FactoryWager Wiki

AGENTS.md

AI agent entrypoint for the FactoryWager monorepo (~/Projects).

Git remotes: origin → project-R-score (this monorepo). cascade → private nested product cascade-mover-v3 (git remote only — do not default-push there). Runtime identity: lib/github-repository-ref.ts (owner/name/host/remote — not REPO_URL); parts SSOT in CANONICAL_REMOTES.

Remote SSH: Reasonix remote hosts live in ~/.reasonix/config.toml under [remote]. Active: factorywager-staging (internal.staging, ~/.ssh/id_ed25519, workspace ~/Projects). cloudflare-pages (API-based, no SSH — deploy via bash scripts/cloudflare-pages-deploy.sh). Cascade Mover host is placeholder (uncomment when IP known). The reasonix.factory-wager.com tunnel was decommissioned 2026-07-28 (template deleted, staged Access app dropped, surface retired — never provisioned); real tunnel inventory: docs/harness/tenants/tunnel-inventory.md. CLI: reasonix remote test/connect/list. First-time bootstrap: bun run remote:setup. Reasonix binary: /Applications/Reasonix.app/Contents/MacOS/reasonix.

Cloudflare MCP (.mcp.json — workspace MCP SSOT; .cursor/mcp.json is a symlink to it, .vscode/mcp.json is generated from it via bun run mcp:sync, auto-regenerated by pre-commit when .mcp.json is staged): cloudflare (account/API) · cloudflare-docs (search) · cloudflare-bindings (Workers bindings) · cloudflare-builds (Workers Builds CI — not Pages deploy history) · cloudflare-observability (logs/metrics). Token SSOT: Proton Pass pass://factorywager/Cloudflare API Token/password → bun run proton:inject:factorywager:reasonix (derived CLOUDFLARE_API_TOKEN in project .env / ~/.reasonix/.env — never paste). Pages project pins: bun run cloudflare:env. Token scope probe (bun run cloudflare:env:validate) proves harness operational confidence — not MCP runtime authorization (dashboard token policy only). Vault map: docs/harness/tenants/proton-integration.md. Not a TOC/partner desk: Soft Balance, rails, MessageLog, phones, and package Telegram stay in toc-ops-repo (ct); Pages exposes the baked board at /portal/toc/ · docs/harness/tenants/toc-ops.md.

Canonical docs

Role Doc
This file (agent entry) AGENTS.md
Human hub / wiki homepage README.md · wiki.factory-wager.com
Wiki full index wiki-index.md — portal boards · registry · tenants · proof loop
Registry index registry-index.md — registry bake + portal consumer map
Full agent guide docs/AGENTS.md (aligned to this entry + UNIFIED / WIRE_BOUNDARY)
Harness JIT index docs/harness/README.md (when NFR unresolved → one owner)
Authority / lanes docs/harness/AUTHORITY.md
Repository review (JIT) docs/harness/REVIEW.md
Proof / install journey docs/harness/PROOF.md · bun run proof:install
Docs index docs/README.md
Human hub README.md
Workspace map STRUCTURE.md
Coding standards .custom-instructions.md · docs/DEVELOPMENT-STANDARDS.md
Bun install policy docs/UNIFIED.md · catalogs/workspaces: docs/harness/tenants/monorepo-workspaces.md · bun run validate:workspaces
Import boundaries docs/IMPORT_BOUNDARIES.md
Wire boundary (parse once) docs/WIRE_BOUNDARY.md
Portal foundation (static UI) docs/portal-foundation.md · bun run verify:portal:static · bun run public:audit:verify · docs/harness/tenants/public-plane.md · serve:public:hot · bind policy serve-public-bind.md · bun run brand:status:bind / brand:status:lifecycle · bun run check:serve-shape
TOC Ops portal board (fixture) docs/harness/tenants/toc-ops.md · /portal/toc/ · bun run ops:seed:toc · bun run test:toc-ops
Ops loop throughput docs/harness/tenants/ops-loop-throughput.md · bun run ops:loop:baseline / ops:loop:post / ops:outbox:requeue · claim ops-loop-throughput
Factory Telegram docs/harness/tenants/telegram-factory.md · bun run telegram:verify · telegram:ops:consume · handshake: partner-package-group-handshake.md · telegram:handshake:catalog · lib/telegram/
Seat capital desk docs/harness/tenants/seat-capital-desk.md · bun run seat:desk:refresh · seat:desk:topic-prompts · telegram:package-group:accounting
Compliance portal (MA/NJ) docs/harness/tenants/compliance-portal.md · /portal/compliance/ · bun run compliance:bake / compliance:verify
Partner limit raises docs/harness/tenants/partner-limits.md · /portal/limits/ · ops:limits:demo · ops:limits:predict · bake ops:snapshot → limit-raises.json
Tennis HQ registry auth (cloud agent) docs/harness/tenants/tennis-hq-registry.md · /registry/tennis/agent-auth.json · /portal/tennis/ · FACTORY_WAGER_TOKEN
Identity / auth (Phase 0–2b) lib/identity/README.md · lockout · anomaly · geo · password strength · JIT
Ops snapshot / registry bake docs/harness/tenants/ops-snapshot.md · bun run ops:snapshot
Proton / vault deploy docs/harness/tenants/proton-integration.md · bun run proton:inject:factorywager:reasonix
Platform routing (local vs Pages) docs/platform-routing.md · bun run check:routes · bun run verify:pages-edge
Bun native capabilities docs/BUN_NATIVE_CAPABILITIES.md (WebView, markdown.ansi, Terminal/PTY, Bun.Image, cron, UDP)
Bun token/catalog operate docs/BUN_DOCS_OPERATE.md · lib/docs/docs-artifact-paths.ts (docs:refresh:fast daily · docs:feeds:refresh · full docs:refresh)
TokenRef (interior) / BunToken (export) lib/docs/token-ref.ts · lib/docs/bun-token.ts
Projects triage projects/README.md
Path SSOT (code) lib/docs/repo-docs.ts
Cloudflare / R2 / Pages config/r2-env.ts · bun run cloudflare:env / :assert / :assert-apex / :assert-live / :validate · cloudflare:preflight · cloudflare:deploy:verify · docs/harness/tenants/cloudflare-pages.md
Harness thesis lopopolo/harness-engineering

Communication precision

Do not append an unrequested caveat, counterargument, or moralizing endcap to a sharp claim merely to demonstrate balance. If a boundary condition changes the truth of the claim, put it in the mechanism or scope the claim correctly. If it does not, cut it. Accuracy belongs in the argument; model self-protection does not.

Terminology (harness): prefer artifact over codebase for what is maintained, delivered, or proven; use repository / source tree for the git tree. Domain-valued strings use brands, not bare string, after the boundary — see .custom-instructions.md and lopopolo/harness-engineering.

Branded IDs are mandatory (agents)

Do not declare domain IDs as bare string. This is enforced by pre-commit (--staged --strict has no baseline — new code always fails). Bare id: string / _id: string is also flagged; suppress only with an explicit // brand-ok decision — the detector no longer auto-suppresses opaque primary keys.

Wrong Right
sessionId: string sessionId: SessionId + asSessionId / trySessionId / parseSessionId
userId?: string userId?: UserId
function f(accountId: string) function f(accountId: AccountId)
id: string (opaque DTO PK) id: string; // brand-ok — opaque entity primary key
'' as AccountId never — use try* or throw 
bun tools/brand-catalog.ts SessionId   # which constructor + mint authority
bun run check:brands                   # repo-wide (baseline may grandfather legacy only)
bun tools/branded-id-check.ts --staged --strict   # what pre-commit runs on your diff

Import brands from lib/types/branded.ts. Map: lib/types/branded/README.md. Manifest: lib/types/brand-manifest.json. Skill: .agents/skills/branded-ids/. Intentional opaque passthrough only: // brand-ok on that line.

Wire boundary (parse once)

Full map: docs/WIRE_BOUNDARY.md — what is edge vs interior, path/name allowlists, suppressions.

Interior (default) Boundary only
Domain types / brands unknown fun args
No re-decode decodeUnknownSync / decodeUnknown*
Trusted SessionId, structs parse* / is* / type guards

Operating rules

Bun install policy (machine + workspace): docs/UNIFIED.md

Machine Bun policy (summary)

Machine SSOT is ~/.bunfig.toml (linker = "isolated", globalStore = true, frozenLockfile = true, minimumReleaseAge = 259200, minimumReleaseAgeExcludes = ["bun-types", "@types/bun", "@types/node", "typescript"] — type-only packages outrun the 3d gate; list replaces Bun’s default, keep it a superset — absolute [install.cache].dir); env in ~/.config/shell/bun.sh (BUN_INSTALL, NO_PROXY — no BUN_INSTALL_GLOBAL_STORE); PATH in ~/.config/shell/path.sh. Full component table: docs/UNIFIED.md.

Portal doctor + bunfig control plane

Unified offline health gate for the portal control plane (linker · bakes · catalog · bunfig · optional --full gates).

Command Role
bun run portal:doctor Full pure doctor (writes doctor-state.json unless --no-write)
bun run portal:doctor --group bunfig Machine/project/merge/excludes only
bun run portal:doctor --group catalog,bunfig Multi-group (repeatable or comma list)
bun run portal:doctor --verbose Fix · auto · impact · scope table
bun run bake:doctor Refresh public/registry/doctor-state.json for boards
Loopback API POST /api/doctor/run via serve-public (rewrites bake; not on Pages)

Board: /portal/doctor/ · capability rows below (Unified Doctor · Bunfig · Doctor groups) · policy SSOT docs/UNIFIED.md.

Bun API references (required for agents)

Before using an unfamiliar Bun API, resolve its canonical doc instead of guessing the signature:

bun tools/bun-doc-refs.ts suggest "Bun.secrets"   # → catalog DOC + SHIP/FIX/BLOG/NOTE when known
bun tools/bun-doc-refs.ts url "Bun.stringWidth"   # → canonical URL
bun tools/bun-docs-catalog.ts get Bun.WebView     # full catalog entry
bun run docs:catalog:export                       # compact TSV for agents

Commands: url list suggest (catalog → canonical map → index) · catalog · check/annotate (find/insert @see refs) · audit (map anchors vs index) · deepcheck (repo links vs index) · validate (HTTP links) · integrity (4-layer proof; --fix self-heals taxonomy aliases, --fix-dry previews) · status (includes tier-A coverage) · schedule (Bun.cron daemon; --once for single runs) · export (hierarchical llms-full.txt)

Operate loop (feeds → scrape → catalog with embedded releaseHits → integrity): docs/BUN_DOCS_OPERATE.md · daily bun run docs:refresh:fast · feeds bun run docs:feeds:refresh · full bun run docs:refresh · strict gate bun run verify:docs-coverage:save. Committed tool JSON: bun-docs-index.json + bun-docs-catalog.json (fast) · bun-docs-feeds.json (feeds).

Rules:

Branded ID types (harness)

Mandatory for agents. Domain *Id values are never bare string after the boundary (see section above).

Stable import: lib/types/branded.ts · Domains: lib/types/branded/{session,identity,documents,security,deployment,audit,operations}.ts · Manifest: lib/types/brand-manifest.json · Agent map: lib/types/branded/README.md

Each domain module repeats the same pattern: type + as* + try* + parse* + *_BRAND_SPECS. Agents learn the invariant from structure.

Tier Use
asXId Required string → brand or throw
tryXId Optional → brand or undefined (never empty forge)
parseXId Wire unknown → brand or throw

Mint authority is documented per brand in the manifest (system-internal · user-input · wire-input). Optional audit: BRAND_PROVENANCE=1.

bun tools/brand-catalog.ts                       # JIT brand discovery (domain|BrandName)
bun run check:brands                             # actionable unbranded IDs (manifest-driven + baseline)
bun run check:brands:types                       # tsc proof: SessionId ≠ UserId
bun run check:brands:all                         # manifest + smart + types
bun tools/brand-manifest.ts                      # regenerate institutional record
bun tools/brand-manifest.ts --check              # fail if manifest stale (pre-commit)
bun tools/branded-id-check.ts --write-baseline   # only when expanding detector (owners)

Skill: .agents/skills/branded-ids/ · Type proof: tests/branded-types.test-d.ts

Console depth (output verbosity)

Object-inspection depth has two layers sharing one SSOT (bunfig.toml [console] depth = 6). Native layer (plain console.log): --console-depth=N flag > bunfig [console] depth (6) > Bun default 2. Wrapper layer (lib/console-depth.ts over Bun.inspect / .table / .custom): explicit depth option > --console-depth=N flag > BUN_CONSOLE_DEPTH env (repo-local override; the runtime ignores it) > bunfig [console] depth > 2. Prefer wrapper helpers (inspect / logDepth / logTable / inspectTable / jsonOut / stripANSI / inspectCustom) over raw console.log(obj) / console.table — jsonOut(value) is the choke point for --json machine branches (byte-identical to console.log(JSON.stringify(v, null, 2))), inspectTable is the string-returning table for report/HTML contexts; forward to children with depthArgs() / withConsoleDepth(). Wrappers: lib/console-depth.ts (inspect / width / ANSI / markdown) · lib/deep-equals.ts (Bun.deepEquals) · lib/security/index.ts SecurityUtils (claim security-hash-boundaries) · bun run harness:status. Note: Bun’s runtime does not read BUN_CONSOLE_DEPTH itself and util.inspect.defaultOptions.depth is a no-op in Bun — only bun --console-depth=N, bunfig [console] depth, and Bun.inspect({depth}) work.

Kind References
Repo claim console-depth-boundaries · wrapper lib/console-depth.ts · tests/console-depth.test.ts · tools/benchmarks/console-depth-perf.ts · deep-equals wrapper lib/deep-equals.ts · hash wrapper security-hash-boundaries
Bun runtime/console · runtime/utils (inspect · .table · .custom · stringWidth) · hashing
Other external Bun repository · bun-types current source · bun-types 1.3.14 pin

Grounded capability map

Each row maps to a documented API — Bun or Proton Pass CLI — with type, version, “Used in”, status, and canonical source.

Consumers of this map (decision tables): packages/workspace docs index — docs/packages/README.md · machine SSOT docs/packages/docs-index.json. Regenerate tables: bun run packages:docs-index · CI: bun run packages:docs-index:check · re-audit dates: bun run packages:docs-index --bump-verified.

Capability Type Version Bun API Proton CLI Used in Status Source Example (snippet)
Vault config (TOML) config Bun ≥1.4 import x from './vault-map.toml' with { type: 'toml' } — autofill map loading Available Bun TOML loader const map = await import('./vault-map.toml', { with: { type: 'toml' } });
Vault inject secrets pass‑cli ≥2.2 — pass-cli inject -i/--in-file -o/--out-file -f portal-cli secret inject · vault:resolve --inject Implemented pass-cli inject bun run portal-cli secret inject -i env.template -o .env -f
SSH agent load ssh pass‑cli ≥2.2 — pass-cli ssh-agent load --vault-name vault:resolve --ssh Implemented Proton Pass CLI bun run vault:resolve:ssh
Secure share secrets pass‑cli ≥2.2 — pass-cli share list · item share · invite accept <id> portal-cli secret share / invite accept Implemented pass-cli share bun run portal-cli secret invite accept <INVITE_ID>
Secret retrieval secrets pass‑cli ≥2.2 — pass-cli item view (not item get) portal-cli secret get · autofill Implemented pass-cli item bun run portal-cli secret get 'pass://factorywager/…/password'
Vault & item listing secrets pass‑cli ≥2.2 — pass-cli vault list · item list --output json portal-cli secret vaults · vault-health bake Implemented same bun run portal-cli secret items factorywager
Spawn external process runtime Bun ≥1.0 Bun.spawn(cmd, { stdout: "inherit", stderr: "inherit", stdin: "inherit" }) — all subcommands Implemented Bun.spawn Bun.spawn(["git", "rev-parse", "HEAD"], { stdout: "inherit", stderr: "inherit" })
Streaming file write io Bun ≥1.0 Bun.write(path, response) — snapshot asset capture Implemented Bun.write await Bun.write(snapshotDir + "/report.html", fetch(url))
Glob scanning io Bun ≥1.0 Bun.glob(pattern) → async iterator — manifest grep Implemented Bun.glob for await (const f of Bun.glob("snapshots/*/manifest.txt")) { ... }
File existence & read io Bun ≥1.0 Bun.file(path).exists(), .text() — snapshot index & manifest Implemented Bun.file if (await Bun.file("snapshots/index.jsonl").exists()) { ... }
ANSI color output display Bun ≥1.0 Bun.color(hex, "ansi-16m") — vault-map status lines · autofill Implemented Bun.color Bun.color("#2DA44E", "ansi-16m")
Vault health gate test Bun ≥1.0 expect().toMatchSnapshot() pass-cli list (bake only) portal-cli vault health · Harness Gates Implemented snapshots · /portal/vault/ bun run portal-cli vault health
Portal dashboard launcher cli Bun ≥1.0 Bun.spawn (optional --open) — portal-cli dashboard --view=… Implemented boards SSOT chrome-catalog bun run portal-cli dashboard --view=packages --open
Nav badges (baked) ui — fetch registry JSON — topbar overflow counts Implemented public/portal/nav-badges.js failures / vault active / packages / monorepo score
Watch mode (hard restart) dev Bun ≥1.0 bun --watch — portal-cli development · long-running commands Available watch mode bun --watch tools/portal-cli.ts snapshot run
Hot reload (state-preserving) dev Bun ≥1.0 bun --hot — portal and dashboard development Available hot mode bun --hot tools/portal-cli.ts dashboard
No clear screen on reload dev Bun ≥1.0 bun --no-clear-screen — development with persistent logs Available watch mode bun --watch --no-clear-screen tools/portal-cli.ts snapshot run
Debugger debug Bun ≥1.0 bun --inspect · --inspect-wait · --inspect-brk — debugging portal CLI and tests Available debugger bun --inspect-brk tools/portal-cli.ts probe lockfile
Working directory env Bun ≥1.0 bun --cwd — run snapshots and commands from a selected project Available runtime context bun --cwd /path tools/portal-cli.ts snapshot list
Custom Bun config config Bun ≥1.0 bun --config — portal-specific bunfig.toml selection Available runtime context bun --config ./bunfig.toml tools/portal-cli.ts --help
Define constants env Bun ≥1.0 bun --define — compile-time feature and environment constants Available define constants bun --define 'process.env.NODE_ENV:"production"' tools/portal-cli.ts --help
Custom export conditions env Bun ≥1.0 bun --conditions — monorepo package resolution Available dependency resolution bun --conditions custom tools/portal-cli.ts pm ls
Silent command echo output Bun ≥1.0 bun --silent — CI and package-script pipes Available general execution options bun --silent run portal-cli --help
Low memory mode perf Bun ≥1.0 bun --smol — constrained CI runners Available runtime process control bun --smol tools/portal-cli.ts vault health
Prefer cached packages network Bun ≥1.0 bun --prefer-offline — cache-first and intermittently connected runs Available auto-install bun --prefer-offline tools/portal-cli.ts pm ls
Auto-install fallback deps Bun ≥1.0 bun --install=fallback — scripts that may reference missing local packages Available auto-install bun --install=fallback tools/portal-cli.ts --help
Console depth flag runtime Bun ≥1.0 bun --console-depth=N — portal-cli child spawns · lib/console-depth.ts Implemented runtime · –console-depth bun tools/portal-cli.ts --console-depth=4 probe lockfile
Terminal detection display Bun ≥1.0 new Bun.Terminal(Bun.stdout) — help text formatting (future) Available Bun.Terminal const term = new Bun.Terminal(Bun.stdout); term.write("Hello");
Image chart generation image Bun ≥1.0 new Bun.Image(file).png() — report chart rendering (future) Available Bun.Image const img = new Bun.Image(await Bun.file("chart.png").arrayBuffer()); img.resize(800,600);
Built‑in test runner test Bun ≥1.0 bun:test – describe, test, expect — unit tests Implemented Bun test import { describe, test, expect } from "bun:test";
Snapshot testing test Bun ≥1.0 expect().toMatchSnapshot() — portal vault health · portal capabilities health · check:snapshots SSOT Implemented bun test snapshots expect(report).toMatchSnapshot()
Update snapshots test Bun ≥1.0 bun test <file> --update-snapshots — portal vault health --update · portal capabilities health --update · bun run test:snapshots:update Implemented same bun test tests/capability-map-subset.test.ts --update-snapshots
Runtime version runtime Bun ≥1.0 Bun.version · Bun.revision — capabilities doctor · bake provenance Implemented Bun.version · revision Bun.version · Bun.revision.slice(0, 8)
Environment variables runtime Bun ≥1.0 Bun.env (alias of process.env) — all modules Implemented Bun.env const scope = Bun.env.PORTAL_SCOPE \|\| "prediction"
Module main detection runtime Bun ≥1.0 Bun.main — CLI entry guard Implemented Bun.main if (import.meta.path === Bun.main) { … }
Sleep runtime Bun ≥1.0 Bun.sleep(ms) · Bun.sleepSync(ms) — rate limiting · short polls Available Bun.sleep · sleepSync await Bun.sleep(1000)
Which (PATH probe) runtime Bun ≥1.0 Bun.which(bin, opts?) — pass-cli discovery · portal-cli secret which Implemented Bun.which Bun.which("pass-cli")
UUID v7 runtime Bun ≥1.0 Bun.randomUUIDv7() — snapshot ids · request ids (future) Available Bun.randomUUIDv7 Bun.randomUUIDv7()
Promise peek runtime Bun ≥1.0 Bun.peek(promise) · peek.status — avoid microticks (advanced) Available Bun.peek Bun.peek(Promise.resolve(1))
Open in editor dev Bun ≥1.0 Bun.openInEditor(path, opts?) — jump-to-source from CLI (future) Available Bun.openInEditor Bun.openInEditor(import.meta.path, { line: 10 })
Deep equals test Bun ≥1.0 Bun.deepEquals(a, b, strict?) — bake:capabilities:check · capabilityMapsDeepEqual · expect().toEqual Implemented Bun.deepEquals Bun.deepEquals(stable(a), stable(b), true)
Escape HTML security Bun ≥1.0 Bun.escapeHTML(value) — portal report strings (future) Available Bun.escapeHTML Bun.escapeHTML("<script>")
Structured debug output dev Bun ≥1.0 Bun.inspect(obj, { colors, depth }) · Bun.inspect.custom — snapshot run --debug · custom class print Implemented Bun.inspect · custom Bun.inspect(manifest, { colors: true, depth: 4 })
Inspect table display Bun ≥1.0 Bun.inspect.table(rows, cols?, { colors }) — portal-cli pm graph · doctor · bake:all summary Implemented Bun.inspect.table Bun.inspect.table(rows, ["step", "ms"], { colors: true })
Semantic versioning dev Bun ≥1.0 Bun.semver.satisfies · Bun.semver.order — portal-cli capabilities doctor · minBun/minPassCli floors Implemented Bun.semver Bun.semver.satisfies(Bun.version, ">=1.4.0")
String width (Unicode) display Bun ≥1.0 Bun.stringWidth(s, opts?) — lib/portal/cli-chrome pad/truncate/columns · snapshot-core Implemented Bun.stringWidth padDisplay(s, w) via Bun.stringWidth(s)
Strip ANSI display Bun ≥1.0 Bun.stripANSI(text) — doctor / CLI plain width · logs Implemented Bun.stripANSI Bun.stripANSI("\u001b[31mred\u001b[0m")
Wrap ANSI text display Bun ≥1.0 Bun.wrapAnsi(text, columns, opts?) — doctor frames · long CLI help Implemented Bun.wrapAnsi Bun.wrapAnsi(line, 80, { hard: false, wordWrap: true })
file:// ↔ path io Bun ≥1.0 Bun.fileURLToPath · Bun.pathToFileURL — import.meta.url → abs path · path → URL Implemented fileURLToPath · pathToFileURL Bun.fileURLToPath(import.meta.url)
GZIP compress compress Bun ≥1.0 Bun.gzipSync · Bun.gunzipSync — artifact packs · oneliners proof Available gzipSync · gunzipSync Bun.gunzipSync(Bun.gzipSync(buf))
DEFLATE compress compress Bun ≥1.0 Bun.deflateSync · Bun.inflateSync — wire payloads (future) Available deflateSync · inflateSync Bun.inflateSync(Bun.deflateSync(buf))
Zstandard compress compress Bun ≥1.0 Bun.zstdCompress(Sync) · Bun.zstdDecompress(Sync) — large registry bakes (future) Available zstdCompress · zstdDecompress Bun.zstdCompressSync(buf, { level: 6 })
High-precision timer perf Bun ≥1.0 Bun.nanoseconds() — bake:all · doctor elapsed Implemented Bun.nanoseconds const t0 = Bun.nanoseconds()
ReadableStream consumers io Bun ≥1.0 Bun.readableStreamToText · ToBytes · ToJSON · ToArray · ToBlob · ToFormData · ToArrayBuffer — fetch body → text/json Available readableStreamTo* await Bun.readableStreamToText(res.body!)
Module resolveSync deps Bun ≥1.0 Bun.resolveSync(spec, root) — package path probes Available Bun.resolveSync Bun.resolveSync("./package.json", import.meta.dir)
JSC serialize runtime Bun ≥1.0 serialize / deserialize from bun:jsc — structured clone buffers (future) Available utils · bun:jsc deserialize(serialize({ a: 1 }))
Shallow memory estimate perf Bun ≥1.0 estimateShallowMemoryUsageOf from bun:jsc — heap triage (future) Available estimateShallowMemoryUsageOf estimateShallowMemoryUsageOf(obj)
Pack workspace pkg Bun ≥1.0 bun pm pack — portal-cli pm pack Implemented bun pm pack bun run portal-cli pm pack --dry-run
List dependencies pkg Bun ≥1.0 bun pm ls — portal-cli pm ls Implemented bun pm ls bun run portal-cli pm ls
Bump version pkg Bun ≥1.0 bun pm version — portal-cli pm version Implemented bun pm version bun run portal-cli pm version --no-git-tag-version
Manage package.json pkg Bun ≥1.0 bun pm pkg get/set/delete/fix — portal-cli pm pkg … Implemented bun pm pkg bun run portal-cli pm pkg get name
Trust lifecycle scripts security Bun ≥1.0 bun pm trust / untrusted — portal-cli pm trust Implemented bun pm trust bun run portal-cli pm untrusted
Security scanner security Bun ≥1.4 bun pm scan · [install.security] scanner SOCKET_API_KEY (optional; free mode preferred) portal-cli scanner (policy · estimate · scan –oneshot · doctor) Implemented Security Scanner API bun run portal-cli scanner policy · scanner scan --oneshot --force
Cache inspection infra Bun ≥1.0 bun pm cache — portal-cli pm cache Implemented bun pm cache bun run portal-cli pm cache
Curated runtime flags catalog cli Bun ≥1.0 config/runtime-flags.json SSOT (14 curated · harvest set) · context-scoped shortcodes · -i ≡ --install=fallback (not --no-install) — portal-cli flags · portal:flags:check · doctor catalog-* Implemented runtime options · auto-install bun run portal:flags · portal:flags:check · portal-cli doctor --group catalog
Linker policy verification config Bun ≥1.4 bun.lock configVersion field — install:verify · portal-cli doctor (linker-config-version · machine-isolated-linker) Implemented Default strategy · isolated installs bun run portal-cli doctor · portal-cli doctor --verbose · unit: probeLockfileConfigVersion
Cloudflare Access (live) security Bun ≥1.0 Live HTTPS probe (Access 302 / www-authenticate) — portal-cli doctor group infra · infra-ledger-access · infra-portal-access Implemented Access policies · .cloudflare-access.yml bun tools/portal-cli.ts doctor --env ci --group infra
Unified Doctor dev Bun ≥1.4 bun run portal:doctor — CI · developer checks · /portal/doctor/ · bake:doctor Implemented claim portal-doctor · isolated installs bun run portal:doctor --verbose · portal-cli doctor --json
Bunfig (machine) config Bun ≥1.4 ~/.bunfig.toml — Machine-level install policy SSOT Implemented runtime/bunfig · docs/UNIFIED.md linker · globalStore · minimumReleaseAge · cache.dir
Bunfig (project) config Bun ≥1.4 ./bunfig.toml — Project-level overrides only (no machine keys) Implemented same · doctor bunfig-project-no-machine-keys scopes · [test] · frozenLockfile
Bunfig merge config Bun ≥1.4 Shallow merge: machine → project — Effective install config resolution Implemented doctor bunfig-merge-consistency bun run install:verify
Doctor groups dev Bun ≥1.4 linker · bakes · catalog · gates · bunfig — Group-based portal doctor checks Implemented tools/lib/portal-cli-doctor.ts portal-cli doctor --group bunfig · --group catalog,bunfig
Lockfile hash integrity Bun ≥1.0 bun pm hash — portal-cli pm hash Implemented bun pm hash bun run portal-cli pm hash
PM utilities (full group) pkg Bun ≥1.0 bun pm — portal-cli pm passthrough Implemented bun pm bun run portal-cli pm whoami
Package graph bake audit Bun ≥1.0 Bun.file + Bun.write (bake) · Bun.inspect.table (view) — audit:packages --bake · portal-cli pm graph Implemented claim packages-graph-map-v13 · surfaces v3 (page→registry · lib hubs · orphan triage) · pm/filter bun run portal-cli pm graph · bun run audit:packages -- --bake
Install age gate + excludes security Bun ≥1.3 minimumReleaseAge / minimumReleaseAgeExcludes (bunfig) — machine ~/.bunfig.toml · bunfig:bake · portal-cli bunfig status Implemented minimum release age · docs/UNIFIED.md bun run bunfig:bake · bun run portal-cli bunfig status
Bunfig state bake audit Bun ≥1.3 Bun.TOML.parse (machine+project merge, per-key provenance) — bunfig:bake → bunfig-state.json · portal-cli bunfig status|check Implemented scripts/bake-bunfig.ts · bake:all step bunfig bun run bunfig:bake · bun run portal-cli bunfig check
Surfaces state bake audit Bun ≥1.3 Bun.TOML.parse (config/surfaces.toml + Access/wrangler/r2-env cross-check) — surfaces:bake → surfaces-state.json · subdomain + publish-lane SSOT Implemented config/surfaces.toml · bake:all step surfaces bun run surfaces:bake · bun run surfaces:check

Known technical debt

Debt Status Exit criteria Owner Doc
STO TypeScript 6 RESOLVED 2026-07-28 — STO is on "typescript": "catalog:" (6.0.3); bun.lock records the switch typecheck green with catalog TS 6 done platform / STO Open debt: STO TypeScript 6
This site is open source. Improve this page.