@synap-core/cli 1.12.2 → 1.13.1-next.20261102.ec3d166

package/dist/commands/market.js

@@ -32,12 +32,14 @@ import { renderNextSteps, FLOW } from "../lib/next-steps.js";
 import { getStoredToken, isTokenLocallyExpired } from "../lib/auth.js";
 import prompts from "prompts";
 import { fetchPublicBrowseRows, fetchMyRows, fetchAvailableSlugs, fetchRetiredWorkspaceSlugs, fetchPackageDefinition, fetchPackageRecord, hydrateMineCategories, } from "../lib/cp-packages.js";
-import { fetchInstalledSlugs, fetchInstalledTemplates, fetchInstalledInventory, fetchInstalledInventoryStrict, installedRowsToTemplates, fetchWorkspaceAttachments, fetchWorkspaceAttachmentsStrict, verifyStampLanded, INSTALLED_KINDS } from "../lib/installed.js";
+import { fetchInstalledSlugs, fetchInstalledTemplates, fetchInstalledInventory, installedRowsToTemplates, fetchWorkspaceAttachments, fetchWorkspaceAttachmentsStrict, verifyStampLanded, INSTALLED_KINDS } from "../lib/installed.js";
 import { isSuite } from "../lib/suite.js";
 import { TEMPLATE_STEP_LABELS, classifyTemplateStep, proposalsDoor, stepFromApplyState, templateStepGlyph, templateStepPhrase, } from "../lib/template-steps.js";
 import { capabilityAdd } from "./capability.js";
 import { bundledTemplatesVersion } from "../lib/bundle-version.js";
 import { HubNetworkError } from "../lib/hub-client.js";
+import { checksFromStandings, fetchPackageStandings, StandingsUnavailableError, } from "../lib/package-updates.js";
+import { podAdminOrigin } from "../lib/safe-open.js";
 import { parseDataChanges, dataChangesFromRefusal, consentNeedsPerson, dataChangeRefusalMessage, printDataChanges, parseAcceptList, decideConsent, consentRerunCommand, consentRefusalLines, lifecycleNotice, overlayNotice, overlayNeedsAttention, } from "../lib/template-lifecycle.js";
 // Same longer budget launch uses — an apply writes profiles/views/entities.
 const APPLY_TIMEOUT_MS = 120_000;
@@ -167,8 +169,8 @@ const KIND_HEADINGS = {
     // (`GET /installed`) calls the same thing `automation`. Both tokens reach
     // `kindHeading()` — `market --list` speaks CP, `market installed` speaks pod —
     // so both are mapped, to the ONE plural the registry says.
-    workflow: "Rules",
-    automation: "Rules",
+    workflow: "Automations",
+    automation: "Automations",
     view: "Views",
     cell: "Cards",
     workspace: "Spaces",
@@ -1260,6 +1262,14 @@ function stampVersion(pkg, slug, version) {
     const meta = pkg._meta ?? {};
     return { ...pkg, _meta: { ...meta, slug, ...(version ? { version } : {}) } };
 }
+/**
+ * The slugs with an update that `synap market update <slug>` can apply (a
+ * kind with a CLI updater). Next-step suggestions use it, so they never offer
+ * a command that would only refuse.
+ */
+export function cliUpdatableSlugs(checks) {
+    return checks.filter((c) => c.updateAvailable && updateDoorFor(c.kind) !== null).map((c) => c.slug);
+}
 export function updateDoorFor(kind) {
     switch (kind ?? "workspace") {
         case "workspace":
@@ -1341,7 +1351,7 @@ export function dedupeBySlug(checks) {
  * pod's idempotent-create path, which reconciles when the pod build supports
  * it (see the `applyOnePackage` caveat below for what "created" means here).
  */
-async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIMEOUT_MS, extra = {}) {
+export async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIMEOUT_MS, extra = {}) {
     if (cat.lockedSlugs.has(entry.slug)) {
         const tier = cat.tierBySlug.get(entry.slug)?.requiredTier;
         if (!opts.json)
@@ -1366,14 +1376,28 @@ async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIM
     try {
         const res = (await hubPost("/packages/apply", pkg, cfg, applyTimeoutMs));
         s?.stop();
+        // A key that may not apply a workspace package on its own (a computer
+        // key's grant leaves out `workspace.update`) files the update for the
+        // person's approval: 202 `{status:"proposed", proposalId, reviewUrl}`.
+        // Waiting, never failed — it applies when the person approves it.
         if (writeGovernance(res) === "proposed") {
             const proposalId = res.proposalId ? String(res.proposalId) : undefined;
+            const reviewUrl = approvalLink(cfg.podUrl, proposalId, res.reviewUrl);
             if (!opts.json) {
-                log.info(`${entry.name} — update proposed (under review, not live yet).`);
-                if (proposalId)
-                    log.hint(`Review and approve: synap open proposal ${proposalId}`);
+                log.info(`${entry.name} — update filed for your approval (not applied yet).`);
+                if (reviewUrl)
+                    log.hint(`Approve it: ${reviewUrl}`);
+                else if (proposalId)
+                    log.hint(`Approve it: synap open proposal ${proposalId}`);
             }
-            return { slug: entry.slug, outcome: "proposed", status: "proposed", warnings: [] };
+            return {
+                slug: entry.slug,
+                outcome: "proposed",
+                status: "proposed",
+                warnings: [],
+                ...(proposalId ? { proposalId } : {}),
+                ...(reviewUrl ? { reviewUrl } : {}),
+            };
         }
         const ws = res.workspace;
         const dependencies = res.dependencies;
@@ -1431,7 +1455,7 @@ async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIM
             if (refusal)
                 log.warn(refusal);
             else
-                renderHubError(e);
+                renderHubError(e, { personDoor: marketUpdatesDoor(cfg.podUrl) });
         }
         return {
             slug: entry.slug,
@@ -1442,6 +1466,29 @@ async function applyOnePackage(entry, cat, cfg, opts, applyTimeoutMs = APPLY_TIM
         };
     }
 }
+/**
+ * Where the person approves a filed update: pod admin's proposal page, the
+ * approval door (`/proposal/<id>`), when the pod-admin origin derives from the
+ * pod's; else the link the pod sent (`reviewUrl`); else nothing.
+ */
+export function approvalLink(podUrl, proposalId, reviewUrl) {
+    const admin = podAdminOrigin(podUrl);
+    if (admin && proposalId)
+        return `${admin}/proposal/${encodeURIComponent(proposalId)}`;
+    return typeof reviewUrl === "string" && reviewUrl.length > 0 ? reviewUrl : undefined;
+}
+/**
+ * Where the person applies a package update a limited key may not apply
+ * (a computer key's grant leaves out `workspace.update`, by design: applying a
+ * workspace package is the person's act). Pod admin's Marketplace, Updates
+ * tab, named by URL when the pod-admin origin derives from the pod's.
+ */
+export function marketUpdatesDoor(podUrl) {
+    const admin = podAdminOrigin(podUrl);
+    return admin
+        ? `Apply it yourself from pod admin → Marketplace → Updates: ${admin}/marketplace/updates`
+        : "Apply it yourself from pod admin → Marketplace → Updates.";
+}
 /**
  * Ask the pod's write-free preview door (`POST /packages/preflight`, the same
  * body `/packages/apply` takes) which data changes an update would run.
@@ -1509,26 +1556,28 @@ async function reconcileOutcome(c, report, opts) {
 }
 export async function marketUpdate(slugsArg, opts) {
     const applyTimeoutMs = parseApplyTimeoutMs(opts.timeout);
-    // STRICT fetch: distinguish "pod unreachable" (transient — don't claim the
-    // pod is empty, that reads as data loss) from "genuinely nothing installed".
     const cat = await buildMarketCatalog();
-    let installedTemplates;
-    // Whether the pod answered from the ONE read door (`GET /installed`, all six
-    // kinds) or is old enough that only workspace packages were visible. An old
-    // pod is not an empty pod — say which, rather than letting a narrower list
-    // read as the whole truth.
-    let degraded = false;
+    // THE POD'S ANSWER, never the CLI's: which installed package has an update
+    // is derived once on the pod, for every kind, with one rule (Hub
+    // `GET /package-updates` → `installed[]`), and pod admin's Updates tab reads
+    // the same list. A pod that cannot answer is said out loud, never replaced
+    // by a verdict computed here (that fork is how the CLI said "content
+    // changed" while pod admin said nothing, 2 Nov 2026).
+    let standings;
     try {
-        const inv = await fetchInstalledInventoryStrict();
-        installedTemplates = installedRowsToTemplates(inv.rows);
-        degraded = inv.degraded;
+        standings = await fetchPackageStandings(await resolveHubConfig(opts));
     }
     catch (e) {
         // Unreachable ≠ success — a script checking `$?` (or `&&`-chaining) must see
         // failure, not exit 0, even though the JSON payload also carries the reason.
         process.exitCode = 1;
+        const unavailable = e instanceof StandingsUnavailableError ? e.reason : null;
         if (opts.json) {
-            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, error: "pod-unreachable" }, null, 2));
+            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, error: unavailable ?? "pod-unreachable" }, null, 2));
+            return;
+        }
+        if (e instanceof StandingsUnavailableError) {
+            log.error(e.message);
             return;
         }
         log.error("Couldn't reach your pod to read what's installed — not saying it's empty.");
@@ -1536,26 +1585,21 @@ export async function marketUpdate(slugsArg, opts) {
         log.hint("Check the pod is up / you're on the right --pod, then retry.");
         return;
     }
-    const degradedNote = degraded
-        ? "This pod does not serve GET /api/hub/installed — only workspace packages were checked. Capability / view / skill / automation / card installs were NOT (upgrade the pod to include them)."
-        : undefined;
-    if (installedTemplates.length === 0) {
+    // Kept in the JSON for readers of the older shape: the pod's list covers
+    // every kind, so it is never the workspace-only view of an old pod.
+    const degraded = false;
+    if (standings.length === 0) {
         if (opts.json) {
-            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, degraded, ...(degradedNote ? { degradedNote } : {}) }, null, 2));
+            console.log(JSON.stringify({ checks: [], loggedIn: cat.loggedIn, degraded }, null, 2));
             return;
         }
         log.warn("No installed packages found on this pod.");
-        if (degradedNote)
-            log.dim(degradedNote);
         log.hint("Install one: synap market install <slug>");
         return;
     }
-    // ONE ROW PER SLUG. `GET /installed` reports one row per installed OBJECT —
-    // a views pack that installed four views is four rows — and an update is
-    // applied per PACKAGE, not per object. Without this the preview listed
-    // `task-views-pack` four times and the "N up to date" tally counted it four
-    // times. `market installed` has always deduped the same way.
-    let checks = dedupeBySlug(computeUpdates(installedTemplates, cat));
+    // One check per slug: the pod answers per package (slug + kind); a slug
+    // installed as two kinds is updated per kind by its own door, but listed once.
+    let checks = dedupeBySlug(checksFromStandings(standings));
     const entryBySlug = new Map(cat.entries.map((e) => [e.slug, e]));
     const explicitSlugs = !!slugsArg && slugsArg.length > 0;
     let unknownSlugs = [];
@@ -1679,8 +1723,6 @@ export async function marketUpdate(slugsArg, opts) {
         if (noVersionInfo.length > 0) {
             log.dim(`${noVersionInfo.length} installed without a version stamp — can't check ${noVersionInfo.length === 1 ? "it" : "them"} for updates.`);
         }
-        if (degradedNote)
-            log.dim(degradedNote);
     }
     // What the JSON carries for the new facts: per slug, the pod's data changes
     // (`null` = this pod sent none: an older pod) and the template lifecycle.
@@ -1722,7 +1764,10 @@ export async function marketUpdate(slugsArg, opts) {
         return;
     }
     if (!shouldApply) {
-        const steps = FLOW.afterMarketUpdateCheck(withUpdates.map((c) => c.slug));
+        // Next steps offer only what this command can run: a capability update
+        // (no CLI updater) is the person's act in pod admin, named once below.
+        const steps = FLOW.afterMarketUpdateCheck(cliUpdatableSlugs(withUpdates));
+        const personApplies = withUpdates.filter((c) => updateDoorFor(c.kind) === null).map((c) => c.slug);
         if (opts.json) {
             console.log(JSON.stringify({
                 checks,
@@ -1730,6 +1775,9 @@ export async function marketUpdate(slugsArg, opts) {
                 unknownSlugs,
                 applied: [],
                 nextSteps: steps,
+                ...(personApplies.length > 0
+                    ? { appliedInPodAdmin: { slugs: personApplies, where: marketUpdatesDoor(cfg.podUrl) } }
+                    : {}),
                 dataChanges: dataChangesJson,
                 templateLifecycle: lifecycleJson,
             }, null, 2));
@@ -1739,6 +1787,9 @@ export async function marketUpdate(slugsArg, opts) {
         if ([...previews.values()].some((pv) => (pv.changes?.length ?? 0) > 0)) {
             log.hint("Updates with data changes ask before they run. To agree up front: --accept-data-changes <opKey,…>  (or --yes for all listed)");
         }
+        if (personApplies.length > 0) {
+            log.hint(`${personApplies.join(", ")}: not updated by this command. ${marketUpdatesDoor(cfg.podUrl)}`);
+        }
         renderNextSteps(steps);
         return;
     }
@@ -1750,8 +1801,13 @@ export async function marketUpdate(slugsArg, opts) {
     for (const c of withUpdates) {
         const door = updateDoorFor(c.kind);
         if (door === null) {
-            if (!opts.json)
-                log.warn(`${c.slug} is a ${c.kind} — the pod has no per-package update for this kind, so it was not updated. Nothing was written.`);
+            if (!opts.json) {
+                // A capability update is a person's act on pod admin (the pod refuses
+                // an agent key there); any other kind here has no updater at all.
+                log.warn(c.kind === "capability"
+                    ? `${c.slug} is a capability — it was not updated here. Nothing was written. ${marketUpdatesDoor(cfg.podUrl)}`
+                    : `${c.slug} is a ${c.kind} — the pod has no per-package update for this kind, so it was not updated. Nothing was written.`);
+            }
             results.push({ slug: c.slug, outcome: "no-updater", status: "no-updater", warnings: [] });
             continue;
         }
@@ -1834,9 +1890,11 @@ export async function marketUpdate(slugsArg, opts) {
  * already-current, the `*-with-failures` and `"stamp-contradiction"` statuses
  * get their OWN bucket — a partial capability-seed failure or a stamp that
  * silently didn't take is never folded into a clean "updated" count.
- * `"timed-out"` is broken out from the generic `"failed"` bucket; everything
- * else (locked/proposed/fetch-failed/not-in-catalog/no-workspace/unknown)
- * rolls into "failed".
+ * `"timed-out"` is broken out from the generic `"failed"` bucket;
+ * `"proposed"`/`"awaiting-approval"` count as waiting for the person's
+ * approval (never failed); everything else
+ * (locked/fetch-failed/not-in-catalog/no-workspace/unknown) rolls into
+ * "failed".
  */
 export function summarizeApplyResults(results) {
     let updated = 0;
@@ -1886,7 +1944,7 @@ export function summarizeApplyResults(results) {
     }
     const parts = [`${updated} updated`, `${unchanged} already current`];
     if (proposed > 0)
-        parts.push(`${proposed} proposed (awaiting review)`);
+        parts.push(`${proposed} waiting for your approval`);
     // The vocabulary's `unfinished` ("Not finished"): one state, one name on
     // every surface — never "completed with failures" (review2 UX §1 #2).
     if (withFailures > 0)
@@ -1899,7 +1957,7 @@ export function summarizeApplyResults(results) {
         parts.push(`${needsConsent} waiting for your agreement to data changes`);
     const clean = withFailures === 0 && failed === 0 && timedOut === 0 && needsConsent === 0;
     // Proposed isn't a failure (never ⚠) but isn't live yet (not a bare ✓) —
-    // a distinct "→ awaiting review" marker keeps the summary honest.
+    // a distinct "→ waiting for your approval" marker keeps the summary honest.
     const marker = !clean ? "⚠" : proposed > 0 ? "→" : "✓";
     const color = !clean ? chalk.yellow : proposed > 0 ? chalk.cyan : chalk.green;
     return {
@@ -2389,7 +2447,7 @@ export async function marketInstalled(opts) {
     const entryBySlug = new Map(cat.entries.map((e) => [e.slug, e]));
     if (opts.layers) {
         const graph = await buildInstallationGraph(installedTemplates, cat, checks);
-        const steps = FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug));
+        const steps = FLOW.afterMarketInstalledCheck(cliUpdatableSlugs(rows));
         if (opts.json) {
             console.log(JSON.stringify({
                 nodes: [...graph.nodes.values()],
@@ -2416,7 +2474,7 @@ export async function marketInstalled(opts) {
     }
     if (opts.tree) {
         const { packages, leafRows } = await buildCompositionTrees(rows, cat, installedTemplates, workspaceCountBySlug);
-        const steps = FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug));
+        const steps = FLOW.afterMarketInstalledCheck(cliUpdatableSlugs(rows));
         if (opts.json) {
             console.log(JSON.stringify({
                 packages,
@@ -2476,7 +2534,7 @@ export async function marketInstalled(opts) {
         return;
     }
     if (opts.json) {
-        const steps = FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug));
+        const steps = FLOW.afterMarketInstalledCheck(cliUpdatableSlugs(rows));
         console.log(JSON.stringify({
             rows: rows.map((c) => {
                 const entry = entryBySlug.get(c.slug);
@@ -2594,7 +2652,7 @@ export async function marketInstalled(opts) {
         log.dim(degradedNote);
     if (!cat.loggedIn)
         log.dim("Not logged in — private template updates aren't visible. Run: synap login");
-    renderNextSteps(FLOW.afterMarketInstalledCheck(rows.filter((c) => c.updateAvailable).map((c) => c.slug)));
+    renderNextSteps(FLOW.afterMarketInstalledCheck(cliUpdatableSlugs(rows)));
 }
 /** Classify one workspace's attachment, reusing `computeUpdates`' drift verdict for the stamped case. */
 function classifyAttachment(ws, check) {