@automagik/omni 2.260907.5 → 2.260907.6

package/dist/commands/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAySpC,wBAAgB,iBAAiB,IAAI,OAAO,CA6J3C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAySpC,wBAAgB,iBAAiB,IAAI,OAAO,CA+J3C"}

package/dist/commands/multitenancy.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Multitenancy Commands (read-only; issue #982)
+ *
+ * omni multitenancy status - Show the server's tenancy posture
+ *
+ * STRICTLY VISIBILITY, BY DESIGN
+ * ------------------------------
+ * There is deliberately no `enable`, no cutover, and no write of any kind
+ * here: production cutover is receipt-gated and belongs to the separate
+ * private production authority. `status` wraps the posture the server already
+ * reports on the authenticated `POST /auth/validate` surface — it issues no
+ * additional server-side queries.
+ *
+ * A server that reports no posture is itself an answer: it predates posture
+ * reporting (and therefore the tenant control plane), which is one of the
+ * three states an operator staring at a `/api/v2/platform` 404 needs to tell
+ * apart. That case prints an explanation rather than fabricated defaults.
+ */
+import { Command } from 'commander';
+export declare function createMultitenancyCommand(): Command;
+//# sourceMappingURL=multitenancy.d.ts.map

package/dist/commands/multitenancy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multitenancy.d.ts","sourceRoot":"","sources":["../../src/commands/multitenancy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,yBAAyB,IAAI,OAAO,CAgCnD"}

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsLpC,wBAAgB,mBAAmB,IAAI,OAAO,CAU7C"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyLpC,wBAAgB,mBAAmB,IAAI,OAAO,CAU7C"}

package/dist/commands/tenants.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Platform Tenant Control-Plane Commands (`omni tenants`)
+ *
+ * Tenant lifecycle (list/get/create/suspend/archive) and memberships
+ * (list/add/disable/status/role) over the platform control plane
+ * (issue #981; wish: omni-full-multitenancy, Group G1; ADR-0005).
+ *
+ * Every command carries an audited `--reason` and refuses to run without it —
+ * the server enforces the same rule (reads validate the `x-platform-reason`
+ * header, mutations validate body `reason`), but a local check turns a
+ * validation 400 into an actionable message before any request is sent.
+ *
+ * The control plane is feature-flagged server-side: when
+ * `OMNI_MULTITENANCY_ENABLED` is not `true` the whole surface 404s, and only
+ * PLATFORM-class credentials are accepted. Both failure modes are rendered as
+ * explanations, not raw HTTP dumps.
+ *
+ * The `keys issue-root` subcommand is intentionally absent — the route ships
+ * separately (#979) and the subcommand follows it.
+ */
+import { type OmniClient } from '@omni/sdk';
+import { Command } from 'commander';
+interface ReasonOption {
+    reason?: string;
+}
+interface CreateOptions extends ReasonOption {
+    slug: string;
+    name: string;
+    maxKeyTtl: number;
+    maxKeyRate: number;
+    maxKeyBudget: number;
+}
+interface MembershipAddOptions extends ReasonOption {
+    principal: string;
+    role: string;
+}
+interface MembershipStatusOptions extends ReasonOption {
+    status: string;
+}
+interface MembershipRoleOptions extends ReasonOption {
+    role: string;
+}
+/**
+ * Enforce the audited `--reason` before any request is sent. The server
+ * requires 3-500 characters; mirroring the bounds here keeps the refusal
+ * local, immediate, and explained.
+ */
+declare function requireReason(reason: string | undefined, action: string): string;
+/**
+ * Render a control-plane failure as an explanation, not a raw HTTP dump.
+ *
+ * - An "Endpoint not found" 404 means the surface is unmounted: multitenancy
+ *   is disabled (`OMNI_MULTITENANCY_ENABLED`) or the server predates the
+ *   control plane. Any other 404 is a genuine missing tenant/membership
+ *   (the API is deliberately non-enumerating there).
+ * - 401/403 mean the configured key is not a PLATFORM-class credential with
+ *   the required scope — tenant and legacy data-plane keys are denied by
+ *   design, so "log in harder" is not the fix; a platform credential is.
+ */
+declare function renderPlatformError(err: unknown, action: string): never;
+declare function handleList(client: OmniClient, options: ReasonOption): Promise<void>;
+declare function handleGet(client: OmniClient, id: string, options: ReasonOption): Promise<void>;
+declare function handleCreate(client: OmniClient, options: CreateOptions): Promise<void>;
+declare function handleSuspend(client: OmniClient, id: string, options: ReasonOption): Promise<void>;
+declare function handleArchive(client: OmniClient, id: string, options: ReasonOption): Promise<void>;
+declare function handleMembershipsList(client: OmniClient, tenantId: string, options: ReasonOption): Promise<void>;
+declare function handleMembershipsAdd(client: OmniClient, tenantId: string, options: MembershipAddOptions): Promise<void>;
+declare function handleMembershipsDisable(client: OmniClient, tenantId: string, membershipId: string, options: ReasonOption): Promise<void>;
+declare function handleMembershipsStatus(client: OmniClient, tenantId: string, membershipId: string, options: MembershipStatusOptions): Promise<void>;
+declare function handleMembershipsRole(client: OmniClient, tenantId: string, membershipId: string, options: MembershipRoleOptions): Promise<void>;
+export declare function createTenantsCommand(): Command;
+/**
+ * Exported for tests — lets us exercise reason enforcement, SDK-call mapping,
+ * and control-plane error rendering without reaching into Commander internals.
+ */
+export declare const __testables: {
+    requireReason: typeof requireReason;
+    renderPlatformError: typeof renderPlatformError;
+    handleList: typeof handleList;
+    handleGet: typeof handleGet;
+    handleCreate: typeof handleCreate;
+    handleSuspend: typeof handleSuspend;
+    handleArchive: typeof handleArchive;
+    handleMembershipsList: typeof handleMembershipsList;
+    handleMembershipsAdd: typeof handleMembershipsAdd;
+    handleMembershipsDisable: typeof handleMembershipsDisable;
+    handleMembershipsStatus: typeof handleMembershipsStatus;
+    handleMembershipsRole: typeof handleMembershipsRole;
+};
+export {};
+//# sourceMappingURL=tenants.d.ts.map

package/dist/commands/tenants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenants.d.ts","sourceRoot":"","sources":["../../src/commands/tenants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAgB,KAAK,UAAU,EAAsD,MAAM,WAAW,CAAC;AAC9G,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,UAAU,YAAY;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,UAAU,aAAc,SAAQ,YAAY;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,UAAU,oBAAqB,SAAQ,YAAY;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,uBAAwB,SAAQ,YAAY;IACpD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,qBAAsB,SAAQ,YAAY;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AA0BD;;;;GAIG;AACH,iBAAS,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMzE;AAgBD;;;;;;;;;;GAUG;AACH,iBAAS,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAchE;AA8BD,iBAAe,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlF;AAED,iBAAe,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7F;AAED,iBAAe,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrF;AAED,iBAAe,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjG;AAED,iBAAe,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjG;AAMD,iBAAe,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAO/G;AAED,iBAAe,oBAAoB,CACjC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CASf;AAED,iBAAe,wBAAwB,CACrC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,iBAAe,uBAAuB,CACpC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,iBAAe,qBAAqB,CAClC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAKf;AAQD,wBAAgB,oBAAoB,IAAI,OAAO,CAqJ9C;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;CAavB,CAAC"}

package/dist/index.js

@@ -135777,6 +135777,132 @@ function createOmniClient(config) {
           throw OmniApiError.from(await resp.json(), resp.status);
       }
     },
+    platform: {
+      tenants: {
+        async list(reason) {
+          const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants`, {
+            headers: { "x-platform-reason": reason }
+          });
+          const json = await resp.json();
+          if (!resp.ok)
+            throw OmniApiError.from(json, resp.status);
+          return { items: json?.items ?? [] };
+        },
+        async get(id, reason) {
+          const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants/${id}`, {
+            headers: { "x-platform-reason": reason }
+          });
+          const json = await resp.json();
+          if (!resp.ok)
+            throw OmniApiError.from(json, resp.status);
+          if (!json?.data)
+            throw new OmniApiError("Tenant not found", "NOT_FOUND", undefined, 404);
+          return json.data;
+        },
+        async create(body) {
+          const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body)
+          });
+          const json = await resp.json();
+          if (!resp.ok)
+            throw OmniApiError.from(json, resp.status);
+          if (!json?.data)
+            throw new OmniApiError("Failed to create tenant", "CREATE_FAILED", undefined, resp.status);
+          return json.data;
+        },
+        async suspend(id, reason) {
+          const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants/${id}/suspend`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ reason })
+          });
+          const json = await resp.json();
+          if (!resp.ok)
+            throw OmniApiError.from(json, resp.status);
+          if (!json?.data)
+            throw new OmniApiError("Failed to suspend tenant", "SUSPEND_FAILED", undefined, resp.status);
+          return json.data;
+        },
+        async archive(id, reason) {
+          const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants/${id}/archive`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ reason })
+          });
+          const json = await resp.json();
+          if (!resp.ok)
+            throw OmniApiError.from(json, resp.status);
+          if (!json?.data)
+            throw new OmniApiError("Failed to archive tenant", "ARCHIVE_FAILED", undefined, resp.status);
+          return json.data;
+        },
+        memberships: {
+          async list(tenantId, reason) {
+            const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants/${tenantId}/memberships`, {
+              headers: { "x-platform-reason": reason }
+            });
+            const json = await resp.json();
+            if (!resp.ok)
+              throw OmniApiError.from(json, resp.status);
+            return { items: json?.items ?? [] };
+          },
+          async attach(tenantId, body) {
+            const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants/${tenantId}/memberships`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify(body)
+            });
+            const json = await resp.json();
+            if (!resp.ok)
+              throw OmniApiError.from(json, resp.status);
+            if (!json?.data)
+              throw new OmniApiError("Failed to attach membership", "ATTACH_FAILED", undefined, resp.status);
+            return json.data;
+          },
+          async disable(tenantId, membershipId, reason) {
+            const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants/${tenantId}/memberships/${membershipId}/disable`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ reason })
+            });
+            const json = await resp.json();
+            if (!resp.ok)
+              throw OmniApiError.from(json, resp.status);
+            if (!json?.data)
+              throw new OmniApiError("Failed to disable membership", "DISABLE_FAILED", undefined, resp.status);
+            return json.data;
+          },
+          async setStatus(tenantId, membershipId, status, reason) {
+            const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants/${tenantId}/memberships/${membershipId}/status`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ status, reason })
+            });
+            const json = await resp.json();
+            if (!resp.ok)
+              throw OmniApiError.from(json, resp.status);
+            if (!json?.data)
+              throw new OmniApiError("Failed to set membership status", "STATUS_FAILED", undefined, resp.status);
+            return json.data;
+          },
+          async setRole(tenantId, membershipId, role, reason) {
+            const resp = await apiFetch(`${baseUrl}/api/v2/platform/tenants/${tenantId}/memberships/${membershipId}/role`, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ role, reason })
+            });
+            const json = await resp.json();
+            if (!resp.ok)
+              throw OmniApiError.from(json, resp.status);
+            if (!json?.data)
+              throw new OmniApiError("Failed to set membership role", "ROLE_FAILED", undefined, resp.status);
+            return json.data;
+          }
+        }
+      }
+    },
     context: {
       async get() {
         const resp = await apiFetch(`${baseUrl}/api/v2/context`, {});
@@ -136392,7 +136518,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260907.5",
+  version: "2.260907.6",
   repository: {
     type: "git",
     url: "git+https://github.com/automagik-dev/omni.git",
@@ -137598,6 +137724,20 @@ function credentialStatusFields(auth) {
     delegationDepth: credential.delegationDepth
   };
 }
+function serverPostureFields(auth) {
+  const posture = auth.server;
+  if (!posture)
+    return {};
+  const fields = {
+    serverMultitenancy: posture.multitenancyEnabled ? "enabled" : "disabled",
+    serverControlPlane: posture.controlPlaneMounted ? "mounted" : "not mounted",
+    serverDbEnforcement: posture.dbEnforcement
+  };
+  if (posture.multitenancyEnabled && posture.dbEnforcement === "legacy") {
+    fields.tenancyWarning = "isolation not enforced: multitenancy is enabled but DB enforcement is legacy \u2014 the tenant boundary is advisory only (migration state)";
+  }
+  return fields;
+}
 
 // src/commands/auth.ts
 init_output();
@@ -138292,6 +138432,7 @@ one, or the entry named by the global flag:
         keyPrefix: result.keyPrefix,
         scopes: result.scopes,
         ...credentialStatusFields(result),
+        ...serverPostureFields(result),
         configDir: getConfigDir()
       });
     } catch (err) {
@@ -146496,6 +146637,30 @@ async function handleCloseContact(options) {
   }
 }
 
+// src/commands/multitenancy.ts
+init_output();
+function createMultitenancyCommand() {
+  const multitenancy = new Command("multitenancy").description("Multitenancy posture (read-only)");
+  multitenancy.command("status").description("Show the server's multitenancy flag, control plane, and DB enforcement posture").action(async () => {
+    const client = getClient();
+    try {
+      const result = await client.auth.validate();
+      if (!result.server) {
+        data({
+          posture: "unreported",
+          note: "This server does not report tenancy posture \u2014 it predates posture reporting " + "(and likely the tenant control plane). Platform commands will 404 regardless of flags. " + "Upgrade the server to get posture visibility."
+        });
+        return;
+      }
+      data(serverPostureFields(result));
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to read server posture: ${message2}`, undefined, 2);
+    }
+  });
+  return multitenancy;
+}
+
 // src/commands/music.ts
 import { writeFileSync as writeFileSync9 } from "fs";
 import { resolve as resolvePath2 } from "path";
@@ -149603,6 +149768,7 @@ async function validateAuthKey(statusInfo, client) {
     statusInfo.keyPrefix = auth.keyPrefix;
     statusInfo.scopes = auth.scopes;
     Object.assign(statusInfo, credentialStatusFields(auth));
+    Object.assign(statusInfo, serverPostureFields(auth));
   } catch {
     statusInfo.keyValid = false;
   }
@@ -149674,6 +149840,233 @@ function createStopCommand() {
   return new Command("stop").description("Stop all omni PM2 processes").action(runStop);
 }
 
+// src/commands/tenants.ts
+init_output();
+var TENANT_ROLES = ["tenant-owner", "tenant-admin", "tenant-operator", "tenant-viewer"];
+var MEMBERSHIP_STATUSES = ["active", "disabled"];
+var REASON_REQUIRED_HINT = "Every platform control-plane call is audited; " + 'provide a justification of 3-500 characters, e.g. --reason "onboarding request OPS-1421".';
+var CONTROL_PLANE_UNAVAILABLE = "the platform control plane is not available on this server. " + "Either multitenancy is disabled (start the API with OMNI_MULTITENANCY_ENABLED=true) " + "or the server predates the tenant control plane \u2014 upgrade it.";
+var CREDENTIAL_REJECTED_401 = "the server rejected the credential (401). " + "The platform control plane accepts only PLATFORM-class credentials \u2014 legacy admin/god keys and " + "tenant data-plane keys are denied by design. Authenticate with a platform key: " + "omni auth login --api-key <platform-key>.";
+var CREDENTIAL_FORBIDDEN_403 = "the credential authenticated but is not allowed (403). " + "A PLATFORM-class credential with the matching platform:* scope is required \u2014 tenant-class " + "credentials can never reach the control plane, and platform keys act only within their scopes.";
+function requireReason(reason, action) {
+  const trimmed = reason?.trim() ?? "";
+  if (trimmed.length < 3 || trimmed.length > 500) {
+    error(`--reason is required to ${action}. ${REASON_REQUIRED_HINT}`, undefined, 1);
+  }
+  return trimmed;
+}
+function parseRole(value) {
+  if (!TENANT_ROLES.includes(value)) {
+    error(`Invalid --role "${value}". Valid roles: ${TENANT_ROLES.join(", ")}`, undefined, 1);
+  }
+  return value;
+}
+function parseStatus(value) {
+  if (!MEMBERSHIP_STATUSES.includes(value)) {
+    error(`Invalid --status "${value}". Valid statuses: ${MEMBERSHIP_STATUSES.join(", ")}`, undefined, 1);
+  }
+  return value;
+}
+function renderPlatformError(err2, action) {
+  if (err2 instanceof OmniApiError) {
+    if (err2.status === 404 && err2.message.startsWith("Endpoint not found")) {
+      error(`Failed to ${action}: ${CONTROL_PLANE_UNAVAILABLE}`, undefined, 1);
+    }
+    if (err2.status === 401) {
+      error(`Failed to ${action}: ${CREDENTIAL_REJECTED_401}`, undefined, 1);
+    }
+    if (err2.status === 403) {
+      error(`Failed to ${action}: ${CREDENTIAL_FORBIDDEN_403}`, undefined, 1);
+    }
+  }
+  const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+  error(`Failed to ${action}: ${message2}`);
+}
+function formatTenantRow(tenant) {
+  return {
+    id: tenant.id,
+    slug: tenant.slug,
+    name: tenant.displayName,
+    status: tenant.status,
+    keyTtl: tenant.maxKeyTtlSeconds,
+    keyRate: tenant.maxKeyRateLimit,
+    keyBudget: tenant.maxKeyBudget,
+    created: new Date(tenant.createdAt).toLocaleDateString()
+  };
+}
+function formatMembershipRow(membership) {
+  return {
+    id: membership.id,
+    principal: membership.principalId,
+    role: membership.role,
+    status: membership.status,
+    invitedBy: membership.invitedByPrincipalId ?? "-",
+    created: new Date(membership.createdAt).toLocaleDateString()
+  };
+}
+async function handleList5(client, options3) {
+  const reason = requireReason(options3.reason, "list tenants");
+  const result = await client.platform.tenants.list(reason);
+  list(result.items.map(formatTenantRow), {
+    emptyMessage: "No tenants found.",
+    rawData: result.items
+  });
+}
+async function handleGet3(client, id, options3) {
+  const reason = requireReason(options3.reason, "read a tenant");
+  const tenant = await client.platform.tenants.get(id, reason);
+  data(tenant);
+}
+async function handleCreate4(client, options3) {
+  const reason = requireReason(options3.reason, "create a tenant");
+  const tenant = await client.platform.tenants.create({
+    slug: options3.slug,
+    displayName: options3.name,
+    maxKeyTtlSeconds: options3.maxKeyTtl,
+    maxKeyRateLimit: options3.maxKeyRate,
+    maxKeyBudget: options3.maxKeyBudget,
+    reason
+  });
+  success(`Tenant created: ${tenant.slug} (${tenant.id})`);
+  data(tenant);
+}
+async function handleSuspend(client, id, options3) {
+  const reason = requireReason(options3.reason, "suspend a tenant");
+  const tenant = await client.platform.tenants.suspend(id, reason);
+  success(`Tenant suspended: ${tenant.slug} (${tenant.id})`);
+  info(`Reason: ${reason}`);
+}
+async function handleArchive(client, id, options3) {
+  const reason = requireReason(options3.reason, "archive a tenant");
+  const tenant = await client.platform.tenants.archive(id, reason);
+  success(`Tenant archived: ${tenant.slug} (${tenant.id})`);
+  warn("Archived is terminal \u2014 there is no un-archive and no hard delete.");
+  info(`Reason: ${reason}`);
+}
+async function handleMembershipsList(client, tenantId, options3) {
+  const reason = requireReason(options3.reason, "list memberships");
+  const result = await client.platform.tenants.memberships.list(tenantId, reason);
+  list(result.items.map(formatMembershipRow), {
+    emptyMessage: "No memberships found.",
+    rawData: result.items
+  });
+}
+async function handleMembershipsAdd(client, tenantId, options3) {
+  const reason = requireReason(options3.reason, "attach a membership");
+  const role = parseRole(options3.role);
+  const membership = await client.platform.tenants.memberships.attach(tenantId, {
+    principalId: options3.principal,
+    role,
+    reason
+  });
+  success(`Membership attached: ${membership.principalId} as ${membership.role} (${membership.id})`);
+}
+async function handleMembershipsDisable(client, tenantId, membershipId, options3) {
+  const reason = requireReason(options3.reason, "disable a membership");
+  const membership = await client.platform.tenants.memberships.disable(tenantId, membershipId, reason);
+  success(`Membership disabled: ${membership.id}`);
+  info(`Reason: ${reason}`);
+}
+async function handleMembershipsStatus(client, tenantId, membershipId, options3) {
+  const reason = requireReason(options3.reason, "set a membership status");
+  const status = parseStatus(options3.status);
+  const membership = await client.platform.tenants.memberships.setStatus(tenantId, membershipId, status, reason);
+  success(`Membership ${membership.id} status set to ${membership.status}`);
+}
+async function handleMembershipsRole(client, tenantId, membershipId, options3) {
+  const reason = requireReason(options3.reason, "set a membership role");
+  const role = parseRole(options3.role);
+  const membership = await client.platform.tenants.memberships.setRole(tenantId, membershipId, role, reason);
+  success(`Membership ${membership.id} role set to ${membership.role}`);
+}
+var REASON_HELP = "Audited justification (required, 3-500 chars)";
+function createTenantsCommand() {
+  const tenants2 = new Command("tenants").description("Platform tenant control plane (requires a PLATFORM-class credential and OMNI_MULTITENANCY_ENABLED=true)");
+  tenants2.command("list").description("List tenants, newest first (the read itself is audited)").option("--reason <text>", REASON_HELP).action(async (options3) => {
+    const client = getClient();
+    try {
+      await handleList5(client, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "list tenants");
+    }
+  });
+  tenants2.command("get <id>").description("Get one tenant by id").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
+    const client = getClient();
+    try {
+      await handleGet3(client, id, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "get the tenant");
+    }
+  });
+  tenants2.command("create").description("Create a tenant with its mandatory credential ceilings").requiredOption("--slug <slug>", "Immutable lowercase DNS-like slug (e.g. acme)").requiredOption("--name <name>", "Human-readable tenant name").requiredOption("--max-key-ttl <seconds>", "Ceiling for credential TTL, in seconds", Number.parseInt).requiredOption("--max-key-rate <n>", "Ceiling for credential rate limit", Number.parseInt).requiredOption("--max-key-budget <n>", "Ceiling for credential budget", Number.parseInt).option("--reason <text>", REASON_HELP).action(async (options3) => {
+    const client = getClient();
+    try {
+      await handleCreate4(client, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "create the tenant");
+    }
+  });
+  tenants2.command("suspend <id>").description("Suspend a tenant (bumps its revocation epoch, invalidating tenant credentials)").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
+    const client = getClient();
+    try {
+      await handleSuspend(client, id, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "suspend the tenant");
+    }
+  });
+  tenants2.command("archive <id>").description("Archive a tenant (TERMINAL \u2014 no un-archive, no hard delete)").option("--reason <text>", REASON_HELP).action(async (id, options3) => {
+    const client = getClient();
+    try {
+      await handleArchive(client, id, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "archive the tenant");
+    }
+  });
+  const memberships = new Command("memberships").description("Manage tenant memberships");
+  memberships.command("list <tenant-id>").description("List the memberships of one tenant (the read itself is audited)").option("--reason <text>", REASON_HELP).action(async (tenantId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsList(client, tenantId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "list memberships");
+    }
+  });
+  memberships.command("add <tenant-id>").description("Grant a principal a role in the tenant").requiredOption("--principal <uuid>", "Principal to grant access to").requiredOption("--role <role>", `Tenant role: ${TENANT_ROLES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsAdd(client, tenantId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "attach the membership");
+    }
+  });
+  memberships.command("disable <tenant-id> <membership-id>").description("Disable a membership (memberships are never hard-deleted)").option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsDisable(client, tenantId, membershipId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "disable the membership");
+    }
+  });
+  memberships.command("status <tenant-id> <membership-id>").description("Activate or disable an existing membership").requiredOption("--status <status>", `New status: ${MEMBERSHIP_STATUSES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsStatus(client, tenantId, membershipId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "set the membership status");
+    }
+  });
+  memberships.command("role <tenant-id> <membership-id>").description("Change the role an existing membership acts under").requiredOption("--role <role>", `New role: ${TENANT_ROLES.join(" | ")}`).option("--reason <text>", REASON_HELP).action(async (tenantId, membershipId, options3) => {
+    const client = getClient();
+    try {
+      await handleMembershipsRole(client, tenantId, membershipId, options3);
+    } catch (err2) {
+      renderPlatformError(err2, "set the membership role");
+    }
+  });
+  tenants2.addCommand(memberships);
+  return tenants2;
+}
+
 // src/commands/trust.ts
 import { hostname as osHostname } from "os";
 init_config();
@@ -149733,7 +150126,7 @@ function formatHostRow(host) {
     status: host.revokedAt ? "revoked" : "active"
   };
 }
-async function handleList5() {
+async function handleList6() {
   try {
     const { items } = await callApi("GET", "/hosts");
     list(items.map(formatHostRow), {
@@ -149744,7 +150137,7 @@ async function handleList5() {
     error(`Failed to list genie hosts: ${err2 instanceof Error ? err2.message : "Unknown error"}`);
   }
 }
-async function handleGet3(id) {
+async function handleGet4(id) {
   try {
     const { data: data2 } = await callApi("GET", `/hosts/${encodeURIComponent(id)}`);
     data(data2);
@@ -149847,8 +150240,8 @@ Signing is per-server: only servers you have handshaken against recognize this
 keypair, so calls to other entries stay bearer-only. Bind another one with:
   omni trust handshake --server <name>
 `).option("--rotate", "Issue a new keypair even if one already exists (unbinds every previously bound server)").option("--hostname <name>", "Override the hostname reported to omni (defaults to os.hostname())").action(handleHandshake);
-  trust.command("list").description("List active (non-revoked) genie hosts").action(handleList5);
-  trust.command("get <id>").description("Show details for one genie host (active or revoked)").action(handleGet3);
+  trust.command("list").description("List active (non-revoked) genie hosts").action(handleList6);
+  trust.command("get <id>").description("Show details for one genie host (active or revoked)").action(handleGet4);
   trust.command("update <id>").description("Replace a genie host scopes (comma-separated)").requiredOption("--scope <list>", 'Comma-separated scope list, e.g. "agents:write,providers:write"').action(handleUpdate3);
   trust.command("revoke <id>").description("Revoke a genie host (irreversible \u2014 re-register with a fresh keypair to restore trust)").action(handleRevoke2);
   return trust;
@@ -151718,6 +152111,12 @@ var COMMANDS = [
     helpGroup: "Management",
     helpDescription: "API key management"
   },
+  {
+    create: createTenantsCommand,
+    category: "advanced",
+    helpGroup: "Management",
+    helpDescription: "Platform tenant control plane (multitenancy)"
+  },
   {
     create: createTrustCommand,
     category: "advanced",
@@ -151756,6 +152155,12 @@ var COMMANDS = [
   },
   { create: createEventsCommand, category: "standard", helpGroup: "System", helpDescription: "Query message history" },
   { create: createAuthCommand, category: "core", helpGroup: "System", helpDescription: "Authentication management" },
+  {
+    create: createMultitenancyCommand,
+    category: "advanced",
+    helpGroup: "System",
+    helpDescription: "Server multitenancy posture (read-only)"
+  },
   {
     create: createServerCommand,
     category: "core",

package/dist/lib/credential-status.d.ts

@@ -25,4 +25,22 @@ import type { AuthValidateResponse } from '@omni/sdk';
  * the legacy projection the surrounding output already prints.
  */
 export declare function credentialStatusFields(auth: AuthValidateResponse): Record<string, unknown>;
+/**
+ * Project the server's tenancy posture into display fields (issue #982).
+ *
+ * Same empty-object contract as above, for the same reason: a server that does
+ * not report posture — any server predating it — must add NOTHING, so output
+ * against an old server stays field-for-field what it is today. "Absent" is
+ * itself the operator's signal that the server predates the control plane.
+ *
+ * Field names are prefixed `server*` so they cannot collide with the
+ * credential projection or the existing status fields (`omni auth status`
+ * already prints a `server` key naming the config entry).
+ *
+ * The `tenancyWarning` field mirrors `mixedTenancyStateWarning` semantics on
+ * the API side: it appears exactly when the flag is on but the database is in
+ * legacy enforcement — the advisory-only migration state — and never in the
+ * three coherent combinations.
+ */
+export declare function serverPostureFields(auth: AuthValidateResponse): Record<string, unknown>;
 //# sourceMappingURL=credential-status.d.ts.map

package/dist/lib/credential-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-status.d.ts","sourceRoot":"","sources":["../../src/lib/credential-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEtD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgB1F"}
+{"version":3,"file":"credential-status.d.ts","sourceRoot":"","sources":["../../src/lib/credential-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAEtD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgB1F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBvF"}