@bussolabs/closeyourit-cli 0.22.0 → 0.23.1

package/dist/commands/kb/create.d.ts

@@ -3,6 +3,9 @@ export default class KbCreate extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        group: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        tag: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         title: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         kind: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         body: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -11,7 +14,7 @@ export default class KbCreate extends BaseCommand {
         'tech-spec-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'in-review': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'review-note': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
-        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'author-origin': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<unknown>;
 }

package/dist/commands/kb/create.js

@@ -3,19 +3,33 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const promises_1 = require("node:fs/promises");
 const core_1 = require("@oclif/core");
 const base_1 = require("../../base");
+const knowledge_1 = require("../../lib/knowledge");
 const limits_1 = require("../../lib/limits");
 const output_1 = require("../../lib/output");
 class KbCreate extends base_1.BaseCommand {
-    static description = 'Create a knowledge page in a project';
+    static description = 'Create a knowledge page in one or more projects (and groups)';
     static examples = [
         '<%= config.bin %> kb create --project acme-api --title "Kamal rollback" --body "Steps…"',
         '<%= config.bin %> kb create -p acme-api --title "ADR: queue backend" --kind decision --body-file ./adr.md',
         '<%= config.bin %> kb create -p acme-api --title "Deploy" --body-file ./body.md --tech-spec-file ./tech.md',
         '<%= config.bin %> kb create -p acme-api --title "Worktree trap" --body-file ./note.md --in-review --review-note "Hit it today, not obvious from the code"',
+        '<%= config.bin %> kb create -p acme-api -p billing --group Piattaforma --tag deploy --tag kamal --title "Rollback" --body-file ./note.md',
     ];
     static flags = {
-        // Required — passed straight to the server as `project` (key or UUID), resolved there.
-        ...base_1.projectFlag,
+        // Repeatable: a page belongs to every project you name (plus every project of the groups).
+        // The first one goes out as `project` (key or UUID, resolved server-side, no extra lookup);
+        // the others are resolved here because `project_ids` only takes ids.
+        //
+        // Not `required`: a page can live on groups alone (a procedure that follows a whole
+        // macro-project, including the projects it will gain later). What a page cannot do is belong
+        // nowhere — the guard in `run` asks for one of the two.
+        project: core_1.Flags.string({
+            char: 'p',
+            description: 'Project id (UUID) or key the page belongs to (repeatable)',
+            multiple: true,
+        }),
+        group: core_1.Flags.string({ description: 'Group id (UUID) or name the page belongs to (repeatable)', multiple: true }),
+        tag: core_1.Flags.string({ description: 'Tag for the page (repeatable; the server lowercases and dedupes them)', multiple: true }),
         title: core_1.Flags.string({ description: `Page title (max ${limits_1.LENGTH_LIMITS.title} characters)`, required: true }),
         kind: core_1.Flags.string({ description: 'Page kind: note|decision|guide', default: 'note' }),
         body: core_1.Flags.string({ description: `Page body (markdown, max ${limits_1.LENGTH_LIMITS.pageBody} characters)` }),
@@ -34,6 +48,11 @@ class KbCreate extends base_1.BaseCommand {
         'review-note': core_1.Flags.string({
             description: `One line explaining why the page is worth keeping (review queue, max ${limits_1.LENGTH_LIMITS.reviewNote} characters)`,
         }),
+        // Chi ha scritto materialmente il testo, che NON è il proprietario del token: il nome
+        // dell'assistente o della skill. Senza, una proposta in revisione resta attribuita al canale.
+        'author-origin': core_1.Flags.string({
+            description: 'Name of the assistant or skill that wrote the text (declares an automatic author)',
+        }),
     };
     async run() {
         const { flags } = await this.parse(KbCreate);
@@ -75,18 +94,35 @@ class KbCreate extends base_1.BaseCommand {
         ]);
         if (tooLong)
             this.error(tooLong, { exit: 2 });
+        const [primary, ...extraProjects] = (0, knowledge_1.cleanList)(flags.project);
+        const groupRefs = (0, knowledge_1.cleanList)(flags.group);
+        // Una pagina deve appartenere a qualcosa: senza scope il server la creerebbe org-wide, visibile
+        // soltanto a chi ha accesso pieno — cioè invisibile a chi l'ha appena scritta.
+        if (primary === undefined && groupRefs.length === 0) {
+            this.error('Provide at least one --project or one --group: a knowledge page has to belong somewhere.', { exit: 2 });
+        }
+        const projectIds = await this.resolveAll(extraProjects, (ref) => this.resolveProjectId(ref));
+        const groupIds = await this.resolveAll(groupRefs, (ref) => this.resolveGroupId(ref));
+        const tags = (0, knowledge_1.cleanList)(flags.tag);
         const res = await this.api.post('/cli/v1/knowledge/pages', {
-            project: flags.project,
+            // Chiavi presenti solo quando c'è qualcosa da collegare: il server unisce `project` e
+            // `project_ids`, quindi un elenco vuoto sarebbe rumore in ogni creazione mono-progetto.
+            ...(primary !== undefined && { project: primary }),
+            ...(projectIds.length > 0 && { project_ids: projectIds }),
+            ...(groupIds.length > 0 && { group_ids: groupIds }),
+            ...(tags.length > 0 && { tags }),
             title: flags.title,
             kind: flags.kind,
             body,
             tech_spec: techSpec,
             in_review: flags['in-review'] ? true : undefined,
             review_note: flags['review-note'],
+            author_origin: flags['author-origin'],
         });
         if (!this.jsonEnabled()) {
+            const page = res.data ?? {};
             this.log(flags['in-review'] ? 'Knowledge page proposed, waiting for review:' : 'Knowledge page created:');
-            this.log((0, output_1.renderRecord)(res.data ?? {}));
+            this.log((0, output_1.renderRecord)({ ...page, ...(0, knowledge_1.pageScopeLines)(page) }));
         }
         return res;
     }

package/dist/commands/kb/detach.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class KbDetach extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        attachment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/kb/detach.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class KbDetach extends base_1.BaseCommand {
+    static description = 'Remove an attachment from a knowledge page (irreversible)';
+    static examples = ['<%= config.bin %> kb detach <page-id> --attachment <attachment-id> --confirm'];
+    static args = {
+        id: core_1.Args.string({ description: 'Knowledge page id', required: true }),
+    };
+    static flags = {
+        attachment: core_1.Flags.string({ description: 'Attachment id to remove', required: true }),
+        confirm: core_1.Flags.boolean({ description: 'Required: confirm the irreversible deletion' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(KbDetach);
+        if (!flags.confirm) {
+            this.error('Refusing to delete without --confirm (the action is irreversible).', { exit: 2 });
+        }
+        await this.api.delete(`/cli/v1/knowledge/pages/${encodeURIComponent(args.id)}/attachments/${encodeURIComponent(flags.attachment)}`);
+        if (!this.jsonEnabled())
+            this.log(`Removed attachment ${flags.attachment} from knowledge page ${args.id}`);
+        return { detached: flags.attachment, page: args.id };
+    }
+}
+exports.default = KbDetach;

package/dist/commands/kb/show.js

@@ -37,6 +37,9 @@ class KbShow extends base_1.BaseCommand {
                 kind: page.kind,
                 project: page.project,
                 project_name: page.project_name,
+                // Gli altri progetti, i gruppi e i tag: una pagina condivisa fra più ambiti si leggeva
+                // come se appartenesse solo al primo (CYCL-45).
+                ...(0, knowledge_1.pageScopeLines)(page),
                 author: page.author,
                 created_at: page.created_at,
                 updated_at: page.updated_at,

package/dist/commands/kb/update.d.ts

@@ -7,6 +7,10 @@ export default class KbUpdate extends BaseCommand {
     };
     static flags: {
         title: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        group: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        tag: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'author-origin': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         kind: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         body: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'body-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/kb/update.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const promises_1 = require("node:fs/promises");
 const core_1 = require("@oclif/core");
 const base_1 = require("../../base");
+const knowledge_1 = require("../../lib/knowledge");
 const limits_1 = require("../../lib/limits");
 const output_1 = require("../../lib/output");
 class KbUpdate extends base_1.BaseCommand {
@@ -11,12 +12,32 @@ class KbUpdate extends base_1.BaseCommand {
         '<%= config.bin %> kb update <page-id> --title "New title"',
         '<%= config.bin %> kb update <page-id> --kind decision --body-file ./adr.md',
         '<%= config.bin %> kb update <page-id> --tech-spec-file ./tech.md',
+        '<%= config.bin %> kb update <page-id> --project acme-api --project billing --group Piattaforma',
+        '<%= config.bin %> kb update <page-id> --tag deploy --tag kamal',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Knowledge page id', required: true }),
     };
     static flags = {
         title: core_1.Flags.string({ description: `New title (max ${limits_1.LENGTH_LIMITS.title} characters)` }),
+        // Ambiti e tag: passarli SOSTITUISCE l'elenco (è come sono fatti sul server), non passarli lo
+        // lascia intatto. Per questo viaggiano solo quando il comando li riceve davvero.
+        project: core_1.Flags.string({
+            char: 'p',
+            description: 'Replace the projects the page belongs to: id (UUID) or key (repeatable)',
+            multiple: true,
+        }),
+        group: core_1.Flags.string({
+            description: 'Replace the groups the page belongs to: id (UUID) or name (repeatable)',
+            multiple: true,
+        }),
+        tag: core_1.Flags.string({
+            description: 'Replace the page tags (repeatable; `--tag ""` clears them)',
+            multiple: true,
+        }),
+        'author-origin': core_1.Flags.string({
+            description: 'Name of the assistant or skill that rewrote the text (only applies with a text change)',
+        }),
         kind: core_1.Flags.string({ description: 'New kind: note|decision|guide' }),
         body: core_1.Flags.string({ description: `New body (markdown, max ${limits_1.LENGTH_LIMITS.pageBody} characters)` }),
         'body-file': core_1.Flags.string({
@@ -56,33 +77,60 @@ class KbUpdate extends base_1.BaseCommand {
         if (flags.title === undefined &&
             flags.kind === undefined &&
             body === undefined &&
-            techSpec === undefined) {
-            this.error('Provide at least one of --title, --kind, --body, --body-file, --tech-spec or --tech-spec-file.', { exit: 2 });
+            techSpec === undefined &&
+            flags.project === undefined &&
+            flags.group === undefined &&
+            flags.tag === undefined) {
+            this.error('Provide at least one of --title, --kind, --body, --body-file, --tech-spec, --tech-spec-file, --project, --group or --tag.', { exit: 2 });
         }
         // The backend expects the full title/body/kind/tech_spec on update → read the current page and
         // merge, so a partial edit (e.g. only --tech-spec) doesn't blank out the other fields.
+        //
+        // Solo quando il testo cambia davvero: un update di soli ambiti o tag non ha niente da fondere,
+        // e rimandare il testo appena letto cancellerebbe la modifica di chi ha scritto nel frattempo
+        // (CYCL-45). Senza campi di testo non c'è nemmeno niente da misurare, quindi la lettura salta.
         const base = `/cli/v1/knowledge/pages/${encodeURIComponent(args.id)}`;
-        const current = await this.api.get(base);
-        const page = current.data ?? {};
-        // I campi troppo lunghi si scoprono qui, tutti insieme, invece che uno per rifiuto (CYCL-32). Il
-        // valore attuale fa da salvaguardia: una pagina scritta prima che il tetto esistesse si può
-        // ancora correggere e accorciare per gradi, com'è dal server.
-        const tooLong = (0, limits_1.tooLongMessage)([
-            { flag: '--title', value: flags.title, max: limits_1.LENGTH_LIMITS.title, previous: page.title },
-            { flag: bodyFlag, value: body, max: limits_1.LENGTH_LIMITS.pageBody, previous: page.body },
-            { flag: techSpecFlag, value: techSpec, max: limits_1.LENGTH_LIMITS.techSpec, previous: page.tech_spec },
-        ]);
-        if (tooLong)
-            this.error(tooLong, { exit: 2 });
-        const res = await this.api.put(base, {
-            title: flags.title ?? page.title,
-            kind: flags.kind ?? page.kind,
-            body: body ?? page.body,
-            tech_spec: techSpec ?? page.tech_spec,
-        });
+        const editsText = flags.title !== undefined || flags.kind !== undefined || body !== undefined || techSpec !== undefined;
+        let text = {};
+        if (editsText) {
+            const current = await this.api.get(base);
+            const page = current.data ?? {};
+            // I campi troppo lunghi si scoprono qui, tutti insieme, invece che uno per rifiuto (CYCL-32). Il
+            // valore attuale fa da salvaguardia: una pagina scritta prima che il tetto esistesse si può
+            // ancora correggere e accorciare per gradi, com'è dal server.
+            const tooLong = (0, limits_1.tooLongMessage)([
+                { flag: '--title', value: flags.title, max: limits_1.LENGTH_LIMITS.title, previous: page.title },
+                { flag: bodyFlag, value: body, max: limits_1.LENGTH_LIMITS.pageBody, previous: page.body },
+                { flag: techSpecFlag, value: techSpec, max: limits_1.LENGTH_LIMITS.techSpec, previous: page.tech_spec },
+            ]);
+            if (tooLong)
+                this.error(tooLong, { exit: 2 });
+            text = {
+                title: flags.title ?? page.title,
+                kind: flags.kind ?? page.kind,
+                body: body ?? page.body,
+                tech_spec: techSpec ?? page.tech_spec,
+            };
+        }
+        // Scope e tag: la chiave viaggia SOLO se il flag è stato passato, perché il server aggiorna
+        // esattamente quello che riceve — mandare un elenco vuoto per "non li tocco" scollegherebbe la
+        // pagina da progetti e gruppi e le cancellerebbe i tag ad ogni correzione di una virgola (CYCL-45).
+        const scope = {};
+        if (flags.project !== undefined) {
+            scope.project_ids = await this.resolveAll((0, knowledge_1.cleanList)(flags.project), (ref) => this.resolveProjectId(ref));
+        }
+        if (flags.group !== undefined) {
+            scope.group_ids = await this.resolveAll((0, knowledge_1.cleanList)(flags.group), (ref) => this.resolveGroupId(ref));
+        }
+        if (flags.tag !== undefined)
+            scope.tags = (0, knowledge_1.cleanList)(flags.tag);
+        if (flags['author-origin'] !== undefined)
+            scope.author_origin = flags['author-origin'];
+        const res = await this.api.put(base, { ...text, ...scope });
         if (!this.jsonEnabled()) {
+            const updated = res.data ?? {};
             this.log('Knowledge page updated:');
-            this.log((0, output_1.renderRecord)(res.data ?? {}));
+            this.log((0, output_1.renderRecord)({ ...updated, ...(0, knowledge_1.pageScopeLines)(updated) }));
         }
         return res;
     }

package/dist/commands/metrics/bulk-triage.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base';
+export default class MetricsBulkTriage extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        action: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        group: import("@oclif/core/lib/interfaces").OptionFlag<string[], import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/metrics/bulk-triage.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const error_codes_1 = require("../../errors/error-codes");
+const bulk_triage_1 = require("../../lib/bulk-triage");
+const output_1 = require("../../lib/output");
+class MetricsBulkTriage extends base_1.BaseCommand {
+    static description = 'Resolve, ignore or reopen several metric groups in one call';
+    static examples = [
+        '<%= config.bin %> metrics bulk-triage -p acme-api --action resolve --group <id-a> --group <id-b>',
+        '<%= config.bin %> metrics bulk-triage -p acme-api --action ignore --group <id-a> --json',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        action: core_1.Flags.string({ description: 'What to do with them', options: [...bulk_triage_1.TRIAGE_ACTIONS], required: true }),
+        group: core_1.Flags.string({ description: 'Metric group id (repeatable)', multiple: true, required: true }),
+    };
+    async run() {
+        const { flags } = await this.parse(MetricsBulkTriage);
+        const projectId = await this.resolveProjectId(flags.project);
+        const ids = (0, bulk_triage_1.uniqueIds)(flags.group);
+        const res = await this.api.post(`/cli/v1/projects/${encodeURIComponent(projectId)}/metric_groups/bulk_triage`, { bulk_action: flags.action, ids });
+        const groups = res.data ?? [];
+        if (!this.jsonEnabled()) {
+            this.log((0, bulk_triage_1.triagedLine)(groups.length, 'metric group', flags.action));
+            this.log((0, output_1.renderTable)(['ID', 'KIND', 'NAME', 'STATUS'], groups.map((group) => [
+                String(group.id ?? ''),
+                String(group.kind ?? ''),
+                String(group.name ?? group.title ?? ''),
+                (0, output_1.statusCell)(group.status),
+            ])));
+        }
+        (0, bulk_triage_1.assertNothingDropped)({
+            action: flags.action,
+            code: error_codes_1.ErrorCodes.MetricGroup.notFound,
+            noun: 'metric group',
+            requested: ids,
+            rows: groups,
+        });
+        return res;
+    }
+}
+exports.default = MetricsBulkTriage;

package/dist/commands/service-accounts/show.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsShow extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/show.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+const service_accounts_1 = require("../../lib/service-accounts");
+class ServiceAccountsShow extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Service account id', required: true }),
+    };
+    static description = 'Show a service account: identity, how many tokens are active, and the environments it can read secrets in';
+    static examples = ['<%= config.bin %> service-accounts show <id>', '<%= config.bin %> service-accounts show <id> --json'];
+    async run() {
+        const { args } = await this.parse(ServiceAccountsShow);
+        const res = await this.api.get(`/cli/v1/service/accounts/${encodeURIComponent(args.id)}`);
+        const account = (0, service_accounts_1.withoutSecret)(res.data ?? {});
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderRecord)((0, service_accounts_1.accountSummary)(account)));
+            this.log((0, service_accounts_1.environmentsLine)(account.secret_environment_codes));
+        }
+        // Stripped on the machine path too, not just on screen: the human branch prints an allow-list of
+        // fields, so leaving `--json` on the raw payload would make the quieter output the leakier one.
+        return { ...res, data: account };
+    }
+}
+exports.default = ServiceAccountsShow;

package/dist/commands/service-accounts/tokens/list.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base';
+export default class ServiceAccountsTokensList extends BaseCommand {
+    static args: {
+        account: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/tokens/list.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+const service_accounts_1 = require("../../../lib/service-accounts");
+class ServiceAccountsTokensList extends base_1.BaseCommand {
+    static args = {
+        account: core_1.Args.string({ description: 'Service account id', required: true }),
+    };
+    static description = 'List the CLI tokens of a service account — which ones still work and which are revoked. Never the secret.';
+    static examples = [
+        '<%= config.bin %> service-accounts tokens list <account-id>',
+        '<%= config.bin %> service-accounts tokens list <account-id> --json',
+    ];
+    static flags = { ...base_1.pageFlag };
+    async run() {
+        const { args, flags } = await this.parse(ServiceAccountsTokensList);
+        // The backend clamps a page below 1 back to page 1 without a word, so a script that computed the
+        // wrong number would get plausible rows instead of an error.
+        const invalid = (0, base_1.paginationError)(flags);
+        if (invalid)
+            this.error(invalid, { exit: 2 });
+        const res = await this.api.get(`/cli/v1/service/accounts/${encodeURIComponent(args.account)}/tokens?page=${flags.page}`);
+        // Stripped on both paths: a listing tells you which tokens exist, never what they are.
+        const tokens = (res.data ?? []).map((token) => (0, service_accounts_1.withoutSecret)(token));
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderTable)(['ID', 'NAME', 'PREFIX', 'STATUS', 'LAST USED', 'REVOKED AT'], tokens.map((token) => [
+                String(token.id ?? ''),
+                String(token.name ?? ''),
+                String(token.token_prefix ?? ''),
+                (0, output_1.statusCell)((0, service_accounts_1.tokenStatus)(token)),
+                String(token.last_used_at ?? '-'),
+                String(token.revoked_at ?? '-'),
+            ])));
+        }
+        return { ...res, data: tokens };
+    }
+}
+exports.default = ServiceAccountsTokensList;

package/dist/commands/service-accounts/update.d.ts

@@ -0,0 +1,31 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsUpdate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        'secret-environment': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'all-environments': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+    /**
+     * Refuse a code this organization does not declare, before the write goes out.
+     *
+     * The server would answer 200 to it: `SetSecretAccess` intersects the list with the real codes and
+     * saves the remainder, so a single typo empties the allow-list — which grants EVERY environment
+     * instead of restricting to one. Checked after the flag guards and never for `--all-environments`
+     * (there is no code to check), so the extra read only happens when it can prevent something.
+     */
+    private refuseUnknownEnvironments;
+    /**
+     * The environment codes of the organization, or `undefined` when they cannot be read.
+     *
+     * Listing them needs `environments.view`, which managing service accounts does not imply: a 403
+     * here says nothing about the update being legitimate, so it must not block it — the request/response
+     * comparison after the write stays as the guard. An empty list is read the same way rather than as
+     * "every code is invalid", so a lookup that changes shape can never refuse a correct command.
+     */
+    private organizationEnvironmentCodes;
+}

package/dist/commands/service-accounts/update.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const api_1 = require("../../lib/api");
+const output_1 = require("../../lib/output");
+const paginate_1 = require("../../lib/paginate");
+const service_accounts_1 = require("../../lib/service-accounts");
+class ServiceAccountsUpdate extends base_1.BaseCommand {
+    // Only the secret boundary, on purpose: projects, groups and roles are three separate writes on
+    // the backend, and a command that offered them here would have to change access one piece at a
+    // time — a half-applied grant is worse than none. They stay on the access page until there is a
+    // single atomic update (CYCL-46).
+    static description = "Update a service account's secret access: the environments it may read secrets in (full replace)";
+    static examples = [
+        '<%= config.bin %> service-accounts update <id> --secret-environment staging --secret-environment production',
+        '<%= config.bin %> service-accounts update <id> --all-environments',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Service account id', required: true }),
+    };
+    static flags = {
+        'secret-environment': core_1.Flags.string({
+            description: 'Environment code the account may read secrets in (repeatable; replaces the whole list)',
+            multiple: true,
+        }),
+        'all-environments': core_1.Flags.boolean({
+            description: 'Remove the restriction entirely: secrets readable in every environment',
+            default: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(ServiceAccountsUpdate);
+        const codes = (0, service_accounts_1.normalizeEnvironmentCodes)(flags['secret-environment'] ?? []);
+        const openUp = flags['all-environments'];
+        // The two flags say opposite things about the same list. Guessing which one wins would either
+        // widen the access silently or ignore the codes that were spelled out.
+        if (openUp && codes.length > 0) {
+            this.error('Pass either --secret-environment (the codes to allow) or --all-environments (no restriction at all), not both.', { exit: 2 });
+        }
+        // No flag, or nothing but blanks: the body would carry an empty list, and on this endpoint an
+        // empty list is not "leave it alone" — it is "every environment". An `update` that meant to
+        // change nothing would hand out the production secrets.
+        if (!openUp && codes.length === 0) {
+            this.error('Nothing to set: pass --secret-environment <code> (repeatable) to restrict the account, or ' +
+                '--all-environments to remove the restriction. An empty list means every environment, so it has to be asked for.', { exit: 2 });
+        }
+        await this.refuseUnknownEnvironments(codes);
+        const res = await this.api.put(`/cli/v1/service/accounts/${encodeURIComponent(args.id)}`, { secret_environment_codes: codes });
+        const account = (0, service_accounts_1.withoutSecret)(res.data ?? {});
+        const applied = (0, service_accounts_1.normalizeEnvironmentCodes)(Array.isArray(account.secret_environment_codes) ? account.secret_environment_codes : []);
+        if (!this.jsonEnabled()) {
+            this.log('Service account updated:');
+            this.log((0, output_1.renderRecord)((0, service_accounts_1.accountSummary)(account)));
+            this.log((0, service_accounts_1.environmentsLine)(applied));
+        }
+        // After printing: the boundary that is actually in force is what the reader needs most when the
+        // server kept something else, and only then does the command refuse to call it a success.
+        (0, service_accounts_1.assertBoundaryApplied)(codes, applied);
+        return { ...res, data: account };
+    }
+    /**
+     * Refuse a code this organization does not declare, before the write goes out.
+     *
+     * The server would answer 200 to it: `SetSecretAccess` intersects the list with the real codes and
+     * saves the remainder, so a single typo empties the allow-list — which grants EVERY environment
+     * instead of restricting to one. Checked after the flag guards and never for `--all-environments`
+     * (there is no code to check), so the extra read only happens when it can prevent something.
+     */
+    async refuseUnknownEnvironments(codes) {
+        if (codes.length === 0)
+            return;
+        const known = await this.organizationEnvironmentCodes();
+        if (known === undefined)
+            return;
+        const unknown = (0, service_accounts_1.unknownEnvironmentCodes)(codes, known);
+        if (unknown.length === 0)
+            return;
+        this.error(`Unknown environment ${unknown.length === 1 ? 'code' : 'codes'}: ${unknown.join(', ')}. ` +
+            `This organization declares: ${known.join(', ')}. ` +
+            'Nothing was changed — a code that does not exist is dropped by the server, which would leave the ' +
+            'account with no restriction at all (every environment).', { exit: 2 });
+    }
+    /**
+     * The environment codes of the organization, or `undefined` when they cannot be read.
+     *
+     * Listing them needs `environments.view`, which managing service accounts does not imply: a 403
+     * here says nothing about the update being legitimate, so it must not block it — the request/response
+     * comparison after the write stays as the guard. An empty list is read the same way rather than as
+     * "every code is invalid", so a lookup that changes shape can never refuse a correct command.
+     */
+    async organizationEnvironmentCodes() {
+        try {
+            const rows = await (0, paginate_1.fetchAllPages)(this.api, '/cli/v1/environments');
+            const codes = (0, service_accounts_1.normalizeEnvironmentCodes)(rows.map((row) => row.code));
+            return codes.length > 0 ? codes : undefined;
+        }
+        catch (error) {
+            if (error instanceof api_1.ApiRequestError)
+                return undefined;
+            throw error;
+        }
+    }
+}
+exports.default = ServiceAccountsUpdate;

package/dist/commands/shared/delete.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base';
+export default class SharedDelete extends BaseCommand {
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/shared/delete.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class SharedDelete extends base_1.BaseCommand {
+    static args = {
+        name: core_1.Args.string({ description: 'Shared secret name, or its id', required: true }),
+    };
+    // The backend has no per-environment destroy: like the web matrix, it deletes the whole row.
+    // Say so in the description, in the --confirm refusal and in the success line, so nobody reads
+    // this as "removes the production cell" (CYCL-41).
+    static description = 'Delete an organization shared secret from EVERY environment at once (irreversible). There is no per-environment deletion.';
+    static examples = ['<%= config.bin %> shared delete API_KEY --confirm'];
+    static flags = {
+        confirm: core_1.Flags.boolean({ description: 'Required: confirm the deletion across every environment' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(SharedDelete);
+        if (!flags.confirm) {
+            this.error(`Refusing to delete without --confirm: this removes ${args.name} from every environment at once, not just one.`, { exit: 2 });
+        }
+        const ref = base_1.UUID_RE.test(args.name) ? args.name : args.name.toUpperCase();
+        await this.api.delete(`/cli/v1/shared_secrets/${encodeURIComponent(ref)}`);
+        if (!this.jsonEnabled()) {
+            this.log(`Shared secret ${ref} deleted from every environment.`);
+        }
+        return { deleted: ref, environments: 'all' };
+    }
+}
+exports.default = SharedDelete;