@bussolabs/closeyourit-cli 0.22.0 → 0.23.1

package/dist/commands/shared/list.d.ts

@@ -0,0 +1,6 @@
+import { BaseCommand } from '../../base';
+export default class SharedList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/shared/list.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+const paginate_1 = require("../../lib/paginate");
+/**
+ * Environment codes carried by a shared-variable row, or `[]` when the payload does not say.
+ *
+ * A shared variable holds one value per environment, but `SharedSecretVariableSerializer` today
+ * ships only `{id, name, description, created_at, updated_at}` — the per-environment matrix is not
+ * in the list payload. Read it defensively rather than print an always-empty column: the day the
+ * backend adds `environments`, `shared list` shows it without a CLI change (CYCL-41).
+ */
+function environmentCodes(row) {
+    if (!Array.isArray(row.environments))
+        return [];
+    return row.environments
+        .map((env) => (env !== null && typeof env === 'object' ? env.code : env))
+        .map((code) => String(code ?? ''))
+        .filter(Boolean);
+}
+class SharedList extends base_1.BaseCommand {
+    static description = 'List the organization shared secret names (one row per variable, every page). Never prints values.';
+    static examples = ['<%= config.bin %> shared list', '<%= config.bin %> shared list --json'];
+    async run() {
+        await this.parse(SharedList);
+        const data = await (0, paginate_1.fetchAllPages)(this.api, '/cli/v1/shared_secrets');
+        if (!this.jsonEnabled()) {
+            // ENVIRONMENTS shows up only when at least one row carries it, like the STATUS column of
+            // `kb list`: a column of blanks would read as "this variable is on no environment".
+            const showEnvironments = data.some((secret) => environmentCodes(secret).length > 0);
+            const headers = showEnvironments ? ['NAME', 'ENVIRONMENTS', 'DESCRIPTION', 'UPDATED'] : ['NAME', 'DESCRIPTION', 'UPDATED'];
+            const rows = data.map((secret) => {
+                const row = [String(secret.name ?? '')];
+                if (showEnvironments)
+                    row.push(environmentCodes(secret).join(', '));
+                row.push(String(secret.description ?? ''), String(secret.updated_at ?? ''));
+                return row;
+            });
+            this.log((0, output_1.renderTable)(headers, rows));
+        }
+        return { data, meta: (0, paginate_1.aggregatedMeta)(data.length) };
+    }
+}
+exports.default = SharedList;

package/dist/commands/shared/set.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../base';
+export default class SharedSet extends BaseCommand {
+    static args: {
+        assignment: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        value: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/shared/set.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class SharedSet extends base_1.BaseCommand {
+    static args = {
+        assignment: core_1.Args.string({ description: 'NAME=VALUE, or just NAME with --value', required: true }),
+    };
+    static description = 'Set (create or update) an organization shared secret for one environment. Projects delegated on that environment read the new value.';
+    static examples = [
+        '<%= config.bin %> shared set -e production SENTRY_DSN=https://key@sentry.io/42',
+        '<%= config.bin %> shared set -e staging API_KEY --value s3cr3t --description "Stripe key"',
+    ];
+    static flags = {
+        // No --project on purpose: a shared variable belongs to the organization and reaches projects
+        // through delegation, so scoping it to one project at write time would be a lie.
+        ...base_1.environmentFlag,
+        value: core_1.Flags.string({ description: 'Secret value (use when the arg is just NAME)' }),
+        description: core_1.Flags.string({ description: 'Optional description' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(SharedSet);
+        const eq = args.assignment.indexOf('=');
+        const name = eq === -1 ? args.assignment : args.assignment.slice(0, eq);
+        const value = eq === -1 ? flags.value : args.assignment.slice(eq + 1);
+        if (value === undefined) {
+            this.error('Provide a value: use NAME=VALUE or pass --value', { exit: 1 });
+        }
+        const res = await this.api.post('/cli/v1/shared_secrets', {
+            environment: flags.environment,
+            name,
+            value,
+            description: flags.description,
+        });
+        if (!this.jsonEnabled()) {
+            this.log(`Shared secret ${String(name).toUpperCase()} saved (${flags.environment}).`);
+        }
+        return res;
+    }
+}
+exports.default = SharedSet;

package/dist/commands/tickets/ask.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class TicketsAsk extends BaseCommand {
+    static strict: boolean;
+    static description: string;
+    static examples: string[];
+    static args: {
+        question: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        timeout: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tickets/ask.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const error_codes_1 = require("../../errors/error-codes");
+const api_1 = require("../../lib/api");
+const output_1 = require("../../lib/output");
+const poll_1 = require("../../lib/poll");
+class TicketsAsk extends base_1.BaseCommand {
+    // Variadic question: every positional word is joined into a single natural-language question.
+    static strict = false;
+    static description = 'Ask a natural-language question about the tickets you can see; the AI answers and cites the tickets it used (may take a few seconds)';
+    static examples = [
+        '<%= config.bin %> tickets ask what is left before the next release',
+        '<%= config.bin %> tickets ask "has anyone reported this crash before?" --json',
+    ];
+    // Non-required: with strict = false the arg validation is off, so we guard the empty case ourselves.
+    static args = {
+        question: core_1.Args.string({ description: 'The question (all positional words are joined)' }),
+    };
+    static flags = {
+        timeout: core_1.Flags.integer({
+            description: 'Seconds to wait for the answer before giving up',
+            default: poll_1.DEFAULT_TIMEOUT_SECONDS,
+        }),
+    };
+    async run() {
+        const { argv, flags } = await this.parse(TicketsAsk);
+        const question = argv.join(' ').trim();
+        if (question === '') {
+            this.error('Provide a question (e.g. "tickets ask what is left before the next release").', { exit: 2 });
+        }
+        const invalidTimeout = (0, poll_1.timeoutError)(flags.timeout);
+        if (invalidTimeout)
+            this.error(invalidTimeout, { exit: 2 });
+        if (!this.jsonEnabled())
+            this.log('Asking your tickets (AI), this may take a few seconds…');
+        // The question is answered elsewhere: this call only queues it and hands back the id to follow.
+        const queued = await this.api.post('/cli/v1/tickets/ask', { question });
+        const requestId = queued.data?.request_id;
+        if (typeof requestId !== 'string' || requestId === '') {
+            throw new api_1.ApiRequestError(502, error_codes_1.ErrorCodes.Ask.failed, 'The server accepted the question without a request id: there is nothing to follow.');
+        }
+        const final = await (0, poll_1.pollUntil)(async () => (await this.api.get(`/cli/v1/ai/requests/${encodeURIComponent(requestId)}`)).data ?? {}, (state) => state.status !== 'pending', {
+            timeoutMs: flags.timeout * 1000,
+            // Not "ask again": the question is still being worked on as request `${requestId}`, and
+            // repeating it would queue a second one instead of picking that answer up. Waiting longer
+            // is the way through.
+            timeoutMessage: `No answer within ${flags.timeout}s: request ${requestId} is still being worked on. ` +
+                'Ask again with a longer --timeout (asking now would queue a second question, not collect this one).',
+        });
+        if (final.status === 'failed') {
+            throw new api_1.ApiRequestError(502, final.error?.code ?? error_codes_1.ErrorCodes.Ask.failed, final.error?.message ?? 'The question could not be answered (temporary problem upstream); try again in a moment.');
+        }
+        // Anything that is not `pending` ended the wait, but only `done` carries a result: a missing or
+        // unknown status would otherwise print as a successful empty answer.
+        if (final.status !== 'done') {
+            throw new api_1.ApiRequestError(502, error_codes_1.ErrorCodes.Ask.failed, `The server reported a request state this CLI does not know ("${final.status ?? 'none'}"): treat the answer as missing.`);
+        }
+        const result = final.result ?? {};
+        if (!this.jsonEnabled()) {
+            if (result.insufficient) {
+                this.log('The tickets you can see do not have enough to answer this confidently.');
+            }
+            const answer = String(result.answer ?? '').trim();
+            if (answer !== '')
+                this.log((0, output_1.sanitizeMultiline)(result.answer));
+            // The tickets the answer stands on: an answer that names its sources can be checked, one that
+            // does not asks to be believed.
+            const tickets = Array.isArray(result.tickets) ? result.tickets : [];
+            if (tickets.length > 0) {
+                this.log('\n🎫 Tickets:');
+                for (const ticket of tickets) {
+                    this.log(`  ${(0, output_1.sanitize)(ticket.code)} · ${(0, output_1.sanitize)(ticket.title)} · ${(0, output_1.sanitize)(ticket.status_label)}`);
+                }
+            }
+        }
+        return { data: { request_id: requestId, status: final.status, result } };
+    }
+}
+exports.default = TicketsAsk;

package/dist/commands/tickets/dependencies/add.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../../base';
+export default class TicketsDependenciesAdd extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        blocker: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+    /** Il blocker si nomina col suo codice; l'elenco lo espone su `code`, salvo che sia oscurato. */
+    private dependencyExists;
+}

package/dist/commands/tickets/dependencies/add.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const api_1 = require("../../../lib/api");
+/** Il server risponde così quando l'arco che si sta creando non è ammesso — doppione compreso. */
+const NOT_ALLOWED = 'R422-TICKET-017';
+class TicketsDependenciesAdd extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Ticket id or code (e.g. CYRA-132)', required: true }),
+        blocker: core_1.Args.string({ description: 'Prerequisite ticket id or code — may live in another project', required: true }),
+    };
+    static description = 'Add a prerequisite to a ticket: the blocker has to be finished before this ticket can start';
+    static examples = [
+        '<%= config.bin %> tickets dependencies add CYRA-132 CYAU-83 --project closeyourit-rails',
+        'while read -r a b; do <%= config.bin %> tickets dependencies add "$a" "$b" -p closeyourit-rails; done < ordine.txt',
+    ];
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(TicketsDependenciesAdd);
+        const projectId = await this.resolveProjectId(flags.project);
+        const base = `/cli/v1/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(args.id)}/dependencies`;
+        // Gemello della guardia in `remove`: con l'argomento vuoto la rilettura combacerebbe con una riga
+        // oscurata (`code: null` vale "") e questo comando direbbe «già presente» uscendo 0 — un errore
+        // vero che passa per lavoro fatto, proprio dentro il file che si rilancia.
+        if (args.blocker.trim() === '') {
+            this.error('Il prerequisito va nominato: passa il suo codice, anche di un altro prodotto (es. CYAU-83).', { exit: 2 });
+        }
+        try {
+            const res = await this.api.post(base, { blocker: args.blocker });
+            if (!this.jsonEnabled())
+                this.log(`prerequisito aggiunto: ${args.id} ← ${args.blocker}`);
+            return res.data;
+        }
+        catch (error) {
+            // Rilanciare il file intero deve essere sicuro: un legame già scritto non è un errore, è il
+            // lavoro già fatto. Ma `R422-TICKET-017` non vuol dire solo «c'è già» — è la risposta a ogni
+            // arco non ammesso, e trattarla come «va bene» in blocco farebbe passare per riuscite anche le
+            // righe rifiutate per un altro motivo. Quindi si rilegge l'elenco: se l'arco c'è davvero si esce
+            // 0, altrimenti l'errore propaga.
+            //
+            // Il ciclo (R422-TICKET-013) e il prerequisito inesistente (R404-TICKET-015) propagano sempre:
+            // lì la riga è sbagliata e va vista, non ingoiata.
+            if (!(error instanceof api_1.ApiRequestError) || error.code !== NOT_ALLOWED)
+                throw error;
+            const gia = await this.dependencyExists(base, args.blocker);
+            if (!gia)
+                throw error;
+            if (!this.jsonEnabled())
+                this.log(`prerequisito già presente: ${args.id} ← ${args.blocker}`);
+            return { ticket: args.id, blocker: args.blocker, alreadyPresent: true };
+        }
+    }
+    /** Il blocker si nomina col suo codice; l'elenco lo espone su `code`, salvo che sia oscurato. */
+    async dependencyExists(base, blocker) {
+        const res = await this.api.get(base);
+        const cercato = blocker.toLowerCase();
+        return (res.data ?? []).some((row) => (typeof row.code === 'string' && row.code.toLowerCase() === cercato) ||
+            (typeof row.blocker_id === 'string' && row.blocker_id === blocker));
+    }
+}
+exports.default = TicketsDependenciesAdd;

package/dist/commands/tickets/dependencies/list.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base';
+export default class TicketsDependenciesList extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tickets/dependencies/list.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+class TicketsDependenciesList extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Ticket id or code (e.g. CYRA-132)', required: true }),
+    };
+    static description = 'List the prerequisites of a ticket: what has to be finished before this one can start';
+    static examples = [
+        '<%= config.bin %> tickets dependencies list CYRA-132 --project closeyourit-rails',
+        '<%= config.bin %> tickets dependencies list CYRA-132 -p closeyourit-rails --json',
+    ];
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(TicketsDependenciesList);
+        const projectId = await this.resolveProjectId(flags.project);
+        const path = `/cli/v1/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(args.id)}/dependencies`;
+        const res = await this.api.get(path);
+        const rows = res.data ?? [];
+        if (!this.jsonEnabled()) {
+            // Un prerequisito in un prodotto che il tuo accesso non vede resta VISIBILE come fatto — esiste,
+            // ed è concluso o no — ma senza codice né titolo. È la stessa regola della pagina web: nascondere
+            // anche l'esistenza direbbe «questo ticket non è bloccato», che è falso e porta a partire.
+            this.log((0, output_1.renderTable)(['ID', 'BLOCKER', 'TITLE', 'STATUS', 'DONE'], rows.map((row) => [
+                (0, output_1.sanitize)(row.id ?? ''),
+                row.hidden === true ? '(nascosto)' : (0, output_1.sanitize)(row.code ?? ''),
+                row.hidden === true ? '(fuori dal tuo accesso)' : (0, output_1.sanitize)(row.title ?? ''),
+                (0, output_1.sanitize)(row.status?.label ?? row.status?.code ?? ''),
+                row.done === true ? 'sì' : 'no',
+            ])));
+        }
+        return rows;
+    }
+}
+exports.default = TicketsDependenciesList;

package/dist/commands/tickets/dependencies/remove.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../../base';
+export default class TicketsDependenciesRemove extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        blocker: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+    private resolveDependencyId;
+}

package/dist/commands/tickets/dependencies/remove.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class TicketsDependenciesRemove extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Ticket id or code (e.g. CYRA-132)', required: true }),
+        blocker: core_1.Args.string({
+            description: 'Prerequisite to remove: its ticket code (e.g. CYAU-83) or the dependency id',
+            required: true,
+        }),
+    };
+    static description = 'Remove a prerequisite from a ticket';
+    static examples = [
+        '<%= config.bin %> tickets dependencies remove CYRA-132 CYAU-83 --project closeyourit-rails',
+    ];
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(TicketsDependenciesRemove);
+        const projectId = await this.resolveProjectId(flags.project);
+        const base = `/cli/v1/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(args.id)}/dependencies`;
+        // Il server vuole l'UUID della dipendenza, che nessun comando ti ha mai mostrato: si accetta anche
+        // il CODICE del prerequisito — quello che hai scritto per aggiungerlo — e lo si risolve leggendo
+        // l'elenco. Nessun --confirm: l'arco si ricrea identico con una riga, e la riprovabilità è lo scopo
+        // di tutto questo lavoro.
+        // Un prerequisito NASCOSTO ha `code: null`, che confrontato come stringa vale "". Un argomento
+        // vuoto diventa quindi "" e combacerebbe con la prima riga oscurata: `remove <ticket> ""`
+        // cancellerebbe un prerequisito che chi lancia non ha nemmeno il diritto di vedere, in silenzio.
+        if (args.blocker.trim() === '') {
+            this.error('Il prerequisito da togliere va nominato: passa il suo codice (es. CYAU-83) o l\'id della dipendenza.', { exit: 2 });
+        }
+        const dependencyId = await this.resolveDependencyId(base, args.blocker);
+        if (!dependencyId) {
+            // Nessuna DELETE alla cieca: senza aver trovato l'arco, mandarla vorrebbe dire chiedere al server
+            // di cancellare un id che non abbiamo, e leggere il suo 404 come se fosse la nostra risposta.
+            this.error(`Nessun prerequisito «${args.blocker}» su ${args.id}: niente da togliere.`, { exit: 2 });
+        }
+        await this.api.delete(`${base}/${encodeURIComponent(dependencyId)}`);
+        if (!this.jsonEnabled())
+            this.log(`prerequisito rimosso: ${args.id} ← ${args.blocker}`);
+        return { ticket: args.id, blocker: args.blocker, removed: dependencyId };
+    }
+    async resolveDependencyId(base, blocker) {
+        const res = await this.api.get(base);
+        const righe = res.data ?? [];
+        const cercato = blocker.toLowerCase();
+        // Prima per codice del prerequisito, poi per id della dipendenza: chi ha già l'id (lo stampa
+        // `dependencies list`) non deve essere costretto a passare dal codice, che per un prerequisito
+        // oscurato non esiste nemmeno.
+        // `code` ASSENTE non combacia mai, con nessun argomento: è la riga oscurata, e l'unico modo di
+        // toglierla è nominarne l'id — quello che `dependencies list` stampa anche per lei.
+        const perCodice = righe.find((row) => typeof row.code === 'string' && row.code.toLowerCase() === cercato);
+        if (perCodice?.id)
+            return String(perCodice.id);
+        const perId = righe.find((row) => String(row.id ?? '') === blocker || String(row.blocker_id ?? '') === blocker);
+        return perId?.id ? String(perId.id) : null;
+    }
+}
+exports.default = TicketsDependenciesRemove;

package/dist/commands/tickets/work-context.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base';
+export default class TicketsWorkContext extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        full: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+    /** Le due liste congelate: stessa tabella di `guidance show`, così il confronto con l'oggi è immediato. */
+    private renderPayload;
+}

package/dist/commands/tickets/work-context.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const api_1 = require("../../lib/api");
+const guidance_1 = require("../../lib/guidance");
+const output_1 = require("../../lib/output");
+class TicketsWorkContext extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Ticket id or code (e.g. DRFL-3)', required: true }),
+    };
+    static description = "Show the work context frozen when an automation host claimed the ticket: the references and procedures actually delivered back then, never the project's current guidance";
+    static examples = [
+        '<%= config.bin %> tickets work-context <ticket-id> --project acme-api',
+        '<%= config.bin %> tickets work-context DRFL-3 -p driverone-flutter',
+        '<%= config.bin %> tickets work-context DRFL-3 -p driverone-flutter --full',
+        '<%= config.bin %> tickets work-context DRFL-3 -p driverone-flutter --json',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        full: core_1.Flags.boolean({
+            description: 'Also print the frozen text of every reference and procedure, not just the table',
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(TicketsWorkContext);
+        const projectId = await this.resolveProjectId(flags.project);
+        const path = `/cli/v1/projects/${encodeURIComponent(projectId)}/tickets/${encodeURIComponent(args.id)}/work_context`;
+        // Una sola lettura, e sull'endpoint dello snapshot: mai un ripiego su /guidance. La guidance del
+        // progetto può essere cambiata dopo la presa in carico, e mostrarla al posto della fotografia
+        // significherebbe rispondere a un audit con la configurazione di oggi (CYCL-47, scenario 1).
+        let res;
+        try {
+            res = await this.api.get(path);
+        }
+        catch (error) {
+            throw describeWorkContextError(error, args.id);
+        }
+        if (!this.jsonEnabled()) {
+            const snapshot = res.data ?? {};
+            this.log(`Work context frozen when ${(0, output_1.sanitize)(args.id)} was claimed from the agent queue — not the project's current guidance (that is \`guidance show\`).`);
+            this.log((0, output_1.renderRecord)(snapshotSummary(snapshot)));
+            this.renderPayload(snapshot.payload, flags.full);
+        }
+        return res;
+    }
+    /** Le due liste congelate: stessa tabella di `guidance show`, così il confronto con l'oggi è immediato. */
+    renderPayload(payload, full) {
+        const rendered = (0, guidance_1.renderGuidance)(payload);
+        if (!rendered) {
+            this.log('\nThis snapshot froze no references and no procedures.');
+            return;
+        }
+        this.log(rendered);
+        if (!full) {
+            this.log('\nPass --full to read the frozen text of each reference and procedure.');
+            return;
+        }
+        // Il testo integrale è il cuore dell'audit (le istruzioni consegnate, non solo le loro chiavi),
+        // ma su una guidance ricca sono migliaia di caratteri: sta dietro --full per non trasformare
+        // ogni lettura rapida in un muro di testo. In --json c'è sempre tutto, comunque.
+        const body = renderFrozenText(payload);
+        if (body)
+            this.log(body);
+    }
+}
+exports.default = TicketsWorkContext;
+/** Intestazione della fotografia: chi l'ha ricevuta, quando, con quale versione di schema e digest. */
+function snapshotSummary(snapshot) {
+    return {
+        snapshot_id: snapshot.id ?? null,
+        captured_at: snapshot.generated_at ?? null,
+        captured_by: snapshot.actor_name ?? null,
+        payload_version: snapshot.payload_version ?? null,
+        digest: snapshot.digest ?? null,
+    };
+}
+/** Le entry di una lista del payload, o [] se il backend non l'ha mandata. */
+function entries(value) {
+    return Array.isArray(value) ? value : [];
+}
+/**
+ * Il testo congelato di ogni entry che ne ha uno: le `instructions` di una reference, il `content`
+ * di una procedure. Ritorna '' quando nessuna entry porta testo, così `--full` su uno snapshot di
+ * sole chiavi non stampa un titolo su una sezione vuota.
+ */
+function renderFrozenText(payload) {
+    if (!payload || typeof payload !== 'object')
+        return '';
+    const value = payload;
+    const blocks = [
+        ...entries(value.references).map((entry) => frozenBlock(entry, entry.instructions)),
+        ...entries(value.procedures).map((entry) => frozenBlock(entry, entry.content)),
+    ].filter((block) => block.length > 0);
+    if (blocks.length === 0)
+        return '';
+    return `${(0, output_1.section)('Frozen text', '🧊')}\n${blocks.join('\n')}`;
+}
+/** Una entry col suo testo: riga di intestazione (chiave · livello · posizione) e testo per intero. */
+function frozenBlock(entry, text) {
+    const body = String(text ?? '');
+    if (body.trim() === '')
+        return '';
+    const head = [entry.key, entry.level, entry.location].filter((part) => part !== undefined && part !== null && part !== '');
+    return `\n── ${head.map((part) => (0, output_1.sanitize)(part)).join(' · ')}\n${(0, output_1.sanitizeMultiline)(body)}`;
+}
+/**
+ * Riscrive i due rifiuti che un lettore fraintenderebbe, lasciando intatto tutto il resto (codice
+ * del server compreso, così uno script continua a distinguerli):
+ *
+ * - `R404-TICKET-004` non è «ticket non trovato»: il ticket c'è, è la fotografia a mancare. Dire
+ *   «mai preso in carico» sarebbe però una bugia comoda: lo snapshot lo scatta SOLO la presa in
+ *   carico dalla coda degli host automatici (Agents::TicketQueues::Claim), quindi un ticket preso a
+ *   mano — con `tickets lease claim` o assegnandolo — non ne ha uno, e nemmeno i ticket presi in
+ *   carico prima che la fotografia esistesse. Il messaggio dice cosa manca e perché può mancare,
+ *   così chi legge non conclude che nessuno ci abbia mai lavorato.
+ * - il 403 arriva come «Permesso negato» e basta: qui la chiave che manca è `tickets.audit.view`,
+ *   che è dedicata al materiale d'audit — vedere il ticket, o la sua guidance, non basta.
+ */
+function describeWorkContextError(error, ticketRef) {
+    if (!(error instanceof api_1.ApiRequestError))
+        return error;
+    if (error.status === 404 && error.code === 'R404-TICKET-004') {
+        return new api_1.ApiRequestError(error.status, error.code, `No work context was captured for ticket ${ticketRef}: the snapshot is taken only when an automation host claims the ticket from the queue, so a manual claim — or one older than the snapshot itself — leaves none behind.`, error.details);
+    }
+    if (error.status === 403) {
+        return new api_1.ApiRequestError(error.status, error.code, `${error.message}. Reading a work context needs the tickets.audit.view permission: it is audit material, seeing the ticket is not enough.`, error.details);
+    }
+    return error;
+}

package/dist/commands/vault/requests/approve.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../../base';
+export default class VaultRequestsApprove extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/vault/requests/approve.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+const vault_requests_1 = require("../../../lib/vault-requests");
+class VaultRequestsApprove extends base_1.BaseCommand {
+    // No --confirm here, unlike the destructive deletions of this CLI: "approve" IS the confirmation —
+    // the command exists to say yes, and asking twice would only push the reviewer back to the website
+    // this command replaces. The success line names what was applied and where, so an approval on the
+    // wrong id is visible at once.
+    static description = 'Approve a pending secret change request: the change it carries is applied to the vault. Whoever asked for it cannot approve it (four-eyes), and a service account never can.';
+    static examples = [
+        '<%= config.bin %> vault requests approve <id>',
+        '<%= config.bin %> vault requests approve <id> --json',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Change request id (from "vault requests list")', required: true }),
+    };
+    async run() {
+        const { args } = await this.parse(VaultRequestsApprove);
+        let res;
+        try {
+            res = await this.api.post(`${vault_requests_1.CHANGE_REQUESTS_PATH}/${encodeURIComponent(args.id)}/approve`);
+        }
+        catch (error) {
+            throw (0, vault_requests_1.describeDecisionError)(error);
+        }
+        const decided = (0, vault_requests_1.withoutValue)(res.data ?? {});
+        if (!this.jsonEnabled()) {
+            const label = (0, vault_requests_1.changeRequestLabel)(decided);
+            this.log(label ? `Change request approved: ${label} is applied.` : 'Change request approved.');
+            const summary = (0, vault_requests_1.changeRequestSummary)(decided);
+            if (Object.keys(summary).length > 0)
+                this.log((0, output_1.renderRecord)(summary));
+        }
+        return { ...res, data: decided };
+    }
+}
+exports.default = VaultRequestsApprove;

package/dist/commands/vault/requests/list.d.ts

@@ -0,0 +1,6 @@
+import { BaseCommand } from '../../../base';
+export default class VaultRequestsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}