@catalyst-cloud/cli 0.9.3 → 0.9.5

package/dist/execution.js

@@ -37,14 +37,15 @@ export const EXCLUSION_REASONS = {
     retry_backoff: "the failed phase is retrying in place and waiting out its backoff",
     routing_unavailable: "the unit was claimed and refused at kickoff (no route, no eligible coding-account slot, or the provider is unavailable)",
     repo_paused: "an operator paused the repository",
-    remediate_parked: "the remediate phase is parked, so the failing phase has nowhere to be repaired; `catalyst-skills release <ticket>` releases the park once its cause is fixed",
-    phase_parked: "the offered phase is parked after repeated failures or the repair-round cap; `catalyst-skills release <ticket>` releases it once its cause is fixed",
+    remediate_parked: "the remediate phase is parked, so the failing phase has nowhere to be repaired; `catalyst release <ticket>` releases the park once its cause is fixed",
+    phase_parked: "the offered phase is parked after repeated failures or the repair-round cap; `catalyst release <ticket>` releases it once its cause is fixed",
     later_phase_lease_held: "an earlier phase is offered while a live container still holds a later phase of this ticket",
     human_owned_pr: "a person's own pull request holds this ticket; it releases itself when that PR closes or merges",
     review_not_converging: "review and repair kept finding new problems without converging; a person reads the findings and comments on the ticket to resume",
     round_threshold: "the ticket spent its lifetime repair budget; answering its ask or pushing a fix buys one more cycle",
     claim_storm: "this unit was claimed too many times in the last hour, so it waits out the hour; nothing to release",
     repo_at_capacity: "the repository's runner seats are all in use; it starts when one frees",
+    wip_limit: "the project is at its WIP limit (tickets in progress, counting blocked, parked and waiting ones); this new start waits until one of them finishes, and the tickets in progress keep running",
 };
 /** Every fail-closed unknown the evaluator names. */
 export const UNKNOWN_REASONS = {
@@ -332,9 +333,9 @@ export function renderAccount(a) {
     const harness = a.harness ? `/${a.harness}` : "";
     const status = a.status ? (ACCOUNT_STATUS[a.status] ?? a.status) : "status unknown";
     const bits = [`${name}  ${a.provider ?? "?"}${harness}  ${status}`];
-    // CTC-4199: a cancelled subscription is retired, never re-credentialed; say so in the text view too.
+    // CTC-4199: a cancelled subscription is kept for reporting and not used; never re-credential it (Ryan, 2026-09-29).
     if (a.renewalStatus === "canceled")
-        bits.push("subscription canceled — retire on the AI accounts page");
+        bits.push("subscription canceled — kept for reporting, not used");
     if (typeof a.bindingUsedPercent === "number") {
         const resets = typeof a.bindingResetsAtMs === "number" ? `, resets ${new Date(a.bindingResetsAtMs).toISOString()}` : "";
         bits.push(`usage ${a.bindingUsedPercent}% of the ${a.bindingWindow ?? "binding"} window${resets}`);

package/dist/identity.js

@@ -14,7 +14,7 @@ function render(result, choices) {
         return `${summary}\nNo choices were offered. An automatic match cannot be replaced; an unmatched roster may need a retry.`;
     if (result.options.length === 0)
         return `${summary}\nThe workspace roster has no eligible people.`;
-    return [summary, ...result.options.map((o) => `${o.id}\t${o.displayName ?? o.name ?? "(unnamed)"}`), "Select your own identity explicitly: catalyst-skills identity linear set <linearUserId>"].join("\n");
+    return [summary, ...result.options.map((o) => `${o.id}\t${o.displayName ?? o.name ?? "(unnamed)"}`), "Select your own identity explicitly: catalyst identity linear set <linearUserId>"].join("\n");
 }
 export async function cmdIdentity(args, ctx, deps = {}) {
     const parts = positionals(args);
@@ -25,11 +25,11 @@ export async function cmdIdentity(args, ctx, deps = {}) {
     }
     const cfg = requireConfig(ctx);
     if (!cfg.user)
-        throw new CliError("this machine uses a tenant account key; run catalyst-skills login as yourself", "member-required");
+        throw new CliError("this machine uses a tenant account key; run catalyst login as yourself", "member-required");
     const createClient = deps.createClient ?? (async (options) => (await loadHttpSdk()).createTenantClient(options));
     const client = await createClient({ key: await bearerFor(ctx, cfg), baseUrl: cfg.baseUrl, fetch: ctx.fetch });
     if (!client.linearIdentity)
-        throw new CliError("the installed SDK lacks identity recovery; upgrade catalyst-skills after the SDK release", "sdk-upgrade-required");
+        throw new CliError("the installed SDK lacks identity recovery; upgrade the catalyst CLI after the SDK release", "sdk-upgrade-required");
     if (action === "set") {
         // The arity check above requires a selection; never choose the first roster entry for a person.
         if (selected === undefined)

package/dist/oauth.js

@@ -152,7 +152,7 @@ async function pollDeviceCode(ctx, discovery, auth, sleep) {
             continue;
         }
         if (err === "access_denied")
-            throw new CliError("login was denied — run: catalyst-skills login to try again", "login-denied");
+            throw new CliError("login was denied — run: catalyst login to try again", "login-denied");
         if (err === "expired_token")
             return "expired";
         // A transient HTTP failure (request timeout, rate limit, server error) is retried, honouring
@@ -220,7 +220,7 @@ export async function bearerFor(ctx, cfg, deps = {}) {
     if (typeof cfg.key === "string" && cfg.key !== "")
         return cfg.key;
     if (!cfg.auth)
-        throw new CliError("this machine is not connected — run: catalyst-skills login", "not-configured");
+        throw new CliError("this machine is not connected — run: catalyst login", "not-configured");
     const msToExpiry = Date.parse(cfg.auth.expiresAt) - ctx.now().getTime();
     if (Number.isFinite(msToExpiry) && msToExpiry > REFRESH_SKEW_MS)
         return cfg.auth.accessToken;
@@ -256,7 +256,7 @@ async function refreshAndPersist(ctx, cfg, deps) {
         const err = await oauthError(res, discovery.tokenUrl);
         if (err === "invalid_grant") {
             // revocation or > inactivity window — the ONLY session-expired case; NOT routine expiry.
-            throw new CliError("your login expired or was revoked — run: catalyst-skills login", "session-expired");
+            throw new CliError("your login expired or was revoked — run: catalyst login", "session-expired");
         }
         const transient = res.status === 429 || res.status >= 500;
         if (!transient)

package/dist/query.js

@@ -156,7 +156,7 @@ async function fromApi(ctx, cfg, sub, rest, f, args) {
             if (!q)
                 throw new UsageError("search needs terms: query search <terms>");
             const res = await api.getJson("/api/v1/search", { query: { q, limit: f.limit } });
-            return rowsOf(res.body);
+            return searchRows(res.body);
         }
         case "changes": {
             const since = flagString(args, "since");
@@ -224,6 +224,21 @@ export function applyFilters(rows, f) {
         return true;
     });
 }
+/** The hub answers search in four groups (`issues`, `pulls`, `projects`, `initiatives`, the read
+ *  model's SearchView). `rowsOf` returns only the first array it finds, so it dropped every match that
+ *  was not a ticket. Every group comes back here, flattened, each row tagged with its `kind`. */
+const SEARCH_GROUPS = [["issues", "issue"], ["pulls", "pull"], ["projects", "project"], ["initiatives", "initiative"]];
+export function searchRows(body) {
+    if (Array.isArray(body))
+        return body;
+    if (!body || typeof body !== "object")
+        return [];
+    const b = body;
+    if (SEARCH_GROUPS.some(([group]) => Array.isArray(b[group]))) {
+        return SEARCH_GROUPS.flatMap(([group, kind]) => Array.isArray(b[group]) ? b[group].map((row) => ({ kind, ...row })) : []);
+    }
+    return rowsOf(body);
+}
 function printResult(ctx, args, sub, result) {
     if (args.json || !Array.isArray(result)) {
         ctx.stdout(JSON.stringify(result, null, args.json ? 0 : 2));
@@ -242,6 +257,17 @@ export function summaryLine(sub, r) {
             return `${r.id}  ${r.state ?? "?"}  ${r.name ?? ""}`;
         case "cycles":
             return `cycle ${r.number ?? r.id}  ${r.name ?? ""}  ${r.starts_at ?? ""} → ${r.ends_at ?? ""}`;
+        case "search":
+            switch (r.kind) {
+                case "pull":
+                    return `pull        #${r.number ?? "?"}  ${r.title ?? ""}${r.repo_id ? `  (${r.repo_id})` : ""}`;
+                case "project":
+                    return `project     ${r.name ?? r.id}`;
+                case "initiative":
+                    return `initiative  ${r.name ?? r.id}`;
+                default:
+                    return `issue       ${r.identifier ?? r.id}  ${r.title ?? ""}`;
+            }
         default:
             return JSON.stringify(r);
     }

package/dist/ready.js

@@ -184,7 +184,7 @@ export async function readyReport(ctx, deps) {
                     ? `config: joined ${cfg.name} as ${cfg.user.label} (${cfg.user.role})`
                     : `config: joined ${cfg.name} (${cfg.slug}) as ${cfg.principal}`,
             }
-            : { id: "config", ok: false, line: "config: not connected", fix: "npx @catalyst-cloud/catalyst-skills login (keyless; or pass --key / set CATALYST_CLOUD_TOKEN)", who: "you (approve the login in your browser)" });
+            : { id: "config", ok: false, line: "config: not connected", fix: "npx -p @catalyst-cloud/cli catalyst login (keyless; or pass --key / set CATALYST_CLOUD_TOKEN)", who: "you (approve the login in your browser)" });
     }
     catch (err) {
         checks.push({ id: "config", ok: false, line: `config: ${err instanceof CliError ? err.message : String(err)}`, fix: "re-run login to rewrite it", who: "you" });
@@ -192,7 +192,7 @@ export async function readyReport(ctx, deps) {
     const cache = readContractCache(ctx.home);
     const range = readManifest().tenantContractRange;
     if (!cache) {
-        checks.push({ id: "contract", ok: false, line: "contract: not cached", fix: "catalyst-skills contract --refresh", who: "you" });
+        checks.push({ id: "contract", ok: false, line: "contract: not cached", fix: "catalyst contract --refresh", who: "you" });
     }
     else if (contractVersionInRange(cache.contractVersion, range) !== true) {
         checks.push({ id: "contract", ok: false, line: `contract: version ${cache.contractVersion} is outside this bundle's range ${range}`, fix: upgradeCommand(), who: "you" });
@@ -290,7 +290,7 @@ export async function readyReport(ctx, deps) {
         checks.push({ id: "skills", ok: true, line: `skills: all ${deps.skillNames.length} present in ${skillsDir}` });
     }
     else {
-        checks.push({ id: "skills", ok: false, line: `skills: ${present.length} of ${deps.skillNames.length} in ${skillsDir}, missing ${missing.join(", ")}`, fix: "catalyst-skills install", who: "you" });
+        checks.push({ id: "skills", ok: false, line: `skills: ${present.length} of ${deps.skillNames.length} in ${skillsDir}, missing ${missing.join(", ")}`, fix: "catalyst install", who: "you" });
     }
     try {
         await (deps.loadSdk ?? loadSdk)();

package/dist/release.js

@@ -37,7 +37,7 @@ export function renderTicketRelease(ticket, r) {
     const lines = [];
     const dry = r.dryRun === true;
     if (r.outcome === "nothing-held") {
-        lines.push(`${ticket}: nothing holds this ticket — run \`catalyst-skills explain ${ticket}\` for why it is not running`);
+        lines.push(`${ticket}: nothing holds this ticket — run \`catalyst explain ${ticket}\` for why it is not running`);
     }
     else if (r.outcome === "refused") {
         lines.push(dry ? `${ticket} (dry run): would be refused — nothing would be released:` : `${ticket}: refused — nothing was released:`);

package/dist/replica.js

@@ -196,7 +196,7 @@ function baseStatusLine(s) {
         case "not-configured":
             return `replica: not configured (${s.reasons.join("; ")})`;
         case "absent":
-            return `replica: absent at ${s.dbPath} — start it with: catalyst-skills replica start --detach`;
+            return `replica: absent at ${s.dbPath} — start it with: catalyst replica start --detach`;
         case "fresh":
             return `replica: fresh at ${s.dbPath} (cursor ${s.cursor}, heartbeat ${s.heartbeatAgeMs}ms ago${s.lag !== undefined ? `, ${s.lag} behind head ${s.head}` : ""})`;
         case "stale":
@@ -240,7 +240,9 @@ export async function engineFor(sdk, dbPath, ctx, deps = {}) {
     }
     catch (err) {
         const why = err instanceof Error ? err.message.split("\n")[0] : String(err);
-        ctx.stderr(`[catalyst-skills] better-sqlite3 unavailable (${why}); using node:sqlite`);
+        // node:sqlite is the supported path (CTC-4272): say nothing when it works, except under CATALYST_DEBUG.
+        if (ctx.env?.CATALYST_DEBUG === "1")
+            ctx.stderr(`[catalyst] better-sqlite3 unavailable (${why}); using node:sqlite`);
         return deps.readonly ? sdk.nodeSqliteReadonlyEngine(dbPath) : sdk.nodeSqliteEngine(dbPath);
     }
 }
@@ -252,7 +254,7 @@ export const SNAPSHOT_MAX_FAILURES = 5;
  *  count on; staying live is that signal. The failing warm loop never reaches it — its resync demand
  *  fails and tears the attempt down first (CTC-2499). */
 export const SNAPSHOT_LIVE_STABLE_MS = 60_000;
-export const REPLICA_RESTART_COMMAND = "catalyst-skills replica start --detach";
+export const REPLICA_RESTART_COMMAND = "catalyst replica start --detach";
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function defaultWaitForStop() {
     return new Promise((resolve) => {
@@ -342,7 +344,7 @@ async function cmdStart(args, ctx, cfg, dbPath, deps) {
         const argv = (deps.argv ?? process.argv.slice(1)).filter((a) => a !== "--detach");
         const { pid } = (deps.detach ?? detachSelf)(argv, ctx.env);
         writeFileSync(pidfilePath(dbPath), `${pid}\n`);
-        ctx.stdout(`replica writer started in the background (pid ${pid}, db ${dbPath}); check with: catalyst-skills replica status`);
+        ctx.stdout(`replica writer started in the background (pid ${pid}, db ${dbPath}); check with: catalyst replica status`);
         return 0;
     }
     const sdk = await loadSdk();
@@ -503,7 +505,7 @@ async function cmdStart(args, ctx, cfg, dbPath, deps) {
         const lastError = attemptError ?? "the snapshot pull failed";
         const nowMs = ctx.now().getTime();
         const stopped = failures >= maxFailures
-            ? { at: nowMs, reason: `${failures} consecutive snapshot failures`, restartWith: "catalyst-skills replica start --detach" }
+            ? { at: nowMs, reason: `${failures} consecutive snapshot failures`, restartWith: "catalyst replica start --detach" }
             : null;
         writeWriterState(dbPath, { pid: process.pid, consecutiveFailures: failures, lastError, lastFailureAt: nowMs, stopped }, nowMs);
         if (stopped) {
@@ -562,7 +564,7 @@ export function assertSingleSelect(sql) {
 async function cmdSql(args, ctx, dbPath, sql, deps) {
     const query = assertSingleSelect(sql);
     if (!existsSync(dbPath))
-        throw new CliError(`no replica at ${dbPath} — start it with: catalyst-skills replica start --detach`, "replica-absent", 3);
+        throw new CliError(`no replica at ${dbPath} — start it with: catalyst replica start --detach`, "replica-absent", 3);
     const sdk = await loadSdk();
     const engine = await engineFor(sdk, dbPath, ctx, { ...deps.engineDeps, readonly: true });
     const replica = await sdk.CatalystReplica.openReadOnly({ dbPath, engine, log: () => { } });
@@ -577,7 +579,7 @@ async function cmdSql(args, ctx, dbPath, sql, deps) {
 }
 async function cmdSchema(args, ctx, dbPath, table) {
     if (!existsSync(dbPath))
-        throw new CliError(`no replica at ${dbPath} — the schema is what the file holds; start it with: catalyst-skills replica start --detach`, "replica-absent", 3);
+        throw new CliError(`no replica at ${dbPath} — the schema is what the file holds; start it with: catalyst replica start --detach`, "replica-absent", 3);
     const db = new (loadSqlite().DatabaseSync)(dbPath, { readOnly: true });
     try {
         const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name").all().map((r) => r.name);

package/dist/runtime-store.js

@@ -21,11 +21,11 @@ const PLATFORM_ARCH = {
  *  needs `.zip` extraction, a separate mechanism this ticket does not build (D7). */
 export function tarballFor(version, platform, arch) {
     if (platform === "win32") {
-        throw new CliError("catalyst-skills runtime install does not support Windows yet — supported: darwin (arm64, x64) and linux (x64, arm64). Use whatever Node 22.15+ or bun 1.4+ you already have on Windows.", "runtime-unsupported-platform");
+        throw new CliError("catalyst runtime install does not support Windows yet — supported: darwin (arm64, x64) and linux (x64, arm64). Use whatever Node 22.15+ or bun 1.4+ you already have on Windows.", "runtime-unsupported-platform");
     }
     const arches = PLATFORM_ARCH[platform];
     if (!arches || !arches.includes(arch)) {
-        throw new CliError(`catalyst-skills runtime install does not support ${platform}/${arch} — supported: darwin (arm64, x64) and linux (x64, arm64)`, "runtime-unsupported-platform");
+        throw new CliError(`catalyst runtime install does not support ${platform}/${arch} — supported: darwin (arm64, x64) and linux (x64, arm64)`, "runtime-unsupported-platform");
     }
     const file = `node-v${version}-${platform}-${arch}.tar.gz`;
     return { file, url: `https://nodejs.org/dist/v${version}/${file}`, shasums: `https://nodejs.org/dist/v${version}/SHASUMS256.txt` };

package/dist/runtime.js

@@ -13,7 +13,7 @@
 export const BUN_MIN = "1.4.0";
 /** The ONE copy-pasteable command. Installs a pinned Node under the CLI's own cache and pins it;
  *  it never touches the machine's default Node and needs no admin rights. See src/runtime-store.ts. */
-export const FIX_COMMAND = "npx -y @catalyst-cloud/catalyst-skills runtime install";
+export const FIX_COMMAND = "npx -y -p @catalyst-cloud/cli catalyst runtime install";
 /** Detect the runtime this process is running on. `process.versions.bun` is present only under bun. */
 export function detectRuntime(versions = process.versions) {
     if (versions.bun)

package/dist/secret.js

@@ -70,7 +70,7 @@ function requireRepo(args, verb) {
 /** The cloud's refusal, in its own words, plus what to do for the two we can explain. */
 function refusalLine(status, body, repo) {
     if (status === 401) {
-        return "refused (401): the cloud did not accept your credential here. If `catalyst-skills me` works, this cloud predates secret writes from the CLI and needs a newer release; otherwise log in again.";
+        return "refused (401): the cloud did not accept your credential here. If `catalyst me` works, this cloud predates secret writes from the CLI and needs a newer release; otherwise log in again.";
     }
     if (status === 404)
         return `refused (404): ${repo} is not a repository of this tenant (register it in the app first)`;

package/dist/skills.js

@@ -137,5 +137,5 @@ export function updateNoticeLine(previous, current, entry) {
     // minor — so it never crosses 0.2.x → 0.3.0. Pin @latest via `npm install`, THEN re-run login: the
     // install alone does not rewrite customer.json.cliPath, so the skill helpers would keep spawning the
     // stale recorded bundle and repeat this notice forever; the new global bin records its own path.
-    return `[catalyst-skills] updated ${previous} → ${current}: ${summary} · update with: ${upgradeCommand()}`;
+    return `[catalyst] updated ${previous} → ${current}: ${summary} · update with: ${upgradeCommand()}`;
 }

package/dist/team.js

@@ -0,0 +1,329 @@
+// Team setup uses the person's saved login and the SDK's typed personal-admin methods.
+// A fresh SDK client per call refreshes a device-login token across a multi-chunk migration.
+import { createHash } from "node:crypto";
+import { flagBool, flagList, flagString, positionals } from "./args.js";
+import { requireConfig } from "./config.js";
+import { loadContract } from "./contract.js";
+import { UsageError } from "./errors.js";
+import { bearerFor } from "./oauth.js";
+import { loadHttpSdk } from "./sdk.js";
+const SLOTS = ["dispatch", "intake", "research", "plan", "implement", "remediate", "verify", "review", "pr", "done", "canceled"];
+function isSlot(value) { return SLOTS.includes(value); }
+const NAMES = {
+    dispatch: ["todo", "to do", "ready"], intake: ["intake", "triage"], research: ["research"],
+    plan: ["plan", "planning"], implement: ["implement", "in progress", "doing"],
+    remediate: ["remediate", "fix"], verify: ["verify", "validate", "testing"], review: ["review"],
+    pr: ["pr", "in review", "pull request"], done: ["done", "completed"], canceled: ["canceled", "cancelled"],
+};
+const MAX_CHUNKS = 100;
+const MAX_RUN_MS = 5 * 60_000;
+function routes(doc) {
+    const read = doc.routes.find((r) => r.method === "GET" && r.path.endsWith("/team-workflow"))?.path;
+    if (!read)
+        throw new UsageError("team setup needs a newer Catalyst Cloud (team-workflow route absent)");
+    const desired = { teams: read.replace(/\/team-workflow$/, "/teams"), read, check: `${read}/check`, save: `${read}/save`, adopt: `${read}/adopt`, undo: `${read}/adopt-undo`, migrate: `${read}/migrate` };
+    for (const [name, path] of Object.entries(desired)) {
+        const method = name === "teams" || name === "read" ? "GET" : "POST";
+        if (!doc.routes.some((r) => r.method === method && r.path === path))
+            throw new UsageError(`team setup needs a newer Catalyst Cloud (${method} ${path} absent)`);
+    }
+    return desired;
+}
+function key(args) {
+    const [sub, team, ...extra] = positionals(args);
+    if (extra.length > 0)
+        throw new UsageError(`team ${sub ?? ""} takes one team key`);
+    if (!team && !(sub === "list" || (sub === "check" && flagBool(args, "all"))))
+        throw new UsageError(`team ${sub ?? ""} needs a team key`);
+    if (team && flagBool(args, "all"))
+        throw new UsageError("team check takes a key or --all, not both");
+    return team ?? "";
+}
+function emit(ctx, args, value, lines) {
+    if (args.json)
+        ctx.stdout(JSON.stringify(value));
+    else
+        for (const line of lines)
+            ctx.stdout(line);
+}
+function refusal(ctx, args, reply) {
+    const { body, status } = reply;
+    emit(ctx, args, { status, ...body }, [`refused (${status}): ${String(body.error ?? "http")}${body.reason || body.message ? ` — ${String(body.reason ?? body.message)}` : ""}`]);
+    return 1;
+}
+function readinessLines(value) {
+    if (value === null || typeof value !== "object")
+        return ["the change landed, but readiness could not be checked; run team check"];
+    const r = value;
+    return [`readiness: ${String(r.status ?? "unknown")}; checked at ${String(r.checkedAt ?? "unknown")}`,
+        ...(Array.isArray(r.checks) ? r.checks : []).filter((c) => c.state === "fail").map((c) => `  ${String(c.id)}: ${String(c.reason ?? "failed")} (${String(c.owner ?? c.whoCanFix ?? "team admin")})`)];
+}
+function fromSdk(result) {
+    if (result.outcome === "ok") {
+        const { outcome: _outcome, status, ...body } = result;
+        return { status, body: body };
+    }
+    return {
+        status: result.outcome === "shape" ? 502 : "status" in result ? result.status : 503,
+        body: { error: "error" in result ? result.error ?? result.outcome : result.outcome, reason: result.reason, ...(result.outcome === "shape" ? { upstreamStatus: result.status } : {}) },
+    };
+}
+function isRefusal(reply) { return typeof reply.body.error === "string" || !((reply.status >= 200 && reply.status < 300) || reply.status === 304); }
+function assignments(values, label) {
+    return values.map((value) => {
+        const split = value.indexOf("=");
+        if (split <= 0 || split === value.length - 1)
+            throw new UsageError(`--${label} needs left=right (got ${value})`);
+        return [value.slice(0, split), value.slice(split + 1)];
+    });
+}
+function mapping(view, explicit) {
+    if (view.stageSource === "none" || !Array.isArray(view.stages))
+        throw new UsageError("live Linear stages are unreadable; retry team map after the connection is healthy");
+    const stages = view.stages;
+    const selected = new Map();
+    const unresolved = [];
+    if (explicit.length > 0) {
+        for (const [slot, stateName] of explicit) {
+            if (!isSlot(slot))
+                throw new UsageError(`unknown workflow role: ${slot}`);
+            if (selected.has(slot))
+                throw new UsageError(`duplicate workflow role: ${slot}`);
+            const found = stages.filter((s) => s.name.toLocaleLowerCase() === stateName.toLocaleLowerCase() || s.id === stateName);
+            if (found.length !== 1)
+                throw new UsageError(`${stateName} matches ${found.length} live Linear stages; choose an unambiguous name or id`);
+            selected.set(slot, found[0].id);
+        }
+    }
+    else {
+        for (const slot of SLOTS) {
+            const names = NAMES[slot] ?? [];
+            const match = names.flatMap((name) => stages.filter((stage) => stage.name.toLocaleLowerCase() === name));
+            const unique = [...new Map(match.map((stage) => [stage.id, stage])).values()];
+            if (unique.length === 1)
+                selected.set(slot, unique[0].id);
+            else
+                unresolved.push(slot);
+        }
+    }
+    const previous = new Map((view.rows ?? []).map((r) => [r.slot, r.linearStateId]));
+    const diff = SLOTS.map((slot) => {
+        const before = previous.get(slot) ?? null;
+        const after = selected.get(slot) ?? null;
+        return { slot, before, after, change: before === after ? "unchanged" : before === null ? "added" : after === null ? "removed" : "changed" };
+    });
+    return { rows: SLOTS.filter((slot) => selected.has(slot)).map((slot) => ({ slot, linearStateId: selected.get(slot), source: "chosen" })), diff, unresolved };
+}
+function hashPlan(value) { return createHash("sha256").update(JSON.stringify(value)).digest("hex"); }
+function planLines(title, rows, hash) {
+    return [title, ...rows.map((row) => `  ${JSON.stringify(row)}`), `Plan hash: ${hash}`, `Review this plan with the person, then rerun with --yes --plan-hash ${hash} to apply exactly it.`];
+}
+export async function cmdTeam(args, ctx, deps = {}) {
+    const [sub] = positionals(args);
+    if (!sub || !["list", "check", "map", "adopt", "migrate", "checklist"].includes(sub))
+        throw new UsageError("team needs list | check | map | adopt | migrate | checklist");
+    const team = key(args);
+    if (sub !== "check" && flagBool(args, "all"))
+        throw new UsageError("--all belongs to team check");
+    if (sub !== "adopt" && flagBool(args, "undo"))
+        throw new UsageError("--undo belongs to team adopt");
+    if (sub !== "migrate" && (flagBool(args, "retire") || flagList(args, "choice").length))
+        throw new UsageError("--retire and --choice belong to team migrate");
+    if (sub !== "map" && flagList(args, "stage").length)
+        throw new UsageError("--stage belongs to team map");
+    if (!["map", "adopt", "migrate"].includes(sub) && flagString(args, "plan-hash") !== undefined)
+        throw new UsageError("--plan-hash belongs to team map, adopt, or migrate");
+    if ((sub === "check" || sub === "checklist") && flagBool(args, "yes"))
+        throw new UsageError(`team ${sub} takes no --yes`);
+    const cfg = requireConfig(ctx);
+    let { doc } = await loadContract(ctx, cfg);
+    try {
+        routes(doc);
+    }
+    catch (error) {
+        if (!(error instanceof UsageError) || !error.message.includes("team-workflow"))
+            throw error;
+        // A fresh cached contract can predate the team routes. Revalidate once before telling the
+        // person the cloud is too old; the conditional GET is cheap when the server has not changed.
+        doc = (await loadContract(ctx, cfg, { refresh: true })).doc;
+        routes(doc);
+    }
+    // API hashes detect stale server state. CLI approval additionally binds the reviewed scope,
+    // operation and signed-in tenant so consent cannot transfer to a different command or account.
+    const approvalHash = (operation, plan) => hashPlan({ baseUrl: cfg.baseUrl, account: cfg.account, actor: cfg.user?.id ?? null, team, operation, plan });
+    const createClient = deps.createClient ?? (async (options) => (await loadHttpSdk()).createTenantClient(options));
+    const client = async () => (await createClient({ key: await bearerFor(ctx, cfg), baseUrl: cfg.baseUrl, fetch: ctx.fetch })).teamWorkflow;
+    if (sub === "list") {
+        const reply = fromSdk(await (await client()).teams());
+        if (isRefusal(reply))
+            return refusal(ctx, args, reply);
+        if (!Array.isArray(reply.body.teams))
+            return refusal(ctx, args, { status: 502, body: { error: "bad-response", reason: "team list was missing" } });
+        const teams = reply.body.teams;
+        emit(ctx, args, { teams, liveTeamRead: reply.body.liveTeamRead }, teams.map((t) => `${String(t.teamKey ?? t.teamId ?? t.key ?? "unknown")}: ${String(t.name ?? t.teamName ?? "")}`));
+        return 0;
+    }
+    if (sub === "check") {
+        const teamList = flagBool(args, "all") ? fromSdk(await (await client()).teams()) : null;
+        if (teamList && isRefusal(teamList))
+            return refusal(ctx, args, teamList);
+        const teamKeys = teamList ? (Array.isArray(teamList.body.teams) ? teamList.body.teams : []).map((t) => String(t.teamKey || t.teamId || t.key || "")).filter(Boolean) : [team];
+        if (teamList && !Array.isArray(teamList.body.teams))
+            return refusal(ctx, args, { status: 502, body: { error: "bad-response", reason: "team list was missing" } });
+        if (teamList && teamKeys.length === 0)
+            return refusal(ctx, args, { status: 404, body: { error: "no-teams", reason: "No Linear teams are visible to this account; connect the tenant's Linear workspace and retry." } });
+        const results = [];
+        let failed = false;
+        for (const teamKey of teamKeys) {
+            const reply = fromSdk(await (await client()).check(teamKey));
+            if (isRefusal(reply)) {
+                results.push({ team: teamKey, status: reply.status, ...reply.body });
+                failed = true;
+                break;
+            }
+            results.push({ team: teamKey, ...reply.body });
+            if (reply.body.readiness?.status !== "ready")
+                failed = true;
+        }
+        emit(ctx, args, { results }, results.flatMap((result) => [`${String(result.team)}:`, ...(result.error ? [`  refused: ${String(result.error)} — ${String(result.reason ?? result.message ?? "")}`] : readinessLines(result.readiness))]));
+        return failed ? 1 : 0;
+    }
+    if (sub === "checklist") {
+        const reply = fromSdk(await (await client()).get(team));
+        if (isRefusal(reply))
+            return refusal(ctx, args, reply);
+        const checklist = reply.body.checklist;
+        if (!Array.isArray(checklist) || !checklist.every((line) => typeof line === "string"))
+            return refusal(ctx, args, { status: 503, body: { error: "stages-unreadable", reason: "Could not read live Linear stages; retry team checklist." } });
+        emit(ctx, args, { team, checklist }, checklist);
+        return 0;
+    }
+    if (sub === "map") {
+        const reply = fromSdk(await (await client()).get(team));
+        if (isRefusal(reply))
+            return refusal(ctx, args, reply);
+        if (typeof reply.body.mappingHash !== "string")
+            return refusal(ctx, args, { status: 502, body: { error: "bad-response", reason: "team workflow read omitted the mapping hash; update Catalyst Cloud before saving" } });
+        let proposal;
+        try {
+            proposal = mapping(reply.body, assignments(flagList(args, "stage"), "stage"));
+        }
+        catch (error) {
+            return refusal(ctx, args, { status: 400, body: { error: "mapping-unresolved", reason: error instanceof Error ? error.message : String(error) } });
+        }
+        const config = reply.body.config && typeof reply.body.config === "object" ? reply.body.config : undefined;
+        const mode = config?.mode ?? "mapped-existing";
+        const gitAutomation = config?.gitAutomation ?? "off";
+        const planHash = approvalHash("map", { team, rows: proposal.rows, diff: proposal.diff, unresolved: proposal.unresolved, mappingHash: reply.body.mappingHash, mode, gitAutomation });
+        const preview = { team, rows: proposal.rows, diff: proposal.diff, unresolved: proposal.unresolved, mappingHash: reply.body.mappingHash, mode, gitAutomation, planHash, decision: "not-confirmed" };
+        if (!flagBool(args, "yes")) {
+            emit(ctx, args, preview, planLines(`Mapping plan for ${team}:`, proposal.diff, planHash));
+            return 3;
+        }
+        if (flagString(args, "plan-hash") !== planHash)
+            return refusal(ctx, args, { status: 409, body: { error: "plan-hash-mismatch", reason: `Preview again and review the updated plan hash ${planHash}.` } });
+        if (!args.json)
+            for (const line of planLines(`Mapping plan for ${team}:`, proposal.diff, planHash).slice(0, -1))
+                ctx.stdout(line);
+        const saved = fromSdk(await (await client()).save({ team, mode, gitAutomation, rows: proposal.rows, expectedMappingHash: reply.body.mappingHash }));
+        if (isRefusal(saved))
+            return refusal(ctx, args, saved);
+        emit(ctx, args, { ...preview, decision: "applied", result: saved.body }, readinessLines(saved.body.readiness));
+        return 0;
+    }
+    if (sub === "adopt") {
+        const undo = flagBool(args, "undo");
+        const previewReply = fromSdk(undo ? await (await client()).undoPreview(team) : await (await client()).adoptPreview(team));
+        if (isRefusal(previewReply))
+            return refusal(ctx, args, previewReply);
+        const hashName = undo ? "undoHash" : "planHash";
+        const hash = previewReply.body[hashName];
+        if (typeof hash !== "string" || !Array.isArray(previewReply.body[undo ? "candidates" : "stages"]))
+            return refusal(ctx, args, { status: 502, body: { error: "bad-response", reason: `adopt preview omitted ${hashName} or scope` } });
+        const planHash = approvalHash(undo ? "adopt-undo" : "adopt", {
+            serverHash: hash, teamId: previewReply.body.teamId,
+            stages: previewReply.body.stages, labels: previewReply.body.labels,
+            candidates: previewReply.body.candidates, unfilledLoadBearing: previewReply.body.unfilledLoadBearing,
+        });
+        const plan = { team, decision: "not-confirmed", preview: previewReply.body, planHash };
+        const scope = [
+            ...previewReply.body[undo ? "candidates" : "stages"],
+            ...(undo ? [] : Array.isArray(previewReply.body.labels) ? previewReply.body.labels : []),
+        ];
+        if (!flagBool(args, "yes")) {
+            emit(ctx, args, plan, planLines(`${undo ? "Undo" : "Adopt"} plan for ${team}:`, scope, planHash));
+            return 3;
+        }
+        if (flagString(args, "plan-hash") !== planHash)
+            return refusal(ctx, args, { status: 409, body: { error: "plan-hash-mismatch", reason: `Preview again and review the updated plan hash ${planHash}.` } });
+        if (!args.json)
+            for (const line of planLines(`${undo ? "Undo" : "Adopt"} plan for ${team}:`, scope, planHash).slice(0, -1))
+                ctx.stdout(line);
+        const applied = fromSdk(undo ? await (await client()).undoApply(team, hash) : await (await client()).adoptApply(team, hash));
+        if (isRefusal(applied))
+            return refusal(ctx, args, applied);
+        const outcomes = (undo ? [applied.body.archived, applied.body.kept, applied.body.failed] : [applied.body.stages, applied.body.labels, applied.body.labelsNotCreated, applied.body.provenanceGaps, applied.body.labelProvenanceGaps]).flatMap((v) => Array.isArray(v) ? v : []);
+        emit(ctx, args, { team, decision: "applied", preview: previewReply.body, result: applied.body }, [...outcomes.map((o) => `  ${JSON.stringify(o)}`), ...readinessLines(applied.body.readiness)]);
+        return 0;
+    }
+    const choices = assignments(flagList(args, "choice"), "choice").map(([sourceStateId, destinationStateId]) => ({ sourceStateId, destinationStateId }));
+    const previewReply = fromSdk(await (await client()).migratePreview(team, choices));
+    if (isRefusal(previewReply))
+        return refusal(ctx, args, previewReply);
+    const preview = previewReply.body.preview;
+    if (!preview || typeof preview.migrationHash !== "string" || !Array.isArray(preview.sources))
+        return refusal(ctx, args, { status: 502, body: { error: "bad-response", reason: "migration preview omitted hash or source rows" } });
+    if (preview.actionsAvailable === false)
+        return refusal(ctx, args, { status: 409, body: { error: "migration-approval-unavailable", reason: "Catalyst cannot verify the exact tickets in this migration preview, so moves and retirement are paused. Use Linear's bulk editor to move tickets, or retry when approved migration snapshots are available." } });
+    const step = flagBool(args, "retire") ? "retire" : "migrate";
+    const planHash = approvalHash(step, { preview, choices });
+    const plan = { team, step, decision: "not-confirmed", preview, planHash };
+    const blocked = preview.overLimit || preview.sources.some((source) => source.outcome === "needs-a-choice");
+    if (!flagBool(args, "yes")) {
+        emit(ctx, args, plan, planLines(`Migration ${plan.step} plan for ${team}:`, preview.sources, planHash));
+        return 3;
+    }
+    if (flagString(args, "plan-hash") !== planHash)
+        return refusal(ctx, args, { status: 409, body: { error: "plan-hash-mismatch", reason: `Preview again and review the updated plan hash ${planHash}.` } });
+    if (blocked)
+        return refusal(ctx, args, { status: 400, body: { error: "migration-plan-blocked", reason: "Resolve the preview's blocked sources or issue limit before applying." } });
+    if (!args.json)
+        for (const line of planLines(`Migration ${plan.step} plan for ${team}:`, preview.sources, planHash).slice(0, -1))
+            ctx.stdout(line);
+    const results = [];
+    const deadline = Date.now() + MAX_RUN_MS;
+    let hash = preview.migrationHash;
+    for (let n = 0; n < (step === "retire" ? 1 : MAX_CHUNKS); n++) {
+        if (Date.now() >= deadline)
+            return refusal(ctx, args, { status: 503, body: { error: "migration-time-budget", reason: "The bounded run ended; preview again before continuing." } });
+        const result = fromSdk(step === "retire" ? await (await client()).migrateRetire(team, hash, choices) : await (await client()).migrateChunk(team, hash, choices));
+        if (isRefusal(result))
+            return refusal(ctx, args, result);
+        results.push(result.body);
+        const partial = Array.isArray(result.body.sources) && result.body.sources.some((source) => source.outcome === "partially-moved");
+        if (!args.json) {
+            ctx.stdout(`${step} chunk ${n + 1}: moved ${String(result.body.moved ?? 0)}, remaining ${String(result.body.remaining ?? 0)}`);
+            for (const source of Array.isArray(result.body.sources) ? result.body.sources : [])
+                ctx.stdout(`  ${JSON.stringify(source)}`);
+            for (const [name, value] of Object.entries(result.body))
+                if (name === "failed" || name === "blockers" || name === "logGaps")
+                    ctx.stdout(`  ${name}: ${JSON.stringify(value)}`);
+        }
+        if (partial) {
+            emit(ctx, args, { ...plan, decision: "partial", results }, [`Migration partially completed; at least one source reported a refused or incomplete move.`, ...readinessLines(result.body.readiness)]);
+            return 1;
+        }
+        if (step === "retire" && Array.isArray(result.body.failed) && result.body.failed.length > 0) {
+            emit(ctx, args, { ...plan, decision: "partial", results }, [`Source retirement partially completed: ${JSON.stringify(result.body.failed)}`]);
+            return 1;
+        }
+        if (step === "retire" || result.body.remaining === 0) {
+            emit(ctx, args, { ...plan, decision: "applied", results }, [...readinessLines(result.body.readiness), ...(step === "migrate" ? ["Tickets moved. Retiring source stages requires a separate team migrate --retire confirmation."] : [])]);
+            return 0;
+        }
+        if (typeof result.body.migrationHash !== "string")
+            return refusal(ctx, args, { status: 502, body: { error: "bad-response", reason: "migration chunk omitted the next hash" } });
+        hash = result.body.migrationHash;
+    }
+    return refusal(ctx, args, { status: 503, body: { error: "migration-chunk-limit", reason: "The bounded run ended; preview again before continuing." } });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catalyst-cloud/cli",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Customer skill bundle for Catalyst Cloud, named from the executive's seat — get set up, see what is happening, see what needs you, run a project, unstick what is stuck — plus the catalyst CLI that reads through the Catalyst Cloud SDK, writes through the agent proxy, and connects your machine to your tenant with one command. The skills directory is the roster; this line never counts it.",
   "license": "MIT",
   "type": "module",

package/skills/catalyst-github/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Catalyst's GitHub: show a ticket's pull request with its checks, reviews and review threads, say whether it is mergeable under this repository's policy, and explain what a PR accumulates as the ticket moves (the branch, the draft, the rewrite, the force-pushes, the labels, the queue). Use when someone asks "show me the PR", "what are the checks saying", "why hasn't it merged", "what does the queue need", "what does that label mean", or wants the branch and merge conventions Catalyst follows.
 allowed-tools: Bash(catalyst-skills:*) Bash(npx @catalyst-cloud/catalyst-skills:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.9.3 — written in this repository for customer tenants -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.9.5 — written in this repository for customer tenants -->
 
 # Catalyst's GitHub