cherry-works 0.1.0

package/dist/main.js

@@ -0,0 +1,4086 @@
+#!/usr/bin/env node
+
+// main.ts
+import { pathToFileURL as pathToFileURL2 } from "url";
+
+// package.json
+var package_default = {
+  name: "cherry-works",
+  version: "0.1.0",
+  description: "The charter engine: resolves a charter and compiles it into what a coding agent reads.",
+  keywords: [
+    "claude-code",
+    "coding-agent",
+    "charter",
+    "ai-agents",
+    "cli",
+    "guardrails"
+  ],
+  homepage: "https://github.com/tamnguyenvt/cherry-works#readme",
+  bugs: {
+    url: "https://github.com/tamnguyenvt/cherry-works/issues"
+  },
+  repository: {
+    type: "git",
+    url: "git+https://github.com/tamnguyenvt/cherry-works.git"
+  },
+  license: "MIT",
+  author: "Tam Nguyen",
+  type: "module",
+  engines: {
+    node: ">=22",
+    pnpm: ">=10"
+  },
+  packageManager: "pnpm@10.2.1",
+  bin: {
+    cw: "./dist/cw.js"
+  },
+  files: [
+    "dist"
+  ],
+  imports: {
+    "#hexagon/*": "./src/hexagon/*",
+    "#portal/*": "./dist/portal/*"
+  },
+  scripts: {
+    build: "tsup && tailwindcss -i src/driver/portal/page/styles.css -o dist/portal/styles.css --minify",
+    typecheck: "tsc --noEmit && tsc --noEmit -p src/driver/portal/page",
+    test: 'pnpm run lint:deps && pnpm run build && node --import tsx --test "test/**/*.test.ts"',
+    cw: "node --import tsx main.ts",
+    "lint:deps": "depcruise src main.ts",
+    "specs:link": "node --import tsx scripts/link-specs.ts",
+    "specs:check": "node --import tsx scripts/link-specs.ts --check",
+    release: "node --import tsx scripts/release.ts",
+    prepublishOnly: `node -e "console.error('Publish with \\"pnpm release <version>\\", which checks the package first.'); process.exit(1)"`
+  },
+  devDependencies: {
+    "@codemirror/commands": "^6.11.1",
+    "@codemirror/lang-markdown": "^6.5.2",
+    "@codemirror/language": "^6.12.4",
+    "@codemirror/state": "^6.7.4",
+    "@codemirror/view": "^6.43.11",
+    "@tailwindcss/cli": "^4.3.3",
+    "@tanstack/react-query": "^5.103.2",
+    "@types/node": "^22.10.2",
+    "@types/picomatch": "^4.0.3",
+    "@types/prompts": "^2.4.9",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@types/yargs": "^17.0.35",
+    "class-variance-authority": "^0.7.1",
+    clsx: "^2.1.1",
+    cmdk: "^1.1.1",
+    "dependency-cruiser": "^18.2.0",
+    "lucide-react": "^1.47.0",
+    marked: "^18.0.13",
+    playwright: "^1.63.0",
+    "radix-ui": "^1.6.7",
+    react: "^19.3.0",
+    "react-dom": "^19.3.0",
+    sonner: "^2.0.8",
+    "tailwind-merge": "^3.7.0",
+    tailwindcss: "^4.3.3",
+    tsup: "^8.3.5",
+    tsx: "^4.19.2",
+    "tw-animate-css": "^1.4.0",
+    typescript: "^5.7.2"
+  },
+  pnpm: {
+    onlyBuiltDependencies: [
+      "esbuild"
+    ]
+  },
+  dependencies: {
+    "@hono/node-server": "^2.1.1",
+    "@hono/zod-openapi": "^1.6.3",
+    hono: "^4.13.7",
+    picomatch: "^4.0.7",
+    prompts: "^2.4.2",
+    yaml: "^2.9.0",
+    yargs: "^18.1.0",
+    zod: "^4.6.1"
+  }
+};
+
+// src/driver/cli/Commander.ts
+import yargs from "yargs";
+
+// src/hexagon/domain/models/Fault.ts
+var Fault = class extends Error {
+  constructor(message, fix, severity = "error") {
+    super(message);
+    this.fix = fix;
+    this.severity = severity;
+    this.name = new.target.name;
+  }
+  fix;
+  severity;
+};
+var CharterRootFault = class extends Fault {
+};
+var SettingsFault = class extends Fault {
+};
+var CharterPrimitiveFault = class extends Fault {
+};
+var TestSuiteFault = class extends Fault {
+};
+var TestCaseFault = class extends Fault {
+};
+var VendorFault = class extends Fault {
+};
+function throwAggregateError(faults2) {
+  throw new AggregateError(faults2, faults2.map((one) => one.message).join(" "));
+}
+var FaultsByFile = class _FaultsByFile {
+  /** Nothing wrong with any file. */
+  static none = new _FaultsByFile({});
+  #files;
+  constructor(files) {
+    this.#files = files;
+  }
+  /** Every fault, under the file it is wrong with. */
+  get files() {
+    return this.#files;
+  }
+  /** Is no file wrong at all? */
+  get isEmpty() {
+    return Object.keys(this.#files).length === 0;
+  }
+  /** These and the other's together, a file both name holding the faults of
+   *  both. */
+  with(other) {
+    const files = { ...this.#files };
+    for (const [file, faults2] of Object.entries(other.#files)) files[file] = [...files[file] ?? [], ...faults2];
+    return new _FaultsByFile(files);
+  }
+  /** What is wrong badly enough to stop a build, under the file that has to
+   *  change. A file whose every fault is a warning is not in here at all
+   *  (FR-005). */
+  errors() {
+    return new _FaultsByFile(
+      Object.fromEntries(
+        Object.entries(this.#files).map(([file, faults2]) => [file, faults2.filter((one) => one.severity === "error")]).filter(([, faults2]) => faults2.length > 0)
+      )
+    );
+  }
+  /** The same faults, each file named the way an author would type it: where
+   *  it sits under the repository they ran in, where the file is the `href` it
+   *  was read from. */
+  namedFrom(repo) {
+    return new _FaultsByFile(Object.fromEntries(Object.entries(this.#files).map(([file, faults2]) => [nameOf(file, repo), faults2])));
+  }
+};
+var Faults = class {
+  constructor(faults2) {
+    this.faults = faults2;
+  }
+  faults;
+};
+function nameOf(file, repo) {
+  const at = `${repo.href.replace(/\/$/, "")}/`;
+  return decodeURIComponent(file.startsWith(at) ? file.slice(at.length) : file);
+}
+
+// src/hexagon/domain/models/AgentProvider.ts
+var AGENT_PROVIDERS = ["claude"];
+function isAgentProvider(name) {
+  return typeof name === "string" && AGENT_PROVIDERS.includes(name);
+}
+
+// src/hexagon/utils/globs.ts
+import picomatch from "picomatch";
+function covers(outer, inner) {
+  return outer === inner || matches(outer, inner);
+}
+function matches(glob, path) {
+  return picomatch(glob, { dot: true })(path);
+}
+
+// src/hexagon/domain/models/charter/primitive/Primitive.ts
+import { z as z4 } from "zod";
+
+// src/hexagon/domain/models/charter/primitive/BasePrimitive.ts
+import { z } from "zod";
+
+// src/hexagon/domain/models/helper.ts
+function formatFrontmatterValue(value) {
+  return Array.isArray(value) ? `[${value.map((one) => JSON.stringify(one)).join(", ")}]` : String(value);
+}
+
+// src/hexagon/domain/models/charter/primitive/BasePrimitive.ts
+var DELIMITER = "---";
+var goodLine = z.string().regex(/\S/);
+var goodArray = z.array(goodLine).min(1).readonly();
+var CommonHeaders = z.object({
+  id: z.string().regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
+  /** All an agent reads of a primitive before opening its body. */
+  description: goodLine,
+  tags: z.array(goodLine).readonly().optional(),
+  /** The files this primitive speaks about, where it speaks about any. A guide's
+   *  are what decide when its body is loaded; a mixin may name them to say how
+   *  far what it lends reaches (FR-006). */
+  globs: z.array(goodLine).readonly().optional(),
+  /** `corpus:<id>`, the reasoning this primitive cites (FR-005). */
+  rationale: goodLine.optional(),
+  mixins: z.array(goodLine).readonly().optional()
+});
+var BasePrimitive = class {
+  constructor(headers, body) {
+    this.headers = headers;
+    this.body = body;
+  }
+  headers;
+  body;
+  /** What every kind requires of its author, whatever else its own contract
+   *  asks for. A kind's own `requires` stands beside this rather than adding to
+   *  it, so whoever asks for a kind's headers asks for both (FR-039). `id` is
+   *  not among them: a primitive is named where it is asked for rather than
+   *  answered for, so what is left to ask about is what it is for. */
+  static requires = { description: "line" };
+  /** The schema every kind's headers are read by, its own standing in place of
+   *  this. What a file is refused against, and the one place saying what shape
+   *  each header holds — including the ones a kind takes without requiring, so
+   *  whoever is writing a header reads its shape off the same contract a file
+   *  is refused against (FR-004). */
+  static schema = CommonHeaders;
+  /**
+   * This primitive as the file it is authored in: its headers between the
+   * delimiters, and its body under them.
+   *
+   * The other direction of the reading `primitiveOf` does, and the same
+   * frontmatter, so a file written here is a file that reads back as this
+   * primitive. Said here rather than by whoever writes, for the reason
+   * `description` is: what a primitive holds is the primitive's own, and a
+   * caller holding one already has everything the file says.
+   *
+   * The kind leads, since it is what decides how the rest is read (FR-003). A
+   * list is written the way the parser gives it back, so an author opening the
+   * file finds what they declared rather than a second spelling of it.
+   */
+  toMarkdown() {
+    return [
+      DELIMITER,
+      ...Object.entries({ kind: this.kind, ...this.headers }).map(([field, value]) => `${field}: ${formatFrontmatterValue(value)}`),
+      DELIMITER,
+      "",
+      this.body
+    ].join("\n").replace(/\n*$/, "\n");
+  }
+  /**
+   * The one line this primitive is found by, composed: what its author wrote it
+   * is for, and — where its kind decides when it applies — what it applies to.
+   *
+   * Said here rather than by whoever compiles, because what makes a kind
+   * activate is the kind's own contract (FR-001, FR-004): a skill's triggers are
+   * the author's words, which only a skill knows how to say in a line. A kind
+   * that nothing activates on its description is the description it was
+   * written with.
+   */
+  description() {
+    return this.headers.description;
+  }
+};
+function headersOf(sampledKind, headerSchema, record) {
+  const parsed = headerSchema.safeParse(record);
+  if (parsed.success) return parsed.data;
+  const { kind, sample } = sampledKind;
+  const sampleLines = Object.entries({ kind, ...sample }).map(([field, value]) => `${field}: ${formatFrontmatterValue(value)}`);
+  return throwAggregateError([
+    new CharterPrimitiveFault(
+      `These headers are not what a ${kind} holds.`,
+      `Write them the way this ${kind} does:
+${sampleLines.join("\n")}`
+    )
+  ]);
+}
+
+// src/hexagon/domain/models/charter/primitive/AgentPrimitive.ts
+var AgentHeaders = CommonHeaders.extend({
+  tools: goodArray
+});
+var AgentPrimitive = class _AgentPrimitive extends BasePrimitive {
+  static kind = "agent";
+  kind = _AgentPrimitive.kind;
+  /** What this kind requires beyond the common headers, declared where its
+   *  contract is: it is read both where a file is checked and where one is
+   *  scaffolded (FR-004, FR-039). */
+  static requires = { tools: "list" };
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = AgentHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "it is spawned by identity, holding the `tools` it lists and nothing else";
+  /** An agent as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "reviewer",
+    description: "Review a diff and name what is wrong with it.",
+    tools: ["Read", "Grep"]
+  };
+  /** One agent, or every fault its headers have (FR-004). */
+  static of(record, body) {
+    return new _AgentPrimitive(headersOf(_AgentPrimitive, AgentHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/CommandPrimitive.ts
+var CommandPrimitive = class _CommandPrimitive extends BasePrimitive {
+  static kind = "command";
+  kind = _CommandPrimitive.kind;
+  /** What this kind requires beyond the common headers: nothing. Declared all
+   *  the same, since what a file is scaffolded with is read off this (FR-039). */
+  static requires = {};
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = CommonHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "it is asked for by name, or a request matches what it describes itself as being for";
+  /** A command as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "release",
+    description: "Cut a release from the main branch."
+  };
+  /** One command, or every fault its headers have. Nothing beyond what every
+   *  primitive declares: a command is asked for by name, and the one line it
+   *  describes itself with is what decides that it is the one being asked for. */
+  static of(record, body) {
+    return new _CommandPrimitive(headersOf(_CommandPrimitive, CommonHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/CorpusPrimitive.ts
+var CorpusHeaders = CommonHeaders.extend({});
+var CorpusPrimitive = class _CorpusPrimitive extends BasePrimitive {
+  static kind = "corpus";
+  kind = _CorpusPrimitive.kind;
+  /** What this kind requires beyond the common headers: nothing. Declared all
+   *  the same, since what a file is scaffolded with is read off this (FR-039). */
+  static requires = {};
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = CorpusHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "a primitive's `rationale` cites it \u2014 the reasoning, read when someone asks why";
+  /** A corpus as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "type-safety",
+    description: "Why the charter insists on types."
+  };
+  /** One corpus, or every fault its headers have (FR-004). */
+  static of(record, body) {
+    return new _CorpusPrimitive(headersOf(_CorpusPrimitive, CorpusHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/GuidePrimitive.ts
+var GuideHeaders = CommonHeaders.extend({});
+var GuidePrimitive = class _GuidePrimitive extends BasePrimitive {
+  static kind = "guide";
+  kind = _GuidePrimitive.kind;
+  /** What this kind requires beyond the common headers: nothing. Declared all
+   *  the same, since what a file is scaffolded with is read off this (FR-039). */
+  static requires = {};
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = GuideHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "a touched file matches one of its `globs`, or every turn where globs are not specified";
+  /** A guide as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "no-any",
+    description: "Reject the any type in application code.",
+    globs: ["src/**/*.ts"],
+    tags: ["typescript"],
+    rationale: "corpus:type-safety"
+  };
+  /** One guide, or every fault its headers have (FR-004). */
+  static of(record, body) {
+    return new _GuidePrimitive(headersOf(_GuidePrimitive, GuideHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/MixinPrimitive.ts
+import { z as z2 } from "zod";
+var MixinHeaders = CommonHeaders.extend({
+  /** Never: reading refuses a mixin that declares one. */
+  mixins: z2.undefined().optional()
+});
+var MixinPrimitive = class _MixinPrimitive extends BasePrimitive {
+  static kind = "mixin";
+  kind = _MixinPrimitive.kind;
+  /** What this kind requires beyond the common headers: nothing. Declared all
+   *  the same, since what a file is scaffolded with is read off this (FR-039). */
+  static requires = {};
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = MixinHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "never on its own: its body is lent to the primitives that pull it in";
+  /** A mixin as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "typescript-scope",
+    description: "What counts as TypeScript application code.",
+    globs: ["src/**/*.ts"]
+  };
+  /** One mixin, or every fault its headers have (FR-004, FR-006). */
+  static of(record, body) {
+    return new _MixinPrimitive(headersOf(_MixinPrimitive, MixinHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/PlaybookPrimitive.ts
+var PlaybookHeaders = CommonHeaders.extend({
+  triggers: goodArray
+});
+var PlaybookPrimitive = class _PlaybookPrimitive extends BasePrimitive {
+  static kind = "playbook";
+  kind = _PlaybookPrimitive.kind;
+  /** What this kind requires beyond the common headers, declared where its
+   *  contract is: it is read both where a file is checked and where one is
+   *  scaffolded (FR-004, FR-039). */
+  static requires = { triggers: "list" };
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = PlaybookHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "one of its `triggers` matches; the body is a sequence of commands";
+  /** A playbook as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "ship-a-feature",
+    description: "Take a finished branch from review to release.",
+    triggers: ["ship this", "release this feature"]
+  };
+  /** What this is found by: what it is for, and the requests its author said
+   *  bring it up. */
+  description() {
+    return `${this.headers.description} Use when: ${this.headers.triggers.join("; ")}.`;
+  }
+  /** One playbook, or every fault its headers have (FR-004). */
+  static of(record, body) {
+    return new _PlaybookPrimitive(headersOf(_PlaybookPrimitive, PlaybookHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/PosturePrimitive.ts
+var PostureHeaders = CommonHeaders.extend({
+  allow: goodArray,
+  deny: goodArray
+});
+var PosturePrimitive = class _PosturePrimitive extends BasePrimitive {
+  static kind = "posture";
+  kind = _PosturePrimitive.kind;
+  /** What this kind requires beyond the common headers, declared where its
+   *  contract is: it is read both where a file is checked and where one is
+   *  scaffolded (FR-004, FR-039). */
+  static requires = { allow: "list", deny: "list" };
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = PostureHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "always, wherever the host can be told what to `allow` and what to `deny`";
+  /** A posture as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "no-force-push",
+    description: "Never rewrite history someone else may have pulled.",
+    allow: ["Bash(git push:*)"],
+    deny: ["Bash(git push --force:*)"]
+  };
+  /** One posture, or every fault its headers have (FR-004). */
+  static of(record, body) {
+    return new _PosturePrimitive(headersOf(_PosturePrimitive, PostureHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/SensorPrimitive.ts
+import { z as z3 } from "zod";
+var SIGNALS = [
+  "PreToolUse",
+  "PostToolUse",
+  "UserPromptSubmit",
+  "Notification",
+  "Stop",
+  "SubagentStop",
+  "PreCompact",
+  "SessionStart",
+  "SessionEnd"
+];
+var SensorHeaders = CommonHeaders.extend({
+  /** What raises it: one of the events every host of this engine speaks in. */
+  signal: z3.enum(SIGNALS),
+  /** What is run when it does. A sensor that names no command is a sensor
+   *  nothing can fire, so this is required. */
+  run: goodLine
+});
+var SensorPrimitive = class _SensorPrimitive extends BasePrimitive {
+  static kind = "sensor";
+  kind = _SensorPrimitive.kind;
+  /** What this kind requires beyond the common headers, declared where its
+   *  contract is: it is read both where a file is checked and where one is
+   *  scaffolded (FR-004, FR-039). */
+  static requires = { signal: "line", run: "line" };
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = SensorHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "the `signal` it names is raised, and the harness runs what it says to `run`";
+  /** A sensor as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "test-on-stop",
+    description: "Run the tests when the agent stops.",
+    signal: "Stop",
+    run: "pnpm test"
+  };
+  /** One sensor, or every fault its headers have (FR-004). */
+  static of(record, body) {
+    return new _SensorPrimitive(headersOf(_SensorPrimitive, SensorHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/SkillPrimitive.ts
+var SkillHeaders = CommonHeaders.extend({
+  triggers: goodArray
+});
+var SkillPrimitive = class _SkillPrimitive extends BasePrimitive {
+  static kind = "skill";
+  kind = _SkillPrimitive.kind;
+  /** What this kind requires beyond the common headers, declared where its
+   *  contract is: it is read both where a file is checked and where one is
+   *  scaffolded (FR-004, FR-039). */
+  static requires = { triggers: "list" };
+  /** The schema its headers are read by: what `headersOf` refuses a file
+   *  against, and what says the shape of every header this kind takes, required
+   *  or not (FR-004). */
+  static schema = SkillHeaders;
+  /** When a reader of this charter is to open this kind at all, said
+   *  where the kind's contract is: the neutral surface lists one
+   *  line per kind and none of them is written down twice (FR-002). */
+  static activatesWhen = "one of its `triggers` matches what is being asked";
+  /** A skill as an author writes one: what a refused header is fixed with. */
+  static sample = {
+    id: "refactoring",
+    description: "Change how code is structured without changing what it does.",
+    triggers: ["refactor this", "clean this up"]
+  };
+  /** What this is found by: what it is for, and the requests its author said
+   *  bring it up. */
+  description() {
+    return `${this.headers.description} Use when: ${this.headers.triggers.join("; ")}.`;
+  }
+  /** One skill, or every fault its headers have (FR-004). */
+  static of(record, body) {
+    return new _SkillPrimitive(headersOf(_SkillPrimitive, SkillHeaders, record), body);
+  }
+};
+
+// src/hexagon/domain/models/charter/primitive/Primitive.ts
+var PRIMITIVE_CLASSES = [
+  GuidePrimitive,
+  SensorPrimitive,
+  CommandPrimitive,
+  SkillPrimitive,
+  PlaybookPrimitive,
+  AgentPrimitive,
+  PosturePrimitive,
+  CorpusPrimitive,
+  MixinPrimitive
+];
+var KINDS = Object.freeze(PRIMITIVE_CLASSES.map((one) => one.kind));
+var PRIMITIVE_IDENTITY_SCHEMA = z4.string().regex(/^[a-z0-9-]+:[a-z0-9-]+$/).transform((identity) => identity);
+function identityOf(kindAndId) {
+  if (typeof kindAndId !== "string") return `${kindAndId.kind}:${kindAndId.id}`;
+  const parsed = PRIMITIVE_IDENTITY_SCHEMA.safeParse(kindAndId);
+  if (!parsed.success)
+    throw new CharterPrimitiveFault(
+      `"${kindAndId}" is not an identity: one is a kind and an id with a colon between them.`,
+      'Write it as <kind>:<id>, as in "guide:no-any".'
+    );
+  return parsed.data;
+}
+function isKind(value) {
+  return typeof value === "string" && KINDS.includes(value);
+}
+var CLASS_OF = new Map(
+  PRIMITIVE_CLASSES.map((one) => [one.kind, one])
+);
+var PrimitiveHeader = class {
+  constructor(field, shape, required, allowedValues) {
+    this.field = field;
+    this.shape = shape;
+    this.required = required;
+    this.allowedValues = allowedValues;
+  }
+  field;
+  shape;
+  required;
+  allowedValues;
+};
+var PrimitiveRequirements = class {
+  constructor(headers, sample) {
+    this.headers = headers;
+    this.sample = sample;
+  }
+  headers;
+  sample;
+};
+function primitiveHeadersOf(kind) {
+  const kindClass = CLASS_OF.get(kind);
+  const required = { ...BasePrimitive.requires, ...kindClass.requires };
+  return Object.entries(kindClass.schema.shape).filter(([field]) => field !== "id").map(([field, type]) => {
+    let heldType = type;
+    while (!(heldType instanceof z4.ZodArray) && typeof heldType?.unwrap === "function")
+      heldType = heldType.unwrap();
+    return new PrimitiveHeader(
+      field,
+      heldType instanceof z4.ZodArray ? "list" : "line",
+      field in required,
+      heldType instanceof z4.ZodEnum ? heldType.options : void 0
+    );
+  });
+}
+function primitiveSampleOf(kind) {
+  return Object.entries({ kind, ...CLASS_OF.get(kind).sample }).map(([field, value]) => `${field}: ${formatFrontmatterValue(value)}`).join("\n");
+}
+function primitiveOf(input, parser) {
+  let headers;
+  let body;
+  if (typeof input === "string") {
+    const lines3 = input.replace(/^/, "").split(/\r?\n/);
+    if (lines3[0]?.trim() !== DELIMITER)
+      throwAggregateError([
+        new CharterPrimitiveFault(
+          `This file opens with no "${DELIMITER}" frontmatter block.`,
+          `Add one at the top declaring at least "id" and "description".`
+        )
+      ]);
+    const end = lines3.findIndex((line, index) => index > 0 && line.trim() === DELIMITER);
+    if (end === -1)
+      throwAggregateError([
+        new CharterPrimitiveFault(
+          `The frontmatter block is never closed.`,
+          `Add a "${DELIMITER}" line after the headers.`
+        )
+      ]);
+    headers = parser.parse(lines3.slice(1, end).join("\n"));
+    body = lines3.slice(end + 1).join("\n").trim();
+  } else {
+    headers = input.headers;
+    body = input.body;
+  }
+  if (!isKind(headers.kind))
+    throwAggregateError([
+      headers.kind === void 0 ? new CharterPrimitiveFault(
+        `This file declares no "kind", so nothing knows what to read it as.`,
+        `Add "kind: <one the charter knows>" to the frontmatter.`
+      ) : new CharterPrimitiveFault(
+        `"${String(headers.kind)}" is not a kind the charter knows.`,
+        `Declare a kind the charter knows: ${KINDS.join(", ")}.`
+      )
+    ]);
+  const kind = headers.kind;
+  if (typeof input === "string") return CLASS_OF.get(kind).of(headers, body);
+  const headerFields = primitiveHeadersOf(kind).map((header) => header.field);
+  const unknownHeaderFaults = Object.keys(headers).filter((field) => field !== "kind" && field !== "id" && !headerFields.includes(field)).map(
+    (field) => new CharterPrimitiveFault(
+      `A ${kind} holds no "${field}".`,
+      `Answer one of what a ${kind} holds: ${headerFields.join(", ")}.`
+    )
+  );
+  let primitive;
+  let schemaFaults = [];
+  try {
+    primitive = CLASS_OF.get(kind).of(headers, body);
+  } catch (raised) {
+    if (!(raised instanceof AggregateError)) throw raised;
+    schemaFaults = raised.errors;
+  }
+  if (primitive === void 0 || unknownHeaderFaults.length > 0) throwAggregateError([...unknownHeaderFaults, ...schemaFaults]);
+  return primitive;
+}
+
+// src/hexagon/domain/models/charter/CharterRoot.ts
+var REPO_SCOPE = "repo";
+var VENDOR_SCOPE = "vendor";
+var BUILTIN_SCOPE = "builtin";
+var BUILTIN_PATH_PREFIX = "(built into cw)";
+var ScopedPrimitive = class {
+  constructor(identity, scope, file, primitive) {
+    this.identity = identity;
+    this.scope = scope;
+    this.file = file;
+    this.primitive = primitive;
+  }
+  identity;
+  scope;
+  file;
+  primitive;
+  /** Whether a word someone searched for is anywhere a reader would look for
+   *  it: the identity, the kind, what it is for, when its kind comes up, its
+   *  file, or any header it declared — ignoring case, since whoever typed it
+   *  did not know how it was written (FR-114). */
+  mentions(word) {
+    const activatesWhen = PRIMITIVE_CLASSES.find((one) => one.kind === this.primitive.kind).activatesWhen;
+    const headerValues = Object.values(this.primitive.headers).flatMap(
+      (value) => value === void 0 ? [] : Array.isArray(value) ? value : [String(value)]
+    );
+    const loweredWord = word.toLowerCase();
+    return [this.identity, this.primitive.kind, activatesWhen, this.file, ...headerValues].some(
+      (one) => one.toLowerCase().includes(loweredWord)
+    );
+  }
+};
+var CharterRoot = class {
+  constructor(primitives, faultsByFiles) {
+    this.primitives = primitives;
+    this.faultsByFiles = faultsByFiles;
+  }
+  primitives;
+  faultsByFiles;
+  /** Everything wrong with this charter, under the file that has to change: the
+   *  files that could not be read as a primitive at all, and what the ones that
+   *  were read get wrong together. The two never name one file — a file reading
+   *  refused holds no primitive to get anything else wrong — so one asking is
+   *  the whole answer (FR-009). */
+  get allFaultsByFiles() {
+    return this.faultsByFiles.with(this.compositeFaultsByFiles);
+  }
+  /** Every mixin, under the id a host names it by, wherever it was authored. */
+  get mixins() {
+    return new Map(
+      this.primitives.filter(({ primitive }) => primitive.kind === "mixin").map((one) => [one.primitive.headers.id, one.primitive])
+    );
+  }
+  /**
+   * What one primitive says once its mixins are in it: the body of every mixin
+   * it pulls in, in the order it named them, and then its own (FR-006).
+   *
+   * The one place a mixin is applied at all. Nothing is merged and no header
+   * moves — a mixin lends text, so what comes back is text, and the host's own
+   * words come last so they read as the point and the lent ones as the setting.
+   *
+   * Asked of the charter because the charter is what already read the mixins
+   * and knows which identity a name means across layers. A mixin nothing
+   * answers to is left out rather than raised: `allFaultsByFiles` already names
+   * that file, and a build refused for it never reaches here (FR-009).
+   */
+  bodyOf(one) {
+    const mixins = this.mixins;
+    return [
+      ...(one.primitive.headers.mixins ?? []).map((named) => mixins.get(named)?.body),
+      one.primitive.body
+    ].filter((body) => body !== void 0 && body.trim() !== "").join("\n\n");
+  }
+  /**
+   * Every primitive under the identity the whole charter names it by (FR-017).
+   *
+   * Held here for the reason `mixins` is: one identity space covers every
+   * layer, so which file declares a name is a question about the whole charter
+   * and not about either layer on its own (FR-014).
+   *
+   * The first claim on an identity is the one in here where two files claim it.
+   * A collision is what `compositeFaultsByFiles` is for, and it names both files
+   * there; nothing is asked to explain a charter that has one (SC-006).
+   */
+  get primitiveById() {
+    const byIdentity = /* @__PURE__ */ new Map();
+    for (const one of this.primitives) if (!byIdentity.has(one.identity)) byIdentity.set(one.identity, one);
+    return byIdentity;
+  }
+  /** Every corpus, under the identity a primitive cites it by, wherever it was
+   *  authored: `corpus:<id>`. */
+  get corpora() {
+    return new Set(
+      this.primitives.filter(({ primitive }) => primitive.kind === "corpus").map((one) => one.identity)
+    );
+  }
+  /** Every mixin one primitive uses, in the order it named them (FR-014). A
+   *  name nothing answers to is left out: `compositeFaultsByFiles` already
+   *  names that file as an error. */
+  mixinsOf(one) {
+    const byIdentity = this.primitiveById;
+    return (one.primitive.headers.mixins ?? []).flatMap((id) => byIdentity.get(`mixin:${id}`) ?? []);
+  }
+  /** The corpus one primitive cites as its rationale, or nothing where it cites
+   *  none or cites one this charter does not hold — the second is a warning
+   *  `compositeFaultsByFiles` already names (FR-005, FR-014). */
+  rationaleOf(one) {
+    const { rationale } = one.primitive.headers;
+    return rationale !== void 0 && this.corpora.has(rationale) ? this.primitiveById.get(rationale) : void 0;
+  }
+  /** Every primitive using one mixin; nothing for any other kind (FR-014). */
+  hostsOf(mixin) {
+    if (mixin.primitive.kind !== "mixin") return [];
+    return this.primitives.filter((host) => (host.primitive.headers.mixins ?? []).includes(mixin.primitive.headers.id));
+  }
+  /** Every primitive citing one corpus as its rationale; nothing for any other
+   *  kind (FR-014). */
+  citersOf(corpus) {
+    if (corpus.primitive.kind !== "corpus") return [];
+    return this.primitives.filter((citer) => citer.primitive.headers.rationale === corpus.identity);
+  }
+  /** Does what a mixin lends reach as far as the host pulling it in, or the host
+   *  no further than the mixin? A side that names no files is asking about
+   *  nothing in particular, and is left alone (FR-006). */
+  reaches(host, mixin) {
+    const hostGlobs = host.headers.globs ?? [];
+    const mixinGlobs = mixin.headers.globs ?? [];
+    if (hostGlobs.length === 0 || mixinGlobs.length === 0) return true;
+    const coversAll = (outer, inner) => inner.every((narrower) => outer.some((wider) => covers(wider, narrower)));
+    return coversAll(mixinGlobs, hostGlobs) || coversAll(hostGlobs, mixinGlobs);
+  }
+  /**
+   * What is wrong with this charter that is wrong with no one file on its own,
+   * under the file that has to change (FR-009).
+   *
+   * Reading refused the files whose own headers do not hold, and said so where
+   * it read them; what is left are the questions no single file answers. Every
+   * layer is read into one identity space, the way one registry holds one name
+   * per package: two files claim one identity; one names a mixin nothing
+   * answers to; one pulls in a mixin that speaks about other files than it does
+   * — a mixin lends its body at projection time, so what makes the two belong
+   * together is the files they both apply to (FR-006, FR-014). One cites a
+   * rationale no corpus answers to, which is a warning rather than an error:
+   * the rule holds without its reasoning, and the author is told the reasoning
+   * is gone (FR-005). A corpus nobody cites and a mixin nobody pulls in are
+   * warnings too: nothing breaks, and nothing reads them either (FR-014).
+   */
+  get compositeFaultsByFiles() {
+    const everyPrimitive = this.primitives;
+    const mixinsByIdentity = this.mixins;
+    const corpusIdentities = this.corpora;
+    const fileByIdentity = /* @__PURE__ */ new Map();
+    const faultsByFiles = {};
+    const addFault = (file, found) => {
+      faultsByFiles[file] = [...faultsByFiles[file] ?? [], found];
+    };
+    for (const one of everyPrimitive) {
+      const { file, primitive } = one;
+      const { identity } = one;
+      const declaredIn = fileByIdentity.get(identity);
+      if (declaredIn === void 0) fileByIdentity.set(identity, file);
+      else
+        addFault(
+          file,
+          new CharterRootFault(
+            `"${identity}" is already declared by ${declaredIn}. One identity names one primitive in a charter, whichever layer it was authored in.`,
+            `Give this one an id of its own, or delete it if the other says the same thing. A vendor claiming an id you authored is one to raise with whoever publishes it. An id ${BUILTIN_PATH_PREFIX} claims is the engine's own and nobody can change it, so the one to rename is yours.`
+          )
+        );
+      for (const namedMixin of primitive.headers.mixins ?? []) {
+        const mixin = mixinsByIdentity.get(namedMixin);
+        if (mixin === void 0) {
+          addFault(
+            file,
+            new CharterRootFault(
+              `This pulls in the mixin "${namedMixin}", and this charter holds no mixin of that id.`,
+              `Author it, or drop "${namedMixin}" from "mixins". A mixin is named by its id, whichever layer authored it.`
+            )
+          );
+          continue;
+        }
+        if (!this.reaches(primitive, mixin)) {
+          addFault(
+            file,
+            new CharterRootFault(
+              `This pulls in the mixin "${namedMixin}", and neither one's "globs" covers the other's. The mixin's body would be written into a primitive that applies to different files.`,
+              `Widen one side's "globs" until it covers the other's, or move the shared text into a corpus and cite it with "rationale".`
+            )
+          );
+        }
+      }
+      const cited = primitive.headers.rationale;
+      if (cited !== void 0 && !corpusIdentities.has(cited)) {
+        addFault(
+          file,
+          new CharterRootFault(
+            `This cites "${cited}" as its rationale, and this charter holds no corpus of that identity.`,
+            `Author that corpus, correct the reference, or drop "rationale". A corpus is cited as "corpus:<id>", whichever layer authored it.`,
+            "warn"
+          )
+        );
+      }
+      if (primitive.kind === "corpus" && this.citersOf(one).length === 0)
+        addFault(
+          file,
+          new CharterRootFault(
+            `No primitive cites "${identity}" as its rationale, so nothing an agent reads leads to it.`,
+            `Cite it from the rules it explains with "rationale: ${identity}", or delete it.`,
+            "warn"
+          )
+        );
+      if (primitive.kind === "mixin" && this.hostsOf(one).length === 0)
+        addFault(
+          file,
+          new CharterRootFault(
+            `No primitive pulls in the mixin "${primitive.headers.id}", so its body is never written anywhere.`,
+            `Name "${primitive.headers.id}" under "mixins" of the primitives it was written for, or delete it.`,
+            "warn"
+          )
+        );
+    }
+    return new FaultsByFile(faultsByFiles);
+  }
+};
+function charterRootOf({
+  repo,
+  vendor,
+  builtin
+}, yamlParser2) {
+  const primitives = [];
+  const faultsByFiles = {};
+  const read = (one, scope) => {
+    try {
+      const primitive = primitiveOf(one.contents, yamlParser2);
+      primitives.push(new ScopedPrimitive(identityOf({ kind: primitive.kind, id: primitive.headers.id }), scope, one.path, primitive));
+    } catch (raised) {
+      if (!(raised instanceof AggregateError)) throw raised;
+      faultsByFiles[one.path] = raised.errors;
+    }
+  };
+  const sorted = (files) => [...files].sort((one, another) => one.path.localeCompare(another.path));
+  for (const one of sorted(builtin)) read(one, BUILTIN_SCOPE);
+  for (const one of sorted(repo)) read(one, REPO_SCOPE);
+  for (const one of sorted(vendor)) read(one, VENDOR_SCOPE);
+  return new CharterRoot(primitives, new FaultsByFile(faultsByFiles));
+}
+
+// src/hexagon/domain/path.ts
+function folderURL(at) {
+  const url = new URL(at);
+  if (!url.pathname.endsWith("/"))
+    throw new Fault(
+      `"${url.href}" names a file, and a folder is what is wanted here.`,
+      `Write it with the separator a folder ends in, as in "${url.href}/".`
+    );
+  return url;
+}
+var WORKSPACE_DIRECTORY = ".cw";
+var CHARTER_DIRECTORY = `${WORKSPACE_DIRECTORY}/charter`;
+var VENDOR_DIRECTORY = `${WORKSPACE_DIRECTORY}/vendor`;
+var TEST_DIRECTORY = `${WORKSPACE_DIRECTORY}/test`;
+var OUT_DIRECTORY = `${WORKSPACE_DIRECTORY}/out`;
+var SETTINGS_FILE = `${WORKSPACE_DIRECTORY}/settings.json`;
+function charterFolderIn(repo) {
+  return folderIn(repo, CHARTER_DIRECTORY);
+}
+function outFolderIn(repo) {
+  return folderIn(repo, OUT_DIRECTORY);
+}
+var CLAUDE_DIRECTORY = ".claude";
+var CLAUDE_ENTRY_FILE = "CLAUDE.md";
+function agentProviderFolderIn(repo, provider) {
+  switch (provider) {
+    case "claude":
+      return folderIn(repo, CLAUDE_DIRECTORY);
+  }
+}
+function testFolderIn(repo) {
+  return folderIn(repo, TEST_DIRECTORY);
+}
+function vendorFolderIn(repo) {
+  return folderIn(repo, VENDOR_DIRECTORY);
+}
+function folderIn(repo, directory) {
+  return folderURL(new URL(`${directory}/`, repo.href.endsWith("/") ? repo : new URL(`${repo.href}/`)));
+}
+function settingsFileIn(repo) {
+  return new URL(SETTINGS_FILE, repo.href.endsWith("/") ? repo : new URL(`${repo.href}/`));
+}
+
+// src/driver/cli/commands/AddCommand.ts
+import prompts from "prompts";
+
+// src/driver/cli/commands/Command.ts
+import { pathToFileURL } from "url";
+var EXIT_OK = 0;
+var EXIT_FAILURE = 1;
+var EXIT_USAGE = 2;
+
+// src/driver/cli/commands/helper.ts
+import { spawn } from "child_process";
+function parseKVParams(typed, paramName) {
+  const params = /* @__PURE__ */ Object.create(null);
+  for (const one of typed) {
+    const at = one.indexOf("=");
+    if (at <= 0)
+      throw new Fault(
+        `"--${paramName} ${one}" names nothing to put a value under.`,
+        `Type each one as --${paramName} name=value, once per name.`
+      );
+    (params[one.slice(0, at)] ??= []).push(one.slice(at + 1));
+  }
+  return params;
+}
+function toText({ data: { files } }) {
+  return Object.keys(files).sort().map((file) => [file, ...(files[file] ?? []).flatMap(lines), ""].join("\n")).join("");
+}
+function lines({ data: { severity, message, fix } }) {
+  return [`  ${severity}: ${message}`, ...fix ? [`         ${fix}`] : []];
+}
+async function editInEditor(cwd, file) {
+  const editorCommand = process.env.VISUAL || process.env.EDITOR;
+  if (!editorCommand)
+    throw new Fault("Neither $VISUAL nor $EDITOR is set, so there is no editor to open it in.", 'Set one, as in "export EDITOR=vim".');
+  const exitCode = await new Promise(
+    (resolve, reject) => spawn("sh", ["-c", `${editorCommand} "$1"`, editorCommand, `${cwd}/${file}`], { stdio: "inherit" }).once("error", reject).once("exit", resolve)
+  );
+  return exitCode === 0 ? void 0 : `${editorCommand} exited with ${exitCode} on ${file}.
+`;
+}
+
+// src/driver/cli/commands/AddCommand.ts
+var OPTIONS = {
+  kind: {
+    type: "string",
+    describe: "Which kind of primitive to write; a word that is none is answered with every kind there is"
+  },
+  id: {
+    type: "string",
+    describe: 'What it is named by across the whole charter: "no-any"'
+  },
+  header: {
+    type: "string",
+    isArray: true,
+    describe: 'One header the kind requires, as name=value; typed once per header, and what "cw kinds <kind>" names'
+  }
+};
+var AddCommand = class {
+  name = "add <kind> <id>";
+  summary = "Write a new primitive of one kind, holding what that kind requires";
+  options = OPTIONS;
+  async run({ charterAuthoringApp: charterAuthoringApp2 }, { kind, id, header }) {
+    const taken = (await charterAuthoringApp2.listPrimitiveRequirements(kind ?? "")).data.headers.map((one) => one.data);
+    const lists = new Set(taken.filter((one) => one.shape === "list").map((one) => one.field));
+    const answers = header.length > 0 ? Object.fromEntries(
+      Object.entries(parseKVParams(header, "header")).map(([field, values]) => {
+        if (lists.has(field)) return [field, values];
+        if (values.length > 1)
+          throw new Fault(
+            `"${field}" holds one line, and was typed ${values.length} times.`,
+            `Type "--header ${field}=..." once.`
+          );
+        return [field, values[0]];
+      })
+    ) : await this.#answered(
+      taken.filter((one) => one.required),
+      kind ?? ""
+    );
+    const scopedPrimitiveDTO2 = await charterAuthoringApp2.add(kind ?? "", id ?? "", answers);
+    if (scopedPrimitiveDTO2.type === "Faults")
+      return {
+        code: EXIT_FAILURE,
+        problem: scopedPrimitiveDTO2.data.faults.map(({ data: { message, fix } }) => `${message}
+  ${fix}
+`).join("")
+      };
+    return {
+      code: EXIT_OK,
+      result: [`Wrote ${scopedPrimitiveDTO2.data.file}.`, 'Write what it has to say in the body, then run "cw build".', ""].join("\n")
+    };
+  }
+  /**
+   * Every header this kind requires, answered by whoever is at the terminal.
+   *
+   * One question per header, in the order the engine named them, each asked as
+   * what it holds: one line of text, or a list of names typed with commas between
+   * them.
+   *
+   * Nobody at the terminal is refused rather than answered with blanks: every
+   * header here is one its kind requires, so a file written without them is a
+   * file the next build refuses, and writing it would leave the author to find
+   * that out later (FR-035 is setup's, and this asks for what nothing can default).
+   */
+  async #answered(required, kind) {
+    if (!process.stdin.isTTY)
+      throw new Fault(
+        `A ${kind} requires ${required.map((one) => `"${one.field}"`).join(", ")}, and nobody is at the terminal to answer.`,
+        `Run "cw add" where you can answer, or author the file under the charter yourself.`
+      );
+    const answers = await prompts(
+      required.map(
+        ({ field, shape }) => shape === "line" ? { type: "text", name: field, message: `${field}?` } : {
+          type: "list",
+          name: field,
+          message: `${field}?`,
+          // `prompts` hands an answer left empty back as [""].
+          format: (entries) => entries.map((one) => one.trim()).filter((one) => one !== "")
+        }
+      )
+    );
+    if (required.some((one) => answers[one.field] === void 0))
+      throw new Fault("This was stopped before it had its answers, so nothing was written.", 'Run "cw add" again.');
+    return answers;
+  }
+};
+
+// src/driver/cli/commands/BuildCommand.ts
+var BUILDING = {
+  preview: {
+    type: "boolean",
+    describe: "Say what a build would do to each file, and write nothing",
+    default: false
+  }
+};
+var BuildCommand = class {
+  name = "build";
+  summary = "Compile the charter into the files each agent reads";
+  options = BUILDING;
+  async run({ charterAuthoringApp: charterAuthoringApp2 }, { preview }) {
+    if (preview) {
+      const planSummaryDTO3 = await charterAuthoringApp2.preview();
+      if (planSummaryDTO3.type === "FaultsByFile") {
+        const noOfFiles = Object.keys(planSummaryDTO3.data.files).length;
+        return {
+          code: EXIT_FAILURE,
+          problem: `Nothing was previewed: ${noOfFiles} file${noOfFiles === 1 ? " has" : "s have"} errors.
+Run "cw doctor" to see what is wrong with them.
+`
+        };
+      }
+      const { added: added2, edited: edited2, deleted: deleted2, unchanged } = planSummaryDTO3.data;
+      const changes = [
+        ...added2.map((path) => ["create", path]),
+        ...edited2.map((path) => ["update", path]),
+        ...deleted2.map((path) => ["delete", path]),
+        ...unchanged.map((path) => ["unchanged", path])
+      ];
+      return {
+        code: EXIT_OK,
+        result: [
+          ...changes.map(([change, path]) => `  ${change.padEnd("unchanged".length)}  ${path}`),
+          `${changes.length} file${changes.length === 1 ? "" : "s"}: ${added2.length} create, ${edited2.length} update, ${deleted2.length} delete, ${unchanged.length} unchanged.`,
+          ""
+        ].join("\n")
+      };
+    }
+    const planSummaryDTO2 = await charterAuthoringApp2.build();
+    if (planSummaryDTO2.type === "FaultsByFile") {
+      const noOfFiles = Object.keys(planSummaryDTO2.data.files).length;
+      return {
+        code: EXIT_FAILURE,
+        problem: `Nothing was built: ${noOfFiles} file${noOfFiles === 1 ? " has" : "s have"} errors.
+Run "cw doctor" to see what is wrong with them.
+`
+      };
+    }
+    const { added, edited, deleted } = planSummaryDTO2.data;
+    const wrote = added.length + edited.length;
+    return {
+      code: EXIT_OK,
+      result: [
+        `Built ${wrote} file${wrote === 1 ? "" : "s"}: ${added.length} added, ${edited.length} changed.`,
+        ...deleted.map((path) => `  deleted ${path}, whose primitive is gone`),
+        ""
+      ].join("\n")
+    };
+  }
+};
+
+// src/driver/cli/commands/DoctorCommand.ts
+var DoctorCommand = class {
+  name = "doctor";
+  summary = "Check this repository: agents, charter, vendors, and what is built";
+  async run({ version, charterAuthoringApp: charterAuthoringApp2 }, _options) {
+    const {
+      agents,
+      errorCount: errors,
+      warnCount: warnings,
+      pendingCount: pending,
+      faultsByFile: faultsByFile2,
+      driftedVendors: driftedVendors2,
+      problemCount
+    } = (await charterAuthoringApp2.doctor()).data;
+    return {
+      code: problemCount === 0 ? EXIT_OK : EXIT_FAILURE,
+      result: [
+        // Which cw wrote the report, so one pasted into a bug report names
+        // the release it came from (FR-132).
+        `cw ${version}`,
+        // A repository that compiles for none is set up and building: the
+        // neutral surface is compiled for everybody (FR-019).
+        agents.length === 0 ? "Agents:   none chosen, so only the neutral surface is compiled." : `Agents:   ${agents.join(", ")}.`,
+        errors > 0 ? `Charter:  ${errors} error${errors === 1 ? "" : "s"}.` : warnings === 0 ? "Charter:  holds." : `Charter:  holds, with ${warnings} warning${warnings === 1 ? "" : "s"}.`,
+        driftedVendors2.length === 0 ? "Vendors:  none edited here." : `Vendors:  edited here: ${driftedVendors2.join(", ")}. Run "git checkout" under .cw/vendor/ to undo, or commit what you meant.`,
+        pending === null ? "Built:    not known, since the charter does not hold." : pending === 0 ? "Built:    up to date." : `Built:    ${pending} file${pending === 1 ? "" : "s"} out of date. Run "cw build".`,
+        // Every fault under the file that has to change, below the four lines
+        // rather than inside them: a line says how many, and this says which
+        // (FR-009).
+        ...Object.keys(faultsByFile2.data.files).length === 0 ? [] : ["", toText(faultsByFile2)],
+        problemCount === 0 ? "Nothing to fix." : `${problemCount} thing${problemCount === 1 ? "" : "s"} to fix.`,
+        ""
+      ].join("\n")
+    };
+  }
+};
+
+// src/driver/cli/commands/EditCommand.ts
+var OPTIONS2 = {
+  identity: {
+    type: "string",
+    describe: 'What the primitive is named by across the whole charter: "guide:no-any"'
+  }
+};
+var EditCommand = class {
+  name = "edit <identity>";
+  summary = "Open the file of one primitive in your editor";
+  options = OPTIONS2;
+  async run({ cwd, charterAuthoringApp: charterAuthoringApp2 }, { identity }) {
+    const { scopedPrimitive: scopedPrimitive2 } = (await charterAuthoringApp2.open(identity ?? "")).data;
+    if (scopedPrimitive2.data.scope === BUILTIN_SCOPE)
+      throw new Fault(
+        `${scopedPrimitive2.data.identity} is built into cw, and there is no file of it in this repository to edit.`,
+        `To differ from it, run "cw add" for a primitive of your own under an identity of its own.`
+      );
+    const problem = await editInEditor(cwd, scopedPrimitive2.data.file);
+    if (problem !== void 0) return { code: EXIT_FAILURE, problem };
+    return {
+      code: EXIT_OK,
+      result: [`Closed ${scopedPrimitive2.data.file}.`, 'Run "cw doctor" to see that the charter still holds, then "cw build".', ""].join("\n")
+    };
+  }
+};
+
+// src/driver/cli/commands/ExplainCommand.ts
+var OPTIONS3 = {
+  identity: {
+    type: "string",
+    describe: 'What the primitive is named by across the whole charter: "guide:no-any"'
+  }
+};
+var ExplainCommand = class {
+  name = "explain <identity>";
+  summary = "Say which file declares an identity, and which layer it came from";
+  options = OPTIONS3;
+  async run({ charterAuthoringApp: charterAuthoringApp2 }, { identity }) {
+    const explanationOutcomeDTO2 = await charterAuthoringApp2.explain(identity ?? "");
+    if (explanationOutcomeDTO2.type === "FaultsByFile") {
+      const noOfFiles = Object.keys(explanationOutcomeDTO2.data.files).length;
+      return {
+        code: EXIT_FAILURE,
+        problem: `Nothing was explained: ${noOfFiles} file${noOfFiles === 1 ? " has" : "s have"} errors.
+Run "cw doctor" to see what is wrong with them.
+`
+      };
+    }
+    const { scopedPrimitive: scopedPrimitive2, activatesWhen, useMixins, rationale, hosts, citers, testCasesByFile: testCasesByFile2 } = explanationOutcomeDTO2.data;
+    const citedRationale = scopedPrimitive2.data.headers.rationale;
+    const declaredHeaders = Object.entries(scopedPrimitive2.data.headers).filter(([name]) => name !== "id" && name !== "description");
+    return {
+      code: EXIT_OK,
+      result: [
+        `${scopedPrimitive2.data.identity}  ${scopedPrimitive2.data.description}`,
+        `  ${scopedPrimitive2.data.file}`,
+        `  ${layer(scopedPrimitive2.data.scope)}`,
+        `  comes up when ${activatesWhen}`,
+        ...declaredHeaders.map(([name, value]) => `  declares ${name}: ${typeof value === "string" ? value : value.join(", ")}`),
+        ...useMixins.map(({ data }) => `  uses mixin ${data.identity}`),
+        ...rationale !== void 0 ? [`  rationale ${rationale.data.identity}`] : citedRationale !== void 0 ? [`  rationale ${String(citedRationale)} (does not resolve)`] : [],
+        ...hosts.map(({ data }) => `  mixin of ${data.identity}`),
+        ...citers.map(({ data }) => `  rationale of ${data.identity}`),
+        ...Object.entries(testCasesByFile2.data).flatMap(
+          ([file, situations]) => situations.map((situation) => `  pinned down by ${file}: ${situation}`)
+        ),
+        ""
+      ].join("\n")
+    };
+  }
+};
+function layer(scope) {
+  const saidByScope = {
+    [REPO_SCOPE]: "authored in this repository",
+    [VENDOR_SCOPE]: "installed from a vendor",
+    [BUILTIN_SCOPE]: "built into cw, and not authored in this repository"
+  };
+  return saidByScope[scope];
+}
+
+// src/driver/cli/commands/InitCommand.ts
+import prompts2 from "prompts";
+var OPTIONS4 = {
+  agent: {
+    type: "string",
+    describe: `Which agent this charter compiles for: ${AGENT_PROVIDERS.join(", ")}`
+  }
+};
+var InitCommand = class {
+  name = "init";
+  summary = "Set this repository up under a charter";
+  options = OPTIONS4;
+  async run({ charterAuthoringApp: charterAuthoringApp2 }, { agent }) {
+    const agents = await whichAgents(charterAuthoringApp2, agent);
+    await charterAuthoringApp2.init({ agents });
+    return {
+      code: EXIT_OK,
+      result: [
+        "Set up this repository under a charter.",
+        `Compiling for: ${agents.join(", ")}.`,
+        'Author your first rule under .cw/charter/guide/, then run "cw build".',
+        ""
+      ].join("\n")
+    };
+  }
+};
+async function whichAgents(charterAuthoringApp2, typed) {
+  if (typed !== void 0) {
+    if (!isAgentProvider(typed))
+      throw new Fault(
+        `This engine compiles for no agent called "${typed}".`,
+        `Name any of: ${AGENT_PROVIDERS.join(", ")}.`
+      );
+    return [typed];
+  }
+  const agentsInSettings = (await charterAuthoringApp2.settings()).data.agents.filter(isAgentProvider);
+  if (!process.stdin.isTTY) {
+    if (agentsInSettings.length === 0)
+      throw new Fault(
+        "Nobody is at the terminal to choose an agent, and this repository has none chosen yet.",
+        `Run "cw init --agent <name>", naming one of: ${AGENT_PROVIDERS.join(", ")}.`
+      );
+    return agentsInSettings;
+  }
+  const { chosen } = await prompts2({
+    type: "multiselect",
+    name: "chosen",
+    message: "Which agents does this charter compile for?",
+    // What the settings already name arrives ticked, so a return keeps what this
+    // repository is already running under and a second run is rechoosing rather
+    // than starting over (FR-038). Nothing named yet — a repository being set up
+    // for the first time — arrives with nothing ticked.
+    choices: AGENT_PROVIDERS.map((one) => ({ title: one, value: one, selected: agentsInSettings.includes(one) })),
+    // Ticking none of them is not an answer: a charter compiles for at least one
+    // agent, so the prompt holds the submit until one is ticked (FR-033).
+    min: 1
+  });
+  if (chosen === void 0)
+    throw new Fault("Setup was stopped before it had its answers.", 'Run "cw init" again.');
+  return chosen;
+}
+
+// src/driver/cli/commands/KindsCommand.ts
+var OPTIONS5 = {
+  kind: {
+    type: "string",
+    describe: "Which kind to be told what it requires; left off, every kind and when each comes up"
+  }
+};
+var KindsCommand = class {
+  name = "kinds [kind]";
+  summary = "Say which kinds a charter is written in, and what one of them requires";
+  options = OPTIONS5;
+  async run({ charterAuthoringApp: charterAuthoringApp2 }, { kind }) {
+    if (kind === void 0) {
+      const { data: data2 } = await charterAuthoringApp2.kinds();
+      return {
+        code: EXIT_OK,
+        result: `${Object.entries(data2).map(([named, activatesWhen]) => `${named}  ${activatesWhen}`).join("\n")}
+`
+      };
+    }
+    const { data } = await charterAuthoringApp2.listPrimitiveRequirements(kind);
+    const required = data.headers.filter((one) => one.data.required);
+    const widestField = Math.max(...required.map((one) => one.data.field.length));
+    return {
+      code: EXIT_OK,
+      result: [
+        `A ${kind} requires:`,
+        // A header read from a closed set is one of those values or refused, so
+        // the values are part of what it requires (FR-118).
+        ...required.map(
+          ({ data: { field, shape, allowedValues } }) => `  ${field.padEnd(widestField)}  ${shape}${allowedValues === void 0 ? "" : `, one of ${allowedValues.join(", ")}`}`
+        ),
+        "",
+        `Write one the way this ${kind} is written:`,
+        data.sample,
+        ""
+      ].join("\n")
+    };
+  }
+};
+
+// src/driver/cli/commands/ListCommand.ts
+var LISTING = {
+  kind: { type: "string", describe: "Only the primitives of this kind" },
+  min: {
+    type: "boolean",
+    describe: "What an agent surveys by: identity and description, nothing else",
+    default: false
+  }
+};
+var ListCommand = class {
+  name = "list";
+  summary = "Say what the charter holds";
+  options = LISTING;
+  async run({ charterAuthoringApp: charterAuthoringApp2 }, { kind, min }) {
+    const catalogueDTO2 = await charterAuthoringApp2.list(kind);
+    if (catalogueDTO2.type === "FaultsByFile") {
+      const noOfFiles = Object.keys(catalogueDTO2.data.files).length;
+      return {
+        code: EXIT_FAILURE,
+        problem: `Nothing was listed: ${noOfFiles} file${noOfFiles === 1 ? " has" : "s have"} errors.
+Run "cw doctor" to see what is wrong with them.
+`
+      };
+    }
+    const { entries } = catalogueDTO2.data;
+    if (entries.length === 0)
+      return {
+        code: EXIT_OK,
+        result: kind === void 0 ? "This charter holds nothing yet.\n" : `This charter holds no ${kind}.
+`
+      };
+    return {
+      code: EXIT_OK,
+      result: min ? `${entries.map(surveyed).join("\n")}
+` : `${entries.map(inFull).join("\n")}
+`
+    };
+  }
+};
+function surveyed({ data: { identity, description } }) {
+  return `${identity}  ${description}`;
+}
+function inFull(entry) {
+  const { file, tags, globs, rationale, mixins } = entry.data;
+  const declared = [
+    ...globs === void 0 ? [] : [`globs: ${globs.join(", ")}`],
+    ...tags === void 0 ? [] : [`tags: ${tags.join(", ")}`],
+    ...mixins === void 0 ? [] : [`mixins: ${mixins.join(", ")}`],
+    ...rationale === void 0 ? [] : [`rationale: ${rationale}`]
+  ];
+  return [surveyed(entry), `  ${file}`, ...declared.length === 0 ? [] : [`  ${declared.join(", ")}`]].join("\n");
+}
+
+// src/driver/portal/server.ts
+import { randomBytes } from "crypto";
+import { access } from "fs/promises";
+import { fileURLToPath } from "url";
+import { Hono } from "hono";
+import { bearerAuth } from "hono/bearer-auth";
+import { serve } from "@hono/node-server";
+import { serveStatic } from "@hono/node-server/serve-static";
+
+// src/driver/portal/routes.ts
+import { createRoute, OpenAPIHono } from "@hono/zod-openapi";
+import { HTTPException } from "hono/http-exception";
+import { z as z10 } from "zod";
+
+// src/hexagon/port/driver/dtos/dto.ts
+import { z as z5 } from "zod";
+var strings = z5.array(z5.string()).readonly();
+var dto = (type, data) => z5.object({ type: z5.literal(type), data });
+function byType(...schemas) {
+  return Object.fromEntries(schemas.map((one) => [one.shape.type.value, one]));
+}
+
+// src/hexagon/port/driver/dtos/data.ts
+import { z as z6 } from "zod";
+var fault = dto(
+  "Fault",
+  z6.object({
+    message: z6.string(),
+    fix: z6.string(),
+    severity: z6.enum(["error", "warn"])
+  })
+);
+var faultsByFile = dto(
+  "FaultsByFile",
+  z6.object({
+    files: z6.record(z6.string(), z6.array(fault).readonly())
+  })
+);
+var faults = dto(
+  "Faults",
+  z6.object({
+    faults: z6.array(fault).readonly()
+  })
+);
+var primitiveKinds = dto("PrimitiveKinds", z6.record(z6.string(), z6.string()));
+var catalogueEntry = dto(
+  "CatalogueEntry",
+  z6.object({
+    identity: z6.string(),
+    kind: z6.string(),
+    id: z6.string(),
+    description: z6.string(),
+    file: z6.string(),
+    tags: strings.optional(),
+    globs: strings.optional(),
+    rationale: z6.string().optional(),
+    mixins: strings.optional()
+  })
+);
+var catalogue = dto(
+  "Catalogue",
+  z6.object({
+    entries: z6.array(catalogueEntry).readonly()
+  })
+);
+var scopedPrimitive = dto(
+  "ScopedPrimitive",
+  z6.object({
+    identity: z6.string(),
+    kind: z6.string(),
+    description: z6.string(),
+    file: z6.string(),
+    scope: z6.enum(["repo", "vendor", "builtin"]),
+    headers: z6.record(z6.string(), z6.union([z6.string(), strings]))
+  })
+);
+var scopedPrimitives = dto(
+  "ScopedPrimitives",
+  z6.object({
+    primitives: z6.array(scopedPrimitive).readonly()
+  })
+);
+var primitiveSnapshot = dto(
+  "PrimitiveSnapshot",
+  z6.object({
+    scopedPrimitive,
+    body: z6.string(),
+    revision: z6.string()
+  })
+);
+var planSummary = dto(
+  "PlanSummary",
+  z6.object({
+    added: strings,
+    edited: strings,
+    deleted: strings,
+    unchanged: strings
+  })
+);
+var primitiveHeader = dto(
+  "PrimitiveHeader",
+  z6.object({
+    field: z6.string(),
+    shape: z6.enum(["line", "list"]),
+    required: z6.boolean(),
+    allowedValues: strings.optional()
+  })
+);
+var primitiveRequirements = dto(
+  "PrimitiveRequirements",
+  z6.object({
+    headers: z6.array(primitiveHeader).readonly(),
+    sample: z6.string()
+  })
+);
+var testCasesByFile = dto("TestCasesByFile", z6.record(z6.string(), strings));
+var testCaseReport = dto(
+  "TestCaseReport",
+  z6.object({
+    suiteName: z6.string(),
+    situation: z6.string(),
+    passed: z6.boolean(),
+    unmet: fault.optional()
+  })
+);
+var testRunReport = dto(
+  "TestRunReport",
+  z6.object({
+    testCaseReports: z6.array(testCaseReport).readonly()
+  })
+);
+var testCase = dto(
+  "TestCase",
+  z6.object({
+    situation: z6.string(),
+    expectation: z6.string(),
+    identity: z6.string().optional()
+  })
+);
+var testSuite = dto(
+  "TestSuite",
+  z6.object({
+    name: z6.string(),
+    text: z6.string().optional(),
+    description: z6.string().optional(),
+    cases: z6.array(testCase).readonly(),
+    fault: fault.optional()
+  })
+);
+var testSuites = dto(
+  "TestSuites",
+  z6.object({
+    testSuites: z6.array(testSuite).readonly()
+  })
+);
+var workspaceSettings = dto(
+  "WorkspaceSettings",
+  z6.object({
+    agents: strings
+  })
+);
+var DataDTOs = byType(
+  catalogue,
+  catalogueEntry,
+  fault,
+  faults,
+  faultsByFile,
+  planSummary,
+  primitiveHeader,
+  primitiveKinds,
+  primitiveRequirements,
+  primitiveSnapshot,
+  scopedPrimitive,
+  scopedPrimitives,
+  testCase,
+  testCaseReport,
+  testCasesByFile,
+  testRunReport,
+  testSuite,
+  testSuites,
+  workspaceSettings
+);
+
+// src/hexagon/port/driver/dtos/outcome.ts
+import { z as z7 } from "zod";
+var doctorOutcome = dto(
+  "DoctorOutcome",
+  z7.object({
+    agents: strings,
+    errorCount: z7.number(),
+    warnCount: z7.number(),
+    pendingCount: z7.number().nullable(),
+    faultsByFile: DataDTOs.FaultsByFile,
+    driftedVendors: strings,
+    problemCount: z7.number()
+  })
+);
+var explanationOutcome = dto(
+  "ExplanationOutcome",
+  z7.object({
+    scopedPrimitive: DataDTOs.ScopedPrimitive,
+    activatesWhen: z7.string(),
+    useMixins: z7.array(DataDTOs.ScopedPrimitive).readonly(),
+    rationale: DataDTOs.ScopedPrimitive.optional(),
+    hosts: z7.array(DataDTOs.ScopedPrimitive).readonly(),
+    citers: z7.array(DataDTOs.ScopedPrimitive).readonly(),
+    testCasesByFile: DataDTOs.TestCasesByFile
+  })
+);
+var OutcomeDTOs = byType(doctorOutcome, explanationOutcome);
+
+// src/hexagon/domain/models/test/TestSuite.ts
+import { z as z9 } from "zod";
+
+// src/hexagon/domain/models/test/TestCase.ts
+import { z as z8 } from "zod";
+var TEST_CASE_SCHEMA = z8.union([
+  z8.strictObject({
+    do: z8.strictObject({ touchFile: z8.string().min(1) }),
+    expect: z8.union([
+      z8.strictObject({ activate: PRIMITIVE_IDENTITY_SCHEMA }),
+      z8.strictObject({ allow: z8.boolean() })
+    ])
+  }),
+  z8.strictObject({
+    when: z8.enum(SIGNALS),
+    expect: z8.strictObject({ run: PRIMITIVE_IDENTITY_SCHEMA })
+  })
+]);
+var TestCase = class {
+  constructor(written) {
+    this.written = written;
+  }
+  written;
+  /** The situation it puts, said as a line, and what it expects of it: what a
+   *  run reports it under, and what an explanation names it by (FR-048,
+   *  FR-014). */
+  describe() {
+    return `${this.situation} ${this.expectation}`;
+  }
+  /** The situation it puts: the file it touches, or the event it raises. */
+  get situation() {
+    return "when" in this.written ? `firing event ${this.written.when}` : `touching ${this.written.do.touchFile}`;
+  }
+  /** What it expects the charter to make of its situation. */
+  get expectation() {
+    const written = this.written;
+    if ("when" in written) return `runs ${written.expect.run}`;
+    if ("activate" in written.expect) return `activates ${written.expect.activate}`;
+    return `is ${written.expect.allow ? "allowed" : "denied"}`;
+  }
+  /**
+   * Which primitive this case expects to be activated: the sensor a raised event
+   * is expected to run, or the guide a touched file is expected to bring up
+   * (FR-014).
+   *
+   * Nothing for the third shape. That one expects a touched file to be allowed
+   * or denied, which every posture in the charter answers between them, so it
+   * activates no one primitive by name.
+   */
+  get activatedIdentity() {
+    if ("when" in this.written) return this.written.expect.run;
+    if ("activate" in this.written.expect) return this.written.expect.activate;
+    return void 0;
+  }
+};
+
+// src/hexagon/domain/models/test/TestSuite.ts
+var TEST_SUITE_SCHEMA = z9.strictObject({
+  description: z9.string().min(1).optional(),
+  cases: z9.array(TEST_CASE_SCHEMA.transform((written) => new TestCase(written))).min(1)
+});
+var TestSuite = class {
+  constructor(description, cases, body) {
+    this.description = description;
+    this.cases = cases;
+    this.body = body;
+  }
+  description;
+  cases;
+  body;
+};
+var SAMPLE_CASES = [
+  { do: { touchFile: "src/one.ts" }, expect: { activate: "guide:no-any" } },
+  { do: { touchFile: ".env" }, expect: { allow: false } },
+  { when: "PreToolUse", expect: { run: "sensor:no-secrets" } }
+];
+var SAMPLE = JSON.stringify({ cases: SAMPLE_CASES }, void 0, 1).replace(/\n\s*/g, " ");
+var DEFAULT_TEST_SUITE_BODY = `${JSON.stringify({ description: "What these cases pin down.", cases: [SAMPLE_CASES[0]] }, null, 2)}
+`;
+function testSuiteOf(text) {
+  let written;
+  try {
+    written = JSON.parse(text);
+  } catch {
+    throw new TestSuiteFault(
+      `This file is not JSON, so nothing can read the cases it was meant to hold.`,
+      `Write it as ${SAMPLE}`
+    );
+  }
+  const read = TEST_SUITE_SCHEMA.safeParse(written);
+  if (!read.success) throw new TestSuiteFault(`This file is not written as a suite of cases.`, `Write it as ${SAMPLE}`);
+  return new TestSuite(read.data.description, read.data.cases, text);
+}
+
+// src/hexagon/domain/models/test/TestRoot.ts
+function testSuiteNameOf(path) {
+  return path.slice(`${TEST_DIRECTORY}/`.length);
+}
+var TestRoot = class {
+  constructor(suitesByFile, faultsByFiles) {
+    this.suitesByFile = suitesByFile;
+    this.faultsByFiles = faultsByFiles;
+  }
+  suitesByFile;
+  faultsByFiles;
+  /** Whether a test file is under this name, whether it reads or not. A name
+   *  reaching outside `.cw/test/` is no name of one. */
+  hasTestSuiteNamed(name) {
+    const path = `${TEST_DIRECTORY}/${name}`;
+    return path in this.suitesByFile || path in this.faultsByFiles.files;
+  }
+  /** What a new test file is named: `untitled-<n>.json` for the first `n` no
+   *  test file has (FR-091). */
+  get untitledName() {
+    let untitledNumber = 1;
+    while (this.hasTestSuiteNamed(`untitled-${untitledNumber}.json`)) untitledNumber++;
+    return `untitled-${untitledNumber}.json`;
+  }
+};
+function testRootOf(testSuiteFiles) {
+  const suitesByFile = {};
+  const faultsByFiles = {};
+  for (const { path, contents } of [...testSuiteFiles].sort((one, another) => one.path.localeCompare(another.path))) {
+    try {
+      suitesByFile[path] = testSuiteOf(contents);
+    } catch (raised) {
+      if (!(raised instanceof Fault)) throw raised;
+      faultsByFiles[path] = [raised];
+    }
+  }
+  return new TestRoot(suitesByFile, new FaultsByFile(faultsByFiles));
+}
+
+// src/hexagon/application/dtos.ts
+function catalogueDTO(catalogue2) {
+  return { type: "Catalogue", data: { entries: catalogue2.full.map((one) => ({ type: "CatalogueEntry", data: one })) } };
+}
+function doctorOutcomeDTO({ agents }, faultsByFile2, planSummary2, driftedVendors2, repo) {
+  const faults2 = Object.values(faultsByFile2.files).flat();
+  const errorCount = faults2.filter((one) => one.severity === "error").length;
+  const pendingCount = planSummary2 === void 0 ? null : planSummary2.added.length + planSummary2.edited.length + planSummary2.deleted.length;
+  const unwell = [errorCount > 0, driftedVendors2.length > 0, pendingCount !== 0];
+  return {
+    type: "DoctorOutcome",
+    data: {
+      agents,
+      errorCount,
+      warnCount: faults2.filter((one) => one.severity === "warn").length,
+      pendingCount,
+      faultsByFile: faultsByFileDTO(faultsByFile2, repo),
+      driftedVendors: driftedVendors2,
+      problemCount: unwell.filter(Boolean).length
+    }
+  };
+}
+function explanationOutcomeDTO(scopedPrimitive2, activatesWhen, useMixins, rationale, hosts, citers, testCasesByFile2) {
+  return {
+    type: "ExplanationOutcome",
+    data: {
+      scopedPrimitive: scopedPrimitiveDTO(scopedPrimitive2),
+      activatesWhen,
+      useMixins: useMixins.map(scopedPrimitiveDTO),
+      ...rationale === void 0 ? {} : { rationale: scopedPrimitiveDTO(rationale) },
+      hosts: hosts.map(scopedPrimitiveDTO),
+      citers: citers.map(scopedPrimitiveDTO),
+      testCasesByFile: { type: "TestCasesByFile", data: testCasesByFile2 }
+    }
+  };
+}
+function faultDTO({ message, fix, severity }) {
+  return { type: "Fault", data: { message, fix, severity } };
+}
+function faultsDTO(faults2) {
+  return { type: "Faults", data: { faults: faults2.faults.map(faultDTO) } };
+}
+function faultsByFileDTO(faultsByFile2, repo) {
+  return {
+    type: "FaultsByFile",
+    data: {
+      files: Object.fromEntries(
+        Object.entries(faultsByFile2.namedFrom(repo).files).map(([file, faults2]) => [file, faults2.map(faultDTO)])
+      )
+    }
+  };
+}
+function primitiveSnapshotDTO(scopedPrimitive2, revision) {
+  return {
+    type: "PrimitiveSnapshot",
+    data: { scopedPrimitive: scopedPrimitiveDTO(scopedPrimitive2), body: scopedPrimitive2.primitive.body, revision }
+  };
+}
+function planSummaryDTO({ added, edited, deleted, unchanged }) {
+  return { type: "PlanSummary", data: { added, edited, deleted, unchanged } };
+}
+function primitiveHeaderDTO({ field, shape, required, allowedValues }) {
+  return {
+    type: "PrimitiveHeader",
+    data: { field, shape, required, ...allowedValues === void 0 ? {} : { allowedValues } }
+  };
+}
+function primitiveRequirementsDTO({ headers, sample }) {
+  return { type: "PrimitiveRequirements", data: { headers: headers.map(primitiveHeaderDTO), sample } };
+}
+function primitiveKindsDTO(kinds) {
+  return { type: "PrimitiveKinds", data: Object.fromEntries(kinds.map((one) => [one.kind, one.activatesWhen])) };
+}
+function scopedPrimitiveDTO({ identity, scope, file, primitive }) {
+  return {
+    type: "ScopedPrimitive",
+    data: {
+      identity,
+      kind: primitive.kind,
+      description: primitive.headers.description,
+      file,
+      scope,
+      // A header nobody wrote is left out rather than carried as undefined: this
+      // says what the file declared.
+      headers: Object.fromEntries(
+        Object.entries(primitive.headers).filter(
+          (entry) => entry[1] !== void 0
+        )
+      )
+    }
+  };
+}
+function scopedPrimitivesDTO(scopedPrimitives2) {
+  return {
+    type: "ScopedPrimitives",
+    data: {
+      primitives: [...scopedPrimitives2].sort((one, another) => one.identity < another.identity ? -1 : one.identity > another.identity ? 1 : 0).map(scopedPrimitiveDTO)
+    }
+  };
+}
+function testCaseReportDTO({ suiteName, situation, passed, unmet }) {
+  return {
+    type: "TestCaseReport",
+    data: { suiteName, situation, passed, ...unmet === void 0 ? {} : { unmet: faultDTO(unmet) } }
+  };
+}
+function testRunReportDTO({ testCaseReports }) {
+  return { type: "TestRunReport", data: { testCaseReports: testCaseReports.map(testCaseReportDTO) } };
+}
+function testSuitesDTO({ suitesByFile, faultsByFiles }) {
+  const paths = [...Object.keys(suitesByFile), ...Object.keys(faultsByFiles.files)].sort((one, another) => one.localeCompare(another));
+  return {
+    type: "TestSuites",
+    data: {
+      testSuites: paths.map((path) => {
+        const suite = suitesByFile[path];
+        const [fault2] = faultsByFiles.files[path] ?? [];
+        return {
+          type: "TestSuite",
+          data: {
+            name: testSuiteNameOf(path),
+            ...suite === void 0 ? {} : { text: suite.body },
+            ...suite?.description === void 0 ? {} : { description: suite.description },
+            cases: (suite?.cases ?? []).map(({ situation, expectation, activatedIdentity }) => ({
+              type: "TestCase",
+              data: { situation, expectation, ...activatedIdentity === void 0 ? {} : { identity: activatedIdentity } }
+            })),
+            ...fault2 === void 0 ? {} : { fault: faultDTO(fault2) }
+          }
+        };
+      })
+    }
+  };
+}
+function workspaceSettingsDTO({ agents }) {
+  return { type: "WorkspaceSettings", data: { agents } };
+}
+
+// src/driver/portal/routes.ts
+var json = (schema, description) => ({
+  content: { "application/json": { schema } },
+  description
+});
+function api(charterAuthoringApp2, charterVendoringApp2, testAuthoringApp2) {
+  const app = new OpenAPIHono();
+  app.onError((raised, c) => {
+    if (raised instanceof Fault) return c.json(faultDTO(raised), 422);
+    if (raised instanceof HTTPException) return raised.getResponse();
+    console.error(raised);
+    return c.text(raised.message, 500);
+  });
+  return app.openapi(
+    createRoute({
+      method: "get",
+      path: "/charter/root/faults",
+      responses: { 200: json(DataDTOs.FaultsByFile, "Everything wrong with the charter, under each file") }
+    }),
+    async (c) => c.json((await charterAuthoringApp2.doctor()).data.faultsByFile, 200)
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/charter/root/primitives",
+      request: { query: z10.object({ matching: z10.string().optional() }) },
+      responses: {
+        200: json(DataDTOs.ScopedPrimitives, "Every primitive of every layer, or those mentioning the word"),
+        422: json(z10.union([DataDTOs.FaultsByFile, DataDTOs.Fault]), "The charter does not hold")
+      }
+    }),
+    async (c) => {
+      const scopedPrimitivesDTO2 = await charterAuthoringApp2.fullList(c.req.valid("query").matching || void 0);
+      return scopedPrimitivesDTO2.type === "FaultsByFile" ? c.json(scopedPrimitivesDTO2, 422) : c.json(scopedPrimitivesDTO2, 200);
+    }
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/charter/root/primitives/{identity}/explanation",
+      request: { params: z10.object({ identity: z10.string() }) },
+      responses: {
+        200: json(OutcomeDTOs.ExplanationOutcome, "What the engine says of one primitive"),
+        422: json(z10.union([DataDTOs.FaultsByFile, DataDTOs.Fault]), "The charter does not hold, or holds nothing of it")
+      }
+    }),
+    async (c) => {
+      const { identity } = c.req.valid("param");
+      const explanationOutcomeDTO2 = await charterAuthoringApp2.explain(identity);
+      return explanationOutcomeDTO2.type === "FaultsByFile" ? c.json(explanationOutcomeDTO2, 422) : c.json(explanationOutcomeDTO2, 200);
+    }
+  ).openapi(
+    createRoute({
+      method: "post",
+      path: "/charter/root/primitives",
+      request: {
+        body: json(
+          z10.object({
+            kind: z10.string(),
+            id: z10.string(),
+            headers: z10.record(z10.string(), z10.union([z10.string(), z10.array(z10.string())])),
+            body: z10.string()
+          }),
+          "A new primitive: its kind and id, a line or a list under each header, and its body"
+        )
+      },
+      responses: {
+        201: {
+          ...json(DataDTOs.ScopedPrimitive, "The primitive written"),
+          headers: z10.object({ Location: z10.string() })
+        },
+        422: json(z10.union([DataDTOs.Faults, DataDTOs.Fault]), "The answers the kind refused, or an identity already claimed")
+      }
+    }),
+    async (c) => {
+      const { kind, id, headers, body } = c.req.valid("json");
+      const scopedPrimitiveDTO2 = await charterAuthoringApp2.add(kind, id, headers, body);
+      if (scopedPrimitiveDTO2.type === "Faults") return c.json(scopedPrimitiveDTO2, 422);
+      return c.json(scopedPrimitiveDTO2, 201, { Location: `/api/charter/root/primitives/${scopedPrimitiveDTO2.data.identity}` });
+    }
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/charter/root/primitives/{identity}",
+      request: { params: z10.object({ identity: z10.string() }) },
+      responses: {
+        200: {
+          ...json(DataDTOs.PrimitiveSnapshot, "One primitive as the charter read it"),
+          headers: z10.object({ ETag: z10.string() })
+        },
+        422: json(DataDTOs.Fault, "The charter holds nothing of it")
+      }
+    }),
+    async (c) => {
+      const { identity } = c.req.valid("param");
+      const primitiveSnapshotDTO2 = await charterAuthoringApp2.open(identity);
+      return c.json(primitiveSnapshotDTO2, 200, { ETag: `"${primitiveSnapshotDTO2.data.revision}"` });
+    }
+  ).openapi(
+    createRoute({
+      method: "put",
+      path: "/charter/root/primitives/{identity}",
+      request: {
+        params: z10.object({ identity: z10.string() }),
+        headers: z10.object({ "if-match": z10.string().optional() }),
+        body: json(
+          z10.object({
+            headers: z10.record(z10.string(), z10.union([z10.string(), z10.array(z10.string())])),
+            body: z10.string()
+          }),
+          "A line or a list under each header, and the body, written over the primitive's own"
+        )
+      },
+      responses: {
+        200: json(DataDTOs.ScopedPrimitive, "The primitive written"),
+        412: json(DataDTOs.Fault, "The file changed on disk after it was opened"),
+        422: json(z10.union([DataDTOs.Faults, DataDTOs.Fault]), "The answers the kind refused, or a primitive this repository did not author")
+      }
+    }),
+    async (c) => {
+      const { identity } = c.req.valid("param");
+      const { revision, scopedPrimitive: scopedPrimitive2 } = (await charterAuthoringApp2.open(identity)).data;
+      if (c.req.valid("header")["if-match"] !== `"${revision}"`)
+        return c.json(
+          faultDTO(
+            new Fault(
+              `${scopedPrimitive2.data.file} changed on disk after it was opened, and saving would write over that change.`,
+              "Open it again to see what changed, then make your edit there."
+            )
+          ),
+          412
+        );
+      const { headers, body } = c.req.valid("json");
+      const scopedPrimitiveDTO2 = await charterAuthoringApp2.rewrite(identity, headers, body, revision);
+      return scopedPrimitiveDTO2.type === "Faults" ? c.json(scopedPrimitiveDTO2, 422) : c.json(scopedPrimitiveDTO2, 200);
+    }
+  ).openapi(
+    createRoute({
+      method: "delete",
+      path: "/charter/root/primitives/{identity}",
+      request: { params: z10.object({ identity: z10.string() }) },
+      responses: {
+        204: { description: "The file is gone" },
+        422: json(DataDTOs.Fault, "A primitive this repository did not author, or none at all")
+      }
+    }),
+    async (c) => {
+      const { identity } = c.req.valid("param");
+      await charterAuthoringApp2.remove(identity);
+      return c.body(null, 204);
+    }
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/definitions/kinds",
+      responses: { 200: json(DataDTOs.PrimitiveKinds, "Every kind, and when a primitive of it comes up") }
+    }),
+    async (c) => c.json(await charterAuthoringApp2.kinds(), 200)
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/definitions/kinds/{kind}/requirements",
+      request: { params: z10.object({ kind: z10.string() }) },
+      responses: {
+        200: json(DataDTOs.PrimitiveRequirements, "Every header the kind takes, and its sample"),
+        422: json(DataDTOs.Fault, "A word that is no kind")
+      }
+    }),
+    async (c) => c.json(await charterAuthoringApp2.listPrimitiveRequirements(c.req.valid("param").kind), 200)
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/charter/root/build",
+      responses: {
+        200: json(DataDTOs.PlanSummary, "What a build would do to every file, nothing written"),
+        422: json(DataDTOs.FaultsByFile, "The charter does not hold")
+      }
+    }),
+    async (c) => {
+      const planSummaryDTO2 = await charterAuthoringApp2.preview();
+      return planSummaryDTO2.type === "FaultsByFile" ? c.json(planSummaryDTO2, 422) : c.json(planSummaryDTO2, 200);
+    }
+  ).openapi(
+    createRoute({
+      method: "post",
+      path: "/charter/root/build",
+      responses: {
+        200: json(DataDTOs.PlanSummary, "What the build wrote and deleted"),
+        422: json(DataDTOs.FaultsByFile, "The charter does not hold, and nothing was written")
+      }
+    }),
+    async (c) => {
+      const planSummaryDTO2 = await charterAuthoringApp2.build();
+      return planSummaryDTO2.type === "FaultsByFile" ? c.json(planSummaryDTO2, 422) : c.json(planSummaryDTO2, 200);
+    }
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/charter/root/health",
+      responses: { 200: json(OutcomeDTOs.DoctorOutcome, "The four answers cw doctor gives, and every fault") }
+    }),
+    async (c) => c.json(await charterAuthoringApp2.doctor(), 200)
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/test-suites",
+      responses: { 200: json(DataDTOs.TestSuites, "Every test file, its text, and its cases or why it does not read") }
+    }),
+    async (c) => c.json(await testAuthoringApp2.suites(), 200)
+  ).openapi(
+    createRoute({
+      method: "post",
+      path: "/test-suites",
+      responses: {
+        201: {
+          ...json(z10.string(), "The name of the test file written"),
+          headers: z10.object({ Location: z10.string() })
+        }
+      }
+    }),
+    async (c) => {
+      const name = await testAuthoringApp2.addSuite();
+      return c.json(name, 201, { Location: `/api/test-suites/${name}` });
+    }
+  ).openapi(
+    createRoute({
+      method: "put",
+      path: "/test-suites/{name}",
+      request: {
+        params: z10.object({ name: z10.string() }),
+        body: json(z10.object({ text: z10.string() }), "The whole text the test file is written over with")
+      },
+      responses: {
+        200: json(z10.string(), "The name of the test file written"),
+        422: json(DataDTOs.Fault, "Text that is not a suite, with its sample, or a name that is no test file")
+      }
+    }),
+    async (c) => c.json(await testAuthoringApp2.writeSuite(c.req.valid("param").name, c.req.valid("json").text), 200)
+  ).openapi(
+    createRoute({
+      method: "delete",
+      path: "/test-suites/{name}",
+      request: { params: z10.object({ name: z10.string() }) },
+      responses: {
+        204: { description: "The test file is gone" },
+        422: json(DataDTOs.Fault, "A name that is no test file")
+      }
+    }),
+    async (c) => {
+      await testAuthoringApp2.removeSuite(c.req.valid("param").name);
+      return c.body(null, 204);
+    }
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/test-suites/outcome",
+      responses: {
+        200: json(DataDTOs.TestRunReport, "How every case came out"),
+        422: json(DataDTOs.FaultsByFile, "The charter does not hold, or a test file does not read")
+      }
+    }),
+    async (c) => {
+      const testRunReportDTO2 = await charterAuthoringApp2.test();
+      return testRunReportDTO2.type === "FaultsByFile" ? c.json(testRunReportDTO2, 422) : c.json(testRunReportDTO2, 200);
+    }
+  ).openapi(
+    createRoute({
+      method: "get",
+      path: "/vendors",
+      responses: { 200: json(z10.array(z10.string()).readonly(), "Every folder a vendor source was installed as") }
+    }),
+    async (c) => c.json(await charterVendoringApp2.installed(), 200)
+  ).openapi(
+    createRoute({
+      method: "post",
+      path: "/vendors",
+      request: {
+        body: json(
+          z10.object({ source: z10.string(), version: z10.string().optional() }),
+          "A source as git fetches it, and the version to pin it to where one is named"
+        )
+      },
+      responses: {
+        204: { description: "The source is installed, and committed" },
+        422: json(DataDTOs.Fault, "No repository, work in hand, or what git refused")
+      }
+    }),
+    async (c) => {
+      const { source, version } = c.req.valid("json");
+      await charterVendoringApp2.add(source, version);
+      return c.body(null, 204);
+    }
+  ).openapi(
+    createRoute({
+      method: "delete",
+      path: "/vendors/{name}",
+      request: { params: z10.object({ name: z10.string() }) },
+      responses: {
+        204: { description: "The folder is gone, and that it is gone is committed" },
+        422: json(DataDTOs.Fault, "No repository, work in hand, or what git refused")
+      }
+    }),
+    async (c) => {
+      await charterVendoringApp2.remove(c.req.valid("param").name);
+      return c.body(null, 204);
+    }
+  );
+}
+
+// src/driver/portal/server.ts
+var DEFAULT_PORT = 9927;
+async function startPortal(page, charterAuthoringApp2, charterVendoringApp2, testAuthoringApp2, port = DEFAULT_PORT) {
+  await access(new URL("index.html", page)).catch(() => {
+    throw new Fault("The portal's page is not built.", 'Run "pnpm build", then start the portal again.');
+  });
+  const token = randomBytes(32).toString("base64url");
+  for (let next = port; ; next++) {
+    try {
+      const address = new URL(`http://127.0.0.1:${next}/?t=${token}`);
+      return { address, server: await listen(portal(page, charterAuthoringApp2, charterVendoringApp2, testAuthoringApp2, token, next), next) };
+    } catch (raised) {
+      if (raised.code !== "EADDRINUSE" || next === 65535) throw raised;
+    }
+  }
+}
+function portal(page, charterAuthoringApp2, charterVendoringApp2, testAuthoringApp2, token, port) {
+  const hosts = [`127.0.0.1:${port}`, `localhost:${port}`];
+  return new Hono().use(async (c, next) => {
+    if (!hosts.includes(c.req.header("host") ?? "")) {
+      return c.text(`The portal answers only at ${hosts.join(" and ")}.`, 403);
+    }
+    if (c.req.method !== "GET" && c.req.header("content-type")?.split(";")[0]?.trim() !== "application/json") {
+      return c.text("Every request but a GET is sent with Content-Type: application/json.", 415);
+    }
+    await next();
+  }).use("/", async (c, next) => {
+    if (c.req.query("t") !== token) return c.text('Open the address "cw portal" printed: this one has no token.', 401);
+    await next();
+  }).use("/api/*", bearerAuth({ token })).route("/api", api(charterAuthoringApp2, charterVendoringApp2, testAuthoringApp2)).use("/*", serveStatic({ root: fileURLToPath(page) }));
+}
+function listen(app, port) {
+  return new Promise((resolve, reject) => {
+    const server = serve({ fetch: app.fetch, hostname: "127.0.0.1", port }, () => resolve(server));
+    server.once("error", reject);
+  });
+}
+
+// src/driver/cli/commands/PortalCommand.ts
+var OPTIONS6 = {
+  port: {
+    type: "number",
+    describe: "Which port to serve on, the next free one when it is taken",
+    default: DEFAULT_PORT
+  }
+};
+var PortalCommand = class {
+  name = "portal";
+  summary = "Serve this repository's charter to a browser on this machine";
+  options = OPTIONS6;
+  async run({ charterAuthoringApp: charterAuthoringApp2, charterVendoringApp: charterVendoringApp2, testAuthoringApp: testAuthoringApp2 }, { port }) {
+    await charterAuthoringApp2.ensureRepoReady();
+    const { address } = await startPortal(
+      new URL("./", import.meta.resolve("#portal/index.html")),
+      charterAuthoringApp2,
+      charterVendoringApp2,
+      testAuthoringApp2,
+      port
+    );
+    return { code: EXIT_OK, result: `The portal is at ${address}
+Press Ctrl+C to stop it.
+` };
+  }
+};
+
+// src/driver/cli/commands/RemoveCommand.ts
+import prompts3 from "prompts";
+var OPTIONS7 = {
+  identity: {
+    type: "string",
+    describe: 'What the primitive is named by across the whole charter: "guide:no-any"'
+  },
+  yes: {
+    type: "boolean",
+    alias: "y",
+    default: false,
+    describe: "Remove it without asking first, as a run with nobody at the terminal must"
+  }
+};
+var RemoveCommand = class {
+  name = "remove <identity>";
+  summary = "Delete the file of one primitive this repository authored";
+  options = OPTIONS7;
+  async run({ charterAuthoringApp: charterAuthoringApp2 }, { identity, yes }) {
+    const { scopedPrimitive: scopedPrimitive2 } = (await charterAuthoringApp2.open(identity ?? "")).data;
+    if (!yes && scopedPrimitive2.data.scope === REPO_SCOPE) {
+      if (!process.stdin.isTTY)
+        throw new Fault(
+          `Removing ${scopedPrimitive2.data.file} is asked first, and nobody is at the terminal to answer.`,
+          `Run "cw remove ${scopedPrimitive2.data.identity} --yes" to remove it without asking.`
+        );
+      const { confirmed } = await prompts3({
+        type: "confirm",
+        name: "confirmed",
+        message: `Remove ${scopedPrimitive2.data.file}?`,
+        initial: false
+      });
+      if (confirmed !== true) return { code: EXIT_OK, result: "Nothing was removed.\n" };
+    }
+    const scopedPrimitiveDTO2 = await charterAuthoringApp2.remove(scopedPrimitive2.data.identity);
+    return {
+      code: EXIT_OK,
+      result: [
+        `Removed ${scopedPrimitiveDTO2.data.file}.`,
+        'Run "cw doctor" to see what still names it, then "cw build".',
+        ""
+      ].join("\n")
+    };
+  }
+};
+
+// src/driver/cli/commands/SuiteAddCommand.ts
+var SuiteAddCommand = class {
+  name = "suite add";
+  summary = `Write a new test file under ${TEST_DIRECTORY}/, holding one sample case`;
+  async run({ testAuthoringApp: testAuthoringApp2 }) {
+    const name = await testAuthoringApp2.addSuite();
+    return {
+      code: EXIT_OK,
+      result: [`Wrote ${TEST_DIRECTORY}/${name}.`, `Run "cw suite edit ${name}" to write its cases, then "cw test".`, ""].join("\n")
+    };
+  }
+};
+
+// src/driver/cli/commands/SuiteEditCommand.ts
+var OPTIONS8 = {
+  name: {
+    type: "string",
+    describe: `The test file's name under ${TEST_DIRECTORY}/: "untitled-1.json"`
+  }
+};
+var SuiteEditCommand = class {
+  name = "suite edit <name>";
+  summary = "Open one test file in your editor";
+  options = OPTIONS8;
+  async run({ cwd, testAuthoringApp: testAuthoringApp2 }, { name }) {
+    const { testSuites: testSuites2 } = (await testAuthoringApp2.suites()).data;
+    if (!testSuites2.some((one) => one.data.name === name))
+      throw new Fault(`${TEST_DIRECTORY}/ holds no test file called "${name ?? ""}".`, 'Run "cw suite add" to write a new one.');
+    const file = `${TEST_DIRECTORY}/${name}`;
+    const problem = await editInEditor(cwd, file);
+    if (problem !== void 0) return { code: EXIT_FAILURE, problem };
+    return { code: EXIT_OK, result: [`Closed ${file}.`, 'Run "cw test" to see how its cases come out.', ""].join("\n") };
+  }
+};
+
+// src/driver/cli/commands/SuiteRemoveCommand.ts
+var OPTIONS9 = {
+  name: {
+    type: "string",
+    describe: `The test file's name under ${TEST_DIRECTORY}/: "untitled-1.json"`
+  }
+};
+var SuiteRemoveCommand = class {
+  name = "suite remove <name>";
+  summary = "Delete one test file";
+  options = OPTIONS9;
+  async run({ testAuthoringApp: testAuthoringApp2 }, { name }) {
+    const removedName = await testAuthoringApp2.removeSuite(name ?? "");
+    return { code: EXIT_OK, result: `Removed ${TEST_DIRECTORY}/${removedName}.
+` };
+  }
+};
+
+// src/driver/cli/commands/TestCommand.ts
+var TestCommand = class {
+  name = "test";
+  summary = `Resolve every situation in ${TEST_DIRECTORY}/ against the charter`;
+  async run({ charterAuthoringApp: charterAuthoringApp2 }, _options) {
+    const testRunReportDTO2 = await charterAuthoringApp2.test();
+    if (testRunReportDTO2.type === "FaultsByFile")
+      return { code: EXIT_FAILURE, problem: `Nothing was resolved.
+
+${toText(testRunReportDTO2)}` };
+    const cases = testRunReportDTO2.data.testCaseReports;
+    if (cases.length === 0) {
+      return {
+        code: EXIT_OK,
+        result: `No tests: ${TEST_DIRECTORY}/ holds no case.
+Write one as ${TEST_DIRECTORY}/<name>.json to pin a situation down.
+`
+      };
+    }
+    const failed = cases.filter((one) => !one.data.passed);
+    return {
+      code: failed.length === 0 ? EXIT_OK : EXIT_FAILURE,
+      result: [
+        ...cases.flatMap(lines2),
+        "",
+        failed.length === 0 ? `${cases.length} case${cases.length === 1 ? "" : "s"} passed.` : `${failed.length} of ${cases.length} case${cases.length === 1 ? "" : "s"} failed.`,
+        ""
+      ].join("\n")
+    };
+  }
+};
+function lines2(one) {
+  return [
+    `  ${one.data.passed ? "pass" : "FAIL"}  ${one.data.situation}`,
+    ...one.data.unmet === void 0 ? [] : [`          ${one.data.unmet.data.message}`, `          ${one.data.unmet.data.fix}`]
+  ];
+}
+
+// src/driver/cli/commands/VendorAddCommand.ts
+var OPTIONS10 = {
+  source: {
+    type: "string",
+    describe: "What git clones the charter from: an address over any transport, or a path on disk"
+  },
+  ref: {
+    type: "string",
+    describe: "The tag, branch or commit to pin to; the source's own default where none is named"
+  }
+};
+var VendorAddCommand = class {
+  name = "vendor add <source>";
+  summary = "Install a charter from a git source, or bring an installed one up to date";
+  options = OPTIONS10;
+  async run({ charterVendoringApp: charterVendoringApp2 }, { source, ref }) {
+    const folder = await charterVendoringApp2.add(source ?? "", ref);
+    return {
+      code: EXIT_OK,
+      result: [
+        `Installed ${source} under ${folder}${ref === void 0 ? "" : `, pinned to ${ref}`}.`,
+        'Run "cw build" to compile what it adds to this charter.',
+        ""
+      ].join("\n")
+    };
+  }
+};
+
+// src/driver/cli/commands/VendorListCommand.ts
+var VendorListCommand = class {
+  name = "vendor list";
+  summary = "List the folders this repository installed charters as";
+  async run({ charterVendoringApp: charterVendoringApp2 }) {
+    const folders = await charterVendoringApp2.installed();
+    if (folders.length === 0)
+      return { code: EXIT_OK, result: 'No vendor source is installed. Run "cw vendor add <source>" to install one.\n' };
+    return { code: EXIT_OK, result: `${folders.join("\n")}
+` };
+  }
+};
+
+// src/driver/cli/commands/VendorRemoveCommand.ts
+var OPTIONS11 = {
+  name: {
+    type: "string",
+    describe: "The folder this charter was installed as, as it reads under .cw/vendor/"
+  }
+};
+var VendorRemoveCommand = class {
+  name = "vendor remove <name>";
+  summary = "Take an installed charter away";
+  options = OPTIONS11;
+  async run({ charterVendoringApp: charterVendoringApp2 }, { name }) {
+    const folder = await charterVendoringApp2.remove(name ?? "");
+    return {
+      code: EXIT_OK,
+      result: [
+        `Removed ${folder}.`,
+        'Run "cw build" to compile this charter without it.',
+        ""
+      ].join("\n")
+    };
+  }
+};
+
+// src/driver/cli/commands/index.ts
+var COMMANDS = [
+  new InitCommand(),
+  new BuildCommand(),
+  new ListCommand(),
+  new KindsCommand(),
+  new AddCommand(),
+  new EditCommand(),
+  new RemoveCommand(),
+  new ExplainCommand(),
+  new DoctorCommand(),
+  new TestCommand(),
+  new SuiteAddCommand(),
+  new SuiteEditCommand(),
+  new SuiteRemoveCommand(),
+  new VendorAddCommand(),
+  new VendorRemoveCommand(),
+  new VendorListCommand(),
+  new PortalCommand()
+];
+
+// src/driver/cli/Commander.ts
+var Commander = class {
+  #context;
+  #commands;
+  constructor(context, commands = COMMANDS) {
+    this.#context = context;
+    this.#commands = commands;
+  }
+  async run(argv) {
+    let code = EXIT_OK;
+    let failed = false;
+    await this.#parser((outcome) => {
+      code = outcome.code;
+      if (outcome.result) process.stdout.write(outcome.result);
+      if (outcome.problem) process.stderr.write(outcome.problem);
+    }).parseAsync([...argv], {}, (error, _parsed, output) => {
+      failed = error !== null && error !== void 0;
+      if (output) (failed ? process.stderr : process.stdout).write(`${output}
+`);
+    });
+    return failed ? EXIT_USAGE : code;
+  }
+  #parser(collect) {
+    let cli2 = yargs().scriptName("cw").usage("Usage: $0 <command> [options]").demandCommand(1, "").strict().recommendCommands().help("help").alias("h", "help").version(this.#context.version).wrap(80).exitProcess(false);
+    const groups = /* @__PURE__ */ new Map();
+    for (const command of this.#commands) {
+      const head = wordsOf(command.name)[0];
+      groups.set(head, [...groups.get(head) ?? [], command]);
+    }
+    for (const [head, commands] of groups) {
+      const [only] = commands;
+      cli2 = commands.length === 1 && only !== void 0 && wordsOf(only.name).length === 1 ? this.#declaringCommand(cli2, only, only.name, collect) : cli2.command({
+        command: head,
+        // What the group is for is what its commands are: saying it any
+        // other way would be a second description to keep in step.
+        describe: commands.map((one) => wordsOf(one.name)[1]).join(", "),
+        builder: (child) => commands.reduce((parser, command) => this.#declaringCommand(parser, command, command.name.slice(head.length + 1), collect), child).demandCommand(1, ""),
+        handler: () => void 0
+      });
+    }
+    return cli2;
+  }
+  /** One command, said to yargs under the name it is typed by — the whole of it
+   *  for a command that stands alone, what follows the group for one inside
+   *  it. */
+  #declaringCommand(cli2, command, name, collect) {
+    return cli2.command({
+      command: name,
+      describe: command.summary,
+      builder: (child) => declaringArguments(child, command.options ?? {}, name),
+      handler: async (options) => {
+        try {
+          collect(await command.run(this.#context, options));
+        } catch (raised) {
+          if (!(raised instanceof Fault)) throw raised;
+          collect({ code: EXIT_FAILURE, problem: `${raised.message}
+  ${raised.fix}
+` });
+        }
+      }
+    });
+  }
+};
+function wordsOf(name) {
+  return name.split(" ").filter((word) => !word.startsWith("<") && !word.startsWith("["));
+}
+function declaringArguments(cli2, options, name) {
+  return Object.entries(options).reduce((parser, [argument, option]) => {
+    const declared = {
+      type: option.type,
+      describe: option.describe,
+      ...option.alias === void 0 ? {} : { alias: option.alias },
+      ...option.default === void 0 ? {} : { default: option.default },
+      // Typed once per value: yargs collects them, and a run that typed none
+      // reads an empty list rather than nothing, so the command asks how many
+      // were typed instead of whether any were.
+      ...option.isArray === void 0 ? {} : { array: true, default: [] }
+    };
+    return name.includes(`<${argument}>`) || name.includes(`[${argument}]`) ? parser.positional(argument, declared) : parser.option(argument, declared);
+  }, cli2);
+}
+
+// src/hexagon/domain/models/charter/builtin/CwAuthorSkill.ts
+var CwAuthorSkill = class extends SkillPrimitive {
+  constructor() {
+    super(
+      {
+        id: "cw-author",
+        description: "Author a new primitive of this repository's charter, asking cw what its kind requires.",
+        triggers: [
+          "write a rule",
+          "add a standard",
+          "write a skill",
+          "add a command",
+          "author a primitive of the charter"
+        ]
+      },
+      `# Authoring a primitive of this charter
+
+This skill is cw's own. It comes with the engine, is not authored in this
+repository, and cannot be changed here. A repository that wants another way of
+authoring writes a primitive of its own, under an identity of its own.
+
+It covers writing a new primitive. Changing or removing one that already exists
+is not what it covers.
+
+Do not write a primitive from memory, or copy the headers of another one. What a
+kind requires is asked of cw, which answers from the same contract a file is
+refused against.
+
+1. If the kind is not settled, run \`cw kinds\`. It names every kind and when a
+   primitive of each comes up; take the one whose line matches what is being
+   asked for.
+2. Run \`cw kinds <kind>\`. It names every header that kind requires, the shape
+   each takes \u2014 one line, or a list \u2014 the values one drawn from a closed set
+   may hold, and a sample written in full.
+3. Run \`cw add <kind> <id> --header <name>=<value>\`, one \`--header\` for each
+   header step 2 named, and for any other the sample shows this primitive
+   needs. A header that takes a list is given once per entry, in order; one that
+   takes a line is given once. Everything after the first \`=\` is the value. If
+   cw refuses, it says why and shows the kind's sample: answer again with that
+   in hand. Nothing is written until the headers hold.
+4. Write the body into the file cw named. The headers decide when the primitive
+   comes up; the body is what an agent reads once it has.
+5. Run \`cw build\`. If it refuses, \`cw doctor\` names each file with a problem
+   and how to fix it.`
+    );
+  }
+};
+
+// src/hexagon/domain/models/charter/builtin/index.ts
+var BUILTIN_PRIMITIVES = [new CwAuthorSkill()];
+
+// src/hexagon/service/charterRepo.ts
+async function loadCharterRoot(repo, fileReaders, yamlParser2) {
+  const repoHref = repo.href.endsWith("/") ? repo.href : `${repo.href}/`;
+  const read = async (layer2) => (await fileReaders.readFilesRecursively(layer2)).filter(
+    ({ file }) => file.href.endsWith(".md") && KINDS.some((kind) => file.href.startsWith(`${layer2.href}${kind}/`))
+  ).map(({ file, contents }) => ({ path: decodeURIComponent(file.href.slice(repoHref.length)), contents }));
+  const authoredFiles = await read(charterFolderIn(repo));
+  const vendors = await fileReaders.listFolders(vendorFolderIn(repo));
+  const vendorFiles = await Promise.all(
+    vendors.map(async (folder) => {
+      const vendor = decodeURIComponent(folder.href.split("/").at(-2) ?? "");
+      return (await read(folder)).map((one) => ({ ...one, vendor }));
+    })
+  );
+  const builtinFiles = BUILTIN_PRIMITIVES.map((primitive) => ({
+    path: `${BUILTIN_PATH_PREFIX}/${primitive.kind}/${primitive.headers.id}.md`,
+    contents: primitive.toMarkdown()
+  }));
+  return charterRootOf({ repo: authoredFiles, vendor: vendorFiles.flat(), builtin: builtinFiles }, yamlParser2);
+}
+async function writeCharter(repo, primitive, fileReader2, fileWriter2) {
+  const under2 = `${primitive.kind}/${primitive.headers.id}.md`;
+  const path = `${CHARTER_DIRECTORY}/${under2}`;
+  const file = new URL(under2, charterFolderIn(repo));
+  if (await fileReader2.readIfThere(file) !== void 0)
+    throw new Fault(
+      `${path} is already there, and writing this one would write over what it holds.`,
+      `Open it, or run this again with an identity this charter has not got.`
+    );
+  await fileWriter2.write(file, primitive.toMarkdown());
+  return new ScopedPrimitive(identityOf({ kind: primitive.kind, id: primitive.headers.id }), REPO_SCOPE, path, primitive);
+}
+
+// src/hexagon/domain/models/Settings.ts
+import { z as z11 } from "zod";
+var SETTINGS = z11.object({
+  agents: z11.array(z11.enum(AGENT_PROVIDERS))
+});
+var WorkspaceSettings = class {
+  constructor(agents) {
+    this.agents = agents;
+  }
+  agents;
+};
+
+// src/hexagon/service/settingsRepo.ts
+async function loadSettings(repo, fileReaders) {
+  const text = await fileReaders.readIfThere(settingsFileIn(repo));
+  if (text === void 0) return new WorkspaceSettings([]);
+  let written;
+  try {
+    written = JSON.parse(text);
+  } catch {
+    throw new SettingsFault(
+      `These are this repository's own settings and this is not JSON.`,
+      `Correct it, or delete it and run "cw init" to write it again.`
+    );
+  }
+  const read = SETTINGS.safeParse(written);
+  if (!read.success) throw whatIsWrongWith(written);
+  return new WorkspaceSettings(read.data.agents);
+}
+function whatIsWrongWith(written) {
+  if (typeof written !== "object" || written === null || Array.isArray(written))
+    return new SettingsFault(
+      `These are this repository's own settings and this holds something other than a set of fields.`,
+      `Write it as an object, as in { "agents": ["claude"] }.`
+    );
+  const agents = written.agents;
+  if (!Array.isArray(agents))
+    return new SettingsFault(
+      `"agents" is what this repository compiles its charter for, and it is not a list of names here.`,
+      `Write it as a list of names, as in { "agents": ["claude"] }.`
+    );
+  return new SettingsFault(
+    `This says it compiles for ${agents.filter((one) => !isAgentProvider(one)).map((one) => `"${String(one)}"`).join(", ")}, and this engine compiles for no such agent.`,
+    `Name any of ${AGENT_PROVIDERS.join(", ")}, or drop what is left.`
+  );
+}
+
+// src/hexagon/service/testSuitesRepo.ts
+async function loadTestRoot(repo, fileReaders) {
+  const repoHref = repo.href.endsWith("/") ? repo.href : `${repo.href}/`;
+  return testRootOf(
+    (await fileReaders.readFilesRecursively(testFolderIn(repo))).filter(({ file }) => file.href.endsWith(".json")).map(({ file, contents }) => ({ path: decodeURIComponent(file.href.slice(repoHref.length)), contents }))
+  );
+}
+async function addTestSuite(repo, fileReaders, fileWriter2) {
+  const name = (await loadTestRoot(repo, fileReaders)).untitledName;
+  await fileWriter2.write(new URL(name, testFolderIn(repo)), DEFAULT_TEST_SUITE_BODY);
+  return name;
+}
+async function writeTestSuite(repo, fileReaders, fileWriter2, name, text) {
+  await ensureTestSuiteNamed(repo, fileReaders, name);
+  testSuiteOf(text);
+  await fileWriter2.write(new URL(name, testFolderIn(repo)), text);
+  return name;
+}
+async function removeTestSuite(repo, fileReaders, fileWriter2, name) {
+  await ensureTestSuiteNamed(repo, fileReaders, name);
+  await fileWriter2.delete(new URL(name, testFolderIn(repo)));
+  return name;
+}
+async function ensureTestSuiteNamed(repo, fileReaders, name) {
+  if (!(await loadTestRoot(repo, fileReaders)).hasTestSuiteNamed(name))
+    throw new TestSuiteFault(`${TEST_DIRECTORY}/ holds no test file called "${name}".`, 'Run "cw suite add" to write a new one.');
+}
+
+// src/hexagon/domain/models/vendor/VendorSource.ts
+var VendorSource = class {
+  constructor(source, name) {
+    this.source = source;
+    this.name = name;
+  }
+  source;
+  name;
+};
+function vendorSourceOf(source) {
+  const name = source.replace(/\.git$/, "").split(/[/:\\]/).filter(Boolean).at(-1) ?? "";
+  if (name === "." || name === ".." || name === "") throw new VendorFault(`Invalid path "${source}".`, "Use correct git path.");
+  return new VendorSource(source, name);
+}
+
+// src/hexagon/service/vendorRepo.ts
+async function loadVendorNames(repo, fileReaders) {
+  return (await fileReaders.listFolders(vendorFolderIn(repo))).map((folder) => `${VENDOR_DIRECTORY}/${decodeURIComponent(folder.href.split("/").at(-2) ?? "")}`).sort();
+}
+async function ensureVCSReady(repo, vcs2, because) {
+  if (!await vcs2.isInstalled(repo))
+    throw new Fault(
+      "This folder is not inside a git repository, and a vendor lives in one.",
+      'Run "git init" here, or run this again where your repository is.'
+    );
+  if (!await vcs2.isClean(repo))
+    throw new Fault(
+      `This repository has work in hand, and ${because}.`,
+      "Commit or stash what you are holding, then run this again."
+    );
+}
+async function addVendor(repo, vcs2, source, version) {
+  await ensureVCSReady(repo, vcs2, "installing a vendor commits what it installs");
+  const folder = `${VENDOR_DIRECTORY}/${vendorSourceOf(source).name}`;
+  await vcs2.subtreeAdd(source, repo, folder, version);
+  return folder;
+}
+async function removeVendor(repo, vcs2, name) {
+  await ensureVCSReady(repo, vcs2, "removing a vendor commits that it is gone");
+  const folder = `${VENDOR_DIRECTORY}/${vendorSourceOf(name).name}`;
+  await vcs2.removeSubFolder(repo, folder);
+  return folder;
+}
+async function driftedVendors(repo, vcs2) {
+  const changed = await vcs2.changedUnder(repo, VENDOR_DIRECTORY);
+  const names = changed.map((path) => path.slice(`${VENDOR_DIRECTORY}/`.length).split("/")[0]).filter((name) => name !== void 0 && name !== "");
+  return [...new Set(names)].sort();
+}
+
+// src/hexagon/domain/services/testService.ts
+var TestCaseReport = class {
+  constructor(suiteName, situation, unmet) {
+    this.suiteName = suiteName;
+    this.situation = situation;
+    this.unmet = unmet;
+  }
+  suiteName;
+  situation;
+  unmet;
+  get passed() {
+    return this.unmet === void 0;
+  }
+};
+var TestRunReport = class {
+  constructor(testCaseReports) {
+    this.testCaseReports = testCaseReports;
+  }
+  testCaseReports;
+};
+function runSuite(charter, suiteName, suite) {
+  return suite.cases.map((one) => runCase(charter, suiteName, one));
+}
+function findUntestedPrimitives(charter, testSuites2) {
+  const testedIdentities = new Set(testSuites2.flatMap((testSuite2) => testSuite2.cases.map((one) => one.activatedIdentity)));
+  const faultsByFiles = {};
+  for (const { identity, file, primitive } of charter.primitives) {
+    if (primitive.kind !== "guide" && primitive.kind !== "sensor" || testedIdentities.has(identity)) continue;
+    faultsByFiles[file] = [
+      new TestCaseFault(
+        `No test case names "${identity}", so nothing notices when it stops coming up where it should.`,
+        primitive.kind === "guide" ? `Add a case to a file under .cw/test/: { "do": { "touchFile": "<a file it speaks about>" }, "expect": { "activate": "${identity}" } }.` : `Add a case to a file under .cw/test/: { "when": "${primitive.headers.signal}", "expect": { "run": "${identity}" } }.`,
+        "warn"
+      )
+    ];
+  }
+  return new FaultsByFile(faultsByFiles);
+}
+function runCase(charter, suiteName, one) {
+  const written = one.written;
+  if ("when" in written) {
+    return new TestCaseReport(suiteName, one.describe(), assertScriptRun(charter, written.when, written.expect.run));
+  }
+  if ("do" in written) {
+    const { touchFile } = written.do;
+    if ("activate" in written.expect) {
+      return new TestCaseReport(suiteName, one.describe(), assertPrimitiveActivated(charter, touchFile, written.expect.activate));
+    }
+    if ("allow" in written.expect) {
+      return new TestCaseReport(suiteName, one.describe(), assertAllowed(charter, touchFile, written.expect.allow));
+    }
+  }
+  throw new Error(`Never happen`);
+}
+function assertPrimitiveActivated(charter, file, identity) {
+  const declared = charter.primitiveById.get(identity);
+  if (declared === void 0) return primitiveNotFound(identity);
+  if (declared.primitive.kind !== "guide")
+    return new TestCaseFault(
+      `Coming up when a file is touched is a guide's rule, and "${identity}" is a ${declared.primitive.kind}.`,
+      `Expect a guide here, or put the situation that kind answers.`
+    );
+  const { globs = [] } = declared.primitive.headers;
+  if (globs.length === 0)
+    return new TestCaseFault(
+      `"${identity}" names no files, so touching one never brings it up.`,
+      `Give that guide "globs", or expect nothing of it here.`
+    );
+  return globs.some((glob) => matches(glob, file)) ? void 0 : new TestCaseFault(
+    `This file matches none of the globs "${identity}" speaks about: ${globs.join(", ")}.`,
+    `Widen that guide's "globs", or touch a file it already speaks about.`
+  );
+}
+function assertAllowed(charter, file, expected) {
+  const denying = charter.primitives.filter(
+    ({ primitive }) => primitive.kind === "posture" && primitive.headers.deny.some((glob) => matches(glob, file))
+  );
+  if (expected)
+    return denying.length === 0 ? void 0 : new TestCaseFault(
+      `${denying.map((one) => `"${one.identity}"`).join(", ")} denies this file.`,
+      `Drop it from that posture's "deny", or expect "allow": false.`
+    );
+  const postures = charter.primitives.filter(({ primitive }) => primitive.kind === "posture");
+  if (postures.length === 0)
+    return new TestCaseFault(
+      `This charter holds no posture, so it refuses nothing.`,
+      `Author a posture denying this file, or expect "allow": true.`
+    );
+  return denying.length > 0 ? void 0 : new TestCaseFault(
+    `No posture denies this file.`,
+    `Add it to a posture's "deny", or expect "allow": true.`
+  );
+}
+function assertScriptRun(charter, event, identity) {
+  const declared = charter.primitiveById.get(identity);
+  if (declared === void 0) return primitiveNotFound(identity);
+  if (declared.primitive.kind !== "sensor")
+    return new TestCaseFault(
+      `Running when an event is raised is a sensor's rule, and "${identity}" is a ${declared.primitive.kind}.`,
+      `Expect a sensor here, or put the situation that kind answers.`
+    );
+  const { signal } = declared.primitive.headers;
+  return signal === event ? void 0 : new TestCaseFault(
+    `"${identity}" fires on ${signal}, not on ${event}.`,
+    `Raise the event it names, or declare the "signal" this case raises.`
+  );
+}
+function primitiveNotFound(identity) {
+  return new TestCaseFault(
+    `This charter holds no primitive called "${identity}".`,
+    `Author it, or correct the name. "cw list --min" says every identity this charter does hold.`
+  );
+}
+
+// src/hexagon/domain/specifications/RepoScopedPrimitive.ts
+var RepoScopedPrimitive = class {
+  static isSatisfiedBy(scopedPrimitive2) {
+    return scopedPrimitive2.scope === REPO_SCOPE;
+  }
+};
+
+// src/hexagon/application/helper.ts
+async function contentHashOf(content) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(content));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/hexagon/domain/models/output/StampedDocument.ts
+var GENERATED_STAMP = "Generated by cherry-works";
+function stamp(document) {
+  return `${document.replace(/\n+$/, "")}
+
+<!-- ${GENERATED_STAMP}. Do not edit; edit the charter and build again. -->
+`;
+}
+function isStamped(contents) {
+  return contents.includes(GENERATED_STAMP);
+}
+
+// src/hexagon/domain/models/output/CharterOutput.ts
+var Catalogue = class _Catalogue {
+  constructor(entries) {
+    this.entries = entries;
+  }
+  entries;
+  static of(entries) {
+    return new _Catalogue(
+      [...entries].sort((one, another) => one.identity < another.identity ? -1 : one.identity > another.identity ? 1 : 0)
+    );
+  }
+  /** This listing is the charter's own file: it says what the charter holds now,
+   *  and nothing else has anything to say in it. */
+  projection = "replace";
+  /**
+   * The same listing, narrowed to the primitives of one kind (FR-011).
+   *
+   * A narrowed listing is a listing: what comes back answers `full` and
+   * `compact` the way this does, so whoever reads it never has to ask whether it
+   * was narrowed. Nothing is re-sorted — the entries keep the order they were
+   * put in, which is the order by identity `of` gave them.
+   */
+  filterByKind(kind) {
+    return new _Catalogue(this.entries.filter((one) => one.kind === kind));
+  }
+  /** Everything every primitive's headers declare about it, and the file its body
+   *  is in (FR-011). */
+  get full() {
+    return this.entries;
+  }
+  /**
+   * The same primitives as an agent surveys them: what each is, what it is
+   * called, and the one line saying what it is for (FR-012).
+   *
+   * This is what an agent reads first, so it holds nothing an agent surveying the
+   * charter would not use — no globs, no tags, and no file. Having found what it
+   * wants here, it asks `full` where that identity lives.
+   */
+  get compact() {
+    return this.entries.map(({ identity, kind, id, description }) => ({ identity, kind, id, description }));
+  }
+};
+var CharterMd = class _CharterMd {
+  constructor(body) {
+    this.body = body;
+  }
+  body;
+  static type = "charter-md";
+  type = _CharterMd.type;
+  static of(kinds) {
+    return new _CharterMd(`${[
+      "# Charter",
+      `This repository is governed by a charter \u2014 the standards it authored under \`${CHARTER_DIRECTORY}/\`, which constrain whatever coding agent runs here. Every surface an agent reads, this file included, is generated from that charter: do not edit them, edit the primitive behind them.`,
+      "## Read first",
+      `[catalog.min.json](./catalog.min.json) \u2014 the kind, identity and description of every primitive this charter holds. Survey it to find what you need; open [catalog.json](./catalog.json) for that primitive's file, globs and mixins, and open a body only once its activation condition below is met.`,
+      "## When each kind applies",
+      kinds.map((one) => `- **${one.kind}** \u2014 ${one.activatesWhen}.`).join("\n"),
+      "## One identity, one primitive",
+      `An identity names one primitive in the whole charter: \`kind:id\`, whether this repository authored it, installed it from a vendor, or the engine brought it. Nothing overrides anything \u2014 two files claiming one identity is an error the charter refuses to build with.`
+    ].join("\n\n")}
+`);
+  }
+  /** This file is the charter's own: it is written whole over whatever is
+   *  there. */
+  projection = "replace";
+  /** This file as a reader opens it: the stamp saying this engine wrote it, and
+   *  the orientation itself. */
+  toStampedDocument() {
+    return stamp(this.body);
+  }
+};
+
+// src/hexagon/domain/models/output/providers/claude/ClaudeSettingsComponent.ts
+var CLAUDE_HOOK_EVENTS = [
+  "PreToolUse",
+  "PostToolUse",
+  "UserPromptSubmit",
+  "Notification",
+  "Stop",
+  "SubagentStop",
+  "PreCompact",
+  "SessionStart",
+  "SessionEnd"
+];
+function isClaudeHookEvent(name) {
+  return CLAUDE_HOOK_EVENTS.includes(name);
+}
+var ClaudeSettingsComponent = class _ClaudeSettingsComponent {
+  constructor(settings) {
+    this.settings = settings;
+  }
+  settings;
+  static kind = "settings";
+  kind = _ClaudeSettingsComponent.kind;
+  /** The settings file this host reads is shared with whatever the repository set
+   *  for itself, so what is put down there is written into what is there rather
+   *  than in place of it (FR-018). */
+  projection = "mergeJSON";
+  static of(settings) {
+    return new _ClaudeSettingsComponent(settings);
+  }
+};
+
+// src/hexagon/domain/models/output/providers/claude/document-based-components/DocumentBasedComponent.ts
+var DocumentBasedComponent = class {
+  constructor(name, headers, body) {
+    this.name = name;
+    this.headers = headers;
+    this.body = body;
+  }
+  name;
+  headers;
+  body;
+  /** A document is this primitive's alone, so putting it down replaces whatever
+   *  is there (FR-020). */
+  projection = "replace";
+  /**
+   * This document as the file this host reads: its frontmatter, its body, and
+   * the stamp saying this engine wrote it.
+   *
+   * Called where a projection is put on disk. A kind that declares no frontmatter
+   * gets none.
+   *
+   * Every one of them carries the stamp, which is what a reader is told and what
+   * a build reads back before taking a file away — a document without it is
+   * someone's own and is left alone (FR-017, FR-020).
+   */
+  toStampedDocument() {
+    const headers = Object.entries(this.headers);
+    return stamp(
+      [
+        // A kind whose file this host reads whole declares no frontmatter, and
+        // gets none: an empty block would be this engine writing a field for
+        // this host to read, and there is none to write.
+        ...headers.length === 0 ? [] : [["---", ...headers.map(([field, value]) => `${field}: ${formatFrontmatterValue(value)}`), "---"].join("\n")],
+        this.body
+      ].filter((block) => block !== "").join("\n\n")
+    );
+  }
+};
+
+// src/hexagon/domain/models/output/providers/claude/document-based-components/ClaudeAgentComponent.ts
+var ClaudeAgentComponent = class _ClaudeAgentComponent extends DocumentBasedComponent {
+  static kind = "agent";
+  kind = _ClaudeAgentComponent.kind;
+  static of(name, declared, body) {
+    return new _ClaudeAgentComponent(name, { name, ...declared }, body);
+  }
+};
+
+// src/hexagon/domain/models/output/providers/claude/document-based-components/ClaudeCommandComponent.ts
+var ClaudeCommandComponent = class _ClaudeCommandComponent extends DocumentBasedComponent {
+  static kind = "command";
+  kind = _ClaudeCommandComponent.kind;
+  static of(name, headers, body) {
+    return new _ClaudeCommandComponent(name, headers, body);
+  }
+};
+
+// src/hexagon/domain/models/output/providers/claude/document-based-components/ClaudeRuleComponent.ts
+var ClaudeRuleComponent = class _ClaudeRuleComponent extends DocumentBasedComponent {
+  static kind = "rule";
+  kind = _ClaudeRuleComponent.kind;
+  static of(name, headers, body) {
+    return new _ClaudeRuleComponent(name, headers, body);
+  }
+};
+
+// src/hexagon/domain/models/output/providers/claude/document-based-components/ClaudeSkillComponent.ts
+var ClaudeSkillComponent = class _ClaudeSkillComponent extends DocumentBasedComponent {
+  static kind = "skill";
+  kind = _ClaudeSkillComponent.kind;
+  static of(name, declared, body) {
+    return new _ClaudeSkillComponent(name, { name, ...declared }, body);
+  }
+};
+
+// src/hexagon/domain/services/compileService.ts
+function compile(charter, agents) {
+  return {
+    // A header nobody wrote is left out rather than listed as nothing: a
+    // listing says what the author declared. `file` is where the body sits
+    // inside the workspace — a vendored primitive reads as
+    // `.cw/vendor/<name>/...`, which is where it is.
+    catalogue: Catalogue.of(
+      charter.primitives.map((one) => {
+        const { id, description, tags, globs, rationale, mixins } = one.primitive.headers;
+        return {
+          identity: one.identity,
+          kind: one.primitive.kind,
+          id,
+          description,
+          file: one.file,
+          ...tags === void 0 ? {} : { tags },
+          ...globs === void 0 ? {} : { globs },
+          ...rationale === void 0 ? {} : { rationale },
+          ...mixins === void 0 ? {} : { mixins }
+        };
+      })
+    ),
+    charterMd: CharterMd.of(PRIMITIVE_CLASSES),
+    providerComponents: agents.flatMap((agent) => forAgent(agent, charter))
+  };
+}
+function forAgent(agent, charter) {
+  switch (agent) {
+    case "claude":
+      return compileClaude(charter);
+  }
+}
+function compileClaude(charter) {
+  const asSettings = charter.primitives.filter(isSettingComponent);
+  const asDocuments = charter.primitives.filter((one) => !isSettingComponent(one));
+  return [
+    ...asSettings.length === 0 ? [] : [ClaudeSettingsComponent.of(claudeSettingsOf(asSettings))],
+    ...asDocuments.flatMap((one) => claudeDocumentComponentOf(charter, one) ?? [])
+  ];
+}
+function isSettingComponent(one) {
+  return one.primitive.kind === PosturePrimitive.kind || one.primitive.kind === SensorPrimitive.kind;
+}
+function claudeSettingsOf(ones) {
+  const allow = /* @__PURE__ */ new Set();
+  const deny = /* @__PURE__ */ new Set();
+  const hooks = {};
+  for (const one of ones) {
+    if (one.primitive.kind === PosturePrimitive.kind) {
+      const headers = one.primitive.headers;
+      for (const permission of headers.allow) allow.add(permission);
+      for (const permission of headers.deny) deny.add(permission);
+    }
+    if (one.primitive.kind === SensorPrimitive.kind) {
+      const { signal, run: run2 } = one.primitive.headers;
+      if (isClaudeHookEvent(signal))
+        hooks[signal] = [...hooks[signal] ?? [], { hooks: [{ type: "command", command: run2 }] }];
+    }
+  }
+  return {
+    ...allow.size === 0 && deny.size === 0 ? {} : { permissions: { allow: [...allow], deny: [...deny] } },
+    ...Object.keys(hooks).length === 0 ? {} : { hooks }
+  };
+}
+function claudeDocumentComponentOf(charter, sc) {
+  const name = claudeNameOf(sc);
+  const body = charter.bodyOf(sc);
+  switch (sc.primitive.kind) {
+    // A guide is a rule this host loads into context whole: when a file it names
+    // is touched, which is what `paths` on a rule does, and at the start of every
+    // session where it names none (FR-013). Under the identity it is changed by,
+    // so a reader who wants it changed is sent to the primitive rather than
+    // editing what the next build overwrites (FR-017, FR-020).
+    case GuidePrimitive.kind: {
+      const { globs = [] } = sc.primitive.headers;
+      return ClaudeRuleComponent.of(
+        name,
+        globs.length === 0 ? {} : { paths: globs },
+        `${[`## ${sc.identity}`, body].join("\n\n")}
+`
+      );
+    }
+    // Named by the identifier alone, because the filename is what someone types
+    // after the slash: this host keeps commands in a directory of their own, so
+    // no other kind can land beside one and the kind would only be typed twice.
+    case CommandPrimitive.kind:
+      return ClaudeCommandComponent.of(sc.primitive.headers.id, { description: sc.primitive.description() }, body);
+    case AgentPrimitive.kind: {
+      const { tools } = sc.primitive.headers;
+      return ClaudeAgentComponent.of(name, { description: sc.primitive.description(), tools: tools.join(", ") }, body);
+    }
+    // One kind of this host for the two the charter loads when the request calls
+    // for them: what decides that the body is worth opening is the description,
+    // because that line is all this host reads before deciding (FR-013), and
+    // composing it is the primitive's.
+    case SkillPrimitive.kind:
+    case PlaybookPrimitive.kind:
+      return ClaudeSkillComponent.of(name, { description: sc.primitive.description() }, body);
+    default:
+      return void 0;
+  }
+}
+function claudeNameOf(one) {
+  return one.identity.replace(/[:/]/g, "-");
+}
+
+// src/hexagon/domain/services/projectionService.ts
+function charterOutputProjection(output, agentProviders) {
+  return [
+    // Indented: this one is committed and read in diffs, and a listing whose
+    // entries land one per line says what changed in the charter rather than
+    // that the listing changed.
+    {
+      path: `${OUT_DIRECTORY}/catalog.json`,
+      contents: `${JSON.stringify(output.catalogue.full, void 0, 2)}
+`,
+      projectionPolicy: output.catalogue.projection
+    },
+    // Not indented: this one is read to be surveyed cheaply, and the whitespace
+    // is bytes an agent pays for and no one reads (SC-005).
+    {
+      path: `${OUT_DIRECTORY}/catalog.min.json`,
+      contents: `${JSON.stringify(output.catalogue.compact)}
+`,
+      projectionPolicy: output.catalogue.projection
+    },
+    {
+      path: `${OUT_DIRECTORY}/CHARTER.md`,
+      contents: output.charterMd.toStampedDocument(),
+      projectionPolicy: output.charterMd.projection
+    },
+    ...agentProviders.map(entryFileProjection),
+    ...output.providerComponents.map(componentProjection)
+  ];
+}
+function entryFileProjection(provider) {
+  const contents = `<!-- CHERRYWORKS START -->
+${[
+    "## Charter",
+    `This repository is governed by a charter. Read [CHARTER.md](./${OUT_DIRECTORY}/CHARTER.md) before anything else here, and work under what it says.`,
+    "It is generated from the charter under `.cw/charter/`: do not edit it, edit the primitive behind it."
+  ].join("\n\n")}
+<!-- CHERRYWORKS END -->
+`;
+  let path;
+  switch (provider) {
+    case "claude":
+      path = CLAUDE_ENTRY_FILE;
+      break;
+  }
+  return { path, contents, projectionPolicy: "upsertWithMarker" };
+}
+function componentProjection(one) {
+  const projectionPolicy = one.projection;
+  switch (one.kind) {
+    case ClaudeCommandComponent.kind:
+      return { path: `${CLAUDE_DIRECTORY}/commands/${one.name}.md`, contents: one.toStampedDocument(), projectionPolicy };
+    case ClaudeAgentComponent.kind:
+      return { path: `${CLAUDE_DIRECTORY}/agents/${one.name}.md`, contents: one.toStampedDocument(), projectionPolicy };
+    // A skill is a directory holding one file of that name, which is where this
+    // host looks for it.
+    case ClaudeSkillComponent.kind:
+      return {
+        path: `${CLAUDE_DIRECTORY}/skills/${one.name}/SKILL.md`,
+        contents: one.toStampedDocument(),
+        projectionPolicy
+      };
+    // A rule of its own file, under the directory this host loads every one of:
+    // at the start of a session where it declares no `paths`, and when one of
+    // them is touched where it does.
+    case ClaudeRuleComponent.kind:
+      return { path: `${CLAUDE_DIRECTORY}/rules/${one.name}.md`, contents: one.toStampedDocument(), projectionPolicy };
+    // Every posture and every sensor of the charter lands in the one file this
+    // host reads its settings from.
+    case ClaudeSettingsComponent.kind:
+      return {
+        path: `${CLAUDE_DIRECTORY}/settings.json`,
+        contents: `${JSON.stringify(one.settings, void 0, 2)}
+`,
+        projectionPolicy
+      };
+  }
+}
+
+// src/hexagon/service/buildService.ts
+async function plan(repo, charter, agentProviders, fileReaders) {
+  const [cleanupPlan, projectionPlan] = await Promise.all([
+    planForCleanup(repo, agentProviders, fileReaders),
+    planForProjection(repo, compile(charter, agentProviders), agentProviders, fileReaders)
+  ]);
+  return { cleanupPlan, projectionPlan };
+}
+async function planForProjection(repo, output, agentProviders, fileReaders) {
+  const planned = /* @__PURE__ */ new Map();
+  for (const one of charterOutputProjection(output, agentProviders)) {
+    const file = new URL(one.path, repo);
+    const held = await fileReaders.readIfThere(file);
+    let contents;
+    switch (one.projectionPolicy) {
+      case "replace":
+        contents = one.contents;
+        break;
+      // What the repository set for itself is read and written back: the fields
+      // this charter speaks for are put over the top of it, and every other one
+      // is theirs and comes through untouched (FR-018).
+      case "mergeJSON": {
+        const already = JSON.parse(held?.trim() || "{}");
+        contents = `${JSON.stringify({ ...already, ...JSON.parse(one.contents) }, void 0, 2)}
+`;
+        break;
+      }
+      // A section says where it starts and ends itself — its first line and its
+      // last — so nothing here knows what a marker of this engine's looks like,
+      // and a second output written this way brings its own (FR-051).
+      case "upsertWithMarker": {
+        const already = held ?? "";
+        const lines3 = one.contents.trimEnd().split("\n");
+        const [start, end] = [lines3.at(0) ?? "", lines3.at(-1) ?? ""].map(
+          (line) => line.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+        );
+        const section = new RegExp(`${start}[\\s\\S]*?${end}\\n?`, "g");
+        if (already.match(section) === null) {
+          contents = already === "" ? one.contents : `${already.replace(/\n*$/, "\n")}
+${one.contents}`;
+          break;
+        }
+        let written = false;
+        contents = already.replace(section, () => {
+          if (written) return "";
+          written = true;
+          return one.contents;
+        });
+        break;
+      }
+    }
+    planned.set(one.path, { path: one.path, file, contents, held });
+  }
+  return [...planned.values()];
+}
+async function planForCleanup(repo, agentProviders, fileReaders) {
+  const outFolder = outFolderIn(repo);
+  const folders = [outFolder, ...agentProviders.map((agent) => agentProviderFolderIn(repo, agent))];
+  const found = await Promise.all(folders.map((folder) => fileReaders.readFilesRecursively(folder)));
+  return found.flat().filter(({ file, contents }) => file.href.startsWith(outFolder.href) || isStamped(contents)).map(({ file, contents }) => ({ path: decodeURIComponent(file.href.slice(repo.href.length)), file, held: contents }));
+}
+var PlanSummary = class {
+  constructor(added, edited, deleted, unchanged) {
+    this.added = added;
+    this.edited = edited;
+    this.deleted = deleted;
+    this.unchanged = unchanged;
+  }
+  added;
+  edited;
+  deleted;
+  unchanged;
+};
+function previewPlan(cleanupPlan, projectionPlan) {
+  return new PlanSummary(
+    projectionPlan.filter((one) => one.held === void 0).map((one) => one.path),
+    projectionPlan.filter((one) => one.held !== void 0 && one.held !== one.contents).map((one) => one.path),
+    cleanupPlan.filter((one) => !projectionPlan.some((other) => other.path === one.path)).map((one) => one.path),
+    projectionPlan.filter((one) => one.held === one.contents).map((one) => one.path)
+  );
+}
+async function executePlan(cleanupPlan, projectionPlan, fileWriter2) {
+  try {
+    await Promise.all(cleanupPlan.map((one) => fileWriter2.delete(one.file)));
+    for (const one of projectionPlan) await fileWriter2.write(one.file, one.contents ?? "");
+  } catch (raised) {
+    throw new Fault(
+      `This build could not be written: ${raised instanceof Error ? raised.message : String(raised)}`,
+      "Check that the files this build writes can be written, then build again."
+    );
+  }
+}
+
+// src/hexagon/application/CharterAuthoring.ts
+var CharterAuthoring = class {
+  #repoPath;
+  #fileReader;
+  #yamlParser;
+  #fileWriter;
+  #vcs;
+  constructor(repoPath2, fileReader2, yamlParser2, fileWriter2, vcs2) {
+    this.#repoPath = repoPath2;
+    this.#fileReader = fileReader2;
+    this.#yamlParser = yamlParser2;
+    this.#fileWriter = fileWriter2;
+    this.#vcs = vcs2;
+  }
+  /**
+   * The four questions about this repository, asked in one go (FR-040): which
+   * agents it compiles for, what validating its charter finds, which installed
+   * charters are edited here, and how many of those are unwell.
+   *
+   * Each is asked of whoever already answers it — the settings, the charter's
+   * validation, version control — and whether each is well is worked out here,
+   * so what `cw doctor` says and what the portal's health check says are one
+   * answer said twice (SC-003). Reads and says: nothing here writes (FR-041).
+   *
+   * Where the charter holds, what a build would still change is the preview run
+   * for it, and every guide and sensor no test case names is a warning too, so
+   * the test files are read here: a file that will not read names no case, and
+   * `cw test` is what refuses it (FR-014). Nothing else reads them for this — a
+   * warning stops nothing, and every other use case asks only for the errors.
+   * Where it does not hold, nothing is previewed (FR-005, FR-009).
+   */
+  async doctor() {
+    const [settings, [charter, , faultsByFiles], drifted, testRoot] = await Promise.all([
+      loadSettings(this.#repoPath, this.#fileReader),
+      this.#read(),
+      driftedVendors(this.#repoPath, this.#vcs),
+      loadTestRoot(this.#repoPath, this.#fileReader)
+    ]);
+    if (charter === void 0) return doctorOutcomeDTO(settings, faultsByFiles, void 0, drifted, this.#repoPath);
+    const { cleanupPlan, projectionPlan } = await plan(this.#repoPath, charter, settings.agents, this.#fileReader);
+    return doctorOutcomeDTO(
+      settings,
+      faultsByFiles.with(findUntestedPrimitives(charter, Object.values(testRoot.suitesByFile))),
+      previewPlan(cleanupPlan, projectionPlan),
+      drifted,
+      this.#repoPath
+    );
+  }
+  /** Everything wrong with this repository's charter under the file that has to
+   *  change, and — where none of it is an error — the charter and what the
+   *  repository configured itself with (FR-005, FR-009): what every use case
+   *  here reads before it asks the charter anything. Settings that do not read
+   *  are neither: there is nothing to validate against until they do, so
+   *  reading them raises rather than reports. */
+  async #read() {
+    const [charter, settings] = await Promise.all([
+      loadCharterRoot(this.#repoPath, this.#fileReader, this.#yamlParser),
+      loadSettings(this.#repoPath, this.#fileReader)
+    ]);
+    const faultsByFiles = charter.allFaultsByFiles;
+    return faultsByFiles.errors().isEmpty ? [charter, settings, faultsByFiles] : [void 0, void 0, faultsByFiles];
+  }
+  /**
+   * What the charter holds, listed, narrowed to one kind where one is named
+   * (FR-011, FR-012).
+   *
+   * The listing is the one the charter compiles to, asked for the way everything
+   * else is: `compile` hands back everything one reading produces, and this
+   * takes the listing out of it (SC-004). No agent is named, since what an agent
+   * reads is not what is being asked for here — a repository that compiles for
+   * none still lists what it holds.
+   *
+   * Whether the word narrowing it is a kind at all is asked here, of the
+   * domain that holds the set. A caller passes on what was typed and knows
+   * nothing about what a kind is.
+   *
+   * Reads and says: this holds a writing port and never reaches for it, which is
+   * what keeps a reading use case unable to write (FR-041).
+   */
+  async list(kind) {
+    if (kind !== void 0 && !isKind(kind))
+      throw new Fault(`"${kind}" is not a kind the charter knows.`, `Ask for one the charter knows: ${KINDS.join(", ")}.`);
+    const [charter, , faultsByFiles] = await this.#read();
+    if (charter === void 0) return faultsByFileDTO(faultsByFiles.errors(), this.#repoPath);
+    const { catalogue: catalogue2 } = compile(charter, []);
+    return catalogueDTO(kind === void 0 ? catalogue2 : catalogue2.filterByKind(kind));
+  }
+  /** Every primitive the charter read, or those mentioning a word, each as the
+   *  whole charter sees it (FR-112, FR-114). Whether one mentions the word is
+   *  the primitive's own to say. */
+  async fullList(matching) {
+    const [charter, , faultsByFiles] = await this.#read();
+    if (charter === void 0) return faultsByFileDTO(faultsByFiles.errors(), this.#repoPath);
+    return scopedPrimitivesDTO(
+      matching === void 0 ? charter.primitives : charter.primitives.filter((one) => one.mentions(matching))
+    );
+  }
+  /**
+   * Which file declares one identity, which layer it arrived in, when it comes
+   * up, the mixins it uses and the corpus it cites, what uses or cites it, and
+   * the situations this repository wrote down about it (FR-014, FR-017).
+   *
+   * The charter is asked, not searched here: one identity space covers every
+   * layer, and which file answers to a name, and which names one primitive
+   * shares with another, are the charter's own questions (FR-014). What is here
+   * is the order — read, refuse a charter that does not hold, then ask.
+   *
+   * An identity nothing answers to is raised rather than reported, the way a
+   * word that is no kind is: there is no file it is wrong with, and the next
+   * move is to go and look at what the charter does hold.
+   *
+   * Reads and says: this holds a writing port and never reaches for it (FR-041).
+   */
+  async explain(identity) {
+    const primitiveIdentity = identityOf(identity);
+    const [charter, , faultsByFiles] = await this.#read();
+    if (charter === void 0) return faultsByFileDTO(faultsByFiles.errors(), this.#repoPath);
+    const declared = charter.primitiveById.get(primitiveIdentity);
+    if (declared === void 0)
+      throw new Fault(
+        `This charter holds no "${identity}".`,
+        'Run "cw list --min" to see every identity it does hold.'
+      );
+    const testRoot = await loadTestRoot(this.#repoPath, this.#fileReader);
+    const testCasesByFile2 = Object.fromEntries(
+      Object.entries(testRoot.suitesByFile).map(([file, suite]) => [
+        file,
+        suite.cases.filter((each) => each.activatedIdentity === primitiveIdentity).map((each) => each.describe())
+      ]).filter(([, situations]) => situations.length > 0)
+    );
+    return explanationOutcomeDTO(
+      declared,
+      // When it comes up is its kind's to say, in the words `cw kinds` says it
+      // in, so it is read off the class that reads the kind (FR-029).
+      PRIMITIVE_CLASSES.find((one) => one.kind === declared.primitive.kind).activatesWhen,
+      charter.mixinsOf(declared),
+      charter.rationaleOf(declared),
+      charter.hostsOf(declared),
+      charter.citersOf(declared),
+      testCasesByFile2
+    );
+  }
+  /**
+   * One reading of the charter, put on disk (FR-020, FR-021).
+   *
+   * Read, ask what is wrong, take away what the last build left, then compile and
+   * write. The order is the whole of this method: a charter with an error is
+   * refused before anything is touched, so a half-built surface never stands —
+   * and a warning is not an error, so a rationale citing a corpus that is gone
+   * still builds (FR-005, FR-009).
+   *
+   * Which agents are compiled for is what the repository said at setup and
+   * keeps in `.cw/settings.json`, never what happens to be installed on the
+   * machine running this: the same charter checked out anywhere builds the same
+   * files (FR-033). A repository naming none still gets its neutral surface
+   * (FR-019), and one whose settings do not read is sent back to `cw init`
+   * rather than built against a guess.
+   *
+   * What a file holds and where it goes is `compile` and the two plans; what is
+   * here is the order of the three and the ports that make it possible.
+   */
+  async build() {
+    const [charter, settings, faultsByFiles] = await this.#read();
+    if (charter === void 0) return faultsByFileDTO(faultsByFiles.errors(), this.#repoPath);
+    const { cleanupPlan, projectionPlan } = await plan(this.#repoPath, charter, settings.agents, this.#fileReader);
+    const planSummary2 = previewPlan(cleanupPlan, projectionPlan);
+    await executePlan(cleanupPlan, projectionPlan, this.#fileWriter);
+    return planSummaryDTO(planSummary2);
+  }
+  /**
+   * The build, worked out and stopped short of disk (FR-022).
+   *
+   * The same two plans a build carries out, read rather than run: planning only
+   * reads, and what a preview adds is `previewPlan` in place of `executePlan`.
+   * It holds a writing port, as everything here does, and reaches for none of it
+   * (FR-041).
+   */
+  async preview() {
+    const [charter, settings, faultsByFiles] = await this.#read();
+    if (charter === void 0) return faultsByFileDTO(faultsByFiles.errors(), this.#repoPath);
+    const { cleanupPlan, projectionPlan } = await plan(this.#repoPath, charter, settings.agents, this.#fileReader);
+    return planSummaryDTO(previewPlan(cleanupPlan, projectionPlan));
+  }
+  /**
+   * Every situation this repository wrote down, resolved against its charter
+   * (FR-048, FR-049, FR-050).
+   *
+   * The same two steps every use case here is: read the charter, then ask it.
+   * What is added is the cases, read off `.cw/test/` by whoever knows where they
+   * live, and the resolving each one comes out of — which runs nothing, fetches
+   * nothing and asks no agent, so a run is decided by the charter alone.
+   *
+   * A charter with an error resolves nothing, for the reason a listing lists
+   * nothing, and neither does a test file that is there and will not read — both
+   * come back as faults under the file that has to change (FR-009). A repository
+   * that wrote no tests resolves nothing either, and that is no fault: it has
+   * not pinned its charter down yet, and the command says so.
+   *
+   * Reads and says: this holds a writing port and never reaches for it (FR-041).
+   */
+  async test() {
+    const [charter, , faultsByFiles] = await this.#read();
+    if (charter === void 0) return faultsByFileDTO(faultsByFiles.errors(), this.#repoPath);
+    const testRoot = await loadTestRoot(this.#repoPath, this.#fileReader);
+    if (!testRoot.faultsByFiles.isEmpty) return faultsByFileDTO(testRoot.faultsByFiles, this.#repoPath);
+    return testRunReportDTO(
+      new TestRunReport(
+        Object.entries(testRoot.suitesByFile).flatMap(([file, suite]) => runSuite(charter, testSuiteNameOf(file), suite))
+      )
+    );
+  }
+  /** What one kind takes of whoever authors a primitive of it, asked of the
+   *  kind itself (FR-004, FR-039). No charter is read: a kind's contract is the
+   *  same in a repository that has authored nothing. A word that is no kind is
+   *  raised the way a listing raises it — there is no file it is wrong with. */
+  async listPrimitiveRequirements(kind) {
+    const primitiveKind = this.#kindOf(kind);
+    return primitiveRequirementsDTO(
+      new PrimitiveRequirements(primitiveHeadersOf(primitiveKind), primitiveSampleOf(primitiveKind))
+    );
+  }
+  /** Every kind the charter knows, and when a primitive of that kind comes up
+   *  (FR-010). Asked of the classes themselves, as the requirements above are:
+   *  no charter is read, and a kind this repository has authored nothing of is a
+   *  kind all the same. */
+  async kinds() {
+    return primitiveKindsDTO(PRIMITIVE_CLASSES);
+  }
+  /**
+   * One primitive written where its kind is authored (FR-039), with the body
+   * its author typed — empty from the command line, where the body is written
+   * in an editor afterwards (FR-117).
+   *
+   * Nothing is validated and nothing is asked of the charter but which
+   * identities it already holds. What arrives is what an author answered, and
+   * reading it as the primitive it claims to be is what refuses an answer its
+   * kind will not take — the same reading a file of it would get, so there is no
+   * second contract here to keep in step with the kind's (FR-004). Where it goes
+   * is the convention: a directory per kind, since nothing reads the directory
+   * (FR-002).
+   *
+   * An identity the charter already holds, in any layer, is refused naming the
+   * file holding it: one identity names one primitive in the whole charter, and
+   * a second file claiming it is a collision the next read would report
+   * (FR-014). The files are read without being validated, so a charter wrong
+   * somewhere else can still be added to.
+   */
+  async add(kindWord, id, headers, body = "") {
+    const kind = this.#kindOf(kindWord);
+    let primitive;
+    try {
+      primitive = primitiveOf({ headers: { ...headers, kind, id }, body });
+    } catch (raised) {
+      if (!(raised instanceof AggregateError)) throw raised;
+      return faultsDTO(new Faults(raised.errors));
+    }
+    const charter = await loadCharterRoot(this.#repoPath, this.#fileReader, this.#yamlParser);
+    const claimingPrimitive = charter.primitiveById.get(identityOf({ kind, id }));
+    if (claimingPrimitive !== void 0)
+      throw new Fault(
+        `"${identityOf({ kind, id })}" is already there, declared by ${claimingPrimitive.file}, and one identity names one primitive in the whole charter.`,
+        `Open ${claimingPrimitive.file}, or run this again with an id this charter has not got.`
+      );
+    return scopedPrimitiveDTO(await writeCharter(this.#repoPath, primitive, this.#fileReader, this.#fileWriter));
+  }
+  /**
+   * One primitive as the charter read it: its headers, its body, the file and
+   * layer it is in, and its revision (FR-075, FR-078).
+   *
+   * Asked of the files as read rather than of the validation, so a primitive
+   * opens whatever else in the charter is wrong — which is when its author most
+   * needs to open it. The revision is the content hash of `toMarkdown()`, the
+   * text a save writes, so a save made over it is checked against the primitive
+   * read again then.
+   */
+  async open(identity) {
+    const scopedPrimitive2 = await this.#scopedPrimitiveOf(identity);
+    return primitiveSnapshotDTO(scopedPrimitive2, await contentHashOf(scopedPrimitive2.primitive.toMarkdown()));
+  }
+  /**
+   * One repository primitive's file written over with new headers and a new
+   * body, keeping its kind, its id and the file it is in (FR-075).
+   *
+   * Refused — raised, with nothing written — for a primitive this repository
+   * did not author (FR-077), and for one whose revision is no longer the one
+   * its author opened, so an edit made on disk since is not lost under
+   * this one (FR-078). Answers the kind will not take come back as the faults
+   * `add` gives for them, since both read answers the one way.
+   *
+   * Kind and id are the identity's, never the headers': an edit cannot move a
+   * file, and a rename is a new primitive and a deletion. Nothing is compiled
+   * and nothing committed (FR-079).
+   */
+  async rewrite(identity, headers, body, revision) {
+    const scopedPrimitive2 = await this.#scopedPrimitiveOf(identity);
+    if (!RepoScopedPrimitive.isSatisfiedBy(scopedPrimitive2))
+      throw new Fault(
+        `${identity} was not authored in this repository, and ${scopedPrimitive2.file} is read-only here.`,
+        `To differ from it, author a primitive of your own under an identity of its own.`
+      );
+    if (await contentHashOf(scopedPrimitive2.primitive.toMarkdown()) !== revision)
+      throw new Fault(
+        `${scopedPrimitive2.file} changed on disk after it was opened, and saving would write over that change.`,
+        `Open it again to see what changed, then make your edit there.`
+      );
+    let primitive;
+    try {
+      primitive = primitiveOf({
+        headers: { ...headers, kind: scopedPrimitive2.primitive.kind, id: scopedPrimitive2.primitive.headers.id },
+        body
+      });
+    } catch (raised) {
+      if (!(raised instanceof AggregateError)) throw raised;
+      return faultsDTO(new Faults(raised.errors));
+    }
+    await this.#fileWriter.write(new URL(scopedPrimitive2.file, this.#repoPath), primitive.toMarkdown());
+    return scopedPrimitiveDTO(new ScopedPrimitive(identity, REPO_SCOPE, scopedPrimitive2.file, primitive));
+  }
+  /**
+   * One repository primitive's file taken away, and nothing else (FR-076).
+   *
+   * Refused for a primitive this repository did not author, as a rewrite is
+   * (FR-077). What still names it is left as it is: the next validation reports
+   * each as dangling, and what to do about them is its author's call. Nothing is
+   * compiled and nothing committed (FR-079).
+   */
+  async remove(identity) {
+    const scopedPrimitive2 = await this.#scopedPrimitiveOf(identity);
+    if (!RepoScopedPrimitive.isSatisfiedBy(scopedPrimitive2))
+      throw new Fault(
+        `${identity} was not authored in this repository, and ${scopedPrimitive2.file} is read-only here.`,
+        `To differ from it, author a primitive of your own under an identity of its own.`
+      );
+    await this.#fileWriter.delete(new URL(scopedPrimitive2.file, this.#repoPath));
+    return scopedPrimitiveDTO(scopedPrimitive2);
+  }
+  /** The primitive one identity names, off the files as read and not the
+   *  validation. Raised when the charter holds nothing of it, the way `explain`
+   *  raises it: there is no file it is wrong with. */
+  async #scopedPrimitiveOf(identity) {
+    const primitiveIdentity = identityOf(identity);
+    const charter = await loadCharterRoot(this.#repoPath, this.#fileReader, this.#yamlParser);
+    const scopedPrimitive2 = charter.primitiveById.get(primitiveIdentity);
+    if (scopedPrimitive2 === void 0)
+      throw new Fault(
+        `This charter holds no "${identity}".`,
+        'Run "cw list --min" to see every identity it does hold.'
+      );
+    return scopedPrimitive2;
+  }
+  /** One word read as the kind it names. Raised rather than reported, the way a
+   *  listing's is: there is no file it is wrong with, and what comes back names
+   *  every kind there is. */
+  #kindOf(kind) {
+    if (!isKind(kind))
+      throw new Fault(`"${kind}" is not a kind the charter knows.`, `Ask for one the charter knows: ${KINDS.join(", ")}.`);
+    return kind;
+  }
+  /** What this repository configured itself with, read the one way settings are
+   *  ever read (FR-038). */
+  async settings() {
+    return workspaceSettingsDTO(await loadSettings(this.#repoPath, this.#fileReader));
+  }
+  /**
+   * Refused outside version control, and then without a settings file, which
+   * setup writes whatever it was answered: its absence is what a repository
+   * never set up looks like, while `loadSettings` reads it as settings naming
+   * no agent (FR-004, FR-037).
+   */
+  async ensureRepoReady() {
+    if (!await this.#vcs.isInstalled(this.#repoPath))
+      throw new Fault(
+        "This folder is not inside a git repository, and a charter is authored inside one.",
+        'Run "git init" here, then "cw init", or run this again where your repository is.'
+      );
+    if (await this.#fileReader.readIfThere(settingsFileIn(this.#repoPath)) === void 0)
+      throw new Fault("This repository was never set up under a charter.", 'Run "cw init" first.');
+  }
+  /**
+   * One repository, set up under a charter (FR-032, FR-037).
+   *
+   * Refused outside version control before anything is written: what setup
+   * writes is committed as one change, and a folder with nothing to commit into
+   * is a folder this has no business writing in (FR-032).
+   *
+   * Refused, too, without an agent to compile for: a charter is authored to
+   * instruct one, and a repository compiling for none would build a surface no
+   * agent it runs reads (FR-033).
+   *
+   * Then the two things setup owns — what the repository configured itself
+   * with, and a directory per kind for a charter to be authored in — and
+   * nothing more: compiling is `build`'s, run once there is a charter to
+   * compile (FR-037). What comes back is that it is set up; what stops it is
+   * raised.
+   *
+   * Nothing is written into an ignore file: everything under the workspace is
+   * committed, what a vendor installed included, so a checkout of this
+   * repository holds the whole charter it is governed by without fetching
+   * anything.
+   *
+   * Every one of those is written whole and none of them is authored content,
+   * so running this again reconfigures the repository and discards nothing
+   * anybody wrote (FR-038).
+   */
+  async init({ agents }) {
+    if (!await this.#vcs.isInstalled(this.#repoPath))
+      throw new Fault(
+        "This folder is not inside a git repository, and a charter is authored inside one.",
+        'Run "git init" here, or run this again where your repository is.'
+      );
+    if (agents.length === 0)
+      throw new Fault(
+        "Setup was given no agent to compile for, and a charter compiles for at least one.",
+        `Choose at least one of: ${AGENT_PROVIDERS.join(", ")}.`
+      );
+    await this.#fileWriter.write(settingsFileIn(this.#repoPath), `${JSON.stringify({ agents }, null, 2)}
+`);
+    const kindFolders = KINDS.map((kind) => `${CHARTER_DIRECTORY}/${kind}/.gitkeep`);
+    for (const path of kindFolders) await this.#fileWriter.write(new URL(path, this.#repoPath), "");
+    return true;
+  }
+};
+
+// src/hexagon/application/CharterVendoring.ts
+var CharterVendoring = class {
+  #repoPath;
+  #fileReader;
+  #vcs;
+  constructor(repoPath2, fileReader2, vcs2) {
+    this.#repoPath = repoPath2;
+    this.#fileReader = fileReader2;
+    this.#vcs = vcs2;
+  }
+  async add(source, version) {
+    return addVendor(this.#repoPath, this.#vcs, source, version);
+  }
+  async remove(name) {
+    return removeVendor(this.#repoPath, this.#vcs, name);
+  }
+  async installed() {
+    return loadVendorNames(this.#repoPath, this.#fileReader);
+  }
+};
+
+// src/hexagon/application/TestAuthoring.ts
+var TestAuthoring = class {
+  #repoPath;
+  #fileReader;
+  #fileWriter;
+  constructor(repoPath2, fileReader2, fileWriter2) {
+    this.#repoPath = repoPath2;
+    this.#fileReader = fileReader2;
+    this.#fileWriter = fileWriter2;
+  }
+  /** Every test file as it was read, with its text, one that does not read
+   *  among them (FR-124). */
+  async suites() {
+    return testSuitesDTO(await loadTestRoot(this.#repoPath, this.#fileReader));
+  }
+  async addSuite() {
+    return addTestSuite(this.#repoPath, this.#fileReader, this.#fileWriter);
+  }
+  async writeSuite(name, text) {
+    return writeTestSuite(this.#repoPath, this.#fileReader, this.#fileWriter, name, text);
+  }
+  async removeSuite(name) {
+    return removeTestSuite(this.#repoPath, this.#fileReader, this.#fileWriter, name);
+  }
+};
+
+// src/zdriven/FileReaders.ts
+import { readdir, readFile } from "fs/promises";
+var FileReaders = class {
+  async readFilesRecursively(folder) {
+    const found = await Promise.all(
+      (await entriesOf(folder)).map(async (entry) => {
+        if (entry.isDirectory()) return this.readFilesRecursively(under(folder, entry.name));
+        const file = new URL(encodeURIComponent(entry.name), folder);
+        return [{ file, contents: await readFile(file, "utf8") }];
+      })
+    );
+    return found.flat();
+  }
+  async listFolders(folder) {
+    return (await entriesOf(folder)).filter((entry) => entry.isDirectory()).map((entry) => under(folder, entry.name));
+  }
+  async readIfThere(file) {
+    try {
+      return await readFile(file, "utf8");
+    } catch (raised) {
+      if (raised.code === "ENOENT") return void 0;
+      throw raised;
+    }
+  }
+};
+async function entriesOf(at) {
+  try {
+    return await readdir(at, { withFileTypes: true });
+  } catch (raised) {
+    if (raised.code === "ENOENT") return [];
+    throw raised;
+  }
+}
+function under(at, directory) {
+  return new URL(`${encodeURIComponent(directory)}/`, at);
+}
+
+// src/zdriven/YamlParser.ts
+import { parse } from "yaml";
+var YamlParser = class {
+  parse(block) {
+    let value;
+    try {
+      value = parse(block, { merge: false });
+    } catch (cause) {
+      throw new CharterPrimitiveFault(
+        `The frontmatter is not readable: ${cause.message.split("\n")[0]}`,
+        `Correct the notation: each header is "name: value", one per line.`
+      );
+    }
+    if (value === null || value === void 0) return {};
+    if (typeof value !== "object" || Array.isArray(value)) {
+      throw new CharterPrimitiveFault(
+        "The frontmatter must be a list of named headers, one per line \u2014 not a bare value or a list.",
+        `Write it as "id: <name>" and the rest of the headers this kind requires, one per line.`
+      );
+    }
+    return value;
+  }
+};
+
+// src/zdriven/FileOutput.ts
+import { mkdir, rm, writeFile } from "fs/promises";
+var FileOutput = class {
+  async write(file, contents) {
+    await mkdir(new URL(".", file), { recursive: true });
+    await writeFile(file, contents, "utf8");
+  }
+  async delete(file) {
+    await rm(file, { force: true });
+  }
+};
+
+// src/zdriven/Git.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var run = promisify(execFile);
+var Git = class {
+  /** How it looks at a folder. Reading files is somebody else's port, and this
+   *  asks it rather than reaching for the filesystem itself. */
+  constructor(fileReader2) {
+    this.fileReader = fileReader2;
+  }
+  fileReader;
+  async isInstalled(folder) {
+    try {
+      await run("git", ["rev-parse", "--git-dir"], { cwd: fileURLToPath2(folder) });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /** `git status --porcelain`: nothing said is nothing staged and nothing
+   *  modified. A folder git refuses to answer about is not clean either — there
+   *  is no repository there to have anything in hand. */
+  async isClean(folder) {
+    try {
+      const { stdout } = await run("git", ["status", "--porcelain"], { cwd: fileURLToPath2(folder) });
+      return stdout.trim() === "";
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * `git status --porcelain` narrowed to one folder, with every untracked file
+   * named rather than the folder holding them: what a vendor folder holds that
+   * the commit it arrived in does not (FR-040).
+   *
+   * The path comes off each line after the two status letters and the space
+   * following them; a rename says `old -> new`, and what is there now is the
+   * half that matters. A folder git refuses to answer about has nothing
+   * changed under it, for the reason a folder outside version control is not
+   * clean: there is nothing recorded to differ from.
+   */
+  async changedUnder(repo, subFolder) {
+    try {
+      const { stdout } = await run("git", ["status", "--porcelain", "--untracked-files=all", "--", subFolder], {
+        cwd: fileURLToPath2(repo)
+      });
+      return stdout.split("\n").filter((line) => line.trim() !== "").map((line) => line.slice(3).trim()).map((path) => path.split(" -> ").at(-1) ?? path);
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * `git subtree`, handed the source exactly as it was written: `add` where the
+   * folder is not there yet and `pull` where it is, so installing a source and
+   * bringing it up to date are one call (FR-023, FR-030).
+   *
+   * Which transport it is, whether the credentials are there, whether the
+   * version exists: git answers all three, and what it says is what the user
+   * reads (FR-031).
+   *
+   * `--squash` because what is installed is content to read and not a history
+   * to walk: one commit lands, holding the source's files under the folder
+   * given (FR-028). `HEAD` where no version is named, which is what the source
+   * calls its own default.
+   */
+  async subtreeAdd(source, repo, intoSubFolder, version) {
+    const cwd = fileURLToPath2(repo);
+    const targetFolder = new URL(`${intoSubFolder}/`, repo);
+    const targetFolderExist = (await this.fileReader.readFilesRecursively(targetFolder)).length > 0;
+    try {
+      await run(
+        "git",
+        ["subtree", targetFolderExist ? "pull" : "add", `--prefix=${intoSubFolder}`, "--squash", "--", source, version ?? "HEAD"],
+        { cwd }
+      );
+    } catch (raised) {
+      throw new Fault(
+        `${raised}`,
+        version === void 0 ? "Check the address, and that you can reach it from here." : `Check the address, and that "${version}" is a tag or branch it has.`
+      );
+    }
+  }
+  /** `git rm -r` and a commit of its own: the folder is gone from the working
+   *  tree and from the history from here on, the way adding it put it into
+   *  both. */
+  async removeSubFolder(repo, subFolder) {
+    const cwd = fileURLToPath2(repo);
+    try {
+      await run("git", ["rm", "-r", "--quiet", "--", subFolder], { cwd });
+      await run("git", ["commit", "-qm", `Remove ${subFolder}`], { cwd });
+    } catch (raised) {
+      throw new Fault(`${raised}`, `Check that "${subFolder}" is a folder this repository holds.`);
+    }
+  }
+};
+
+// main.ts
+var fileReader = new FileReaders();
+var yamlParser = new YamlParser();
+var fileWriter = new FileOutput();
+var vcs = new Git(fileReader);
+var repoPath = pathToFileURL2(`${process.cwd()}/`);
+var charterAuthoringApp = new CharterAuthoring(repoPath, fileReader, yamlParser, fileWriter, vcs);
+var charterVendoringApp = new CharterVendoring(repoPath, fileReader, vcs);
+var testAuthoringApp = new TestAuthoring(repoPath, fileReader, fileWriter);
+var cli = new Commander({ cwd: process.cwd(), version: package_default.version, charterAuthoringApp, charterVendoringApp, testAuthoringApp });
+process.exitCode = await cli.run(process.argv.slice(2));