@intutic/cli 1.10.0 → 2.0.0

package/dist/commands/judge.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `intutic judge configure` — generate the local artifacts an on-prem
+ * LLM-as-judge needs (LLD #70, model catalog & cohort wizard).
+ *
+ * Deliberately local-artifacts-only: it writes a `litellm_config.yaml` and
+ * prints env / Helm snippets for the operator to apply themselves. It never
+ * calls a remote API to flip anything on. `local_judge` is deliberately NOT
+ * exposed through `PATCH /api/v1/gateways/:id/config`
+ * (`services/control-plane/src/lib/gateway.ts`) — this command respects that
+ * boundary by construction, not by omission.
+ *
+ * The catalog's `ref` (`${provider}/${id}`, e.g. `anthropic/claude-haiku-4-5`)
+ * is already LiteLLM's own `litellm_params.model` format, so a selected
+ * catalog entry needs no translation — see `infra/compose/litellm_config.yaml`
+ * for the hand-written example this generates the same shape as.
+ *
+ * @module
+ */
+import { type SetupIO } from './setup.js';
+export interface JudgeConfigureOpts {
+    /** Where to write the generated litellm_config.yaml. */
+    out?: string;
+}
+/**
+ * Build the litellm_config.yaml content for one judge model — the SAME
+ * shape `infra/compose/litellm_config.yaml` hand-writes for its default
+ * entry, generated instead of copy-pasted.
+ */
+export declare function buildLiteLLMConfigYaml(modelRef: string): string;
+export declare function runJudgeConfigure(opts: JudgeConfigureOpts, io?: SetupIO): Promise<void>;
+//# sourceMappingURL=judge.d.ts.map

package/dist/commands/judge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge.d.ts","sourceRoot":"","sources":["../../src/commands/judge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,YAAY,CAAA;AAExD,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAOD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAoB/D;AAwBD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,GAAE,OAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyD9G"}

package/dist/commands/judge.js

@@ -0,0 +1,118 @@
+/**
+ * `intutic judge configure` — generate the local artifacts an on-prem
+ * LLM-as-judge needs (LLD #70, model catalog & cohort wizard).
+ *
+ * Deliberately local-artifacts-only: it writes a `litellm_config.yaml` and
+ * prints env / Helm snippets for the operator to apply themselves. It never
+ * calls a remote API to flip anything on. `local_judge` is deliberately NOT
+ * exposed through `PATCH /api/v1/gateways/:id/config`
+ * (`services/control-plane/src/lib/gateway.ts`) — this command respects that
+ * boundary by construction, not by omission.
+ *
+ * The catalog's `ref` (`${provider}/${id}`, e.g. `anthropic/claude-haiku-4-5`)
+ * is already LiteLLM's own `litellm_params.model` format, so a selected
+ * catalog entry needs no translation — see `infra/compose/litellm_config.yaml`
+ * for the hand-written example this generates the same shape as.
+ *
+ * @module
+ */
+import { writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import pc from 'picocolors';
+import { judgeModelChoices, findCatalogModel, normalizeModelRef } from '@intutic/shared-types';
+import { createClackIO } from './setup.js';
+/** Uppercase `${PROVIDER}_API_KEY` env var LiteLLM reads for this provider's key. */
+function apiKeyEnvVar(providerId) {
+    return `${providerId.toUpperCase()}_API_KEY`;
+}
+/**
+ * Build the litellm_config.yaml content for one judge model — the SAME
+ * shape `infra/compose/litellm_config.yaml` hand-writes for its default
+ * entry, generated instead of copy-pasted.
+ */
+export function buildLiteLLMConfigYaml(modelRef) {
+    const { provider, id } = normalizeModelRef(modelRef);
+    const litellmModel = provider ? `${provider}/${id}` : id;
+    const alias = id || modelRef;
+    const apiKeyLine = provider ? `      api_key: os.environ/${apiKeyEnvVar(provider)}\n` : '';
+    return (`# Generated by \`intutic judge configure\` (LLD #70). Same shape as\n` +
+        `# infra/compose/litellm_config.yaml's hand-written example — add more\n` +
+        `# model_list entries by hand following that file if you need more than\n` +
+        `# the one judge model this command configured.\n\n` +
+        `model_list:\n` +
+        `  - model_name: ${alias}\n` +
+        `    litellm_params:\n` +
+        `      model: ${litellmModel}\n` +
+        apiKeyLine +
+        `\n` +
+        `general_settings:\n` +
+        `  master_key: os.environ/LITELLM_MASTER_KEY\n`);
+}
+function envBlock(modelAlias) {
+    return [
+        '# Compose (infra/compose/docker-compose.gateway.yml) or your own env file:',
+        'INTUTIC_GATEWAY_LOCAL_JUDGE=true',
+        'LITELLM_LOCAL_URL=http://litellm:4000',
+        'LITELLM_LOCAL_API_KEY=${LITELLM_MASTER_KEY}',
+        `LITELLM_LOCAL_JUDGE_MODEL=${modelAlias}`,
+    ].join('\n');
+}
+function helmSnippet(modelAlias) {
+    return [
+        '# tools/helm/intutic-gateway values (or --set on `helm install`):',
+        'proxy:',
+        '  localJudge: true',
+        'litellm:',
+        '  enabled: true',
+        `  judgeModel: "${modelAlias}"`,
+        '  configMapName: ""  # leave empty to let the chart render one from this litellm_config.yaml; set your own for a pre-existing ConfigMap',
+    ].join('\n');
+}
+export async function runJudgeConfigure(opts, io = createClackIO()) {
+    io.intro(pc.bold('Intutic — On-Prem Judge Configuration'));
+    io.log.info('This writes local files only — it never calls a remote API. local_judge is deliberately ' +
+        'not remotely configurable; apply what this generates yourself.');
+    // Unfiltered: a local LiteLLM instance can serve anything, including a
+    // free-text alias not in the catalog at all.
+    const CUSTOM = '__custom__';
+    const choices = judgeModelChoices({ saasRoutableOnly: false });
+    const pick = await io.select({
+        message: 'Which model should the on-prem judge use?',
+        options: [
+            ...choices.slice(0, 30).map((m) => ({ value: m.ref, label: `${m.displayName} (${m.provider})` })),
+            { value: CUSTOM, label: 'Enter a custom model reference (provider/model, or a local alias)…' },
+        ],
+    });
+    // io.select returns setup.ts's private CANCELLED symbol on Ctrl-C, not
+    // exported for identity comparison here — `typeof pick !== 'string'` is
+    // the correct guard regardless, since every real answer is a string.
+    if (typeof pick !== 'string') {
+        io.outro('Cancelled.');
+        return;
+    }
+    let modelRef = pick;
+    if (pick === CUSTOM) {
+        const custom = await io.text({ message: 'Model reference (e.g. anthropic/claude-haiku-4-5, or a local alias like my-org/local-qwen)' });
+        if (typeof custom !== 'string' || !custom.trim()) {
+            io.outro('Cancelled.');
+            return;
+        }
+        modelRef = custom.trim();
+    }
+    if (!findCatalogModel(modelRef)) {
+        io.log.warn(`'${modelRef}' is not in the known model catalog — proceeding as a custom/local alias.`);
+    }
+    const yaml = buildLiteLLMConfigYaml(modelRef);
+    const outPath = resolve(opts.out ?? './litellm_config.yaml');
+    writeFileSync(outPath, yaml, 'utf-8');
+    io.log.success(`Written to ${outPath}`);
+    const { id: modelAlias } = normalizeModelRef(modelRef);
+    io.note(envBlock(modelAlias || modelRef), 'Environment');
+    io.note(helmSnippet(modelAlias || modelRef), 'Helm values');
+    io.log.warn('If this judge model will also be served by the SHARED (non-local) LiteLLM deployment, adding it to ' +
+        'infra/kubernetes/base/litellm/config.yaml obligates matching entries in providerPricingService.ts\'s ' +
+        'STATIC_FALLBACK_RATES and offline_bundle.json — modelNameParity.test.ts enforces this. Not required ' +
+        'for a purely local/on-prem judge.');
+    io.outro(pc.bold('Done. Apply the env/Helm values above, then restart the gateway.'));
+}
+//# sourceMappingURL=judge.js.map

package/dist/commands/judge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge.js","sourceRoot":"","sources":["../../src/commands/judge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9F,OAAO,EAAE,aAAa,EAAgB,MAAM,YAAY,CAAA;AAOxD,qFAAqF;AACrF,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,GAAG,UAAU,CAAC,WAAW,EAAE,UAAU,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACxD,MAAM,KAAK,GAAG,EAAE,IAAI,QAAQ,CAAA;IAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,6BAA6B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAE1F,OAAO,CACL,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,oDAAoD;QACpD,eAAe;QACf,mBAAmB,KAAK,IAAI;QAC5B,uBAAuB;QACvB,gBAAgB,YAAY,IAAI;QAChC,UAAU;QACV,IAAI;QACJ,qBAAqB;QACrB,+CAA+C,CAChD,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB;IAClC,OAAO;QACL,4EAA4E;QAC5E,kCAAkC;QAClC,uCAAuC;QACvC,6CAA6C;QAC7C,6BAA6B,UAAU,EAAE;KAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,OAAO;QACL,mEAAmE;QACnE,QAAQ;QACR,oBAAoB;QACpB,UAAU;QACV,iBAAiB;QACjB,kBAAkB,UAAU,GAAG;QAC/B,yIAAyI;KAC1I,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAwB,EAAE,KAAc,aAAa,EAAE;IAC7F,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAA;IAC1D,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,0FAA0F;QACxF,gEAAgE,CACnE,CAAA;IAED,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,MAAM,GAAG,YAAY,CAAA;IAC3B,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,2CAA2C;QACpD,OAAO,EAAE;YACP,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YACjG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,oEAAoE,EAAE;SAC/F;KACF,CAAC,CAAA;IACF,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QACtB,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,GAAG,IAAI,CAAA;IACnB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,4FAA4F,EAAE,CAAC,CAAA;QACvI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,2EAA2E,CAAC,CAAA;IACtG,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAA;IAC5D,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACrC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,OAAO,EAAE,CAAC,CAAA;IAEvC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACtD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;IACxD,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,IAAI,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAA;IAE3D,EAAE,CAAC,GAAG,CAAC,IAAI,CACT,qGAAqG;QACnG,uGAAuG;QACvG,sGAAsG;QACtG,mCAAmC,CACtC,CAAA;IAED,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC,CAAA;AACvF,CAAC"}

package/dist/commands/org.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `intutic org create` — create a real org from an already-authenticated
+ * session (tenancy phase 4/7, LLD #65).
+ *
+ * Real org creation now requires DNS domain-ownership verification (LLD #71
+ * follow-up): creating an org auto-provisions a real managed gateway cell,
+ * so an org's claimed domain must be proven before `POST /api/v1/orgs` will
+ * create it. There's no anonymous-compatible verification flow (no session
+ * exists yet to own a verification attempt against), so the old anonymous
+ * `POST /api/v1/auth/signup/org` this command used to call is now closed by
+ * default in production (`INTUTIC_PUBLIC_ORG_SIGNUP`, off unless a
+ * deployment has built its own anonymous verification story) — this command
+ * requires `intutic login` first and drives the same flow the dashboard's
+ * "Create Organization" modal does: start verification, publish the TXT
+ * record it's given, confirm it resolves, then create the org.
+ *
+ * Server side: services/control-plane/src/services/domainVerificationService.ts,
+ * services/control-plane/src/routes/orgs.ts.
+ *
+ * @module
+ */
+interface OrgCreateOpts {
+    dev?: boolean;
+    domain?: string;
+    orgName?: string;
+    region?: string;
+}
+/** `intutic org create` */
+export declare function runOrgCreate(opts: OrgCreateOpts): Promise<void>;
+export {};
+//# sourceMappingURL=org.d.ts.map

package/dist/commands/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../src/commands/org.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA6DH,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AA4CD,2BAA2B;AAC3B,wBAAsB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA+FrE"}

package/dist/commands/org.js

@@ -0,0 +1,159 @@
+/**
+ * `intutic org create` — create a real org from an already-authenticated
+ * session (tenancy phase 4/7, LLD #65).
+ *
+ * Real org creation now requires DNS domain-ownership verification (LLD #71
+ * follow-up): creating an org auto-provisions a real managed gateway cell,
+ * so an org's claimed domain must be proven before `POST /api/v1/orgs` will
+ * create it. There's no anonymous-compatible verification flow (no session
+ * exists yet to own a verification attempt against), so the old anonymous
+ * `POST /api/v1/auth/signup/org` this command used to call is now closed by
+ * default in production (`INTUTIC_PUBLIC_ORG_SIGNUP`, off unless a
+ * deployment has built its own anonymous verification story) — this command
+ * requires `intutic login` first and drives the same flow the dashboard's
+ * "Create Organization" modal does: start verification, publish the TXT
+ * record it's given, confirm it resolves, then create the org.
+ *
+ * Server side: services/control-plane/src/services/domainVerificationService.ts,
+ * services/control-plane/src/routes/orgs.ts.
+ *
+ * @module
+ */
+import { log } from '../lib/logger.js';
+import { loadCredentials, saveCredentials } from '../config/store.js';
+import { resolveControlPlaneUrl } from '../config/paths.js';
+import { createApiClient } from '../lib/api.js';
+import { newIso } from '@intutic/id';
+import { createInterface } from 'node:readline';
+const NOT_AUTHENTICATED = 'Not authenticated. Run `intutic login` first.';
+async function prompt(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+/**
+ * Switches the CLI's stored session to a newly created org's default
+ * workspace. `GET /api/v1/auth/session?X-Workspace-Id` mints a new
+ * refresh token scoped to the target workspace but returns its paired
+ * access token only via an httpOnly cookie (browser-only) — this exchanges
+ * that refresh token for a JSON-returned access token via the normal
+ * refresh endpoint, the same two-step dance a browser reload does
+ * implicitly through its cookie jar.
+ */
+async function switchStoredSessionToWorkspace(controlPlaneUrl, apiKey, targetWorkspaceId) {
+    const sessionRes = await fetch(`${controlPlaneUrl}/api/v1/auth/session`, {
+        method: 'GET',
+        headers: {
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${apiKey}`,
+            'X-Workspace-Id': targetWorkspaceId,
+        },
+    });
+    if (!sessionRes.ok) {
+        const body = await sessionRes.json().catch(() => ({}));
+        throw new Error(body.error || `Failed to switch to the new workspace (HTTP ${sessionRes.status})`);
+    }
+    const session = (await sessionRes.json());
+    const refreshRes = await fetch(`${controlPlaneUrl}/api/v1/auth/refresh`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ refreshToken: session.refreshToken }),
+    });
+    if (!refreshRes.ok) {
+        const body = await refreshRes.json().catch(() => ({}));
+        throw new Error(body.error || `Failed to mint a token for the new workspace (HTTP ${refreshRes.status})`);
+    }
+    const refreshed = (await refreshRes.json());
+    return { ...session, accessToken: refreshed.accessToken };
+}
+/** `intutic org create` */
+export async function runOrgCreate(opts) {
+    log.header('Intutic — Create Organization');
+    const creds = await loadCredentials();
+    if (!creds) {
+        log.error(NOT_AUTHENTICATED);
+        process.exit(1);
+    }
+    const controlPlaneUrl = resolveControlPlaneUrl(opts.dev);
+    log.dim(`Control plane: ${controlPlaneUrl}`);
+    const orgName = opts.orgName ?? (await prompt('Organization name: '));
+    const domain = opts.domain ?? (await prompt('Domain (e.g. acme.com): '));
+    if (!orgName.trim() || !domain.trim()) {
+        log.error('Organization name and domain are both required.');
+        process.exit(1);
+    }
+    const client = createApiClient(controlPlaneUrl, creds.apiKey);
+    let verification;
+    try {
+        verification = await client.post('/api/v1/domain-verification/start', {
+            domain: domain.trim(),
+        });
+    }
+    catch (err) {
+        log.error(`Failed to start domain verification: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    log.success('Verification started. Add this DNS TXT record to prove you own the domain:');
+    log.field('Record name', verification.txtRecordName);
+    log.field('Record value', verification.txtRecordValue);
+    log.dim('  DNS changes can take a few minutes to propagate.');
+    let checked;
+    while (true) {
+        const answer = await prompt('\nPress Enter to check DNS now (or type "q" to abort): ');
+        if (answer.trim().toLowerCase() === 'q') {
+            log.warn('Aborted. Nothing was created.');
+            process.exit(1);
+        }
+        try {
+            checked = await client.get(`/api/v1/domain-verification/${verification.verificationId}`);
+        }
+        catch (err) {
+            log.error(`Failed to check verification status: ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
+        if (checked.status === 'verified') {
+            log.success('Domain verified.');
+            break;
+        }
+        if (checked.status === 'expired') {
+            log.error('This verification has expired. Run this command again to start a new one.');
+            process.exit(1);
+        }
+        log.warn('TXT record not seen yet — still pending.');
+    }
+    try {
+        const org = await client.post('/api/v1/orgs', {
+            orgName: orgName.trim(),
+            domain: checked.domain,
+            verificationId: verification.verificationId,
+            // Omitted entirely when not passed -- the server defaults to its home
+            // region and validates against its configured cell regions.
+            ...(opts.region ? { region: opts.region.trim().toLowerCase() } : {}),
+        });
+        log.success(`Org "${org.name}" created.`);
+        log.field('Org ID', org.orgId);
+        log.field('Org plan', org.planTier);
+        if (org.region)
+            log.field('Gateway region', org.region);
+        log.field('Default workspace', org.workspaceId);
+        const switched = await switchStoredSessionToWorkspace(controlPlaneUrl, creds.apiKey, org.workspaceId);
+        await saveCredentials({
+            apiKey: switched.accessToken,
+            workspaceId: switched.workspaceId,
+            controlPlaneUrl,
+            email: switched.email,
+            storedAt: newIso(),
+        });
+        log.dim(`  Switched your CLI session into the new org's default workspace. Run \`intutic team list --org ${org.orgId}\` ` +
+            'to see it, or `intutic team create --org <org_id> --name <name>` to add another team.');
+    }
+    catch (err) {
+        log.error(`Org creation failed: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=org.js.map

package/dist/commands/org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.js","sourceRoot":"","sources":["../../src/commands/org.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAE/C,MAAM,iBAAiB,GAAG,+CAA+C,CAAA;AA0CzE,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAA;YACV,OAAO,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AASD;;;;;;;;GAQG;AACH,KAAK,UAAU,8BAA8B,CAC3C,eAAuB,EACvB,MAAc,EACd,iBAAyB;IAEzB,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,sBAAsB,EAAE;QACvE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU,MAAM,EAAE;YACnC,gBAAgB,EAAE,iBAAiB;SACpC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACtD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,+CAA+C,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IACpG,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAA0B,CAAA;IAElE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,sBAAsB,EAAE;QACvE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;KAC7D,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACtD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,sDAAsD,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAoB,CAAA;IAE9D,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAA;AAC3D,CAAC;AAED,2BAA2B;AAC3B,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB;IACpD,GAAG,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAA;IAE3C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,eAAe,EAAE,CAAC,CAAA;IAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAA;IAExE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAE7D,IAAI,YAAuC,CAAA;IAC3C,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAA4B,mCAAmC,EAAE;YAC/F,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAA;IACzF,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC,CAAA;IACpD,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,YAAY,CAAC,cAAc,CAAC,CAAA;IACtD,GAAG,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAA;IAE7D,IAAI,OAAkC,CAAA;IACtC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,yDAAyD,CAAC,CAAA;QACtF,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAA4B,+BAA+B,YAAY,CAAC,cAAc,EAAE,CAAC,CAAA;QACrH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrG,SAAQ;QACV,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;YAC/B,MAAK;QACP,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,GAAG,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAA;YACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoB,cAAc,EAAE;YAC/D,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;YACvB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,YAAY,CAAC,cAAc;YAC3C,sEAAsE;YACtE,4DAA4D;YAC5D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAA;QAEF,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,YAAY,CAAC,CAAA;QACzC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;QAC9B,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QACnC,IAAI,GAAG,CAAC,MAAM;YAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QACvD,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAE/C,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QACrG,MAAM,eAAe,CAAC;YACpB,MAAM,EAAE,QAAQ,CAAC,WAAW;YAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,eAAe;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,MAAM,EAAE;SACnB,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,CACL,mGAAmG,GAAG,CAAC,KAAK,KAAK;YAC/G,uFAAuF,CAC1F,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}

package/dist/commands/policy.d.ts

@@ -1,3 +1,6 @@
+import { unsupportedWasmImports, explainWasmImport } from '@intutic/shared-types';
+import { type ApiClient } from '../lib/api.js';
+import type { EnforcementAction, InterventionMode, RiskCategory } from '@intutic/shared-types';
 export declare function runPolicyEnable(policyId: string, opts: {
     dev?: boolean;
 }): Promise<void>;
@@ -8,25 +11,113 @@ export declare function runPolicyRollback(policyId: string, opts: {
     version: string;
     dev?: boolean;
 }): Promise<void>;
+/**
+ * A compliance policy exactly as `GET /api/v1/policies` serializes it: the
+ * `pcas_policies` columns (`packages/db/src/schema.ts`) after a JSON round
+ * trip, so timestamps arrive as ISO strings and nullable columns as `null`.
+ *
+ * `intutic policy export` prints these verbatim and is the documented way to
+ * get policies out of a workspace, which makes this the shape a caller piping
+ * the export into another tool depends on. Written out rather than left as
+ * `any[]` for that reason: a column rename on the control plane should be a
+ * visible change here, not a silently different file on someone's disk.
+ */
+export interface CompliancePolicy {
+    policyId: string;
+    workspaceId: string;
+    name: string;
+    description: string | null;
+    riskCategory: RiskCategory | null;
+    /** Glob matched against the tool name the agent is calling. */
+    targetToolPattern: string;
+    enforcementAction: EnforcementAction;
+    interventionMode: InterventionMode | null;
+    priority: number | null;
+    /** Free-form JSON match conditions — the column is `jsonb` with no schema. */
+    conditions: unknown;
+    isActive: boolean | null;
+    currentVersion: number;
+    createdAt: string;
+    updatedAt: string;
+}
 export declare function runPolicyExport(opts: {
     all?: boolean;
     dev?: boolean;
 }): Promise<void>;
+/**
+ * `intutic policy snapshot` — compile this workspace's policy to disk.
+ *
+ * The snapshot is the dynamic tier: every harness gate reads
+ * `~/.intutic/hooks/policy-snapshot.rules` and enforces the compiled floor and
+ * nothing else when it is missing. Until this command existed the only thing
+ * that ever wrote it was `intutic connect`, so arming the gates meant running a
+ * daemon that also rewrites five harnesses' hook configs, starts a drift
+ * watcher and provisions Valkey. This does the one thing.
+ */
+export declare function runPolicySnapshot(opts: {
+    dev?: boolean;
+}): Promise<void>;
 /**
  * Minimal RequestContext used to validate a rule instantiates and evaluates
  * before install. Mirrors packages/wasm-sdk/assembly/mock_context_allow.json
  * (embedded so `intutic policy install` works outside the monorepo).
  */
 export declare const DEFAULT_ALLOW_MOCK: string;
+/**
+ * Every host function the proxy registers, declared once on this side.
+ *
+ * `tools/scripts/check-wasm-host-imports.js` asserts this equals
+ * `HOST_IMPORTS` in `packages/proxy/src/wasm/host.rs`. The two had already
+ * drifted — this side offered `seed`, the proxy never has — and the drift was
+ * invisible because it only surfaced as a per-request warning in a process
+ * nobody was reading.
+ */
+export declare const HOST_IMPORT_NAMES: readonly ["log_info", "abort", "trace", "read_referenced_file"];
+/**
+ * The guest side of the ABI, resolved from a module's exports.
+ *
+ * These are exactly the three things the proxy runner needs of a rule
+ * (`packages/proxy/src/wasm/runner.rs`): linear memory to pass the context
+ * through, an allocator to reserve space in it, and the entry point.
+ *
+ * Every lookup that produces one is checked at run time — a `.wasm` file can
+ * export anything or nothing, and the compiler cannot know which. Declaring
+ * the shape and asserting a module has it are separate jobs; `resolveGuestAbi`
+ * does the second and names whichever piece is missing.
+ */
+export interface WasmGuestAbi {
+    /** Guest linear memory. Every pointer crossing the boundary indexes into it. */
+    memory: WebAssembly.Memory;
+    /** `allocate(size) -> ptr`, or AssemblyScript's `__new(size, 0) -> ptr`. */
+    allocate(size: number): number;
+    /** The rule entry point: `evaluate(ptr, len) -> i32` verdict code. */
+    evaluate(offset: number, length: number): number;
+}
 /**
  * Instantiate a compiled WASM rule with the standard host imports and run
  * `evaluate` against a JSON-serialized RequestContext. Returns the raw
- * verdict code (0=ALLOW, 1=BLOCK, 2=REDACT). Throws on any instantiation or
+ * verdict code (0=ALLOW, 1=BLOCK, 3=REASK; 2 is a deprecated block). Throws on any instantiation or
  * ABI failure — callers decide how to surface it.
  */
-export declare function instantiateAndEvaluate(wasmBuffer: Uint8Array, mockStr: string, opts?: {
-    forceAnomaly?: boolean;
-}): Promise<number>;
+/**
+ * Re-exported so existing callers and tests keep one import site.
+ *
+ * The implementations live in `@intutic/shared-types` because three surfaces
+ * need them — this CLI, the control plane's upload endpoint, and the SDK test
+ * harness — and each having its own copy is precisely how `seed` came to be
+ * offered here and never registered by the proxy.
+ */
+export declare const unsupportedImports: typeof unsupportedWasmImports;
+export declare const explainUnsupportedImport: typeof explainWasmImport;
+/**
+ * Instantiates a compiled rule with the proxy's host imports and evaluates it
+ * against one mock context, returning the raw verdict code.
+ *
+ * The import set here is the proxy's, not a convenient superset: a rule that
+ * links in this sandbox must link in the proxy, or install validation passes
+ * something the proxy then silently bypasses.
+ */
+export declare function instantiateAndEvaluate(wasmBuffer: Uint8Array, mockStr: string): Promise<number>;
 export declare function runPolicyTest(opts: {
     wasm: string;
     mock: string;
@@ -61,15 +152,58 @@ export declare function buildCompileArgs(opts: {
     out?: string;
     debug?: boolean;
 }): string[];
+/** `GET /api/v1/rule-candidates/:id/source`, as the control plane serves it. */
+export interface CandidateSource {
+    candidateId: string;
+    guardrailId: string | null;
+    status: string;
+    source: string;
+    sourceSha256: string;
+}
+/** Where a fetched candidate source is written: two directories below the project root, which is what its `../../assembly/index` import needs. */
+export declare function candidateSourcePath(candidateId: string): string;
+export declare function candidateOutPath(candidateId: string): string;
+export declare function sourceSha256Of(source: string): string;
+/**
+ * Fetch a candidate's source of record and check it against the hash the
+ * server states. A body that does not hash to its own `sourceSha256` is not
+ * compiled: `/bundle` would refuse the result anyway, and a mismatch here
+ * means something between the control plane and this process changed bytes.
+ */
+export declare function fetchCandidateSource(client: Pick<ApiClient, 'getWithStatus'>, candidateId: string): Promise<CandidateSource>;
+/**
+ * Upload a compiled bundle to its candidate together with the hash of the
+ * source it was compiled from, and print the gate results. The server
+ * recomputes the hash from the candidate row; a bundle built from anything
+ * else is refused before a gate runs.
+ */
+export declare function uploadCandidateBundle(client: Pick<ApiClient, 'postForm'>, candidateId: string, wasmPath: string, sourceSha256: string): Promise<void>;
 export declare function runPolicyCompile(opts: {
     src?: string;
     out?: string;
     debug?: boolean;
+    candidate?: string;
+    upload?: boolean;
+    dev?: boolean;
 }): Promise<void>;
 export declare function runPolicyInstall(opts: {
     wasm: string;
     name?: string;
     priority?: string;
 }): Promise<void>;
+/**
+ * `intutic policy replay <ruleId>` — "prove before enforce": run an installed
+ * or not-yet-active rule against a sample of this workspace's own recent
+ * traffic and report what it would have done, without touching enforcement.
+ *
+ * Uses `postWithStatus` rather than `post`: the 422 the route returns for too
+ * little sampled traffic is an answer this command exists to report, not a
+ * request failure to throw past.
+ */
+export declare function runPolicyReplay(ruleId: string, opts: {
+    limit?: string;
+    since?: string;
+    dev?: boolean;
+}): Promise<void>;
 export declare function runPolicyListLocal(): Promise<void>;
 //# sourceMappingURL=policy.d.ts.map

package/dist/commands/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAsBA,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB9F;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/F;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GACvC,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB3F;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAW7B,CAAA;AAEF;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,OAAO,CAAC,MAAM,CAAC,CAyFjB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAUtF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAQhG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+ChB;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA6BxD"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAE/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AA0C9F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB9F;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/F;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GACvC,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACzC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB3F;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0C9E;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAW7B,CAAA;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,iEAAoB,CAAA;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,MAAM,EAAE,WAAW,CAAC,MAAM,CAAA;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;CACjD;AAwFD;;;;;GAKG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,+BAAyB,CAAA;AACxD,eAAO,MAAM,wBAAwB,0BAAoB,CAAA;AAEzD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CA2JjB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6CvF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAUtF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGxE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAQhG;AAID,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,kJAAkJ;AAClJ,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA4BlI;AAWD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EACnC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,GAAG,CAAC,EAAE,OAAO,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DhB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqEhB;AAwBD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GACtD,OAAO,CAAC,IAAI,CAAC,CAgEf;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CA6BxD"}