@omniaseo/cli 0.1.0

package/dist/commands/connect.js

@@ -0,0 +1,203 @@
+import { CliError, EXIT } from '../errors.js';
+import { CODEX_REFRESH_FEATURE, mergeCodexServerConfig } from '../codex/config.js';
+import { WORKSPACE_CONTEXT_ACTION } from '../contracts.js';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+function endpoint(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new CliError('MCP endpoint is not a valid URL', 'ENDPOINT_INVALID', EXIT.VALIDATION);
+    }
+    const local = ['localhost', '127.0.0.1', '::1'].includes(parsed.hostname);
+    if (parsed.protocol !== 'https:' && !local) {
+        throw new CliError('MCP endpoint must use HTTPS', 'ENDPOINT_INSECURE', EXIT.VALIDATION);
+    }
+    if (!parsed.pathname.endsWith('/mcp')) {
+        throw new CliError('MCP endpoint path must end in /mcp', 'ENDPOINT_PATH_INVALID', EXIT.VALIDATION);
+    }
+    if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+        throw new CliError('MCP endpoint must not contain userinfo, query parameters or fragments', 'ENDPOINT_CREDENTIAL_FORBIDDEN', EXIT.VALIDATION);
+    }
+    return parsed;
+}
+function resourceUrl(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new CliError('OAuth resource is not a valid URL', 'RESOURCE_INVALID', EXIT.VALIDATION);
+    }
+    if (parsed.protocol !== 'https:' && !['localhost', '127.0.0.1', '::1'].includes(parsed.hostname)) {
+        throw new CliError('OAuth resource must use HTTPS', 'RESOURCE_INSECURE', EXIT.VALIDATION);
+    }
+    if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+        throw new CliError('OAuth resource must not contain userinfo, query parameters or fragments', 'RESOURCE_CREDENTIAL_FORBIDDEN', EXIT.VALIDATION);
+    }
+    return parsed;
+}
+function findUrl(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    for (const [key, child] of Object.entries(value)) {
+        if (key === 'url' && typeof child === 'string')
+            return child;
+        const nested = findUrl(child);
+        if (nested)
+            return nested;
+    }
+    return undefined;
+}
+function completedMcpCall(event) {
+    if (!event || typeof event !== 'object')
+        return undefined;
+    const envelope = event;
+    if (envelope.type !== 'item.completed' || !envelope.item || typeof envelope.item !== 'object')
+        return undefined;
+    const item = envelope.item;
+    if (typeof item.type !== 'string' || !item.type.toLowerCase().includes('mcp'))
+        return undefined;
+    const action = Object.values(item).find((value) => typeof value === 'string' && value.startsWith('omnia_'));
+    if (!action)
+        return undefined;
+    const failed = item.isError === true
+        || item.error !== undefined && item.error !== null
+        || typeof item.status === 'string' && ['failed', 'error', 'cancelled'].includes(item.status.toLowerCase());
+    const result = item.result ?? item.output ?? item.content;
+    const resultFailed = typeof result === 'object' && result !== null && 'isError' in result && result.isError === true;
+    const serialized = result === undefined ? '' : JSON.stringify(result);
+    const contextShape = /organization/iu.test(serialized) && /v[1-9][0-9]*\.[A-Za-z0-9_-]{8,120}/u.test(serialized);
+    return { action, successful: !failed && !resultFailed && contextShape };
+}
+function smokePassed(result) {
+    if (result.status !== 0)
+        return false;
+    const calls = [];
+    for (const line of result.stdout.split('\n').filter(Boolean)) {
+        try {
+            const call = completedMcpCall(JSON.parse(line));
+            if (call)
+                calls.push(call);
+        }
+        catch {
+            // Non-JSON output cannot establish a verified MCP call.
+        }
+    }
+    return calls.length === 1 && calls.every((call) => call.action === WORKSPACE_CONTEXT_ACTION.slug && call.successful);
+}
+export async function connectCodex(options) {
+    if (!/^[A-Za-z][A-Za-z0-9_-]{0,63}$/u.test(options.name)) {
+        throw new CliError('MCP server name is invalid', 'SERVER_NAME_INVALID', EXIT.VALIDATION);
+    }
+    const url = endpoint(options.url).toString();
+    const resource = resourceUrl(options.resource).toString().replace(/\/$/u, '');
+    const version = options.runner.run('codex', ['--version']);
+    if (version.status !== 0) {
+        throw new CliError('Codex CLI is not installed or not executable', 'CODEX_NOT_FOUND', EXIT.DEPENDENCY_MISSING);
+    }
+    const features = options.runner.run('codex', ['features', 'list']);
+    const supported = features.stdout.split(/\r?\n/u).some(line => {
+        const columns = line.trim().split(/\s+/u);
+        return columns[0] === CODEX_REFRESH_FEATURE && ['true', 'false'].includes(columns.at(-1) ?? '');
+    });
+    if (features.status !== 0 || !supported) {
+        throw new CliError('Update Codex to a version supporting automatic connection renewal, then run omnia connect codex again. No configuration or login was changed.', 'CODEX_REFRESH_COMPATIBILITY_UNAVAILABLE', EXIT.DEPENDENCY_MISSING);
+    }
+    let registration;
+    let configPath;
+    const existing = options.runner.run('codex', ['mcp', 'get', options.name, '--json']);
+    if (existing.status === 0) {
+        let configuredUrl;
+        try {
+            configuredUrl = findUrl(JSON.parse(existing.stdout));
+        }
+        catch { /* handled as conflict below */ }
+        if (configuredUrl !== url) {
+            throw new CliError(`Codex MCP server ${options.name} already points to a different URL`, 'CODEX_SERVER_CONFLICT', EXIT.CONFIG_CONFLICT);
+        }
+        registration = 'existing';
+    }
+    else {
+        // `mcp add` can start OAuth implicitly, before the scoped login below.
+        // Configure without authenticating, then let Codex perform one explicit login.
+        registration = 'atomic_config_merge';
+    }
+    const merged = await mergeCodexServerConfig({ name: options.name, url, resource }, options.env ?? process.env, { refreshCoordination: true, preserveExistingServer: registration === 'existing' });
+    configPath = merged.path;
+    const effectiveFeatures = options.runner.run('codex', ['features', 'list']);
+    const enabled = effectiveFeatures.stdout.split(/\r?\n/u).some(line => {
+        const columns = line.trim().split(/\s+/u);
+        return columns[0] === CODEX_REFRESH_FEATURE && columns.at(-1) === 'true';
+    });
+    if (effectiveFeatures.status !== 0 || !enabled) {
+        throw new CliError('Codex is not applying the saved automatic renewal configuration. Resolve conflicting project or profile settings and rerun setup; OAuth login was not started.', 'CODEX_REFRESH_CONFIG_UNVERIFIED', EXIT.CONFIG_CONFLICT);
+    }
+    const loginArgs = ['mcp', 'login', options.name];
+    const requestedScopes = [...new Set([...options.scopes, 'offline_access'])];
+    loginArgs.push('--scopes', requestedScopes.join(','));
+    const login = options.runner.run('codex', loginArgs, { interactive: true });
+    if (login.status !== 0) {
+        throw new CliError('Codex OAuth login did not complete', 'OAUTH_LOGIN_BLOCKED', EXIT.AUTH_BLOCKED);
+    }
+    const validated = options.runner.run('codex', ['mcp', 'get', options.name, '--json']);
+    if (validated.status !== 0) {
+        throw new CliError('Codex cannot read the registered MCP server', 'CODEX_CONFIG_UNVERIFIED', EXIT.CONFIG_CONFLICT);
+    }
+    if (options.skipSmoke) {
+        return {
+            host: 'codex', serverName: options.name, endpoint: url, registration,
+            oauth: 'completed', smoke: 'blocked_by_explicit_skip', ...(configPath ? { configPath } : {}),
+        };
+    }
+    const smokeDirectory = await mkdtemp(join(tmpdir(), 'omnia-connect-smoke-'));
+    let smoke;
+    try {
+        smoke = options.runner.run('codex', [
+            'exec', '--sandbox', 'read-only', '--ephemeral', '--json', '--ignore-rules', '--ignore-user-config',
+            '--cd', smokeDirectory, '--skip-git-repo-check',
+            '-c', `features.${CODEX_REFRESH_FEATURE}=true`,
+            '-c', `mcp_servers.${options.name}.url=${JSON.stringify(url)}`,
+            '-c', `mcp_servers.${options.name}.oauth_resource=${JSON.stringify(resource)}`,
+            '-c', `mcp_servers.${options.name}.required=true`,
+            `Call ${options.name}.${WORKSPACE_CONTEXT_ACTION.slug} exactly once. Use tool discovery if needed to find this MCP tool. Do not use shell, other MCP servers, or write tools. Return only its organization name and opaque ID.`,
+        ], { cwd: smokeDirectory });
+    }
+    finally {
+        await rm(smokeDirectory, { recursive: true, force: true });
+    }
+    if (!smokePassed(smoke)) {
+        throw new CliError('Codex read-only MCP smoke did not produce a verified tool-call event', 'CODEX_SMOKE_BLOCKED', EXIT.AUTH_BLOCKED);
+    }
+    return {
+        host: 'codex', serverName: options.name, endpoint: url, registration,
+        oauth: 'completed', smoke: 'passed', ...(configPath ? { configPath } : {}),
+    };
+}
+export function connectCustom(urlValue, resourceValue) {
+    const url = endpoint(urlValue).toString();
+    const resource = resourceUrl(resourceValue).toString().replace(/\/$/u, '');
+    return {
+        host: 'custom',
+        endpoint: url,
+        protectedResourceMetadata: `${resource}/.well-known/oauth-protected-resource`,
+        protocolVersion: '2025-11-25',
+        transport: 'streamable-http',
+        requirements: ['OAuth authorization code with PKCE S256', 'resource parameter', 'exact redirect URI'],
+        status: 'requires_host_compatibility_smoke',
+    };
+}
+export function connectChatGpt(urlValue, resourceValue) {
+    const custom = connectCustom(urlValue, resourceValue);
+    return {
+        ...custom,
+        host: 'chatgpt',
+        status: 'development_connection_only',
+        publicPublication: 'BLOCKED_EXTERNAL_AUTHORIZATION',
+        guidance: 'Use the ChatGPT developer/test connection flow with the MCP endpoint and protected-resource metadata. This CLI does not edit Codex config or claim silent installation.',
+    };
+}
+//# sourceMappingURL=connect.js.map

package/dist/commands/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,iCAAiC,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3C,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,oCAAoC,EAAE,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,QAAQ,CAAC,uEAAuE,EAAE,+BAA+B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAChJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,mCAAmC,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE,mBAAmB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,IAAI,QAAQ,CAAC,yEAAyE,EAAE,+BAA+B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAClJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAgC,CAAC;IAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA+B,CAAC;IACtD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CACjE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI;WAC/B,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;WAC/C,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IACrH,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,qCAAqC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,YAAY,IAAI,YAAY,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,KAAK,GAAmD,EAAE,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAChD,IAAI,CAAC,MAAM,KAAK,wBAAwB,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;AACtE,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,QAAQ,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,8CAA8C,EAAE,iBAAiB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,qBAAqB,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAChB,+IAA+I,EAC/I,yCAAyC,EAAE,IAAI,CAAC,kBAAkB,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,YAAgD,CAAC;IACrD,IAAI,UAA8B,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YAAC,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;QACvG,IAAI,aAAa,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,oBAAoB,OAAO,CAAC,IAAI,oCAAoC,EAAE,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1I,CAAC;QACD,YAAY,GAAG,UAAU,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,+EAA+E;QAC/E,YAAY,GAAG,qBAAqB,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EACjE,EAAE,mBAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,YAAY,KAAK,UAAU,EAAE,CACnF,CAAC;IACF,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,qBAAqB,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAChB,gKAAgK,EAChK,iCAAiC,EAAE,IAAI,CAAC,eAAe,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC5E,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,oCAAoC,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE,yBAAyB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY;YACpE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,0BAA0B,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;YAClC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB;YACnG,MAAM,EAAE,cAAc,EAAE,uBAAuB;YAC/C,IAAI,EAAE,YAAY,qBAAqB,OAAO;YAC9C,IAAI,EAAE,eAAe,OAAO,CAAC,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;YAC9D,IAAI,EAAE,eAAe,OAAO,CAAC,IAAI,mBAAmB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC9E,IAAI,EAAE,eAAe,OAAO,CAAC,IAAI,gBAAgB;YACjD,QAAQ,OAAO,CAAC,IAAI,IAAI,wBAAwB,CAAC,IAAI,0KAA0K;SAChO,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,sEAAsE,EAAE,qBAAqB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvI,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY;QACpE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,aAAqB;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,GAAG;QACb,yBAAyB,EAAE,GAAG,QAAQ,uCAAuC;QAC7E,eAAe,EAAE,YAAY;QAC7B,SAAS,EAAE,iBAAiB;QAC5B,YAAY,EAAE,CAAC,yCAAyC,EAAE,oBAAoB,EAAE,oBAAoB,CAAC;QACrG,MAAM,EAAE,mCAAmC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,aAAqB;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,OAAO;QACL,GAAG,MAAM;QACT,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,6BAA6B;QACrC,iBAAiB,EAAE,gCAAgC;QACnD,QAAQ,EAAE,yKAAyK;KACpL,CAAC;AACJ,CAAC"}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,27 @@
+import type { CommandRunner } from '../process/runner.js';
+type CheckStatus = 'pass' | 'fail' | 'blocked';
+export type DoctorCheck = {
+    name: string;
+    status: CheckStatus;
+    detail: string;
+};
+export type DoctorResult = {
+    status: 'ok' | 'failed' | 'blocked';
+    checks: readonly DoctorCheck[];
+};
+export type DoctorOptions = {
+    workspace: string;
+    endpoint?: string;
+    runner: CommandRunner;
+    fetchFn?: typeof fetch;
+    nodeVersion?: string;
+    authenticatedProbe?: () => Promise<{
+        organization: string;
+        scopes: readonly string[];
+        capabilities: number;
+        lastAudit: string | null;
+    }>;
+};
+export declare function doctor(options: DoctorOptions): Promise<DoctorResult>;
+export {};
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,KAAK,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAC/C,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAChF,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAA;CAAE,CAAC;AAEnG,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC;QACjC,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAAC;CACJ,CAAC;AAEF,wBAAsB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAoJ1E"}

package/dist/commands/doctor.js

@@ -0,0 +1,157 @@
+import { resolve, join } from 'node:path';
+import { hasSecretLikeKey } from '../config/secrets.js';
+import { readText } from '../io/atomic.js';
+export async function doctor(options) {
+    const checks = [];
+    const workspace = resolve(options.workspace);
+    const version = options.nodeVersion ?? process.version;
+    checks.push({ name: 'cli_version', status: 'pass', detail: '@omniaseo/cli 0.1.0' });
+    checks.push({
+        name: 'node',
+        status: version.replace(/^v/u, '').startsWith('24.') ? 'pass' : 'fail',
+        detail: version.replace(/^v/u, '').startsWith('24.') ? `Node ${version}` : `Node 24 LTS required; found ${version}`,
+    });
+    const connectionText = await readText(join(workspace, '.omnia', 'connection.json'));
+    let connection;
+    if (!connectionText) {
+        checks.push({ name: 'workspace', status: 'fail', detail: 'Run omnia init first' });
+    }
+    else {
+        try {
+            connection = JSON.parse(connectionText);
+            const connectionHasSecret = hasSecretLikeKey(connection);
+            checks.push({
+                name: 'workspace',
+                status: connectionHasSecret ? 'fail' : 'pass',
+                detail: connectionHasSecret ? 'connection.json has a forbidden secret-like key' : 'Non-secret workspace config is valid',
+            });
+        }
+        catch {
+            checks.push({ name: 'workspace', status: 'fail', detail: 'connection.json is invalid JSON' });
+        }
+    }
+    const git = options.runner.run('git', ['-C', workspace, 'status', '--short']);
+    checks.push({
+        name: 'git',
+        status: git.status === 0 ? 'pass' : 'blocked',
+        detail: git.status === 0 ? (git.stdout.trim() ? 'Git worktree has changes' : 'Git worktree is clean') : 'Workspace is not a Git worktree',
+    });
+    const codex = options.runner.run('codex', ['--version']);
+    checks.push({
+        name: 'codex',
+        status: codex.status === 0 ? 'pass' : 'blocked',
+        detail: codex.status === 0 ? codex.stdout.trim() : 'Codex CLI not found',
+    });
+    const rawTarget = options.endpoint ?? (typeof connection?.endpoint === 'string' ? connection.endpoint : undefined);
+    let target;
+    if (rawTarget) {
+        try {
+            const parsed = new URL(rawTarget);
+            if (!parsed.username && !parsed.password && !parsed.search && !parsed.hash)
+                target = parsed.toString();
+        }
+        catch {
+            target = undefined;
+        }
+    }
+    checks.push({
+        name: 'active_connection',
+        status: target ? 'pass' : 'blocked',
+        detail: target ? `Configured endpoint: ${target}` : rawTarget ? 'Endpoint is invalid or contains forbidden URL credentials/parameters' : 'No active non-secret connection metadata',
+    });
+    let authenticated;
+    if (options.authenticatedProbe) {
+        try {
+            authenticated = await options.authenticatedProbe();
+            checks.push({ name: 'cli_oauth', status: 'pass', detail: 'CLI OAuth session accepted by the public action API' });
+        }
+        catch (error) {
+            checks.push({ name: 'cli_oauth', status: 'fail', detail: error instanceof Error ? error.message : 'Authenticated CLI probe failed' });
+        }
+    }
+    else {
+        checks.push({ name: 'cli_oauth', status: 'blocked', detail: 'External CLI OAuth is not configured or no keychain session is available' });
+    }
+    checks.push({
+        name: 'organization',
+        status: authenticated ? 'pass' : typeof connection?.organization === 'string' ? 'pass' : 'blocked',
+        detail: authenticated ? `Authenticated organization: ${authenticated.organization}` : typeof connection?.organization === 'string' ? 'Organization metadata is present' : 'Requires an authenticated CLI or host smoke',
+    });
+    checks.push({
+        name: 'scopes',
+        status: authenticated ? 'pass' : Array.isArray(connection?.scopes) && connection.scopes.length > 0 ? 'pass' : 'blocked',
+        detail: authenticated ? `${authenticated.scopes.length} effective CLI OAuth scopes` : Array.isArray(connection?.scopes) && connection.scopes.length > 0 ? 'Non-secret scope metadata is present' : 'Effective scopes require authentication',
+    });
+    const policyFile = await readText(join(workspace, '.omnia', 'policies.yaml'));
+    checks.push({
+        name: 'resource_policies',
+        status: 'blocked',
+        detail: policyFile ? 'Local policy file exists; backend-enforced policy version requires authenticated verification' : 'Local policy file is missing',
+    });
+    const exampleRecipe = await readText(join(workspace, '.omnia', 'recipes', 'workspace-digest.yaml'));
+    checks.push({
+        name: 'recipes',
+        status: 'blocked',
+        detail: exampleRecipe ? 'Local recipe config exists; installation status requires authenticated backend access' : 'No local recipe config found',
+    });
+    if (!target) {
+        checks.push({ name: 'mcp_reachability', status: 'blocked', detail: 'No MCP endpoint configured' });
+        checks.push({ name: 'oauth', status: 'blocked', detail: 'OAuth is owned by the MCP host; no host connection is configured' });
+    }
+    else {
+        try {
+            const parsed = new URL(target);
+            const base = new URL(parsed.toString());
+            base.pathname = '/';
+            base.search = '';
+            base.hash = '';
+            const fetchFn = options.fetchFn ?? fetch;
+            const [health, metadata] = await Promise.all([
+                fetchFn(new URL('/health', base), { signal: AbortSignal.timeout(5_000) }),
+                fetchFn(new URL('/.well-known/oauth-protected-resource', base), { signal: AbortSignal.timeout(5_000) }),
+            ]);
+            checks.push({
+                name: 'mcp_reachability',
+                status: health.ok ? 'pass' : 'fail',
+                detail: `Health returned HTTP ${health.status}`,
+            });
+            checks.push({
+                name: 'oauth_metadata',
+                status: metadata.ok ? 'pass' : 'fail',
+                detail: `Protected resource metadata returned HTTP ${metadata.status}`,
+            });
+        }
+        catch (error) {
+            checks.push({
+                name: 'mcp_reachability',
+                status: 'fail',
+                detail: error instanceof Error ? error.message : 'MCP request failed',
+            });
+        }
+        checks.push({
+            name: 'oauth',
+            status: 'blocked',
+            detail: 'Token validity, organization, scopes, policies and audit require a host-authenticated read-only smoke; the CLI never reads host tokens',
+        });
+    }
+    checks.push({
+        name: 'schedules',
+        status: 'blocked',
+        detail: 'UNSUPPORTED_HOST until a real external runner binding is configured',
+    });
+    checks.push({
+        name: 'capabilities',
+        status: authenticated ? 'pass' : 'blocked',
+        detail: authenticated ? `${authenticated.capabilities} public actions available` : 'Capability catalog requires an authenticated CLI session',
+    });
+    checks.push({
+        name: 'last_audit',
+        status: authenticated ? 'pass' : 'blocked',
+        detail: authenticated ? (authenticated.lastAudit ?? 'Authenticated; no recent audit event') : 'Audit data is never cached in workspace; query it through an authenticated Omnia Connect action',
+    });
+    const status = checks.some((check) => check.status === 'fail')
+        ? 'failed'
+        : checks.some((check) => check.status === 'blocked') ? 'blocked' : 'ok';
+    return { status, checks };
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAqB3C,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAsB;IACjD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IACvD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACpF,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACtE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,+BAA+B,OAAO,EAAE;KACpH,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACpF,IAAI,UAA+C,CAAC;IACpD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACrF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAA4B,CAAC;YACnE,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC7C,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,sCAAsC;aACzH,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC7C,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,iCAAiC;KAC1I,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/C,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,qBAAqB;KACzE,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,UAAU,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnH,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzG,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACnC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,0CAA0C;KACpL,CAAC,CAAC;IACH,IAAI,aAAgG,CAAC;IACrG,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;QACpH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC;QACxI,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,0EAA0E,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAClG,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,+BAA+B,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,6CAA6C;KACxN,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACvH,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,6BAA6B,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,yCAAyC;KAC7O,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,+FAA+F,CAAC,CAAC,CAAC,8BAA8B;KACtJ,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACpG,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,uFAAuF,CAAC,CAAC,CAAC,8BAA8B;KACjJ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACnG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC,CAAC;IAChI,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YACpB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;YACzC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC3C,OAAO,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzE,OAAO,CAAC,IAAI,GAAG,CAAC,uCAAuC,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;aACxG,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBACnC,MAAM,EAAE,wBAAwB,MAAM,CAAC,MAAM,EAAE;aAChD,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBACrC,MAAM,EAAE,6CAA6C,QAAQ,CAAC,MAAM,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB;aACtE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,wIAAwI;SACjJ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,qEAAqE;KAC9E,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC1C,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,YAAY,2BAA2B,CAAC,CAAC,CAAC,0DAA0D;KAC9I,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC;QACV,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC1C,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,IAAI,sCAAsC,CAAC,CAAC,CAAC,CAAC,iGAAiG;KAChM,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;QAC5D,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,17 @@
+import type { CommandRunner } from '../process/runner.js';
+export type InitOptions = {
+    directory: string;
+    approved: boolean;
+    initGit: boolean;
+    nodeVersion?: string;
+    confirm?: (message: string) => Promise<boolean>;
+    runner: CommandRunner;
+};
+export type InitResult = {
+    workspace: string;
+    changedFiles: readonly string[];
+    backups: readonly string[];
+    gitInitialized: boolean;
+};
+export declare function initWorkspace(options: InitOptions): Promise<InitResult>;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAyC1D,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAqCF,wBAAsB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAyD7E"}

package/dist/commands/init.js

@@ -0,0 +1,126 @@
+import { mkdir } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { hasSecretLikeKey } from '../config/secrets.js';
+import { CliError, EXIT } from '../errors.js';
+import { atomicWrite, backup, exists, mergeManagedBlock, readText } from '../io/atomic.js';
+import { WORKSPACE_CONTEXT_ACTION } from '../contracts.js';
+import { CONNECT_OPERATOR_GUIDE } from '@omnia/omnia-connect-contracts';
+const AGENTS_BODY = `## Omnia Connect
+
+${CONNECT_OPERATOR_GUIDE}
+
+Do not use legacy Browser Agents, billing, role, or invite surfaces.`;
+const GITIGNORE_BODY = `.omnia/outputs/
+.omnia/backups/
+*.omnia-secret`;
+const CODEX_BODY = `# Omnia Connect MCP is registered by \`omnia connect codex\`.
+# OAuth credentials remain in Codex's credential store, never in this workspace.`;
+const README = `# Omnia Connect workspace
+
+This workspace contains non-secret Omnia Connect policies, recipes, schedules and output folders. Connect an MCP host with \`omnia connect codex\`, \`omnia connect chatgpt\` or \`omnia connect custom\`.
+`;
+const POLICIES = `version: 1
+resourcePolicy:
+  mode: deny_by_default
+effectPolicy:
+  sensitive: approval_required
+activeHours:
+  enabled: false
+`;
+const EXAMPLE_RECIPE = `version: 1
+slug: workspace-digest
+enabled: false
+executionTarget: client_managed
+steps:
+  - action: ${WORKSPACE_CONTEXT_ACTION.slug}
+`;
+function assertNode24(version) {
+    const major = Number(version.replace(/^v/u, '').split('.')[0]);
+    if (major !== 24) {
+        throw new CliError(`Node 24 LTS is required; found ${version}`, 'NODE_VERSION_UNSUPPORTED', EXIT.DEPENDENCY_MISSING);
+    }
+}
+function assertSecretFreeConnection(content) {
+    let value;
+    try {
+        value = JSON.parse(content);
+    }
+    catch {
+        throw new CliError('.omnia/connection.json is not valid JSON', 'CONNECTION_INVALID', EXIT.VALIDATION);
+    }
+    if (hasSecretLikeKey(value)) {
+        throw new CliError('.omnia/connection.json contains a forbidden secret-like key', 'WORKSPACE_SECRET_FORBIDDEN', EXIT.VALIDATION);
+    }
+}
+async function planManaged(path, name, body, mode) {
+    const original = await readText(path) ?? '';
+    let merged;
+    try {
+        merged = mergeManagedBlock(original, name, body);
+    }
+    catch (error) {
+        throw new CliError(error instanceof Error ? error.message : 'Managed block is invalid', 'MANAGED_BLOCK_CONFLICT', EXIT.CONFIG_CONFLICT);
+    }
+    return merged.changed ? { path, content: merged.content, backup: original.length > 0, mode } : undefined;
+}
+async function planCreate(path, content, mode) {
+    if (await exists(path))
+        return undefined;
+    return { path, content, backup: false, ...(mode === undefined ? {} : { mode }) };
+}
+export async function initWorkspace(options) {
+    assertNode24(options.nodeVersion ?? process.version);
+    const workspace = resolve(options.directory);
+    const omnia = join(workspace, '.omnia');
+    const backupDirectory = join(omnia, 'backups');
+    await mkdir(workspace, { recursive: true });
+    const existingConnection = await readText(join(omnia, 'connection.json'));
+    if (existingConnection)
+        assertSecretFreeConnection(existingConnection);
+    const planned = (await Promise.all([
+        planManaged(join(workspace, 'AGENTS.md'), 'instructions', AGENTS_BODY, 0o644),
+        planManaged(join(workspace, '.gitignore'), 'gitignore', GITIGNORE_BODY, 0o644),
+        planManaged(join(workspace, '.codex', 'config.toml'), 'config', CODEX_BODY, 0o600),
+        planCreate(join(workspace, 'README.md'), README, 0o644),
+        planCreate(join(omnia, 'connection.json'), `${JSON.stringify({
+            version: 1,
+            serverName: 'omnia-connect',
+            endpoint: null,
+            organization: null,
+            scopes: [],
+        }, null, 2)}\n`),
+        planCreate(join(omnia, 'policies.yaml'), POLICIES),
+        planCreate(join(omnia, 'recipes', 'workspace-digest.yaml'), EXAMPLE_RECIPE),
+    ])).filter((item) => item !== undefined);
+    if (planned.some((item) => item.backup) && !options.approved) {
+        const accepted = await options.confirm?.(`Merge Omnia Connect managed blocks into: ${planned.filter((item) => item.backup).map((item) => item.path).join(', ')}?`);
+        if (!accepted) {
+            throw new CliError('Existing files require confirmation; rerun with --yes', 'CONFIRMATION_REQUIRED', EXIT.CONFIG_CONFLICT);
+        }
+    }
+    const backups = [];
+    for (const item of planned) {
+        if (item.backup) {
+            const saved = await backup(item.path, backupDirectory);
+            if (saved)
+                backups.push(saved);
+        }
+        await atomicWrite(item.path, item.content, item.mode ?? 0o600);
+    }
+    await Promise.all([
+        mkdir(join(workspace, '.codex', 'skills'), { recursive: true }),
+        mkdir(join(omnia, 'schedules'), { recursive: true }),
+        mkdir(join(omnia, 'blueprints'), { recursive: true }),
+        mkdir(join(omnia, 'outputs'), { recursive: true }),
+        mkdir(join(omnia, 'schemas'), { recursive: true }),
+    ]);
+    let gitInitialized = false;
+    if (options.initGit && !await exists(join(workspace, '.git'))) {
+        const result = options.runner.run('git', ['-C', workspace, 'init']);
+        if (result.status !== 0)
+            throw new CliError('git init failed', 'GIT_INIT_FAILED', EXIT.INTERNAL, result.stderr);
+        gitInitialized = true;
+    }
+    return { workspace, changedFiles: planned.map((item) => item.path), backups, gitInitialized };
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,MAAM,WAAW,GAAG;;EAElB,sBAAsB;;qEAE6C,CAAC;AAEtE,MAAM,cAAc,GAAG;;eAER,CAAC;AAEhB,MAAM,UAAU,GAAG;iFAC8D,CAAC;AAElF,MAAM,MAAM,GAAG;;;CAGd,CAAC;AAEF,MAAM,QAAQ,GAAG;;;;;;;CAOhB,CAAC;AAEF,MAAM,cAAc,GAAG;;;;;cAKT,wBAAwB,CAAC,IAAI;CAC1C,CAAC;AAoBF,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,kCAAkC,OAAO,EAAE,EAAE,0BAA0B,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAe;IACjD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,0CAA0C,EAAE,oBAAoB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,6DAA6D,EAAE,4BAA4B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnI,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY;IAC/E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,MAA6C,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,wBAAwB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1I,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3G,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,IAAa;IACpE,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAoB;IACtD,YAAY,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,kBAAkB,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC1E,IAAI,kBAAkB;QAAE,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,CAAC;QAC7E,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC;QAC9E,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC;QAClF,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3D,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,eAAe;YAC3B,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,EAAE;SACX,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC;QAClD,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,EAAE,cAAc,CAAC;KAC5E,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAwB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAE/D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,4CAA4C,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACvD,IAAI,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACnD,CAAC,CAAC;IAEH,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChH,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAChG,CAAC"}

package/dist/commands/m2.d.ts

@@ -0,0 +1,35 @@
+import type { PublicActionClient } from '../client/public-action-client.js';
+import type { ManagementClient } from '../client/management-client.js';
+export declare function whoami(client: PublicActionClient): Promise<unknown>;
+export declare function capabilities(client: PublicActionClient): Promise<unknown>;
+export declare function effectiveScopes(client: PublicActionClient): Promise<unknown>;
+export declare function approvalList(client: PublicActionClient, options: {
+    cursor?: string;
+    limit?: number;
+    state?: string;
+    actionSlug?: string;
+}): Promise<unknown>;
+export declare function approvalOpen(client: PublicActionClient, approvalId: string): Promise<unknown>;
+export declare function approvalWait(client: PublicActionClient, approvalId: string, timeoutMs?: number): Promise<unknown>;
+export declare function auditTail(client: PublicActionClient, options: {
+    cursor?: string;
+    limit?: number;
+    since?: string;
+    outcome?: string;
+}): Promise<unknown>;
+export declare function auditExport(client: PublicActionClient, options: {
+    idempotencyKey: string;
+    since?: string;
+    until?: string;
+    actionSlug?: string;
+    resourceType?: string;
+    effect?: string;
+    outcome?: string;
+    maxRows?: number;
+}): Promise<unknown>;
+export declare function connectionList(client: ManagementClient): Promise<unknown>;
+export declare function connectionInspect(client: ManagementClient, id: string): Promise<unknown>;
+export declare function connectionUpdate(client: ManagementClient, id: string, name: string, expectedUpdatedAt: string): Promise<unknown>;
+export declare function connectionRevoke(client: ManagementClient, id: string, approved: boolean): Promise<unknown>;
+export declare function backendBlocked(capability: 'recipe' | 'schedule' | 'blueprint'): never;
+//# sourceMappingURL=m2.d.ts.map

package/dist/commands/m2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"m2.d.ts","sourceRoot":"","sources":["../../src/commands/m2.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,wBAAsB,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzE;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkB/E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlF;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAChF,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnG;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvH;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACnK,OAAO,CAAC,OAAO,CAAC,CAWlB;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAA0B;AAC1G,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAA+B;AAC9H,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItI;AACD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhH;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,KAAK,CAOrF"}