@miosa/cli 1.1.8 → 1.1.11

package/dist/commands/actions.js

@@ -0,0 +1,222 @@
+import chalk from "chalk";
+import { ActionAuthorityClient } from "../action-authority.js";
+import { MiosaClient } from "../client.js";
+import { loadConfig } from "../config.js";
+import { renderTable } from "../ui/table.js";
+import { handleError, isJsonMode, printJson } from "./util.js";
+function authority() {
+    return new ActionAuthorityClient(new MiosaClient(loadConfig()));
+}
+function parseJson(value) {
+    if (!value)
+        return {};
+    const parsed = JSON.parse(value);
+    if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") {
+        throw new Error("--params and --constraints must be JSON objects.");
+    }
+    return parsed;
+}
+export function register(program) {
+    const actions = program
+        .command("actions")
+        .description("Inspect and manage unified MIOSA agent-action authority");
+    actions
+        .command("catalog")
+        .description("List server-owned, version-pinned action capabilities")
+        .option("--json", "Output JSON")
+        .action(async (opts) => {
+        try {
+            const catalog = await authority().catalog();
+            if (isJsonMode(opts))
+                return printJson({ data: catalog });
+            renderTable(catalog, [
+                { header: "ACTION", key: "name", width: 30 },
+                { header: "VERSION", key: "version", width: 10 },
+                { header: "RISK", key: "risk", width: 12 },
+                { header: "SCOPE", key: "scope", width: 12 },
+                { header: "APPROVAL", key: "approval", width: 12 },
+            ]);
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    actions
+        .command("check <capability>")
+        .description("Ask the authority whether one exact invocation may run")
+        .option("--params <json>", "Exact action parameters", "{}")
+        .option("--workspace <id>", "Workspace scope")
+        .option("--invocation-id <id>", "Stable caller-provided invocation ID")
+        .option("--json", "Output JSON")
+        .action(async (capability, opts) => {
+        try {
+            const decision = await authority().authorize(capability, parseJson(opts.params), {
+                workspaceId: opts.workspace,
+                invocationId: opts.invocationId,
+            });
+            if (isJsonMode(opts))
+                return printJson(decision);
+            console.log(decision.decision === "allow"
+                ? chalk.green("ALLOW")
+                : decision.decision === "pending_approval"
+                    ? chalk.yellow("PENDING APPROVAL")
+                    : chalk.red("DENY"));
+            if (decision.approval_request_id) {
+                console.log(`Approval request: ${decision.approval_request_id}`);
+            }
+            if (decision.receipt_id)
+                console.log(`Receipt: ${decision.receipt_id}`);
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    const approvals = actions
+        .command("approvals")
+        .description("Manage one-time approvals");
+    approvals
+        .command("list")
+        .option("--status <status>", "Filter by status")
+        .option("--json", "Output JSON")
+        .action(async (opts) => {
+        try {
+            const rows = await authority().approvals(opts.status);
+            if (isJsonMode(opts))
+                return printJson({ data: rows });
+            renderTable(rows, [
+                { header: "ID", key: "id", width: 12 },
+                { header: "ACTION", key: "capability_name", width: 28 },
+                {
+                    header: "PRINCIPAL",
+                    key: (row) => `${row.principal_type}:${row.principal_id}`,
+                    width: 28,
+                },
+                { header: "STATUS", key: "status", width: 12 },
+                { header: "CREATED", key: "inserted_at", width: 24 },
+            ]);
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    for (const decision of ["approve", "deny"]) {
+        approvals
+            .command(`${decision} <id>`)
+            .description(`${decision === "approve" ? "Approve" : "Deny"} one exact invocation`)
+            .option("--json", "Output JSON")
+            .action(async (id, opts) => {
+            try {
+                const result = await authority().resolveApproval(id, decision);
+                if (isJsonMode(opts))
+                    return printJson({ data: result });
+                console.log(`${result.id}: ${result.status}`);
+            }
+            catch (error) {
+                handleError(error);
+            }
+        });
+    }
+    const grants = actions
+        .command("grants")
+        .description("Manage standing action grants");
+    grants
+        .command("list")
+        .option("--status <status>", "Filter by status")
+        .option("--json", "Output JSON")
+        .action(async (opts) => {
+        try {
+            const rows = await authority().grants(opts.status);
+            if (isJsonMode(opts))
+                return printJson({ data: rows });
+            renderTable(rows, [
+                { header: "ID", key: "id", width: 12 },
+                { header: "ACTION", key: "capability_name", width: 28 },
+                {
+                    header: "PRINCIPAL",
+                    key: (row) => `${row.principal_type}:${row.principal_id}`,
+                    width: 28,
+                },
+                { header: "STATUS", key: "status", width: 12 },
+                {
+                    header: "EXPIRES",
+                    key: (row) => row.expires_at ?? "never",
+                    width: 24,
+                },
+            ]);
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    grants
+        .command("create <capability>")
+        .requiredOption("--principal-type <type>", "user, api_key, osa, optimal, schedule, opencomputer, mcp, or service")
+        .requiredOption("--principal-id <id>", "Exact principal ID")
+        .option("--workspace <id>", "Optional workspace restriction")
+        .option("--expires-at <iso8601>", "Optional expiration")
+        .option("--constraints <json>", "Additional fail-closed constraints", "{}")
+        .option("--json", "Output JSON")
+        .action(async (capabilityName, opts) => {
+        try {
+            const client = authority();
+            const capability = await client.requireCapability(capabilityName);
+            const grant = await client.createGrant({
+                capability: {
+                    name: capability.name,
+                    fingerprint: capability.fingerprint,
+                },
+                principal_type: opts.principalType,
+                principal_id: opts.principalId,
+                ...(opts.workspace ? { workspace_id: opts.workspace } : {}),
+                ...(opts.expiresAt ? { expires_at: opts.expiresAt } : {}),
+                constraints: parseJson(opts.constraints),
+            });
+            if (isJsonMode(opts))
+                return printJson({ data: grant });
+            console.log(chalk.green(`Grant created: ${grant.id}`));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    grants
+        .command("revoke <id>")
+        .description("Revoke a standing grant immediately")
+        .option("--json", "Output JSON")
+        .action(async (id, opts) => {
+        try {
+            const grant = await authority().revokeGrant(id);
+            if (isJsonMode(opts))
+                return printJson({ data: grant });
+            console.log(chalk.green(`Grant revoked: ${grant.id}`));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    actions
+        .command("receipts")
+        .description("List immutable action authority receipts")
+        .option("--limit <count>", "Maximum rows", "100")
+        .option("--json", "Output JSON")
+        .action(async (opts) => {
+        try {
+            const parsedLimit = Number.parseInt(opts.limit ?? "100", 10);
+            const limit = Number.isNaN(parsedLimit) || parsedLimit <= 0 ? 100 : parsedLimit;
+            const rows = await authority().receipts(limit);
+            if (isJsonMode(opts))
+                return printJson({ data: rows });
+            renderTable(rows, [
+                { header: "TIME", key: "occurred_at", width: 24 },
+                { header: "ACTION", key: "capability_name", width: 28 },
+                { header: "SURFACE", key: "surface", width: 14 },
+                { header: "DECISION", key: "decision", width: 20 },
+                { header: "RECEIPT", key: "id", width: 12 },
+            ]);
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+}
+//# sourceMappingURL=actions.js.map

package/dist/commands/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/commands/actions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE/D,SAAS,SAAS;IAChB,OAAO,IAAI,qBAAqB,CAAC,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACvC,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yDAAyD,CAAC,CAAC;IAE1E,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1D,WAAW,CAAC,OAAO,EAAE;gBACnB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC5C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC1C,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC5C,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,CAAC;SAC1D,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;SAC7C,MAAM,CAAC,sBAAsB,EAAE,sCAAsC,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CACL,KAAK,EACH,UAAkB,EAClB,IAKC,EACD,EAAE;QACF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC,SAAS,CAC1C,UAAU,EACV,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EACtB;gBACE,WAAW,EAAE,IAAI,CAAC,SAAS;gBAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CACF,CAAC;YACF,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CACT,QAAQ,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;gBACtB,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,kBAAkB;oBACxC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBAClC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CACxB,CAAC;YACF,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,qBAAqB,QAAQ,CAAC,mBAAmB,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU;gBACrB,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,MAAM,SAAS,GAAG,OAAO;SACtB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC5C,SAAS;SACN,OAAO,CAAC,MAAM,CAAC;SACf,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,WAAW,CAAC,IAAI,EAAE;gBAChB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE;gBACvD;oBACE,MAAM,EAAE,WAAW;oBACnB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,YAAY,EAAE;oBACzD,KAAK,EAAE,EAAE;iBACV;gBACD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK,MAAM,QAAQ,IAAI,CAAC,SAAS,EAAE,MAAM,CAAU,EAAE,CAAC;QACpD,SAAS;aACN,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC;aAC3B,WAAW,CACV,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,uBAAuB,CACtE;aACA,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;aAC/B,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAwB,EAAE,EAAE;YACrD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC/D,IAAI,UAAU,CAAC,IAAI,CAAC;oBAAE,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;IAED,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAChD,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,WAAW,CAAC,IAAI,EAAE;gBAChB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE;gBACvD;oBACE,MAAM,EAAE,WAAW;oBACnB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,YAAY,EAAE;oBACzD,KAAK,EAAE,EAAE;iBACV;gBACD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC9C;oBACE,MAAM,EAAE,SAAS;oBACjB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO;oBACvC,KAAK,EAAE,EAAE;iBACV;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,qBAAqB,CAAC;SAC9B,cAAc,CACb,yBAAyB,EACzB,sEAAsE,CACvE;SACA,cAAc,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;SAC3D,MAAM,CAAC,kBAAkB,EAAE,gCAAgC,CAAC;SAC5D,MAAM,CAAC,wBAAwB,EAAE,qBAAqB,CAAC;SACvD,MAAM,CAAC,sBAAsB,EAAE,oCAAoC,EAAE,IAAI,CAAC;SAC1E,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CACL,KAAK,EACH,cAAsB,EACtB,IAOC,EACD,EAAE;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBACrC,UAAU,EAAE;oBACV,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC;gBACD,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;aACzC,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,MAAM;SACH,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAwB,EAAE,EAAE;QACrD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,KAAK,CAAC;SAChD,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,IAAwC,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7D,MAAM,KAAK,GACT,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,WAAW,CAAC,IAAI,EAAE;gBAChB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;gBACjD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE;gBACvD,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;gBAChD,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;gBAClD,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/commands/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAM3C,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,0BAA0B,EAG3B,MAAM,qBAAqB,CAAC;AAe7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAiBnE;AAwBD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAKlC;AAYD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC;IAAE,UAAU,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgJ/D;AAyGD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE;QACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH,GAAG,OAAO,CAAC;IACV,SAAS,EAAE,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC;IACzD,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAqID;AAoED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuoB/C"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/commands/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAM3C,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,0BAA0B,EAG3B,MAAM,qBAAqB,CAAC;AAgB7B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAiBnE;AA6DD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAKlC;AAYD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,WAAW,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC;IAAE,UAAU,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgJ/D;AA0GD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE;QACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH,GAAG,OAAO,CAAC;IACV,SAAS,EAAE,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC;IACzD,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAqID;AAoED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAojC/C"}

package/dist/commands/app.js

@@ -12,6 +12,7 @@ import { loadLocalLink } from "./link.js";
 import { loadAcceptanceContract, saveReleaseReceipt, verifyApplicationRelease, } from "../app-release.js";
 import { applicationIdempotencyKey, createApplicationOperation, loadApplicationOperation, updateApplicationOperation, } from "../app-operation.js";
 import { handleError, isJsonMode, printJson } from "./util.js";
+import { diagnoseAppDocument } from "../app-document.js";
 export function requireApplicationLink(dir) {
     const link = loadLocalLink(dir);
     if (!link?.deploymentId || !link.name) {
@@ -45,6 +46,28 @@ function boolValue(value, key) {
     const found = record(value)[key];
     return typeof found === "boolean" ? found : undefined;
 }
+function parseJsonObject(value, option) {
+    if (!value)
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new UserError(`${option} must be valid JSON.`, `Pass a JSON object, for example ${option} '{"enabled":true}'.`);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new UserError(`${option} must be a JSON object.`, `Pass an object, not ${Array.isArray(parsed) ? "an array" : typeof parsed}.`);
+    }
+    return parsed;
+}
+function parseNonNegativeInteger(value, option) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 0) {
+        throw new UserError(`${option} must be a non-negative integer.`, `Received ${JSON.stringify(value)}.`);
+    }
+    return parsed;
+}
 export async function getRelease(client, deploymentId, releaseId) {
     const raw = await client.apiGet(`/api/v1/deployments/${encodeURIComponent(deploymentId)}/releases/${encodeURIComponent(releaseId)}`);
     return deploymentPayload(raw);
@@ -169,7 +192,8 @@ async function verifyLinkedRelease(client, dir, link, releaseId, contractPath, r
         inspection.migration_verified ||
             verificationEvidence?.migration_verified === true;
     inspection.policy_verified =
-        inspection.policy_verified || verificationEvidence?.policy_verified === true;
+        inspection.policy_verified ||
+            verificationEvidence?.policy_verified === true;
     const receipt = await verifyApplicationRelease({
         application: link.name,
         environment: link.environment,
@@ -472,6 +496,324 @@ export function register(program) {
             handleError(err);
         }
     });
+    const documents = app
+        .command("documents")
+        .description("Inspect durable generated App Documents");
+    documents
+        .command("list")
+        .description("List durable apps in the selected workspace")
+        .option("--workspace <id>", "Workspace ID")
+        .option("--json", "Output machine-readable App Documents")
+        .action(async (opts) => {
+        try {
+            const config = loadConfig();
+            const workspaceId = opts.workspace ?? config.workspace;
+            if (!workspaceId) {
+                throw new UserError("A workspace is required to list App Documents.", "Pass --workspace <id> or select a CLI workspace context.");
+            }
+            const query = new URLSearchParams({ workspace_id: workspaceId });
+            const payload = await new MiosaClient(config).apiGet(`/api/v1/builder/apps?${query.toString()}`);
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    documents
+        .command("show <id>")
+        .description("Show one durable App Document")
+        .option("--json", "Output machine-readable App Document")
+        .action(async (id, opts) => {
+        try {
+            const payload = await new MiosaClient(loadConfig()).apiGet(`/api/v1/builder/apps/${encodeURIComponent(id)}`);
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    documents
+        .command("doctor <id>")
+        .description("Verify workspace, venue, declarations, and exact approval")
+        .option("--workspace <id>", "Expected workspace ID")
+        .option("--json", "Output a stable diagnostic contract")
+        .action(async (id, opts) => {
+        try {
+            const config = loadConfig();
+            const client = new MiosaClient(config);
+            const [payload, platformDiagnostics] = await Promise.all([
+                client.apiGet(`/api/v1/builder/apps/${encodeURIComponent(id)}`),
+                client.apiGet(`/api/v1/builder/apps/${encodeURIComponent(id)}/diagnostics`),
+            ]);
+            const result = diagnoseAppDocument(payload, opts.workspace ?? config.workspace, platformDiagnostics);
+            if (isJsonMode(opts)) {
+                printJson({
+                    ok: result.ok,
+                    data: result,
+                    error: result.ok
+                        ? null
+                        : {
+                            code: "APP_DOCUMENT_DIAGNOSTIC_FAILED",
+                            message: "One or more App Document checks failed.",
+                        },
+                });
+            }
+            else {
+                console.log(JSON.stringify(result, null, 2));
+            }
+            if (!result.ok)
+                process.exitCode = 1;
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    documents
+        .command("approve <id>")
+        .description("Approve the current exact app version for release publishing")
+        .requiredOption("--release <id>", "Immutable candidate release ID")
+        .option("--reason <reason>", "Review reason")
+        .option("--json", "Output the exact approval")
+        .action(async (id, opts) => {
+        try {
+            const payload = await new MiosaClient(loadConfig()).apiPost(`/api/v1/builder/apps/${encodeURIComponent(id)}/approvals`, { reason: opts.reason, release_id: opts.release });
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    documents
+        .command("revoke <id>")
+        .description("Revoke one exact-version review approval")
+        .requiredOption("--approval <id>", "Approval ID")
+        .option("--json", "Output machine-readable result")
+        .action(async (id, opts) => {
+        try {
+            await new MiosaClient(loadConfig()).apiPost(`/api/v1/builder/apps/${encodeURIComponent(id)}/approvals/${encodeURIComponent(opts.approval)}/revoke`, {});
+            const result = {
+                app_document_id: id,
+                approval_id: opts.approval,
+                revoked: true,
+            };
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: result, error: null });
+                return;
+            }
+            console.log(JSON.stringify(result, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    const data = documents
+        .command("data")
+        .description("Read and write declared durable app collections");
+    data
+        .command("list <id> <collection>")
+        .description("List records in one declared app collection")
+        .option("--limit <count>", "Maximum records", "100")
+        .option("--json", "Output machine-readable records")
+        .action(async (id, collection, opts) => {
+        try {
+            const limit = parseNonNegativeInteger(opts.limit, "--limit");
+            const payload = await new MiosaClient(loadConfig()).apiGet(`/api/v1/builder/apps/${encodeURIComponent(id)}/data/${encodeURIComponent(collection)}?limit=${limit}`);
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    data
+        .command("get <id> <collection> <key>")
+        .description("Read one exact app collection record")
+        .option("--json", "Output a machine-readable record")
+        .action(async (id, collection, key, opts) => {
+        try {
+            const payload = await new MiosaClient(loadConfig()).apiGet(`/api/v1/builder/apps/${encodeURIComponent(id)}/data/${encodeURIComponent(collection)}/${encodeURIComponent(key)}`);
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    data
+        .command("put <id> <collection> <key>")
+        .description("Create or update one app collection record")
+        .requiredOption("--value <json>", "JSON object value")
+        .option("--expected-version <number>", "Exact current version")
+        .option("--json", "Output the stored record")
+        .action(async (id, collection, key, opts) => {
+        try {
+            const body = {
+                value: parseJsonObject(opts.value, "--value"),
+            };
+            if (opts.expectedVersion !== undefined) {
+                body["expected_version"] = parseNonNegativeInteger(opts.expectedVersion, "--expected-version");
+            }
+            const payload = await new MiosaClient(loadConfig()).apiPut(`/api/v1/builder/apps/${encodeURIComponent(id)}/data/${encodeURIComponent(collection)}/${encodeURIComponent(key)}`, body);
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    data
+        .command("delete <id> <collection> <key>")
+        .description("Delete one exact app collection record")
+        .option("--expected-version <number>", "Exact current version")
+        .option("--json", "Output machine-readable result")
+        .action(async (id, collection, key, opts) => {
+        try {
+            const query = opts.expectedVersion === undefined
+                ? ""
+                : `?expected_version=${parseNonNegativeInteger(opts.expectedVersion, "--expected-version")}`;
+            await new MiosaClient(loadConfig()).apiDelete(`/api/v1/builder/apps/${encodeURIComponent(id)}/data/${encodeURIComponent(collection)}/${encodeURIComponent(key)}${query}`);
+            const result = {
+                app_document_id: id,
+                collection,
+                key,
+                deleted: true,
+            };
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: result, error: null });
+                return;
+            }
+            console.log(JSON.stringify(result, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    const automations = documents
+        .command("automations")
+        .description("Operate durable, authority-governed app automation runs");
+    automations
+        .command("list <id>")
+        .description("List automation runs for one app")
+        .option("--limit <count>", "Maximum runs", "100")
+        .option("--json", "Output machine-readable runs")
+        .action(async (id, opts) => {
+        try {
+            const limit = parseNonNegativeInteger(opts.limit, "--limit");
+            const payload = await new MiosaClient(loadConfig()).apiGet(`/api/v1/builder/apps/${encodeURIComponent(id)}/automation-runs?limit=${limit}`);
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    automations
+        .command("start <id> <automation>")
+        .description("Start one reviewed automation")
+        .option("--trigger <json>", "Trigger metadata JSON", "{}")
+        .option("--json", "Output the durable run")
+        .action(async (id, automation, opts) => {
+        try {
+            const payload = await new MiosaClient(loadConfig()).apiPost(`/api/v1/builder/apps/${encodeURIComponent(id)}/automations/${encodeURIComponent(automation)}/runs`, { trigger: parseJsonObject(opts.trigger, "--trigger") });
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    automations
+        .command("claim <id> <run>")
+        .description("Claim or resume the current automation step")
+        .option("--json", "Output the exact authority-bound claim")
+        .action(async (id, run, opts) => {
+        try {
+            const payload = await new MiosaClient(loadConfig()).apiPost(`/api/v1/builder/apps/${encodeURIComponent(id)}/automation-runs/${encodeURIComponent(run)}/claim`, {});
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    automations
+        .command("complete <id> <run>")
+        .description("Complete the exact claimed automation step")
+        .requiredOption("--cursor <number>", "Claimed step cursor")
+        .requiredOption("--idempotency-key <key>", "Claimed idempotency key")
+        .option("--output <json>", "Step output JSON object", "{}")
+        .option("--json", "Output the updated run")
+        .action(async (id, run, opts) => {
+        try {
+            const payload = await new MiosaClient(loadConfig()).apiPost(`/api/v1/builder/apps/${encodeURIComponent(id)}/automation-runs/${encodeURIComponent(run)}/complete`, {
+                cursor: parseNonNegativeInteger(opts.cursor, "--cursor"),
+                idempotency_key: opts.idempotencyKey,
+                output: parseJsonObject(opts.output, "--output"),
+            });
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
+    automations
+        .command("fail <id> <run>")
+        .description("Fail the exact claimed automation step")
+        .requiredOption("--cursor <number>", "Claimed step cursor")
+        .requiredOption("--idempotency-key <key>", "Claimed idempotency key")
+        .requiredOption("--reason <reason>", "Failure reason")
+        .option("--json", "Output the updated run")
+        .action(async (id, run, opts) => {
+        try {
+            const payload = await new MiosaClient(loadConfig()).apiPost(`/api/v1/builder/apps/${encodeURIComponent(id)}/automation-runs/${encodeURIComponent(run)}/fail`, {
+                cursor: parseNonNegativeInteger(opts.cursor, "--cursor"),
+                idempotency_key: opts.idempotencyKey,
+                reason: opts.reason,
+            });
+            if (isJsonMode(opts)) {
+                printJson({ ok: true, data: payload, error: null });
+                return;
+            }
+            console.log(JSON.stringify(payload, null, 2));
+        }
+        catch (err) {
+            handleError(err);
+        }
+    });
     app
         .command("pull")
         .argument("[path]", "Local app directory", ".")