@adminiumjs/adminium 0.1.0-rc.1

package/dist/cli/args.js

@@ -0,0 +1,92 @@
+/**
+ * Argument parsing for the `adminium` CLI (01-architecture.md §4.1).
+ *
+ * WHY NO CLI FRAMEWORK. `npx adminium` is advertised as "a complete install"
+ * — the published tarball already carries the server, the dashboard build, and
+ * the meta migrations, so every extra runtime dependency is weight on the very
+ * first thing a new user does. Node 22's built-in `node:util` `parseArgs`
+ * covers the whole surface this CLI needs (long flags, `--flag=value`, short
+ * aliases, repeatables, `--` passthrough, strict unknown-flag rejection) at
+ * zero dependencies, and Zod — already a dependency, already the house rule for
+ * external input — does the typing and coercion `parseArgs` deliberately omits.
+ * A framework would buy help-text formatting we want to control anyway.
+ *
+ * The shape below is deliberately declarative: a command's flags are data, so
+ * `--help` renders from the same spec the parser enforces and the two cannot
+ * drift.
+ */
+import { parseArgs } from 'node:util';
+import { CliUsageError } from './exit.js';
+/** `{ port: { type: 'string', short: 'p' } }` → the `parseArgs` options shape. */
+function toParseArgsOptions(specs) {
+    const options = {};
+    for (const [name, spec] of Object.entries(specs)) {
+        options[name] = {
+            type: spec.type,
+            ...(spec.short === undefined ? {} : { short: spec.short }),
+            ...(spec.multiple === true ? { multiple: true } : {}),
+        };
+    }
+    return options;
+}
+/**
+ * Parse `argv` against `specs`. Unknown flags are rejected (strict) and
+ * re-thrown as a {@link CliUsageError} so the dispatcher can print help rather
+ * than a raw Node error — `parseArgs`'s own message is good but its stack is not
+ * something a user should ever see.
+ */
+export function parseFlags(argv, specs, command = null) {
+    try {
+        const { values, positionals } = parseArgs({
+            args: [...argv],
+            options: toParseArgsOptions(specs),
+            allowPositionals: true,
+            strict: true,
+        });
+        return { values: values, positionals };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new CliUsageError(message, command);
+    }
+}
+/**
+ * Split a repeatable-or-CSV flag into items. 06-llm-assist.md §10.4 writes
+ * `--sections labels,enums,…` and `--locales en_US,de_DE`; supporting the
+ * repeated form too costs nothing and is what people reflexively try.
+ * `--sections a,b --sections c` → `['a','b','c']`.
+ */
+export function splitList(value) {
+    if (value === undefined || typeof value === 'boolean')
+        return [];
+    const raw = Array.isArray(value) ? value : [value];
+    return raw
+        .flatMap((entry) => entry.split(','))
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+}
+/** A string flag's value, or `undefined`. Repeated flags take the LAST value. */
+export function stringFlag(value) {
+    if (value === undefined || typeof value === 'boolean')
+        return undefined;
+    return Array.isArray(value) ? value.at(-1) : value;
+}
+/** A boolean flag's presence. */
+export function boolFlag(value) {
+    return value === true;
+}
+/**
+ * A numeric flag, validated. `--port banana` must say so in one line rather
+ * than surface later as `NaN` from `app.listen`.
+ */
+export function numberFlag(value, flagName, command = null) {
+    const raw = stringFlag(value);
+    if (raw === undefined)
+        return undefined;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed)) {
+        throw new CliUsageError(`--${flagName} must be a number (got "${raw}").`, command);
+    }
+    return parsed;
+}
+//# sourceMappingURL=args.js.map

package/dist/cli/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAwB,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AA4B1C,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,KAAgB;IAC1C,MAAM,OAAO,GAA4C,EAAE,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,GAAG;YACd,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAuB,EAAE,KAAgB,EAAE,UAAyB,IAAI;IACjG,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;YACxC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC;YAClC,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAA8B,EAAE,WAAW,EAAE,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAA8C;IACtE,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,GAAG;SACP,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,KAA8C;IACvE,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACrD,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,QAAQ,CAAC,KAA8C;IACrE,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,KAA8C,EAC9C,QAAgB,EAChB,UAAyB,IAAI;IAE7B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,KAAK,QAAQ,2BAA2B,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/command.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The command contract + `--help` rendering.
+ *
+ * Help text is DERIVED from each command's {@link FlagSpecs}, never written
+ * twice: a flag that exists is documented, and a documented flag exists.
+ */
+import type { FlagSpecs } from './args.js';
+import type { CliIo } from './io.js';
+import type { CliDeps } from './runtime.js';
+import type { ExitCode } from './exit.js';
+export interface CommandContext {
+    io: CliIo;
+    deps: CliDeps;
+    /** Flags after parsing + coercion. */
+    argv: readonly string[];
+}
+export interface Command {
+    name: string;
+    /** One-line summary for the root `--help` list. */
+    summary: string;
+    /** Usage line, e.g. `adminium introspect --connection <id>`. */
+    usage: string;
+    /** Prose under the usage line: what it does and any contract worth stating. */
+    describe?: string;
+    flags: FlagSpecs;
+    /** Returns the process exit code. Throwing `CliError` is equivalent. */
+    run(ctx: CommandContext): Promise<ExitCode>;
+}
+export declare function renderFlags(flags: FlagSpecs): string;
+export declare function renderCommandHelp(command: Command): string;
+export declare function renderRootHelp(commands: readonly Command[], version: string): string;
+//# sourceMappingURL=command.d.ts.map

package/dist/cli/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/cli/command.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,OAAO,CAAC;IACd,sCAAsC;IACtC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,CAAC;IACjB,wEAAwE;IACxE,GAAG,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7C;AAWD,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAWpD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAM1D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA4BpF"}

package/dist/cli/command.js

@@ -0,0 +1,64 @@
+/**
+ * The command contract + `--help` rendering.
+ *
+ * Help text is DERIVED from each command's {@link FlagSpecs}, never written
+ * twice: a flag that exists is documented, and a documented flag exists.
+ */
+const INDENT = '  ';
+/** `--out <path>` / `--dry-run` — the left column of the flag list. */
+function flagLabel(name, spec) {
+    const short = spec.short === undefined ? '' : `-${spec.short}, `;
+    const value = spec.type === 'string' ? ` ${spec.placeholder ?? '<value>'}` : '';
+    return `${short}--${name}${value}`;
+}
+export function renderFlags(flags) {
+    const entries = Object.entries(flags);
+    if (entries.length === 0)
+        return '';
+    const labels = entries.map(([name, spec]) => flagLabel(name, spec));
+    const width = Math.max(...labels.map((label) => label.length));
+    return entries
+        .map(([, spec], i) => {
+        const suffix = spec.defaultDescription === undefined ? '' : ` (default: ${spec.defaultDescription})`;
+        return `${INDENT}${(labels[i] ?? '').padEnd(width)}  ${spec.describe}${suffix}`;
+    })
+        .join('\n');
+}
+export function renderCommandHelp(command) {
+    const parts = [`Usage: ${command.usage}`];
+    if (command.describe !== undefined)
+        parts.push('', command.describe);
+    const flags = renderFlags(command.flags);
+    if (flags !== '')
+        parts.push('', 'Options:', flags);
+    return parts.join('\n');
+}
+export function renderRootHelp(commands, version) {
+    const width = Math.max(...commands.map((command) => command.name.length));
+    const list = commands
+        .map((command) => `${INDENT}${command.name.padEnd(width)}  ${command.summary}`)
+        .join('\n');
+    return [
+        `adminium ${version} — the open-source admin panel generator`,
+        '',
+        'Usage: adminium [command] [options]',
+        '',
+        'Run with no command to start the interactive setup wizard.',
+        '',
+        'Commands:',
+        list,
+        '',
+        'Options:',
+        `${INDENT}-h, --help     Show help (\`adminium <command> --help\` for a command)`,
+        `${INDENT}-v, --version  Show the version`,
+        '',
+        'Environment:',
+        `${INDENT}ADMINIUM_SECRET    Required. Derives the key encrypting stored DSNs and API keys.`,
+        `${INDENT}ADMINIUM_META_URL  Meta store DSN (postgres://, mysql://, sqlite:<path>).`,
+        `${INDENT}ADMINIUM_DATA_DIR  Writable data directory (default ./data).`,
+        `${INDENT}PORT, HOST         Listen address (default 4600, 0.0.0.0).`,
+        '',
+        'Flags override the environment. Docs: https://docs.adminium.dev',
+    ].join('\n');
+}
+//# sourceMappingURL=command.js.map

package/dist/cli/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/cli/command.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2BH,MAAM,MAAM,GAAG,IAAI,CAAC;AAEpB,uEAAuE;AACvE,SAAS,SAAS,CAAC,IAAY,EAAE,IAAuB;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,OAAO,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,kBAAkB,GAAG,CAAC;QACrG,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,CAAC;IAClF,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,MAAM,KAAK,GAAG,CAAC,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAA4B,EAAE,OAAe;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,QAAQ;SAClB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;SAC9E,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;QACL,YAAY,OAAO,0CAA0C;QAC7D,EAAE;QACF,qCAAqC;QACrC,EAAE;QACF,4DAA4D;QAC5D,EAAE;QACF,WAAW;QACX,IAAI;QACJ,EAAE;QACF,UAAU;QACV,GAAG,MAAM,wEAAwE;QACjF,GAAG,MAAM,iCAAiC;QAC1C,EAAE;QACF,cAAc;QACd,GAAG,MAAM,mFAAmF;QAC5F,GAAG,MAAM,2EAA2E;QACpF,GAAG,MAAM,8DAA8D;QACvE,GAAG,MAAM,4DAA4D;QACrE,EAAE;QACF,iEAAiE;KAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/cli/commands/apply-llm-response.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `adminium apply-llm-response` — 06-llm-assist.md §10.4, verbatim:
+ *
+ *   adminium apply-llm-response --run <runId> --file ./response.json
+ *       [--chunk 2] [--yes-above 0.8] [--dry-run]
+ *          → validates, prints the diff table, applies (or previews with --dry-run)
+ *
+ *   "`--dry-run` prints the same per-path validation errors and diff rows the UI
+ *    shows. Exit codes: `0` applied, `2` validation failed, `3` nothing accepted."
+ *
+ * Every step is a call into the existing services — `runService.receiveResponse`
+ * (the same BYO intake `POST /llm/runs/:id/response` uses),
+ * `applyService.buildPlanForRun` (the same diff `GET /llm/runs/:id/diff` returns),
+ * `applyService.applyRun` (the same transactional executor, provenance and undo
+ * included). No HTTP, no second implementation of any of it.
+ *
+ * The one CLI-specific decision is which rows to accept: the review screen has a
+ * confidence slider and checkboxes, and `--yes-above` is its headless equivalent
+ * — the "Accept all ≥ 0.8" bulk control, default and all.
+ */
+import type { Command } from '../command.js';
+import { type ExitCode } from '../exit.js';
+/**
+ * The review screen's default bulk-accept threshold ("Accept all ≥ 0.8",
+ * §10.3). Same number, same meaning, so a headless apply and a reviewed apply
+ * of the same run land on the same set.
+ */
+export declare const DEFAULT_YES_ABOVE = 0.8;
+export declare const applyLlmResponseCommand: Command;
+/** Re-exported for the test — the §10.4 contract is worth asserting by name. */
+export declare const EXIT_CODES: Readonly<Record<'applied' | 'validationFailed' | 'nothingAccepted', ExitCode>>;
+//# sourceMappingURL=apply-llm-response.d.ts.map

package/dist/cli/commands/apply-llm-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-llm-response.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/apply-llm-response.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAKL,KAAK,QAAQ,EACd,MAAM,YAAY,CAAC;AAKpB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAiCrC,eAAO,MAAM,uBAAuB,EAAE,OA2KrC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,GAAG,kBAAkB,GAAG,iBAAiB,EAAE,QAAQ,CAAC,CAIrG,CAAC"}

package/dist/cli/commands/apply-llm-response.js

@@ -0,0 +1,209 @@
+/**
+ * `adminium apply-llm-response` — 06-llm-assist.md §10.4, verbatim:
+ *
+ *   adminium apply-llm-response --run <runId> --file ./response.json
+ *       [--chunk 2] [--yes-above 0.8] [--dry-run]
+ *          → validates, prints the diff table, applies (or previews with --dry-run)
+ *
+ *   "`--dry-run` prints the same per-path validation errors and diff rows the UI
+ *    shows. Exit codes: `0` applied, `2` validation failed, `3` nothing accepted."
+ *
+ * Every step is a call into the existing services — `runService.receiveResponse`
+ * (the same BYO intake `POST /llm/runs/:id/response` uses),
+ * `applyService.buildPlanForRun` (the same diff `GET /llm/runs/:id/diff` returns),
+ * `applyService.applyRun` (the same transactional executor, provenance and undo
+ * included). No HTTP, no second implementation of any of it.
+ *
+ * The one CLI-specific decision is which rows to accept: the review screen has a
+ * confidence slider and checkboxes, and `--yes-above` is its headless equivalent
+ * — the "Accept all ≥ 0.8" bulk control, default and all.
+ */
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { selectAcceptedByConfidence } from '../../llm/apply-service.js';
+import { numberFlag, parseFlags, stringFlag } from '../args.js';
+import { CliError, EXIT_NOTHING_ACCEPTED, EXIT_OK, EXIT_VALIDATION_FAILED, } from '../exit.js';
+import { renderTable } from '../io.js';
+import { loadCliEnv } from '../runtime.js';
+/**
+ * The review screen's default bulk-accept threshold ("Accept all ≥ 0.8",
+ * §10.3). Same number, same meaning, so a headless apply and a reviewed apply
+ * of the same run land on the same set.
+ */
+export const DEFAULT_YES_ABOVE = 0.8;
+/** `{ a: 1 }` → `a: 1`, clipped — the diff table's value columns. */
+function preview(value) {
+    if (value === undefined)
+        return '—';
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string')
+        return value;
+    return JSON.stringify(value);
+}
+/** The §10.3 review rows, as the table §10.4 says to print. */
+function printDiffTable(io, diff, accepted) {
+    io.out(renderTable(['', 'category', 'target', 'status', 'heuristic', 'llm', 'conf'], diff.map((row) => [
+        accepted.has(row.id) ? '✓' : ' ',
+        row.category,
+        row.table ?? '—',
+        row.status,
+        preview(row.heuristicValue),
+        preview(row.llmValue),
+        row.confidence.toFixed(2),
+    ]), [1, 14, 28, 18, 24, 24, 4]));
+}
+export const applyLlmResponseCommand = {
+    name: 'apply-llm-response',
+    summary: 'Validate an LLM response and apply the accepted suggestions',
+    usage: 'adminium apply-llm-response --run <runId> --file <response.json>\n' +
+        '                           [--chunk <n>] [--yes-above <0..1>] [--dry-run]',
+    describe: 'Feeds a saved model reply back into its run: validates it, prints the diff\n' +
+        'against the heuristic baseline, and applies the rows at or above the\n' +
+        'confidence threshold in one transaction.\n' +
+        '\n' +
+        'Your own edits are never overwritten (user > llm > heuristic), and applying\n' +
+        'the same run twice writes no duplicates.\n' +
+        '\n' +
+        'Exit codes: 0 applied · 2 validation failed · 3 nothing accepted.',
+    flags: {
+        run: { type: 'string', short: 'r', placeholder: '<runId>', describe: 'Run id from generate-prompt (required)' },
+        file: { type: 'string', short: 'f', placeholder: '<path>', describe: 'The saved model response (required)' },
+        chunk: {
+            type: 'string',
+            placeholder: '<n>',
+            describe: 'Which chunk this file answers, for chunked runs',
+            defaultDescription: 'unchunked',
+        },
+        'yes-above': {
+            type: 'string',
+            placeholder: '<0..1>',
+            describe: 'Accept suggestions at or above this confidence',
+            defaultDescription: String(DEFAULT_YES_ABOVE),
+        },
+        'dry-run': { type: 'boolean', describe: 'Validate and print the diff; write nothing' },
+        'data-dir': { type: 'string', placeholder: '<path>', describe: 'Data directory' },
+        'meta-url': { type: 'string', placeholder: '<dsn>', describe: 'Meta store DSN' },
+    },
+    async run({ io, deps, argv }) {
+        const { values } = parseFlags(argv, applyLlmResponseCommand.flags, applyLlmResponseCommand.name);
+        const runId = stringFlag(values.run);
+        const file = stringFlag(values.file);
+        if (runId === undefined || file === undefined) {
+            throw new CliError('--run <runId> and --file <path> are both required.', {
+                hint: 'See `adminium apply-llm-response --help`.',
+            });
+        }
+        const chunkIndex = numberFlag(values.chunk, 'chunk', applyLlmResponseCommand.name);
+        const yesAbove = numberFlag(values['yes-above'], 'yes-above', applyLlmResponseCommand.name) ?? DEFAULT_YES_ABOVE;
+        if (yesAbove < 0 || yesAbove > 1) {
+            throw new CliError(`--yes-above must be between 0 and 1 (got ${String(yesAbove)}).`);
+        }
+        const dryRun = values['dry-run'] === true;
+        const dataDir = stringFlag(values['data-dir']);
+        const metaUrl = stringFlag(values['meta-url']);
+        const env = loadCliEnv(deps.env, {
+            ...(dataDir === undefined ? {} : { dataDir }),
+            ...(metaUrl === undefined ? {} : { metaUrl }),
+        });
+        const text = await readFile(resolve(deps.cwd, file), 'utf8').catch((cause) => {
+            throw new CliError(`Could not read ${file}.`, { cause });
+        });
+        const runtime = await deps.openRuntime(env);
+        try {
+            const { runService, applyService } = runtime;
+            const existing = await runService.getRun(runId);
+            if (existing === null)
+                throw new CliError(`Run ${runId} not found.`);
+            // ── 1. Intake + validation ────────────────────────────────────────────
+            // A run still awaiting a response takes the BYO path; one already carrying
+            // a validated response (direct path, or an earlier apply attempt) skips
+            // straight to the diff — re-pasting is not an error, just redundant.
+            let run = existing;
+            if (existing.status === 'awaiting_response') {
+                const promptService = runtime.promptService;
+                const allowed = runtime.allowed;
+                if (promptService === null || allowed === null) {
+                    const cause = runtime.promptServiceError;
+                    if (cause instanceof CliError)
+                        throw cause;
+                    throw new CliError(cause?.message ?? 'The AI validator is unavailable.', { cause });
+                }
+                const { model } = await promptService.loadLatestModel(existing.connectionId);
+                // `dryRun` reaches the SERVICE, not just the print below: intake is a
+                // write (it commits the response and flips the run to `validated`,
+                // after which no different response can ever be pasted). Deciding
+                // afterwards was deciding too late — see `ReceiveResponseInput.dryRun`.
+                const received = await runService.receiveResponse(runId, {
+                    text,
+                    ...(chunkIndex === undefined ? {} : { chunkIndex }),
+                    snapshot: model,
+                    allowedTemplates: allowed.templates,
+                    allowedWidgets: allowed.widgets,
+                    dryRun,
+                });
+                if (received.validation.response === undefined) {
+                    io.err('Validation failed — nothing was applied.');
+                    io.err('');
+                    io.err(renderTable(['path', 'code', 'message'], received.validation.errors.map((error) => [
+                        error.path ?? '—',
+                        error.code,
+                        error.message,
+                    ]), [40, 24, 70]));
+                    return EXIT_VALIDATION_FAILED;
+                }
+                for (const warning of received.validation.warnings) {
+                    io.err(`warning: ${warning.path ?? '—'} — ${warning.message}`);
+                }
+                run = received.run;
+                if (run.status !== 'validated') {
+                    // A chunked run still missing pieces: nothing to accept yet, which is
+                    // exactly what exit 3 means. Under --dry-run the chunk was validated
+                    // but NOT recorded, so say "would be" rather than "accepted".
+                    const progress = `${String(run.chunksReceived)}/${String(run.chunksTotal)}`;
+                    io.out(dryRun
+                        ? `--dry-run: chunk ${progress} validates — nothing was written.`
+                        : `Chunk ${progress} accepted — paste the remaining chunk(s) before applying.`);
+                    return EXIT_NOTHING_ACCEPTED;
+                }
+            }
+            else if (run.responseJson === null || run.responseJson === undefined) {
+                throw new CliError(`Run ${runId} is ${run.status} and carries no validated response to apply.`);
+            }
+            // ── 2. Diff ───────────────────────────────────────────────────────────
+            const { diff } = await applyService.buildPlanForRun(run, []);
+            const accepted = selectAcceptedByConfidence(diff, yesAbove);
+            const acceptedSet = new Set(accepted);
+            printDiffTable(io, diff, acceptedSet);
+            io.out('');
+            // ── 3. Apply (or not) ─────────────────────────────────────────────────
+            if (accepted.length === 0) {
+                io.out(`Nothing accepted at confidence ≥ ${String(yesAbove)} — nothing applied.`);
+                io.out('Lower the bar with --yes-above, or review the run in Studio.');
+                return EXIT_NOTHING_ACCEPTED;
+            }
+            if (dryRun) {
+                io.out(`--dry-run: would apply ${String(accepted.length)} of ${String(diff.length)} suggestion(s) ` +
+                    `at confidence ≥ ${String(yesAbove)}. Nothing was written.`);
+                return EXIT_OK;
+            }
+            const result = await applyService.applyRun(runId, accepted);
+            io.out(`Applied ${String(result.review.accepted.length)} suggestion(s): ` +
+                `${String(result.counts.overrides)} override(s), ${String(result.counts.pages)} page(s).`);
+            if (result.partial) {
+                io.out(`${String(result.review.rejected.length)} suggestion(s) below the bar were not applied.`);
+            }
+            return EXIT_OK;
+        }
+        finally {
+            await runtime.close();
+        }
+    },
+};
+/** Re-exported for the test — the §10.4 contract is worth asserting by name. */
+export const EXIT_CODES = {
+    applied: EXIT_OK,
+    validationFailed: EXIT_VALIDATION_FAILED,
+    nothingAccepted: EXIT_NOTHING_ACCEPTED,
+};
+//# sourceMappingURL=apply-llm-response.js.map

package/dist/cli/commands/apply-llm-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-llm-response.js","sourceRoot":"","sources":["../../../src/cli/commands/apply-llm-response.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEhE,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,sBAAsB,GAEvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,qEAAqE;AACrE,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACpC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,+DAA+D;AAC/D,SAAS,cAAc,CACrB,EAAS,EACT,IAA+B,EAC/B,QAA6B;IAE7B,EAAE,CAAC,GAAG,CACJ,WAAW,CACT,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,EAChE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAChB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QAChC,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,KAAK,IAAI,GAAG;QAChB,GAAG,CAAC,MAAM;QACV,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrB,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;KAC1B,CAAC,EACF,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAC3B,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAY;IAC9C,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,6DAA6D;IACtE,KAAK,EACH,oEAAoE;QACpE,2EAA2E;IAC7E,QAAQ,EACN,8EAA8E;QAC9E,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI;QACJ,+EAA+E;QAC/E,4CAA4C;QAC5C,IAAI;QACJ,mEAAmE;IACrE,KAAK,EAAE;QACL,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,wCAAwC,EAAE;QAC/G,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,qCAAqC,EAAE;QAC5G,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,KAAK;YAClB,QAAQ,EAAE,iDAAiD;YAC3D,kBAAkB,EAAE,WAAW;SAChC;QACD,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,gDAAgD;YAC1D,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,CAAC;SAC9C;QACD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4CAA4C,EAAE;QACtF,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE;QACjF,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE;KACjF;IAED,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC,KAAK,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE;gBACvE,IAAI,EAAE,2CAA2C;aAClD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,uBAAuB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC;QACjH,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,QAAQ,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpF,MAAM,IAAI,QAAQ,CAAC,kBAAkB,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC;YAErE,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,GAAG,GAAG,QAAQ,CAAC;YACnB,IAAI,QAAQ,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;gBAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;gBAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;gBAChC,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,CAAC;oBACzC,IAAI,KAAK,YAAY,QAAQ;wBAAE,MAAM,KAAK,CAAC;oBAC3C,MAAM,IAAI,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,kCAAkC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtF,CAAC;gBACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAE7E,sEAAsE;gBACtE,mEAAmE;gBACnE,kEAAkE;gBAClE,wEAAwE;gBACxE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,KAAK,EAAE;oBACvD,IAAI;oBACJ,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;oBACnD,QAAQ,EAAE,KAAK;oBACf,gBAAgB,EAAE,OAAO,CAAC,SAAS;oBACnC,cAAc,EAAE,OAAO,CAAC,OAAO;oBAC/B,MAAM;iBACP,CAAC,CAAC;gBAEH,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC/C,EAAE,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;oBACnD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACX,EAAE,CAAC,GAAG,CACJ,WAAW,CACT,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAC3B,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;wBACxC,KAAK,CAAC,IAAI,IAAI,GAAG;wBACjB,KAAK,CAAC,IAAI;wBACV,KAAK,CAAC,OAAO;qBACd,CAAC,EACF,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CACb,CACF,CAAC;oBACF,OAAO,sBAAsB,CAAC;gBAChC,CAAC;gBAED,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;oBACnD,EAAE,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,IAAI,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjE,CAAC;gBACD,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;gBAEnB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAC/B,sEAAsE;oBACtE,qEAAqE;oBACrE,8DAA8D;oBAC9D,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC5E,EAAE,CAAC,GAAG,CACJ,MAAM;wBACJ,CAAC,CAAC,oBAAoB,QAAQ,mCAAmC;wBACjE,CAAC,CAAC,SAAS,QAAQ,2DAA2D,CACjF,CAAC;oBACF,OAAO,qBAAqB,CAAC;gBAC/B,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACvE,MAAM,IAAI,QAAQ,CAChB,OAAO,KAAK,OAAO,GAAG,CAAC,MAAM,8CAA8C,CAC5E,CAAC;YACJ,CAAC;YAED,yEAAyE;YACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YACtC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEX,yEAAyE;YACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,EAAE,CAAC,GAAG,CAAC,oCAAoC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;gBAClF,EAAE,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;gBACvE,OAAO,qBAAqB,CAAC;YAC/B,CAAC;YAED,IAAI,MAAM,EAAE,CAAC;gBACX,EAAE,CAAC,GAAG,CACJ,0BAA0B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB;oBAC1F,mBAAmB,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAC9D,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC5D,EAAE,CAAC,GAAG,CACJ,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB;gBAChE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAC5F,CAAC;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,UAAU,GAAmF;IACxG,OAAO,EAAE,OAAO;IAChB,gBAAgB,EAAE,sBAAsB;IACxC,eAAe,EAAE,qBAAqB;CACvC,CAAC"}

package/dist/cli/commands/export-zip.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `adminium export-zip` — bundle the instance's server + configuration.
+ *
+ * The flags, the resolution of configuration, and the reporting are here; the
+ * bundling itself lives behind the `src/export/zip-service.ts` `exportZip(opts)`
+ * contract, so a future Studio download route produces byte-identical bundles
+ * by calling the same service. `adminium import-zip` is the inverse.
+ *
+ * The distinction the docs insist on and this command's copy repeats: the export
+ * is **server + config, not source code** (BRIEF §3). Adminium interprets
+ * configuration at runtime; it never emits an app.
+ */
+import type { Command } from '../command.js';
+/** Human-readable size for the summary line. */
+export declare function formatBytes(bytes: number): string;
+export declare const exportZipCommand: Command;
+//# sourceMappingURL=export-zip.d.ts.map

package/dist/cli/commands/export-zip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-zip.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/export-zip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUjD;AAED,eAAO,MAAM,gBAAgB,EAAE,OAmF9B,CAAC"}

package/dist/cli/commands/export-zip.js

@@ -0,0 +1,111 @@
+/**
+ * `adminium export-zip` — bundle the instance's server + configuration.
+ *
+ * The flags, the resolution of configuration, and the reporting are here; the
+ * bundling itself lives behind the `src/export/zip-service.ts` `exportZip(opts)`
+ * contract, so a future Studio download route produces byte-identical bundles
+ * by calling the same service. `adminium import-zip` is the inverse.
+ *
+ * The distinction the docs insist on and this command's copy repeats: the export
+ * is **server + config, not source code** (BRIEF §3). Adminium interprets
+ * configuration at runtime; it never emits an app.
+ */
+import { resolve } from 'node:path';
+import { PlaintextSecretError } from '../../export/redaction.js';
+import { APP_VERSION } from '../../version.js';
+import { boolFlag, parseFlags, stringFlag } from '../args.js';
+import { CliError, EXIT_OK } from '../exit.js';
+import { loadCliEnv } from '../runtime.js';
+/** Human-readable size for the summary line. */
+export function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${String(bytes)} B`;
+    const units = ['KB', 'MB', 'GB'];
+    let value = bytes / 1024;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    return `${value.toFixed(1)} ${units[unit] ?? 'GB'}`;
+}
+export const exportZipCommand = {
+    name: 'export-zip',
+    summary: 'Export the instance configuration as a runnable bundle',
+    usage: 'adminium export-zip [--connection <id>] [--out <file>] [--include-secrets]',
+    describe: 'Bundles the server plus its configuration — connections, snapshots,\n' +
+        'overrides, pages and dashboards, views, settings, roles — so it can be\n' +
+        'restored or replayed elsewhere.\n' +
+        '\n' +
+        'This is configuration, not source code: Adminium interprets it at runtime\n' +
+        'and does not emit a generated app. Secrets are excluded unless you ask for\n' +
+        'them with --include-secrets.',
+    flags: {
+        connection: {
+            type: 'string',
+            short: 'c',
+            placeholder: '<id>',
+            describe: 'Export only this connection',
+            defaultDescription: 'the whole instance',
+        },
+        out: {
+            type: 'string',
+            short: 'o',
+            placeholder: '<file>',
+            describe: 'Destination archive path',
+            defaultDescription: './adminium-export.zip',
+        },
+        'include-secrets': {
+            type: 'boolean',
+            describe: 'Include encrypted DSNs and provider keys in the bundle',
+            defaultDescription: 'off',
+        },
+        'data-dir': { type: 'string', placeholder: '<path>', describe: 'Data directory' },
+        'meta-url': { type: 'string', placeholder: '<dsn>', describe: 'Meta store DSN' },
+    },
+    async run({ io, deps, argv }) {
+        const { values } = parseFlags(argv, exportZipCommand.flags, exportZipCommand.name);
+        const connectionId = stringFlag(values.connection);
+        const out = stringFlag(values.out) ?? './adminium-export.zip';
+        const dataDir = stringFlag(values['data-dir']);
+        const metaUrl = stringFlag(values['meta-url']);
+        const env = loadCliEnv(deps.env, {
+            ...(dataDir === undefined ? {} : { dataDir }),
+            ...(metaUrl === undefined ? {} : { metaUrl }),
+        });
+        const runtime = await deps.openRuntime(env);
+        try {
+            const result = await deps.exportZip({
+                meta: runtime.metaStore.meta,
+                ...(connectionId === undefined ? {} : { connectionId }),
+                outPath: resolve(deps.cwd, out),
+                includeSecrets: boolFlag(values['include-secrets']),
+                dataDir: env.ADMINIUM_DATA_DIR,
+                appVersion: APP_VERSION,
+            });
+            io.out(`Wrote ${result.path} (${formatBytes(result.bytes)}, ${String(result.entries.length)} entries).`);
+            const counts = Object.entries(result.counts);
+            if (counts.length > 0) {
+                io.out(counts.map(([key, value]) => `${key}: ${String(value)}`).join(' · '));
+            }
+            if (boolFlag(values['include-secrets'])) {
+                io.err('This bundle contains encrypted secrets — treat it as sensitive. They only decrypt ' +
+                    'under this instance\'s ADMINIUM_SECRET.');
+            }
+            return EXIT_OK;
+        }
+        catch (error) {
+            // The export refused to write a value that should have been ciphertext.
+            // Surface it as a first-class failure rather than a stack trace: it means
+            // something upstream stored a secret in plaintext.
+            if (error instanceof PlaintextSecretError) {
+                throw new CliError(error.message, { cause: error });
+            }
+            throw error;
+        }
+        finally {
+            await runtime.close();
+        }
+    },
+};
+//# sourceMappingURL=export-zip.js.map

package/dist/cli/commands/export-zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-zip.js","sourceRoot":"","sources":["../../../src/cli/commands/export-zip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,gDAAgD;AAChD,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACzB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,KAAK,IAAI,IAAI,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,KAAK,IAAI,IAAI,CAAC;QACd,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAY;IACvC,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,wDAAwD;IACjE,KAAK,EAAE,4EAA4E;IACnF,QAAQ,EACN,uEAAuE;QACvE,0EAA0E;QAC1E,mCAAmC;QACnC,IAAI;QACJ,6EAA6E;QAC7E,8EAA8E;QAC9E,8BAA8B;IAChC,KAAK,EAAE;QACL,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,GAAG;YACV,WAAW,EAAE,MAAM;YACnB,QAAQ,EAAE,6BAA6B;YACvC,kBAAkB,EAAE,oBAAoB;SACzC;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,GAAG;YACV,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,0BAA0B;YACpC,kBAAkB,EAAE,uBAAuB;SAC5C;QACD,iBAAiB,EAAE;YACjB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,wDAAwD;YAClE,kBAAkB,EAAE,KAAK;SAC1B;QACD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE;QACjF,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE;KACjF;IAED,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAC;QAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE;YAC/B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBAClC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;gBAC5B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;gBACvD,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;gBAC/B,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBACnD,OAAO,EAAE,GAAG,CAAC,iBAAiB;gBAC9B,UAAU,EAAE,WAAW;aACxB,CAAC,CAAC;YAEH,EAAE,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACzG,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;gBACxC,EAAE,CAAC,GAAG,CACJ,oFAAoF;oBAClF,yCAAyC,CAC5C,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,0EAA0E;YAC1E,mDAAmD;YACnD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/cli/commands/generate-prompt.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `adminium generate-prompt` — 06-llm-assist.md §10.4, verbatim:
+ *
+ *   adminium generate-prompt --connection <id> [--sections labels,enums,…]
+ *       [--locales en_US,de_DE] [--sampling] [--out ./prompt.md]
+ *          → writes prompt file(s), prints runId + token estimate
+ *
+ * Runs through `promptService.createRunForConnection` — the SAME call
+ * `POST /api/v1/llm/runs` makes — so the prompt text a CLI user pastes into a
+ * chat window is byte-identical to the one the Studio BYO screen shows, and the
+ * run is a first-class row either way. It never touches the HTTP API.
+ *
+ * Chunked runs (§4.5) write one file per chunk: `--out ./prompt.md` with three
+ * chunks yields `prompt.1.md`, `prompt.2.md`, `prompt.3.md` — hence "file(s)".
+ */
+import type { Command } from '../command.js';
+import type { CliRuntime } from '../runtime.js';
+/**
+ * Per-column sample cap when `--sampling` is passed. Mirrors the Studio wizard's
+ * `SAMPLING_MAX_VALUES` (06 §4.2) — the two front doors must opt in to the same
+ * amount of data, or "the same prompt" would be a lie.
+ */
+export declare const SAMPLING_MAX_VALUES = 20;
+/** `./prompt.md` + chunk 2 of 3 → `./prompt.2.md`; single-chunk keeps the name. */
+export declare function chunkFileName(out: string, index: number, total: number): string;
+/** The prompt service, or the reason it is unavailable, as one actionable error. */
+export declare function requirePromptService(runtime: CliRuntime): NonNullable<CliRuntime['promptService']>;
+export declare const generatePromptCommand: Command;
+//# sourceMappingURL=generate-prompt.d.ts.map