orizu 0.5.20 → 0.5.21

package/dist/instruction-sets-cli.js

@@ -0,0 +1,361 @@
+import { authedFetch } from './http.js';
+import { loadInstructionSetManifest, MAX_INSTRUCTION_SET_COMPONENT_BYTES } from './instruction-set-manifest.js';
+import { sanitizeHumanInlineText, sanitizeTerminalText } from './json-response.js';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+function positionalArgs(args) {
+    const values = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const value = args[index];
+        if (value.startsWith('--')) {
+            if (argValue(args, value) !== null)
+                index += 1;
+            continue;
+        }
+        values.push(value);
+    }
+    return values;
+}
+function argValue(args, flag) {
+    const index = args.indexOf(flag);
+    return index === -1 || !args[index + 1] || args[index + 1].startsWith('--')
+        ? null
+        : args[index + 1];
+}
+async function responsePayload(response, action) {
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+        throw new Error(`${action} failed (${response.status}): ${typeof payload.error === 'string' ? payload.error : response.statusText}`);
+    }
+    return payload;
+}
+const SAFE_SEGMENT = /^[A-Za-z0-9._-]+$/u;
+function safeSegment(value) { if (!SAFE_SEGMENT.test(value) || value === '.' || value === '..' || value.startsWith('.'))
+    throw new Error('instruction_set_path_unsafe'); }
+function slug(identity) { return identity.replaceAll('/', '__').replace(/[^A-Za-z0-9._-]/gu, '_'); }
+function stable(value) { return `${JSON.stringify(value, null, 2)}\n`; }
+function sha256(value) { return createHash('sha256').update(value, 'utf8').digest('hex'); }
+function writeMaterial(root, material, shape, manifestRoot, fileOps = { writeFileSync }) {
+    const files = {};
+    const syncedContentSha256 = {};
+    const pinnedComponents = {};
+    for (const key of [...shape].sort()) {
+        safeSegment(key);
+        const component = material.components[key];
+        if (typeof component?.body === 'string') {
+            const relative = `${manifestRoot}/${key}.md`;
+            files[key] = relative;
+            const target = join(root, ...relative.split('/'));
+            mkdirSync(join(target, '..'), { recursive: true });
+            fileOps.writeFileSync(target, component.body);
+            syncedContentSha256[key] = sha256(component.body);
+        }
+        else if (component?.repoPath && component?.contentSha && component?.commitSha)
+            pinnedComponents[key] = { repoPath: component.repoPath, contentSha: component.contentSha, commitSha: component.commitSha };
+        else
+            throw new Error('instruction_set_unresolvable');
+    }
+    return { profileVersionId: material.profileVersionId, versionNumber: material.versionNumber, modelConfigIdentity: material.modelConfigIdentity, resolvedFrom: material.resolvedFrom, files, syncedContentSha256, ...(Object.keys(pinnedComponents).length ? { pinnedComponents } : {}) };
+}
+// Only the scratch paths THIS run created are ever removed; a user's own
+// `.<set>.*.bak` in --out is never touched (PR #1668 review).
+function removeOwnScratch(paths) {
+    for (const path of paths)
+        if (path && existsSync(path))
+            rmSync(path, { recursive: true, force: true });
+}
+function existingDestinationIsSynced(destination, name) {
+    try {
+        if (!statSync(destination).isDirectory())
+            return false;
+        const manifest = JSON.parse(readFileSync(join(destination, 'manifest.json'), 'utf8'));
+        return manifest.manifestVersion === 1 && manifest.name === name;
+    }
+    catch {
+        return false;
+    }
+}
+export function syncToDisk(out, set, fileOps = { writeFileSync }) {
+    safeSegment(set.name);
+    for (const key of set.shape)
+        safeSegment(key);
+    const profileSlugs = new Set();
+    for (const profile of set.profiles) {
+        const value = slug(profile.modelConfigIdentity);
+        safeSegment(value);
+        if (profileSlugs.has(value))
+            throw new Error('instruction_set_slug_collision');
+        profileSlugs.add(value);
+    }
+    mkdirSync(out, { recursive: true });
+    const destination = join(out, set.name);
+    if (existsSync(destination) && !existingDestinationIsSynced(destination, set.name))
+        throw new Error('instruction_set_sync_destination_not_synced');
+    const temp = join(out, `.${set.name}.${randomUUID()}.tmp`);
+    const move = fileOps.renameSync || renameSync;
+    let backup = null;
+    mkdirSync(temp);
+    try {
+        const defaultMaterial = writeMaterial(temp, set.default, set.shape, 'default', fileOps);
+        const profiles = set.profiles.map(profile => ({
+            modelConfigIdentity: profile.modelConfigIdentity, slug: slug(profile.modelConfigIdentity), resolvedFrom: profile.resolvedFrom,
+            production: profile.production ? writeMaterial(temp, profile.production, set.shape, `profiles/${slug(profile.modelConfigIdentity)}`, fileOps) : null,
+        })).sort((a, b) => a.modelConfigIdentity.localeCompare(b.modelConfigIdentity));
+        const components = [
+            ...Object.entries(defaultMaterial.files).map(([key, path]) => ({ key, path, syncedContentSha256: defaultMaterial.syncedContentSha256[key] })),
+            ...profiles.flatMap(profile => profile.production
+                ? Object.entries(profile.production.files).map(([key, path]) => ({ key, modelConfig: profile.modelConfigIdentity, path, syncedContentSha256: profile.production.syncedContentSha256[key] }))
+                : []),
+        ];
+        const manifest = { manifestVersion: 1, name: set.name, ...(Object.hasOwn(set, 'description') ? { description: set.description ?? null } : {}), shape: set.shape, components, default: defaultMaterial, profiles, ...(set.filteredTo ? { filteredTo: [...set.filteredTo].sort() } : {}) };
+        fileOps.writeFileSync(join(temp, 'manifest.json'), stable(manifest));
+        backup = join(out, `.${set.name}.${randomUUID()}.bak`);
+        if (existsSync(destination))
+            move(destination, backup);
+        try {
+            move(temp, destination);
+        }
+        catch (error) {
+            if (existsSync(backup))
+                move(backup, destination);
+            throw error;
+        }
+        removeOwnScratch([backup]);
+    }
+    catch (error) {
+        removeOwnScratch([temp]);
+        if (backup && existsSync(backup) && !existsSync(destination))
+            move(backup, destination);
+        removeOwnScratch([backup]);
+        throw error;
+    }
+}
+export async function instructionSetsCommand(args, io) {
+    const positionals = positionalArgs(args);
+    const [subcommand, reference] = positionals;
+    if (subcommand === 'default' && reference === 'move') {
+        const version = argValue(args, '--version');
+        if (!version || !/^[0-9]+$/u.test(version) || Number(version) < 1)
+            throw new Error('--version must be a positive integer');
+    }
+    let writeManifest;
+    if (subcommand === 'create' || subcommand === 'push') {
+        if (!reference || reference.startsWith('--'))
+            throw new Error(subcommand === 'create'
+                ? 'Usage: orizu instructions create <manifest> --project <team/project> [--runner-version <id>] [--model-config <identity>] [--json]'
+                : 'Usage: orizu instructions push <manifest> --project <team/project> [--set <slug-or-exact-name>] [--runner-version <id>] [--json]');
+        writeManifest = loadInstructionSetManifest(reference);
+    }
+    const project = await io.resolveProjectSlug(argValue(args, '--project'));
+    if (subcommand === 'default') {
+        const operation = reference;
+        const set = positionals[2];
+        const identity = argValue(args, '--model-config');
+        const version = argValue(args, '--version');
+        if ((operation !== 'show' && operation !== 'move') || !set)
+            throw new Error('Usage: orizu instructions default show|move <set> --project <team/project> [--model-config <identity> --version <n>] [--json]');
+        if (operation === 'move' && (!identity || !version || !/^[0-9]+$/u.test(version) || Number(version) < 1))
+            throw new Error('--version must be a positive integer');
+        const path = `/api/cli/instruction-sets/${encodeURIComponent(set)}/default?project=${encodeURIComponent(project)}`;
+        if (operation === 'show') {
+            const payload = await responsePayload(await authedFetch(path, { method: 'GET' }), 'Instruction sets default show');
+            if (io.json)
+                io.print(JSON.stringify(payload));
+            else
+                io.print(`Default: v${payload.default?.versionNumber ?? '?'}`);
+            return 0;
+        }
+        if (!io.json) {
+            const impact = await responsePayload(await authedFetch(path, { method: 'GET' }), 'Instruction sets default show');
+            const resolvesToDefault = Array.isArray(impact.resolvesToDefault) ? impact.resolvesToDefault.filter((item) => typeof item === 'string') : [];
+            io.print(`These model configs resolve to the default: ${resolvesToDefault.join(', ')}`);
+        }
+        const payload = await responsePayload(await authedFetch(path, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ modelConfigIdentity: identity, versionNumber: Number(version) }) }), 'Instruction sets default move');
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else
+            io.print(`Default moved to ${identity} v${version}`);
+        return 0;
+    }
+    if (subcommand === 'shape') {
+        const operation = reference;
+        const set = positionals[2];
+        const key = argValue(args, '--key');
+        const from = argValue(args, '--from');
+        if ((operation !== 'add' && operation !== 'remove') || !set || !key || (operation === 'add' && !from))
+            throw new Error('Usage: orizu instructions shape add|remove <set> --project <team/project> --key <key> [--from <manifest>] [--json]');
+        let component;
+        if (operation === 'add') {
+            let manifest;
+            try {
+                manifest = JSON.parse(readFileSync(from, 'utf8'));
+            }
+            catch {
+                throw new Error('instruction_set_manifest_invalid_json');
+            }
+            const source = manifest && typeof manifest === 'object' && Array.isArray(manifest.components)
+                ? manifest.components.find((item) => Boolean(item && typeof item === 'object' && item.key === key))
+                : undefined;
+            if (!source || typeof source.text !== 'string' || Buffer.byteLength(source.text, 'utf8') > MAX_INSTRUCTION_SET_COMPONENT_BYTES)
+                throw new Error(`Instruction set manifest has no component for key: ${key}`);
+            component = { body: source.text };
+        }
+        const payload = await responsePayload(await authedFetch(`/api/cli/instruction-sets/${encodeURIComponent(set)}/shape?project=${encodeURIComponent(project)}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ operation, key, ...(component ? { component } : {}) }) }), `Instruction sets shape ${operation}`);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else {
+            io.print(`Shape ${operation === 'add' ? 'added' : 'removed'}: ${key}`);
+            const affected = Array.isArray(payload.affected) ? payload.affected : [];
+            const identities = [...new Set(affected.flatMap(pointer => pointer && typeof pointer === 'object' && typeof pointer.modelConfigIdentity === 'string' ? [pointer.modelConfigIdentity] : []))];
+            if (identities.length)
+                io.print(`${set} does not resolve for these model configs until the pointers move: ${identities.join(', ')}`);
+            for (const pointer of affected)
+                if (pointer && typeof pointer === 'object') {
+                    const item = pointer;
+                    if (typeof item.modelConfigIdentity === 'string' && (item.pointer === 'production' || item.pointer === 'default') && typeof item.headVersionNumber === 'number') {
+                        const command = item.pointer === 'production' ? 'profiles promote' : 'default move';
+                        const operatorAction = item.pointer === 'production' ? 'promote' : 'default move';
+                        if (typeof item.stalePointerVersionNumber === 'number' && typeof item.branchedFromVersionNumber === 'number' && item.branchedFromVersionNumber !== item.stalePointerVersionNumber)
+                            io.print(`${operatorAction} would move ${item.pointer} from v${item.stalePointerVersionNumber}'s text to v${item.headVersionNumber} = v${item.branchedFromVersionNumber}'s text + ${key}`);
+                        io.print(`Follow up: instructions ${command} ${set} --project ${project} --model-config ${item.modelConfigIdentity} --version ${item.headVersionNumber}`);
+                    }
+                }
+        }
+        return 0;
+    }
+    if (subcommand === 'profiles') {
+        const operation = reference;
+        const set = positionals[2];
+        const identity = argValue(args, '--model-config');
+        if ((operation !== 'new' && operation !== 'promote' && operation !== 'rollback') || !set || !identity)
+            throw new Error('Usage: orizu instructions profiles new|promote|rollback <set> --project <team/project> --model-config <identity> [--version <n>|--to <n>] [--json]');
+        const encodedSet = encodeURIComponent(set);
+        const encodedIdentity = encodeURIComponent(identity);
+        const version = argValue(args, '--version');
+        const to = argValue(args, '--to');
+        if ((operation === 'promote' && (!version || !/^[0-9]+$/u.test(version) || Number(version) < 1)) || (operation === 'rollback' && (!to || !/^[0-9]+$/u.test(to) || Number(to) < 1)))
+            throw new Error(operation === 'promote' ? '--version must be a positive integer' : '--to must be a positive integer');
+        const path = operation === 'new' ? `/api/cli/instruction-sets/${encodedSet}/profiles` : operation === 'promote' ? `/api/cli/instruction-sets/${encodedSet}/profiles/${encodedIdentity}/label` : `/api/cli/instruction-sets/${encodedSet}/profiles/${encodedIdentity}/rollback`;
+        const body = operation === 'new' ? { modelConfigIdentity: identity } : operation === 'promote' ? { versionNumber: Number(version) } : { to: Number(to) };
+        const payload = await responsePayload(await authedFetch(`${path}?project=${encodeURIComponent(project)}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }), `Instruction sets profiles ${operation}`);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else {
+            const profile = payload.profile;
+            io.print(`${profile?.modelConfigIdentity || identity}: v${profile?.versionNumber ?? '?'} ${operation === 'new' ? 'created' : operation === 'promote' ? 'promoted' : 'rolled back'}`);
+            const mirrored = payload.mirroredPromptLabel;
+            if (mirrored && (typeof mirrored.promptName === 'string' || typeof mirrored.promptId === 'string'))
+                io.print(`also moved production for prompt ${typeof mirrored.promptName === 'string' ? mirrored.promptName : mirrored.promptId} (default profile → prompt label)`);
+        }
+        return 0;
+    }
+    if (subcommand === 'create' || subcommand === 'push') {
+        const manifest = writeManifest;
+        const modelConfig = argValue(args, '--model-config');
+        const runnerVersion = argValue(args, '--runner-version');
+        const setReference = argValue(args, '--set') || manifest.name;
+        const path = subcommand === 'create' ? '/api/cli/instruction-sets' : `/api/cli/instruction-sets/${encodeURIComponent(setReference)}/versions`;
+        const body = subcommand === 'create'
+            ? { ...manifest, ...(modelConfig ? { modelConfigIdentity: modelConfig } : {}), ...(runnerVersion ? { runnerVersionId: runnerVersion } : {}) }
+            : { shape: manifest.shape, components: manifest.components, ...(Object.hasOwn(manifest, 'description') ? { description: manifest.description } : {}), ...(runnerVersion ? { runnerVersionId: runnerVersion } : {}) };
+        const payload = await responsePayload(await authedFetch(`${path}?project=${encodeURIComponent(project)}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }), `Instruction sets ${subcommand}`);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else {
+            const set = payload.instructionSet;
+            const pushed = Array.isArray(payload.pushed) ? payload.pushed : [];
+            const unchanged = Array.isArray(payload.unchanged) ? payload.unchanged : [];
+            const skipped = Array.isArray(payload.skipped) ? payload.skipped : [];
+            if (subcommand === 'create') {
+                const profiles = Array.isArray(set?.profiles) ? set.profiles : [];
+                io.print(`${set?.name || manifest.name}: ${profiles.length} profile(s) created`);
+            }
+            else {
+                const describe = (value) => {
+                    if (typeof value === 'string')
+                        return value;
+                    if (value && typeof value === 'object') {
+                        const row = value;
+                        return `${typeof row.modelConfigIdentity === 'string' ? row.modelConfigIdentity : 'unknown'}${typeof row.versionNumber === 'number' ? ` v${row.versionNumber}` : ''}`;
+                    }
+                    return 'unknown';
+                };
+                io.print(`${set?.name || manifest.name}: pushed ${pushed.map(describe).join(', ') || 'none'}; unchanged ${unchanged.map(describe).join(', ') || 'none'}; skipped ${skipped.map(describe).join(', ') || 'none'}`);
+            }
+        }
+        return 0;
+    }
+    if (subcommand === 'archive' || subcommand === 'restore') {
+        if (!reference || reference.startsWith('--'))
+            throw new Error(`Usage: orizu instructions ${subcommand} <slug-or-exact-name> --project <team/project> [--json]`);
+        const archived = subcommand === 'archive';
+        const payload = await responsePayload(await authedFetch(`/api/cli/instruction-sets/${encodeURIComponent(reference)}?project=${encodeURIComponent(project)}`, {
+            method: 'PATCH',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ archived }),
+        }), `Instructions ${subcommand}`);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else {
+            const set = payload.instructionSet;
+            const identity = set?.slug && set.slug !== set.name ? `${set.name || reference} (${set.slug})` : set?.name || set?.slug || reference;
+            io.print(`${archived ? 'Archived' : 'Restored'} instruction set ${identity}`);
+        }
+        return 0;
+    }
+    const status = argValue(args, '--status') || 'active';
+    if (subcommand !== 'list' && subcommand !== 'show' && subcommand !== 'sync')
+        throw new Error('Usage: orizu instructions list|show|sync|archive|restore');
+    if (subcommand === 'sync') {
+        const output = argValue(args, '--out');
+        if (!reference || !output)
+            throw new Error('Usage: orizu instructions sync <set> --out <dir> --project <team/project> [--model-config <identity>] [--json]');
+        const modelConfig = argValue(args, '--model-config');
+        const path = `/api/cli/instruction-sets/${encodeURIComponent(reference)}/sync?project=${encodeURIComponent(project)}${modelConfig ? `&modelConfig=${encodeURIComponent(modelConfig)}` : ''}`;
+        const payload = await responsePayload(await authedFetch(path, { method: 'GET' }), 'Instruction sets sync');
+        const set = payload.instructionSet;
+        if (!set || (set.slug !== reference && set.name !== reference) || (modelConfig && (!Array.isArray(set.filteredTo) || set.filteredTo.length !== 1 || set.filteredTo[0] !== modelConfig))) {
+            throw new Error('instruction_set_sync_response_mismatch');
+        }
+        syncToDisk(output, set);
+        if (io.json)
+            io.print(JSON.stringify(payload));
+        else
+            io.print(`Synced ${set.name} to ${join(output, set.name)}`);
+        return 0;
+    }
+    if (subcommand === 'show' && (!reference || reference.startsWith('--')))
+        throw new Error('Instruction set name is required');
+    if (status !== 'active' && status !== 'archived' && status !== 'all')
+        throw new Error('--status must be active, archived, or all');
+    const query = `project=${encodeURIComponent(project)}&status=${encodeURIComponent(status)}`;
+    const path = subcommand === 'list'
+        ? `/api/cli/instruction-sets?${query}`
+        : `/api/cli/instruction-sets/${encodeURIComponent(reference)}?${query}`;
+    const payload = await responsePayload(await authedFetch(path, { method: 'GET' }), `Instruction sets ${subcommand}`);
+    if (io.json) {
+        io.print(JSON.stringify(payload));
+        return 0;
+    }
+    if (subcommand === 'list') {
+        const sets = Array.isArray(payload.instructionSets) ? payload.instructionSets : [];
+        for (const item of sets) {
+            const set = item;
+            io.print(`${set.name || 'unnamed'}${set.slug ? ` [${set.slug}]` : ''}${set.status === 'archived' ? ' [archived]' : ''}${set.shape ? ` (${set.shape.join(', ')})` : ''}`);
+            if (set.description)
+                io.print(`  ${sanitizeHumanInlineText(sanitizeTerminalText, set.description)}`);
+        }
+        return 0;
+    }
+    const set = payload.instructionSet;
+    io.print(`${set?.name || reference}${set?.status === 'archived' ? ' [archived]' : ''}: ${set?.shape?.join(', ') || ''}`);
+    if (set?.description)
+        io.print(`Description: ${sanitizeHumanInlineText(sanitizeTerminalText, set.description)}`);
+    if (set?.default)
+        io.print(`Default: v${set.default.versionNumber ?? '?'}`);
+    for (const profile of set?.profiles || []) {
+        io.print(`${profile.modelConfigIdentity || 'unspecified'}: production ${profile.production ? `v${profile.production.versionNumber}` : '—'}, latest ${profile.latestVersionNumber ?? '—'}`);
+    }
+    return 0;
+}

package/dist/json-response.d.ts

@@ -0,0 +1,4 @@
+export declare function sanitizeTerminalText(value: unknown): string;
+export declare function sanitizeHumanInlineText(sanitizer: (value: unknown) => string, value: unknown): string;
+export declare function parseJsonResponse<T>(response: Response, context: string): Promise<T>;
+//# sourceMappingURL=json-response.d.ts.map

package/dist/json-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-response.d.ts","sourceRoot":"","sources":["../src/json-response.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAK3D;AAED,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,EACrC,KAAK,EAAE,OAAO,GACb,MAAM,CAER;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,CAAC,CAAC,CAmBZ"}

package/dist/jsonl-stream.d.ts

@@ -0,0 +1,8 @@
+export declare const JSONL_UPLOAD_CHUNK_MAX_BYTES: number;
+interface JsonlChunkOptions {
+    maxPayloadBytes?: number;
+}
+export declare function estimateRowsPayloadByteLength(rows: Array<Record<string, unknown>>): number;
+export declare function streamJsonlRowChunks(filePath: string, options?: JsonlChunkOptions): AsyncGenerator<Array<Record<string, unknown>>>;
+export {};
+//# sourceMappingURL=jsonl-stream.d.ts.map

package/dist/jsonl-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonl-stream.d.ts","sourceRoot":"","sources":["../src/jsonl-stream.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,4BAA4B,QAAkB,CAAA;AAE3D,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AA2CD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAM1F;AAED,wBAAuB,oBAAoB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC9B,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAqEhD"}

package/dist/kill-switch-cli.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Per-team agent kill switch CLI (ALI-1007 / G6):
+ *   orizu team kill-agents <team> [--reason <text>]
+ *   orizu team release-agents <team>
+ *
+ * `kill-agents` ENGAGES the switch — ends every active session of the team and
+ * revokes its agent tokens "in seconds"; `release-agents` re-enables minting
+ * (killed sessions stay ended). Human ADMIN only: the server rejects agent
+ * bearers and non-admins. Pure command logic with an injected fetcher so the
+ * entry point owns argument parsing and human/JSON output.
+ *
+ * Containment (ALI-1166): the guarantee is session-end + per-request
+ * verification + token-row revocation at engage — a bearer bound to an ended
+ * session can never verify again, and ended sessions are terminal
+ * (DB-enforced; no post-kill resurrection).
+ * `tokensRevoked` in the summary counts the persisted agent token rows the
+ * engage revoked (trigger cascade + belt, one transaction); it may include
+ * expired or already-ended-session stragglers that were never live bearers at
+ * kill time. `--json` output is the server's summary passed through, including
+ * `containment: "session-end"`.
+ */
+export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface KillSwitchCommandIo {
+    json: boolean;
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    fetcher?: CliFetcher;
+}
+export declare function killSwitchCommand(args: string[], io: KillSwitchCommandIo): Promise<number>;
+//# sourceMappingURL=kill-switch-cli.d.ts.map

package/dist/kill-switch-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kill-switch-cli.d.ts","sourceRoot":"","sources":["../src/kill-switch-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AA8CD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6ChG"}

package/dist/loopback-serve.d.ts

@@ -0,0 +1,25 @@
+export interface LoopbackServer {
+    port: number;
+    stop: (force?: boolean) => void;
+}
+interface LoopbackServeOptions {
+    port: number;
+    hostname: '127.0.0.1';
+    fetch: (request: Request) => Promise<Response> | Response;
+}
+export interface LoopbackServeRuntime {
+    serve: (options: LoopbackServeOptions) => {
+        port?: number;
+        stop: (force?: boolean) => void;
+    };
+}
+/**
+ * Bind a separate-process test server to loopback.
+ *
+ * The full parallel suite exposed intermittent Bun `port: 0` startup failures,
+ * so these fixtures use explicit high-port candidates. `serve()` still performs
+ * the atomic bind; a collision retries only when Bun reports `EADDRINUSE`.
+ */
+export declare function serveOnLoopback(runtime: LoopbackServeRuntime, requestedPort: number | undefined, fetch: (request: Request) => Promise<Response> | Response, serverName: string): LoopbackServer;
+export {};
+//# sourceMappingURL=loopback-serve.d.ts.map

package/dist/loopback-serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-serve.d.ts","sourceRoot":"","sources":["../src/loopback-serve.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;CAChC;AAED,UAAU,oBAAoB;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,WAAW,CAAA;IACrB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;CAC1D;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAA;CAC7F;AAgBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,EACzD,UAAU,EAAE,MAAM,GACjB,cAAc,CAahB"}

package/dist/manifests-cli.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Promotion manifests CLI (ALI-907): list | show | approve | reject | apply.
+ * Pure command logic with an injected fetcher and project resolver; the entry
+ * point owns argument parsing and human/JSON output. apply is idempotent on the
+ * server — re-applying returns the stored outcome.
+ *
+ * Every id-taking subcommand accepts a short-id PREFIX (ALI-1038/ALI-1092): a
+ * leading hex slice of the manifest UUID is resolved CLI-side against the
+ * project's manifest list — unique match wins, none/ambiguous is a clear error,
+ * never a server 500.
+ */
+export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface ManifestsCommandIo {
+    json: boolean;
+    print: (line: string) => void;
+    fetcher?: CliFetcher;
+    resolveProjectSlug?: (arg: string | null) => Promise<string>;
+    /** Injectable sleeper for the apply auto-retry loop (tests). */
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function manifestsCommand(args: string[], io: ManifestsCommandIo): Promise<number>;
+//# sourceMappingURL=manifests-cli.d.ts.map

package/dist/manifests-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifests-cli.d.ts","sourceRoot":"","sources":["../src/manifests-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5D,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AA0PD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkG9F"}

package/dist/markdown-report-input.d.ts

@@ -0,0 +1,7 @@
+export declare const MARKDOWN_REPORT_MAX_BYTES: number;
+export interface MarkdownReportInput {
+    markdown: string;
+    sourceName: string | null;
+}
+export declare function readMarkdownReportInput(args: readonly string[], reportLabel: 'Optimization' | 'Prompt' | 'Task'): MarkdownReportInput | null;
+//# sourceMappingURL=markdown-report-input.d.ts.map

package/dist/markdown-report-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-report-input.d.ts","sourceRoot":"","sources":["../src/markdown-report-input.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,yBAAyB,QAAkB,CAAA;AAsCxD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,cAAc,GAAG,QAAQ,GAAG,MAAM,GAC9C,mBAAmB,GAAG,IAAI,CA8C5B"}

package/dist/merge-job.d.ts

@@ -0,0 +1,155 @@
+/**
+ * `orizu internal merge-job` — the one-shot merge sandbox ENTRYPOINT
+ * (ALI-1084, merge-sandbox-job Phase 2). The MergeJobCoordinator DO launches
+ * this inside a minimal, AGENT-FREE sandbox booted from the hosted snapshot;
+ * from here the sandbox pulls its own credentials under the established
+ * boot-secret PULL model and runs the SHARED merge core
+ * (deploy-key-merge-core.ts — the exact code the server path runs; no forked
+ * merge logic).
+ *
+ * FLOW (plan §2.2 step 4):
+ *   a. exchange ORIZU_BOOT_SECRET at the DO for a single-use JOB TOKEN
+ *      (`GET {coordinator}/merge-jobs/:jobKey/job-token`) — the token transits
+ *      Cloudflare; the DEPLOY KEY never does;
+ *   b. pull `{spec, privateKeyPem}` DIRECTLY from the control plane
+ *      (`GET {orizu}/api/coordinator/merge-jobs/:jobId/payload`, job-token
+ *      auth) — single-use, audited server-side before the key is returned;
+ *   c. run the shared merge core (tmp worktree, 0600 key file, pinned GitHub
+ *      host keys, expected-head verification, argv-asserted --no-ff merge)
+ *      with the D8 PRE-PUSH GATE wired in: immediately before `git push` the
+ *      core calls `GET .../gate`; `proceed: false` aborts WITHOUT pushing
+ *      (terminal `superseded`). An UNREACHABLE gate also refuses the push
+ *      (fail closed) but reports `failed` (retryable) — "unknown" is not
+ *      "rejected";
+ *   d. POST the terminal result to the DO (boot-secret auth). Reporting the
+ *      terminal state — not the merge outcome — is this command's success:
+ *      exit 0 on ANY reported terminal (conflict/superseded included), exit 1
+ *      only when the env is invalid or the report itself failed.
+ *
+ * FROZEN ENV CONTRACT (the DO's merge-job sandbox env plan):
+ *   ORIZU_BOOT_SECRET       per-sandbox durable bootstrap secret;
+ *   ORIZU_MERGE_JOB_ID      the job's DO addressing key
+ *                           (`merge:<manifestId>:<expectedHeadSha>` — the
+ *                           control-plane job uuid rides the token response);
+ *   ORIZU_COORDINATOR_URL   the coordinator Worker origin;
+ *   ORIZU_BASE_URL          the Orizu control-plane origin.
+ *
+ * REDACTION: every reported detail passes through `redactSecrets` with the
+ * boot secret, the job token, and the private key PEM on the exact-match list
+ * (plus the shape-pattern net). Nothing here ever logs a secret.
+ */
+import { type DeployKeyMergeResult, type GitCommandRunner } from './deploy-key-merge-core.js';
+export type MergeJobFetch = (url: string, init?: RequestInit) => Promise<Response>;
+export declare const REQUIRED_MERGE_JOB_ENV_VARS: readonly ["ORIZU_BOOT_SECRET", "ORIZU_MERGE_JOB_ID", "ORIZU_COORDINATOR_URL", "ORIZU_BASE_URL"];
+export interface MergeJobEnv {
+    bootSecret: string;
+    /** The DO addressing key (`merge:<manifestId>:<expectedHeadSha>`). */
+    jobKey: string;
+    coordinatorUrl: string;
+    baseUrl: string;
+}
+export declare function resolveMergeJobEnv(env: Record<string, string | undefined>): {
+    ok: true;
+    value: MergeJobEnv;
+} | {
+    ok: false;
+    missing: string[];
+    invalid: string[];
+};
+export type MergeJobTerminalStatus = 'succeeded' | 'conflict' | 'superseded' | 'failed';
+export interface MergeJobReport {
+    status: MergeJobTerminalStatus;
+    result: {
+        merged: boolean;
+        sha: string | null;
+        alreadyMerged: boolean;
+        conflict: boolean;
+    } | null;
+    errorDetail: string | null;
+}
+/** Map the shared core's outcome to the job's terminal status. */
+export declare function terminalFromMergeResult(result: DeployKeyMergeResult): MergeJobReport;
+export interface ExchangedJobToken {
+    token: string;
+    /** The control-plane job id (merge_jobs uuid) — payload/gate URLs use it. */
+    jobId: string;
+}
+export declare function exchangeJobToken(opts: {
+    coordinatorUrl: string;
+    jobKey: string;
+    bootSecret: string;
+    fetchImpl: MergeJobFetch;
+    attempts?: number;
+    backoffMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    log?: (line: string) => void;
+}): Promise<ExchangedJobToken>;
+export interface MergeJobSpec {
+    op: 'merge';
+    jobId: string;
+    manifestId: string;
+    workspaceId: string;
+    repoFullName: string;
+    base: string;
+    sourceBranch: string;
+    expectedHeadSha: string;
+    commitMessage: string;
+}
+export interface MergeJobPayload {
+    spec: MergeJobSpec;
+    privateKeyPem: string;
+}
+export declare function fetchMergeJobPayload(opts: {
+    baseUrl: string;
+    jobId: string;
+    token: string;
+    fetchImpl: MergeJobFetch;
+}): Promise<MergeJobPayload>;
+export type GateOutcome = 'proceed' | 'superseded' | 'unavailable';
+export declare function checkPrePushGate(opts: {
+    baseUrl: string;
+    jobId: string;
+    token: string;
+    fetchImpl: MergeJobFetch;
+}): Promise<GateOutcome>;
+export declare function postMergeJobResult(opts: {
+    coordinatorUrl: string;
+    jobKey: string;
+    bootSecret: string;
+    report: MergeJobReport;
+    fetchImpl: MergeJobFetch;
+    attempts?: number;
+    sleep?: (ms: number) => Promise<void>;
+    log?: (line: string) => void;
+}): Promise<boolean>;
+export interface RunMergeJobOptions {
+    env: MergeJobEnv;
+    fetchImpl?: MergeJobFetch;
+    /** Injectable git runner (tests). Default: the core's real spawn. */
+    runGit?: GitCommandRunner;
+    sleep?: (ms: number) => Promise<void>;
+    log?: (line: string) => void;
+    tokenAttempts?: number;
+    tokenBackoffMs?: number;
+}
+export interface MergeJobRunResult {
+    /** Whether the terminal state reached the DO — the command's success bar. */
+    reported: boolean;
+    status: MergeJobTerminalStatus;
+    detail: string | null;
+}
+export declare function runMergeJob(opts: RunMergeJobOptions): Promise<MergeJobRunResult>;
+export interface MergeJobCommandIo {
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    json?: boolean;
+}
+/**
+ * Read the frozen env contract and run the job. Exit 0 on ANY reported
+ * terminal outcome (the REPORT, not the merge, is the command's success —
+ * a conflict is a correctly-completed job); exit 1 when the env is invalid
+ * or the terminal report never reached the DO (the DO's job wall is the
+ * backstop then).
+ */
+export declare function mergeJobCommand(io: MergeJobCommandIo): Promise<number>;
+//# sourceMappingURL=merge-job.d.ts.map