@chatlychat/cli 0.4.1 → 0.5.2

package/dist/commands/auth.d.ts

@@ -17,5 +17,5 @@ export declare function logout(): number;
  * turns a mis-scoped key into an obvious error here rather than a 403 from an
  * unrelated endpoint three days into an integration.
  */
-export declare function whoami(chatly: ChatlyClient, json: boolean): Promise<number>;
+export declare function whoami(chatly: ChatlyClient, args: ParsedArgs): Promise<number>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAO,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAIlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB7D;AAED,wBAAgB,MAAM,IAAI,MAAM,CAM/B;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CASjF"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAIxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB7D;AAED,wBAAgB,MAAM,IAAI,MAAM,CAM/B;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAepF"}

package/dist/commands/auth.js

@@ -1,6 +1,6 @@
 import { createInterface } from 'node:readline/promises';
-import { str } from '../args.js';
-import { CONFIG_PATH, readConfig, writeConfig } from '../config.js';
+import { bool, str } from '../args.js';
+import { CONFIG_PATH, readConfig, resolveCredentials, writeConfig } from '../config.js';
 import { printJson } from '../output.js';
 /**
  * Store a key.
@@ -43,7 +43,13 @@ export function logout() {
  * turns a mis-scoped key into an obvious error here rather than a 403 from an
  * unrelated endpoint three days into an integration.
  */
-export async function whoami(chatly, json) {
+export async function whoami(chatly, args) {
+    const json = bool(args.flags, 'json');
+    // Resolved the same way run.ts resolved the key this client holds.
+    const key = resolveCredentials(str(args.flags, 'key'), undefined).apiKey;
+    if (key.startsWith('cp_')) {
+        return platformWhoami(chatly, json);
+    }
     const me = await chatly.whoami();
     if (json) {
         printJson(me);
@@ -53,4 +59,35 @@ export async function whoami(chatly, json) {
     process.stdout.write(`scopes     ${me.scopes.length === 0 ? '(none)' : me.scopes.join(', ')}\n`);
     return 0;
 }
+/**
+ * A `cp_` platform credential: `GET /v1/platform/whoami`, with the CHT-S01
+ * guardrails an operator set on it. They are shown because a credential can
+ * read but never change them, and "why was my login link refused" or "why
+ * a 403 from CI" is otherwise a support ticket.
+ */
+async function platformWhoami(chatly, json) {
+    const me = await chatly.request('GET', '/v1/platform/whoami');
+    if (json) {
+        printJson(me);
+        return 0;
+    }
+    const restriction = me.restrictedToWorkspaceIds !== null
+        ? `${String(me.restrictedToWorkspaceIds.length)} workspace(s)`
+        : me.restrictedToSlugPrefix !== null
+            ? `slugs starting "${me.restrictedToSlugPrefix}"`
+            : 'none';
+    const lines = [
+        ['platform', `${me.name} (${me.prefix}…)`],
+        ['scopes', me.scopes.length === 0 ? '(none)' : me.scopes.join(', ')],
+        ['expires', me.expiresAt ?? 'never'],
+        ['restricted', restriction],
+        ['login links', me.loginLinks ?? 'enabled'],
+        ['ip allow', me.ipAllowlist == null ? 'any address' : me.ipAllowlist.join(', ')],
+        ['contact', me.contactEmail ?? '(none — nobody is warned before expiry)'],
+    ];
+    for (const [label, value] of lines) {
+        process.stdout.write(`${label.padEnd(13)}${value}\n`);
+    }
+    return 0;
+}
 //# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,GAAG,EAAmB,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAgB;IAC1C,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oFAAoF;YAClF,mFAAmF,CACtF,CAAC;QACF,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4EAA4E,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ;YACjG,uFAAuF,CAC1F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,WAAW,+CAA+C,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,OAAO,QAAQ,CAAC,MAAM,CAAC;IACvB,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,WAAW,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAoB,EAAE,IAAa;IAC9D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC;IACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAmB,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAgB;IAC1C,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oFAAoF;YAClF,mFAAmF,CACtF,CAAC;QACF,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4EAA4E,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ;YACjG,uFAAuF,CAC1F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,WAAW,+CAA+C,CAAC,CAAC;IAC7F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,OAAO,QAAQ,CAAC,MAAM,CAAC;IACvB,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,WAAW,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAoB,EAAE,IAAgB;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,mEAAmE;IACnE,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC;IACzE,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC;IACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC;AACX,CAAC;AAcD;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,IAAa;IAC/D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAiB,KAAK,EAAE,qBAAqB,CAAC,CAAC;IAC9E,IAAI,IAAI,EAAE,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,WAAW,GACf,EAAE,CAAC,wBAAwB,KAAK,IAAI;QAClC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,eAAe;QAC9D,CAAC,CAAC,EAAE,CAAC,sBAAsB,KAAK,IAAI;YAClC,CAAC,CAAC,mBAAmB,EAAE,CAAC,sBAAsB,GAAG;YACjD,CAAC,CAAC,MAAM,CAAC;IACf,MAAM,KAAK,GAA4B;QACrC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC;QAC1C,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,OAAO,CAAC;QACpC,CAAC,YAAY,EAAE,WAAW,CAAC;QAC3B,CAAC,aAAa,EAAE,EAAE,CAAC,UAAU,IAAI,SAAS,CAAC;QAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,IAAI,yCAAyC,CAAC;KAC1E,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/deliveries.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `chatly deliveries list | show | replay` — an external agent's delivery log,
+ * addressed by the `eventId` its endpoint saw.
+ *
+ * The same three routes as `chatly bots deliveries | delivery | redeliver`,
+ * under the name people reach for when debugging an agent rather than managing
+ * a bot, and with the bot as a flag because the thing you have in hand is an
+ * event id from your own logs. The delivery id IS the `eventId` (there is no
+ * second column), so `show` and `replay` take it verbatim.
+ *
+ * `replay` re-sends the ORIGINAL body with the ORIGINAL eventId, so an agent
+ * that dedupes on it sees a repeat. Bodies are kept 7 days; a purged one is
+ * refused by the server with a message saying so.
+ */
+import { type ParsedArgs } from '../args.js';
+import type { ChatlyClient } from '@chatlychat/sdk-node';
+export declare function deliveries(chatly: ChatlyClient, args: ParsedArgs): Promise<number>;
+//# sourceMappingURL=deliveries.d.ts.map

package/dist/commands/deliveries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveries.d.ts","sourceRoot":"","sources":["../../src/commands/deliveries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAO,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAGlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAYzD,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCxF"}

package/dist/commands/deliveries.js

@@ -0,0 +1,46 @@
+/**
+ * `chatly deliveries list | show | replay` — an external agent's delivery log,
+ * addressed by the `eventId` its endpoint saw.
+ *
+ * The same three routes as `chatly bots deliveries | delivery | redeliver`,
+ * under the name people reach for when debugging an agent rather than managing
+ * a bot, and with the bot as a flag because the thing you have in hand is an
+ * event id from your own logs. The delivery id IS the `eventId` (there is no
+ * second column), so `show` and `replay` take it verbatim.
+ *
+ * `replay` re-sends the ORIGINAL body with the ORIGINAL eventId, so an agent
+ * that dedupes on it sees a repeat. Bodies are kept 7 days; a purged one is
+ * refused by the server with a message saying so.
+ */
+import { str } from '../args.js';
+import { need, pagedVia, renderList, showObject } from './common.js';
+function botId(args) {
+    const bot = str(args.flags, 'bot');
+    if (bot === undefined) {
+        throw new Error('Pass the external agent with --bot <bot-id>.');
+    }
+    return encodeURIComponent(bot);
+}
+const botPath = (args) => `/v1/bots/${botId(args)}/deliveries`;
+export async function deliveries(chatly, args) {
+    const sub = args.path[1] ?? 'list';
+    switch (sub) {
+        case 'list': {
+            const status = str(args.flags, 'status');
+            const pages = pagedVia(chatly, botPath(args), status === undefined ? {} : { status });
+            return renderList(args, ['id', 'status', 'attempt', 'httpStatus', 'durationMs', 'createdAt', 'error'], pages.onePage, pages.everyPage);
+        }
+        case 'show':
+            // With `payload` (or `{ purged: true }`) and the agent's `replies`.
+            return showObject(await chatly.request('GET', `${botPath(args)}/${encodeURIComponent(need(args, 2, 'an event id'))}`));
+        case 'replay': {
+            // A literal path, so `check-api-route-callers` can see this is the
+            // route's caller.
+            const eventId = encodeURIComponent(need(args, 2, 'an event id'));
+            return showObject(await chatly.request('POST', `/v1/bots/${botId(args)}/deliveries/${eventId}/replay`));
+        }
+        default:
+            throw new Error(`Unknown deliveries command "${sub}". Try: list, show, replay.`);
+    }
+}
+//# sourceMappingURL=deliveries.js.map

package/dist/commands/deliveries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliveries.js","sourceRoot":"","sources":["../../src/commands/deliveries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,GAAG,EAAmB,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIrE,SAAS,KAAK,CAAC,IAAgB;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAU,EAAE,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;AAEnF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAoB,EAAE,IAAgB;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACnC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACtF,OAAO,UAAU,CACf,IAAI,EACJ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,EAC7E,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,MAAM;YACT,oEAAoE;YACpE,OAAO,UAAU,CACf,MAAM,MAAM,CAAC,OAAO,CAClB,KAAK,EACL,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CACvE,CACF,CAAC;QACJ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,mEAAmE;YACnE,kBAAkB;YAClB,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;YACjE,OAAO,UAAU,CACf,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,SAAS,CAAC,CACrF,CAAC;QACJ,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,6BAA6B,CAAC,CAAC;IACrF,CAAC;AACH,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,29 @@
+import { type ParsedArgs } from '../args.js';
+import { type Framework } from '../init/templates.js';
+import type { EmbedBlock, ScaffoldFile } from '../init/shared.js';
+import type { ChatlyClient } from '@chatlychat/sdk-node';
+interface ChannelRow {
+    readonly type?: unknown;
+    readonly name?: unknown;
+    readonly publicId?: unknown;
+    readonly enabled?: unknown;
+    readonly embed?: unknown;
+}
+/** The web channel to scaffold for, or a sentence saying why there is none. */
+export declare function pickChannel(rows: ReadonlyArray<ChannelRow>, publicId: string | undefined): {
+    publicId: string;
+    embed: EmbedBlock;
+} | {
+    error: string;
+};
+/** What to do next, in the order it has to be done. */
+export declare function nextSteps(framework: Framework, identity: 'hmac' | 'atlas'): ReadonlyArray<string>;
+/** Write every file, or none: existing targets are checked first. */
+export declare function writeAll(dir: string, files: ReadonlyArray<ScaffoldFile>, force: boolean): {
+    written: ReadonlyArray<string>;
+} | {
+    existing: ReadonlyArray<string>;
+};
+export declare function init(chatly: ChatlyClient, args: ParsedArgs): Promise<number>;
+export {};
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAkC,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtF,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAMzD,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CACzB,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,EAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA8B7D;AAyBD,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAmBjG;AAED,qEAAqE;AACrE,wBAAgB,QAAQ,CACtB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,aAAa,CAAC,YAAY,CAAC,EAClC,KAAK,EAAE,OAAO,GACb;IAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAE,CAW1E;AAED,wBAAsB,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAiFlF"}

package/dist/commands/init.js

@@ -0,0 +1,176 @@
+/**
+ * `chatly init <framework>` — the install wizard (CHT-F02).
+ *
+ * Writes the identity route, the launcher, the CSP sources and the privacy
+ * table for one web channel into an existing project, from that channel's own
+ * `embed` block. One read, `GET /v1/channels`, with the caller's `ck_` key —
+ * the route the dashboard's install screen reads, so the CSP and the storage
+ * table come from the server rather than from a list in this CLI that could
+ * drift from it.
+ *
+ * ═══ WHAT IT WILL NOT DO ══════════════════════════════════════════════════
+ *
+ *  - **Overwrite a file.** Every target is checked before anything is
+ *    written, and one existing file stops the whole run with the list, unless
+ *    `--force`. Half a scaffold is worse than none: the summary would name
+ *    files that are not the ones on disk.
+ *  - **Edit the integrator's own files.** `next.config`, the root layout and
+ *    the Express app are THEIRS; the summary says which line goes where.
+ *    A wizard that rewrites a config it did not create is a wizard nobody
+ *    re-runs.
+ *  - **Write a secret.** `CHATLY_IDV_SECRET` is named, never fetched: the
+ *    channel read redacts it, and a secret in a scaffolded file is a secret
+ *    in git.
+ *  - **Generate the e2e fixture.** CHT-F02 asks for one built on CHT-D09's
+ *    `@chatlychat/widget-testing`, which is not on npm. A file importing it
+ *    would scaffold a project that does not install, so the summary says so
+ *    instead.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { bool, str } from '../args.js';
+import { FRAMEWORKS, NO_ATLAS, scaffold } from '../init/templates.js';
+import { printJson } from '../output.js';
+const USAGE = `Usage: chatly init <${FRAMEWORKS.join('|')}> [--public-id <id>] [--identity hmac|atlas] ` +
+    '[--dir <path>] [--dry-run] [--force]\n';
+/** The web channel to scaffold for, or a sentence saying why there is none. */
+export function pickChannel(rows, publicId) {
+    const web = rows.filter((r) => r.type === 'web' && typeof r.publicId === 'string');
+    const chosen = publicId === undefined
+        ? web.length === 1
+            ? web[0]
+            : undefined
+        : web.find((r) => r.publicId === publicId);
+    if (chosen === undefined) {
+        if (publicId !== undefined) {
+            return { error: `No web channel with publicId "${publicId}" in this workspace.` };
+        }
+        if (web.length === 0) {
+            return { error: 'This workspace has no web channel. Create one in the dashboard first.' };
+        }
+        return {
+            error: `This workspace has ${String(web.length)} web channels; name one with --public-id:\n` +
+                web.map((r) => `  ${String(r.publicId)}  ${String(r.name ?? '')}`).join('\n'),
+        };
+    }
+    const embed = chosen.embed;
+    if (embed === null || embed === undefined) {
+        return {
+            error: `Channel ${String(chosen.publicId)} has no embed block: this deployment has not been told ` +
+                'where its widget is served from. Nothing was written.',
+        };
+    }
+    return { publicId: String(chosen.publicId), embed };
+}
+/** Where each framework's identity stub lives, and what to do with it. */
+const WIRE_IDENTITY = {
+    next: 'Wire `currentUserId` in app/api/chatly/identity/route.ts to your auth. Until you do, every visitor is anonymous.',
+    remix: 'Wire `currentUserId` in app/routes/api.chatly.identity.ts to your session. Until you do, every visitor is anonymous. ' +
+        'On React Router v7, app/routes.ts must use flatRoutes() from @react-router/fs-routes for the file to be routed.',
+    astro: 'Wire `currentUserId` in src/pages/api/chatly/identity.ts to your auth. Until you do, every visitor is anonymous. ' +
+        'The endpoint is `prerender = false`, so the site needs a server adapter (e.g. @astrojs/node).',
+    express: "Mount the handler: app.get('/api/chatly/identity', chatlyIdentity((req) => req.user?.id ?? null)).",
+};
+/** Where the widget goes on the page. */
+const RENDER = {
+    next: 'Render <Chatly /> from components/chatly.tsx once, in app/layout.tsx. Install @chatlychat/widget-react.',
+    remix: 'Render <Chatly /> from app/components/chatly.tsx once, in app/root.tsx. Install @chatlychat/widget-react.',
+    astro: 'Render <Chatly /> from src/components/Chatly.astro once, before </body> in your layout.',
+    express: 'Paste chatly/snippet.html before </body> on every page that shows the widget.',
+};
+/** What to do next, in the order it has to be done. */
+export function nextSteps(framework, identity) {
+    const steps = [];
+    if (identity === 'hmac') {
+        steps.push(WIRE_IDENTITY[framework], "Set CHATLY_IDV_SECRET on the server — the channel's identity-verification secret, from the dashboard. Never in a client bundle.");
+    }
+    else {
+        steps.push('Set the channel to identityVerification.mode "atlas" with your instance id, and create the `chatly` JWT template in Atlas.');
+    }
+    steps.push(RENDER[framework], 'Merge chatly.csp.mjs into your Content-Security-Policy with withChatly(…) — do not add a second CSP header.', 'Copy the table in CHATLY-PRIVACY.md into your privacy policy.', 'No e2e fixture was generated: @chatlychat/widget-testing (CHT-D09) is not on npm yet.');
+    return steps;
+}
+/** Write every file, or none: existing targets are checked first. */
+export function writeAll(dir, files, force) {
+    const existing = files.filter((f) => existsSync(join(dir, f.path))).map((f) => f.path);
+    if (existing.length > 0 && !force) {
+        return { existing };
+    }
+    for (const file of files) {
+        const target = join(dir, file.path);
+        mkdirSync(dirname(target), { recursive: true });
+        writeFileSync(target, file.contents);
+    }
+    return { written: files.map((f) => f.path) };
+}
+export async function init(chatly, args) {
+    const framework = args.path[1];
+    if (framework === undefined) {
+        process.stderr.write(USAGE);
+        return 2;
+    }
+    if (!FRAMEWORKS.includes(framework)) {
+        process.stderr.write(`Unknown framework "${framework}".\n${USAGE}`);
+        return 2;
+    }
+    const fw = framework;
+    const identity = str(args.flags, 'identity') ?? 'hmac';
+    if (identity !== 'hmac' && identity !== 'atlas') {
+        process.stderr.write(`--identity must be hmac or atlas, not "${identity}".\n`);
+        return 2;
+    }
+    if (NO_ATLAS.includes(fw) && identity === 'atlas') {
+        process.stderr.write(`\`chatly init ${fw} --identity atlas\` is not generated: an Atlas token is minted in the ` +
+            "browser, so there is no server half. Call Chatly('identify', { getToken }) from your page — " +
+            'https://chatlychat.com/guides/identity-verification#passing-the-token\n');
+        return 2;
+    }
+    const rows = await chatly.request('GET', '/v1/channels');
+    const picked = pickChannel(Array.isArray(rows) ? rows : [], str(args.flags, 'public-id'));
+    if ('error' in picked) {
+        process.stderr.write(`${picked.error}\n`);
+        return 1;
+    }
+    const files = scaffold(fw, {
+        publicId: picked.publicId,
+        embed: picked.embed,
+        identity,
+        generatedOn: new Date().toISOString().slice(0, 10),
+    });
+    const steps = nextSteps(fw, identity);
+    const dir = resolve(str(args.flags, 'dir') ?? '.');
+    if (bool(args.flags, 'dry-run')) {
+        if (bool(args.flags, 'json')) {
+            printJson({ publicId: picked.publicId, files, nextSteps: steps, written: false });
+        }
+        else {
+            for (const file of files) {
+                process.stdout.write(`── ${file.path} ──\n${file.contents}\n`);
+            }
+            process.stdout.write(`(dry run: nothing written to ${dir})\n`);
+        }
+        return 0;
+    }
+    const result = writeAll(dir, files, bool(args.flags, 'force'));
+    if ('existing' in result) {
+        process.stderr.write(`Nothing written — these already exist in ${dir}:\n` +
+            result.existing.map((p) => `  ${p}\n`).join('') +
+            'Move them, or pass --force to overwrite. --dry-run prints what would be written.\n');
+        return 1;
+    }
+    if (bool(args.flags, 'json')) {
+        printJson({
+            publicId: picked.publicId,
+            files: result.written,
+            nextSteps: steps,
+            written: true,
+        });
+        return 0;
+    }
+    process.stdout.write(`Scaffolded Chatly for web channel ${picked.publicId} in ${dir}:\n` +
+        result.written.map((p) => `  + ${p}\n`).join('') +
+        '\nNext:\n' +
+        steps.map((s, i) => `  ${String(i + 1)}. ${s}\n`).join(''));
+    return 0;
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAmB,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAkB,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAKzC,MAAM,KAAK,GACT,uBAAuB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,+CAA+C;IAC1F,wCAAwC,CAAC;AAU3C,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CACzB,IAA+B,EAC/B,QAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACnF,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAChB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACR,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,iCAAiC,QAAQ,sBAAsB,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,KAAK,EAAE,uEAAuE,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO;YACL,KAAK,EACH,sBAAsB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,6CAA6C;gBACrF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAChF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAsC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO;YACL,KAAK,EACH,WAAW,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,yDAAyD;gBAC3F,uDAAuD;SAC1D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,0EAA0E;AAC1E,MAAM,aAAa,GAAwC;IACzD,IAAI,EAAE,kHAAkH;IACxH,KAAK,EACH,uHAAuH;QACvH,iHAAiH;IACnH,KAAK,EACH,mHAAmH;QACnH,+FAA+F;IACjG,OAAO,EACL,oGAAoG;CACvG,CAAC;AAEF,yCAAyC;AACzC,MAAM,MAAM,GAAwC;IAClD,IAAI,EAAE,yGAAyG;IAC/G,KAAK,EACH,2GAA2G;IAC7G,KAAK,EACH,yFAAyF;IAC3F,OAAO,EAAE,+EAA+E;CACzF,CAAC;AAEF,uDAAuD;AACvD,MAAM,UAAU,SAAS,CAAC,SAAoB,EAAE,QAA0B;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,aAAa,CAAC,SAAS,CAAC,EACxB,iIAAiI,CAClI,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,4HAA4H,CAC7H,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,SAAS,CAAC,EACjB,6GAA6G,EAC7G,+DAA+D,EAC/D,uFAAuF,CACxF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CACtB,GAAW,EACX,KAAkC,EAClC,KAAc;IAEd,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,MAAoB,EAAE,IAAgB;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAE,UAAoC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,SAAS,OAAO,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,SAAsB,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC;IACvD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,QAAQ,MAAM,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iBAAiB,EAAE,wEAAwE;YACzF,8FAA8F;YAC9F,yEAAyE,CAC5E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,KAAK,EAAE,cAAc,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,WAAW,CACxB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAqB,CAAC,CAAC,CAAC,EAAE,EACjD,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAC7B,CAAC;IACF,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ;QACR,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;IAEnD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7B,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4CAA4C,GAAG,KAAK;YAClD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,oFAAoF,CACvF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7B,SAAS,CAAC;YACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,OAAO;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,MAAM,CAAC,QAAQ,OAAO,GAAG,KAAK;QACjE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,WAAW;QACX,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAC7D,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/integrations.d.ts

@@ -11,5 +11,32 @@ import type { ChatlyClient } from '@chatlychat/sdk-node';
 export declare function webhooks(chatly: ChatlyClient, args: ParsedArgs): Promise<number>;
 export declare function customerCards(chatly: ChatlyClient, args: ParsedArgs): Promise<number>;
 export declare function docsSources(chatly: ChatlyClient, args: ParsedArgs): Promise<number>;
+/**
+ * `chatly privacy …` — the data-rights executor's own commands (CHT-X03).
+ *
+ * ═══ WHY THE EXECUTOR KEY NEEDS A CLI COMMAND AT ALL ══════════════════════
+ *
+ * Because without one, `POST /v1/privacy/executor-key` had no caller.
+ * `check-api-route-callers` flagged it, and CLAUDE.md §5 is explicit that the
+ * fix is a caller and NOT an allow-list entry: an endpoint nothing can reach
+ * is a feature nobody can use, which is how the Gmail and Outlook mailbox
+ * sign-in shipped complete and unreachable.
+ *
+ * It is a good fit rather than a box-tick. The route exists to be run ONCE,
+ * by an operator, while they are filling in a privacy platform's executor
+ * registration form — exactly the shape of thing a CLI is for, and exactly
+ * the shape of thing that does not deserve a dashboard screen. The response
+ * is three fields a human pastes.
+ *
+ * ═══ WHY IT PRINTS A WARNING AND NOT JUST THE OBJECT ══════════════════════
+ *
+ * The secret is shown ONCE. `showObject` on a shown-once credential is the
+ * ergonomic trap every key-minting surface here has: the value scrolls past
+ * in a terminal somebody then closes. So the human-readable form labels it,
+ * says it will not be shown again, and names the sealed alternative — while
+ * `--json` stays exactly the API response, because that is what a script
+ * pipes into `jq`.
+ */
+export declare function privacy(chatly: ChatlyClient, args: ParsedArgs): Promise<number>;
 export declare function channels(chatly: ChatlyClient, args: ParsedArgs): Promise<number>;
 //# sourceMappingURL=integrations.d.ts.map

package/dist/commands/integrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../src/commands/integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAIxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAuHtF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAmD3F;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAmFzF;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA2DtF"}
+{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../src/commands/integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAYxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AASzD,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAmItF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAmD3F;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAmFzF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA0FrF;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAuGtF"}

package/dist/commands/integrations.js

@@ -8,19 +8,38 @@
  */
 import { bool, str } from '../args.js';
 import { itemsOf, printJson, printTable } from '../output.js';
-import { bodyFrom, need, renderList, showObject, showRows } from './common.js';
+import { bodyFrom, need, queryFrom, renderList, showObject, showRows, } from './common.js';
+/** The delivery log's filters: `--trace`, `--endpoint`, `--status`. */
+const DELIVERY_FILTERS = [
+    ['trace', 'trace'],
+    ['endpoint', 'endpointId'],
+    ['status', 'status'],
+];
 export async function webhooks(chatly, args) {
     const sub = args.path[1] ?? 'deliveries';
     switch (sub) {
         case 'deliveries':
-            return renderList(args, ['id', 'event', 'status', 'responseStatus', 'attempts', 'createdAt'], 
+            return renderList(args, 
+            /*
+             * The API's own field names. This read `event`, `responseStatus` and
+             * `attempts` — none of which `GET /v1/webhooks/deliveries` sends — so
+             * three of six columns printed blank on every row. `trace` is the
+             * `X-Chatly-Trace` each attempt carried (CHT-SI13).
+             */
+            ['id', 'eventType', 'status', 'httpStatus', 'attempt', 'trace', 'createdAt'], 
             /*
              * `deliveries`, not `list`. On the extended surface `webhooks.list`
              * is the SUBSCRIPTION list (`GET /v1/webhooks`) and the delivery log
              * is `deliveries`/`deliveriesAll` — this called `list`/`listAll` and
              * would have rendered subscriptions under delivery column headings.
              */
-            (q) => chatly.webhooks.deliveries(q), () => chatly.webhooks.deliveriesAll());
+            /*
+             * `--trace <ulid>` answers "what did Chatly send because of this
+             * chain?" from the id a partner product logged. `--endpoint` and
+             * `--status` are the two filters the route already had and this
+             * command never forwarded.
+             */
+            (q) => chatly.webhooks.deliveries({ ...q, ...queryFrom(args, DELIVERY_FILTERS) }), () => chatly.webhooks.deliveriesAll(queryFrom(args, DELIVERY_FILTERS)));
         case 'delivery':
             return showObject(await chatly.webhooks.delivery(need(args, 2, 'a delivery id')));
         case 'redeliver':
@@ -206,6 +225,93 @@ export async function docsSources(chatly, args) {
             throw new Error(`Unknown: docs-sources ${sub}`);
     }
 }
+/**
+ * `chatly privacy …` — the data-rights executor's own commands (CHT-X03).
+ *
+ * ═══ WHY THE EXECUTOR KEY NEEDS A CLI COMMAND AT ALL ══════════════════════
+ *
+ * Because without one, `POST /v1/privacy/executor-key` had no caller.
+ * `check-api-route-callers` flagged it, and CLAUDE.md §5 is explicit that the
+ * fix is a caller and NOT an allow-list entry: an endpoint nothing can reach
+ * is a feature nobody can use, which is how the Gmail and Outlook mailbox
+ * sign-in shipped complete and unreachable.
+ *
+ * It is a good fit rather than a box-tick. The route exists to be run ONCE,
+ * by an operator, while they are filling in a privacy platform's executor
+ * registration form — exactly the shape of thing a CLI is for, and exactly
+ * the shape of thing that does not deserve a dashboard screen. The response
+ * is three fields a human pastes.
+ *
+ * ═══ WHY IT PRINTS A WARNING AND NOT JUST THE OBJECT ══════════════════════
+ *
+ * The secret is shown ONCE. `showObject` on a shown-once credential is the
+ * ergonomic trap every key-minting surface here has: the value scrolls past
+ * in a terminal somebody then closes. So the human-readable form labels it,
+ * says it will not be shown again, and names the sealed alternative — while
+ * `--json` stays exactly the API response, because that is what a script
+ * pipes into `jq`.
+ */
+export async function privacy(chatly, args) {
+    const sub = args.path[1] ?? 'help';
+    switch (sub) {
+        case 'executor-key': {
+            /*
+             * `@RequireIdempotencyKey()` on the route, so a key is MANDATORY: a
+             * retried POST without one answers 428 in production. The SDK mints one
+             * per write, which is why this is a plain `request` and not a special
+             * case — see `packages/sdk-spec/CONTRACT.md`.
+             */
+            const res = await chatly.request('POST', '/v1/privacy/executor-key');
+            if (bool(args.flags, 'json')) {
+                return showObject(res);
+            }
+            process.stdout.write(`Executor URL   ${res.executorUrl}\n` +
+                `Workspace      ${res.workspaceId}\n` +
+                `Scopes         ${res.scopes.join(', ')}\n` +
+                `Key id         ${res.id}\n`);
+            if (res.token !== null) {
+                process.stdout.write(`Secret         ${res.token}\n` +
+                    '\nThe secret is shown ONCE and is not recoverable. Register the three\n' +
+                    'values above with your privacy platform now.\n' +
+                    'To receive it encrypted instead, send an X-Secret-Recipient header\n' +
+                    '(see /docs/api-rest, "Never printing a key").\n');
+            }
+            else {
+                process.stdout.write(`Sealed secret  ${res.sealedSecret ?? '(none)'}\n` +
+                    `Sealed scheme  ${res.sealedScheme ?? '(none)'}\n` +
+                    '\nSealed to the public key you sent. Decrypt it with the matching\n' +
+                    'private key; refuse a scheme you do not recognise rather than\n' +
+                    'guessing from the length.\n');
+            }
+            return 0;
+        }
+        case 'lookup':
+            /*
+             * Resolve a subject. A POST rather than a GET because an OIDC issuer is
+             * a URL and a subject claim is arbitrary text, neither of which survives
+             * a query string reliably — the route's own header makes the argument.
+             */
+            return showObject(await chatly.request('POST', '/v1/privacy/lookup', {
+                body: bodyFrom(args, 'the subject (issuer/subject, externalId or emails)'),
+            }));
+        case 'request':
+            return showObject(await chatly.request('POST', '/v1/privacy/requests', {
+                body: bodyFrom(args, 'the request (caseId, type and subject)'),
+            }));
+        case 'status':
+            return showObject(await chatly.request('GET', `/v1/privacy/requests/${encodeURIComponent(need(args, 2, 'a request id'))}`));
+        case 'cancel':
+            return showObject(await chatly.request('DELETE', `/v1/privacy/requests/${encodeURIComponent(need(args, 2, 'a request id'))}`));
+        default:
+            process.stderr.write('Usage: chatly privacy <executor-key|lookup|request|status|cancel>\n' +
+                '  executor-key            mint the credential a privacy platform registers\n' +
+                '  lookup --body <json>    resolve a person to a stable subjectId\n' +
+                '  request --body <json>   file a data-rights request\n' +
+                '  status <id>             read one back\n' +
+                '  cancel <id>             withdraw one that has not run\n');
+            return 2;
+    }
+}
 export async function channels(chatly, args) {
     const sub = args.path[1] ?? 'list';
     switch (sub) {
@@ -231,6 +337,33 @@ export async function channels(chatly, args) {
             return showObject(await chatly.request('POST', '/v1/channels', { body: bodyFrom(args, 'the channel') }));
         case 'update':
             return showObject(await chatly.request('PATCH', `/v1/channels/${encodeURIComponent(need(args, 2, 'a channel id'))}`, { body: bodyFrom(args, 'the fields to change') }));
+        case 'set-key':
+            // Adopt an existing channel into config-as-code: `chatly.json` matches channels on `key`.
+            return showObject(await chatly.request('PATCH', `/v1/channels/${encodeURIComponent(need(args, 2, 'a channel id'))}`, { body: { key: need(args, 3, 'a key (^[a-z][a-z0-9-]{0,63}$)') } }));
+        case 'brand': {
+            /*
+             * A DTCG `brand.json` (CHT-SI14). With `--url` or `--file`/`--body`
+             * it APPLIES the document; with neither it reads back the resolved
+             * mapping — each role's value and which layer it came from, because
+             * `brand.json` ranks below the workspace theme and the channel's own
+             * settings and "why didn't my accent change?" is answered by `source`.
+             */
+            const path = `/v1/channels/${encodeURIComponent(need(args, 2, 'a channel id'))}/brand`;
+            const url = str(args.flags, 'url');
+            const hasDocument = str(args.flags, 'file') !== undefined || str(args.flags, 'body') !== undefined;
+            if (url !== undefined && hasDocument) {
+                throw new Error('Pass --url or a document (--file/--body), not both.');
+            }
+            if (url !== undefined) {
+                return showObject(await chatly.request('PUT', path, { body: { brandUrl: url } }));
+            }
+            if (hasDocument) {
+                return showObject(await chatly.request('PUT', path, {
+                    body: { brand: bodyFrom(args, 'the brand document') },
+                }));
+            }
+            return showObject(await chatly.request('GET', path));
+        }
         case 'rotate-secret':
             // The inbound webhook signing secret, shown once.
             return showObject(await chatly.request('POST', `/v1/channels/${encodeURIComponent(need(args, 2, 'a channel id'))}/secret/rotate`));
@@ -246,7 +379,15 @@ export async function channels(chatly, args) {
              * the only field that distinguishes "locked to these sites" from "open
              * to every site".
              */
-            printTable(itemsOf(res), ['id', 'publicId', 'type', 'name', 'status', 'originsRestricted']);
+            printTable(itemsOf(res), [
+                'id',
+                'key',
+                'publicId',
+                'type',
+                'name',
+                'status',
+                'originsRestricted',
+            ]);
             return 0;
         }
         default: