tenjin-cli 0.1.0-alpha.0 → 0.1.0-alpha.2

package/dist/publish-D76B3MBK.js

@@ -0,0 +1,1480 @@
+import { createRequire as __tenjinCreateRequire } from 'node:module'; const require = __tenjinCreateRequire(import.meta.url);
+import {
+  buildSiwxHeader,
+  headingOutline
+} from "./chunk-S3IGX57D.js";
+import {
+  dropCandidate,
+  readCandidate
+} from "./chunk-TLCMMYLY.js";
+import {
+  rateLimitError
+} from "./chunk-YIYQ2ZNT.js";
+import {
+  ATOMIC_RE,
+  UUID_RE
+} from "./chunk-3OV7E5G5.js";
+import {
+  sanitizeForTerminal
+} from "./chunk-Z52RA3NC.js";
+import {
+  CLIENT_HEADER,
+  httpRequest,
+  trimSlash
+} from "./chunk-QNP7H47L.js";
+import "./chunk-N62ROTMC.js";
+import "./chunk-RRN3YTK7.js";
+import "./chunk-CYOF7ROH.js";
+import "./chunk-ZABPQJ3M.js";
+import "./chunk-HSDCI7OV.js";
+import {
+  resolveContextSettings,
+  resolvePublishSettings
+} from "./chunk-UPIEAMGH.js";
+import {
+  PublishModeSchema,
+  formatUsdDisplay,
+  parsePublishModeFlag,
+  parseUsdToAtomic,
+  toMoney
+} from "./chunk-IYLHQMT5.js";
+import {
+  describeWallet,
+  resolveWalletProvider
+} from "./chunk-Z6MFJV5Z.js";
+import "./chunk-YN5SHIXQ.js";
+import {
+  hasCode
+} from "./chunk-2I4QTOLB.js";
+import "./chunk-YBMMV4Y4.js";
+import "./chunk-UO22YNY4.js";
+import {
+  writeFileAtomic
+} from "./chunk-MUBUQVC3.js";
+import {
+  CliError,
+  external_exports,
+  sessionPath
+} from "./chunk-OYMYCW7J.js";
+import "./chunk-NCE5NSN6.js";
+import "./chunk-RY4XKNV3.js";
+import "./chunk-QVX5MWJZ.js";
+import "./chunk-YALGASEU.js";
+import "./chunk-HIVZG55D.js";
+import "./chunk-RBJPAZFI.js";
+import "./chunk-5CLSD5YN.js";
+import "./chunk-ZXTAQYNA.js";
+
+// src/commands/publish.ts
+import { readFile as readFile2 } from "fs/promises";
+
+// src/lib/scan.ts
+var LONG_QUOTE_WORDS = 80;
+function scan(text) {
+  const lines = text.split("\n");
+  const findings = [
+    ...scanHex64(lines),
+    ...scanLineDetectors(lines),
+    ...scanPemBlocks(lines),
+    ...scanLongVerbatim(lines)
+  ];
+  return dedupeAndSort(suppressEmailsInDbUris(findings));
+}
+function suppressEmailsInDbUris(findings) {
+  const uris = findings.filter((f) => f.check === "db-connection-uri");
+  if (uris.length === 0) return findings;
+  return findings.filter(
+    (f) => f.check !== "email" || !uris.some((u) => u.line === f.line && f.span[0] >= u.span[0] && f.span[1] <= u.span[1])
+  );
+}
+function maskKeeping(match, prefixLen) {
+  const prefix = match.slice(0, Math.min(prefixLen, match.length));
+  return `${prefix}\u2026[redacted ${match.length - prefix.length} chars]`;
+}
+var LINE_DETECTORS = [
+  // Secrets/keys — severity block, excerpt always masked. Provider patterns
+  // adapted from gitleaks (MIT). The 0x-64-hex EVM key is handled separately
+  // (scanHex64) so a tx/block hash is not hard-blocked. See header + NOTICE.md.
+  {
+    check: "aws-access-key",
+    severity: "block",
+    // gitleaks aws-access-token.
+    re: /\b(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g,
+    excerpt: (m) => maskKeeping(m[0], 4)
+  },
+  {
+    check: "jwt",
+    severity: "block",
+    // gitleaks jwt (three base64url segments, header starts eyJ).
+    re: /\beyJ[A-Za-z0-9_-]{5,}\.eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b/g,
+    excerpt: (m) => maskKeeping(m[0], 3)
+  },
+  {
+    check: "github-token",
+    severity: "block",
+    // gitleaks github-pat / -oauth / -app / -refresh (36 chars) + fine-grained pat.
+    re: /\b(?:gh[posru]_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z_]{82})\b/g,
+    excerpt: (m) => maskKeeping(m[0], 4)
+  },
+  {
+    check: "slack-token",
+    severity: "block",
+    // gitleaks slack tokens (bot/user/app/refresh/legacy prefixes).
+    re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g,
+    excerpt: (m) => maskKeeping(m[0], 5)
+  },
+  {
+    check: "stripe-token",
+    severity: "block",
+    // gitleaks stripe-access-token.
+    re: /\b[sr]k_(?:live|test)_[0-9A-Za-z]{10,99}\b/g,
+    excerpt: (m) => maskKeeping(m[0], 8)
+  },
+  {
+    check: "anthropic-key",
+    severity: "block",
+    // gitleaks anthropic-api-key. Ordered before openai so sk-ant- isn't
+    // mis-typed as a bare OpenAI sk- key.
+    re: /\bsk-ant-[0-9A-Za-z_-]{20,}\b/g,
+    excerpt: (m) => maskKeeping(m[0], 7)
+  },
+  {
+    check: "openai-key",
+    severity: "block",
+    // gitleaks openai-api-key: classic sk- plus the modern sk-proj-/sk-svcacct-/
+    // sk-admin- keys. The body is base62 and MUST contain a digit (real keys are
+    // high-entropy), which keeps sk- kebab identifiers (sk-user-profile-updated…)
+    // from hard-blocking. `(?!ant-)` keeps an Anthropic key out. Only the base62
+    // leading run of a modern key is matched — enough to flag it. The run is
+    // terminated by a non-base62 lookahead (not \b, which a trailing `_` — a word
+    // char — would not fire), so an underscore-adjacent key still matches.
+    // Assumption + chosen tradeoff: a real key opens with a >=20-char base62 run,
+    // so the {20,} floor is what separates a key from a kebab identifier. A key
+    // whose FIRST segment is shorter than 20 (e.g. `sk-proj-abc123_` then more,
+    // broken up by underscores) slips past this BARE-PASTE detector; that is
+    // accepted, because such a value in an assignment still warns via
+    // secret-assignment — the bare-paste path is the only gap.
+    re: /\bsk-(?!ant-)(?:proj-|svcacct-|admin-)?(?=[0-9A-Za-z]*[0-9])[0-9A-Za-z]{20,}(?![0-9A-Za-z])/g,
+    excerpt: (m) => maskKeeping(m[0], 3)
+  },
+  {
+    check: "google-key",
+    severity: "block",
+    // gitleaks gcp-api-key (AIza) and gcp-oauth-client-secret (GOCSPX-).
+    re: /\b(?:AIza[0-9A-Za-z_-]{35}|GOCSPX-[0-9A-Za-z_-]{20,})\b/g,
+    excerpt: (m) => maskKeeping(m[0], m[0].startsWith("AIza") ? 4 : 7)
+  },
+  {
+    check: "npm-token",
+    severity: "block",
+    // gitleaks npm-access-token.
+    re: /\bnpm_[0-9A-Za-z]{36}\b/g,
+    excerpt: (m) => maskKeeping(m[0], 4)
+  },
+  {
+    check: "db-connection-uri",
+    severity: "block",
+    // A connection string with an embedded password (scheme://user:pass@host).
+    // Only the password (group 3) is secret; the excerpt masks it and keeps the
+    // rest so the finding is legible. Placeholder-gated like the other high-
+    // confidence shapes so a docs example (postgres://postgres:postgres@…,
+    // ://user:<password>@…) doesn't hard-block; a real password still blocks.
+    re: /\b([a-z][a-z0-9+.-]*):\/\/([^\s:@/]+):([^\s@/]+)@([^\s/:]+)/gi,
+    excerpt: (m) => `${m[1]}://${m[2]}:[redacted]@${m[4]}`,
+    skip: (m) => isPlaceholder(m[3] ?? "") || isExamplePassword(m[3] ?? "")
+  },
+  {
+    check: "bearer-token",
+    severity: "block",
+    // An Authorization: Bearer header carrying a live token; placeholder-gated
+    // like secret-assignment so `Bearer <token>` examples don't hard-block.
+    re: /\bAuthorization:\s*Bearer\s+(\S{8,})/gi,
+    excerpt: (m) => `Authorization: Bearer [redacted ${m[1]?.length ?? 0} chars]`,
+    skip: (m) => isPlaceholder(m[1] ?? "")
+  },
+  // Generic secret-named assignment — WARN, not block (review): a keyword match is
+  // lower-confidence than a structured shape, and warn still forces confirmation
+  // in default auto mode, so nothing publishes unseen while benign config
+  // (SECRET_NAME=…, MYSQL_ROOT_PASSWORD=…) is not permanently non-bypassable. The
+  // excerpt stays masked. Placeholder and structural (path/URL/regex) values are
+  // skipped entirely.
+  {
+    check: "secret-assignment",
+    severity: "warn",
+    // Key: api[_-]?key, secret, access/private key, passw(or)?d, token,
+    // credential(s), auth token — camelCase-insensitive. Value: a quoted string
+    // (interior spaces allowed) or an unquoted run, ≥6 chars. Value is masked.
+    re: /\b([A-Za-z0-9_]*(?:API[_-]?KEY|SECRET|ACCESS[_-]?KEY|PRIVATE[_-]?KEY|PASSW(?:OR)?D|TOKEN|CREDENTIALS?|AUTH[_-]?TOKEN)[A-Za-z0-9_]*)\s*[:=]\s*("[^"]{6,}"|'[^']{6,}'|[^\s"']{6,})/gi,
+    excerpt: (m) => `${m[1]}=[redacted ${dequote(m[2] ?? "").length} chars]`,
+    skip: (m) => {
+      const raw = m[2] ?? "";
+      const value = dequote(raw);
+      if (isPlaceholder(value) || isStructural(value)) return true;
+      return raw === value && isCodeExpression(value);
+    }
+  },
+  // Wallet addresses — warn (a contract address may be intentional). Not a secret,
+  // shown abbreviated. viem's checksum validation is deliberately NOT used to gate
+  // this: EIP-55 strict validation rejects the valid all-lowercase/all-uppercase
+  // forms, which a scanner must still surface, so shape matching is the right test.
+  {
+    check: "wallet-address",
+    severity: "warn",
+    re: /(?<![0-9a-fx])0x[0-9a-fA-F]{40}(?![0-9a-fA-F])/gi,
+    excerpt: (m) => `${m[0].slice(0, 6)}\u2026${m[0].slice(-4)}`
+  },
+  // Employer-internal markers — warn.
+  {
+    check: "confidential-marker",
+    severity: "warn",
+    re: /\b(?:CONFIDENTIAL|INTERNAL ONLY)\b/gi,
+    excerpt: (m) => m[0]
+  },
+  {
+    check: "internal-hostname",
+    severity: "warn",
+    re: /\b(?:[a-z0-9-]+\.)+(?:internal|corp|local|lan|intranet)\b/gi,
+    excerpt: (m) => m[0]
+  },
+  // Personal data — warn. `email` subsumes corp-domain emails (an internal marker).
+  {
+    check: "email",
+    severity: "warn",
+    re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+    excerpt: (m) => m[0]
+  },
+  {
+    check: "phone",
+    severity: "warn",
+    re: /(?<!\d)(?:\+?\d{1,2}[\s.-]?)?(?:\(\d{3}\)|\d{3})[\s.-]\d{3}[\s.-]\d{4}(?!\d)/g,
+    excerpt: (m) => m[0]
+  }
+];
+function scanLineDetectors(lines) {
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    for (const detector of LINE_DETECTORS) {
+      detector.re.lastIndex = 0;
+      let m;
+      while ((m = detector.re.exec(line)) !== null) {
+        if (!detector.skip?.(m)) {
+          out.push({
+            check: detector.check,
+            severity: detector.severity,
+            line: i + 1,
+            span: [m.index, m.index + m[0].length],
+            excerpt: detector.excerpt(m)
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+function dequote(value) {
+  const m = /^"([^"]*)"$|^'([^']*)'$/.exec(value);
+  return m !== null ? m[1] ?? m[2] ?? "" : value;
+}
+var PLACEHOLDER_WORD = /^(?:xxx+|example|example-value|placeholder|redacted|changeme|dummy|sample|todo|tbd|none|null|secret|test|\*+|\.{3,})$/i;
+var PLACEHOLDER_PREFIX = /^(?:your|my)[-_][a-z]+(?:[-_][a-z]+)*$/i;
+function isPlaceholder(value) {
+  if (/^[<${%]/.test(value)) return true;
+  return PLACEHOLDER_WORD.test(value) || PLACEHOLDER_PREFIX.test(value);
+}
+function isCodeExpression(value) {
+  const v = value.replace(/[,;]+$/, "");
+  if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)+$/.test(v)) return true;
+  if (/^[A-Za-z_$][\w$.]*\([^)]*\)$/.test(v)) return true;
+  if (/\($/.test(v)) return true;
+  return /^[a-z_$][a-z_$]*$/.test(v);
+}
+function isStructural(value) {
+  return /^(?:\.?\.?\/|~\/|https?:\/\/|\^)/.test(value);
+}
+var EXAMPLE_PASSWORDS = /* @__PURE__ */ new Set([
+  "password",
+  "postgres",
+  "mysql",
+  "root",
+  "admin",
+  "changeme",
+  "example",
+  "secret",
+  "test",
+  "guest",
+  "toor"
+]);
+function isExamplePassword(password) {
+  return EXAMPLE_PASSWORDS.has(password.toLowerCase());
+}
+var HEX64_RE = /(?<![0-9a-fx])0x[0-9a-fA-F]{64}(?![0-9a-fA-F])/gi;
+var HASH_LABEL_RE = /(?:^|[^a-z0-9])(?:blockhash|txhash|txn|tx|hash)[\s/:=]*$/i;
+function scanHex64(lines) {
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    HEX64_RE.lastIndex = 0;
+    let m;
+    while ((m = HEX64_RE.exec(line)) !== null) {
+      const hash = isHashContext(line, m.index);
+      out.push({
+        check: hash ? "hex32-value" : "raw-private-key",
+        severity: hash ? "warn" : "block",
+        line: i + 1,
+        span: [m.index, m.index + m[0].length],
+        excerpt: hash ? `${m[0].slice(0, 6)}\u2026${m[0].slice(-4)}` : maskKeeping(m[0], 2)
+      });
+    }
+  }
+  return out;
+}
+function isHashContext(line, matchIndex) {
+  const before = line.slice(0, matchIndex);
+  if (HASH_LABEL_RE.test(before)) return true;
+  const prefix = /(\S*)$/.exec(before)?.[1] ?? "";
+  return /^https?:\/\//.test(line.slice(matchIndex - prefix.length));
+}
+var PEM_BEGIN = /-----BEGIN[ A-Z0-9]*PRIVATE KEY(?: BLOCK)?-----/;
+function scanPemBlocks(lines) {
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const m = PEM_BEGIN.exec(line);
+    if (m !== null) {
+      out.push({
+        check: "pem-private-key",
+        severity: "block",
+        line: i + 1,
+        span: [m.index, m.index + m[0].length],
+        excerpt: m[0]
+        // the header marker only — no key material follows on it
+      });
+    }
+  }
+  return out;
+}
+var FENCE = /^(\s*)(`{3,}|~{3,})/;
+function scanLongVerbatim(lines) {
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    const fence = FENCE.exec(line);
+    if (fence !== null) {
+      const marker = fence[2] ?? "```";
+      const start = i;
+      const body = [];
+      i++;
+      while (i < lines.length && !closesFence(lines[i] ?? "", marker)) {
+        body.push(lines[i] ?? "");
+        i++;
+      }
+      i++;
+      pushIfLong(out, body, start, line);
+      continue;
+    }
+    if (/^\s*>/.test(line)) {
+      const start = i;
+      const body = [];
+      while (i < lines.length && /^\s*>/.test(lines[i] ?? "")) {
+        body.push((lines[i] ?? "").replace(/^\s*>\s?/, ""));
+        i++;
+      }
+      pushIfLong(out, body, start, lines[start] ?? "");
+      continue;
+    }
+    i++;
+  }
+  return out;
+}
+function closesFence(line, marker) {
+  const m = FENCE.exec(line);
+  return m !== null && (m[2] ?? "").startsWith(marker);
+}
+function pushIfLong(out, body, startLine, firstLine) {
+  const text = body.join(" ").trim();
+  const words = text.length === 0 ? 0 : text.split(/\s+/).length;
+  if (words < LONG_QUOTE_WORDS) return;
+  const excerpt = text.length > 60 ? `${text.slice(0, 57)}\u2026` : text;
+  out.push({
+    check: "long-verbatim-quote",
+    severity: "warn",
+    line: startLine + 1,
+    span: [0, firstLine.length],
+    excerpt
+  });
+}
+function dedupeAndSort(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = findings.filter((f) => {
+    const key = `${f.check}:${f.line}:${f.span[0]}:${f.span[1]}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  return unique.sort(
+    (a, b) => a.line - b.line || a.span[0] - b.span[0] || a.check.localeCompare(b.check)
+  );
+}
+
+// src/lib/card.ts
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+function parseFrontmatter(text) {
+  const match = FRONTMATTER_RE.exec(text);
+  if (match === null) return { frontmatter: {}, body: text };
+  const block = match[1] ?? "";
+  const body = text.slice(match[0].length);
+  return { frontmatter: parseBlock(block), body };
+}
+function indentOf(line) {
+  return line.length - line.trimStart().length;
+}
+function parseBlock(block) {
+  const lines = block.split(/\r?\n/).filter((l) => l.trim().length > 0 && !/^\s*#/.test(l));
+  const out = {};
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    if (indentOf(line) !== 0) {
+      throw usage(`Unexpected indentation in frontmatter: ${JSON.stringify(line)}`);
+    }
+    const kv = splitKey(line);
+    if (kv === null) throw usage(`Malformed frontmatter line: ${JSON.stringify(line)}`);
+    const { key, value } = kv;
+    if (value.length > 0) {
+      out[key] = parseInlineValue(value);
+      i++;
+      continue;
+    }
+    const child = [];
+    i++;
+    while (i < lines.length && indentOf(lines[i] ?? "") > 0) {
+      child.push(lines[i] ?? "");
+      i++;
+    }
+    if (child.length === 0) {
+      out[key] = "";
+    } else if (child.every((c) => /^\s*-\s/.test(c))) {
+      out[key] = child.map((c) => unquote(c.replace(/^\s*-\s+/, "").trim()));
+    } else {
+      out[key] = parseNestedMap(child);
+    }
+  }
+  return out;
+}
+function parseNestedMap(lines) {
+  const out = {};
+  const baseIndent = indentOf(lines[0] ?? "");
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    if (indentOf(line) !== baseIndent)
+      throw usage(`Malformed nested frontmatter: ${JSON.stringify(line)}`);
+    const kv = splitKey(line);
+    if (kv === null) throw usage(`Malformed nested frontmatter line: ${JSON.stringify(line)}`);
+    const { key, value } = kv;
+    if (value.length > 0) {
+      const parsed = parseInlineValue(value);
+      out[key] = Array.isArray(parsed) ? parsed : [parsed];
+      i++;
+      continue;
+    }
+    const items = [];
+    i++;
+    while (i < lines.length && indentOf(lines[i] ?? "") > baseIndent) {
+      const c = lines[i] ?? "";
+      if (!/^\s*-\s/.test(c))
+        throw usage(`Expected a list item in frontmatter: ${JSON.stringify(c)}`);
+      items.push(unquote(c.replace(/^\s*-\s+/, "").trim()));
+      i++;
+    }
+    out[key] = items;
+  }
+  return out;
+}
+function splitKey(line) {
+  const m = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*:\s?(.*)$/.exec(line);
+  if (m === null || m[1] === void 0) return null;
+  guardKey(m[1]);
+  return { key: m[1], value: (m[2] ?? "").trim() };
+}
+var UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function guardKey(key) {
+  if (UNSAFE_KEYS.has(key)) {
+    throw new CliError("USAGE", `Unsupported key: ${JSON.stringify(key)}`, {
+      fix: "Rename it; __proto__, constructor, and prototype are not allowed as keys."
+    });
+  }
+}
+function parseInlineValue(value) {
+  if (value.startsWith("[") && value.endsWith("]")) {
+    const inner = value.slice(1, -1).trim();
+    if (inner.length === 0) return [];
+    return inner.split(",").map((v) => unquote(v.trim()));
+  }
+  return unquote(value);
+}
+function unquote(value) {
+  if (value.startsWith('"') && value.endsWith('"') && value.length >= 2 || value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+var ARTIFACT_TYPES = ["document", "skill", "dataset"];
+var TEMPORAL_MODES = ["snapshot", "maintained", "evergreen"];
+var MEDIA_TYPE_RE = /^[a-z0-9]+\/[a-z0-9][a-z0-9.+-]*$/i;
+var CANONICAL_KEY_RE = /^[a-z][a-z0-9_]{0,31}$/;
+var ISO_OFFSET_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/;
+var CardErrors = class {
+  fieldErrors = {};
+  add(field, message) {
+    const key = `resource.${field}`;
+    (this.fieldErrors[key] ??= []).push(message);
+  }
+  get empty() {
+    return Object.keys(this.fieldErrors).length === 0;
+  }
+  throwIfAny() {
+    if (this.empty) return;
+    const first = Object.entries(this.fieldErrors)[0];
+    const summary = first !== void 0 ? `${first[0]}: ${first[1][0]}` : "invalid card";
+    throw new CliError("USAGE", `Invalid answer card (${summary})`, {
+      fix: "Correct the reported resource.<field> values (frontmatter or flags), then re-run.",
+      details: { fieldErrors: this.fieldErrors }
+    });
+  }
+};
+function deriveCard(frontmatter, flags) {
+  const errs = new CardErrors();
+  const card = {};
+  const scalar = (fmKey, flagVal) => {
+    if (flagVal !== void 0) return flagVal;
+    const fm = frontmatter[fmKey];
+    if (fm === void 0) return void 0;
+    if (typeof fm !== "string") {
+      errs.add(fmKey, "expected a single string value");
+      return void 0;
+    }
+    return fm;
+  };
+  const list = (fmKey, flagVal) => {
+    if (flagVal !== void 0 && flagVal.length > 0) return flagVal;
+    const fm = frontmatter[fmKey];
+    if (fm === void 0) return void 0;
+    if (!Array.isArray(fm)) {
+      errs.add(fmKey, "expected a list");
+      return void 0;
+    }
+    return fm;
+  };
+  const artifactType = scalar("artifactType", flags.artifactType);
+  if (artifactType !== void 0) {
+    if (ARTIFACT_TYPES.includes(artifactType)) {
+      card.artifactType = artifactType;
+    } else {
+      errs.add("artifactType", `must be one of ${ARTIFACT_TYPES.join(", ")}`);
+    }
+  }
+  const mediaType = scalar("mediaType", void 0);
+  if (mediaType !== void 0) {
+    if (mediaType.length > 100) errs.add("mediaType", "must be at most 100 characters");
+    else if (!MEDIA_TYPE_RE.test(mediaType))
+      errs.add("mediaType", "must be a MIME type, e.g. text/markdown");
+    else card.mediaType = mediaType;
+  }
+  const temporalMode = scalar("temporalMode", flags.temporalMode);
+  if (temporalMode !== void 0) {
+    if (TEMPORAL_MODES.includes(temporalMode)) {
+      card.temporalMode = temporalMode;
+    } else {
+      errs.add("temporalMode", `must be one of ${TEMPORAL_MODES.join(", ")}`);
+    }
+  }
+  const asOf = validateIso(scalar("asOf", flags.asOf), "asOf", errs);
+  if (asOf !== void 0) card.asOf = asOf;
+  const validUntil = validateIso(scalar("validUntil", flags.validUntil), "validUntil", errs);
+  if (validUntil !== void 0) card.validUntil = validUntil;
+  if (asOf !== void 0 && validUntil !== void 0 && Date.parse(validUntil) < Date.parse(asOf)) {
+    errs.add("validUntil", "must be at or after asOf");
+  }
+  const supersedes = scalar("supersedesPostId", void 0);
+  if (supersedes !== void 0) {
+    if (UUID_RE.test(supersedes)) card.supersedesPostId = supersedes;
+    else errs.add("supersedesPostId", "must be a post uuid");
+  }
+  const questions = list("questionsAnswered", flags.question);
+  if (questions !== void 0) {
+    validateStringList(questions, "questionsAnswered", errs);
+    card.questionsAnswered = questions;
+  }
+  const tasks = list("tasksSupported", flags.task);
+  if (tasks !== void 0) {
+    validateStringList(tasks, "tasksSupported", errs);
+    card.tasksSupported = tasks;
+  }
+  const scope = scalar("scope", flags.scope);
+  if (scope !== void 0) {
+    if (scope.length > 500) errs.add("scope", "must be at most 500 characters");
+    else card.scope = scope;
+  }
+  const exclusions = scalar("exclusions", flags.exclusions);
+  if (exclusions !== void 0) {
+    if (exclusions.length > 500) errs.add("exclusions", "must be at most 500 characters");
+    else card.exclusions = exclusions;
+  }
+  const provenance = scalar("provenanceSummary", flags.provenance);
+  if (provenance !== void 0) {
+    if (provenance.length > 500) errs.add("provenanceSummary", "must be at most 500 characters");
+    else card.provenanceSummary = provenance;
+  }
+  const methodology = scalar("methodologySummary", flags.methodology);
+  if (methodology !== void 0) {
+    if (methodology.length > 500) errs.add("methodologySummary", "must be at most 500 characters");
+    else card.methodologySummary = methodology;
+  }
+  const appliesTo = flags.appliesTo ?? readAppliesTo(frontmatter, errs);
+  if (appliesTo !== void 0) {
+    const validated = validateAppliesTo(appliesTo, errs);
+    if (validated !== void 0) card.appliesTo = validated;
+  }
+  const cadence = scalar("maintenanceCadence", void 0);
+  if (cadence !== void 0) {
+    if (cadence.length > 120) errs.add("maintenanceCadence", "must be at most 120 characters");
+    else card.maintenanceCadence = cadence;
+  }
+  const repro = scalar("reproductionMinutes", void 0);
+  if (repro !== void 0) {
+    const n = Number(repro);
+    if (!Number.isInteger(n) || n < 0 || n > 1e6) {
+      errs.add("reproductionMinutes", "must be an integer from 0 to 1000000");
+    } else {
+      card.reproductionMinutes = n;
+    }
+  }
+  const cost = scalar("estimatedPaidInputCost", void 0);
+  if (cost !== void 0) {
+    if (ATOMIC_RE.test(cost)) card.estimatedPaidInputCost = cost;
+    else errs.add("estimatedPaidInputCost", "must be an atomic USDC digit string");
+  }
+  errs.throwIfAny();
+  return Object.keys(card).length > 0 ? card : void 0;
+}
+function validateIso(value, field, errs) {
+  if (value === void 0) return void 0;
+  if (!ISO_OFFSET_RE.test(value) || !Number.isFinite(Date.parse(value))) {
+    errs.add(field, "must be an ISO-8601 timestamp with an offset, e.g. 2026-07-01T00:00:00Z");
+    return void 0;
+  }
+  return value;
+}
+function validateStringList(list, field, errs) {
+  if (list.length > 10) errs.add(field, "at most 10 items");
+  for (const item of list) {
+    if (item.length === 0) errs.add(field, "items must be non-empty");
+    else if (item.length > 200) errs.add(field, "each item is at most 200 characters");
+  }
+}
+function readAppliesTo(frontmatter, errs) {
+  const fm = frontmatter.appliesTo;
+  if (fm === void 0) return void 0;
+  if (typeof fm === "string" || Array.isArray(fm)) {
+    errs.add("appliesTo", "must be a map of key to a list of values");
+    return void 0;
+  }
+  return fm;
+}
+function validateAppliesTo(appliesTo, errs) {
+  const keys = Object.keys(appliesTo);
+  if (keys.length > 8) errs.add("appliesTo", "at most 8 keys");
+  const out = {};
+  for (const [key, rawValues] of Object.entries(appliesTo)) {
+    if (!CANONICAL_KEY_RE.test(key)) {
+      errs.add("appliesTo", `key ${JSON.stringify(key)} must match ^[a-z][a-z0-9_]{0,31}$`);
+      continue;
+    }
+    const values = rawValues.map((v) => v.trim());
+    if (values.length > 20) errs.add("appliesTo", `key ${key} has more than 20 values`);
+    for (const v of values) {
+      if (v.length < 1 || v.length > 120) {
+        errs.add("appliesTo", `key ${key} values must be 1 to 120 characters`);
+      }
+    }
+    out[key] = values;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function parseAppliesToFlags(pairs) {
+  const out = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) {
+      throw new CliError("USAGE", `Invalid --applies-to ${JSON.stringify(pair)}`, {
+        fix: "Use key=value, e.g. --applies-to products=Vercel."
+      });
+    }
+    const key = pair.slice(0, eq).trim();
+    const value = pair.slice(eq + 1).trim();
+    guardKey(key);
+    (out[key] ??= []).push(value);
+  }
+  return out;
+}
+var MISSING_SENTENCES = {
+  questionsOrTasks: "Add at least one question answered or task supported.",
+  scope: "Describe the scope (what this piece covers).",
+  exclusions: "State the exclusions (what this piece does not cover).",
+  asOf: "Set an as-of date (a snapshot card needs one).",
+  provenanceOrMethodology: "Add a provenance or methodology summary."
+};
+function missingSentences(tokens) {
+  return tokens.map((t) => MISSING_SENTENCES[t] ?? t);
+}
+function localCardEligibility(card) {
+  const tokens = [];
+  const hasQuestionsOrTasks = (card?.questionsAnswered?.some(hasText) ?? false) || (card?.tasksSupported?.some(hasText) ?? false);
+  if (!hasQuestionsOrTasks) tokens.push("questionsOrTasks");
+  if (!hasText(card?.scope)) tokens.push("scope");
+  if (!hasText(card?.exclusions)) tokens.push("exclusions");
+  if (card?.temporalMode === "snapshot" && !hasText(card.asOf)) tokens.push("asOf");
+  if (!hasText(card?.provenanceSummary) && !hasText(card?.methodologySummary)) {
+    tokens.push("provenanceOrMethodology");
+  }
+  return { cacheEligible: tokens.length === 0, missing: missingSentences(tokens) };
+}
+function hasText(value) {
+  return value !== void 0 && value.trim().length > 0;
+}
+function usage(message) {
+  return new CliError("USAGE", message, {
+    fix: "Frontmatter supports key: value, key: [a, b], block lists, and a one-level appliesTo map."
+  });
+}
+
+// src/lib/posts-api.ts
+var PUBLISH_STATUSES = ["draft", "published", "unlisted"];
+var PRICE_RE = /^(0|[1-9]\d{0,12})$/;
+var HANDLE_RE = /^[a-z0-9-]{2,32}$/;
+var RESERVED_HANDLES = /* @__PURE__ */ new Set(["latest"]);
+function buildPostCreateBody(input) {
+  const isDraft = input.status === "draft";
+  const title = input.title?.trim();
+  const bodyMd = input.bodyMd;
+  const hasTitle = title !== void 0 && title.length > 0;
+  const hasBody = bodyMd !== void 0 && bodyMd.trim().length > 0;
+  if (isDraft && !hasTitle && !hasBody) {
+    throw new CliError("USAGE", "A draft needs a title or a body.", {
+      fix: "Add a `title:` or some Markdown; a completely empty draft is rejected."
+    });
+  }
+  if (!isDraft && !hasTitle) {
+    throw new CliError("USAGE", "A published post needs a title.", {
+      fix: "Add a `title:` to the frontmatter or a leading `# Heading`, or pass --draft."
+    });
+  }
+  if (!isDraft && !hasBody) {
+    throw new CliError("USAGE", "A published post needs a body.", {
+      fix: "Add Markdown below the frontmatter, or pass --draft."
+    });
+  }
+  if (title !== void 0 && title.length > 200) {
+    throw new CliError("USAGE", "title must be at most 200 characters.");
+  }
+  if (bodyMd !== void 0 && bodyMd.length > 2e5) {
+    throw new CliError("USAGE", "bodyMd must be at most 200000 characters.");
+  }
+  if (input.excerpt !== void 0 && input.excerpt.length > 500) {
+    throw new CliError("USAGE", "excerpt must be at most 500 characters.");
+  }
+  if (input.tags !== void 0) {
+    if (input.tags.length > 5) throw new CliError("USAGE", "at most 5 tags.");
+    for (const tag of input.tags) {
+      if (tag.length === 0 || tag.length > 50) {
+        throw new CliError("USAGE", "each tag is 1 to 50 characters.");
+      }
+    }
+  }
+  if (input.priceAtomic !== void 0 && !PRICE_RE.test(input.priceAtomic)) {
+    throw new CliError("USAGE", `Invalid price: ${JSON.stringify(input.priceAtomic)}`, {
+      fix: "A price is an atomic USDC integer up to 13 digits, e.g. 100000 for $0.10."
+    });
+  }
+  if (input.handle !== void 0) {
+    if (!HANDLE_RE.test(input.handle)) {
+      throw new CliError("USAGE", `Invalid handle: ${JSON.stringify(input.handle)}`, {
+        fix: "A handle is 2 to 32 chars of a-z, 0-9, or hyphen."
+      });
+    }
+    if (input.handle.startsWith("0x") || RESERVED_HANDLES.has(input.handle)) {
+      throw new CliError("USAGE", `Reserved handle: ${JSON.stringify(input.handle)}`, {
+        fix: "Pick a handle that is not 0x-prefixed and not a reserved word (e.g. latest)."
+      });
+    }
+  }
+  return {
+    ...title !== void 0 && title.length > 0 ? { title } : {},
+    ...bodyMd !== void 0 ? { bodyMd } : {},
+    ...input.excerpt !== void 0 ? { excerpt: input.excerpt } : {},
+    ...input.tags !== void 0 && input.tags.length > 0 ? { tags: input.tags } : {},
+    ...input.priceAtomic !== void 0 ? { price: input.priceAtomic } : {},
+    ...input.handle !== void 0 ? { handle: input.handle } : {},
+    status: input.status,
+    ...input.resource !== void 0 ? { resource: input.resource } : {}
+  };
+}
+var resourceEchoSchema = external_exports.object({
+  cacheEligible: external_exports.boolean(),
+  cacheEligibleMissing: external_exports.array(external_exports.string())
+}).passthrough();
+var ownPostSchema = external_exports.object({
+  id: external_exports.string(),
+  slug: external_exports.string(),
+  title: external_exports.string(),
+  status: external_exports.string(),
+  price: external_exports.string(),
+  url: external_exports.string(),
+  warnings: external_exports.array(external_exports.string()).optional(),
+  resource: resourceEchoSchema.optional()
+}).passthrough();
+var MAX_RECOVERIES = 3;
+async function publishPost(input, auth, opts) {
+  const body = buildPostCreateBody(input);
+  const url = `${trimSlash(opts.baseUrl)}/api/posts`;
+  const bodyStr = JSON.stringify(body);
+  let recoveries = 0;
+  for (; ; ) {
+    const authHeaders = await auth.headersFor({ method: "POST", url, body: bodyStr });
+    const res = await httpRequest(url, {
+      method: "POST",
+      timeoutMs: opts.timeoutMs,
+      headers: { "x-tenjin-client": CLIENT_HEADER, ...authHeaders },
+      jsonBody: body,
+      ...opts.fetchImpl !== void 0 ? { fetchImpl: opts.fetchImpl } : {}
+    });
+    if (!res.ok) throw writeTransportError(url, res);
+    if (res.status === 401 && recoveries < MAX_RECOVERIES) {
+      const code = auth401Code(res);
+      if (await auth.recover(code)) {
+        recoveries++;
+        continue;
+      }
+      throw authError(code, res);
+    }
+    if (res.status === 401) throw authError(auth401Code(res), res);
+    if (res.status === 429) throw rateLimitError(url, (n) => res.header(n));
+    if (res.status !== 201 && res.status !== 200) throw publishFailed(res);
+    const parsed = ownPostSchema.safeParse(res.json);
+    if (!parsed.success) {
+      throw new CliError("CONTRACT_MISMATCH", "The publish response did not match the contract.", {
+        fix: "Update tenjin-cli; the server contract may have changed.",
+        details: parsed.error.issues
+      });
+    }
+    const post = parsed.data;
+    return {
+      resourceId: post.id,
+      slug: post.slug,
+      title: post.title,
+      status: post.status,
+      priceAtomic: post.price,
+      url: post.url,
+      ...post.resource !== void 0 ? { cacheEligible: post.resource.cacheEligible } : {},
+      cacheEligibleMissing: post.resource?.cacheEligibleMissing ?? [],
+      warnings: post.warnings ?? []
+    };
+  }
+}
+function auth401Code(res) {
+  const header = res.header("www-authenticate");
+  const m = header !== void 0 ? /error="([^"]+)"/.exec(header) : null;
+  if (m?.[1] !== void 0) return m[1];
+  return bodyErrorCode(res.json);
+}
+function bodyErrorCode(json) {
+  if (typeof json === "object" && json !== null) {
+    const err = json.error;
+    if (typeof err === "object" && err !== null) {
+      const code = err.code;
+      if (typeof code === "string") return code;
+    }
+  }
+  return void 0;
+}
+function serverMessage(json) {
+  if (typeof json === "object" && json !== null) {
+    const err = json.error;
+    if (typeof err === "object" && err !== null) {
+      const m = err.message;
+      if (typeof m === "string") return m;
+    }
+  }
+  return void 0;
+}
+function authError(code, res) {
+  return new CliError(
+    "PUBLISH_FAILED",
+    serverMessage(res.json) ?? `Publish was not authorized (${code ?? "401"}).`,
+    {
+      fix: code === "session_key_unbound" ? "Delete ~/.tenjin/session.json to re-establish the session key." : "Check the wallet and retry.",
+      details: {
+        code: code ?? "unauthorized",
+        ...res.json !== void 0 ? { server: res.json } : {}
+      }
+    }
+  );
+}
+function publishFailed(res) {
+  return new CliError(
+    "PUBLISH_FAILED",
+    serverMessage(res.json) ?? `Publish failed (${res.status}).`,
+    {
+      fix: "Review the server error, then re-run `tenjin publish`.",
+      details: { status: res.status, ...res.json !== void 0 ? { server: res.json } : {} }
+    }
+  );
+}
+function writeTransportError(url, result) {
+  const code = result.kind === "network" || result.kind === "timeout" ? "NETWORK_ERROR" : "API_UNREACHABLE";
+  return new CliError(code, `${url}: ${result.message}`, {
+    fix: "Check --base-url and your network, then retry."
+  });
+}
+
+// src/lib/session-key.ts
+import { createHash, randomBytes, webcrypto } from "crypto";
+import { readFile, stat } from "fs/promises";
+var SESSION_SCOPE = "read+write";
+var SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+var EXP_SKEW_MS = 6e4;
+var SessionFileSchema = external_exports.object({
+  /** Lowercased wallet address this delegation is bound to. */
+  address: external_exports.string(),
+  /** The constant base64 SIWX `Tenjin-Session-Delegation` header value. */
+  delegation: external_exports.string(),
+  /** Delegation expiry (ISO 8601); a request is never signed at/after this. */
+  exp: external_exports.string(),
+  scope: external_exports.string(),
+  /** base64url raw 65-byte uncompressed P-256 point (0x04||X||Y). */
+  publicKeyRaw: external_exports.string(),
+  /** The P-256 private key as a JWK, re-imported to sign each request. */
+  privateKeyJwk: external_exports.record(external_exports.string(), external_exports.unknown())
+});
+var subtle = webcrypto.subtle;
+function toBase64(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function toBase64Url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function contentDigest(body) {
+  const hash = createHash("sha256").update(body, "utf8").digest();
+  return `sha-256=:${hash.toString("base64")}:`;
+}
+function targetUri(url) {
+  const u = new URL(url);
+  return `${u.protocol}//${u.host}${u.pathname}${u.search}`;
+}
+function signatureParams(input) {
+  const covered = input.contentDigest !== void 0 ? '"@method" "@target-uri" "content-digest"' : '"@method" "@target-uri"';
+  return `(${covered});created=${input.created};nonce="${input.nonce}";keyid="${input.keyid}";alg="ecdsa-p256-sha256"`;
+}
+function signatureBase(input) {
+  const params = signatureParams(input);
+  const lines = [
+    `"@method": ${input.method.toUpperCase()}`,
+    `"@target-uri": ${targetUri(input.url)}`,
+    ...input.contentDigest !== void 0 ? [`"content-digest": ${input.contentDigest}`] : [],
+    `"@signature-params": ${params}`
+  ];
+  return lines.join("\n");
+}
+function generateP256KeyPair() {
+  return subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, [
+    "sign",
+    "verify"
+  ]);
+}
+async function importSigningKey(jwk) {
+  return subtle.importKey(
+    "jwk",
+    jwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+}
+async function signBase(jwk, base) {
+  const key = await importSigningKey(jwk);
+  const sig = await subtle.sign({ name: "ECDSA", hash: "SHA-256" }, key, Buffer.from(base, "utf8"));
+  return toBase64(new Uint8Array(sig));
+}
+function keyidFor(publicKeyRaw) {
+  return `p256:${publicKeyRaw}`;
+}
+function delegationResources(publicKeyRaw, expIso) {
+  return [
+    `urn:tenjin:session:pubkey:p256:${publicKeyRaw}`,
+    `urn:tenjin:session:exp:${expIso}`,
+    `urn:tenjin:session:scope:${SESSION_SCOPE}`
+  ];
+}
+async function establishSession(config, deps = {}) {
+  const now = deps.now ?? Date.now;
+  const pair = await generateP256KeyPair();
+  const rawPub = new Uint8Array(await subtle.exportKey("raw", pair.publicKey));
+  const publicKeyRaw = toBase64Url(rawPub);
+  const jwk = await subtle.exportKey("jwk", pair.privateKey);
+  const expIso = new Date(now() + SESSION_TTL_MS).toISOString();
+  const delegation = await buildSiwxHeader(config.signer, {
+    baseUrl: config.baseUrl,
+    chainId: config.chainId,
+    ttlMs: SESSION_TTL_MS,
+    statement: "Delegate a Tenjin session key.",
+    resources: delegationResources(publicKeyRaw, expIso)
+  });
+  const file = {
+    address: config.signer.address.toLowerCase(),
+    delegation,
+    exp: expIso,
+    scope: SESSION_SCOPE,
+    publicKeyRaw,
+    privateKeyJwk: jwk
+  };
+  await saveSessionFile(config.dataDir, file);
+  return file;
+}
+async function signWithSession(file, req, deps = {}) {
+  const now = deps.now ?? Date.now;
+  const nonce = deps.nonce ?? (() => randomBytes(16).toString("hex"));
+  const digest = contentDigest(req.body);
+  const created = Math.floor(now() / 1e3);
+  const params = {
+    method: req.method,
+    url: req.url,
+    contentDigest: digest,
+    created,
+    nonce: nonce(),
+    keyid: keyidFor(file.publicKeyRaw)
+  };
+  const base = signatureBase(params);
+  const signature = await signBase(file.privateKeyJwk, base);
+  return {
+    "Tenjin-Session-Delegation": file.delegation,
+    "Signature-Input": `tenjin=${signatureParams(params)}`,
+    Signature: `tenjin=:${signature}:`,
+    "Content-Digest": digest
+  };
+}
+async function loadSessionFile(dir) {
+  const path = sessionPath(dir);
+  if (process.platform !== "win32") {
+    try {
+      const mode = (await stat(path)).mode & 63;
+      if (mode !== 0) return null;
+    } catch (err) {
+      if (hasCode(err, "ENOENT")) return null;
+      throw sessionReadError(path, err);
+    }
+  }
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (err) {
+    if (hasCode(err, "ENOENT")) return null;
+    throw sessionReadError(path, err);
+  }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const parsed = SessionFileSchema.safeParse(json);
+  return parsed.success ? parsed.data : null;
+}
+function sessionReadError(path, cause) {
+  return new CliError("INTERNAL", `Could not read the session cache at ${path}`, {
+    fix: `Check file permissions on ${path}, or delete it to re-establish.`,
+    cause
+  });
+}
+async function saveSessionFile(dir, file) {
+  await writeFileAtomic(sessionPath(dir), `${JSON.stringify(file, null, 2)}
+`, {
+    mode: 384,
+    dirMode: 448
+  });
+}
+function isSessionUsable(file, address, now) {
+  if (file.address !== address.toLowerCase()) return false;
+  if (file.scope !== SESSION_SCOPE) return false;
+  const expMs = Date.parse(file.exp);
+  if (!Number.isFinite(expMs)) return false;
+  return now < expMs - EXP_SKEW_MS;
+}
+function recoveryFor(code) {
+  switch (code) {
+    case "proof_expired":
+      return "resign";
+    case "session_expired":
+    case "proof_revoked":
+    case "insufficient_scope":
+      return "reestablish";
+    case "session_key_unbound":
+      return "fatal";
+    default:
+      return "fatal";
+  }
+}
+function createSessionKeyAuth(config, deps = {}) {
+  const now = deps.now ?? Date.now;
+  let cached = null;
+  let forceReestablish = false;
+  const ensure = async () => {
+    if (!forceReestablish && cached !== null && isSessionUsable(cached, config.signer.address, now())) {
+      return cached;
+    }
+    if (!forceReestablish) {
+      const onDisk = await loadSessionFile(config.dataDir);
+      if (onDisk !== null && isSessionUsable(onDisk, config.signer.address, now())) {
+        cached = onDisk;
+        return cached;
+      }
+    }
+    cached = await establishSession(config, deps);
+    forceReestablish = false;
+    return cached;
+  };
+  return {
+    async headersFor(req) {
+      const file = await ensure();
+      return signWithSession(file, req, deps);
+    },
+    async recover(code) {
+      const recovery = recoveryFor(code);
+      if (recovery === "fatal") return false;
+      if (recovery === "reestablish") {
+        cached = null;
+        forceReestablish = true;
+      }
+      return true;
+    }
+  };
+}
+function createSiwxAuth(config) {
+  return {
+    async headersFor() {
+      const header = await buildSiwxHeader(config.signer, {
+        baseUrl: config.baseUrl,
+        chainId: config.chainId
+      });
+      return { "SIGN-IN-WITH-X": header };
+    },
+    async recover(code) {
+      return code === "nonce_already_used" || code === "invalid_proof" || code === "proof_expired";
+    }
+  };
+}
+
+// src/commands/publish.ts
+var WRITE_CHAIN_ID = "eip155:8453";
+async function runPublish(args, ctx, deps = {}) {
+  const env = deps.env ?? process.env;
+  const cwd = deps.cwd ?? process.cwd();
+  if (args.mode !== void 0) parsePublishModeFlag(args.mode, "--mode");
+  const { raw, candidate } = await resolveSource(args, ctx.dataDir);
+  const { frontmatter, body } = parseFrontmatter(raw);
+  const status = resolveStatus(args, frontmatter);
+  const title = resolveTitle(frontmatter, body);
+  const tags = resolveTags(frontmatter);
+  const excerpt = expectString(frontmatter, "excerpt");
+  const handle = expectString(frontmatter, "handle");
+  const cardFlags = cardFlagsFrom(args);
+  if (candidate?.meta.question !== void 0 && cardFlags.question === void 0 && frontmatter.questionsAnswered === void 0) {
+    cardFlags.question = [candidate.meta.question];
+  }
+  const card = deriveCard(frontmatter, cardFlags);
+  const settings = await resolvePublishSettings({
+    dataDir: ctx.dataDir,
+    cwd,
+    ...args.mode !== void 0 ? { flag: args.mode } : {},
+    env
+  });
+  for (const warning of settings.warnings) {
+    ctx.io.stderr.write(`${warning}
+`);
+  }
+  const envMode = env.TENJIN_PUBLISH_MODE;
+  if (envMode !== void 0 && envMode.length > 0 && !PublishModeSchema.safeParse(envMode).success) {
+    ctx.io.stderr.write(
+      `Ignoring invalid TENJIN_PUBLISH_MODE=${JSON.stringify(envMode)}; using ${settings.mode} (${settings.modeSource}).
+`
+    );
+  }
+  if (settings.modeSource === "default") {
+    const usd = formatUsdDisplay(settings.defaultPriceAtomic);
+    ctx.io.stderr.write(
+      `publish.mode: ${settings.mode} (default) - a clean scan publishes at $${usd} without asking. Change: tenjin config set publish.mode review.
+`
+    );
+  }
+  const priceAtomic = resolvePrice(args, frontmatter, settings.defaultPriceAtomic);
+  const findings = dedupeFindings([...scan(raw), ...scan(cardScanText(card))]);
+  const blocking = findings.filter((f) => f.severity === "block");
+  const warns = findings.filter((f) => f.severity === "warn");
+  const eligibility = localCardEligibility(card);
+  const price = toMoney(priceAtomic);
+  if (blocking.length > 0) {
+    throw new CliError("PUBLISH_BLOCKED", blockMessage(blocking), {
+      fix: "Remove the secret from the file (it is never masked away by --yes), then re-run.",
+      details: {
+        mode: settings.mode,
+        findings: blocking.map(publicFinding),
+        price: { atomic: price.atomic, usd: price.usd }
+      }
+    });
+  }
+  const needsConfirm = settings.mode === "review" || settings.mode === "auto" && warns.length > 0;
+  if (needsConfirm && args.yes !== true) {
+    throw new CliError("NEEDS_CONFIRMATION", confirmMessage(warns.length, price.usd), {
+      fix: "Review the findings, then re-run with --yes (or resolve the source and re-run).",
+      details: {
+        mode: settings.mode,
+        price: { atomic: price.atomic, usd: price.usd },
+        findings: warns.map(publicFinding),
+        card: eligibility,
+        target: { status, titlePreview: sanitizeForTerminal(title ?? "(untitled draft)") }
+      }
+    });
+  }
+  const runtime = await resolveContextSettings(ctx);
+  const provider = resolveWalletProvider(
+    ctx,
+    deps.provider !== void 0 ? { provider: deps.provider } : {}
+  );
+  await describeWallet(provider);
+  const signer = await provider.getSigner();
+  const auth = resolveWriteAuth(signer, runtime.baseUrl, ctx.dataDir, deps, env);
+  const input = {
+    ...title !== void 0 ? { title } : {},
+    bodyMd: body,
+    ...excerpt !== void 0 ? { excerpt } : {},
+    ...tags !== void 0 ? { tags } : {},
+    priceAtomic,
+    ...handle !== void 0 ? { handle } : {},
+    status,
+    ...card !== void 0 ? { resource: card } : {}
+  };
+  const result = await publishPost(input, auth, {
+    baseUrl: runtime.baseUrl,
+    timeoutMs: ctx.flags.timeout,
+    ...deps.fetchImpl !== void 0 ? { fetchImpl: deps.fetchImpl } : {}
+  });
+  const candidateInfo = candidate !== void 0 ? await clearPublishedCandidate(ctx, candidate.id) : void 0;
+  return receipt(result, runtime.baseUrl, candidateInfo);
+}
+async function clearPublishedCandidate(ctx, id) {
+  try {
+    if (await dropCandidate(ctx.dataDir, id)) return { id, cleared: true };
+    const warning = `Published, but candidate ${id} was already gone; nothing to clear.`;
+    ctx.io.stderr.write(`${warning}
+`);
+    return { id, cleared: false, warning };
+  } catch (err) {
+    const warning = `Published successfully, but could not clear candidate ${id}: ${errorMessage(err)}. Remove it with \`tenjin candidate drop ${id}\`.`;
+    ctx.io.stderr.write(`${warning}
+`);
+    return { id, cleared: false, warning };
+  }
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function resolveSource(args, dataDir) {
+  if (args.candidate !== void 0) {
+    if (args.file !== void 0) {
+      throw new CliError("USAGE", "Pass EITHER a file or --candidate, not both.", {
+        fix: "Publish a file with `tenjin publish post.md`, or a candidate with `--candidate <id>`."
+      });
+    }
+    if (!UUID_RE.test(args.candidate)) {
+      throw new CliError("USAGE", `Invalid candidate id: ${JSON.stringify(args.candidate)}`, {
+        fix: "Pass a candidate id from `tenjin candidate list`."
+      });
+    }
+    const record = await readCandidate(dataDir, args.candidate);
+    if (record === null) {
+      throw new CliError("USAGE", `Unknown candidate: ${JSON.stringify(args.candidate)}`, {
+        fix: "List parked candidates with `tenjin candidate list`."
+      });
+    }
+    return { raw: await readDraft(record), candidate: record };
+  }
+  if (args.file === void 0) {
+    throw new CliError("USAGE", "Nothing to publish.", {
+      fix: "Pass a Markdown file (`tenjin publish post.md`) or `--candidate <id>`."
+    });
+  }
+  return { raw: await readMarkdown(args.file) };
+}
+async function readDraft(record) {
+  try {
+    return await readFile2(record.draftPath, "utf8");
+  } catch (err) {
+    throw new CliError("INTERNAL", `Candidate ${record.id} is missing its draft.`, {
+      fix: `Drop it with \`tenjin candidate drop ${record.id}\` and re-add the draft.`,
+      cause: err
+    });
+  }
+}
+function receipt(result, baseUrl, candidateInfo) {
+  const price = toMoney(result.priceAtomic);
+  const missing = missingSentences(result.cacheEligibleMissing);
+  const cacheEligible = result.cacheEligible ?? false;
+  const deskUrl = `${trimSlash(baseUrl)}/desk`;
+  const title = sanitizeForTerminal(result.title);
+  const human = [
+    `Published ${title} (${result.status}) for ${price.usd} USD \u2192 ${result.url}`,
+    cacheEligible ? "Answer card is lookup-eligible." : missing.length > 0 ? `Answer card not lookup-eligible yet: ${missing.join(" ")}` : "Published as a browse-only document (no answer card).",
+    ...candidateInfo?.cleared === true ? [`Cleared candidate ${candidateInfo.id}.`] : [],
+    ...result.warnings.map((w) => `warning: ${sanitizeForTerminal(w)}`)
+  ];
+  return {
+    data: {
+      resourceId: result.resourceId,
+      url: result.url,
+      status: result.status,
+      price,
+      cacheEligible,
+      missing,
+      deskUrl,
+      ...candidateInfo !== void 0 ? { candidate: candidateInfo } : {},
+      ...result.warnings.length > 0 ? { warnings: result.warnings } : {}
+    },
+    humanLines: human
+  };
+}
+async function readMarkdown(file) {
+  try {
+    return await readFile2(file, "utf8");
+  } catch (err) {
+    throw new CliError("USAGE", `Could not read ${JSON.stringify(file)}`, {
+      fix: "Pass a path to a readable Markdown file, e.g. `tenjin publish post.md`.",
+      cause: err
+    });
+  }
+}
+function resolveStatus(args, frontmatter) {
+  if (args.draft === true) return "draft";
+  const fm = frontmatter.status;
+  if (fm === void 0) return "published";
+  if (typeof fm !== "string" || !PUBLISH_STATUSES.includes(fm)) {
+    throw new CliError("USAGE", `Invalid status ${JSON.stringify(fm)} in frontmatter.`, {
+      fix: "Use status: draft | published | unlisted, or pass --draft."
+    });
+  }
+  return fm;
+}
+function resolveTitle(frontmatter, body) {
+  const fm = frontmatter.title;
+  if (fm !== void 0) {
+    if (typeof fm !== "string") {
+      throw new CliError("USAGE", "frontmatter title must be a single string.");
+    }
+    return fm.trim();
+  }
+  const headings = headingOutline(body);
+  const h1 = headings.find((h) => h.level === 1) ?? headings[0];
+  return h1?.text;
+}
+function resolveTags(frontmatter) {
+  const fm = frontmatter.tags;
+  if (fm === void 0) return void 0;
+  if (typeof fm === "string") return [fm];
+  if (Array.isArray(fm)) return fm;
+  throw new CliError("USAGE", "frontmatter tags must be a list of strings.");
+}
+function expectString(frontmatter, key) {
+  const fm = frontmatter[key];
+  if (fm === void 0) return void 0;
+  if (typeof fm !== "string") {
+    throw new CliError("USAGE", `frontmatter ${key} must be a single string.`);
+  }
+  return fm;
+}
+function resolvePrice(args, frontmatter, defaultAtomic) {
+  if (args.price !== void 0) return parseUsdToAtomic(args.price);
+  const fm = frontmatter.price;
+  if (fm !== void 0) {
+    if (typeof fm !== "string") {
+      throw new CliError("USAGE", 'frontmatter price must be a decimal-USD string, e.g. "0.10".');
+    }
+    return parseUsdToAtomic(fm);
+  }
+  return defaultAtomic;
+}
+function cardFlagsFrom(args) {
+  return {
+    ...args.question !== void 0 && args.question.length > 0 ? { question: args.question } : {},
+    ...args.task !== void 0 && args.task.length > 0 ? { task: args.task } : {},
+    ...args.scope !== void 0 ? { scope: args.scope } : {},
+    ...args.exclusions !== void 0 ? { exclusions: args.exclusions } : {},
+    ...args.asOf !== void 0 ? { asOf: args.asOf } : {},
+    ...args.validUntil !== void 0 ? { validUntil: args.validUntil } : {},
+    ...args.artifactType !== void 0 ? { artifactType: args.artifactType } : {},
+    ...args.temporalMode !== void 0 ? { temporalMode: args.temporalMode } : {},
+    ...args.provenance !== void 0 ? { provenance: args.provenance } : {},
+    ...args.methodology !== void 0 ? { methodology: args.methodology } : {},
+    ...args.appliesTo !== void 0 && args.appliesTo.length > 0 ? { appliesTo: parseAppliesToFlags(args.appliesTo) } : {}
+  };
+}
+function resolveWriteAuth(signer, baseUrl, dataDir, deps, env) {
+  const config = { signer, baseUrl, chainId: WRITE_CHAIN_ID, dataDir };
+  const useSession = deps.useSession ?? env.TENJIN_NO_SESSION !== "1";
+  return useSession ? createSessionKeyAuth(config) : createSiwxAuth(config);
+}
+function cardScanText(card) {
+  if (card === void 0) return "";
+  const parts = [];
+  const add = (v) => {
+    if (v !== void 0) parts.push(v);
+  };
+  add(card.scope);
+  add(card.exclusions);
+  add(card.provenanceSummary);
+  add(card.methodologySummary);
+  add(card.mediaType);
+  add(card.maintenanceCadence);
+  add(card.asOf);
+  add(card.validUntil);
+  add(card.estimatedPaidInputCost);
+  if (card.questionsAnswered !== void 0) parts.push(...card.questionsAnswered);
+  if (card.tasksSupported !== void 0) parts.push(...card.tasksSupported);
+  if (card.appliesTo !== void 0) {
+    for (const values of Object.values(card.appliesTo)) parts.push(...values);
+  }
+  return parts.join("\n");
+}
+function dedupeFindings(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  return findings.filter((f) => {
+    const key = `${f.check}:${f.excerpt}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function publicFinding(f) {
+  return { check: f.check, severity: f.severity, line: f.line, excerpt: f.excerpt };
+}
+function blockMessage(blocking) {
+  const checks = [...new Set(blocking.map((f) => f.check))].join(", ");
+  return `Publish blocked: the file contains ${blocking.length} secret finding(s) (${checks}).`;
+}
+function confirmMessage(warnCount, priceUsd) {
+  return warnCount > 0 ? `Publish needs confirmation: ${warnCount} finding(s), price $${priceUsd}.` : `Publish needs confirmation: price $${priceUsd}.`;
+}
+export {
+  runPublish
+};
+//# sourceMappingURL=publish-D76B3MBK.js.map