@tinkerlandai/indiana-cli 0.3.11 → 0.3.13

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.3.13 — 2026-10-26
+
+- Remove the `indiana iam` commands. IAM files are generated by the `@tinkerlandai/indiana-iam` build package; `indiana-iam validate` replaces `indiana iam check`.
+- Add scoped Funnel, Paywall and Coupon authoring commands with canonical schemas, local validation, previews and explicit authorization requirements.
+- Align bundled contracts, code-reference commands and error handling with the current management architecture.
+
 ## 0.3.11 — 2026-10-23
 
 - Preserve the full capability catalog during npm release verification, with an explicit failure when command output exceeds its bound.
@@ -16,6 +22,7 @@
 
 ## 0.3.8 — 2026-10-23
 
+- Recover a committed logout after a lost response using the original native refresh proof. Remove only the matching local profile after server confirmation; retain credentials on an uncertain or mismatched result. Requires the matching Admin deployment.
 - Connect `growth experiments bandit-history list`, `growth metrics event-suggestions list` and `snapshots dimensions` through the management catalog. They and `growth experiments time-series` request `platform.read` plus `analytics.read` in the same environment. Requires the matching Admin deployment.
 - Report Screen preview shares and the App Manifest preview as `BROWSER_ONLY`; they stay in the browser. App Manifest and consent operations remain unavailable until delegated access is connected.
 

package/README.md

@@ -1,6 +1,6 @@
 # Indiana CLI
 
-Indiana CLI **0.3.11**, Node.js 22+. The executable is `indiana`. CLI versions are independent of the Customer SDKs.
+Indiana CLI **0.3.13**, Node.js 22+. The executable is `indiana`. CLI versions are independent of the Customer SDKs.
 
 Install the public npm package:
 
@@ -11,7 +11,7 @@ indiana doctor --server https://tinker.cash --json
 indiana login --server https://tinker.cash
 ```
 
-For a reproducible installation, use `npm install -g @tinkerlandai/indiana-cli@0.3.11`. Uninstall with `npm uninstall -g @tinkerlandai/indiana-cli`. Node.js 22+ must be on PATH; the package includes the `indiana` command and npm installs its runtime dependencies.
+For a reproducible installation, use `npm install -g @tinkerlandai/indiana-cli@0.3.13`. Uninstall with `npm uninstall -g @tinkerlandai/indiana-cli`. Node.js 22+ must be on PATH; the package includes the `indiana` command and npm installs its runtime dependencies.
 
 The existing website installation channel remains available on macOS and Linux:
 
@@ -51,7 +51,7 @@ Better Auth in the Indiana Admin issues and refreshes CLI tokens through Authori
 
 Implemented remote command surfaces include `login`, `whoami`, `auth status`, `logout`, `projects list`, and scoped `coupons`, `rewards` and `referral-programs` catalog/code/lifecycle operations. Their execution still requires current server registration, membership, role/App access and explicit resource grants. No local command proves those permissions.
 
-`coupons subscription`, `coupons subscription-state` and `coupons subscription-recover` are unavailable in the current management runtime. They return `CAPABILITY_UNAVAILABLE` (exit 7) before reading files or credentials or making requests. `capabilities` reports these separately; `--only-supported` excludes them. Customer/Feature/Product management and Offering/Paywall/Funnel authoring now have connected scoped operations. Scoped balances, usage, ledger, billing controls, analytics and Sandbox Stripe refunds also use the original Console handlers. Organization governance, GrowthBook administration, profile images and compatible integration configuration use explicit layered grants. Of 110 Console entries, 107 are connected; Apple/Google provider configuration and native Product bindings remain deferred. Inspect the operation catalog for exact availability; it does not certify every provider/business branch.
+`coupons subscription`, `coupons subscription-state` and `coupons subscription-recover` are unavailable in the current management runtime. They return `CAPABILITY_UNAVAILABLE` (exit 7) before reading files or credentials or making requests. `capabilities` reports these separately; `--only-supported` excludes them. Customer/Feature/Product management and Offering/Paywall/Funnel authoring now have connected scoped operations. Scoped balances, usage, ledger, billing controls, analytics and Sandbox Stripe refunds also use the original Console handlers. Organization governance, GrowthBook administration, profile images and compatible integration configuration use explicit layered grants. The generated catalog records connected operations individually; App Manifest/consent scope remains unconnected, browser-only previews stay unavailable, and Apple/Google provider configuration and native Product bindings remain deferred. Inspect the operation catalog for exact availability; it does not certify every provider/business branch.
 
 Production OAuth and the scoped business slice are deployed at `https://tinker.cash`; `https://dev.tinker.cash` remains the separate Indiana-test deployment. Credentials and native OAuth clients are origin-bound and cannot be shared between them. See production acceptance for exact verified coverage and remaining gaps.
 
@@ -62,11 +62,60 @@ governance or same-user actions. `--scopes-file <path>` requests several exact l
 in one immutable consent. Environment remains the default and preserves existing grants.
 App configuration covers all App environments; selected-environment analysis still
 requires its separate resource grants. See [layered authorization](../../docs/cli-layered-authorization.md)
-for dependencies, tested scope and release receipts. Invitation creation/resending
+for grant dependencies and scope. Invitation creation/resending
 sends no email unless `--send-email` is explicitly supplied.
 
 ## Business operations
 
+### Marketing authoring
+
+Funnel, Paywall and Coupon authoring reuse the existing scoped Console/management services. CLI 0.3.13 exposes explicit draft commands, canonical schemas and verification limits. Older installations need an upgrade to use these commands.
+
+```sh
+indiana funnels describe --json
+indiana paywalls describe --schema document --json
+indiana paywalls describe --schema preview --json
+indiana coupons describe --schema write --json
+indiana coupons describe --schema read-result --json
+```
+
+`describe` is offline. `document` describes the file accepted by create/save/validate, `write` describes the full action accepted by the existing `apply` command, and `preview` describes that resource's preview file. `read-result` and `write-result` describe successful command output under `data`. JSON Schema covers shape; canonical parsers also run graph, binding, date and other refinements. Local input failures include field paths for correction without echoing the document.
+
+`authorization.stages` lists the existing grants required for reads, writes, saved checks and previews; `authorization.requirements` combines them without duplicates. Server simulations also read their Product, Feature and Coupon dependencies; Funnel simulation additionally requires analytics access. Bind these explicit requirements to the exact Org/App/environment when requesting consent. Local Coupon preview needs no grant.
+
+```sh
+indiana funnels create --file funnel.json --name "Welcome" --request-id <uuid> --json
+indiana funnels get <id> --json
+indiana funnels save <id> --revision <revision> --name "Welcome" --file funnel.json --json
+indiana funnels validate --file funnel.json --mode publish --json
+indiana funnels check <id> --revision <revision> --json
+indiana funnels preview --file funnel-preview-request.json --json
+indiana funnels publish <id> --revision <revision> --json
+
+indiana paywalls create --file paywall.json --json
+indiana paywalls get <id> --json
+indiana paywalls save <id> --revision <revision> --file paywall.json --json
+indiana paywalls check <id> --revision <revision> --json
+indiana paywalls preview --file paywall-preview-request.json --json
+indiana paywalls publish <id> --revision <revision> --json
+
+indiana coupons validate --file coupon.json --json
+indiana coupons preview --file coupon.json --locale en --json
+indiana coupons create --file coupon.json --json
+indiana coupons get <id> --json
+indiana coupons check <id> --revision <revision> --file proposed-coupon.json --json
+indiana coupons save <id> --revision <revision> --file coupon.json --json
+indiana coupons activate <id> --revision <revision> --json
+```
+
+Funnel/Paywall `get` returns the full record; Coupon `get` retains its existing collection response, with the input document at `rows[0].input`. Create/save files contain a document, without scope fields or an action wrapper. Funnel creation requires a caller-owned stable request UUID. Save and publish/activate require the exact last-read revision. Paywall/Coupon creation has no creation-request contract: reconcile an uncertain result by reading before attempting another creation. Mutations are never automatically retried.
+
+Funnel/Coupon `check` reads the saved revision and validates its canonical structure; it does not certify remote reference availability or database publication guards. Coupon `check --file` also applies the shared lifecycle rules to proposed edits, including locked commercial terms after activation. Paywall `check` runs the existing server publish preflight, returns individual blockers and exits 2 when blocked. Every check refuses a different saved revision with exit 5. Publish/activate still performs current native role, scope, lifecycle and business checks.
+
+Funnel preview accepts the canonical single-session preview request, including explicit simulated scenario, stable preview ID and journal. The retained `funnels preview query` command supports the original transport. Paywall preview accepts `{ "doc": <Paywall document>, "locale": "en", "currency": "USD" }`; currency is optional and scope is supplied by the management adapter. Both return simulation JSON, without starting a customer Run, accepting payment, granting a Coupon, minting a public link or opening a browser. Coupon preview is local localized terms, not customer eligibility or a quote. Design previews, SDK runtime execution and financial acceptance remain separate.
+
+Use scoped `templates list` to discover authored designs and `code pull/check/diff/push` to edit their sources. Paywalls pin published Offering Versions; template copy and draft saves do not publish or alter Product terms. Coupon presentation is authored in the consuming screen. Remote authoring commands require the approved exact App/environment and resource permissions, independently of offline discovery and validation.
+
 ### Code reference scanning
 
 CLI **0.3.5** adds a CI surface using a dedicated App/environment API Key, independently of personal OAuth management sessions. The target server must have the matching code-reference API and database migration before a repository can report.
@@ -96,11 +145,13 @@ Scan evidence describes configured static scope only. Clean up old branches, mer
 
 ### Independent screen sources (unreleased source)
 
-The current source adds `indiana code` for Paywall, Popup and Page designs. These commands require a source build and the matching Web management adapter; the scoped public 0.3.5 scanner release does not include them; they remain pending a separate release.
+The current source adds `indiana code` for Paywall, Popup, Page and Banner designs. These commands require a source build and the matching Web management adapter; the scoped public 0.3.5 scanner release does not include them; they remain pending a separate release.
 
 ```sh
 indiana code pull paywall/<uuid> --out ./template
-indiana code pull funnel/<uuid>/screen/<screen-id> --out ./popup
+indiana code pull popup/<uuid> --out ./popup
+indiana code pull page/<uuid> --out ./page
+indiana code pull banner/<uuid> --out ./banner
 indiana code pull template/<uuid> --out ./private-template
 indiana code check ./template --json
 indiana code diff ./template --json
@@ -159,9 +210,9 @@ Scope priority is explicit flags → `indiana.config.json` → selected profile.
 
 Rename existing `grow.config.json` files to `indiana.config.json`; the JSON format is unchanged.
 
-The user directory defaults to `.config/indiana` (Windows: `LOCALAPPDATA/Indiana/cli`). Override with **`INDIANA_CLI_CONFIG_DIR`**; 0.2.0 no longer reads `GROW_CLI_CONFIG_DIR`. Existing configuration formats are unchanged. Credentials default to the system keychain, with no implicit file fallback. Explicit `--credential-store file` requires POSIX 0600 files/0700 directories and is unavailable on Windows. Locks and atomic replacement protect writes. New locks record the local owner process and recover automatically only after that process is confirmed stopped. A live PID, an unverifiable owner or another host keeps the lock occupied regardless of age. Older versions left empty `.lock` files without ownership metadata: stop all Indiana CLI commands using that configuration, then remove only the reported `.lock` file and retry; preserve the configuration and credentials. This recovery is unreleased source until a new CLI distribution is published.
+The user directory defaults to `.config/indiana` (Windows: `LOCALAPPDATA/Indiana/cli`). Override with **`INDIANA_CLI_CONFIG_DIR`**; 0.2.0 no longer reads `GROW_CLI_CONFIG_DIR`. Existing configuration formats are unchanged. Credentials default to the system keychain, with no implicit file fallback. Explicit `--credential-store file` requires POSIX 0600 files/0700 directories and is unavailable on Windows. Locks and atomic replacement protect writes. New locks record the local owner process and recover automatically only after that process is confirmed stopped. A live PID, an unverifiable owner or another host keeps the lock occupied regardless of age. Older versions left empty `.lock` files without ownership metadata: stop all Indiana CLI commands using that configuration, then remove only the reported `.lock` file and retry; preserve the configuration and credentials.
 
-Credentials are saved only after the exact requested authorization is active. Refresh preserves user/client/session/grant identity and requires an active, unexpired grant. whoami verifies the current Supabase user/session and active grant without outputting tokens. Logout without a saved credential succeeds without a network call. With a saved credential, logout confirms revocation of the exact Indiana authorization and termination of its own Supabase Auth session (`scope=local`) before removing local credentials. Both results are reported separately. A failed or incomplete response retains credentials for retry; termination can refresh the same native session after the grant is revoked, without enabling business commands. `logout --local` explicitly leaves both server authorization and native session unchanged. Server and CLI support for this logout contract must be released together; older servers cannot confirm native cleanup.
+Credentials are saved only after the exact requested authorization is active. Refresh preserves user/client/session/grant identity and requires an active, unexpired grant. whoami verifies the current native Better Auth user/session and active grant without outputting tokens. Logout without a saved credential succeeds without a network call. With a saved credential, logout confirms revocation of the exact Indiana authorization and termination of its own native Auth session before removing local credentials. Both results are reported separately. A failed or incomplete response retains credentials for retry; termination can refresh the same native session after the grant is revoked, without enabling business commands. `logout --local` explicitly leaves both server authorization and native session unchanged. Server and CLI support for this logout contract must be released together; older servers cannot confirm native cleanup.
 
 ## Local document tools
 
@@ -187,7 +238,7 @@ The current source distinguishes transport failures from HTTP responses in `doct
 
 `doctor` identifies whether management metadata or OAuth discovery failed. Check the hostname/DNS for `dns`, host/port and proxy address for `connection_refused`, routing/VPN/firewall for `unreachable`, and the system clock/certificate trust for `tls`. HTTP 407 indicates proxy authentication; an unclassified proxy tunnel failure can remain `unknown`. If your network requires a proxy, check `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY`. On Node.js 22.21+ within 22.x or Node.js 24+, `NODE_USE_ENV_PROXY=1 indiana doctor --json` enables environment proxies for that invocation. This switch does not create a proxy or configure its address, and the CLI never changes shell configuration automatically.
 
-Read-only transport failures use `check_availability`; writes and OAuth token exchanges use `recover_operation` with `retryable: false`, because the remote operation may have completed. Inspect the original operation/session before retrying. A network failure during refresh preserves the saved credential and does not by itself require deleting it or logging in again. Genuine HTTP service failures retain `SERVICE_UNAVAILABLE` with their status and available request ID. These diagnostics are unreleased source until a new CLI distribution is published.
+Read-only transport failures use `check_availability`; writes and OAuth token exchanges use `recover_operation` with `retryable: false`, because the remote operation may have completed. Inspect the original operation/session before retrying. A network failure during refresh preserves the saved credential and does not by itself require deleting it or logging in again. Genuine HTTP service failures retain `SERVICE_UNAVAILABLE` with their status and available request ID.
 
 | Exit | Meaning                                                   |
 | ---- | --------------------------------------------------------- |

package/dist/{chunk-A5HJK2OY.js → chunk-VEDX3X5S.js}

@@ -121,6 +121,7 @@ var localErrorRecovery = {
   CONFIGURATION_DISPOSED: "reload_state",
   UNSUPPORTED_SCHEMA: "upgrade_sdk",
   FUNNEL_STOPPED: "check_availability",
+  PAYWALL_UNAVAILABLE: "check_availability",
   EVALUATION_MODE: "reload_state",
   SERVER_REQUIRED: "fix_request",
   STICKY_SAVE_FAILED: "retry_same_request",
@@ -263,10 +264,17 @@ function cliErrorCause(error) {
 }
 function schemaError(error, code, message) {
   if (error instanceof ZodError)
-    return new CliError(code, message, 2, {
-      fields: error.issues.slice(0, 50).map(({ code: code2, path, message: message2 }) => ({ code: code2, path, message: message2 })),
-      truncated: error.issues.length > 50
-    });
+    return new CliError(
+      code,
+      message,
+      2,
+      {
+        fields: error.issues.slice(0, 50).map(({ code: code2, path, message: message2 }) => ({ code: code2, path, message: message2 })),
+        truncated: error.issues.length > 50
+      },
+      false,
+      { recovery: "fix_request" }
+    );
   return error;
 }
 function errorResult(error) {

package/dist/{io-COF7BMWZ.js → io-KD7VVAPB.js}

@@ -1,7 +1,7 @@
 import {
   readJsonFile,
   readJsonStream
-} from "./chunk-A5HJK2OY.js";
+} from "./chunk-VEDX3X5S.js";
 export {
   readJsonFile,
   readJsonStream