@apex-actions/cli 0.95.2 → 0.97.0

package/README.md

@@ -2,7 +2,7 @@
 
 `apex` developer and operator CLI (TypeScript, commander).
 
-Part of the [Apex Actions](../) superproject. Conventions, architecture, and agent context live in the `context` repository.
+A workspace of the [Apex Actions](../../README.md) repository. What it is inside: [`docs/architecture/components/cli.md`](../../docs/architecture/components/cli.md); the conventions: [`docs/conventions/`](../../docs/conventions/README.md).
 
 ## Commands
 
@@ -20,12 +20,12 @@ Part of the [Apex Actions](../) superproject. Conventions, architecture, and age
 | `apex secret` · `apex variable` | the control-plane REST API | a customer token with `secrets:*` / `variables:*` (`APEX_TOKEN` or `apex login`) |
 | `apex login --console` · `logout --console` | the Admin Console in the browser, and the control-plane REST API | an operator signed in to the Admin Console, who approves it |
 | `apex grant list` · `apex tenant installations` | the control-plane admin API | the operator token (`apex login --console`), or the machine token |
-| `apex grant create` · `update` · `revoke` | the control-plane admin API | the operator token (`apex login --console`) — never the machine token (control-plane ADR-0056, ADR-0079) |
+| `apex grant create` · `update` · `revoke` | the control-plane admin API | the operator token (`apex login --console`) — never the machine token (`api` ADR-0056, `api` ADR-0079) |
 
 Every other customer command in `cli/reference.ts` names the permission it needs; the public reference shows it.
 
-Generated reference: `docs/feature-docs/cli-commands.md` (`pnpm docs:cli` from `packages/release`), and
-the structured one the public site renders, `docs/feature-docs/cli-reference.json` (`pnpm docs:reference`;
+Generated reference: `docs/features/cli-commands.md` (`pnpm docs:cli` from `packages/tooling`), and
+the structured one the public site renders, `apps/cli/cli-reference.json` (`pnpm docs:reference`;
 customer commands only, classified in `cli/reference.ts`).
 
 ```bash
@@ -38,7 +38,7 @@ apex logs '#42' --job test                 # one job, clean enough to pipe
 ```
 
 `apex migrate scan` answers "will my workflows run" before anything has moved. Every verdict comes
-out of the engine's conformance corpus with the fixture that proves it (ADR-0002, engine ADR-0013) —
+out of the engine's conformance corpus with the fixture that proves it (`cli` ADR-0002, `engine` ADR-0013) —
 nothing here holds a second opinion about compatibility. It imports secret and variable **names** and
 never values, and `--path` scans a checkout on this machine with no token and no network:
 
@@ -49,8 +49,8 @@ apex migrate scan acme --repo acme/api --json   # one repository of an organizat
 
 ### Credentials
 
-The CLI resolves one credential, in this order (control-plane ADR-0064, amended by
-[ADR-0005](docs/adr/0005-an-exported-token-outranks-a-saved-login.md)) — **the environment outranks
+The CLI resolves one credential, in this order (`api` ADR-0064, amended by
+[ADR-0005](../../docs/adrs/cli/0005-an-exported-token-outranks-a-saved-login.md)) — **the environment outranks
 the file**:
 
 1. `APEX_TOKEN` — a token minted on the dashboard (`/settings/tokens`), for CI and scripts;
@@ -66,7 +66,7 @@ the file**:
 **Operator commands** — `apex grant` and `apex tenant installations` — look first for the **operator
 token** `apex login --console` saved in `$XDG_CONFIG_HOME/apex/console-credentials` (same mode rules), when
 it is unexpired and was minted by the control plane `APEX_API_URL` names, and otherwise use the order above
-(control-plane ADR-0079). The operator token is approved on the Admin Console (`APEX_CONSOLE_URL`, or the
+(`api` ADR-0079). The operator token is approved on the Admin Console (`APEX_CONSOLE_URL`, or the
 API's `app.` host read as `admin.`) by an operator, by loopback only; it lives a week at most and reaches
 only the grant routes and the installation list, and every grant it writes names its operator. The machine
 token can list grants and is refused every write. `apex logout --console` revokes and forgets it.
@@ -75,7 +75,7 @@ token can list grants and is refused every write. `apex logout --console` revoke
 only ever sent to the control plane that issued it. `apex login` opens the consent page on the web
 app — `APEX_WEB_URL`, or the API's origin — and listens on `127.0.0.1` for the loopback callback
 (RFC 8252, PKCE); once the code is redeemed it hands the tab back to the web app's bare `/cli/done`
-page (control-plane ADR-0075). Where no browser can open on this machine — an SSH session
+page (`api` ADR-0075). Where no browser can open on this machine — an SSH session
 (`SSH_CONNECTION`/`SSH_TTY`), a Codespace, a dev container, `/.dockerenv`, or Linux with neither `DISPLAY`
 nor `WAYLAND_DISPLAY` — or with `--device` (or `--no-browser`), it uses the **device flow** instead (RFC 8628,
 run by Apex): it prints a code and `…/cli/device`, the person enters the code on any device, a phone included,
@@ -83,7 +83,7 @@ and the CLI polls — honouring `interval` and `slow_down` — until the approva
 minutes end. `--browser` insists on the loopback. `apex token create` and a widening `apex token edit` take
 the same three flags. A customer token carries **permissions** (`resource:read|write`, write implying
 read; resources `actions`, `approvals`, `deployments`, `secrets`, `variables`, `environments`, `notifications`,
-`administration`) and belongs to **one Account** (control-plane ADR-0071). It reaches the repository routes its
+`administration`) and belongs to **one Account** (`api` ADR-0071). It reaches the repository routes its
 grants cover, within its person's role and the Account owner's token policy; `apex login` takes the policy's
 defaults for the person's role (the Owner's: everything), in the Account `--account` names when there is more than
 one. A route it lacks the grant for answers 403 `this token needs <permission>`, which the CLI completes with the
@@ -103,7 +103,7 @@ apex secret list --repo acme/api --json                      # names only
 ```
 
 A pipeline gets its own token. It is approved in the browser like a login, printed once to stdout,
-and never saved (control-plane ADR-0064: a token never mints a token):
+and never saved (`api` ADR-0064: a token never mints a token):
 
 ```bash
 apex token create ci-deploy --permission actions:write --permission secrets:write \
@@ -124,8 +124,8 @@ refused · 2 usage or configuration · 3 not found on `delete`.
 - `src/domain/` — pure decisions: run and job selection, input parsing, exit codes
 - `src/application/` — use cases over ports
 - `src/infrastructure/` — adapters: the engine and runner binaries, the REST API
-- `docs/` — general docs (`*.md`), `adr/`, `feature-docs/`, `run-book/`
-- `VERSION` — lockstep version, managed by the `release` library; do not edit by hand
+- Documentation is the root's: decisions in `docs/adrs/cli/`, the rest by category in `docs/` (TASK-0526)
+- `VERSION` — the release version, which `version:sync` writes from the root (ADR-0048); never edited by hand
 
 ## Licence
 

package/THIRD-PARTY-NOTICES.md

@@ -1,6 +1,6 @@
 # Third-party notices
 
-**Generated — do not edit.** `pnpm notices` from `packages/release`, for `cli`.
+**Generated — do not edit.** `pnpm notices` from `packages/tooling`, for `cli`.
 
 Production npm dependencies, as resolved by pnpm. 40 packages: 0BSD, Apache-2.0, ISC, MIT.
 
@@ -489,7 +489,7 @@ FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## @types/node 24.13.3
+## @types/node 24.19.2
 
 - License: MIT
 - Homepage: https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node
@@ -1162,7 +1162,7 @@ OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 ```
 
-## undici-types 7.18.2
+## undici-types 7.24.6
 
 - License: MIT
 - Homepage: https://undici.nodejs.org

package/dist/cli/environment/main.js

@@ -127,7 +127,7 @@ const deleteCommand = new Command('delete')
             return;
         case 'deleted':
             // Anything already waiting stays waiting: it was gated by rules that
-            // existed when it was gated (control-plane ADR-0018).
+            // existed when it was gated (api ADR-0018).
             console.log(`${chalk.green('✔')} ${name} is no longer protected`);
             console.log(chalk.dim('Deployments already waiting stay waiting; approve or reject them.'));
     }

package/dist/cli/grant/main.js

@@ -4,7 +4,7 @@ import { createGrant, listGrants, revokeGrant, updateGrant } from '../../src/app
 import { createGrantBody, createdLine, grantLine, revokedLine, updateGrantBody } from '../../src/domain/grants.js';
 import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
 /**
- * `apex grant`: complimentary access from the terminal (control-plane ADR-0056 as amended by ADR-0079,
+ * `apex grant`: complimentary access from the terminal (api ADR-0056 as amended by api ADR-0079,
  * TASK-0199). The admin API's own shapes, unchanged. Every write needs a person: the operator token
  * `apex login --console` saved, whose operator the grant row and the audit log name. The machine token
  * (`APEX_ADMIN_TOKEN`) can list and is refused every write, so a leaked one cannot make a free tenant.

package/dist/cli/login/device.js

@@ -3,7 +3,7 @@ import { chooseFlow, deviceInstructions } from '../../src/domain/credentials.js'
 import { HttpDeviceExchange, detectHeadless, machineReport, sleep } from '../../src/infrastructure/device-login.js';
 /**
  * How `apex login`, `apex token create` and a widening `apex token edit` get their approval back
- * (control-plane ADR-0075): the loopback redirect where a browser opens on this machine, a device code
+ * (api ADR-0075): the loopback redirect where a browser opens on this machine, a device code
  * typed on any device where one cannot. One set of flags for the three commands.
  */
 export const withFlowOptions = (command) => command

package/dist/cli/login/main.js

@@ -8,20 +8,20 @@ import { HttpLoginExchange, listenForCallback, newPkcePair, openInBrowser } from
 import { approvalFlow, withFlowOptions } from './device.js';
 /**
  * `apex login`: sign the CLI in with the browser a person already uses
- * (control-plane ADR-0064, RFC 8252 + PKCE). The token it mints is the same
+ * (api ADR-0064, RFC 8252 + PKCE). The token it mints is the same
  * one the dashboard mints, saved `0600` for this user alone.
  *
  * It opens a browser only because it was asked to — this command is the
  * asking — and prints the URL either way. Where no browser can open on this
  * machine (SSH, a container, a Codespace, a Linux box with no display), or
  * with `--device`, it prints a code to enter on any device instead
- * (control-plane ADR-0075); `--browser` insists on the browser here.
+ * (api ADR-0075); `--browser` insists on the browser here.
  *
  * The token carries the Account token policy's defaults for the person's role
  * there (the Owner's: everything), and belongs to that one Account — named with
- * `--account` when the person is in more than one (control-plane ADR-0071).
+ * `--account` when the person is in more than one (api ADR-0071).
  *
- * `--console` is the operator's sign-in (control-plane ADR-0079): approved on the
+ * `--console` is the operator's sign-in (api ADR-0079): approved on the
  * Admin Console by an operator, it saves an **operator token** beside the Account
  * login — a week at most, reaching only complimentary access (`apex grant`).
  */
@@ -77,7 +77,7 @@ export default withFlowOptions(new Command('login')
         console.log(`  permissions: ${describeGrants(outcome.permissions)}${outcome.accountId === undefined ? '' : ` · Account ${outcome.accountId}`}`);
     }
     console.log(chalk.dim(`Saved to ${outcome.location}. Revoke it any time at ${webBase}${TOKENS_PAGE}.`));
-    // The environment outranks the saved login (ADR-0005): say so, or the login looks like it did nothing.
+    // The environment outranks the saved login (cli ADR-0005): say so, or the login looks like it did nothing.
     for (const name of [TOKEN_ENV, ADMIN_TOKEN_ENV]) {
         if (process.env[name])
             console.log(chalk.yellow(`${name} is set in this shell and is used before the saved login; unset it to use the login.`));
@@ -107,7 +107,7 @@ const reportFailure = (outcome, command) => {
     }
 };
 /**
- * `apex login --console` (control-plane ADR-0079): the loopback approval on the Admin Console, saving the
+ * `apex login --console` (api ADR-0079): the loopback approval on the Admin Console, saving the
  * operator token to its own file. No device flow — `--device` is refused rather than silently ignored.
  */
 const consoleSignIn = async (opts) => {

package/dist/cli/logout/main.js

@@ -9,12 +9,12 @@ import { ADMIN_TOKEN_ENV, CONSOLE_URL_ENV, FileCredentialStore, TOKEN_ENV, WEB_U
  *
  * The token is revoked at the control plane that minted it — never at whatever
  * `APEX_API_URL` says now — with `DELETE /api/v1/me/token`, the one thing a
- * token may do to itself (control-plane ADR-0064). The file goes whether or not
+ * token may do to itself (api ADR-0064). The file goes whether or not
  * the server could be reached; when it could not, the command says the token
  * may still be valid and where to revoke it, rather than implying it is dead.
  *
  * `--console` does the same to the operator token `apex login --console` saved
- * (control-plane ADR-0079), which may revoke itself and nothing else.
+ * (api ADR-0079), which may revoke itself and nothing else.
  */
 export default new Command('logout')
     .description('Revoke the token `apex login` saved, and forget it')

package/dist/cli/migrate/main.js

@@ -194,7 +194,7 @@ const ScanCommand = new Command('scan')
  * coexistence **on** first — from that moment Apex plans nothing here — then add
  * workflows as you gain confidence in them. Doing it the other way round leaves
  * a window in which everything runs on both, which is how a publishing workflow
- * nearly pushed the same images twice (control-plane ADR-0046).
+ * nearly pushed the same images twice (api ADR-0046).
  */
 const CoexistCommand = new Command('coexist')
     .description('Run Apex beside GitHub Actions on one repository, opting workflows in one at a time')

package/dist/cli/notify/main.js

@@ -42,7 +42,7 @@ const printDelivery = (d) => {
     const status = `${d.status}${d.httpStatus === undefined ? '' : ` ${String(d.httpStatus)}`}`;
     console.log(`  ${chalk.dim(d.createdAt)}  ${d.ruleName.padEnd(18)} ${d.trigger.padEnd(10)} ${colour(status.padEnd(12))} ${d.attempts > 1 ? chalk.dim(`${String(d.attempts)} attempts`) : ''}`);
     // Somebody else's server's words, so they are printed as data and never
-    // interpreted (control-plane ADR-0029).
+    // interpreted (api ADR-0029).
     if (d.detail !== undefined && d.detail !== '')
         console.log(chalk.dim(`      ${d.detail}`));
 };

package/dist/cli/reference.js

@@ -3,7 +3,7 @@
  * sits in, who it is for, and a few examples a person can copy.
  *
  * `test/cli-reference.test.ts` walks `buildProgram` and writes
- * `docs/feature-docs/cli-reference.json` from the tree plus this table; the
+ * `apps/cli/cli-reference.json` from the tree plus this table; the
  * marketing site renders that file. A top-level command missing from here
  * fails the test, so nothing reaches the site — or escapes it — unclassified.
  *
@@ -11,7 +11,7 @@
  * for.** A customer's credential is an API token carrying the permissions its
  * person chose (`resource:read|write`, write implying read), within one
  * Account, their role there and the Account's token policy (control-plane
- * ADR-0071). A token reaches the control plane's repository routes its grants
+ * api ADR-0071). A token reaches the control plane's repository routes its grants
  * cover, plus its own identity and tokens; every other route — the fleet, the
  * operator's organisation, tenants, billing — answers it 403. So a command is
  * `customer` exactly when every route it calls is a repository or self route in
@@ -49,7 +49,7 @@ export const REFERENCE = {
             },
             { command: 'apex login --browser', description: 'Open a browser on this machine even where the CLI would choose a code.' },
         ],
-        // The operator's sign-in, approved on the Admin Console (control-plane ADR-0079).
+        // The operator's sign-in, approved on the Admin Console (api ADR-0079).
         operatorOptions: ['--console'],
     },
     logout: {
@@ -126,7 +126,7 @@ export const REFERENCE = {
     secret: {
         group: 'config',
         audience: 'customer',
-        // `--org <organization>` asks for organization:read|write in that Organization instead (control-plane ADR-0084).
+        // `--org <organization>` asks for organization:read|write in that Organization instead (api ADR-0084).
         subcommandPermissions: { list: 'secrets:read', set: 'secrets:write', delete: 'secrets:write' },
         examples: [
             { command: 'printf %s "$NPM_TOKEN" | apex secret set NPM_TOKEN --repo acme/web', description: 'Set a secret from a pipe; a value never goes on the command line.' },
@@ -266,7 +266,7 @@ export const REFERENCE = {
     actions: {
         group: 'config',
         audience: 'customer',
-        // An organisation's action policy asks for organization:* in that Organization (control-plane ADR-0084, TASK-0279).
+        // An organisation's action policy asks for organization:* in that Organization (api ADR-0084, TASK-0279).
         subcommandPermissions: { list: 'actions:read', pin: 'administration:write', policy: 'organization:read' },
         examples: [
             { command: 'apex actions list acme/web', description: 'Every action a repository pulls in, least fixed first.' },
@@ -312,6 +312,6 @@ export const REFERENCE = {
     runner: { group: 'runners', audience: OPERATOR },
     terms: { group: 'billing', audience: OPERATOR },
     tenant: { group: 'billing', audience: OPERATOR },
-    // Complimentary access: the operator token `apex login --console` saves writes; no Account token reaches it (control-plane ADR-0079).
+    // Complimentary access: the operator token `apex login --console` saves writes; no Account token reaches it (api ADR-0079).
     grant: { group: 'billing', audience: OPERATOR },
 };

package/dist/cli/secret/shared.js

@@ -6,7 +6,7 @@ import { nameProblem, reachFrom, secretAppFrom } from '../../src/domain/secrets.
 import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
 /** What `--org` says in every subcommand's help. */
 export const ORG_OPTION = ['--org [organization]', 'an organization’s scope, by its GitHub login (bare: the operator organization)'];
-/** `gh secret --app`'s spelling (context TASK-0394): Dependabot's store is handed only to a run Dependabot started. */
+/** `gh secret --app`'s spelling (TASK-0394): Dependabot's store is handed only to a run Dependabot started. */
 export const APP_OPTION = ['--app <app>', 'which store: actions (default) or dependabot, handed only to runs Dependabot started'];
 export const collect = (value, previous) => [...previous, value];
 export const usage = (message) => {

package/dist/cli/tenant/main.js

@@ -20,7 +20,7 @@ const api = () => {
 };
 const departuresCommand = new Command('departures')
     .description('Every tenant that uninstalled, newest first, and when its data is deleted')
-    .option('--repositories', 'repositories removed from an installation that stays, instead (ADR-0069 amendment)')
+    .option('--repositories', 'repositories removed from an installation that stays, instead (api ADR-0069 amendment)')
     .option('--json', 'machine-readable output')
     .action(async (opts) => {
     const client = api();
@@ -62,7 +62,7 @@ const departuresCommand = new Command('departures')
     for (const d of outcome.value)
         console.log(`  ${departureLine(d)}`);
 });
-/** `apex tenant purge --repository <repoId>` (context TASK-0331). */
+/** `apex tenant purge --repository <repoId>` (TASK-0331). */
 const purgeRemovedRepository = async (raw, opts) => {
     const repoId = Number(raw);
     if (!Number.isSafeInteger(repoId) || repoId <= 0) {
@@ -98,7 +98,7 @@ const purgeRemovedRepository = async (raw, opts) => {
 const purgeCommand = new Command('purge')
     .description("Delete one departed tenant's data now, whatever its window — a dry run unless --apply")
     .argument('[installationId]', 'the installation that left')
-    .option('--repository <repoId>', 'a repository removed from an installation that stays, instead (ADR-0069 amendment)')
+    .option('--repository <repoId>', 'a repository removed from an installation that stays, instead (api ADR-0069 amendment)')
     .option('--apply', 'delete it (default: report what would be deleted)')
     .option('--json', 'machine-readable output')
     .action(async (raw, opts) => {
@@ -227,7 +227,7 @@ const installationsCommand = new Command('installations')
     .option('--fresh', 'only installations that never ran, paid or were granted')
     .option('--json', 'machine-readable output')
     .action(async (opts) => {
-    // The operator token `apex login --console` saved reaches this route too (control-plane ADR-0079).
+    // The operator token `apex login --console` saved reaches this route too (api ADR-0079).
     let client;
     try {
         client = new HttpControlPlane({ operator: true });

package/dist/cli/token/main.js

@@ -8,14 +8,14 @@ import { api, collect, usage } from '../secret/shared.js';
 import { approvalFlow, withFlowOptions } from '../login/device.js';
 /**
  * `apex token`: the person's API tokens from the terminal (control-plane
- * ADR-0064, amended 2026-09-27).
+ * api ADR-0064, amended 2026-09-27).
  *
  * `create` asks for the person's approval in the browser, exactly as `apex
  * login` does, and prints the token once — the token alone on stdout, so
  * `$(apex token create …)` captures it, and everything a person reads on
  * stderr. It is never saved, and the CLI's own login is left as it was.
  * A token carries the permissions asked for with `--permission` and belongs
- * to one Account (control-plane ADR-0071).
+ * to one Account (api ADR-0071).
  * `edit` narrows a token at once with whichever credential the CLI has, and
  * widens one only through the same browser approval.
  * `list` and `revoke` use whichever credential the CLI already has.
@@ -25,7 +25,7 @@ import { approvalFlow, withFlowOptions } from '../login/device.js';
 const PERMISSION_HELP = `resource:read or resource:write (write implies read); resource is one of ${TOKEN_RESOURCES.join(', ')}`;
 /**
  * The approval half `create` and a widening `edit` share — the loopback on this machine, or a device code
- * (control-plane ADR-0075). Everything a person reads goes to stderr: stdout is the token's alone.
+ * (api ADR-0075). Everything a person reads goes to stderr: stdout is the token's alone.
  */
 const approvalDeps = (flags, what) => {
     const apiUrl = apiUrlFrom();

package/dist/cli/whoami/main.js

@@ -24,7 +24,7 @@ const credentialLine = (credential) => {
  * credential got it there. The answer is the server's (`GET /api/v1/me`), not
  * a guess from the local file; the credential itself is never printed.
  *
- * It also names any credential that was present and lost (ADR-0005: the
+ * It also names any credential that was present and lost (cli ADR-0005: the
  * environment outranks the saved login), because the surprise this command
  * exists to prevent is acting as somebody other than the one you meant.
  *

package/dist/src/application/authenticate.js

@@ -35,7 +35,7 @@ export const approveInBrowser = async (deps, token, accountId) => {
 /** RFC 8628 §3.2's default when a server names no interval. */
 const DEFAULT_INTERVAL_SECONDS = 5;
 /**
- * The device flow (control-plane ADR-0075, RFC 8628 run by Apex): ask for a request, show the code, and
+ * The device flow (api ADR-0075, RFC 8628 run by Apex): ask for a request, show the code, and
  * poll with the device code — which never leaves this process — every `interval` seconds, slowing down
  * when told, until the person approves or denies on any device, or the code's ten minutes pass.
  */
@@ -113,7 +113,7 @@ export const login = async (deps) => {
     };
 };
 /**
- * `apex login --console` (control-plane ADR-0079): the same loopback + PKCE approval, opened on the Admin
+ * `apex login --console` (api ADR-0079): the same loopback + PKCE approval, opened on the Admin
  * Console's bare page rather than the app's — `deps.webBase` is the Console's — and redeemed at the same
  * control plane, for an **operator token**. Only the loopback: an operator approves in the Console's own
  * browser session. What comes back must be an operator token, or nothing is saved.
@@ -132,7 +132,7 @@ export const consoleLogin = async (deps) => {
 };
 /**
  * Revoke the saved token at the control plane that minted it, then forget it
- * (control-plane ADR-0064: a token may revoke itself and nothing else). The file
+ * (api ADR-0064: a token may revoke itself and nothing else). The file
  * goes either way — keeping a credential because the network was down would be
  * the wrong failure — and a revocation that did not happen is reported as such,
  * never implied.

package/dist/src/application/manage-departures.js

@@ -16,7 +16,7 @@ export const listDepartures = async (api) => await attempt(() => api.departures(
  * left to ask.
  */
 export const purgeDeparture = async (api, installationId, apply) => await attempt(() => api.purgeDeparture(installationId, apply));
-/** Every repository the App was removed from, newest first (control-plane ADR-0069 amendment). */
+/** Every repository the App was removed from, newest first (api ADR-0069 amendment). */
 export const listRepositoryDepartures = async (api) => await attempt(() => api.repositoryDepartures());
 /** Purge one removed repository's data now, whatever its window — a dry run unless `apply`; machine token only. */
 export const purgeRepositoryDeparture = async (api, repoId, apply) => await attempt(() => api.purgeRepositoryDeparture(repoId, apply));

package/dist/src/application/manage-secrets.js

@@ -2,7 +2,7 @@
 import { targetLabel } from '../domain/secrets.js';
 /**
  * Why the unnamed organisation scope refused: it is the operator organisation's
- * (BUG-0112). A customer names theirs — `--org <login>` (ADR-0084) — and that
+ * (BUG-0112). A customer names theirs — `--org <login>` (api ADR-0084) — and that
  * route's refusal explains itself, so it is relayed as worded.
  */
 export const ORG_SCOPE_REFUSAL = 'the bare --org scope is the operator organisation’s — name yours: --org <your-organization>';

package/dist/src/application/manage-terms.js

@@ -12,7 +12,7 @@ const attempt = async (fn) => {
  * The API answers what *this caller* may act for; the CLI authenticates as the
  * machine principal, which administers every account, so an operator sees the
  * whole list. Nothing is classified here — outstanding is the control plane's
- * judgement (control-plane ADR-0039 amendment 1) and a second one would be a
+ * judgement (api ADR-0039 amendment 1) and a second one would be a
  * second answer to a question that must have one.
  */
 export const readTermsStanding = async (api) => await attempt(() => api.termsStanding());

package/dist/src/domain/accounts.js

@@ -1,6 +1,6 @@
 /**
  * The Accounts backfill as the control plane reports it (control-plane
- * `POST /api/v1/console/accounts/backfill`, TASK-0195), and how a person reads it.
+ * `POST /api/v1/office/accounts/backfill`, TASK-0195), and how a person reads it.
  */
 const ORG_VERB = {
     connect: ['would join', 'joined'],

package/dist/src/domain/credentials.js

@@ -1,7 +1,7 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
 /**
  * A customer's terminal credential, and the browser login that mints one
- * (control-plane ADR-0064).
+ * (api ADR-0064).
  *
  * Pure decisions only: where the consent page is, whether a loopback callback
  * is the one this login asked for, whether a file mode is private enough to
@@ -24,10 +24,10 @@ export const describeSource = (source) => {
             return 'the operator token `apex login --console` saved';
     }
 };
-/** An operator token's prefix (control-plane ADR-0079); an Account token's is `apex_pat_`. */
+/** An operator token's prefix (api ADR-0079); an Account token's is `apex_pat_`. */
 export const OPERATOR_TOKEN_PREFIX = 'apex_opt_';
 /**
- * The Admin Console's base URL, where `apex login --console` is approved (control-plane ADR-0079):
+ * The Admin Console's base URL, where `apex login --console` is approved (api ADR-0079):
  * `APEX_CONSOLE_URL` when set, else the API's host with `app.` read as `admin.` — the hosted service's
  * pair — else `undefined`, and the command asks for `APEX_CONSOLE_URL`.
  */
@@ -116,19 +116,19 @@ export const authorizeUrl = (webBase, request) => {
     return `${normaliseUrl(webBase)}/cli/authorize?${query.toString()}`;
 };
 /**
- * Where the loopback callback sends the browser once the code is redeemed (control-plane ADR-0075): the
+ * Where the loopback callback sends the browser once the code is redeemed (api ADR-0075): the
  * web app's bare `/cli/done`, so the tab ends on our domain rather than on this process's `127.0.0.1`.
  * The page is copy only and confirms nothing server-side, so it carries only the outcome and the purpose
  * — never the code, the state or anything else the callback held.
  */
 export const doneUrl = (webBase, outcome, purpose) => `${normaliseUrl(webBase)}/cli/done?${new URLSearchParams({ outcome, purpose }).toString()}`;
-/** A token's lifetime bounds (control-plane ADR-0064): every token expires, 90 days at most. */
+/** A token's lifetime bounds (api ADR-0064): every token expires, 90 days at most. */
 export const MAX_TOKEN_DAYS = 90;
 /** Repositories one token may be held to. */
 export const MAX_TOKEN_REPOS = 100;
 const REPO = /^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/;
 /**
- * What a token may be granted (context ADR-0038): `resource:read|write`, write implying read. The control plane's
+ * What a token may be granted (ADR-0038): `resource:read|write`, write implying read. The control plane's
  * `RepoPermission`, in the order a person reads them.
  */
 export const TOKEN_RESOURCES = ['actions', 'approvals', 'deployments', 'secrets', 'variables', 'environments', 'notifications', 'administration', 'organization'];
@@ -235,7 +235,7 @@ export const judgeCallback = (params, expectedState) => {
 const set = (v) => v !== undefined && v !== '';
 /**
  * Why no browser can open on this machine, in words for the terminal — or `undefined` when one can.
- * ADR-0075's list: an SSH session, a Codespace, a dev container, a container, or Linux with no display.
+ * api ADR-0075's list: an SSH session, a Codespace, a dev container, a container, or Linux with no display.
  */
 export const headlessReason = ({ env, platform, dockerenv }) => {
     if (set(env['SSH_CONNECTION']) || set(env['SSH_TTY']))

package/dist/src/domain/fleet-history.js

@@ -3,7 +3,7 @@
 // How big was the fleet, and when was it nothing?
 //
 // The control plane serves runner *lifetimes* — `registeredAt` to `lastSeenAt`,
-// departed runners included (control-plane ADR-0041). Everything below is the
+// departed runners included (api ADR-0041). Everything below is the
 // pure arithmetic that turns a pile of intervals into the two answers a capacity
 // question actually wants: the peak, and the time at zero. It is here rather
 // than in the control plane so that it can be tested without a server, and so

package/dist/src/domain/grants.js

@@ -1,7 +1,7 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
 /**
- * Complimentary access from the terminal (control-plane ADR-0056 as amended by
- * ADR-0079, TASK-0199): the grant and installation shapes the admin API
+ * Complimentary access from the terminal (api ADR-0056 as amended by
+ * api ADR-0079, TASK-0199): the grant and installation shapes the admin API
  * answers with, the checks `apex grant` makes before a round trip — the
  * control plane makes them again — and how each reads as a line.
  */

package/dist/src/domain/insight.js

@@ -1,6 +1,6 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
 // The REST shapes for "what got slower" and "what is flaky", mirroring
-// control-plane/contracts/openapi.yaml, plus the pure decisions the CLI makes
+// packages/contracts/openapi/openapi.yaml, plus the pure decisions the CLI makes
 // about presenting them.
 /**
  * A duration a person can compare at a glance.

package/dist/src/domain/logsearch.js

@@ -1,6 +1,6 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
 // The REST shapes for a log search and a structured log view, mirroring
-// control-plane/contracts/openapi.yaml, plus the pure decisions the CLI makes
+// packages/contracts/openapi/openapi.yaml, plus the pure decisions the CLI makes
 // about presenting them.
 /**
  * `ci.yml #12 · build` — how a result names the job it found.

package/dist/src/domain/notify.js

@@ -1,10 +1,10 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
 // The REST shapes for notification routing, mirroring
-// control-plane/contracts/openapi.yaml, plus the pure presentation decisions
+// packages/contracts/openapi/openapi.yaml, plus the pure presentation decisions
 // the CLI makes about them.
 //
 // There is no destination URL in any of these types, and that is not an
-// oversight: the control plane never returns one (control-plane ADR-0029), so
+// oversight: the control plane never returns one (api ADR-0029), so
 // a field for it here would be a field that is always empty and would invite
 // somebody to try to fill it.
 export const TRIGGERS = ['broke', 'recovered', 'failed', 'succeeded'];
@@ -38,7 +38,7 @@ export const lastAttemptLine = (rule) => {
  * all is neither, and calling it a rejection points the reader at the
  * destination when the fault is on this side of the socket. It read as Slack
  * turning us away while the real cause was a `TypeError` in our own resolver
- * (control-plane ADR-0036), which is a day of somebody's time in the wrong
+ * (api ADR-0036), which is a day of somebody's time in the wrong
  * logs.
  */
 export const sendOutcomeLine = (outcome) => {
@@ -53,7 +53,7 @@ export const sendOutcomeLine = (outcome) => {
  *
  * Written out because the default subscription is the thing people misread:
  * "broke, recovered" looks like it might mean *every* failure, and it does not
- * (control-plane ADR-0028).
+ * (api ADR-0028).
  */
 export const subscriptionLine = (rule) => {
     const transitions = rule.on.filter((t) => t === 'broke' || t === 'recovered');

package/dist/src/domain/provenance.js

@@ -1,6 +1,6 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
 // The REST shapes for "why did this run" and "how do I run it here", mirroring
-// control-plane/contracts/openapi.yaml, plus the pure decisions the CLI makes
+// packages/contracts/openapi/openapi.yaml, plus the pure decisions the CLI makes
 // about presenting them.
 /**
  * The retry note for one job, or `undefined` when it ran first time.

package/dist/src/domain/runs.js

@@ -1,6 +1,6 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
 // What the CLI knows about runs and jobs, and the pure decisions it makes
-// about them. The REST shapes come from control-plane/contracts/openapi.
+// about them. The REST shapes come from packages/contracts/openapi.
 /** The run's action-policy findings as `apex logs --summary` prints them: where, which job, the policy's sentence. */
 export const policyLines = (run) => (run.policyFindings ?? []).map((f) => `${f.workflowPath}${f.line === undefined || f.line <= 0 ? '' : `:${String(f.line)}`} (job ${f.jobId}): ${f.reason}`);
 /** A run is worth following while anything can still change. */

package/dist/src/domain/spend.js

@@ -1,5 +1,5 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
-// The REST shapes for a spend report, mirroring control-plane/contracts/openapi.yaml,
+// The REST shapes for a spend report, mirroring packages/contracts/openapi/openapi.yaml,
 // plus the pure decisions the CLI makes about presenting money.
 /**
  * Money, at a precision that does not pretend.

package/dist/src/domain/supplychain.js

@@ -1,6 +1,6 @@
 // domain layer — see ../../../../docs/conventions/clean-architecture.md §1
 // The REST shapes for the action supply chain, mirroring
-// control-plane/contracts/openapi.yaml, plus the pure decisions the CLI makes
+// packages/contracts/openapi/openapi.yaml, plus the pure decisions the CLI makes
 // about presenting them. No judgement lives here: whether a reference is
 // allowed is the control plane's answer, and a second implementation would be
 // a second answer.

package/dist/src/infrastructure/binary-install.js

@@ -8,7 +8,7 @@ import { homedir } from 'node:os';
 import { delimiter, dirname, join } from 'node:path';
 import { promisify } from 'node:util';
 /**
- * Where `engine` and `runner` publish their binaries on a release tag (context ADR-0040): one archive per
+ * Where `engine` and `runner` publish their binaries on a release tag (ADR-0040): one archive per
  * platform and a SHA256SUMS file per command, under the lockstep version.
  */
 export const DIST_BASE = 'https://apexactions.com/dl';

package/dist/src/infrastructure/control-plane-http.js

@@ -14,7 +14,7 @@ export class HttpError extends Error {
         this.status = status;
     }
 }
-/** A named Organization's reach, as the API takes it (control-plane ADR-0084); nothing for any other scope. */
+/** A named Organization's reach, as the API takes it (api ADR-0084); nothing for any other scope. */
 /** Dependabot's store is named; the Actions store is the routes' default, so its paths are unchanged (TASK-0394). */
 const appQuery = (target) => (target.app === 'dependabot' ? '?app=dependabot' : '');
 const reachBody = (target, reach) => target.kind === 'org' && target.org !== undefined && reach !== undefined
@@ -23,13 +23,13 @@ const reachBody = (target, reach) => target.kind === 'org' && target.org !== und
 /**
  * Adapter: the control-plane REST API over the platform's `fetch`.
  *
- * The credential is resolved in control-plane ADR-0064's order as this repo's
- * ADR-0005 amends it (see `credentials.ts`): a customer's `APEX_TOKEN`, then
+ * The credential is resolved in api ADR-0064's order as this repo's
+ * cli ADR-0005 amends it (see `credentials.ts`): a customer's `APEX_TOKEN`, then
  * the operator's `APEX_ADMIN_TOKEN` — the machine principal, which keeps
  * scripts and boot paths working when GitHub is unreachable (ADR-0006) — then
  * the token `apex login` saved. The environment outranks the file.
  * A customer token reaches the repository routes its permissions cover, in its
- * Account (control-plane ADR-0071); a route it lacks the grant for answers 403
+ * Account (api ADR-0071); a route it lacks the grant for answers 403
  * `this token needs <permission>`, which this client extends with the edit
  * that would add it.
  *
@@ -69,7 +69,7 @@ export class HttpControlPlane {
     async whoami() {
         return await this.#json('GET', '/api/v1/me');
     }
-    // ── the person's tokens: read and revoke, never mint (ADR-0064, amended 2026-09-27) ──
+    // ── the person's tokens: read and revoke, never mint (api ADR-0064, amended 2026-09-27) ──
     async listTokens() {
         const body = await this.#json('GET', '/api/v1/me/tokens');
         if (!Array.isArray(body.tokens))
@@ -235,7 +235,7 @@ export class HttpControlPlane {
      * The terms in force and who owes an acceptance, read from `/me`.
      *
      * It rides on `/me` in the API because the remedy is at somebody's next
-     * sign-in and that is the call every screen makes (control-plane ADR-0039
+     * sign-in and that is the call every screen makes (api ADR-0039
      * amendment 1); here it means one request answers both halves.
      */
     async termsStanding() {
@@ -247,23 +247,23 @@ export class HttpControlPlane {
         return body.accepted;
     }
     async departures() {
-        return (await this.#json('GET', '/api/v1/console/departures')).departures;
+        return (await this.#json('GET', '/api/v1/office/departures')).departures;
     }
     async purgeDeparture(installationId, apply) {
         return await this.#json('POST', `/api/v1/departures/${installationId}/purge${apply ? '?apply=true' : ''}`);
     }
     async repositoryDepartures() {
-        return (await this.#json('GET', '/api/v1/console/repository-departures')).departures;
+        return (await this.#json('GET', '/api/v1/office/repository-departures')).departures;
     }
     async purgeRepositoryDeparture(repoId, apply) {
         return await this.#json('POST', `/api/v1/repository-departures/${repoId}/purge${apply ? '?apply=true' : ''}`);
     }
     async accountsBackfill(input, apply) {
-        return await this.#json('POST', `/api/v1/console/accounts/backfill${apply ? '?apply=true' : ''}`, input);
+        return await this.#json('POST', `/api/v1/office/accounts/backfill${apply ? '?apply=true' : ''}`, input);
     }
-    // ── complimentary access (control-plane ADR-0056, ADR-0079): the admin API's shapes, unchanged ──
+    // ── complimentary access (api ADR-0056, api ADR-0079): the admin API's shapes, unchanged ──
     /**
-     * Every grant. The list is paged since context TASK-0241 (control-plane ADR-0081), so this follows `page.nextCursor`
+     * Every grant. The list is paged since TASK-0241 (api ADR-0081), so this follows `page.nextCursor`
      * to the end; a control plane from before the grammar answers everything and no `page`, which ends the loop at once.
      */
     async listGrants() {
@@ -273,7 +273,7 @@ export class HttpControlPlane {
             const query = new URLSearchParams({ limit: '200' });
             if (cursor !== undefined)
                 query.set('cursor', cursor);
-            const body = await this.#json('GET', `/api/v1/console/grants?${query.toString()}`);
+            const body = await this.#json('GET', `/api/v1/office/grants?${query.toString()}`);
             all.push(...body.grants);
             cursor = body.page?.nextCursor;
             if (cursor === undefined)
@@ -282,22 +282,22 @@ export class HttpControlPlane {
         return all;
     }
     async createGrant(body) {
-        return await this.#json('POST', '/api/v1/console/grants', body);
+        return await this.#json('POST', '/api/v1/office/grants', body);
     }
     async updateGrant(id, body) {
-        return (await this.#json('PATCH', `/api/v1/console/grants/${encodeURIComponent(id)}`, body)).grant;
+        return (await this.#json('PATCH', `/api/v1/office/grants/${encodeURIComponent(id)}`, body)).grant;
     }
     async revokeGrant(id) {
-        return await this.#json('DELETE', `/api/v1/console/grants/${encodeURIComponent(id)}`);
+        return await this.#json('DELETE', `/api/v1/office/grants/${encodeURIComponent(id)}`);
     }
     async listInstallations() {
-        return (await this.#json('GET', '/api/v1/console/installations')).installations;
+        return (await this.#json('GET', '/api/v1/office/installations')).installations;
     }
     async accountsUnconnected() {
-        return (await this.#json('GET', '/api/v1/console/accounts/unconnected')).installations;
+        return (await this.#json('GET', '/api/v1/office/accounts/unconnected')).installations;
     }
     async accountsConnect(input) {
-        return await this.#json('POST', '/api/v1/console/accounts/connect', input);
+        return await this.#json('POST', '/api/v1/office/accounts/connect', input);
     }
     async actionPolicy(owner) {
         return await this.#json('GET', `/api/v1/orgs/${encodeURIComponent(owner)}/action-policy`);
@@ -382,7 +382,7 @@ export class HttpControlPlane {
         return await this.#json('GET', `/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/coexistence/diff?${q.toString()}`);
     }
     /**
-     * Every live runner. The list is paged since control-plane ADR-0081, so this follows `page.nextCursor` to the end —
+     * Every live runner. The list is paged since api ADR-0081, so this follows `page.nextCursor` to the end —
      * `apex runner list` means all of them, and the fleet alone can hold more than one page. A control plane from before
      * the grammar answers everything and no `page`, which ends the loop at once.
      */
@@ -434,7 +434,7 @@ export class HttpControlPlane {
         return await this.#json('GET', `/api/v1/runs/${encodeURIComponent(runId)}/artifacts`);
     }
     /**
-     * Every artifact a repository holds. The list is paged since control-plane ADR-0081 (context TASK-0228), so this
+     * Every artifact a repository holds. The list is paged since api ADR-0081 (TASK-0228), so this
      * follows `page.nextCursor` to the end; before, the list stopped at 200 without saying so. The total is the API's,
      * over every artifact. A control plane from before the grammar answers one page and no `page`, which ends the loop.
      */

package/dist/src/infrastructure/credentials.js

@@ -38,7 +38,7 @@ export class InsecureCredentialsError extends NotConfiguredError {
 export const credentialsPath = (env = process.env) => join(set(env['XDG_CONFIG_HOME']) ? env['XDG_CONFIG_HOME'] : join(homedir(), '.config'), 'apex', 'credentials');
 /**
  * `$XDG_CONFIG_HOME/apex/console-credentials`: where `apex login --console` keeps the operator token
- * (control-plane ADR-0079) — beside the Account login, never in place of it.
+ * (api ADR-0079) — beside the Account login, never in place of it.
  */
 export const consoleCredentialsPath = (env = process.env) => join(dirname(credentialsPath(env)), 'console-credentials');
 /**
@@ -105,8 +105,8 @@ export class FileCredentialStore {
     }
 }
 /**
- * Which credential the CLI uses (control-plane ADR-0064's order, amended by
- * this repo's ADR-0005 — the environment outranks the file):
+ * Which credential the CLI uses (api ADR-0064's order, amended by
+ * cli ADR-0005 — the environment outranks the file):
  *
  * 1. `APEX_TOKEN` — a dashboard token, for CI and scripts;
  * 2. `APEX_ADMIN_TOKEN` — the operator's. An explicitly exported variable is
@@ -162,7 +162,7 @@ export const resolveCredential = (env = process.env, store = new FileCredentialS
 };
 /**
  * Which credential an operator command — `apex grant`, `apex tenant installations` — uses (control-plane
- * ADR-0079): the operator token `apex login --console` saved, when it is private, unexpired and was minted by
+ * api ADR-0079): the operator token `apex login --console` saved, when it is private, unexpired and was minted by
  * the control plane `APEX_API_URL` names; otherwise the ordinary order ({@link resolveCredential}), in which
  * the machine token can read grants and is refused every write. An expired operator token is skipped, and
  * the refusal that follows says to sign in again.

package/dist/src/infrastructure/device-login.js

@@ -4,7 +4,7 @@ import { hostname, platform, release, type } from 'node:os';
 import { headlessReason, isDevicePollError, normaliseUrl } from '../domain/credentials.js';
 import { redeemedFrom } from './loopback-login.js';
 /**
- * The device flow's adapters (control-plane ADR-0075): the two calls, what this machine says about
+ * The device flow's adapters (api ADR-0075): the two calls, what this machine says about
  * itself, and whether a browser can open here at all.
  */
 /** Why no browser can open here, read from this process's environment; `undefined` when one can. */

package/dist/src/infrastructure/loopback-login.js

@@ -5,7 +5,7 @@ import { createServer } from 'node:http';
 import { judgeCallback, normaliseUrl } from '../domain/credentials.js';
 /**
  * Adapters for `apex login`: the PKCE pair, the loopback listener, the
- * browser, and the code exchange (RFC 8252, RFC 7636; control-plane ADR-0064).
+ * browser, and the code exchange (RFC 8252, RFC 7636; api ADR-0064).
  */
 /** base64url(sha256(verifier)) — RFC 7636's S256. */
 export const s256 = (verifier) => createHash('sha256').update(verifier, 'ascii').digest('base64url');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apex-actions/cli",
-  "version": "0.95.2",
+  "version": "0.97.0",
   "license": "SEE LICENSE IN LICENSE",
   "//files": "Without this npm ships src, test and the CI config alongside the binary a user installs.",
   "files": [
@@ -13,7 +13,8 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Apex-Actions/cli.git"
+    "url": "git+https://github.com/Apex-Actions/apex-actions.git",
+    "directory": "apps/cli"
   },
   "description": "apex — developer and operator CLI for Apex Actions",
   "type": "module",
@@ -33,16 +34,11 @@
     "@types/node": "^24.0.0",
     "dependency-cruiser": "^16.10.0",
     "eslint": "^9.28.0",
-    "husky": "^9.1.7",
-    "lint-staged": "^16.1.0",
     "tsx": "^4.19.4",
     "typescript": "^5.8.3",
     "typescript-eslint": "^8.67.0",
     "vitest": "^3.2.0"
   },
-  "lint-staged": {
-    "*.ts": "eslint --max-warnings=0"
-  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",