@soku-ai/cli 0.1.0-alpha.0

package/dist/commands/egress.js

@@ -0,0 +1,197 @@
+/** `soku egress -- <curl…>` — proxy a third-party API call through Soku so the
+ * credential is injected server-side (no API key on this machine), and
+ * `soku egress providers` — list the covered hosts.
+ *
+ * The agent prefixes its existing skill `curl` with `soku egress --`; we parse
+ * the curl, strip any placeholder auth header, and forward the request to
+ * `/api/cli/egress`. The upstream response is streamed back to stdout verbatim,
+ * so the skill sees exactly what a direct call would return. Only Soku-level
+ * failures (auth, allowlist, billing) become a CLI error envelope.
+ */
+import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { clearToken, loadToken } from '../auth/store.js';
+import { loadConfig, resolveApiBaseUrl } from '../config.js';
+import { apiRequest } from '../http/client.js';
+import { cyan, dim, emitError, emitSuccess, ExitCode, table } from '../output/envelope.js';
+// A header value carrying only an auth scheme word (or nothing) — the result of
+// `-H "Authorization: Bearer $X"` when `$X` is unset. Not a real credential.
+const PLACEHOLDER_AUTH = /^\s*(bearer|token|key|basic)?\s*$/i;
+function readData(value) {
+    if (value.startsWith('@'))
+        return readFileSync(value.slice(1));
+    return Buffer.from(value);
+}
+/** Extract method / url / headers / body from a curl-style token list. Pure. */
+export function parseCurl(tokens) {
+    const headers = {};
+    let method;
+    let url;
+    let body;
+    let getMode = false;
+    let i = tokens[0] === 'curl' ? 1 : 0;
+    for (; i < tokens.length; i++) {
+        const t = tokens[i];
+        switch (t) {
+            case '-X':
+            case '--request':
+                method = tokens[++i]?.toUpperCase();
+                break;
+            case '-H':
+            case '--header': {
+                const h = tokens[++i];
+                if (h) {
+                    const idx = h.indexOf(':');
+                    if (idx > 0)
+                        headers[h.slice(0, idx).trim().toLowerCase()] = h.slice(idx + 1).trim();
+                }
+                break;
+            }
+            case '-d':
+            case '--data':
+            case '--data-raw':
+            case '--data-ascii':
+            case '--data-binary': {
+                const d = tokens[++i];
+                if (d !== undefined)
+                    body = readData(d);
+                break;
+            }
+            case '-G':
+            case '--get':
+                getMode = true;
+                break;
+            case '--url':
+                url = tokens[++i];
+                break;
+            default:
+                if (/^https?:\/\//i.test(t))
+                    url = t;
+                // Unknown flags are skipped; we do not consume their value, so a few
+                // exotic curl flags may leak a token — the documented subset is
+                // -X/-H/-d/--data*/-G/--url + the URL.
+                break;
+        }
+    }
+    if (!method)
+        method = body ? 'POST' : 'GET';
+    if (getMode && body && url) {
+        const u = new URL(url);
+        for (const [k, v] of new URLSearchParams(body.toString()))
+            u.searchParams.append(k, v);
+        url = u.toString();
+        body = undefined;
+        method = 'GET';
+    }
+    return { method, url, headers, body };
+}
+/** Drop empty / bare-scheme auth headers so the server injects the real key
+ * (an empty `Authorization: Bearer ` would otherwise be treated as BYO). */
+export function stripPlaceholderAuth(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+        if (PLACEHOLDER_AUTH.test(v))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+function workspace() {
+    const cfg = loadConfig();
+    const orgId = process.env.SOKU_ORG_ID || cfg.activeOrgId;
+    const brandId = process.env.SOKU_BRAND_ID || cfg.activeBrandId;
+    if (!orgId || !brandId) {
+        emitError('no_workspace', 'No active workspace selected.', ExitCode.USAGE, 'Run `soku org use <id>` then `soku brand use <id>`.');
+    }
+    return { orgId, brandId };
+}
+function egressErrorExit(status, type, message) {
+    const code = status === 401 || status === 403
+        ? ExitCode.AUTH
+        : status === 402 || status === 400
+            ? ExitCode.USAGE
+            : status === 404
+                ? ExitCode.NOT_FOUND
+                : ExitCode.RUNTIME;
+    return emitError(type, message, code);
+}
+async function runEgress(parsed) {
+    if (!parsed.url) {
+        emitError('usage', 'No URL found in the egress request.', ExitCode.USAGE, 'Usage: soku egress -- curl <url>');
+    }
+    const token = await loadToken();
+    if (!token) {
+        emitError('not_authenticated', 'No Soku session found.', ExitCode.AUTH, 'Run `soku auth login`.');
+    }
+    const { orgId, brandId } = workspace();
+    const headers = stripPlaceholderAuth(parsed.headers);
+    const spec = { method: parsed.method, url: parsed.url, headers, id: randomUUID() };
+    const specHeader = Buffer.from(JSON.stringify(spec)).toString('base64');
+    const base = resolveApiBaseUrl();
+    let res;
+    try {
+        res = await fetch(`${base}/api/cli/egress`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'X-Soku-Org': orgId,
+                'X-Soku-Brand': brandId,
+                'X-Soku-Egress-Spec': specHeader,
+                ...(parsed.body ? { 'Content-Type': 'application/octet-stream' } : {}),
+            },
+            body: parsed.body,
+        });
+    }
+    catch (err) {
+        return emitError('network_error', `Could not reach ${base}: ${err.message}`, ExitCode.RUNTIME, 'Behind a proxy? Set ALL_PROXY.');
+    }
+    // Success always carries the upstream marker; anything else is a Soku-level
+    // failure (auth/workspace dependency error, or an _egress_error envelope).
+    if (res.headers.get('x-soku-egress') !== 'upstream') {
+        if (res.status === 401)
+            await clearToken();
+        const parsedBody = (await res.json().catch(() => null));
+        const errObj = parsedBody?.error ??
+            parsedBody?.detail ??
+            {};
+        const type = String(errObj.type ?? errObj.error ?? 'egress_error');
+        const message = String(errObj.message ?? `Egress failed (HTTP ${res.status}).`);
+        egressErrorExit(res.status, type, message);
+    }
+    // Passthrough: stream the upstream body to stdout verbatim.
+    if (res.body) {
+        await pipeline(Readable.fromWeb(res.body), process.stdout);
+    }
+    process.exit(ExitCode.OK);
+}
+export function registerEgressCommands(program) {
+    const egress = program
+        .command('egress')
+        .description('Proxy a third-party API call with a server-injected credential')
+        .argument('[request...]', 'the third-party request, e.g. `-- curl -H "..." https://host/path`')
+        .allowUnknownOption()
+        .action(async (request) => {
+        await runEgress(parseCurl(request));
+    });
+    egress
+        .command('providers')
+        .description('List third-party hosts the egress proxy injects credentials for')
+        .action(async () => {
+        const data = await apiRequest('/api/cli/egress/providers', { workspace: true });
+        emitSuccess(data, (d) => {
+            const t = table(d.providers.map((p) => ({
+                id: p.id,
+                hosts: p.hostnames.join(', '),
+                auth: `${p.auth.location}:${p.auth.name}`,
+            })), [
+                { key: 'id', header: 'PROVIDER' },
+                { key: 'hosts', header: 'HOSTS' },
+                { key: 'auth', header: 'AUTH' },
+            ]);
+            return `${t}\n${dim(`${d.count} covered · call via: `)}${cyan('soku egress -- curl <url>')}`;
+        });
+    });
+}
+//# sourceMappingURL=egress.js.map

package/dist/commands/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../src/commands/egress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAI/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAS1F,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,oCAAoC,CAAA;AAE7D,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,MAAgB;IACxC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,IAAI,MAA0B,CAAA;IAC9B,IAAI,GAAuB,CAAA;IAC3B,IAAI,IAAwB,CAAA;IAC5B,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACnB,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;gBACnC,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;gBACrB,IAAI,CAAC,EAAE,CAAC;oBACN,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBAC1B,IAAI,GAAG,GAAG,CAAC;wBAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBACtF,CAAC;gBACD,MAAK;YACP,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ,CAAC;YACd,KAAK,YAAY,CAAC;YAClB,KAAK,cAAc,CAAC;YACpB,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;gBACrB,IAAI,CAAC,KAAK,SAAS;oBAAE,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;gBACvC,MAAK;YACP,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,OAAO;gBACV,OAAO,GAAG,IAAI,CAAA;gBACd,MAAK;YACP,KAAK,OAAO;gBACV,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;gBACjB,MAAK;YACP;gBACE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,GAAG,GAAG,CAAC,CAAA;gBACpC,qEAAqE;gBACrE,gEAAgE;gBAChE,uCAAuC;gBACvC,MAAK;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;IAC3C,IAAI,OAAO,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;QAClB,IAAI,GAAG,SAAS,CAAA;QAChB,MAAM,GAAG,KAAK,CAAA;IAChB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACvC,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,OAA+B;IAClE,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAQ;QACtC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACZ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAA;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAA;IAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,SAAS,CACP,cAAc,EACd,+BAA+B,EAC/B,QAAQ,CAAC,KAAK,EACd,qDAAqD,CACtD,CAAA;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IACpE,MAAM,IAAI,GACR,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAC9B,CAAC,CAAC,QAAQ,CAAC,IAAI;QACf,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAChC,CAAC,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,MAAM,KAAK,GAAG;gBACd,CAAC,CAAC,QAAQ,CAAC,SAAS;gBACpB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAA;IAC1B,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAkB;IACzC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,SAAS,CAAC,OAAO,EAAE,qCAAqC,EAAE,QAAQ,CAAC,KAAK,EAAE,kCAAkC,CAAC,CAAA;IAC/G,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,SAAS,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAA;IACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAA;IAClF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAEvE,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAA;IAChC,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,iBAAiB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,YAAY,EAAE,KAAK;gBACnB,cAAc,EAAE,OAAO;gBACvB,oBAAoB,EAAE,UAAU;gBAChC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE;YACD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,SAAS,CACd,eAAe,EACf,mBAAmB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,EACpD,QAAQ,CAAC,OAAO,EAChB,gCAAgC,CACjC,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,UAAU,EAAE,CAAA;QAC1C,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAA;QACzF,MAAM,MAAM,GACT,UAAU,EAAE,KAA6C;YACzD,UAAU,EAAE,MAA8C;YAC3D,EAAE,CAAA;QACJ,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,cAAc,CAAC,CAAA;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,uBAAuB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAA;QAC/E,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,4DAA4D;IAC5D,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA8C,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACtG,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAC3B,CAAC;AAQD,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,QAAQ,CAAC,cAAc,EAAE,oEAAoE,CAAC;SAC9F,kBAAkB,EAAE;SACpB,MAAM,CAAC,KAAK,EAAE,OAAiB,EAAE,EAAE;QAClC,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,2BAA2B,EAC3B,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAA;QACD,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC,GAAG,KAAK,CACb,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7B,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;aAC1C,CAAC,CAAC,EACH;gBACE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE;gBACjC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;gBACjC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;aAChC,CACF,CAAA;YACD,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,uBAAuB,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAA;QAC9F,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/commands/generated.d.ts

@@ -0,0 +1,41 @@
+/** Typed data-action sub-commands, generated from the capability manifest.
+ *
+ * The manifest (`src/generated/capabilities.json`, produced by
+ * `scripts/gen-capabilities.ts`) is a snapshot of the backend ActionSpec
+ * registry's read-only data-infra surface. Each action becomes a sub-command
+ * under its namespace (e.g. `soku ads query-single-dimension`), with one flag
+ * per input param. `--help` on any command is the shell-native equivalent of
+ * the old `capabilities describe`. The raw `soku call` command remains as a
+ * forward-compat escape hatch for actions not yet in a published manifest.
+ */
+import { Command } from 'commander';
+export interface ManifestParam {
+    name: string;
+    type: string;
+    required: boolean;
+    description: string;
+    example?: unknown;
+}
+export interface ManifestAction {
+    id: string;
+    namespace: string;
+    action: string;
+    description: string;
+    long_description: string | null;
+    capability_mode: string;
+    priority: string;
+    requires_review: boolean;
+    freshness_kind: string;
+    input_params: ManifestParam[];
+    output_shape: string | null;
+    see_also: string[];
+}
+export interface CapabilityManifest {
+    actions: ManifestAction[];
+}
+/** Load the committed manifest shipped alongside the compiled CLI. */
+export declare function loadManifest(): CapabilityManifest;
+/** Register one namespace group + typed sub-command per manifest action. */
+export declare function buildGeneratedCommands(program: Command, manifest: CapabilityManifest): void;
+export declare function registerGeneratedCommands(program: Command): void;
+//# sourceMappingURL=generated.d.ts.map

package/dist/commands/generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../src/commands/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAMnC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,aAAa,EAAE,CAAA;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAmCD,sEAAsE;AACtE,wBAAgB,YAAY,IAAI,kBAAkB,CAGjD;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAmD3F;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEhE"}

package/dist/commands/generated.js

@@ -0,0 +1,106 @@
+/** Typed data-action sub-commands, generated from the capability manifest.
+ *
+ * The manifest (`src/generated/capabilities.json`, produced by
+ * `scripts/gen-capabilities.ts`) is a snapshot of the backend ActionSpec
+ * registry's read-only data-infra surface. Each action becomes a sub-command
+ * under its namespace (e.g. `soku ads query-single-dimension`), with one flag
+ * per input param. `--help` on any command is the shell-native equivalent of
+ * the old `capabilities describe`. The raw `soku call` command remains as a
+ * forward-compat escape hatch for actions not yet in a published manifest.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { apiRequest } from '../http/client.js';
+import { emitError, emitSuccess, ExitCode } from '../output/envelope.js';
+import { unwrapDispatch } from '../output/unwrap.js';
+function toKebab(name) {
+    return name.replace(/_/g, '-');
+}
+function toCamel(name) {
+    return name.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function isJsonType(type) {
+    // object / list, plus unions that include either (e.g. "string|list").
+    return /\b(object|list)\b/.test(type);
+}
+function isNumberType(type) {
+    return type === 'integer' || type === 'number';
+}
+function parseJsonFlag(param, raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return emitError('usage', `--${toKebab(param)} must be valid JSON.`, ExitCode.USAGE);
+    }
+}
+function parseNumberFlag(param, raw) {
+    const n = Number(raw);
+    if (Number.isNaN(n)) {
+        return emitError('usage', `--${toKebab(param)} must be a number.`, ExitCode.USAGE);
+    }
+    return n;
+}
+/** Load the committed manifest shipped alongside the compiled CLI. */
+export function loadManifest() {
+    const path = fileURLToPath(new URL('../generated/capabilities.json', import.meta.url));
+    return JSON.parse(readFileSync(path, 'utf8'));
+}
+/** Register one namespace group + typed sub-command per manifest action. */
+export function buildGeneratedCommands(program, manifest) {
+    const groups = new Map();
+    const groupFor = (namespace) => {
+        let group = groups.get(namespace);
+        if (!group) {
+            group = program.command(namespace).description(`${namespace} data capabilities`);
+            groups.set(namespace, group);
+        }
+        return group;
+    };
+    for (const spec of manifest.actions) {
+        const cmd = groupFor(spec.namespace).command(toKebab(spec.action));
+        cmd.description(spec.description);
+        if (spec.long_description)
+            cmd.addHelpText('after', `\n${spec.long_description}`);
+        for (const param of spec.input_params) {
+            const flag = `--${toKebab(param.name)}`;
+            const desc = param.description || param.name;
+            if (param.type === 'boolean') {
+                cmd.option(flag, desc);
+                continue;
+            }
+            const valueFlag = `${flag} <value>`;
+            const coerce = isJsonType(param.type)
+                ? (v) => parseJsonFlag(param.name, v)
+                : isNumberType(param.type)
+                    ? (v) => parseNumberFlag(param.name, v)
+                    : undefined;
+            if (param.required) {
+                if (coerce)
+                    cmd.requiredOption(valueFlag, desc, coerce);
+                else
+                    cmd.requiredOption(valueFlag, desc);
+            }
+            else {
+                if (coerce)
+                    cmd.option(valueFlag, desc, coerce);
+                else
+                    cmd.option(valueFlag, desc);
+            }
+        }
+        cmd.action(async (opts) => {
+            const payload = {};
+            for (const param of spec.input_params) {
+                const value = opts[toCamel(param.name)];
+                if (value !== undefined)
+                    payload[param.name] = value;
+            }
+            const result = await apiRequest(`/api/cli/call/${encodeURIComponent(spec.namespace)}/${encodeURIComponent(spec.action)}`, { method: 'POST', body: payload, workspace: true });
+            emitSuccess(unwrapDispatch(result));
+        });
+    }
+}
+export function registerGeneratedCommands(program) {
+    buildGeneratedCommands(program, loadManifest());
+}
+//# sourceMappingURL=generated.js.map

package/dist/commands/generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.js","sourceRoot":"","sources":["../../src/commands/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAIxC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AA6BpD,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,uEAAuE;IACvE,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,CAAA;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,GAAW;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;IACtF,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,GAAW;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,gCAAgC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACtF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAuB,CAAA;AACrE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CAAC,OAAgB,EAAE,QAA4B;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAA;IACzC,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAW,EAAE;QAC9C,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,GAAG,SAAS,oBAAoB,CAAC,CAAA;YAChF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QAClE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,gBAAgB;YAAE,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEjF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAA;YAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBACtB,SAAQ;YACV,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,IAAI,UAAU,CAAA;YACnC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBACnC,CAAC,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;oBACxB,CAAC,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC/C,CAAC,CAAC,SAAS,CAAA;YACf,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,MAAM;oBAAE,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;;oBAClD,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC1C,CAAC;iBAAM,CAAC;gBACN,IAAI,MAAM;oBAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;;oBAC1C,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAA6B,EAAE,EAAE;YACjD,MAAM,OAAO,GAA4B,EAAE,CAAA;YAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;gBACvC,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YACtD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EACxF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CACnD,CAAA;YACD,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;AACjD,CAAC"}

package/dist/commands/org.d.ts

@@ -0,0 +1,4 @@
+/** `soku org list | use <id>` */
+import { Command } from 'commander';
+export declare function registerOrgCommands(program: Command): void;
+//# sourceMappingURL=org.d.ts.map

package/dist/commands/org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.d.ts","sourceRoot":"","sources":["../../src/commands/org.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAanC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+D1D"}

package/dist/commands/org.js

@@ -0,0 +1,49 @@
+/** `soku org list | use <id>` */
+import { loadConfig, updateConfig } from '../config.js';
+import { apiRequest } from '../http/client.js';
+import { cyan, dim, emitError, emitSuccess, ExitCode, green, table } from '../output/envelope.js';
+import { matchRef } from '../resolve.js';
+export function registerOrgCommands(program) {
+    const org = program.command('org').description('Manage the active organization');
+    org
+        .command('list')
+        .description('List organizations you belong to')
+        .action(async () => {
+        const data = await apiRequest('/api/cli/orgs');
+        const activeOrgId = loadConfig().activeOrgId;
+        emitSuccess(data, (d) => table(d.orgs.map((o) => ({
+            active: o.id === activeOrgId ? green('●') : ' ',
+            name: o.name,
+            slug: o.slug ?? '',
+            id: o.id,
+        })), [
+            { key: 'active', header: ' ' },
+            { key: 'name', header: 'NAME' },
+            { key: 'slug', header: 'SLUG' },
+            { key: 'id', header: 'ID' },
+        ]));
+    });
+    org
+        .command('use <org>')
+        .description('Set the active organization (accepts id, slug, or name)')
+        .action(async (ref) => {
+        const { orgs } = await apiRequest('/api/cli/orgs');
+        const res = matchRef(orgs, ref);
+        if (res.kind === 'none') {
+            emitError('not_found', `No organization matching "${ref}".`, ExitCode.NOT_FOUND, 'Run `soku org list` to see available orgs.');
+        }
+        if (res.kind === 'ambiguous') {
+            const candidates = res.matches.map((o) => `${o.slug ?? o.id} (${o.id})`).join(', ');
+            emitError('ambiguous', `"${ref}" matches ${res.matches.length} organizations.`, ExitCode.USAGE, `Use a slug or id: ${candidates}`);
+        }
+        const match = res.item;
+        // Switching org clears the brand — it may not belong to the new org.
+        const prev = loadConfig();
+        updateConfig({
+            activeOrgId: match.id,
+            activeBrandId: prev.activeOrgId === match.id ? prev.activeBrandId : undefined,
+        });
+        emitSuccess({ active_org_id: match.id, name: match.name, slug: match.slug }, (d) => `${green('✓')} Active org: ${cyan(d.name ?? d.active_org_id)} ${dim(`(${d.active_org_id})`)}\n  ${dim('Next: soku brand use <slug|id>')}`);
+    });
+}
+//# sourceMappingURL=org.js.map

package/dist/commands/org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.js","sourceRoot":"","sources":["../../src/commands/org.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAIjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAQxC,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAA;IAEhF,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAiC,eAAe,CAAC,CAAA;QAC9E,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC,WAAW,CAAA;QAC5C,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,KAAK,CACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjB,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;YAC/C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC,CAAC,EACH;YACE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;YAC9B,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/B,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/B,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;SAC5B,CACF,CACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEJ,GAAG;SACA,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAiC,eAAe,CAAC,CAAA;QAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACxB,SAAS,CACP,WAAW,EACX,6BAA6B,GAAG,IAAI,EACpC,QAAQ,CAAC,SAAS,EAClB,4CAA4C,CAC7C,CAAA;QACH,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnF,SAAS,CACP,WAAW,EACX,IAAI,GAAG,aAAa,GAAG,CAAC,OAAO,CAAC,MAAM,iBAAiB,EACvD,QAAQ,CAAC,KAAK,EACd,qBAAqB,UAAU,EAAE,CAClC,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAA;QACtB,qEAAqE;QACrE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAA;QACzB,YAAY,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,EAAE;YACrB,aAAa,EAAE,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;SAC9E,CAAC,CAAA;QACF,WAAW,CACT,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAC/D,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC,OAAO,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAC5I,CAAA;IACH,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/commands/resources.d.ts

@@ -0,0 +1,4 @@
+/** `soku resources list` — show the external resources granted to this session. */
+import { Command } from 'commander';
+export declare function registerResourceCommands(program: Command): void;
+//# sourceMappingURL=resources.d.ts.map

package/dist/commands/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/commands/resources.ts"],"names":[],"mappings":"AAAA,mFAAmF;AAEnF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAYnC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0B/D"}

package/dist/commands/resources.js

@@ -0,0 +1,22 @@
+/** `soku resources list` — show the external resources granted to this session. */
+import { Command } from 'commander';
+import { apiRequest } from '../http/client.js';
+import { emitSuccess, table } from '../output/envelope.js';
+export function registerResourceCommands(program) {
+    program
+        .command('resources')
+        .description('List external resources granted to this session')
+        .addCommand(new Command('list').action(async () => {
+        const data = await apiRequest('/api/cli/resources', { workspace: true });
+        emitSuccess(data, (d) => table(d.resources.map((r) => ({
+            id: r.id,
+            label: r.label ?? '',
+            description: r.description ?? '',
+        })), [
+            { key: 'id', header: 'RESOURCE' },
+            { key: 'label', header: 'LABEL' },
+            { key: 'description', header: 'DESCRIPTION' },
+        ]));
+    }));
+}
+//# sourceMappingURL=resources.js.map

package/dist/commands/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/commands/resources.ts"],"names":[],"mappings":"AAAA,mFAAmF;AAEnF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAS1D,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,UAAU,CACT,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,UAAU,CAC3B,oBAAoB,EACpB,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAA;QACD,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,KAAK,CACH,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;SACjC,CAAC,CAAC,EACH;YACE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE;YACjC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;YACjC,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE;SAC9C,CACF,CACF,CAAA;IACH,CAAC,CAAC,CACH,CAAA;AACL,CAAC"}

package/dist/commands/review.d.ts

@@ -0,0 +1,8 @@
+/** `soku review list | show <id> | approve <id> | deny <id>`
+ *
+ * HITL for review-gated write actions: a `soku call` of a write action returns
+ * a pending review id; the user approves it here, which executes the action.
+ */
+import { Command } from 'commander';
+export declare function registerReviewCommands(program: Command): void;
+//# sourceMappingURL=review.d.ts.map

package/dist/commands/review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../src/commands/review.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AA4BnC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqE7D"}

package/dist/commands/review.js

@@ -0,0 +1,74 @@
+/** `soku review list | show <id> | approve <id> | deny <id>`
+ *
+ * HITL for review-gated write actions: a `soku call` of a write action returns
+ * a pending review id; the user approves it here, which executes the action.
+ */
+import { apiRequest } from '../http/client.js';
+import { cyan, dim, emitSuccess, green, red, table } from '../output/envelope.js';
+function statusMark(status) {
+    if (status === 'approved')
+        return green('approved');
+    if (status === 'failed' || status === 'rejected')
+        return red(status);
+    return dim(status);
+}
+function truncate(text, max) {
+    const one = (text ?? '').replace(/\s+/g, ' ').trim();
+    return one.length > max ? `${one.slice(0, max - 1)}…` : one;
+}
+export function registerReviewCommands(program) {
+    const review = program
+        .command('review')
+        .description('Approve or inspect review-gated write actions');
+    review
+        .command('list')
+        .description('List your review-gated actions (pending and decided)')
+        .option('--status <status>', 'Filter: pending | executing | approved | failed | rejected')
+        .action(async (opts) => {
+        const q = opts.status ? `?status=${encodeURIComponent(opts.status)}` : '';
+        const data = await apiRequest(`/api/cli/reviews${q}`, {
+            workspace: true,
+        });
+        emitSuccess(data, (d) => table(d.reviews.map((r) => ({
+            id: r.id,
+            action: `${r.namespace}/${r.action}`,
+            status: statusMark(r.status),
+            summary: truncate(r.summary, 48),
+        })), [
+            { key: 'id', header: 'ID' },
+            { key: 'action', header: 'ACTION' },
+            { key: 'status', header: 'STATUS' },
+            { key: 'summary', header: 'SUMMARY' },
+        ]));
+    });
+    review
+        .command('show <id>')
+        .description('Show one review (full payload, executed payload, result)')
+        .action(async (id) => {
+        emitSuccess(await apiRequest(`/api/cli/reviews/${encodeURIComponent(id)}`, { workspace: true }));
+    });
+    review
+        .command('approve <id>')
+        .description('Approve a review — this executes the write action')
+        .action(async (id) => {
+        const r = await apiRequest(`/api/cli/reviews/${encodeURIComponent(id)}/respond`, {
+            method: 'POST',
+            body: { decision: 'approve' },
+            workspace: true,
+        });
+        emitSuccess(r, (d) => `${d.status === 'approved' ? green('✓') : red('✖')} ${statusMark(d.status)}: ${cyan(`${d.namespace}/${d.action}`)}`);
+    });
+    review
+        .command('deny <id>')
+        .description('Reject a review — the action is not executed')
+        .option('--feedback <text>', 'Reason for rejecting')
+        .action(async (id, opts) => {
+        const r = await apiRequest(`/api/cli/reviews/${encodeURIComponent(id)}/respond`, {
+            method: 'POST',
+            body: { decision: 'reject', feedback: opts.feedback },
+            workspace: true,
+        });
+        emitSuccess(r, (d) => `${red('✖')} rejected: ${cyan(`${d.namespace}/${d.action}`)}`);
+    });
+}
+//# sourceMappingURL=review.js.map

package/dist/commands/review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../src/commands/review.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAcjF,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAA;IACpE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+CAA+C,CAAC,CAAA;IAE/D,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,mBAAmB,EAAE,4DAA4D,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAuC,mBAAmB,CAAC,EAAE,EAAE;YAC1F,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QACF,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,KAAK,CACH,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;SACjC,CAAC,CAAC,EACH;YACE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;YAC3B,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;SACtC,CACF,CACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,WAAW,CACT,MAAM,UAAU,CAAC,oBAAoB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CACpF,CAAA;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,MAAM,CAAC,GAAG,MAAM,UAAU,CAAS,oBAAoB,kBAAkB,CAAC,EAAE,CAAC,UAAU,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE;YAC7B,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QACF,WAAW,CACT,CAAC,EACD,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CACtH,CAAA;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAA2B,EAAE,EAAE;QACxD,MAAM,CAAC,GAAG,MAAM,UAAU,CAAS,oBAAoB,kBAAkB,CAAC,EAAE,CAAC,UAAU,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrD,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QACF,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/commands/skill.d.ts

@@ -0,0 +1,19 @@
+/** `soku skill` — discover and install Soku skills into an AI client.
+ *
+ * - `soku skill list`                  browse the public skill catalog (CDN)
+ * - `soku skill install <slug...>`     download + install business skills
+ * - `soku skill install --all`         install the whole catalog
+ * - `soku skill install` (no slug)     install just the bundled `soku` meta-skill
+ * - `soku skill installed` / `remove`  manage what's installed locally
+ *
+ * Business skills are fetched as per-skill zips from a public CDN
+ * (`cdn.soku.ai/skills/`), already translated to CLI-native at pack time. We
+ * verify the sha256 from index.json, unzip safely, and drop each business skill
+ * into `<skillsDir>/soku/<slug>/` with a top-level symlink
+ * `<skillsDir>/soku-<slug> -> soku/<slug>`. The bundled `soku` meta-skill (how
+ * to drive the CLI) ships in the npm package and is installed as a prerequisite. */
+import { Command } from 'commander';
+/** A slug is safe to use as a path segment (no traversal/separators). Exported for tests. */
+export declare function isSafeSlug(slug: string): boolean;
+export declare function registerSkillCommand(program: Command): void;
+//# sourceMappingURL=skill.d.ts.map

package/dist/commands/skill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../src/commands/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;oFAaoF;AAQpF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiFnC,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAuKD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8H3D"}