orizu 0.5.20 → 0.5.21

package/dist/archive-artifacts-cli.d.ts

@@ -0,0 +1,50 @@
+/**
+ * ALI-1199 archive/restore commands and assignment inventory.
+ *
+ * Kept outside index.ts per the CLI line ratchet. The server owns
+ * authorization and idempotency; this module validates the CLI grammar and
+ * renders the canonical response without inventing client-side state.
+ */
+export interface ArchiveArtifactsIo {
+    json: boolean;
+    print: (line: string) => void;
+    resolveProjectSlug: (projectArg: string | null) => Promise<string>;
+    fetcher?: (path: string, init?: RequestInit) => Promise<Response>;
+}
+interface TaskSummary {
+    id: string;
+    title: string;
+    status: string;
+    archiveStatus?: string;
+    teamSlug?: string;
+    projectSlug?: string;
+}
+interface AppSummary {
+    id: string;
+    name: string;
+    currentVersionNum?: number;
+    status?: string;
+}
+interface DatasetSummary {
+    id: string;
+    name: string;
+    rowCount: number | string;
+    status?: string;
+}
+interface ScorerSummary {
+    id: string;
+    name: string;
+    mode: string;
+    metricLabel: string;
+    implementationKind: string;
+    status?: string;
+}
+type PrintLine = (line: string) => void;
+export declare function printTaskSummaries(items: TaskSummary[], print: PrintLine): void;
+export declare function printAppSummaries(items: AppSummary[], print: PrintLine): void;
+export declare function printDatasetSummaries(items: DatasetSummary[], print: PrintLine): void;
+export declare function printScorerSummaries(items: ScorerSummary[], print: PrintLine): void;
+export declare function archiveArtifactCommand(args: string[], io: ArchiveArtifactsIo): Promise<void>;
+export declare function listAssignmentsCommand(args: string[], io: ArchiveArtifactsIo): Promise<void>;
+export {};
+//# sourceMappingURL=archive-artifacts-cli.d.ts.map

package/dist/archive-artifacts-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-artifacts-cli.d.ts","sourceRoot":"","sources":["../src/archive-artifacts-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAqBD,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,cAAc;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;AA+CvC,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,QAexE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,QAYtE;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,cAAc,EAAE,EACvB,KAAK,EAAE,SAAS,QAajB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,EAAE,EACtB,KAAK,EAAE,SAAS,QAejB;AAyCD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,kBAAkB,GACrB,OAAO,CAAC,IAAI,CAAC,CA8Df;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,kBAAkB,GACrB,OAAO,CAAC,IAAI,CAAC,CAwEf"}

package/dist/artifact-archive.d.ts

@@ -0,0 +1,48 @@
+export interface StoredZipEntry {
+    path: string;
+    data: Buffer;
+    /**
+     * Original file mode (ALI-1159, codex round 7): NOT part of the archive or
+     * the content hash (the deterministic zip stores fixed attributes), but the
+     * verified-snapshot materialization carries it over so an executable
+     * `./run.sh` runner keeps its +x bit when executed from the snapshot.
+     */
+    mode?: number;
+}
+export interface ArtifactArchive {
+    zipBase64: string;
+    contentSha256: string;
+}
+/** Exported for runner-dir-verify (ALI-1159): the pre-exec scan must resolve
+ * the same directory this module hashes and the runner later executes. */
+export declare function expandHomePath(path: string): string;
+/**
+ * Archives must be byte-identical for identical logical content across machines
+ * because content-addressed deduplication depends on deterministic inputs.
+ *
+ * Tradeoff: runner artifacts are downloaded, unzipped, and executed directly
+ * (there is no install step), so vendored dependency trees such as
+ * node_modules, .venv/venv, and build outputs are legitimate runtime payload
+ * and are deliberately NOT excluded — hash reproducibility therefore depends
+ * on the author shipping identical vendored trees across machines. Only true
+ * junk (.git, .DS_Store, __pycache__, .pytest_cache, .orizu) and secrets
+ * (.env, .env.*) are stripped: secrets must never ship, because runners
+ * receive their configuration at exec time.
+ */
+export declare function shouldExcludeArtifactPath(relativePath: string): boolean;
+export declare function collectArtifactFiles(sourceDir: string, relativeDir?: string): string[];
+export declare const ZIP_GENERAL_PURPOSE_UTF8 = 2048;
+export declare const ZIP_DOS_TIME_2000_01_01 = 0;
+export declare const ZIP_DOS_DATE_2000_01_01: number;
+export declare function createStoredZip(entries: StoredZipEntry[]): Buffer;
+/**
+ * Read the exact entry set the deterministic archive covers (sorted relative
+ * paths + bytes). Exported for runner-dir-verify (ALI-1159): the verified
+ * snapshot must be materialized from the SAME in-memory bytes that were
+ * hashed, so a post-hash mutation of the directory cannot change what runs.
+ */
+export declare function readArtifactEntries(dirArg: string): StoredZipEntry[];
+/** Deterministic archive of an already-read entry set. */
+export declare function archiveArtifactEntries(entries: StoredZipEntry[]): ArtifactArchive;
+export declare function zipDirectoryToBase64(dirArg: string): ArtifactArchive;
+//# sourceMappingURL=artifact-archive.d.ts.map

package/dist/artifact-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-archive.d.ts","sourceRoot":"","sources":["../src/artifact-archive.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;CACtB;AAcD;0EAC0E;AAC1E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAOvE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,MAAM,EAAE,CAclF;AAED,eAAO,MAAM,wBAAwB,OAAS,CAAA;AAC9C,eAAO,MAAM,uBAAuB,IAAI,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAsC,CAAA;AAkB1E,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CA2DjE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAwBpE;AAED,0DAA0D;AAC1D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,eAAe,CAMjF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAEpE"}

package/dist/artifact-pull.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Runner/optimizer artifact commands: list (discover names, version ids, and
+ * labels) and pull (symmetric with `runners push` / `optimizers push` —
+ * resolve by id or name, download the content-addressed zip from storage,
+ * and extract it into --out). Pull writes version metadata to
+ * .orizu/pull.json — .orizu/ is excluded from artifact zips (see
+ * artifact-archive.ts), so a pulled directory re-pushes with an identical
+ * content hash.
+ *
+ * Lives outside index.ts per the CLI index line ratchet (ALI-976): this module
+ * owns its own argument parsing and printing via injected io.
+ */
+export type PullableArtifactKind = 'runner' | 'optimizer';
+export interface PullArtifactIo {
+    json: boolean;
+    print: (line: string) => void;
+    resolveProjectSlug: (projectArg: string | null) => Promise<string>;
+    fetcher?: (path: string, init?: RequestInit) => Promise<Response>;
+}
+export declare const ARTIFACT_MAX_BYTES: number;
+export declare function runnerOptimizerCommand(args: string[], io: PullArtifactIo): Promise<void>;
+//# sourceMappingURL=artifact-pull.d.ts.map

package/dist/artifact-pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-pull.d.ts","sourceRoot":"","sources":["../src/artifact-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAGD,eAAO,MAAM,kBAAkB,QAAmB,CAAA;AA8DlD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,cAAc,iBAM9E"}

package/dist/banner.d.ts

@@ -0,0 +1,3 @@
+export declare const ORIZU_BANNER = "     \u2584\u2584\n   \u2584\u259C\u259B \u2588\u2588\u2599\n  \u259F\u2580   \u25E5\u2588\u2588\u259B\n        \u2580\u259C\u2584\n       \u2584\u259F\u2588\n     \u2584\u2588\u2588\u2588\n   \u2584\u2588\u2588\u2588\u2588\u25E4        \u2584\u2584\u2584\u2588\u259B\n \u259F\u2588\u2588\u2588\u2588\u2588\u25E4     \u2584\u2584\u2588\u2588\u2588\u2588\u2588\u259B\n \u2584\u2580\u2588\u2588\u2588\u25E4  \u2584\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u259B\n \u25E5\u2588\u2584\u2580\u259B\u2590\u2588\u2584\u25E5\u259C\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u259B \u2588\u2588\u2588\u2580\n  \u259C\u2588\u2588 \u2588\u2588\u2588\u2588\u2584\u25E5\u259C\u2588\u2588\u2588\u2588\u259B \u2588\u2588\u2580\n   \u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2584 \u259C\u2588\u259B \u2588\u2580\n    \u2590\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u25E3  \u2580";
+export declare function renderBanner(): string;
+//# sourceMappingURL=banner.d.ts.map

package/dist/banner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"banner.d.ts","sourceRoot":"","sources":["../src/banner.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,YAAY,m4BAYN,CAAA;AAEnB,wBAAgB,YAAY,IAAI,MAAM,CAErC"}

package/dist/connectors-cli.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Connector readiness CLI (ALI-903). Thin, read-only consumer of the
+ * project-scoped `/api/cli/connectors` endpoint. Pure command logic with an
+ * injected fetcher and project resolver; the entry point owns argument parsing
+ * and human/JSON output. Secret material is never printed (the endpoint already
+ * redacts config and surfaces credentials only as a boolean).
+ */
+export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface ConnectorReadiness {
+    type: string;
+    status: string;
+    hasCredentials: boolean;
+    updatedAt: string | null;
+    config: Record<string, unknown>;
+}
+export interface ConnectorsResult {
+    connectors: ConnectorReadiness[];
+}
+export interface FetchConnectorsOptions {
+    fetcher?: CliFetcher;
+    projectSlug: string;
+}
+export interface ConnectorsCommandIo {
+    json: boolean;
+    print: (line: string) => void;
+    fetcher?: CliFetcher;
+    resolveProjectSlug?: (arg: string | null) => Promise<string>;
+}
+export declare function fetchConnectors(opts: FetchConnectorsOptions): Promise<ConnectorsResult>;
+export declare function connectorsCommand(args: string[], io: ConnectorsCommandIo): Promise<number>;
+//# sourceMappingURL=connectors-cli.d.ts.map

package/dist/connectors-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectors-cli.d.ts","sourceRoot":"","sources":["../src/connectors-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,kBAAkB,EAAE,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC7D;AAaD,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAQ7F;AAgCD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BhG"}

package/dist/credentials.d.ts

@@ -0,0 +1,46 @@
+import { ServerCredentials, StoredCredentialsV2, StoredCredentialsV3 } from './types.js';
+export declare function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentialsV3 | null;
+export declare function getServerCredentials(baseUrl: string): ServerCredentials | null;
+export declare function saveServerCredentials(baseUrl: string, credentials: ServerCredentials): void;
+export declare function updateServerCredentials(baseUrl: string, credentials: ServerCredentials): void;
+export declare function getActiveBaseUrl(): string | null;
+/**
+ * In-sandbox bearer resolution (ALI-1044). Resolves a bearer supplied out-of-band
+ * to the hosted agent, WITHOUT consulting credentials.json:
+ *   1. `ORIZU_TOKEN` — an explicit bearer in the environment (wins if present).
+ *   2. `ORIZU_TOKEN_FILE` — an absolute path to a 0600 file whose TRIMMED contents
+ *      are the bearer.
+ * Returns null when neither is set, so callers fall through to credentials.json.
+ *
+ * The token file is read FRESH on EVERY call and never cached: the hosted loop
+ * ROTATES the file underneath a long-lived agent process, so caching the value
+ * would pin a stale (soon-expired) bearer. The token is never logged, echoed, or
+ * passed via argv — only returned to the caller for a single request's header.
+ *
+ * A set-but-unreadable/empty `ORIZU_TOKEN_FILE` throws a clear error rather than
+ * returning null, so a misconfigured sandbox fails loudly instead of silently
+ * falling back to (absent) credentials.json and emitting a confusing "not logged
+ * in" message.
+ */
+export declare function resolveEnvBearerToken(): string | null;
+/**
+ * THE uniform bearer resolution for every CLI command (ALI-1090). Exactly the
+ * order `authedFetch` uses: `ORIZU_TOKEN` env → `ORIZU_TOKEN_FILE` (both via
+ * resolveEnvBearerToken, read FRESH per call — never cached, so hosted token
+ * rotations are picked up) → stored credentials.json. Commands that need a raw
+ * bearer (`orizu env`, the run-gepa wrapper) MUST use this instead of reading
+ * credentials.json directly, or they break in hosted sandboxes that are
+ * pre-authenticated via ORIZU_TOKEN_FILE and never ran `orizu login`.
+ */
+export declare function resolveAuthTokenForBaseUrl(baseUrl: string): string;
+/**
+ * Non-throwing "is any auth available?" check (login --no-prompt-if-logged-in,
+ * setup status). Mirrors resolveAuthTokenForBaseUrl's order so an env bearer
+ * counts as signed in. A misconfigured ORIZU_TOKEN_FILE reports false here —
+ * actual requests still fail loudly via resolveEnvBearerToken.
+ */
+export declare function hasResolvableAuth(baseUrl: string): boolean;
+export declare function setActiveBaseUrl(baseUrl: string | null): void;
+export declare function clearServerCredentials(baseUrl: string): boolean;
+export declare function clearCredentialsFile(): void;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAkHnB,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAapF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAWtF;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAItD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAY/D;AAED,wBAAgB,oBAAoB,SAKnC"}

package/dist/csv.d.ts

@@ -0,0 +1,49 @@
+/**
+ * CSV parsing utilities with RFC 4180 compliance.
+ *
+ * This is the single canonical implementation shared by the web app and the
+ * published CLI: lib/csv-utils.ts re-exports from here. It lives inside
+ * packages/cli because the CLI is published standalone to npm and cannot
+ * import files outside its package root, while the app can import anything.
+ *
+ * Resource limits are enforced while parsing so a hostile CSV cannot exhaust
+ * memory. The numeric defaults are inlined here (this package cannot import
+ * @/lib/resource-limits) and mirror RESOURCE_LIMITS.CSV_* in that module —
+ * keep the two in sync.
+ */
+export declare class CSVResourceLimitError extends Error {
+    constructor(message: string);
+}
+export interface CSVParseOptions {
+    maxBytes?: number;
+    maxRows?: number;
+    maxFields?: number;
+    maxFieldBytes?: number;
+}
+/**
+ * Parses CSV text into a 2D array of strings, handling quoted fields, escaped
+ * quotes, multiline fields, and different line endings (CRLF, LF, CR).
+ * Completely empty rows are skipped.
+ *
+ * Resource limits (size, rows, fields, field size) are enforced during
+ * parsing; pass `options` to override the defaults. A violation throws
+ * {@link CSVResourceLimitError}.
+ *
+ * @example
+ * ```typescript
+ * const csv = 'name,age,city\nJohn,25,"New York"'
+ * parseCSV(csv) // [['name', 'age', 'city'], ['John', '25', 'New York']]
+ * ```
+ */
+export declare function parseCSV(csvText: string, options?: CSVParseOptions): string[][];
+/**
+ * Parses CSV data into an array of objects using the first row as headers.
+ *
+ * @example
+ * ```typescript
+ * const csv = 'name,age\nJohn,25'
+ * parseCSVToObjects(csv) // [{ name: 'John', age: '25' }]
+ * ```
+ */
+export declare function parseCSVToObjects(csvText: string, options?: CSVParseOptions): Record<string, string>[];
+//# sourceMappingURL=csv.d.ts.map

package/dist/csv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.d.ts","sourceRoot":"","sources":["../src/csv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AA6ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,EAAE,EAAE,CA+DnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAiB1B"}

package/dist/dataset-download.d.ts

@@ -0,0 +1,6 @@
+export interface ParsedDatasetReference {
+    datasetId: string;
+    project?: string;
+}
+export declare function parseDatasetReference(input: string): ParsedDatasetReference;
+//# sourceMappingURL=dataset-download.d.ts.map

package/dist/dataset-download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-download.d.ts","sourceRoot":"","sources":["../src/dataset-download.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CA4B3E"}

package/dist/dataset-edit-rows.d.ts

@@ -0,0 +1,10 @@
+export interface DatasetEditRowsOptions {
+    datasetId: string;
+    file: string;
+    json: boolean;
+    printJson: (value: Record<string, unknown>) => void;
+    printLine: (value: string) => void;
+    sanitize: (value: string) => string;
+}
+export declare function editDatasetRows(options: DatasetEditRowsOptions): Promise<void>;
+//# sourceMappingURL=dataset-edit-rows.d.ts.map

package/dist/dataset-edit-rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-edit-rows.d.ts","sourceRoot":"","sources":["../src/dataset-edit-rows.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnD,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;CACpC;AAsDD,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CpF"}

package/dist/dataset-upload-snapshot.d.ts

@@ -0,0 +1,13 @@
+interface UploadedDatasetIdentity {
+    id: string;
+    name: string;
+    rowCount: number;
+}
+interface DatasetVersionSnapshot {
+    datasetVersion: {
+        id: string;
+    };
+}
+export declare function ensureDatasetUploadSnapshot<T extends DatasetVersionSnapshot>(dataset: UploadedDatasetIdentity, jsonOutput: boolean, createSnapshot: (datasetId: string) => Promise<T>): Promise<T>;
+export {};
+//# sourceMappingURL=dataset-upload-snapshot.d.ts.map

package/dist/dataset-upload-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-upload-snapshot.d.ts","sourceRoot":"","sources":["../src/dataset-upload-snapshot.ts"],"names":[],"mappings":"AAAA,UAAU,uBAAuB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,sBAAsB;IAC9B,cAAc,EAAE;QACd,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;CACF;AAED,wBAAsB,2BAA2B,CAAC,CAAC,SAAS,sBAAsB,EAChF,OAAO,EAAE,uBAAuB,EAChC,UAAU,EAAE,OAAO,EACnB,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAwBZ"}

package/dist/daytona-slice-rehearsal.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Self-contained rehearsal harness for the Daytona slice (ALI-973 / WS-F).
+ *
+ * Extends the smoke test's in-memory fake-server technique to the WS-F broker /
+ * session-branch / finish-branch / apply contracts, and backs it with a REAL
+ * local bare git repo so the whole flow (clone → commit → push → merge) runs
+ * against genuine git. Consumed by BOTH the unit test and the local-sim
+ * rehearsal in `scripts/daytona-workbench-slice.mjs`, so the two never drift.
+ *
+ * This is the piece that makes `--provider local-sim` a rehearsal, not a mock:
+ * `finish-branch` and `apply` shell out to git on the bare repo (rev-list /
+ * update-ref), so a session branch really is merged into `main`.
+ */
+import type { SliceConfig, SliceFetcher } from './daytona-slice.js';
+import type { SandboxProvider } from './sandbox-provider.js';
+export interface SeededBareRepo {
+    gitDir: string;
+    repoFullName: string;
+    defaultBranch: string;
+}
+/**
+ * Create a bare git repo seeded with the Phase-1 workbench contract (matching
+ * `lib/workbench-repo-contract.ts`) on a `main` branch: root manifests, a
+ * `.gitignore` that ignores `.orizu/`, and a project stub.
+ */
+export declare function seedLocalBareRepo(baseDir: string, config: SliceConfig): SeededBareRepo;
+interface StoredSession {
+    id: string;
+    workspaceId: string;
+    branch: string | null;
+    headSha: string | null;
+    projectSlug: string | null;
+}
+interface StoredMint {
+    id: string;
+    workspaceId: string;
+    purpose: string;
+    revoked: boolean;
+}
+interface StoredManifest {
+    id: string;
+    status: string;
+    branch: string;
+    headSha: string;
+    outcome: Record<string, unknown>;
+}
+/**
+ * In-memory WS-F control plane over a real bare repo. Session-start cuts a real
+ * branch; finish-branch diffs it; apply fast-forwards `main`. Tracks token mints
+ * so revocation is observable and asserts tokens never leak into stored state.
+ */
+export declare class FakeWorkbenchApi {
+    private readonly repo;
+    workspaces: Map<string, {
+        id: string;
+        teamSlug: string;
+        slug: string;
+    }>;
+    sessions: Map<string, StoredSession>;
+    mints: Map<string, StoredMint>;
+    manifests: Map<string, StoredManifest>;
+    tokensIssued: string[];
+    private counter;
+    constructor(repo: SeededBareRepo);
+    private id;
+    private branchHead;
+    newFetcher(): SliceFetcher;
+}
+export interface SliceRehearsal {
+    config: SliceConfig;
+    api: FakeWorkbenchApi;
+    provider: SandboxProvider;
+    makeFetcher: () => SliceFetcher;
+    resolveCloneUrl: (repo: string) => string;
+    bareRepoDir: string;
+    defaultBranch: () => string;
+    cleanup: () => void;
+}
+/**
+ * Wire a full self-contained rehearsal: seed a bare repo, stand up the fake
+ * control plane, and hand back a local-sim provider + resolveCloneUrl that maps
+ * the broker's repo name to the bare repo path.
+ */
+export declare function createSliceRehearsal(options?: {
+    config?: Partial<SliceConfig>;
+    keep?: boolean;
+}): SliceRehearsal;
+export {};
+//# sourceMappingURL=daytona-slice-rehearsal.d.ts.map

package/dist/daytona-slice-rehearsal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daytona-slice-rehearsal.d.ts","sourceRoot":"","sources":["../src/daytona-slice-rehearsal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AA2B5D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,cAAc,CAmCtF;AAED,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,UAAU,cAAc;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAMD;;;;GAIG;AACH,qBAAa,gBAAgB;IAQf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,UAAU;YAAyB,MAAM;kBAAY,MAAM;cAAQ,MAAM;OAAK;IAC9E,QAAQ,6BAAmC;IAC3C,KAAK,0BAAgC;IACrC,SAAS,8BAAoC;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAK;IAC3B,OAAO,CAAC,OAAO,CAAI;gBAEU,IAAI,EAAE,cAAc;IAEjD,OAAO,CAAC,EAAE;IAKV,OAAO,CAAC,UAAU;IAIlB,UAAU,IAAI,YAAY;CAkI3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAA;IACnB,GAAG,EAAE,gBAAgB,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,WAAW,EAAE,MAAM,YAAY,CAAA;IAC/B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,MAAM,CAAA;IAC3B,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,cAAc,CAuBpH"}

package/dist/daytona-slice.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Daytona thin-slice load path — pure step logic (ALI-973 / WS-F).
+ *
+ * smoke.ts-style: an importable eight-step workflow with an injected fetcher
+ * factory + an injected `SandboxProvider` (ADR-003 seam). The `scripts/daytona-
+ * workbench-slice.mjs` driver supplies a live-server fetcher + a real provider;
+ * the unit test and the local-sim rehearsal supply an in-memory API fake + the
+ * local-sim provider. No process/argv/print here.
+ *
+ * The slice proves the full hosted-agent load path against the GitHub-hosted
+ * repo, deliberately thin — its purpose is to pin the token-broker API shape
+ * before Phase 3:
+ *   1. resolve workspace + start a session on its own repo branch,
+ *   2. create a sandbox via the provider,
+ *   3. mint a READ token and clone the session branch INSIDE the sandbox,
+ *   4. read + parse the root manifests (orizu.team.json, schemaVersion),
+ *   5. resolve one object ref WITHOUT committing bytes (falls back to proving
+ *      `.orizu/` is the git-ignored materialization target when the exemplar
+ *      workspace carries no object refs),
+ *   6. write a small generated file + commit inside the sandbox,
+ *   7. mint a WRITE token, push the session branch, revoke BOTH tokens,
+ *   8. token-hygiene sweep (no token residue on the sandbox fs), then finish-
+ *      branch → approve → apply via the API, then destroy the sandbox.
+ */
+import type { SandboxProvider, SandboxProviderKind, SandboxSession } from './sandbox-provider.js';
+import { type HygieneFinding } from './sandbox-hygiene.js';
+export type SliceFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface SliceConfig {
+    teamSlug: string;
+    projectSlug: string;
+    workspaceSlug: string;
+}
+export interface SliceStepPlan {
+    index: number;
+    key: string;
+    title: string;
+    plan: string;
+}
+export interface SliceStepReport {
+    index: number;
+    key: string;
+    title: string;
+    ok: boolean;
+    detail: string;
+    durationMs: number;
+}
+export interface SliceReport {
+    ok: boolean;
+    provider: SandboxProviderKind;
+    steps: SliceStepReport[];
+    failedStep: SliceStepReport | null;
+    totalMs: number;
+    hygiene: {
+        clean: boolean;
+        findings: HygieneFinding[];
+    } | null;
+    ids: {
+        workspaceId?: string;
+        sessionId?: string;
+        branch?: string;
+        repo?: string;
+        sandboxId?: string;
+        readMintId?: string;
+        writeMintId?: string;
+        manifestId?: string;
+        commitSha?: string;
+        mergeOutcome?: string;
+        /** Set on the error path when a session branch was pushed but the run did
+         *  not reach the merge — names the branch left on the remote for cleanup. */
+        orphanedBranch?: string;
+    };
+}
+export interface SliceHooks {
+    /** Test seam: run after commit/push, immediately BEFORE the hygiene sweep.
+     *  Used to plant a credential so the sweep's detection power is provable. */
+    beforeHygiene?: (session: SandboxSession, ctx: {
+        repoPath: string;
+    }) => Promise<void> | void;
+}
+export interface RunSliceOptions {
+    config: SliceConfig;
+    makeFetcher: () => SliceFetcher;
+    provider: SandboxProvider;
+    /** Map the broker's repo full-name to a clone URL the provider understands.
+     *  Live: `https://github.com/<repo>.git`. Local-sim: the bare repo path. */
+    resolveCloneUrl: (repo: string) => string;
+    now?: () => number;
+    onStep?: (step: SliceStepReport) => void;
+    keep?: boolean;
+    generatedFileName?: string;
+    generatedFileBody?: string;
+    hooks?: SliceHooks;
+}
+export declare function planSliceSteps(): SliceStepPlan[];
+export interface ProviderSelectionInput {
+    providerFlag?: string | null;
+    hasDaytonaKey: boolean;
+}
+/**
+ * Resolve the provider kind. An explicit `--provider` flag always wins; with no
+ * flag the default is `local-sim` when DAYTONA_API_KEY is absent, and `daytona`
+ * when it is present (the live run is founder-gated by that key).
+ */
+export declare function selectProviderKind(input: ProviderSelectionInput): SandboxProviderKind;
+export declare function runDaytonaSlice(opts: RunSliceOptions): Promise<SliceReport>;
+//# sourceMappingURL=daytona-slice.d.ts.map

package/dist/daytona-slice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daytona-slice.d.ts","sourceRoot":"","sources":["../src/daytona-slice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAEhF,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAElF,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAA;IACX,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAA;IACxB,UAAU,EAAE,eAAe,GAAG,IAAI,CAAA;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC9D,GAAG,EAAE;QACH,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB;qFAC6E;QAC7E,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,MAAM,WAAW,UAAU;IACzB;iFAC6E;IAC7E,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC7F;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,WAAW,EAAE,MAAM,YAAY,CAAA;IAC/B,QAAQ,EAAE,eAAe,CAAA;IACzB;gFAC4E;IAC5E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAA;IACxC,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,UAAU,CAAA;CACnB;AAgBD,wBAAgB,cAAc,IAAI,aAAa,EAAE,CAEhD;AAYD,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,mBAAmB,CASrF;AA2GD,wBAAsB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAoRjF"}