@enterpriseai/cli 3.6.10 → 3.7.0

package/dist/commands/vertical.js

@@ -8,7 +8,7 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { resolveCommandContext, normalizeFormat, makeSpinner } from '../lib/context.js';
-import { PlatformAPIClient } from '../lib/api.js';
+import { PlatformAPIClient, } from '../lib/api.js';
 import { resolveActiveTenantContext, resolveMainCompanyTenantId, resolvePublicApiUrl, } from '../lib/tenant-context.js';
 import { findProjectRoot, patchEnvFile } from '../lib/config.js';
 import { errMsg, isRecord, normalizeChildTenantDisplayNameOption, normalizeChildTenantSlugOption, toObjectTypeSlug, } from '../lib/utils.js';
@@ -17,6 +17,8 @@ const VERTICAL_ENROLLMENT_TYPE = 'tenant-vertical-enrollment';
 const DEFAULT_VERTICAL_SOURCE = ['eai', 'cli'].join('-');
 const APP_KEY_ENV = 'EAI_APP_KEY';
 const LEGACY_VERTICAL_KEY_ENV = 'EAI_VERTICAL_KEY';
+const DEFAULT_SOURCE_UNKNOWN_GITHUB_OIDC_AUDIENCE = 'api://enterprise-ai-publicapi/source-unknown';
+const DEFAULT_SOURCE_UNKNOWN_RUNTIME_PATH = 'eai.runtime.json';
 export function buildVerticalEnrollmentData(name, tenantId, options) {
     const displayName = name.trim();
     const verticalKey = (options.key || toObjectTypeSlug(displayName)).trim();
@@ -36,6 +38,289 @@ export function buildVerticalEnrollmentData(name, tenantId, options) {
         ...(options.appUrl ? { appUrl: options.appUrl } : {}),
     };
 }
+/**
+ * Parse the GitHub repository identifier accepted by Admin Portal export jobs.
+ */
+export function parseRepositorySlug(repo) {
+    const normalized = repo
+        .trim()
+        .replace(/^git@github\.com:/, '')
+        .replace(/^https:\/\/github\.com\//, '')
+        .replace(/\.git$/, '');
+    const [owner, name, extra] = normalized.split('/');
+    if (!owner || !name || extra) {
+        throw new Error('Repository must be in owner/name form.');
+    }
+    return { owner, name };
+}
+function defaultRepoUrl(owner, name) {
+    return `https://github.com/${owner}/${name}`;
+}
+function normaliseOptionalString(value) {
+    const normalized = value?.trim();
+    return normalized || undefined;
+}
+function assertSha256Digest(value, field) {
+    if (!/^sha256:[a-fA-F0-9]{64}$/.test(value)) {
+        throw new Error(`${field} must be a sha256:<64 hex chars> digest.`);
+    }
+}
+function assertGitCommitSha(value, field) {
+    if (!/^[a-fA-F0-9]{40}$/.test(value)) {
+        throw new Error(`${field} must be a 40 character git commit SHA.`);
+    }
+}
+function buildSchemaProvenance(options) {
+    const schemaDigest = normaliseOptionalString(options.schemaDigest);
+    const validatorDigest = normaliseOptionalString(options.validatorDigest);
+    const templateVersion = normaliseOptionalString(options.templateVersion);
+    const baseTemplateSha = normaliseOptionalString(options.baseTemplateSha);
+    const approvedSourceSha = normaliseOptionalString(options.approvedSourceSha);
+    const approvedReleaseId = normaliseOptionalString(options.approvedRelease);
+    const hasAny = schemaDigest ||
+        validatorDigest ||
+        templateVersion ||
+        baseTemplateSha ||
+        approvedSourceSha ||
+        approvedReleaseId;
+    if (!hasAny)
+        return undefined;
+    if (!schemaDigest || !validatorDigest) {
+        throw new Error('Schema provenance requires --schema-digest and --validator-digest.');
+    }
+    if (!templateVersion) {
+        throw new Error('Schema provenance requires --template-version.');
+    }
+    if (!baseTemplateSha && !approvedSourceSha && !approvedReleaseId) {
+        throw new Error('Schema provenance requires --base-template-sha, --approved-source-sha, or --approved-release.');
+    }
+    assertSha256Digest(schemaDigest, '--schema-digest');
+    assertSha256Digest(validatorDigest, '--validator-digest');
+    if (baseTemplateSha)
+        assertGitCommitSha(baseTemplateSha, '--base-template-sha');
+    if (approvedSourceSha)
+        assertGitCommitSha(approvedSourceSha, '--approved-source-sha');
+    return {
+        templateVersion,
+        ...(baseTemplateSha ? { baseTemplateSha } : {}),
+        ...(approvedSourceSha ? { approvedSourceSha } : {}),
+        ...(approvedReleaseId ? { approvedReleaseId } : {}),
+        schemaDigest,
+        validatorDigest,
+    };
+}
+/**
+ * Build the PublicAPI payload used to store source-unknown app repo metadata.
+ */
+export function buildSourceUnknownRegistrationData(options) {
+    const repo = parseRepositorySlug(options.repo);
+    const defaultBranch = (options.branch || 'main').trim();
+    if (!defaultBranch) {
+        throw new Error('Default branch is required.');
+    }
+    const schemaProvenance = buildSchemaProvenance(options);
+    return {
+        repoOwner: repo.owner,
+        repoName: repo.name,
+        repoUrl: options.repoUrl?.trim() || defaultRepoUrl(repo.owner, repo.name),
+        defaultBranch,
+        workflowPath: options.workflow?.trim() || '.github/workflows/eai-app.yml',
+        ref: options.ref?.trim() || `refs/heads/${defaultBranch}`,
+        ...(options.commit?.trim() ? { commitSha: options.commit.trim() } : {}),
+        configPath: options.config?.trim() || 'src/eai.config/index.ts',
+        runtimePath: options.runtime?.trim() || DEFAULT_SOURCE_UNKNOWN_RUNTIME_PATH,
+        sourceMode: 'source-unknown',
+        ...(schemaProvenance ? { schemaProvenance } : {}),
+        validationSummary: {
+            status: 'registered_by_cli',
+            appValidated: !options.skipValidate,
+        },
+    };
+}
+export function buildSourceUnknownAdoptObservedData(options) {
+    const registration = buildSourceUnknownRegistrationData(options);
+    const activeUrl = options.url.trim();
+    const environment = (options.environment || 'production').trim();
+    if (!activeUrl) {
+        throw new Error('Observed app URL is required.');
+    }
+    try {
+        new URL(activeUrl);
+    }
+    catch {
+        throw new Error('Observed app URL must be an absolute URL.');
+    }
+    if (!environment) {
+        throw new Error('Observed environment is required.');
+    }
+    return {
+        ...registration,
+        adoptionMode: 'adopted-observed',
+        observedDeployment: {
+            environment,
+            activeUrl,
+            status: 'adopted_observed',
+            observedAt: options.observedAt?.trim() || new Date().toISOString(),
+            ...(options.deploymentId?.trim() ? { deploymentId: options.deploymentId.trim() } : {}),
+            ...(options.imageDigest?.trim() ? { imageDigest: options.imageDigest.trim() } : {}),
+            ...(options.configHash?.trim() ? { configHash: options.configHash.trim() } : {}),
+        },
+        validationSummary: {
+            status: 'adopted_observed_by_cli',
+            appValidated: !options.skipValidate,
+            destructiveOperationsBlocked: true,
+        },
+    };
+}
+export function buildSourceUnknownWorkflowSetupData(options) {
+    const environment = (options.environment || 'preview').trim();
+    if (!environment) {
+        throw new Error('Workflow setup environment is required.');
+    }
+    return {
+        environment,
+        workflowPath: options.workflow?.trim() || '.github/workflows/eai-app.yml',
+        ...(options.ref?.trim() ? { ref: options.ref.trim() } : {}),
+        ...(options.commit?.trim() ? { commitSha: options.commit.trim() } : {}),
+        ...(options.configHash?.trim() ? { configHash: options.configHash.trim() } : {}),
+    };
+}
+export function buildSourceUnknownWorkflowEvidenceData(options) {
+    const repo = parseRepositorySlug(options.repo);
+    const operationId = options.operationId?.trim();
+    const nonce = options.nonce?.trim();
+    const environment = (options.environment || 'preview').trim();
+    const defaultBranch = (options.branch || 'main').trim();
+    const workflowPath = options.workflow?.trim() || '.github/workflows/eai-app.yml';
+    const ref = options.ref?.trim() || `refs/heads/${defaultBranch}`;
+    const commitSha = options.commit?.trim();
+    const configHash = options.configHash?.trim();
+    const artifactDigest = options.artifactDigest?.trim();
+    const imageDigest = options.imageDigest?.trim();
+    if (!operationId)
+        throw new Error('Workflow evidence operation ID is required.');
+    if (!nonce)
+        throw new Error('Workflow evidence nonce is required.');
+    if (!environment)
+        throw new Error('Workflow evidence environment is required.');
+    if (!defaultBranch)
+        throw new Error('Default branch is required.');
+    if (!commitSha)
+        throw new Error('Workflow evidence commit SHA is required.');
+    if (!configHash)
+        throw new Error('Workflow evidence config hash is required.');
+    if (!artifactDigest)
+        throw new Error('Workflow evidence artifact digest is required.');
+    if (!imageDigest)
+        throw new Error('Workflow evidence image digest is required.');
+    assertSha256Digest(artifactDigest, '--artifact-digest');
+    assertSha256Digest(imageDigest, '--image-digest');
+    const schemaProvenance = buildSchemaProvenance(options);
+    if (!schemaProvenance) {
+        throw new Error('Workflow evidence requires schema provenance: provide --template-version, --schema-digest, --validator-digest, and an approved source anchor.');
+    }
+    const workflowRun = {};
+    if (options.workflowRunId?.trim())
+        workflowRun.id = options.workflowRunId.trim();
+    if (options.workflowRunAttempt?.trim()) {
+        const attempt = Number(options.workflowRunAttempt.trim());
+        workflowRun.attempt = Number.isFinite(attempt) ? attempt : options.workflowRunAttempt.trim();
+    }
+    return {
+        operationId,
+        nonce,
+        environment,
+        workflowPath,
+        ref,
+        commitSha,
+        configHash,
+        artifactDigest,
+        imageDigest,
+        schemaProvenance,
+        ...(Object.keys(workflowRun).length > 0 ? { workflowRun } : {}),
+        oidcClaims: {
+            repository: `${repo.owner}/${repo.name}`,
+            ref,
+            sha: commitSha,
+            workflow_ref: `${repo.owner}/${repo.name}/${workflowPath}@${ref}`,
+            ...(workflowRun.id ? { run_id: String(workflowRun.id) } : {}),
+            ...(workflowRun.attempt ? { run_attempt: String(workflowRun.attempt) } : {}),
+        },
+        validationSummary: {
+            status: 'passed_by_cli',
+            appValidated: !options.skipValidate,
+        },
+    };
+}
+export function buildSourceUnknownDeploymentData(options) {
+    const operationId = options.operationId?.trim();
+    const environment = (options.environment || 'preview').trim();
+    const repo = options.repo?.trim() ? parseRepositorySlug(options.repo) : undefined;
+    const workflowRunId = normaliseOptionalString(options.workflowRunId);
+    const artifactDigest = options.artifactDigest?.trim();
+    const imageDigest = options.imageDigest?.trim();
+    if (!operationId)
+        throw new Error('Deployment handoff operation ID is required.');
+    if (!environment)
+        throw new Error('Deployment handoff environment is required.');
+    if (artifactDigest)
+        assertSha256Digest(artifactDigest, '--artifact-digest');
+    if (imageDigest)
+        assertSha256Digest(imageDigest, '--image-digest');
+    const deploymentTarget = {};
+    const targetKind = normaliseOptionalString(options.targetKind);
+    const releaseChannel = normaliseOptionalString(options.releaseChannel);
+    if (targetKind)
+        deploymentTarget.kind = targetKind;
+    if (releaseChannel)
+        deploymentTarget.releaseChannel = releaseChannel;
+    return {
+        operationId,
+        environment,
+        ...(repo ? { repoOwner: repo.owner, repoName: repo.name } : {}),
+        ...(options.workflow?.trim() ? { workflowPath: options.workflow.trim() } : {}),
+        ...(options.ref?.trim() ? { ref: options.ref.trim() } : {}),
+        ...(options.commit?.trim() ? { commitSha: options.commit.trim() } : {}),
+        ...(workflowRunId ? { workflowRunId } : {}),
+        ...(options.configHash?.trim() ? { configHash: options.configHash.trim() } : {}),
+        ...(artifactDigest ? { artifactDigest } : {}),
+        ...(imageDigest ? { imageDigest } : {}),
+        ...(Object.keys(deploymentTarget).length > 0 ? { deploymentTarget } : {}),
+        validationSummary: {
+            status: 'deployment_requested_by_cli',
+            appValidated: !options.skipValidate,
+            requiresTenantInfra: true,
+        },
+    };
+}
+async function resolveGitHubOidcToken(options) {
+    const explicitToken = normaliseOptionalString(options.githubOidcToken);
+    if (explicitToken)
+        return explicitToken;
+    const envToken = normaliseOptionalString(process.env['GITHUB_ID_TOKEN']);
+    if (envToken)
+        return envToken;
+    const requestUrlEnvKey = ['ACTIONS', 'ID', 'TOKEN', 'REQUEST', 'URL'].join('_');
+    const requestTokenEnvKey = ['ACTIONS', 'ID', 'TOKEN', 'REQUEST', 'TOKEN'].join('_');
+    const requestUrl = normaliseOptionalString(process.env[requestUrlEnvKey]);
+    const requestToken = normaliseOptionalString(process.env[requestTokenEnvKey]);
+    if (!requestUrl || !requestToken) {
+        throw new Error('Workflow evidence requires --github-oidc-token or GitHub Actions OIDC request environment variables.');
+    }
+    const audience = normaliseOptionalString(options.githubOidcAudience) || DEFAULT_SOURCE_UNKNOWN_GITHUB_OIDC_AUDIENCE;
+    const separator = requestUrl.includes('?') ? '&' : '?';
+    const response = await fetch(`${requestUrl}${separator}audience=${encodeURIComponent(audience)}`, {
+        headers: { Authorization: `Bearer ${requestToken}` },
+    });
+    if (!response.ok) {
+        throw new Error(`GitHub OIDC token request failed: ${response.status} ${response.statusText}`);
+    }
+    const payload = await response.json();
+    if (!isRecord(payload) || typeof payload.value !== 'string' || !payload.value.trim()) {
+        throw new Error('GitHub OIDC token response did not include a token value.');
+    }
+    return payload.value.trim();
+}
 function extractDocs(payload) {
     if (!isRecord(payload))
         return [];
@@ -75,8 +360,8 @@ async function resolveAppManagementContext(options) {
         tenantId: context.activeTenant.id,
     };
 }
-async function validateVerticalEnrollment(verticalKey, ctx) {
-    const res = await ctx.client.listResources(VERTICAL_ENROLLMENT_TYPE, {
+async function validateVerticalEnrollment(verticalKey, client) {
+    const res = await client.listResources(VERTICAL_ENROLLMENT_TYPE, {
         limit: 1,
         where: { verticalKey },
     });
@@ -195,6 +480,411 @@ verticalCommand
         out.info(`App tenant: ${chalk.cyan(immediateParentTenantId)}`);
     }
 });
+verticalCommand
+    .command('connect-existing <key>')
+    .description('Register an existing app repository for managed deployment')
+    .requiredOption('--repo <owner/repo>', 'GitHub repository to connect')
+    .option('--tenant-id <id>', 'Run against a specific company tenant')
+    .option('--repo-url <url>', 'Repository URL when it differs from https://github.com/owner/repo')
+    .option('--branch <branch>', 'Default branch', 'main')
+    .option('--workflow <path>', 'GitHub Actions workflow path', '.github/workflows/eai-app.yml')
+    .option('--ref <ref>', 'Approved git ref (defaults to refs/heads/<branch>)')
+    .option('--commit <sha>', 'Current commit SHA to bind')
+    .option('--config <path>', 'eai.config path', 'src/eai.config/index.ts')
+    .option('--runtime <path>', 'eai.runtime path', DEFAULT_SOURCE_UNKNOWN_RUNTIME_PATH)
+    .option('--template-version <version>', 'Approved schema/template version')
+    .option('--base-template-sha <sha>', 'Base eai-app-template commit SHA when known')
+    .option('--approved-source-sha <sha>', 'Approved source commit SHA for non-template apps')
+    .option('--approved-release <id>', 'Approved schema/validator release identifier')
+    .option('--schema-digest <digest>', 'Approved schema digest in sha256:<hex> form')
+    .option('--validator-digest <digest>', 'Approved validator digest in sha256:<hex> form')
+    .option('--skip-validate', 'Skip app lookup', false)
+    .option('--format <format>', 'Output format (text|json)', 'text')
+    .option('--json', 'Output raw JSON (deprecated, use --format json)', false)
+    .action(async (key, options) => {
+    const ctx = await resolveAppManagementContext({ tenantId: options.tenantId, interactive: !options.tenantId });
+    const companyTenantId = options.tenantId
+        ? ctx.tenantId
+        : await resolveMainCompanyTenantId(ctx.publicApiUrl, ctx.tenantId);
+    const client = new PlatformAPIClient(ctx.publicApiUrl, companyTenantId);
+    const format = normalizeFormat(options);
+    const appKey = key.trim();
+    if (!appKey) {
+        fail('App key is required.');
+    }
+    let registration;
+    try {
+        registration = buildSourceUnknownRegistrationData(options);
+    }
+    catch (err) {
+        fail(errMsg(err));
+    }
+    if (!options.skipValidate) {
+        await validateVerticalEnrollment(appKey, client);
+    }
+    const spinner = makeSpinner(format, `Connecting ${appKey} to ${registration.repoOwner}/${registration.repoName}...`);
+    const res = await client.registerSourceUnknownApp(companyTenantId, appKey, registration);
+    const payload = await readResponsePayload(res);
+    if (!res.ok) {
+        spinner?.fail('Failed to connect existing app repository');
+        fail(isRecord(payload) && typeof payload.message === 'string' ? payload.message : `${res.status} ${res.statusText}`);
+    }
+    if (format === 'json') {
+        out.json({
+            tenantId: companyTenantId,
+            appKey,
+            sourceMode: 'source-unknown',
+            repository: {
+                owner: registration.repoOwner,
+                name: registration.repoName,
+                url: registration.repoUrl,
+            },
+            request: registration,
+            response: payload,
+        });
+        return;
+    }
+    spinner?.succeed(`Connected existing repository for ${chalk.cyan(appKey)}`);
+    out.info(`Repository: ${chalk.cyan(`${registration.repoOwner}/${registration.repoName}`)}`);
+    out.info(`Branch: ${chalk.cyan(String(registration.defaultBranch))} · Ref: ${chalk.dim(String(registration.ref))}`);
+    out.info(`Workflow: ${chalk.cyan(String(registration.workflowPath))}`);
+});
+verticalCommand
+    .command('adopt-observed <key>')
+    .description('Import an already-running app as read-only observed infrastructure')
+    .requiredOption('--repo <owner/repo>', 'GitHub repository to connect')
+    .requiredOption('--url <url>', 'Currently active observed app URL')
+    .option('--tenant-id <id>', 'Run against a specific company tenant')
+    .option('--repo-url <url>', 'Repository URL when it differs from https://github.com/owner/repo')
+    .option('--environment <environment>', 'Observed deployment environment', 'production')
+    .option('--branch <branch>', 'Default branch', 'main')
+    .option('--workflow <path>', 'GitHub Actions workflow path', '.github/workflows/eai-app.yml')
+    .option('--ref <ref>', 'Approved git ref (defaults to refs/heads/<branch>)')
+    .option('--commit <sha>', 'Current commit SHA to bind')
+    .option('--config <path>', 'eai.config path', 'src/eai.config/index.ts')
+    .option('--runtime <path>', 'eai.runtime path', DEFAULT_SOURCE_UNKNOWN_RUNTIME_PATH)
+    .option('--template-version <version>', 'Approved schema/template version')
+    .option('--base-template-sha <sha>', 'Base eai-app-template commit SHA when known')
+    .option('--approved-source-sha <sha>', 'Approved source commit SHA for non-template apps')
+    .option('--approved-release <id>', 'Approved schema/validator release identifier')
+    .option('--schema-digest <digest>', 'Approved schema digest in sha256:<hex> form')
+    .option('--validator-digest <digest>', 'Approved validator digest in sha256:<hex> form')
+    .option('--deployment-id <id>', 'Observed deployment identifier')
+    .option('--image-digest <digest>', 'Observed immutable image digest')
+    .option('--config-hash <hash>', 'Observed config hash')
+    .option('--observed-at <iso>', 'Observation timestamp')
+    .option('--skip-validate', 'Skip app lookup', false)
+    .option('--format <format>', 'Output format (text|json)', 'text')
+    .option('--json', 'Output raw JSON (deprecated, use --format json)', false)
+    .action(async (key, options) => {
+    const ctx = await resolveAppManagementContext({ tenantId: options.tenantId, interactive: !options.tenantId });
+    const companyTenantId = options.tenantId
+        ? ctx.tenantId
+        : await resolveMainCompanyTenantId(ctx.publicApiUrl, ctx.tenantId);
+    const client = new PlatformAPIClient(ctx.publicApiUrl, companyTenantId);
+    const format = normalizeFormat(options);
+    const appKey = key.trim();
+    if (!appKey) {
+        fail('App key is required.');
+    }
+    let registration;
+    try {
+        registration = buildSourceUnknownAdoptObservedData(options);
+    }
+    catch (err) {
+        fail(errMsg(err));
+    }
+    if (!options.skipValidate) {
+        await validateVerticalEnrollment(appKey, client);
+    }
+    const spinner = makeSpinner(format, `Adopting observed app ${appKey} from ${registration.repoOwner}/${registration.repoName}...`);
+    const res = await client.registerSourceUnknownApp(companyTenantId, appKey, registration);
+    const payload = await readResponsePayload(res);
+    if (!res.ok) {
+        spinner?.fail('Failed to adopt observed app');
+        fail(isRecord(payload) && typeof payload.message === 'string' ? payload.message : `${res.status} ${res.statusText}`);
+    }
+    if (format === 'json') {
+        out.json({
+            tenantId: companyTenantId,
+            appKey,
+            sourceMode: 'source-unknown',
+            adoptionMode: 'adopted-observed',
+            repository: {
+                owner: registration.repoOwner,
+                name: registration.repoName,
+                url: registration.repoUrl,
+            },
+            observedDeployment: registration.observedDeployment,
+            request: registration,
+            response: payload,
+        });
+        return;
+    }
+    spinner?.succeed(`Adopted observed app ${chalk.cyan(appKey)}`);
+    out.info(`Repository: ${chalk.cyan(`${registration.repoOwner}/${registration.repoName}`)}`);
+    out.info(`Observed URL: ${chalk.cyan(String(registration.observedDeployment?.activeUrl))}`);
+    out.info('Destructive operations remain blocked until a managed redeploy verifies control.');
+});
+verticalCommand
+    .command('workflow-setup <key>')
+    .description('Issue source-unknown workflow setup operation and nonce')
+    .option('--tenant-id <id>', 'Run against a specific company tenant')
+    .option('--environment <environment>', 'Deployment environment to bind', 'preview')
+    .option('--workflow <path>', 'GitHub Actions workflow path', '.github/workflows/eai-app.yml')
+    .option('--ref <ref>', 'Approved git ref')
+    .option('--commit <sha>', 'Current commit SHA to bind')
+    .option('--config-hash <hash>', 'Validated config hash to bind')
+    .option('--skip-validate', 'Skip app lookup', false)
+    .option('--format <format>', 'Output format (text|json)', 'text')
+    .option('--json', 'Output raw JSON (deprecated, use --format json)', false)
+    .action(async (key, options) => {
+    const ctx = await resolveAppManagementContext({ tenantId: options.tenantId, interactive: !options.tenantId });
+    const companyTenantId = options.tenantId
+        ? ctx.tenantId
+        : await resolveMainCompanyTenantId(ctx.publicApiUrl, ctx.tenantId);
+    const client = new PlatformAPIClient(ctx.publicApiUrl, companyTenantId);
+    const format = normalizeFormat(options);
+    const appKey = key.trim();
+    if (!appKey) {
+        fail('App key is required.');
+    }
+    let setupRequest;
+    try {
+        setupRequest = buildSourceUnknownWorkflowSetupData(options);
+    }
+    catch (err) {
+        fail(errMsg(err));
+    }
+    if (!options.skipValidate) {
+        await validateVerticalEnrollment(appKey, client);
+    }
+    const spinner = makeSpinner(format, `Issuing workflow setup for ${appKey}...`);
+    const res = await client.setupSourceUnknownWorkflow(companyTenantId, appKey, setupRequest);
+    const payload = await readResponsePayload(res);
+    if (!res.ok) {
+        spinner?.fail('Failed to issue source-unknown workflow setup');
+        fail(isRecord(payload) && typeof payload.message === 'string' ? payload.message : `${res.status} ${res.statusText}`);
+    }
+    if (format === 'json') {
+        out.json({
+            tenantId: companyTenantId,
+            appKey,
+            sourceMode: 'source-unknown',
+            request: setupRequest,
+            response: payload,
+        });
+        return;
+    }
+    spinner?.succeed(`Issued workflow setup for ${chalk.cyan(appKey)}`);
+    if (isRecord(payload)) {
+        const operationId = typeof payload.operationId === 'string' ? payload.operationId : '<unknown>';
+        const nonce = typeof payload.nonce === 'string' ? payload.nonce : '<returned in JSON response>';
+        const expiresAt = typeof payload.expiresAt === 'string' ? payload.expiresAt : '<unknown>';
+        const setup = isRecord(payload.setup) ? payload.setup : {};
+        const workflowPath = typeof setup.workflowPath === 'string' ? setup.workflowPath : setupRequest.workflowPath;
+        const evidencePath = typeof setup.publicApiEvidencePath === 'string' ? setup.publicApiEvidencePath : undefined;
+        out.info(`Operation: ${chalk.cyan(operationId)}`);
+        out.info(`Nonce: ${chalk.cyan(nonce)} ${chalk.dim('(displayed once)')}`);
+        out.info(`Expires: ${chalk.cyan(expiresAt)}`);
+        out.info(`Workflow: ${chalk.cyan(String(workflowPath))}`);
+        if (evidencePath) {
+            out.info(`Evidence endpoint: ${chalk.cyan(evidencePath)}`);
+        }
+    }
+});
+verticalCommand
+    .command('workflow-evidence <key>')
+    .description('Submit source-unknown workflow evidence for a setup operation')
+    .requiredOption('--repo <owner/repo>', 'GitHub repository submitting evidence')
+    .requiredOption('--operation-id <id>', 'Source-unknown workflow setup operation ID')
+    .requiredOption('--nonce <nonce>', 'One-time setup nonce')
+    .requiredOption('--commit <sha>', 'Workflow commit SHA')
+    .requiredOption('--config-hash <hash>', 'Validated config hash')
+    .requiredOption('--artifact-digest <digest>', 'Workflow artifact digest in sha256:<hex> form')
+    .requiredOption('--image-digest <digest>', 'Immutable image digest in sha256:<hex> form')
+    .option('--tenant-id <id>', 'Run against a specific company tenant')
+    .option('--environment <environment>', 'Deployment environment to bind', 'preview')
+    .option('--branch <branch>', 'Default branch', 'main')
+    .option('--workflow <path>', 'GitHub Actions workflow path', '.github/workflows/eai-app.yml')
+    .option('--ref <ref>', 'Approved git ref (defaults to refs/heads/<branch>)')
+    .option('--template-version <version>', 'Approved schema/template version')
+    .option('--base-template-sha <sha>', 'Base eai-app-template commit SHA when known')
+    .option('--approved-source-sha <sha>', 'Approved source commit SHA for non-template apps')
+    .option('--approved-release <id>', 'Approved schema/validator release identifier')
+    .option('--schema-digest <digest>', 'Approved schema digest in sha256:<hex> form')
+    .option('--validator-digest <digest>', 'Approved validator digest in sha256:<hex> form')
+    .option('--workflow-run-id <id>', 'GitHub Actions run ID')
+    .option('--workflow-run-attempt <n>', 'GitHub Actions run attempt')
+    .option('--github-oidc-token <token>', 'GitHub Actions OIDC token for workflow evidence submission')
+    .option('--github-oidc-audience <audience>', 'GitHub Actions OIDC audience', DEFAULT_SOURCE_UNKNOWN_GITHUB_OIDC_AUDIENCE)
+    .option('--skip-validate', 'Skip app lookup', false)
+    .option('--format <format>', 'Output format (text|json)', 'text')
+    .option('--json', 'Output raw JSON (deprecated, use --format json)', false)
+    .action(async (key, options) => {
+    const ctx = await resolveAppManagementContext({ tenantId: options.tenantId, interactive: !options.tenantId });
+    const companyTenantId = options.tenantId
+        ? ctx.tenantId
+        : await resolveMainCompanyTenantId(ctx.publicApiUrl, ctx.tenantId);
+    const client = new PlatformAPIClient(ctx.publicApiUrl, companyTenantId);
+    const format = normalizeFormat(options);
+    const appKey = key.trim();
+    if (!appKey) {
+        fail('App key is required.');
+    }
+    let evidenceRequest;
+    try {
+        evidenceRequest = buildSourceUnknownWorkflowEvidenceData(options);
+    }
+    catch (err) {
+        fail(errMsg(err));
+    }
+    if (!options.skipValidate) {
+        await validateVerticalEnrollment(appKey, client);
+    }
+    let githubOidcToken;
+    try {
+        githubOidcToken = await resolveGitHubOidcToken(options);
+    }
+    catch (err) {
+        fail(errMsg(err));
+    }
+    const spinner = makeSpinner(format, `Submitting workflow evidence for ${appKey}...`);
+    const res = await client.submitSourceUnknownWorkflowEvidence(companyTenantId, appKey, evidenceRequest, githubOidcToken);
+    const payload = await readResponsePayload(res);
+    if (!res.ok) {
+        spinner?.fail('Failed to submit source-unknown workflow evidence');
+        fail(isRecord(payload) && typeof payload.message === 'string' ? payload.message : `${res.status} ${res.statusText}`);
+    }
+    if (format === 'json') {
+        out.json({
+            tenantId: companyTenantId,
+            appKey,
+            sourceMode: 'source-unknown',
+            request: evidenceRequest,
+            response: payload,
+        });
+        return;
+    }
+    spinner?.succeed(`Submitted workflow evidence for ${chalk.cyan(appKey)}`);
+    out.info(`Operation: ${chalk.cyan(evidenceRequest.operationId)}`);
+    out.info(`Artifact: ${chalk.cyan(evidenceRequest.artifactDigest)}`);
+    out.info(`Image: ${chalk.cyan(evidenceRequest.imageDigest)}`);
+});
+verticalCommand
+    .command('deploy-source-unknown <key>')
+    .description('Request a TenantInfra deployment handoff for a source-unknown app')
+    .requiredOption('--operation-id <id>', 'Accepted source-unknown workflow evidence operation ID')
+    .option('--tenant-id <id>', 'Run against a specific company tenant')
+    .option('--environment <environment>', 'Deployment environment to bind', 'preview')
+    .option('--repo <owner/name>', 'GitHub repository that produced the deployment evidence')
+    .option('--workflow <path>', 'GitHub Actions workflow path')
+    .option('--ref <ref>', 'Approved git ref')
+    .option('--commit <sha>', 'Workflow commit SHA')
+    .option('--workflow-run-id <id>', 'GitHub Actions workflow run ID')
+    .option('--config-hash <hash>', 'Validated config hash')
+    .option('--artifact-digest <digest>', 'Workflow artifact digest in sha256:<hex> form')
+    .option('--image-digest <digest>', 'Immutable image digest in sha256:<hex> form')
+    .option('--target-kind <kind>', 'Deployment backend target kind', 'tenantinfra')
+    .option('--release-channel <channel>', 'Release channel to request', 'preview')
+    .option('--skip-validate', 'Skip app lookup', false)
+    .option('--format <format>', 'Output format (text|json)', 'text')
+    .option('--json', 'Output raw JSON (deprecated, use --format json)', false)
+    .action(async (key, options) => {
+    const ctx = await resolveAppManagementContext({ tenantId: options.tenantId, interactive: !options.tenantId });
+    const companyTenantId = options.tenantId
+        ? ctx.tenantId
+        : await resolveMainCompanyTenantId(ctx.publicApiUrl, ctx.tenantId);
+    const client = new PlatformAPIClient(ctx.publicApiUrl, companyTenantId);
+    const format = normalizeFormat(options);
+    const appKey = key.trim();
+    if (!appKey) {
+        fail('App key is required.');
+    }
+    let deploymentRequest;
+    try {
+        deploymentRequest = buildSourceUnknownDeploymentData(options);
+    }
+    catch (err) {
+        fail(errMsg(err));
+    }
+    if (!options.skipValidate) {
+        await validateVerticalEnrollment(appKey, client);
+    }
+    const spinner = makeSpinner(format, `Requesting source-unknown deployment handoff for ${appKey}...`);
+    const res = await client.requestSourceUnknownDeployment(companyTenantId, appKey, deploymentRequest);
+    const payload = await readResponsePayload(res);
+    if (!res.ok) {
+        spinner?.fail('Failed to request source-unknown deployment handoff');
+        fail(isRecord(payload) && typeof payload.message === 'string' ? payload.message : `${res.status} ${res.statusText}`);
+    }
+    if (format === 'json') {
+        out.json({
+            tenantId: companyTenantId,
+            appKey,
+            sourceMode: 'source-unknown',
+            request: deploymentRequest,
+            response: payload,
+        });
+        return;
+    }
+    spinner?.succeed(`Recorded deployment handoff for ${chalk.cyan(appKey)}`);
+    if (isRecord(payload)) {
+        const status = typeof payload.status === 'string' ? payload.status : 'unknown';
+        const requestId = typeof payload.deploymentRequestId === 'string' ? payload.deploymentRequestId : '<unknown>';
+        const requiresTenantInfra = payload.requiresTenantInfra === true ? 'required' : 'not required';
+        out.info(`Status: ${chalk.cyan(status)}`);
+        out.info(`Request: ${chalk.cyan(requestId)}`);
+        out.info(`TenantInfra: ${chalk.cyan(requiresTenantInfra)}`);
+    }
+});
+verticalCommand
+    .command('deploy-source-unknown-status <key>')
+    .description('Read the latest source-unknown deployment handoff status')
+    .option('--tenant-id <id>', 'Run against a specific company tenant')
+    .option('--skip-validate', 'Skip app lookup', false)
+    .option('--format <format>', 'Output format (text|json)', 'text')
+    .option('--json', 'Output raw JSON (deprecated, use --format json)', false)
+    .action(async (key, options) => {
+    const ctx = await resolveAppManagementContext({ tenantId: options.tenantId, interactive: !options.tenantId });
+    const companyTenantId = options.tenantId
+        ? ctx.tenantId
+        : await resolveMainCompanyTenantId(ctx.publicApiUrl, ctx.tenantId);
+    const client = new PlatformAPIClient(ctx.publicApiUrl, companyTenantId);
+    const format = normalizeFormat(options);
+    const appKey = key.trim();
+    if (!appKey) {
+        fail('App key is required.');
+    }
+    if (!options.skipValidate) {
+        await validateVerticalEnrollment(appKey, client);
+    }
+    const spinner = makeSpinner(format, `Reading source-unknown deployment handoff status for ${appKey}...`);
+    const res = await client.getLatestSourceUnknownDeployment(companyTenantId, appKey);
+    const payload = await readResponsePayload(res);
+    if (!res.ok) {
+        spinner?.fail('Failed to read source-unknown deployment handoff status');
+        fail(isRecord(payload) && typeof payload.message === 'string' ? payload.message : `${res.status} ${res.statusText}`);
+    }
+    if (format === 'json') {
+        out.json({
+            tenantId: companyTenantId,
+            appKey,
+            sourceMode: 'source-unknown',
+            response: payload,
+        });
+        return;
+    }
+    spinner?.succeed(`Read deployment handoff status for ${chalk.cyan(appKey)}`);
+    if (isRecord(payload)) {
+        const status = typeof payload.status === 'string' ? payload.status : 'unknown';
+        const requestId = typeof payload.deploymentRequestId === 'string' ? payload.deploymentRequestId : '<none>';
+        const requiresTenantInfra = payload.requiresTenantInfra === true ? 'required' : 'not required';
+        out.info(`Status: ${chalk.cyan(status)}`);
+        out.info(`Request: ${chalk.cyan(requestId)}`);
+        out.info(`TenantInfra: ${chalk.cyan(requiresTenantInfra)}`);
+    }
+});
 verticalCommand
     .command('select <key>')
     .description('Set EAI_APP_KEY in the current project .env.local')
@@ -210,7 +900,7 @@ verticalCommand
         fail('App key is required.');
     }
     if (!options.skipValidate) {
-        await validateVerticalEnrollment(verticalKey, ctx);
+        await validateVerticalEnrollment(verticalKey, ctx.client);
     }
     await patchEnvFile(ctx.root, {
         [APP_KEY_ENV]: verticalKey,
@@ -247,7 +937,7 @@ verticalCommand
         fail('App key is required.');
     }
     if (!options.skipValidate) {
-        await validateVerticalEnrollment(verticalKey, ctx);
+        await validateVerticalEnrollment(verticalKey, ctx.client);
     }
     const spinner = makeSpinner(format, options.dryRun
         ? `Planning app storage readiness for ${verticalKey}...`