cool-workflow 0.1.92 → 0.1.94

package/dist/cli/format.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.humanBytes = humanBytes;
+exports.formatClonesList = formatClonesList;
+exports.formatClonesGc = formatClonesGc;
+exports.formatWorkbenchView = formatWorkbenchView;
+function humanBytes(n) {
+    if (n < 1024)
+        return `${n}B`;
+    const units = ["KiB", "MiB", "GiB"];
+    let v = n / 1024;
+    let i = 0;
+    while (v >= 1024 && i < units.length - 1) {
+        v /= 1024;
+        i += 1;
+    }
+    return `${v.toFixed(1)}${units[i]}`;
+}
+function formatClonesList(result) {
+    if (result.count === 0)
+        return `No cached remote checkouts in ${result.clonesDir}.`;
+    const rows = result.entries.map((e) => {
+        const when = e.fetchedAt ? e.fetchedAt.replace("T", " ").replace(/\..*$/, "Z") : "unknown";
+        return `  ${e.kind.padEnd(7)} ${humanBytes(e.bytes).padStart(8)}  ${when}  ${e.url}${e.ref ? `@${e.ref}` : ""}`;
+    });
+    return [
+        `${result.count} cached checkout${result.count === 1 ? "" : "s"} — ${humanBytes(result.totalBytes)} in ${result.clonesDir}`,
+        "  KIND       SIZE  FETCHED               SOURCE",
+        ...rows,
+        `\nReclaim with: cw clones gc --older-than-days 30   (or --all)`
+    ].join("\n");
+}
+function formatClonesGc(result) {
+    const scope = result.all ? "all entries" : `entries older than ${result.olderThanDays} day(s)`;
+    if (result.removed.length === 0)
+        return `Nothing to reclaim (${scope}); ${result.keptCount} kept in ${result.clonesDir}.`;
+    const rows = result.removed.map((r) => `  ${humanBytes(r.bytes).padStart(8)}  ${r.url}`);
+    return [
+        `Reclaimed ${result.removed.length} checkout${result.removed.length === 1 ? "" : "s"} (${scope}) — freed ${humanBytes(result.freedBytes)}; ${result.keptCount} kept`,
+        ...rows
+    ].join("\n");
+}
+function formatWorkbenchView(view) {
+    const lines = [
+        `Workbench view ${view.runId} (${view.resolved ? "resolved" : "UNRESOLVED"})`,
+        view.error ? `  error: ${view.error}` : ""
+    ].filter(Boolean);
+    for (const [group, panels] of Object.entries(view.panels)) {
+        lines.push(`  ${group}:`);
+        for (const [name, panel] of Object.entries(panels)) {
+            const note = panel.status === "present" ? panel.capability : `absent (${panel.error || "unreadable"})`;
+            lines.push(`    ${name}: ${panel.status} — ${note}`);
+        }
+    }
+    return lines.join("\n");
+}

package/dist/cli/handlers/audit.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleAudit = handleAudit;
+const capability_core_1 = require("../../capability-core");
+const operator_ux_1 = require("../../operator-ux");
+const io_1 = require("../io");
+/** `cw audit summary|verify|worker|provenance|multi-agent|policy|role|blackboard|judge|attest|decision <run-id> [worker-id|role-id]`. */
+function handleAudit(args, runner) {
+    const [subcommand, runId, id] = args.positionals;
+    switch (subcommand) {
+        case "summary":
+            (0, io_1.printJson)(runner.auditSummary((0, io_1.required)(runId, "run id")));
+            return;
+        case "verify": {
+            const result = (0, capability_core_1.auditVerify)(runner, { ...args.options, runId: (0, io_1.required)(runId, "run id") });
+            (0, io_1.printJson)(result);
+            // Fail-closed: any unverified chain exits non-zero so `cw audit verify
+            // <run> && deploy` stops — mirrors the telemetry-verify guard. verifyTrustAudit
+            // returns verified:true for a truly absent/empty chain (nothing to prove),
+            // so this stays exit 0 there; a FULLY-corrupt log reports present:false but
+            // verified:false (corruptLines>0) and must NOT be conflated with absent — the
+            // earlier `present && ...` guard let that severe tamper escape (exit 0).
+            if (!result.verified)
+                process.exitCode = 1;
+            return;
+        }
+        case "worker":
+            (0, io_1.printJson)(runner.workerAudit((0, io_1.required)(runId, "run id"), (0, io_1.required)(id, "worker id")));
+            return;
+        case "provenance":
+            (0, io_1.printJson)(runner.evidenceProvenance((0, io_1.required)(runId, "run id"), args.options));
+            return;
+        case "multi-agent": {
+            const view = runner.auditMultiAgent((0, io_1.required)(runId, "run id"));
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(view);
+            else
+                process.stdout.write(`${(0, operator_ux_1.formatMultiAgentTrustAudit)(view)}\n`);
+            return;
+        }
+        case "policy": {
+            const view = runner.auditPolicy((0, io_1.required)(runId, "run id"));
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(view);
+            else
+                process.stdout.write(`${(0, operator_ux_1.formatMultiAgentTrustAudit)(view)}\n`);
+            return;
+        }
+        case "role": {
+            const view = runner.auditRole((0, io_1.required)(runId, "run id"), (0, io_1.required)(id, "role id"));
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(view);
+            else
+                process.stdout.write(`${(0, operator_ux_1.formatMultiAgentTrustAudit)(view)}\n`);
+            return;
+        }
+        case "blackboard": {
+            const view = runner.auditBlackboard((0, io_1.required)(runId, "run id"));
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(view);
+            else
+                process.stdout.write(`${(0, operator_ux_1.formatMultiAgentTrustAudit)(view)}\n`);
+            return;
+        }
+        case "judge": {
+            const view = runner.auditJudge((0, io_1.required)(runId, "run id"));
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(view);
+            else
+                process.stdout.write(`${(0, operator_ux_1.formatMultiAgentTrustAudit)(view)}\n`);
+            return;
+        }
+        case "attest":
+            (0, io_1.printJson)(runner.recordAuditAttestation((0, io_1.required)(runId, "run id"), args.options));
+            return;
+        case "decision":
+            (0, io_1.printJson)(runner.recordAuditDecision((0, io_1.required)(runId, "run id"), (0, io_1.required)(id, "worker id"), args.options));
+            return;
+        default:
+            throw new Error("Usage: cw.js audit summary|worker|provenance|multi-agent|policy|role|blackboard|judge|attest|decision <run-id> [worker-id|role-id]");
+    }
+}

package/dist/cli/handlers/blackboard.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleBlackboard = handleBlackboard;
+exports.handleCoordinator = handleCoordinator;
+const state_explosion_1 = require("../../state-explosion");
+const io_1 = require("../io");
+/** `cw blackboard <verb> <run-id> …` — shared-blackboard read/write family. */
+function handleBlackboard(args, runner) {
+    const [subcommand, action, runId] = args.positionals;
+    switch (subcommand) {
+        case "summary":
+            (0, io_1.printJson)(runner.blackboardSummary((0, io_1.required)(action, "run id"), args.options));
+            return;
+        case "summarize": {
+            const digest = runner.blackboardSummarize((0, io_1.required)(action, "run id"), args.options);
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(digest);
+            else
+                process.stdout.write(`${(0, state_explosion_1.formatBlackboardDigest)(digest)}\n`);
+            return;
+        }
+        case "graph":
+            (0, io_1.printJson)(runner.blackboardGraph((0, io_1.required)(action, "run id")));
+            return;
+        case "resolve":
+            (0, io_1.printJson)(runner.resolveRunBlackboard((0, io_1.required)(action, "run id"), args.options));
+            return;
+        case "topic":
+            if (action === "create") {
+                (0, io_1.printJson)(runner.createBlackboardTopic((0, io_1.required)(runId, "run id"), args.options));
+                return;
+            }
+            break;
+        case "message":
+            if (action === "post") {
+                (0, io_1.printJson)(runner.postBlackboardMessage((0, io_1.required)(runId, "run id"), args.options));
+                return;
+            }
+            if (action === "list") {
+                (0, io_1.printJson)(runner.listBlackboardMessages((0, io_1.required)(runId, "run id"), args.options));
+                return;
+            }
+            break;
+        case "context":
+            if (action === "put") {
+                (0, io_1.printJson)(runner.putBlackboardContext((0, io_1.required)(runId, "run id"), args.options));
+                return;
+            }
+            break;
+        case "artifact":
+            if (action === "add") {
+                (0, io_1.printJson)(runner.addBlackboardArtifact((0, io_1.required)(runId, "run id"), args.options));
+                return;
+            }
+            if (action === "list") {
+                (0, io_1.printJson)(runner.listBlackboardArtifacts((0, io_1.required)(runId, "run id"), args.options));
+                return;
+            }
+            break;
+        case "snapshot":
+            (0, io_1.printJson)(runner.snapshotBlackboard((0, io_1.required)(action, "run id"), args.options));
+            return;
+        default:
+            break;
+    }
+    throw new Error("Usage: cw.js blackboard summary|summarize|graph|resolve <run-id> | topic create <run-id> | message post|list <run-id> | context put <run-id> | artifact add|list <run-id> | snapshot <run-id>");
+}
+/** `cw coordinator summary|decision <run-id> …` — coordinator decision ledger. */
+function handleCoordinator(args, runner) {
+    const [subcommand, runId] = args.positionals;
+    switch (subcommand) {
+        case "summary":
+            (0, io_1.printJson)(runner.coordinatorSummary((0, io_1.required)(runId, "run id"), args.options));
+            return;
+        case "decision":
+            (0, io_1.printJson)(runner.recordCoordinatorDecision((0, io_1.required)(runId, "run id"), args.options));
+            return;
+        default:
+            throw new Error("Usage: cw.js coordinator summary <run-id> | coordinator decision <run-id> --kind <kind> --outcome <outcome> --reason TEXT");
+    }
+}

package/dist/cli/handlers/candidate.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleCandidate = handleCandidate;
+const operator_ux_1 = require("../../operator-ux");
+const io_1 = require("../io");
+/** `cw candidate list|show|register|score|rank|select|reject|summary <run-id> [candidate-id]`. */
+function handleCandidate(args, runner) {
+    const [subcommand, runId, candidateId, reason] = args.positionals;
+    switch (subcommand) {
+        case "list":
+            (0, io_1.printJson)(runner.listCandidates((0, io_1.required)(runId, "run id"), args.options));
+            return;
+        case "show":
+            (0, io_1.printJson)(runner.showCandidate((0, io_1.required)(runId, "run id"), (0, io_1.required)(candidateId, "candidate id")));
+            return;
+        case "register":
+            (0, io_1.printJson)(runner.registerCandidate((0, io_1.required)(runId, "run id"), args.options));
+            return;
+        case "score":
+            (0, io_1.printJson)(runner.scoreCandidate((0, io_1.required)(runId, "run id"), (0, io_1.required)(candidateId, "candidate id"), args.options));
+            return;
+        case "rank":
+            (0, io_1.printJson)(runner.rankCandidates((0, io_1.required)(runId, "run id"), args.options));
+            return;
+        case "select":
+            (0, io_1.printJson)(runner.selectCandidate((0, io_1.required)(runId, "run id"), (0, io_1.required)(candidateId, "candidate id"), args.options));
+            return;
+        case "reject":
+            (0, io_1.printJson)(runner.rejectCandidate((0, io_1.required)(runId, "run id"), (0, io_1.required)(candidateId, "candidate id"), String(args.options.reason || args.options.message || reason || "rejected")));
+            return;
+        case "summary":
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(runner.summarizeCandidateOperatorRecords((0, io_1.required)(runId, "run id")));
+            else
+                process.stdout.write(`${(0, operator_ux_1.formatCandidateSummary)(runner.summarizeCandidateOperatorRecords((0, io_1.required)(runId, "run id")))}\n`);
+            return;
+        default:
+            throw new Error("Usage: cw.js candidate list|show|register|score|rank|select|reject|summary <run-id> [candidate-id]");
+    }
+}

package/dist/cli/handlers/clones.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleClones = handleClones;
+// `cw clones` handler — carved out of the command-surface god-dispatch. The
+// remote-source clone cache (v0.1.91): `list` inspects the cached checkouts that
+// `--link`/URL reviews populate; `gc` reclaims them (TTL sweep, or --all). Pure
+// filesystem work — no network, no run registry, no runner needed.
+const capability_core_1 = require("../../capability-core");
+const format_1 = require("../format");
+const io_1 = require("../io");
+/** `cw clones list [--json] | clones gc [--older-than-days N] [--all] [--json]`. */
+function handleClones(args) {
+    const [subcommand] = args.positionals;
+    switch (subcommand) {
+        case "list": {
+            const result = (0, capability_core_1.listClones)(args.options);
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(result);
+            else
+                process.stdout.write(`${(0, format_1.formatClonesList)(result)}\n`);
+            return;
+        }
+        case "gc": {
+            const result = (0, capability_core_1.gcClones)(args.options);
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(result);
+            else
+                process.stdout.write(`${(0, format_1.formatClonesGc)(result)}\n`);
+            return;
+        }
+        default:
+            throw new Error("Usage: cw.js clones list [--json] | clones gc [--older-than-days N] [--all] [--json]");
+    }
+}

package/dist/cli/handlers/collaboration.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleApprove = handleApprove;
+exports.handleReject = handleReject;
+exports.handleComment = handleComment;
+exports.handleHandoff = handleHandoff;
+exports.handleReview = handleReview;
+const io_1 = require("../io");
+/** `cw approve <kind> <run-id> <target-id>` — record an approval on a target. */
+function handleApprove(args, runner) {
+    const [targetKind, runId, targetId] = args.positionals;
+    (0, io_1.printJson)(runner.collaborationApprove((0, io_1.required)(runId, "run id"), (0, io_1.required)(targetKind, "target kind (candidate|commit|selection|run|task|node)"), (0, io_1.required)(targetId, "target id"), args.options));
+}
+/** `cw reject <kind> <run-id> <target-id>` — record a rejection on a target. */
+function handleReject(args, runner) {
+    const [targetKind, runId, targetId] = args.positionals;
+    (0, io_1.printJson)(runner.collaborationReject((0, io_1.required)(runId, "run id"), (0, io_1.required)(targetKind, "target kind (candidate|commit|selection|run|task|node)"), (0, io_1.required)(targetId, "target id"), args.options));
+}
+/** `cw comment add <kind> <run-id> <target-id> | comment list <run-id>` — leave or list comments. */
+function handleComment(args, runner) {
+    const [subcommand, ...rest] = args.positionals;
+    if (subcommand === "add") {
+        const [targetKind, runId, targetId] = rest;
+        (0, io_1.printJson)(runner.collaborationComment((0, io_1.required)(runId, "run id"), (0, io_1.required)(targetKind, "target kind"), (0, io_1.required)(targetId, "target id"), args.options));
+        return;
+    }
+    if (subcommand === "list") {
+        const result = runner.collaborationCommentList((0, io_1.required)(rest[0], "run id"), args.options);
+        if ((0, io_1.wantsJson)(args.options))
+            (0, io_1.printJson)(result);
+        else
+            process.stdout.write(`${runner.formatCommentList(result.comments)}\n`);
+        return;
+    }
+    throw new Error("Usage: cw.js comment add <kind> <run-id> <target-id> --body <text> | comment list <run-id> [--json]");
+}
+/** `cw handoff <kind> <run-id> [target-id]` — hand a target off to the next owner. */
+function handleHandoff(args, runner) {
+    const [targetKind, runId, targetIdRaw] = args.positionals;
+    const kind = (0, io_1.required)(targetKind, "target kind (run|task|candidate|commit|node)");
+    const rid = (0, io_1.required)(runId, "run id");
+    const targetId = targetIdRaw || (kind === "run" ? rid : undefined);
+    (0, io_1.printJson)(runner.collaborationHandoff(rid, kind, (0, io_1.required)(targetId, "target id"), args.options));
+}
+/** `cw review status <run-id> | review policy <run-id> …` — read or set review state/policy. */
+function handleReview(args, runner) {
+    const [subcommand, runId] = args.positionals;
+    if (subcommand === "status") {
+        const report = runner.reviewStatus((0, io_1.required)(runId, "run id"), args.options);
+        if ((0, io_1.wantsJson)(args.options))
+            (0, io_1.printJson)(report);
+        else
+            process.stdout.write(`${runner.formatReviewStatus(report)}\n`);
+        return;
+    }
+    if (subcommand === "policy") {
+        (0, io_1.printJson)(runner.reviewPolicy((0, io_1.required)(runId, "run id"), args.options));
+        return;
+    }
+    throw new Error("Usage: cw.js review status <run-id> [--json] | review policy <run-id> --required-approvals N --authorized-roles a,b --applies-to commit,selection");
+}

package/dist/cli/handlers/eval.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleEval = handleEval;
+const multi_agent_eval_1 = require("../../multi-agent-eval");
+const io_1 = require("../io");
+/** `cw eval snapshot|replay|compare|score|gate|report …` — multi-agent eval. */
+function handleEval(args, runner) {
+    const [subcommand, first, second] = args.positionals;
+    let result;
+    switch (subcommand) {
+        case "snapshot":
+            result = runner.evalSnapshot((0, io_1.required)(first, "run id"), args.options);
+            break;
+        case "replay":
+            result = runner.evalReplay((0, io_1.required)(first, "snapshot id or path"), args.options);
+            break;
+        case "compare":
+            result = runner.evalCompare((0, io_1.required)(first, "baseline id or path"), (0, io_1.required)(second, "replay id or path"));
+            break;
+        case "score":
+            result = runner.evalScore((0, io_1.required)(first, "replay id or path"));
+            break;
+        case "gate":
+            result = runner.evalGate((0, io_1.required)(first, "suite id or path"));
+            if (!(0, io_1.wantsJson)(args.options) && result.status === "fail")
+                process.exitCode = 1;
+            break;
+        case "report":
+            result = runner.evalReport((0, io_1.required)(first, "replay id or path"));
+            break;
+        default:
+            throw new Error("Usage: cw.js eval snapshot <run-id> --id <snapshot-id> | replay <snapshot-id-or-path> | compare <baseline-id-or-path> <replay-id-or-path> | score <replay-id-or-path> | gate <suite-id-or-path> | report <replay-id-or-path>");
+    }
+    if ((0, io_1.wantsJson)(args.options))
+        (0, io_1.printJson)(result);
+    else
+        process.stdout.write(`${(0, multi_agent_eval_1.formatMultiAgentEval)(result)}\n`);
+    if (subcommand === "gate" && result.status === "fail")
+        process.exitCode = 1;
+}

package/dist/cli/handlers/maintenance.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleGc = handleGc;
+exports.handleTelemetry = handleTelemetry;
+exports.handleDemo = handleDemo;
+const capability_core_1 = require("../../capability-core");
+const run_registry_1 = require("../../run-registry");
+const telemetry_demo_1 = require("../../telemetry-demo");
+const io_1 = require("../io");
+/** `cw gc plan|run|verify [run-id] …` — run retention & provable reclamation. */
+function handleGc(args, runner) {
+    // Run Retention & Provable Reclamation (v0.1.39). `plan` is a pure dry-run
+    // (frees nothing); `run` executes the write-ahead reclamation transaction;
+    // `verify` re-proves a reclaimed run. CW never reclaims by default.
+    const registry = (0, capability_core_1.runRegistryFor)(args.options, runner);
+    const [subcommand, id] = args.positionals;
+    switch (subcommand) {
+        case "plan": {
+            const result = (0, capability_core_1.gcPlan)(registry, id, args.options);
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(result);
+            else
+                process.stdout.write(`${(0, run_registry_1.formatGcPlan)(result)}\n`);
+            return;
+        }
+        case "run": {
+            const result = (0, capability_core_1.gcRun)(registry, id, args.options);
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(result);
+            else
+                process.stdout.write(`${(0, run_registry_1.formatGcRun)(result)}\n`);
+            return;
+        }
+        case "verify": {
+            const result = (0, capability_core_1.gcVerify)(registry, (0, io_1.required)(id, "run id"), args.options);
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(result);
+            else
+                process.stdout.write(`${(0, run_registry_1.formatGcVerify)(result)}\n`);
+            // Fail closed ONLY on a real integrity failure: a run that WAS reclaimed
+            // but no longer re-proves. A not-reclaimed run has nothing to verify
+            // (reclaimed:false/verified:false) and must not be treated as a failure.
+            // LIMIT (honest): a DELETED reclaimed.json reads as reclaimed:false, so
+            // proof-deletion is indistinguishable from never-reclaimed here without
+            // an independent witness (e.g. a trust-audit reclamation event) — a
+            // follow-up. This guard is still strictly better than the prior exit-0.
+            if (result.reclaimed && !result.verified)
+                process.exitCode = 1;
+            return;
+        }
+        default:
+            throw new Error("Usage: cw.js gc plan|run|verify [run-id] [--reclaimAfterArchiveDays N] [--keep-scratch] [--keep-snapshots] [--limit N] [--json]");
+    }
+}
+/** `cw telemetry verify <run-id> …` — verify the signed telemetry ledger. */
+function handleTelemetry(args, runner) {
+    const [subcommand, id] = args.positionals;
+    switch (subcommand) {
+        case "verify": {
+            const result = (0, capability_core_1.telemetryVerify)(runner, { ...args.options, runId: id || args.options.runId || args.options.run });
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(result);
+            else
+                process.stdout.write(`${(0, telemetry_demo_1.formatTelemetryVerify)(result)}\n`);
+            // Fail closed: a forged/edited/corrupt ledger verifies false — report it
+            // through the exit code so `cw telemetry verify <run> && deploy` cannot
+            // pass on a lie. (Absent ledger = present:false/verified:true -> exit 0.)
+            if (!result.verified)
+                process.exitCode = 1;
+            return;
+        }
+        default:
+            throw new Error("Usage: cw.js telemetry verify <run-id> [--pubkey <pem-or-path>] [--json]");
+    }
+}
+/** `cw demo tamper|bundle [--json]` — the tamper/bundle integrity demos. */
+function handleDemo(args, runner) {
+    const [subcommand] = args.positionals;
+    switch (subcommand) {
+        case "tamper": {
+            const result = (0, capability_core_1.demoTamper)(runner, args.options);
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(result);
+            else
+                process.stdout.write(`${(0, telemetry_demo_1.formatTamperDemo)(result)}\n`);
+            // Fail closed: if the proof did not hold (a tamper went undetected),
+            // exit nonzero so the demo can never green a broken guarantee.
+            if (!result.proven)
+                process.exitCode = 1;
+            return;
+        }
+        case "bundle": {
+            const result = (0, capability_core_1.demoBundle)(runner, args.options);
+            if ((0, io_1.wantsJson)(args.options))
+                (0, io_1.printJson)(result);
+            else
+                process.stdout.write(`${(0, telemetry_demo_1.formatBundleDemo)(result)}\n`);
+            // Fail closed: a forged bundle that verified would be a regression in the
+            // bundle guarantee — exit nonzero so the demo can never green it.
+            if (!result.proven)
+                process.exitCode = 1;
+            return;
+        }
+        default:
+            throw new Error("Usage: cw.js demo tamper|bundle [--json]");
+    }
+}