@growthub/cli 0.6.0 → 0.6.2

package/dist/commands/auth-login.js

@@ -0,0 +1,270 @@
+import os from "node:os";
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+import open from "open";
+import { readConfig, resolveConfigPath } from "../config/store.js";
+import { loadPaperclipEnvFile } from "../config/env.js";
+import { startLoginFlow } from "../auth/login-flow.js";
+import { writeSession, clearSession, readSession, describeSessionPath } from "../auth/session-store.js";
+import { clearHostedOverlay, readHostedOverlay, seedHostedOverlayFromSession, writeHostedOverlay, describeHostedOverlayPath, } from "../auth/overlay-store.js";
+import { computeEffectiveProfile, writeEffectiveProfileSnapshot, } from "../auth/effective-profile.js";
+import { resolvePaperclipInstanceId } from "../config/home.js";
+import { isSessionExpired } from "../auth/session-store.js";
+import { fetchHostedSession } from "../auth/hosted-client.js";
+const DEFAULT_HOSTED_BASE_URL = "https://www.growthub.ai";
+function trimSlashes(value) {
+    return value.replace(/\/+$/, "");
+}
+function resolveHostedBaseUrl(opts) {
+    const explicit = opts.baseUrl?.trim();
+    if (explicit)
+        return trimSlashes(explicit);
+    const envBase = process.env.GROWTHUB_BASE_URL?.trim();
+    if (envBase)
+        return trimSlashes(envBase);
+    try {
+        const config = readConfig(opts.configPath);
+        const configuredBase = config?.auth?.growthubBaseUrl?.trim();
+        if (configuredBase)
+            return trimSlashes(configuredBase);
+        const portalBase = config?.auth?.growthubPortalBaseUrl?.trim();
+        if (portalBase)
+            return trimSlashes(portalBase);
+    }
+    catch {
+        // fall through
+    }
+    return DEFAULT_HOSTED_BASE_URL;
+}
+export async function authLogin(opts) {
+    const configPath = resolveConfigPath(opts.config);
+    loadPaperclipEnvFile(configPath);
+    const hostedBaseUrl = resolveHostedBaseUrl({ baseUrl: opts.baseUrl, configPath: opts.config });
+    const machineLabel = opts.machineLabel?.trim() || os.hostname();
+    const workspaceLabel = opts.workspaceLabel?.trim();
+    const linkedInstanceId = resolvePaperclipInstanceId();
+    const existingSession = readSession();
+    if (!opts.token && existingSession && !isSessionExpired(existingSession)) {
+        const sameBaseUrl = trimSlashes(existingSession.hostedBaseUrl) === hostedBaseUrl;
+        if (sameBaseUrl) {
+            try {
+                await fetchHostedSession(existingSession);
+                if (opts.json) {
+                    console.log(JSON.stringify({
+                        status: "ok",
+                        hostedBaseUrl,
+                        userId: existingSession.userId ?? null,
+                        email: existingSession.email ?? null,
+                        reusedSession: true,
+                    }, null, 2));
+                    return;
+                }
+                p.log.success(`Already connected${existingSession.email ? ` as ${existingSession.email}` : ""}.`);
+                if (existingSession.hostedBaseUrl) {
+                    p.log.message(pc.dim(`Hosted: ${existingSession.hostedBaseUrl}`));
+                }
+                return;
+            }
+            catch {
+                clearSession();
+            }
+        }
+    }
+    // Scripted / CI path: accept a hosted-minted token directly.
+    if (opts.token) {
+        const now = new Date().toISOString();
+        writeSession({
+            version: 1,
+            hostedBaseUrl,
+            accessToken: opts.token.trim(),
+            issuedAt: now,
+            machineLabel,
+        });
+        const existingOverlay = readHostedOverlay();
+        const overlay = existingOverlay ??
+            seedHostedOverlayFromSession({
+                hostedBaseUrl,
+                machineLabel,
+                linkedInstanceId,
+            });
+        writeHostedOverlay({
+            ...overlay,
+            hostedBaseUrl,
+            linkedInstanceId: overlay.linkedInstanceId ?? linkedInstanceId,
+        });
+        const effective = computeEffectiveProfile({ configPath });
+        writeEffectiveProfileSnapshot(effective);
+        if (opts.json) {
+            console.log(JSON.stringify({ status: "ok", hostedBaseUrl, mode: "token" }, null, 2));
+        }
+        else {
+            p.log.success("Saved hosted session from --token.");
+            p.log.message(pc.dim(`Session: ${describeSessionPath()}`));
+            p.log.message(pc.dim(`Overlay: ${describeHostedOverlayPath()}`));
+        }
+        return;
+    }
+    p.intro(pc.bgCyan(pc.black(" growthub auth login ")));
+    p.log.message(pc.dim(`Hosted app: ${hostedBaseUrl}`));
+    const flow = await startLoginFlow({
+        hostedBaseUrl,
+        machineLabel,
+        workspaceLabel,
+        timeoutMs: opts.timeoutMs,
+    });
+    if (!opts.noBrowser) {
+        try {
+            p.log.message("Opening browser to complete sign-in…");
+            await open(flow.loginUrl);
+        }
+        catch (err) {
+            p.log.warn(`Could not launch browser automatically: ${err instanceof Error ? err.message : String(err)}`);
+            p.log.message(pc.dim("Paste this URL into a browser:"));
+            p.log.message(pc.cyan(flow.loginUrl));
+        }
+    }
+    else {
+        p.log.message(pc.dim("Paste this URL into a browser:"));
+        p.log.message(pc.cyan(flow.loginUrl));
+    }
+    const spinner = p.spinner();
+    spinner.start("Waiting for hosted app to complete the exchange…");
+    try {
+        const result = await flow.waitForCallback();
+        spinner.stop("Received hosted session token.");
+        const nowIso = new Date().toISOString();
+        writeSession({
+            version: 1,
+            hostedBaseUrl: result.hostedBaseUrl,
+            accessToken: result.token,
+            expiresAt: result.expiresAt,
+            userId: result.userId,
+            email: result.email,
+            orgId: result.orgId,
+            orgName: result.orgName,
+            machineLabel: result.machineLabel,
+            issuedAt: nowIso,
+        });
+        const existingOverlay = readHostedOverlay();
+        const overlay = existingOverlay
+            ? {
+                ...existingOverlay,
+                hostedBaseUrl: result.hostedBaseUrl,
+                userId: result.userId ?? existingOverlay.userId,
+                email: result.email ?? existingOverlay.email,
+                displayName: result.email ?? existingOverlay.displayName,
+                orgId: result.orgId ?? existingOverlay.orgId,
+                orgName: result.orgName ?? existingOverlay.orgName,
+                linkedInstanceId: existingOverlay.linkedInstanceId ?? linkedInstanceId,
+            }
+            : seedHostedOverlayFromSession({
+                hostedBaseUrl: result.hostedBaseUrl,
+                userId: result.userId,
+                email: result.email,
+                orgId: result.orgId,
+                orgName: result.orgName,
+                machineLabel: result.machineLabel,
+                linkedInstanceId,
+            });
+        writeHostedOverlay(overlay);
+        const effective = computeEffectiveProfile({ configPath });
+        writeEffectiveProfileSnapshot(effective);
+        if (opts.json) {
+            console.log(JSON.stringify({
+                status: "ok",
+                hostedBaseUrl: result.hostedBaseUrl,
+                userId: result.userId ?? null,
+                email: result.email ?? null,
+                orgId: result.orgId ?? null,
+            }, null, 2));
+        }
+        else {
+            p.log.success(`Signed in${result.email ? ` as ${result.email}` : ""}.`);
+            p.log.message(pc.dim(`Session: ${describeSessionPath()}`));
+        }
+        p.outro("Done");
+    }
+    catch (err) {
+        spinner.stop("Login failed.");
+        p.log.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    finally {
+        flow.close();
+    }
+}
+export async function authLogout(opts) {
+    const sessionCleared = clearSession();
+    const overlayCleared = opts.keepOverlay ? false : clearHostedOverlay();
+    const effective = computeEffectiveProfile({ configPath: resolveConfigPath(opts.config) });
+    writeEffectiveProfileSnapshot(effective);
+    if (opts.json) {
+        console.log(JSON.stringify({
+            status: "ok",
+            sessionCleared,
+            overlayCleared,
+        }, null, 2));
+        return;
+    }
+    if (!sessionCleared && !overlayCleared) {
+        console.log(pc.dim("No hosted session or overlay present. Local workspace profile is untouched."));
+        return;
+    }
+    if (sessionCleared)
+        console.log(pc.green("Cleared hosted session."));
+    if (overlayCleared)
+        console.log(pc.green("Cleared hosted overlay."));
+    console.log(pc.dim("Local workspace profile is untouched."));
+}
+export async function authWhoami(opts) {
+    const session = readSession();
+    const overlay = readHostedOverlay();
+    const effective = computeEffectiveProfile({ configPath: resolveConfigPath(opts.config) });
+    const payload = {
+        authenticated: effective.authenticated,
+        hostedBaseUrl: session?.hostedBaseUrl ?? overlay?.hostedBaseUrl ?? null,
+        userId: overlay?.userId ?? session?.userId ?? null,
+        email: overlay?.email ?? session?.email ?? null,
+        displayName: overlay?.displayName ?? null,
+        orgId: overlay?.orgId ?? session?.orgId ?? null,
+        orgName: overlay?.orgName ?? session?.orgName ?? null,
+        entitlements: overlay?.entitlements ?? [],
+        linkedInstanceId: overlay?.linkedInstanceId ?? null,
+        session: {
+            present: Boolean(session),
+            expired: effective.session.expired,
+            expiresAt: effective.session.expiresAt,
+        },
+    };
+    if (opts.json) {
+        console.log(JSON.stringify(payload, null, 2));
+        return;
+    }
+    if (!payload.authenticated) {
+        console.log(pc.yellow("Not signed in."));
+        if (effective.session.present && effective.session.expired) {
+            console.log(pc.dim("Hosted session exists but is expired. Run `growthub auth login` to refresh."));
+        }
+        else {
+            console.log(pc.dim("Run `growthub auth login` to connect this CLI to hosted Growthub."));
+        }
+        console.log(pc.dim("Local workspace profile continues to work without authentication."));
+        return;
+    }
+    console.log(pc.bold(`Signed in${payload.email ? ` as ${payload.email}` : payload.userId ? ` as ${payload.userId}` : ""}.`));
+    if (payload.hostedBaseUrl)
+        console.log(pc.dim(`Hosted: ${payload.hostedBaseUrl}`));
+    if (payload.orgName || payload.orgId) {
+        console.log(pc.dim(`Org: ${payload.orgName ?? payload.orgId}`));
+    }
+    if (payload.linkedInstanceId) {
+        console.log(pc.dim(`Linked local instance: ${payload.linkedInstanceId}`));
+    }
+    if (payload.entitlements.length > 0) {
+        console.log(pc.dim(`Entitlements: ${payload.entitlements.join(", ")}`));
+    }
+    if (payload.session.expiresAt) {
+        console.log(pc.dim(`Session expires: ${payload.session.expiresAt}`));
+    }
+}
+//# sourceMappingURL=auth-login.js.map

package/dist/commands/auth-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.js","sourceRoot":"","sources":["../../src/commands/auth-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACxG,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,4BAA4B,EAC5B,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAE1D,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAG7B;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,QAAQ;QAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,OAAO;QAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAC7D,IAAI,cAAc;YAAE,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;QAC/D,IAAI,UAAU;YAAE,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IACpD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;IAChE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,gBAAgB,GAAG,0BAA0B,EAAE,CAAC;IACtD,MAAM,eAAe,GAAG,WAAW,EAAE,CAAC;IAEtC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,eAAe,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,WAAW,CAAC,eAAe,CAAC,aAAa,CAAC,KAAK,aAAa,CAAC;QACjF,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,kBAAkB,CAAC,eAAe,CAAC,CAAC;gBAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;wBACE,MAAM,EAAE,IAAI;wBACZ,aAAa;wBACb,MAAM,EAAE,eAAe,CAAC,MAAM,IAAI,IAAI;wBACtC,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,IAAI;wBACpC,aAAa,EAAE,IAAI;qBACpB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,CAAC,CAAC,GAAG,CAAC,OAAO,CACX,oBAAoB,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CACnF,CAAC;gBACF,IAAI,eAAe,CAAC,aAAa,EAAE,CAAC;oBAClC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;gBACpE,CAAC;gBACD,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,YAAY,CAAC;YACX,OAAO,EAAE,CAAC;YACV,aAAa;YACb,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAC9B,QAAQ,EAAE,GAAG;YACb,YAAY;SACb,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;QAC5C,MAAM,OAAO,GACX,eAAe;YACf,4BAA4B,CAAC;gBAC3B,aAAa;gBACb,YAAY;gBACZ,gBAAgB;aACjB,CAAC,CAAC;QAEL,kBAAkB,CAAC;YACjB,GAAG,OAAO;YACV,aAAa;YACb,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,gBAAgB;SAC/D,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;YACpD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,yBAAyB,EAAE,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO;IACT,CAAC;IAED,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,aAAa,EAAE,CAAC,CAAC,CAAC;IAEtD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC;QAChC,aAAa;QACb,YAAY;QACZ,cAAc;QACd,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1G,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACxD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,YAAY,CAAC;YACX,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,eAAe;YAC7B,CAAC,CAAC;gBACE,GAAG,eAAe;gBAClB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM;gBAC/C,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;gBAC5C,WAAW,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC,WAAW;gBACxD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK;gBAC5C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC,OAAO;gBAClD,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,IAAI,gBAAgB;aACvE;YACH,CAAC,CAAC,4BAA4B,CAAC;gBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,gBAAgB;aACjB,CAAC,CAAC;QAEP,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5B,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;aAC5B,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACxE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,cAAc,GAAG,YAAY,EAAE,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAEvE,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1F,6BAA6B,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,MAAM,EAAE,IAAI;YACZ,cAAc;YACd,cAAc;SACf,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC,CAAC;QACnG,OAAO;IACT,CAAC;IAED,IAAI,cAAc;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,cAAc;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE1F,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,aAAa,IAAI,IAAI;QACvE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,IAAI;QAClD,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,KAAK,IAAI,IAAI;QAC/C,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI;QACzC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,KAAK,IAAI,IAAI;QAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,IAAI,IAAI;QACrD,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,EAAE;QACzC,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,IAAI;QACnD,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;YACzB,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO;YAClC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,SAAS;SACvC;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACzC,IAAI,SAAS,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5H,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC"}

package/dist/commands/capability.d.ts

@@ -0,0 +1,15 @@
+/**
+ * CLI Commands — capability
+ *
+ * growthub capability list       — List CMS-backed runtime node primitives
+ * growthub capability inspect    — Show capability bindings, family, outputs
+ * growthub capability resolve    — Show machine-scoped resolution for all caps
+ *
+ * Interactive picker is available via `growthub capability` (no subcommand).
+ */
+import { Command } from "commander";
+export declare function runCapabilityPicker(opts: {
+    allowBackToHub?: boolean;
+}): Promise<"done" | "back">;
+export declare function registerCapabilityCommands(program: Command): void;
+//# sourceMappingURL=capability.d.ts.map

package/dist/commands/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/commands/capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2IpC,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CA8G3B;AAMD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoJjE"}

package/dist/commands/capability.js

@@ -0,0 +1,366 @@
+/**
+ * CLI Commands — capability
+ *
+ * growthub capability list       — List CMS-backed runtime node primitives
+ * growthub capability inspect    — Show capability bindings, family, outputs
+ * growthub capability resolve    — Show machine-scoped resolution for all caps
+ *
+ * Interactive picker is available via `growthub capability` (no subcommand).
+ */
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+import { createCmsCapabilityRegistryClient, CAPABILITY_FAMILIES, } from "../runtime/cms-capability-registry/index.js";
+import { createMachineCapabilityResolver, } from "../runtime/machine-capability-resolver/index.js";
+import { getWorkflowAccess } from "../auth/workflow-access.js";
+import { printPaperclipCliBanner } from "../utils/banner.js";
+// ---------------------------------------------------------------------------
+// Display helpers
+// ---------------------------------------------------------------------------
+const FAMILY_CONFIG = {
+    video: { color: pc.magenta, emoji: "🎬", label: "Video" },
+    image: { color: pc.cyan, emoji: "🖼️ ", label: "Image" },
+    slides: { color: pc.yellow, emoji: "📊", label: "Slides" },
+    text: { color: pc.green, emoji: "📝", label: "Text" },
+    data: { color: pc.blue, emoji: "📦", label: "Data" },
+    ops: { color: pc.red, emoji: "⚙️ ", label: "Ops" },
+};
+function familyBadge(family) {
+    const cfg = FAMILY_CONFIG[family];
+    if (!cfg)
+        return family;
+    return cfg.color(`${cfg.emoji} ${cfg.label}`);
+}
+function executionKindLabel(kind) {
+    if (kind === "hosted-execute")
+        return pc.cyan("hosted");
+    if (kind === "provider-assembly")
+        return pc.yellow("provider");
+    if (kind === "local-only")
+        return pc.green("local");
+    return kind;
+}
+function hr(width = 72) {
+    return pc.dim("─".repeat(width));
+}
+function stripAnsi(str) {
+    // eslint-disable-next-line no-control-regex
+    return str.replace(/\x1B\[[0-9;]*m/g, "");
+}
+function box(lines) {
+    const padded = lines.map((l) => "  " + l);
+    const width = Math.max(...padded.map((l) => stripAnsi(l).length)) + 4;
+    const top = pc.dim("┌" + "─".repeat(width) + "┐");
+    const bottom = pc.dim("└" + "─".repeat(width) + "┘");
+    const body = padded.map((l) => {
+        const pad = width - stripAnsi(l).length;
+        return pc.dim("│") + l + " ".repeat(pad) + pc.dim("│");
+    });
+    return [top, ...body, bottom].join("\n");
+}
+// ---------------------------------------------------------------------------
+// Grouped list renderer
+// ---------------------------------------------------------------------------
+function printGroupedCapabilities(nodes) {
+    const byFamily = {};
+    for (const node of nodes) {
+        (byFamily[node.family] ??= []).push(node);
+    }
+    const families = Object.keys(byFamily).sort();
+    const totalFamilies = families.length;
+    console.log("");
+    console.log(pc.bold("CMS Capability Registry") +
+        pc.dim(`  ${nodes.length} capabilit${nodes.length !== 1 ? "ies" : "y"}  ·  ${totalFamilies} ${totalFamilies !== 1 ? "families" : "family"}`));
+    console.log(hr());
+    for (const family of families) {
+        const groupNodes = byFamily[family];
+        const header = familyBadge(family);
+        console.log(`\n${header}  ${pc.dim("(" + groupNodes.length + ")")}`);
+        for (const node of groupNodes) {
+            const enabledTag = node.enabled ? pc.green("enabled") : pc.red("disabled");
+            console.log(`  ${pc.bold(node.slug)}  ${pc.dim(node.displayName)}  ${enabledTag}`);
+            console.log(`  ${pc.dim("Execution:")} ${executionKindLabel(node.executionKind)}  ${pc.dim("Outputs:")} ${pc.dim(node.outputTypes.join(", "))}`);
+            if (node.description) {
+                console.log(`  ${pc.dim(node.description)}`);
+            }
+            console.log("");
+        }
+    }
+    console.log(hr());
+    console.log(pc.dim("  growthub capability inspect <slug>  ·  growthub capability resolve"));
+    console.log("");
+}
+// ---------------------------------------------------------------------------
+// Inspect renderer
+// ---------------------------------------------------------------------------
+function printCapabilityCard(node) {
+    const iconPrefix = node.icon ? `${node.icon}  ` : "";
+    const lines = [
+        `${iconPrefix}${pc.bold(node.displayName)}  ${pc.dim(node.slug)}`,
+        `${familyBadge(node.family)}  ${node.enabled ? pc.green("enabled") : pc.red("disabled")}`,
+        "",
+        `${pc.dim("Category:")}          ${node.category}`,
+        `${pc.dim("Node Type:")}         ${node.nodeType}`,
+        `${pc.dim("Execution Kind:")}    ${executionKindLabel(node.executionKind)}`,
+        `${pc.dim("Execution Strategy:")} ${node.executionBinding.strategy}`,
+        `${pc.dim("Tool Name:")}         ${node.executionTokens.tool_name}`,
+        `${pc.dim("Output Types:")}      ${node.outputTypes.join(", ")}`,
+        `${pc.dim("Required Bindings:")} ${node.requiredBindings.length > 0 ? node.requiredBindings.join(", ") : pc.dim("(none)")}`,
+    ];
+    if (node.description) {
+        lines.push("", pc.dim(node.description));
+    }
+    const inputKeys = Object.keys(node.executionTokens.input_template);
+    if (inputKeys.length > 0) {
+        lines.push("", `${pc.dim("Input fields:")} ${inputKeys.join(", ")}`);
+    }
+    console.log("");
+    console.log(box(lines));
+    console.log("");
+}
+// ---------------------------------------------------------------------------
+// Interactive picker (accessible from discovery hub)
+// ---------------------------------------------------------------------------
+export async function runCapabilityPicker(opts) {
+    printPaperclipCliBanner();
+    p.intro(pc.bold("CMS Capability Registry"));
+    const access = getWorkflowAccess();
+    if (access.state !== "ready") {
+        p.note([
+            "Capabilities are unavailable until the hosted user is linked to this local machine.",
+            access.reason,
+        ].join("\n"), "Growthub Local Machine Required");
+        return opts.allowBackToHub ? "back" : "done";
+    }
+    const registry = createCmsCapabilityRegistryClient();
+    while (true) {
+        const familyChoice = await p.select({
+            message: "Filter by capability family",
+            options: [
+                { value: "all", label: "All Families" },
+                ...CAPABILITY_FAMILIES.map((family) => {
+                    const cfg = FAMILY_CONFIG[family];
+                    return {
+                        value: family,
+                        label: cfg ? `${cfg.emoji}  ${cfg.label}` : family,
+                    };
+                }),
+                ...(opts.allowBackToHub ? [{ value: "__back_to_hub", label: "← Back to main menu" }] : []),
+            ],
+        });
+        if (p.isCancel(familyChoice)) {
+            p.cancel("Cancelled.");
+            process.exit(0);
+        }
+        if (familyChoice === "__back_to_hub")
+            return "back";
+        const query = familyChoice === "all"
+            ? undefined
+            : { family: familyChoice };
+        let result;
+        try {
+            result = await registry.listCapabilities(query);
+        }
+        catch (err) {
+            p.log.error("Failed to load capabilities: " + err.message);
+            continue;
+        }
+        if (result.nodes.length === 0) {
+            p.note("No capabilities available for that family.", "Nothing found");
+            continue;
+        }
+        while (true) {
+            const capChoice = await p.select({
+                message: "Select capability",
+                options: [
+                    ...result.nodes.map((n) => ({
+                        value: n.slug,
+                        label: `${familyBadge(n.family)}  ` +
+                            pc.bold(n.displayName) + "  " +
+                            pc.dim(n.slug),
+                        hint: n.description ? n.description.slice(0, 55) : undefined,
+                    })),
+                    { value: "__back_to_family", label: "← Back to family filter" },
+                ],
+            });
+            if (p.isCancel(capChoice)) {
+                p.cancel("Cancelled.");
+                process.exit(0);
+            }
+            if (capChoice === "__back_to_family")
+                break;
+            const selected = result.nodes.find((n) => n.slug === capChoice);
+            if (!selected)
+                continue;
+            printCapabilityCard(selected);
+            const nextStep = await p.select({
+                message: "Next step",
+                options: [
+                    { value: "resolve", label: "🔍 Check machine binding" },
+                    { value: "back_to_caps", label: "← Back to capability list" },
+                ],
+            });
+            if (p.isCancel(nextStep)) {
+                p.cancel("Cancelled.");
+                process.exit(0);
+            }
+            if (nextStep === "back_to_caps")
+                continue;
+            if (nextStep === "resolve") {
+                try {
+                    const resolver = createMachineCapabilityResolver();
+                    const binding = await resolver.resolveCapability(selected.slug);
+                    if (binding) {
+                        const statusColor = binding.allowed ? pc.green : pc.red;
+                        console.log("");
+                        console.log(box([
+                            `${pc.bold("Machine Binding:")} ${selected.slug}`,
+                            `${pc.dim("Allowed:")}  ${statusColor(String(binding.allowed))}`,
+                            `${pc.dim("Reason:")}   ${binding.reason ?? "—"}`,
+                            ...(binding.machineConnectionId ? [`${pc.dim("Connection:")} ${binding.machineConnectionId}`] : []),
+                        ]));
+                        console.log("");
+                    }
+                }
+                catch (err) {
+                    p.log.error("Resolution failed: " + err.message);
+                }
+            }
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+export function registerCapabilityCommands(program) {
+    const cap = program
+        .command("capability")
+        .description("Discover and inspect CMS-backed runtime node capabilities")
+        .addHelpText("after", `
+Examples:
+  $ growthub capability                     # interactive browser
+  $ growthub capability list                # all capabilities grouped by family
+  $ growthub capability list --family video # filter by family
+  $ growthub capability list --json         # machine-readable output
+  $ growthub capability inspect video-gen   # inspect a specific capability
+  $ growthub capability resolve             # resolve machine bindings for all
+`);
+    cap.action(async () => {
+        await runCapabilityPicker({});
+    });
+    // ── list ────────────────────────────────────────────────────────────────
+    cap
+        .command("list")
+        .description("List all CMS-backed runtime node capabilities")
+        .option("--family <family>", "Filter by family (video, image, slides, text, data, ops)")
+        .option("--json", "Output raw JSON for scripting")
+        .action(async (opts) => {
+        const access = getWorkflowAccess();
+        if (access.state !== "ready") {
+            console.error(pc.red(`${access.reason}.`));
+            process.exitCode = 1;
+            return;
+        }
+        const registry = createCmsCapabilityRegistryClient();
+        const query = opts.family
+            ? { family: opts.family }
+            : undefined;
+        try {
+            const { nodes, meta } = await registry.listCapabilities(query);
+            if (opts.json) {
+                console.log(JSON.stringify({ nodes, meta }, null, 2));
+                return;
+            }
+            if (nodes.length === 0) {
+                console.error(pc.yellow("No capabilities found" + (opts.family ? ` for family: ${opts.family}` : "") + "."));
+                console.error(pc.dim("Valid families: " + CAPABILITY_FAMILIES.join(", ")));
+                process.exitCode = 1;
+                return;
+            }
+            printGroupedCapabilities(nodes);
+            console.log(pc.dim(`  Source: ${meta.source}  ·  Fetched: ${meta.fetchedAt}`));
+            console.log("");
+        }
+        catch (err) {
+            console.error(pc.red("Failed to list capabilities: " + err.message));
+            process.exitCode = 1;
+        }
+    });
+    // ── inspect ─────────────────────────────────────────────────────────────
+    cap
+        .command("inspect")
+        .description("Inspect a specific CMS capability node")
+        .argument("<slug>", "Capability slug (e.g. 'video-gen', 'text-gen')")
+        .option("--json", "Output raw JSON")
+        .action(async (slug, opts) => {
+        const access = getWorkflowAccess();
+        if (access.state !== "ready") {
+            console.error(pc.red(`${access.reason}.`));
+            process.exitCode = 1;
+            return;
+        }
+        const registry = createCmsCapabilityRegistryClient();
+        try {
+            const node = await registry.getCapability(slug);
+            if (!node) {
+                console.error(pc.red(`Unknown capability: "${slug}".`) + pc.dim(" Run `growthub capability list` to browse."));
+                process.exitCode = 1;
+                return;
+            }
+            if (opts.json) {
+                console.log(JSON.stringify(node, null, 2));
+                return;
+            }
+            printCapabilityCard(node);
+        }
+        catch (err) {
+            console.error(pc.red("Failed to inspect capability: " + err.message));
+            process.exitCode = 1;
+        }
+    });
+    // ── resolve ─────────────────────────────────────────────────────────────
+    cap
+        .command("resolve")
+        .description("Resolve machine-scoped capability bindings for all capabilities")
+        .option("--json", "Output raw JSON")
+        .action(async (opts) => {
+        const access = getWorkflowAccess();
+        if (access.state !== "ready") {
+            console.error(pc.red(`${access.reason}.`));
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const resolver = createMachineCapabilityResolver();
+            const result = await resolver.resolveAll();
+            if (opts.json) {
+                console.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            console.log("");
+            console.log(pc.bold("Machine Capability Resolution"));
+            console.log(hr());
+            console.log(`  ${pc.dim("Hostname:")}  ${result.machineContext.hostname}`);
+            console.log(`  ${pc.dim("Instance:")}  ${result.machineContext.instanceId}`);
+            console.log(`  ${pc.dim("Session:")}   ${result.machineContext.hasActiveSession ? pc.green("active") : pc.red("none")}`);
+            if (result.machineContext.machineLabel) {
+                console.log(`  ${pc.dim("Machine:")}   ${result.machineContext.machineLabel}`);
+            }
+            console.log(`  ${pc.dim("Entitlements:")} ${result.entitlements.length > 0 ? result.entitlements.join(", ") : pc.dim("(none)")}`);
+            console.log(hr());
+            for (const binding of result.bindings) {
+                const statusColor = binding.allowed ? pc.green : pc.red;
+                const statusIcon = binding.allowed ? "✓" : "✗";
+                console.log(`  ${statusColor(statusIcon)} ${pc.bold(binding.capabilitySlug)}` +
+                    `  ${pc.dim(binding.reason ?? "")}`);
+            }
+            console.log("");
+            console.log(pc.dim(`  Resolved at: ${result.resolvedAt}`));
+            console.log("");
+        }
+        catch (err) {
+            console.error(pc.red("Failed to resolve capabilities: " + err.message));
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=capability.js.map