@fulldivevr/workcord-cli 2.17.0 → 3.0.1

package/dist/commands/hermes.js

@@ -1,649 +0,0 @@
-import { Option } from "commander";
-import { randomUUID } from "node:crypto";
-import { readFile, stat, writeFile } from "node:fs/promises";
-import { Writable } from "node:stream";
-import { actingUserId, resolveHermesKey } from "../auth.js";
-import { hermesBinary, hermesCall, hermesStream, hermesUpload } from "../hermes-client.js";
-import { assertArchiveSize, flavorSetWarnings, guardOwnership, rolloutBody, } from "../hermes-guards.js";
-import { getOrCreateGroup } from "./_group.js";
-export function agentRef(opts) {
-    const refs = [opts.agent, opts.roomAgent, opts.marketplaceInstall].filter(Boolean);
-    if (refs.length !== 1) {
-        throw new Error("Pass exactly one of --agent <id>, --room-agent <id>, or --marketplace-install <id>.");
-    }
-    if (opts.roomAgent)
-        return `workcord-room-agent:${opts.roomAgent}`;
-    if (opts.marketplaceInstall)
-        return `marketplace-install:${opts.marketplaceInstall}`;
-    return opts.agent;
-}
-function agentFlags(cmd) {
-    return cmd
-        .option("--agent <id>", "custom agent id")
-        .option("--room-agent <id>", "room agent id (resolved as workcord-room-agent:<id>)")
-        .option("--marketplace-install <id>", "marketplace flavor install id or its room agent id")
-        .option("--refresh", "re-reveal the tenant key instead of using the cached one")
-        .option("--no-cache", "do not read or write the local tenant-key cache");
-}
-function jsonOption(cmd, name, description) {
-    return cmd.option(`--${name} <json>`, description);
-}
-function parseJson(raw, flag) {
-    if (raw === undefined)
-        return undefined;
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        throw new Error(`${flag} must be valid JSON`);
-    }
-}
-function out(data) {
-    process.stdout.write(JSON.stringify(data) + "\n");
-}
-export function hermesChatTextBody(text) {
-    return { parts: [{ type: "text", text }] };
-}
-async function credentials(program, opts) {
-    return resolveHermesKey(agentRef(opts), {
-        refresh: opts.refresh,
-        cache: opts.cache,
-        asUserId: actingUserId(program),
-    });
-}
-function tenantPath(creds, suffix) {
-    if (!creds.tenantId) {
-        throw new Error("No tenantId available for this agent. Re-run with --refresh, or set WORKCORD_HERMES_TENANT_ID alongside WORKCORD_HERMES_KEY.");
-    }
-    return `/v1/tenants/${encodeURIComponent(creds.tenantId)}${suffix}`;
-}
-function seg(value) {
-    return encodeURIComponent(value);
-}
-function segments(value) {
-    return value
-        .split("/")
-        .filter((part) => part.length > 0)
-        .map(seg)
-        .join("/");
-}
-function collect(value, previous = []) {
-    return [...previous, value];
-}
-async function currentFlavor(creds) {
-    const res = (await hermesCall({ ...creds, path: "/v1/tenant-api/flavors/current" }));
-    return res?.flavor ?? null;
-}
-async function resolveFlavorId(creds, explicit) {
-    if (explicit)
-        return explicit;
-    const current = await currentFlavor(creds);
-    if (!current?.id) {
-        throw new Error("This tenant has no current flavor. Pass --flavor <flavorId>.");
-    }
-    return current.id;
-}
-async function downloadToFile(creds, path, outPath, query) {
-    const chunks = [];
-    const sink = new Writable({
-        write(chunk, _encoding, done) {
-            chunks.push(Buffer.from(chunk));
-            done();
-        },
-    });
-    await hermesBinary({ ...creds, path, query, out: sink });
-    const bytes = Buffer.concat(chunks);
-    await writeFile(outPath, bytes);
-    return bytes.byteLength;
-}
-async function readArchive(archivePath) {
-    const info = await stat(archivePath);
-    assertArchiveSize(info.size, archivePath);
-    const buffer = await readFile(archivePath);
-    return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
-}
-export function registerHermes(program) {
-    const group = getOrCreateGroup(program, "hermes", "Advanced Hermes Hub diagnostics and recovery for an agent tenant");
-    agentFlags(group.command("key").description("Reveal (and cache) the Hermes Hub tenant key for an agent.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out({ key: creds.key, tenantId: creds.tenantId, hubBaseUrl: creds.hubBaseUrl });
-    });
-    agentFlags(group.command("whoami").description("Show the Hermes Hub tenant this agent's key belongs to.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant" }));
-    });
-    agentFlags(group.command("runtime").description("Show the tenant runtime.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/runtime" }));
-    });
-    const agent = group.command("agent").description("Tenant agent lifecycle");
-    agentFlags(agent.command("status").description("Show the tenant agent.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/agent" }));
-    });
-    for (const verb of ["start", "stop", "restart"]) {
-        agentFlags(agent.command(verb).description(`${verb[0].toUpperCase()}${verb.slice(1)} the tenant agent.`)).action(async (opts) => {
-            const creds = await credentials(program, opts);
-            out(await hermesCall({ ...creds, method: "POST", path: `/v1/tenant-api/tenant/agent/${verb}` }));
-        });
-    }
-    agentFlags(agent.command("card").description("Show the tenant agent card.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/agent-card" }));
-    });
-    const chat = group.command("chat").description("Tenant chats and chat messages");
-    jsonOption(agentFlags(chat.command("list").description("List chats.")), "query", "query parameters as JSON").action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: tenantPath(creds, "/chats"), query: parseJson(opts.query, "--query") }));
-    });
-    jsonOption(agentFlags(chat.command("create").description("Create a chat.")), "body", "request body as JSON").action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, "/chats"), body: parseJson(opts.body, "--body") ?? {} }));
-    });
-    agentFlags(chat.command("get").description("Get one chat."))
-        .requiredOption("--chat <chatId>", "chat id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: tenantPath(creds, `/chats/${encodeURIComponent(opts.chat)}`) }));
-    });
-    jsonOption(agentFlags(chat.command("messages").description("List messages in a chat.")), "query", "query parameters as JSON")
-        .requiredOption("--chat <chatId>", "chat id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            path: tenantPath(creds, `/chats/${encodeURIComponent(opts.chat)}/messages`),
-            query: parseJson(opts.query, "--query"),
-        }));
-    });
-    jsonOption(agentFlags(chat.command("send").description("Send a message to a chat.")), "body", "request body as JSON (overrides --text)")
-        .requiredOption("--chat <chatId>", "chat id")
-        .option("--text <text>", "message text")
-        .option("--idempotency-key <key>", "Idempotency-Key header (generated when omitted)")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const body = parseJson(opts.body, "--body") ?? (opts.text !== undefined ? hermesChatTextBody(opts.text) : undefined);
-        if (body === undefined) {
-            throw new Error("One of --text or --body is required.");
-        }
-        out(await hermesCall({
-            ...creds,
-            method: "POST",
-            path: tenantPath(creds, `/chats/${encodeURIComponent(opts.chat)}/messages`),
-            headers: { "idempotency-key": opts.idempotencyKey ?? randomUUID() },
-            body,
-        }));
-    });
-    agentFlags(chat.command("message").description("Get one chat message."))
-        .requiredOption("--message <messageId>", "chat message id")
-        .option("--after-revision <n>", "only return when the revision is newer than this")
-        .option("--wait-seconds <n>", "long-poll for up to this many seconds")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}`),
-            query: { afterRevision: opts.afterRevision, waitSeconds: opts.waitSeconds },
-        }));
-    });
-    agentFlags(chat.command("stream").description("Stream a chat message's events (SSE)."))
-        .requiredOption("--message <messageId>", "chat message id")
-        .option("--last-event-id <id>", "resume from this event id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        await hermesStream({
-            ...creds,
-            path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}/events`),
-            lastEventId: opts.lastEventId,
-        });
-    });
-    agentFlags(chat.command("stop").description("Stop a chat message."))
-        .requiredOption("--message <messageId>", "chat message id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}/stop`) }));
-    });
-    jsonOption(agentFlags(chat.command("approve").description("Answer a chat message's approval request.")), "body", "request body as JSON")
-        .requiredOption("--message <messageId>", "chat message id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            method: "POST",
-            path: tenantPath(creds, `/chat-messages/${encodeURIComponent(opts.message)}/approval`),
-            body: parseJson(opts.body, "--body") ?? {},
-        }));
-    });
-    const run = group.command("run").description("Tenant runs");
-    jsonOption(agentFlags(run.command("create").description("Create a run.")), "body", "request body as JSON").action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, "/runs"), body: parseJson(opts.body, "--body") ?? {} }));
-    });
-    agentFlags(run.command("get").description("Get one run."))
-        .requiredOption("--run <runId>", "run id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}`) }));
-    });
-    agentFlags(run.command("stream").description("Stream a run's events (SSE)."))
-        .requiredOption("--run <runId>", "run id")
-        .option("--last-event-id <id>", "resume from this event id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        await hermesStream({ ...creds, path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}/events`), lastEventId: opts.lastEventId });
-    });
-    agentFlags(run.command("stop").description("Stop a run."))
-        .requiredOption("--run <runId>", "run id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, method: "POST", path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}/stop`) }));
-    });
-    jsonOption(agentFlags(run.command("approve").description("Answer a run's approval request.")), "body", "request body as JSON")
-        .requiredOption("--run <runId>", "run id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            method: "POST",
-            path: tenantPath(creds, `/runs/${encodeURIComponent(opts.run)}/approval`),
-            body: parseJson(opts.body, "--body") ?? {},
-        }));
-    });
-    const files = group.command("files").description("Tenant-visible files");
-    agentFlags(files.command("ls").description("List files under the tenant's virtual roots."))
-        .option("--path <path>", "directory path (empty means root)")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/files", query: { path: opts.path } }));
-    });
-    agentFlags(files.command("cat").description("Read one tenant-visible file."))
-        .requiredOption("--path <path>", "file path")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/files/content", query: { path: opts.path } }));
-    });
-    agentFlags(files.command("download").description("Download one tenant-visible file (raw bytes)."))
-        .requiredOption("--path <path>", "file path")
-        .option("--out <file>", "write to this file instead of stdout")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const path = "/v1/tenant-api/tenant/files/download";
-        const query = { path: opts.path };
-        if (opts.out) {
-            out({ path: opts.out, bytes: await downloadToFile(creds, path, opts.out, query) });
-            return;
-        }
-        await hermesBinary({ ...creds, path, query });
-    });
-    const share = group.command("share").description("Share-group filesystem");
-    agentFlags(share.command("groups").description("List share groups visible to this tenant.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/shares" }));
-    });
-    const shareGroupFlags = (cmd) => agentFlags(cmd).requiredOption("--group <groupId>", "share group id");
-    const sharePath = (groupId, action) => `/v1/tenant-api/tenant/shares/${seg(groupId)}/${action}`;
-    shareGroupFlags(share.command("ls").description("List one share-group directory."))
-        .option("--path <path>", "path relative to the share root")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: sharePath(opts.group, "list"), query: { path: opts.path } }));
-    });
-    shareGroupFlags(share.command("read").description("Read one file from a share group."))
-        .requiredOption("--path <path>", "path relative to the share root")
-        .option("--offset <n>", "leading lines to skip")
-        .option("--limit <n>", "maximum lines to return")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            path: sharePath(opts.group, "read"),
-            query: { path: opts.path, offset: opts.offset, limit: opts.limit },
-        }));
-    });
-    shareGroupFlags(share.command("stat").description("Stat one share-group path."))
-        .requiredOption("--path <path>", "path relative to the share root")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: sharePath(opts.group, "stat"), query: { path: opts.path } }));
-    });
-    shareGroupFlags(share.command("grep").description("Search share-group file contents."))
-        .requiredOption("--pattern <regexp>", "Go regular expression")
-        .option("--path <path>", "path relative to the share root")
-        .option("--ignore-case", "case-insensitive match")
-        .option("--max <n>", "maximum results")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            path: sharePath(opts.group, "grep"),
-            query: { pattern: opts.pattern, path: opts.path, ignore_case: opts.ignoreCase, max: opts.max },
-        }));
-    });
-    shareGroupFlags(share.command("find").description("Find share-group paths by base name."))
-        .option("--name <glob>", "glob matched against each entry's base name")
-        .option("--path <path>", "path relative to the share root")
-        .option("--max <n>", "maximum results")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            path: sharePath(opts.group, "find"),
-            query: { name: opts.name, path: opts.path, max: opts.max },
-        }));
-    });
-    shareGroupFlags(share.command("write").description("Write one file into a share group."))
-        .requiredOption("--path <path>", "path relative to the share root")
-        .option("--content <text>", "file contents", "")
-        .addOption(new Option("--mode <mode>", "write mode").choices(["overwrite", "append"]))
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            method: "POST",
-            path: sharePath(opts.group, "write"),
-            body: { path: opts.path, content: opts.content, ...(opts.mode ? { mode: opts.mode } : {}) },
-        }));
-    });
-    shareGroupFlags(share.command("mkdir").description("Create a share-group directory."))
-        .requiredOption("--path <path>", "directory path relative to the share root")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, method: "POST", path: sharePath(opts.group, "mkdir"), body: { path: opts.path } }));
-    });
-    shareGroupFlags(share.command("move").description("Move a share-group path."))
-        .requiredOption("--from <path>", "source path relative to the share root")
-        .requiredOption("--to <path>", "destination path relative to the share root")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, method: "POST", path: sharePath(opts.group, "move"), body: { from: opts.from, to: opts.to } }));
-    });
-    shareGroupFlags(share.command("rm").description("Remove a share-group path."))
-        .requiredOption("--path <path>", "path relative to the share root")
-        .option("--recursive", "required to remove a non-empty directory")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            method: "POST",
-            path: sharePath(opts.group, "remove"),
-            body: { path: opts.path, recursive: Boolean(opts.recursive) },
-        }));
-    });
-    const skills = group.command("skills").description("Skills installed on this tenant");
-    agentFlags(skills.command("list").description("List this tenant's skills.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/skills" }));
-    });
-    for (const [verb, enabled] of [["enable", true], ["disable", false]]) {
-        agentFlags(skills.command(verb).description(`${verb[0].toUpperCase()}${verb.slice(1)} one skill on this tenant.`))
-            .requiredOption("--skill <name>", "skill name")
-            .action(async (opts) => {
-            const creds = await credentials(program, opts);
-            out(await hermesCall({
-                ...creds,
-                method: "PUT",
-                path: `/v1/tenant-api/tenant/skills/${seg(opts.skill)}/state`,
-                body: { enabled },
-            }));
-        });
-    }
-    agentFlags(skills.command("files").description("List one skill's files."))
-        .requiredOption("--category <category>", "skill category")
-        .requiredOption("--skill <skill>", "skill name")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/skills/${seg(opts.category)}/${seg(opts.skill)}/files` }));
-    });
-    agentFlags(skills.command("cat").description("Read one skill file."))
-        .requiredOption("--path <skillPath>", "slash-delimited path relative to $HERMES_HOME/skills")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/skill-files/${segments(opts.path)}` }));
-    });
-    const flavor = group.command("flavor").description("Flavor marketplace and this tenant's flavor pin");
-    agentFlags(flavor.command("current").description("Show this tenant's current flavor pin.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/flavors/current" }));
-    });
-    agentFlags(flavor.command("catalog").description("List the flavor catalog.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/flavors" }));
-    });
-    agentFlags(flavor.command("get").description("Get one catalog flavor."))
-        .requiredOption("--flavor <flavorId>", "flavor id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: `/v1/tenant-api/flavors/${seg(opts.flavor)}` }));
-    });
-    agentFlags(flavor.command("set").description("Re-pin this tenant to another version of its flavor."))
-        .requiredOption("--flavor-version <version>", "flavor version")
-        .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
-        .option("--force", "proceed despite a downgrade or deprecated target")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const current = await currentFlavor(creds);
-        const flavorId = opts.flavor ?? current?.id;
-        if (!flavorId) {
-            throw new Error("This tenant has no current flavor. Pass --flavor <flavorId>.");
-        }
-        const entry = (await hermesCall({ ...creds, path: `/v1/tenant-api/flavors/${seg(flavorId)}` }));
-        const warnings = flavorSetWarnings(flavorId === current?.id ? current?.version : undefined, opts.flavorVersion, entry?.versions ?? []);
-        if (warnings.length > 0) {
-            for (const warning of warnings) {
-                process.stderr.write(`warning: ${warning}\n`);
-            }
-            if (!opts.force) {
-                throw new Error(`Refusing to re-pin ${flavorId} to ${opts.flavorVersion}: ${warnings.join("; ")}. Re-run with --force to proceed.`);
-            }
-        }
-        out(await hermesCall({
-            ...creds,
-            method: "PUT",
-            path: "/v1/tenant-api/flavors/current",
-            body: { flavorId, flavorVersion: opts.flavorVersion },
-        }));
-    });
-    agentFlags(flavor.command("subscribe").description("Set this tenant's flavor update policy."))
-        .addOption(new Option("--policy <policy>", "update policy").choices(["pinned", "stable", "canary", "auto_patch"]).makeOptionMandatory())
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            method: "PUT",
-            path: "/v1/tenant-api/flavors/current/subscription",
-            body: { updatePolicy: opts.policy },
-        }));
-    });
-    agentFlags(flavor.command("checkout").description("Download one flavor version's source tarball."))
-        .requiredOption("--flavor-version <version>", "flavor version")
-        .requiredOption("--out <file>", "write the gzipped tarball here")
-        .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const flavorId = await resolveFlavorId(creds, opts.flavor);
-        const bytes = await downloadToFile(creds, `/v1/tenant-api/flavors/${seg(flavorId)}/versions/${seg(opts.flavorVersion)}/source`, opts.out);
-        out({ path: opts.out, bytes });
-    });
-    agentFlags(flavor.command("publish").description("Publish a new version of an owned flavor."))
-        .requiredOption("--archive <file>", "gzipped flavor package built beforehand")
-        .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const flavorId = await resolveFlavorId(creds, opts.flavor);
-        const data = await readArchive(opts.archive);
-        out(await guardOwnership("flavor", flavorId, creds.tenantId, () => hermesUpload({
-            ...creds,
-            path: `/v1/tenant-api/flavors/${seg(flavorId)}/versions`,
-            contentType: "application/gzip",
-            data,
-        })));
-    });
-    agentFlags(flavor.command("rollout").description("Roll one flavor version out to tenants pinned to that flavor."))
-        .requiredOption("--flavor-version <version>", "flavor version")
-        .option("--flavor <flavorId>", "flavor id (defaults to the current pin)")
-        .option("--all-matching", "target every tenant pinned to this flavor id, ignoring their update policy (requires --force)")
-        .option("--canary", "restrict the automatic rollout to the canary cohort")
-        .option("--tenant <tenantId>", "target one tenant (repeatable)", collect)
-        .option("--force", "accept the blast radius of --all-matching")
-        .action(async (opts) => {
-        const body = rolloutBody(opts);
-        const creds = await credentials(program, opts);
-        const flavorId = await resolveFlavorId(creds, opts.flavor);
-        const result = (await guardOwnership("flavor", flavorId, creds.tenantId, () => hermesCall({
-            ...creds,
-            method: "POST",
-            path: `/v1/tenant-api/flavors/${seg(flavorId)}/versions/${seg(opts.flavorVersion)}/rollout`,
-            body,
-        })));
-        process.stderr.write(`rollout affected ${String(result?.updatedCount ?? 0)} of ${String(result?.matchedCount ?? 0)} matched tenants\n`);
-        out(result);
-    });
-    const skill = group.command("skill").description("Skill marketplace (owner-gated for publish)");
-    agentFlags(skill.command("catalog").description("List the skill catalog.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/skills" }));
-    });
-    agentFlags(skill.command("get").description("Get one catalog skill."))
-        .requiredOption("--skill <skillId>", "skill id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: `/v1/tenant-api/skills/${seg(opts.skill)}` }));
-    });
-    agentFlags(skill.command("checkout").description("Download one skill version's source tarball."))
-        .requiredOption("--skill <skillId>", "skill id")
-        .requiredOption("--skill-version <version>", "skill version")
-        .requiredOption("--out <file>", "write the gzipped tarball here")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const bytes = await downloadToFile(creds, `/v1/tenant-api/skills/${seg(opts.skill)}/versions/${seg(opts.skillVersion)}/source`, opts.out);
-        out({ path: opts.out, bytes });
-    });
-    agentFlags(skill.command("publish").description("Publish a new version of an owned skill."))
-        .requiredOption("--skill <skillId>", "skill id")
-        .requiredOption("--archive <file>", "gzipped skill package built beforehand")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const data = await readArchive(opts.archive);
-        out(await guardOwnership("skill", opts.skill, creds.tenantId, () => hermesUpload({
-            ...creds,
-            path: `/v1/tenant-api/skills/${seg(opts.skill)}/versions`,
-            contentType: "application/gzip",
-            data,
-        })));
-    });
-    const evals = group.command("eval").description("Flavor eval suites and runs");
-    agentFlags(evals.command("suites").description("List eval suites for this tenant's flavor.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/flavor/eval-suites" }));
-    });
-    agentFlags(evals.command("run").description("Start an eval run."))
-        .requiredOption("--suite <suiteId>", "eval suite id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, method: "POST", path: "/v1/tenant-api/tenant/flavor/eval-runs", body: { suiteId: opts.suite } }));
-    });
-    agentFlags(evals.command("list").description("List this tenant's eval runs."))
-        .option("--suite <suiteId>", "filter by suite id")
-        .option("--status <status>", "filter by status")
-        .option("--limit <n>", "maximum runs to return")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({
-            ...creds,
-            path: "/v1/tenant-api/tenant/eval-runs",
-            query: { suite_id: opts.suite, status: opts.status, limit: opts.limit },
-        }));
-    });
-    agentFlags(evals.command("get").description("Get one eval run."))
-        .requiredOption("--run <evalRunId>", "eval run id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: `/v1/tenant-api/tenant/eval-runs/${seg(opts.run)}` }));
-    });
-    agentFlags(evals.command("cancel").description("Cancel one eval run."))
-        .requiredOption("--run <evalRunId>", "eval run id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, method: "POST", path: `/v1/tenant-api/tenant/eval-runs/${seg(opts.run)}:cancel` }));
-    });
-    const peers = group.command("peers").description("A2A peers");
-    agentFlags(peers.command("list").description("List this tenant's A2A peers.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/peers" }));
-    });
-    agentFlags(peers.command("get").description("Get one peer."))
-        .requiredOption("--peer <peerId>", "peer id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: `/v1/tenant-api/peers/${seg(opts.peer)}` }));
-    });
-    jsonOption(agentFlags(peers.command("call").description("Send a message to a peer.")), "body", "request body as JSON (overrides the other flags)")
-        .requiredOption("--peer <peerId>", "peer id")
-        .option("--message <text>", "message text")
-        .option("--context <contextId>", "conversation context id")
-        .option("--async", "return before the peer replies")
-        .option("--wait-seconds <n>", "seconds to wait for a reply")
-        .option("--idempotency-key <key>", "idempotency key (generated when omitted)")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const body = parseJson(opts.body, "--body") ??
-            (opts.message !== undefined
-                ? {
-                    message: opts.message,
-                    ...(opts.context ? { contextId: opts.context } : {}),
-                    ...(opts.async ? { async: true } : {}),
-                    ...(opts.waitSeconds ? { waitSeconds: Number(opts.waitSeconds) } : {}),
-                    idempotencyKey: opts.idempotencyKey ?? randomUUID(),
-                }
-                : undefined);
-        if (body === undefined) {
-            throw new Error("One of --message or --body is required.");
-        }
-        out(await hermesCall({ ...creds, method: "POST", path: `/v1/tenant-api/peers/${seg(opts.peer)}/messages`, body }));
-    });
-    jsonOption(agentFlags(peers.command("find").description("Find peers by query and capabilities.")), "body", "request body as JSON (overrides the other flags)")
-        .option("--query <text>", "free-text query")
-        .option("--required-capability <name>", "capability the peer must have (repeatable)", collect)
-        .option("--exclude-capability <name>", "capability the peer must not have (repeatable)", collect)
-        .option("--limit <n>", "maximum peers to return")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        const body = parseJson(opts.body, "--body") ?? {
-            ...(opts.query ? { query: opts.query } : {}),
-            ...(opts.requiredCapability?.length ? { requiredCapabilities: opts.requiredCapability } : {}),
-            ...(opts.excludeCapability?.length ? { excludeCapabilities: opts.excludeCapability } : {}),
-            ...(opts.limit ? { limit: Number(opts.limit) } : {}),
-        };
-        out(await hermesCall({ ...creds, method: "POST", path: "/v1/tenant-api/peers:find", body }));
-    });
-    const conversations = group.command("conversations").description("A2A conversations");
-    agentFlags(conversations.command("list").description("List conversations.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/conversations" }));
-    });
-    agentFlags(conversations.command("get").description("Get one conversation."))
-        .requiredOption("--context <contextId>", "conversation context id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: `/v1/tenant-api/conversations/${seg(opts.context)}` }));
-    });
-    agentFlags(conversations.command("messages").description("List one conversation's messages."))
-        .requiredOption("--context <contextId>", "conversation context id")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: `/v1/tenant-api/conversations/${seg(opts.context)}/messages` }));
-    });
-    const sessions = group.command("sessions").description("Tenant agent sessions");
-    agentFlags(sessions.command("list").description("List this tenant's sessions."))
-        .option("--limit <n>", "maximum sessions to return")
-        .option("--source <source>", "filter by source")
-        .action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/sessions", query: { limit: opts.limit, source: opts.source } }));
-    });
-    agentFlags(group.command("artifacts").description("List this tenant's artifacts.")).action(async (opts) => {
-        const creds = await credentials(program, opts);
-        out(await hermesCall({ ...creds, path: "/v1/tenant-api/tenant/artifacts" }));
-    });
-}
-//# sourceMappingURL=hermes.js.map