devlyn-cli 2.3.0 → 2.3.1

package/benchmark/auto-resolve/fixtures/retired/F27-cli-subscription-proration/spec.md

@@ -0,0 +1,69 @@
+---
+id: "F27-cli-subscription-proration"
+title: "Subscription invoice proration"
+status: planned
+complexity: high
+depends-on: []
+---
+
+# F27 Subscription invoice proration
+
+## Context
+
+Add a subscription-invoice command that prorates plan changes across a billing
+period, applies idempotent credits, reads plan and tax rules from
+data/subscription-plans.json, and prints exact integer-cent invoice totals.
+
+Subscription billing is money movement. Off-by-one date ranges, per-invoice
+rounding instead of per-segment rounding, or duplicate credits can silently
+undercharge or overcharge customers.
+
+## Requirements
+
+- [ ] `bench-cli subscription-invoice --input <path>` reads JSON shaped as `{ "customer_id": string, "state": string, "period": { "start": "YYYY-MM-DD", "end": "YYYY-MM-DD" }, "changes": Array<Change>, "credits": Array<Credit> }`.
+- [ ] Plan monthly prices and state tax rates come from `data/subscription-plans.json`. Do not hardcode these values in the command implementation.
+- [ ] Each change has `{ "date": "YYYY-MM-DD", "plan": string }`.
+- [ ] Each credit has `{ "id": string, "amount_cents": number }`.
+- [ ] Dates are interpreted as UTC calendar dates. The billing period start is inclusive and the end is exclusive.
+- [ ] Validate before printing any invoice output: `customer_id` and `state` are non-empty strings, period dates are valid ISO dates, `period.start < period.end`, `changes` is a non-empty array, one change starts exactly on `period.start`, all change dates are within `[period.start, period.end)`, plans exist in the rules file, credit ids are non-empty strings, and credit amounts are positive integers.
+- [ ] Unknown state exits `2`, writes exactly one JSON error object to stderr, and writes nothing to stdout.
+- [ ] Identical duplicate credits, where both `id` and `amount_cents` match, are idempotent and apply only once.
+- [ ] Credits with the same `id` but different `amount_cents` are conflicting duplicates. They exit `2` with exact error shape `{ "error": "conflicting_credit", "id": string }`, write it to stderr, and write nothing to stdout.
+- [ ] Sort changes by `date` ascending. If two changes have the same `date`, the later entry in the input wins for that date.
+- [ ] Build invoice segments from each effective change until the next change date or `period.end`. Omit zero-day superseded segments.
+- [ ] `period_days` is the UTC calendar-day difference between `period.start` and `period.end`.
+- [ ] Each segment amount is `Math.round(plan.monthly_cents * segment_days / period_days)`. Round each segment independently before summing.
+- [ ] `subtotal_cents` is the sum of segment amounts.
+- [ ] `credit_cents` is the sum of unique credit amounts, capped at `subtotal_cents`.
+- [ ] Tax is computed after credits: `tax_cents = Math.round((subtotal_cents - credit_cents) * tax_rate)`.
+- [ ] `total_cents = subtotal_cents - credit_cents + tax_cents`.
+- [ ] On success, write exactly one JSON object to stdout and no stderr. Keys: `customer_id`, `period_days`, `subtotal_cents`, `credit_cents`, `tax_cents`, `total_cents`, `segments`.
+- [ ] Each segment row has keys `plan`, `start`, `end`, `days`, and `amount_cents`, ordered by segment start date.
+- [ ] `tests/cli.test.js` is updated. Existing tests still pass AND at least two new tests cover `subscription-invoice`: one successful prorated invoice and one validation failure.
+
+## Constraints
+
+- **No new npm dependencies.**
+- **No floating-money output.** All public amounts are integer cents.
+- **No silent catches.** Invalid input, unreadable files, and invalid rules must surface as JSON errors with exit `2`.
+- **No extra stdout/stderr text** on the success path; downstream tooling parses stdout as JSON.
+- **Touch only `bin/cli.js` and `tests/cli.test.js`.**
+
+## Out of Scope
+
+- Payment collection.
+- Invoice persistence.
+- Time zones beyond UTC calendar dates.
+- Coupons, discounts, or taxes beyond the seeded rules file.
+- Adding web UI or server routes.
+- Touching `server/`, `web/`, or `tests/server.test.js`.
+
+## Verification
+
+- `node --test tests/cli.test.js` exits 0.
+- A period with multiple plan changes computes UTC calendar-day segments using an inclusive start and exclusive end.
+- Each segment is rounded independently before `subtotal_cents` is summed.
+- Duplicate identical credits apply once, while conflicting duplicate credits fail with the exact JSON error.
+- Tax is computed after credits and `total_cents` uses integer cents only.
+- Changing `data/subscription-plans.json` prices or tax rates changes command output without code changes.
+- `git diff --stat` shows only `bin/cli.js` and `tests/cli.test.js` touched (the rules seed comes from setup, not the arm).

package/benchmark/auto-resolve/fixtures/retired/F27-cli-subscription-proration/task.txt

@@ -0,0 +1,7 @@
+Add a subscription-invoice command that prorates plan changes across a billing period, applies idempotent credits, reads plan and tax rules from data/subscription-plans.json, and prints exact integer-cent invoice totals.
+
+It should work as `bench-cli subscription-invoice --input <path>`. The input has a customer id, state, billing period start/end dates, plan changes, and credits. Use UTC calendar dates with period start inclusive and period end exclusive. Read plan monthly prices and state tax rates from `data/subscription-plans.json`, not from hardcoded values.
+
+Sort plan changes by date. A change effective on a date applies until the next change date or the period end; if multiple changes have the same date, the later input entry wins for that date. Prorate each segment as `Math.round(plan.monthly_cents * segment_days / period_days)` and sum those rounded segment amounts. Apply unique credits after subtotal and before tax; identical duplicate credits apply once, but the same credit id with a different amount should fail with `{ "error": "conflicting_credit", "id": string }`.
+
+On success, print one JSON object to stdout with `customer_id`, `period_days`, `subtotal_cents`, `credit_cents`, `tax_cents`, `total_cents`, and `segments`. Each segment should include `plan`, `start`, `end`, `days`, and `amount_cents`. Invalid input should exit 2, print one JSON error to stderr, and print no stdout. Existing CLI tests should still pass and add at least one success test plus one validation failure test. No new dependencies; only touch `bin/cli.js` and `tests/cli.test.js`.

package/benchmark/auto-resolve/fixtures/retired/F27-cli-subscription-proration/verifiers/exact-proration.js

@@ -0,0 +1,48 @@
+'use strict';
+const assert = require('node:assert');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const workdir = process.env.BENCH_WORKDIR || process.cwd();
+const input = path.join(os.tmpdir(), `subscription-proration-${process.pid}.json`);
+
+fs.writeFileSync(input, JSON.stringify({
+  customer_id: 'cus_27',
+  state: 'CA',
+  period: { start: '2026-03-01', end: '2026-04-01' },
+  changes: [
+    { date: '2026-03-01', plan: 'starter' },
+    { date: '2026-03-11', plan: 'growth' },
+    { date: '2026-03-21', plan: 'scale' }
+  ],
+  credits: [
+    { id: 'credit-a', amount_cents: 500 },
+    { id: 'credit-a', amount_cents: 500 },
+    { id: 'credit-b', amount_cents: 700 }
+  ]
+}), 'utf8');
+
+const proc = spawnSync('node', ['bin/cli.js', 'subscription-invoice', '--input', input], {
+  cwd: workdir,
+  encoding: 'utf8'
+});
+
+assert.strictEqual(proc.status, 0, proc.stderr || proc.stdout);
+assert.strictEqual(proc.stderr, '');
+assert.deepStrictEqual(JSON.parse(proc.stdout), {
+  customer_id: 'cus_27',
+  period_days: 31,
+  subtotal_cents: 4954,
+  credit_cents: 1200,
+  tax_cents: 310,
+  total_cents: 4064,
+  segments: [
+    { plan: 'starter', start: '2026-03-01', end: '2026-03-11', days: 10, amount_cents: 387 },
+    { plan: 'growth', start: '2026-03-11', end: '2026-03-21', days: 10, amount_cents: 1161 },
+    { plan: 'scale', start: '2026-03-21', end: '2026-04-01', days: 11, amount_cents: 3406 }
+  ]
+});
+
+process.stdout.write(JSON.stringify({ ok: true }) + '\n');

package/benchmark/auto-resolve/fixtures/retired/F27-cli-subscription-proration/verifiers/rules-source-and-conflict.js

@@ -0,0 +1,79 @@
+'use strict';
+const assert = require('node:assert');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const workdir = process.env.BENCH_WORKDIR || process.cwd();
+const rulesPath = path.join(workdir, 'data', 'subscription-plans.json');
+const originalRules = fs.readFileSync(rulesPath, 'utf8');
+let inputCounter = 0;
+
+function runInvoice(inputBody) {
+  inputCounter += 1;
+  const input = path.join(os.tmpdir(), `subscription-rules-${process.pid}-${inputCounter}.json`);
+  fs.writeFileSync(input, JSON.stringify(inputBody), 'utf8');
+  return spawnSync('node', ['bin/cli.js', 'subscription-invoice', '--input', input], {
+    cwd: workdir,
+    encoding: 'utf8'
+  });
+}
+
+try {
+  fs.writeFileSync(rulesPath, JSON.stringify({
+    plans: {
+      starter: { monthly_cents: 3100 },
+      growth: { monthly_cents: 6200 }
+    },
+    tax_rates: {
+      CA: 0.1
+    }
+  }, null, 2) + '\n');
+
+  const sourceProc = runInvoice({
+    customer_id: 'cus_source',
+    state: 'CA',
+    period: { start: '2026-02-01', end: '2026-03-01' },
+    changes: [
+      { date: '2026-02-01', plan: 'starter' },
+      { date: '2026-02-15', plan: 'growth' }
+    ],
+    credits: []
+  });
+  assert.strictEqual(sourceProc.status, 0, sourceProc.stderr || sourceProc.stdout);
+  assert.strictEqual(sourceProc.stderr, '');
+  assert.deepStrictEqual(JSON.parse(sourceProc.stdout), {
+    customer_id: 'cus_source',
+    period_days: 28,
+    subtotal_cents: 4650,
+    credit_cents: 0,
+    tax_cents: 465,
+    total_cents: 5115,
+    segments: [
+      { plan: 'starter', start: '2026-02-01', end: '2026-02-15', days: 14, amount_cents: 1550 },
+      { plan: 'growth', start: '2026-02-15', end: '2026-03-01', days: 14, amount_cents: 3100 }
+    ]
+  });
+
+  const conflictProc = runInvoice({
+    customer_id: 'cus_conflict',
+    state: 'CA',
+    period: { start: '2026-02-01', end: '2026-03-01' },
+    changes: [{ date: '2026-02-01', plan: 'starter' }],
+    credits: [
+      { id: 'credit-conflict', amount_cents: 100 },
+      { id: 'credit-conflict', amount_cents: 101 }
+    ]
+  });
+  assert.strictEqual(conflictProc.status, 2);
+  assert.strictEqual(conflictProc.stdout, '');
+  assert.deepStrictEqual(JSON.parse(conflictProc.stderr), {
+    error: 'conflicting_credit',
+    id: 'credit-conflict'
+  });
+} finally {
+  fs.writeFileSync(rulesPath, originalRules);
+}
+
+process.stdout.write(JSON.stringify({ ok: true }) + '\n');

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/NOTES.md

@@ -0,0 +1,54 @@
+# F28 - Notes
+
+## Failure Mode
+
+This fixture detects return-policy implementations that look plausible but get
+policy precedence or cents math wrong: applying expiration before
+nonreturnable, charging restocking fees on defective items, merging exchange
+credit into refunds, accepting malformed enum/date/SKU input, mishandling the
+return-window boundary, or mutating the request file during authorization.
+
+## Pipeline Phases
+
+It stresses IMPLEMENT and VERIFY. The visible spec requires exact JSON output
+and validation behavior, while hidden verifiers assert policy precedence,
+integer-cent totals, invalid quantity handling, and input immutability.
+The validation boundary verifier also covers duplicate order SKUs, unknown
+requested SKUs, invalid calendar dates, invalid return-line enums, and the
+purchase-day-as-day-0 return-window edge.
+
+## Why Existing Fixtures Do Not Cover This
+
+F16 covers quote math, F23 covers warehouse allocation rollback, and F25 covers
+cart promotions. None combine business rejection precedence with separate
+refund versus exchange-credit ledgers and an immutability requirement.
+
+## Retirement Criteria
+
+Retire or rotate this fixture if both `solo_claude` and the selected pair arm
+score near the ceiling for two shipped versions, or if a future fixture covers
+return-policy precedence, exchange credit, and immutable input with clearer
+headroom.
+
+## Headroom Status
+
+Initial headroom smoke `20260511-f28-headroom-smoke-085307` measured
+bare 59 / solo_claude 66 and passed a one-fixture headroom gate with solo
+headroom 14 under the older threshold-only gate. Under the current default
+margin gate, the same score fails because bare headroom is only 1 point.
+
+Follow-up pair smoke `20260511-f28-pair-smoke-091021` reused the same
+bare/solo artifacts but re-judged the headroom step at bare 65 / solo_claude
+66, failing the `bare <= 60` precondition. The pair arm was not executed.
+
+Those runs were superseded when the hidden policy oracle was corrected: it had
+expected a defective item to bypass expiration, but the visible spec only says
+defective items waive restocking fees. `policy-precedence.js` now keeps the
+defective exchange line inside the return window and leaves the nonreturnable
+line as the expired-plus-nonreturnable precedence case.
+
+Corrected-oracle reverify `20260511-f28-policy-oraclefix-reverified-pair`
+reused the same provider diffs and scored bare 50 / solo_claude 98 /
+`l2_risk_probes` 96, margin -2, failing headroom and the pair gate. Treat F28
+as rejected for pair-lift evidence. Rework or rotate it before spending more
+pair arms.

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/RETIRED.md

@@ -0,0 +1,7 @@
+# F28 Retirement
+
+Retired from active golden fixtures on 2026-05-11.
+
+Reason: F28 no longer has usable pair-lift headroom after the hidden oracle was corrected. Initial smoke runs `20260511-f28-headroom-smoke-085307` and `20260511-f28-pair-smoke-091021` were superseded by `20260511-f28-policy-oraclefix-reverified-pair`, which reverified the same provider diffs against the corrected oracle and scored bare 50 / solo_claude 98 / l2_risk_probes 96. That fails the solo headroom precondition and produces pair margin -2.
+
+Keep this fixture only for diagnostics or historical replay. Rework or rotate it before using it for new solo_claude < pair evidence.

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/expected.json

@@ -0,0 +1,67 @@
+{
+  "verification_commands": [
+    {
+      "cmd": "node --test tests/cli.test.js",
+      "exit_code": 0,
+      "stdout_contains": [],
+      "stdout_not_contains": ["not ok "]
+    },
+    {
+      "cmd": "node \"$BENCH_FIXTURE_DIR/verifiers/policy-precedence.js\"",
+      "exit_code": 0,
+      "stdout_contains": ["\"ok\":true"],
+      "stdout_not_contains": [],
+      "contract_refs": [
+        "Nonreturnable rejection takes precedence over expiration.",
+        "A defective return (`reason === \"defective\"`) waives any restocking fee.",
+        "Approved `exchange` lines contribute `gross_cents - restocking_fee_cents` to `exchange_credit_cents` and `0` to `refund_cents`."
+      ]
+    },
+    {
+      "cmd": "node \"$BENCH_FIXTURE_DIR/verifiers/validation-and-immutability.js\"",
+      "exit_code": 0,
+      "stdout_contains": ["\"ok\":true"],
+      "stdout_not_contains": [],
+      "contract_refs": [
+        "Validate before authorization: dates must parse as ISO dates, ids and SKUs must be non-empty strings, quantities and cents must be positive integers, percents must be non-negative numbers, order SKUs must be unique, requested SKUs must exist, and total requested quantity per SKU must not exceed ordered quantity.",
+        "Invalid input exits `2`, writes exactly one JSON error object to stderr, and writes nothing to stdout.",
+        "The command must not modify the input file."
+      ]
+    },
+    {
+      "cmd": "node \"$BENCH_FIXTURE_DIR/verifiers/validation-boundary.js\"",
+      "exit_code": 0,
+      "stdout_contains": ["\"ok\":true"],
+      "stdout_not_contains": [],
+      "contract_refs": [
+        "Validate before authorization: dates must parse as ISO dates, ids and SKUs must be non-empty strings, quantities and cents must be positive integers, percents must be non-negative numbers, order SKUs must be unique, requested SKUs must exist, and total requested quantity per SKU must not exceed ordered quantity.",
+        "Invalid input exits `2`, writes exactly one JSON error object to stderr, and writes nothing to stdout.",
+        "A line is rejected with reason `\"expired\"` when `today` is more than `return_window_days` after `purchased_at`. The purchase day counts as day 0."
+      ]
+    }
+  ],
+  "forbidden_patterns": [
+    {
+      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{[^}]*return\\s+(null|undefined|''|\\{\\})",
+      "description": "silent catch returning fallback in return authorization path",
+      "files": ["bin/cli.js"],
+      "severity": "disqualifier"
+    },
+    {
+      "pattern": "catch\\s*\\([^)]*\\)\\s*\\{\\s*\\}",
+      "description": "empty catch block",
+      "files": ["bin/cli.js"],
+      "severity": "disqualifier"
+    },
+    {
+      "pattern": "/\\*\\s*eslint-disable",
+      "description": "eslint-disable without scoped justification",
+      "files": ["bin/cli.js"],
+      "severity": "disqualifier"
+    }
+  ],
+  "required_files": ["bin/cli.js", "tests/cli.test.js"],
+  "forbidden_files": [],
+  "max_deps_added": 0,
+  "spec_output_files": ["bin/cli.js", "tests/cli.test.js"]
+}

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/metadata.json

@@ -0,0 +1,10 @@
+{
+  "id": "F28-cli-return-authorization",
+  "category": "high-risk",
+  "difficulty": "high",
+  "timeout_seconds": 1500,
+  "required_tools": ["node"],
+  "browser": false,
+  "deps_change_expected": false,
+  "intent": "Add a bench-cli authorize-return command that reads an order and return request JSON file, applies return windows, nonreturnable items, defective-item fee waivers, exchange credits, and emits one exact cents-based authorization JSON without mutating the input."
+}

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/setup.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+set -e

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/spec.md

@@ -0,0 +1,67 @@
+---
+id: "F28-cli-return-authorization"
+title: "Return authorization policy"
+status: planned
+complexity: high
+depends-on: []
+---
+
+# F28 Return authorization policy
+
+## Context
+
+`bench-cli` currently has greeting and version commands only. The task:
+add an `authorize-return` command that reads an order and return request JSON
+file, applies return windows, nonreturnable items, defective-item fee waivers,
+exchange credits, and emits one exact cents-based authorization JSON without
+mutating the input.
+
+Return approvals feed finance and warehouse workflows, so policy precedence and
+integer-cent totals must be deterministic.
+
+## Requirements
+
+- [ ] `bench-cli authorize-return --input <path>` reads JSON shaped as `{ "today": "YYYY-MM-DD", "order": Order, "request": ReturnRequest }`.
+- [ ] `order` has `{ "id": string, "purchased_at": "YYYY-MM-DD", "items": Array<OrderItem> }`.
+- [ ] Each order item has `{ "sku": string, "qty": number, "unit_cents": number, "return_window_days": number, "restocking_fee_percent": number, "nonreturnable"?: boolean }`.
+- [ ] `request` has `{ "id": string, "lines": Array<ReturnLine> }`.
+- [ ] Each return line has `{ "sku": string, "qty": number, "reason": string, "condition": "sealed" | "opened", "resolution": "refund" | "exchange" }`.
+- [ ] Validate before authorization: dates must parse as ISO dates, ids and SKUs must be non-empty strings, quantities and cents must be positive integers, percents must be non-negative numbers, order SKUs must be unique, requested SKUs must exist, and total requested quantity per SKU must not exceed ordered quantity.
+- [ ] Invalid input exits `2`, writes exactly one JSON error object to stderr, and writes nothing to stdout.
+- [ ] Business rejections do not exit non-zero. A line is rejected with reason `"nonreturnable"` when the order item has `nonreturnable: true`.
+- [ ] A line is rejected with reason `"expired"` when `today` is more than `return_window_days` after `purchased_at`. The purchase day counts as day 0.
+- [ ] Nonreturnable rejection takes precedence over expiration.
+- [ ] A defective return (`reason === "defective"`) waives any restocking fee.
+- [ ] Otherwise, restocking fee is `0` for `condition: "sealed"` and `Math.round(unit_cents * qty * restocking_fee_percent / 100)` for `condition: "opened"`.
+- [ ] Approved `refund` lines contribute `gross_cents - restocking_fee_cents` to `refund_cents`.
+- [ ] Approved `exchange` lines contribute `gross_cents - restocking_fee_cents` to `exchange_credit_cents` and `0` to `refund_cents`.
+- [ ] On success, write exactly one JSON object to stdout and no stderr. Keys: `request_id`, `order_id`, `approved`, `rejected`, `refund_cents`, `exchange_credit_cents`, `restocking_fee_cents`.
+- [ ] `approved` rows are ordered by request line order and have keys `sku`, `qty`, `resolution`, `gross_cents`, `restocking_fee_cents`, `refund_cents`, `exchange_credit_cents`.
+- [ ] `rejected` rows are ordered by request line order and have keys `sku`, `qty`, `reason`.
+- [ ] The command must not modify the input file.
+- [ ] `tests/cli.test.js` is updated. Existing tests still pass AND at least two new tests cover one mixed approval/rejection authorization and one validation failure.
+
+## Constraints
+
+- **No new npm dependencies.**
+- **No floating-money output.** All public amounts are integer cents.
+- **No silent catches.** Invalid input and file-read failures must surface as JSON errors with exit `2`.
+- **No extra stdout/stderr text** on the success path; downstream tooling parses stdout as JSON.
+- **Touch only `bin/cli.js` and `tests/cli.test.js`.**
+
+## Out of Scope
+
+- Inventory mutation or restocking side effects.
+- Payment processor calls.
+- Partial-line approvals.
+- Currencies, locales, or tax calculation.
+- Touching `server/`, `web/`, or `tests/server.test.js`.
+
+## Verification
+
+- `node --test tests/cli.test.js` exits 0.
+- A mixed request applies nonreturnable before expiration, waives defective-item fees, and separates refund cents from exchange credit cents.
+- An opened non-defective refund charges `Math.round(gross * restocking_fee_percent / 100)`.
+- Invalid over-requested quantity exits `2`, prints one JSON error object to stderr, and prints no stdout.
+- The input file contents are unchanged after authorization.
+- `git diff --stat` shows only `bin/cli.js` and `tests/cli.test.js` touched.

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/task.txt

@@ -0,0 +1,5 @@
+Add a bench-cli authorize-return command that reads an order and return request JSON file, applies return windows, nonreturnable items, defective-item fee waivers, exchange credits, and emits one exact cents-based authorization JSON without mutating the input.
+
+The command should be `bench-cli authorize-return --input <path>`. The input contains `today`, an `order`, and a `request`. Validate malformed data before authorizing, and for invalid input exit 2 with one JSON error on stderr and no stdout. Business rejections like nonreturnable or expired items should be normal successful output, not process failures.
+
+Use integer cents only. Approved refund lines add to `refund_cents`; approved exchange lines add to `exchange_credit_cents`; opened non-defective items pay a rounded restocking fee; defective items waive the fee. Output one JSON object with request/order ids, approved rows, rejected rows, and the refund, exchange-credit, and restocking-fee totals. Update `tests/cli.test.js`, keep existing tests passing, do not add dependencies, and do not touch server or web files.

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/verifiers/policy-precedence.js

@@ -0,0 +1,72 @@
+'use strict';
+const assert = require('node:assert');
+const { execFileSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const work = process.env.BENCH_WORKDIR || process.cwd();
+const cli = path.join(work, 'bin', 'cli.js');
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'f28-return-policy-'));
+const input = path.join(tmp, 'return.json');
+
+fs.writeFileSync(input, JSON.stringify({
+  today: '2026-05-20',
+  order: {
+    id: 'O-100',
+    purchased_at: '2026-05-01',
+    items: [
+      { sku: 'SHIRT', qty: 2, unit_cents: 2500, return_window_days: 30, restocking_fee_percent: 10 },
+      { sku: 'HEADSET', qty: 1, unit_cents: 12500, return_window_days: 30, restocking_fee_percent: 15 },
+      { sku: 'CARD', qty: 1, unit_cents: 5000, return_window_days: 1, restocking_fee_percent: 0, nonreturnable: true }
+    ]
+  },
+  request: {
+    id: 'R-200',
+    lines: [
+      { sku: 'SHIRT', qty: 1, reason: 'changed_mind', condition: 'opened', resolution: 'refund' },
+      { sku: 'HEADSET', qty: 1, reason: 'defective', condition: 'opened', resolution: 'exchange' },
+      { sku: 'CARD', qty: 1, reason: 'changed_mind', condition: 'sealed', resolution: 'refund' }
+    ]
+  }
+}), 'utf8');
+
+const stdout = execFileSync('node', [cli, 'authorize-return', '--input', input], {
+  cwd: work,
+  encoding: 'utf8',
+  stdio: ['ignore', 'pipe', 'pipe']
+});
+const parsed = JSON.parse(stdout);
+
+assert.deepStrictEqual(parsed, {
+  request_id: 'R-200',
+  order_id: 'O-100',
+  approved: [
+    {
+      sku: 'SHIRT',
+      qty: 1,
+      resolution: 'refund',
+      gross_cents: 2500,
+      restocking_fee_cents: 250,
+      refund_cents: 2250,
+      exchange_credit_cents: 0
+    },
+    {
+      sku: 'HEADSET',
+      qty: 1,
+      resolution: 'exchange',
+      gross_cents: 12500,
+      restocking_fee_cents: 0,
+      refund_cents: 0,
+      exchange_credit_cents: 12500
+    }
+  ],
+  rejected: [
+    { sku: 'CARD', qty: 1, reason: 'nonreturnable' }
+  ],
+  refund_cents: 2250,
+  exchange_credit_cents: 12500,
+  restocking_fee_cents: 250
+});
+
+console.log(JSON.stringify({ ok: true }));

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/verifiers/validation-and-immutability.js

@@ -0,0 +1,43 @@
+'use strict';
+const assert = require('node:assert');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const work = process.env.BENCH_WORKDIR || process.cwd();
+const cli = path.join(work, 'bin', 'cli.js');
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'f28-return-validation-'));
+const input = path.join(tmp, 'return.json');
+const payload = {
+  today: '2026-05-20',
+  order: {
+    id: 'O-101',
+    purchased_at: '2026-05-01',
+    items: [
+      { sku: 'COAT', qty: 1, unit_cents: 9900, return_window_days: 30, restocking_fee_percent: 12 }
+    ]
+  },
+  request: {
+    id: 'R-201',
+    lines: [
+      { sku: 'COAT', qty: 2, reason: 'changed_mind', condition: 'opened', resolution: 'refund' }
+    ]
+  }
+};
+const original = JSON.stringify(payload, null, 2);
+fs.writeFileSync(input, original, 'utf8');
+
+const result = spawnSync('node', [cli, 'authorize-return', '--input', input], {
+  cwd: work,
+  encoding: 'utf8'
+});
+
+assert.strictEqual(result.status, 2);
+assert.strictEqual(result.stdout, '');
+const err = JSON.parse(result.stderr);
+assert.strictEqual(typeof err.error, 'string');
+assert.notStrictEqual(err.error.length, 0);
+assert.strictEqual(fs.readFileSync(input, 'utf8'), original);
+
+console.log(JSON.stringify({ ok: true }));

package/benchmark/auto-resolve/fixtures/retired/F28-cli-return-authorization/verifiers/validation-boundary.js

@@ -0,0 +1,116 @@
+'use strict';
+
+const assert = require('node:assert');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const work = process.env.BENCH_WORKDIR || process.cwd();
+const cli = path.join(work, 'bin', 'cli.js');
+
+function runCase(name, payload) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), `f28-return-${name}-`));
+  const input = path.join(tmp, 'return.json');
+  fs.writeFileSync(input, JSON.stringify(payload, null, 2), 'utf8');
+  return spawnSync('node', [cli, 'authorize-return', '--input', input], {
+    cwd: work,
+    encoding: 'utf8'
+  });
+}
+
+function assertJsonError(result, label) {
+  assert.strictEqual(result.status, 2, `${label}: expected exit 2`);
+  assert.strictEqual(result.stdout, '', `${label}: expected empty stdout`);
+  const parsed = JSON.parse(result.stderr);
+  assert.strictEqual(typeof parsed.error, 'string', `${label}: error must be a string`);
+  assert.notStrictEqual(parsed.error.length, 0, `${label}: error must not be empty`);
+}
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+const boundary = runCase('boundary', {
+  today: '2026-05-20',
+  order: {
+    id: 'O-BORDER',
+    purchased_at: '2026-05-01',
+    items: [
+      { sku: 'MUG', qty: 1, unit_cents: 1000, return_window_days: 19, restocking_fee_percent: 25 }
+    ]
+  },
+  request: {
+    id: 'R-BORDER',
+    lines: [
+      { sku: 'MUG', qty: 1, reason: 'changed_mind', condition: 'sealed', resolution: 'refund' }
+    ]
+  }
+});
+
+assert.strictEqual(boundary.status, 0);
+assert.strictEqual(boundary.stderr, '');
+assert.deepStrictEqual(JSON.parse(boundary.stdout), {
+  request_id: 'R-BORDER',
+  order_id: 'O-BORDER',
+  approved: [
+    {
+      sku: 'MUG',
+      qty: 1,
+      resolution: 'refund',
+      gross_cents: 1000,
+      restocking_fee_cents: 0,
+      refund_cents: 1000,
+      exchange_credit_cents: 0
+    }
+  ],
+  rejected: [],
+  refund_cents: 1000,
+  exchange_credit_cents: 0,
+  restocking_fee_cents: 0
+});
+
+const validBase = {
+  today: '2026-05-20',
+  order: {
+    id: 'O-VALIDATE',
+    purchased_at: '2026-05-01',
+    items: [
+      { sku: 'COAT', qty: 1, unit_cents: 9900, return_window_days: 30, restocking_fee_percent: 12 }
+    ]
+  },
+  request: {
+    id: 'R-VALIDATE',
+    lines: [
+      { sku: 'COAT', qty: 1, reason: 'changed_mind', condition: 'opened', resolution: 'refund' }
+    ]
+  }
+};
+
+const duplicateSku = clone(validBase);
+duplicateSku.order.items.push({
+  sku: 'COAT',
+  qty: 1,
+  unit_cents: 9900,
+  return_window_days: 30,
+  restocking_fee_percent: 12
+});
+assertJsonError(runCase('duplicate-sku', duplicateSku), 'duplicate order SKU');
+
+const unknownSku = clone(validBase);
+unknownSku.request.lines[0].sku = 'SCARF';
+assertJsonError(runCase('unknown-sku', unknownSku), 'unknown requested SKU');
+
+const invalidDate = clone(validBase);
+invalidDate.today = '2026-02-30';
+assertJsonError(runCase('invalid-date', invalidDate), 'invalid calendar date');
+
+const invalidCondition = clone(validBase);
+invalidCondition.request.lines[0].condition = 'damaged_box';
+assertJsonError(runCase('invalid-condition', invalidCondition), 'invalid condition');
+
+const invalidResolution = clone(validBase);
+invalidResolution.request.lines[0].resolution = 'store_credit';
+assertJsonError(runCase('invalid-resolution', invalidResolution), 'invalid resolution');
+
+console.log(JSON.stringify({ ok: true }));