@bussolabs/closeyourit-cli 0.22.0 → 0.23.1

package/dist/lib/assistant.d.ts

@@ -0,0 +1,29 @@
+/** A message of an assistant conversation, as the backend serializes it (AssistantMessageSerializer). */
+export interface AssistantMessage extends Record<string, unknown> {
+    id?: string;
+    role?: string;
+    /** `streaming` = still being written; `complete`/`failed` = final. */
+    status?: string;
+    content?: string | null;
+    tools_used?: unknown;
+    error_code?: string | null;
+    created_at?: string;
+}
+/** `{code, message}` for a failed reply: the server code when there is one, ours when there is not. */
+export declare function assistantFailure(errorCode?: string | null): {
+    code: string;
+    message: string;
+};
+/**
+ * The `🧰 Tools used:` line, or '' when the reply used none. What the assistant read is what makes
+ * the answer checkable, so it is printed next to the answer and not hidden behind `--json`.
+ */
+export declare function renderToolsUsed(tools: unknown, prefix?: string): string;
+/** Every message of a conversation, oldest first (the order the backend serializes them in). */
+export declare function renderMessages(messages: unknown): string;
+/**
+ * The conversation list. ID first: it is the argument of `assistant conversations show|delete` and
+ * the value of `assistant ask --conversation`, so a table without it would force `--json` just to
+ * carry on the conversation you are looking at.
+ */
+export declare function renderConversationsTable(rows: Array<Record<string, unknown>>): string;

package/dist/lib/assistant.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assistantFailure = assistantFailure;
+exports.renderToolsUsed = renderToolsUsed;
+exports.renderMessages = renderMessages;
+exports.renderConversationsTable = renderConversationsTable;
+const error_codes_1 = require("../errors/error-codes");
+const output_1 = require("./output");
+/**
+ * Why a reply failed, said in a way that tells the reader what to do next.
+ *
+ * The backend ships only the code (`Assistant::Message#error_kind` does the same reading on the web
+ * side), and the three cases ask for three different reactions: nothing will change until someone
+ * connects the AI service, or the question itself must be rewritten, or it is worth trying again in
+ * a minute. Collapsing them into one "the assistant failed" would send people to retry forever
+ * something that cannot succeed.
+ */
+const FAILURE_MESSAGES = {
+    // Integrations::Providers::NOT_CONNECTED_CODE
+    'R503-INTEGRATION-006': 'The AI service is not connected for your organization: connect it from the web app, then ask again.',
+    // Assistant::Message::NO_ANSWER_ERROR_CODES
+    'R502-GEMINI-004': 'The assistant did not produce an answer for this question — try rephrasing it.',
+};
+const FAILURE_FALLBACK = 'The assistant could not answer (temporary problem upstream); try again in a moment.';
+/** `{code, message}` for a failed reply: the server code when there is one, ours when there is not. */
+function assistantFailure(errorCode) {
+    const code = errorCode ?? undefined;
+    return {
+        code: code ?? error_codes_1.ErrorCodes.Ask.failed,
+        message: (code ? FAILURE_MESSAGES[code] : undefined) ?? FAILURE_FALLBACK,
+    };
+}
+/**
+ * The `🧰 Tools used:` line, or '' when the reply used none. What the assistant read is what makes
+ * the answer checkable, so it is printed next to the answer and not hidden behind `--json`.
+ */
+function renderToolsUsed(tools, prefix = '') {
+    const names = Array.isArray(tools) ? tools.map((tool) => (0, output_1.sanitize)(tool)).filter((tool) => tool.trim() !== '') : [];
+    return names.length === 0 ? '' : `${prefix}🧰 Tools used: ${names.join(', ')}`;
+}
+/** One message: who spoke and when, the text, the reason when it failed, the tools it used. */
+function renderMessage(message) {
+    const when = (0, output_1.sanitize)(message.created_at ?? '');
+    const lines = [`${(0, output_1.statusDot)(message.status)} [${(0, output_1.sanitize)(message.role ?? '-')}] ${when}`.trimEnd()];
+    const content = String(message.content ?? '').trim();
+    if (content !== '')
+        lines.push((0, output_1.sanitizeMultiline)(message.content));
+    // A failed reply carries no text at all: without this line the conversation would show an empty
+    // bubble and no hint of what went wrong.
+    if (message.status === 'failed') {
+        const failure = assistantFailure(message.error_code);
+        lines.push(`⚠️  ${failure.code} — ${failure.message}`);
+    }
+    const tools = renderToolsUsed(message.tools_used);
+    if (tools !== '')
+        lines.push(tools);
+    return lines.join('\n');
+}
+/** Every message of a conversation, oldest first (the order the backend serializes them in). */
+function renderMessages(messages) {
+    const rows = Array.isArray(messages) ? messages : [];
+    return rows.length === 0 ? '(no messages)' : rows.map((message) => renderMessage(message)).join('\n\n');
+}
+/**
+ * The conversation list. ID first: it is the argument of `assistant conversations show|delete` and
+ * the value of `assistant ask --conversation`, so a table without it would force `--json` just to
+ * carry on the conversation you are looking at.
+ */
+function renderConversationsTable(rows) {
+    return (0, output_1.renderTable)(['ID', 'TITLE', 'LAST MESSAGE', 'CREATED'], rows.map((row) => [
+        String(row.id ?? ''),
+        String(row.title ?? ''),
+        String(row.last_message_at ?? ''),
+        String(row.created_at ?? ''),
+    ]));
+}

package/dist/lib/bulk-triage.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Bulk triage of monitoring groups (errors, metrics) — CYCL-44.
+ *
+ * The two endpoints are the same shape (`POST .../bulk_triage` with `ids[]` + `bulk_action`) and
+ * share the same blind spot, so the guard lives here once instead of in both commands.
+ */
+/** The three actions the backend accepts, for errors and metrics alike (`Observability::Triage::ACTIONS`). */
+export declare const TRIAGE_ACTIONS: readonly ["resolve", "ignore", "reopen"];
+/**
+ * The ids to send: the order they were written in, each one once.
+ *
+ * The server matches with `where(id: ids)`, which never returns the same row twice — so a repeated
+ * `--group` would come back as one row and the check below would read it as "one went missing".
+ * Deduplicating is safe here precisely because this endpoint is not all-or-nothing: unlike merge,
+ * where the raw list is the evidence the server needs to refuse the whole operation.
+ */
+export declare function uniqueIds(values: string[]): string[];
+/**
+ * Refuse a partial triage the caller cannot see.
+ *
+ * `bulk_triage` scopes the selection to the project and answers 200 on whatever is left, so an id
+ * belonging to another project (or to a page refreshed on stale data) is dropped without a word.
+ * A script would go on believing it closed thirty groups after closing twenty-eight. Everything the
+ * server did touch stays done — the triage is reversible, and undoing the good part would be worse
+ * — but the command says so and exits non-zero.
+ */
+export declare function assertNothingDropped(opts: {
+    action: string;
+    code: string;
+    noun: string;
+    requested: string[];
+    rows: Array<Record<string, unknown>>;
+}): void;
+/** `1 error group` / `3 error groups` — the count line both commands print. */
+export declare function triagedLine(count: number, noun: string, action: string): string;

package/dist/lib/bulk-triage.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRIAGE_ACTIONS = void 0;
+exports.uniqueIds = uniqueIds;
+exports.assertNothingDropped = assertNothingDropped;
+exports.triagedLine = triagedLine;
+const api_1 = require("./api");
+/**
+ * Bulk triage of monitoring groups (errors, metrics) — CYCL-44.
+ *
+ * The two endpoints are the same shape (`POST .../bulk_triage` with `ids[]` + `bulk_action`) and
+ * share the same blind spot, so the guard lives here once instead of in both commands.
+ */
+/** The three actions the backend accepts, for errors and metrics alike (`Observability::Triage::ACTIONS`). */
+exports.TRIAGE_ACTIONS = ['resolve', 'ignore', 'reopen'];
+/**
+ * The ids to send: the order they were written in, each one once.
+ *
+ * The server matches with `where(id: ids)`, which never returns the same row twice — so a repeated
+ * `--group` would come back as one row and the check below would read it as "one went missing".
+ * Deduplicating is safe here precisely because this endpoint is not all-or-nothing: unlike merge,
+ * where the raw list is the evidence the server needs to refuse the whole operation.
+ */
+function uniqueIds(values) {
+    const seen = new Set();
+    return values.filter((value) => {
+        const key = value.toLowerCase();
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/**
+ * Refuse a partial triage the caller cannot see.
+ *
+ * `bulk_triage` scopes the selection to the project and answers 200 on whatever is left, so an id
+ * belonging to another project (or to a page refreshed on stale data) is dropped without a word.
+ * A script would go on believing it closed thirty groups after closing twenty-eight. Everything the
+ * server did touch stays done — the triage is reversible, and undoing the good part would be worse
+ * — but the command says so and exits non-zero.
+ */
+function assertNothingDropped(opts) {
+    const returned = new Set(opts.rows.map((row) => String(row.id ?? '').toLowerCase()));
+    const missing = opts.requested.filter((id) => !returned.has(id.toLowerCase()));
+    if (missing.length === 0)
+        return;
+    throw new api_1.ApiRequestError(404, opts.code, `Triaged ${opts.rows.length} of ${opts.requested.length} ${opts.noun}s (${opts.action}). ` +
+        `Not found in this project: ${missing.join(', ')} — those were left untouched, ` +
+        `the other ${opts.rows.length} were changed.`);
+}
+/** `1 error group` / `3 error groups` — the count line both commands print. */
+function triagedLine(count, noun, action) {
+    return `Triaged ${count} ${noun}${count === 1 ? '' : 's'} (${action}).`;
+}

package/dist/lib/grouping-rules.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Custom error grouping rules (CYCL-44, server side CYRA-153).
+ *
+ * At ingest time the first active rule, in `position` order, whose match succeeds rewrites the
+ * occurrence's fingerprint: everything hitting rules with the same `fingerprint_key` lands in one
+ * group. This is how a team bends the automatic grouping.
+ */
+/** Occurrence field a rule looks at (`Errors::GroupingRule.fields`). */
+export declare const GROUPING_RULE_FIELDS: readonly ["exception_type", "message", "culprit", "transaction"];
+/**
+ * How the field is compared (`Errors::GroupingRule.operators`). Always case-insensitive and never a
+ * regular expression: on the ingest hot path a user-supplied pattern would be an open door to ReDoS.
+ */
+export declare const GROUPING_RULE_OPERATORS: readonly ["contains", "equals", "starts_with"];
+export interface GroupingRuleFlags {
+    active?: boolean;
+    field?: string;
+    'fingerprint-key'?: string;
+    operator?: string;
+    position?: number;
+    value?: string;
+}
+/**
+ * The rule attributes to send, skipping every flag left out. `create` fills the required ones by
+ * declaring them required; `update` sends only what it was told to change, so an omitted flag keeps
+ * the value the rule already has instead of blanking it.
+ */
+export declare function groupingRuleBody(flags: GroupingRuleFlags): Record<string, unknown>;

package/dist/lib/grouping-rules.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * Custom error grouping rules (CYCL-44, server side CYRA-153).
+ *
+ * At ingest time the first active rule, in `position` order, whose match succeeds rewrites the
+ * occurrence's fingerprint: everything hitting rules with the same `fingerprint_key` lands in one
+ * group. This is how a team bends the automatic grouping.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GROUPING_RULE_OPERATORS = exports.GROUPING_RULE_FIELDS = void 0;
+exports.groupingRuleBody = groupingRuleBody;
+/** Occurrence field a rule looks at (`Errors::GroupingRule.fields`). */
+exports.GROUPING_RULE_FIELDS = ['exception_type', 'message', 'culprit', 'transaction'];
+/**
+ * How the field is compared (`Errors::GroupingRule.operators`). Always case-insensitive and never a
+ * regular expression: on the ingest hot path a user-supplied pattern would be an open door to ReDoS.
+ */
+exports.GROUPING_RULE_OPERATORS = ['contains', 'equals', 'starts_with'];
+/**
+ * The rule attributes to send, skipping every flag left out. `create` fills the required ones by
+ * declaring them required; `update` sends only what it was told to change, so an omitted flag keeps
+ * the value the rule already has instead of blanking it.
+ */
+function groupingRuleBody(flags) {
+    const body = {};
+    if (flags.field !== undefined)
+        body.field = flags.field;
+    if (flags.operator !== undefined)
+        body.operator = flags.operator;
+    if (flags.value !== undefined)
+        body.value = flags.value;
+    if (flags['fingerprint-key'] !== undefined)
+        body.fingerprint_key = flags['fingerprint-key'];
+    if (flags.position !== undefined)
+        body.position = flags.position;
+    if (flags.active !== undefined)
+        body.active = flags.active;
+    return body;
+}

package/dist/lib/knowledge.d.ts

@@ -5,6 +5,11 @@ export declare const KNOWLEDGE_KINDS: readonly ["note", "decision", "guide"];
  * `--kind note --kind decision,guide` → ['note', 'decision', 'guide'].
  */
 export declare function normalizeKinds(values?: string[]): string[];
+/**
+ * Clean a repeatable flag into a list: trimmed, empties dropped, order preserved.
+ * `--tag ""` therefore means "leave nothing" — the deliberate way to clear tags on update.
+ */
+export declare function cleanList(values?: string[]): string[];
 /** Collapse whitespace and truncate a cell so the list table stays single-line. */
 export declare function truncate(value: string, max?: number): string;
 /**
@@ -59,6 +64,16 @@ export declare function buildBooksQuery(opts: {
     project?: string;
     q?: string;
 }): string;
+/**
+ * The scope lines of a page — every project it belongs to, its groups, its tags — as readable
+ * `key: a, b` rows. `renderRecord` drops arrays, so without these a page connected to five projects
+ * read as if it had one, and its tags were invisible from the terminal (CYCL-45).
+ *
+ * `projects` shows up only past the first one: with a single project the `project` line above
+ * already says it, and repeating it would be noise on the pages that have always had just one.
+ * Groups and tags appear whenever there are any.
+ */
+export declare function pageScopeLines(page: Record<string, unknown>): Record<string, string>;
 /**
  * Render the `kb book list` table. ID first: it is the argument of `kb book show` and of
  * `kb book add-page`, so a table without it would force `--json` just to act on what you are

package/dist/lib/knowledge.js

@@ -2,11 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KNOWLEDGE_STATUSES = exports.KNOWLEDGE_KINDS = void 0;
 exports.normalizeKinds = normalizeKinds;
+exports.cleanList = cleanList;
 exports.truncate = truncate;
 exports.buildPagesQuery = buildPagesQuery;
 exports.renderRelated = renderRelated;
 exports.renderRelatedGroups = renderRelatedGroups;
 exports.buildBooksQuery = buildBooksQuery;
+exports.pageScopeLines = pageScopeLines;
 exports.renderBooksTable = renderBooksTable;
 exports.renderBook = renderBook;
 exports.renderPagesTable = renderPagesTable;
@@ -25,6 +27,15 @@ function normalizeKinds(values) {
         .map((value) => value.trim())
         .filter((value) => value.length > 0);
 }
+/**
+ * Clean a repeatable flag into a list: trimmed, empties dropped, order preserved.
+ * `--tag ""` therefore means "leave nothing" — the deliberate way to clear tags on update.
+ */
+function cleanList(values) {
+    if (!values)
+        return [];
+    return values.map((value) => value.trim()).filter((value) => value.length > 0);
+}
 /** Collapse whitespace and truncate a cell so the list table stays single-line. */
 function truncate(value, max = 60) {
     const flat = value.replace(/\s+/g, ' ').trim();
@@ -107,6 +118,31 @@ function joinList(value) {
         return undefined;
     return value.map((entry) => String(entry)).join(', ');
 }
+/**
+ * The scope lines of a page — every project it belongs to, its groups, its tags — as readable
+ * `key: a, b` rows. `renderRecord` drops arrays, so without these a page connected to five projects
+ * read as if it had one, and its tags were invisible from the terminal (CYCL-45).
+ *
+ * `projects` shows up only past the first one: with a single project the `project` line above
+ * already says it, and repeating it would be noise on the pages that have always had just one.
+ * Groups and tags appear whenever there are any.
+ */
+function pageScopeLines(page) {
+    const lines = {};
+    const projects = Array.isArray(page.projects) ? page.projects : [];
+    if (projects.length > 1) {
+        const keys = projects.map((project) => String(project.key ?? '')).filter(Boolean);
+        if (keys.length > 0)
+            lines.projects = keys.join(', ');
+    }
+    const groups = joinList(page.groups);
+    if (groups)
+        lines.groups = groups;
+    const tags = joinList(page.tags);
+    if (tags)
+        lines.tags = tags;
+    return lines;
+}
 /**
  * Render the `kb book list` table. ID first: it is the argument of `kb book show` and of
  * `kb book add-page`, so a table without it would force `--json` just to act on what you are

package/dist/lib/output.js

@@ -148,10 +148,20 @@ const STATUS_TONE = {
     high: 'down',
     moderate: 'warn',
     low: 'neutral',
+    // workload action (carico di lavoro non-dev)
+    planned: 'neutral',
+    in_progress: 'warn',
+    done: 'ok',
+    cancelled: 'neutral',
     // runtime support state
     ending_soon: 'warn',
     eol: 'down',
     supported: 'ok',
+    // assistant reply + async AI request (CYCL-43): `streaming`/`pending` = still being written,
+    // `complete`/`done` = there is an answer, `failed` = there will not be one.
+    complete: 'ok',
+    failed: 'down',
+    streaming: 'warn',
 };
 /**
  * Badge colour (Tailwind family name) → tone. Ticket status/priority labels are org-customisable,

package/dist/lib/poll.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Wait for something the server is preparing elsewhere, asking again every so often (CYCL-43).
+ *
+ * Both AI flows the CLI exposes answer later than they reply: `assistant ask` gets a message that
+ * is still being written, `tickets ask` an AI request that is still pending. The waiting is the
+ * same in both, and it is the part that goes wrong in interesting ways — so it lives here once.
+ *
+ * Two guarantees the callers depend on: the pause grows between attempts (a slow answer must not
+ * turn into hundreds of requests) and the wait always ends (`timeoutMs`), because a command that
+ * hangs forever on a terminal is worse than one that gives up and says where the answer will be.
+ *
+ * `timeoutMs` bounds the pauses and the number of attempts, not a single request: one `fetch` that
+ * never returns still hangs, because `CliApi` sends without an abort signal — a gap that belongs to
+ * the HTTP layer and would have to be closed there, for every command at once.
+ */
+export interface PollOptions<T> {
+    /** What the caller already holds (the POST response): already settled → no request at all. */
+    initial?: T;
+    /** Hard ceiling on the whole wait. */
+    timeoutMs: number;
+    /** First pause; each following one is `factor` times longer, capped at `maxDelayMs`. */
+    firstDelayMs?: number;
+    maxDelayMs?: number;
+    factor?: number;
+    /** Body of the timeout error: says how to get the answer that is still coming. */
+    timeoutMessage: string;
+    /** Injectable for tests; default sleeps for real. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Injectable for tests; default is the wall clock. */
+    now?: () => number;
+}
+/**
+ * Default `--timeout` of the commands that wait for an AI answer. Three minutes is long enough for
+ * an assistant that reads several things before replying, and short enough that a terminal left
+ * open never looks frozen.
+ */
+export declare const DEFAULT_TIMEOUT_SECONDS = 180;
+/**
+ * Ask `fetch` again until `settled` says the value is final, then return it.
+ *
+ * Throws an `ApiRequestError` (status 408, `C408-ASK-001`) carrying `timeoutMessage` when the
+ * budget runs out — the shape `BaseCommand.catch` already prints as `code: message` on stderr and
+ * as an `{error:{code,message}}` envelope in `--json`, so a script can tell "still working" from
+ * "the server refused".
+ */
+export declare function pollUntil<T>(fetch: () => Promise<T>, settled: (value: T) => boolean, opts: PollOptions<T>): Promise<T>;
+/**
+ * Message for a `--timeout` that cannot wait for anything, or undefined when it is usable.
+ * Same shape as `paginationError`: the command line is refused before any call goes out.
+ */
+export declare function timeoutError(seconds: number): string | undefined;

package/dist/lib/poll.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TIMEOUT_SECONDS = void 0;
+exports.pollUntil = pollUntil;
+exports.timeoutError = timeoutError;
+const promises_1 = require("node:timers/promises");
+const api_1 = require("./api");
+const error_codes_1 = require("../errors/error-codes");
+const FIRST_DELAY_MS = 1000;
+const MAX_DELAY_MS = 5000;
+const FACTOR = 1.5;
+/**
+ * Default `--timeout` of the commands that wait for an AI answer. Three minutes is long enough for
+ * an assistant that reads several things before replying, and short enough that a terminal left
+ * open never looks frozen.
+ */
+exports.DEFAULT_TIMEOUT_SECONDS = 180;
+/**
+ * Ask `fetch` again until `settled` says the value is final, then return it.
+ *
+ * Throws an `ApiRequestError` (status 408, `C408-ASK-001`) carrying `timeoutMessage` when the
+ * budget runs out — the shape `BaseCommand.catch` already prints as `code: message` on stderr and
+ * as an `{error:{code,message}}` envelope in `--json`, so a script can tell "still working" from
+ * "the server refused".
+ */
+async function pollUntil(fetch, settled, opts) {
+    if (opts.initial !== undefined && settled(opts.initial))
+        return opts.initial;
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => (0, promises_1.setTimeout)(ms));
+    const maxDelay = opts.maxDelayMs ?? MAX_DELAY_MS;
+    const factor = opts.factor ?? FACTOR;
+    const deadline = now() + opts.timeoutMs;
+    let wait = Math.min(opts.firstDelayMs ?? FIRST_DELAY_MS, maxDelay);
+    for (;;) {
+        const remaining = deadline - now();
+        if (remaining <= 0) {
+            throw new api_1.ApiRequestError(408, error_codes_1.ErrorCodes.Ask.timeout, opts.timeoutMessage);
+        }
+        // Never sleep past the deadline: the last attempt lands exactly on it, so the full budget is
+        // used instead of being cut short by a pause that would have overshot it.
+        // eslint-disable-next-line no-await-in-loop
+        await sleep(Math.min(wait, remaining));
+        // eslint-disable-next-line no-await-in-loop
+        const value = await fetch();
+        if (settled(value))
+            return value;
+        wait = Math.min(Math.round(wait * factor), maxDelay);
+    }
+}
+/**
+ * Message for a `--timeout` that cannot wait for anything, or undefined when it is usable.
+ * Same shape as `paginationError`: the command line is refused before any call goes out.
+ */
+function timeoutError(seconds) {
+    if (seconds < 1)
+        return `Invalid --timeout ${seconds}: wait at least 1 second.`;
+    return undefined;
+}

package/dist/lib/service-accounts.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Reading and correcting a service account without recreating it (CYCL-46).
+ *
+ * One rule runs through everything here: on the secret boundary of a service account, an EMPTY list
+ * of environment codes does not mean "no access", it means "every environment". So the empty list is
+ * never a neutral value to fall into by accident — it is a decision, and it has to be printed with
+ * words that cannot be misread.
+ */
+/** The boundary in words: the codes, or the fact that there is no boundary at all. */
+export declare function environmentsLine(codes: unknown): string;
+/**
+ * Environment codes the way the server stores them: trimmed, lowercase, each one once, blanks
+ * dropped — the same normalisation `Connections::SetSecretAccess#sanitize` applies before saving.
+ * Sending them already in that shape is what makes "what I asked for" and "what came back"
+ * comparable at all: otherwise ` Staging ` would look dropped every single time.
+ */
+export declare function normalizeEnvironmentCodes(values: unknown[]): string[];
+/**
+ * The fields of a service account worth printing, as an explicit allow-list — the same discipline as
+ * `changeRequestSummary`: `renderRecord` prints every scalar it is handed, so handing it the raw
+ * payload would print whatever the server adds next, up to and including a field carrying a token.
+ * `secret_environment_codes` is left out on purpose: it is an array (renderRecord would swallow it)
+ * and it deserves the sentence `environmentsLine` builds, not a bare key.
+ */
+export declare function accountSummary(account: Record<string, unknown>): Record<string, unknown>;
+/**
+ * A copy of a token row without the secret, on both the human and the `--json` path.
+ *
+ * `UserApiTokenSerializer` never ships it — the secret exists only in the response of `tokens
+ * create`, reveal-once, and in the database there is just a prefix. This strips it anyway, for the
+ * same reason `withoutValue` does it on the vault queue: the CLI decides what leaves the terminal,
+ * so a payload that one day carried the secret (a serializer edit, a proxy, a hand-rolled backend)
+ * cannot turn a plain listing into a second reveal.
+ */
+export declare function withoutSecret<T>(row: T): T;
+/** `active` while the token works, `revoked` once it has been withdrawn — what the reader is after. */
+export declare function tokenStatus(token: Record<string, unknown>): string;
+/**
+ * The requested codes an organization does not declare — checked BEFORE writing.
+ *
+ * `SetSecretAccess` intersects what it receives with the codes the organization really has and
+ * saves what is left, answering 200 either way. On a typo that intersection is empty, and an empty
+ * allow-list is not "no environments", it is EVERY environment: `--secret-environment stagin` would
+ * hand the account the production secrets it was being restricted away from. Catching it here means
+ * the mistake costs an error message instead of an open door.
+ *
+ * `known` empty is treated as "could not read them" by the caller, not as "nothing is valid": a
+ * lookup that came back empty (no permission, a serializer without `code`) must not block a command
+ * the caller is entitled to run.
+ */
+export declare function unknownEnvironmentCodes(requested: string[], known: string[]): string[];
+/**
+ * Refuse an environment boundary the server did not actually put in place.
+ *
+ * The pre-flight check above catches the typo before it is written, but it cannot be the only
+ * guard: reading the environments needs `environments.view`, a permission managing members does not
+ * imply, and an environment can be removed between the two calls. So the request and the response
+ * are compared here too, and any difference — a code dropped OR a code appearing that nobody asked
+ * for, which would mean a wider boundary than requested — is an error, not a footnote.
+ *
+ * Whatever the server did save stays saved (the boundary is one call away from being fixed, and
+ * rolling it back blindly could lock out an agent mid-run), but the command says so and exits
+ * non-zero — the same shape as `assertNothingDropped` on a partial bulk triage.
+ */
+export declare function assertBoundaryApplied(requested: string[], applied: string[]): void;