@bussolabs/closeyourit-cli 0.21.0 → 0.23.1

package/dist/commands/kb/attachments.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class KbAttachments extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/kb/attachments.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+const paginate_1 = require("../../lib/paginate");
+class KbAttachments extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Knowledge page id', required: true }),
+    };
+    static description = "List a knowledge page's attachments";
+    static examples = [
+        '<%= config.bin %> kb attachments <page-id>',
+        '<%= config.bin %> kb attachments <page-id> --json',
+    ];
+    async run() {
+        const { args } = await this.parse(KbAttachments);
+        // Elenco completo, non la sola prima pagina: il comando non ha un --page, quindi fermarsi a
+        // cento allegati significherebbe nasconderne il resto senza modo di chiederli.
+        const attachments = await (0, paginate_1.fetchAllPages)(this.api, `/cli/v1/knowledge/pages/${encodeURIComponent(args.id)}/attachments`);
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderTable)(['ID', 'FILENAME', 'CONTENT_TYPE', 'BYTE_SIZE', 'SCRIPT', 'CREATED_AT'], attachments.map((attachment) => [
+                String(attachment.id ?? ''),
+                String(attachment.filename ?? ''),
+                String(attachment.content_type ?? ''),
+                String(attachment.byte_size ?? ''),
+                // Il server dichiara se il file è uno script: sapere che si sta scaricando qualcosa di
+                // eseguibile è la sola cosa che l'elenco può dire prima che il file sia sul disco.
+                attachment.script === undefined ? '' : (attachment.script ? 'yes' : 'no'),
+                String(attachment.created_at ?? ''),
+            ])));
+        }
+        return { data: attachments, meta: (0, paginate_1.aggregatedMeta)(attachments.length) };
+    }
+}
+exports.default = KbAttachments;

package/dist/commands/kb/create.d.ts

@@ -3,6 +3,9 @@ export default class KbCreate extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        group: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        tag: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         title: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         kind: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         body: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -11,7 +14,7 @@ export default class KbCreate extends BaseCommand {
         'tech-spec-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'in-review': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'review-note': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'author-origin': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<unknown>;
 }

package/dist/commands/kb/create.js

@@ -3,19 +3,33 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const promises_1 = require("node:fs/promises");
 const core_1 = require("@oclif/core");
 const base_1 = require("../../base");
+const knowledge_1 = require("../../lib/knowledge");
 const limits_1 = require("../../lib/limits");
 const output_1 = require("../../lib/output");
 class KbCreate extends base_1.BaseCommand {
-    static description = 'Create a knowledge page in a project';
+    static description = 'Create a knowledge page in one or more projects (and groups)';
     static examples = [
         '<%= config.bin %> kb create --project acme-api --title "Kamal rollback" --body "Steps…"',
         '<%= config.bin %> kb create -p acme-api --title "ADR: queue backend" --kind decision --body-file ./adr.md',
         '<%= config.bin %> kb create -p acme-api --title "Deploy" --body-file ./body.md --tech-spec-file ./tech.md',
         '<%= config.bin %> kb create -p acme-api --title "Worktree trap" --body-file ./note.md --in-review --review-note "Hit it today, not obvious from the code"',
+        '<%= config.bin %> kb create -p acme-api -p billing --group Piattaforma --tag deploy --tag kamal --title "Rollback" --body-file ./note.md',
     ];
     static flags = {
-        // Required — passed straight to the server as `project` (key or UUID), resolved there.
-        ...base_1.projectFlag,
+        // Repeatable: a page belongs to every project you name (plus every project of the groups).
+        // The first one goes out as `project` (key or UUID, resolved server-side, no extra lookup);
+        // the others are resolved here because `project_ids` only takes ids.
+        //
+        // Not `required`: a page can live on groups alone (a procedure that follows a whole
+        // macro-project, including the projects it will gain later). What a page cannot do is belong
+        // nowhere — the guard in `run` asks for one of the two.
+        project: core_1.Flags.string({
+            char: 'p',
+            description: 'Project id (UUID) or key the page belongs to (repeatable)',
+            multiple: true,
+        }),
+        group: core_1.Flags.string({ description: 'Group id (UUID) or name the page belongs to (repeatable)', multiple: true }),
+        tag: core_1.Flags.string({ description: 'Tag for the page (repeatable; the server lowercases and dedupes them)', multiple: true }),
         title: core_1.Flags.string({ description: `Page title (max ${limits_1.LENGTH_LIMITS.title} characters)`, required: true }),
         kind: core_1.Flags.string({ description: 'Page kind: note|decision|guide', default: 'note' }),
         body: core_1.Flags.string({ description: `Page body (markdown, max ${limits_1.LENGTH_LIMITS.pageBody} characters)` }),
@@ -34,6 +48,11 @@ class KbCreate extends base_1.BaseCommand {
         'review-note': core_1.Flags.string({
             description: `One line explaining why the page is worth keeping (review queue, max ${limits_1.LENGTH_LIMITS.reviewNote} characters)`,
         }),
+        // Chi ha scritto materialmente il testo, che NON è il proprietario del token: il nome
+        // dell'assistente o della skill. Senza, una proposta in revisione resta attribuita al canale.
+        'author-origin': core_1.Flags.string({
+            description: 'Name of the assistant or skill that wrote the text (declares an automatic author)',
+        }),
     };
     async run() {
         const { flags } = await this.parse(KbCreate);
@@ -75,18 +94,35 @@ class KbCreate extends base_1.BaseCommand {
         ]);
         if (tooLong)
             this.error(tooLong, { exit: 2 });
+        const [primary, ...extraProjects] = (0, knowledge_1.cleanList)(flags.project);
+        const groupRefs = (0, knowledge_1.cleanList)(flags.group);
+        // Una pagina deve appartenere a qualcosa: senza scope il server la creerebbe org-wide, visibile
+        // soltanto a chi ha accesso pieno — cioè invisibile a chi l'ha appena scritta.
+        if (primary === undefined && groupRefs.length === 0) {
+            this.error('Provide at least one --project or one --group: a knowledge page has to belong somewhere.', { exit: 2 });
+        }
+        const projectIds = await this.resolveAll(extraProjects, (ref) => this.resolveProjectId(ref));
+        const groupIds = await this.resolveAll(groupRefs, (ref) => this.resolveGroupId(ref));
+        const tags = (0, knowledge_1.cleanList)(flags.tag);
         const res = await this.api.post('/cli/v1/knowledge/pages', {
-            project: flags.project,
+            // Chiavi presenti solo quando c'è qualcosa da collegare: il server unisce `project` e
+            // `project_ids`, quindi un elenco vuoto sarebbe rumore in ogni creazione mono-progetto.
+            ...(primary !== undefined && { project: primary }),
+            ...(projectIds.length > 0 && { project_ids: projectIds }),
+            ...(groupIds.length > 0 && { group_ids: groupIds }),
+            ...(tags.length > 0 && { tags }),
             title: flags.title,
             kind: flags.kind,
             body,
             tech_spec: techSpec,
             in_review: flags['in-review'] ? true : undefined,
             review_note: flags['review-note'],
+            author_origin: flags['author-origin'],
         });
         if (!this.jsonEnabled()) {
+            const page = res.data ?? {};
             this.log(flags['in-review'] ? 'Knowledge page proposed, waiting for review:' : 'Knowledge page created:');
-            this.log((0, output_1.renderRecord)(res.data ?? {}));
+            this.log((0, output_1.renderRecord)({ ...page, ...(0, knowledge_1.pageScopeLines)(page) }));
         }
         return res;
     }

package/dist/commands/kb/detach.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class KbDetach extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        attachment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/kb/detach.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class KbDetach extends base_1.BaseCommand {
+    static description = 'Remove an attachment from a knowledge page (irreversible)';
+    static examples = ['<%= config.bin %> kb detach <page-id> --attachment <attachment-id> --confirm'];
+    static args = {
+        id: core_1.Args.string({ description: 'Knowledge page id', required: true }),
+    };
+    static flags = {
+        attachment: core_1.Flags.string({ description: 'Attachment id to remove', required: true }),
+        confirm: core_1.Flags.boolean({ description: 'Required: confirm the irreversible deletion' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(KbDetach);
+        if (!flags.confirm) {
+            this.error('Refusing to delete without --confirm (the action is irreversible).', { exit: 2 });
+        }
+        await this.api.delete(`/cli/v1/knowledge/pages/${encodeURIComponent(args.id)}/attachments/${encodeURIComponent(flags.attachment)}`);
+        if (!this.jsonEnabled())
+            this.log(`Removed attachment ${flags.attachment} from knowledge page ${args.id}`);
+        return { detached: flags.attachment, page: args.id };
+    }
+}
+exports.default = KbDetach;

package/dist/commands/kb/show.js

@@ -37,6 +37,9 @@ class KbShow extends base_1.BaseCommand {
                 kind: page.kind,
                 project: page.project,
                 project_name: page.project_name,
+                // Gli altri progetti, i gruppi e i tag: una pagina condivisa fra più ambiti si leggeva
+                // come se appartenesse solo al primo (CYCL-45).
+                ...(0, knowledge_1.pageScopeLines)(page),
                 author: page.author,
                 created_at: page.created_at,
                 updated_at: page.updated_at,

package/dist/commands/kb/update.d.ts

@@ -7,6 +7,10 @@ export default class KbUpdate extends BaseCommand {
     };
     static flags: {
         title: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        group: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        tag: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'author-origin': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         kind: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         body: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'body-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/kb/update.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const promises_1 = require("node:fs/promises");
 const core_1 = require("@oclif/core");
 const base_1 = require("../../base");
+const knowledge_1 = require("../../lib/knowledge");
 const limits_1 = require("../../lib/limits");
 const output_1 = require("../../lib/output");
 class KbUpdate extends base_1.BaseCommand {
@@ -11,12 +12,32 @@ class KbUpdate extends base_1.BaseCommand {
         '<%= config.bin %> kb update <page-id> --title "New title"',
         '<%= config.bin %> kb update <page-id> --kind decision --body-file ./adr.md',
         '<%= config.bin %> kb update <page-id> --tech-spec-file ./tech.md',
+        '<%= config.bin %> kb update <page-id> --project acme-api --project billing --group Piattaforma',
+        '<%= config.bin %> kb update <page-id> --tag deploy --tag kamal',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Knowledge page id', required: true }),
     };
     static flags = {
         title: core_1.Flags.string({ description: `New title (max ${limits_1.LENGTH_LIMITS.title} characters)` }),
+        // Ambiti e tag: passarli SOSTITUISCE l'elenco (è come sono fatti sul server), non passarli lo
+        // lascia intatto. Per questo viaggiano solo quando il comando li riceve davvero.
+        project: core_1.Flags.string({
+            char: 'p',
+            description: 'Replace the projects the page belongs to: id (UUID) or key (repeatable)',
+            multiple: true,
+        }),
+        group: core_1.Flags.string({
+            description: 'Replace the groups the page belongs to: id (UUID) or name (repeatable)',
+            multiple: true,
+        }),
+        tag: core_1.Flags.string({
+            description: 'Replace the page tags (repeatable; `--tag ""` clears them)',
+            multiple: true,
+        }),
+        'author-origin': core_1.Flags.string({
+            description: 'Name of the assistant or skill that rewrote the text (only applies with a text change)',
+        }),
         kind: core_1.Flags.string({ description: 'New kind: note|decision|guide' }),
         body: core_1.Flags.string({ description: `New body (markdown, max ${limits_1.LENGTH_LIMITS.pageBody} characters)` }),
         'body-file': core_1.Flags.string({
@@ -56,33 +77,60 @@ class KbUpdate extends base_1.BaseCommand {
         if (flags.title === undefined &&
             flags.kind === undefined &&
             body === undefined &&
-            techSpec === undefined) {
-            this.error('Provide at least one of --title, --kind, --body, --body-file, --tech-spec or --tech-spec-file.', { exit: 2 });
+            techSpec === undefined &&
+            flags.project === undefined &&
+            flags.group === undefined &&
+            flags.tag === undefined) {
+            this.error('Provide at least one of --title, --kind, --body, --body-file, --tech-spec, --tech-spec-file, --project, --group or --tag.', { exit: 2 });
         }
         // The backend expects the full title/body/kind/tech_spec on update → read the current page and
         // merge, so a partial edit (e.g. only --tech-spec) doesn't blank out the other fields.
+        //
+        // Solo quando il testo cambia davvero: un update di soli ambiti o tag non ha niente da fondere,
+        // e rimandare il testo appena letto cancellerebbe la modifica di chi ha scritto nel frattempo
+        // (CYCL-45). Senza campi di testo non c'è nemmeno niente da misurare, quindi la lettura salta.
         const base = `/cli/v1/knowledge/pages/${encodeURIComponent(args.id)}`;
-        const current = await this.api.get(base);
-        const page = current.data ?? {};
-        // I campi troppo lunghi si scoprono qui, tutti insieme, invece che uno per rifiuto (CYCL-32). Il
-        // valore attuale fa da salvaguardia: una pagina scritta prima che il tetto esistesse si può
-        // ancora correggere e accorciare per gradi, com'è dal server.
-        const tooLong = (0, limits_1.tooLongMessage)([
-            { flag: '--title', value: flags.title, max: limits_1.LENGTH_LIMITS.title, previous: page.title },
-            { flag: bodyFlag, value: body, max: limits_1.LENGTH_LIMITS.pageBody, previous: page.body },
-            { flag: techSpecFlag, value: techSpec, max: limits_1.LENGTH_LIMITS.techSpec, previous: page.tech_spec },
-        ]);
-        if (tooLong)
-            this.error(tooLong, { exit: 2 });
-        const res = await this.api.put(base, {
-            title: flags.title ?? page.title,
-            kind: flags.kind ?? page.kind,
-            body: body ?? page.body,
-            tech_spec: techSpec ?? page.tech_spec,
-        });
+        const editsText = flags.title !== undefined || flags.kind !== undefined || body !== undefined || techSpec !== undefined;
+        let text = {};
+        if (editsText) {
+            const current = await this.api.get(base);
+            const page = current.data ?? {};
+            // I campi troppo lunghi si scoprono qui, tutti insieme, invece che uno per rifiuto (CYCL-32). Il
+            // valore attuale fa da salvaguardia: una pagina scritta prima che il tetto esistesse si può
+            // ancora correggere e accorciare per gradi, com'è dal server.
+            const tooLong = (0, limits_1.tooLongMessage)([
+                { flag: '--title', value: flags.title, max: limits_1.LENGTH_LIMITS.title, previous: page.title },
+                { flag: bodyFlag, value: body, max: limits_1.LENGTH_LIMITS.pageBody, previous: page.body },
+                { flag: techSpecFlag, value: techSpec, max: limits_1.LENGTH_LIMITS.techSpec, previous: page.tech_spec },
+            ]);
+            if (tooLong)
+                this.error(tooLong, { exit: 2 });
+            text = {
+                title: flags.title ?? page.title,
+                kind: flags.kind ?? page.kind,
+                body: body ?? page.body,
+                tech_spec: techSpec ?? page.tech_spec,
+            };
+        }
+        // Scope e tag: la chiave viaggia SOLO se il flag è stato passato, perché il server aggiorna
+        // esattamente quello che riceve — mandare un elenco vuoto per "non li tocco" scollegherebbe la
+        // pagina da progetti e gruppi e le cancellerebbe i tag ad ogni correzione di una virgola (CYCL-45).
+        const scope = {};
+        if (flags.project !== undefined) {
+            scope.project_ids = await this.resolveAll((0, knowledge_1.cleanList)(flags.project), (ref) => this.resolveProjectId(ref));
+        }
+        if (flags.group !== undefined) {
+            scope.group_ids = await this.resolveAll((0, knowledge_1.cleanList)(flags.group), (ref) => this.resolveGroupId(ref));
+        }
+        if (flags.tag !== undefined)
+            scope.tags = (0, knowledge_1.cleanList)(flags.tag);
+        if (flags['author-origin'] !== undefined)
+            scope.author_origin = flags['author-origin'];
+        const res = await this.api.put(base, { ...text, ...scope });
         if (!this.jsonEnabled()) {
+            const updated = res.data ?? {};
             this.log('Knowledge page updated:');
-            this.log((0, output_1.renderRecord)(res.data ?? {}));
+            this.log((0, output_1.renderRecord)({ ...updated, ...(0, knowledge_1.pageScopeLines)(updated) }));
         }
         return res;
     }

package/dist/commands/metrics/bulk-triage.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base';
+export default class MetricsBulkTriage extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        action: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        group: import("@oclif/core/lib/interfaces").OptionFlag<string[], import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/metrics/bulk-triage.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const error_codes_1 = require("../../errors/error-codes");
+const bulk_triage_1 = require("../../lib/bulk-triage");
+const output_1 = require("../../lib/output");
+class MetricsBulkTriage extends base_1.BaseCommand {
+    static description = 'Resolve, ignore or reopen several metric groups in one call';
+    static examples = [
+        '<%= config.bin %> metrics bulk-triage -p acme-api --action resolve --group <id-a> --group <id-b>',
+        '<%= config.bin %> metrics bulk-triage -p acme-api --action ignore --group <id-a> --json',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        action: core_1.Flags.string({ description: 'What to do with them', options: [...bulk_triage_1.TRIAGE_ACTIONS], required: true }),
+        group: core_1.Flags.string({ description: 'Metric group id (repeatable)', multiple: true, required: true }),
+    };
+    async run() {
+        const { flags } = await this.parse(MetricsBulkTriage);
+        const projectId = await this.resolveProjectId(flags.project);
+        const ids = (0, bulk_triage_1.uniqueIds)(flags.group);
+        const res = await this.api.post(`/cli/v1/projects/${encodeURIComponent(projectId)}/metric_groups/bulk_triage`, { bulk_action: flags.action, ids });
+        const groups = res.data ?? [];
+        if (!this.jsonEnabled()) {
+            this.log((0, bulk_triage_1.triagedLine)(groups.length, 'metric group', flags.action));
+            this.log((0, output_1.renderTable)(['ID', 'KIND', 'NAME', 'STATUS'], groups.map((group) => [
+                String(group.id ?? ''),
+                String(group.kind ?? ''),
+                String(group.name ?? group.title ?? ''),
+                (0, output_1.statusCell)(group.status),
+            ])));
+        }
+        (0, bulk_triage_1.assertNothingDropped)({
+            action: flags.action,
+            code: error_codes_1.ErrorCodes.MetricGroup.notFound,
+            noun: 'metric group',
+            requested: ids,
+            rows: groups,
+        });
+        return res;
+    }
+}
+exports.default = MetricsBulkTriage;

package/dist/commands/seo-sites/show.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base';
+export default class SeoSitesShow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<unknown>;
+    /**
+     * One nested block as a section of its own — or nothing at all when the payload has no such
+     * block. An empty "Vitals" heading reads as "this site has no vitals measured", when it really
+     * means "this server never sent them": same reason `tickets show` skips absent guidance (CYCL-2).
+     */
+    private printBlock;
+}

package/dist/commands/seo-sites/show.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+/**
+ * The blocks the card opens with, in reading order, each with the heading a reader recognises.
+ * Everything else the payload carries is printed after these, under a heading derived from its own
+ * key: the endpoint is new (CYRA-541) and keeps growing, and a client that only knows five names
+ * would drop the sixth block without ever saying so.
+ */
+const KNOWN_BLOCKS = [
+    { icon: '🔎', key: 'open_issues', title: 'Open findings' },
+    { icon: '🕒', key: 'last_audit', title: 'Last run' },
+    { icon: '⚡', key: 'vitals', title: 'Vitals' },
+    { icon: '📦', key: 'project', title: 'Project' },
+    { icon: '🌱', key: 'environment', title: 'Environment' },
+];
+/**
+ * The known block keys, each mapped to `undefined`, to spread over the head record. `renderRecord`
+ * prints a null scalar as `key: -`, so a site that was never checked (`last_audit: null`) would
+ * grow a `last_audit: -` line among its settings — a block that is not there, listed as if it were
+ * a setting you could change. Same trick `seo show` uses to lift `evidence` out of its head.
+ */
+const BLOCKS_OFF_THE_HEAD = Object.fromEntries(KNOWN_BLOCKS.map((block) => [block.key, undefined]));
+/** A value `renderRecord`/`renderTable` can print as a cell (null included: it prints as `-`). */
+function isScalar(value) {
+    return value === null || ['string', 'number', 'boolean'].includes(typeof value);
+}
+/** `recent_audits` → `Recent audits`: the heading for a block nobody taught this client about. */
+function titleFromKey(key) {
+    const words = key.split('_').join(' ');
+    return words.charAt(0).toUpperCase() + words.slice(1);
+}
+/**
+ * A list of objects as a table. The columns are every scalar field the rows carry, in the order
+ * they first appear: taking the shape from the first row alone would silently crop a field that
+ * only the failed run has (its error). Returns '' when no row has anything printable.
+ */
+function renderRows(rows) {
+    const columns = [];
+    for (const row of rows) {
+        for (const [key, value] of Object.entries(row)) {
+            if (isScalar(value) && !columns.includes(key))
+                columns.push(key);
+        }
+    }
+    if (columns.length === 0)
+        return '';
+    return (0, output_1.renderTable)(columns.map((column) => column.toUpperCase()), rows.map((row) => columns.map((column) => String(row[column] ?? ''))));
+}
+/** The printable body of a nested block, or '' when there is nothing in it to print. */
+function renderBlock(value) {
+    if (Array.isArray(value)) {
+        const rows = value.filter((item) => Boolean(item) && typeof item === 'object' && !Array.isArray(item));
+        if (rows.length > 0)
+            return renderRows(rows);
+        // A list of plain values (enabled checks, urls) reads as one line, not as a one-column table.
+        const items = value.filter((item) => isScalar(item) && item !== null);
+        return items.map((item) => (0, output_1.sanitize)(item)).join(', ');
+    }
+    if (value && typeof value === 'object') {
+        const record = value;
+        return Object.keys(record).length > 0 ? (0, output_1.renderRecord)(record) : '';
+    }
+    return '';
+}
+class SeoSitesShow extends base_1.BaseCommand {
+    static description = 'Show one site under SEO check: how it is set up, what is open, how the last run went and how fast it is';
+    static examples = ['<%= config.bin %> seo-sites show <site-id>', '<%= config.bin %> seo-sites show <site-id> --json'];
+    static args = {
+        id: core_1.Args.string({ description: 'Site id', required: true }),
+    };
+    async run() {
+        const { args } = await this.parse(SeoSitesShow);
+        const res = await this.api.get(`/cli/v1/seo_sites/${encodeURIComponent(args.id)}`);
+        if (!this.jsonEnabled()) {
+            const data = res.data ?? {};
+            // Configuration and cadence first: everything you would change with `seo-sites update`.
+            this.log((0, output_1.renderRecord)({ ...data, ...BLOCKS_OFF_THE_HEAD }));
+            for (const { icon, key, title } of KNOWN_BLOCKS)
+                this.printBlock(title, data[key], icon);
+            const known = new Set(KNOWN_BLOCKS.map((block) => block.key));
+            for (const [key, value] of Object.entries(data)) {
+                if (known.has(key) || isScalar(value))
+                    continue;
+                // The heading comes from a server-supplied key: sanitize it like every other printed
+                // string (CWE-150). `section` interpolates its title raw, so this is the last stop.
+                this.printBlock((0, output_1.sanitize)(titleFromKey(key)), value);
+            }
+        }
+        return res;
+    }
+    /**
+     * One nested block as a section of its own — or nothing at all when the payload has no such
+     * block. An empty "Vitals" heading reads as "this site has no vitals measured", when it really
+     * means "this server never sent them": same reason `tickets show` skips absent guidance (CYCL-2).
+     */
+    printBlock(title, value, icon) {
+        const body = renderBlock(value);
+        if (!body)
+            return;
+        this.log((0, output_1.section)(title, icon));
+        this.log(body);
+    }
+}
+exports.default = SeoSitesShow;

package/dist/commands/service-accounts/show.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsShow extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/show.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+const service_accounts_1 = require("../../lib/service-accounts");
+class ServiceAccountsShow extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Service account id', required: true }),
+    };
+    static description = 'Show a service account: identity, how many tokens are active, and the environments it can read secrets in';
+    static examples = ['<%= config.bin %> service-accounts show <id>', '<%= config.bin %> service-accounts show <id> --json'];
+    async run() {
+        const { args } = await this.parse(ServiceAccountsShow);
+        const res = await this.api.get(`/cli/v1/service/accounts/${encodeURIComponent(args.id)}`);
+        const account = (0, service_accounts_1.withoutSecret)(res.data ?? {});
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderRecord)((0, service_accounts_1.accountSummary)(account)));
+            this.log((0, service_accounts_1.environmentsLine)(account.secret_environment_codes));
+        }
+        // Stripped on the machine path too, not just on screen: the human branch prints an allow-list of
+        // fields, so leaving `--json` on the raw payload would make the quieter output the leakier one.
+        return { ...res, data: account };
+    }
+}
+exports.default = ServiceAccountsShow;

package/dist/commands/service-accounts/tokens/list.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base';
+export default class ServiceAccountsTokensList extends BaseCommand {
+    static args: {
+        account: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/tokens/list.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+const service_accounts_1 = require("../../../lib/service-accounts");
+class ServiceAccountsTokensList extends base_1.BaseCommand {
+    static args = {
+        account: core_1.Args.string({ description: 'Service account id', required: true }),
+    };
+    static description = 'List the CLI tokens of a service account — which ones still work and which are revoked. Never the secret.';
+    static examples = [
+        '<%= config.bin %> service-accounts tokens list <account-id>',
+        '<%= config.bin %> service-accounts tokens list <account-id> --json',
+    ];
+    static flags = { ...base_1.pageFlag };
+    async run() {
+        const { args, flags } = await this.parse(ServiceAccountsTokensList);
+        // The backend clamps a page below 1 back to page 1 without a word, so a script that computed the
+        // wrong number would get plausible rows instead of an error.
+        const invalid = (0, base_1.paginationError)(flags);
+        if (invalid)
+            this.error(invalid, { exit: 2 });
+        const res = await this.api.get(`/cli/v1/service/accounts/${encodeURIComponent(args.account)}/tokens?page=${flags.page}`);
+        // Stripped on both paths: a listing tells you which tokens exist, never what they are.
+        const tokens = (res.data ?? []).map((token) => (0, service_accounts_1.withoutSecret)(token));
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderTable)(['ID', 'NAME', 'PREFIX', 'STATUS', 'LAST USED', 'REVOKED AT'], tokens.map((token) => [
+                String(token.id ?? ''),
+                String(token.name ?? ''),
+                String(token.token_prefix ?? ''),
+                (0, output_1.statusCell)((0, service_accounts_1.tokenStatus)(token)),
+                String(token.last_used_at ?? '-'),
+                String(token.revoked_at ?? '-'),
+            ])));
+        }
+        return { ...res, data: tokens };
+    }
+}
+exports.default = ServiceAccountsTokensList;