@sequenceholdings/studio-cli 0.1.18 → 0.1.22

package/dist/functions/commands.js

@@ -15,8 +15,10 @@ import { confirmYes } from '../prompt.js';
 import { collectBundleFiles, isDirectory, validateLocalBundle, } from './bundle.js';
 import { managedFunctionManifestSchema, MF_MANIFEST_FILENAME, manifestEgressHosts, manifestEgressIpRanges, } from './manifest.js';
 import { buildEgressPreviewLines, egressPropagationNote, formatEgressSummary, printFunctionEgressHosts, } from './egress-preview.js';
-import { parseSourceSpec, resolveArtifactSource, } from '@sequenceholdings/artifact-studio/source-resolver';
+import { resolveArtifactSource, } from '@sequenceholdings/artifact-studio/source-resolver';
 import { buildSecretPreviewLines, classifySecrets, } from './secret-reconcile.js';
+import { parseFunctionsSourceSelection, resolveFunctionSourceDir, } from './source-selection.js';
+export { parseFunctionsSourceSelection, parseFunctionsSourceSpec, resolveFunctionSourceDir } from './source-selection.js';
 const execFileAsync = promisify(execFile);
 export const LOG = '[seq-studio]';
 const POLL_INTERVAL_MS = 5_000;
@@ -85,20 +87,6 @@ export function workDir(args) {
     const dir = typeof args.flags.dir === 'string' ? args.flags.dir : '.';
     return resolve(dir);
 }
-/**
- * Source selection for build/deploy: --dir (local, default '.'), a platform
- * git-service repo (--repo <ns>/<name>), or any git URL (--git-url <url>);
- * --ref picks a branch/tag/commit. Reuses the artifact-studio resolver —
- * functions name their local dir with --dir rather than a positional, so map
- * it onto the spec parser's positional slot.
- */
-export function parseFunctionsSourceSpec(args) {
-    const dir = typeof args.flags.dir === 'string' ? args.flags.dir : undefined;
-    if (dir !== undefined && (args.flags.repo !== undefined || args.flags['git-url'] !== undefined)) {
-        throw new Error('--dir cannot be combined with --repo / --git-url.');
-    }
-    return parseSourceSpec({ positional: dir === undefined ? [] : [dir], flags: args.flags });
-}
 /** Manifest read with a source-aware error for the missing case. */
 async function readSourceManifest(dir, spec) {
     const manifest = await readManifestOptional(dir);
@@ -106,7 +94,7 @@ async function readSourceManifest(dir, spec) {
         return manifest;
     throw new Error(spec.kind === 'local'
         ? `No ${MF_MANIFEST_FILENAME} in ${dir}. Run \`seq-studio functions init\` to scaffold one, or pass --dir.`
-        : `No ${MF_MANIFEST_FILENAME} at the root of the source repo — a managed-function repo keeps its manifest at the top level.`);
+        : `No ${MF_MANIFEST_FILENAME} in the selected remote source directory — keep it at the repo root or select a function directory with --path.`);
 }
 /**
  * Resolve the target function: --fn <slug> wins, else the manifest in the
@@ -210,6 +198,7 @@ entrypoint: handler
 limits:
   memory_mb: 256
   timeout_seconds: 60
+  min_instances: 0
   max_instances: 3
   invoke_rate_per_minute: 60
 
@@ -349,14 +338,15 @@ export async function functionsInitCommand(args) {
 // build (local pre-flight)
 // ---------------------------------------------------------------------------
 export async function functionsBuildCommand(args) {
-    const spec = parseFunctionsSourceSpec(args);
+    const { spec, path } = parseFunctionsSourceSelection(args);
     // A public git URL needs no bearer token, but optional auth resolution still
     // identifies a selected M2M principal so policy can reject arbitrary CI
     // input before cloning. Local builds remain completely offline.
     const remote = await buildSourceOptions({ args, spec });
     const source = await resolveArtifactSource(spec, remote);
     try {
-        return await buildFromResolvedSource({ spec, source });
+        const dir = await resolveFunctionSourceDir({ repoDir: source.dir, path });
+        return await buildFromResolvedSource({ spec, source: { ...source, dir } });
     }
     finally {
         await source.cleanup();
@@ -417,7 +407,7 @@ export async function functionsDeployCommand(args) {
         console.error(`${LOG} ${REQUIRE_EXPLICIT_ENV_MESSAGE}`);
         return 1;
     }
-    const spec = parseFunctionsSourceSpec(args);
+    const { spec, path } = parseFunctionsSourceSelection(args);
     // Remote deploys resolve auth up front: --repo needs it to fetch the tree,
     // while --git-url must reject a selected M2M principal before cloning.
     // Local sources still defer auth until after validation so malformed local
@@ -425,7 +415,8 @@ export async function functionsDeployCommand(args) {
     const ctx = spec.kind !== 'local' ? await buildContext(args) : null;
     const source = await resolveArtifactSource(spec, ctx ? sourceClientOptions(ctx) : {});
     try {
-        return await deployFromResolvedSource({ args, spec, ctx, source });
+        const dir = await resolveFunctionSourceDir({ repoDir: source.dir, path });
+        return await deployFromResolvedSource({ args, spec, ctx, source: { ...source, dir } });
     }
     finally {
         await source.cleanup();
@@ -983,17 +974,19 @@ export const FUNCTIONS_USAGE = `usage:
                                                       (version history is retained)
 
   Flags: -e/--env <env|preview:<slug>> (required for network commands; see: seq-studio envs list) · --fn <slug> · --dir <path>
+         --path <repo-subdirectory>  (remote build/deploy only) select one function in a multi-function repo
          --from-env-file <path>  (default: .env) source file for secret values
          --no-wait · --yes
          --no-provision  (deploy) update-only: error instead of registering a new
                          shell, writing secret values, or attaching secrets (CI sweep)
 
   Source for build/deploy: a local --dir (default .), a platform git-service
-  repo (--repo <ns>/<name>), or a public HTTPS git URL (--git-url <url>). --ref selects a
-  branch/tag/commit (default: the repo's default branch). Remote sources record
-  the pinned commit as provenance (never dirty) and NEVER read a repo-committed
-  .env for secret values — provision secrets server-side or pass a local
-  --from-env-file (resolved against your cwd).
+  repo (--repo <ns>/<name>), or a public HTTPS git URL (--git-url <url>). --path selects
+  a function directory within a remote repo; omit it for the existing root-manifest
+  layout. --ref selects a branch/tag/commit (default: the repo's default branch).
+  Remote sources record the pinned commit as provenance (never dirty) and NEVER
+  read a repo-committed .env for secret values — provision secrets server-side
+  or pass a local --from-env-file (resolved against your cwd).
 
   Interactive --repo builds clone over smart-HTTP and require a repo:read git
   PAT in ATLAS_GIT_PAT (\`seq-studio auth pat create --scopes repo:read\`, or

package/dist/functions/manifest.d.ts

@@ -52,6 +52,7 @@ export declare const managedFunctionManifestSchema: z.ZodObject<{
     limits: z.ZodDefault<z.ZodObject<{
         memory_mb: z.ZodDefault<z.ZodNumber>;
         timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        min_instances: z.ZodDefault<z.ZodNumber>;
         max_instances: z.ZodDefault<z.ZodNumber>;
         invoke_rate_per_minute: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
@@ -83,6 +84,7 @@ export declare const managedFunctionManifestSchema: z.ZodObject<{
         data: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             tables: z.ZodDefault<z.ZodArray<z.ZodString>>;
             actions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            operations: z.ZodDefault<z.ZodArray<z.ZodString>>;
             query: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strip>>>;
     }, z.core.$strip>>;

package/dist/functions/manifest.js

@@ -493,6 +493,12 @@ function validateCapabilityGates({ gates, uses, roles, }) {
  * Mirrors atlas/src/server/services/managed-functions/manifest.ts.
  */
 const SERVICE_ACCOUNT_REF_RE = /^([a-z][a-z0-9-]{1,98}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
+/**
+ * GraphQL Name grammar — persisted-operation names exactly as they appear in
+ * a namespace's operations manifest. Mirrors
+ * atlas/src/server/services/managed-functions/manifest.ts.
+ */
+const GRAPHQL_OPERATION_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]*$/;
 export const managedFunctionManifestSchema = z.object({
     schema_version: z.literal(1).default(1),
     function: z.object({
@@ -510,12 +516,23 @@ export const managedFunctionManifestSchema = z.object({
         .object({
         memory_mb: z.number().int().min(128).max(2048).default(256),
         timeout_seconds: z.number().int().min(1).max(540).default(60),
+        min_instances: z.number().int().min(0).max(10).default(0),
         max_instances: z.number().int().min(1).max(10).default(3),
         invoke_rate_per_minute: z.number().int().min(1).max(600).default(60),
+    })
+        .superRefine((limits, ctx) => {
+        if (limits.min_instances > limits.max_instances) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'min_instances cannot exceed max_instances',
+                path: ['min_instances'],
+            });
+        }
     })
         .default({
         memory_mb: 256,
         timeout_seconds: 60,
+        min_instances: 0,
         max_instances: 3,
         invoke_rate_per_minute: 60,
     }),
@@ -567,12 +584,13 @@ export const managedFunctionManifestSchema = z.object({
         gates: capabilityGatesSchema,
         /**
          * ORM Data API consumer reach, grouped by namespace: the `tables` this
-         * function may read, the `actions` it may invoke, and whether raw `query`
-         * (arbitrary read SQL over the namespace) is allowed — all ON BEHALF OF the
-         * invoking user. The invoke proxy mints a short-lived token scoped to
-         * exactly these refs; the Data API re-resolves the user's claims per call,
-         * so declaring a table never widens what the user could see. Writes go
-         * through declared actions only — raw table writes don't exist.
+         * function may read, the v1 `actions` and v2 persisted `operations` it may
+         * invoke, and whether raw `query` (arbitrary read SQL over the namespace)
+         * is allowed — all ON BEHALF OF the invoking user. The invoke proxy mints
+         * a short-lived token scoped to exactly these refs; the Data API
+         * re-resolves the user's claims per call, so declaring a table never
+         * widens what the user could see. Writes go through declared actions and
+         * operations only — raw table writes don't exist.
          *
          * Mirrors atlas/src/server/services/managed-functions/manifest.ts — must
          * stay in sync so `seq-studio` doesn't strip the block before deploy.
@@ -581,6 +599,18 @@ export const managedFunctionManifestSchema = z.object({
             .record(z.string().regex(/^[a-z][a-z0-9_]{0,40}$/, 'capabilities.data keys are ORM namespace names'), z.object({
             tables: z.array(z.string().regex(/^[a-z_][a-z0-9_]*$/, 'table names')).max(64).default([]),
             actions: z.array(z.string().regex(/^[a-z_][a-z0-9_]*$/, 'action names')).max(64).default([]),
+            /**
+             * ORM v2 persisted operations (GraphQL mutations/actions by name)
+             * this function may execute — each mints a `<ns>/ops/<Name>` write
+             * ref on the invoke token.
+             */
+            operations: z
+                .array(z
+                .string()
+                .max(128)
+                .regex(GRAPHQL_OPERATION_NAME_RE, 'operation names must match the GraphQL Name grammar'))
+                .max(64)
+                .default([]),
             query: z.boolean().default(false),
         }))
             .default({}),
@@ -600,9 +630,9 @@ export const managedFunctionManifestSchema = z.object({
         ctx.addIssue({ code: 'custom', message, path: ['capabilities', 'gates'] });
     }
     // A namespace is "reached" when its block declares at least one table,
-    // action, or raw query — the same rule the server's floor reconciliation
-    // uses (readManifestDataNamespaces).
-    const reachesData = Object.values(manifest.capabilities.data).some((block) => block.tables.length > 0 || block.actions.length > 0 || block.query);
+    // action, operation, or raw query — the same rule the server's floor
+    // reconciliation uses (readManifestDataNamespaces).
+    const reachesData = Object.values(manifest.capabilities.data).some((block) => block.tables.length > 0 || block.actions.length > 0 || block.operations.length > 0 || block.query);
     if (reachesData && manifest.service_account === undefined) {
         ctx.addIssue({
             code: 'custom',

package/dist/functions/source-selection.d.ts

@@ -0,0 +1,24 @@
+import { type SourceSpec } from '@sequenceholdings/artifact-studio/source-resolver';
+import type { ParsedArgs } from '../process/commands.js';
+export interface FunctionsSourceSelection {
+    spec: SourceSpec;
+    path?: string;
+}
+/**
+ * Functions name their local source with --dir rather than a positional, so
+ * map it onto the shared source parser used by other seq-studio primitives.
+ */
+export declare function parseFunctionsSourceSpec(args: ParsedArgs): SourceSpec;
+/**
+ * Select a managed function within a remote repository. Local callers already
+ * select the function root with --dir, so --path is remote-only.
+ */
+export declare function parseFunctionsSourceSelection(args: ParsedArgs): FunctionsSourceSelection;
+/**
+ * Resolve the selected function root after the repository is materialized.
+ * realpath containment prevents a committed symlink from escaping the repo.
+ */
+export declare function resolveFunctionSourceDir({ repoDir, path, }: {
+    repoDir: string;
+    path?: string;
+}): Promise<string>;

package/dist/functions/source-selection.js

@@ -0,0 +1,67 @@
+import { realpath } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { parseSourceSpec, } from '@sequenceholdings/artifact-studio/source-resolver';
+import { isDirectory } from './bundle.js';
+/**
+ * Functions name their local source with --dir rather than a positional, so
+ * map it onto the shared source parser used by other seq-studio primitives.
+ */
+export function parseFunctionsSourceSpec(args) {
+    const dir = typeof args.flags.dir === 'string' ? args.flags.dir : undefined;
+    if (dir !== undefined && (args.flags.repo !== undefined || args.flags['git-url'] !== undefined)) {
+        throw new Error('--dir cannot be combined with --repo / --git-url.');
+    }
+    return parseSourceSpec({ positional: dir === undefined ? [] : [dir], flags: args.flags });
+}
+function validateFunctionRepoPath(path) {
+    const segments = path.split('/');
+    if (path.length === 0 ||
+        path.trim() !== path ||
+        isAbsolute(path) ||
+        path.includes('\\') ||
+        [...path].some((character) => character.charCodeAt(0) < 0x20) ||
+        segments.some((segment) => segment.length === 0 || segment === '.' || segment === '..')) {
+        throw new Error(`--path must be a canonical relative directory within the repository (got ${JSON.stringify(path)}).`);
+    }
+}
+/**
+ * Select a managed function within a remote repository. Local callers already
+ * select the function root with --dir, so --path is remote-only.
+ */
+export function parseFunctionsSourceSelection(args) {
+    const spec = parseFunctionsSourceSpec(args);
+    const pathFlag = args.flags.path;
+    if (pathFlag === true)
+        throw new Error('--path requires a value.');
+    if (pathFlag === undefined)
+        return { spec };
+    if (spec.kind === 'local') {
+        throw new Error('--path only applies together with --repo or --git-url; use --dir for local source.');
+    }
+    validateFunctionRepoPath(pathFlag);
+    return { spec, path: pathFlag };
+}
+/**
+ * Resolve the selected function root after the repository is materialized.
+ * realpath containment prevents a committed symlink from escaping the repo.
+ */
+export async function resolveFunctionSourceDir({ repoDir, path, }) {
+    if (path === undefined)
+        return repoDir;
+    validateFunctionRepoPath(path);
+    const candidate = resolve(repoDir, path);
+    if (!(await isDirectory(candidate))) {
+        throw new Error(`--path does not name a directory in the repository: ${path}`);
+    }
+    const [canonicalRepoDir, canonicalCandidate] = await Promise.all([
+        realpath(repoDir),
+        realpath(candidate),
+    ]);
+    const relativePath = relative(canonicalRepoDir, canonicalCandidate);
+    if (relativePath === '..' ||
+        relativePath.startsWith(`..${sep}`) ||
+        isAbsolute(relativePath)) {
+        throw new Error(`--path must stay within the repository: ${path}`);
+    }
+    return canonicalCandidate;
+}

package/dist/main.d.ts

@@ -5,6 +5,7 @@
  *   seq-studio process <sub>      manage Lattice processes
  *   seq-studio artifact <sub>     manage Artifact Studio apps
  *   seq-studio functions <sub>    manage Managed Functions
+ *   seq-studio agents <sub>       manage typed agent definitions
  *   seq-studio secrets <sub>      manage org-owned Managed Secrets
  *   seq-studio repos <sub>        manage platform git-service repos
  *   seq-studio pipeline <sub>     author + validate Data Pipelines stage specs

package/dist/main.js

@@ -5,6 +5,7 @@
  *   seq-studio process <sub>      manage Lattice processes
  *   seq-studio artifact <sub>     manage Artifact Studio apps
  *   seq-studio functions <sub>    manage Managed Functions
+ *   seq-studio agents <sub>       manage typed agent definitions
  *   seq-studio secrets <sub>      manage org-owned Managed Secrets
  *   seq-studio repos <sub>        manage platform git-service repos
  *   seq-studio pipeline <sub>     author + validate Data Pipelines stage specs
@@ -23,6 +24,7 @@ const TOP_LEVEL_USAGE = `usage:
   seq-studio process <sub> [args]    lint | plan | apply | test | simulate | bundle | init
   seq-studio artifact <sub> [args]   init | build | plan | deploy | dev | list | show | pull | promote | rollback
   seq-studio functions <sub> [args]  init | build | deploy | list | show | logs | promote | rollback | delete
+  seq-studio agents <sub> [args]     init | validate | plan | apply | list | show
   seq-studio secrets <sub> [args]    create | set | list | attach | detach | apply
   seq-studio repos <sub> [args]      list | namespaces | show | create | clone | pull | delete
   seq-studio pipeline <sub> [args]   init | validate — Data Pipelines stage specs
@@ -73,6 +75,10 @@ export async function run(argv = process.argv.slice(2)) {
             const { runFunctionsCommand } = await import('./functions/commands.js');
             return runFunctionsCommand(sub, parseArgs(rest));
         }
+        case 'agents': {
+            const { runAgentsCommand } = await import('./agents/commands.js');
+            return runAgentsCommand(sub, parseArgs(rest));
+        }
         case 'secrets': {
             const { runSecretsCommand } = await import('./secrets/commands.js');
             return runSecretsCommand(sub, parseArgs(rest));

package/dist/orm/delegate.js

@@ -9,14 +9,19 @@ import { getAccessToken, tryGetAccessToken } from '../auth.js';
 import { resolveEnvWithDiscovery } from '../config.js';
 import { normalizeShortEnvFlag, readEnvFromArgv } from '../env-flags.js';
 import { REQUIRE_EXPLICIT_ENV_MESSAGE } from '../env-flags.js';
-/** ORM subcommands that talk to Atlas — must not silently target `local`. */
+/**
+ * ORM subcommands that talk to Atlas — must not silently target `local`.
+ * `init`, `generate`, `validate`, `diff`, and `migrate-from-yaml` are offline.
+ */
 const ORM_NETWORK_SUBS = new Set(['plan', 'apply']);
 const ORM_USAGE = `usage:
-  seq-studio orm init <dir>            scaffold a namespace directory
-  seq-studio orm validate [dir]        parse + validate definitions and verify committed migrations are in sync
-  seq-studio orm plan [dir] -e <env>   compile definitions and diff against the registry
-  seq-studio orm apply [dir] -e <env>  author the migration, register, apply, and refresh types.gen.ts (the everyday command)
-  seq-studio orm diff [dir]            write/verify the committed migration standalone (--check is the offline CI gate; --allow-destructive consents)
+  seq-studio orm init <dir>              scaffold a namespace package (v2: TypeScript schema + GraphQL documents)
+  seq-studio orm generate [dir]          write schema.graphql + operations.manifest.json + typePolicies.gen.ts (offline; runs consumer codegen when codegen.ts is present)
+  seq-studio orm validate [dir]          parse + validate definitions and verify committed migrations are in sync
+  seq-studio orm plan [dir] -e <env>     compile definitions and diff against the registry
+  seq-studio orm apply [dir] -e <env>    author the migration, register, apply, and refresh the generated outputs (the everyday command)
+  seq-studio orm diff [dir]              write/verify the committed migration standalone (--check is the offline CI gate; --allow-destructive consents; --rebase records a v1 -> v2 conversion)
+  seq-studio orm migrate-from-yaml <dir> convert a v1 YAML namespace to the v2 TypeScript format (offline; migrations/ preserved)
 
   Environments: see \`seq-studio envs list\` (built-in: local; more are
   discovered after you authenticate).

package/dist/pipeline/commands.js

@@ -49,6 +49,19 @@ const PIPELINE_USAGE = `usage:
       banksouth require --approved-by — approvals are explicit even for
       rollbacks)
 
+  seq-studio pipeline adopt --stage <slug> --ref <sha|branch> -e <env>
+                            --native-id <id> [--resource-key <key>] [--kind job|dlt_pipeline]
+                            --approved-by <you> [--old-source-removal-pr <url>]
+                            [--repo pipelines/<slug>] [--json]
+      bind a live Databricks job/pipeline to the stage without recreation
+      (SEQ-2449). Always requires --approved-by. Monorepo-declared keys also
+      require --old-source-removal-pr.
+
+  seq-studio pipeline unbind --stage <slug> --ref <sha|branch> -e <env>
+                             --approved-by <you> [--resource-key <key>]
+                             [--repo pipelines/<slug>] [--json]
+      release an adopted binding; the remote object stays live (never deleted)
+
   seq-studio pipeline run-now --stage <slug> -e <env> [--repo pipelines/<slug>] [--json]
       fire the stage's active deployment resource (job run-now / DLT
       start_update) and print the Databricks run URL
@@ -297,6 +310,14 @@ export async function runPipelineCommand(sub, args) {
             return pipelineInitCommand(args);
         case 'validate':
             return pipelineValidateCommand(args);
+        case 'adopt': {
+            const { pipelineAdoptCommand } = await import('./lifecycle.js');
+            return pipelineAdoptCommand(args);
+        }
+        case 'unbind': {
+            const { pipelineUnbindCommand } = await import('./lifecycle.js');
+            return pipelineUnbindCommand(args);
+        }
         case 'plan': {
             const { pipelinePlanCommand } = await import('./lifecycle.js');
             return pipelinePlanCommand(args);

package/dist/pipeline/lifecycle.d.ts

@@ -56,3 +56,5 @@ export declare function pipelineDeployCommand(args: ParsedArgs): Promise<number>
 export declare function pipelinePromoteCommand(args: ParsedArgs): Promise<number>;
 export declare function pipelineRunNowCommand(args: ParsedArgs): Promise<number>;
 export declare function pipelineRollbackCommand(args: ParsedArgs): Promise<number>;
+export declare function pipelineAdoptCommand(args: ParsedArgs): Promise<number>;
+export declare function pipelineUnbindCommand(args: ParsedArgs): Promise<number>;

package/dist/pipeline/lifecycle.js

@@ -315,6 +315,113 @@ async function pollDeployment({ baseUrl, token, deploymentId, }) {
     console.error(`${LOG} timed out waiting for deployment ${deploymentId}`);
     return 1;
 }
+export async function pipelineAdoptCommand(args) {
+    const stage = flagString(args.flags, 'stage');
+    const ref = flagString(args.flags, 'ref');
+    const nativeId = flagString(args.flags, 'native-id');
+    const approvedBy = flagString(args.flags, 'approved-by');
+    if (!stage || !ref || !nativeId || !approvedBy) {
+        console.error('usage: seq-studio pipeline adopt --stage <slug> --ref <sha|branch> -e <env> ' +
+            '--native-id <id> --approved-by <you> [--resource-key <key>] [--kind job|dlt_pipeline] ' +
+            '[--old-source-removal-pr <url>] [--repo pipelines/<slug>] [--json]');
+        return 1;
+    }
+    const { env, token } = await envAndToken(args);
+    const json = args.flags.json === true || args.flags.json === 'true';
+    const repo = flagString(args.flags, 'repo');
+    const resourceKey = flagString(args.flags, 'resource-key') ?? stage.replace(/-/g, '_');
+    const kind = flagString(args.flags, 'kind') ?? 'job';
+    if (kind !== 'job' && kind !== 'dlt_pipeline') {
+        console.error(`${LOG} --kind must be job or dlt_pipeline`);
+        return 1;
+    }
+    const oldSourceRemovalPr = flagString(args.flags, 'old-source-removal-pr');
+    const stageId = await resolveStageIdBySlug({
+        baseUrl: env.url,
+        token,
+        slug: stage,
+        repo,
+    });
+    try {
+        const response = await postJson({
+            baseUrl: env.url,
+            token,
+            path: `/api/data-pipelines/stages/${stageId}/adopt`,
+            body: {
+                environment: deployEnvironmentForEnv(env),
+                ref,
+                bindings: [{ resourceKey, nativeId, kind }],
+                approvedBy,
+                ...(oldSourceRemovalPr ? { oldSourceRemovalPr } : {}),
+            },
+        });
+        if (json) {
+            console.log(JSON.stringify(response, null, 2));
+        }
+        else {
+            console.log(`${LOG} enqueued adopt for ${stage} → ${resourceKey}=${nativeId} ` +
+                `(trigger=${response.triggerRunId}). Worker binds on Trigger; ` +
+                `confirm with plan or stage_resources once the run completes.`);
+        }
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof AtlasApiError) {
+            console.error(`${LOG} adopt failed: ${error.message}`);
+            return 1;
+        }
+        throw error;
+    }
+}
+export async function pipelineUnbindCommand(args) {
+    const stage = flagString(args.flags, 'stage');
+    const ref = flagString(args.flags, 'ref');
+    const approvedBy = flagString(args.flags, 'approved-by');
+    if (!stage || !ref || !approvedBy) {
+        console.error('usage: seq-studio pipeline unbind --stage <slug> --ref <sha|branch> -e <env> ' +
+            '--approved-by <you> [--resource-key <key>] [--repo pipelines/<slug>] [--json]');
+        return 1;
+    }
+    const { env, token } = await envAndToken(args);
+    const json = args.flags.json === true || args.flags.json === 'true';
+    const repo = flagString(args.flags, 'repo');
+    const resourceKey = flagString(args.flags, 'resource-key');
+    const stageId = await resolveStageIdBySlug({
+        baseUrl: env.url,
+        token,
+        slug: stage,
+        repo,
+    });
+    try {
+        const response = await postJson({
+            baseUrl: env.url,
+            token,
+            path: `/api/data-pipelines/stages/${stageId}/unbind`,
+            body: {
+                environment: deployEnvironmentForEnv(env),
+                ref,
+                approvedBy,
+                ...(resourceKey ? { resourceKeys: [resourceKey] } : {}),
+            },
+        });
+        if (json) {
+            console.log(JSON.stringify(response, null, 2));
+        }
+        else {
+            console.log(`${LOG} enqueued unbind for ${stage}` +
+                (resourceKey ? ` (${resourceKey})` : '') +
+                ` (trigger=${response.triggerRunId}). Remote object is never deleted.`);
+        }
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof AtlasApiError) {
+            console.error(`${LOG} unbind failed: ${error.message}`);
+            return 1;
+        }
+        throw error;
+    }
+}
 /**
  * Stage identity is `(repo, slug)` — a bare slug can be ambiguous across
  * Pipelines. `--repo pipelines/<domain>` scopes the lookup server-side; an

package/dist/process/build.js

@@ -190,8 +190,9 @@ function serializeNodeMetadata(node) {
             const human = node;
             const meta = {
                 metadata: human.metadata ?? {},
-                timeout: human.timeout ?? '7d',
             };
+            if (human.timeout !== undefined)
+                meta.timeout = human.timeout;
             if (human.on_timeout_edge_id)
                 meta.on_timeout_edge_id = human.on_timeout_edge_id;
             if (human.completeLabel)

package/dist/process/lint.js

@@ -549,6 +549,14 @@ function lintHuman(processId, node, errors, warnings) {
         }
     }
     if (node.on_timeout_edge_id) {
+        if (node.timeout === undefined) {
+            errors.push({
+                process_id: processId,
+                node_id: node.id,
+                message: `on_timeout_edge_id "${node.on_timeout_edge_id}" requires timeout — ` +
+                    `omit on_timeout_edge_id for an indefinite wait, or set timeout to enable the timeout edge`,
+            });
+        }
         const ok = node.outgoing_edges.some((e) => e.id === node.on_timeout_edge_id);
         if (!ok) {
             errors.push({

package/dist/repos/commands.d.ts

@@ -44,6 +44,58 @@ export declare function reposCloneCommand(args: ParsedArgs, deps?: {
  * so askpass never sends ATLAS_GIT_PAT to an attacker-controlled host.
  */
 export declare function normalizeCloneUrl(raw: string, env: ResolvedEnv): string;
+type DiscoveredCliCheck = {
+    name: string;
+    script?: string;
+    command?: string[];
+    source: 'autodiscover' | 'ci.json';
+};
+/**
+ * Pure discovery shared by `repos ci show` / `import`. Mirrors atlas
+ * `discoverCiChecks` / `parseCiJson` so CLI preview matches execution.
+ */
+export declare function discoverCliChecks({ ciJson, packageScripts, }: {
+    ciJson?: unknown;
+    packageScripts?: Record<string, string>;
+}): {
+    ok: true;
+    checks: DiscoveredCliCheck[];
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Load `.seq/ci.json` / `package.json` for CI preview.
+ *
+ * Matches the runner: only a true 404 means "file absent". Invalid JSON and
+ * non-404 API errors fail closed (no silent package.json fallback over a bad
+ * `.seq/ci.json`).
+ */
+export declare function loadRemoteCiSources({ ctx, repoId, ref, }: {
+    ctx: CommandContext;
+    repoId: string;
+    ref: string;
+}): Promise<{
+    ok: true;
+    ciJson?: unknown;
+    packageScripts?: Record<string, string>;
+} | {
+    ok: false;
+    error: string;
+}>;
+/**
+ * Discover CI checks from a remote repo tip (pure preview — no Settings write).
+ * Uses the same autodiscovery rules as the platform runner (PLA-378).
+ */
+export declare function reposCiShowCommand(args: ParsedArgs): Promise<number>;
+/** Add a check-run name to Settings `requiredChecks` (merge-blocking). */
+export declare function reposCiRequireCommand(args: ParsedArgs): Promise<number>;
+/**
+ * Set requiredChecks to every check discovered on the tip (opt-in bulk require).
+ */
+export declare function reposCiImportCommand(args: ParsedArgs): Promise<number>;
+export declare function reposCiCommand(args: ParsedArgs): Promise<number>;
 export declare function reposDeleteCommand(args: ParsedArgs): Promise<number>;
-export declare const REPOS_USAGE = "usage:\n  seq-studio repos list -e <env> [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] -e <env>              list or create namespaces\n  seq-studio repos show <ns>/<name> -e <env>                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> -e <env> [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> -e <env> [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> -e <env> [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (seq-studio or Atlas UI /settings/tokens).\n  PAT without Auth0 login: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seq-studio login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
+export declare const REPOS_USAGE = "usage:\n  seq-studio repos list -e <env> [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] -e <env>              list or create namespaces\n  seq-studio repos show <ns>/<name> -e <env>                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> -e <env> [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> -e <env> [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> -e <env> [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)\n  seq-studio repos ci show <ns>/<name> -e <env> [--ref r]           preview discovered CI checks\n  seq-studio repos ci require <ns>/<name> --check <name> -e <env>   reserved (refuses write until sandboxed runner)\n  seq-studio repos ci import <ns>/<name> -e <env> [--ref r]         reserved (refuses write until sandboxed runner)\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (seq-studio or Atlas UI /settings/tokens).\n  PAT without Auth0 login: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seq-studio login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
 export declare function runReposCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;
+export {};