@rosthq/cli 0.7.122 → 0.7.124

package/README.md

@@ -96,6 +96,64 @@ rost onboard status
 rost onboard resume
 ```
 
+Every tenant-scoped `rost onboard` verb (and `rost seat create-complete`)
+authenticates with an existing implementation-bootstrap credential first and
+falls back to the user session, so the whole composite flow below runs without
+a personal login. (`rost onboard run` prints the public onboarding prompt
+offline and needs no credential.)
+
+Retain each allowed local business source before constructing the setup plan.
+The CLI reads the file and base64-encodes it client-side; the server computes
+the digest and canonical family manifest and rejects paths, URLs, and
+client-supplied digests:
+
+```bash
+rost onboard source-ingest \
+  --file ./org-chart.csv \
+  --source-key org-chart \
+  --kind org_chart \
+  --title "Org chart" \
+  --json
+```
+
+The JSON output contains the opaque `source_upload_id` and the exact
+`source_ref` object to place in the setup plan's `sources[]`.
+
+Transport note: the command body is capped server-side at 1 MiB, and base64
+expands content by 4/3 — so the largest source file reachable through this
+command today is about 780 KB, not the protocol's documented 5,000,000-byte
+bound. The CLI checks this before sending and names the exact fitting size;
+split or trim a larger export.
+
+Stage the one-approval composite setup with the complete declarative plan
+(`--input '<json>'` inline, or `--input-file <path>` for a large plan):
+
+```bash
+rost onboard setup --input-file ./setup-plan.json --json
+```
+
+Staging succeeds with exit code 0: the server holds the one owner approval and
+the CLI prints the pending confirmation id and the exact approval URL (with
+`--json`, the full pending-confirmation object including
+`approveVia.webUrl`). Hand the human that one URL.
+
+Discover the setup state through the command's idempotent contract by
+re-submitting the identical plan:
+
+```bash
+rost onboard setup-status --input-file ./setup-plan.json --json
+```
+
+After the owner approves, this returns the immutable applied receipt — the
+`application_id`, `receipt.receipt_revision`, and `receipt.digests.input` are
+exactly the `--setup-application-id`, `--expected-receipt-revision`, and
+`--expected-input-digest` the rehearsal step needs. While approval is still
+pending, re-submission returns the current approval card: an identical
+still-valid card is reused with the same confirmation id and URL; only a
+changed server-derived projection (live state moved) supersedes the stale card
+and mints a fresh one. After application, a same-key re-submission with a
+*different* plan digest is a typed conflict, never a mutation.
+
 After the owner approves the atomic setup proposal, run the exact receipt-bound
 sandbox rehearsal:
 
@@ -117,8 +175,27 @@ runtime run IDs. It never returns an approval URL, makes an agent live, arms a
 schedule, accesses credentials, mutates sources, sends externally, or stages a
 confirmation. A retry with the same key and configuration returns the same
 terminal evidence; changed configuration is a conflict. Keep that exact evidence
-for the separate later `rost onboard activate` step, which alone stages the
-post-rehearsal activation approval.
+for the separate activation step:
+
+```bash
+rost onboard activate \
+  --setup-application-id <application-id> \
+  --expected-input-digest <digest> \
+  --expected-receipt-revision <revision> \
+  --terminal-rehearsal-batch-receipt-id <batch-receipt-id> \
+  --rehearsal-runs '[{"agent_id":"<agent-id>","rehearsal_run_id":"<run-id>"}]' \
+  --configuration-digests '[{"agent_id":"<agent-id>","configuration_digest":"<digest>"}]' \
+  --idempotency-key <stable-key> \
+  --json
+```
+
+`rost onboard activate` accepts only the exact all-passed terminal batch and
+per-agent evidence returned by rehearsal. It stages one complete owner approval
+showing every agent, Seat, Charter/configuration digest, rehearsal run, effective
+lane/model, permissions, schedule, warnings, and the onboarding-completion
+effect. Approval makes every receipt agent live, arms eligible schedules, and
+completes onboarding in one transaction; any stale or failed agent rolls the
+whole activation back. A same-key retry returns the original committed receipt.
 
 Register the same `rost_impl_` bearer with an MCP client. This uses the bearer directly; there is no `mcp_token.create` step and no second token:
 
@@ -128,4 +205,4 @@ rost implementation access install-mcp --client codex
 rost implementation access install-mcp --client cursor
 ```
 
-The implementation credential is intentionally narrow and fail-closed. It can run vetted reads (for example `onboarding.status`, `graph.get`, `charter.get/list`, `compass.get_current`, `goal.list`, `agent.list_fleet`, `system.health`), stage human-gated proposals (`onboarding.setup`, `seat.create_complete`, `agent.create_custom`, `agent.create_from_template`, `compass.set`, `compass.approve_version`, `onboarding.finish`), execute only the receipt-bound sandbox exception `onboarding.rehearse`, and close its own run. `seat.create_complete` stages one atomic complete-Seat proposal for an owner to approve; it never makes an optional agent live. The rehearsal exception grants no general agent execution authority and cannot reach unrelated agents. Everything else, including other confirmation-free durable mutations and `confirmation.approve`, is denied. The policy module is `packages/commands/src/implementation-bootstrap-policy.ts` and is enforced by both the runtime guard and a CI drift test.
+The implementation credential is intentionally narrow and fail-closed. It can run vetted reads (for example `onboarding.status`, `graph.get`, `charter.get/list`, `compass.get_current`, `goal.list`, `agent.list_fleet`, `system.health`), stage human-gated proposals (`onboarding.setup`, `onboarding.activate`, `seat.create_complete`, `agent.create_custom`, `agent.create_from_template`, `compass.set`, `compass.approve_version`, `onboarding.finish`), execute only the receipt-bound sandbox exception `onboarding.rehearse`, and close its own run. `seat.create_complete` stages one atomic complete-Seat proposal for an owner to approve; it never makes an optional agent live. `onboarding.activate` stages the one post-rehearsal owner decision and cannot approve itself. The rehearsal exception grants no general agent execution authority and cannot reach unrelated agents. Everything else, including other confirmation-free durable mutations and `confirmation.approve`, is denied. The policy module is `packages/commands/src/implementation-bootstrap-policy.ts` and is enforced by both the runtime guard and a CI drift test.

package/dist/commands/onboarding.d.ts

@@ -5,17 +5,39 @@ type CliIo = {
 };
 export type OnboardingDeps = {
     makeClient(): Promise<CommandClient>;
+    readFile?: (path: string) => Promise<Buffer>;
 };
 export type OnboardingInvocation = {
-    commandId: "onboarding.status" | "onboarding.resume" | "onboarding.rehearse";
+    commandId: "onboarding.status" | "onboarding.resume" | "onboarding.rehearse" | "onboarding.activate" | "onboarding.source_ingest" | "onboarding.setup";
     body: Record<string, unknown>;
     json: boolean;
-    action: "status" | "resume" | "rehearse";
+    action: "status" | "resume" | "rehearse" | "activate" | "source-ingest" | "setup" | "setup-status";
+    sourceFile?: string;
+    inputFile?: string;
 };
 export declare class OnboardingUsageError extends Error {
     constructor(message: string);
 }
 export declare function runOnboarding(args: string[], io: CliIo, deps: OnboardingDeps): Promise<number>;
+/**
+ * Execute a parsed (file-resolved) invocation and render its result. Shared by
+ * the user-session path (runOnboarding) and the implementation-credential path
+ * in index.ts, so both credentials get identical bodies and rendering.
+ *
+ * `onError` lets the implementation-credential caller intercept a dead-run
+ * credential (fall through to the user session) before the error is printed.
+ */
+export declare function executeOnboardingInvocation(invocation: OnboardingInvocation, io: CliIo, client: CommandClient): Promise<number>;
+export declare function executeOnboardingInvocation(invocation: OnboardingInvocation, io: CliIo, client: CommandClient, options: {
+    onError: (error: unknown) => "handled" | "print";
+}): Promise<number | "fall-through">;
+/**
+ * Resolve the local file reads a parsed invocation deferred: the source bytes
+ * behind `onboard source-ingest --file` (base64-encoded client-side; the server
+ * never accepts paths) and the JSON plan behind `--input-file`. Read failures
+ * surface as usage errors before any client is constructed.
+ */
+export declare function resolveOnboardingInvocationFiles(invocation: OnboardingInvocation, readFileImpl?: (path: string) => Promise<Buffer>): Promise<void>;
 export declare function parseOnboardingInvocation(args: string[]): OnboardingInvocation;
 export declare function onboardingUsage(): string;
 export declare function formatOnboardingOutput(action: OnboardingInvocation["action"], output: unknown): string;

package/dist/commands/onboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAC;AAIzE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAI3B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC,CAAC;AASF,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,qBAAqB,CAAC;IAC7E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;CAC1C,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBpG;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CA4E9E;AAED,wBAAgB,eAAe,IAAI,MAAM,CAKxC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,OAAO,GACd,MAAM,CAWR"}
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../src/commands/onboarding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAC;AAKzE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAI3B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAGrC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C,CAAC;AAmDF,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EACL,mBAAmB,GACnB,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,kBAAkB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,GAAG,OAAO,GAAG,cAAc,CAAC;IAInG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAepG;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,EAChC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,CAAC,CAAC;AACnB,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,EAChC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,GAAG,OAAO,CAAA;CAAE,GAC5D,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;AAmCpC;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,oBAAoB,EAChC,YAAY,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAY,GACzD,OAAO,CAAC,IAAI,CAAC,CA8Cf;AA8DD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,CA+G9E;AA2FD,wBAAgB,eAAe,IAAI,MAAM,CASxC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,OAAO,GACd,MAAM,CAoBR"}

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAuS3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAwS3D,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAmCrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAI1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAKF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAUxC;AAID,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAGlD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;CACtC,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyanG;AA0gBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAoCrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAI1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAKF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAUxC;AAID,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAGlD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;CACtC,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmenG;AA8gBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}