@sonisoft/now-sdk-ext-cli 5.1.0 → 5.3.0

package/dist/commands/flow/definition.d.ts

@@ -0,0 +1,31 @@
+import { AuthenticatedCommand } from '../../common/authenticated-command.js';
+export declare class FlowDefinition extends AuthenticatedCommand<typeof FlowDefinition> {
+    static args: {};
+    static description: string;
+    static examples: {
+        description: string;
+        command: string;
+    }[];
+    static flags: {
+        'sys-id': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        type: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<"action" | "flow" | "subflow", import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        scope: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /**
+     * Fail with the reason core classified, plus the remediation that goes with it.
+     *
+     * Only the failure classification and the message core produced are logged —
+     * never the response body.
+     */
+    private _failDefinition;
+    /**
+     * Call the one core method that matches the requested type.
+     *
+     * Each type maps to exactly one design-time read. Nothing here executes,
+     * tests, publishes or creates a context.
+     */
+    private _retrieve;
+}
+//# sourceMappingURL=definition.d.ts.map

package/dist/commands/flow/definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.d.ts","sourceRoot":"","sources":["../../../src/commands/flow/definition.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAkD5E,qBAAa,cAAe,SAAQ,oBAAoB,CAAC,OAAO,cAAc,CAAC;IAE7E,MAAM,CAAC,IAAI,KAAK;IAChB,MAAM,CAAC,WAAW,SAa4C;IAC9D,MAAM,CAAC,QAAQ;;;QAqBd;IACD,MAAM,CAAC,KAAK;;;;;MAwBX;IAEK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B1B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAevB;;;;;OAKG;YACW,SAAS;CA6BxB"}

package/dist/commands/flow/definition.js

@@ -0,0 +1,166 @@
+/* eslint-disable perfectionist/sort-objects */
+import { Flags } from '@oclif/core';
+import { FlowManager } from '@sonisoft/now-sdk-ext-core';
+import { AuthenticatedCommand } from '../../common/authenticated-command.js';
+import { FlowDisplayService } from '../../services/flow-display.service.js';
+/**
+ * Remediation per machine-readable failure reason. Core classifies the failure;
+ * the CLI is the only layer that knows which flag would have avoided it.
+ */
+const REMEDIATION = {
+    api_error: [
+        'ServiceNow answered with an error. Re-run with --log-level debug to see the request detail.',
+        'If the artifact lives in a scoped application, pass --scope with its scope sys_id or name.',
+    ],
+    invalid_identifier: [
+        'Pass the 32-character sys_id of the artifact, not its name.',
+        'The sys_id is in the sys_id= parameter of the Workflow Studio URL, or in the record list.',
+    ],
+    malformed_response: [
+        'The instance returned a body this version does not recognise.',
+        'Check that Flow Designer is active on the instance and that the family version is supported.',
+    ],
+    not_found: [
+        'Confirm the sys_id exists on this instance — and that --auth points at the instance you meant.',
+        'A deleted or not-yet-deployed artifact reports the same way as a wrong sys_id.',
+    ],
+    permission_denied: [
+        'The authenticated user needs read access to Flow Designer design-time records.',
+        'Retry with an account holding the flow_designer (or admin) role.',
+    ],
+    request_failed: [
+        'The request did not complete. Check connectivity and the instance URL for this alias.',
+        'Run "nex auth doctor" to confirm the credential resolves.',
+    ],
+    type_mismatch: [
+        'The sys_id exists but is a different artifact type than the one requested.',
+        'Retry with the matching --type: flow, subflow, or action.',
+    ],
+};
+export class FlowDefinition extends AuthenticatedCommand {
+    static args = {};
+    static description = 'Retrieve the read-only design-time definition of a flow, subflow, or action.\n\n' +
+        'Returns what the artifact IS, not what a run of it did: triggers, actions, ' +
+        'nested subflows, flow logic, inputs and outputs as Workflow Studio stores ' +
+        'them. Nothing is executed, published or modified, and no flow context is ' +
+        'created or required.\n\n' +
+        'This is the design-time counterpart to `flow details`, which describes one ' +
+        'past execution and needs a context sys_id.\n\n' +
+        'The type is never inferred from the sys_id: --type selects the artifact ' +
+        'that is asked for, and a sys_id of a different type fails with a ' +
+        'type_mismatch rather than being relabelled.\n\n' +
+        'With --json, stdout carries exactly one JSON document — the complete typed ' +
+        'result including the untouched ServiceNow payload — so it can be piped or ' +
+        'redirected. Without it, a short summary is printed; definition bodies, ' +
+        'step scripts and input values are never printed or logged.';
+    static examples = [
+        {
+            description: 'Summarise a flow definition',
+            command: '<%= config.bin %> <%= command.id %> --sys-id 887dda5583237210fdb8f7b6feaad32c --auth dev',
+        },
+        {
+            description: 'Retrieve a subflow definition',
+            command: '<%= config.bin %> <%= command.id %> -i 887dda5583237210fdb8f7b6feaad32c --type subflow --auth dev',
+        },
+        {
+            description: 'Retrieve a custom action definition with its ordered steps',
+            command: '<%= config.bin %> <%= command.id %> -i 887dda5583237210fdb8f7b6feaad32c --type action --auth dev',
+        },
+        {
+            description: 'Redirect the full JSON definition to a file',
+            command: '<%= config.bin %> <%= command.id %> -i 887dda5583237210fdb8f7b6feaad32c --json --auth dev > flow.json',
+        },
+        {
+            description: 'Pipe the JSON definition into another tool',
+            command: '<%= config.bin %> <%= command.id %> -i 887dda5583237210fdb8f7b6feaad32c --type action --json --auth dev | jq .summary.steps',
+        },
+    ];
+    static flags = {
+        'sys-id': Flags.string({
+            char: 'i',
+            description: 'sys_id of the flow, subflow, or action to retrieve',
+            required: true,
+        }),
+        'type': Flags.option({
+            char: 't',
+            description: 'Artifact type to retrieve. Must match what the sys_id actually is.',
+            required: false,
+            default: 'flow',
+            options: ['flow', 'subflow', 'action'],
+        })(),
+        'scope': Flags.string({
+            description: 'Scope sys_id or name for the transaction scope parameter. ' +
+                "Optional — ServiceNow resolves the artifact's own scope when omitted.",
+            required: false,
+        }),
+        'json': Flags.boolean({
+            char: 'j',
+            description: 'Output the complete typed result as JSON',
+            required: false,
+            default: false,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(FlowDefinition);
+        const displayService = new FlowDisplayService();
+        const artifact = flags.type;
+        const sysId = flags['sys-id'];
+        // Progress goes through this.log, which oclif suppresses under --json — that
+        // is what keeps stdout to a single JSON document for piping.
+        this.log(`Retrieving ${artifact} definition: ${sysId}`);
+        const outcome = await this._retrieve(artifact, sysId, flags.scope);
+        if (!outcome.result.success) {
+            this._failDefinition(artifact, sysId, outcome.result);
+        }
+        const lines = outcome.artifact === 'action'
+            ? displayService.formatActionDefinitionResult(outcome.result, flags.json)
+            : displayService.formatArtifactDefinitionResult(outcome.result, flags.json);
+        for (const line of lines) {
+            flags.json ? console.log(line) : this.log(line);
+        }
+    }
+    /**
+     * Fail with the reason core classified, plus the remediation that goes with it.
+     *
+     * Only the failure classification and the message core produced are logged —
+     * never the response body.
+     */
+    _failDefinition(artifact, sysId, result) {
+        const reason = result.failureReason ?? 'request_failed';
+        const detail = result.errorMessage ?? `ServiceNow did not return a ${artifact} definition.`;
+        this._logger.error('Design-time definition retrieval failed.', { artifact, failureReason: reason, sysId });
+        this.error(`Could not retrieve the ${artifact} definition for ${sysId} [${reason}]: ${detail}`, {
+            suggestions: REMEDIATION[reason] ?? REMEDIATION.request_failed,
+        });
+    }
+    /**
+     * Call the one core method that matches the requested type.
+     *
+     * Each type maps to exactly one design-time read. Nothing here executes,
+     * tests, publishes or creates a context.
+     */
+    async _retrieve(artifact, sysId, scope) {
+        // No scope in the constructor: the design-time routes take the transaction
+        // scope as a request option, not through a background script.
+        const flowManager = new FlowManager(this.instance);
+        const options = scope ? { scope } : undefined;
+        try {
+            switch (artifact) {
+                case 'action': {
+                    return { artifact, result: await flowManager.getActionDefinition(sysId, options) };
+                }
+                case 'subflow': {
+                    return { artifact, result: await flowManager.getSubflowDefinition(sysId, options) };
+                }
+                default: {
+                    return { artifact, result: await flowManager.getFlowDesignDefinition(sysId, options) };
+                }
+            }
+        }
+        catch (error) {
+            this._logger.error('Error retrieving flow design-time definition.', error);
+            return this.error(error);
+        }
+    }
+}
+//# sourceMappingURL=definition.js.map

package/dist/commands/flow/definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.js","sourceRoot":"","sources":["../../../src/commands/flow/definition.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACnC,OAAO,EAA+E,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAErI,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAc3E;;;GAGG;AACH,MAAM,WAAW,GAA6B;IAC5C,SAAS,EAAE;QACT,6FAA6F;QAC7F,4FAA4F;KAC7F;IACD,kBAAkB,EAAE;QAClB,6DAA6D;QAC7D,2FAA2F;KAC5F;IACD,kBAAkB,EAAE;QAClB,+DAA+D;QAC/D,8FAA8F;KAC/F;IACD,SAAS,EAAE;QACT,gGAAgG;QAChG,gFAAgF;KACjF;IACD,iBAAiB,EAAE;QACjB,gFAAgF;QAChF,kEAAkE;KACnE;IACD,cAAc,EAAE;QACd,uFAAuF;QACvF,2DAA2D;KAC5D;IACD,aAAa,EAAE;QACb,4EAA4E;QAC5E,2DAA2D;KAC5D;CACF,CAAA;AAED,MAAM,OAAO,cAAe,SAAQ,oBAA2C;IAE7E,MAAM,CAAC,IAAI,GAAG,EAAE,CAAA;IAChB,MAAM,CAAC,WAAW,GAAG,kFAAkF;QACrG,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,0BAA0B;QAC1B,6EAA6E;QAC7E,gDAAgD;QAChD,0EAA0E;QAC1E,mEAAmE;QACnE,iDAAiD;QACjD,6EAA6E;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,4DAA4D,CAAA;IAC9D,MAAM,CAAC,QAAQ,GAAG;QAChB;YACE,WAAW,EAAE,6BAA6B;YAC1C,OAAO,EAAE,0FAA0F;SACpG;QACD;YACE,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,mGAAmG;SAC7G;QACD;YACE,WAAW,EAAE,4DAA4D;YACzE,OAAO,EAAE,kGAAkG;SAC5G;QACD;YACE,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE,uGAAuG;SACjH;QACD;YACE,WAAW,EAAE,4CAA4C;YACzD,OAAO,EAAE,6HAA6H;SACvI;KACF,CAAA;IACD,MAAM,CAAC,KAAK,GAAG;QACb,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,oEAAoE;YACjF,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,MAAe;YACxB,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU;SAChD,CAAC,EAAE;QACJ,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;YACpB,WAAW,EAAE,4DAA4D;gBACvE,uEAAuE;YACzE,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;YACpB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,0CAA0C;YACvD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;SACf,CAAC;KACH,CAAA;IAED,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAA0B,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE9B,6EAA6E;QAC7E,6DAA6D;QAC7D,IAAI,CAAC,GAAG,CAAC,cAAc,QAAQ,gBAAgB,KAAK,EAAE,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAEnE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ;YACzC,CAAC,CAAC,cAAc,CAAC,4BAA4B,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;YACzE,CAAC,CAAC,cAAc,CAAC,8BAA8B,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,eAAe,CACrB,QAA4B,EAC5B,KAAa,EACb,MAA6D;QAE7D,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,gBAAgB,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,IAAI,+BAA+B,QAAQ,cAAc,CAAC;QAE5F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3G,IAAI,CAAC,KAAK,CAAC,0BAA0B,QAAQ,mBAAmB,KAAK,KAAK,MAAM,MAAM,MAAM,EAAE,EAAE;YAC9F,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,cAAc;SAC/D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS,CACrB,QAA4B,EAC5B,KAAa,EACb,KAAc;QAEd,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,OAAO,GAAsC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjF,IAAI,CAAC;YACH,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrF,CAAC;gBAED,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtF,CAAC;gBAED,OAAO,CAAC,CAAC,CAAC;oBACR,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACzF,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAc,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC,KAAK,CAAC,KAAc,CAAC,CAAC;QACpC,CAAC;IACH,CAAC"}

package/dist/commands/policy/status.d.ts

@@ -0,0 +1,27 @@
+import { Command } from '@oclif/core';
+/**
+ * Reports what this invocation is permitted to do, and which layer decided.
+ *
+ * Exists because precedence bugs are otherwise invisible: a user sees "refused" with no
+ * way to tell whether the environment denied it, a flag denied it, or nothing granted
+ * it — and the fix is completely different in each case.
+ *
+ * Extends plain `Command`, not `AuthenticatedCommand`: answering "what may I do" must
+ * not require working credentials. Someone diagnosing a refusal should not have to get
+ * past auth first.
+ */
+export default class PolicyStatus extends Command {
+    static description: string;
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    static flags: {
+        'deny-execute': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'deny-write': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'read-only': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+    };
+    run(): Promise<{
+        permitted: Record<string, unknown>;
+        source: string;
+    }>;
+}
+//# sourceMappingURL=status.d.ts.map

package/dist/commands/policy/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/commands/policy/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAQ,MAAM,aAAa,CAAA;AAK1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,OAAO;IAC/C,MAAM,CAAC,WAAW,SAIG;IACvB,MAAM,CAAC,cAAc,UAAO;IAC5B,MAAM,CAAC,QAAQ,WAIZ;IACH,MAAM,CAAC,KAAK;;;;MAIT;IAEY,GAAG,IAAI,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAC,CAAC;CA2ClF"}

package/dist/commands/policy/status.js

@@ -0,0 +1,67 @@
+import { Command, Flags } from '@oclif/core';
+import { checkRequirement, currentLayers, DENY_ENV } from '@sonisoft/now-sdk-ext-core';
+import { installCliPolicy } from '../../common/policy.js';
+/**
+ * Reports what this invocation is permitted to do, and which layer decided.
+ *
+ * Exists because precedence bugs are otherwise invisible: a user sees "refused" with no
+ * way to tell whether the environment denied it, a flag denied it, or nothing granted
+ * it — and the fix is completely different in each case.
+ *
+ * Extends plain `Command`, not `AuthenticatedCommand`: answering "what may I do" must
+ * not require working credentials. Someone diagnosing a refusal should not have to get
+ * past auth first.
+ */
+export default class PolicyStatus extends Command {
+    static description = 'Show what this invocation is permitted to change on the instance, and why.\n\n' +
+        'Changes are permitted by default. NEX_POLICY_DENY, set in the environment, ' +
+        'outranks every command-line flag — that is the only layer an agent driving this ' +
+        'CLI cannot reach.';
+    static enableJsonFlag = true;
+    static examples = [
+        '<%= config.bin %> <%= command.id %>',
+        '<%= config.bin %> <%= command.id %> --read-only',
+        'NEX_POLICY_DENY=all <%= config.bin %> <%= command.id %>',
+    ];
+    static flags = {
+        'deny-execute': Flags.boolean({ description: 'Evaluate as if --deny-execute were passed.' }),
+        'deny-write': Flags.boolean({ description: 'Evaluate as if --deny-write were passed.' }),
+        'read-only': Flags.boolean({ description: 'Evaluate as if --read-only were passed.' }),
+    };
+    async run() {
+        const { flags } = await this.parse(PolicyStatus);
+        const warnings = [];
+        installCliPolicy(flags, (m) => warnings.push(m));
+        const verbs = ['write', 'execute'];
+        const permitted = {};
+        for (const verb of verbs) {
+            const decision = checkRequirement({ target: 'instance', verbs: [verb] });
+            permitted[verb] = { allowed: decision.allowed, decidedBy: decision.decidingLayer };
+        }
+        const envSet = Boolean(process.env[DENY_ENV]);
+        const result = { permitted, source: envSet ? `${DENY_ENV} is set` : 'no environment lockdown' };
+        if (!this.jsonEnabled()) {
+            this.log('Instance changes');
+            for (const verb of verbs) {
+                const entry = permitted[verb];
+                const mark = entry.allowed ? 'permitted' : 'REFUSED  ';
+                this.log(`  ${verb.padEnd(8)} ${mark}  (${entry.decidedBy})`);
+            }
+            this.log('');
+            this.log('Reads are never gated.');
+            this.log(envSet
+                ? `${DENY_ENV} is set in the environment and outranks every flag.`
+                : `${DENY_ENV} is not set. Set it in your shell profile or container ` +
+                    `environment to deny changes in a way a command-line flag cannot undo.`);
+            // Ordered, because the order IS the behaviour.
+            this.log('');
+            this.log('Layers, highest priority first:');
+            for (const layer of currentLayers())
+                this.log(`  ${layer.name}`);
+            for (const warning of warnings)
+                this.warn(warning);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/commands/policy/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/commands/policy/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAE,KAAK,EAAC,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAC,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAY,MAAM,4BAA4B,CAAA;AAE/F,OAAO,EAAC,gBAAgB,EAAmB,MAAM,wBAAwB,CAAA;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,OAAO;IAC/C,MAAM,CAAC,WAAW,GAChB,gFAAgF;QAChF,6EAA6E;QAC7E,kFAAkF;QAClF,mBAAmB,CAAA;IACvB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IAC5B,MAAM,CAAC,QAAQ,GAAG;QACd,qCAAqC;QACrC,iDAAiD;QACjD,yDAAyD;KAC1D,CAAA;IACH,MAAM,CAAC,KAAK,GAAG;QACX,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAC,WAAW,EAAE,4CAA4C,EAAC,CAAC;QAC1F,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,EAAC,WAAW,EAAE,0CAA0C,EAAC,CAAC;QACtF,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,EAAC,WAAW,EAAE,yCAAyC,EAAC,CAAC;KACrF,CAAA;IAEM,KAAK,CAAC,GAAG;QACd,MAAM,EAAC,KAAK,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAE9C,MAAM,QAAQ,GAAa,EAAE,CAAA;QAC7B,gBAAgB,CAAC,KAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAE/D,MAAM,KAAK,GAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC1C,MAAM,SAAS,GAA4B,EAAE,CAAA;QAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAC,CAAC,CAAA;YACtE,SAAS,CAAC,IAAI,CAAC,GAAG,EAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAC,CAAA;QAClF,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,EAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,SAAS,CAAC,CAAC,CAAC,yBAAyB,EAAC,CAAA;QAE7F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAA0C,CAAA;gBACtE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAA;gBACtD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,KAAK,CAAC,SAAS,GAAG,CAAC,CAAA;YAC/D,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YAClC,IAAI,CAAC,GAAG,CACN,MAAM;gBACJ,CAAC,CAAC,GAAG,QAAQ,qDAAqD;gBAClE,CAAC,CAAC,GAAG,QAAQ,yDAAyD;oBACpE,uEAAuE,CAC5E,CAAA;YAED,+CAA+C;YAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACZ,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAA;YAC3C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;YAEhE,KAAK,MAAM,OAAO,IAAI,QAAQ;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpD,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC"}

package/dist/common/authenticated-command.d.ts

@@ -6,9 +6,12 @@ export declare abstract class AuthenticatedCommand<T extends typeof Command> ext
     static baseFlags: {
         auth: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
         'cred-store': Interfaces.BooleanFlag<boolean>;
+        'deny-execute': Interfaces.BooleanFlag<boolean>;
+        'deny-write': Interfaces.BooleanFlag<boolean>;
         'log-dir': Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
         'log-file': Interfaces.BooleanFlag<boolean>;
         'log-level': Interfaces.OptionFlag<"info" | "debug" | "warn" | "error" | "trace", Interfaces.CustomOptions>;
+        'read-only': Interfaces.BooleanFlag<boolean>;
     };
     static enableJsonFlag: boolean;
     protected _logger: Logger;

package/dist/common/authenticated-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-command.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,aAAa,CAAA;AAExD,OAAO,EAA+B,MAAM,EAAE,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAMjI,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAA;AAC7H,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE/E,8BAAsB,oBAAoB,CAAC,CAAC,SAAS,OAAO,OAAO,CAAE,SAAQ,OAAO;IAElF,MAAM,CAAC,SAAS;;;;;;MAkCf;IAEC,MAAM,CAAC,cAAc,UAAO;IAChC,SAAS,CAAC,OAAO,EAAG,MAAM,CAAC;IACvB,SAAS,CAAC,IAAI,EAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,KAAK,EAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAEnC,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED,IAAW,MAAM,CAAC,MAAM,EAAE,MAAM,EAE/B;cAEa,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cAgBrD,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAwElC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ;CA0BjB"}
+{"version":3,"file":"authenticated-command.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAS,UAAU,EAAE,MAAM,aAAa,CAAA;AAExD,OAAO,EAAgD,MAAM,EAAE,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAOlJ,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,OAAO,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAA;AAC7H,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,OAAO,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE/E,8BAAsB,oBAAoB,CAAC,CAAC,SAAS,OAAO,OAAO,CAAE,SAAQ,OAAO;IAElF,MAAM,CAAC,SAAS;;;;;;;;;MA4Df;IAEC,MAAM,CAAC,cAAc,UAAO;IAChC,SAAS,CAAC,OAAO,EAAG,MAAM,CAAC;IACvB,SAAS,CAAC,IAAI,EAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,KAAK,EAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAEnC,IAAW,MAAM,IAAI,MAAM,CAE1B;IAED,IAAW,MAAM,CAAC,MAAM,EAAE,MAAM,EAE/B;cAEa,KAAK,CAAC,GAAG,EAAE,KAAK,GAAG;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,GAAG,CAAC;cA8BrD,OAAO,CAAC,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiFlC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ;CA0BjB"}

package/dist/common/authenticated-command.js

@@ -1,7 +1,8 @@
 import { Command, Flags } from '@oclif/core';
 import { getCredentials } from "@servicenow/sdk-cli/dist/auth/index.js";
-import { configureLogging, flushLogs, ServiceNowInstance } from '@sonisoft/now-sdk-ext-core';
+import { configureLogging, flushLogs, isPolicyRefusal, ServiceNowInstance } from '@sonisoft/now-sdk-ext-core';
 import { LogFactory } from '../util/log-factory.js';
+import { installCliPolicy } from './policy.js';
 export class AuthenticatedCommand extends Command {
     //   // define flags that can be inherited by any command that extends BaseCommand
     static baseFlags = {
@@ -16,6 +17,26 @@ export class AuthenticatedCommand extends Command {
             helpGroup: 'GLOBAL',
             required: false,
         }),
+        // Changes are PERMITTED by default; these take permission away.
+        //
+        // Deliberately deny-direction rather than `--allow-write`. With a permissive
+        // default an allow-flag would grant nothing it did not already have, and it could
+        // not override NEX_POLICY_DENY either, so it would ship as a no-op. If the default
+        // ever flips to deny, the allow flags arrive in that same change.
+        //
+        // These are agent-reachable, which is fine: an agent can only ever RESTRICT itself
+        // with them. The layer an agent cannot reach is NEX_POLICY_DENY, which outranks
+        // every flag — that is what makes pointing nex at production meaningful.
+        'deny-execute': Flags.boolean({
+            description: 'Refuse background scripts, flow runs and ATF runs for this invocation.',
+            helpGroup: 'GLOBAL',
+            required: false,
+        }),
+        'deny-write': Flags.boolean({
+            description: 'Refuse any change to instance data for this invocation.',
+            helpGroup: 'GLOBAL',
+            required: false,
+        }),
         'log-dir': Flags.string({
             description: 'Directory to write log files to. Implies --log-file.',
             helpGroup: 'GLOBAL',
@@ -37,6 +58,12 @@ export class AuthenticatedCommand extends Command {
             options: ['debug', 'warn', 'error', 'info', 'trace'],
             summary: 'Specify level for logging.',
         })(),
+        'read-only': Flags.boolean({
+            description: 'Refuse every change to the instance — equivalent to ' +
+                '--deny-write --deny-execute. Reads are unaffected.',
+            helpGroup: 'GLOBAL',
+            required: false,
+        }),
     };
     // add the --json flag
     static enableJsonFlag = true;
@@ -52,6 +79,19 @@ export class AuthenticatedCommand extends Command {
         this._logger = logger;
     }
     async catch(err) {
+        // A refusal is a decision, not a crash. Render it as the CLI's own error with
+        // remediation, rather than letting a stack trace reach the user for something they
+        // asked for by passing a flag. Handled first, before the generic path below.
+        if (isPolicyRefusal(err)) {
+            this.authLogger?.warn("Refused by policy.", { message: err.message });
+            await flushLogs();
+            this.error(err.message, {
+                suggestions: [
+                    'Reads are unaffected — only changes to the instance were refused.',
+                    'Run `nex policy status` to see what is permitted and which layer decided.',
+                ],
+            });
+        }
         // authLogger is assigned partway through init(), so anything that throws
         // before that point — a missing required flag, for instance — arrived here
         // with it still undefined and produced "Cannot read properties of undefined
@@ -102,6 +142,14 @@ export class AuthenticatedCommand extends Command {
         });
         this.logger = LogFactory.createLogger(this.ctor.name);
         this.authLogger = LogFactory.createLogger("AuthenticatedCommand");
+        // Install the permission ladder before anything can issue a request. Core's gate
+        // is inert until this runs, so ordering matters: after logging (so a malformed
+        // NEX_POLICY_DENY has somewhere to warn) and before the first credential fetch.
+        //
+        // Note there is no per-command classification. The gate sits at the HTTP layer and
+        // decides per REQUEST, so `update-set current` reading or writing depending on
+        // --set, and `script-sync sync` going both ways, need no special handling here.
+        installCliPolicy(this.flags, (message) => this.authLogger.warn(message));
         // const wrapper:CredentialWrapper = new CredentialWrapper();
         // const credential:Creds = await (flags.auth ? wrapper.getStoredCredentialsByAlias(flags.auth) : wrapper.getStoredCredentialsByAlias( 'fluent-default'));
         // const credentialArgs = {"_": "get-credentials", auth: flags.auth || "fluent-default"};

package/dist/common/authenticated-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-command.js","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAU,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAEjI,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOpD,MAAM,OAAgB,oBAA+C,SAAQ,OAAO;IACpF,kFAAkF;IAChF,MAAM,CAAC,SAAS,GAAG;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC;QACrF,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,6BAA6B;QAC7B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;YAC1B,WAAW,EAAE,0EAA0E;gBACrF,gGAAgG;YAClG,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,sDAAsD;YACnE,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,oEAAoE;QACpE,+EAA+E;QAC/E,wDAAwD;QACxD,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;YACxB,WAAW,EAAE,qEAAqE;gBAChF,4EAA4E;gBAC5E,qCAAqC;YACvC,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU;YAC7D,OAAO,EAAE,4BAA4B;SAEtC,CAAC,EAAE;KACL,CAAA;IACH,sBAAsB;IAClB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IACtB,OAAO,CAAU;IACb,IAAI,CAAW;IACf,UAAU,CAAS;IACnB,KAAK,CAAY;IACrB,QAAQ,CAAqB;IAEnC,IAAW,MAAM;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,IAAW,MAAM,CAAC,MAAc;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAgC;QACpD,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAEnE,6EAA6E;QAC7E,+EAA+E;QAC/E,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,SAAS,EAAE,CAAA;QAEjB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,CAAoB;QAC1C,+EAA+E;QAC/E,wEAAwE;QACxE,MAAM,SAAS,EAAE,CAAA;QACjB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACzB,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,SAAS,EAAG,KAAK,CAAC,IAAoC,CAAC,SAAS;YAChE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YACxC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;SACzB,CAAC,CAAA;QAEF,IAAI,CAAC,KAAK,GAAG,KAAiB,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAe,CAAA;QAE3B,6EAA6E;QAC7E,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAwB,IAAI,MAAM,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAuB,CAAC;QAE3D,iFAAiF;QACjF,mFAAmF;QACnF,0DAA0D;QAC1D,gBAAgB,CAAC;YACf,gFAAgF;YAChF,0DAA0D;YAC1D,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;YACxD,KAAK,EAAE,QAAQ;YACf,2EAA2E;YAC3E,6EAA6E;YAC7E,wDAAwD;YACxD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAC,YAAY,EAAE,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAClE,6DAA6D;QAC7D,0JAA0J;QAC1J,yFAAyF;QAEzF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAE7C,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,kDAAkD;YAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,EAAC,CAAC,CAAC;QAE1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,sEAAsE;YACtE,wEAAwE;YACxE,kBAAkB;YAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,UAAU,GAA+B;YAC7C,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,UAAU;SACX,CAAA;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;IACnF,CAAC;IAED;;;;;;;OAOG;IACK,QAAQ,CAAC,KAAa,EAAE,KAAe;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC;QAChE,MAAM,WAAW,GAAG;YAClB,gDAAgD;YAChD,oDAAoD;SACrD,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,yEAAyE;YACzE,4EAA4E;YAC5E,4EAA4E;YAC5E,0CAA0C;YAC1C,WAAW,CAAC,OAAO,CACjB,uFAAuF;gBACvF,0FAA0F;gBAC1F,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,WAAW,GAAI,KAA4C,EAAE,WAAW,CAAC;QAC/E,IAAI,WAAW;YAAE,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,KAAK,IAAI,CAAC;QACrG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC,WAAW,EAAC,CAAC,CAAC;IACpC,CAAC"}
+{"version":3,"file":"authenticated-command.js","sourceRoot":"","sources":["../../src/common/authenticated-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAc,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAU,kBAAkB,EAA8B,MAAM,4BAA4B,CAAC;AAElJ,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAoB,MAAM,aAAa,CAAC;AAOjE,MAAM,OAAgB,oBAA+C,SAAQ,OAAO;IACpF,kFAAkF;IAChF,MAAM,CAAC,SAAS,GAAG;QACjB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAC,CAAC;QACrF,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,6BAA6B;QAC7B,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;YAC1B,WAAW,EAAE,0EAA0E;gBACrF,gGAAgG;YAClG,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,gEAAgE;QAChE,EAAE;QACF,6EAA6E;QAC7E,kFAAkF;QAClF,mFAAmF;QACnF,kEAAkE;QAClE,EAAE;QACF,mFAAmF;QACnF,gFAAgF;QAChF,yEAAyE;QACzE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC;YAC5B,WAAW,EAAE,wEAAwE;YACrF,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;YAC1B,WAAW,EAAE,yDAAyD;YACtE,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,sDAAsD;YACnE,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,oEAAoE;QACpE,+EAA+E;QAC/E,wDAAwD;QACxD,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;YACxB,WAAW,EAAE,qEAAqE;gBAChF,4EAA4E;gBAC5E,qCAAqC;YACvC,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU;YAC7D,OAAO,EAAE,4BAA4B;SAEtC,CAAC,EAAE;QACJ,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;YACzB,WAAW,EAAE,sDAAsD;gBACjE,oDAAoD;YACtD,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;SAChB,CAAC;KACH,CAAA;IACH,sBAAsB;IAClB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAA;IACtB,OAAO,CAAU;IACb,IAAI,CAAW;IACf,UAAU,CAAS;IACnB,KAAK,CAAY;IACrB,QAAQ,CAAqB;IAEnC,IAAW,MAAM;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,IAAW,MAAM,CAAC,MAAc;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAgC;QACpD,8EAA8E;QAC9E,mFAAmF;QACnF,6EAA6E;QAC7E,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,EAAE,EAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAC,CAAC,CAAC;YACpE,MAAM,SAAS,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;gBACtB,WAAW,EAAE;oBACX,mEAAmE;oBACnE,2EAA2E;iBAC5E;aACF,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAEnE,6EAA6E;QAC7E,+EAA+E;QAC/E,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,SAAS,EAAE,CAAA;QAEjB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAES,KAAK,CAAC,OAAO,CAAC,CAAoB;QAC1C,+EAA+E;QAC/E,wEAAwE;QACxE,MAAM,SAAS,EAAE,CAAA;QACjB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACzB,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,SAAS,EAAG,KAAK,CAAC,IAAoC,CAAC,SAAS;YAChE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YACxC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;SACzB,CAAC,CAAA;QAEF,IAAI,CAAC,KAAK,GAAG,KAAiB,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAe,CAAA;QAE3B,6EAA6E;QAC7E,uEAAuE;QACvE,uDAAuD;QACvD,MAAM,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAwB,IAAI,MAAM,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAuB,CAAC;QAE3D,iFAAiF;QACjF,mFAAmF;QACnF,0DAA0D;QAC1D,gBAAgB,CAAC;YACf,gFAAgF;YAChF,0DAA0D;YAC1D,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;YACxD,KAAK,EAAE,QAAQ;YACf,2EAA2E;YAC3E,6EAA6E;YAC7E,wDAAwD;YACxD,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAC,YAAY,EAAE,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAElE,iFAAiF;QACjF,+EAA+E;QAC/E,gFAAgF;QAChF,EAAE;QACF,mFAAmF;QACnF,+EAA+E;QAC/E,gFAAgF;QAChF,gBAAgB,CAAC,IAAI,CAAC,KAAoB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACxF,6DAA6D;QAC7D,0JAA0J;QAC1J,yFAAyF;QAEzF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAE7C,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,kDAAkD;YAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,8DAA8D;QAC9D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,EAAC,CAAC,CAAC;QAE1F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,sEAAsE;YACtE,wEAAwE;YACxE,kBAAkB;YAClB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,UAAU,GAA+B;YAC7C,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,UAAU;SACX,CAAA;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACK,eAAe;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAA;IACnF,CAAC;IAED;;;;;;;OAOG;IACK,QAAQ,CAAC,KAAa,EAAE,KAAe;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC;QAChE,MAAM,WAAW,GAAG;YAClB,gDAAgD;YAChD,oDAAoD;SACrD,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,yEAAyE;YACzE,4EAA4E;YAC5E,4EAA4E;YAC5E,0CAA0C;YAC1C,WAAW,CAAC,OAAO,CACjB,uFAAuF;gBACvF,0FAA0F;gBAC1F,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,WAAW,GAAI,KAA4C,EAAE,WAAW,CAAC;QAC/E,IAAI,WAAW;YAAE,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,KAAK,IAAI,CAAC;QACrG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAC,WAAW,EAAC,CAAC,CAAC;IACpC,CAAC"}

package/dist/common/policy.d.ts

@@ -0,0 +1,32 @@
+import { type PolicyLayer, Verb } from '@sonisoft/now-sdk-ext-core';
+/**
+ * Builds and installs the permission ladder for one `nex` invocation.
+ *
+ * Changes are PERMITTED by default. This is not the strongest posture available — an
+ * agent that decides to run `nex bulk delete` still just does it — but it is the one
+ * that does not break every existing script and CI job, and the machinery is arranged
+ * so flipping is a one-line change (see DEFAULT_ALLOW below).
+ *
+ * What it does buy today: `NEX_POLICY_DENY`, set somewhere the agent cannot write,
+ * outranks every flag. That is the difference between "the agent probably will not
+ * write to prod" and "the agent cannot".
+ */
+export interface PolicyFlags {
+    'deny-execute'?: boolean;
+    'deny-write'?: boolean;
+    'read-only'?: boolean;
+}
+/** The verbs a set of flags takes away. */
+export declare function deniedByFlags(flags: PolicyFlags): Verb[];
+/**
+ * Assembles the ladder, highest priority first.
+ *
+ * Order is the whole design. `NEX_POLICY_DENY` sits above the flags so a flag cannot
+ * grant past it; the permissive default sits at the bottom so anything above it can
+ * take permission away.
+ */
+export declare function buildLayers(flags: PolicyFlags, warn: (message: string) => void): PolicyLayer[];
+/** Installs the policy for this process. Call once, from init(), before any request. */
+export declare function installCliPolicy(flags: PolicyFlags, warn: (message: string) => void): void;
+export { ALLOW_ENV, DENY_ENV } from '@sonisoft/now-sdk-ext-core';
+//# sourceMappingURL=policy.d.ts.map

package/dist/common/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/common/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,WAAW,EAEhB,IAAI,EACL,MAAM,4BAA4B,CAAA;AAEnC;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,WAAW;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,EAAE,CAUxD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,WAAW,EAAE,CAuB9F;AAwBD,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAG1F;AAID,OAAO,EAAC,SAAS,EAAE,QAAQ,EAAC,MAAM,4BAA4B,CAAA"}

package/dist/common/policy.js

@@ -0,0 +1,68 @@
+import { allowFromEnvironment, DENY_ENV, denyFromEnvironment, denyLayer, grantLayer, installPolicy, setRemediationWriter, } from '@sonisoft/now-sdk-ext-core';
+/** The verbs a set of flags takes away. */
+export function deniedByFlags(flags) {
+    const denied = new Set();
+    if (flags['read-only']) {
+        denied.add('write');
+        denied.add('execute');
+    }
+    if (flags['deny-write'])
+        denied.add('write');
+    if (flags['deny-execute'])
+        denied.add('execute');
+    return [...denied];
+}
+/**
+ * Assembles the ladder, highest priority first.
+ *
+ * Order is the whole design. `NEX_POLICY_DENY` sits above the flags so a flag cannot
+ * grant past it; the permissive default sits at the bottom so anything above it can
+ * take permission away.
+ */
+export function buildLayers(flags, warn) {
+    const layers = [];
+    // 0. Operator lockdown. The only rung an agent cannot reach — and only when set
+    //    somewhere it cannot write. A project-local .mcp.json or a committed .env is
+    //    still editable by anything with file access; a shell profile is not.
+    const envDeny = denyFromEnvironment(process.env, warn);
+    if (envDeny)
+        layers.push(envDeny);
+    // 1. Per-invocation denials. Agent-reachable, but they only ever restrict.
+    const flagDenied = deniedByFlags(flags);
+    if (flagDenied.length > 0)
+        layers.push(denyLayer('command-line flag', flagDenied));
+    // 2. Grants from the environment. Inert while the default is permissive; kept in
+    //    place so the ladder does not have to be rebuilt when the default flips.
+    const envAllow = allowFromEnvironment(process.env, warn);
+    if (envAllow)
+        layers.push(envAllow);
+    // 3. THE DEFAULT. Delete this one layer to make `nex` deny-by-default; everything
+    //    above keeps working unchanged.
+    layers.push(grantLayer('default (changes permitted)', ['write', 'execute']));
+    return layers;
+}
+/**
+ * Explains a refusal in terms of what the user can actually do about it.
+ *
+ * Names the deciding layer, because "refused" without "by what" is unactionable — and
+ * the fix differs completely: unset an environment variable, or drop a flag.
+ */
+function remediation(verbs, missing, layer) {
+    const what = missing === 'execute' ? 'running scripts or flows' : 'changing instance data';
+    if (layer.startsWith(DENY_ENV)) {
+        return `Refused: ${what} is denied by ${DENY_ENV}. ` +
+            `This is set in the environment, not on the command line — unset it there to allow this.`;
+    }
+    if (layer === 'command-line flag') {
+        return `Refused: ${what} is denied by a flag on this command. ` +
+            `Remove --read-only / --deny-${missing} to allow it.`;
+    }
+    return `Refused: ${what} is not permitted (${layer}).`;
+}
+/** Installs the policy for this process. Call once, from init(), before any request. */
+export function installCliPolicy(flags, warn) {
+    installPolicy(buildLayers(flags, warn));
+    setRemediationWriter(remediation);
+}
+export { ALLOW_ENV, DENY_ENV } from '@sonisoft/now-sdk-ext-core';
+//# sourceMappingURL=policy.js.map

package/dist/common/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/common/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EACpB,QAAQ,EACR,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,aAAa,EAEb,oBAAoB,GAErB,MAAM,4BAA4B,CAAA;AAqBnC,2CAA2C;AAC3C,MAAM,UAAU,aAAa,CAAC,KAAkB;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAQ,CAAA;IAC9B,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACnB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACvB,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,KAAK,CAAC,cAAc,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAChD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAkB,EAAE,IAA+B;IAC7E,MAAM,MAAM,GAAkB,EAAE,CAAA;IAEhC,gFAAgF;IAChF,iFAAiF;IACjF,0EAA0E;IAC1E,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtD,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEjC,2EAA2E;IAC3E,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAA;IAElF,iFAAiF;IACjF,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAEnC,kFAAkF;IAClF,oCAAoC;IACpC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,6BAA6B,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IAE5E,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAsB,EAAE,OAAa,EAAE,KAAa;IACvE,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,wBAAwB,CAAA;IAE1F,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,YAAY,IAAI,iBAAiB,QAAQ,IAAI;YAClD,yFAAyF,CAAA;IAC7F,CAAC;IAED,IAAI,KAAK,KAAK,mBAAmB,EAAE,CAAC;QAClC,OAAO,YAAY,IAAI,wCAAwC;YAC7D,+BAA+B,OAAO,eAAe,CAAA;IACzD,CAAC;IAED,OAAO,YAAY,IAAI,sBAAsB,KAAK,IAAI,CAAA;AACxD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,KAAkB,EAAE,IAA+B;IAClF,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACvC,oBAAoB,CAAC,WAAW,CAAC,CAAA;AACnC,CAAC;AAID,OAAO,EAAC,SAAS,EAAE,QAAQ,EAAC,MAAM,4BAA4B,CAAA"}

package/dist/services/flow-display.service.d.ts

@@ -1,4 +1,4 @@
-import type { FlowContextDetailsResult, FlowLogResult } from '@sonisoft/now-sdk-ext-core';
+import type { ActionDefinitionResult, FlowArtifactDefinitionResult, FlowContextDetailsResult, FlowLogResult } from '@sonisoft/now-sdk-ext-core';
 export interface FlowCopyResult {
     success: boolean;
     newFlowSysId?: string;
@@ -14,6 +14,24 @@ export interface FlowTestResult {
     errorMessage?: string;
 }
 export declare class FlowDisplayService {
+    /** Widest description the one-line summary will print before eliding. */
+    private static readonly DESCRIPTION_MAX_LENGTH;
+    /**
+     * Render an action design-time definition: metadata plus ordered steps.
+     *
+     * As with a flow definition, only the summary projection is printed — the raw
+     * `metadata`/`steps` payloads stay on the JSON path.
+     */
+    formatActionDefinitionResult(result: ActionDefinitionResult, jsonOutput: boolean): string[];
+    /**
+     * Render a flow or subflow design-time definition.
+     *
+     * The JSON form is the whole typed core result, opaque `definition` payload
+     * included, so it can be piped or redirected straight into a file. The text
+     * form deliberately renders only the summary projection: the definition body
+     * carries step scripts and input values, which do not belong on a terminal.
+     */
+    formatArtifactDefinitionResult(result: FlowArtifactDefinitionResult, jsonOutput: boolean): string[];
     formatCopyResult(result: FlowCopyResult, jsonOutput: boolean): string[];
     formatCancelResult(result: any, jsonOutput: boolean): string[];
     formatErrorResult(result: any, jsonOutput: boolean): string[];
@@ -24,7 +42,18 @@ export declare class FlowDisplayService {
     formatTestResult(result: FlowTestResult, jsonOutput: boolean): string[];
     formatDetailsResult(result: FlowContextDetailsResult, jsonOutput: boolean): string[];
     formatLogsResult(result: FlowLogResult, jsonOutput: boolean): string[];
+    private _artifactLabel;
     private _mapLogLevel;
     private _stateIcon;
+    /**
+     * Reduce a design-time description to one summary line.
+     *
+     * Workflow Studio stores the description as authored, which for a shipped
+     * subflow is frequently a block of HTML hundreds of characters long. Printing
+     * it verbatim buries the counts underneath it, so the tags come out, the
+     * whitespace collapses, and anything past the cutoff is elided. The full text
+     * is never lost \u2014 it is on the `--json` path, untouched.
+     */
+    private _summaryDescription;
 }
 //# sourceMappingURL=flow-display.service.d.ts.map

package/dist/services/flow-display.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow-display.service.d.ts","sourceRoot":"","sources":["../../src/services/flow-display.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAEzF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,kBAAkB;IAC7B,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAoCvE,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAoB9D,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAwB7D,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IA6CjE,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAoB/D,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IA4B/D,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAwC9D,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAuCvE,mBAAmB,CAAC,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAqGpF,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAmCtE,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,UAAU;CAwBnB"}
+{"version":3,"file":"flow-display.service.d.ts","sourceRoot":"","sources":["../../src/services/flow-display.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/I,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,kBAAkB;IAC7B,yEAAyE;IACzE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAO;IAErD;;;;;OAKG;IACH,4BAA4B,CAAC,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAoD3F;;;;;;;OAOG;IACH,8BAA8B,CAAC,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAiDnG,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAoCvE,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAoB9D,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAwB7D,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IA6CjE,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAoB/D,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IA4B/D,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAwC9D,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAuCvE,mBAAmB,CAAC,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAqGpF,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE;IAmCtE,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,UAAU;IAyBlB;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;CAW5B"}