orizu 0.5.19 → 0.5.21

package/dist/instruction-set-manifest.js

@@ -0,0 +1,162 @@
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+// Keep file-backed component reads within the same text budget used by prompt
+// tooling; request assembly never asks Node to allocate an unbounded body.
+export const MAX_INSTRUCTION_SET_COMPONENT_BYTES = 512 * 1024;
+const fail = (code) => { throw new Error(code); };
+const sha256 = (value) => createHash('sha256').update(value, 'utf8').digest('hex');
+function hasPinnedComponents(material) {
+    if (!material || typeof material !== 'object')
+        return false;
+    const pinned = material.pinnedComponents;
+    return Boolean(pinned && typeof pinned === 'object' && Object.keys(pinned).length > 0);
+}
+export function loadInstructionSetManifest(path) {
+    let value;
+    let source;
+    try {
+        source = readFileSync(path, 'utf8');
+    }
+    catch {
+        return fail('instruction_set_path_not_found');
+    }
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        return fail('instruction_set_manifest_invalid_json');
+    }
+    if (!value || typeof value !== 'object')
+        return fail('instruction_set_manifest_invalid');
+    const input = value;
+    if (typeof input.name !== 'string' || input.name.trim() === '')
+        return fail('instruction_set_manifest_invalid_name');
+    const hasDescription = Object.hasOwn(input, 'description');
+    if (hasDescription && input.description !== null && typeof input.description !== 'string')
+        return fail('instruction_set_manifest_invalid_description');
+    const description = hasDescription
+        ? input.description === '' ? null : input.description
+        : undefined;
+    if (hasPinnedComponents(input.default))
+        return fail('instruction_set_component_unavailable');
+    if (!Array.isArray(input.shape) || input.shape.length === 0 || input.shape.some(key => typeof key !== 'string' || key === '') || new Set(input.shape).size !== input.shape.length)
+        return fail('instruction_set_manifest_invalid_shape');
+    if (!Array.isArray(input.components))
+        return fail('instruction_set_manifest_invalid_components');
+    let root;
+    try {
+        root = realpathSync(dirname(path));
+    }
+    catch {
+        return fail('instruction_set_path_not_found');
+    }
+    const seen = new Set();
+    const loadedComponents = [];
+    for (const raw of input.components) {
+        if (!raw || typeof raw !== 'object')
+            return fail('instruction_set_manifest_invalid_component');
+        const component = raw;
+        if (typeof component.key !== 'string' || component.key === '' || !input.shape.includes(component.key))
+            return fail(component.key && !input.shape.includes(component.key) ? 'instruction_set_key_outside_shape' : 'instruction_set_manifest_invalid_component');
+        const modelConfig = component.modelConfig === undefined ? undefined : component.modelConfig;
+        if (modelConfig !== undefined && (typeof modelConfig !== 'string' || modelConfig === ''))
+            return fail('instruction_set_manifest_invalid_component');
+        const identity = `${component.key}\u0000${modelConfig ?? ''}`;
+        if (seen.has(identity))
+            return fail('instruction_set_duplicate_component');
+        seen.add(identity);
+        let text;
+        if (typeof component.text === 'string' && component.path === undefined)
+            text = component.text;
+        else if (typeof component.path === 'string' && component.text === undefined) {
+            if (isAbsolute(component.path))
+                return fail('instruction_set_path_escape');
+            const candidate = resolve(root, component.path);
+            if (relative(root, candidate).startsWith('..'))
+                return fail('instruction_set_path_escape');
+            if (!existsSync(candidate))
+                return fail('instruction_set_path_not_found');
+            let target;
+            try {
+                target = realpathSync(candidate);
+            }
+            catch {
+                return fail('instruction_set_path_not_found');
+            }
+            if (relative(root, target).startsWith('..'))
+                return fail('instruction_set_path_escape');
+            try {
+                text = readFileSync(target, 'utf8');
+            }
+            catch {
+                return fail('instruction_set_path_not_found');
+            }
+            if (Buffer.byteLength(text, 'utf8') > MAX_INSTRUCTION_SET_COMPONENT_BYTES)
+                return fail('instruction_set_component_too_large');
+        }
+        else
+            return fail('instruction_set_manifest_invalid_component');
+        if (Buffer.byteLength(text, 'utf8') > MAX_INSTRUCTION_SET_COMPONENT_BYTES)
+            return fail('instruction_set_component_too_large');
+        const hasSyncBaseline = typeof component.syncedContentSha256 === 'string';
+        if (component.syncedContentSha256 !== undefined && (!hasSyncBaseline || !/^[a-f0-9]{64}$/u.test(component.syncedContentSha256)))
+            return fail('instruction_set_manifest_invalid_component');
+        loadedComponents.push({
+            key: component.key,
+            ...(modelConfig === undefined ? {} : { modelConfig }),
+            text,
+            hasSyncBaseline,
+            changedSinceSync: hasSyncBaseline && sha256(text) !== component.syncedContentSha256,
+        });
+    }
+    for (const key of input.shape)
+        if (!loadedComponents.some(component => component.key === key))
+            return fail('instruction_set_missing_shape_key');
+    const defaultIdentity = input.default && typeof input.default === 'object'
+        && typeof input.default.modelConfigIdentity === 'string'
+        ? input.default.modelConfigIdentity
+        : null;
+    let components = loadedComponents;
+    if (defaultIdentity) {
+        if (input.manifestVersion === 1 && input.shape.some(key => {
+            const bare = loadedComponents.find(component => component.key === key && component.modelConfig === undefined);
+            const tagged = loadedComponents.find(component => component.key === key && component.modelConfig === defaultIdentity);
+            return bare && tagged && (!bare.hasSyncBaseline || !tagged.hasSyncBaseline);
+        }))
+            return fail('instruction_set_sync_baseline_missing');
+        const changedDefaultKeys = new Set(loadedComponents.flatMap(component => (component.modelConfig === undefined && component.hasSyncBaseline && component.changedSinceSync
+            ? [component.key]
+            : [])));
+        const changedSameIdentityKeys = new Set(loadedComponents.flatMap(component => (component.modelConfig === defaultIdentity && component.hasSyncBaseline && component.changedSinceSync
+            ? [component.key]
+            : [])));
+        if ([...changedDefaultKeys].some(key => changedSameIdentityKeys.has(key)))
+            return fail('instruction_set_conflicting_synced_edits');
+        if (changedDefaultKeys.size > 0) {
+            components = loadedComponents.filter(component => (component.modelConfig !== defaultIdentity || !changedDefaultKeys.has(component.key)));
+        }
+    }
+    const namedProfiles = new Set([
+        ...(components.some(component => component.modelConfig === undefined) && defaultIdentity
+            ? [defaultIdentity]
+            : []),
+        ...components.flatMap(component => component.modelConfig ? [component.modelConfig] : []),
+    ]);
+    const namedProfileHasPins = Array.isArray(input.profiles) && input.profiles.some(profile => {
+        if (!profile || typeof profile !== 'object')
+            return false;
+        const value = profile;
+        return typeof value.modelConfigIdentity === 'string'
+            && namedProfiles.has(value.modelConfigIdentity)
+            && hasPinnedComponents(value.production);
+    });
+    if (namedProfileHasPins)
+        return fail('instruction_set_component_unavailable');
+    return {
+        name: input.name,
+        ...(hasDescription ? { description } : {}),
+        shape: input.shape,
+        components: components.map(({ key, modelConfig, text }) => ({ key, ...(modelConfig === undefined ? {} : { modelConfig }), text })),
+    };
+}

package/dist/instruction-sets-cli.d.ts

@@ -0,0 +1,40 @@
+import { renameSync, writeFileSync } from 'node:fs';
+export interface InstructionSetsCommandIo {
+    json: boolean;
+    print: (line: string) => void;
+    resolveProjectSlug: (provided: string | null) => Promise<string>;
+}
+export interface SyncComponent {
+    body?: string;
+    repoPath?: string;
+    contentSha?: string;
+    commitSha?: string;
+}
+export interface SyncMaterial {
+    profileVersionId: string;
+    versionNumber: number;
+    modelConfigIdentity: string;
+    resolvedFrom: string;
+    components: Record<string, SyncComponent>;
+}
+export interface SyncProfile {
+    modelConfigIdentity: string;
+    resolvedFrom: string;
+    production: SyncMaterial | null;
+}
+export interface SyncSet {
+    name: string;
+    slug?: string;
+    description?: string | null;
+    shape: string[];
+    default: SyncMaterial;
+    profiles: SyncProfile[];
+    filteredTo?: string[];
+}
+export interface SyncFileOps {
+    writeFileSync: typeof writeFileSync;
+    renameSync?: typeof renameSync;
+}
+export declare function syncToDisk(out: string, set: SyncSet, fileOps?: SyncFileOps): void;
+export declare function instructionSetsCommand(args: string[], io: InstructionSetsCommandIo): Promise<number>;
+//# sourceMappingURL=instruction-sets-cli.d.ts.map

package/dist/instruction-sets-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instruction-sets-cli.d.ts","sourceRoot":"","sources":["../src/instruction-sets-cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuC,UAAU,EAAoB,aAAa,EAAE,MAAM,SAAS,CAAA;AAI1G,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CACjE;AA+BD,MAAM,WAAW,aAAa;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AAC5G,MAAM,WAAW,YAAY;IAAG,gBAAgB,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;CAAE;AAC/K,MAAM,WAAW,WAAW;IAAG,mBAAmB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,YAAY,GAAG,IAAI,CAAA;CAAE;AACnH,MAAM,WAAW,OAAO;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE;AAM7K,MAAM,WAAW,WAAW;IAAG,aAAa,EAAE,OAAO,aAAa,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,UAAU,CAAA;CAAE;AAoCpG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,WAA+B,QAyC7F;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+K1G"}

package/dist/instruction-sets-cli.js

@@ -0,0 +1,361 @@
+import { authedFetch } from './http.js';
+import { loadInstructionSetManifest, MAX_INSTRUCTION_SET_COMPONENT_BYTES } from './instruction-set-manifest.js';
+import { sanitizeHumanInlineText, sanitizeTerminalText } from './json-response.js';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+function positionalArgs(args) {
+    const values = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const value = args[index];
+        if (value.startsWith('--')) {
+            if (argValue(args, value) !== null)
+                index += 1;
+            continue;
+        }
+        values.push(value);
+    }
+    return values;
+}
+function argValue(args, flag) {
+    const index = args.indexOf(flag);
+    return index === -1 || !args[index + 1] || args[index + 1].startsWith('--')
+        ? null
+        : args[index + 1];
+}
+async function responsePayload(response, action) {
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+        throw new Error(`${action} failed (${response.status}): ${typeof payload.error === 'string' ? payload.error : response.statusText}`);
+    }
+    return payload;
+}
+const SAFE_SEGMENT = /^[A-Za-z0-9._-]+$/u;
+function safeSegment(value) { if (!SAFE_SEGMENT.test(value) || value === '.' || value === '..' || value.startsWith('.'))
+    throw new Error('instruction_set_path_unsafe'); }
+function slug(identity) { return identity.replaceAll('/', '__').replace(/[^A-Za-z0-9._-]/gu, '_'); }
+function stable(value) { return `${JSON.stringify(value, null, 2)}\n`; }
+function sha256(value) { return createHash('sha256').update(value, 'utf8').digest('hex'); }
+function writeMaterial(root, material, shape, manifestRoot, fileOps = { writeFileSync }) {
+    const files = {};
+    const syncedContentSha256 = {};
+    const pinnedComponents = {};
+    for (const key of [...shape].sort()) {
+        safeSegment(key);
+        const component = material.components[key];
+        if (typeof component?.body === 'string') {
+            const relative = `${manifestRoot}/${key}.md`;
+            files[key] = relative;
+            const target = join(root, ...relative.split('/'));
+            mkdirSync(join(target, '..'), { recursive: true });
+            fileOps.writeFileSync(target, component.body);
+            syncedContentSha256[key] = sha256(component.body);
+        }
+        else if (component?.repoPath && component?.contentSha && component?.commitSha)
+            pinnedComponents[key] = { repoPath: component.repoPath, contentSha: component.contentSha, commitSha: component.commitSha };
+        else
+            throw new Error('instruction_set_unresolvable');
+    }
+    return { profileVersionId: material.profileVersionId, versionNumber: material.versionNumber, modelConfigIdentity: material.modelConfigIdentity, resolvedFrom: material.resolvedFrom, files, syncedContentSha256, ...(Object.keys(pinnedComponents).length ? { pinnedComponents } : {}) };
+}
+// Only the scratch paths THIS run created are ever removed; a user's own
+// `.<set>.*.bak` in --out is never touched (PR #1668 review).
+function removeOwnScratch(paths) {
+    for (const path of paths)
+        if (path && existsSync(path))
+            rmSync(path, { recursive: true, force: true });
+}
+function existingDestinationIsSynced(destination, name) {
+    try {
+        if (!statSync(destination).isDirectory())
+            return false;
+        const manifest = JSON.parse(readFileSync(join(destination, 'manifest.json'), 'utf8'));
+        return manifest.manifestVersion === 1 && manifest.name === name;
+    }
+    catch {
+        return false;
+    }
+}
+export function syncToDisk(out, set, fileOps = { writeFileSync }) {
+    safeSegment(set.name);
+    for (const key of set.shape)
+        safeSegment(key);
+    const profileSlugs = new Set();
+    for (const profile of set.profiles) {
+        const value = slug(profile.modelConfigIdentity);
+        safeSegment(value);
+        if (profileSlugs.has(value))
+            throw new Error('instruction_set_slug_collision');
+        profileSlugs.add(value);
+    }
+    mkdirSync(out, { recursive: true });
+    const destination = join(out, set.name);
+    if (existsSync(destination) && !existingDestinationIsSynced(destination, set.name))
+        throw new Error('instruction_set_sync_destination_not_synced');
+    const temp = join(out, `.${set.name}.${randomUUID()}.tmp`);
+    const move = fileOps.renameSync || renameSync;
+    let backup = null;
+    mkdirSync(temp);
+    try {
+        const defaultMaterial = writeMaterial(temp, set.default, set.shape, 'default', fileOps);
+        const profiles = set.profiles.map(profile => ({
+            modelConfigIdentity: profile.modelConfigIdentity, slug: slug(profile.modelConfigIdentity), resolvedFrom: profile.resolvedFrom,
+            production: profile.production ? writeMaterial(temp, profile.production, set.shape, `profiles/${slug(profile.modelConfigIdentity)}`, fileOps) : null,
+        })).sort((a, b) => a.modelConfigIdentity.localeCompare(b.modelConfigIdentity));
+        const components = [
+            ...Object.entries(defaultMaterial.files).map(([key, path]) => ({ key, path, syncedContentSha256: defaultMaterial.syncedContentSha256[key] })),
+            ...profiles.flatMap(profile => profile.production
+                ? Object.entries(profile.production.files).map(([key, path]) => ({ key, modelConfig: profile.modelConfigIdentity, path, syncedContentSha256: profile.production.syncedContentSha256[key] }))
+                : []),
+        ];
+        const manifest = { manifestVersion: 1, name: set.name, ...(Object.hasOwn(set, 'description') ? { description: set.description ?? null } : {}), shape: set.shape, components, default: defaultMaterial, profiles, ...(set.filteredTo ? { filteredTo: [...set.filteredTo].sort() } : {}) };
+        fileOps.writeFileSync(join(temp, 'manifest.json'), stable(manifest));
+        backup = join(out, `.${set.name}.${randomUUID()}.bak`);
+        if (existsSync(destination))
+            move(destination, backup);
+        try {
+            move(temp, destination);
+        }
+        catch (error) {
+            if (existsSync(backup))
+                move(backup, destination);
+            throw error;
+        }
+        removeOwnScratch([backup]);
+    }
+    catch (error) {
+        removeOwnScratch([temp]);
+        if (backup && existsSync(backup) && !existsSync(destination))
+            move(backup, destination);
+        removeOwnScratch([backup]);
+        throw error;
+    }
+}
+export async function instructionSetsCommand(args, io) {
+    const positionals = positionalArgs(args);
+    const [subcommand, reference] = positionals;
+    if (subcommand === 'default' && reference === 'move') {
+        const version = argValue(args, '--version');
+        if (!version || !/^[0-9]+$/u.test(version) || Number(version) < 1)
+            throw new Error('--version must be a positive integer');
+    }
+    let writeManifest;
+    if (subcommand === 'create' || subcommand === 'push') {
+        if (!reference || reference.startsWith('--'))
+            throw new Error(subcommand === 'create'
+                ? 'Usage: orizu instructions create <manifest> --project <team/project> [--runner-version <id>] [--model-config <identity>] [--json]'
+                : 'Usage: orizu instructions push <manifest> --project <team/project> [--set <slug-or-exact-name>] [--runner-version <id>] [--json]');
+        writeManifest = loadInstructionSetManifest(reference);
+    }
+    const project = await io.resolveProjectSlug(argValue(args, '--project'));
+    if (subcommand === 'default') {
+        const operation = reference;
+        const set = positionals[2];
+        const identity = argValue(args, '--model-config');
+        const version = argValue(args, '--version');
+        if ((operation !== 'show' && operation !== 'move') || !set)
+            throw new Error('Usage: orizu instructions default show|move <set> --project <team/project> [--model-config <identity> --version <n>] [--json]');
+        if (operation === 'move' && (!identity || !version || !/^[0-9]+$/u.test(version) || Number(version) < 1))
+            throw new Error('--version must be a positive integer');
+        const path = `/api/cli/instruction-sets/${encodeURIComponent(set)}/default?project=${encodeURIComponent(project)}`;
+        if (operation === 'show') {
+            const payload = await responsePayload(await authedFetch(path, { method: 'GET' }), 'Instruction sets default show');
+            if (io.json)
+                io.print(JSON.stringify(payload));
+            else
+                io.print(`Default: v${payload.default?.versionNumber ?? '?'}`);
+            return 0;
+        }
+        if (!io.json) {
+            const impact = await responsePayload(await authedFetch(path, { method: 'GET' }), 'Instruction sets default show');
+            const resolvesToDefault = Array.isArray(impact.resolvesToDefault) ? impact.resolvesToDefault.filter((item) => typeof item === 'string') : [];
+            io.print(`These model configs resolve to the default: ${resolvesToDefault.join(', ')}`);
+        }
+        const payload = await responsePayload(await authedFetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ modelConfigIdentity: identity, versionNumber: Number(version) }) }), 'Instruction sets default move');
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else
+            io.print(`Default moved to ${identity} v${version}`);
+        return 0;
+    }
+    if (subcommand === 'shape') {
+        const operation = reference;
+        const set = positionals[2];
+        const key = argValue(args, '--key');
+        const from = argValue(args, '--from');
+        if ((operation !== 'add' && operation !== 'remove') || !set || !key || (operation === 'add' && !from))
+            throw new Error('Usage: orizu instructions shape add|remove <set> --project <team/project> --key <key> [--from <manifest>] [--json]');
+        let component;
+        if (operation === 'add') {
+            let manifest;
+            try {
+                manifest = JSON.parse(readFileSync(from, 'utf8'));
+            }
+            catch {
+                throw new Error('instruction_set_manifest_invalid_json');
+            }
+            const source = manifest && typeof manifest === 'object' && Array.isArray(manifest.components)
+                ? manifest.components.find((item) => Boolean(item && typeof item === 'object' && item.key === key))
+                : undefined;
+            if (!source || typeof source.text !== 'string' || Buffer.byteLength(source.text, 'utf8') > MAX_INSTRUCTION_SET_COMPONENT_BYTES)
+                throw new Error(`Instruction set manifest has no component for key: ${key}`);
+            component = { body: source.text };
+        }
+        const payload = await responsePayload(await authedFetch(`/api/cli/instruction-sets/${encodeURIComponent(set)}/shape?project=${encodeURIComponent(project)}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ operation, key, ...(component ? { component } : {}) }) }), `Instruction sets shape ${operation}`);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else {
+            io.print(`Shape ${operation === 'add' ? 'added' : 'removed'}: ${key}`);
+            const affected = Array.isArray(payload.affected) ? payload.affected : [];
+            const identities = [...new Set(affected.flatMap(pointer => pointer && typeof pointer === 'object' && typeof pointer.modelConfigIdentity === 'string' ? [pointer.modelConfigIdentity] : []))];
+            if (identities.length)
+                io.print(`${set} does not resolve for these model configs until the pointers move: ${identities.join(', ')}`);
+            for (const pointer of affected)
+                if (pointer && typeof pointer === 'object') {
+                    const item = pointer;
+                    if (typeof item.modelConfigIdentity === 'string' && (item.pointer === 'production' || item.pointer === 'default') && typeof item.headVersionNumber === 'number') {
+                        const command = item.pointer === 'production' ? 'profiles promote' : 'default move';
+                        const operatorAction = item.pointer === 'production' ? 'promote' : 'default move';
+                        if (typeof item.stalePointerVersionNumber === 'number' && typeof item.branchedFromVersionNumber === 'number' && item.branchedFromVersionNumber !== item.stalePointerVersionNumber)
+                            io.print(`${operatorAction} would move ${item.pointer} from v${item.stalePointerVersionNumber}'s text to v${item.headVersionNumber} = v${item.branchedFromVersionNumber}'s text + ${key}`);
+                        io.print(`Follow up: instructions ${command} ${set} --project ${project} --model-config ${item.modelConfigIdentity} --version ${item.headVersionNumber}`);
+                    }
+                }
+        }
+        return 0;
+    }
+    if (subcommand === 'profiles') {
+        const operation = reference;
+        const set = positionals[2];
+        const identity = argValue(args, '--model-config');
+        if ((operation !== 'new' && operation !== 'promote' && operation !== 'rollback') || !set || !identity)
+            throw new Error('Usage: orizu instructions profiles new|promote|rollback <set> --project <team/project> --model-config <identity> [--version <n>|--to <n>] [--json]');
+        const encodedSet = encodeURIComponent(set);
+        const encodedIdentity = encodeURIComponent(identity);
+        const version = argValue(args, '--version');
+        const to = argValue(args, '--to');
+        if ((operation === 'promote' && (!version || !/^[0-9]+$/u.test(version) || Number(version) < 1)) || (operation === 'rollback' && (!to || !/^[0-9]+$/u.test(to) || Number(to) < 1)))
+            throw new Error(operation === 'promote' ? '--version must be a positive integer' : '--to must be a positive integer');
+        const path = operation === 'new' ? `/api/cli/instruction-sets/${encodedSet}/profiles` : operation === 'promote' ? `/api/cli/instruction-sets/${encodedSet}/profiles/${encodedIdentity}/label` : `/api/cli/instruction-sets/${encodedSet}/profiles/${encodedIdentity}/rollback`;
+        const body = operation === 'new' ? { modelConfigIdentity: identity } : operation === 'promote' ? { versionNumber: Number(version) } : { to: Number(to) };
+        const payload = await responsePayload(await authedFetch(`${path}?project=${encodeURIComponent(project)}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }), `Instruction sets profiles ${operation}`);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else {
+            const profile = payload.profile;
+            io.print(`${profile?.modelConfigIdentity || identity}: v${profile?.versionNumber ?? '?'} ${operation === 'new' ? 'created' : operation === 'promote' ? 'promoted' : 'rolled back'}`);
+            const mirrored = payload.mirroredPromptLabel;
+            if (mirrored && (typeof mirrored.promptName === 'string' || typeof mirrored.promptId === 'string'))
+                io.print(`also moved production for prompt ${typeof mirrored.promptName === 'string' ? mirrored.promptName : mirrored.promptId} (default profile → prompt label)`);
+        }
+        return 0;
+    }
+    if (subcommand === 'create' || subcommand === 'push') {
+        const manifest = writeManifest;
+        const modelConfig = argValue(args, '--model-config');
+        const runnerVersion = argValue(args, '--runner-version');
+        const setReference = argValue(args, '--set') || manifest.name;
+        const path = subcommand === 'create' ? '/api/cli/instruction-sets' : `/api/cli/instruction-sets/${encodeURIComponent(setReference)}/versions`;
+        const body = subcommand === 'create'
+            ? { ...manifest, ...(modelConfig ? { modelConfigIdentity: modelConfig } : {}), ...(runnerVersion ? { runnerVersionId: runnerVersion } : {}) }
+            : { shape: manifest.shape, components: manifest.components, ...(Object.hasOwn(manifest, 'description') ? { description: manifest.description } : {}), ...(runnerVersion ? { runnerVersionId: runnerVersion } : {}) };
+        const payload = await responsePayload(await authedFetch(`${path}?project=${encodeURIComponent(project)}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }), `Instruction sets ${subcommand}`);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else {
+            const set = payload.instructionSet;
+            const pushed = Array.isArray(payload.pushed) ? payload.pushed : [];
+            const unchanged = Array.isArray(payload.unchanged) ? payload.unchanged : [];
+            const skipped = Array.isArray(payload.skipped) ? payload.skipped : [];
+            if (subcommand === 'create') {
+                const profiles = Array.isArray(set?.profiles) ? set.profiles : [];
+                io.print(`${set?.name || manifest.name}: ${profiles.length} profile(s) created`);
+            }
+            else {
+                const describe = (value) => {
+                    if (typeof value === 'string')
+                        return value;
+                    if (value && typeof value === 'object') {
+                        const row = value;
+                        return `${typeof row.modelConfigIdentity === 'string' ? row.modelConfigIdentity : 'unknown'}${typeof row.versionNumber === 'number' ? ` v${row.versionNumber}` : ''}`;
+                    }
+                    return 'unknown';
+                };
+                io.print(`${set?.name || manifest.name}: pushed ${pushed.map(describe).join(', ') || 'none'}; unchanged ${unchanged.map(describe).join(', ') || 'none'}; skipped ${skipped.map(describe).join(', ') || 'none'}`);
+            }
+        }
+        return 0;
+    }
+    if (subcommand === 'archive' || subcommand === 'restore') {
+        if (!reference || reference.startsWith('--'))
+            throw new Error(`Usage: orizu instructions ${subcommand} <slug-or-exact-name> --project <team/project> [--json]`);
+        const archived = subcommand === 'archive';
+        const payload = await responsePayload(await authedFetch(`/api/cli/instruction-sets/${encodeURIComponent(reference)}?project=${encodeURIComponent(project)}`, {
+            method: 'PATCH',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ archived }),
+        }), `Instructions ${subcommand}`);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else {
+            const set = payload.instructionSet;
+            const identity = set?.slug && set.slug !== set.name ? `${set.name || reference} (${set.slug})` : set?.name || set?.slug || reference;
+            io.print(`${archived ? 'Archived' : 'Restored'} instruction set ${identity}`);
+        }
+        return 0;
+    }
+    const status = argValue(args, '--status') || 'active';
+    if (subcommand !== 'list' && subcommand !== 'show' && subcommand !== 'sync')
+        throw new Error('Usage: orizu instructions list|show|sync|archive|restore');
+    if (subcommand === 'sync') {
+        const output = argValue(args, '--out');
+        if (!reference || !output)
+            throw new Error('Usage: orizu instructions sync <set> --out <dir> --project <team/project> [--model-config <identity>] [--json]');
+        const modelConfig = argValue(args, '--model-config');
+        const path = `/api/cli/instruction-sets/${encodeURIComponent(reference)}/sync?project=${encodeURIComponent(project)}${modelConfig ? `&modelConfig=${encodeURIComponent(modelConfig)}` : ''}`;
+        const payload = await responsePayload(await authedFetch(path, { method: 'GET' }), 'Instruction sets sync');
+        const set = payload.instructionSet;
+        if (!set || (set.slug !== reference && set.name !== reference) || (modelConfig && (!Array.isArray(set.filteredTo) || set.filteredTo.length !== 1 || set.filteredTo[0] !== modelConfig))) {
+            throw new Error('instruction_set_sync_response_mismatch');
+        }
+        syncToDisk(output, set);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else
+            io.print(`Synced ${set.name} to ${join(output, set.name)}`);
+        return 0;
+    }
+    if (subcommand === 'show' && (!reference || reference.startsWith('--')))
+        throw new Error('Instruction set name is required');
+    if (status !== 'active' && status !== 'archived' && status !== 'all')
+        throw new Error('--status must be active, archived, or all');
+    const query = `project=${encodeURIComponent(project)}&status=${encodeURIComponent(status)}`;
+    const path = subcommand === 'list'
+        ? `/api/cli/instruction-sets?${query}`
+        : `/api/cli/instruction-sets/${encodeURIComponent(reference)}?${query}`;
+    const payload = await responsePayload(await authedFetch(path, { method: 'GET' }), `Instruction sets ${subcommand}`);
+    if (io.json) {
+        io.print(JSON.stringify(payload));
+        return 0;
+    }
+    if (subcommand === 'list') {
+        const sets = Array.isArray(payload.instructionSets) ? payload.instructionSets : [];
+        for (const item of sets) {
+            const set = item;
+            io.print(`${set.name || 'unnamed'}${set.slug ? ` [${set.slug}]` : ''}${set.status === 'archived' ? ' [archived]' : ''}${set.shape ? ` (${set.shape.join(', ')})` : ''}`);
+            if (set.description)
+                io.print(`  ${sanitizeHumanInlineText(sanitizeTerminalText, set.description)}`);
+        }
+        return 0;
+    }
+    const set = payload.instructionSet;
+    io.print(`${set?.name || reference}${set?.status === 'archived' ? ' [archived]' : ''}: ${set?.shape?.join(', ') || ''}`);
+    if (set?.description)
+        io.print(`Description: ${sanitizeHumanInlineText(sanitizeTerminalText, set.description)}`);
+    if (set?.default)
+        io.print(`Default: v${set.default.versionNumber ?? '?'}`);
+    for (const profile of set?.profiles || []) {
+        io.print(`${profile.modelConfigIdentity || 'unspecified'}: production ${profile.production ? `v${profile.production.versionNumber}` : '—'}, latest ${profile.latestVersionNumber ?? '—'}`);
+    }
+    return 0;
+}

package/dist/json-response.d.ts

@@ -0,0 +1,4 @@
+export declare function sanitizeTerminalText(value: unknown): string;
+export declare function sanitizeHumanInlineText(sanitizer: (value: unknown) => string, value: unknown): string;
+export declare function parseJsonResponse<T>(response: Response, context: string): Promise<T>;
+//# sourceMappingURL=json-response.d.ts.map

package/dist/json-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-response.d.ts","sourceRoot":"","sources":["../src/json-response.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAK3D;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,EACrC,KAAK,EAAE,OAAO,GACb,MAAM,CAER;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,CAAC,CAmBZ"}

package/dist/jsonl-stream.d.ts

@@ -0,0 +1,8 @@
+export declare const JSONL_UPLOAD_CHUNK_MAX_BYTES: number;
+interface JsonlChunkOptions {
+    maxPayloadBytes?: number;
+}
+export declare function estimateRowsPayloadByteLength(rows: Array<Record<string, unknown>>): number;
+export declare function streamJsonlRowChunks(filePath: string, options?: JsonlChunkOptions): AsyncGenerator<Array<Record<string, unknown>>>;
+export {};
+//# sourceMappingURL=jsonl-stream.d.ts.map

package/dist/jsonl-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonl-stream.d.ts","sourceRoot":"","sources":["../src/jsonl-stream.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,4BAA4B,QAAkB,CAAA;AAE3D,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AA2CD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAM1F;AAED,wBAAuB,oBAAoB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC9B,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAqEhD"}

package/dist/kill-switch-cli.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Per-team agent kill switch CLI (ALI-1007 / G6):
+ *   orizu team kill-agents <team> [--reason <text>]
+ *   orizu team release-agents <team>
+ *
+ * `kill-agents` ENGAGES the switch — ends every active session of the team and
+ * revokes its agent tokens "in seconds"; `release-agents` re-enables minting
+ * (killed sessions stay ended). Human ADMIN only: the server rejects agent
+ * bearers and non-admins. Pure command logic with an injected fetcher so the
+ * entry point owns argument parsing and human/JSON output.
+ *
+ * Containment (ALI-1166): the guarantee is session-end + per-request
+ * verification + token-row revocation at engage — a bearer bound to an ended
+ * session can never verify again, and ended sessions are terminal
+ * (DB-enforced; no post-kill resurrection).
+ * `tokensRevoked` in the summary counts the persisted agent token rows the
+ * engage revoked (trigger cascade + belt, one transaction); it may include
+ * expired or already-ended-session stragglers that were never live bearers at
+ * kill time. `--json` output is the server's summary passed through, including
+ * `containment: "session-end"`.
+ */
+export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface KillSwitchCommandIo {
+    json: boolean;
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    fetcher?: CliFetcher;
+}
+export declare function killSwitchCommand(args: string[], io: KillSwitchCommandIo): Promise<number>;
+//# sourceMappingURL=kill-switch-cli.d.ts.map

package/dist/kill-switch-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kill-switch-cli.d.ts","sourceRoot":"","sources":["../src/kill-switch-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AA8CD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6ChG"}

package/dist/loopback-serve.d.ts

@@ -0,0 +1,25 @@
+export interface LoopbackServer {
+    port: number;
+    stop: (force?: boolean) => void;
+}
+interface LoopbackServeOptions {
+    port: number;
+    hostname: '127.0.0.1';
+    fetch: (request: Request) => Promise<Response> | Response;
+}
+export interface LoopbackServeRuntime {
+    serve: (options: LoopbackServeOptions) => {
+        port?: number;
+        stop: (force?: boolean) => void;
+    };
+}
+/**
+ * Bind a separate-process test server to loopback.
+ *
+ * The full parallel suite exposed intermittent Bun `port: 0` startup failures,
+ * so these fixtures use explicit high-port candidates. `serve()` still performs
+ * the atomic bind; a collision retries only when Bun reports `EADDRINUSE`.
+ */
+export declare function serveOnLoopback(runtime: LoopbackServeRuntime, requestedPort: number | undefined, fetch: (request: Request) => Promise<Response> | Response, serverName: string): LoopbackServer;
+export {};
+//# sourceMappingURL=loopback-serve.d.ts.map