@stage5/lumine 0.3.31 → 0.3.33

package/lib/admin.js

@@ -12,6 +12,11 @@ import {
 import path from "node:path";
 import { assertAuthScope, resolveAuth } from "./auth.js";
 import { requestJson } from "./http.js";
+import { commitThumbnailImage, readThumbnailFile } from "./thumbnail.js";
+import {
+  THUMBNAIL_CONTENT_TYPE_BY_EXTENSION,
+  THUMBNAIL_MAX_FILE_SIZE_BYTES,
+} from "./constants.js";
 import { receiptToKeep } from "./admin-receipts.js";
 import { prepareAdminMutationIntent } from "./admin-request-intents.js";
 import { formatBytes, parseStorageSizeBytes } from "./util.js";
@@ -39,6 +44,7 @@ import {
   printOwnerTrace,
 } from "./admin-owner-trace.js";
 import { buildRolesOperation, printRoles } from "./admin-roles.js";
+import { buildCraftOperation, formatCraftResult } from "./admin-craft.js";
 import { formatChatReportResult } from "./admin-chat-reports.js";
 import { formatIdentityDeviceUsage } from "./admin-identity-inspection.js";
 import {
@@ -202,7 +208,7 @@ const REVIEW_REQUEST_LABELS = {
   cardcraft: "AI Card crafting",
 };
 const REVIEW_REQUEST_USAGE =
-  "Usage: lumine admin review list [--type rewards|project|storage|cardcraft] [--status queue|pending|approved|rejected|all] [--cursor <c>] | show <type:id> [--dir <path>] | approve <type:id> [--config <rules.json>] [--size <500MB|1GB|2GB|n MB>] [--reason <text>] | reject <type:id> [--reason <text>] | revoke <type:id> --reason <text> | propose rewards:<id> --dir <edited-snapshot> --config <rules.json> [--reason <text>]. A bare id works with --type.";
+  "Usage: lumine admin review list [--type rewards|project|storage|cardcraft] [--status queue|pending|approved|rejected|all] [--cursor <c>] | show <type:id> [--dir <path>] | approve <type:id> [--config <rules.json>] [--size <500MB|1GB|2GB|n MB>] [--reason <text>] | reject <type:id> [--reason <text>] | revoke <type:id> --reason <text> | propose rewards:<id> --dir <edited-snapshot> --config <rules.json> [--reason <text>] [--title <new app name>] [--thumbnail <image|workspace>]. A bare id works with --type.";
 
 function parseReviewRequestType(value) {
   const key = String(value || "")
@@ -945,6 +951,20 @@ function buildRewardProposalOperation(reviewId, options) {
     );
   }
   const files = readRewardProposalDirectory(options.dir);
+  // --title proposes a new app name; --thumbnail <file> a new thumbnail (set
+  // on your proposal workspace copy first), or --thumbnail workspace to offer
+  // the one already set on that copy (e.g. from the website).
+  const title = String(options.title || "").trim();
+  if (title.length > 100) {
+    throw cliValidationError("--title must be at most 100 characters.");
+  }
+  const thumbnail = String(options.adminThumbnail || "").trim();
+  // Checked before signing in or opening the copy; its hash makes a retry
+  // with a different picture a new request rather than a replay.
+  const thumbnailSha256 =
+    thumbnail && thumbnail !== "workspace"
+      ? hashProposalThumbnailFile(thumbnail)
+      : "";
   return writeOperation(
     "reward-review.propose",
     "POST",
@@ -953,11 +973,78 @@ function buildRewardProposalOperation(reviewId, options) {
       files,
       config: readRewardConfigFile(options.adminConfigFile),
       reason,
+      ...(title ? { title } : {}),
+      ...(thumbnail ? { thumbnailFrom: "workspace" } : {}),
+      ...(thumbnailSha256 ? { thumbnailSha256 } : {}),
+    },
+    {
+      requiresRun: false,
+      reviewId,
+      fileCount: files.length,
+      ...(thumbnail && thumbnail !== "workspace"
+        ? {
+            prepare: ({ options: runOptions, auth }) =>
+              setProposalWorkspaceThumbnail({
+                options: runOptions,
+                auth,
+                reviewId,
+                filePath: thumbnail,
+              }),
+          }
+        : {}),
     },
-    { requiresRun: false, reviewId, fileCount: files.length },
   );
 }
 
+// Puts a proposed thumbnail on the reviewer's proposal workspace copy (opened
+// on first use), the copy the offer's thumbnailFrom 'workspace' reads.
+async function setProposalWorkspaceThumbnail({
+  options,
+  auth,
+  reviewId,
+  filePath,
+}) {
+  const { buffer, contentType } = await readThumbnailFile(filePath);
+  const receipt = await requestJson({
+    method: "POST",
+    url: `${options.apiUrl}/cli/admin/reward-reviews/${reviewId}/workspace`,
+    authToken: auth.token,
+    body: {},
+    headers: { "x-lumine-idempotency-key": `cli:${randomUUID()}` },
+    timeoutMs: options.timeoutMs,
+  });
+  const buildId = Number(receipt?.data?.workspace?.buildId || 0);
+  if (!receipt?.ok || !buildId) {
+    throw new Error(
+      receipt?.error || "Could not open the proposal workspace copy.",
+    );
+  }
+  await commitThumbnailImage({ options, auth, buildId, buffer, contentType });
+  // stderr: --json output stays one parseable receipt.
+  console.error(`Proposed thumbnail set on workspace copy (Build #${buildId}).`);
+}
+
+function hashProposalThumbnailFile(filePath) {
+  const extension = path.extname(filePath).toLowerCase();
+  if (!THUMBNAIL_CONTENT_TYPE_BY_EXTENSION[extension]) {
+    throw cliValidationError(
+      `--thumbnail must be a ${Object.keys(THUMBNAIL_CONTENT_TYPE_BY_EXTENSION).join(", ")} file, or "workspace".`,
+    );
+  }
+  let buffer;
+  try {
+    buffer = readFileSync(path.resolve(filePath));
+  } catch {
+    throw cliValidationError(`Thumbnail file does not exist: ${filePath}`);
+  }
+  if (!buffer.length || buffer.length > THUMBNAIL_MAX_FILE_SIZE_BYTES) {
+    throw cliValidationError(
+      `Thumbnail file must be between 1 byte and ${formatBytes(THUMBNAIL_MAX_FILE_SIZE_BYTES)}.`,
+    );
+  }
+  return createHash("sha256").update(buffer).digest("hex");
+}
+
 const REWARD_PROPOSAL_MAX_FILES = 500;
 const REWARD_PROPOSAL_MAX_BYTES = 5 * 1024 * 1024;
 const REWARD_PROPOSAL_SKIPPED_DIRS = new Set([
@@ -1364,6 +1451,12 @@ export async function adminCommand(options) {
     (operation.mutates ? `cli:${randomUUID()}` : "");
   let result;
   try {
+    // A step that must land before the request (e.g. a proposed thumbnail
+    // uploaded to the reviewer's workspace copy); its failure is reported
+    // like the request's own.
+    if (typeof operation.prepare === "function") {
+      await operation.prepare({ options, auth });
+    }
     const fetchOperation = async (requestPath = operation.path, signal) => {
       const receipt = await requestJson({
         method: operation.method,
@@ -1576,6 +1669,9 @@ export async function adminCommand(options) {
   if (operation.name === "ai-email-policy.set") {
     assertAiEmailPolicySetResult({ operation, result });
   }
+  if (AI_BUCKET_CHANGE_OPERATIONS.has(operation.name)) {
+    assertAiBucketChangeResult({ operation, result });
+  }
   if (operation.name === "daily-run.start") {
     assertAdminTodoHandoffResult(result, operation.body.scope);
   }
@@ -2045,6 +2141,42 @@ export function assertAiEmailPolicySetResult({ operation, result }) {
   throw error;
 }
 
+const AI_BUCKET_CHANGE_OPERATIONS = new Set([
+  "ai-bucket.restrict",
+  "ai-bucket.rule.add",
+  "ai-bucket.rule.disable",
+]);
+
+// A bucket change is done only when the API re-read the canonical bucket and
+// confirmed it (verified), and a restriction reads back as the requested mode.
+export function assertAiBucketChangeResult({ operation, result }) {
+  const data = result?.data || {};
+  const requestedMode =
+    operation?.name === "ai-bucket.restrict" ? operation.body?.mode : null;
+  if (
+    result?.ok === true &&
+    data.verified === true &&
+    Number(data.bucket?.id) > 0 &&
+    (!requestedMode || data.bucket?.restriction?.mode === requestedMode)
+  ) {
+    return;
+  }
+  const error = new Error(
+    "The API did not confirm the canonical AI bucket state after this change. Inspect the bucket before retrying.",
+  );
+  error.code = "LUMINE_ADMIN_AI_BUCKET_NOT_VERIFIED";
+  error.data = {
+    ok: false,
+    status: "partial_failure",
+    error: {
+      code: error.code,
+      message: error.message,
+      details: { requestedMode, canonical: result?.data || null },
+    },
+  };
+  throw error;
+}
+
 const RECOMMENDATION_CONTENT_TYPES = new Map([
   ["comment", "comment"],
   ["aistory", "aiStory"],
@@ -2452,6 +2584,10 @@ export function parseAdminOperation(options) {
   if (namespace === "roles") {
     return buildRolesOperation(options);
   }
+  // Twinkle.craft universe curation (admin-craft.js); no run.
+  if (namespace === "craft") {
+    return buildCraftOperation({ action, options });
+  }
 
   if (namespace === "correction" || namespace === "corrections") {
     if (!action || action === "status") {
@@ -2660,6 +2796,78 @@ export function parseAdminOperation(options) {
         },
       );
     }
+    if (action === "inspect") {
+      const reason = String(options.adminReason || "").trim();
+      if (!reason) {
+        throw cliValidationError(
+          "Say why with --reason <management reason>; the inspection is audited.",
+        );
+      }
+      if (reason.length > MAX_IDENTITY_INSPECTION_REASON_LENGTH) {
+        throw cliValidationError(
+          `An inspection reason must be at most ${MAX_IDENTITY_INSPECTION_REASON_LENGTH} characters.`,
+        );
+      }
+      // A read like identity inspect: private evidence is printed, never
+      // kept on disk; the server records who looked, when and why.
+      return bodyReadOperation(
+        "ai-bucket.inspect",
+        "POST",
+        `/cli/admin/ai-buckets/${bucketId}/inspect`,
+        {
+          reason,
+          includePrivateEvidence: options.adminIncludePrivateEvidence === true,
+        },
+      );
+    }
+    if (action === "restrict") {
+      const mode = String(options.adminMode || "");
+      if (!["none", "signup", "full"].includes(mode)) {
+        throw cliValidationError("Pass --mode none, signup or full.");
+      }
+      const body = { mode };
+      if (options.adminMessage !== undefined) {
+        const message = String(options.adminMessage).trim();
+        if (message.length > 500) {
+          throw cliValidationError("--message must be at most 500 characters.");
+        }
+        body.message = message;
+      }
+      return aiBucketChangeOperation({
+        options,
+        name: "ai-bucket.restrict",
+        method: "PUT",
+        path: `/cli/admin/ai-buckets/${bucketId}/restriction`,
+        body,
+        // a restriction changes only on an explicit instruction
+        confirmRequired: true,
+      });
+    }
+    if (action === "rule" && target === "add") {
+      return aiBucketChangeOperation({
+        options,
+        name: "ai-bucket.rule.add",
+        method: "POST",
+        path: `/cli/admin/ai-buckets/${bucketId}/rules`,
+        body: parseAiBucketRuleBody(options),
+        confirmRequired: true,
+      });
+    }
+    if (action === "rule" && target === "disable") {
+      const ruleId = parseRequiredInteger(options.adminRuleId, "--rule-id", 1);
+      const note = String(options.note || "").trim();
+      if (note.length > 180) {
+        throw cliValidationError("--note must be at most 180 characters.");
+      }
+      return aiBucketChangeOperation({
+        options,
+        name: "ai-bucket.rule.disable",
+        method: "POST",
+        path: `/cli/admin/ai-buckets/${bucketId}/rules/${ruleId}/disable`,
+        body: note ? { note } : {},
+        confirmRequired: true,
+      });
+    }
     if (action === "note" && target === "set") {
       return writeOperation(
         "ai-bucket.note.set",
@@ -2748,7 +2956,7 @@ export function parseAdminOperation(options) {
     });
     if (operation) return operation;
     throw cliValidationError(
-      "Usage: lumine admin reward-review list [--status pending|approved|all] [--cursor <id>] | show <id> [--dir <path>] | approve <id> [--config <rules.json>] [--reason <text>] | propose <id> --dir <edited-snapshot> --config <rules.json> [--reason <text>] | reject <id> --reason <text> | revoke <id> --reason <text>.",
+      "Usage: lumine admin reward-review list [--status pending|approved|all] [--cursor <id>] | show <id> [--dir <path>] | approve <id> [--config <rules.json>] [--reason <text>] | propose <id> --dir <edited-snapshot> --config <rules.json> [--reason <text>] [--title <new app name>] [--thumbnail <image|workspace>] | reject <id> --reason <text> | revoke <id> --reason <text>.",
     );
   }
 
@@ -5085,6 +5293,108 @@ export function assertAdminTodoHandoffResult(result, expectedRunScope = null) {
   return handoff;
 }
 
+// --dry-run is a read (no receipt, nothing changes); a real run is a write
+// that needs --confirm, checked here and again by the server.
+function aiBucketChangeOperation({ options, name, method, path, body, confirmRequired }) {
+  // --allow-shared-network lets a rule reach a shared network (an academy,
+  // a school); it is sent, and printed, only when given
+  if (options.adminAllowSharedNetwork) {
+    if (!["ai-bucket.restrict", "ai-bucket.rule.add"].includes(name)) {
+      throw cliValidationError("--allow-shared-network applies only to restrict and rule add.");
+    }
+    body = { ...body, allowSharedNetwork: true };
+  }
+  if (options.adminDryRun) {
+    return bodyReadOperation(`${name}.preview`, method, path, {
+      ...body,
+      dryRun: true,
+    });
+  }
+  const confirm = options.adminConfirm;
+  if (confirm !== "" && confirm !== "true") {
+    throw cliValidationError("Pass --confirm on its own, without a value.");
+  }
+  if (confirmRequired && confirm !== "true") {
+    throw cliValidationError(
+      "Every bucket change needs --confirm (a rule changes who shares AI Energy, and on a restricted bucket who is blocked). Run it with --dry-run first to see what it changes.",
+    );
+  }
+  return writeOperation(name, method, path, {
+    ...body,
+    ...(confirm === "true" ? { confirm: true } : {}),
+  });
+}
+
+function parseAiBucketRuleBody(options) {
+  const type = String(options.adminType || "");
+  const note = String(options.note || "").trim();
+  if (note.length > 180) {
+    throw cliValidationError("--note must be at most 180 characters.");
+  }
+  const withNote = (body) => (note ? { ...body, note } : body);
+  const scope = () => {
+    const value = String(options.adminScope || "");
+    if (!["signup", "full"].includes(value)) {
+      throw cliValidationError(
+        "Pass --scope signup or full for an IP or device rule.",
+      );
+    }
+    return value;
+  };
+  if (type === "user") {
+    return withNote({
+      type,
+      userId: parseRequiredInteger(options.adminUser, "--user", 1),
+    });
+  }
+  if (type === "email") {
+    const email = String(options.adminEmail || "").trim().toLowerCase();
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+      throw cliValidationError("Pass a valid --email <address>.");
+    }
+    if (!options.adminDryRun && !options.adminConfirmEmailRule) {
+      throw cliValidationError(
+        "An email rule covers every account with that verified address. Pass --confirm-email-rule (run --dry-run first to see them).",
+      );
+    }
+    return withNote({
+      type,
+      email,
+      ...(options.adminConfirmEmailRule ? { confirmEmailRule: true } : {}),
+    });
+  }
+  if (type === "ip") {
+    const ip = String(options.adminIp || "").trim();
+    if (!ip) throw cliValidationError("Pass --ip <address>.");
+    return withNote({
+      type,
+      ip,
+      scope: scope(),
+      ...(options.adminIncludePrefix ? { includePrefix: true } : {}),
+    });
+  }
+  if (type === "device") {
+    if (!/^[a-f0-9]{16}$/.test(options.adminDeviceKey || "")) {
+      throw cliValidationError(
+        "Pass --device-key with the exact key from ai-bucket inspect or identity inspect.",
+      );
+    }
+    if (!options.adminDryRun && !note) {
+      throw cliValidationError("Say why with --note <reason> for a device rule.");
+    }
+    return withNote({
+      type,
+      sourceUserId: parseRequiredInteger(options.adminUser, "--user", 1),
+      deviceKey: options.adminDeviceKey,
+      scope: scope(),
+      ...(options.adminUserIds || !options.adminDryRun
+        ? { expectedUserIds: parseAiBucketUserIds(options.adminUserIds) }
+        : {}),
+    });
+  }
+  throw cliValidationError("Pass --type user, email, ip or device.");
+}
+
 function readOperation(name, path, extra = {}) {
   return {
     name,
@@ -5769,6 +6079,10 @@ function printRewardReviewResult({ operation, data }) {
     );
     for (const file of review.proposal.changedFiles || [])
       console.log(`  ${file.status}: ${file.path}`);
+    if (review.proposal.title)
+      console.log(`  new name: ${review.proposal.title}`);
+    if (review.proposal.thumbnailUrl)
+      console.log(`  new thumbnail: ${review.proposal.thumbnailUrl}`);
   }
   if (review.status === "rejected" && review.declinedByCreator) {
     console.log(
@@ -6846,6 +7160,174 @@ function printRewardBankReport(data) {
   }
 }
 
+function aiBucketRestrictionLabel(restriction) {
+  const mode = restriction?.mode || "none";
+  const label = mode === "none" ? "unrestricted" : mode === "signup" ? "signup-only" : "full";
+  return restriction?.message ? `${label} — "${restriction.message}"` : label;
+}
+
+function formatAiBucketAccounts(accounts) {
+  return (accounts || []).length
+    ? accounts.map((a) => `${a.username || "?"} (#${a.userId})`).join(", ")
+    : "none";
+}
+
+function printAiBucketNetworkRuleChanges(changes) {
+  if (!changes?.length) return;
+  console.log("Network/device rules whose restriction changes:");
+  for (const c of changes) {
+    const r = c.reach;
+    const reach = !c.strengthens
+      ? "loosens"
+      : !r?.measured
+        ? "reach NOT MEASURED"
+        : `${r.accountCount}${r.lowerBound ? "+" : ""} account(s)${r.sharedNetwork ? " — SHARED NETWORK" : ""}`;
+    console.log(`  #${c.ruleId} ${c.kind} ${c.match}: ${c.from} → ${c.to} · ${reach}`);
+  }
+}
+
+function printAiBucketBlockers(blockers, overrideGiven) {
+  for (const blocker of blockers || []) {
+    if (blocker.overridable && overrideGiven) {
+      console.log(`OVERRIDDEN by --allow-shared-network (${blocker.code}): ${blocker.message}`);
+    } else {
+      console.log(`BLOCKED (${blocker.code}): ${blocker.message}${blocker.overridable ? " Only --allow-shared-network, on Mikey's explicit word, lifts this." : ""}`);
+    }
+  }
+}
+
+function printAiBucketRules(rules, indent = "  ") {
+  for (const rule of rules || []) {
+    console.log(
+      `${indent}#${rule.id} ${rule.kind} ${rule.match} · scope ${rule.scope} · effective ${rule.effectiveRestriction}${rule.note ? ` · ${rule.note}` : ""}`,
+    );
+  }
+}
+
+// The bucket commands of todo 79 (inspect, restrict, rule add/disable and
+// their --dry-run previews). Returns false for the older ai-bucket commands.
+function printAiBucketRuleResult({ operation, data }) {
+  const name = operation.name;
+  const head = (bucket) =>
+    `AI bucket #${bucket.id} (${bucket.label}): ${aiBucketRestrictionLabel(bucket.restriction)}`;
+  if (name === "ai-bucket.inspect") {
+    console.log(`${head(data.bucket)}; ${data.rules.length} active rule(s), ${data.memberCount} member account(s).`);
+    if (data.bucket.note) console.log(`Note: ${data.bucket.note}`);
+    console.log("Rules:");
+    printAiBucketRules(data.rules);
+    console.log(
+      `Members: ${(data.members || []).map((m) => `${m.username || "?"} (#${m.userId}${m.viaEmailRule ? ", via email rule" : ""})`).join(", ") || "none"}`,
+    );
+    for (const account of data.evidence?.accounts || []) {
+      console.log(`Evidence for ${account.username || "?"} (#${account.userId})${account.canonicalBucketId && account.canonicalBucketId !== data.bucket.id ? ` · resolves to bucket #${account.canonicalBucketId}` : ""}:`);
+      if (!account.devices.length) console.log("    Devices: none recorded");
+      for (const device of account.devices) {
+        const rule = device.ruleId ? ` · rule #${device.ruleId}` : "";
+        if (device.sharedDevice) {
+          console.log(`    Device ${device.key}: shared by ${device.accountCount} accounts (not listed; not family evidence)${rule}`);
+          continue;
+        }
+        const others = device.otherAccounts.length
+          ? device.otherAccounts.map((a) => `${a.username || "?"} (#${a.userId})${a.inBucket ? "" : " OUTSIDE bucket"}`).join(", ")
+          : "no other account";
+        console.log(`    Device ${device.key}: ${device.accountCount} account(s); others: ${others}${device.accountsTruncated ? " (more not listed)" : ""}${device.status !== "complete" ? ` · ${device.status}` : ""}${rule}`);
+      }
+      printNetwork(account.network, "    ");
+      const ruled = (account.network?.addresses || []).filter((a) => a.ruleId);
+      if (ruled.length) {
+        console.log(`    IP rules matching these addresses: ${ruled.map((a) => `#${a.ruleId} [${a.addressId}]`).join(", ")}`);
+      }
+    }
+    if (data.evidence?.membersNotInspected) {
+      console.log(`Evidence covers the first ${data.evidence.membersInspected} members; ${data.evidence.membersNotInspected} not inspected.`);
+    }
+    console.log(data.interpretation);
+    return true;
+  }
+  if (name === "ai-bucket.restrict.preview") {
+    const p = data.preview;
+    console.log(`DRY RUN ${head(data.bucket)} → ${aiBucketRestrictionLabel(p.to)}${p.changed ? "" : " (no change)"}.`);
+    console.log(`Accounts it reaches: ${formatAiBucketAccounts(p.memberAccounts)}`);
+    console.log(`Sessions dropped: ${p.sessionsKickedUserIds.length ? p.sessionsKickedUserIds.map((id) => `#${id}`).join(", ") : "none"}; existing logins ${p.existingLoginsPreserved ? "kept" : "ended"}; existing bans kept.`);
+    if (p.fullBlockLiftedUserIds.length) console.log(`Full block lifted for: ${p.fullBlockLiftedUserIds.map((id) => `#${id}`).join(", ")} (unless another restriction still applies).`);
+    if (p.adminConflictUserIds.length) console.log(`BLOCKED: admin account(s) ${p.adminConflictUserIds.map((id) => `#${id}`).join(", ")} cannot be fully restricted.`);
+    printAiBucketNetworkRuleChanges(p.networkRuleChanges);
+    printAiBucketBlockers(p.blockers, data.sharedNetworkOverride);
+    console.log("Nothing was changed. Run again with --confirm to apply.");
+    return true;
+  }
+  if (name === "ai-bucket.restrict") {
+    console.log(`${head(data.bucket)} (was ${aiBucketRestrictionLabel(data.previous)}); verified.`);
+    printAiBucketNetworkRuleChanges(data.networkRuleChanges);
+    if (data.sharedNetworkOverride) console.log("OVERRIDE USED: --allow-shared-network — a shared network or unmeasured rule is now restricted.");
+    console.log(`Sessions dropped: ${data.kickedUserIds.length ? data.kickedUserIds.map((id) => `#${id}`).join(", ") : "none"}; existing logins ${data.existingLoginsPreserved ? "kept" : "ended"}; existing bans kept.`);
+    return true;
+  }
+  if (name === "ai-bucket.rule.add.preview") {
+    console.log(`DRY RUN ${head(data.bucket)} (the real run needs --confirm).`);
+    if (data.device) {
+      const d = data.device;
+      if (d.sharedDevice) {
+        console.log(`Shared device: ${d.observedAccountCount} accounts (${d.outsideBucketCount} outside this bucket); not listed, not family evidence.`);
+      } else {
+        console.log(`Device ${d.key} (${d.scope}) from #${d.sourceUserId}: seen on ${d.observedUserIds.map((id) => `#${id}`).join(", ") || "no account"} in ${d.lookbackDays} days; effective ${data.effectiveRestriction}.`);
+        if (d.outsideBucketUserIds.length) console.log(`Outside this bucket: ${d.outsideBucketUserIds.map((id) => `#${id}`).join(", ")}`);
+      }
+      if (d.existingRuleId) console.log(`Existing rule #${d.existingRuleId} in bucket #${d.existingRuleBucketId}.`);
+      if (!(data.blockers || []).length) console.log(`Pass the reviewed accounts with --user-ids ${d.observedUserIds.join(",")} on the real run.`);
+    } else {
+      const p = data.preview;
+      const r = p.rule;
+      console.log(`Rule: ${r.type} ${r.userId ? `#${r.userId}` : r.email || r.ip}${r.scope ? ` · scope ${r.scope}` : ""}${r.prefixRuleTypes?.length ? ` + prefix rules ${r.prefixRuleTypes.join(", ")}` : ""}; effective ${p.effectiveRestriction}.`);
+      if (p.existingRule) console.log(`Existing rule #${p.existingRule.ruleId} in bucket #${p.existingRule.bucketId} (${p.existingRule.bucketLabel}).`);
+      if (p.affectedAccounts) console.log(`Accounts it names: ${formatAiBucketAccounts(p.affectedAccounts)}`);
+      if (p.exactAddress) {
+        const a = p.exactAddress;
+        console.log(a.kind === "shared_network"
+          ? `Address [${a.addressId}]: shared network, ${a.accountCount} accounts (not listed; not family evidence).`
+          : `Address [${a.addressId}]: ${a.accountCount} account(s): ${formatAiBucketAccounts(a.accounts)}${a.olderHistoryNotRead ? " · older history not read" : ""}`);
+      }
+      if (p.prefixReach) {
+        const r = p.prefixReach;
+        console.log(r.measured
+          ? `Prefix: at least ${r.accountCount} account(s) used AI from it${r.sharedNetwork ? " — shared network" : ""}${r.olderHistoryNotRead ? " · older history not read" : ""} (accounts that never used AI there are not counted).`
+          : "Prefix: reach could not be measured.");
+      }
+      for (const existing of p.existingPrefixRules || []) {
+        if (existing) console.log(`Existing prefix rule #${existing.ruleId} in bucket #${existing.bucketId} (${existing.scope}).`);
+      }
+      if (p.sessionsKickedUserIds.length) console.log(`Sessions dropped: ${p.sessionsKickedUserIds.map((id) => `#${id}`).join(", ")}`);
+    }
+    printAiBucketBlockers(data.blockers || data.preview?.blockers || [], data.sharedNetworkOverride);
+    console.log(`Would change: ${data.wouldChange ? "yes" : "no"}. Nothing was changed.`);
+    return true;
+  }
+  if (name === "ai-bucket.rule.add") {
+    console.log(`${head(data.bucket)}; rule saved; ${data.ruleCount} active rule(s), ${data.memberCount} member(s); verified.`);
+    printAiBucketRules(data.addedRules);
+    if (data.sharedNetworkOverride) console.log("OVERRIDE USED: --allow-shared-network — this rule reaches a shared network.");
+    if (data.kickedUserIds?.length) console.log(`Sessions dropped: ${data.kickedUserIds.map((id) => `#${id}`).join(", ")}`);
+    return true;
+  }
+  if (name === "ai-bucket.rule.disable.preview") {
+    const p = data.preview;
+    console.log(`DRY RUN ${head(data.bucket)} (the real run needs --confirm).`);
+    printAiBucketRules([p.rule]);
+    console.log(p.alreadyDisabled ? "Already disabled." : `Released accounts: ${formatAiBucketAccounts(p.releasedAccounts)}${p.liftsRestriction ? " (each keeps any other restriction that still applies)" : ""}.`);
+    if (p.prefixRulesRemainActive) {
+      console.log(`${p.prefixNote}${p.companionPrefixRuleIds?.length ? ` Its prefix rules here: ${p.companionPrefixRuleIds.map((id) => `#${id}`).join(", ")}.` : ""}`);
+    }
+    console.log(`Would change: ${data.wouldChange ? "yes" : "no"}. Nothing was changed.`);
+    return true;
+  }
+  if (name === "ai-bucket.rule.disable") {
+    console.log(`${head(data.bucket)}; rule #${data.disabledRule.id} disabled; ${data.ruleCount} active rule(s), ${data.memberCount} member(s); verified.`);
+    console.log(`Released accounts: ${formatAiBucketAccounts(data.releasedAccounts)}`);
+    return true;
+  }
+  return false;
+}
+
 function printAdminResult({ operation, result }) {
   const data = result?.data || {};
   if (printChatSafetyResult({ operation, data })) return;
@@ -6858,6 +7340,9 @@ function printAdminResult({ operation, result }) {
     for (const line of formatProfileReview(data)) console.log(line);
     return;
   }
+  if (operation.name.startsWith("ai-bucket.") && printAiBucketRuleResult({ operation, data })) {
+    return;
+  }
   if (operation.name === "reward-activity.report") {
     printRewardActivity(data);
     return;
@@ -6874,6 +7359,13 @@ function printAdminResult({ operation, result }) {
     printRoles(data);
     return;
   }
+  if (operation.name.startsWith("craft.")) {
+    const lines = formatCraftResult({ operation, data });
+    if (lines) {
+      for (const line of lines) console.log(line);
+      return;
+    }
+  }
   if (operation.name.startsWith("reward-bank.")) {
     if (operation.name === "reward-bank.seed") {
       console.log(