@hyperscale0/cli 1.0.0-beta.30 → 1.0.0-beta.32

package/README.md

@@ -14,15 +14,40 @@ Use `bunx @hyperscale0/cli@latest` or `npx @hyperscale0/cli@latest`
 without a global install. Browser login requests read-only scopes through
 portal consent. Request different scopes with `auth login --scopes <scope,...>`.
 The login summary shows the authority actually returned by the server.
+Headless email login uses `auth login --email founder@example.com --no-browser`
+in sandbox or live. The password prompt requires a TTY. Passwords and temporary sessions never
+enter files or saved replay requests. Use browser sign-in for terms.
+Default scopes include blueprints:read for `compose check`. Creation requires
+explicit reauthorization:
+
+```sh
+env -u HYPERSCALE_TOKEN hyperscale auth login --base-url https://dev.hyperscale0.ai --environment sandbox --scopes activity:read,billing:read,blueprints:read,catalog:read,finance:read,products:read,blueprints:write
+```
+
 Headless callers can use `auth login --no-browser --token <pat>`.
 
 ## Product commands
 
 `product select <id>` saves a Product. Member PATs use that Product's route.
-`product actions` lists the selected Build's exact public action names.
-`product run <instrument.action> --input-file request.json` runs one.
-Product API keys still work through `HYPERSCALE_API_KEY` or `--api-key`.
-The server's frozen operation set resolves aliases, never the bundled catalog.
+Use a Product API key in `HYPERSCALE_API_KEY` for object operations.
+Keep Product identity in the input and omit the global `--product` flag:
+
+```sh
+hyperscale call product.objects.discover --input '{"productId":"<product-id>"}' --json
+hyperscale call product.objects.create --input '{"productId":"<product-id>","kind":"<kind>"}' --idempotency-key object-001 --json
+hyperscale call product.objects.actions --input '{"productId":"<product-id>","kind":"<kind>","objectId":"<object-id>"}' --json
+hyperscale call product.objects.execute --input-file action.json --idempotency-key action-001 --json
+```
+
+Copy action.name, productBuildId, digest and target from the chosen available
+action into action.json. Also include productId, kind, objectId, expectedRevision
+from the actions response, and required fields and input. Copy instanceId when
+present in target. Object creation never enters an agreement or moves money.
+Use product.objects.list and product.objects.retrieve for stored objects.
+See https://hyperscale0.ai/docs/runtime.md for the complete request shape.
+
+Low-level `product actions` and `product run` remain for admitted operations.
+Instrument creation stays internal to object attachment execution.
 
 `ops list --catalog` browses catalog command data without authentication.
 `ops list` discovers operations for the active credential and Product.
@@ -30,18 +55,16 @@ The server's frozen operation set resolves aliases, never the bundled catalog.
 `compose check/plan/apply <file.hsx>` uses the server composer.
 Run `hyperscale help <command>` for options and examples.
 
-## Review and resume
+## Resume
 
-HTTP 409 `approval_required` prints the server review URL, approval request
-ID, waiting state and a local resume reference. Review happens in the browser.
+A transport failure or interrupted dispatch prints a local resume reference.
 Then run `hyperscale resume <reference>`. Resume replays the same origin,
 environment, credential, path, body bytes and idempotency key from secure local
-storage. Body and credential overrides are refused. `--yes` cannot approve
-money. Approval is not evidence of execution.
+storage. Body and credential overrides are refused.
 
 A lost response does not mean failure. Keep the printed operation reference
 and read its status before retrying. Resume never creates a new idempotency key.
-Successful requests remove their saved credential copy. Review and uncertain
+Successful requests remove their saved credential copy. Uncertain
 requests remain local until they complete. Logout removes the login credential;
 it does not revoke separately saved pending requests. Use portal token revocation
 if those requests must lose server authority.
@@ -50,9 +73,7 @@ if those requests must lose server authority.
 
 `--json` writes success to stdout and one error object to stderr on failure.
 Errors retain HTTP status, code, message, fix, details and available correlation
-IDs. Approval details include `approvalRequestId`, `reviewUrl`, `state`
-and `resumeReference`. Exit 0 means success, 1 means failure or waiting for
-review, and 2 means composer refusal. JSON help is also available.
+IDs. Exit 0 means success, 1 means failure, and 2 means composer refusal. JSON help is also available.
 
 Human output honors non-TTY streams, narrow terminals and NO_COLOR, including
 an empty NO_COLOR value. Identifiers are never shortened.