cli: engine-only surface — platform verbs move to the vos plugin

.changeset/cli-engine-only.md

@@ -0,0 +1,5 @@
+---
+'@vosjs/cli': minor
+---
+
+The CLI is now engine-only: `render` / `still` / `info` / `check` / `preview` / `versions`, local and account-free. The platform verbs (`fetch` / `push` / `pull`) moved to the vos plugin (`@vosso/vos-plugin`, npm), next to the service they talk to — installed plugin verbs surface through `vos <verb>` exactly as before via a new delegate-on-unknown seam, appear in `vos help` through the plugin's manifest, and get a version row in `vos versions`. Existing installs keep working: the earlier plugin package names still resolve as fallbacks, and `vos voila <verb>` remains a hidden alias.

packages/cli/README.md

@@ -13,32 +13,23 @@ npx vos render animation.json out.webm
 ## Commands
 
 ```bash
-vos render <config.json|url|take> [out]  # config → video; a take directory renders via the take pipeline
+vos render <config.json|url|take> [out]  # config → video; a take directory renders via the plugin
 vos still  <config.json|url> [out]   # config → single frame (WebP)
 vos info   <config.json|url>         # inspect a config
+vos check  <config.json|url>         # migrate → schema → syntax → compile → determinism/dialect lints, all local
 vos preview <config.json|url>        # serve a local playback page
-vos versions                         # installed @vosjs/* versions
-
-# Take pipeline — screen recordings in, product video out (npm i -D @vosso/cli)
-vos create   --actions actions.json [out.webm] [--strict]   # record + plan + render, one shot
-vos record   --actions actions.json [--out take] [--strict]
-vos plan     <take> [--fresh]
-vos frames   <take> [--at-zooms | --frame <t> --size WxH]
-vos open     <take>
-vos validate <actions.json|take>
-
-# Platform (vos.so) — fetch a program, validate locally, push a private remix
-vos fetch <vosId|watch-url> [--out dir]   # writes config.json + meta.json (no auth for public programs)
-vos check <config.json>                   # migrate → schema → syntax → compile → determinism/dialect lints, all local
-vos push  <config.json|take> [--vos id] [--title t] [--slug s] [--remix-of id] [--note n] [--label l] [--base versionId] [--overrides id,id]
-vos pull  [dir|take] [--vos id] [--since versionId] [--check]   # what changed on vos.so since your base; syncs config + base
+vos versions                         # installed @vosjs/* (and plugin) versions
 ```
 
-The take verbs delegate to the separately installed [`@vosso/cli`](https://www.npmjs.com/package/@vosso/cli) (its `run(argv)` export is the contract; `@vosso/voila-cli` remains an install fallback, and `vos voila <verb>` keeps working as a hidden alias for existing scripts). `vos render` is polymorphic by a deterministic sniff, never a flag: a take directory is recognized by its `doc.json`; anything else renders as an engine config.
+That is the whole engine surface: local, deterministic, no account, no auth — this package knows nothing about any hosting platform. Everything else — the take pipeline (screen recordings in, product video out: `create` / `record` / `plan` / `frames` / `open` / `validate`) and the vos.so platform verbs (`fetch` / `push` / `pull` / `login`) — ships as a separately installed plugin:
 
-The platform verbs implement the iteration loop of the remix contract at [vos.so/llms-remix.txt](https://vos.so/llms-remix.txt): `fetch` a public program's config (params and presets preserved), edit it, `check` it locally (the same compiler the platform runs), and `push` it back as a **private** vos with lineage — or iterate an existing one with `--vos`. Auth resolves from `VOS_API_KEY`, then the first line of `~/.config/vos/credentials` (mint a key at [vos.so/app/api](https://vos.so/app/api); an ephemeral `vos_rg_` remix grant works too). Keys can never publish — the pushed vos stays private until a human publishes it on vos.so. A directory that has fetched or pushed TRACKS its vos through `meta.json`, so `--base` defaults to the version you actually edited from: a push against a moved head is rejected with the attributed, typed changelog of what changed there, and `vos pull` brings those changes down — versions with origin, label, note and a semantic summary, plus the `protected` set of human-edited nodes (keep their values unless the user asked; `--overrides` is the explicit consent). The previous local copy survives as `config.backup.json`. Take directories (recognized by `doc.json`) push and pull through the take pipeline in `@vosso/cli` automatically. `VOS_ORIGIN` overrides the platform origin for self-hosted or local development.
+```bash
+npm i -D @vosso/vos-plugin
+```
+
+Any verb this CLI does not own is forwarded to the plugin (its `run(argv)` export is the contract; the earlier package names `@vosso/cli` and `@vosso/voila-cli` still resolve as fallbacks, and `vos voila <verb>` keeps working as a hidden alias for existing scripts). Installed plugin verbs appear in `vos help` via the plugin's manifest, and run as plain `vos <verb>` — one binary either way. `vos render` is polymorphic by a deterministic sniff, never a flag: a take directory is recognized by its `doc.json`; anything else renders as an engine config. The plugin's verbs and the vos.so contracts are documented at [vos.so/llms.txt](https://vos.so/llms.txt).
 
-`vos render` accepts `--width` / `--height` / `--fps` / `--duration` / `--format webm|mp4`; `vos still` accepts `--time` / `--width` / `--height`. Configs can be local files or URLs, and API `{ "config": … }` envelopes are unwrapped automatically. Old config versions are migrated before rendering.
+`vos render` accepts `--width` / `--height` / `--fps` / `--duration` / `--format webm|mp4`; `vos still` accepts `--time` / `--width` / `--height`. Configs can be local files or URLs, and API `{ "config": … }` envelopes are unwrapped automatically. Old config versions are migrated before rendering. `vos check` runs the full local validation pipeline — the same compiler a hosted push runs server-side, so a clean check is a config that will compile anywhere.
 
 Rendering runs the same deterministic pipeline everywhere: the config is compiled with `@vosjs/core`, wrapped in the engine's capture template, and encoded frame-by-frame (WebCodecs) in headless Chromium. Same input, same video — locally, in CI, or on a server.