@hs-x/cli 0.3.6 → 0.4.0

package/dist/commands/flags.d.ts

@@ -5,7 +5,7 @@ import type { FlagDefinition } from '@hs-x/types';
 import { Option } from 'effect';
 import { CliError } from '../cli-error.js';
 import { readLocalProjectContext } from '../project-context.js';
-import { BACK, type ConfirmOptions, type PromptOptions, type SelectOptions, promptConfirm, promptSelect } from '../prompt.js';
+import { BACK, type ConfirmOptions, type PromptOptions, type SelectOptions, promptSelect } from '../prompt.js';
 import type { Reporter as SyncReporter } from '../reporter/types.js';
 import type { CliResult } from '../result.js';
 import { AccountStore } from '../services/account-store.js';
@@ -24,6 +24,10 @@ export interface FlagCreatePromptDeps {
     readonly text: (opts: PromptOptions) => Promise<string | undefined | typeof BACK>;
     readonly confirm: (opts: ConfirmOptions) => Promise<boolean | undefined | typeof BACK>;
 }
+interface FlagConsentPromptDeps {
+    readonly isInteractive: () => boolean;
+    readonly confirm: (opts: ConfirmOptions) => Promise<boolean | undefined>;
+}
 export interface ResolvedFlagsContext {
     readonly projectId: string;
     readonly environment: string;
@@ -80,6 +84,8 @@ export declare function runCreate(input: {
     readonly client: FlagAuthoringClient;
     readonly scope: RuntimeTenantSyncReadScope;
     readonly reporter: SyncReporter;
+    readonly yes?: boolean;
+    readonly prompts?: FlagConsentPromptDeps;
 }): Promise<CliResult>;
 export type FlagsAction = 'list' | 'create' | 'enable' | 'disable' | 'archive';
 /** Dependency-injected action seam used by the bare `hs-x flags` TTY flow. */
@@ -94,10 +100,8 @@ export interface FlagCreateWizardInput {
 }
 /** Build and submit a bounded typed definition using only schema-supported exact-match rules. */
 export declare function runCreateWizard(input: FlagCreateWizardInput): Promise<CliResult>;
-export interface FlagMutationPromptDeps {
-    readonly isInteractive: () => boolean;
+export interface FlagMutationPromptDeps extends FlagConsentPromptDeps {
     readonly select: typeof promptSelect;
-    readonly confirm: typeof promptConfirm;
 }
 export declare function runSetState(input: {
     readonly argv: readonly string[];
@@ -156,4 +160,5 @@ export declare const flagsCmd: Command.Command<"flags", AccountStore | FileSyste
         readonly cloudflareApiToken: Option.Option<string>;
     }>;
 }>;
+export {};
 //# sourceMappingURL=flags.d.ts.map

package/dist/commands/flags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../src/commands/flags.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,0BAA0B,EAEhC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAkB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,QAAQ,EAAY,MAAM,iBAAiB,CAAC;AAUrD,OAAO,EAEL,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAU/B,OAAO,EACL,IAAI,EACJ,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAElB,aAAa,EACb,YAAY,EAEb,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAuBpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,EAChC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,KACnB,OAAO,CAAC,CAAC,GAAG,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC;IAClF,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC;CACxF;AAkBD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;KACvC,CAAC;CACH;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;CACpC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkLhC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,SAAS,CAAC,CA0HrB;AAyBD,wBAAsB,SAAS,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC,GAAG,OAAO,CAAC,SAAS,CAAC,CAoDrB;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,8EAA8E;AAC9E,wBAAsB,iBAAiB,CACrC,OAAO,GAAE,eAAkC,GAC1C,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAiBlC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAyPD,iGAAiG;AACjG,wBAAsB,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,CAkMtF;AAOD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,OAAO,YAAY,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,aAAa,CAAC;CACxC;AAQD,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAC3C,GAAG,OAAO,CAAC,SAAS,CAAC,CA8ErB;AAoiBD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpB,CAAC"}
+{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../src/commands/flags.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,0BAA0B,EAEhC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAkB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,QAAQ,EAAY,MAAM,iBAAiB,CAAC;AAWrD,OAAO,EAEL,uBAAuB,EAKxB,MAAM,uBAAuB,CAAC;AAU/B,OAAO,EACL,IAAI,EACJ,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,EAGlB,YAAY,EAEb,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAiDpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IACtF,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,EAChC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,KACnB,OAAO,CAAC,CAAC,GAAG,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC;IAClF,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC;CACxF;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1E;AA2CD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG;QAC7E,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;KACvC,CAAC;CACH;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC;IACpE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;CACpC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkLhC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,SAAS,CAAC,CAiLrB;AAyBD,wBAAsB,SAAS,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C,GAAG,OAAO,CAAC,SAAS,CAAC,CAmErB;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/E,8EAA8E;AAC9E,wBAAsB,iBAAiB,CACrC,OAAO,GAAE,eAAkC,GAC1C,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAiBlC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAyPD,iGAAiG;AACjG,wBAAsB,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,SAAS,CAAC,CAsMtF;AAYD,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,QAAQ,CAAC,MAAM,EAAE,OAAO,YAAY,CAAC;CACtC;AAQD,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAC3C,GAAG,OAAO,CAAC,SAAS,CAAC,CAqFrB;AA0jBD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpB,CAAC"}

package/dist/commands/flags.js

@@ -9,6 +9,7 @@ import { activeSession } from '../account-store.js';
 import { CliError, exitWith } from '../cli-error.js';
 import { accountIdOption, controlPlaneUrlOption, jsonOption, runHandler, yesOption, } from '../cli/kit.js';
 import { DEFAULT_CONTROL_PLANE_URL } from '../config.js';
+import { requestMutationConsent } from '../mutation-consent.js';
 import { isMachineOutput } from '../output-context.js';
 import { canDiscoverHubSpotAppIdFromTenantBindings, readLocalProjectContext, resolveHubSpotAppId, resolveHubSpotAppIdFromTenantBindings, resolveProjectId, resolveRuntimeOrigin, } from '../project-context.js';
 import { ProjectPickerCancelled, createControlPlaneFlagAuthoringClient, discoverProjectRuntimeBindings, discoverProjects, resolveAccountId, resolveProjectSelection, resolveRuntimeBinding, } from '../project-picker.js';
@@ -30,21 +31,56 @@ function resolveFlag(argv, flag) {
     }
     return undefined;
 }
-function fail(reporter, json, message) {
-    if (json) {
-        reporter.raw(`${JSON.stringify({ ok: false, error: message })}\n`);
+function isMachineReporter(reporter) {
+    return reporter.mode === 'json' || reporter.mode === 'ndjson';
+}
+function fail(reporter, _json, message, code = 'HSX_E_INPUT_INVALID') {
+    if (isMachineReporter(reporter)) {
+        reporter.error(code, message);
+        reporter.done(undefined, 1);
     }
     else {
         reporter.rawErr(`Error: ${message}\n`);
     }
     return { exitCode: 1 };
 }
+function succeed(reporter, data, human) {
+    if (isMachineReporter(reporter)) {
+        reporter.data(data);
+        reporter.done();
+        return;
+    }
+    human();
+}
+function flagTransportErrorCode(error) {
+    if (!(error instanceof RuntimeFlagAuthoringError))
+        return 'HSX_E_INTERNAL';
+    if (error.status === 401 || error.status === 403)
+        return 'HSX_E_API_UNAUTHORIZED';
+    if (error.status >= 500)
+        return 'HSX_E_API_SERVER';
+    return 'HSX_E_API_BAD_REQUEST';
+}
 const liveFlagsPrompts = {
     isInteractive,
     select: promptSelect,
     text: promptText,
     confirm: promptConfirm,
 };
+const liveFlagConsentPrompts = {
+    isInteractive,
+    confirm: promptConfirm,
+};
+const FLAG_DEFINITION_CONSENT_ERROR = 'Creating or updating a flag requires explicit consent in machine or non-interactive mode. Re-run with --yes.';
+function flagStateConsentError(state) {
+    return `Changing a flag to ${state} requires explicit consent in machine or non-interactive mode. Re-run with --yes.`;
+}
+function hasExplicitYes(argv) {
+    return argv.some((arg) => arg === '--yes' || arg === '-y');
+}
+function flagDefinitionPlan(definition, options) {
+    return `\nFlag definition plan\n${JSON.stringify(definition, null, 2)}\n\n${options.wizard ? 'Percentage rollouts are available through --file only.\n\n' : ''}`;
+}
 class FlagsPromptCancelled extends Error {
     constructor() {
         super('Cancelled.');
@@ -237,10 +273,45 @@ export async function flagsCommand(input) {
     const { argv, json } = input;
     const root = input.root ?? process.cwd();
     const subcommand = argv[1];
-    const reporter = createReporter({ command: 'flags', argv });
+    const reporter = createReporter({
+        command: 'flags',
+        argv: json && !argv.includes('--json') ? [...argv, '--json'] : argv,
+    });
     if (!subcommand || !SUBCOMMANDS.has(subcommand)) {
         return fail(reporter, json, `Usage: hs-x flags <${[...SUBCOMMANDS].join('|')}> [options]`);
     }
+    const machineOutput = json || isMachineOutput();
+    const interactive = isInteractive();
+    const yes = hasExplicitYes(argv);
+    if ((subcommand === 'create' || subcommand === 'define') && !resolveFlag(argv, '--file')) {
+        if (machineOutput || !interactive) {
+            return fail(reporter, json, 'Require --file <flag-definition.json> for `flags create` outside an interactive terminal.');
+        }
+    }
+    if ((subcommand === 'enable' || subcommand === 'disable' || subcommand === 'archive') &&
+        !resolveFlag(argv, '--key') &&
+        (machineOutput || !interactive)) {
+        const state = subcommand === 'enable' ? 'enabled' : subcommand === 'disable' ? 'disabled' : 'archived';
+        return fail(reporter, json, `Require --key <flagKey> to ${state} a flag.`);
+    }
+    if (subcommand !== 'list' && (machineOutput || !interactive)) {
+        const consent = await requestMutationConsent({
+            yes,
+            machineOutput,
+            interactive,
+            message: 'Apply this flag mutation?',
+            confirm: promptConfirm,
+        });
+        if (consent === 'require-yes') {
+            return fail(reporter, json, subcommand === 'create' || subcommand === 'define'
+                ? FLAG_DEFINITION_CONSENT_ERROR
+                : flagStateConsentError(subcommand === 'enable'
+                    ? 'enabled'
+                    : subcommand === 'disable'
+                        ? 'disabled'
+                        : 'archived'));
+        }
+    }
     const local = await readLocalProjectContext(root);
     const projectId = resolveProjectId({
         explicit: resolveFlag(argv, '--project-id'),
@@ -312,7 +383,7 @@ export async function flagsCommand(input) {
                 return await runList({ argv, json, client, reporter });
             case 'create':
             case 'define':
-                return await runCreate({ argv, json, client, scope, reporter });
+                return await runCreate({ argv, json, client, scope, reporter, yes });
             case 'enable':
                 return await runSetState({ argv, json, client, state: 'enabled', reporter });
             case 'disable':
@@ -325,29 +396,31 @@ export async function flagsCommand(input) {
     }
     catch (error) {
         if (error instanceof RuntimeFlagAuthoringError) {
-            return fail(reporter, json, `Tenant Worker rejected the request (${error.status}): ${error.message}`);
+            return fail(reporter, json, `Tenant Worker rejected the request (${error.status}): ${error.message}`, flagTransportErrorCode(error));
         }
-        return fail(reporter, json, error instanceof Error ? error.message : String(error));
+        return fail(reporter, json, error instanceof Error ? error.message : String(error), flagTransportErrorCode(error));
     }
 }
 async function runList(input) {
     const limitRaw = resolveFlag(input.argv, '--limit');
     const flags = await input.client.listFlags(limitRaw !== undefined ? { limit: Number(limitRaw) } : undefined);
-    if (input.json) {
-        input.reporter.raw(`${JSON.stringify({ ok: true, flags }, null, 2)}\n`);
-    }
-    else if (flags.length === 0) {
-        input.reporter.raw('No flags defined.\n');
-    }
-    else {
+    succeed(input.reporter, { flags }, () => {
+        if (flags.length === 0) {
+            input.reporter.raw('No flags defined.\n');
+            return;
+        }
         for (const flag of flags) {
             const label = flag.label ? ` — ${flag.label}` : '';
             input.reporter.raw(`${flag.key}  [${flag.type}, ${flag.state}, v${flag.version}]${label}\n`);
         }
-    }
+    });
     return { exitCode: 0 };
 }
 export async function runCreate(input) {
+    const prompts = input.prompts ?? liveFlagConsentPrompts;
+    const yes = input.yes ?? hasExplicitYes(input.argv);
+    const machineOutput = input.json || isMachineOutput();
+    const interactive = prompts.isInteractive();
     const file = resolveFlag(input.argv, '--file');
     if (!file)
         return fail(input.reporter, input.json, 'Require --file <flag-definition.json> for `flags create`.');
@@ -377,13 +450,25 @@ export async function runCreate(input) {
     if (decoded._tag === 'Left') {
         return fail(input.reporter, input.json, `Invalid flag definition: ${String(decoded.left)}`);
     }
-    const result = await input.client.defineFlag(decoded.right);
-    if (input.json) {
-        input.reporter.raw(`${JSON.stringify({ ok: true, flag: result.flag, syncedSnapshots: result.syncedSnapshots }, null, 2)}\n`);
+    if (!machineOutput && interactive) {
+        input.reporter.raw(flagDefinitionPlan(decoded.right, { wizard: false }));
     }
-    else {
-        input.reporter.raw(`Defined "${result.flag.key}" [${result.flag.type}, ${result.flag.state}, v${result.flag.version}] — synced ${result.syncedSnapshots} snapshot(s).\n`);
+    const consent = await requestMutationConsent({
+        yes,
+        machineOutput,
+        interactive,
+        message: `Create or update flag "${decoded.right.key}"?`,
+        confirm: prompts.confirm,
+    });
+    if (consent === 'require-yes') {
+        return fail(input.reporter, input.json, FLAG_DEFINITION_CONSENT_ERROR);
     }
+    if (consent === 'cancelled')
+        return cancelled(input.reporter);
+    const result = await input.client.defineFlag(decoded.right);
+    succeed(input.reporter, { flag: result.flag, syncedSnapshots: result.syncedSnapshots }, () => {
+        input.reporter.raw(`Defined "${result.flag.key}" [${result.flag.type}, ${result.flag.state}, v${result.flag.version}] — synced ${result.syncedSnapshots} snapshot(s).\n`);
+    });
     return { exitCode: 0 };
 }
 /** Dependency-injected action seam used by the bare `hs-x flags` TTY flow. */
@@ -815,22 +900,28 @@ export async function runCreateWizard(input) {
         const referenceError = validateWizardReferences(decoded.right);
         if (referenceError)
             return fail(input.reporter, false, referenceError);
-        input.reporter.raw(`\nFlag definition preview\n${JSON.stringify(decoded.right, null, 2)}\n\nPercentage rollouts are available through --file only.\n\n`);
-        if (input.yes) {
-            definition = decoded.right;
-            break;
-        }
-        const confirmed = await prompts.confirm({
+        input.reporter.raw(flagDefinitionPlan(decoded.right, { wizard: true }));
+        let requestedBack = false;
+        const consent = await requestMutationConsent({
+            yes: input.yes ?? false,
+            machineOutput: false,
+            interactive: true,
             message: `Create or update flag "${decoded.right.key}"?`,
-            default: false,
-            allowBack: true,
+            confirm: async (options) => {
+                const answer = await prompts.confirm({ ...options, allowBack: true });
+                if (answer === BACK) {
+                    requestedBack = true;
+                    return undefined;
+                }
+                return answer;
+            },
         });
-        if (confirmed === undefined || confirmed === false)
-            return cancelled(input.reporter);
-        if (confirmed === true) {
+        if (consent === 'proceed') {
             definition = decoded.right;
             break;
         }
+        if (!requestedBack)
+            return cancelled(input.reporter);
         // Esc from the final confirmation returns to the immediately preceding
         // targeting-rule step without discarding the rest of the draft.
         const revisedRules = await buildRules(prompts, variations ?? []);
@@ -844,7 +935,13 @@ export async function runCreateWizard(input) {
     return { exitCode: 0 };
 }
 function cancelled(reporter) {
-    reporter.rawErr('Cancelled.\n');
+    if (isMachineReporter(reporter)) {
+        reporter.error('HSX_E_INPUT_INVALID', 'Cancelled.');
+        reporter.done(undefined, 130);
+    }
+    else {
+        reporter.rawErr('Cancelled.\n');
+    }
     return { exitCode: 130 };
 }
 const liveFlagMutationPrompts = {
@@ -854,13 +951,21 @@ const liveFlagMutationPrompts = {
 };
 export async function runSetState(input) {
     const prompts = input.prompts ?? liveFlagMutationPrompts;
+    const yes = input.yes ?? hasExplicitYes(input.argv);
+    const machineOutput = input.json || isMachineOutput();
+    const interactive = prompts.isInteractive();
     let key = resolveFlag(input.argv, '--key');
-    const canPrompt = !input.json && !isMachineOutput() && prompts.isInteractive();
+    const canPrompt = !machineOutput && interactive;
     // Deterministic machine/non-interactive validation must not touch the tenant
     // transport merely to discover that a required mutation key is absent.
     if (!key && !canPrompt) {
         return fail(input.reporter, input.json, `Require --key <flagKey> to ${input.state} a flag.`);
     }
+    // Machine and non-interactive mutations require consent before even the
+    // read-only flag lookup, so a missing --yes can never reach tenant transport.
+    if (key && !yes && (machineOutput || !interactive)) {
+        return fail(input.reporter, input.json, flagStateConsentError(input.state));
+    }
     const flags = await input.client.listFlags();
     const candidates = flags.filter((flag) => flag.state !== 'archived' && flag.state !== input.state);
     if (!key && canPrompt) {
@@ -892,19 +997,21 @@ export async function runSetState(input) {
     if (existing.state === input.state) {
         return fail(input.reporter, input.json, `Flag "${key}" is already ${input.state}.`);
     }
-    if (input.state === 'archived' &&
-        !input.json &&
-        !input.yes &&
-        !isMachineOutput() &&
-        prompts.isInteractive()) {
-        const confirmed = await prompts.confirm({
-            message: `Archive flag "${key}"?`,
-            default: false,
-        });
-        if (confirmed !== true) {
-            input.reporter.rawErr('Cancelled.\n');
-            return { exitCode: 130 };
-        }
+    if (!machineOutput && interactive) {
+        input.reporter.raw(`\nFlag state-change plan\nKey: ${key}\nCurrent state: ${existing.state}\nCurrent version: ${existing.version}\nNew state: ${input.state}\nNew version: ${existing.version + 1}\n\n`);
+    }
+    const consent = await requestMutationConsent({
+        yes,
+        machineOutput,
+        interactive,
+        message: `Set flag "${key}" to ${input.state}?`,
+        confirm: prompts.confirm,
+    });
+    if (consent === 'require-yes') {
+        return fail(input.reporter, input.json, flagStateConsentError(input.state));
+    }
+    if (consent === 'cancelled') {
+        return cancelled(input.reporter);
     }
     const updated = {
         ...existing,
@@ -913,12 +1020,9 @@ export async function runSetState(input) {
         updatedAt: new Date().toISOString(),
     };
     const result = await input.client.defineFlag(updated);
-    if (input.json) {
-        input.reporter.raw(`${JSON.stringify({ ok: true, key, state: input.state, flag: result.flag }, null, 2)}\n`);
-    }
-    else {
+    succeed(input.reporter, { key, state: input.state, flag: result.flag }, () => {
         input.reporter.raw(`Flag "${key}" is now ${input.state} (v${result.flag.version}).\n`);
-    }
+    });
     return { exitCode: 0 };
 }
 // ─── Native @effect/cli command (Phase 4) ───────────────────────────────────
@@ -929,15 +1033,9 @@ export async function runSetState(input) {
 // `runList`/`runCreate`/`runSetState` bodies and the `createFlagAuthoringClient`
 // transport are reused verbatim from the legacy path.
 //
-// JSON-shape MISMATCH (flagged, NOT changed): every flags output is a bespoke
-// shape — `{ ok, flags }`, `{ ok, flag, syncedSnapshots }`, `{ ok:false, error }`,
-// all pretty-printed (2-space) — and NOT the `JsonReporter`
-// `{schema_version, command, ok, data}` envelope. Errors in human mode print
-// `Error: <msg>` to stderr. To preserve the exact bytes the subprocess tests
-// assert, the bodies emit through the legacy `fail()` / `reporter.raw` writers
-// and the handler fails with a silent `exitWith(1)` so `runHandler` does not
-// re-render. TODO(phase-5): reconcile these payloads with the standard envelope
-// once the dispatch swap lets the fixtures move in lockstep.
+// Machine output uses the shared reporter contract: JSON emits one
+// `{schema_version, command, ok, data|error}` envelope and JSON-stream emits
+// start/data-or-error/done events. Human output retains the established text.
 const projectIdOption = Options.text('project-id').pipe(Options.withAlias('project'), Options.optional);
 const appIdOption = Options.integer('app-id').pipe(Options.optional);
 const environmentOption = Options.text('environment').pipe(Options.optional);
@@ -958,12 +1056,13 @@ const identityOptions = {
     runtimeOrigin: runtimeOriginOption,
     cloudflareApiToken: cloudflareApiTokenOption,
 };
-/** Effect twin of `fail()` for the native path: emit the bespoke output, then fail silently. */
-function failEff(json, message) {
+/** Effect twin of `fail()` for the native path, rendered once before a silent exit. */
+function failEff(_json, message, code = 'HSX_E_INPUT_INVALID') {
     return Effect.gen(function* () {
         const reporter = yield* Reporter;
-        if (json) {
-            yield* reporter.raw(`${JSON.stringify({ ok: false, error: message })}\n`);
+        if (reporter.mode === 'json' || reporter.mode === 'ndjson') {
+            yield* reporter.error(code, message);
+            yield* reporter.done(undefined, 1);
         }
         else {
             yield* reporter.rawErr(`Error: ${message}\n`);
@@ -974,16 +1073,20 @@ function failEff(json, message) {
 function cancelEff() {
     return Effect.gen(function* () {
         const reporter = yield* Reporter;
-        yield* reporter.rawErr('Cancelled.\n');
+        if (reporter.mode === 'json' || reporter.mode === 'ndjson') {
+            yield* reporter.error('HSX_E_INPUT_INVALID', 'Cancelled.');
+            yield* reporter.done(undefined, 130);
+        }
+        else {
+            yield* reporter.rawErr('Cancelled.\n');
+        }
         return yield* Effect.fail(exitWith(130));
     });
 }
 /**
  * Synchronous reporter sink for the shared `runList`/`runCreate`/`runSetState`
- * bodies on the native path. These helpers emit verbatim bytes (the bespoke
- * `--json`/human shapes) and so route through `reporter.raw`/`rawErr`, the
- * sanctioned I/O edge, instead of `process.std*`. Mode is derived solely from
- * `--json` so the produced bytes match the legacy path exactly.
+ * bodies on the native path. Machine modes use data/error/done; human mode
+ * retains the established raw text through the sanctioned reporter edge.
  */
 const syncReporter = Effect.gen(function* () {
     const reporter = yield* Reporter;
@@ -1191,16 +1294,15 @@ function resolveClient(opts, config = {}) {
     });
 }
 /**
- * Map a thrown `RuntimeFlagAuthoringError`/`Error` to the legacy bespoke
- * failure. A `CliError` (an already-rendered `failEff`) is re-raised untouched;
- * anything else is rendered like the legacy `try/catch` around the dispatch.
+ * Map a thrown `RuntimeFlagAuthoringError`/`Error` to the standard machine
+ * failure contract while preserving the legacy human message.
  */
 function withClientErrors(json, body) {
     return body.pipe(Effect.catchAll((error) => error instanceof CliError
         ? Effect.fail(error)
         : error instanceof RuntimeFlagAuthoringError
-            ? failEff(json, `Tenant Worker rejected the request (${error.status}): ${error.message}`)
-            : failEff(json, error instanceof Error ? error.message : String(error))));
+            ? failEff(json, `Tenant Worker rejected the request (${error.status}): ${error.message}`, flagTransportErrorCode(error))
+            : failEff(json, error instanceof Error ? error.message : String(error), flagTransportErrorCode(error))));
 }
 const flagsListCmd = Command.make('list', { ...identityOptions, limit: limitOption }, (opts) => runHandler('flags', { json: opts.json }, Effect.gen(function* () {
     const { client } = yield* resolveClient(opts);
@@ -1225,6 +1327,11 @@ function makeCreateCmd(name) {
         if (!file && !wizardAllowed) {
             return yield* failEff(opts.json, 'Require --file <flag-definition.json> for `flags create` outside an interactive terminal.');
         }
+        const machineOutput = opts.json || isMachineOutput();
+        const interactive = isInteractive();
+        if (file && !opts.yes && (machineOutput || !interactive)) {
+            return yield* failEff(opts.json, FLAG_DEFINITION_CONSENT_ERROR);
+        }
         // A definition file is authoritative and never opens context/wizard
         // pickers. If its scope is ambiguous, report the required identity flag.
         const { client, scope } = yield* resolveClient(opts, { allowPrompt: !file });
@@ -1250,6 +1357,7 @@ function makeCreateCmd(name) {
             client,
             scope,
             reporter,
+            yes: opts.yes,
         }));
     })));
 }
@@ -1258,9 +1366,14 @@ const flagsDefineCmd = makeCreateCmd('define');
 function makeSetStateCmd(name, state) {
     return Command.make(name, { ...identityOptions, key: keyOption, yes: yesOption }, (opts) => runHandler('flags', { json: opts.json }, Effect.gen(function* () {
         const key = Option.getOrUndefined(opts.key);
-        if (key === undefined && (isMachineOutput() || !isInteractive())) {
+        if (key === undefined && (opts.json || isMachineOutput() || !isInteractive())) {
             return yield* failEff(opts.json, `Require --key <flagKey> to ${state} a flag.`);
         }
+        if (key !== undefined &&
+            !opts.yes &&
+            (opts.json || isMachineOutput() || !isInteractive())) {
+            return yield* failEff(opts.json, flagStateConsentError(state));
+        }
         const { client } = yield* resolveClient(opts);
         const reporter = yield* syncReporter;
         yield* withClientErrors(opts.json, Effect.tryPromise({
@@ -1321,6 +1434,9 @@ export const flagsCmd = bareFlagsCmd.pipe(Command.withSubcommands([
  */
 function runCreateFromSource(input) {
     return Effect.gen(function* () {
+        const prompts = input.prompts ?? liveFlagConsentPrompts;
+        const machineOutput = input.json || isMachineOutput();
+        const interactive = prompts.isInteractive();
         let parsed;
         try {
             parsed = JSON.parse(input.source);
@@ -1344,16 +1460,28 @@ function runCreateFromSource(input) {
         if (decoded._tag === 'Left') {
             return yield* failEff(input.json, `Invalid flag definition: ${String(decoded.left)}`);
         }
+        if (!machineOutput && interactive) {
+            input.reporter.raw(flagDefinitionPlan(decoded.right, { wizard: false }));
+        }
+        const consent = yield* Effect.promise(() => requestMutationConsent({
+            yes: input.yes,
+            machineOutput,
+            interactive,
+            message: `Create or update flag "${decoded.right.key}"?`,
+            confirm: prompts.confirm,
+        }));
+        if (consent === 'require-yes') {
+            return yield* failEff(input.json, FLAG_DEFINITION_CONSENT_ERROR);
+        }
+        if (consent === 'cancelled')
+            return yield* cancelEff();
         const result = yield* Effect.tryPromise({
             try: () => input.client.defineFlag(decoded.right),
             catch: (cause) => cause,
         });
-        if (input.json) {
-            input.reporter.raw(`${JSON.stringify({ ok: true, flag: result.flag, syncedSnapshots: result.syncedSnapshots }, null, 2)}\n`);
-        }
-        else {
+        succeed(input.reporter, { flag: result.flag, syncedSnapshots: result.syncedSnapshots }, () => {
             input.reporter.raw(`Defined "${result.flag.key}" [${result.flag.type}, ${result.flag.state}, v${result.flag.version}] — synced ${result.syncedSnapshots} snapshot(s).\n`);
-        }
+        });
     });
 }
 //# sourceMappingURL=flags.js.map