@customyai/cli 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @customyai/cli
+
+## 0.1.0
+
+### Minor Changes
+
+- Primera versión pública de `@customyai/cli` (antes `@customy/cli`, privada): `customy apps validate | codegen | sync` sobre el manifiesto `app/v1`, ejecutable como `customy` y usable como biblioteca (`validateManifest`, `generateAppTypes`, `syncApp`, `runCli`). Sin dependencias internas: el manifiesto viaja dentro del paquete y solo depende de `zod`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Customy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,18 @@
+# @customyai/cli
+
+La CLI de Customy para apps: valida, tipa y sincroniza el `customy.app.json` de una app (manifiesto `app/v1`: productos y scopes, recursos, eventos con schema y propósitos de consentimiento, capabilities, planes y meters).
+
+```bash
+npm install --save-dev @customyai/cli
+
+npx customy apps validate                          # --file customy.app.json
+npx customy apps codegen --out src/customy.generated.ts
+CUSTOMY_ACCESS_URL=https://access-api.customy.ai CUSTOMY_ACCESS_TOKEN=… \
+  npx customy apps sync --workspace-env <envId>    # --reason "…"
+```
+
+- **validate**: sale 1 y enseña cada problema con su ruta (`plans.0.capabilities.missing: CAPABILITY_UNDECLARED`).
+- **codegen**: escribe los tipos de la app — `CustomyEventName`, `CustomyEventProperties` (de los JSON Schema de sus eventos), `CustomyCapability`, `CustomyPlan`, `CustomyMeter` y los propósitos por evento — para `createCustomy<…>()` de `@customyai/sdk`, `createData<CustomyEventProperties>()` y `createBilling<CustomyMeter>()`.
+- **sync**: idempotente. Instala la app en el Workspace si no existe y publica una versión nueva del manifiesto sobre la revisión actual; Access lo lleva a cada producto y la CLI enseña cómo quedó cada uno (sale 1 si alguno falló; repetir `sync` lo repara). Lee `CUSTOMY_ACCESS_URL` y `CUSTOMY_ACCESS_TOKEN` (el de un administrador del Workspace) del entorno, nunca de la línea de comandos, y nunca crea credenciales.
+
+También se puede usar como biblioteca: `validateManifest`, `generateAppTypes`, `syncApp` y `runCli`.

package/dist/bin.cjs

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+'use strict';
+
+var chunkL2FDW7NF_cjs = require('./chunk-L2FDW7NF.cjs');
+
+// src/bin.ts
+chunkL2FDW7NF_cjs.runCli(process.argv.slice(2), {
+  cwd: process.cwd(),
+  env: process.env,
+  out: (line) => console.log(line),
+  err: (line) => console.error(line)
+}).then((code) => {
+  process.exitCode = code;
+});

package/dist/bin.d.cts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/bin.mjs

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { runCli } from './chunk-XKJUU7AX.mjs';
+
+// src/bin.ts
+runCli(process.argv.slice(2), {
+  cwd: process.cwd(),
+  env: process.env,
+  out: (line) => console.log(line),
+  err: (line) => console.error(line)
+}).then((code) => {
+  process.exitCode = code;
+});

package/dist/chunk-L2FDW7NF.cjs

@@ -0,0 +1,389 @@
+'use strict';
+
+var zod = require('zod');
+var promises = require('fs/promises');
+var path = require('path');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var path__default = /*#__PURE__*/_interopDefault(path);
+
+// src/codegen.ts
+var literal = (value) => JSON.stringify(value);
+var union = (values) => values.length ? values.map(literal).join(" | ") : "never";
+var key = (name) => /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : literal(name);
+function schemaToType(schema, indent = "") {
+  if (!schema || typeof schema !== "object") return "unknown";
+  if (Array.isArray(schema.enum)) return schema.enum.length ? schema.enum.map(literal).join(" | ") : "never";
+  const types = Array.isArray(schema.type) ? schema.type : schema.type ? [schema.type] : [];
+  if (types.length > 1) return types.map((type) => schemaToType({ ...schema, type }, indent)).join(" | ");
+  switch (types[0]) {
+    case "string":
+      return "string";
+    case "number":
+    case "integer":
+      return "number";
+    case "boolean":
+      return "boolean";
+    case "null":
+      return "null";
+    case "array":
+      return `Array<${schemaToType(schema.items, indent)}>`;
+    case "object": {
+      const required = new Set(schema.required ?? []);
+      const inner = `${indent}  `;
+      const fields = Object.entries(schema.properties ?? {}).map(([name, value]) => `${inner}${key(name)}${required.has(name) ? "" : "?"}: ${schemaToType(value, inner)};`);
+      if (schema.additionalProperties !== false && !schema.properties) return "Record<string, unknown>";
+      return fields.length ? `{
+${fields.join("\n")}
+${indent}}` : "Record<string, never>";
+    }
+    default:
+      return "unknown";
+  }
+}
+function generateAppTypes(manifest) {
+  const events = manifest.events.map((event) => `  ${literal(event.name)}: ${schemaToType(event.properties, "  ")};`);
+  return [
+    `// Generado por \`customy apps codegen\` desde customy.app.json (${manifest.key}). No editar a mano.`,
+    "",
+    `export type CustomyEventName = ${union(manifest.events.map((event) => event.name))};`,
+    "",
+    "export interface CustomyEventProperties {",
+    ...events,
+    "}",
+    "",
+    `export type CustomyCapability = ${union(manifest.capabilities.map((capability) => capability.lookupKey))};`,
+    `export type CustomyPlan = ${union(manifest.plans.map((plan) => plan.code))};`,
+    `export type CustomyMeter = ${union(manifest.meters.map((meter) => meter.code))};`,
+    "",
+    "/** Prop\xF3sitos de consentimiento que exige cada evento. */",
+    `export const CUSTOMY_EVENT_PURPOSES = {
+${manifest.events.map((event) => `  ${literal(event.name)}: ${literal(event.purposes)},`).join("\n")}
+} as const;`,
+    ""
+  ].join("\n");
+}
+var EntitlementMeterAggregationSchema = zod.z.enum(["sum", "count", "last"]);
+var identifier = zod.z.string().regex(/^[a-z][a-z0-9-]{1,62}$/);
+var ConnectedOperationSchema = zod.z.enum([
+  "read",
+  "propose",
+  "submit",
+  "read_owned",
+  "write_owned",
+  "research",
+  "deliver_budget_alert",
+  "deliver_notification"
+]);
+var ConnectedBindingKindSchema = zod.z.enum([
+  "product",
+  "internal_service",
+  "external_destination",
+  "public_form",
+  "private_collection",
+  "external_source",
+  "external_automation",
+  "external_communication"
+]);
+var ProductBindingSchema = zod.z.object({
+  kind: ConnectedBindingKindSchema,
+  /** Claves de recurso admitidas; sin lista, cualquiera. Son nombres del producto, nunca de apps. */
+  keys: zod.z.array(identifier).min(1).optional(),
+  /** Patrón que debe cumplir el identificador del recurso en el producto. */
+  resourceIdPattern: zod.z.string().min(1).optional(),
+  operations: zod.z.object({
+    allowed: zod.z.array(ConnectedOperationSchema).max(4),
+    /** exact: exactamente `allowed`; subset: un subconjunto no vacío. */
+    mode: zod.z.enum(["exact", "subset"]),
+    /** false: las operaciones pueden omitirse (si se dan, cumplen el modo). */
+    required: zod.z.boolean().default(true)
+  }).strict().optional(),
+  maxPerConnection: zod.z.number().int().positive().optional()
+}).strict();
+var ProductManifestSchema = zod.z.object({
+  schema: zod.z.literal("product/v1"),
+  key: zod.z.string().regex(/^customy-[a-z][a-z0-9-]*$/),
+  /** Audiencia de sus tokens de máquina (discovery). */
+  audience: zod.z.string().regex(/^customy-[a-z][a-z0-9-]*$/),
+  /** Si true, todo enlace debe declarar `bindingKind` (no admite el enlace implícito). */
+  bindingRequired: zod.z.boolean().default(false),
+  bindings: zod.z.array(ProductBindingSchema).default([]),
+  /** Productos a los que llama en nombre de una app (token exchange). Solo esos lo aceptan como actor. */
+  requires: zod.z.array(zod.z.string().regex(/^customy-[a-z][a-z0-9-]*$/)).default([])
+}).strict().superRefine((manifest, context) => {
+  const kinds = manifest.bindings.map((binding) => binding.kind);
+  if (new Set(kinds).size !== kinds.length) context.addIssue({ code: zod.z.ZodIssueCode.custom, message: "Binding kinds must be unique per product" });
+  if (manifest.requires.includes(manifest.key)) context.addIssue({ code: zod.z.ZodIssueCode.custom, message: "A product cannot require itself" });
+});
+var product = (key2, bindings = [], bindingRequired = false, requires = []) => ProductManifestSchema.parse({ schema: "product/v1", key: key2, audience: key2, bindingRequired, bindings, requires });
+var CONNECTABLE_PRODUCT_MANIFESTS = [
+  product("customy-atlas", [{ kind: "internal_service", operations: { allowed: ["read", "propose"], mode: "subset" } }]),
+  product("customy-tables", [{ kind: "private_collection", keys: ["favorites", "comparisons", "preferences"], operations: { allowed: ["read_owned", "write_owned"], mode: "subset" } }]),
+  product("customy-agent", [{ kind: "external_automation", keys: ["catalog-updater"], operations: { allowed: ["research", "deliver_budget_alert"], mode: "subset" } }]),
+  product("customy-forms", [{ kind: "public_form", keys: ["subscription", "contact", "commercial"], resourceIdPattern: "^frm_[a-zA-Z0-9_-]+$", operations: { allowed: ["read", "submit"], mode: "exact" } }], false, ["customy-links"]),
+  product("customy-crm"),
+  product("customy-content", [{ kind: "external_destination", operations: { allowed: ["read"], mode: "exact" } }]),
+  product("customy-storage"),
+  product("customy-data", [{ kind: "external_source", keys: ["analytics-source"], operations: { allowed: ["submit"], mode: "exact" } }]),
+  product("customy-analytics"),
+  product("customy-campaigns", [{ kind: "external_communication", keys: ["weekly-brief"], operations: { allowed: ["read"], mode: "exact" } }]),
+  product("customy-engagement", [{ kind: "external_communication", keys: ["notification-delivery"], operations: { allowed: ["deliver_notification"], mode: "exact" } }]),
+  // Una referencia de solo lectura a un sitio de Pages del Workspace; no concede edición ni publicación.
+  product("customy-pages", [{ kind: "product", resourceIdPattern: "^[0-9]{6,20}$", operations: { allowed: ["read"], mode: "exact", required: false }, maxPerConnection: 1 }], true)
+];
+function connectedResourceViolation(resource, manifests = CONNECTABLE_PRODUCT_MANIFESTS) {
+  const manifest = manifests.find((entry) => entry.key === resource.productKey);
+  if (!manifest) return "PRODUCT_NOT_CONNECTABLE";
+  if (manifest.bindingRequired && !resource.bindingKind) return "BINDING_KIND_REQUIRED";
+  const binding = resource.bindingKind ? manifest.bindings.find((entry) => entry.kind === resource.bindingKind) : void 0;
+  if (!binding) {
+    const plainReference = resource.bindingKind === void 0 || resource.bindingKind === "product";
+    if (plainReference && !resource.operations) return null;
+    return plainReference ? "OPERATIONS_REQUIRE_BINDING" : "BINDING_NOT_OFFERED";
+  }
+  if (binding.keys && !binding.keys.includes(resource.key)) return "BINDING_KEY_NOT_ALLOWED";
+  if (binding.resourceIdPattern && !new RegExp(binding.resourceIdPattern).test(resource.resourceId)) return "BINDING_RESOURCE_ID_INVALID";
+  const rule = binding.operations;
+  const operations = resource.operations;
+  if (!rule) return operations ? "OPERATIONS_REQUIRE_BINDING" : null;
+  if (!operations || operations.length === 0) return rule.required ? "BINDING_OPERATIONS_REQUIRED" : null;
+  if (operations.some((operation) => !rule.allowed.includes(operation))) return "BINDING_OPERATION_NOT_ALLOWED";
+  if (rule.mode === "exact" && (operations.length !== rule.allowed.length || rule.allowed.some((operation) => !operations.includes(operation)))) return "BINDING_OPERATIONS_MISMATCH";
+  return null;
+}
+function connectedResourceLimit(productKey2, manifests = CONNECTABLE_PRODUCT_MANIFESTS) {
+  const limits = manifests.find((entry) => entry.key === productKey2)?.bindings.map((binding) => binding.maxPerConnection).filter((value) => value !== void 0) ?? [];
+  return limits.length ? Math.min(...limits) : null;
+}
+
+// src/vendor/app-manifest.ts
+var slug = zod.z.string().regex(/^[a-z][a-z0-9-]{1,38}[a-z0-9]$/);
+var productKey = zod.z.string().regex(/^customy-[a-z][a-z0-9-]*$/);
+var httpsOrigin = zod.z.string().url().max(512).refine((value) => {
+  const url = new URL(value);
+  return url.origin === value && (url.protocol === "https:" || ["localhost", "127.0.0.1"].includes(url.hostname));
+}, "Origins must be bare https origins");
+var eventName = zod.z.string().regex(/^[a-z][a-z0-9_.:-]{0,199}$/);
+var lookupKey = zod.z.string().regex(/^[a-z][a-z0-9_.:-]{0,79}$/);
+var AppProductUseSchema = zod.z.object({
+  product: productKey,
+  /** Scopes de producto que pedirán sus credenciales de máquina (`<producto>:<scope>`). */
+  scopes: zod.z.array(zod.z.string().regex(/^[a-z][a-z0-9_-]*:[a-z0-9_:.-]+$/)).max(64).default([])
+}).strict();
+var AppResourceSchema = zod.z.object({
+  key: zod.z.string().regex(/^[a-z][a-z0-9-]{1,62}$/),
+  product: productKey,
+  bindingKind: ConnectedBindingKindSchema.optional(),
+  operations: zod.z.array(ConnectedOperationSchema).min(1).max(2).optional()
+}).strict();
+var AppEventSchema = zod.z.object({
+  name: eventName,
+  type: zod.z.enum(["track", "identify", "group", "page", "screen", "alias"]),
+  schemaVersion: zod.z.number().int().positive(),
+  /** JSON Schema de `properties`; se publica como schema fijado del evento. */
+  properties: zod.z.record(zod.z.unknown()).default({ type: "object" }),
+  purposes: zod.z.array(zod.z.string().regex(/^[a-z][a-z0-9_.:-]{0,79}$/)).min(1).max(8)
+}).strict();
+var AppCapabilitySchema = zod.z.object({
+  lookupKey,
+  name: zod.z.string().min(1).max(120),
+  type: zod.z.enum(["boolean", "metered", "config"]),
+  meter: lookupKey.optional()
+}).strict();
+var AppPlanSchema = zod.z.object({
+  code: lookupKey,
+  name: zod.z.string().min(1).max(120),
+  rank: zod.z.number().int().nonnegative().default(100),
+  capabilities: zod.z.record(lookupKey, zod.z.unknown()).default({})
+}).strict();
+var AppMeterSchema = zod.z.object({
+  code: lookupKey,
+  aggregation: EntitlementMeterAggregationSchema,
+  unit: zod.z.string().min(1).max(40)
+}).strict();
+var AppManifestSchema = zod.z.object({
+  /** Referencia opcional al JSON Schema publicado, para autocompletado en editores. */
+  $schema: zod.z.string().url().max(200).optional(),
+  schema: zod.z.literal("app/v1"),
+  key: slug,
+  name: zod.z.string().trim().min(1).max(80),
+  origins: zod.z.object({ staging: httpsOrigin.optional(), production: httpsOrigin.optional() }).strict().refine((origins) => Boolean(origins.staging || origins.production), "Declare at least one origin"),
+  products: zod.z.array(AppProductUseSchema).max(32).default([]),
+  resources: zod.z.array(AppResourceSchema).max(64).default([]),
+  events: zod.z.array(AppEventSchema).max(256).default([]),
+  capabilities: zod.z.array(AppCapabilitySchema).max(256).default([]),
+  plans: zod.z.array(AppPlanSchema).max(32).default([]),
+  meters: zod.z.array(AppMeterSchema).max(64).default([])
+}).strict();
+var APP_ACCESS_SCOPES = ["capabilities:read", "users:contact:read"];
+var APP_ACCESS_SCOPE_SET = new Set(APP_ACCESS_SCOPES);
+function appScopeAllowed(product2, scope) {
+  if (product2 === "customy-access") return APP_ACCESS_SCOPE_SET.has(scope);
+  return scope.startsWith(`${product2.replace(/^customy-/, "")}:`);
+}
+function appManifestProblems(input, manifests = CONNECTABLE_PRODUCT_MANIFESTS) {
+  const parsed = AppManifestSchema.safeParse(input);
+  if (!parsed.success) return parsed.error.issues.map((issue) => ({ path: issue.path.join("."), code: "SCHEMA_INVALID" }));
+  const app = parsed.data;
+  const problems = [];
+  const unique = (items, key2, path2) => {
+    const seen = /* @__PURE__ */ new Set();
+    items.forEach((item, index) => {
+      const k = key2(item);
+      if (seen.has(k)) problems.push({ path: `${path2}.${index}`, code: "DUPLICATE" });
+      seen.add(k);
+    });
+  };
+  unique(app.products, (p) => p.product, "products");
+  unique(app.resources, (r) => r.key, "resources");
+  unique(app.events, (e) => e.name, "events");
+  unique(app.capabilities, (c) => c.lookupKey, "capabilities");
+  unique(app.plans, (p) => p.code, "plans");
+  unique(app.meters, (m) => m.code, "meters");
+  app.products.forEach((use, index) => {
+    use.scopes.forEach((scope, scopeIndex) => {
+      if (!appScopeAllowed(use.product, scope)) problems.push({ path: `products.${index}.scopes.${scopeIndex}`, code: "SCOPE_OUTSIDE_PRODUCT" });
+    });
+  });
+  const counts = /* @__PURE__ */ new Map();
+  app.resources.forEach((resource, index) => {
+    const violation = connectedResourceViolation({ ...resource, productKey: resource.product, resourceId: "manifest" }, manifests);
+    if (violation && violation !== "BINDING_RESOURCE_ID_INVALID") problems.push({ path: `resources.${index}`, code: violation });
+    counts.set(resource.product, (counts.get(resource.product) ?? 0) + 1);
+  });
+  for (const [product2, count] of counts) {
+    const limit = connectedResourceLimit(product2, manifests);
+    if (limit !== null && count > limit) problems.push({ path: "resources", code: "BINDING_LIMIT_EXCEEDED" });
+  }
+  const meters = new Set(app.meters.map((meter) => meter.code));
+  const capabilities = new Set(app.capabilities.map((capability) => capability.lookupKey));
+  app.capabilities.forEach((capability, index) => {
+    if (capability.type === "metered" && (!capability.meter || !meters.has(capability.meter))) problems.push({ path: `capabilities.${index}.meter`, code: "METER_UNDECLARED" });
+    if (capability.type !== "metered" && capability.meter) problems.push({ path: `capabilities.${index}.meter`, code: "METER_ON_UNMETERED" });
+  });
+  app.plans.forEach((plan, index) => {
+    for (const key2 of Object.keys(plan.capabilities)) if (!capabilities.has(key2)) problems.push({ path: `plans.${index}.capabilities.${key2}`, code: "CAPABILITY_UNDECLARED" });
+  });
+  return problems;
+}
+
+// src/apps.ts
+function validateManifest(input) {
+  const problems = appManifestProblems(input);
+  return problems.length ? { ok: false, problems } : { ok: true, manifest: AppManifestSchema.parse(input) };
+}
+var SyncError = class extends Error {
+  constructor(code, status) {
+    super(`${code} (${status})`);
+    this.code = code;
+    this.status = status;
+  }
+  code;
+  status;
+};
+async function syncApp(options) {
+  const base = options.accessUrl.replace(/\/$/, "");
+  if (!/^https:\/\//.test(base) && !/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(base)) throw new SyncError("ACCESS_URL_INSECURE", 0);
+  const call = async (method, path2, body) => {
+    const response = await (options.fetch ?? fetch)(`${base}${path2}`, {
+      method,
+      headers: { authorization: `Bearer ${options.token}`, "content-type": "application/json", "idempotency-key": crypto.randomUUID() },
+      body: JSON.stringify(body)
+    });
+    const json = await response.json().catch(() => ({}));
+    if (!response.ok) throw new SyncError(String(json.code ?? json.error ?? "ACCESS_REQUEST_FAILED"), response.status);
+    return json;
+  };
+  const env = encodeURIComponent(options.workspaceEnvironmentId);
+  const installed = await call("POST", `/api/admin/env/${env}/connected-applications/install`, { manifest: options.manifest, reason: options.reason });
+  const connection = installed.connection;
+  const reconciliation = (value) => value && typeof value === "object" ? value : {};
+  if (!installed.replayed) {
+    return { action: "installed", applicationId: connection.applicationId, environmentId: connection.environmentId, revision: connection.revision, reconciliation: reconciliation(installed.reconciliation) };
+  }
+  const updated = await call("PUT", `/api/admin/env/${encodeURIComponent(connection.environmentId)}/connected-application/manifest`, {
+    expectedRevision: connection.revision,
+    manifest: options.manifest,
+    reason: options.reason
+  });
+  const revision = Number(updated.revision ?? connection.revision);
+  return { action: updated.unchanged ? "unchanged" : "updated", applicationId: connection.applicationId, environmentId: connection.environmentId, revision, reconciliation: reconciliation(updated.reconciliation) };
+}
+function option(args, name) {
+  const index = args.indexOf(`--${name}`);
+  return index >= 0 ? args[index + 1] : void 0;
+}
+async function loadManifest(args, io) {
+  const file = path__default.default.resolve(io.cwd, option(args, "file") ?? "customy.app.json");
+  let raw;
+  try {
+    raw = JSON.parse(await promises.readFile(file, "utf8"));
+  } catch (error) {
+    io.err(`no se pudo leer ${path__default.default.relative(io.cwd, file) || file}: ${error instanceof Error ? error.message : error}`);
+    return null;
+  }
+  const result = validateManifest(raw);
+  if (!result.ok) {
+    for (const problem of result.problems) io.err(`\u2717 ${problem.path || "(ra\xEDz)"}: ${problem.code}`);
+    return null;
+  }
+  return result.manifest;
+}
+async function runCli(argv, io) {
+  const [group, command, ...args] = argv;
+  if (group !== "apps" || !["validate", "codegen", "sync"].includes(command ?? "")) {
+    io.err("uso: customy apps <validate|codegen|sync> [--file customy.app.json]");
+    return 2;
+  }
+  const manifest = await loadManifest(args, io);
+  if (!manifest) return 1;
+  if (command === "validate") {
+    io.out(`\u2713 ${manifest.key}: manifiesto app/v1 v\xE1lido (${manifest.events.length} eventos, ${manifest.capabilities.length} capabilities)`);
+    return 0;
+  }
+  if (command === "codegen") {
+    const out = path__default.default.resolve(io.cwd, option(args, "out") ?? "customy.generated.ts");
+    await promises.mkdir(path__default.default.dirname(out), { recursive: true });
+    await promises.writeFile(out, generateAppTypes(manifest));
+    io.out(`\u2713 tipos de ${manifest.key} en ${path__default.default.relative(io.cwd, out)}`);
+    return 0;
+  }
+  const workspaceEnvironmentId = option(args, "workspace-env");
+  const accessUrl = io.env.CUSTOMY_ACCESS_URL;
+  const token = io.env.CUSTOMY_ACCESS_TOKEN;
+  if (!workspaceEnvironmentId || !accessUrl || !token) {
+    io.err("sync necesita --workspace-env y las variables CUSTOMY_ACCESS_URL y CUSTOMY_ACCESS_TOKEN");
+    return 2;
+  }
+  try {
+    const result = await syncApp({
+      manifest,
+      accessUrl,
+      token,
+      workspaceEnvironmentId,
+      reason: option(args, "reason") ?? `customy apps sync ${manifest.key}`,
+      fetch: io.fetch
+    });
+    const verb = { installed: "instalada", updated: "actualizada", unchanged: "sin cambios" }[result.action];
+    io.out(`\u2713 ${manifest.key} ${verb}: aplicaci\xF3n ${result.applicationId}, entorno ${result.environmentId}, revisi\xF3n ${result.revision}`);
+    let failed = false;
+    for (const [product2, outcome] of Object.entries(result.reconciliation)) {
+      if (outcome.status === "failed") {
+        failed = true;
+        io.err(`\u2717 ${product2}: ${outcome.code} \u2014 vuelve a ejecutar sync para reintentar`);
+      } else if (outcome.status === "reconciled") io.out(`\u2713 ${product2}: ${outcome.changed ? "actualizado" : "al d\xEDa"}${outcome.resourceId ? ` (${outcome.resourceId})` : ""}`);
+    }
+    return failed ? 1 : 0;
+  } catch (error) {
+    io.err(`\u2717 sync: ${error instanceof Error ? error.message : error}`);
+    return 1;
+  }
+}
+
+exports.SyncError = SyncError;
+exports.generateAppTypes = generateAppTypes;
+exports.runCli = runCli;
+exports.schemaToType = schemaToType;
+exports.syncApp = syncApp;
+exports.validateManifest = validateManifest;