@sequenceholdings/studio-cli 0.1.21 → 0.1.24

package/dist/app/scaffold.js

@@ -0,0 +1,263 @@
+/**
+ * Scaffold ORM / function / artifact into an app monorepo and keep
+ * sequence.app.yml in sync. Delegates to each primitive's real `init`.
+ */
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { functionsInitCommand } from '../functions/commands.js';
+import { parseArgs } from '../process/commands.js';
+import { currentVersion } from '../update-check.js';
+import { defaultDeployOrder, extendDeployOrder, loadAppManifest, ormNamespaceFromAppId, titleizeSlug, writeAppManifest, } from './manifest.js';
+const LOG = '[seq-studio]';
+const APP_MANIFEST_LABEL = 'sequence.app.yml';
+export function defaultScaffoldNames(_appId) {
+    return { functionName: 'hello' };
+}
+function primitiveIdFor({ kind, name }) {
+    switch (kind) {
+        case 'orm':
+            return `${name}-orm`;
+        case 'artifact':
+            return `${name}-ui`;
+        case 'function':
+            return name;
+    }
+}
+function relativePathFor({ kind, appId, name, }) {
+    switch (kind) {
+        case 'orm':
+            return join('orm', ormNamespaceFromAppId(appId));
+        case 'function':
+            return join('functions', name);
+        case 'artifact':
+            return 'artifact';
+    }
+}
+function buildPrimitiveEntry({ kind, appId, name, dependsOn, }) {
+    const path = relativePathFor({ kind, appId, name }).replace(/\\/g, '/');
+    const id = primitiveIdFor({ kind, name: kind === 'orm' || kind === 'artifact' ? appId : name });
+    const base = { id, kind, path, depends_on: dependsOn };
+    switch (kind) {
+        case 'orm':
+            return { ...base, namespace: ormNamespaceFromAppId(appId) };
+        case 'function':
+            return { ...base, slug: name };
+        case 'artifact':
+            return { ...base, project_id: appId };
+    }
+}
+async function rewriteArtifactIdentity({ artifactDir, appId, }) {
+    const title = titleizeSlug(appId);
+    const manifestPath = join(artifactDir, 'artifact.bundle.yml');
+    if (existsSync(manifestPath)) {
+        const body = await readFile(manifestPath, 'utf8');
+        const next = body
+            .replace(/(project_id:\s*)\S+/g, `$1${appId}`)
+            .replace(/^(\s*)title:\s*.*$/m, `$1title: "${title}"`);
+        if (next !== body)
+            await writeFile(manifestPath, next, 'utf8');
+    }
+    const pkgPath = join(artifactDir, 'package.json');
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(await readFile(pkgPath, 'utf8'));
+            pkg.name = appId;
+            await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, 'utf8');
+        }
+        catch {
+            // leave non-JSON package.json alone
+        }
+    }
+}
+async function scaffoldOrm({ absPath }) {
+    const { runOrmCommand } = await import('../orm/delegate.js');
+    const code = await runOrmCommand('init', [absPath]);
+    if (code !== 0) {
+        throw new Error(`orm init failed for ${absPath} (exit ${code}). ` +
+            '`seq-studio init --with orm` requires `@sequenceholdings/orm` ' +
+            '(workspace / internal installs today; not yet available via public npm).');
+    }
+}
+async function scaffoldArtifact({ absPath, appId, }) {
+    const { runCli } = await import('@sequenceholdings/artifact-studio/cli');
+    const code = await runCli(['init', absPath]);
+    if (code !== 0) {
+        throw new Error(`artifact init failed for ${absPath} (exit ${code})`);
+    }
+    await rewriteArtifactIdentity({ artifactDir: absPath, appId });
+}
+async function scaffoldFunction({ absPath }) {
+    const code = await functionsInitCommand(parseArgs([absPath]));
+    if (code !== 0) {
+        throw new Error(`functions init failed for ${absPath} (exit ${code})`);
+    }
+}
+async function scaffoldKind({ kind, appRoot, appId, name, }) {
+    const relPath = relativePathFor({ kind, appId, name }).replace(/\\/g, '/');
+    const absPath = join(appRoot, relPath);
+    const entry = buildPrimitiveEntry({ kind, appId, name, dependsOn: [] });
+    switch (kind) {
+        case 'orm':
+            await mkdir(dirname(absPath), { recursive: true });
+            await scaffoldOrm({ absPath });
+            break;
+        case 'function':
+            await scaffoldFunction({ absPath });
+            break;
+        case 'artifact':
+            await mkdir(absPath, { recursive: true });
+            await scaffoldArtifact({ absPath, appId });
+            break;
+    }
+    return entry;
+}
+function applyDefaultDependsOn(primitives) {
+    const orm = primitives.find((entry) => entry.kind === 'orm');
+    if (!orm)
+        return primitives;
+    return primitives.map((entry) => {
+        if (entry.kind === 'orm' || entry.depends_on.length > 0)
+            return entry;
+        return { ...entry, depends_on: [orm.id] };
+    });
+}
+export async function initAppMonorepo({ rootDir, appId, kinds, names = defaultScaffoldNames(appId), description, }) {
+    if (kinds.length === 0) {
+        throw new Error('select at least one primitive via --with orm,function,artifact (or --orm --function …)');
+    }
+    const appRoot = resolve(rootDir);
+    if (existsSync(join(appRoot, 'sequence.app.yml'))) {
+        throw new Error(`${join(appRoot, 'sequence.app.yml')} already exists — refusing to re-init`);
+    }
+    if (existsSync(appRoot)) {
+        const { readdir } = await import('node:fs/promises');
+        const entries = await readdir(appRoot).catch((error) => {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        });
+        if (entries.length > 0) {
+            throw new Error(`${appRoot} is not empty — init into a new directory, or remove existing files first`);
+        }
+    }
+    await mkdir(appRoot, { recursive: true });
+    try {
+        const version = currentVersion();
+        const primitives = [];
+        for (const kind of kinds) {
+            const name = kind === 'function' ? names.functionName : appId;
+            primitives.push(await scaffoldKind({ kind, appRoot, appId, name }));
+        }
+        const withDeps = applyDefaultDependsOn(primitives);
+        const manifest = {
+            schema_version: 1,
+            app: {
+                id: appId,
+                title: titleizeSlug(appId),
+                ...(description !== undefined ? { description } : {}),
+            },
+            studio: {
+                created_with: version,
+                min_cli: version,
+            },
+            primitives: withDeps,
+            deploy: {
+                order: defaultDeployOrder(withDeps),
+                on_error: 'stop',
+            },
+        };
+        await writeAppManifest({ rootDir: appRoot, manifest });
+        await writeFile(join(appRoot, '.gitignore'), ['node_modules/', 'dist/', '.env', '.env.*', '!.env.example', '.DS_Store', '*.log'].join('\n') + '\n', 'utf8');
+        return manifest;
+    }
+    catch (error) {
+        // Directory was empty (or newly created) — remove partial scaffolds so a
+        // retry can `init` into the same path without a manual cleanup.
+        await rm(appRoot, { recursive: true, force: true }).catch(() => {
+            /* best-effort */
+        });
+        throw error;
+    }
+}
+export async function addPrimitiveToApp({ rootDir, kind, name, }) {
+    const appRoot = resolve(rootDir);
+    const manifest = await loadAppManifest(appRoot);
+    const appId = manifest.app.id;
+    if (kind === 'orm') {
+        throw new Error('adding a second orm namespace is not supported via `seq-studio add` yet — edit sequence.app.yml and scaffold with `seq-studio orm init` manually');
+    }
+    if (kind === 'artifact' && manifest.primitives.some((entry) => entry.kind === 'artifact')) {
+        throw new Error('this app already has an artifact primitive — remove it from sequence.app.yml before re-adding');
+    }
+    const entryId = primitiveIdFor({ kind, name: kind === 'artifact' ? appId : name });
+    if (manifest.primitives.some((entry) => entry.id === entryId)) {
+        throw new Error(`primitive id "${entryId}" already exists in sequence.app.yml`);
+    }
+    const relPath = relativePathFor({ kind, appId, name }).replace(/\\/g, '/');
+    if (manifest.primitives.some((entry) => entry.path === relPath)) {
+        throw new Error(`path "${relPath}" is already declared in sequence.app.yml`);
+    }
+    const absPath = join(appRoot, relPath);
+    // Refuse before scaffolding so a failed init cannot roll back pre-existing files.
+    if (existsSync(absPath)) {
+        throw new Error(`${relPath} already exists on disk — remove it or choose a different name before \`seq-studio add\``);
+    }
+    try {
+        let entry = await scaffoldKind({ kind, appRoot, appId, name });
+        const orm = manifest.primitives.find((item) => item.kind === 'orm');
+        if (orm && entry.depends_on.length === 0) {
+            entry = { ...entry, depends_on: [orm.id] };
+        }
+        const primitives = [...manifest.primitives, entry];
+        const next = {
+            ...manifest,
+            primitives,
+            deploy: {
+                ...manifest.deploy,
+                order: extendDeployOrder({
+                    existingOrder: manifest.deploy.order,
+                    primitives,
+                    newId: entry.id,
+                }),
+                on_error: manifest.deploy.on_error,
+            },
+        };
+        await writeAppManifest({ rootDir: appRoot, manifest: next });
+        return { manifest: next, entry };
+    }
+    catch (error) {
+        // Safe: absPath did not exist before this invocation.
+        await rm(absPath, { recursive: true, force: true }).catch(() => {
+            /* best-effort */
+        });
+        throw error;
+    }
+}
+export function printInitNextSteps({ appRoot, manifest, }) {
+    const rel = relative(process.cwd(), appRoot);
+    const display = !rel || rel.startsWith('..') ? appRoot : rel;
+    console.log(`${LOG} scaffolded app "${manifest.app.id}" in ${display}`);
+    console.log(`${LOG} wrote ${APP_MANIFEST_LABEL} with ${manifest.primitives.length} primitive(s):`);
+    for (const entry of manifest.primitives) {
+        console.log(`${LOG}   - ${entry.kind.padEnd(9)} ${entry.id}  (${entry.path})`);
+    }
+    console.log('');
+    console.log('Next:');
+    console.log(`  cd ${display}`);
+    for (const entry of manifest.primitives) {
+        console.log(`  (cd ${entry.path} && pnpm install)`);
+    }
+    console.log('  seq-studio login');
+    console.log('  seq-studio deploy -e local --yes');
+    console.log('  # or targeted:');
+    const fn = manifest.primitives.find((entry) => entry.kind === 'function');
+    if (fn) {
+        console.log(`  seq-studio functions deploy --dir ${fn.path} -e local --yes`);
+    }
+    if (manifest.primitives.some((entry) => entry.kind === 'artifact')) {
+        console.log('  seq-studio artifact deploy artifact -e local');
+    }
+    console.log('  # add another function later:');
+    console.log('  seq-studio add function list-types');
+}

package/dist/atlas-client.js

@@ -9,6 +9,7 @@ import { PREVIEW_DOMAIN } from './preview.js';
 const MAX_503_RETRIES = 5;
 const DEFAULT_RETRY_AFTER_SECONDS = 2;
 const LOG_PREFIX = '[seq-studio]';
+const CF_ACCESS_DOMAIN = 'seqholdings.com';
 export class AtlasApiError extends Error {
     status;
     path;
@@ -42,6 +43,7 @@ async function authenticatedFetch({ baseUrl, init = {}, path, token, }) {
         redirect: 'manual',
         headers: {
             ...previewAccessHeaders(baseUrl),
+            ...cfAccessHeaders(baseUrl),
             ...init.headers,
             Authorization: `Bearer ${token}`,
         },
@@ -63,6 +65,33 @@ function previewAccessHeaders(baseUrl) {
         return {};
     }
 }
+/**
+ * Cloudflare Access fronts *.seqholdings.com and only bypasses the company
+ * network, so a CI runner is turned away at the edge with an HTML "Access
+ * Restricted" page before Atlas ever sees the bearer token. A service token
+ * gets through the edge; the bearer still authenticates at the app.
+ *
+ * Scoped to seqholdings.com so the token is never sent to localhost, a tenant
+ * domain, or any other host the CLI can be pointed at.
+ */
+function cfAccessHeaders(baseUrl) {
+    const clientId = process.env.CF_ACCESS_CLIENT_ID?.trim();
+    const clientSecret = process.env.CF_ACCESS_CLIENT_SECRET?.trim();
+    if (!clientId || !clientSecret)
+        return {};
+    try {
+        const parsed = new URL(baseUrl);
+        if (parsed.protocol !== 'https:')
+            return {};
+        const hostname = parsed.hostname.toLowerCase();
+        if (hostname !== CF_ACCESS_DOMAIN && !hostname.endsWith(`.${CF_ACCESS_DOMAIN}`))
+            return {};
+        return { 'CF-Access-Client-Id': clientId, 'CF-Access-Client-Secret': clientSecret };
+    }
+    catch {
+        return {};
+    }
+}
 function messageFromBody(body, status, statusText) {
     if (body && typeof body === 'object') {
         const record = body;

package/dist/auth.js

@@ -43,6 +43,8 @@ const SEQUENCE_BUILTIN_ENVS = new Set(['local', 'staging', 'production', 'bankso
 export function isSequenceAuthEnvName(envName) {
     return (envName === SEQUENCE_REALM ||
         SEQUENCE_BUILTIN_ENVS.has(envName) ||
+        envName === 'worktree' ||
+        envName.startsWith('local:') ||
         envName === 'preview' ||
         envName.startsWith('preview:'));
 }

package/dist/functions/commands.js

@@ -198,6 +198,7 @@ entrypoint: handler
 limits:
   memory_mb: 256
   timeout_seconds: 60
+  min_instances: 0
   max_instances: 3
   invoke_rate_per_minute: 60
 

package/dist/functions/manifest.d.ts

@@ -5,6 +5,20 @@ import { z } from 'zod';
  * as artifact-studio's duplicated manifest. Keep the two in sync.
  */
 export declare const MF_MANIFEST_FILENAME = "managed-function.yml";
+export declare const managedFunctionAuthorizationAdapterSchema: z.ZodEnum<{
+    "encompass.loan-read-by-guid": "encompass.loan-read-by-guid";
+    "encompass.loan-read-by-number": "encompass.loan-read-by-number";
+    "encompass.loan-search": "encompass.loan-search";
+}>;
+export type ManagedFunctionAuthorizationAdapter = z.infer<typeof managedFunctionAuthorizationAdapterSchema>;
+export declare const managedFunctionAuthorizationSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    adapter: z.ZodEnum<{
+        "encompass.loan-read-by-guid": "encompass.loan-read-by-guid";
+        "encompass.loan-read-by-number": "encompass.loan-read-by-number";
+        "encompass.loan-search": "encompass.loan-search";
+    }>;
+}, z.core.$strict>;
 /**
  * CLI-side copy of the server's egress entry validation (see
  * atlas/src/server/services/managed-functions/egress.ts). Returns the
@@ -52,12 +66,21 @@ export declare const managedFunctionManifestSchema: z.ZodObject<{
     limits: z.ZodDefault<z.ZodObject<{
         memory_mb: z.ZodDefault<z.ZodNumber>;
         timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        min_instances: z.ZodDefault<z.ZodNumber>;
         max_instances: z.ZodDefault<z.ZodNumber>;
         invoke_rate_per_minute: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     secrets: z.ZodDefault<z.ZodArray<z.ZodString>>;
     egress: z.ZodDefault<z.ZodArray<z.ZodString>>;
     service_account: z.ZodOptional<z.ZodString>;
+    authorization: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        adapter: z.ZodEnum<{
+            "encompass.loan-read-by-guid": "encompass.loan-read-by-guid";
+            "encompass.loan-read-by-number": "encompass.loan-read-by-number";
+            "encompass.loan-search": "encompass.loan-search";
+        }>;
+    }, z.core.$strict>>;
     input_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     output_schema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     capabilities: z.ZodDefault<z.ZodObject<{
@@ -83,6 +106,7 @@ export declare const managedFunctionManifestSchema: z.ZodObject<{
         data: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             tables: z.ZodDefault<z.ZodArray<z.ZodString>>;
             actions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            operations: z.ZodDefault<z.ZodArray<z.ZodString>>;
             query: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strip>>>;
     }, z.core.$strip>>;

package/dist/functions/manifest.js

@@ -6,6 +6,22 @@ import { z } from 'zod';
  */
 export const MF_MANIFEST_FILENAME = 'managed-function.yml';
 const SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
+export const managedFunctionAuthorizationAdapterSchema = z.enum([
+    'encompass.loan-read-by-guid',
+    'encompass.loan-read-by-number',
+    'encompass.loan-search',
+]);
+export const managedFunctionAuthorizationSchema = z
+    .object({
+    version: z.literal(1),
+    adapter: managedFunctionAuthorizationAdapterSchema,
+})
+    .strict();
+const AUTHORIZATION_ADAPTER_BY_FUNCTION_ID = {
+    'encompass-get-common-loan-fields': 'encompass.loan-read-by-guid',
+    'encompass-get-loan-by-number': 'encompass.loan-read-by-number',
+    'encompass-search-pipeline': 'encompass.loan-search',
+};
 /** RFC 1035 label: alnum, optional inner dashes, max 63 chars. */
 const DNS_LABEL_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
 /**
@@ -493,6 +509,12 @@ function validateCapabilityGates({ gates, uses, roles, }) {
  * Mirrors atlas/src/server/services/managed-functions/manifest.ts.
  */
 const SERVICE_ACCOUNT_REF_RE = /^([a-z][a-z0-9-]{1,98}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
+/**
+ * GraphQL Name grammar — persisted-operation names exactly as they appear in
+ * a namespace's operations manifest. Mirrors
+ * atlas/src/server/services/managed-functions/manifest.ts.
+ */
+const GRAPHQL_OPERATION_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]*$/;
 export const managedFunctionManifestSchema = z.object({
     schema_version: z.literal(1).default(1),
     function: z.object({
@@ -510,12 +532,23 @@ export const managedFunctionManifestSchema = z.object({
         .object({
         memory_mb: z.number().int().min(128).max(2048).default(256),
         timeout_seconds: z.number().int().min(1).max(540).default(60),
+        min_instances: z.number().int().min(0).max(10).default(0),
         max_instances: z.number().int().min(1).max(10).default(3),
         invoke_rate_per_minute: z.number().int().min(1).max(600).default(60),
+    })
+        .superRefine((limits, ctx) => {
+        if (limits.min_instances > limits.max_instances) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'min_instances cannot exceed max_instances',
+                path: ['min_instances'],
+            });
+        }
     })
         .default({
         memory_mb: 256,
         timeout_seconds: 60,
+        min_instances: 0,
         max_instances: 3,
         invoke_rate_per_minute: 60,
     }),
@@ -554,6 +587,11 @@ export const managedFunctionManifestSchema = z.object({
         .string()
         .regex(SERVICE_ACCOUNT_REF_RE, 'service_account must be a platform service-account slug (lowercase alphanumeric with hyphens) or uuid')
         .optional(),
+    /**
+     * Server-owned resource authorization. Authors select a reviewed adapter;
+     * they cannot provide input/output paths or executable policy.
+     */
+    authorization: managedFunctionAuthorizationSchema.optional(),
     input_schema: z.record(z.string(), z.unknown()).optional(),
     output_schema: z.record(z.string(), z.unknown()).optional(),
     /**
@@ -567,12 +605,13 @@ export const managedFunctionManifestSchema = z.object({
         gates: capabilityGatesSchema,
         /**
          * ORM Data API consumer reach, grouped by namespace: the `tables` this
-         * function may read, the `actions` it may invoke, and whether raw `query`
-         * (arbitrary read SQL over the namespace) is allowed — all ON BEHALF OF the
-         * invoking user. The invoke proxy mints a short-lived token scoped to
-         * exactly these refs; the Data API re-resolves the user's claims per call,
-         * so declaring a table never widens what the user could see. Writes go
-         * through declared actions only — raw table writes don't exist.
+         * function may read, the v1 `actions` and v2 persisted `operations` it may
+         * invoke, and whether raw `query` (arbitrary read SQL over the namespace)
+         * is allowed — all ON BEHALF OF the invoking user. The invoke proxy mints
+         * a short-lived token scoped to exactly these refs; the Data API
+         * re-resolves the user's claims per call, so declaring a table never
+         * widens what the user could see. Writes go through declared actions and
+         * operations only — raw table writes don't exist.
          *
          * Mirrors atlas/src/server/services/managed-functions/manifest.ts — must
          * stay in sync so `seq-studio` doesn't strip the block before deploy.
@@ -581,11 +620,47 @@ export const managedFunctionManifestSchema = z.object({
             .record(z.string().regex(/^[a-z][a-z0-9_]{0,40}$/, 'capabilities.data keys are ORM namespace names'), z.object({
             tables: z.array(z.string().regex(/^[a-z_][a-z0-9_]*$/, 'table names')).max(64).default([]),
             actions: z.array(z.string().regex(/^[a-z_][a-z0-9_]*$/, 'action names')).max(64).default([]),
+            /**
+             * ORM v2 persisted operations (GraphQL mutations/actions by name)
+             * this function may execute — each mints a `<ns>/ops/<Name>` write
+             * ref on the invoke token.
+             */
+            operations: z
+                .array(z
+                .string()
+                .max(128)
+                .regex(GRAPHQL_OPERATION_NAME_RE, 'operation names must match the GraphQL Name grammar'))
+                .max(64)
+                .default([]),
             query: z.boolean().default(false),
         }))
             .default({}),
     }).default({ uses: [], gates: [], data: {} }),
 }).superRefine((manifest, ctx) => {
+    const expectedAdapter = AUTHORIZATION_ADAPTER_BY_FUNCTION_ID[manifest.function.id];
+    if (expectedAdapter !== undefined && manifest.authorization === undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            message: `function "${manifest.function.id}" requires authorization adapter "${expectedAdapter}"`,
+            path: ['authorization'],
+        });
+    }
+    else if (expectedAdapter !== undefined &&
+        manifest.authorization?.adapter !== expectedAdapter) {
+        ctx.addIssue({
+            code: 'custom',
+            message: `function "${manifest.function.id}" must use authorization adapter "${expectedAdapter}"`,
+            path: ['authorization', 'adapter'],
+        });
+    }
+    else if (expectedAdapter === undefined &&
+        manifest.authorization !== undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            message: `function "${manifest.function.id}" is not registered for a server-owned authorization adapter`,
+            path: ['authorization'],
+        });
+    }
     for (const message of validateCapabilityPins({
         uses: manifest.capabilities.uses,
         roles: manifest.capabilities.roles,
@@ -600,9 +675,9 @@ export const managedFunctionManifestSchema = z.object({
         ctx.addIssue({ code: 'custom', message, path: ['capabilities', 'gates'] });
     }
     // A namespace is "reached" when its block declares at least one table,
-    // action, or raw query — the same rule the server's floor reconciliation
-    // uses (readManifestDataNamespaces).
-    const reachesData = Object.values(manifest.capabilities.data).some((block) => block.tables.length > 0 || block.actions.length > 0 || block.query);
+    // action, operation, or raw query — the same rule the server's floor
+    // reconciliation uses (readManifestDataNamespaces).
+    const reachesData = Object.values(manifest.capabilities.data).some((block) => block.tables.length > 0 || block.actions.length > 0 || block.operations.length > 0 || block.query);
     if (reachesData && manifest.service_account === undefined) {
         ctx.addIssue({
             code: 'custom',

package/dist/main.d.ts

@@ -2,6 +2,9 @@
  * seq-studio argv router.
  *
  * Top-level commands:
+ *   seq-studio init               scaffold an app monorepo (sequence.app.yml)
+ *   seq-studio add                 add a primitive to an app monorepo
+ *   seq-studio deploy             deploy all primitives from sequence.app.yml
  *   seq-studio process <sub>      manage Lattice processes
  *   seq-studio artifact <sub>     manage Artifact Studio apps
  *   seq-studio functions <sub>    manage Managed Functions

package/dist/main.js

@@ -2,6 +2,9 @@
  * seq-studio argv router.
  *
  * Top-level commands:
+ *   seq-studio init               scaffold an app monorepo (sequence.app.yml)
+ *   seq-studio add                 add a primitive to an app monorepo
+ *   seq-studio deploy             deploy all primitives from sequence.app.yml
  *   seq-studio process <sub>      manage Lattice processes
  *   seq-studio artifact <sub>     manage Artifact Studio apps
  *   seq-studio functions <sub>    manage Managed Functions
@@ -21,6 +24,9 @@ import { applyCommand, bundleCommand, doctorCommand, initCommand, lintCommand, p
 // Lazy-load artifact delegate: published @sequenceholdings/artifact-studio/cli
 // still auto-runs runCli() at module load; importing it here breaks doctor/process.
 const TOP_LEVEL_USAGE = `usage:
+  seq-studio init <dir> --with <kinds>   scaffold an app monorepo (sequence.app.yml)
+  seq-studio add <kind> <name>           add a primitive to the current app monorepo
+  seq-studio deploy -e <env>             deploy primitives from sequence.app.yml
   seq-studio process <sub> [args]    lint | plan | apply | test | simulate | bundle | init
   seq-studio artifact <sub> [args]   init | build | plan | deploy | dev | list | show | pull | promote | rollback
   seq-studio functions <sub> [args]  init | build | deploy | list | show | logs | promote | rollback | delete
@@ -65,6 +71,21 @@ export async function run(argv = process.argv.slice(2)) {
         return namespace ? 0 : 1;
     }
     switch (namespace) {
+        case 'init': {
+            const { runAppInitCommand } = await import('./app/commands.js');
+            return runAppInitCommand(parseArgs([sub, ...rest].filter((a) => Boolean(a))));
+        }
+        case 'add': {
+            const { runAppAddCommand } = await import('./app/commands.js');
+            return runAppAddCommand({
+                kindArg: sub,
+                args: parseArgs(rest),
+            });
+        }
+        case 'deploy': {
+            const { runAppDeployCommand } = await import('./app/commands.js');
+            return runAppDeployCommand(parseArgs([sub, ...rest].filter((a) => Boolean(a))));
+        }
         case 'process':
             return runProcessNamespace(sub, rest);
         case 'artifact': {

package/dist/pipeline/codegen.d.ts

@@ -0,0 +1,2 @@
+import type { ParsedArgs } from '../process/commands.js';
+export declare function pipelineCodegenTablesCommand(args: ParsedArgs): Promise<number>;