@akterjs/cli 0.0.0-stage → 0.1.0

package/dist/operation-registry.pure-DVC8EDgj.mjs

@@ -0,0 +1,283 @@
+import { C as isReadonlyArrayEmpty, M as match, N as matchLeft, P as min, R as some, i as dedupe, j as map, l as filter, m as flatten, p as flatMap, r as contains, w as isReadonlyArrayNonEmpty } from "./Array-B4kuTQeW.mjs";
+import { t as match$1 } from "./Boolean-kILIvmhE.mjs";
+import { K as forEach, W as fnUntraced, dt as map$1 } from "./Effect-CKFpqbmw.mjs";
+import { S as none, T as toArray, Tn as pipe, _ as isSome, b as map$2, cn as isString, d as fromUndefinedOr, f as getOrElse, i as filter$1, o as flatMap$1, r as exists, v as liftPredicate, x as match$2 } from "./Option-DkxSnBhp.mjs";
+import { i as Number$1 } from "./Order-C1JC991I.mjs";
+import { F as String$1, I as Struct, M as Record, Q as brand, _r as values, a as Boolean, an as optionalKey, at as decodeUnknownEffect, b as JsonObject, dr as keys, fr as map$3, hr as toEntries, mr as set, mt as is, n as ArraySchema, or as fromEntries, ot as decodeUnknownOption, qt as isPattern, sr as get, ur as isEmptyRecord, y as Json } from "./Schema-MiKt5K1v.mjs";
+import { _ as toUpperCase, f as replaceAll, h as startsWith, m as split, n as camelToSnake, p as slice, s as isNonEmpty } from "./String-q5dcsVe4.mjs";
+// ../../node_modules/.pnpm/@akterjs+cloud-api@file+..+akter-cloud+packages+cloud-api_effect@4.1.2_patch_hash=0e611_59e8fdba67d150970876667b4296bdf6/node_modules/@akterjs/cloud-api/src/flags/flag-name.schema.ts
+/**
+* A feature flag's name (ADR 0030): 2 to 63 characters, a lowercase letter, then letters or digits, in camelCase, such
+* as `cloudFork`. The spec's `x-akter` hint, `FeatureNotEnabledError` and control's overrides all use it, so a flag is
+* never renamed: it is retired and a new one added.
+*/
+const FlagName = String$1.check(isPattern(/^[a-z][A-Za-z0-9]{1,62}$/u)).pipe(brand("FlagName")).annotate({
+	description: "A feature flag's name: a lowercase letter, then 1 to 62 letters or digits, such as cloudFork.",
+	identifier: "FlagName"
+});
+// ../../node_modules/.pnpm/@akterjs+cloud-api@file+..+akter-cloud+packages+cloud-api_effect@4.1.2_patch_hash=0e611_59e8fdba67d150970876667b4296bdf6/node_modules/@akterjs/cloud-api/src/operations/operation-registry.pure.ts
+const Media = Record(String$1, Struct({ schema: optionalKey(JsonObject) }));
+const Hints = Struct({
+	confirm: optionalKey(Boolean),
+	flag: optionalKey(FlagName),
+	idempotent: optionalKey(Boolean),
+	openWorld: optionalKey(Boolean),
+	servedAs: optionalKey(String$1)
+});
+const Parameter = Struct({
+	description: optionalKey(String$1),
+	in: String$1,
+	name: String$1,
+	required: optionalKey(Boolean),
+	schema: JsonObject
+});
+const RequestBody = Struct({ content: Media });
+const Response = Struct({ content: optionalKey(Media) });
+const ComponentsSpec = Struct({ schemas: optionalKey(Record(String$1, JsonObject)) });
+const Names = ArraySchema(String$1);
+const Tag = Struct({
+	description: optionalKey(String$1),
+	name: String$1
+});
+const OperationSpec = Struct({
+	description: optionalKey(String$1),
+	operationId: String$1,
+	parameters: optionalKey(ArraySchema(Parameter)),
+	requestBody: optionalKey(RequestBody),
+	responses: Record(String$1, Response),
+	security: optionalKey(ArraySchema(JsonObject)),
+	summary: optionalKey(String$1),
+	"x-akter": optionalKey(Hints)
+});
+const Spec = Struct({
+	components: optionalKey(ComponentsSpec),
+	paths: Record(String$1, JsonObject),
+	tags: optionalKey(ArraySchema(Tag))
+});
+const methods = [
+	"get",
+	"put",
+	"post",
+	"delete",
+	"patch",
+	"head"
+];
+const componentRef = "#/components/schemas/";
+const definitionRef = "#/$defs/";
+const firstSuccess = 200;
+const firstRedirect = 300;
+const isJsonObject = is(JsonObject);
+const isJsonArray = is(ArraySchema(Json));
+const kebab = (name) => replaceAll("_", "-")(camelToSnake(name));
+const refName = (schema) => pipe(get(schema, "$ref"), filter$1(isString), filter$1(startsWith(componentRef)), map$2(slice(21)));
+const localRef = (key, value) => {
+	if (key === "$ref" && isString(value) && startsWith(componentRef)(value)) return `${definitionRef}${slice(21)(value)}`;
+	return value;
+};
+const rewriteRefs = (value) => {
+	if (isJsonObject(value)) return map$3(value, (inner, key) => localRef(key, rewriteRefs(inner)));
+	if (isJsonArray(value)) return map(value, rewriteRefs);
+	return value;
+};
+const refsIn = (value) => {
+	if (isJsonObject(value)) return [...toArray(refName(value)), ...flatMap(values(value), refsIn)];
+	if (isJsonArray(value)) return flatMap(value, refsIn);
+	return [];
+};
+const definitionsOf = (components, roots) => {
+	const found = /* @__PURE__ */ new Map();
+	let pending = flatMap(roots, refsIn);
+	while (isReadonlyArrayNonEmpty(pending)) {
+		const [name, ...rest] = pending;
+		const schema = get(components, name).pipe(filter$1(() => !found.has(name)));
+		pending = rest;
+		if (isSome(schema)) {
+			found.set(name, schema.value);
+			pending = [...pending, ...refsIn(schema.value)];
+		}
+	}
+	return map$3(fromEntries(found), rewriteRefs);
+};
+const withDefinitions = (schema, definitions) => {
+	if (isEmptyRecord(definitions)) return schema;
+	return set(schema, "$defs", definitions);
+};
+const documentOf = (components, schema) => {
+	const root = rewriteRefs(schema);
+	const rooted = getOrElse(liftPredicate(root, isJsonObject), () => ({}));
+	return withDefinitions(rooted, definitionsOf(components, [schema]));
+};
+const resolved = (components, schema) => getOrElse(flatMap$1(refName(schema), (name) => get(components, name)), () => schema);
+const stringOf = (schema, key) => pipe(get(schema, key), filter$1(isString), getOrElse(() => ""));
+const scalarKinds = {
+	boolean: "boolean",
+	integer: "integer",
+	number: "number",
+	string: "string"
+};
+const scalarKind = (type) => getOrElse(get(scalarKinds, type), () => "json");
+const typeOf = (components, schema) => {
+	const anyOf = getOrElse(filter$1(get(schema, "anyOf"), isJsonArray), () => []);
+	const types = dedupe(map(filter(anyOf, isJsonObject), (branch) => stringOf(resolved(components, branch), "type")));
+	return getOrElse(matchLeft(types, {
+		onEmpty: none,
+		onNonEmpty: (type, others) => liftPredicate(type, () => isReadonlyArrayEmpty(others))
+	}), () => stringOf(schema, "type"));
+};
+const kindOf = (components, schema) => {
+	const target = resolved(components, schema);
+	const type = typeOf(components, target);
+	if (type !== "array") return scalarKind(type);
+	const items = getOrElse(filter$1(get(target, "items"), isJsonObject), () => ({}));
+	if (typeOf(components, resolved(components, items)) === "string") return "strings";
+	return "json";
+};
+const descriptionOf = (components, schema, fallback) => {
+	const own = isNonEmpty(stringOf(schema, "description"));
+	const target = stringOf(resolved(components, schema), "description");
+	if (own) return stringOf(schema, "description");
+	return getOrElse(liftPredicate(target, isNonEmpty), () => fallback);
+};
+const parameterField = (components) => (parameter) => {
+	const inPath = parameter.in === "path";
+	return {
+		description: descriptionOf(components, parameter.schema, parameter.description ?? ""),
+		in: match$1(inPath, {
+			onFalse: () => "query",
+			onTrue: () => "path"
+		}),
+		kind: kindOf(components, parameter.schema),
+		name: parameter.name,
+		required: parameter.required === true || inPath,
+		schema: parameter.schema
+	};
+};
+const parameterFields = ({ components, spec }) => pipe(spec.parameters ?? [], filter((parameter) => parameter.in === "path" || parameter.in === "query"), map(parameterField(components)));
+const jsonSchemaOf = (content) => pipe(content, flatMap$1(get("application/json")), flatMap$1((media) => fromUndefinedOr(media.schema)));
+const propertyField = (components, required) => ([name, property]) => {
+	const schema = getOrElse(liftPredicate(property, isJsonObject), () => ({}));
+	return {
+		description: descriptionOf(components, schema, ""),
+		in: "body",
+		kind: kindOf(components, schema),
+		name,
+		required: contains(required, name),
+		schema
+	};
+};
+const objectFields = (components, schema) => {
+	const target = resolved(components, schema);
+	const properties = filter$1(get(target, "properties"), isJsonObject);
+	const required = pipe(get(target, "required"), flatMap$1(decodeUnknownOption(Names)), getOrElse(() => []));
+	return match$2(properties, {
+		onNone: () => [{
+			description: "The request body as JSON.",
+			in: "payload",
+			kind: "json",
+			name: "payload",
+			required: true,
+			schema
+		}],
+		onSome: (fields) => map(toEntries(fields), propertyField(components, required))
+	});
+};
+const bodyFields = ({ components, spec }) => {
+	const content = map$2(fromUndefinedOr(spec.requestBody), (body) => body.content);
+	return match$2(jsonSchemaOf(content), {
+		onNone: () => [],
+		onSome: (schema) => objectFields(components, schema)
+	});
+};
+const inputOf = (components, fields) => {
+	const properties = fromEntries(map(fields, (field) => [field.name, rewriteRefs(field.schema)]));
+	const required = map(filter(fields, (field) => field.required), (field) => field.name);
+	const definitions = definitionsOf(components, map(fields, (field) => field.schema));
+	return withDefinitions({
+		additionalProperties: false,
+		properties,
+		required,
+		type: "object"
+	}, definitions);
+};
+const successAt = (located, status) => {
+	const content = flatMap$1(get(located.spec.responses, String(status)), (response) => fromUndefinedOr(response.content));
+	const json = jsonSchemaOf(content);
+	if (isSome(json)) return {
+		kind: "json",
+		schema: documentOf(located.components, json.value),
+		status
+	};
+	if (exists(content, (media) => !isEmptyRecord(media))) return {
+		kind: "binary",
+		schema: {
+			format: "binary",
+			type: "string"
+		},
+		status
+	};
+	return {
+		kind: "empty",
+		schema: {},
+		status
+	};
+};
+const successOf = (located) => {
+	const statuses = pipe(keys(located.spec.responses), map(Number), filter((status) => status >= firstSuccess && status < firstRedirect));
+	const lowest = match(statuses, {
+		onEmpty: () => firstSuccess,
+		onNonEmpty: (found) => min(found, Number$1)
+	});
+	return successAt(located, lowest);
+};
+const annotationsOf = ({ method, spec }) => {
+	const hints = spec["x-akter"] ?? {};
+	const readOnly = method === "GET" || method === "HEAD";
+	const destructive = method === "DELETE";
+	return {
+		confirm: hints.confirm ?? destructive,
+		destructive,
+		idempotent: hints.idempotent ?? (readOnly || destructive || method === "PUT"),
+		openWorld: hints.openWorld ?? false,
+		readOnly
+	};
+};
+const operationOf = (groups) => (located) => {
+	const { components, method, path, spec } = located;
+	const [group, name = group] = split(spec.operationId, ".");
+	const [served, servedName = served] = split(spec["x-akter"]?.servedAs ?? spec.operationId, ".");
+	const fields = [...parameterFields(located), ...bodyFields(located)];
+	return {
+		annotations: annotationsOf(located),
+		command: [kebab(served), kebab(servedName)],
+		description: spec.description ?? spec.summary ?? "",
+		fields,
+		flag: fromUndefinedOr(spec["x-akter"]?.flag),
+		group,
+		groupDescription: getOrElse(get(groups, served), () => ""),
+		id: spec.operationId,
+		input: inputOf(components, fields),
+		method,
+		name,
+		path,
+		secured: some(spec.security ?? [], (requirement) => !isEmptyRecord(requirement)),
+		success: successOf(located),
+		tool: `${camelToSnake(served)}_${camelToSnake(servedName)}`
+	};
+};
+const locate = (components, path) => ([method, operation]) => map$1(decodeUnknownEffect(OperationSpec)(operation), (spec) => ({
+	components,
+	method: toUpperCase(method),
+	path,
+	spec
+}));
+const operationsOf = fnUntraced(function* operationsOf(input) {
+	const spec = yield* decodeUnknownEffect(Spec)(input);
+	const components = spec.components?.schemas ?? {};
+	const groups = fromEntries(map(spec.tags ?? [], (tag) => [tag.name, tag.description ?? ""]));
+	const located = yield* forEach(toEntries(spec.paths), ([path, item]) => {
+		const operations = filter(toEntries(item), ([method]) => contains(methods, method));
+		return forEach(operations, locate(components, path));
+	});
+	return map(flatten(located), operationOf(groups));
+});
+export { operationsOf as n, kebab as t };

package/dist/registry/actor-call.service.mjs

@@ -0,0 +1 @@
+export { t as ActorCall } from "../actor-call.service-CGM_vD9u.mjs";

package/dist/registry/actor-commands.config.mjs

@@ -0,0 +1,127 @@
+import { T as join, _ as getSomes, c as every, j as map, p as flatMap, v as groupBy } from "../Array-B4kuTQeW.mjs";
+import { Xt as succeed, _n as when, d as asVoid, o as andThen, x as catchTag } from "../Effect-CKFpqbmw.mjs";
+import { S as none, T as toArray, _ as isSome, c as flatten, f as getOrElse, v as liftPredicate, x as match } from "../Option-DkxSnBhp.mjs";
+import { fr as map$1, or as fromEntries, sr as get } from "../Schema-MiKt5K1v.mjs";
+import { c as Int, f as optional, i as withDescription$1, l as String, m as withDescription, o as Boolean, p as withDefault, r as unlisted, t as make } from "../Command-Dzq9KM-h.mjs";
+import { n as actorOperations, t as ActorCall } from "../actor-call.service-CGM_vD9u.mjs";
+import { t as kebab } from "../operation-registry.pure-DVC8EDgj.mjs";
+import { servedBy } from "./cloud-served.pure.mjs";
+import { servedCommandOf } from "./served-command.config.mjs";
+import { reported } from "./operation-output.pure.mjs";
+import { Confirmation } from "../terminal/confirm.adapter.mjs";
+// src/registry/actor-commands.config.ts
+const help = {
+	actor: "The actor's name in the app, such as Sale. Required.",
+	after: "Only log lines after this seq, the last one printed, to read on from there",
+	commandId: "An id for this call, so a retry with the same id runs it once; a new one is made when it is missing",
+	computer: "The computer's name, as the actor named it. Required.",
+	computerPath: "Relative path in the computer's files directory. Required.",
+	content: "The file to upload: @<path>, - for stdin, or its bytes as base64. Required.",
+	cursor: "Where the page starts, from the cursor the page before printed",
+	direction: "toComputer or fromComputer; copy-back returns a receipt for an actor command to attach. Required.",
+	into: "The new actor's key as JSON; a bare word is taken as a string key. Required.",
+	key: "The actor's key as JSON; a bare word is taken as a string key. Required.",
+	length: "How many bytes to read from --offset; pass both or neither",
+	limit: "The most entries to print",
+	member: "The command or query to run. Required.",
+	offset: "The byte to start reading at; pass it with --length",
+	path: "The file's path in the actor, such as photos/cat.png. Required.",
+	payload: "The payload as JSON, as the actor's schema encodes it",
+	prefix: "Only paths that start with this",
+	step: "The step's id, as akter steps list prints it. Required."
+};
+const json = Boolean("json").pipe(withDefault(false), withDescription("Print the actor's answer, or each update, as one line of JSON, and failures as JSON too"));
+const url = String("url").pipe(optional, withDescription("The app's URL, such as the one akter dev prints; defaults to AKTER_APP_URL"));
+const dryRun = Boolean("dry-run").pipe(withDefault(false), withDescription("Print the RPC request instead of sending it"));
+const count = Int("count").pipe(optional, withDescription("Stop after this many updates; without it, watch until stopped"));
+const fieldFlag = (name) => String(kebab(name)).pipe(optional, withDescription(help[name]));
+const shared = (operation) => ({
+	fields: fromEntries(map(operation.fields, (name) => [name, fieldFlag(name)])),
+	json,
+	url
+});
+const targetFields = [
+	"actor",
+	"key",
+	"computer"
+];
+const confirmedFirst = (operation, options, extra) => {
+	const command = `akter ${join(operation.command, " ")}`;
+	const given = flatMap(targetFields, (name) => toArray(flatten(get(options.fields, name))));
+	const asking = Confirmation.use((confirmation) => confirmation.confirm({
+		question: `${operation.description} Run ${command} for ${join(given, " ")}?`,
+		unattended: `${command} needs a person to confirm it, and no terminal is attached to ask. Run it in a terminal.`
+	}));
+	return when(asking, succeed(operation.annotations.confirm && !extra.dryRun)).pipe(asVoid, catchTag("CliExitError", reported(options.json)));
+};
+const run = (operation, options, extra) => andThen(confirmedFirst(operation, options, extra), ActorCall.use((service) => service.call(operation, {
+	...extra,
+	json: options.json,
+	url: options.url,
+	values: options.fields
+})));
+const describedCommandOf = (operation) => {
+	const [, name] = operation.command;
+	const asks = liftPredicate(" Asks a person to confirm.", () => operation.annotations.confirm);
+	const described = withDescription$1(`${operation.description}${getOrElse(asks, () => "")}`);
+	if (operation.kind === "watch") return make(name, {
+		...shared(operation),
+		count
+	}, (options) => run(operation, options, {
+		count: options.count,
+		dryRun: false
+	})).pipe(described);
+	if (operation.annotations.readOnly) return make(name, shared(operation), (options) => run(operation, options, {
+		count: none(),
+		dryRun: false
+	})).pipe(described);
+	return make(name, {
+		...shared(operation),
+		dryRun
+	}, (options) => run(operation, options, {
+		count: none(),
+		dryRun: options.dryRun
+	})).pipe(described);
+};
+const commandOf = (operation) => {
+	const command = describedCommandOf(operation);
+	return match(operation.flag, {
+		onNone: () => command,
+		onSome: () => unlisted(command)
+	});
+};
+const servedCommandFor = (served) => servedCommandOf({
+	flags: {
+		...shared(served.actor),
+		dryRun
+	},
+	local: (options) => run(served.actor, options, {
+		count: none(),
+		dryRun: options.dryRun
+	}),
+	served
+});
+const commandFor = (operations) => (actor) => match(servedBy(operations)(actor), {
+	onNone: () => commandOf(actor),
+	onSome: (cloud) => servedCommandFor({
+		actor,
+		cloud
+	})
+});
+const groupDescriptions = {
+	actors: "Call, query, watch and create an app's actors",
+	computers: "See, pause, resume, stop and delete the computers an app's actors own, and read their logs",
+	files: "Upload, list and download the files an app's actors hold",
+	steps: "Read the durable computer steps an app's actors' jobs ran"
+};
+const servedIds = (operations, members) => {
+	const served = getSomes(map(members, servedBy(operations)));
+	return map(served, ({ id }) => id);
+};
+const actorCommands = (operations) => map$1(groupBy(actorOperations, ({ command: [owner] }) => owner), (members, owner) => ({
+	commands: map(members, commandFor(operations)),
+	description: getOrElse(get(groupDescriptions, owner), () => owner),
+	serves: servedIds(operations, members),
+	unlisted: every(members, ({ flag }) => isSome(flag))
+}));
+export { actorCommands };

package/dist/registry/actor-refusal.pure.mjs

@@ -0,0 +1,34 @@
+import { R as some, u as findFirst } from "../Array-B4kuTQeW.mjs";
+import { Xt as isError, b as map, f as getOrElse, un as isTagged, v as liftPredicate } from "../Option-DkxSnBhp.mjs";
+import { CliExitError } from "../terminal/cli-exit.errors.mjs";
+// src/registry/actor-refusal.pure.ts
+const refusals = [
+	[[
+		"CallerNotAllowedError",
+		"FileAccessDeniedError",
+		"UnauthenticatedError"
+	], CliExitError.codes.authentication],
+	[["InvalidRequestError"], CliExitError.codes.usage],
+	[[
+		"ActorUnavailableError",
+		"RpcClientError",
+		"TimeoutError"
+	], CliExitError.codes.unavailable]
+];
+const refusalCode = (failure) => getOrElse(map(findFirst(refusals, ([tags]) => some(tags, (tag) => isTagged(failure, tag))), ([, code]) => code), () => CliExitError.codes.failed);
+const unansweredReasons = [["RpcClientError", "Unreachable"], ["TimeoutError", "TimedOut"]];
+const unansweredOf = (tag) => (failure) => map(liftPredicate(failure, isError), (thrown) => {
+	const known = findFirst(unansweredReasons, ([name]) => isTagged(failure, name));
+	const reason = getOrElse(map(known, ([, why]) => why), () => "Failed");
+	return CliExitError.make({
+		code: refusalCode(failure),
+		message: `${tag} got no answer: ${thrown.message}`,
+		reason
+	});
+});
+const rejectedRequest = (tag) => (defect) => CliExitError.make({
+	code: CliExitError.codes.failed,
+	message: `${tag} was refused: ${defect}`,
+	reason: "RequestRefused"
+});
+export { refusalCode, rejectedRequest, unansweredOf };

package/dist/registry/approval.service.mjs

@@ -0,0 +1,80 @@
+import { T as join } from "../Array-B4kuTQeW.mjs";
+import { t as match } from "../Boolean-kILIvmhE.mjs";
+import { t as error } from "../Console-BKHUkH6a.mjs";
+import { At as provideContext, T as context, Vn as effect, W as fnUntraced, Wn as merge, Xt as succeed, _n as when, aa as Service, d as asVoid, et as gen, ht as mapError, in as timeout } from "../Effect-CKFpqbmw.mjs";
+import { b as map, i as filter, in as isNumber, qt as hasProperty, un as isTagged, v as liftPredicate, x as match$1 } from "../Option-DkxSnBhp.mjs";
+import { ot as decodeUnknownOption } from "../Schema-MiKt5K1v.mjs";
+import { v as trim } from "../String-q5dcsVe4.mjs";
+import { c as String, d as run, t as TerminalCapabilities } from "../TerminalCapabilities-w_44MAca.mjs";
+import { d as make, r as ConfirmationRequiredErrorEncoded } from "../cloud-client.adapter-Cy1BjDbG.mjs";
+import { CliExitError } from "../terminal/cli-exit.errors.mjs";
+import { Confirmation } from "../terminal/confirm.adapter.mjs";
+// src/registry/approval.service.ts
+const approvalWait = "30 seconds";
+const unattended = ({ command, organization, required }) => CliExitError.make({
+	code: CliExitError.codes.confirmation,
+	message: join([
+		`${command} runs with an API key, so the key's creator has to approve it, and no terminal is attached to ask for their code.`,
+		`Ask for an approval: akter approvals request --organization ${organization} --operation ${required.operation} --target ${required.target}`,
+		`Turn the emailed code into a token: akter approvals confirm --organization ${organization} --request <id> --code <code>`,
+		`Then run ${command} again with --approval <token>.`
+	], "\n"),
+	reason: "ApprovalRequired"
+});
+const statusOf = (failure) => liftPredicate(failure, hasProperty("response")).pipe(map(({ response }) => response), filter(hasProperty("status")), map(({ status }) => status), filter(isNumber));
+const failedStep = (step) => (failure) => {
+	const status = statusOf(failure);
+	return CliExitError.make({
+		code: match$1(status, {
+			onNone: () => CliExitError.codes.unavailable,
+			onSome: CliExitError.ofStatus
+		}),
+		message: `${step} failed${match$1(status, {
+			onNone: () => "",
+			onSome: (code) => ` with status ${code}`
+		})}, so nothing was changed.`,
+		reason: "ApprovalFailed"
+	});
+};
+const notTyped = () => CliExitError.make({
+	code: CliExitError.codes.confirmation,
+	message: "No approval code was typed, so nothing was changed.",
+	reason: "NotConfirmed"
+});
+const rejected = () => CliExitError.make({
+	code: CliExitError.codes.authentication,
+	message: "The approval code was refused, so nothing was changed. A third wrong code ends the approval.",
+	reason: "CodeRejected"
+});
+const confirmFailure = (failure) => match(hasProperty(failure, "cause") && isTagged(failure.cause, "CodeRejectedError"), {
+	onFalse: () => failedStep("Turning the approval code into a token")(failure),
+	onTrue: rejected
+});
+const approve = fnUntraced(function* approve(asking) {
+	const { canPrompt } = yield* TerminalCapabilities;
+	if (!canPrompt) return yield* unattended(asking);
+	const { http, organization, required } = asking;
+	const client = make(http);
+	const sent = yield* client.approvalsRequest(organization, { payload: {
+		operation: required.operation,
+		target: required.target
+	} }).pipe(timeout(approvalWait), mapError(failedStep("Asking for an approval")));
+	yield* error(`${asking.command} needs approval. Emailed a code to ${sent.sentTo}; it works for 15 minutes.`);
+	const code = yield* run(String({ message: "Approval code" })).pipe(mapError(notTyped));
+	return (yield* client.approvalsConfirm(organization, sent.id, { payload: { code: trim(code) } }).pipe(timeout(approvalWait), mapError(confirmFailure))).token;
+});
+var Approval = class extends Service()("@akterjs/cli/registry/approval.service/Approval", { make: gen(function* makeApproval() {
+	const context$1 = yield* context();
+	const confirmation = yield* Confirmation.make;
+	return {
+		confirm: ({ command, needed, question }) => when(confirmation.confirm({
+			question,
+			unattended: `${command} needs a person to confirm it, and no terminal is attached to ask. Run it in a terminal, or pass --approval with a token: an API key gets one from akter approvals request and akter approvals confirm.`
+		}), succeed(needed)).pipe(asVoid),
+		isRequired: decodeUnknownOption(ConfirmationRequiredErrorEncoded),
+		token: (asking) => provideContext(approve(asking), context$1)
+	};
+}) }) {
+	static layer = effect(this, this.make).pipe(merge(Confirmation.layer));
+};
+export { Approval };

package/dist/registry/cloud-commands.config.mjs

@@ -0,0 +1,151 @@
+import { C as isReadonlyArrayEmpty, R as some$1, c as every, j as map, l as filter, r as contains, v as groupBy, w as isReadonlyArrayNonEmpty } from "../Array-B4kuTQeW.mjs";
+import { t as match } from "../Boolean-kILIvmhE.mjs";
+import { S as none, _ as isSome, f as getOrElse, i as filter$1, w as some$2, x as match$1 } from "../Option-DkxSnBhp.mjs";
+import { ar as filter$2, hr as toEntries, lr as has, or as fromEntries, pt as fromJsonString, sr as get, y as Json } from "../Schema-MiKt5K1v.mjs";
+import { v as trim } from "../String-q5dcsVe4.mjs";
+import { a as withSubcommands, c as Int, d as map$1, f as optional, g as withSchema, i as withDescription$1, l as String$1, m as withDescription, o as Boolean, p as withDefault, r as unlisted, s as Finite, t as make, u as atLeast } from "../Command-Dzq9KM-h.mjs";
+import { OperationCall } from "./operation-call.service.mjs";
+import { t as kebab } from "../operation-registry.pure-DVC8EDgj.mjs";
+// src/registry/cloud-commands.config.ts
+const noneRequired = 0;
+const reservedFlags = [
+	"all",
+	"approval",
+	"dry-run",
+	"input",
+	"json",
+	"url"
+];
+const JsonText = fromJsonString(Json);
+const kindHelp = {
+	boolean: "",
+	integer: "",
+	json: " As JSON.",
+	number: "",
+	string: "",
+	strings: " Repeat it for more."
+};
+const organizationHelp = " Defaults to AKTER_ORGANIZATION, then the organization saved by akter login.";
+const when = (condition, text) => match(condition, {
+	onFalse: () => "",
+	onTrue: () => text
+});
+const helpOf = (field) => {
+	const required = when(field.required, " Required.");
+	const fallback = when(field.name === "organization", organizationHelp);
+	return trim(`${field.description}${kindHelp[field.kind]}${required}${fallback}`);
+};
+const some = (value) => value;
+const listed = (items) => filter$1(some$2(map(items, String)), () => isReadonlyArrayNonEmpty(items));
+const flagsByKind = {
+	boolean: (name) => Boolean(name).pipe(optional, map$1(some)),
+	integer: (name) => Int(name).pipe(optional, map$1(some)),
+	json: (name) => String$1(name).pipe(withSchema(JsonText), optional, map$1(some)),
+	number: (name) => Finite(name).pipe(optional, map$1(some)),
+	string: (name) => String$1(name).pipe(optional, map$1(some)),
+	strings: (name) => String$1(name).pipe(atLeast(noneRequired), map$1((items) => listed(items)))
+};
+const flagOf = (field) => withDescription(flagsByKind[field.kind](kebab(field.name)), helpOf(field));
+const input = String$1("input").pipe(optional, withDescription("The whole input as one JSON object, the same arguments as the operation's MCP tool; @file reads a file and - reads stdin. Flags override its fields."));
+const json = Boolean("json").pipe(withDefault(false), withDescription("Print the API's answer as one line of JSON in its own schema, and failures as JSON too"));
+const url = String$1("url").pipe(optional, withDescription("The Cloud API's URL; defaults to AKTER_CLOUD_URL, then the URL saved by akter login, then https://api.akter.dev"));
+const dryRun = Boolean("dry-run").pipe(withDefault(false), withDescription("Check the input and print the request instead of sending it"));
+const all = Boolean("all").pipe(withDefault(false), withDescription("Read every page, sending each page's next as after until a page has none, and print one answer holding them all"));
+const approval = String$1("approval").pipe(optional, withDescription("A token from an approved request, to run this without a person at the terminal"));
+const shared = (operation) => ({
+	fields: fromEntries(map(operation.fields, (field) => [field.name, flagOf(field)])),
+	input,
+	json,
+	url
+});
+const run = (operation, options, extra) => OperationCall.use((service) => service.call(operation, {
+	...extra,
+	input: options.input,
+	json: options.json,
+	url: options.url,
+	values: options.fields
+}));
+const readCommand = (operation) => {
+	const [, name] = operation.command;
+	return make(name, shared(operation), (options) => run(operation, options, {
+		all: false,
+		approval: none(),
+		dryRun: false
+	})).pipe(withDescription$1(operation.description));
+};
+const pagedCommand = (operation) => {
+	const [, name] = operation.command;
+	return make(name, {
+		...shared(operation),
+		all
+	}, (options) => run(operation, options, {
+		all: options.all,
+		approval: none(),
+		dryRun: false
+	})).pipe(withDescription$1(operation.description));
+};
+const writeCommand = (operation) => {
+	const [, name] = operation.command;
+	return make(name, {
+		...shared(operation),
+		dryRun
+	}, (options) => run(operation, options, {
+		all: false,
+		approval: none(),
+		dryRun: options.dryRun
+	})).pipe(withDescription$1(operation.description));
+};
+const confirmedCommand = (operation) => {
+	const [, name] = operation.command;
+	return make(name, {
+		...shared(operation),
+		approval,
+		dryRun
+	}, (options) => run(operation, options, {
+		all: false,
+		approval: options.approval,
+		dryRun: options.dryRun
+	})).pipe(withDescription$1(`${operation.description} Asks a person to confirm.`));
+};
+const commandOf = (operation) => {
+	if (operation.annotations.readOnly && some$1(operation.fields, (field) => field.name === "after")) return pagedCommand(operation);
+	if (operation.annotations.readOnly) return readCommand(operation);
+	if (operation.annotations.confirm) return confirmedCommand(operation);
+	return writeCommand(operation);
+};
+const listedCommand = (operation) => {
+	const command = commandOf(operation);
+	return match$1(operation.flag, {
+		onNone: () => command,
+		onSome: () => unlisted(command)
+	});
+};
+const groupCommand = ({ group, joined, members }) => {
+	const [first] = members;
+	const nothingJoined = {
+		commands: [],
+		description: "",
+		serves: []
+	};
+	const { commands, serves } = getOrElse(get(joined, group), () => nothingJoined);
+	const own = filter(members, ({ id }) => !contains(serves, id));
+	const command = make(group).pipe(withDescription$1(first.groupDescription), withSubcommands([...map(own, listedCommand), ...commands]));
+	if (isReadonlyArrayEmpty(commands) && every(members, ({ flag }) => isSome(flag))) return unlisted(command);
+	return command;
+};
+const cloudCommands = ({ joined, operations }) => {
+	const groups = groupBy(operations, ({ command: [group] }) => group);
+	const own = map(toEntries(filter$2(joined, (_group, name) => !has(groups, name))), ([group, { commands, description, unlisted: unlisted$1 = false }]) => {
+		const command = make(group).pipe(withDescription$1(description), withSubcommands([...commands]));
+		return match(unlisted$1, {
+			onFalse: () => command,
+			onTrue: () => unlisted(command)
+		});
+	});
+	return [...map(toEntries(groups), ([group, members]) => groupCommand({
+		group,
+		joined,
+		members
+	})), ...own];
+};
+export { cloudCommands, reservedFlags };