@openwop/cli 1.4.1 → 1.6.0

package/README.md

@@ -134,7 +134,7 @@ openwop packs search ads        # browse the signed pack registry
 
 The `onboard` wizard walks you through:
 
-1. **Host URL** — `https://app.openwop.dev/api` (shared demo), `http://localhost:8080` (local), or a custom URL.
+1. **Host URL** — `https://api.openwop.dev` (shared demo; `https://app.openwop.dev/api` also works), `http://localhost:8080` (local), or a custom URL.
 2. **AI provider** — `anthropic`, `openai`, `google`, or `minimax` (matches what the demo backend dispatches to).
 3. **API key** — auto-detects `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` / `GOOGLE_API_KEY` / `MINIMAX_API_KEY`, or hidden-input via raw-mode stdin. The key is POSTed to `/v1/host/openwop-app/byok/secrets` on the configured host. **The key is never written to your local config file** — only a credential ref pointer is stored.
 4. **Model** — provider-specific recommended defaults plus a custom option.

package/dist/cli.js

@@ -578,7 +578,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.4.1",
+  version: "1.6.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -667,7 +667,10 @@ var PROVIDER_CATALOG = {
   }
 };
 var HOST_PRESETS = [
-  { key: "shared", label: "Shared demo at https://app.openwop.dev/api (recommended for trying things out)", url: "https://app.openwop.dev/api" },
+  // openwop-app ADR 0827: the protocol origin, served straight from Cloud Run with
+  // no CDN in front (`https://app.openwop.dev/api` still works; its edge drops
+  // conditional requests). `openwop login` opens the host-named web page.
+  { key: "shared", label: "Shared demo at https://api.openwop.dev (recommended for trying things out)", url: "https://api.openwop.dev" },
   { key: "local", label: "Local demo at http://localhost:8080 (run `openwop demo start` to launch)", url: "http://localhost:8080" }
 ];
 
@@ -1206,6 +1209,14 @@ function hostRootFor(path, roots) {
   }
   return best === null ? null : `${roots[best]}${path.slice(best.length)}`;
 }
+function hostSurfaceAdvertised(discovery, v1Prefix) {
+  if (!discovery || typeof discovery !== "object") return false;
+  const { paths, extensions } = discovery;
+  if (paths !== null && typeof paths === "object") {
+    return Object.keys(paths).some((p) => p.startsWith(v1Prefix));
+  }
+  return hostRootFor(v1Prefix, hostRootsFrom(extensions)) !== null;
+}
 async function negotiateMajor(ctx) {
   if (ctx.protocolMajor !== void 0) return ctx.protocolMajor;
   const pinned = ctx.env?.OPENWOP_PROTOCOL_MAJOR;
@@ -14925,13 +14936,21 @@ Approve a code ONLY if you just ran \`openwop login\` yourself.
 Exit codes: 0 signed in / signed out \xB7 1 denied, expired or not available on this host \xB7 2 usage.
 
 Examples:
-  export OPENWOP_BASE_URL=https://app.openwop.dev/api
+  export OPENWOP_BASE_URL=https://api.openwop.dev
   openwop login
   openwop login --label "work laptop"
   openwop logout
 `;
 var sleep2 = (ms2) => new Promise((r) => setTimeout(r, ms2));
-function approvalUrl(baseUrl, path) {
+function approvalUrl(baseUrl, path, uri) {
+  if (typeof uri === "string") {
+    try {
+      const u = new URL(uri);
+      const loopback = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+      if (u.protocol === "https:" || u.protocol === "http:" && loopback) return u.toString();
+    } catch {
+    }
+  }
   const p = typeof path === "string" && path.startsWith("/") ? path : "/access?tab=api-keys";
   try {
     return `${new URL(baseUrl).origin}${p}`;
@@ -14969,7 +14988,7 @@ async function runLogin(ctx, argv) {
   const userCode = started?.userCode;
   if (typeof deviceCode !== "string" || typeof userCode !== "string") throw notAvailable(ctx);
   writeLine(ctx.io.stderr, "");
-  writeLine(ctx.io.stderr, `  1. Open   ${approvalUrl(ctx.baseUrl, started.verificationPath)}`);
+  writeLine(ctx.io.stderr, `  1. Open   ${approvalUrl(ctx.baseUrl, started.verificationPath, started.verificationUri)}`);
   writeLine(ctx.io.stderr, `  2. Enter  ${userCode}   under "Sign in the OpenWOP CLI", and approve.`);
   writeLine(ctx.io.stderr, "");
   writeLine(ctx.io.stderr, "Waiting for approval\u2026");
@@ -16887,8 +16906,8 @@ var APPROVALS_ROUTES = [
 var APPROVALS_HELP = `Usage:
   openwop approvals list [--status pending|approved|rejected] [--json]
   openwop approvals get <approvalId> [--json]
-  openwop approvals claim <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
-  openwop approvals reject <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
+  openwop approvals claim <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
+  openwop approvals reject <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
   openwop approvals sla-policy [--json]
   openwop approvals sla-policy set (--enabled | --disabled) [--remind-after-ms n] [--escalate-after-ms n] [--expire-after-ms n] [--json]
   openwop approvals email-pref [--json]
@@ -16926,6 +16945,11 @@ Endpoints:
   --acted-for <s>      (claim/reject) As a delegate covering several people, whose approval this is.
   --expected-hash <h>  (claim/reject) The definition hash you reviewed (composed-workflow proposals;
                        the host refuses the decision if the proposal changed since).
+  --content-hash <h>   (claim/reject) The contentHash of the assistant-action card you reviewed
+                       (\`approvals get\` prints it under the card). REQUIRED to claim an
+                       assistant action (ADR 0862): the host refuses a claim without it (exit 2),
+                       and refuses one whose action changed since you read it (exit 1; re-read
+                       it with \`approvals get\` and review the new card).
   --status <s>   (list) Filter the queue: pending | approved | rejected (default: all).
   --note <text>  (claim/reject) Optional human note recorded with the decision.
   --json         Print the raw host response instead of the rendered view.
@@ -16942,6 +16966,8 @@ Examples:
   openwop approvals list --status pending
   openwop approvals get appr_123 --json
   openwop approvals claim appr_123 --note "LGTM, ship it"
+  openwop approvals get appr_456                      # an assistant action: read the card
+  openwop approvals claim appr_456 --content-hash 9f2c\u2026   # \u2026then approve exactly what you read
   openwop approvals reject appr_123 --note "out of policy"
 
 Teams approval delivery:
@@ -16988,8 +17014,7 @@ function exitForStatus(status) {
 async function ensureApprovalsAdvertised(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/approvals"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/approvals");
   if (!advertised) {
     throw new CliError(
       "approvals: this host does not advertise the approval-inbox surface (/v1/host/openwop-app/approvals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -17074,12 +17099,31 @@ async function runApprovalsGet(ctx, argv) {
   if (approval.resolvedAt) writeLine(ctx.io.stdout, `resolvedAt: ${approval.resolvedAt}`);
   if (approval.runId) writeLine(ctx.io.stdout, `runId: ${approval.runId}`);
   if (approval.note) writeLine(ctx.io.stdout, `note: ${approval.note}`);
+  if (approval.action && typeof approval.action === "object") renderActionCard(ctx, approval.action);
   return exitForStatus(approval.status);
 }
+function renderActionCard(ctx, action) {
+  writeLine(ctx.io.stdout, "action:");
+  if (action.actionId) writeLine(ctx.io.stdout, `  actionId: ${action.actionId}`);
+  if (action.kind) writeLine(ctx.io.stdout, `  kind: ${action.kind}`);
+  if (action.riskLevel) writeLine(ctx.io.stdout, `  riskLevel: ${action.riskLevel}`);
+  if (action.reason) writeLine(ctx.io.stdout, `  reason: ${action.reason}`);
+  if (typeof action.draft === "string" && action.draft.length) writeLine(ctx.io.stdout, `  draft: ${action.draft}`);
+  if (action.payload && typeof action.payload === "object") {
+    for (const [k, v] of Object.entries(action.payload)) {
+      writeLine(ctx.io.stdout, `  ${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`);
+    }
+  }
+  if (action.contentHash) writeLine(ctx.io.stdout, `  contentHash: ${action.contentHash}   (claim with --content-hash ${action.contentHash})`);
+}
+function detailsOf(body) {
+  const d = body && typeof body === "object" ? body.details : void 0;
+  return d && typeof d === "object" ? d : {};
+}
 async function runApprovalsResolve(ctx, argv, verb) {
-  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note", "--acted-for", "--expected-hash"] });
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note", "--acted-for", "--expected-hash", "--content-hash"] });
   if (options.help || positionals.length !== 1) {
-    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
+    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
 `);
     return options.help ? 0 : 2;
   }
@@ -17089,11 +17133,25 @@ async function runApprovalsResolve(ctx, argv, verb) {
   if (options.note !== void 0) decision.note = options.note;
   if (options.actedFor !== void 0) decision.actedFor = options.actedFor;
   if (options.expectedHash !== void 0) decision.expectedDefinitionHash = options.expectedHash;
+  if (options.contentHash !== void 0) decision.expectedContentHash = options.contentHash;
   const body = Object.keys(decision).length ? decision : void 0;
   let res;
   try {
     res = await requestJson(ctx, path, { method: "POST", ...body !== void 0 ? { body } : {} });
   } catch (err) {
+    if (err instanceof HttpError && err.status === 409 && detailsOf(err.body).reason === "action_changed") {
+      const now = detailsOf(err.body).contentHash;
+      throw new CliError(
+        `approvals: the action behind ${positionals[0]} changed since you reviewed it \u2014 nothing was ${verb === "claim" ? "approved" : "rejected"}. Re-read it with \`openwop approvals get ${positionals[0]}\`${now ? ` (its card now hashes to ${now})` : ""} and decide on what it says now.`,
+        1
+      );
+    }
+    if (err instanceof HttpError && err.status === 400 && detailsOf(err.body).reason === "content_hash_required") {
+      throw new CliError(
+        `approvals: ${positionals[0]} is an assistant action \u2014 read its card with \`openwop approvals get ${positionals[0]}\`, then pass the contentHash it shows: --content-hash <hash>.`,
+        2
+      );
+    }
     if (err instanceof HttpError && err.status === 409) {
       const status = err.body?.status;
       throw new CliError(`approvals: ${positionals[0]} is already ${status ?? "resolved"} \u2014 the host rejected a second decision.`, 1);
@@ -17975,8 +18033,7 @@ Run \`openwop connections --help\` for usage.`);
 async function ensureAdvertised(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/connections"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/connections");
   if (!advertised) {
     throw new CliError(
       "connections: this host does not advertise the connections surface (/v1/host/openwop-app/connections is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -19385,8 +19442,7 @@ Run \`openwop workforces --help\` for usage.`);
 async function ensureAdvertised2(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/workforces"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/workforces");
   if (!advertised) {
     throw new CliError(
       "workforces: this host does not advertise the workforces surface (/v1/host/openwop-app/workforces is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -30933,6 +30989,7 @@ export {
   getChannelPlugin,
   hostRootFor,
   hostRootsFrom,
+  hostSurfaceAdvertised,
   idempotencyHeaders,
   isNoCredentialChallenge,
   isTerminalRunEvent,

package/dist/openwop.js

@@ -579,7 +579,7 @@ function errText(err) {
 // package.json
 var package_default = {
   name: "@openwop/cli",
-  version: "1.4.1",
+  version: "1.6.0",
   description: "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   license: "Apache-2.0",
   type: "module",
@@ -668,7 +668,10 @@ var PROVIDER_CATALOG = {
   }
 };
 var HOST_PRESETS = [
-  { key: "shared", label: "Shared demo at https://app.openwop.dev/api (recommended for trying things out)", url: "https://app.openwop.dev/api" },
+  // openwop-app ADR 0827: the protocol origin, served straight from Cloud Run with
+  // no CDN in front (`https://app.openwop.dev/api` still works; its edge drops
+  // conditional requests). `openwop login` opens the host-named web page.
+  { key: "shared", label: "Shared demo at https://api.openwop.dev (recommended for trying things out)", url: "https://api.openwop.dev" },
   { key: "local", label: "Local demo at http://localhost:8080 (run `openwop demo start` to launch)", url: "http://localhost:8080" }
 ];
 
@@ -1206,6 +1209,14 @@ function hostRootFor(path, roots) {
   }
   return best === null ? null : `${roots[best]}${path.slice(best.length)}`;
 }
+function hostSurfaceAdvertised(discovery, v1Prefix) {
+  if (!discovery || typeof discovery !== "object") return false;
+  const { paths, extensions } = discovery;
+  if (paths !== null && typeof paths === "object") {
+    return Object.keys(paths).some((p) => p.startsWith(v1Prefix));
+  }
+  return hostRootFor(v1Prefix, hostRootsFrom(extensions)) !== null;
+}
 async function negotiateMajor(ctx) {
   if (ctx.protocolMajor !== void 0) return ctx.protocolMajor;
   const pinned = ctx.env?.OPENWOP_PROTOCOL_MAJOR;
@@ -14925,13 +14936,21 @@ Approve a code ONLY if you just ran \`openwop login\` yourself.
 Exit codes: 0 signed in / signed out \xB7 1 denied, expired or not available on this host \xB7 2 usage.
 
 Examples:
-  export OPENWOP_BASE_URL=https://app.openwop.dev/api
+  export OPENWOP_BASE_URL=https://api.openwop.dev
   openwop login
   openwop login --label "work laptop"
   openwop logout
 `;
 var sleep2 = (ms2) => new Promise((r) => setTimeout(r, ms2));
-function approvalUrl(baseUrl, path) {
+function approvalUrl(baseUrl, path, uri) {
+  if (typeof uri === "string") {
+    try {
+      const u = new URL(uri);
+      const loopback = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
+      if (u.protocol === "https:" || u.protocol === "http:" && loopback) return u.toString();
+    } catch {
+    }
+  }
   const p = typeof path === "string" && path.startsWith("/") ? path : "/access?tab=api-keys";
   try {
     return `${new URL(baseUrl).origin}${p}`;
@@ -14969,7 +14988,7 @@ async function runLogin(ctx, argv) {
   const userCode = started?.userCode;
   if (typeof deviceCode !== "string" || typeof userCode !== "string") throw notAvailable(ctx);
   writeLine(ctx.io.stderr, "");
-  writeLine(ctx.io.stderr, `  1. Open   ${approvalUrl(ctx.baseUrl, started.verificationPath)}`);
+  writeLine(ctx.io.stderr, `  1. Open   ${approvalUrl(ctx.baseUrl, started.verificationPath, started.verificationUri)}`);
   writeLine(ctx.io.stderr, `  2. Enter  ${userCode}   under "Sign in the OpenWOP CLI", and approve.`);
   writeLine(ctx.io.stderr, "");
   writeLine(ctx.io.stderr, "Waiting for approval\u2026");
@@ -16887,8 +16906,8 @@ var APPROVALS_ROUTES = [
 var APPROVALS_HELP = `Usage:
   openwop approvals list [--status pending|approved|rejected] [--json]
   openwop approvals get <approvalId> [--json]
-  openwop approvals claim <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
-  openwop approvals reject <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
+  openwop approvals claim <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
+  openwop approvals reject <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
   openwop approvals sla-policy [--json]
   openwop approvals sla-policy set (--enabled | --disabled) [--remind-after-ms n] [--escalate-after-ms n] [--expire-after-ms n] [--json]
   openwop approvals email-pref [--json]
@@ -16926,6 +16945,11 @@ Endpoints:
   --acted-for <s>      (claim/reject) As a delegate covering several people, whose approval this is.
   --expected-hash <h>  (claim/reject) The definition hash you reviewed (composed-workflow proposals;
                        the host refuses the decision if the proposal changed since).
+  --content-hash <h>   (claim/reject) The contentHash of the assistant-action card you reviewed
+                       (\`approvals get\` prints it under the card). REQUIRED to claim an
+                       assistant action (ADR 0862): the host refuses a claim without it (exit 2),
+                       and refuses one whose action changed since you read it (exit 1; re-read
+                       it with \`approvals get\` and review the new card).
   --status <s>   (list) Filter the queue: pending | approved | rejected (default: all).
   --note <text>  (claim/reject) Optional human note recorded with the decision.
   --json         Print the raw host response instead of the rendered view.
@@ -16942,6 +16966,8 @@ Examples:
   openwop approvals list --status pending
   openwop approvals get appr_123 --json
   openwop approvals claim appr_123 --note "LGTM, ship it"
+  openwop approvals get appr_456                      # an assistant action: read the card
+  openwop approvals claim appr_456 --content-hash 9f2c\u2026   # \u2026then approve exactly what you read
   openwop approvals reject appr_123 --note "out of policy"
 
 Teams approval delivery:
@@ -16988,8 +17014,7 @@ function exitForStatus(status) {
 async function ensureApprovalsAdvertised(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/approvals"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/approvals");
   if (!advertised) {
     throw new CliError(
       "approvals: this host does not advertise the approval-inbox surface (/v1/host/openwop-app/approvals is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -17074,12 +17099,31 @@ async function runApprovalsGet(ctx, argv) {
   if (approval.resolvedAt) writeLine(ctx.io.stdout, `resolvedAt: ${approval.resolvedAt}`);
   if (approval.runId) writeLine(ctx.io.stdout, `runId: ${approval.runId}`);
   if (approval.note) writeLine(ctx.io.stdout, `note: ${approval.note}`);
+  if (approval.action && typeof approval.action === "object") renderActionCard(ctx, approval.action);
   return exitForStatus(approval.status);
 }
+function renderActionCard(ctx, action) {
+  writeLine(ctx.io.stdout, "action:");
+  if (action.actionId) writeLine(ctx.io.stdout, `  actionId: ${action.actionId}`);
+  if (action.kind) writeLine(ctx.io.stdout, `  kind: ${action.kind}`);
+  if (action.riskLevel) writeLine(ctx.io.stdout, `  riskLevel: ${action.riskLevel}`);
+  if (action.reason) writeLine(ctx.io.stdout, `  reason: ${action.reason}`);
+  if (typeof action.draft === "string" && action.draft.length) writeLine(ctx.io.stdout, `  draft: ${action.draft}`);
+  if (action.payload && typeof action.payload === "object") {
+    for (const [k, v] of Object.entries(action.payload)) {
+      writeLine(ctx.io.stdout, `  ${k}: ${typeof v === "string" ? v : JSON.stringify(v)}`);
+    }
+  }
+  if (action.contentHash) writeLine(ctx.io.stdout, `  contentHash: ${action.contentHash}   (claim with --content-hash ${action.contentHash})`);
+}
+function detailsOf(body) {
+  const d = body && typeof body === "object" ? body.details : void 0;
+  return d && typeof d === "object" ? d : {};
+}
 async function runApprovalsResolve(ctx, argv, verb) {
-  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note", "--acted-for", "--expected-hash"] });
+  const { options, positionals } = parseOptions(argv, { bool: ["--help"], value: ["--note", "--acted-for", "--expected-hash", "--content-hash"] });
   if (options.help || positionals.length !== 1) {
-    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--json]
+    write(ctx.io.stdout, `Usage: openwop approvals ${verb} <approvalId> [--note <text>] [--acted-for <subject>] [--expected-hash <h>] [--content-hash <h>] [--json]
 `);
     return options.help ? 0 : 2;
   }
@@ -17089,11 +17133,25 @@ async function runApprovalsResolve(ctx, argv, verb) {
   if (options.note !== void 0) decision.note = options.note;
   if (options.actedFor !== void 0) decision.actedFor = options.actedFor;
   if (options.expectedHash !== void 0) decision.expectedDefinitionHash = options.expectedHash;
+  if (options.contentHash !== void 0) decision.expectedContentHash = options.contentHash;
   const body = Object.keys(decision).length ? decision : void 0;
   let res;
   try {
     res = await requestJson(ctx, path, { method: "POST", ...body !== void 0 ? { body } : {} });
   } catch (err) {
+    if (err instanceof HttpError && err.status === 409 && detailsOf(err.body).reason === "action_changed") {
+      const now = detailsOf(err.body).contentHash;
+      throw new CliError(
+        `approvals: the action behind ${positionals[0]} changed since you reviewed it \u2014 nothing was ${verb === "claim" ? "approved" : "rejected"}. Re-read it with \`openwop approvals get ${positionals[0]}\`${now ? ` (its card now hashes to ${now})` : ""} and decide on what it says now.`,
+        1
+      );
+    }
+    if (err instanceof HttpError && err.status === 400 && detailsOf(err.body).reason === "content_hash_required") {
+      throw new CliError(
+        `approvals: ${positionals[0]} is an assistant action \u2014 read its card with \`openwop approvals get ${positionals[0]}\`, then pass the contentHash it shows: --content-hash <hash>.`,
+        2
+      );
+    }
     if (err instanceof HttpError && err.status === 409) {
       const status = err.body?.status;
       throw new CliError(`approvals: ${positionals[0]} is already ${status ?? "resolved"} \u2014 the host rejected a second decision.`, 1);
@@ -17975,8 +18033,7 @@ Run \`openwop connections --help\` for usage.`);
 async function ensureAdvertised(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/connections"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/connections");
   if (!advertised) {
     throw new CliError(
       "connections: this host does not advertise the connections surface (/v1/host/openwop-app/connections is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",
@@ -19385,8 +19442,7 @@ Run \`openwop workforces --help\` for usage.`);
 async function ensureAdvertised2(ctx) {
   const wk = await safeRequest(ctx, "/.well-known/openwop", { auth: false });
   if (!wk.ok) return;
-  const paths = wk.body && typeof wk.body === "object" ? wk.body.paths : void 0;
-  const advertised = paths !== null && typeof paths === "object" && Object.keys(paths).some((p) => p.startsWith("/v1/host/openwop-app/workforces"));
+  const advertised = hostSurfaceAdvertised(wk.body, "/v1/host/openwop-app/workforces");
   if (!advertised) {
     throw new CliError(
       "workforces: this host does not advertise the workforces surface (/v1/host/openwop-app/workforces is absent from /.well-known/openwop). The host is the authority \u2014 refusing to guess.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/cli",
-  "version": "1.4.1",
+  "version": "1.6.0",
   "description": "OpenWOP CLI for operating the workflow-engine demo app and OpenWOP-compatible hosts.",
   "license": "Apache-2.0",
   "type": "module",