@eve-horizon/cli 0.2.0 → 0.2.5

package/dist/commands/manifest.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleManifest = handleManifest;
+const args_1 = require("../lib/args");
+const client_1 = require("../lib/client");
+const output_1 = require("../lib/output");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+async function handleManifest(subcommand, positionals, flags, context) {
+    const json = Boolean(flags.json);
+    switch (subcommand) {
+        case 'validate': {
+            const useLatest = (0, args_1.toBoolean)(flags.latest) ?? false;
+            const strict = (0, args_1.toBoolean)(flags.strict) ?? false;
+            const validateSecretsFlag = flags['validate-secrets'] ?? flags.validate_secrets;
+            const validateSecrets = (0, args_1.toBoolean)(validateSecretsFlag) ?? false;
+            const dir = typeof flags.dir === 'string' ? flags.dir : process.cwd();
+            const manifestPath = (0, args_1.getStringFlag)(flags, ['path']) ?? (0, node_path_1.join)(dir, '.eve', 'manifest.yaml');
+            let manifestYaml;
+            if (!useLatest) {
+                try {
+                    manifestYaml = (0, node_fs_1.readFileSync)(manifestPath, 'utf-8');
+                }
+                catch (error) {
+                    throw new Error(`Failed to read manifest at ${manifestPath}: ${error.message}`);
+                }
+            }
+            let projectId = (0, args_1.getStringFlag)(flags, ['project']) ?? context.projectId;
+            if (!projectId && manifestYaml) {
+                const match = manifestYaml.match(/^project:\s*(\S+)/m);
+                if (match) {
+                    projectId = match[1];
+                }
+            }
+            if (!projectId) {
+                throw new Error('Missing project id. Provide --project, set a profile default, or add "project: proj_xxx" to manifest.');
+            }
+            const response = await (0, client_1.requestJson)(context, `/projects/${projectId}/manifest/validate`, {
+                method: 'POST',
+                body: {
+                    manifest_yaml: manifestYaml,
+                    validate_secrets: validateSecrets || strict,
+                    strict,
+                },
+            });
+            if (json) {
+                (0, output_1.outputJson)(response, json);
+            }
+            else {
+                if (response.valid) {
+                    console.log('✓ Manifest valid');
+                }
+                else {
+                    console.log('✗ Manifest invalid');
+                }
+                if (response.manifest_hash) {
+                    console.log(`  Hash: ${response.manifest_hash.substring(0, 12)}...`);
+                }
+                if (response.errors && response.errors.length > 0) {
+                    console.log('');
+                    console.log('Errors:');
+                    response.errors.forEach((error) => console.log(`  - ${error}`));
+                }
+                if (response.warnings && response.warnings.length > 0) {
+                    console.log('');
+                    console.log('Warnings:');
+                    response.warnings.forEach((warning) => console.log(`  - ${warning}`));
+                }
+                if (response.secret_validation?.missing?.length) {
+                    console.log('');
+                    console.log('Missing secrets:');
+                    response.secret_validation.missing.forEach((item) => {
+                        const hint = item.hints?.[0] ? ` (${item.hints[0]})` : '';
+                        console.log(`  - ${item.key}${hint}`);
+                    });
+                }
+            }
+            if (!response.valid) {
+                process.exitCode = 1;
+            }
+            return;
+        }
+        default:
+            throw new Error('Usage: eve manifest <validate>');
+    }
+}

package/dist/commands/org.js

@@ -12,6 +12,7 @@ async function handleOrg(subcommand, positionals, flags, context) {
         case 'ensure': {
             let orgId = typeof flags.id === 'string' ? flags.id : '';
             let orgName = typeof flags.name === 'string' ? flags.name : '';
+            let orgSlug = typeof flags.slug === 'string' ? flags.slug : '';
             const nameOrId = positionals[0];
             if (!orgId && nameOrId) {
                 if (/^org_[a-zA-Z0-9]+$/.test(nameOrId)) {
@@ -25,7 +26,7 @@ async function handleOrg(subcommand, positionals, flags, context) {
             }
             orgId = orgId || context.orgId || DEFAULT_ORG_ID;
             orgName = orgName || DEFAULT_ORG_NAME;
-            const body = { id: orgId, name: orgName };
+            const body = { id: orgId, name: orgName, ...(orgSlug ? { slug: orgSlug } : {}) };
             const org = await (0, client_1.requestJson)(context, '/orgs/ensure', {
                 method: 'POST',
                 body,

package/dist/commands/profile.js

@@ -126,8 +126,9 @@ function handleProfile(subcommand, positionals, flags, config) {
                 config.profiles[name] = {};
             }
             config.profiles[name] = applyProfileFlags(config.profiles[name], flags);
+            config.active_profile = name;
             (0, config_1.saveConfig)(config);
-            (0, output_1.outputJson)({ name, ...config.profiles[name] }, json, `✓ Profile updated: ${name}`);
+            (0, output_1.outputJson)({ active_profile: name, ...config.profiles[name] }, json, `✓ Profile set: ${name}`);
             return;
         }
         case 'remove': {

package/dist/commands/system.js

@@ -34,8 +34,10 @@ async function handleSystem(subcommand, positionals, flags, context) {
             return handleConfig(context, json);
         case 'settings':
             return handleSettings(positionals, flags, context, json);
+        case 'orchestrator':
+            return handleOrchestrator(positionals, flags, context, json);
         default:
-            throw new Error('Usage: eve system <status|health|jobs|envs|logs|pods|events|config|settings>');
+            throw new Error('Usage: eve system <status|health|jobs|envs|logs|pods|events|config|settings|orchestrator>');
     }
 }
 // ============================================================================
@@ -61,10 +63,10 @@ async function handleStatus(context, json) {
         }
     }
     catch (error) {
-        // If /system/status doesn't exist yet, fall back to basic health check
+        // If /system/status is missing, fall back to basic health check
         const err = error;
         if (err.message?.includes('HTTP 404')) {
-            console.log('Note: Full system status endpoint not yet implemented.');
+            console.log('Note: /system/status not available on this API version.');
             console.log('Falling back to basic health check...');
             console.log('');
             return handleHealth(context, json);
@@ -318,6 +320,47 @@ async function handleConfig(context, json) {
         response.deployments.forEach((deployment) => console.log(`    - ${deployment}`));
     }
 }
+/**
+ * eve system orchestrator <status|set-concurrency>
+ * Manage orchestrator concurrency settings
+ */
+async function handleOrchestrator(positionals, flags, context, json) {
+    const subcommand = positionals[0];
+    if (subcommand === 'status') {
+        const response = await requestOrchestratorJson(context, '/system/orchestrator/status');
+        if (json) {
+            (0, output_1.outputJson)(response, json);
+        }
+        else {
+            formatOrchestratorStatus(response);
+        }
+        return;
+    }
+    if (subcommand === 'set-concurrency') {
+        const limitStr = positionals[1];
+        if (!limitStr) {
+            throw new Error('Usage: eve system orchestrator set-concurrency <n>');
+        }
+        const limit = parseInt(limitStr, 10);
+        if (isNaN(limit) || limit < 1) {
+            throw new Error('Concurrency limit must be a positive integer');
+        }
+        const response = await requestOrchestratorJson(context, '/system/orchestrator/concurrency', {
+            method: 'POST',
+            body: JSON.stringify({ limit }),
+        });
+        if (json) {
+            (0, output_1.outputJson)(response, json);
+        }
+        else {
+            console.log(`Concurrency limit updated to ${limit}`);
+            console.log('');
+            formatOrchestratorStatus(response);
+        }
+        return;
+    }
+    throw new Error('Usage: eve system orchestrator <status|set-concurrency>');
+}
 /**
  * eve system settings [get <key>] [set <key> <value>]
  * Admin only: Get or set system settings
@@ -526,3 +569,81 @@ function padRight(str, width) {
         return str;
     return str + ' '.repeat(width - str.length);
 }
+/**
+ * Get orchestrator URL from context.
+ * Derives from API URL by replacing the port with the orchestrator port.
+ */
+function getOrchestratorUrl(context) {
+    const envUrl = process.env.EVE_ORCHESTRATOR_URL;
+    if (envUrl) {
+        return envUrl;
+    }
+    // Derive from API URL by changing the port
+    const orchPort = process.env.EVE_ORCHESTRATOR_PORT || '4802';
+    const apiUrl = new URL(context.apiUrl);
+    apiUrl.port = orchPort;
+    return apiUrl.toString().replace(/\/$/, '');
+}
+/**
+ * Request JSON from the orchestrator service.
+ * Similar to requestJson but targets the orchestrator directly.
+ */
+async function requestOrchestratorJson(context, path, options) {
+    const orchUrl = getOrchestratorUrl(context);
+    const url = `${orchUrl}${path}`;
+    const headers = {};
+    if (options?.body) {
+        headers['Content-Type'] = 'application/json';
+    }
+    if (context.token) {
+        headers.Authorization = `Bearer ${context.token}`;
+    }
+    const response = await fetch(url, {
+        method: options?.method ?? 'GET',
+        headers,
+        body: options?.body,
+    });
+    const text = await response.text();
+    let data = null;
+    if (text) {
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            data = text;
+        }
+    }
+    if (!response.ok) {
+        const message = typeof data === 'string' ? data : text;
+        throw new Error(`HTTP ${response.status}: ${message}`);
+    }
+    return data;
+}
+/**
+ * Format orchestrator status for human-readable output
+ */
+function formatOrchestratorStatus(status) {
+    console.log('Orchestrator Concurrency Status');
+    console.log('═══════════════════════════════════════');
+    console.log('');
+    console.log(`  Limit:          ${status.limit}`);
+    console.log(`  In-Flight:      ${status.inFlight}`);
+    console.log(`  Uptime:         ${formatUptime(status.uptimeSeconds)}`);
+    console.log(`  Last Change:    ${status.lastChange}`);
+    console.log('');
+}
+/**
+ * Format uptime seconds to human-readable format
+ */
+function formatUptime(seconds) {
+    const hours = Math.floor(seconds / 3600);
+    const minutes = Math.floor((seconds % 3600) / 60);
+    const secs = seconds % 60;
+    if (hours > 0) {
+        return `${hours}h ${minutes}m ${secs}s`;
+    }
+    if (minutes > 0) {
+        return `${minutes}m ${secs}s`;
+    }
+    return `${secs}s`;
+}

package/dist/index.js

@@ -24,6 +24,8 @@ const admin_1 = require("./commands/admin");
 const agents_1 = require("./commands/agents");
 const init_1 = require("./commands/init");
 const release_1 = require("./commands/release");
+const manifest_1 = require("./commands/manifest");
+const build_1 = require("./commands/build");
 async function main() {
     const { flags, positionals } = (0, args_1.parseArgs)(process.argv.slice(2));
     const command = positionals[0];
@@ -107,6 +109,12 @@ async function main() {
         case 'release':
             await (0, release_1.handleRelease)(subcommand, rest, flags, context);
             return;
+        case 'manifest':
+            await (0, manifest_1.handleManifest)(subcommand, rest, flags, context);
+            return;
+        case 'build':
+            await (0, build_1.handleBuild)(subcommand, rest, flags, context);
+            return;
         default:
             (0, help_1.showMainHelp)();
     }

package/dist/lib/help.js

@@ -106,6 +106,28 @@ exports.HELP = {
             },
         },
     },
+    manifest: {
+        description: 'Validate project manifests for schema and required secrets.',
+        usage: 'eve manifest <subcommand> [options]',
+        subcommands: {
+            validate: {
+                description: 'Validate a manifest (schema + secrets)',
+                usage: 'eve manifest validate [--project <id>] [--path <path>] [--latest]',
+                options: [
+                    '--project <id>       Project ID (uses profile default)',
+                    '--path <path>        Path to manifest (default: .eve/manifest.yaml)',
+                    '--latest             Validate latest synced manifest instead of local file',
+                    '--validate-secrets   Validate required secrets (from manifest)',
+                    '--strict             Fail validation if required secrets are missing',
+                ],
+                examples: [
+                    'eve manifest validate',
+                    'eve manifest validate --project proj_xxx',
+                    'eve manifest validate --latest --project proj_xxx',
+                ],
+            },
+        },
+    },
     secrets: {
         description: 'Manage secrets at system/org/user/project scope. Values are never returned in plaintext.',
         usage: 'eve secrets <subcommand> [options]',
@@ -576,7 +598,7 @@ have to specify them on every command. Useful when working with multiple environ
     auth: {
         description: `Authenticate with Eve Horizon. Auth is optional for local development but required
 for cloud deployments. Credentials are stored per-profile.`,
-        usage: 'eve auth <login|logout|status|whoami|bootstrap|sync|token>',
+        usage: 'eve auth <login|logout|status|whoami|bootstrap|sync|creds|token|mint>',
         subcommands: {
             login: {
                 description: 'Login via GitHub SSH challenge (default) or Supabase (legacy)',
@@ -621,6 +643,23 @@ for cloud deployments. Credentials are stored per-profile.`,
                     'eve auth token  # Share with reviewers for PR preview access',
                 ],
             },
+            mint: {
+                description: 'Mint a user token (admin-only, no SSH login required)',
+                usage: 'eve auth mint --email <email> [--org <org_id> | --project <project_id>] [--role <role>] [--ttl <days>]',
+                options: [
+                    '--email <email>     Target user email (created if missing)',
+                    '--org <org_id>      Org scope for membership and permission checks',
+                    '--project <id>      Project scope for membership and permission checks',
+                    '--role <role>       Role to assign (member|admin), default member',
+                    '--ttl <days>        Token TTL in days (1-90, default: server configured)',
+                ],
+                examples: [
+                    'eve auth mint --email app-bot@example.com --org org_xxx',
+                    'eve auth mint --email app-bot@example.com --project proj_xxx',
+                    'eve auth mint --email app-bot@example.com --project proj_xxx --role admin',
+                    'eve auth mint --email bot@example.com --org org_xxx --ttl 90',
+                ],
+            },
             bootstrap: {
                 description: 'Bootstrap the first admin user with flexible security modes',
                 usage: 'eve auth bootstrap --email <email> [--token <token>] [options]',
@@ -647,18 +686,35 @@ for cloud deployments. Credentials are stored per-profile.`,
             },
             sync: {
                 description: 'Extract OAuth tokens from host and set as Eve secrets',
-                usage: 'eve auth sync [--claude] [--codex] [--project <id>] [--system] [--dry-run]',
+                usage: 'eve auth sync [--claude] [--codex] [--org <id>] [--project <id>] [--dry-run]',
                 options: [
                     '--claude           Only extract Claude/Anthropic tokens',
                     '--codex            Only extract Codex/OpenAI tokens',
-                    '--project <id>     Project to set secrets on (uses profile default)',
-                    '--system           Set as system secrets instead of project secrets',
+                    '--org <id>         Set as org-level secrets',
+                    '--project <id>     Set as project-level secrets',
                     '--dry-run          Show what would be set without actually setting',
+                    '',
+                    'Scope priority: --project > --org > user (default)',
+                    'Default scope is user-level, so credentials are available to all your jobs.',
                 ],
                 examples: [
-                    'eve auth sync',
-                    'eve auth sync --claude --dry-run',
-                    'eve auth sync --project proj_xxx',
+                    'eve auth sync                    # Sync to user-level (default)',
+                    'eve auth sync --org org_xxx      # Sync to org-level',
+                    'eve auth sync --project proj_xxx # Sync to project-level',
+                    'eve auth sync --dry-run          # Preview without syncing',
+                ],
+            },
+            creds: {
+                description: 'Show local AI tool credentials (Claude Code, Codex/Code) without syncing',
+                usage: 'eve auth creds [--claude] [--codex]',
+                options: [
+                    '--claude           Only check Claude/Anthropic credentials',
+                    '--codex            Only check Codex/OpenAI credentials',
+                ],
+                examples: [
+                    'eve auth creds',
+                    'eve auth creds --claude',
+                    'eve auth creds --json',
                 ],
             },
         },
@@ -697,19 +753,36 @@ for cloud deployments. Credentials are stored per-profile.`,
             },
             deploy: {
                 description: 'Deploy to an environment',
-                usage: 'eve env deploy <env> --ref <sha> [--direct] [--inputs <json>] [--project <id>]',
+                usage: 'eve env deploy <env> --ref <sha> [--direct] [--inputs <json>] [--image-tag <tag>] [--project <id>]',
                 options: [
                     '<env>                  Environment name (staging, production, test)',
                     '--ref <sha>            Git SHA or commit reference (required)',
                     '--direct               Bypass pipeline and do direct deploy',
                     '--inputs <json>        JSON inputs for the deployment (e.g., \'{"release_id":"rel_xxx"}\')',
+                    '--image-tag <tag>      Use a specific image tag for deploy (direct only)',
                     '--project <id>         Project ID or slug (uses profile default if omitted)',
+                    '--watch                Poll deployment status until ready (default: true)',
+                    '--timeout <seconds>    Watch timeout in seconds (default: 120)',
                 ],
                 examples: [
                     'eve env deploy staging --ref abc123',
                     'eve env deploy staging --ref abc123 --direct',
                     'eve env deploy staging --ref abc123 --inputs \'{"release_id":"rel_xxx","smoke_test":false}\'',
                     'eve env deploy staging --ref abc123 --direct --inputs \'{"release_id":"rel_xxx"}\'',
+                    'eve env deploy staging --ref abc123 --direct --image-tag demo-abc123',
+                ],
+            },
+            diagnose: {
+                description: 'Diagnose environment deployments (k8s-only)',
+                usage: 'eve env diagnose <project> <env> [--events <n>]',
+                options: [
+                    '<project>             Project ID or slug',
+                    '<env>                 Environment name',
+                    '--events <n>          Limit number of recent events',
+                ],
+                examples: [
+                    'eve env diagnose proj_xxx staging',
+                    'eve env diagnose proj_xxx staging --events 20',
                 ],
             },
             logs: {
@@ -748,6 +821,7 @@ for cloud deployments. Credentials are stored per-profile.`,
             'eve env create test --type=persistent',
             'eve env deploy staging --ref abc123',
             'eve env logs proj_xxx staging api --tail 200',
+            'eve env diagnose proj_xxx staging',
         ],
     },
     api: {
@@ -1036,6 +1110,105 @@ for cloud deployments. Credentials are stored per-profile.`,
             'eve release resolve v1.2.3 --json',
         ],
     },
+    build: {
+        description: 'Manage builds. Builds are first-class primitives for container image creation (specs, runs, artifacts).',
+        usage: 'eve build <subcommand> [options]',
+        subcommands: {
+            create: {
+                description: 'Create a new build spec',
+                usage: 'eve build create --project <id> --ref <sha> --manifest-hash <hash> [--services <s1,s2>]',
+                options: [
+                    '--project <id>       Project ID (uses profile default)',
+                    '--ref <sha>          Git SHA or commit reference (required)',
+                    '--manifest-hash <h>  Manifest hash (required)',
+                    '--services <list>    Comma-separated service names to build',
+                ],
+                examples: [
+                    'eve build create --ref abc123 --manifest-hash mfst_123',
+                    'eve build create --project proj_xxx --ref abc123 --manifest-hash mfst_123 --services api,web',
+                ],
+            },
+            list: {
+                description: 'List build specs for a project',
+                usage: 'eve build list [--project <id>] [--limit <n>] [--offset <n>]',
+                options: [
+                    '--project <id>       Project ID (uses profile default)',
+                    '--limit <n>          Number of results',
+                    '--offset <n>         Skip first n results',
+                ],
+                examples: [
+                    'eve build list',
+                    'eve build list --project proj_xxx --limit 20',
+                ],
+            },
+            show: {
+                description: 'Show build spec details',
+                usage: 'eve build show <build_id>',
+                examples: [
+                    'eve build show build_xxx',
+                ],
+            },
+            run: {
+                description: 'Start a build run for an existing build spec',
+                usage: 'eve build run <build_id>',
+                examples: [
+                    'eve build run build_xxx',
+                ],
+            },
+            runs: {
+                description: 'List runs for a build spec',
+                usage: 'eve build runs <build_id> [--limit <n>]',
+                options: [
+                    '--limit <n>          Number of results',
+                    '--offset <n>         Skip first n results',
+                ],
+                examples: [
+                    'eve build runs build_xxx',
+                ],
+            },
+            logs: {
+                description: 'Show build logs',
+                usage: 'eve build logs <build_id> [--run <run_id>]',
+                options: [
+                    '--run <id>           Specific run ID (default: latest)',
+                ],
+                examples: [
+                    'eve build logs build_xxx',
+                    'eve build logs build_xxx --run brun_yyy',
+                ],
+            },
+            artifacts: {
+                description: 'List build artifacts (images produced)',
+                usage: 'eve build artifacts <build_id>',
+                examples: [
+                    'eve build artifacts build_xxx',
+                ],
+            },
+            diagnose: {
+                description: 'Show full build state (spec, runs, artifacts, logs)',
+                usage: 'eve build diagnose <build_id>',
+                examples: [
+                    'eve build diagnose build_xxx',
+                ],
+            },
+            cancel: {
+                description: 'Cancel an active build run',
+                usage: 'eve build cancel <build_id>',
+                examples: [
+                    'eve build cancel build_xxx',
+                ],
+            },
+        },
+        examples: [
+            'eve build create --ref abc123 --manifest-hash mfst_123 --services api,web',
+            'eve build list',
+            'eve build show build_xxx',
+            'eve build run build_xxx',
+            'eve build logs build_xxx',
+            'eve build artifacts build_xxx',
+            'eve build diagnose build_xxx',
+        ],
+    },
     init: {
         description: `Initialize a new Eve Horizon project from a template.
 
@@ -1141,6 +1314,31 @@ eve-new-project-setup skill to complete configuration.`,
                 usage: 'eve system config',
                 examples: ['eve system config'],
             },
+            settings: {
+                description: 'Get or set system settings (admin only)',
+                usage: 'eve system settings [get <key>] [set <key> <value>]',
+                options: [
+                    'get <key>            Get specific setting',
+                    'set <key> <value>    Update setting value',
+                ],
+                examples: [
+                    'eve system settings',
+                    'eve system settings get some-key',
+                    'eve system settings set some-key some-value',
+                ],
+            },
+            orchestrator: {
+                description: 'Manage orchestrator concurrency settings',
+                usage: 'eve system orchestrator <status|set-concurrency>',
+                options: [
+                    'status                           Show concurrency status',
+                    'set-concurrency <n>              Set concurrency limit',
+                ],
+                examples: [
+                    'eve system orchestrator status',
+                    'eve system orchestrator set-concurrency 8',
+                ],
+            },
         },
         examples: [
             'eve system health',
@@ -1148,6 +1346,7 @@ eve-new-project-setup skill to complete configuration.`,
             'eve system jobs',
             'eve system envs',
             'eve system logs api',
+            'eve system orchestrator status',
         ],
     },
 };
@@ -1162,8 +1361,10 @@ function showMainHelp() {
     console.log('Commands:');
     console.log('  org        Manage organizations');
     console.log('  project    Manage projects');
+    console.log('  manifest   Validate manifests (schema, secrets)');
     console.log('  job        Manage jobs (create, list, show, update, claim, etc.)');
     console.log('  env        Manage environments (list, show, deploy)');
+    console.log('  build      Manage builds (create, run, logs, artifacts)');
     console.log('  release    Manage and inspect releases');
     console.log('  api        Explore API sources and call endpoints');
     console.log('  db         Inspect env DB schema, RLS, and SQL');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eve-horizon/cli",
-  "version": "0.2.0",
+  "version": "0.2.5",
   "description": "Eve Horizon CLI",
   "license": "MIT",
   "repository": {