			...typeof freezeAt === "string" ? { freezeAt } : {},
+			problemVersionIds: problems.map((problem) => field(object(problem, "contest problem"), "problemVersionId"))
+		}
+	};
+}
+async function contestBody(command, cwd, base = {}) {
+	const body = { ...base };
+	for (const [option, key] of Object.entries({
+		title: "title",
+		description: "description",
+		access: "accessMode",
+		starts: "startsAt",
+		ends: "endsAt",
+		freeze: "freezeAt"
+	})) {
+		const value = stringOption(command, option);
+		if (value !== void 0) body[key] = value;
+	}
+	const inviteCode = await readProtectedTextFile(cwd, stringOption(command, "invite-code-file"), "--invite-code-file");
+	if (inviteCode !== void 0) body.inviteCode = inviteCode;
+	const problems = repeatableOption(command, "problem");
+	if (problems.length) body.problemVersionIds = problems.map((id) => uuid(id, "problem"));
+	if (typeof body.title === "string" && (!body.title.trim() || body.title.length > 120)) throw usageError("--title must contain 1–120 characters.");
+	if (typeof body.description === "string" && body.description.length > 1e4) throw usageError("--description must contain at most 10,000 characters.");
+	if (Array.isArray(body.problemVersionIds) && (body.problemVersionIds.length < 1 || body.problemVersionIds.length > 100 || new Set(body.problemVersionIds).size !== body.problemVersionIds.length)) throw usageError("Contest problem IDs must be unique and contain 1–100 values.");
+	if (body.accessMode !== "public" && body.accessMode !== "invite") throw usageError("--access must be public or invite.");
+	const invite = body.inviteCode;
+	if (invite !== void 0 && (typeof invite !== "string" || invite.length < 16 || invite.length > 128)) throw usageError("--invite-code-file must contain 16–128 characters.");
+	if (body.accessMode === "public" && invite !== void 0) throw usageError("--invite-code-file cannot be used with --access public.");
+	const startsAt = canonicalTimestamp(typeof body.startsAt === "string" ? body.startsAt : void 0, "starts");
+	const endsAt = canonicalTimestamp(typeof body.endsAt === "string" ? body.endsAt : void 0, "ends");
+	const freezeAt = canonicalTimestamp(typeof body.freezeAt === "string" ? body.freezeAt : void 0, "freeze");
+	if (startsAt !== void 0 && endsAt !== void 0 && (endsAt <= startsAt || freezeAt !== void 0 && (freezeAt <= startsAt || freezeAt >= endsAt))) throw usageError("Contest timestamps must satisfy starts < freeze < ends (freeze is optional).");
+	return body;
+}
+async function createCollectionSkeleton(root, force) {
+	const file = path.join(root, "collection", "source.json");
+	await assertSafeFileDestinations(root, ["collection/source.json"], force);
+	await mkdir(path.dirname(file), { recursive: true });
+	await atomicWriteFile(file, `${JSON.stringify({
+		schema: "wasm-oj-browser-collection-source-v1",
+		localization: {
+			defaultLocale: "zh-TW",
+			supportedLocales: ["zh-TW", "en"]
+		},
+		problems: []
+	}, null, 2)}\n`);
+	return {
+		value: {
+			directory: root,
+			source: file
+		},
+		exitCode: 0
+	};
+}
+async function watchLocalWorkspace(root, execute, onNotice) {
+	const watched = ["woj.json", ...(await readWorkspace(root)).sources].map((relative) => path.join(root, ...relative.split("/")));
+	let latest = await execute();
+	onNotice(JSON.stringify(latest.value));
+	let running = false;
+	let queued = false;
+	const rerun = async () => {
+		if (running) {
+			queued = true;
+			return;
+		}
+		running = true;
+		try {
+			do {
+				queued = false;
+				try {
+					latest = await execute();
+					onNotice(JSON.stringify(latest.value));
+				} catch (error) {
+					onNotice(`watch error: ${error instanceof Error ? error.message : String(error)}`);
+				}
+			} while (queued);
+		} finally {
+			running = false;
+		}
+	};
+	const watchers = watched.map((file) => watch(file, { persistent: true }, () => {
+		rerun();
+	}));
+	await new Promise((resolve) => {
+		const stop = () => {
+			for (const watcher of watchers) watcher.close();
+			process.off("SIGINT", stop);
+			process.off("SIGTERM", stop);
+			resolve();
+		};
+		process.once("SIGINT", stop);
+		process.once("SIGTERM", stop);
+	});
+	return latest;
+}
+function completion(shell) {
+	const commands = [
+		"auth",
+		"init",
+		"build",
+		"run",
+		"test",
+		"bench",
+		"watch",
+		"problem",
+		"submit",
+		"submission",
+		"contest",
+		"performance",
+		"judge",
+		"toolchain",
+		"organizer",
+		"config",
+		"cache",
+		"doctor",
+		"completion",
+		"version"
+	].join(" ");
+	if (shell === "bash") return `complete -W '${commands}' woj`;
+	if (shell === "zsh") return `#compdef woj\n_arguments '1:command:(${commands})'`;
+	if (shell === "fish") return commands.split(" ").map((command) => `complete -c woj -n '__fish_use_subcommand' -a ${command}`).join("\n");
+	throw usageError("completion shell must be bash, zsh, or fish.");
+}
+async function dispatchCommand(command, dependencies) {
+	const key = commandKey(command.spec.path);
+	const config = await dependencies.configStore.read();
+	if (key === "version") {
+		exactPositionals(command, 0);
+		return {
+			value: { version: WOJ_CLI_VERSION },
+			exitCode: 0
+		};
+	}
+	if (key === "config list") {
+		exactPositionals(command, 0);
+		return {
+			value: config,
+			exitCode: 0
+		};
+	}
+	if (key === "config get") {
+		const [name] = exactPositionals(command, 1);
+		if (!isConfigKey(name)) throw usageError(`Unknown config key '${name}'. Valid keys: ${CONFIG_KEYS.join(", ")}.`);
+		return {
+			value: {
+				key: name,
+				value: config[name] ?? null
+			},
+			exitCode: 0
+		};
+	}
+	if (key === "config set") {
+		const [name, value] = exactPositionals(command, 2);
+		if (!isConfigKey(name)) throw usageError(`Unknown config key '${name}'. Valid keys: ${CONFIG_KEYS.join(", ")}.`);
+		const next = {
+			...config,
+			[name]: validateConfigValue(name, value)
+		};
+		await dependencies.configStore.write(next);
+		return {
+			value: {
+				key: name,
+				value: next[name]
+			},
+			exitCode: 0
+		};
+	}
+	if (key === "config unset") {
+		const [name] = exactPositionals(command, 1);
+		if (!isConfigKey(name)) throw usageError(`Unknown config key '${name}'. Valid keys: ${CONFIG_KEYS.join(", ")}.`);
+		const next = { ...config };
+		delete next[name];
+		await dependencies.configStore.write(next);
+		return {
+			value: {
+				key: name,
+				removed: true
+			},
+			exitCode: 0
+		};
+	}
+	if (key === "init") {
+		const [directory = "."] = exactPositionals(command, 0, 1);
+		return {
+			value: await createWorkspace(path.resolve(dependencies.cwd, directory), {
+				name: stringOption(command, "name"),
+				language: stringOption(command, "language"),
+				target: stringOption(command, "target"),
+				optimization: stringOption(command, "optimization"),
+				entry: stringOption(command, "entry"),
+				force: booleanOption(command, "force")
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "build") {
+		exactPositionals(command, 0);
+		return localOutcome(await dependencies.local.build(dependencies.cwd, config));
+	}
+	if (key === "run") {
+		exactPositionals(command, 0);
+		return localOutcome(await dependencies.local.run(dependencies.cwd, config, {
+			stdin: await runInput(command, dependencies.cwd),
+			args: repeatableOption(command, "arg")
+		}));
+	}
+	if (key === "test") {
+		exactPositionals(command, 0);
+		return localOutcome(await dependencies.local.test(dependencies.cwd, config, { cases: repeatableOption(command, "case") }));
+	}
+	if (key === "bench") {
+		exactPositionals(command, 0);
+		return localOutcome(await dependencies.local.bench(dependencies.cwd, config, {
+			stdin: stringOption(command, "stdin"),
+			iterations: positiveInteger(stringOption(command, "iterations"), 10, 1e4, "iterations")
+		}));
+	}
+	if (key === "watch") {
+		exactPositionals(command, 0);
+		const action = stringOption(command, "command") ?? "test";
+		if (!(/* @__PURE__ */ new Set([
+			"build",
+			"run",
+			"test"
+		])).has(action)) throw usageError("--command must be build, run, or test.");
+		const execute = action === "build" ? () => dependencies.local.build(dependencies.cwd, config) : action === "run" ? () => dependencies.local.run(dependencies.cwd, config, { args: [] }) : () => dependencies.local.test(dependencies.cwd, config, { cases: [] });
+		return localOutcome(await watchLocalWorkspace(dependencies.cwd, execute, dependencies.onNotice));
+	}
+	if (key === "judge inspect") {
+		const [file] = exactPositionals(command, 1);
+		return localOutcome(await dependencies.local.inspectJudge(path.resolve(dependencies.cwd, file)));
+	}
+	if (key === "judge verify") {
+		const [file] = exactPositionals(command, 1);
+		return localOutcome(await dependencies.local.verifyJudge(path.resolve(dependencies.cwd, file), {
+			sha256: stringOption(command, "sha256"),
+			bytes: stringOption(command, "bytes") === void 0 ? void 0 : positiveInteger(stringOption(command, "bytes"), 1, 33554432, "bytes")
+		}));
+	}
+	if (key === "judge execute") {
+		const [file] = exactPositionals(command, 1);
+		const source = stringOption(command, "source");
+		if (!source) throw usageError("judge execute requires --source <woj-workspace-directory>.");
+		if (!booleanOption(command, "all")) throw usageError("judge execute requires --all to acknowledge that every packaged case may be exposed.");
+		return localOutcome(await dependencies.local.executeJudge(path.resolve(dependencies.cwd, source), config, path.resolve(dependencies.cwd, file)));
+	}
+	if (key === "toolchain list") {
+		exactPositionals(command, 0);
+		return localOutcome(await dependencies.local.toolchainList(config));
+	}
+	if (key === "toolchain info") {
+		const [id] = exactPositionals(command, 1);
+		return localOutcome(await dependencies.local.toolchainInfo(config, id));
+	}
+	if (key === "toolchain verify") {
+		const [id] = exactPositionals(command, 0, 1);
+		return localOutcome(await dependencies.local.toolchainVerify(config, id));
+	}
+	if (key === "toolchain prune") {
+		exactPositionals(command, 0);
+		if (!booleanOption(command, "yes")) throw usageError("toolchain prune requires --yes.");
+		return localOutcome(await dependencies.local.toolchainPrune(config));
+	}
+	if (key === "cache status") {
+		exactPositionals(command, 0);
+		return localOutcome(await dependencies.local.cacheStatus(config));
+	}
+	if (key === "cache prune") {
+		exactPositionals(command, 0);
+		if (!booleanOption(command, "yes")) throw usageError("cache prune requires --yes.");
+		return localOutcome(await dependencies.local.cachePrune(config));
+	}
+	if (key === "cache clear") {
+		exactPositionals(command, 0);
+		if (!booleanOption(command, "yes")) throw usageError("cache clear requires --yes.");
+		return localOutcome(await dependencies.local.cacheClear(config));
+	}
+	if (key === "doctor") {
+		exactPositionals(command, 0);
+		const result = await dependencies.local.doctor(dependencies.cwd, config);
+		return {
+			value: result.value,
+			exitCode: result.successful ? 0 : 7
+		};
+	}
+	if (key === "completion") {
+		const [shell] = exactPositionals(command, 1);
+		return {
+			value: completion(shell),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer collection init") {
+		const [directory = "."] = exactPositionals(command, 0, 1);
+		return createCollectionSkeleton(path.resolve(dependencies.cwd, directory), booleanOption(command, "force"));
+	}
+	if (key === "organizer collection build" || key === "organizer collection verify") {
+		const [directory = "."] = exactPositionals(command, 0, 1);
+		const arguments_ = [key.endsWith("build") ? "build" : "verify", path.resolve(dependencies.cwd, directory)];
+		for (const name of [
+			"index",
+			"source",
+			"managed",
+			"managed-source"
+		]) {
+			const value = stringOption(command, name);
+			if (value !== void 0) arguments_.push(`--${name}`, normalizedRelativePath(value, `--${name}`));
+		}
+		if (key.endsWith("build") && stringOption(command, "managed") !== void 0 && stringOption(command, "managed-source") === void 0) throw usageError("--managed requires --managed-source when building.");
+		try {
+			await dependencies.collectionCli(arguments_);
+		} catch (error) {
+			throw new CliError(error instanceof Error ? error.message : "Collection operation failed.", {
+				exitCode: 4,
+				code: "collection-invalid",
+				cause: error
+			});
+		}
+		return {
+			value: {
+				command: arguments_[0],
+				directory: arguments_[1]
+			},
+			exitCode: 0
+		};
+	}
+	const { origin, client } = await configured(command, dependencies);
+	if (key === "toolchain fetch") {
+		const [id] = exactPositionals(command, 1);
+		return localOutcome(await dependencies.local.toolchainFetch(config, origin, id));
+	}
+	if (key === "auth login") {
+		exactPositionals(command, 0);
+		const deviceName = stringOption(command, "device-name") ?? `${process.platform} woj`;
+		if (!deviceName || deviceName !== deviceName.normalize("NFC") || deviceName !== deviceName.trim() || new TextEncoder().encode(deviceName).byteLength > 80 || /[\p{Cc}\p{Cf}\p{Cs}]/u.test(deviceName)) throw usageError("--device-name must be trimmed NFC text containing 1–80 visible UTF-8 bytes.");
+		return {
+			value: await deviceLogin(client, dependencies.tokenStore, dependencies.opener, {
+				deviceName,
+				onVerification: dependencies.onNotice,
+				sleep: dependencies.sleep
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "auth logout") {
+		exactPositionals(command, 0);
+		return logout(origin, client, dependencies.tokenStore);
+	}
+	if (key === "auth status") {
+		exactPositionals(command, 0);
+		return {
+			value: {
+				server: origin,
+				session: await client.request("/api/auth/session", { authenticated: "optional" })
+			},
+			exitCode: 0
+		};
+	}
+	if (key === "problem list") {
+		exactPositionals(command, 0);
+		const locale = localeOption(command);
+		return {
+			value: localizedList(await client.request("/api/problems", { authenticated: "optional" }), locale),
+			exitCode: 0
+		};
+	}
+	if (key === "problem show") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "problem-version-id");
+		const contestId = stringOption(command, "contest");
+		if (contestId) uuid(contestId, "contest");
+		const locale = localeOption(command);
+		const downloaded = await exactPublicProblem(client, id, contestId);
+		const problem = downloaded.problem;
+		return {
+			value: {
+				problemVersionId: id,
+				catalogPublicationId: downloaded.metadata.catalogPublicationId,
+				content: downloaded.metadata.content,
+				locale,
+				title: problem.title[locale],
+				track: problem.track[locale],
+				difficulty: problem.difficulty,
+				tags: problem.tags,
+				statement: problem.statement[locale],
+				editorial: problem.editorial[locale],
+				samples: problem.judgeCases.filter((testCase) => testCase.kind === "sample"),
+				availableLanguages: Object.keys(problem.starterTemplates).sort()
+			},
+			exitCode: 0
+		};
+	}
+	if (key === "problem pull") return problemPull(command, dependencies, client);
+	if (key === "submit") return submit(command, dependencies, client);
+	if (key === "submission list") {
+		exactPositionals(command, 0);
+		const next = cursor(stringOption(command, "cursor"), ["before", "beforeId"], "submission cursor");
+		if (next.before) {
+			canonicalCursorTimestamp(next.before, "submission cursor");
+			uuid(next.beforeId, "submission cursor beforeId");
+		}
+		return {
+			value: await client.request(`/api/submissions${query({
+				limit: boundedIntegerOption(command, "limit", 100),
+				before: next.before,
+				beforeId: next.beforeId
+			})}`),
+			exitCode: 0
+		};
+	}
+	if (key === "submission show") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "submission-id");
+		return {
+			value: await client.request(`/api/submissions/${id}`),
+			exitCode: 0
+		};
+	}
+	if (key === "submission watch") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "submission-id");
+		return submissionWatch(client, id, positiveInteger(stringOption(command, "interval"), 2, 30, "interval") * 1e3, dependencies.sleep);
+	}
+	if (key === "submission cancel") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "submission-id");
+		return {
+			value: await client.request(`/api/submissions/${id}/cancel`, {
+				method: "POST",
+				body: {}
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "submission source") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "submission-id");
+		return {
+			value: await client.request(`/api/submissions/${id}/source`),
+			exitCode: 0
+		};
+	}
+	if (key === "submission policy") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "submission-id");
+		return {
+			value: await client.request(`/api/submissions/${id}/policy-summary`),
+			exitCode: 0
+		};
+	}
+	if (key === "contest list") {
+		exactPositionals(command, 0);
+		return {
+			value: await client.request("/api/contests", { authenticated: "optional" }),
+			exitCode: 0
+		};
+	}
+	if (key === "contest show" || key === "contest problems") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "contest-id");
+		const value = object(await client.request(`/api/contests/${id}`, { authenticated: "optional" }), "contest");
+		return {
+			value: key.endsWith("problems") ? { problems: array(value.problems, "contest problems") } : value,
+			exitCode: 0
+		};
+	}
+	if (key === "contest join") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "contest-id");
+		const code = await readProtectedTextFile(dependencies.cwd, stringOption(command, "code-file"), "--code-file");
+		if (code !== void 0 && (code.length < 16 || code.length > 128)) throw usageError("--code-file must contain 16–128 characters.");
+		return {
+			value: await client.request(`/api/contests/${id}/join`, {
+				method: "POST",
+				body: { ...code ? { inviteCode: code } : {} }
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "contest standings") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "contest-id");
+		return {
+			value: await client.request(`/api/contests/${id}/leaderboard${query({ limit: boundedIntegerOption(command, "limit", 100) })}`, { authenticated: "optional" }),
+			exitCode: 0
+		};
+	}
+	if (key === "performance frontier" || key === "performance evolution") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "problem-version-id");
+		const language = stringOption(command, "language");
+		if (language !== void 0 && !LANGUAGES.includes(language)) throw usageError("--language must name a supported language.");
+		const contestId = stringOption(command, "contest");
+		if (contestId !== void 0) uuid(contestId, "contest");
+		const value = object(await client.request(`/api/problems/${id}/performance${query({
+			language,
+			contestId
+		})}`, { authenticated: key.endsWith("frontier") ? "optional" : true }), "performance");
+		return {
+			value: key.endsWith("frontier") ? {
+				context: value.context,
+				frontier: value.frontier
+			} : {
+				context: value.context,
+				myEvolution: value.myEvolution
+			},
+			exitCode: 0
+		};
+	}
+	if (key === "organizer repo list" || key === "organizer repo show") {
+		if (key.endsWith("list")) exactPositionals(command, 0);
+		const id = key.endsWith("show") ? exactPositionals(command, 1)[0] : void 0;
+		if (id !== void 0) positiveInteger(id, 1, Number.MAX_SAFE_INTEGER, "repository-id");
+		const values = object(await client.request("/api/organizer/repositories"), "repositories");
+		if (key.endsWith("list")) return {
+			value: values,
+			exitCode: 0
+		};
+		const repository = array(values.repositories, "repositories").find((item) => String(object(item, "repository").id ?? object(item, "repository").github_repository_id) === id);
+		if (!repository) throw new CliError(`Repository '${id}' is not in your Organizer scope.`, { exitCode: 5 });
+		return {
+			value: { repository },
+			exitCode: 0
+		};
+	}
+	if (key === "organizer collection list") {
+		exactPositionals(command, 0);
+		return {
+			value: await client.request("/api/organizer/collections"),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer collection show") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "collection-id");
+		return {
+			value: await client.request(`/api/organizer/collections/${id}`),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer collection create") {
+		exactPositionals(command, 0);
+		const repository = stringOption(command, "repo");
+		const index = stringOption(command, "index") ?? "collection/index.json";
+		if (!repository) throw usageError("--repo must be a GitHub numeric repository ID.");
+		const repositoryId = positiveInteger(repository, 1, Number.MAX_SAFE_INTEGER, "--repo");
+		return {
+			value: await client.request("/api/organizer/collections", {
+				method: "POST",
+				body: {
+					githubRepositoryId: repositoryId,
+					indexPath: normalizedRelativePath(index, "--index")
+				}
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer collection validate") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "collection-id");
+		const ref = stringOption(command, "ref");
+		if (!ref || ref.length > 256 || /[\u0000-\u001f\u007f]/u.test(ref)) throw usageError("--ref must be a 1–256 character printable Git ref.");
+		const created = await client.request(`/api/organizer/collections/${id}/validations`, {
+			method: "POST",
+			body: { ref }
+		});
+		if (!booleanOption(command, "wait")) return {
+			value: created,
+			exitCode: 0
+		};
+		const validation = object(object(created, "validation creation").validation, "validation");
+		const initialState = field(validation, "state", "validation state");
+		if (TERMINAL_VALIDATION_STATES.has(initialState)) return {
+			value: created,
+			exitCode: initialState === "valid" ? 0 : 1
+		};
+		return watchResource({
+			client,
+			path: `/api/organizer/validations/${serverUuid(validation, "id", "validation ID")}`,
+			envelope: "validation",
+			terminal: TERMINAL_VALIDATION_STATES,
+			success: /* @__PURE__ */ new Set(["valid"]),
+			intervalMs: 2e3,
+			sleep: dependencies.sleep
+		});
+	}
+	if (key === "organizer collection validation") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "validation-id");
+		if (!booleanOption(command, "watch")) return {
+			value: await client.request(`/api/organizer/validations/${id}`),
+			exitCode: 0
+		};
+		return watchResource({
+			client,
+			path: `/api/organizer/validations/${id}`,
+			envelope: "validation",
+			terminal: TERMINAL_VALIDATION_STATES,
+			success: /* @__PURE__ */ new Set(["valid"]),
+			intervalMs: positiveInteger(stringOption(command, "interval"), 2, 30, "interval") * 1e3,
+			sleep: dependencies.sleep
+		});
+	}
+	if (key === "organizer collection publish") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "revision-id");
+		const mode = stringOption(command, "mode") ?? "official-practice";
+		if (mode !== "official-practice" && mode !== "contest") throw usageError("--mode must be official-practice or contest.");
+		const created = await client.request(`/api/organizer/revisions/${id}/publications`, {
+			method: "POST",
+			body: {
+				mode,
+				idempotencyKey: `woj-publish-${randomUUID()}`
+			}
+		});
+		if (!booleanOption(command, "wait")) return {
+			value: created,
+			exitCode: 0
+		};
+		return watchResource({
+			client,
+			path: `/api/organizer/publications/${serverUuid(object(object(created, "publication creation").publicationJob, "publication job"), "id", "publication job ID")}`,
+			envelope: "publication",
+			terminal: TERMINAL_PUBLICATION_STATES,
+			success: /* @__PURE__ */ new Set(["published"]),
+			intervalMs: 2e3,
+			sleep: dependencies.sleep
+		});
+	}
+	if (key === "organizer collection publication") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "publication-job-id");
+		if (!booleanOption(command, "watch")) return {
+			value: await client.request(`/api/organizer/publications/${id}`),
+			exitCode: 0
+		};
+		return watchResource({
+			client,
+			path: `/api/organizer/publications/${id}`,
+			envelope: "publication",
+			terminal: TERMINAL_PUBLICATION_STATES,
+			success: /* @__PURE__ */ new Set(["published"]),
+			intervalMs: positiveInteger(stringOption(command, "interval"), 2, 30, "interval") * 1e3,
+			sleep: dependencies.sleep
+		});
+	}
+	if (key === "organizer collection activate") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "publication-id");
+		return {
+			value: await client.request(`/api/organizer/publications/${id}/activate`, {
+				method: "POST",
+				body: {}
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest list") {
+		exactPositionals(command, 0);
+		return {
+			value: await client.request("/api/organizer/contests"),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest show") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "contest-id");
+		return {
+			value: await client.request(`/api/organizer/contests/${id}`),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest create") {
+		exactPositionals(command, 0);
+		const body = await contestBody(command, dependencies.cwd);
+		for (const name of [
+			"title",
+			"startsAt",
+			"endsAt",
+			"accessMode",
+			"problemVersionIds"
+		]) if (body[name] === void 0) throw usageError(`contest create requires ${name}.`);
+		if (body.description === void 0) body.description = "";
+		if (body.accessMode === "invite" && body.inviteCode === void 0) throw usageError("Invite contests require --invite-code-file.");
+		return {
+			value: await client.request("/api/contests", {
+				method: "POST",
+				body
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest update") {
+		const [contestId] = exactPositionals(command, 1);
+		const id = uuid(contestId, "contest-id");
+		const draft = await currentContestDraft(client, id);
+		return {
+			value: await client.request(`/api/organizer/contests/${id}`, {
+				method: "PUT",
+				body: await contestBody(command, dependencies.cwd, draft.body)
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest add-problem" || key === "organizer contest remove-problem") {
+		const [contestId, problemVersionId] = exactPositionals(command, 2);
+		const id = uuid(contestId, "contest-id");
+		const problem = uuid(problemVersionId, "problem-version-id");
+		return {
+			value: await client.request(`/api/organizer/contests/${id}/problems/${problem}`, {
+				method: key.endsWith("add-problem") ? "POST" : "DELETE",
+				body: {}
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest publish") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "contest-id");
+		return {
+			value: await client.request(`/api/contests/${id}/publish`, {
+				method: "POST",
+				body: {}
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest archive") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "contest-id");
+		return {
+			value: await client.request(`/api/organizer/contests/${id}/archive`, {
+				method: "POST",
+				body: {}
+			}),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest participants") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "contest-id");
+		const next = cursor(stringOption(command, "cursor"), ["afterJoinedAt", "afterUserId"], "participant cursor");
+		if (next.afterJoinedAt) {
+			canonicalCursorTimestamp(next.afterJoinedAt, "participant cursor");
+			uuid(next.afterUserId, "participant cursor afterUserId");
+		}
+		return {
+			value: await client.request(`/api/organizer/contests/${id}/participants${query({
+				limit: boundedIntegerOption(command, "limit", 100),
+				afterJoinedAt: next.afterJoinedAt,
+				afterUserId: next.afterUserId
+			})}`),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer contest standings") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "contest-id");
+		return {
+			value: await client.request(`/api/contests/${id}/leaderboard${query({ limit: boundedIntegerOption(command, "limit", 100) })}`),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer rejudge options") {
+		const [source] = exactPositionals(command, 1);
+		uuid(source, "problem-version-id");
+		return {
+			value: await client.request(`/api/organizer/rejudges/options${query({ source })}`),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer rejudge start") {
+		exactPositionals(command, 0);
+		const from = stringOption(command, "from");
+		const to = stringOption(command, "to");
+		if (!from || !to) throw usageError("rejudge start requires --from and --to.");
+		uuid(from, "from");
+		uuid(to, "to");
+		const created = await client.request("/api/organizer/rejudges", {
+			method: "POST",
+			body: {
+				oldProblemVersionId: from,
+				newProblemVersionId: to,
+				idempotencyKey: `woj-rejudge-${randomUUID()}`
+			}
+		});
+		if (!booleanOption(command, "wait")) return {
+			value: created,
+			exitCode: 0
+		};
+		return watchResource({
+			client,
+			path: `/api/organizer/rejudges/${serverUuid(object(created, "rejudge creation"), "rejudgeBatchId")}`,
+			envelope: "rejudgeBatch",
+			terminal: TERMINAL_REJUDGE_STATES,
+			success: /* @__PURE__ */ new Set(["effective"]),
+			intervalMs: 2e3,
+			sleep: dependencies.sleep
+		});
+	}
+	if (key === "organizer rejudge list") {
+		exactPositionals(command, 0);
+		return {
+			value: await client.request(`/api/organizer/rejudges${query({ limit: boundedIntegerOption(command, "limit", 100) })}`),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer rejudge show") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "batch-id");
+		return {
+			value: await client.request(`/api/organizer/rejudges/${id}`),
+			exitCode: 0
+		};
+	}
+	if (key === "organizer rejudge watch") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "batch-id");
+		return watchResource({
+			client,
+			path: `/api/organizer/rejudges/${id}`,
+			envelope: "rejudgeBatch",
+			terminal: TERMINAL_REJUDGE_STATES,
+			success: /* @__PURE__ */ new Set(["effective"]),
+			intervalMs: positiveInteger(stringOption(command, "interval"), 2, 30, "interval") * 1e3,
+			sleep: dependencies.sleep
+		});
+	}
+	if (key === "organizer rejudge cancel") {
+		const [id] = exactPositionals(command, 1);
+		uuid(id, "batch-id");
+		return {
+			value: await client.request(`/api/organizer/rejudges/${id}/cancel`, {
+				method: "POST",
+				body: {}
+			}),
+			exitCode: 0
+		};
+	}
+	throw new CliError(`Command '${key}' has no handler.`, {
+		exitCode: 6,
+		code: "handler-missing"
+	});
+}
+//#endregion
+//#region src/cli/help.ts
+var ROOT_HELP = `woj ${WOJ_CLI_VERSION} — local-first WASM-OJ
+
+Usage: woj [--offline] [--json] [--server origin] <command> [options]
+
+Local engine:   init, build, run, test, bench, watch, judge, toolchain
+Student:        auth, problem, submit, submission, contest, performance
+Organizer:      organizer repo, organizer collection, organizer contest, organizer rejudge
+Operations:     config, cache, doctor, completion, version
+
+Boundaries:
+  Local commands use only bytes already on this machine.
+  Remote commands address immutable server resources and require authentication where noted.
+  --offline rejects every command that could access the network before dispatch.
+
+Run 'woj <command> --help' for command details.`;
+function helpText(prefix) {
+	if (prefix.length === 0) return ROOT_HELP;
+	const exact = WOJ_COMMANDS.find((command) => command.path.length === prefix.length && prefix.every((part, index) => command.path[index] === part));
+	const children = WOJ_COMMANDS.filter((command) => command.path.length > prefix.length && prefix.every((part, index) => command.path[index] === part)).map((command) => ({
+		name: command.path[prefix.length],
+		command
+	}));
+	if (exact && children.length === 0) {
+		const optionLines = Object.entries(exact.options ?? {}).map(([name, kind]) => `  --${name}${kind === "boolean" ? "" : " <value>"}`);
+		return [
+			exact.summary,
+			"",
+			`Usage: woj ${exact.path.join(" ")}${exact.usage ? ` ${exact.usage}` : ""}${optionLines.length ? " [options]" : ""}`,
+			`Boundary: ${exact.boundary}`,
+			...optionLines.length ? [
+				"",
+				"Options:",
+				...optionLines
+			] : []
+		].join("\n");
+	}
+	const unique = /* @__PURE__ */ new Map();
+	for (const child of children) {
+		const direct = child.command.path.length === prefix.length + 1;
+		unique.set(child.name, direct ? child.command.summary : `${child.name} commands`);
+	}
+	return [
+		`Usage: woj ${prefix.join(" ")} <command>`,
+		"",
+		"Commands:",
+		...[...unique].sort(([left], [right]) => left.localeCompare(right)).map(([name, summary]) => `  ${name.padEnd(16)} ${summary}`)
+	].join("\n");
+}
+//#endregion
+//#region src/cli/parser.ts
+var GLOBAL_OPTIONS = /* @__PURE__ */ new Set([
+	"offline",
+	"json",
+	"server"
+]);
+function takeGlobal(arguments_) {
+	const rest = [];
+	let offline = false;
+	let json = false;
+	let server;
+	let help = false;
+	let version = false;
+	for (let index = 0; index < arguments_.length; index += 1) {
+		const argument = arguments_[index];
+		if (argument === "--") {
+			rest.push(...arguments_.slice(index + 1));
+			break;
+		}
+		if (argument === "--offline") offline = true;
+		else if (argument === "--json") json = true;
+		else if (argument === "--help" || argument === "-h") help = true;
+		else if (argument === "--version" || argument === "-V") version = true;
+		else if (argument === "--server") {
+			const value = arguments_[index + 1];
+			if (!value || value.startsWith("-")) throw usageError("--server requires an origin.");
+			server = value;
+			index += 1;
+		} else rest.push(argument);
+	}
+	return {
+		rest,
+		offline,
+		json,
+		...server ? { server } : {},
+		help,
+		version
+	};
+}
+function matchingCommand(words) {
+	let match;
+	for (let count = 1; count <= words.length; count += 1) {
+		const spec = COMMAND_BY_KEY.get(words.slice(0, count).join(" "));
+		if (spec) match = {
+			spec,
+			consumed: count
+		};
+	}
+	return match;
+}
+function knownPrefix(words) {
+	return WOJ_COMMANDS.some((command) => words.length <= command.path.length && words.every((word, index) => command.path[index] === word));
+}
+function parseLeafArguments(spec, arguments_) {
+	const positionals = [];
+	const options = {};
+	for (let index = 0; index < arguments_.length; index += 1) {
+		const argument = arguments_[index];
+		if (argument === "--") {
+			positionals.push(...arguments_.slice(index + 1));
+			break;
+		}
+		if (!argument.startsWith("--")) {
+			if (argument.startsWith("-") && argument !== "-") throw usageError(`Unknown option '${argument}'.`);
+			positionals.push(argument);
+			continue;
+		}
+		const equals = argument.indexOf("=");
+		const name = argument.slice(2, equals < 0 ? void 0 : equals);
+		if (!name || GLOBAL_OPTIONS.has(name)) throw usageError(`Global option '--${name}' must appear before the command.`);
+		const kind = spec.options?.[name];
+		if (!kind) throw usageError(`Unknown option '--${name}' for '${spec.path.join(" ")}'.`);
+		if (kind === "boolean") {
+			if (equals >= 0) throw usageError(`--${name} does not accept a value.`);
+			options[name] = true;
+			continue;
+		}
+		const value = equals >= 0 ? argument.slice(equals + 1) : arguments_[index + 1];
+		if (!value || equals < 0 && value.startsWith("--")) throw usageError(`--${name} requires a value.`);
+		if (equals < 0) index += 1;
+		if (kind === "repeatable") {
+			const current = options[name];
+			options[name] = [...Array.isArray(current) ? current : [], value];
+		} else {
+			if (name in options) throw usageError(`--${name} may be provided only once.`);
+			options[name] = value;
+		}
+	}
+	return {
+		positionals,
+		options
+	};
+}
+function parseCli(arguments_) {
+	const global = takeGlobal(arguments_);
+	if (global.version) return { kind: "version" };
+	if (global.rest.length === 0) return {
+		kind: "help",
+		prefix: []
+	};
+	const match = matchingCommand(global.rest);
+	if (global.help) {
+		const prefix = match?.spec.path ?? global.rest.filter((part) => !part.startsWith("-"));
+		if (!knownPrefix(prefix)) throw usageError(`Unknown command '${prefix.join(" ")}'.`);
+		return {
+			kind: "help",
+			prefix
+		};
+	}
+	if (!match) {
+		const prefix = global.rest.filter((part) => !part.startsWith("-"));
+		if (knownPrefix(prefix)) return {
+			kind: "help",
+			prefix
+		};
+		throw usageError(`Unknown command '${prefix.join(" ")}'. Run 'woj --help'.`);
+	}
+	const leaf = parseLeafArguments(match.spec, global.rest.slice(match.consumed));
+	return {
+		kind: "command",
+		command: {
+			spec: match.spec,
+			...leaf,
+			global: {
+				offline: global.offline,
+				json: global.json,
+				...global.server ? { server: global.server } : {}
+			}
+		}
+	};
+}
+//#endregion
+//#region src/cli/index.ts
+function defaultIo() {
+	return {
+		stdout: (text) => process.stdout.write(text),
+		stderr: (text) => process.stderr.write(text)
+	};
+}
+var TERMINAL_CONTROL = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/gu;
+function escapedCodePoint(value) {
+	return [...value].map((character) => `\\u{${character.codePointAt(0).toString(16).padStart(4, "0")}}`).join("");
+}
+function terminalText(value) {
+	return value.replace(TERMINAL_CONTROL, escapedCodePoint).replaceAll("\r", "\\u{000d}");
+}
+function terminalLine(value, maximumCodePoints) {
+	const sanitized = terminalText(value).replace(/[\n\t\u2028\u2029]+/gu, " ").trim();
+	const codePoints = [...sanitized];
+	return codePoints.length <= maximumCodePoints ? sanitized : `${codePoints.slice(0, maximumCodePoints).join("")}…`;
+}
+function terminalJson(value) {
+	return (JSON.stringify(value, null, 2) ?? "null").replace(/[\u007f-\u009f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/gu, (character) => `\\u${character.codePointAt(0).toString(16).padStart(4, "0")}`);
+}
+function printValue(io, value, json) {
+	if (typeof value === "string" && !json) {
+		io.stdout(`${terminalText(value)}\n`);
+		return;
+	}
+	io.stdout(`${terminalJson(value)}\n`);
+}
+function printError(io, error, json) {
+	if (json) io.stderr(`${terminalJson({ error: {
+		code: error.code,
+		message: error.message,
+		exitCode: error.exitCode
+	} })}\n`);
+	else io.stderr(`error[${terminalLine(error.code, 80) || "cli-error"}]: ${terminalLine(error.message, 2e3) || "The CLI failed."}\n`);
+}
+async function runWojCli(arguments_, provided = {}) {
+	const io = provided.io ?? defaultIo();
+	let json = arguments_.includes("--json");
+	try {
+		const parsed = parseCli(arguments_);
+		if (parsed.kind === "help") {
+			io.stdout(`${helpText(parsed.prefix)}\n`);
+			return WOJ_EXIT.success;
+		}
+		if (parsed.kind === "version") {
+			io.stdout(`woj ${WOJ_CLI_VERSION}\n`);
+			return WOJ_EXIT.success;
+		}
+		json = parsed.command.global.json;
+		if (parsed.command.global.offline && parsed.command.spec.boundary !== "local") throw usageError(`'woj ${parsed.command.spec.path.join(" ")}' can access the network and is disabled by --offline.`);
+		const tokenStore = provided.tokenStore ?? new OsKeychainTokenStore();
+		const dependencies = {
+			cwd: provided.cwd ?? process.cwd(),
+			configStore: provided.configStore ?? new JsonConfigStore(),
+			tokenStore,
+			local: provided.local ?? new NodeLocalRuntime(),
+			collectionCli: provided.collectionCli ?? runCollectionCli,
+			remote: provided.remote ?? ((origin) => new HttpRemoteClient(origin, tokenStore)),
+			opener: provided.opener ?? new SystemBrowserOpener(),
+			sleep: provided.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))),
+			onNotice: (message) => io.stderr(`${terminalLine(message, 4e3)}\n`)
+		};
+		const outcome = await dispatchCommand(parsed.command, dependencies);
+		printValue(io, outcome.value, json);
+		return outcome.exitCode;
+	} catch (error) {
+		const cliError = asCliError(error);
+		printError(io, cliError, json);
+		return cliError.exitCode;
+	}
+}
+async function main(arguments_) {
+	return runWojCli(arguments_);
+}
+//#endregion
+export { ApiError, CLI_TOOLCHAIN_DESCRIPTORS, COMMAND_BY_KEY, CONFIG_KEYS, CliError, HttpRemoteClient, JsonConfigStore, LANGUAGES, MemoryConfigStore, MemoryTokenStore, NodeLocalRuntime, OsKeychainTokenStore, WOJ_ACCESS_TOKEN, WOJ_CLI_VERSION, WOJ_COMMANDS, WOJ_EXIT, WOJ_WORKSPACE_SCHEMA, WORKSPACE_FILE, asCliError, commandKey, createWorkspace, defaultConfigDirectory, defaultConfigPath, deviceLogin, isConfigKey, isWojAccessToken, judgeSucceeded, main, parseCli, parseConfig, parsePublicProblem, parseWorkspace, readWorkspace, readWorkspaceFileBytes, readWorkspaceSources, runWojCli, unavailableError, usageError, validateConfigValue, writeWorkspace };