@maiaos/cli 0.1.0-canary.44938d4.manual.1

package/README.md

@@ -0,0 +1,382 @@
+# `@maiaos/cli`
+
+> **Publication status:** Source-implemented candidate, canary-only. npm
+> canaries use the
+> `canary` dist-tag for installation evidence and remain
+> `releaseQualified: false`. No stable version or `latest` dist-tag is
+> released.
+
+JSON-first package for the `maia` executable.
+
+The source manifest is prepared for npm packing with exact pnpm 11.20.0, built
+output, offline guidance, and no install lifecycle script. The built executable
+embeds the manifest's exact Node version and exits before command handling when
+the runtime is not Node 24.19.0. The source manifest remains `0.0.0`; release
+tooling prepares an exact canary version only in an isolated pack copy.
+Homebrew is a later channel for the same CLI contract, not a second
+implementation.
+
+This is the first complete client and the qualification boundary for every
+planned Build, Teammates, Rooms, Routines, Skill Studio, Activity, and Advanced
+Runtime Extensions slice. Those domains must work headlessly through node,
+protocol, SDK, and this CLI before Desktop or mobile depend on them. The
+planned exact-version `maia-cli` and `maia-orchestration` Skill bundles and
+their recommendation/install/sync commands are not implemented or present in
+the source registry.
+
+Offline `guidance/maia-cli/SKILL.md` and
+`guidance/maia-orchestration/SKILL.md` copies ship in the npm pack for
+offline inspection of the installed package. They are digest-locked
+markdown guidance, not installed Skills, and they request no capabilities.
+Recommendation, install, and sync remain planned; there is no `skill` or
+`guidance` command family.
+
+Callable foundation commands in the source registry:
+
+- `maia help` / `maia --help` — human text lists the 60 current usage
+  rows. `maia help --json` is the classified command index (no usage dump,
+  `registryDigest`, per-family implemented/candidate counts, budget 2,048 B).
+  `maia help <family> --json` is the allowlisted family page. Availability is
+  only `implemented` or `source_implemented_candidate`. Help `implemented` is
+  the classified index label, not the AGENTS release-gated Implemented
+  vocabulary and not product enablement. This is not an Orca
+  help/`agent-context` pair and does not claim a byte/token win.
+- `maia status`
+- `maia version` / `maia --version`
+- `maia project add <repository>`
+- `maia project list`
+- `maia project show <project-id>`
+- `maia workspace list --project <project-id>`
+- `maia workspace show <workspace-id>`
+- `maia workspace repo add <workspace-id> <repository> --expected-revision <revision>`
+- `maia receipt show <command-id>`
+- `maia receipt list [--limit <1..32>] [--after] [--actor] [--method] [--since] [--until]`
+- `maia runtime probe codex`
+
+The source also exposes the release-disabled neutral execution-selection
+candidate:
+
+- `maia execution catalog`
+- `maia workspace execution show <workspace-id>`
+- `maia workspace execution set <workspace-id> (--profile <profile-id> | --policy <policy-id>) --expected-revision <revision>`
+- `maia workspace execution clear <workspace-id> --expected-revision <revision>`
+
+Set and clear map to the single receipt-backed
+`workspace.execution.configure` protocol mutation. The exact built-in catalog
+contains one `trusted_host` local provider, one local profile, and one default
+policy. Resolution remains explicitly `unavailable` with reason
+`local_provider_unbound`; these commands do not bind a provider, create or
+launch an execution instance, start a process, or grant local or remote
+execution authority.
+
+The source also exposes `maia runtime list` as a blocked, release-disabled
+candidate for the closed installed-harness inventory. `@maiaos/sdk`
+`listInstalledHarnesses` returns the full protocol catalog. The CLI `--json`
+projection is the compact `runtime.list` item list (`harnessId`, `status`,
+and `reason` when present): 337 UTF-8 bytes
+(`ceil(337/4) = 85` token estimate) for the mixed four-item page, under the
+2,048-byte list-summary budget. Installed Orca `1.4.182` has no equivalent
+installed-harness command; this slice does not claim a byte/token win against
+`account list` or `agent-context`. Omitted protocol fields are schema-v1
+invariants (`displayName` from `harnessId`, `method` `harness.installed.list`,
+`schemaVersion` 1, `selected`/`authorized` false, `detected` from `status`).
+Human output stays one terse TSV row per item. The command does not launch,
+select, authorize, or version-probe a harness.
+
+The source also exposes the macOS-only, release-disabled Codex integration
+authorization family:
+
+- `maia integration plan codex`
+- `maia integration apply <plan-id> [--command-id <id>]`
+- `maia integration status codex`
+- `maia integration remove codex [--command-id <id>]`
+
+All four commands use the authenticated local node through `@maiaos/sdk`.
+Callers cannot provide an executable path, digest, owner allowlist, adapter, or
+policy revision. Plan resolves only the closed catalog from startup-captured
+`PATH` and launches nothing; apply revalidates the unchanged five-minute plan;
+status returns exactly one bounded item; remove persists the fence before
+manager-owned cleanup and returns exit 76 with a lossless `cleanup_unknown`
+result when cleanup cannot be proved. The exact built CLI/SDK/authenticated-node
+path is source-qualified at revision
+`80631fb5c9adeb38ab58b12a7db80647161d5871`, including replay, restart, expiry,
+hostile replacement, active-tree removal, bounded output, and
+`cleanup_unknown` recovery. The source candidate does not enable Codex
+Sessions/Turns and is not release-qualified.
+
+The source also exposes the release-disabled Pi RPC authorization, probe, and
+conversation-only grammar:
+
+- `maia integration plan pi-rpc`
+- `maia integration apply <plan-id> --integration pi-rpc [--command-id <id>]`
+- `maia integration status pi-rpc`
+- `maia integration remove pi-rpc`
+- `maia runtime probe pi-rpc`
+
+These commands are callable source candidates, not release-enabled product
+behavior or evidence that Pi is installed or available. Their separate
+schema-v14 authorization projects the exact owner set `pi-rpc-probe`,
+`pi-rpc-session`. The probe performs `set_auto_retry`,
+`set_auto_compaction`, and `get_state`, with both automatic-work flags required
+false. Apply requires the explicit integration selector so an arbitrary plan
+identifier cannot choose authority implicitly; omitting it preserves the
+existing Codex apply grammar.
+
+- `maia session create <workspace-id> --runtime <codex|pi> [--profile <codex|pi-rpc>]`
+- `maia session list --project <project-id>`
+- `maia session show <session-id>`
+- `maia session events <session-id>`
+
+The session ledger commands above are source-callable foundations. The source
+also exports `maia session start <session-id> --expected-revision <revision>`.
+For runtime `pi` and profile `pi-rpc`, it routes to the exact active Pi
+authorization, workspace-attributed process owner, and one private Pi 0.84.2
+v3 Session file. Codex activation remains blocked outside its exact internal
+test authority. Neither classification nor presence in `maia help --json`
+qualifies this source candidate.
+
+The source now routes `turn send`, `turn show`, and `turn interrupt` through
+the ordinary CLI/SDK family. Pi send/interrupt require the exact active
+conversation authorization; Pi history remains showable after authorization
+loss. Ordinary Codex Turn content remains denied without its internal source
+authority. The Pi candidate accepts at most one active prompt per Session,
+persists assistant-only completion, and supports bounded interrupt, but the
+clean runtime environment has no credential/provider binding. No real model
+turn, tool, approval, attachment, repository mutation, or release enablement is
+claimed.
+H2 and its current G2 record are source-qualified only for revision
+`e7f784b4aa567d19311235d729b047f96c9dfc7c` and its exact bound artifact;
+prior records remain sealed for their own identities. Ordinary Darwin-arm64
+composition verifies the embedded sibling helper but rejects every process
+consumer before native preparation. The exact manager migrations,
+current-source real-Codex lifecycle, and bounded coding-task proofs now pass
+only for their named revisions. The CLI session/turn consumers remain blocked
+and release-disabled. A1 installs `maia` and `maia-node` from exact npm
+tarballs; package closure, integrity/provenance, carried-helper identity, clean
+installation, and an explicit release decision remain. Homebrew is a later CLI
+channel. The retained macOS F1/H2 manifest remains historical exact-artifact
+evidence; its app/DMG deficits belong to later Desktop/native qualification.
+
+The source also exposes the local-v1 orchestration candidate:
+
+- `maia run create <workspace-id> <terminal-id> --graph-stdin`
+- `maia run list --workspace <workspace-id>`
+- `maia run show <run-id>`
+- `maia run task list <run-id>`
+- `maia run task show <run-id> <task-id>`
+- `maia run dispatch show <run-id>`
+- `maia run inbox check <run-id>` / `maia run inbox ack <run-id>`
+- `maia run question open <run-id> <dispatch-id> --body-stdin`
+- `maia run question reply <run-id> <dispatch-id> <question-id> --answer-stdin`
+- `maia run question cancel <run-id> <dispatch-id> <question-id>`
+- `maia run dispatch settle-terminal <run-id> <dispatch-id>`
+
+The CLI is only a compact SDK client. Task graphs, Question bodies, and reply
+answers use bounded fatal-UTF-8 stdin readers that advance one chunk on demand;
+the bounded Question subject remains an explicit `--subject` argv value. Check
+is non-blocking, acknowledgement is one Delivery at a time with compact
+CLI stdout rather than a protocol dump, and no command
+starts a Worker, model turn, PTY, planner, waiter, execution instance, provider,
+automation, or remote authority. This family is source-implemented and
+built-boundary tested, but it remains blocked and release-disabled.
+
+`maia context show --json` is a source-implemented, release-disabled Client
+principal candidate. It calls the transport-neutral SDK `showCurrentContext`
+query and prints a compact, deterministic projection of the authenticated
+local Client, `actor_local_user`, allowed actions, and context revision. It
+omits `nodeId` until ADR-014 NodeBootstrap allocates an authoritative value.
+It does not accept an identity override, read cwd/Git/project files
+as authority, expose an attachment, or let `--session-id` turn a selector into
+caller identity. Session/Run/Dispatch principals remain absent. Explicit
+`run inbox check` prints a compact CLI/human projection of the lossless SDK
+result. Inbox `--scope current` waits for a mailbox-owning principal.
+`run create`, `run show`, `run question open|reply|cancel`, and
+`run dispatch settle-terminal` share one compact aggregate CLI/human
+projection; `@maiaos/sdk` remains lossless over the full protocol
+aggregate.
+
+`maia receipt list` is a bounded newest-first identity index. Default page
+size is 8 and the maximum is 32. Compact `--json` is
+`{ command, count, items, nextCursor? }` with no `result`, digest, or path
+(measured wrapped UTF-8: empty 69, one item object 195, default 8 + cursor
+1,662, max 32 6,341). Human TSV is
+`receipt.list\t<count>\t<cursor|->` then identity rows. Classified
+`maia help receipt --json` marks both `receipt list` and `receipt show`
+`implemented`; the public v1 line remains a source-implemented candidate and
+is not release-qualified. `receipt show` stays keyed recovery after a known
+command ID.
+
+The terminal commands are a blocked, release-disabled, source-implemented
+macOS live-terminal candidate, not release-qualified product behavior.
+Installed help identifies this status directly; callable source is not evidence
+of release enablement or qualification.
+CLI `--json` now projects compact terminal list/show/events/read envelopes;
+`@maiaos/sdk` and `@maiaos/protocol` stay lossless. Measured compact bytes
+and the `winClaim: false` near-miss posture are owned by
+[token-efficiency budgets](../README.md#cli-node-implementation-plan--token-efficiency-budgets).
+Interactive creation selects only the node-owned fixed login-shell profile;
+callers supply no executable, argv, environment, or cwd. The exact 13-command
+active public surface is create/list/show/events/read, controller
+request/show/acquire/release, input write, resize/signal/close. Observer
+attach/check/detach/resync, controller renew, restart, delete, and reconcile
+are unavailable or inert. The compatibility tier is cooperative local-user
+execution, not hard containment, and it grants no runtime, model, worker,
+plugin, or remote authority.
+
+Add `--json` for a stable JSON success or error object. Successful output is
+written to stdout; errors are written to stderr and exit with status 64 for
+invalid or unimplemented input, 66 for a missing requested record, 69 for an
+unavailable node, 74 for a request deadline, 75 for another retryable operation
+failure, 76 when the mutation outcome is unknown, 77 for denied authority, and
+70 for other software/data-integrity failures. Unknown codes fail to 70 rather
+than being misclassified as usage errors. Unexpected CLI implementation
+failures are redacted, non-retryable `internal_error` results at 70; they are
+never mislabeled as node unavailability.
+`maia status` also renders the authenticated process-resource pressure,
+admission headroom, active/fenced/cleanup-unknown and watcher counts,
+capability truth, and one bounded next step. Human output remains the operator
+hatch for per-metric trees; `--json` is the compact agent projection and
+`@maiaos/sdk` `readStatus` stays lossless. macOS
+output says hard limits are unavailable and observed-pressure termination is
+disabled. It may direct the local user to
+close a terminal or inspect cleanup uncertainty, but it never claims or invokes
+automatic PID/PGID cleanup.
+`runtime probe codex` and the release-disabled `runtime probe pi-rpc`
+candidate always write their typed compatibility result to stdout; `ready`
+exits 0, `unavailable` exits 69, and `incompatible` exits 70 so shell
+automation cannot mistake inspection data for runtime readiness. A Pi result
+remains explicitly request-scoped, no-model, and `releaseQualified: false`.
+
+Mutations generate their command ID before transport dispatch. If the
+connection fails after the node may have committed, JSON errors include a
+bounded `recovery.commandId`; human output prints the exact
+`maia receipt show <command-id>` recovery command. Reuse that ID to inspect or
+idempotently replay the operation instead of starting a new mutation.
+Unattended automations and LLM callers should generate and durably retain an
+explicit `--command-id` before invoking a mutation. The CLI-generated ID is a
+human-convenience fallback that survives an ambiguous response while the CLI
+process remains alive; a hard process kill before output can still lose that
+locally generated identifier. Recover it with `maia receipt list` when the
+command ID is unknown, then `maia receipt show <command-id>` for the keyed
+result.
+The parser rejects more than 32 arguments, tokens above 4 KiB, or commands
+above 16 KiB before loading operational modules; orchestration graph content
+uses the independently bounded stdin path rather than that argv ceiling.
+Hostile values are never echoed into diagnostics. List operations default to
+two records except `receipt list`, which defaults to 8 and accepts at most 32. Registry
+pages accept an explicit maximum of 100; session and terminal event pages
+accept at most 32 records, terminal reads accept at most eight chunks, and node
+event pages are also bounded by encoded bytes.
+
+Node-facing commands lazily load the Node SDK adapter, securely resolve the
+current profile's private descriptor, authenticate over local IPC, and verify
+the live process identity. They do not start or stop a node. Project
+registration records one canonical Git repository and a `local-main`
+workspace; repository attachment is explicit and optimistic-revision guarded.
+The node retains local paths while public JSON uses opaque location IDs. The
+session ledger commands create and inspect a durable node-owned record. The
+blocked `session start` candidate commits its receipt and activation intent
+before the node launches Codex; its asynchronous result is observed through
+`session show` and `session events` when exercising candidate source.
+Git-worktree creation/removal, structured Session attachments, approvals,
+steering, release-qualified interruption, diffs, automation, remote terminal
+operation, and network command families remain unimplemented. Client node registration,
+`--node` selection, create/pair/use/forget flows, and every bootstrap provider
+also remain planned only; the current profile resolver is not a multi-company
+authority switcher. The candidate Turn family is
+omitted from ordinary help and fails closed at both CLI and node boundaries.
+Terminal candidates may appear in alpha help but must not be presented as
+release-qualified or release-enabled.
+
+ADR-015 accepts two later CLI families: registry-backed `maia api
+list/show/invoke` and Session-bound `maia notebook` lifecycle, execute,
+variable, checkpoint, branch, handoff, and close commands. None is present in
+the source registry or installed help. `maia api` will project the exact built
+Public operation catalog generated by `@maiaos/protocol` through `@maiaos/sdk`; it
+will exclude CLI presentation, NodeBootstrap, roadmap-only, database, Worker-
+administration, provider-internal, and private service behavior. Generic
+invocation must preserve the named operation's validation, Capability,
+Approval, revision, idempotency, Receipt, cancellation, and availability
+semantics.
+
+The first Notebook slice stores one active Notebook per Session and returns an
+explicit containment-unavailable result for execution. The CLI never evaluates
+TypeScript, owns Notebook state, or supervises its Runtime process. Execution
+remains blocked until A6/W3 hard containment and the canonical recovery,
+security, limit, cross-Harness, and product-value gates pass. See the
+[accepted Notebook contract](../../services/README.md#execution--portable-notebooks)
+and [M3.25/M6 roadmap split](../README.md#cli-roadmap--m325-public-operation-catalog-and-notebook-records).
+
+Every future node-facing command must follow this dependency chain:
+
+```text
+@maiaos/cli ──► @maiaos/sdk ── authenticated local IPC ──► maia-node
+                    ╲                                 ╱
+                     ╲══► @maiaos/protocol ◄═══════════╱
+```
+
+The CLI owns argument parsing, terminal interaction, and human/JSON/NDJSON
+presentation. `@maiaos/sdk` owns commands, queries, subscriptions, validation,
+cancellation, cursors, and local or remote transport adapters. The CLI must not
+open node IPC directly, read node storage, supervise an agent runtime, or
+silently compete with the desktop lifecycle owner.
+
+The source keeps operational modules behind dynamic boundaries, and the build
+tree-shakes and minifies the complete entry into one standalone executable.
+The sealed macOS F1 CLI artifact is 152,823 bytes with SHA-256
+`51ecc0d535314978550b5e0bd7169e28ae999353ff98cf509944dee1ea12c367`;
+33 CLI tests passed and the full repository `pnpm check` was green. This exact
+snapshot measured built CLI status at 66.62 ms p95 in its local artifact-bound
+startup run. The earlier 2026-08-10 Apple M4 Pro/repository-pinned Node 24.19.0
+session-activation, runtime-probe, and
+standalone-minification artifact is 143,119 bytes and measured 62.86 ms p95 across 30 real
+`maia status --json` processes and emitted exactly 324 bytes per response.
+That retained output-size evidence predates the process-resource health fields
+and does not qualify the current source-candidate response size.
+Help/version remain dependency-light; their latest
+dedicated 30-process measurements predate this session-activation artifact and are not
+attributed to it. The bundle has a linked external source map, metafile,
+exact-input notices, and a CycloneDX SBOM tied to its SHA-256 digest. A copied
+artifact test proves version output without package metadata or dependencies.
+The earlier unavailable-terminal pack-layout and production-deploy observations are recorded in the
+[benchmark ledger](../../services/README.md#benchmarks--historical-durable-unavailable-terminal-footprint-decision);
+the local-v1 orchestration artifact and latency observation is recorded in the
+[same ledger](../../services/README.md#benchmarks--local-v1-orchestration-candidate). The
+equivalent-feature comparison remains a later gate.
+
+The sealed live-terminal standalone predecessor is 217,323 bytes with SHA-256
+`7f74874f5d87622588cf5538847e36cfbe43da17b37bea7a1e2c9efeaaa5eb`,
+4.986449% above its then-strict 207,001-byte reference. The coordinator later
+approved one new one-time standalone comparison identity: 248,047 bytes with
+SHA-256
+`905b3a533cd504d9af54c20a31a51d301aad6c4f182cd13899f89442eee23ed7`.
+The hard ceiling remains 262,144 bytes; this identity does not raise that
+limit, is not a blanket waiver, and does not qualify the terminal product, F1,
+or a release. The live-terminal package-layout predecessor remains 250,058
+packed bytes, 1,168,775 unpacked bytes, and 106 entries. After omitting
+declaration maps, unpublished-`src/` library JavaScript maps, and the unused
+bin declaration emit, the published CLI pack comparison identity is 1,043,804
+unpacked bytes and 71 entries; the exact packed archive bytes are owned by the
+benchmark ledger so this tarball README cannot oscillate against its own
+archive size. The collapsed SDK comparison identity is 17,997 packed bytes,
+85,879 unpacked bytes, and 8 entries. Direct dependencies remain two, bundled dependencies remain zero, and
+the standalone SBOM remains four components and five dependency nodes. Local
+`dist` still keeps the linked standalone `dist/bin/maia.mjs.map`, compact
+esbuild metafile, notices, and digest-bound SBOM. Future growth compares
+against the collapsed identities and the 248,047-byte standalone identity
+under the unchanged 262,144-byte ceiling. See the
+[owning decision](../../services/README.md#benchmarks--sdkcli-collapsed-pack-and-standalone-comparison-identity-approved)
+and the
+[live-terminal predecessor](../../services/README.md#benchmarks--live-terminal-sdkcli-package-footprint-baseline-decision-approved).
+
+A future explicit foreground `maia` device-capability host may answer approved
+node invocations while the process remains running. That planned role uses a
+separate host identity and grant and never turns ordinary CLI commands into
+ambient desktop authority. No such CLI surface exists today; see
+[Device capabilities](../../services/README.md#device-capabilities).
+
+See the [Maia CLI roadmap](../README.md#cli-roadmap),
+[canonical roadmap](../../ROADMAP.md), and
+[ADE parity ledger](../README.md#ade-parity) for the planned project,
+workspace, terminal, runtime, session, orchestration, Public operation catalog,
+Notebook, automation, and headless contracts.

package/dist/bin/maia.NOTICES.txt

@@ -0,0 +1,31 @@
+Maia CLI third-party notices
+
+Generated from the exact esbuild input graph. Do not edit by hand.
+
+================================================================================
+effect 4.0.0-beta.106
+Declared license: MIT
+Bundled source: node_modules/.pnpm/effect@4.0.0-beta.106/node_modules/effect
+
+--- LICENSE ---
+MIT License
+
+Copyright (c) 2023 Effectful Technologies Inc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/bin/maia.cdx.json

@@ -0,0 +1,138 @@
+{
+  "$schema": "https://cyclonedx.org/schema/bom-1.6.schema.json",
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "bom-ref": "@maiaos/local-ipc@0.1.0-canary.44938d4.manual.1",
+      "name": "@maiaos/local-ipc",
+      "properties": [
+        {
+          "name": "maia:source-kind",
+          "value": "workspace"
+        },
+        {
+          "name": "maia:source-path",
+          "value": "packages/local-ipc"
+        }
+      ],
+      "purl": "pkg:npm/%40maiaos/local-ipc@0.1.0-canary.44938d4.manual.1",
+      "scope": "required",
+      "type": "library",
+      "version": "0.1.0-canary.44938d4.manual.1"
+    },
+    {
+      "bom-ref": "@maiaos/protocol@0.1.0-canary.44938d4.manual.1",
+      "name": "@maiaos/protocol",
+      "properties": [
+        {
+          "name": "maia:source-kind",
+          "value": "workspace"
+        },
+        {
+          "name": "maia:source-path",
+          "value": "packages/protocol"
+        }
+      ],
+      "purl": "pkg:npm/%40maiaos/protocol@0.1.0-canary.44938d4.manual.1",
+      "scope": "required",
+      "type": "library",
+      "version": "0.1.0-canary.44938d4.manual.1"
+    },
+    {
+      "bom-ref": "@maiaos/sdk@0.1.0-canary.44938d4.manual.1",
+      "name": "@maiaos/sdk",
+      "properties": [
+        {
+          "name": "maia:source-kind",
+          "value": "workspace"
+        },
+        {
+          "name": "maia:source-path",
+          "value": "packages/sdk"
+        }
+      ],
+      "purl": "pkg:npm/%40maiaos/sdk@0.1.0-canary.44938d4.manual.1",
+      "scope": "required",
+      "type": "library",
+      "version": "0.1.0-canary.44938d4.manual.1"
+    },
+    {
+      "bom-ref": "effect@4.0.0-beta.106",
+      "licenses": [
+        {
+          "license": {
+            "name": "MIT"
+          }
+        }
+      ],
+      "name": "effect",
+      "properties": [
+        {
+          "name": "maia:source-kind",
+          "value": "third-party"
+        },
+        {
+          "name": "maia:source-path",
+          "value": "node_modules/.pnpm/effect@4.0.0-beta.106/node_modules/effect"
+        }
+      ],
+      "purl": "pkg:npm/effect@4.0.0-beta.106",
+      "scope": "required",
+      "type": "library",
+      "version": "4.0.0-beta.106"
+    }
+  ],
+  "dependencies": [
+    {
+      "dependsOn": [
+        "@maiaos/local-ipc@0.1.0-canary.44938d4.manual.1",
+        "@maiaos/protocol@0.1.0-canary.44938d4.manual.1",
+        "@maiaos/sdk@0.1.0-canary.44938d4.manual.1",
+        "effect@4.0.0-beta.106"
+      ],
+      "ref": "@maiaos/cli@0.1.0-canary.44938d4.manual.1"
+    },
+    {
+      "dependsOn": [],
+      "ref": "@maiaos/local-ipc@0.1.0-canary.44938d4.manual.1"
+    },
+    {
+      "dependsOn": [],
+      "ref": "@maiaos/protocol@0.1.0-canary.44938d4.manual.1"
+    },
+    {
+      "dependsOn": [],
+      "ref": "@maiaos/sdk@0.1.0-canary.44938d4.manual.1"
+    },
+    {
+      "dependsOn": [],
+      "ref": "effect@4.0.0-beta.106"
+    }
+  ],
+  "metadata": {
+    "component": {
+      "bom-ref": "@maiaos/cli@0.1.0-canary.44938d4.manual.1",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "79cea5139557653509c7100ff027d9169503d707cefb367f66bbf5382f3de671"
+        }
+      ],
+      "name": "@maiaos/cli",
+      "type": "application",
+      "version": "0.1.0-canary.44938d4.manual.1"
+    },
+    "properties": [
+      {
+        "name": "maia:artifact",
+        "value": "dist/bin/maia.mjs"
+      },
+      {
+        "name": "maia:generator",
+        "value": "apps/cli/scripts/build-executable.mjs"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}