@stage5/lumine 0.2.32 → 0.2.33

package/lib/admin.js

@@ -313,13 +313,15 @@ export function resolveOperatorViewFilter({ operation, unviewed, viewed }) {
 }
 
 function adminOperationRequiresRun(operation) {
-  return ![
-    "identity.list",
-    "identity.status",
-    "identity.use",
-    "daily-run.start",
-    "daily-run.status",
-  ].includes(operation.name);
+  return (
+    ![
+      "identity.list",
+      "identity.status",
+      "identity.use",
+      "daily-run.start",
+      "daily-run.status",
+    ].includes(operation.name) && !operation.name.startsWith("ai-bucket.")
+  );
 }
 
 function noActiveRunError() {
@@ -360,6 +362,31 @@ export function parseAdminOperation(options) {
     }
   }
 
+  if (namespace === "ai-bucket" || namespace === "ai-buckets") {
+    const bucketId = parseRequiredInteger(
+      options.adminBucketId,
+      "AI bucket ID",
+      1,
+    );
+    if (action === "get" || action === "status") {
+      return readOperation(
+        "ai-bucket.get",
+        `/cli/admin/ai-buckets/${bucketId}`,
+      );
+    }
+    if (action === "accounts" && target === "add") {
+      return writeOperation(
+        "ai-bucket.accounts.add",
+        "POST",
+        `/cli/admin/ai-buckets/${bucketId}/accounts`,
+        {
+          userIds: parseAiBucketUserIds(options.adminUserIds),
+          note: options.note || undefined,
+        },
+      );
+    }
+  }
+
   if (namespace === "daily-run") {
     if (action === "start") {
       return writeOperation(
@@ -1010,6 +1037,29 @@ function parseOrderedIds(value) {
   return ids;
 }
 
+function parseAiBucketUserIds(value) {
+  const raw = String(value || "").trim();
+  if (!raw) {
+    throw cliValidationError(
+      "Pass explicit accounts with --user-ids <id,id,...>.",
+    );
+  }
+  const ids = raw
+    .split(",")
+    .map((part) => part.trim())
+    .filter(Boolean)
+    .map((part) => parseRequiredInteger(part, "AI bucket user ID", 1));
+  if (ids.length > 500) {
+    throw cliValidationError(
+      "An AI bucket batch can contain at most 500 users.",
+    );
+  }
+  if (new Set(ids).size !== ids.length) {
+    throw cliValidationError("AI bucket user IDs must be unique.");
+  }
+  return ids;
+}
+
 function parseRequiredInteger(
   value,
   label,
@@ -1049,6 +1099,15 @@ function cliValidationError(message) {
 
 function printAdminResult({ operation, result }) {
   const data = result?.data || {};
+  if (data.bucket && Array.isArray(data.memberUserIds)) {
+    const added = Array.isArray(data.accounts)
+      ? `; added ${data.accounts.length} explicit account(s)`
+      : "";
+    console.log(
+      `AI bucket #${data.bucket.id} (${data.bucket.label}): ${data.memberCount} canonical member account(s)${added}.`,
+    );
+    return;
+  }
   if (data.run !== undefined) {
     if (!data.run) {
       console.log("No active delegated administrator daily run.");

package/lib/commands.js

@@ -2172,6 +2172,8 @@ export function parseArgs(args) {
       : raw.ids
         ? String(raw.ids)
         : "",
+    adminBucketId: raw.bucketId ? String(raw.bucketId) : "",
+    adminUserIds: raw.userIds ? String(raw.userIds) : "",
     adminType: raw.type ? String(raw.type) : "",
     adminKind: raw.kind ? String(raw.kind) : "",
     adminContentTypes: raw.contentTypes ? String(raw.contentTypes) : "",
@@ -2507,6 +2509,8 @@ export function printHelp() {
   lumine thumbnail generate ["<prompt>"] --model <gpt-image-2|nano-banana>
   lumine doctor runtime-assets
   lumine admin identity list|status|use <zero|ciel|auto> [--json]
+  lumine admin ai-bucket get --bucket-id <id> [--json]
+  lumine admin ai-bucket accounts add --bucket-id <id> --user-ids <id,id,...> [--note <text>] [--json]
   lumine admin daily-run start [--identity zero|ciel|auto] [--comment-mode off|draft|post] [--run-key <key>] [--json]
   lumine admin daily-run status|complete|fail [--reason <text>] [--json]
   lumine admin recommendations list [--content-types comment,dailyReflection] [--unviewed|--viewed] [--cursor <cursor>] [--json]
@@ -2605,6 +2609,8 @@ Options:
   --idempotency-key <k> Stable retry key for one admin mutation
   --level <1|2|3>       Admin subject effort level
   --subject-ids <ids>   Complete ordered Featured subject IDs
+  --bucket-id <id>      Unbanned AI identity bucket for account consolidation
+  --user-ids <ids>      Explicit user IDs for an AI bucket batch (up to 500)
   --type <type>         Admin target: subject, comment, aiStory, or dailyReflection
   --kind recommend      Admin recommendation queue kind
   --anyone-can-reward   Enable canonical reward eligibility

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage5/lumine",
-  "version": "0.2.32",
+  "version": "0.2.33",
   "description": "Command line tools for launching Lumine builds on Twinkle.",
   "type": "module",
   "bin": {

package/sdk/LUMINE_ADMIN.md

@@ -49,6 +49,30 @@ Comment mode is stored only on the current run:
 - `draft`: server-generated drafts, no public comment.
 - `post`: drafts plus idempotent publication through the ordinary comment path.
 
+### Private AI-bucket maintenance
+
+AI identity buckets are private operator bookkeeping, not a Zero/Ciel public
+action. They therefore do not require or attach to a delegated daily run:
+
+```bash
+lumine admin ai-bucket get --bucket-id 10 --json
+lumine admin ai-bucket accounts add --bucket-id 10 \
+  --user-ids 3127,13037,15410,16288 \
+  --note "operator-confirmed account family" --json
+```
+
+`accounts add` accepts 1-500 unique positive user IDs, preflights the complete
+batch before writing, adds the canonical user and durable verified-email rules,
+re-attributes current-day AI usage, and returns the canonical bucket members.
+It is idempotent to retry. The API records the real operator in the private
+Lumine audit log; no public bot identity is involved.
+
+This surface intentionally accepts only an existing **unbanned** bucket. It
+cannot ban accounts, block signup, add IP/device/risk-key rules, or infer an
+account family. Identification remains a human/LLM evidence judgment and must
+be explicitly requested by Mikey; routine administrator runs still escalate
+suspected alternate accounts and never auto-enforce.
+
 ## Editorial priorities
 
 The CLI enforces none of this — it is the standing instruction for the operator