@sequenceholdings/studio-cli 0.1.21 → 0.1.22

package/README.md

@@ -145,13 +145,17 @@ bundle; it never implicitly deletes agents.
 | Command | What it does |
 |---------|--------------|
 | `seq-studio agents init <dir>` | Scaffold a standalone typed agent repository |
-| `seq-studio agents validate [--dir <dir>] [--target <APP_ENV>]` | Compile and validate locally, without API access |
-| `seq-studio agents plan [--dir <dir>]` | Offline compile/hash plan |
-| `seq-studio agents plan [--dir <dir>] -e <env> [--target <APP_ENV>]` | Diff creates, updates, and unchanged definitions against an environment |
-| `seq-studio agents apply [--dir <dir>] -e <env> [--target <APP_ENV>] [--yes]` | Apply creates and updates after showing the plan |
+| `seq-studio agents validate [--dir <dir>] [--target <APP_ENV>] [--only <id1,id2>]` | Compile and validate locally, without API access |
+| `seq-studio agents plan [--dir <dir>] [--only <id1,id2>]` | Offline compile/hash plan |
+| `seq-studio agents plan [--dir <dir>] -e <env> [--target <APP_ENV>] [--only <id1,id2>]` | Diff creates, updates, and unchanged definitions against an environment |
+| `seq-studio agents apply [--dir <dir>] -e <env> [--target <APP_ENV>] [--only <id1,id2>] [--yes]` | Apply creates and updates after showing the plan |
 | `seq-studio agents list -e <env>` | List visible runtime agents |
 | `seq-studio agents show <id> -e <env>` | Show one runtime agent |
 
+For `validate`, `plan`, and `apply`, `--only` accepts a comma-separated list of
+agent IDs after deployment-environment selection; every requested ID must be
+selected.
+
 An optional `deploy-manifest.json` targets definitions by deployment identity:
 
 ```json
@@ -187,8 +191,10 @@ Use `--repo agents/<name> [--ref <ref>]` or `--git-url <url>` instead of
 ## ORM commands
 
 `seq-studio orm` authors and deploys governed ORM v2 namespaces: TypeScript
-table definitions and policies plus named GraphQL documents compiled into
-persisted operations.
+table definitions, Drizzle-authored read-only views, and policies plus named
+GraphQL documents compiled into persisted operations. Import Drizzle query
+helpers from `@sequenceholdings/orm/drizzle`; managed view builders are
+compiled to canonical SQL before registration.
 
 | Command | What it does |
 |---------|--------------|
@@ -335,6 +341,40 @@ same repo share Git review and commit provenance, but keep separate manifests,
 versions, runtime resources, secrets, and permissions. `--path` accepts only a
 canonical relative directory inside a remote repo; use `--dir` for local source.
 
+### Scaling
+
+Managed functions scale to zero by default. Set a bounded warm pool in
+`managed-function.yml` when first-request latency matters:
+
+```yaml
+limits:
+  min_instances: 1
+  max_instances: 3
+```
+
+`min_instances` defaults to `0`, cannot exceed `max_instances`, and incurs
+Cloud Run idle-instance charges while warm.
+
+### ORM data access
+
+A function declares its ORM Data API reach in `capabilities.data`, grouped by
+namespace: `tables` it may read, v1 `actions` and ORM v2 persisted `operations`
+it may invoke, and whether raw read `query` is allowed. At invoke time the
+platform mints a short-lived data token scoped to exactly these refs — an
+operation is scoped as `<namespace>/ops/<OperationName>` (the GraphQL operation
+name from the namespace's `graphql/` documents, case-sensitive), and anything
+undeclared is denied by the Data API. A function that reaches any namespace
+must also attach a top-level `service_account`:
+
+```yaml
+service_account: lucky-svc
+capabilities:
+  data:
+    lucky:
+      tables: [lucky_draws]
+      operations: [RollLuckyNumber]
+```
+
 ## Artifact commands
 
 `seq-studio artifact <sub>` is the entry point for Artifact Studio. It runs
@@ -467,11 +507,34 @@ JSON API — the same repos `--repo <ns>/<name>` sources build from.
 | `seq-studio repos clone <ns>/<name> \| --url <clone-url> \| --id <uuid> -e <env> [--ref <r>] [--out <dir>] [--force]` | smart-HTTP `git clone` when `ATLAS_GIT_PAT` is set (`--url`/`--id` need no seqapi); otherwise JSON materialize + PAT hint |
 | `seq-studio repos pull <ns>/<name> -e <env> [--ref <r>] [--out <dir>] [--force]` | always materialize via JSON API (no `.git` dir); refuses a non-empty destination unless `--force` |
 | `seq-studio repos delete <ns>/<name> -e <env> [--yes]` | delete a repo — interactive confirm unless `--yes` |
+| `seq-studio repos ci show <ns>/<name> -e <env> [--ref <r>]` | preview CI checks discovered from the ref |
+| `seq-studio repos ci require <ns>/<name> --check <name> -e <env>` | reserved for requiring a named CI check; currently refuses to write until the sandboxed runner is live |
+| `seq-studio repos ci import <ns>/<name> -e <env> [--ref <r>]` | reserved for requiring every discovered check; currently refuses to write until the sandboxed runner is live |
 
 `show` prints the smart-HTTP clone URL (`…/repos/<id>/git`). Basic auth:
 any username, PAT as password. Prefer `repos clone` over hand-rolling the
 tree API.
 
+PR CI discovers `ci/check` from the first available `lint`, `typecheck`, or
+`check` script and `ci/test` from `test`. A `.seq/ci.json` takes precedence;
+its `checks` array can declare script/argv checks or be empty to opt out.
+
+For example:
+
+    { "checks": [
+      { "phase": "check", "script": "lint" },
+      { "phase": "test", "command": ["pnpm", "test"] }
+    ] }
+
+Each check needs `phase` (`check` or `test`) and exactly one of `script` or
+`command`; `name` is optional and otherwise defaults to `ci/<phase>`
+(`-2`, etc. for additional checks in that phase).
+Discovery alone never blocks a merge. Until the sandboxed executor is live,
+`repos ci show` is preview-only, Settings controls are disabled, and
+`require`/`import` refuse to write (discovery currently posts `neutral`
+check-runs). Once the executor is live, repo owners can opt in by requiring
+check names in Settings or with `repos ci require`/`repos ci import`.
+
 ## Pipeline commands
 
 `seq-studio pipeline <sub>` authors and validates Data Pipelines **stage
@@ -486,6 +549,8 @@ install it alongside the CLI to use this family.
 | `seq-studio pipeline validate [dir] [--assets <file\|url>] [--json]` | Run the full offline spec gate: envelope + body validation, `schema_ref` resolution, and repo-level graph validation (reference resolution, single-writer, cycles, column subsets, serving projection checks). Exit 0/1 |
 | `seq-studio pipeline plan --repo pipelines/<slug> --ref <sha\|branch> -e <env> [--json]` | Plan a Pipeline deploy (materialize → SDK/`validateSpecGraph` → compile → live-diff → provision findings). Does **not** run Databricks `bundle validate` (that is a Trigger deploy-path hard gate). Exit 1 on destructive findings (CI-safe). `--json` emits the stable plan envelope |
 | `seq-studio pipeline deploy --repo pipelines/<slug> --ref <sha> -e <env> [--approved-by <sub>] [--no-wait]` | Plan then enqueue deploy; Trigger runs `bundle validate` then `bundle deploy` against reviewed bytes. Polls to terminal unless `--no-wait`. Production/banksouth require a pinned 40-hex SHA (client + server) |
+| `seq-studio pipeline adopt --stage <slug> --ref <sha\|branch> -e <env> --native-id <id> --approved-by <you> [--resource-key <key>] [--kind job\|dlt_pipeline] [--old-source-removal-pr <url>] [--repo pipelines/<slug>]` | Bind a live Databricks job/pipeline into the stage without recreation (`bundle deployment bind` on Trigger). Always requires `--approved-by` naming the caller. When the key is still in the monorepo DAB, pass `--old-source-removal-pr` and follow the returned cutover checklist: unbind the old bundle state without deleting the remote, then remove its DAB declaration and add the target-specific adopted-resource entry in the same PR before redeploying. |
+| `seq-studio pipeline unbind --stage <slug> --ref <sha\|branch> -e <env> --approved-by <you> [--resource-key <key>] [--repo pipelines/<slug>]` | Release an adopted binding on Trigger; the remote object stays live (never deleted) |
 | `seq-studio pipeline run-now --stage <slug> -e <env> [--repo pipelines/<slug>] [--json]` | Run the stage's active job or DLT pipeline immediately and print its Databricks run URL |
 | `seq-studio pipeline promote --stage <slug> --version <v> -e <env> [--repo pipelines/<slug>] [--approved-by <you>] [--no-wait]` | Promote a validated version to another environment. Prod/banksouth require `--approved-by` naming the authenticated caller (approvals are self-recorded); `--repo` disambiguates a slug that exists in multiple Pipelines |
 | `seq-studio pipeline rollback --stage <slug> -e <env> [--repo pipelines/<slug>] [--approved-by <you>] [--no-wait]` | Redeploy the previously retired deployment's version. Prod/banksouth require `--approved-by` — approvals are explicit even for rollbacks |

package/dist/agents/commands.d.ts

@@ -6,5 +6,5 @@ export declare function agentsPlanCommand(args: ParsedArgs): Promise<number>;
 export declare function agentsApplyCommand(args: ParsedArgs): Promise<number>;
 export declare function agentsListCommand(args: ParsedArgs): Promise<number>;
 export declare function agentsShowCommand(args: ParsedArgs): Promise<number>;
-export declare const AGENTS_USAGE = "usage:\n  seq-studio agents init <dir>                         scaffold a typed agent\n  seq-studio agents validate [--dir d] [--target app] offline compile + validation\n  seq-studio agents plan [--dir d] [-e <env>]          offline bundle plan or live diff\n  seq-studio agents apply [--dir d] -e <env> [--yes]  apply creates/updates; never deletes\n  seq-studio agents list -e <env>                      list visible agents\n  seq-studio agents show <id> -e <env>                 show one agent\n\n  Source: local --dir (default .), --repo agents/<name>, or --git-url <url>.\n  Use --ref for remote sources. --target selects the deployment APP_ENV when it\n  differs from the CLI environment alias (notably OpCo registrations).\n";
+export declare const AGENTS_USAGE = "usage:\n  seq-studio agents init <dir>                         scaffold a typed agent\n  seq-studio agents validate [--dir d] [--target app] [--only ids] offline compile + validation\n  seq-studio agents plan [--dir d] [-e <env>] [--only ids]          offline bundle plan or live diff\n  seq-studio agents apply [--dir d] -e <env> [--only ids] [--yes]  apply creates/updates; never deletes\n  seq-studio agents list -e <env>                      list visible agents\n  seq-studio agents show <id> -e <env>                 show one agent\n\n  Source: local --dir (default .), --repo agents/<name>, or --git-url <url>.\n  Use --ref for remote sources. --target selects the deployment APP_ENV when it\n  differs from the CLI environment alias (notably OpCo registrations). --only\n  accepts a comma-separated list of agent IDs after environment selection.\n";
 export declare function runAgentsCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;

package/dist/agents/commands.js

@@ -7,6 +7,22 @@ import { compileAgentSource as compileSource, materializeAgentSource as material
 import { agentsInitCommand } from './scaffold.js';
 export { agentsInitCommand };
 const LOG = '[seq-studio]';
+function requestedAgentIds(args) {
+    const only = args.flags.only;
+    if (only === undefined)
+        return undefined;
+    if (typeof only !== 'string') {
+        throw new Error('--only must be a comma-separated list of agent IDs');
+    }
+    const ids = only
+        .split(',')
+        .map((id) => id.trim())
+        .filter(Boolean);
+    if (ids.length === 0) {
+        throw new Error('--only must include at least one agent ID');
+    }
+    return [...new Set(ids)];
+}
 export async function agentsValidateCommand(args) {
     const { source } = await materialize({ args, requireEnvironment: false });
     try {
@@ -15,6 +31,7 @@ export async function agentsValidateCommand(args) {
             directory: source.dir,
             targetEnvironment: target,
             deployEnvironments: await deployEnvironmentNames(),
+            onlyIds: requestedAgentIds(args),
         });
         if (bundle.definitions.length === 0) {
             console.error(`${LOG} no named agent.ts definitions found`);
@@ -34,6 +51,7 @@ async function deploymentBundle({ args, source, context, }) {
         directory: source.dir,
         targetEnvironment: target,
         deployEnvironments: await deployEnvironmentNames(),
+        onlyIds: requestedAgentIds(args),
     });
 }
 /**
@@ -75,6 +93,7 @@ export async function agentsPlanCommand(args) {
                 directory: source.dir,
                 targetEnvironment: target,
                 deployEnvironments: await deployEnvironmentNames(),
+                onlyIds: requestedAgentIds(args),
             });
             console.log(`${LOG} offline plan: ${bundle.definitions.length} valid definition${bundle.definitions.length === 1 ? '' : 's'}, bundle ${bundle.hash}`);
             console.log(`${LOG} pass -e <env> for create/update/unchanged live diff`);
@@ -174,15 +193,16 @@ export async function agentsShowCommand(args) {
 }
 export const AGENTS_USAGE = `usage:
   seq-studio agents init <dir>                         scaffold a typed agent
-  seq-studio agents validate [--dir d] [--target app] offline compile + validation
-  seq-studio agents plan [--dir d] [-e <env>]          offline bundle plan or live diff
-  seq-studio agents apply [--dir d] -e <env> [--yes]  apply creates/updates; never deletes
+  seq-studio agents validate [--dir d] [--target app] [--only ids] offline compile + validation
+  seq-studio agents plan [--dir d] [-e <env>] [--only ids]          offline bundle plan or live diff
+  seq-studio agents apply [--dir d] -e <env> [--only ids] [--yes]  apply creates/updates; never deletes
   seq-studio agents list -e <env>                      list visible agents
   seq-studio agents show <id> -e <env>                 show one agent
 
   Source: local --dir (default .), --repo agents/<name>, or --git-url <url>.
   Use --ref for remote sources. --target selects the deployment APP_ENV when it
-  differs from the CLI environment alias (notably OpCo registrations).
+  differs from the CLI environment alias (notably OpCo registrations). --only
+  accepts a comma-separated list of agent IDs after environment selection.
 `;
 export async function runAgentsCommand(sub, args) {
     try {

package/dist/agents/source.d.ts

@@ -10,9 +10,11 @@ export declare function materializeAgentSource({ args, requireEnvironment, }: {
     source: ResolvedSource;
     context: CommandContext | null;
 }>;
-export declare function compileAgentSource({ directory, targetEnvironment, deployEnvironments, }: {
+export declare function compileAgentSource({ directory, targetEnvironment, deployEnvironments, onlyIds, }: {
     directory: string;
     targetEnvironment?: string;
     /** Registered deployment environments, so a real env absent from the manifest is not read as a typo. */
     deployEnvironments?: readonly string[];
+    /** Restrict a plan or apply to explicit agent IDs after environment selection. */
+    onlyIds?: readonly string[];
 }): Promise<CompiledAgentBundle>;

package/dist/agents/source.js

@@ -87,10 +87,25 @@ async function compileManifestEntries({ directory, entries, allowDuplicateIds =
         sources: compiled.sources,
     };
 }
-export async function compileAgentSource({ directory, targetEnvironment, deployEnvironments = [], }) {
+export async function compileAgentSource({ directory, targetEnvironment, deployEnvironments = [], onlyIds, }) {
     const manifest = await readManifest(directory);
-    if (!manifest)
-        return compileAgentDirectory({ rootDir: directory });
+    if (!manifest) {
+        const compiled = await compileAgentDirectory({ rootDir: directory });
+        if (!onlyIds || onlyIds.length === 0)
+            return compiled;
+        const requested = new Set(onlyIds);
+        const definitions = compiled.definitions.filter((definition) => requested.has(definition.id));
+        const missing = [...requested].filter((id) => !definitions.some((definition) => definition.id === id));
+        if (missing.length > 0) {
+            throw new Error(`Requested agent IDs were not selected: ${missing.join(', ')}`);
+        }
+        return {
+            ...compiled,
+            definitions,
+            hash: hashAgentBundle({ definitions }),
+            sources: compiled.sources.filter((source) => requested.has(source.definition.id)),
+        };
+    }
     if (targetEnvironment !== undefined) {
         assertKnownTargetEnvironment({
             manifest,
@@ -109,10 +124,18 @@ export async function compileAgentSource({ directory, targetEnvironment, deployE
     }
     // With a target: last-wins by id (tenant overrides). Without: every distinct
     // path, so validate still compiles override sources that lose a collapse.
-    const entries = selectAgentEntries({
+    const selectedEntries = selectAgentEntries({
         manifest,
         environment: targetEnvironment,
     });
+    const requested = new Set(onlyIds);
+    const entries = requested.size === 0
+        ? selectedEntries
+        : selectedEntries.filter((entry) => requested.has(entry.id));
+    const missing = [...requested].filter((id) => !entries.some((entry) => entry.id === id));
+    if (missing.length > 0) {
+        throw new Error(`Requested agent IDs were not selected: ${missing.join(', ')}`);
+    }
     return compileManifestEntries({
         directory,
         entries,

package/dist/atlas-client.js

@@ -9,6 +9,7 @@ import { PREVIEW_DOMAIN } from './preview.js';
 const MAX_503_RETRIES = 5;
 const DEFAULT_RETRY_AFTER_SECONDS = 2;
 const LOG_PREFIX = '[seq-studio]';
+const CF_ACCESS_DOMAIN = 'seqholdings.com';
 export class AtlasApiError extends Error {
     status;
     path;
@@ -42,6 +43,7 @@ async function authenticatedFetch({ baseUrl, init = {}, path, token, }) {
         redirect: 'manual',
         headers: {
             ...previewAccessHeaders(baseUrl),
+            ...cfAccessHeaders(baseUrl),
             ...init.headers,
             Authorization: `Bearer ${token}`,
         },
@@ -63,6 +65,33 @@ function previewAccessHeaders(baseUrl) {
         return {};
     }
 }
+/**
+ * Cloudflare Access fronts *.seqholdings.com and only bypasses the company
+ * network, so a CI runner is turned away at the edge with an HTML "Access
+ * Restricted" page before Atlas ever sees the bearer token. A service token
+ * gets through the edge; the bearer still authenticates at the app.
+ *
+ * Scoped to seqholdings.com so the token is never sent to localhost, a tenant
+ * domain, or any other host the CLI can be pointed at.
+ */
+function cfAccessHeaders(baseUrl) {
+    const clientId = process.env.CF_ACCESS_CLIENT_ID?.trim();
+    const clientSecret = process.env.CF_ACCESS_CLIENT_SECRET?.trim();
+    if (!clientId || !clientSecret)
+        return {};
+    try {
+        const parsed = new URL(baseUrl);
+        if (parsed.protocol !== 'https:')
+            return {};
+        const hostname = parsed.hostname.toLowerCase();
+        if (hostname !== CF_ACCESS_DOMAIN && !hostname.endsWith(`.${CF_ACCESS_DOMAIN}`))
+            return {};
+        return { 'CF-Access-Client-Id': clientId, 'CF-Access-Client-Secret': clientSecret };
+    }
+    catch {
+        return {};
+    }
+}
 function messageFromBody(body, status, statusText) {
     if (body && typeof body === 'object') {
         const record = body;

package/dist/auth.js

@@ -43,6 +43,8 @@ const SEQUENCE_BUILTIN_ENVS = new Set(['local', 'staging', 'production', 'bankso
 export function isSequenceAuthEnvName(envName) {
     return (envName === SEQUENCE_REALM ||
         SEQUENCE_BUILTIN_ENVS.has(envName) ||
+        envName === 'worktree' ||
+        envName.startsWith('local:') ||
         envName === 'preview' ||
         envName.startsWith('preview:'));
 }

package/dist/functions/commands.js

@@ -198,6 +198,7 @@ entrypoint: handler
 limits:
   memory_mb: 256
   timeout_seconds: 60
+  min_instances: 0
   max_instances: 3
   invoke_rate_per_minute: 60
 

package/dist/functions/manifest.d.ts

@@ -52,6 +52,7 @@ export declare const managedFunctionManifestSchema: z.ZodObject<{
     limits: z.ZodDefault<z.ZodObject<{
         memory_mb: z.ZodDefault<z.ZodNumber>;
         timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        min_instances: z.ZodDefault<z.ZodNumber>;
         max_instances: z.ZodDefault<z.ZodNumber>;
         invoke_rate_per_minute: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
@@ -83,6 +84,7 @@ export declare const managedFunctionManifestSchema: z.ZodObject<{
         data: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             tables: z.ZodDefault<z.ZodArray<z.ZodString>>;
             actions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            operations: z.ZodDefault<z.ZodArray<z.ZodString>>;
             query: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strip>>>;
     }, z.core.$strip>>;

package/dist/functions/manifest.js

@@ -493,6 +493,12 @@ function validateCapabilityGates({ gates, uses, roles, }) {
  * Mirrors atlas/src/server/services/managed-functions/manifest.ts.
  */
 const SERVICE_ACCOUNT_REF_RE = /^([a-z][a-z0-9-]{1,98}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
+/**
+ * GraphQL Name grammar — persisted-operation names exactly as they appear in
+ * a namespace's operations manifest. Mirrors
+ * atlas/src/server/services/managed-functions/manifest.ts.
+ */
+const GRAPHQL_OPERATION_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]*$/;
 export const managedFunctionManifestSchema = z.object({
     schema_version: z.literal(1).default(1),
     function: z.object({
@@ -510,12 +516,23 @@ export const managedFunctionManifestSchema = z.object({
         .object({
         memory_mb: z.number().int().min(128).max(2048).default(256),
         timeout_seconds: z.number().int().min(1).max(540).default(60),
+        min_instances: z.number().int().min(0).max(10).default(0),
         max_instances: z.number().int().min(1).max(10).default(3),
         invoke_rate_per_minute: z.number().int().min(1).max(600).default(60),
+    })
+        .superRefine((limits, ctx) => {
+        if (limits.min_instances > limits.max_instances) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'min_instances cannot exceed max_instances',
+                path: ['min_instances'],
+            });
+        }
     })
         .default({
         memory_mb: 256,
         timeout_seconds: 60,
+        min_instances: 0,
         max_instances: 3,
         invoke_rate_per_minute: 60,
     }),
@@ -567,12 +584,13 @@ export const managedFunctionManifestSchema = z.object({
         gates: capabilityGatesSchema,
         /**
          * ORM Data API consumer reach, grouped by namespace: the `tables` this
-         * function may read, the `actions` it may invoke, and whether raw `query`
-         * (arbitrary read SQL over the namespace) is allowed — all ON BEHALF OF the
-         * invoking user. The invoke proxy mints a short-lived token scoped to
-         * exactly these refs; the Data API re-resolves the user's claims per call,
-         * so declaring a table never widens what the user could see. Writes go
-         * through declared actions only — raw table writes don't exist.
+         * function may read, the v1 `actions` and v2 persisted `operations` it may
+         * invoke, and whether raw `query` (arbitrary read SQL over the namespace)
+         * is allowed — all ON BEHALF OF the invoking user. The invoke proxy mints
+         * a short-lived token scoped to exactly these refs; the Data API
+         * re-resolves the user's claims per call, so declaring a table never
+         * widens what the user could see. Writes go through declared actions and
+         * operations only — raw table writes don't exist.
          *
          * Mirrors atlas/src/server/services/managed-functions/manifest.ts — must
          * stay in sync so `seq-studio` doesn't strip the block before deploy.
@@ -581,6 +599,18 @@ export const managedFunctionManifestSchema = z.object({
             .record(z.string().regex(/^[a-z][a-z0-9_]{0,40}$/, 'capabilities.data keys are ORM namespace names'), z.object({
             tables: z.array(z.string().regex(/^[a-z_][a-z0-9_]*$/, 'table names')).max(64).default([]),
             actions: z.array(z.string().regex(/^[a-z_][a-z0-9_]*$/, 'action names')).max(64).default([]),
+            /**
+             * ORM v2 persisted operations (GraphQL mutations/actions by name)
+             * this function may execute — each mints a `<ns>/ops/<Name>` write
+             * ref on the invoke token.
+             */
+            operations: z
+                .array(z
+                .string()
+                .max(128)
+                .regex(GRAPHQL_OPERATION_NAME_RE, 'operation names must match the GraphQL Name grammar'))
+                .max(64)
+                .default([]),
             query: z.boolean().default(false),
         }))
             .default({}),
@@ -600,9 +630,9 @@ export const managedFunctionManifestSchema = z.object({
         ctx.addIssue({ code: 'custom', message, path: ['capabilities', 'gates'] });
     }
     // A namespace is "reached" when its block declares at least one table,
-    // action, or raw query — the same rule the server's floor reconciliation
-    // uses (readManifestDataNamespaces).
-    const reachesData = Object.values(manifest.capabilities.data).some((block) => block.tables.length > 0 || block.actions.length > 0 || block.query);
+    // action, operation, or raw query — the same rule the server's floor
+    // reconciliation uses (readManifestDataNamespaces).
+    const reachesData = Object.values(manifest.capabilities.data).some((block) => block.tables.length > 0 || block.actions.length > 0 || block.operations.length > 0 || block.query);
     if (reachesData && manifest.service_account === undefined) {
         ctx.addIssue({
             code: 'custom',

package/dist/pipeline/commands.js

@@ -49,6 +49,19 @@ const PIPELINE_USAGE = `usage:
       banksouth require --approved-by — approvals are explicit even for
       rollbacks)
 
+  seq-studio pipeline adopt --stage <slug> --ref <sha|branch> -e <env>
+                            --native-id <id> [--resource-key <key>] [--kind job|dlt_pipeline]
+                            --approved-by <you> [--old-source-removal-pr <url>]
+                            [--repo pipelines/<slug>] [--json]
+      bind a live Databricks job/pipeline to the stage without recreation
+      (SEQ-2449). Always requires --approved-by. Monorepo-declared keys also
+      require --old-source-removal-pr.
+
+  seq-studio pipeline unbind --stage <slug> --ref <sha|branch> -e <env>
+                             --approved-by <you> [--resource-key <key>]
+                             [--repo pipelines/<slug>] [--json]
+      release an adopted binding; the remote object stays live (never deleted)
+
   seq-studio pipeline run-now --stage <slug> -e <env> [--repo pipelines/<slug>] [--json]
       fire the stage's active deployment resource (job run-now / DLT
       start_update) and print the Databricks run URL
@@ -297,6 +310,14 @@ export async function runPipelineCommand(sub, args) {
             return pipelineInitCommand(args);
         case 'validate':
             return pipelineValidateCommand(args);
+        case 'adopt': {
+            const { pipelineAdoptCommand } = await import('./lifecycle.js');
+            return pipelineAdoptCommand(args);
+        }
+        case 'unbind': {
+            const { pipelineUnbindCommand } = await import('./lifecycle.js');
+            return pipelineUnbindCommand(args);
+        }
         case 'plan': {
             const { pipelinePlanCommand } = await import('./lifecycle.js');
             return pipelinePlanCommand(args);

package/dist/pipeline/lifecycle.d.ts

@@ -56,3 +56,5 @@ export declare function pipelineDeployCommand(args: ParsedArgs): Promise<number>
 export declare function pipelinePromoteCommand(args: ParsedArgs): Promise<number>;
 export declare function pipelineRunNowCommand(args: ParsedArgs): Promise<number>;
 export declare function pipelineRollbackCommand(args: ParsedArgs): Promise<number>;
+export declare function pipelineAdoptCommand(args: ParsedArgs): Promise<number>;
+export declare function pipelineUnbindCommand(args: ParsedArgs): Promise<number>;

package/dist/pipeline/lifecycle.js

@@ -315,6 +315,113 @@ async function pollDeployment({ baseUrl, token, deploymentId, }) {
     console.error(`${LOG} timed out waiting for deployment ${deploymentId}`);
     return 1;
 }
+export async function pipelineAdoptCommand(args) {
+    const stage = flagString(args.flags, 'stage');
+    const ref = flagString(args.flags, 'ref');
+    const nativeId = flagString(args.flags, 'native-id');
+    const approvedBy = flagString(args.flags, 'approved-by');
+    if (!stage || !ref || !nativeId || !approvedBy) {
+        console.error('usage: seq-studio pipeline adopt --stage <slug> --ref <sha|branch> -e <env> ' +
+            '--native-id <id> --approved-by <you> [--resource-key <key>] [--kind job|dlt_pipeline] ' +
+            '[--old-source-removal-pr <url>] [--repo pipelines/<slug>] [--json]');
+        return 1;
+    }
+    const { env, token } = await envAndToken(args);
+    const json = args.flags.json === true || args.flags.json === 'true';
+    const repo = flagString(args.flags, 'repo');
+    const resourceKey = flagString(args.flags, 'resource-key') ?? stage.replace(/-/g, '_');
+    const kind = flagString(args.flags, 'kind') ?? 'job';
+    if (kind !== 'job' && kind !== 'dlt_pipeline') {
+        console.error(`${LOG} --kind must be job or dlt_pipeline`);
+        return 1;
+    }
+    const oldSourceRemovalPr = flagString(args.flags, 'old-source-removal-pr');
+    const stageId = await resolveStageIdBySlug({
+        baseUrl: env.url,
+        token,
+        slug: stage,
+        repo,
+    });
+    try {
+        const response = await postJson({
+            baseUrl: env.url,
+            token,
+            path: `/api/data-pipelines/stages/${stageId}/adopt`,
+            body: {
+                environment: deployEnvironmentForEnv(env),
+                ref,
+                bindings: [{ resourceKey, nativeId, kind }],
+                approvedBy,
+                ...(oldSourceRemovalPr ? { oldSourceRemovalPr } : {}),
+            },
+        });
+        if (json) {
+            console.log(JSON.stringify(response, null, 2));
+        }
+        else {
+            console.log(`${LOG} enqueued adopt for ${stage} → ${resourceKey}=${nativeId} ` +
+                `(trigger=${response.triggerRunId}). Worker binds on Trigger; ` +
+                `confirm with plan or stage_resources once the run completes.`);
+        }
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof AtlasApiError) {
+            console.error(`${LOG} adopt failed: ${error.message}`);
+            return 1;
+        }
+        throw error;
+    }
+}
+export async function pipelineUnbindCommand(args) {
+    const stage = flagString(args.flags, 'stage');
+    const ref = flagString(args.flags, 'ref');
+    const approvedBy = flagString(args.flags, 'approved-by');
+    if (!stage || !ref || !approvedBy) {
+        console.error('usage: seq-studio pipeline unbind --stage <slug> --ref <sha|branch> -e <env> ' +
+            '--approved-by <you> [--resource-key <key>] [--repo pipelines/<slug>] [--json]');
+        return 1;
+    }
+    const { env, token } = await envAndToken(args);
+    const json = args.flags.json === true || args.flags.json === 'true';
+    const repo = flagString(args.flags, 'repo');
+    const resourceKey = flagString(args.flags, 'resource-key');
+    const stageId = await resolveStageIdBySlug({
+        baseUrl: env.url,
+        token,
+        slug: stage,
+        repo,
+    });
+    try {
+        const response = await postJson({
+            baseUrl: env.url,
+            token,
+            path: `/api/data-pipelines/stages/${stageId}/unbind`,
+            body: {
+                environment: deployEnvironmentForEnv(env),
+                ref,
+                approvedBy,
+                ...(resourceKey ? { resourceKeys: [resourceKey] } : {}),
+            },
+        });
+        if (json) {
+            console.log(JSON.stringify(response, null, 2));
+        }
+        else {
+            console.log(`${LOG} enqueued unbind for ${stage}` +
+                (resourceKey ? ` (${resourceKey})` : '') +
+                ` (trigger=${response.triggerRunId}). Remote object is never deleted.`);
+        }
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof AtlasApiError) {
+            console.error(`${LOG} unbind failed: ${error.message}`);
+            return 1;
+        }
+        throw error;
+    }
+}
 /**
  * Stage identity is `(repo, slug)` — a bare slug can be ambiguous across
  * Pipelines. `--repo pipelines/<domain>` scopes the lookup server-side; an

package/dist/repos/commands.d.ts

@@ -44,6 +44,58 @@ export declare function reposCloneCommand(args: ParsedArgs, deps?: {
  * so askpass never sends ATLAS_GIT_PAT to an attacker-controlled host.
  */
 export declare function normalizeCloneUrl(raw: string, env: ResolvedEnv): string;
+type DiscoveredCliCheck = {
+    name: string;
+    script?: string;
+    command?: string[];
+    source: 'autodiscover' | 'ci.json';
+};
+/**
+ * Pure discovery shared by `repos ci show` / `import`. Mirrors atlas
+ * `discoverCiChecks` / `parseCiJson` so CLI preview matches execution.
+ */
+export declare function discoverCliChecks({ ciJson, packageScripts, }: {
+    ciJson?: unknown;
+    packageScripts?: Record<string, string>;
+}): {
+    ok: true;
+    checks: DiscoveredCliCheck[];
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Load `.seq/ci.json` / `package.json` for CI preview.
+ *
+ * Matches the runner: only a true 404 means "file absent". Invalid JSON and
+ * non-404 API errors fail closed (no silent package.json fallback over a bad
+ * `.seq/ci.json`).
+ */
+export declare function loadRemoteCiSources({ ctx, repoId, ref, }: {
+    ctx: CommandContext;
+    repoId: string;
+    ref: string;
+}): Promise<{
+    ok: true;
+    ciJson?: unknown;
+    packageScripts?: Record<string, string>;
+} | {
+    ok: false;
+    error: string;
+}>;
+/**
+ * Discover CI checks from a remote repo tip (pure preview — no Settings write).
+ * Uses the same autodiscovery rules as the platform runner (PLA-378).
+ */
+export declare function reposCiShowCommand(args: ParsedArgs): Promise<number>;
+/** Add a check-run name to Settings `requiredChecks` (merge-blocking). */
+export declare function reposCiRequireCommand(args: ParsedArgs): Promise<number>;
+/**
+ * Set requiredChecks to every check discovered on the tip (opt-in bulk require).
+ */
+export declare function reposCiImportCommand(args: ParsedArgs): Promise<number>;
+export declare function reposCiCommand(args: ParsedArgs): Promise<number>;
 export declare function reposDeleteCommand(args: ParsedArgs): Promise<number>;
-export declare const REPOS_USAGE = "usage:\n  seq-studio repos list -e <env> [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] -e <env>              list or create namespaces\n  seq-studio repos show <ns>/<name> -e <env>                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> -e <env> [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> -e <env> [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> -e <env> [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (seq-studio or Atlas UI /settings/tokens).\n  PAT without Auth0 login: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seq-studio login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
+export declare const REPOS_USAGE = "usage:\n  seq-studio repos list -e <env> [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] -e <env>              list or create namespaces\n  seq-studio repos show <ns>/<name> -e <env>                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> -e <env> [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> -e <env> [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> -e <env> [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)\n  seq-studio repos ci show <ns>/<name> -e <env> [--ref r]           preview discovered CI checks\n  seq-studio repos ci require <ns>/<name> --check <name> -e <env>   reserved (refuses write until sandboxed runner)\n  seq-studio repos ci import <ns>/<name> -e <env> [--ref r]         reserved (refuses write until sandboxed runner)\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (seq-studio or Atlas UI /settings/tokens).\n  PAT without Auth0 login: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seq-studio login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
 export declare function runReposCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;
+export {};

package/dist/repos/commands.js

@@ -16,7 +16,8 @@ import { existsSync, readdirSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { resolve, sep } from 'node:path';
 import { materializeRepo, resolveCommitSha, resolveRepo, } from '@sequenceholdings/artifact-studio/git-service-client';
-import { deleteNoContent, getJson, postJson } from '../atlas-client.js';
+import { z } from 'zod';
+import { AtlasApiError, deleteNoContent, getJson, getJsonOr404, postJson, } from '../atlas-client.js';
 import { printCliError } from '../cli-errors.js';
 import { PREVIEW_DOMAIN } from '../preview.js';
 import { confirmYes } from '../prompt.js';
@@ -468,6 +469,257 @@ function defaultOutFromCloneTarget({ url, id, }) {
     const match = /\/repos\/([^/]+)\/git\/?$/.exec(new URL(url).pathname);
     return match?.[1] ?? 'repo';
 }
+/**
+ * Mirror of atlas `ci-discover` Zod contract so `repos ci show` fails closed
+ * on the same invalid `.seq/ci.json` shapes the runner rejects (`ci/config`).
+ * Keep in sync with `atlas/src/server/services/git-service/ci-discover.ts`.
+ */
+const CiPhaseSchema = z.enum(['check', 'test']);
+const CiJsonEntrySchema = z
+    .object({
+    phase: CiPhaseSchema,
+    name: z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(/^[a-z][a-z0-9._/-]*$/)
+        .optional(),
+    script: z.string().min(1).max(128).optional(),
+    command: z.array(z.string().min(1).max(256)).min(1).max(32).optional(),
+})
+    .superRefine((entry, ctx) => {
+    const hasScript = entry.script != null;
+    const hasCommand = entry.command != null;
+    if (hasScript === hasCommand) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'each check must specify exactly one of script or command',
+            path: hasScript ? ['command'] : ['script'],
+        });
+    }
+});
+const CiJsonSchema = z.object({
+    checks: z.array(CiJsonEntrySchema).max(16),
+});
+/** Match atlas `ci-discover` defaultNameForPhase (per-phase index, not array index). */
+function defaultNameForPhase(phase, indexInPhase) {
+    if (indexInPhase === 0)
+        return `ci/${phase}`;
+    return `ci/${phase}-${indexInPhase + 1}`;
+}
+/**
+ * Pure discovery shared by `repos ci show` / `import`. Mirrors atlas
+ * `discoverCiChecks` / `parseCiJson` so CLI preview matches execution.
+ */
+export function discoverCliChecks({ ciJson, packageScripts, }) {
+    if (ciJson !== undefined) {
+        const parsed = CiJsonSchema.safeParse(ciJson);
+        if (!parsed.success) {
+            const detail = parsed.error.issues
+                .map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`)
+                .slice(0, 3)
+                .join('; ');
+            return { ok: false, error: `Invalid .seq/ci.json: ${detail}` };
+        }
+        const phaseCounts = new Map();
+        const seenNames = new Set();
+        const checks = [];
+        for (const entry of parsed.data.checks) {
+            const indexInPhase = phaseCounts.get(entry.phase) ?? 0;
+            phaseCounts.set(entry.phase, indexInPhase + 1);
+            const name = entry.name ?? defaultNameForPhase(entry.phase, indexInPhase);
+            if (seenNames.has(name)) {
+                return {
+                    ok: false,
+                    error: `Invalid .seq/ci.json: duplicate check name "${name}"`,
+                };
+            }
+            seenNames.add(name);
+            const check = {
+                name,
+                source: 'ci.json',
+            };
+            if (entry.script != null)
+                check.script = entry.script;
+            if (entry.command != null)
+                check.command = entry.command;
+            checks.push(check);
+        }
+        return { ok: true, checks };
+    }
+    const checks = [];
+    if (packageScripts) {
+        for (const candidate of ['lint', 'typecheck', 'check']) {
+            if (packageScripts[candidate]?.trim()) {
+                checks.push({ name: 'ci/check', script: candidate, source: 'autodiscover' });
+                break;
+            }
+        }
+        if (packageScripts.test?.trim()) {
+            checks.push({ name: 'ci/test', script: 'test', source: 'autodiscover' });
+        }
+    }
+    return { ok: true, checks };
+}
+function decodeFileContent(file) {
+    return file.encoding === 'base64'
+        ? Buffer.from(file.content, 'base64').toString('utf8')
+        : file.content;
+}
+/**
+ * Load `.seq/ci.json` / `package.json` for CI preview.
+ *
+ * Matches the runner: only a true 404 means "file absent". Invalid JSON and
+ * non-404 API errors fail closed (no silent package.json fallback over a bad
+ * `.seq/ci.json`).
+ */
+export async function loadRemoteCiSources({ ctx, repoId, ref, }) {
+    let ciJson;
+    try {
+        const file = await getJsonOr404({
+            ...clientOptions(ctx),
+            path: `/api/git-service/repos/${repoId}/contents/.seq/ci.json?ref=${encodeURIComponent(ref)}`,
+        });
+        if (file != null) {
+            try {
+                ciJson = JSON.parse(decodeFileContent(file));
+            }
+            catch {
+                return { ok: false, error: 'invalid .seq/ci.json: not valid JSON' };
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof AtlasApiError) {
+            return { ok: false, error: `failed to fetch .seq/ci.json: ${err.message}` };
+        }
+        throw err;
+    }
+    // When ci.json is present (including empty checks), skip package.json —
+    // discovery never falls through to autodiscover in that case.
+    if (ciJson !== undefined) {
+        return { ok: true, ciJson };
+    }
+    let packageScripts;
+    try {
+        const file = await getJsonOr404({
+            ...clientOptions(ctx),
+            path: `/api/git-service/repos/${repoId}/contents/package.json?ref=${encodeURIComponent(ref)}`,
+        });
+        if (file != null) {
+            let pkg;
+            try {
+                pkg = JSON.parse(decodeFileContent(file));
+            }
+            catch {
+                return { ok: false, error: 'invalid package.json: not valid JSON' };
+            }
+            if (pkg.scripts && typeof pkg.scripts === 'object') {
+                packageScripts = {};
+                for (const [key, value] of Object.entries(pkg.scripts)) {
+                    if (typeof value === 'string')
+                        packageScripts[key] = value;
+                }
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof AtlasApiError) {
+            return { ok: false, error: `failed to fetch package.json: ${err.message}` };
+        }
+        throw err;
+    }
+    return { ok: true, packageScripts };
+}
+/**
+ * Discover CI checks from a remote repo tip (pure preview — no Settings write).
+ * Uses the same autodiscovery rules as the platform runner (PLA-378).
+ */
+export async function reposCiShowCommand(args) {
+    const { namespace, name } = parseRepoPath(args.positional[0]);
+    const ctx = await reposContext(args);
+    const resolved = await resolveRepo({ ...clientOptions(ctx), namespace, name });
+    const repo = await getJson({
+        ...clientOptions(ctx),
+        path: `/api/git-service/repos/${resolved.id}`,
+    });
+    const ref = stringFlag(args.flags, 'ref') ?? repo.defaultBranch;
+    const required = new Set(repo.reviewPolicy?.requiredChecks ?? []);
+    const sources = await loadRemoteCiSources({ ctx, repoId: resolved.id, ref });
+    if (!sources.ok) {
+        console.error(`${LOG} ${sources.error} on ${namespace}/${name}@${ref}`);
+        return 1;
+    }
+    const discovered = discoverCliChecks(sources);
+    if (!discovered.ok) {
+        console.error(`${LOG} ${discovered.error} on ${namespace}/${name}@${ref}`);
+        return 1;
+    }
+    console.log(`${LOG} CI for ${namespace}/${name}@${ref} on ${ctx.env.name}:`);
+    if (discovered.checks.length === 0) {
+        console.log('  (no checks discovered)');
+        return 0;
+    }
+    for (const check of discovered.checks) {
+        const how = check.script != null
+            ? `script=${check.script}`
+            : check.command != null
+                ? `command=${JSON.stringify(check.command)}`
+                : '';
+        console.log(`  ${check.name}  ${how}  source=${check.source}  required=${required.has(check.name)}`);
+    }
+    return 0;
+}
+const REQUIRED_CHECKS_WRITE_DISABLED = `${LOG} writing requiredChecks is disabled until the sandboxed CI runner is live ` +
+    `(discovery posts neutral check-runs that cannot satisfy the merge gate). ` +
+    `Use \`seq-studio repos ci show\` to preview discovered names.`;
+/** Add a check-run name to Settings `requiredChecks` (merge-blocking). */
+export async function reposCiRequireCommand(args) {
+    const check = stringFlag(args.flags, 'check');
+    if (!check) {
+        console.error('usage: seq-studio repos ci require <ns>/<name> --check <name> -e <env>');
+        return 1;
+    }
+    console.error(REQUIRED_CHECKS_WRITE_DISABLED);
+    return 1;
+}
+/**
+ * Set requiredChecks to every check discovered on the tip (opt-in bulk require).
+ */
+export async function reposCiImportCommand(args) {
+    // Still run show so authors can preview names, then refuse the write.
+    const code = await reposCiShowCommand(args);
+    if (code !== 0)
+        return code;
+    console.error(REQUIRED_CHECKS_WRITE_DISABLED);
+    return 1;
+}
+export async function reposCiCommand(args) {
+    const [action] = args.positional;
+    const rest = {
+        ...args,
+        positional: args.positional.slice(1),
+    };
+    switch (action) {
+        case 'show':
+            return reposCiShowCommand(rest);
+        case 'require':
+            return reposCiRequireCommand(rest);
+        case 'import':
+            return reposCiImportCommand(rest);
+        case 'help':
+        case undefined:
+            console.log(`usage:
+  seq-studio repos ci show <ns>/<name> -e <env> [--ref r]           preview discovered CI checks
+  seq-studio repos ci require <ns>/<name> --check <name> -e <env>   reserved (refuses write until sandboxed runner)
+  seq-studio repos ci import <ns>/<name> -e <env> [--ref r]         reserved (refuses write until sandboxed runner)
+`);
+            return action ? 0 : 1;
+        default:
+            console.error(`unknown repos ci command: ${action}`);
+            return 1;
+    }
+}
 export async function reposDeleteCommand(args) {
     const { namespace, name } = parseRepoPath(args.positional[0]);
     const ctx = await reposContext(args);
@@ -505,6 +757,9 @@ export const REPOS_USAGE = `usage:
   seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]
                                                                     materialize the tree at a ref (JSON API)
   seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)
+  seq-studio repos ci show <ns>/<name> -e <env> [--ref r]           preview discovered CI checks
+  seq-studio repos ci require <ns>/<name> --check <name> -e <env>   reserved (refuses write until sandboxed runner)
+  seq-studio repos ci import <ns>/<name> -e <env> [--ref r]         reserved (refuses write until sandboxed runner)
 
   Flags: -e/--env <env> (required; see: seq-studio envs list)
 
@@ -534,6 +789,8 @@ export async function runReposCommand(sub, args) {
                 return await reposPullCommand(args);
             case 'delete':
                 return await reposDeleteCommand(args);
+            case 'ci':
+                return await reposCiCommand(args);
             case 'help':
             case '--help':
             case '-h':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/studio-cli",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Unified Sequence Studio CLI — `seq-studio agents` (typed agent definitions), `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
   "license": "UNLICENSED",
   "repository": {