@bussolabs/closeyourit-cli 0.22.0 → 0.24.1

package/dist/lib/output.js

@@ -148,10 +148,20 @@ const STATUS_TONE = {
     high: 'down',
     moderate: 'warn',
     low: 'neutral',
+    // workload action (carico di lavoro non-dev)
+    planned: 'neutral',
+    in_progress: 'warn',
+    done: 'ok',
+    cancelled: 'neutral',
     // runtime support state
     ending_soon: 'warn',
     eol: 'down',
     supported: 'ok',
+    // assistant reply + async AI request (CYCL-43): `streaming`/`pending` = still being written,
+    // `complete`/`done` = there is an answer, `failed` = there will not be one.
+    complete: 'ok',
+    failed: 'down',
+    streaming: 'warn',
 };
 /**
  * Badge colour (Tailwind family name) → tone. Ticket status/priority labels are org-customisable,

package/dist/lib/poll.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Wait for something the server is preparing elsewhere, asking again every so often (CYCL-43).
+ *
+ * Both AI flows the CLI exposes answer later than they reply: `assistant ask` gets a message that
+ * is still being written, `tickets ask` an AI request that is still pending. The waiting is the
+ * same in both, and it is the part that goes wrong in interesting ways — so it lives here once.
+ *
+ * Two guarantees the callers depend on: the pause grows between attempts (a slow answer must not
+ * turn into hundreds of requests) and the wait always ends (`timeoutMs`), because a command that
+ * hangs forever on a terminal is worse than one that gives up and says where the answer will be.
+ *
+ * `timeoutMs` bounds the pauses and the number of attempts, not a single request: one `fetch` that
+ * never returns still hangs, because `CliApi` sends without an abort signal — a gap that belongs to
+ * the HTTP layer and would have to be closed there, for every command at once.
+ */
+export interface PollOptions<T> {
+    /** What the caller already holds (the POST response): already settled → no request at all. */
+    initial?: T;
+    /** Hard ceiling on the whole wait. */
+    timeoutMs: number;
+    /** First pause; each following one is `factor` times longer, capped at `maxDelayMs`. */
+    firstDelayMs?: number;
+    maxDelayMs?: number;
+    factor?: number;
+    /** Body of the timeout error: says how to get the answer that is still coming. */
+    timeoutMessage: string;
+    /** Injectable for tests; default sleeps for real. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Injectable for tests; default is the wall clock. */
+    now?: () => number;
+}
+/**
+ * Default `--timeout` of the commands that wait for an AI answer. Three minutes is long enough for
+ * an assistant that reads several things before replying, and short enough that a terminal left
+ * open never looks frozen.
+ */
+export declare const DEFAULT_TIMEOUT_SECONDS = 180;
+/**
+ * Ask `fetch` again until `settled` says the value is final, then return it.
+ *
+ * Throws an `ApiRequestError` (status 408, `C408-ASK-001`) carrying `timeoutMessage` when the
+ * budget runs out — the shape `BaseCommand.catch` already prints as `code: message` on stderr and
+ * as an `{error:{code,message}}` envelope in `--json`, so a script can tell "still working" from
+ * "the server refused".
+ */
+export declare function pollUntil<T>(fetch: () => Promise<T>, settled: (value: T) => boolean, opts: PollOptions<T>): Promise<T>;
+/**
+ * Message for a `--timeout` that cannot wait for anything, or undefined when it is usable.
+ * Same shape as `paginationError`: the command line is refused before any call goes out.
+ */
+export declare function timeoutError(seconds: number): string | undefined;

package/dist/lib/poll.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TIMEOUT_SECONDS = void 0;
+exports.pollUntil = pollUntil;
+exports.timeoutError = timeoutError;
+const promises_1 = require("node:timers/promises");
+const api_1 = require("./api");
+const error_codes_1 = require("../errors/error-codes");
+const FIRST_DELAY_MS = 1000;
+const MAX_DELAY_MS = 5000;
+const FACTOR = 1.5;
+/**
+ * Default `--timeout` of the commands that wait for an AI answer. Three minutes is long enough for
+ * an assistant that reads several things before replying, and short enough that a terminal left
+ * open never looks frozen.
+ */
+exports.DEFAULT_TIMEOUT_SECONDS = 180;
+/**
+ * Ask `fetch` again until `settled` says the value is final, then return it.
+ *
+ * Throws an `ApiRequestError` (status 408, `C408-ASK-001`) carrying `timeoutMessage` when the
+ * budget runs out — the shape `BaseCommand.catch` already prints as `code: message` on stderr and
+ * as an `{error:{code,message}}` envelope in `--json`, so a script can tell "still working" from
+ * "the server refused".
+ */
+async function pollUntil(fetch, settled, opts) {
+    if (opts.initial !== undefined && settled(opts.initial))
+        return opts.initial;
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => (0, promises_1.setTimeout)(ms));
+    const maxDelay = opts.maxDelayMs ?? MAX_DELAY_MS;
+    const factor = opts.factor ?? FACTOR;
+    const deadline = now() + opts.timeoutMs;
+    let wait = Math.min(opts.firstDelayMs ?? FIRST_DELAY_MS, maxDelay);
+    for (;;) {
+        const remaining = deadline - now();
+        if (remaining <= 0) {
+            throw new api_1.ApiRequestError(408, error_codes_1.ErrorCodes.Ask.timeout, opts.timeoutMessage);
+        }
+        // Never sleep past the deadline: the last attempt lands exactly on it, so the full budget is
+        // used instead of being cut short by a pause that would have overshot it.
+        // eslint-disable-next-line no-await-in-loop
+        await sleep(Math.min(wait, remaining));
+        // eslint-disable-next-line no-await-in-loop
+        const value = await fetch();
+        if (settled(value))
+            return value;
+        wait = Math.min(Math.round(wait * factor), maxDelay);
+    }
+}
+/**
+ * Message for a `--timeout` that cannot wait for anything, or undefined when it is usable.
+ * Same shape as `paginationError`: the command line is refused before any call goes out.
+ */
+function timeoutError(seconds) {
+    if (seconds < 1)
+        return `Invalid --timeout ${seconds}: wait at least 1 second.`;
+    return undefined;
+}

package/dist/lib/service-accounts.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Reading and correcting a service account without recreating it (CYCL-46).
+ *
+ * One rule runs through everything here: on the secret boundary of a service account, an EMPTY list
+ * of environment codes does not mean "no access", it means "every environment". So the empty list is
+ * never a neutral value to fall into by accident — it is a decision, and it has to be printed with
+ * words that cannot be misread.
+ */
+/** The boundary in words: the codes, or the fact that there is no boundary at all. */
+export declare function environmentsLine(codes: unknown): string;
+/**
+ * Environment codes the way the server stores them: trimmed, lowercase, each one once, blanks
+ * dropped — the same normalisation `Connections::SetSecretAccess#sanitize` applies before saving.
+ * Sending them already in that shape is what makes "what I asked for" and "what came back"
+ * comparable at all: otherwise ` Staging ` would look dropped every single time.
+ */
+export declare function normalizeEnvironmentCodes(values: unknown[]): string[];
+/**
+ * The fields of a service account worth printing, as an explicit allow-list — the same discipline as
+ * `changeRequestSummary`: `renderRecord` prints every scalar it is handed, so handing it the raw
+ * payload would print whatever the server adds next, up to and including a field carrying a token.
+ * `secret_environment_codes` is left out on purpose: it is an array (renderRecord would swallow it)
+ * and it deserves the sentence `environmentsLine` builds, not a bare key.
+ */
+export declare function accountSummary(account: Record<string, unknown>): Record<string, unknown>;
+/**
+ * A copy of a token row without the secret, on both the human and the `--json` path.
+ *
+ * `UserApiTokenSerializer` never ships it — the secret exists only in the response of `tokens
+ * create`, reveal-once, and in the database there is just a prefix. This strips it anyway, for the
+ * same reason `withoutValue` does it on the vault queue: the CLI decides what leaves the terminal,
+ * so a payload that one day carried the secret (a serializer edit, a proxy, a hand-rolled backend)
+ * cannot turn a plain listing into a second reveal.
+ */
+export declare function withoutSecret<T>(row: T): T;
+/** `active` while the token works, `revoked` once it has been withdrawn — what the reader is after. */
+export declare function tokenStatus(token: Record<string, unknown>): string;
+/**
+ * The requested codes an organization does not declare — checked BEFORE writing.
+ *
+ * `SetSecretAccess` intersects what it receives with the codes the organization really has and
+ * saves what is left, answering 200 either way. On a typo that intersection is empty, and an empty
+ * allow-list is not "no environments", it is EVERY environment: `--secret-environment stagin` would
+ * hand the account the production secrets it was being restricted away from. Catching it here means
+ * the mistake costs an error message instead of an open door.
+ *
+ * `known` empty is treated as "could not read them" by the caller, not as "nothing is valid": a
+ * lookup that came back empty (no permission, a serializer without `code`) must not block a command
+ * the caller is entitled to run.
+ */
+export declare function unknownEnvironmentCodes(requested: string[], known: string[]): string[];
+/**
+ * Refuse an environment boundary the server did not actually put in place.
+ *
+ * The pre-flight check above catches the typo before it is written, but it cannot be the only
+ * guard: reading the environments needs `environments.view`, a permission managing members does not
+ * imply, and an environment can be removed between the two calls. So the request and the response
+ * are compared here too, and any difference — a code dropped OR a code appearing that nobody asked
+ * for, which would mean a wider boundary than requested — is an error, not a footnote.
+ *
+ * Whatever the server did save stays saved (the boundary is one call away from being fixed, and
+ * rolling it back blindly could lock out an agent mid-run), but the command says so and exits
+ * non-zero — the same shape as `assertNothingDropped` on a partial bulk triage.
+ */
+export declare function assertBoundaryApplied(requested: string[], applied: string[]): void;

package/dist/lib/service-accounts.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.environmentsLine = environmentsLine;
+exports.normalizeEnvironmentCodes = normalizeEnvironmentCodes;
+exports.accountSummary = accountSummary;
+exports.withoutSecret = withoutSecret;
+exports.tokenStatus = tokenStatus;
+exports.unknownEnvironmentCodes = unknownEnvironmentCodes;
+exports.assertBoundaryApplied = assertBoundaryApplied;
+const api_1 = require("./api");
+const error_codes_1 = require("../errors/error-codes");
+/**
+ * Reading and correcting a service account without recreating it (CYCL-46).
+ *
+ * One rule runs through everything here: on the secret boundary of a service account, an EMPTY list
+ * of environment codes does not mean "no access", it means "every environment". So the empty list is
+ * never a neutral value to fall into by accident — it is a decision, and it has to be printed with
+ * words that cannot be misread.
+ */
+/** The boundary in words: the codes, or the fact that there is no boundary at all. */
+function environmentsLine(codes) {
+    const list = normalizeEnvironmentCodes(Array.isArray(codes) ? codes : []);
+    return `secret environments: ${list.length > 0 ? list.join(', ') : 'all (no restriction)'}`;
+}
+/**
+ * Environment codes the way the server stores them: trimmed, lowercase, each one once, blanks
+ * dropped — the same normalisation `Connections::SetSecretAccess#sanitize` applies before saving.
+ * Sending them already in that shape is what makes "what I asked for" and "what came back"
+ * comparable at all: otherwise ` Staging ` would look dropped every single time.
+ */
+function normalizeEnvironmentCodes(values) {
+    const seen = new Set();
+    const codes = [];
+    for (const value of values) {
+        const code = String(value ?? '').trim().toLowerCase();
+        if (code === '' || seen.has(code))
+            continue;
+        seen.add(code);
+        codes.push(code);
+    }
+    return codes;
+}
+/**
+ * The fields of a service account worth printing, as an explicit allow-list — the same discipline as
+ * `changeRequestSummary`: `renderRecord` prints every scalar it is handed, so handing it the raw
+ * payload would print whatever the server adds next, up to and including a field carrying a token.
+ * `secret_environment_codes` is left out on purpose: it is an array (renderRecord would swallow it)
+ * and it deserves the sentence `environmentsLine` builds, not a bare key.
+ */
+function accountSummary(account) {
+    const summary = {
+        id: account.id,
+        name: account.name,
+        handle: account.handle,
+        created_at: account.created_at,
+        active_tokens_count: account.active_tokens_count,
+    };
+    return Object.fromEntries(Object.entries(summary).filter(([, value]) => value !== undefined && value !== null));
+}
+/**
+ * A copy of a token row without the secret, on both the human and the `--json` path.
+ *
+ * `UserApiTokenSerializer` never ships it — the secret exists only in the response of `tokens
+ * create`, reveal-once, and in the database there is just a prefix. This strips it anyway, for the
+ * same reason `withoutValue` does it on the vault queue: the CLI decides what leaves the terminal,
+ * so a payload that one day carried the secret (a serializer edit, a proxy, a hand-rolled backend)
+ * cannot turn a plain listing into a second reveal.
+ */
+function withoutSecret(row) {
+    if (row === null || typeof row !== 'object')
+        return row;
+    const { secret: _secret, ...rest } = row;
+    return rest;
+}
+/** `active` while the token works, `revoked` once it has been withdrawn — what the reader is after. */
+function tokenStatus(token) {
+    return token.revoked_at ? 'revoked' : 'active';
+}
+/**
+ * The requested codes an organization does not declare — checked BEFORE writing.
+ *
+ * `SetSecretAccess` intersects what it receives with the codes the organization really has and
+ * saves what is left, answering 200 either way. On a typo that intersection is empty, and an empty
+ * allow-list is not "no environments", it is EVERY environment: `--secret-environment stagin` would
+ * hand the account the production secrets it was being restricted away from. Catching it here means
+ * the mistake costs an error message instead of an open door.
+ *
+ * `known` empty is treated as "could not read them" by the caller, not as "nothing is valid": a
+ * lookup that came back empty (no permission, a serializer without `code`) must not block a command
+ * the caller is entitled to run.
+ */
+function unknownEnvironmentCodes(requested, known) {
+    const declared = new Set(normalizeEnvironmentCodes(known));
+    return requested.filter((code) => !declared.has(code));
+}
+/**
+ * Refuse an environment boundary the server did not actually put in place.
+ *
+ * The pre-flight check above catches the typo before it is written, but it cannot be the only
+ * guard: reading the environments needs `environments.view`, a permission managing members does not
+ * imply, and an environment can be removed between the two calls. So the request and the response
+ * are compared here too, and any difference — a code dropped OR a code appearing that nobody asked
+ * for, which would mean a wider boundary than requested — is an error, not a footnote.
+ *
+ * Whatever the server did save stays saved (the boundary is one call away from being fixed, and
+ * rolling it back blindly could lock out an agent mid-run), but the command says so and exits
+ * non-zero — the same shape as `assertNothingDropped` on a partial bulk triage.
+ */
+function assertBoundaryApplied(requested, applied) {
+    const inForce = applied.length > 0 ? applied.join(', ') : 'all environments (no restriction)';
+    // --all-environments: the removal is the whole point, so a boundary still standing means the
+    // command did nothing while looking like it worked.
+    if (requested.length === 0) {
+        if (applied.length === 0)
+            return;
+        throw new api_1.ApiRequestError(500, error_codes_1.ErrorCodes.ServiceAccount.restrictionNotApplied, `The restriction was not removed: the account can still read secrets only in ${inForce}. ` +
+            'Nothing else changed — run the command again, or check the account from the web vault.');
+    }
+    const kept = new Set(applied.map((code) => code.toLowerCase()));
+    const asked = new Set(requested);
+    const dropped = requested.filter((code) => !kept.has(code));
+    const extra = applied.filter((code) => !asked.has(code.toLowerCase()));
+    if (dropped.length === 0 && extra.length === 0)
+        return;
+    const what = dropped.length > 0
+        ? `Not applied: ${dropped.join(', ')} — the server kept a different boundary ` +
+            '(an environment removed in the meantime, or a code this organization does not have).'
+        : `Applied without being asked for: ${extra.join(', ')} — the boundary is wider than requested ` +
+            `(${requested.join(', ')}).`;
+    throw new api_1.ApiRequestError(404, error_codes_1.ErrorCodes.ServiceAccount.boundaryMismatch, `${what} In force now: ${inForce}. ` +
+        'Run "environments list" to see the real codes, then set the boundary again.');
+}

package/dist/lib/ticket-clarifications.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Lo stato del ciclo di chiarimenti, come lo racconta il SERVER (CYRA-628).
+ *
+ * Fino a qui quello stato viveva nel testo della discussione: un marcatore HTML che tre repository
+ * ri-parsavano per conto loro. Bastava che il sistema stesso scrivesse una riga qualsiasi — «resoconto
+ * aggiornato alla versione 2» — perché chi legge la scambiasse per una risposta e facesse ripartire un
+ * ticket a cui non aveva risposto nessuno. Intanto l'archivio continuava a dire «in attesa»: due parti
+ * dello stesso prodotto raccontavano cose diverse sullo stesso ticket, e decideva quella che sapeva meno.
+ *
+ * Il LIMITE di giri non compare qui e non compare nella risposta: il server espone i fatti — quanti
+ * giri, se è arrivata una risposta — e quando chiamare una persona resta policy di chi legge.
+ */
+export declare function renderClarificationState(stato: Record<string, unknown>): string;

package/dist/lib/ticket-clarifications.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderClarificationState = renderClarificationState;
+const output_1 = require("./output");
+/**
+ * Lo stato del ciclo di chiarimenti, come lo racconta il SERVER (CYRA-628).
+ *
+ * Fino a qui quello stato viveva nel testo della discussione: un marcatore HTML che tre repository
+ * ri-parsavano per conto loro. Bastava che il sistema stesso scrivesse una riga qualsiasi — «resoconto
+ * aggiornato alla versione 2» — perché chi legge la scambiasse per una risposta e facesse ripartire un
+ * ticket a cui non aveva risposto nessuno. Intanto l'archivio continuava a dire «in attesa»: due parti
+ * dello stesso prodotto raccontavano cose diverse sullo stesso ticket, e decideva quella che sapeva meno.
+ *
+ * Il LIMITE di giri non compare qui e non compare nella risposta: il server espone i fatti — quanti
+ * giri, se è arrivata una risposta — e quando chiamare una persona resta policy di chi legge.
+ */
+function renderClarificationState(stato) {
+    const rounds = Array.isArray(stato.rounds) ? stato.rounds : [];
+    const testa = `── ${(0, output_1.sanitize)(stato.state ?? '?')} · giri: ${(0, output_1.sanitize)(stato.cycles ?? 0)} · risposta: ${stato.has_reply ? 'sì' : 'no'}`;
+    if (rounds.length === 0)
+        return `${testa}\nNessuna domanda in corso.`;
+    const corpo = rounds.map((round) => {
+        const quando = round.answered_at ? `risposto ${(0, output_1.sanitize)(round.answered_at)}` : 'senza risposta';
+        return [
+            `\n· giro ${(0, output_1.sanitize)(round.cycle ?? '?')} — ${quando}`,
+            (0, output_1.sanitizeMultiline)(round.questions ?? ''),
+            round.response ? (0, output_1.sanitizeMultiline)(round.response) : '',
+        ].filter(Boolean).join('\n');
+    });
+    return [testa, ...corpo].join('\n');
+}

package/dist/lib/vault-requests.d.ts

@@ -0,0 +1,38 @@
+/** Org-level collection of the secret changes waiting for a second approval (CYCL-40). */
+export declare const CHANGE_REQUESTS_PATH = "/cli/v1/vault/change_requests";
+/**
+ * A copy of a change-request row without the proposed value.
+ *
+ * `SecretChangeRequestSerializer` never ships `value` — it is encrypted at rest and a change
+ * request is only ever allowed to reveal the NAME and the intent. This strips it anyway, on both
+ * the human and the `--json` path: the CLI decides what leaves the terminal, so a payload that one
+ * day carried the secret (a serializer edit, a proxy, a hand-rolled backend) cannot leak it through
+ * a command whose whole point is reviewing secrets without seeing them.
+ */
+export declare function withoutValue<T>(row: T): T;
+/** One row of `vault requests list`: never the value, only what identifies the pending change. */
+export declare function changeRequestRow(row: Record<string, unknown>): string[];
+/** Column headers of `vault requests list`, in the order `changeRequestRow` fills them. */
+export declare const CHANGE_REQUEST_HEADERS: string[];
+/**
+ * Short human wording of what a request is about — `STRIPE_KEY (set) on ACME/production`. Empty when
+ * the payload names nothing, so the caller can fall back to a bare confirmation instead of printing
+ * a line full of question marks.
+ */
+export declare function changeRequestLabel(row: Record<string, unknown>): string;
+/**
+ * The fields of a decided request worth printing, as an explicit allow-list — the same discipline as
+ * `leaseSummary` in `tickets lease claim`: `renderRecord` prints every scalar it is handed, so
+ * handing it the raw payload would print whatever the server adds next. Absent/null fields are
+ * dropped rather than shown as `-`: an approval has no rejection reason, and a row of dashes reads
+ * like missing data instead of "not applicable".
+ */
+export declare function changeRequestSummary(row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Append the way out to a refused decision, keeping the server's own message and code intact — the
+ * pattern `fetchLookupRows` already uses on a 403 in `BaseCommand`. Anything else (a 404 on a
+ * request outside the visible projects, a plain "Permesso negato" from the RBAC gate, a network
+ * failure) passes through untouched: inventing an explanation for an error we have not identified
+ * would be worse than the bare code.
+ */
+export declare function describeDecisionError(error: unknown): unknown;

package/dist/lib/vault-requests.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHANGE_REQUEST_HEADERS = exports.CHANGE_REQUESTS_PATH = void 0;
+exports.withoutValue = withoutValue;
+exports.changeRequestRow = changeRequestRow;
+exports.changeRequestLabel = changeRequestLabel;
+exports.changeRequestSummary = changeRequestSummary;
+exports.describeDecisionError = describeDecisionError;
+const api_1 = require("./api");
+/** Org-level collection of the secret changes waiting for a second approval (CYCL-40). */
+exports.CHANGE_REQUESTS_PATH = '/cli/v1/vault/change_requests';
+/**
+ * A copy of a change-request row without the proposed value.
+ *
+ * `SecretChangeRequestSerializer` never ships `value` — it is encrypted at rest and a change
+ * request is only ever allowed to reveal the NAME and the intent. This strips it anyway, on both
+ * the human and the `--json` path: the CLI decides what leaves the terminal, so a payload that one
+ * day carried the secret (a serializer edit, a proxy, a hand-rolled backend) cannot leak it through
+ * a command whose whole point is reviewing secrets without seeing them.
+ */
+function withoutValue(row) {
+    if (row === null || typeof row !== 'object')
+        return row;
+    const { value: _value, ...rest } = row;
+    return rest;
+}
+/** `key` of the project the change belongs to (its name as a fallback), or '' when the payload is silent. */
+function projectLabel(row) {
+    const project = (row.project ?? {});
+    return String(project.key ?? project.name ?? '');
+}
+/** `code` of the target environment (its label as a fallback), or '' when the payload is silent. */
+function environmentLabel(row) {
+    const environment = (row.environment ?? {});
+    return String(environment.code ?? environment.label ?? '');
+}
+/**
+ * Who asked for the change: name, email as a fallback, '' when nobody is attached. The requester FK
+ * is nullified when the account is deleted (the audit outlives the person), so this is a real case,
+ * not a defensive flourish.
+ */
+function requesterLabel(row) {
+    const requester = (row.requested_by ?? {});
+    return String(requester.name ?? requester.email ?? '');
+}
+/** One row of `vault requests list`: never the value, only what identifies the pending change. */
+function changeRequestRow(row) {
+    return [
+        String(row.id ?? ''),
+        projectLabel(row),
+        environmentLabel(row),
+        String(row.action ?? ''),
+        String(row.name ?? ''),
+        requesterLabel(row),
+        String(row.created_at ?? ''),
+    ];
+}
+/** Column headers of `vault requests list`, in the order `changeRequestRow` fills them. */
+exports.CHANGE_REQUEST_HEADERS = ['ID', 'PROJECT', 'ENVIRONMENT', 'ACTION', 'NAME', 'REQUESTED BY', 'ASKED AT'];
+/**
+ * Short human wording of what a request is about — `STRIPE_KEY (set) on ACME/production`. Empty when
+ * the payload names nothing, so the caller can fall back to a bare confirmation instead of printing
+ * a line full of question marks.
+ */
+function changeRequestLabel(row) {
+    const name = String(row.name ?? '').trim();
+    if (name === '')
+        return '';
+    const action = String(row.action ?? '').trim();
+    const where = [projectLabel(row), environmentLabel(row)].filter(Boolean).join('/');
+    return [name, action && `(${action})`, where && `on ${where}`].filter(Boolean).join(' ');
+}
+/**
+ * The fields of a decided request worth printing, as an explicit allow-list — the same discipline as
+ * `leaseSummary` in `tickets lease claim`: `renderRecord` prints every scalar it is handed, so
+ * handing it the raw payload would print whatever the server adds next. Absent/null fields are
+ * dropped rather than shown as `-`: an approval has no rejection reason, and a row of dashes reads
+ * like missing data instead of "not applicable".
+ */
+function changeRequestSummary(row) {
+    const summary = {
+        id: row.id,
+        project: projectLabel(row) || undefined,
+        environment: environmentLabel(row) || undefined,
+        name: row.name,
+        action: row.action,
+        status: row.status,
+        requested_by: requesterLabel(row) || undefined,
+        requested_at: row.created_at,
+        decided_at: row.decided_at,
+        reason: row.reason,
+    };
+    return Object.fromEntries(Object.entries(summary).filter(([, value]) => value !== undefined && value !== null));
+}
+/**
+ * The four ways a decision is refused, each with the way out. The backend codes are stable and its
+ * messages are already clear about WHAT happened; what a refusal alone does not say is what to do
+ * next — and all four look identical from the outside ("it did not work"), while they call for
+ * opposite reactions: hand the request to a colleague, log in as yourself, refresh the queue, write
+ * a real reason.
+ */
+const DECISION_HINTS = {
+    // Four-eyes separation: whoever decides is never whoever asked (Secrets::ChangeRequests::DecisionGuard).
+    'R403-CHANGEREQUEST-001': 'The four-eyes rule holds here: this one has to be decided by someone else with secrets.manage on that project.',
+    // CYRA-640: the second approval is a person's, never a machine's — a service-account token
+    // authenticates like a personal one, so the refusal has to name the difference.
+    'R403-CHANGEREQUEST-003': 'Only a person can decide a secret change request: a service account cannot, so run this with your own login.',
+    'R409-CHANGEREQUEST-001': 'It was already decided (applied, rejected or withdrawn) — run "vault requests list" to see what is still waiting.',
+    'R422-CHANGEREQUEST-001': 'Pass a --reason that says why: a rejection freezes the request, and whoever asked needs to know what to fix.',
+};
+/**
+ * Append the way out to a refused decision, keeping the server's own message and code intact — the
+ * pattern `fetchLookupRows` already uses on a 403 in `BaseCommand`. Anything else (a 404 on a
+ * request outside the visible projects, a plain "Permesso negato" from the RBAC gate, a network
+ * failure) passes through untouched: inventing an explanation for an error we have not identified
+ * would be worse than the bare code.
+ */
+function describeDecisionError(error) {
+    if (!(error instanceof api_1.ApiRequestError))
+        return error;
+    const hint = DECISION_HINTS[error.code];
+    if (!hint)
+        return error;
+    return new api_1.ApiRequestError(error.status, error.code, `${error.message}. ${hint}`, error.details);
+}

package/dist/lib/workload.d.ts

@@ -0,0 +1,37 @@
+/**
+ * La board del carico di lavoro non-dev (fiere, materiale cartaceo, incontri, chiamate): una sola
+ * raccolta d'organizzazione, con radice di tenancy il TEAM e non il progetto — per questo l'endpoint
+ * non è annidato sotto `/projects/:id` come quasi tutto il resto della CLI.
+ */
+export declare const WORKLOAD_ACTIONS_PATH = "/cli/v1/workload/actions";
+/** Gli stati dell'enum del server, nell'ordine in cui un'attività li attraversa. */
+export declare const WORKLOAD_STATUSES: string[];
+/**
+ * I campi che `workload create` e `workload update` scrivono allo stesso modo. Il titolo resta
+ * fuori: nasce obbligatorio sulla creazione e facoltativo sulla modifica. Il team pure — è
+ * immutabile lato server (spostare un'attività cambierebbe chi la vede), quindi si indica solo
+ * quando l'attività nasce.
+ */
+export declare const actionFieldFlags: {
+    description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    status: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'scheduled-at': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'due-at': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    ticket: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+};
+type ActionFlags = Record<string, unknown>;
+/** Popola `body` coi campi scalari presenti nei flag (chiavi snake_case attese dall'API CLI). */
+export declare function applyActionBody(body: ActionFlags, flags: ActionFlags): void;
+/**
+ * Vero quando il ticket indicato NON è finito sull'attività: il server sostituisce in silenzio con
+ * «nessun ticket» un id che chi scrive non può vedere (anti-BOLA), e senza dirlo l'attività
+ * risulterebbe collegata a chi l'ha appena salvata — mentre non lo è. Falso quando non c'era niente
+ * da collegare (flag assente, o stringa vuota che scollega apposta) o quando il legame c'è davvero.
+ *
+ * Sulla modifica la conseguenza è più pesante che sulla creazione — quel silenzio toglie anche il
+ * ticket che c'era prima — quindi l'avviso vero e proprio lo scrive ciascun comando.
+ */
+export declare function ticketLinkMissing(reference: string | undefined, resolvedId: string | undefined, data: Record<string, unknown>): boolean;
+/** La riga dei partecipanti: `renderRecord` stampa solo i campi scalari, e i nomi sono un elenco. */
+export declare function participantsLine(data: Record<string, unknown>): string;
+export {};

package/dist/lib/workload.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionFieldFlags = exports.WORKLOAD_STATUSES = exports.WORKLOAD_ACTIONS_PATH = void 0;
+exports.applyActionBody = applyActionBody;
+exports.ticketLinkMissing = ticketLinkMissing;
+exports.participantsLine = participantsLine;
+const core_1 = require("@oclif/core");
+const output_1 = require("./output");
+/**
+ * La board del carico di lavoro non-dev (fiere, materiale cartaceo, incontri, chiamate): una sola
+ * raccolta d'organizzazione, con radice di tenancy il TEAM e non il progetto — per questo l'endpoint
+ * non è annidato sotto `/projects/:id` come quasi tutto il resto della CLI.
+ */
+exports.WORKLOAD_ACTIONS_PATH = '/cli/v1/workload/actions';
+/** Gli stati dell'enum del server, nell'ordine in cui un'attività li attraversa. */
+exports.WORKLOAD_STATUSES = ['planned', 'in_progress', 'done', 'cancelled'];
+/**
+ * I campi che `workload create` e `workload update` scrivono allo stesso modo. Il titolo resta
+ * fuori: nasce obbligatorio sulla creazione e facoltativo sulla modifica. Il team pure — è
+ * immutabile lato server (spostare un'attività cambierebbe chi la vede), quindi si indica solo
+ * quando l'attività nasce.
+ */
+exports.actionFieldFlags = {
+    description: core_1.Flags.string({ description: 'What the activity is about (free text)' }),
+    status: core_1.Flags.string({
+        description: `Status (${exports.WORKLOAD_STATUSES.join(', ')})`,
+        options: exports.WORKLOAD_STATUSES,
+    }),
+    'scheduled-at': core_1.Flags.string({ description: 'When it takes place (ISO 8601)' }),
+    'due-at': core_1.Flags.string({ description: 'Deadline (ISO 8601)' }),
+    ticket: core_1.Flags.string({
+        description: 'Link an existing ticket by code (e.g. DRFL-3) or id — pass an empty string to unlink',
+    }),
+};
+/** Popola `body` coi campi scalari presenti nei flag (chiavi snake_case attese dall'API CLI). */
+function applyActionBody(body, flags) {
+    if (flags.description !== undefined)
+        body.description = flags.description;
+    if (flags.status !== undefined)
+        body.status = flags.status;
+    if (flags['scheduled-at'] !== undefined)
+        body.scheduled_at = flags['scheduled-at'];
+    if (flags['due-at'] !== undefined)
+        body.due_at = flags['due-at'];
+}
+/**
+ * Vero quando il ticket indicato NON è finito sull'attività: il server sostituisce in silenzio con
+ * «nessun ticket» un id che chi scrive non può vedere (anti-BOLA), e senza dirlo l'attività
+ * risulterebbe collegata a chi l'ha appena salvata — mentre non lo è. Falso quando non c'era niente
+ * da collegare (flag assente, o stringa vuota che scollega apposta) o quando il legame c'è davvero.
+ *
+ * Sulla modifica la conseguenza è più pesante che sulla creazione — quel silenzio toglie anche il
+ * ticket che c'era prima — quindi l'avviso vero e proprio lo scrive ciascun comando.
+ */
+function ticketLinkMissing(reference, resolvedId, data) {
+    if (!reference || !resolvedId)
+        return false;
+    return data.ticket_id !== resolvedId;
+}
+/** La riga dei partecipanti: `renderRecord` stampa solo i campi scalari, e i nomi sono un elenco. */
+function participantsLine(data) {
+    const names = (Array.isArray(data.participants) ? data.participants : []).map((name) => (0, output_1.sanitize)(name));
+    return `participants: ${names.length > 0 ? names.join(', ') : '-'}`;
+}