cool-workflow 0.2.2 → 0.2.4

package/dist/wiring/capability-table/state.js

@@ -6,40 +6,49 @@
 // (extracted with sed, not retyped).
 Object.defineProperty(exports, "__esModule", { value: true });
 const registry_core_1 = require("./registry-core");
-const io_1 = require("../../cli/io");
-const report_view_cli_1 = require("../../shell/report-view-cli");
+const cli_args_1 = require("../../core/util/cli-args");
+// This slice is required unconditionally at startup for every command;
+// load these shell modules only when a handler that actually needs them runs.
+function loadReportViewCli() {
+    return require("../../shell/report-view-cli");
+}
+function loadStateCli() {
+    return require("../../shell/state-cli");
+}
+function loadStateExplosionCli() {
+    return require("../../shell/state-explosion-cli");
+}
 // MILESTONE 3 (state kernel) CLI bindings: state.check, migration.list|
 // check|prove, node.list|show|graph|snapshot|diff|replay|replay.verify.
 // Handler BODIES live in shell/state-cli.ts (impure — they read/write
 // run state on disk); this table only wires argv shape -> handler call
 // and the row's own exit-code rule, per cli/dispatch.ts's generic
-// executor contract. `required`/`optionalArg` are cli/io.ts's shared
-// coercion helpers, imported here so the wiring stays a thin adapter
+// executor contract. `required`/`optionalArg` are core/util/cli-args.ts's
+// shared coercion helpers, imported here so the wiring stays a thin adapter
 // (Usage-error strings copied byte-for-byte from the old build's
 // handlers/*.ts).
 // ---------------------------------------------------------------------
-const io_2 = require("../../cli/io");
-const state_cli_1 = require("../../shell/state-cli");
+const cli_args_2 = require("../../core/util/cli-args");
 (0, registry_core_1.attachCliBinding)("state.check", {
     path: ["state", "check"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        const report = (0, state_cli_1.checkState)(runId, args.options);
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        const report = loadStateCli().checkState(runId, args.options);
         return { json: report, exitCode: report.status === "unsupported" ? 1 : undefined };
     },
 });
 (0, registry_core_1.attachCliBinding)("migration.list", {
     path: ["migration", "list"],
     jsonMode: "default",
-    handler: () => ({ json: (0, state_cli_1.migrationList)() }),
+    handler: () => ({ json: loadStateCli().migrationList() }),
 });
 (0, registry_core_1.attachCliBinding)("migration.check", {
     path: ["migration", "check"],
     jsonMode: "default",
     handler: (args) => {
-        const target = (0, io_2.required)(args.positionals[0], "target (run-id or state/app file)");
-        const report = (0, state_cli_1.migrationCheck)(target, args.options);
+        const target = (0, cli_args_2.required)(args.positionals[0], "target (run-id or state/app file)");
+        const report = loadStateCli().migrationCheck(target, args.options);
         return { json: report, exitCode: report.status === "unsupported" ? 1 : undefined };
     },
 });
@@ -47,23 +56,23 @@ const state_cli_1 = require("../../shell/state-cli");
     path: ["migration", "prove"],
     jsonMode: "default",
     handler: (args) => {
-        const target = (0, io_2.required)(args.positionals[0], "target (run-id or state/app file)");
-        const proof = (0, state_cli_1.migrationProve)(target, args.options);
+        const target = (0, cli_args_2.required)(args.positionals[0], "target (run-id or state/app file)");
+        const proof = loadStateCli().migrationProve(target, args.options);
         return { json: proof, exitCode: proof.pass ? undefined : 1 };
     },
 });
 (0, registry_core_1.attachCliBinding)("node.list", {
     path: ["node", "list"],
     jsonMode: "default",
-    handler: (args) => ({ json: (0, state_cli_1.listNodes)((0, io_2.required)(args.positionals[0], "run id"), args.options) }),
+    handler: (args) => ({ json: loadStateCli().listNodes((0, cli_args_2.required)(args.positionals[0], "run id"), args.options) }),
 });
 (0, registry_core_1.attachCliBinding)("node.show", {
     path: ["node", "show"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        const nodeId = (0, io_2.required)(args.positionals[1], "node id");
-        return { json: (0, state_cli_1.showNode)(runId, nodeId, args.options) };
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        const nodeId = (0, cli_args_2.required)(args.positionals[1], "node id");
+        return { json: loadStateCli().showNode(runId, nodeId, args.options) };
     },
 });
 // jsonMode "flag": `--json` prints the node array (graphNodes); the bare
@@ -73,62 +82,62 @@ const state_cli_1 = require("../../shell/state-cli");
     path: ["node", "graph"],
     jsonMode: "flag",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        return { json: (0, state_cli_1.graphNodes)(runId, args.options), text: `${(0, report_view_cli_1.graphText)(runId, args.options)}\n` };
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        return { json: loadStateCli().graphNodes(runId, args.options), text: `${loadReportViewCli().graphText(runId, args.options)}\n` };
     },
 });
 (0, registry_core_1.attachCliBinding)("node.snapshot", {
     path: ["node", "snapshot"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        const nodeId = (0, io_2.required)(args.positionals[1], "node id");
-        return { json: (0, state_cli_1.nodeSnapshotCli)(runId, nodeId, args.options) };
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        const nodeId = (0, cli_args_2.required)(args.positionals[1], "node id");
+        return { json: loadStateCli().nodeSnapshotCli(runId, nodeId, args.options) };
     },
 });
 (0, registry_core_1.attachCliBinding)("node.diff", {
     path: ["node", "diff"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        const baselineSnapshotId = (0, io_2.required)(args.positionals[1], "baseline snapshot id");
-        const candidateSnapshotId = (0, io_2.required)(args.positionals[2], "candidate snapshot id");
-        return { json: (0, state_cli_1.nodeDiffCli)(runId, baselineSnapshotId, candidateSnapshotId, args.options) };
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        const baselineSnapshotId = (0, cli_args_2.required)(args.positionals[1], "baseline snapshot id");
+        const candidateSnapshotId = (0, cli_args_2.required)(args.positionals[2], "candidate snapshot id");
+        return { json: loadStateCli().nodeDiffCli(runId, baselineSnapshotId, candidateSnapshotId, args.options) };
     },
 });
 (0, registry_core_1.attachCliBinding)("node.replay", {
     path: ["node", "replay"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        const snapshotId = (0, io_2.required)(args.positionals[1], "snapshot id");
-        return { json: (0, state_cli_1.nodeReplayCli)(runId, snapshotId, args.options) };
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        const snapshotId = (0, cli_args_2.required)(args.positionals[1], "snapshot id");
+        return { json: loadStateCli().nodeReplayCli(runId, snapshotId, args.options) };
     },
 });
 (0, registry_core_1.attachCliBinding)("node.replay.verify", {
     path: ["node", "verify"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        const replayId = (0, io_2.required)(args.positionals[1], "replay id");
-        const verdict = (0, state_cli_1.nodeReplayVerifyCli)(runId, replayId, args.options);
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        const replayId = (0, cli_args_2.required)(args.positionals[1], "replay id");
+        const verdict = loadStateCli().nodeReplayVerifyCli(runId, replayId, args.options);
         return { json: verdict, exitCode: verdict.pass ? undefined : 1 };
     },
 });
 // GAP #24: mirror the state-kernel CLI shell fns as MCP handlers (they were
 // declared MCP tool rows but left on notYetImplemented). Arg-name reads copied
 // byte-for-byte from the old build's mcp/tool-call.ts switch arms.
-registry_core_1.REGISTRY_BY_CAPABILITY.get("state.check").mcp.handler = (args) => (0, state_cli_1.checkState)((0, io_2.required)((0, io_1.optionalArg)(args.runId), "run id"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("migration.list").mcp.handler = () => (0, state_cli_1.migrationList)();
-registry_core_1.REGISTRY_BY_CAPABILITY.get("migration.check").mcp.handler = (args) => (0, state_cli_1.migrationCheck)((0, io_2.required)((0, io_1.optionalArg)(args.target ?? args.runId), "target (run-id or state/app file)"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("migration.prove").mcp.handler = (args) => (0, state_cli_1.migrationProve)((0, io_2.required)((0, io_1.optionalArg)(args.target ?? args.runId), "target (run-id or state/app file)"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("node.list").mcp.handler = (args) => (0, state_cli_1.listNodes)((0, io_2.required)((0, io_1.optionalArg)(args.runId), "run id"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("node.show").mcp.handler = (args) => (0, state_cli_1.showNode)((0, io_2.required)((0, io_1.optionalArg)(args.runId), "run id"), (0, io_2.required)((0, io_1.optionalArg)(args.nodeId), "node id"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("node.graph").mcp.handler = (args) => (0, state_cli_1.graphNodes)((0, io_2.required)((0, io_1.optionalArg)(args.runId), "run id"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("node.snapshot").mcp.handler = (args) => (0, state_cli_1.nodeSnapshotCli)((0, io_2.required)((0, io_1.optionalArg)(args.runId), "run id"), (0, io_2.required)((0, io_1.optionalArg)(args.nodeId), "node id"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("node.diff").mcp.handler = (args) => (0, state_cli_1.nodeDiffCli)((0, io_2.required)((0, io_1.optionalArg)(args.runId), "run id"), (0, io_2.required)((0, io_1.optionalArg)(args.baselineSnapshotId ?? args.baseline), "baseline snapshot id"), (0, io_2.required)((0, io_1.optionalArg)(args.candidateSnapshotId ?? args.candidate), "candidate snapshot id"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("node.replay").mcp.handler = (args) => (0, state_cli_1.nodeReplayCli)((0, io_2.required)((0, io_1.optionalArg)(args.runId), "run id"), (0, io_2.required)((0, io_1.optionalArg)(args.snapshotId), "snapshot id"), args);
-registry_core_1.REGISTRY_BY_CAPABILITY.get("node.replay.verify").mcp.handler = (args) => (0, state_cli_1.nodeReplayVerifyCli)((0, io_2.required)((0, io_1.optionalArg)(args.runId), "run id"), (0, io_2.required)((0, io_1.optionalArg)(args.replayId), "replay id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("state.check").mcp.handler = (args) => loadStateCli().checkState((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("migration.list").mcp.handler = () => loadStateCli().migrationList();
+registry_core_1.REGISTRY_BY_CAPABILITY.get("migration.check").mcp.handler = (args) => loadStateCli().migrationCheck((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.target ?? args.runId), "target (run-id or state/app file)"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("migration.prove").mcp.handler = (args) => loadStateCli().migrationProve((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.target ?? args.runId), "target (run-id or state/app file)"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("node.list").mcp.handler = (args) => loadStateCli().listNodes((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("node.show").mcp.handler = (args) => loadStateCli().showNode((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), (0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.nodeId), "node id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("node.graph").mcp.handler = (args) => loadStateCli().graphNodes((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("node.snapshot").mcp.handler = (args) => loadStateCli().nodeSnapshotCli((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), (0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.nodeId), "node id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("node.diff").mcp.handler = (args) => loadStateCli().nodeDiffCli((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), (0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.baselineSnapshotId ?? args.baseline), "baseline snapshot id"), (0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.candidateSnapshotId ?? args.candidate), "candidate snapshot id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("node.replay").mcp.handler = (args) => loadStateCli().nodeReplayCli((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), (0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.snapshotId), "snapshot id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("node.replay.verify").mcp.handler = (args) => loadStateCli().nodeReplayVerifyCli((0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), (0, cli_args_2.required)((0, cli_args_1.optionalArg)(args.replayId), "replay id"), args);
 // `contract.show` is not yet a declared MCP_TOOL_DATA row with a CLI peer
 // wired here (it IS in MCP_TOOL_DATA already); no milestone-3 conformance
 // case reaches it, so it is intentionally left on its placeholder handler
@@ -143,30 +152,29 @@ registry_core_1.REGISTRY_BY_CAPABILITY.get("node.replay.verify").mcp.handler = (
 // "flag" — text by default, JSON under --json/--format json).
 // ---------------------------------------------------------------------
 const state_explosion_text_1 = require("../../core/format/state-explosion-text");
-const state_explosion_cli_1 = require("../../shell/state-explosion-cli");
-const io_3 = require("../../cli/io");
+const cli_args_3 = require("../../core/util/cli-args");
 (0, registry_core_1.attachCliBinding)("summary.refresh", {
     path: ["summary", "refresh"],
     jsonMode: "flag",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        const index = (0, state_explosion_cli_1.summaryRefreshCli)(runId, args.options);
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        const index = loadStateExplosionCli().summaryRefreshCli(runId, args.options);
         // Byte-exact port of the old build's handleSummary "refresh": the
         // human-text branch re-reads via a fresh summaryShow call rather than
         // formatting the refresh's own index record (src/cli/handlers/
         // operator.ts:118-127); only computed when actually needed, so a
         // --json call does exactly the one read the old build's if/else did.
-        if ((0, io_3.wantsJson)(args.options))
+        if ((0, cli_args_3.wantsJson)(args.options))
             return { json: index };
-        return { json: index, text: (0, state_explosion_text_1.formatStateExplosionReport)((0, state_explosion_cli_1.summaryShowCli)(runId, args.options)) };
+        return { json: index, text: (0, state_explosion_text_1.formatStateExplosionReport)(loadStateExplosionCli().summaryShowCli(runId, args.options)) };
     },
 });
 (0, registry_core_1.attachCliBinding)("summary.show", {
     path: ["summary", "show"],
     jsonMode: "flag",
     handler: (args) => {
-        const runId = (0, io_2.required)(args.positionals[0], "run id");
-        const report = (0, state_explosion_cli_1.summaryShowCli)(runId, args.options);
+        const runId = (0, cli_args_2.required)(args.positionals[0], "run id");
+        const report = loadStateExplosionCli().summaryShowCli(runId, args.options);
         return { json: report, text: (0, state_explosion_text_1.formatStateExplosionReport)(report) };
     },
 });

package/dist/wiring/capability-table/trust-ledger.js

@@ -6,7 +6,7 @@
 // retyped).
 Object.defineProperty(exports, "__esModule", { value: true });
 const registry_core_1 = require("./registry-core");
-const io_1 = require("../../cli/io");
+const cli_args_1 = require("../../core/util/cli-args");
 // MILESTONE 8 (ledger, telemetry, trust-audit, tamper/bundle demos) CLI
 // bindings: ledger propose|review|verify|apply|list, telemetry verify,
 // audit verify, demo tamper|bundle, report bundle|verify-bundle. Handler
@@ -19,11 +19,24 @@ const io_1 = require("../../cli/io");
 // row — a known, preserved wart.
 // ---------------------------------------------------------------------
 const ledger_cli_1 = require("../../shell/ledger-cli");
-const telemetry_cli_1 = require("../../shell/telemetry-cli");
-const audit_cli_1 = require("../../shell/audit-cli");
-const demo_cli_1 = require("../../shell/demo-cli");
-const telemetry_demo_1 = require("../../shell/telemetry-demo");
-const report_cli_1 = require("../../shell/report-cli");
+// This file is required at startup for every command. Loading these shell
+// modules only when their handler runs, not at import time, keeps that
+// load cost out of commands that never touch telemetry/audit/demo/report.
+function loadTelemetryCli() {
+    return require("../../shell/telemetry-cli");
+}
+function loadAuditCli() {
+    return require("../../shell/audit-cli");
+}
+function loadDemoCli() {
+    return require("../../shell/demo-cli");
+}
+function loadTelemetryDemo() {
+    return require("../../shell/telemetry-demo");
+}
+function loadReportCli() {
+    return require("../../shell/report-cli");
+}
 (0, registry_core_1.attachCliBinding)("ledger.propose", {
     path: ["ledger", "propose"],
     jsonMode: "default",
@@ -67,68 +80,79 @@ registry_core_1.REGISTRY_BY_CAPABILITY.get("ledger.list").mcp.handler = (args) =
     path: ["telemetry", "verify"],
     jsonMode: "flag",
     handler: (args) => {
-        const runId = (0, io_1.required)((0, io_1.optionalArg)(args.positionals[0]) || (0, io_1.optionalArg)(args.options.runId) || (0, io_1.optionalArg)(args.options.run), "run id");
-        const result = (0, telemetry_cli_1.telemetryVerifyCli)(runId, args.options);
-        return { json: result, text: (0, telemetry_demo_1.formatTelemetryVerify)(result), exitCode: result.verified ? undefined : 1 };
+        const runId = (0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.positionals[0]) || (0, cli_args_1.optionalArg)(args.options.runId) || (0, cli_args_1.optionalArg)(args.options.run), "run id");
+        const result = loadTelemetryCli().telemetryVerifyCli(runId, args.options);
+        return { json: result, text: loadTelemetryDemo().formatTelemetryVerify(result), exitCode: result.verified ? undefined : 1 };
     },
 });
-registry_core_1.REGISTRY_BY_CAPABILITY.get("telemetry.verify").mcp.handler = (args) => (0, telemetry_cli_1.telemetryVerifyCli)((0, io_1.required)((0, io_1.optionalArg)(args.runId), "run id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("telemetry.verify").mcp.handler = (args) => loadTelemetryCli().telemetryVerifyCli((0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), args);
 (0, registry_core_1.attachCliBinding)("audit.verify", {
     path: ["audit", "verify"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_1.required)((0, io_1.optionalArg)(args.positionals[0]), "run id");
-        const result = (0, audit_cli_1.auditVerifyCli)(runId, args.options);
+        const runId = (0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.positionals[0]), "run id");
+        const result = loadAuditCli().auditVerifyCli(runId, args.options);
         return { json: result, exitCode: result.verified ? undefined : 1 };
     },
 });
-registry_core_1.REGISTRY_BY_CAPABILITY.get("audit.verify").mcp.handler = (args) => (0, audit_cli_1.auditVerifyCli)((0, io_1.required)((0, io_1.optionalArg)(args.runId), "run id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("audit.verify").mcp.handler = (args) => loadAuditCli().auditVerifyCli((0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), args);
 (0, registry_core_1.attachCliBinding)("audit.head", {
     path: ["audit", "head"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_1.required)((0, io_1.optionalArg)(args.positionals[0]), "run id");
-        return { json: (0, audit_cli_1.auditHeadCli)(runId, args.options) };
+        const runId = (0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.positionals[0]), "run id");
+        return { json: loadAuditCli().auditHeadCli(runId, args.options) };
     },
 });
-registry_core_1.REGISTRY_BY_CAPABILITY.get("audit.head").mcp.handler = (args) => (0, audit_cli_1.auditHeadCli)((0, io_1.required)((0, io_1.optionalArg)(args.runId), "run id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("audit.head").mcp.handler = (args) => loadAuditCli().auditHeadCli((0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), args);
+(0, registry_core_1.attachCliBinding)("audit.repair", {
+    path: ["audit", "repair"],
+    jsonMode: "default",
+    handler: (args) => {
+        const runId = (0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.positionals[0]), "run id");
+        const result = loadAuditCli().auditRepairCli(runId, args.options);
+        return { json: result, exitCode: result.outcome === "refused" ? 1 : undefined };
+    },
+});
+registry_core_1.REGISTRY_BY_CAPABILITY.get("audit.repair").mcp.handler = (args) => loadAuditCli().auditRepairCli((0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), args);
 (0, registry_core_1.addCliOnlyCapability)("demo.tamper", "Prove tamper-evidence: build a signed telemetry ledger, forge it, watch verification fail offline.", {
     path: ["demo", "tamper"],
     jsonMode: "flag",
     handler: (args) => {
-        const result = (0, demo_cli_1.demoTamperCli)();
-        return { json: result, text: (0, telemetry_demo_1.formatTamperDemo)(result), exitCode: result.proven ? undefined : 1 };
+        const result = loadDemoCli().demoTamperCli();
+        return { json: result, text: loadTelemetryDemo().formatTamperDemo(result), exitCode: result.proven ? undefined : 1 };
     },
 }, "Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface telemetry.verify. No agent or MCP client needs to invoke a demo.");
 (0, registry_core_1.addCliOnlyCapability)("demo.bundle", "Prove portable-bundle verification: export a sealed report bundle, forge it two ways, watch report verify-bundle catch both offline with only the embedded public key.", {
     path: ["demo", "bundle"],
     jsonMode: "flag",
     handler: (args) => {
-        const result = (0, demo_cli_1.demoBundleCli)();
-        return { json: result, text: (0, telemetry_demo_1.formatBundleDemo)(result), exitCode: result.proven ? undefined : 1 };
+        const result = loadDemoCli().demoBundleCli();
+        return { json: result, text: loadTelemetryDemo().formatBundleDemo(result), exitCode: result.proven ? undefined : 1 };
     },
 }, "Human-facing demonstration (operator/newcomer onboarding); the underlying integrity check is exposed programmatically as the both-surface report.verify-bundle. No agent or MCP client needs to invoke a demo.");
 (0, registry_core_1.attachCliBinding)("report.bundle", {
     path: ["report", "bundle"],
     jsonMode: "default",
     handler: (args) => {
-        const runId = (0, io_1.required)((0, io_1.optionalArg)(args.positionals[0]), "run id");
-        const result = (0, report_cli_1.reportBundleCli)(runId, args.options);
+        const runId = (0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.positionals[0]), "run id");
+        const result = loadReportCli().reportBundleCli(runId, args.options);
         return { json: result, exitCode: result.ok ? undefined : 1 };
     },
 });
-registry_core_1.REGISTRY_BY_CAPABILITY.get("report.bundle").mcp.handler = (args) => (0, report_cli_1.reportBundleCli)((0, io_1.required)((0, io_1.optionalArg)(args.runId), "run id"), args);
+registry_core_1.REGISTRY_BY_CAPABILITY.get("report.bundle").mcp.handler = (args) => loadReportCli().reportBundleCli((0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.runId), "run id"), args);
 (0, registry_core_1.attachCliBinding)("report.verify-bundle", {
     path: ["report", "verify-bundle"],
-    jsonMode: "default",
+    jsonMode: "flag",
     handler: (args) => {
-        const archivePath = (0, io_1.required)((0, io_1.optionalArg)(args.positionals[0]), "bundle path");
-        const result = (0, report_cli_1.reportVerifyBundleCli)({ ...args.options, archive: archivePath });
-        return { json: result, exitCode: result.ok ? undefined : 1 };
+        const archivePath = (0, cli_args_1.required)((0, cli_args_1.optionalArg)(args.positionals[0]), "bundle path");
+        const reportCli = loadReportCli();
+        const result = reportCli.reportVerifyBundleCli({ ...args.options, archive: archivePath });
+        return { json: result, text: reportCli.formatReportVerifyBundle(result), exitCode: result.ok ? undefined : 1 };
     },
 });
 registry_core_1.REGISTRY_BY_CAPABILITY.get("report.verify-bundle").mcp.handler = (args) => {
-    const result = (0, report_cli_1.reportVerifyBundleCli)(args);
+    const result = loadReportCli().reportVerifyBundleCli(args);
     return result;
 };
 // ---------------------------------------------------------------------