sigrank 1.0.11 → 1.0.14

package/README.md

@@ -1,16 +1,17 @@
-# Upsilon Measurement Engine — `sigrank` CLI/MCP
+# SigRank SignalAF — `sigrank` CLI/MCP
 
-> **Upsilon** is SignalAF's measurement engine. **SigRank** is the public leaderboard
-> and proof surface. The existing `sigrank` package name and `sigrank/0.1-draft`
-> record remain stable for compatibility. _Four token counts only. Never prompts or code._
+> **SignalAF** is the public brand. **SigRank** is the leaderboard and proof surface.
+> The `sigrank` package reads local AI session logs, derives your token cascade,
+> and publishes to the board at [signalaf.com](https://signalaf.com).
+> _Four token counts only. Never prompts or code._
 
 <div align="center">
 
 <p><img src="./.github/assets/og-card.png" alt="SigRank SignalAF — AI operator evaluation and token cascade efficiency leaderboard" width="800"></p>
 
-**Upsilon measures. SigRank proves. MO§ES™ governs. SignalAF is the brand.**
+**SignalAF is the brand. SigRank proves. MO§ES™ governs.**
 
-Upsilon describes observable AI operator token-processing patterns—not AI model quality, cognition, work quality, employee productivity, or business value.
+SigRank evaluates observable AI operator token-processing patterns—not AI model quality, cognition, work quality, employee productivity, or business value.
 
 [![npm version](https://img.shields.io/npm/v/sigrank.svg?style=flat-square&color=gold)](https://www.npmjs.com/package/sigrank)
 [![CI](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/ci.yml)
@@ -59,13 +60,13 @@ Upsilon describes observable AI operator token-processing patterns—not AI mode
 ## SignalAF product architecture
 
 ```text
-MO§ES™ governance → Upsilon measurement engine → SigRank public proof
+MO§ES™ governance → SignalAF brand → SigRank leaderboard → Upsilon engine
 ```
 
 | Repo | What it is | Install |
 |------|-----------|---------|
-| **[sigrank-mcp](https://github.com/SunrisesIllNeverSee/sigrank-mcp)** (this repo) | Upsilon's compatibility instrument—extracts four token pillars, computes locally, and optionally submits to SigRank. | `npx sigrank` |
-| **[sigrank-app](https://github.com/SunrisesIllNeverSee/sigrank-app)** | Upsilon web implementation plus the SigRank leaderboard/proof surface. | [signalaf.com](https://signalaf.com) |
+| **[sigrank-mcp](https://github.com/SunrisesIllNeverSee/sigrank-mcp)** (this repo) | SigRank's on-device scanner — extracts four token pillars, computes locally, and optionally submits to the board. | `npx sigrank` |
+| **[sigrank-app](https://github.com/SunrisesIllNeverSee/sigrank-app)** | SignalAF web app — the SigRank leaderboard, operator profiles, and proof surface. | [signalaf.com](https://signalaf.com) |
 | **[bestuser-router-mcp](https://github.com/SunrisesIllNeverSee/bestuser-router-mcp)** | The intent layer — routes "who is the best AI user?" queries to SigRank SignalAF's leaderboard. MCP server for AI assistants. | `npx bestuser-router-mcp` |
 | **[sigarena](https://github.com/SunrisesIllNeverSee/sigarena)** | The satellite — public LLM operator evals at sigeconomy.com. Read-only leaderboard, SEO/AEO surface. | [sigeconomy.com](https://sigeconomy.com) |
 | **[signaf](https://github.com/SunrisesIllNeverSee/signa)** | The coach — reads your session logs, builds a taste profile, measures ASI, coaches you on token efficiency. | `npx @burnmydays/signaf` |
@@ -77,7 +78,7 @@ MO§ES™ governance → Upsilon measurement engine → SigRank public proof
 | Site | What it is |
 | ---- | ---------- |
 | **[SIGNOMY](https://signomy.xyz)** | Governed AI agent marketplace where ranked agents form teams, fill slots, run missions, and earn revenue under constitutional protocol. Agents are free. Operators pay. |
-| **[MO§ES](https://mos2es.com)** | Constitutional governance and methodology—the law governing Upsilon and other governed systems. |
+| **[MO§ES](https://mos2es.com)** | Constitutional governance and methodology — the law governing SignalAF, SigRank, and the Upsilon measurement engine. |
 
 ## Quickstart — 3 steps to the board
 

package/manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/anthropics/mcpb/main/schemas/mcpb-manifest-v0.4.schema.json",
   "manifest_version": "0.4",
   "name": "sigrank",
-  "version": "1.0.10",
+  "version": "1.0.13",
   "description": "Ranks AI coding operators by token cascade efficiency (Yield = cache_read \u00d7 output / input\u00b2). 25 tools including SigRank Standard record, yield calculation, local token usage pulls, signed submission, and tokscale-powered analytics (market share, developer profiles, model trends, cost analysis, device profiles, MCP usage, competitive intelligence). Privacy-first: runs locally, only four token counts leave the machine.",
   "author": {
     "name": "SunrisesIllNeverSee",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "1.0.11",
+  "version": "1.0.14",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "Upsilon measurement engine distributed through the sigrank CLI/MCP compatibility package, with SigRank public leaderboard tools.",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",

package/presentation/tui.mjs

@@ -2335,6 +2335,45 @@ export async function runTui({
     return;
   }
 
+  // ── Terminal size guard ────────────────────────────────────────────────────
+  // The TUI renders a tab bar + content + footer in a locked alternate-screen
+  // frame. If the terminal is too small, the footer smears off the bottom and
+  // content rows get clamped — confusing, not useful. Refuse to render until
+  // there's enough room, matching the PostHog wizard's pattern: show a clear
+  // message with current vs required dimensions, and re-check on resize.
+  const MIN_COLS = 80;
+  const MIN_ROWS = 24;
+  const tooSmall = () =>
+    (process.stdout.columns || 80) < MIN_COLS ||
+    (process.stdout.rows || 24) < MIN_ROWS;
+  if (tooSmall() && process.stdout.isTTY) {
+    const renderSizeMsg = () => {
+      const cols = process.stdout.columns || 80;
+      const rows = process.stdout.rows || 24;
+      process.stdout.write(`${ESC}H${ESC}2J`);
+      process.stdout.write(
+        `\n  SigRank TUI needs more room to display required content.\n` +
+        `  Please make this terminal bigger.\n\n` +
+        `  Currently ${cols}×${rows}, needs at least ${MIN_COLS}×${MIN_ROWS}.\n\n` +
+        `  Waiting for resize… (Ctrl+C to cancel)\n`,
+      );
+    };
+    renderSizeMsg();
+    await new Promise((resolve) => {
+      const onResize = () => {
+        if (!tooSmall()) {
+          process.stdout.off("resize", onResize);
+          resolve();
+        } else {
+          renderSizeMsg();
+        }
+      };
+      process.stdout.on("resize", onResize);
+    });
+    // Clear the size-warning message before entering the alt screen
+    process.stdout.write(`${ESC}H${ESC}2J`);
+  }
+
   write(ENTER_ALT); // switch to alternate screen — original terminal state preserved on exit
   write(CLEAR_SB); // FIXED-WINDOW (2026-06-27): clear scrollback so nothing is above the TUI
   write(HIDE);

package/proxy.mjs

@@ -360,7 +360,16 @@ export async function startProxy({
       return;
     }
 
-    const upstreamUrl = new URL(req.url, upstreamBase);
+    const upstreamUrl = new URL(parsedUrl.pathname + parsedUrl.search, upstreamBase);
+    // Defense-in-depth: verify the constructed URL origin matches the intended
+    // upstream. This prevents an absolute-form request target (e.g.
+    // "http://attacker.example/v1/messages") from overriding upstreamBase via
+    // new URL(req.url, base) — which would forward credentials to an attacker.
+    if (upstreamUrl.origin !== new URL(upstreamBase).origin) {
+      res.writeHead(400, { "content-type": "text/plain; charset=utf-8" });
+      res.end("Refused to proxy to unexpected origin\n");
+      return;
+    }
     const transport = upstreamUrl.protocol === "http:" ? http : https;
     const tracker = createUsageTracker({
       backend: route.backend,

package/tools/rank-windows.mjs

@@ -10,7 +10,7 @@ import { MAX_INPUT, withParseWarnings } from "./_helpers.mjs";
 export const TOOL_DEF = {
   name: "rank_windows",
   description:
-    "Rank all four time windows (7d/30d/90d/all-time) in one call from a dashboard paste — paste the full table from ccusage, tokscale, or the Claude Max usage dashboard and get the cascade (Υ, SNR, Leverage, Velocity, 10xDEV, class, card) for each window. Each window is parsed and scored independently. Named keys required (input/output/cacheCreate/cacheRead); positional order is NOT safe here (dashboards list cache_read before cache_create — see WINDOWED_PROFILES gotcha). Omit windows you don't have — partial input is allowed (1–4 windows). Does NOT submit to the board; use tokenpull_submit for zero-paste publishing.",
+    "Rank all four time windows (7d/30d/90d/all-time) in one call from a dashboard paste — paste the full table from ccusage, tokscale, or the Claude Max usage dashboard and get the cascade (Υ, SNR, Leverage, Velocity, 10xDEV, class, card) for each window. Each window is parsed and scored independently. Named keys required (input/output/cacheCreate/cacheRead); positional order is NOT safe here (dashboards list cache_read before cache_create — see WINDOWED_PROFILES gotcha). Omit windows you don't have — partial input is allowed (1–4 windows). Does NOT submit to the board; use tokenpull_submit for a local zero-paste preview, or submit_verified to publish via the enrolled-device path.",
   annotations: {
     title: "Rank all time windows",
     ...ANNOTATIONS.readOnlyHint,
@@ -115,6 +115,6 @@ export async function handleRankWindows(args) {
   return {
     windows,
     source_tool: sourceTool,
-    note: "Local preview only — use tokenpull_submit to publish to the board.",
+    note: "Local preview only — use submit_verified to publish to the board.",
   };
 }

package/tools/submit-paste.mjs

@@ -7,17 +7,15 @@ import { narrate } from "../presentation/narrate.mjs";
 import { SUBMIT_OUTPUT, ANNOTATIONS } from "./_schemas.mjs";
 import {
   MAX_INPUT,
-  uploadStamp,
   withParseWarnings,
 } from "./_helpers.mjs";
-import { TERMS_VERSION, PRIVACY_VERSION, isRankedAck } from "../lib/constants.mjs";
 
 export const TOOL_DEF = {
   name: "submit_paste",
   description:
-    "Ranks a paste of token counts AND publishes it to the live SigRank board at signalaf.com in one call. First computes the cascade locally for an instant preview (yield, leverage, velocity, class, card), then submits the raw paste to the board's web-paste endpoint, which re-parses and re-scores it server-side. The server score is authoritative — it may differ from the local preview if the board applies additional validation. Returns both the local preview and the server response (including the operator's new rank if accepted). A codename is required to publish — omit it for a local preview only (no board submission). Token-only, no auth required. Use this when you have token counts from ccusage or a dashboard and want to both see your score and publish it. Do NOT use this if you want to pull your local usage automatically — use tokenpull_submit for the zero-paste flow. Do NOT use this for multi-window dashboard pastes — use rank_windows to rank them first, then submit each window. After calling this, use get_operator with your codename to verify your submission appeared on the board.",
+    "Ranks a paste of token counts locally and shows the cascade result (yield, leverage, velocity, class, card). This is a PREVIEW-ONLY tool — it does not publish to the board. The board's /api/v1/ingest-paste endpoint now requires an authenticated Supabase session, which MCP tools do not carry. To publish to the leaderboard, use submit_verified (which signs and posts to /api/v1/snapshots via the enrolled-device path) or submit directly through the signalaf.com web UI. Use this when you have token counts from ccusage or a dashboard and want to see your score instantly. Do NOT use this if you want to pull your local usage automatically — use tokenpull_submit for the zero-paste flow. Do NOT use this for multi-window dashboard pastes — use rank_windows to rank them first.",
   annotations: {
-    title: "Submit paste to board",
+    title: "Preview paste ranking",
     ...ANNOTATIONS.destructiveHint,
     ...ANNOTATIONS.idempotentHint,
     ...ANNOTATIONS.openWorldHint,
@@ -28,17 +26,17 @@ export const TOOL_DEF = {
       text: {
         type: "string",
         description:
-          'Token counts to rank and submit. Two formats: (1) JSON {"input":N,"output":N,"cacheCreate":N,"cacheRead":N} from ccusage (preferred — the board parses this reliably), or (2) four whitespace-separated numbers: input output cacheCreate cacheRead. The 4-number form ranks locally but the board may reject it. Example: {"input":1000000,"output":500000,"cacheCreate":50000,"cacheRead":800000}',
+          'Token counts to rank. Two formats: (1) JSON {"input":N,"output":N,"cacheCreate":N,"cacheRead":N} from ccusage (preferred), or (2) four whitespace-separated numbers: input output cacheCreate cacheRead. Example: {"input":1000000,"output":500000,"cacheCreate":50000,"cacheRead":800000}',
       },
       codename: {
         type: "string",
         description:
-          'Operator codename to publish under on the leaderboard (e.g. "Ghost Falcon"). Required to submit — omit for local preview only (no board submission, just returns the local cascade result). Must be a non-empty string.',
+          'Operator codename for the ranking card display (e.g. "Ghost Falcon"). Optional — used only for the local preview card, not for board submission.',
       },
     },
     required: ["text"],
     description:
-      "Requires token counts (text). Codename is optional but required for board submission — omit it for preview-only mode.",
+      "Requires token counts (text). Returns a local preview only — does not publish to the board.",
   },
   outputSchema: SUBMIT_OUTPUT,
 };
@@ -53,69 +51,22 @@ export async function handleSubmitPaste(args, ctx) {
       detail: `text exceeds ${MAX_INPUT} chars (${args.text.length}). Paste only the token-count table, not full output.`,
     };
   }
-  // Local preview first — also validates the paste is parseable before any POST.
+  // Local preview — this tool is preview-only. The board's /api/v1/ingest-paste
+  // endpoint now requires an authenticated Supabase session, which MCP tools
+  // do not carry. Use submit_verified for authenticated board submission.
   const pillars = parsePillars(args.text);
   const c = withParseWarnings(pillars, cascade(pillars));
   const codename = String(args?.codename || "").trim();
   const card = narrate(c, codename || "This operator");
 
-  // No codename → cannot publish (the board endpoint requires it). Fail fast at the
-  // tool boundary with a clear message instead of an opaque server 400.
-  if (!codename) {
-    return {
-      ...c,
-      card,
-      submission: {
-        status: "not_submitted",
-        reason: "codename_required",
-        detail:
-          "Pass a codename to publish to the board. Showing local preview only.",
-      },
-    };
-  }
-
-  // Privacy: send ONLY the 4 parsed token numbers (canonical "input output
-  // cacheCreate cacheRead" form), never the raw user text. parsePillars above
-  // already validated the input — we reconstruct from the parsed pillars so
-  // no conversation content or prose can leak to the server. The server's
-  // ingestMeta() re-parses these 4 numbers authoritatively (Strategy 3:
-  // four bare numbers). This makes every submit path — signed and paste —
-  // send only token counts.
-  const canonicalPaste = `${pillars.input} ${pillars.output} ${pillars.cacheCreate} ${pillars.cacheRead}`;
-  const stamp = uploadStamp({
-    codename,
-    pillars: c.pillars,
-    source: "web_paste",
-  });
-  const res = await ctx.doFetch(`${ctx.apiBase}/api/v1/ingest-paste`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      accept: "application/json",
-    },
-    body: JSON.stringify({
-      codename,
-      raw_paste: canonicalPaste,
-      consent_acknowledged: true,
-      terms_version: TERMS_VERSION,
-      privacy_version: PRIVACY_VERSION,
-      ...stamp,
-    }),
-  });
-  let ack;
-  try {
-    ack = await res.json();
-  } catch {
-    ack = {
-      status: "error",
-      detail: `HTTP ${res.status} (non-JSON response)`,
-    };
-  }
-  const ranked = isRankedAck(res, ack);
   return {
     ...c,
     card,
-    ranked,
-    submission: { ...stamp, httpStatus: res.status, ranked, ...ack },
+    submission: {
+      status: "not_submitted",
+      reason: "preview_only",
+      detail:
+        "submit_paste is preview-only. The board requires an authenticated session. Use submit_verified (enrolled device) or the signalaf.com web UI to publish.",
+    },
   };
 }

package/tools/tokenpull-submit.mjs

@@ -7,19 +7,15 @@ import { narrate } from "../presentation/narrate.mjs";
 import { ALL_PLATFORMS } from "../adapters/index.mjs";
 import { SUBMIT_OUTPUT, ANNOTATIONS } from "./_schemas.mjs";
 import {
-  MAX_INPUT,
   pullByPlatform,
-  uploadStamp,
-  WINDOW_TYPE,
 } from "./_helpers.mjs";
-import { TERMS_VERSION, PRIVACY_VERSION, isRankedAck } from "../lib/constants.mjs";
 
 export const TOOL_DEF = {
   name: "tokenpull_submit",
   description:
-    "Pull your LOCAL token usage from session logs AND publish it to the SigRank board in one call — the zero-paste flow. Reads the four canonical pillars (input, output, cacheCreate, cacheRead) per window from your local logs, computes the cascade, and submits each window to the board where it is re-scored server-side and tagged with the source platform. Requires a codename to publish; omit for a local preview only. Token-only — no prompt content is read or transmitted.",
+    "Pull your LOCAL token usage from session logs and compute the cascade per window — the zero-paste preview flow. Reads the four canonical pillars (input, output, cacheCreate, cacheRead) per window from your local logs and computes yield, leverage, velocity, class, and card. This is a PREVIEW-ONLY tool — it does not publish to the board. The board's /api/v1/ingest-paste endpoint now requires an authenticated Supabase session, which MCP tools do not carry. To publish to the leaderboard, use submit_verified (which signs and posts to /api/v1/snapshots via the enrolled-device path) or submit directly through the signalaf.com web UI. Token-only — no prompt content is read or transmitted.",
   annotations: {
-    title: "Pull and submit tokens",
+    title: "Pull and preview tokens",
     ...ANNOTATIONS.destructiveHint,
     ...ANNOTATIONS.idempotentHint,
     ...ANNOTATIONS.openWorldHint,
@@ -30,13 +26,13 @@ export const TOOL_DEF = {
       codename: {
         type: "string",
         description:
-          'Operator codename to publish under on the leaderboard (e.g. "Iron Lotus"). Required to submit — omit for local preview only.',
+          'Operator codename for the ranking card display (e.g. "Iron Lotus"). Optional — used only for the local preview card, not for board submission.',
       },
       window: {
         type: "string",
         enum: ["7d", "30d", "90d", "all"],
         description:
-          'Submit only this time window (default: all 4 windows). Use "7d" for recent activity or "all" for all-time ranking.',
+          'Preview only this time window (default: all 4 windows). Use "7d" for recent activity or "all" for all-time ranking.',
       },
       platform: {
         type: "string",
@@ -49,15 +45,16 @@ export const TOOL_DEF = {
 };
 
 export async function handleTokenpullSubmit(args, ctx) {
-  // Pull local usage, then publish each window's CANONICAL pillars to the board
-  // (server re-scores). The board stays platform-agnostic via the 4 pillars; the
-  // source platform rides along as a tag. Conversion already happened in the adapter.
+  // Pull local usage and compute the cascade per window. This tool is
+  // preview-only — the board's /api/v1/ingest-paste endpoint now requires
+  // an authenticated Supabase session, which MCP tools do not carry. Use
+  // submit_verified for authenticated board submission.
   const codename = String(args?.codename || "").trim();
   const platform = args?.platform || "claude";
 
   // MULTI: same combined cross-platform cascade as submit_verified. Includes Devin
   // (cloud, via tokscale). Aggregate every locally-detected platform's pillars per
-  // window and publish as platform='multi'.
+  // window.
   if (platform === "multi") {
     const detected = [];
     for (const p of ALL_PLATFORMS) {
@@ -102,58 +99,17 @@ export async function handleTokenpullSubmit(args, ctx) {
         continue;
       const c = cascade(sum);
       const card = narrate(c, `${wk} multi`);
-      if (!codename) {
-        out.push({
-          window: wk,
-          pillars: sum,
-          cascade: c,
-          card,
-          submission: { status: "not_submitted", reason: "codename_required" },
-        });
-        continue;
-      }
-      const rawPaste = `${sum.input} ${sum.output} ${sum.cacheCreate} ${sum.cacheRead}`;
-      const windowType = WINDOW_TYPE[wk] || wk;
-      const stamp = uploadStamp({
-        codename,
-        window: windowType,
-        pillars: sum,
-        platform: "multi",
-      });
-      const res = await ctx.doFetch(`${ctx.apiBase}/api/v1/ingest-paste`, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          accept: "application/json",
-        },
-        body: JSON.stringify({
-          codename,
-          raw_paste: rawPaste,
-          window_type: windowType,
-          telemetry: { platform: { primary: "multi" } },
-          consent_acknowledged: true,
-          terms_version: TERMS_VERSION,
-          privacy_version: PRIVACY_VERSION,
-          ...stamp,
-        }),
-      });
-      let ack;
-      try {
-        ack = await res.json();
-      } catch {
-        ack = { status: "parse_error", httpStatus: res.status };
-      }
-      // Fix 4: was `ack?.ranked ?? ack?.accepted ?? false` — a looser predicate
-      // than the single-platform branch below, which would mark a non-persisted
-      // 202 as ranked. Now both branches use the shared isRankedAck() so every
-      // submit path agrees on what "ranked" means.
-      const ranked = isRankedAck(res, ack);
       out.push({
         window: wk,
         pillars: sum,
         cascade: c,
         card,
-        submission: { ...stamp, httpStatus: res.status, ranked, ...ack },
+        submission: {
+          status: "not_submitted",
+          reason: "preview_only",
+          detail:
+            "tokenpull_submit is preview-only. Use submit_verified (enrolled device) or the signalaf.com web UI to publish.",
+        },
       });
     }
     return {
@@ -172,58 +128,17 @@ export async function handleTokenpullSubmit(args, ctx) {
   for (const w of targets) {
     const c = cascade(w.pillars);
     const card = narrate(c, `${w.window} window`);
-    if (!codename) {
-      out.push({
-        window: w.window,
-        pillars: w.pillars,
-        cascade: c,
-        card,
-        submission: { status: "not_submitted", reason: "codename_required" },
-      });
-      continue;
-    }
-    // canonical pillars → "input output cacheCreate cacheRead" (the parser's 4-bare-number form)
-    const rawPaste = `${w.pillars.input} ${w.pillars.output} ${w.pillars.cacheCreate} ${w.pillars.cacheRead}`;
-    const windowType = WINDOW_TYPE[w.window] || w.window;
-    const stamp = uploadStamp({
-      codename,
-      window: windowType,
-      pillars: w.pillars,
-      platform: pulled.platform,
-    });
-    const res = await ctx.doFetch(`${ctx.apiBase}/api/v1/ingest-paste`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        accept: "application/json",
-      },
-      body: JSON.stringify({
-        codename,
-        raw_paste: rawPaste,
-        window_type: windowType,
-        telemetry: { platform: { primary: pulled.platform } },
-        consent_acknowledged: true,
-        terms_version: TERMS_VERSION,
-        privacy_version: PRIVACY_VERSION,
-        ...stamp,
-      }),
-    });
-    let ack;
-    try {
-      ack = await res.json();
-    } catch {
-      ack = { status: "error", detail: `HTTP ${res.status} (non-JSON)` };
-    }
-    // ranked = actually on the board (verified + persisted), not just received — parity
-    // with submit_verified (submit/index.mjs). An unenrolled/revoked device gets 202 but is NEVER ranked.
-    const ranked = isRankedAck(res, ack);
     out.push({
       window: w.window,
       pillars: w.pillars,
       cascade: c,
       card,
-      ranked,
-      submission: { ...stamp, httpStatus: res.status, ranked, ...ack },
+      submission: {
+        status: "not_submitted",
+        reason: "preview_only",
+        detail:
+          "tokenpull_submit is preview-only. Use submit_verified (enrolled device) or the signalaf.com web UI to publish.",
+      },
     });
   }
   return {