@ciphrix/cli 0.1.0

package/dist/commands/policy.js

@@ -0,0 +1,112 @@
+import { writeLine, writeNextHint, writePageFooter, writeTable } from '../io.js';
+import { asRecord, asText, callTool, errorMessage, resolveToolContext } from '../toolSurface.js';
+const UUID = /^[0-9a-f]{8}-[0-9a-f-]{27}$/i;
+const num = (value, fallback) => typeof value === 'number' ? String(value) : asText(value, fallback);
+export const policyListCommand = async ({ io, apiUrl, json = false, name, status, page, limit, store, }) => {
+    const ctx = await resolveToolContext(apiUrl, store);
+    const input = {};
+    if (name)
+        input.name = name;
+    if (status)
+        input.status = status
+            .split(',')
+            .map((value) => value.trim())
+            .filter(Boolean);
+    if (page)
+        input.page = page;
+    if (limit)
+        input.limit = limit;
+    const envelope = await callTool(ctx, 'list_documents', input);
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not list documents.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope, null, 2));
+        return;
+    }
+    const data = asRecord(envelope.data);
+    const policies = Array.isArray(data.policies) ? data.policies : [];
+    const counts = asRecord(data.counts);
+    const count = (value) => typeof value === 'number' ? String(value) : asText(value, '0');
+    writeLine(io.stdout, `${io.theme.bold('Documents')} ${io.theme.dim(`(${count(data.total)} total · ${count(counts.draft)} draft · ${count(counts.pending)} pending · ${count(counts.published)} published)`)}`);
+    if (policies.length === 0) {
+        writeLine(io.stdout, 'No documents found.');
+        return;
+    }
+    const rows = policies.map((policy) => {
+        const record = asRecord(policy);
+        return [
+            asText(record.code, '-'),
+            asText(record.name),
+            asText(record.status, '-'),
+            record.isPublished === true ? 'published' : '-',
+        ];
+    });
+    writeTable(io, ['CODE', 'NAME', 'STATUS', 'PUBLISHED'], rows);
+    writePageFooter(io, {
+        shown: policies.length,
+        total: typeof data.total === 'number' ? data.total : policies.length,
+        page: typeof data.page === 'number' ? data.page : 1,
+        limit: typeof data.limit === 'number' ? data.limit : 25,
+        hasMore: data.hasMore === true,
+    });
+    const next = asText(asRecord(policies[0]).code);
+    if (next)
+        writeNextHint(io, `ciphrix document get ${next}`);
+};
+export const policyGetCommand = async ({ io, apiUrl, json = false, policy, version, minor, store, }) => {
+    const ctx = await resolveToolContext(apiUrl, store);
+    if (version) {
+        const versionEnvelope = await callTool(ctx, 'get_document_version', {
+            ...(UUID.test(policy) ? { policyId: policy } : { name: policy }),
+            versionNumber: version,
+            ...(minor !== undefined ? { minorVersionNumber: minor } : {}),
+        });
+        if (versionEnvelope.status !== 'ok')
+            throw new Error(errorMessage(versionEnvelope, 'Document version not found.'));
+        const recordV = asRecord(versionEnvelope.data);
+        if (json) {
+            writeLine(io.stdout, JSON.stringify(recordV, null, 2));
+            return;
+        }
+        writeLine(io.stdout, `${io.theme.bold(policy)} ${io.theme.dim(`· version ${num(recordV.versionNumber, String(version))}.${num(recordV.minorVersionNumber, '0')} · ${asText(recordV.status, 'unknown')}`)}`);
+        const versionMeta = [
+            ['Reviewer', recordV.reviewedBy],
+            ['Approver', recordV.approvedBy],
+            ['Approved', recordV.approvedAt],
+        ];
+        for (const [label, value] of versionMeta) {
+            if (value === undefined || value === null || value === '')
+                continue;
+            writeLine(io.stdout, `  ${io.theme.dim(`${label}:`)} ${asText(value)}`);
+        }
+        writeLine(io.stdout);
+        const body = asText(recordV.contentMarkdown);
+        writeLine(io.stdout, body.trim() === '' ? io.theme.dim('(no content)') : body.trimEnd());
+        return;
+    }
+    const envelope = await callTool(ctx, 'get_document', UUID.test(policy) ? { policyId: policy } : { name: policy });
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Document not found.'));
+    const record = asRecord(asRecord(envelope.data).policy);
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(record, null, 2));
+        return;
+    }
+    const currentVersion = asRecord(record.currentVersion);
+    const meta = [
+        ['Reviewer', currentVersion.reviewer ?? currentVersion.reviewedBy],
+        ['Approver', currentVersion.approver ?? currentVersion.approvedBy],
+        ['Approved', currentVersion.approvedAt],
+    ];
+    for (const [label, value] of meta) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        writeLine(io.stdout, `  ${io.theme.dim(`${label}:`)} ${asText(value)}`);
+    }
+    if (meta.some(([, value]) => value !== undefined && value !== null && value !== ''))
+        writeLine(io.stdout);
+    const markdown = asText(currentVersion.contentMarkdown);
+    writeLine(io.stdout, `${io.theme.bold(asText(record.name, 'Document'))} ${io.theme.dim(`· ${asText(record.status, 'unknown')}${record.isPublished === true ? ' · published' : ''}`)}`);
+    writeLine(io.stdout);
+    writeLine(io.stdout, markdown.trim() === '' ? io.theme.dim('(no content)') : markdown.trimEnd());
+};

package/dist/commands/policyActions.d.ts

@@ -0,0 +1,37 @@
+import type { CredentialStore } from '../credentials.js';
+import { type CliIO } from '../io.js';
+export interface PolicyActionOptions {
+    io: CliIO;
+    apiUrl?: string | undefined;
+    json?: boolean | undefined;
+    yes?: boolean | undefined;
+    store?: CredentialStore | undefined;
+    confirm?: ((question: string) => Promise<boolean>) | undefined;
+}
+export interface PolicyTargetOptions extends PolicyActionOptions {
+    policy: string;
+}
+export interface PolicyCreateOptions extends PolicyActionOptions {
+    name: string;
+    type?: string | undefined;
+    description?: string | undefined;
+}
+export declare const policyCreateCommand: ({ io, apiUrl, json, yes, store, confirm, name, type, description, }: PolicyCreateOptions) => Promise<void>;
+export interface PolicyEditOptions extends PolicyTargetOptions {
+    content?: string | undefined;
+    file?: string | undefined;
+}
+export declare const policyEditCommand: ({ io, apiUrl, json, yes, store, confirm, policy, content, file, }: PolicyEditOptions) => Promise<void>;
+export interface PolicyVersionOptions extends PolicyTargetOptions {
+    changeType?: string | undefined;
+    summary?: string | undefined;
+}
+export declare const policyVersionCommand: ({ io, apiUrl, json, yes, store, confirm, policy, changeType, summary, }: PolicyVersionOptions) => Promise<void>;
+export declare const policySubmitCommand: (options: PolicyTargetOptions) => Promise<void>;
+export declare const policyApproveCommand: (options: PolicyTargetOptions) => Promise<void>;
+export declare const policyDeleteCommand: ({ io, apiUrl, json, yes, store, confirm, policy, }: PolicyTargetOptions) => Promise<void>;
+export interface PolicyMetadataUpdateOptions extends PolicyTargetOptions {
+    changes: Record<string, unknown>;
+}
+export declare const policyUpdateMetaCommand: ({ io, apiUrl, json, store, policy, changes, }: PolicyMetadataUpdateOptions) => Promise<void>;
+export declare const policyVersionsCommand: ({ io, apiUrl, json, store, policy, }: PolicyTargetOptions) => Promise<void>;

package/dist/commands/policyActions.js

@@ -0,0 +1,177 @@
+import { readFile } from 'node:fs/promises';
+import { applyTool } from '../actions.js';
+import { writeLine, writeTable } from '../io.js';
+import { asRecord, asText, callTool, errorMessage, resolveToolContext } from '../toolSurface.js';
+const UUID = /^[0-9a-f]{8}-[0-9a-f-]{27}$/i;
+const num = (value, fallback) => typeof value === 'number' ? String(value) : asText(value, fallback);
+const target = (policy) => UUID.test(policy) ? { policyId: policy } : { name: policy };
+const renderResult = (io, json, result) => {
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(result, null, 2));
+        return;
+    }
+    const data = asRecord(result.data);
+    const name = asText(data.name, asText(data.policyId, 'document'));
+    const status = asText(data.status, 'done');
+    writeLine(io.stdout, `${io.theme.green('✓')} ${name}: ${status}`);
+};
+export const policyCreateCommand = async ({ io, apiUrl, json = false, yes = false, store, confirm, name, type, description, }) => {
+    const ctx = await resolveToolContext(apiUrl, store);
+    const input = { name };
+    if (type)
+        input.type = type;
+    if (description)
+        input.description = description;
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'create_document',
+        input,
+        fallback: 'Could not create the document.',
+        yes,
+        confirm,
+    });
+    if (result)
+        renderResult(io, json, result);
+};
+export const policyEditCommand = async ({ io, apiUrl, json = false, yes = false, store, confirm, policy, content, file, }) => {
+    const markdown = file ? await readFile(file, 'utf8') : content;
+    if (!markdown) {
+        throw new Error('Provide the new content with --file <path> or --content <markdown>.');
+    }
+    const ctx = await resolveToolContext(apiUrl, store);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'edit_document_content',
+        input: { ...target(policy), contentMarkdown: markdown },
+        fallback: 'Could not edit the document.',
+        yes,
+        confirm,
+    });
+    if (result)
+        renderResult(io, json, result);
+};
+export const policyVersionCommand = async ({ io, apiUrl, json = false, yes = false, store, confirm, policy, changeType, summary, }) => {
+    const ctx = await resolveToolContext(apiUrl, store);
+    const input = { ...target(policy) };
+    if (changeType)
+        input.changeType = changeType;
+    if (summary)
+        input.changeSummary = summary;
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'create_document_version',
+        input,
+        fallback: 'Could not create a new version.',
+        yes,
+        confirm,
+    });
+    if (result)
+        renderResult(io, json, result);
+};
+export const policySubmitCommand = async (options) => {
+    const { io, apiUrl, json = false, yes = false, store, confirm, policy } = options;
+    const ctx = await resolveToolContext(apiUrl, store);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'submit_document',
+        input: target(policy),
+        fallback: 'Could not submit the document for review.',
+        yes,
+        confirm,
+    });
+    if (result)
+        renderResult(io, json, result);
+};
+export const policyApproveCommand = async (options) => {
+    const { io, apiUrl, json = false, yes = false, store, confirm, policy } = options;
+    const ctx = await resolveToolContext(apiUrl, store);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'approve_document',
+        input: target(policy),
+        fallback: 'Could not approve the document.',
+        yes,
+        confirm,
+    });
+    if (result)
+        renderResult(io, json, result);
+};
+export const policyDeleteCommand = async ({ io, apiUrl, json = false, yes = false, store, confirm, policy, }) => {
+    const ctx = await resolveToolContext(apiUrl, store);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'delete_document',
+        input: target(policy),
+        fallback: 'Could not delete the document.',
+        yes,
+        confirm,
+    });
+    if (result)
+        renderResult(io, json, result);
+};
+export const policyUpdateMetaCommand = async ({ io, apiUrl, json = false, store, policy, changes, }) => {
+    if (Object.keys(changes).length === 0) {
+        throw new Error('Provide at least one field, for example --type manual or --publish on');
+    }
+    const ctx = await resolveToolContext(apiUrl, store);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'update_document',
+        input: { ...target(policy), changes },
+        fallback: 'Could not update the document.',
+    });
+    if (!result)
+        return;
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+        return;
+    }
+    const applied = asRecord(result.data).applied;
+    const failed = asRecord(result.data).failed;
+    const appliedList = Array.isArray(applied)
+        ? applied.map((value) => asText(value)).join(', ')
+        : '';
+    writeLine(io.stdout, `${io.theme.green('✓')} updated ${policy}: ${appliedList}`);
+    if (Array.isArray(failed) && failed.length > 0) {
+        for (const item of failed) {
+            const record = asRecord(item);
+            writeLine(io.stdout, `${io.theme.yellow('!')} ${asText(record.field)}: ${asText(record.error)}`);
+        }
+    }
+};
+export const policyVersionsCommand = async ({ io, apiUrl, json = false, store, policy, }) => {
+    const ctx = await resolveToolContext(apiUrl, store);
+    const envelope = await callTool(ctx, 'list_document_versions', target(policy));
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not list document versions.'));
+    const data = asRecord(envelope.data);
+    const versions = Array.isArray(data.versions) ? data.versions : [];
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(data, null, 2));
+        return;
+    }
+    writeLine(io.stdout, `${io.theme.bold(policy)} ${io.theme.dim(`· ${versions.length} version(s)`)}`);
+    if (versions.length === 0) {
+        writeLine(io.stdout, 'No versions found.');
+        return;
+    }
+    writeTable(io, ['VERSION', 'STATUS', 'REVIEWED BY', 'APPROVED BY', 'APPROVED'], versions.map((version) => {
+        const record = asRecord(version);
+        const major = num(record.versionNumber, '?');
+        const minor = num(record.minorVersionNumber, '0');
+        return [
+            `${major}.${minor}`,
+            asText(record.status, '-'),
+            asText(record.reviewedBy, '-'),
+            asText(record.approvedBy, '-'),
+            asText(record.approvedAt, '-').slice(0, 10),
+        ];
+    }));
+};

package/dist/commands/risk.d.ts

@@ -0,0 +1,51 @@
+import type { CredentialStore } from '../credentials.js';
+import { type CliIO } from '../io.js';
+export interface RiskCommonOptions {
+    io: CliIO;
+    apiUrl?: string | undefined;
+    json?: boolean | undefined;
+    credentialStore?: CredentialStore | undefined;
+}
+export interface RiskTargetOptions extends RiskCommonOptions {
+    risk: string;
+}
+export interface RiskActionOptions extends RiskTargetOptions {
+    yes?: boolean | undefined;
+    confirm?: ((question: string) => Promise<boolean>) | undefined;
+}
+export declare const riskListCommand: ({ io, apiUrl, json, credentialStore, status, businessUnit, page, limit, }: RiskCommonOptions & {
+    status?: string | undefined;
+    businessUnit?: string | undefined;
+    page?: number | undefined;
+    limit?: number | undefined;
+}) => Promise<void>;
+export declare const riskGetCommand: ({ io, risk, apiUrl, json, credentialStore, }: RiskTargetOptions) => Promise<void>;
+export interface RiskUpdateOptions extends RiskTargetOptions {
+    changes: Record<string, string>;
+}
+export declare const riskUpdateCommand: ({ io, risk, changes, apiUrl, json, credentialStore, }: RiskUpdateOptions) => Promise<void>;
+export declare const riskCreateCommand: ({ io, apiUrl, json, credentialStore, title, category, description, }: RiskCommonOptions & {
+    title: string;
+    category?: string | undefined;
+    description?: string | undefined;
+}) => Promise<void>;
+export declare const riskDeleteCommand: ({ io, risk, apiUrl, json, yes, confirm, credentialStore, }: RiskActionOptions) => Promise<void>;
+export declare const riskTreatmentCommand: ({ io, risk, apiUrl, json, credentialStore, }: RiskTargetOptions) => Promise<void>;
+export declare const riskScoresCommand: ({ io, risk, apiUrl, json, credentialStore, }: RiskTargetOptions) => Promise<void>;
+export declare const riskControlsCommand: ({ io, risk, apiUrl, json, credentialStore, }: RiskTargetOptions) => Promise<void>;
+export declare const riskLinkControlCommand: ({ io, risk, controlInstanceId, mappingId, action, apiUrl, json, yes, credentialStore, }: RiskTargetOptions & {
+    controlInstanceId?: string | undefined;
+    mappingId?: string | undefined;
+    action: string;
+    yes?: boolean | undefined;
+}) => Promise<void>;
+export declare const riskFilesCommand: ({ io, risk, apiUrl, json, credentialStore, }: RiskTargetOptions) => Promise<void>;
+export declare const riskAttachCommand: ({ io, risk, file, uploadId, apiUrl, json, yes, credentialStore, }: RiskTargetOptions & {
+    file?: string | undefined;
+    uploadId?: string | undefined;
+    yes?: boolean | undefined;
+}) => Promise<void>;
+export declare const riskDetachCommand: ({ io, risk, mappingId, apiUrl, json, yes, credentialStore, }: RiskTargetOptions & {
+    mappingId: string;
+    yes?: boolean | undefined;
+}) => Promise<void>;

package/dist/commands/risk.js

@@ -0,0 +1,289 @@
+import { applyTool } from '../actions.js';
+import { writeLine, writeNextHint, writePageFooter, writeTable } from '../io.js';
+import { uploadLocalFile } from '../upload.js';
+import { asRecord, callTool, errorMessage, resolveToolContext, asText } from '../toolSurface.js';
+const text = (value, fallback = '-') => typeof value === 'string' ? value : typeof value === 'number' ? String(value) : fallback;
+const UUID = /^[0-9a-f]{8}-[0-9a-f-]{27}$/i;
+const target = (risk) => UUID.test(risk) ? { riskId: risk } : { title: risk };
+export const riskListCommand = async ({ io, apiUrl, json = false, credentialStore, status, businessUnit, page, limit, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const input = {};
+    if (status)
+        input.status = status
+            .split(',')
+            .map((value) => value.trim())
+            .filter(Boolean);
+    if (businessUnit)
+        input.businessUnit = businessUnit;
+    if (page)
+        input.page = page;
+    if (limit)
+        input.limit = limit;
+    const envelope = await callTool(ctx, 'list_risks', input);
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not list risks.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const data = asRecord(envelope.data);
+    const risks = Array.isArray(data.risks) ? data.risks : [];
+    writeLine(io.stdout, `${io.theme.bold('Risks')} ${io.theme.dim(`(${text(data.total, String(risks.length))} total)`)}`);
+    if (risks.length === 0) {
+        writeLine(io.stdout, 'No risks found.');
+        return;
+    }
+    writeTable(io, ['CODE', 'TITLE', 'STATUS', 'OWNER', 'BUSINESS UNIT', 'SCORE'], risks.map((risk) => {
+        const record = asRecord(risk);
+        return [
+            text(record.code, '-'),
+            text(record.title),
+            text(record.status),
+            text(record.owner),
+            text(record.businessUnit),
+            text(record.score),
+        ];
+    }));
+    writePageFooter(io, {
+        shown: risks.length,
+        total: typeof data.total === 'number' ? data.total : risks.length,
+        page: typeof data.page === 'number' ? data.page : 1,
+        limit: typeof data.limit === 'number' ? data.limit : 25,
+        hasMore: data.hasMore === true,
+    });
+    const next = asText(asRecord(risks[0]).code);
+    if (next)
+        writeNextHint(io, `ciphrix risk get ${next}`);
+};
+export const riskGetCommand = async ({ io, risk, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'get_risk', target(risk));
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Risk not found.'));
+    const detail = asRecord(asRecord(envelope.data).risk);
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(detail, null, 2));
+        return;
+    }
+    writeLine(io.stdout, io.theme.bold(text(detail.risk_title ?? detail.title, 'Risk')));
+    const fields = [
+        ['Status', detail.risk_status ?? detail.status],
+        ['Category', detail.risk_category ?? detail.category],
+        ['Business unit', detail.business_unit ?? detail.businessUnit],
+        ['Owner', detail.risk_owner ?? detail.owner],
+        ['Code', detail.risk_code],
+        ['Description', detail.risk_description ?? detail.description],
+        ['Context', detail.risk_context ?? detail.context],
+    ];
+    for (const [label, value] of fields) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        writeLine(io.stdout, `  ${io.theme.dim(`${label}:`)} ${text(value)}`);
+    }
+};
+export const riskUpdateCommand = async ({ io, risk, changes, apiUrl, json = false, credentialStore, }) => {
+    if (Object.keys(changes).length === 0) {
+        throw new Error('Provide at least one field, for example --status closed');
+    }
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'update_risk',
+        input: { ...target(risk), changes },
+        fallback: 'Could not update the risk.',
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else {
+        const data = asRecord(result.data);
+        const applied = Array.isArray(data.applied)
+            ? data.applied.map((value) => text(value)).join(', ')
+            : '';
+        writeLine(io.stdout, `${io.theme.green('✓')} updated ${risk}: ${applied}`);
+    }
+};
+export const riskCreateCommand = async ({ io, apiUrl, json = false, credentialStore, title, category, description, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const input = { title };
+    if (category)
+        input.category = category;
+    if (description)
+        input.description = description;
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'create_risk',
+        input,
+        fallback: 'Could not create the risk.',
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else
+        writeLine(io.stdout, `${io.theme.green('✓')} risk created: ${title}`);
+};
+export const riskDeleteCommand = async ({ io, risk, apiUrl, json = false, yes = false, confirm, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'delete_risk',
+        input: target(risk),
+        fallback: 'Could not delete the risk.',
+        yes,
+        confirm,
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else
+        writeLine(io.stdout, `${io.theme.green('✓')} risk ${risk} deleted`);
+};
+const riskTarget = (risk) => {
+    const looksLikeCode = /^[A-Z0-9]{2,10}-[A-Z]{2,5}-[A-Z0-9]{2,8}$/.test(risk);
+    return looksLikeCode ? { code: risk } : { name: risk };
+};
+export const riskTreatmentCommand = async ({ io, risk, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'get_risk_treatment', riskTarget(risk));
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not read the treatment.'));
+    const data = asRecord(envelope.data);
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(data, null, 2));
+        return;
+    }
+    writeLine(io.stdout, `${io.theme.bold('Treatment')} ${io.theme.dim(`· ${risk}`)}`);
+    writeLine(io.stdout, `  ${io.theme.dim('Strategy:')} ${asText(data.treatmentType, 'not_set')}`);
+    if (typeof data.treatmentNotes === 'string' && data.treatmentNotes.trim() !== '') {
+        writeLine(io.stdout);
+        writeLine(io.stdout, data.treatmentNotes);
+    }
+};
+export const riskScoresCommand = async ({ io, risk, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'list_risk_scores', riskTarget(risk));
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not read the scores.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const scores = asRecord(asRecord(envelope.data).scores);
+    writeLine(io.stdout, `${io.theme.bold('Scores')} ${io.theme.dim(`· ${risk}`)}`);
+    for (const [label, value] of Object.entries(scores)) {
+        if (value === null || value === undefined || value === '')
+            continue;
+        writeLine(io.stdout, `  ${io.theme.dim(`${label}:`)} ${typeof value === 'string' ? value : JSON.stringify(value)}`);
+    }
+};
+export const riskControlsCommand = async ({ io, risk, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'list_risk_controls', riskTarget(risk));
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not read the linked controls.'));
+    const data = asRecord(envelope.data);
+    const controls = Array.isArray(data.controls) ? data.controls : [];
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(data, null, 2));
+        return;
+    }
+    writeLine(io.stdout, `${io.theme.bold('Linked controls')} ${io.theme.dim(`(${controls.length})`)}`);
+    if (controls.length === 0) {
+        writeLine(io.stdout, 'No controls linked.');
+        return;
+    }
+    writeTable(io, ['CONTROL', 'CODE'], controls.map((control) => {
+        const record = asRecord(control);
+        return [asText(record.name, asText(record.id)), asText(record.code, '-')];
+    }));
+};
+export const riskLinkControlCommand = async ({ io, risk, controlInstanceId, mappingId, action, apiUrl, json = false, yes = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const input = { ...riskTarget(risk), action };
+    if (controlInstanceId)
+        input.controlInstanceId = controlInstanceId;
+    if (mappingId)
+        input.mappingId = mappingId;
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'link_risk_control',
+        input,
+        fallback: 'Could not change the risk control.',
+        yes,
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else
+        writeLine(io.stdout, `${io.theme.green('✓')} control ${action === 'unlink' ? 'unlinked' : 'linked'} on ${risk}`);
+};
+export const riskFilesCommand = async ({ io, risk, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'list_risk_files', riskTarget(risk));
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not read risk files.'));
+    const data = asRecord(envelope.data);
+    const files = Array.isArray(data.files) ? data.files : [];
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(data, null, 2));
+        return;
+    }
+    writeLine(io.stdout, `${io.theme.bold('Risk files')} ${io.theme.dim(`(${files.length})`)}`);
+    if (files.length === 0) {
+        writeLine(io.stdout, 'No files attached.');
+        return;
+    }
+    writeTable(io, ['MAPPING', 'FILE'], files.map((file) => {
+        const record = asRecord(file);
+        return [asText(record.mappingId, '-'), asText(record.name)];
+    }));
+};
+export const riskAttachCommand = async ({ io, risk, file, uploadId, apiUrl, json = false, yes = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    let uploadIds;
+    if (uploadId)
+        uploadIds = [uploadId];
+    else if (file)
+        uploadIds = [(await uploadLocalFile(ctx, file, 'risk')).id];
+    else
+        throw new Error('Provide --file <path> or --upload <uploadId>');
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'link_risk_file',
+        input: { ...riskTarget(risk), action: 'link', uploadIds },
+        fallback: 'Could not attach the file.',
+        yes,
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else
+        writeLine(io.stdout, `${io.theme.green('✓')} attached ${uploadIds.length} file(s) to ${risk}`);
+};
+export const riskDetachCommand = async ({ io, risk, mappingId, apiUrl, json = false, yes = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'link_risk_file',
+        input: { ...riskTarget(risk), action: 'unlink', mappingId },
+        fallback: 'Could not detach the file.',
+        yes,
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else
+        writeLine(io.stdout, `${io.theme.green('✓')} detached ${mappingId} from ${risk}`);
+};