@epilot/cli 0.1.81 → 0.1.83

package/README.md

@@ -29,7 +29,7 @@ npm install -g @epilot/cli
 
 <!-- usage-help -->
 ```
-epilot v0.1.81 — CLI for epilot APIs
+epilot v0.1.83 — CLI for epilot APIs
 
 USAGE
   epilot <api> <operationId> [params...] [flags]

package/definitions/blueprint-manifest.json

@@ -1105,6 +1105,136 @@
         }
       }
     },
+    "/v2/blueprint-manifest/blueprints/{blueprint_id}/notes": {
+      "post": {
+        "operationId": "addBlueprintNote",
+        "summary": "addBlueprintNote",
+        "description": "Append an internal note to a blueprint. `id`, `created_at` and `created_by`\nare stamped server-side from the caller, so notes cannot be backdated or\nattributed to someone else. Existing notes are never modified.\n",
+        "tags": [
+          "Blueprints"
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "required": true,
+            "name": "blueprint_id",
+            "schema": {
+              "$ref": "#/components/schemas/BlueprintID"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "text"
+                ],
+                "properties": {
+                  "text": {
+                    "type": "string",
+                    "description": "Plain-text note body. Must not be blank.",
+                    "minLength": 1
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "The created note",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/BlueprintNote"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Blank note text",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v2/blueprint-manifest/blueprints/{blueprint_id}/notes/{note_id}": {
+      "delete": {
+        "operationId": "deleteBlueprintNote",
+        "summary": "deleteBlueprintNote",
+        "description": "Remove a single internal note from a blueprint.",
+        "tags": [
+          "Blueprints"
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "required": true,
+            "name": "blueprint_id",
+            "schema": {
+              "$ref": "#/components/schemas/BlueprintID"
+            }
+          },
+          {
+            "in": "path",
+            "required": true,
+            "name": "note_id",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The blueprint's remaining notes",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "notes": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/BlueprintNote"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Blueprint or note not found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/v2/blueprint-manifest/blueprints/{blueprint_id}/validate": {
       "post": {
         "operationId": "validateBlueprint",
@@ -1208,7 +1338,11 @@
                     "description": "Auth token with access to the destination org. Required for cross-org verification when the caller token only has access to the source org. If not provided, the caller's bearer token is used for both orgs."
                   },
                   "installation_job_id": {
-                    "$ref": "#/components/schemas/BlueprintJobID",
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/BlueprintJobID"
+                      }
+                    ],
                     "description": "Optional install job this verification is checking. If omitted, the latest destination blueprint installation job is used when available."
                   },
                   "sync_engine": {
@@ -2944,6 +3078,63 @@
         }
       }
     },
+    "/v3/blueprint-manifest/blueprints:pre-install": {
+      "post": {
+        "operationId": "preInstallBlueprintV3",
+        "summary": "Preview a V3 blueprint package before installation",
+        "description": "Validates a signed V3 package and returns the destination-specific resource plan used by the install UI.",
+        "tags": [
+          "Blueprints"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": [
+                  "blueprint_file"
+                ],
+                "properties": {
+                  "blueprint_file": {
+                    "type": "string",
+                    "description": "S3 key of a V3 blueprint package previously uploaded through uploadManifest"
+                  },
+                  "source_blueprint_type": {
+                    "type": "string",
+                    "enum": [
+                      "marketplace"
+                    ]
+                  },
+                  "slug": {
+                    "type": "string",
+                    "description": "Marketplace slug to preserve across updates"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Destination-specific V3 blueprint preview",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/BlueprintPreview"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid request or unsupported V3 package"
+          },
+          "404": {
+            "description": "Blueprint package not found"
+          }
+        }
+      }
+    },
     "/v3/blueprint-manifest/blueprint:install": {
       "post": {
         "operationId": "installBlueprintV3",
@@ -2994,6 +3185,12 @@
                     "type": "string",
                     "description": "Auth token for the destination org. Required for cross-org installs where the caller's token belongs to the source org. Defaults to the caller's bearer token."
                   },
+                  "source_blueprint_type": {
+                    "type": "string",
+                    "enum": [
+                      "marketplace"
+                    ]
+                  },
                   "options": {
                     "$ref": "#/components/schemas/BlueprintInstallationJobOptions"
                   },
@@ -3012,7 +3209,9 @@
                 "sameOrgPlanThenContinue": {
                   "summary": "Same-org install, manual approval (default)",
                   "value": {
-                    "source_blueprint_id": "11111111-1111-1111-1111-111111111111"
+                    "source_org_id": "source-org-id",
+                    "source_blueprint_id": "11111111-1111-1111-1111-111111111111",
+                    "destination_org_id": "source-org-id"
                   }
                 },
                 "crossOrgAutoApply": {
@@ -3186,6 +3385,121 @@
         }
       }
     },
+    "/v3/blueprint-manifest/blueprints/{blueprint_id}/deployments/{job_id}:health-check": {
+      "post": {
+        "operationId": "triggerDeploymentHealthCheckV3",
+        "summary": "Run a health check on a deployment",
+        "description": "Starts a read-only health scan of the resources this deployment's\nblueprint instance tracks in the destination org (see\ndocs/rfcs/RFC-org-health-check.md, Phase 0). Checks:\n\n  - live readability — every lineage-tracked resource is read back\n    via its adapter; tracked-but-unreadable resources are flagged.\n  - referential integrity — destination payloads containing\n    unreplaced source-org ids, or references to tracked resources\n    that are not readable.\n  - install completeness — install operations whose final attempt\n    ended `failed` or `skipped`, with their rejection reasons.\n\nAsync — returns 202 immediately with a `running` report stub. Poll\nthe health-report endpoint until `status` is `completed` or\n`failed`. Never mutates any resource.\n",
+        "tags": [
+          "Blueprints"
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "blueprint_id",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/BlueprintID"
+            }
+          },
+          {
+            "in": "path",
+            "name": "job_id",
+            "required": true,
+            "description": "The install job whose deployment is being checked.",
+            "schema": {
+              "$ref": "#/components/schemas/BlueprintJobID"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "source_org_id": {
+                    "type": "string",
+                    "description": "Source/sandbox org to deep-compare entity mappings against."
+                  },
+                  "source_auth_token": {
+                    "type": "string",
+                    "description": "Read token for the source org. Never persisted; used only for this scan."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "202": {
+            "description": "Health check started",
+            "headers": {
+              "Location": {
+                "description": "URL to poll the health report",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeploymentHealthReport"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Blueprint not found, or no deployment with the given job_id on this blueprint."
+          }
+        }
+      }
+    },
+    "/v3/blueprint-manifest/blueprints/{blueprint_id}/deployments/{job_id}/health-report": {
+      "get": {
+        "operationId": "getDeploymentHealthReportV3",
+        "summary": "Get the latest health report of a deployment",
+        "description": "Returns the most recent health report produced for this deployment\nby the `:health-check` endpoint. Idempotent and side-effect free.\n",
+        "tags": [
+          "Blueprints"
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "name": "blueprint_id",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/BlueprintID"
+            }
+          },
+          {
+            "in": "path",
+            "name": "job_id",
+            "required": true,
+            "schema": {
+              "$ref": "#/components/schemas/BlueprintJobID"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Latest health report",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeploymentHealthReport"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "No health report exists for this deployment yet."
+          }
+        }
+      }
+    },
     "/v3/blueprint-manifest/blueprints/{blueprint_id}/lineage": {
       "get": {
         "operationId": "getBlueprintLineageV3",
@@ -3874,6 +4188,34 @@
           }
         ]
       },
+      "BlueprintNote": {
+        "type": "object",
+        "description": "A single internal note on a blueprint.",
+        "required": [
+          "id",
+          "text",
+          "created_at"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "description": "Server-generated note id.",
+            "example": "3f1c9b0e-2f3a-4a1f-9a3e-6f2b8c7d1e40"
+          },
+          "text": {
+            "type": "string",
+            "description": "Plain-text note body.",
+            "example": "Adjusted the meter-reading journey for the §14a rollout."
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "created_by": {
+            "$ref": "#/components/schemas/CallerIdentity"
+          }
+        }
+      },
       "BlueprintID": {
         "type": "string",
         "description": "ID of a blueprint",
@@ -3911,6 +4253,13 @@
               }
             }
           },
+          "notes": {
+            "type": "array",
+            "description": "Internal collaboration notes, oldest first. Append-only: each entry is\nstamped with its author and creation time server-side and is never\nrewritten, so the history of who noted what stays intact. Written via\n`addBlueprintNote` / `deleteBlueprintNote`, not by `updateBlueprint`.\n\nAvailable on every blueprint including marketplace ones (whose\n`description` is read-only), and never included in the published\nmarketplace package — see `buildMetadata` in\n`services/blueprint-v3/published-blueprint.ts`. Carried to a\ndestination org only when an install/sync passes\n`options.sync_notes: true`.\n",
+            "items": {
+              "$ref": "#/components/schemas/BlueprintNote"
+            }
+          },
           "version": {
             "type": "string"
           },
@@ -5108,6 +5457,344 @@
           }
         }
       },
+      "HealthFinding": {
+        "type": "object",
+        "required": [
+          "check_id",
+          "code",
+          "severity",
+          "resource_type",
+          "lineage_id",
+          "message"
+        ],
+        "properties": {
+          "check_id": {
+            "type": "string",
+            "enum": [
+              "live_readability",
+              "referential_integrity",
+              "install_completeness",
+              "schema_consistency",
+              "mapping_integrity",
+              "execution_readiness",
+              "catalog_hygiene",
+              "spec_conformance"
+            ]
+          },
+          "code": {
+            "type": "string",
+            "enum": [
+              "missing_in_destination",
+              "fetch_error",
+              "no_readback",
+              "unreplaced_source_reference",
+              "broken_internal_reference",
+              "dropped_at_install",
+              "orphaned_group_reference",
+              "uuid_group_label",
+              "unreachable_attribute_purpose",
+              "duplicate_attribute_name",
+              "duplicate_headline",
+              "broken_mapping_reference",
+              "stale_mapping_version",
+              "mapping_slot_mismatch",
+              "mapping_parity_mismatch",
+              "stale_lineage",
+              "broken_trigger_reference",
+              "broken_action_reference",
+              "broken_workflow_step",
+              "invalid_mapping_target",
+              "invalid_mapping_source",
+              "invalid_mapping_version",
+              "unknown_mapping_attribute",
+              "workflow_edge_limit",
+              "dead_purpose_reference",
+              "broken_portal_reference",
+              "orphaned_portal_block",
+              "broken_closing_reason",
+              "broken_journey_settings",
+              "unresolved_assignee",
+              "current_write_invalid",
+              "duplicate_live_resource",
+              "missing_file_content",
+              "file_etag_mismatch",
+              "incomplete_webhook",
+              "broken_template_reference",
+              "orphaned_price",
+              "duplicate_price",
+              "inactive_price_in_use",
+              "cross_org_reference"
+            ]
+          },
+          "severity": {
+            "type": "string",
+            "enum": [
+              "error",
+              "warning",
+              "info"
+            ]
+          },
+          "resource_type": {
+            "type": "string"
+          },
+          "lineage_id": {
+            "type": "string"
+          },
+          "target_id": {
+            "type": "string"
+          },
+          "resource_name": {
+            "type": "string",
+            "description": "Human-readable name of the affected resource"
+          },
+          "message": {
+            "type": "string"
+          },
+          "verdict": {
+            "type": "string",
+            "description": "Mechanical root-cause classification and suggested fix, when determinable"
+          },
+          "evidence": {
+            "type": "object",
+            "description": "Check-specific evidence, e.g. the JSON path and referenced id of a broken reference.",
+            "properties": {
+              "path": {
+                "type": "string"
+              },
+              "referenced_id": {
+                "type": "string"
+              },
+              "referenced_type": {
+                "type": "string"
+              },
+              "referenced_name": {
+                "type": "string",
+                "description": "Human-readable name or logical slug of the referenced source resource"
+              },
+              "referenced_lineage_id": {
+                "type": "string",
+                "description": "Logical source lineage identity of the referenced resource"
+              },
+              "expected_target_id": {
+                "type": "string",
+                "description": "Destination id that should have replaced the source reference"
+              },
+              "reference_kind": {
+                "type": "string",
+                "description": "Human-readable description of the exact field carrying the reference"
+              },
+              "operation": {
+                "type": "string"
+              },
+              "rejection_reason": {
+                "type": "string"
+              },
+              "error_message": {
+                "type": "string"
+              },
+              "response_status": {
+                "type": "integer"
+              }
+            }
+          }
+        }
+      },
+      "HealthCheckCoverage": {
+        "type": "object",
+        "required": [
+          "check_id",
+          "status",
+          "scope",
+          "resources_considered",
+          "details"
+        ],
+        "properties": {
+          "check_id": {
+            "type": "string",
+            "enum": [
+              "live_readability",
+              "referential_integrity",
+              "install_completeness",
+              "schema_consistency",
+              "mapping_integrity",
+              "execution_readiness",
+              "spec_conformance"
+            ]
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "completed",
+              "partial",
+              "skipped",
+              "not_applicable"
+            ]
+          },
+          "scope": {
+            "type": "string",
+            "enum": [
+              "tracked_resources",
+              "org_wide",
+              "source_comparison"
+            ]
+          },
+          "resources_considered": {
+            "type": "integer"
+          },
+          "details": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "HealthResourceTypeCoverage": {
+        "type": "object",
+        "required": [
+          "resource_type",
+          "tracked",
+          "readable_by_lineage",
+          "missing_by_lineage",
+          "read_errors",
+          "unchecked",
+          "specialized_checks",
+          "known_blind_spots"
+        ],
+        "properties": {
+          "resource_type": {
+            "type": "string"
+          },
+          "tracked": {
+            "type": "integer"
+          },
+          "readable_by_lineage": {
+            "type": "integer"
+          },
+          "missing_by_lineage": {
+            "type": "integer"
+          },
+          "read_errors": {
+            "type": "integer"
+          },
+          "unchecked": {
+            "type": "integer"
+          },
+          "specialized_checks": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "live_readability",
+                "referential_integrity",
+                "install_completeness",
+                "schema_consistency",
+                "mapping_integrity",
+                "execution_readiness",
+                "spec_conformance"
+              ]
+            }
+          },
+          "known_blind_spots": {
+            "type": "array",
+            "description": "Type-specific contracts the current scanner explicitly does not claim to validate.",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "HealthScanCoverage": {
+        "type": "object",
+        "required": [
+          "checks",
+          "resource_types"
+        ],
+        "properties": {
+          "checks": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/HealthCheckCoverage"
+            }
+          },
+          "resource_types": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/HealthResourceTypeCoverage"
+            }
+          }
+        }
+      },
+      "DeploymentHealthReport": {
+        "type": "object",
+        "required": [
+          "status",
+          "job_id",
+          "blueprint_instance_id",
+          "destination_org_id",
+          "generated_at"
+        ],
+        "properties": {
+          "status": {
+            "type": "string",
+            "enum": [
+              "running",
+              "completed",
+              "failed"
+            ]
+          },
+          "job_id": {
+            "$ref": "#/components/schemas/BlueprintJobID"
+          },
+          "blueprint_instance_id": {
+            "$ref": "#/components/schemas/BlueprintID"
+          },
+          "destination_org_id": {
+            "type": "string"
+          },
+          "generated_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "html_url": {
+            "type": "string",
+            "description": "Presigned link to the rendered HTML report (present once the check completed)"
+          },
+          "summary": {
+            "type": "object",
+            "properties": {
+              "resources_scanned": {
+                "type": "integer"
+              },
+              "unchecked": {
+                "type": "integer"
+              },
+              "errors": {
+                "type": "integer"
+              },
+              "warnings": {
+                "type": "integer"
+              },
+              "infos": {
+                "type": "integer"
+              }
+            }
+          },
+          "findings": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/HealthFinding"
+            }
+          },
+          "coverage": {
+            "$ref": "#/components/schemas/HealthScanCoverage"
+          },
+          "error": {
+            "type": "string",
+            "description": "Failure reason when status is `failed`."
+          }
+        }
+      },
       "RestoreOutcome": {
         "type": "object",
         "properties": {
@@ -5258,7 +5945,11 @@
                 "$ref": "#/components/schemas/BlueprintID"
               },
               "installation_job_id": {
-                "$ref": "#/components/schemas/BlueprintJobID",
+                "allOf": [
+                  {
+                    "$ref": "#/components/schemas/BlueprintJobID"
+                  }
+                ],
                 "description": "Install job this verification is checking, when known."
               },
               "sync_engine": {
@@ -5497,6 +6188,11 @@
             "items": {
               "type": "string"
             }
+          },
+          "sync_notes": {
+            "description": "When `true`, the source blueprint's `notes` overwrite the destination\nblueprint's `notes`. Defaults to `false`, which leaves the\ndestination's notes untouched.\n",
+            "type": "boolean",
+            "default": false
           }
         }
       },

package/dist/{add-component-IVVCAUGY.js → add-component-CJIQYDO5.js}

@@ -3,7 +3,7 @@ import {
   log,
   readManifest,
   writeManifest
-} from "./chunk-4TDAAJ6H.js";
+} from "./chunk-QOD77YLW.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import "./chunk-7ZQ666ZQ.js";

package/dist/app-TIWZ2LQC.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+
+// src/commands/app/index.ts
+import { defineCommand } from "citty";
+var app_default = defineCommand({
+  meta: {
+    name: "app",
+    description: "Manage epilot Apps \u2014 create, deploy, and manage app manifests"
+  },
+  subCommands: {
+    init: () => import("./init-345HGB5B.js").then((m) => m.default),
+    "add-component": () => import("./add-component-CJIQYDO5.js").then((m) => m.default),
+    "remove-component": () => import("./remove-component-LPTHVN4P.js").then((m) => m.default),
+    validate: () => import("./validate-TLSOTJAY.js").then((m) => m.default),
+    deploy: () => import("./deploy-NRQHZ635.js").then((m) => m.default),
+    export: () => import("./export-ZRDJCALM.js").then((m) => m.default),
+    versions: () => import("./versions-VA4H3EPK.js").then((m) => m.default),
+    review: () => import("./review-OZTM3XBD.js").then((m) => m.default),
+    api: () => import("./api-5W2UMWCW.js").then((m) => m.default)
+  }
+});
+export {
+  app_default as default
+};

package/dist/bin/epilot.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   API_LIST
-} from "../chunk-SKN3M7X4.js";
+} from "../chunk-5D7GCYYX.js";
 
 // bin/epilot.ts
 import { runMain } from "citty";
@@ -11,7 +11,7 @@ import { defineCommand } from "citty";
 var main = defineCommand({
   meta: {
     name: "epilot",
-    version: "0.1.81",
+    version: "0.1.83",
     description: "CLI for epilot APIs"
   },
   args: {
@@ -30,13 +30,13 @@ var main = defineCommand({
     auth: () => import("../auth-4HG7B2GC.js").then((m) => m.default),
     profile: () => import("../profile-OZJL5ZPT.js").then((m) => m.default),
     config: () => import("../config-DGZIMLZK.js").then((m) => m.default),
-    completion: () => import("../completion-GMGHDDM3.js").then((m) => m.default),
-    upgrade: () => import("../upgrade-YMDNCJ6J.js").then((m) => m.default),
+    completion: () => import("../completion-N6A4VCAE.js").then((m) => m.default),
+    upgrade: () => import("../upgrade-5RN2XG2M.js").then((m) => m.default),
     "access-token": () => import("../access-token-WWE6BDJH.js").then((m) => m.default),
     address: () => import("../address-EH3C4CVB.js").then((m) => m.default),
     "address-suggestions": () => import("../address-suggestions-RRSLOBFW.js").then((m) => m.default),
     "ai-agents": () => import("../ai-agents-53M2KHPI.js").then((m) => m.default),
-    app: () => import("../app-EULJIEDB.js").then((m) => m.default),
+    app: () => import("../app-TIWZ2LQC.js").then((m) => m.default),
     "audit-logs": () => import("../audit-logs-YFRK3EFU.js").then((m) => m.default),
     automation: () => import("../automation-4DEE3TUI.js").then((m) => m.default),
     billing: () => import("../billing-XX4VVOPI.js").then((m) => m.default),
@@ -134,13 +134,13 @@ process.stderr.on("error", (err) => {
   if (err.code === "EPIPE") process.exit(0);
   throw err;
 });
-var VERSION = true ? "0.1.81" : (await null).default.version;
+var VERSION = true ? "0.1.83" : (await null).default.version;
 var reorderedArgv = hoistFlagsAfterSubcommand(process.argv.slice(2));
 process.argv = [process.argv[0], process.argv[1], ...reorderedArgv];
 var args = process.argv.slice(2);
 var completionsIdx = args.indexOf("--_completions");
 if (completionsIdx >= 0) {
-  const { handleCompletions } = await import("../completion-GMGHDDM3.js");
+  const { handleCompletions } = await import("../completion-N6A4VCAE.js");
   handleCompletions(args[completionsIdx + 1], args[completionsIdx + 2]);
   process.exit(0);
 }

package/dist/{chunk-SKN3M7X4.js → chunk-5D7GCYYX.js}

@@ -169,7 +169,7 @@ var API_LIST = [
     kebabName: "blueprint-manifest",
     title: "Blueprint Manifest API",
     serverUrl: "https://blueprint-manifest.sls.epilot.io",
-    operationCount: 66,
+    operationCount: 71,
     operationIds: [
       "getJob",
       "createExport",
@@ -190,6 +190,8 @@ var API_LIST = [
       "getBlueprint",
       "updateBlueprint",
       "deleteBlueprint",
+      "addBlueprintNote",
+      "deleteBlueprintNote",
       "validateBlueprint",
       "verifyBlueprint",
       "detectPatchChanges",
@@ -225,9 +227,12 @@ var API_LIST = [
       "updateMarketplaceListingVersion",
       "publishMarketplaceListingVersion",
       "publishBlueprintV3",
+      "preInstallBlueprintV3",
       "installBlueprintV3",
       "restoreBlueprintDeploymentV3",
       "getRestorePreview",
+      "triggerDeploymentHealthCheckV3",
+      "getDeploymentHealthReportV3",
       "getBlueprintLineageV3",
       "createBulkInstallV3",
       "getBulkInstallV3",

package/dist/{chunk-4TDAAJ6H.js → chunk-QOD77YLW.js}

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 import {
+  loadCredentials,
   resolveToken
 } from "./chunk-M3M3C5WH.js";
+import {
+  getResolvedProfile
+} from "./chunk-YHQA2AVG.js";
 import {
   BOLD,
   DIM,
@@ -121,6 +125,33 @@ async function request(baseUrl, token, method, path, body) {
   }
   return text;
 }
+var parseJwtPayload = (token) => {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = Buffer.from(parts[1], "base64url").toString("utf-8");
+    return JSON.parse(payload);
+  } catch {
+    return null;
+  }
+};
+function resolveOrgId(tokenFlag, profile) {
+  const token = resolveToken(tokenFlag, profile);
+  const claims = token ? parseJwtPayload(token) : null;
+  const fromToken = claims?.org_id ?? claims?.["custom:ivy_org_id"];
+  if (fromToken) return fromToken;
+  return getResolvedProfile(profile)?.org_id ?? loadCredentials()?.org_id;
+}
+function derivePermissionsBaseUrl(appBaseUrl) {
+  try {
+    const url = new URL(appBaseUrl);
+    if (!url.hostname.startsWith("app.")) return null;
+    url.hostname = url.hostname.replace(/^app\./, "permissions.");
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
 function createAppApiClient(opts) {
   const baseUrl = opts.server ?? DEFAULT_BASE_URL;
   const getToken = () => {
@@ -150,6 +181,28 @@ function createAppApiClient(opts) {
     async patchVersion(appId, version, payload) {
       await request(baseUrl, getToken(), "PATCH", `/v1/app-configurations/${appId}/versions/${version}`, payload);
     },
+    /**
+     * Upsert the app's role in the developer's own organization with the
+     * manifest grants. The role id is attached to the app version via
+     * `role_id`; on installation the App API creates a copy of it (from the
+     * version's grants) in the installer's organization.
+     */
+    async upsertAppRole(params) {
+      const permissionsBaseUrl = derivePermissionsBaseUrl(baseUrl);
+      if (!permissionsBaseUrl) {
+        throw new Error(`Cannot derive permissions API URL from ${baseUrl}`);
+      }
+      const roleId = `${params.orgId}:${params.appId}`;
+      await request(permissionsBaseUrl, getToken(), "PUT", `/v1/permissions/roles/${roleId}`, {
+        id: roleId,
+        organization_id: params.orgId,
+        type: "user_role",
+        slug: params.appId,
+        name: `Automatically created by App ${params.appName}`,
+        grants: params.grants
+      });
+      return roleId;
+    },
     async cloneVersion(appId, version) {
       return request(
         baseUrl,
@@ -358,6 +411,7 @@ export {
   validateManifest,
   readManifest,
   writeManifest,
+  resolveOrgId,
   createAppApiClient,
   uploadFileToPresignedUrl,
   uploadDirectoryAsZip,

package/dist/{completion-GMGHDDM3.js → completion-N6A4VCAE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   API_LIST
-} from "./chunk-SKN3M7X4.js";
+} from "./chunk-5D7GCYYX.js";
 import {
   DIM,
   GREEN,

package/dist/{deploy-JMJFXUKQ.js → deploy-NRQHZ635.js}

@@ -4,10 +4,11 @@ import {
   formatFileSize,
   log,
   readManifest,
+  resolveOrgId,
   uploadDirectoryAsZip,
   uploadFileToPresignedUrl,
   writeManifest
-} from "./chunk-4TDAAJ6H.js";
+} from "./chunk-QOD77YLW.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import "./chunk-7ZQ666ZQ.js";
@@ -106,10 +107,32 @@ var deploy_default = defineCommand({
     }
     if (manifest.permissions?.length || manifest.blueprint?.manifest_id) {
       if (dryRun) {
+        if (manifest.permissions?.length) {
+          log.info("[dry-run] Would upsert app role in developer org");
+        }
         log.info("[dry-run] Would update version permissions/blueprint");
       } else {
+        let roleId;
+        if (manifest.permissions?.length) {
+          const orgId = resolveOrgId(args.token, args.profile);
+          if (orgId) {
+            try {
+              roleId = await client.upsertAppRole({
+                orgId,
+                appId,
+                appName: manifest.name,
+                grants: manifest.permissions
+              });
+              log.success(`Upserted app role ${roleId}`);
+            } catch (err) {
+              log.warn(`Could not upsert app role: ${err.message}`);
+            }
+          } else {
+            log.warn("Could not resolve org id \u2014 attaching grants without a developer-org role");
+          }
+        }
         await client.patchVersion(appId, targetVersion, {
-          ...manifest.permissions?.length ? { grants: manifest.permissions } : {},
+          ...manifest.permissions?.length ? { grants: manifest.permissions, ...roleId ? { role_id: roleId } : {} } : {},
           ...manifest.blueprint?.manifest_id ? { manifest_id: manifest.blueprint.manifest_id } : {}
         });
         log.success(`Updated version ${targetVersion} (permissions/blueprint)`);

package/dist/{export-JDDMBBNS.js → export-ZRDJCALM.js}

@@ -4,7 +4,7 @@ import {
   log,
   toManifest,
   writeManifest
-} from "./chunk-4TDAAJ6H.js";
+} from "./chunk-QOD77YLW.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import "./chunk-7ZQ666ZQ.js";

package/dist/{init-QZTZF2JC.js → init-345HGB5B.js}

@@ -2,7 +2,7 @@
 import {
   log,
   writeManifest
-} from "./chunk-4TDAAJ6H.js";
+} from "./chunk-QOD77YLW.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import "./chunk-7ZQ666ZQ.js";

package/dist/{remove-component-HJA5OA3H.js → remove-component-LPTHVN4P.js}

@@ -3,7 +3,7 @@ import {
   log,
   readManifest,
   writeManifest
-} from "./chunk-4TDAAJ6H.js";
+} from "./chunk-QOD77YLW.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import "./chunk-7ZQ666ZQ.js";

package/dist/{review-7M27IRW6.js → review-OZTM3XBD.js}

@@ -3,7 +3,7 @@ import {
   createAppApiClient,
   log,
   readManifest
-} from "./chunk-4TDAAJ6H.js";
+} from "./chunk-QOD77YLW.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import "./chunk-7ZQ666ZQ.js";

package/dist/{upgrade-YMDNCJ6J.js → upgrade-5RN2XG2M.js}

@@ -72,7 +72,7 @@ ${GREEN}${BOLD}Upgraded to @epilot/cli@${latest}${RESET}
   }
 });
 var getCurrentVersion = () => {
-  if (true) return "0.1.81";
+  if (true) return "0.1.83";
   try {
     const output = execSync("npm ls -g @epilot/cli --depth=0 --json 2>/dev/null", {
       encoding: "utf-8",

package/dist/{validate-QUSO4DR4.js → validate-TLSOTJAY.js}

@@ -2,7 +2,7 @@
 import {
   log,
   validateManifest
-} from "./chunk-4TDAAJ6H.js";
+} from "./chunk-QOD77YLW.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import "./chunk-7ZQ666ZQ.js";

package/dist/{versions-EUTT4SNW.js → versions-VA4H3EPK.js}

@@ -3,7 +3,7 @@ import {
   createAppApiClient,
   log,
   readManifest
-} from "./chunk-4TDAAJ6H.js";
+} from "./chunk-QOD77YLW.js";
 import "./chunk-M3M3C5WH.js";
 import "./chunk-YHQA2AVG.js";
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epilot/cli",
-  "version": "0.1.81",
+  "version": "0.1.83",
   "description": "CLI for epilot APIs",
   "type": "module",
   "bin": {

package/dist/app-EULJIEDB.js

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-
-// src/commands/app/index.ts
-import { defineCommand } from "citty";
-var app_default = defineCommand({
-  meta: {
-    name: "app",
-    description: "Manage epilot Apps \u2014 create, deploy, and manage app manifests"
-  },
-  subCommands: {
-    init: () => import("./init-QZTZF2JC.js").then((m) => m.default),
-    "add-component": () => import("./add-component-IVVCAUGY.js").then((m) => m.default),
-    "remove-component": () => import("./remove-component-HJA5OA3H.js").then((m) => m.default),
-    validate: () => import("./validate-QUSO4DR4.js").then((m) => m.default),
-    deploy: () => import("./deploy-JMJFXUKQ.js").then((m) => m.default),
-    export: () => import("./export-JDDMBBNS.js").then((m) => m.default),
-    versions: () => import("./versions-EUTT4SNW.js").then((m) => m.default),
-    review: () => import("./review-7M27IRW6.js").then((m) => m.default),
-    api: () => import("./api-5W2UMWCW.js").then((m) => m.default)
-  }
-});
-export {
-  app_default as default
-};