@tinkerlandai/indiana-cli 0.3.11 → 0.3.14

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.3.14 — 2026-10-29
+
+- Funnel commands accept only schema 5 author drafts; `funnels create` writes schema 5. Published Funnel snapshots (execution format) are not accepted as input.
+- Preserve rotated credentials as pending until the original device authorization is verified, allowing recovery after an interrupted authorization read.
+- Report management moves to an HTTPS subdomain with `MANAGEMENT_ORIGIN_MOVED` and the new server origin so users can sign in again explicitly.
+- Remove retired subscription discount command stubs and refresh bundled management contracts.
+
+## 0.3.13 — 2026-10-26
+
+- Remove the `indiana iam` commands. IAM files are generated by the `@tinkerlandai/indiana-iam` build package; `indiana-iam validate` replaces `indiana iam check`.
+- Add scoped Funnel, Paywall and Coupon authoring commands with canonical schemas, local validation, previews and explicit authorization requirements.
+- Align bundled contracts, code-reference commands and error handling with the current management architecture.
+
 ## 0.3.11 — 2026-10-23
 
 - Preserve the full capability catalog during npm release verification, with an explicit failure when command output exceeds its bound.
@@ -16,6 +29,7 @@
 
 ## 0.3.8 — 2026-10-23
 
+- Recover a committed logout after a lost response using the original native refresh proof. Remove only the matching local profile after server confirmation; retain credentials on an uncertain or mismatched result. Requires the matching Admin deployment.
 - Connect `growth experiments bandit-history list`, `growth metrics event-suggestions list` and `snapshots dimensions` through the management catalog. They and `growth experiments time-series` request `platform.read` plus `analytics.read` in the same environment. Requires the matching Admin deployment.
 - Report Screen preview shares and the App Manifest preview as `BROWSER_ONLY`; they stay in the browser. App Manifest and consent operations remain unavailable until delegated access is connected.
 

package/README.md

@@ -1,6 +1,6 @@
 # Indiana CLI
 
-Indiana CLI **0.3.11**, Node.js 22+. The executable is `indiana`. CLI versions are independent of the Customer SDKs.
+Indiana CLI **0.3.14**, Node.js 22+. The executable is `indiana`. CLI versions are independent of the Customer SDKs.
 
 Install the public npm package:
 
@@ -11,7 +11,7 @@ indiana doctor --server https://tinker.cash --json
 indiana login --server https://tinker.cash
 ```
 
-For a reproducible installation, use `npm install -g @tinkerlandai/indiana-cli@0.3.11`. Uninstall with `npm uninstall -g @tinkerlandai/indiana-cli`. Node.js 22+ must be on PATH; the package includes the `indiana` command and npm installs its runtime dependencies.
+For a reproducible installation, use `npm install -g @tinkerlandai/indiana-cli@0.3.14`. Uninstall with `npm uninstall -g @tinkerlandai/indiana-cli`. Node.js 22+ must be on PATH; the package includes the `indiana` command and npm installs its runtime dependencies.
 
 The existing website installation channel remains available on macOS and Linux:
 
@@ -51,7 +51,7 @@ Better Auth in the Indiana Admin issues and refreshes CLI tokens through Authori
 
 Implemented remote command surfaces include `login`, `whoami`, `auth status`, `logout`, `projects list`, and scoped `coupons`, `rewards` and `referral-programs` catalog/code/lifecycle operations. Their execution still requires current server registration, membership, role/App access and explicit resource grants. No local command proves those permissions.
 
-`coupons subscription`, `coupons subscription-state` and `coupons subscription-recover` are unavailable in the current management runtime. They return `CAPABILITY_UNAVAILABLE` (exit 7) before reading files or credentials or making requests. `capabilities` reports these separately; `--only-supported` excludes them. Customer/Feature/Product management and Offering/Paywall/Funnel authoring now have connected scoped operations. Scoped balances, usage, ledger, billing controls, analytics and Sandbox Stripe refunds also use the original Console handlers. Organization governance, GrowthBook administration, profile images and compatible integration configuration use explicit layered grants. Of 110 Console entries, 107 are connected; Apple/Google provider configuration and native Product bindings remain deferred. Inspect the operation catalog for exact availability; it does not certify every provider/business branch.
+Customer/Feature/Product management and Offering/Paywall/Funnel authoring now have connected scoped operations. Scoped balances, usage, ledger, billing controls, analytics and Sandbox Stripe refunds also use the original Console handlers. Organization governance, experimentation administration, profile images and compatible integration configuration use explicit layered grants. The generated catalog records connected operations individually; App Manifest/consent scope remains unconnected, browser-only previews stay unavailable, and Apple/Google provider configuration and native Product bindings remain deferred. Inspect the operation catalog for exact availability; it does not certify every provider/business branch.
 
 Production OAuth and the scoped business slice are deployed at `https://tinker.cash`; `https://dev.tinker.cash` remains the separate Indiana-test deployment. Credentials and native OAuth clients are origin-bound and cannot be shared between them. See production acceptance for exact verified coverage and remaining gaps.
 
@@ -62,11 +62,60 @@ governance or same-user actions. `--scopes-file <path>` requests several exact l
 in one immutable consent. Environment remains the default and preserves existing grants.
 App configuration covers all App environments; selected-environment analysis still
 requires its separate resource grants. See [layered authorization](../../docs/cli-layered-authorization.md)
-for dependencies, tested scope and release receipts. Invitation creation/resending
+for grant dependencies and scope. Invitation creation/resending
 sends no email unless `--send-email` is explicitly supplied.
 
 ## Business operations
 
+### Marketing authoring
+
+Funnel, Paywall and Coupon authoring reuse the existing scoped Console/management services. CLI 0.3.13 exposes explicit draft commands, canonical schemas and verification limits. Older installations need an upgrade to use these commands.
+
+```sh
+indiana funnels describe --json
+indiana paywalls describe --schema document --json
+indiana paywalls describe --schema preview --json
+indiana coupons describe --schema write --json
+indiana coupons describe --schema read-result --json
+```
+
+`describe` is offline. `document` describes the file accepted by create/save/validate, `write` describes the full action accepted by the existing `apply` command, and `preview` describes that resource's preview file. `read-result` and `write-result` describe successful command output under `data`. JSON Schema covers shape; canonical parsers also run graph, binding, date and other refinements. Local input failures include field paths for correction without echoing the document.
+
+`authorization.stages` lists the existing grants required for reads, writes, saved checks and previews; `authorization.requirements` combines them without duplicates. Server simulations also read their Product, Feature and Coupon dependencies; Funnel simulation additionally requires analytics access. Bind these explicit requirements to the exact Org/App/environment when requesting consent. Local Coupon preview needs no grant.
+
+```sh
+indiana funnels create --file funnel.json --name "Welcome" --request-id <uuid> --json
+indiana funnels get <id> --json
+indiana funnels save <id> --revision <revision> --name "Welcome" --file funnel.json --json
+indiana funnels validate --file funnel.json --mode publish --json
+indiana funnels check <id> --revision <revision> --json
+indiana funnels preview --file funnel-preview-request.json --json
+indiana funnels publish <id> --revision <revision> --json
+
+indiana paywalls create --file paywall.json --json
+indiana paywalls get <id> --json
+indiana paywalls save <id> --revision <revision> --file paywall.json --json
+indiana paywalls check <id> --revision <revision> --json
+indiana paywalls preview --file paywall-preview-request.json --json
+indiana paywalls publish <id> --revision <revision> --json
+
+indiana coupons validate --file coupon.json --json
+indiana coupons preview --file coupon.json --locale en --json
+indiana coupons create --file coupon.json --json
+indiana coupons get <id> --json
+indiana coupons check <id> --revision <revision> --file proposed-coupon.json --json
+indiana coupons save <id> --revision <revision> --file coupon.json --json
+indiana coupons activate <id> --revision <revision> --json
+```
+
+Funnel/Paywall `get` returns the full record; Coupon `get` retains its existing collection response, with the input document at `rows[0].input`. Create/save files contain a document, without scope fields or an action wrapper. Funnel creation requires a caller-owned stable request UUID. Save and publish/activate require the exact last-read revision. Paywall/Coupon creation has no creation-request contract: reconcile an uncertain result by reading before attempting another creation. Mutations are never automatically retried.
+
+Funnel/Coupon `check` reads the saved revision and validates its canonical structure; it does not certify remote reference availability or database publication guards. Coupon `check --file` also applies the shared lifecycle rules to proposed edits, including locked commercial terms after activation. Paywall `check` runs the existing server publish preflight, returns individual blockers and exits 2 when blocked. Every check refuses a different saved revision with exit 5. Publish/activate still performs current native role, scope, lifecycle and business checks.
+
+Funnel preview accepts the canonical single-session preview request, including explicit simulated scenario, stable preview ID and journal. The retained `funnels preview query` command supports the original transport. Paywall preview accepts `{ "doc": <Paywall document>, "locale": "en", "currency": "USD" }`; currency is optional and scope is supplied by the management adapter. Both return simulation JSON, without starting a customer Run, accepting payment, granting a Coupon, minting a public link or opening a browser. Coupon preview is local localized terms, not customer eligibility or a quote. Design previews, SDK runtime execution and financial acceptance remain separate.
+
+Use scoped `templates list` to discover authored designs and `code pull/check/diff/push` to edit their sources. Paywalls pin published Offering Versions; template copy and draft saves do not publish or alter Product terms. Coupon presentation is authored in the consuming screen. Remote authoring commands require the approved exact App/environment and resource permissions, independently of offline discovery and validation.
+
 ### Code reference scanning
 
 CLI **0.3.5** adds a CI surface using a dedicated App/environment API Key, independently of personal OAuth management sessions. The target server must have the matching code-reference API and database migration before a repository can report.
@@ -96,11 +145,13 @@ Scan evidence describes configured static scope only. Clean up old branches, mer
 
 ### Independent screen sources (unreleased source)
 
-The current source adds `indiana code` for Paywall, Popup and Page designs. These commands require a source build and the matching Web management adapter; the scoped public 0.3.5 scanner release does not include them; they remain pending a separate release.
+The current source adds `indiana code` for Paywall, Popup, Page and Banner designs. These commands require a source build and the matching Web management adapter; the scoped public 0.3.5 scanner release does not include them; they remain pending a separate release.
 
 ```sh
 indiana code pull paywall/<uuid> --out ./template
-indiana code pull funnel/<uuid>/screen/<screen-id> --out ./popup
+indiana code pull popup/<uuid> --out ./popup
+indiana code pull page/<uuid> --out ./page
+indiana code pull banner/<uuid> --out ./banner
 indiana code pull template/<uuid> --out ./private-template
 indiana code check ./template --json
 indiana code diff ./template --json
@@ -109,7 +160,7 @@ indiana code push ./template --json
 
 Use a new output directory. `indiana.source.json` freezes the target, App/environment, revision and baseline; `screen.json` holds the complete structured design and copy. HTML/CSS contents live under `html/<node-id>/<locale>.html` and `html/<node-id>/style.css`, with empty declarations in `screen.json`. Edit these files with your editor or AI agent. Exported JSON bundles from the Web editor are also accepted by check/diff/push. The Web editor imports either a bundle or the source directory, with a review before applying changes.
 
-Check and diff are offline; remote guards still apply when pushing. Pull requires `platform.read`; push requires `platform.write` and the existing native authoring role. Push saves a draft with its original revision, preserving all other Paywall/Funnel configuration. A template target creates a private copy. A revision conflict preserves local files. Successful pushes update the local baseline while retaining working files, including edits made during the request; server sanitization differences remain visible in the next diff. No command publishes, watches files, runs a preview server or stores credentials in a source package.
+Check and diff are offline; remote guards still apply when pushing. Pull requires `platform.read`; push requires `platform.write` and the existing native authoring role. Push saves a draft with its original revision, preserving the target's other configuration. A template target creates a private copy. A revision conflict preserves local files. Successful pushes update the local baseline while retaining working files, including edits made during the request; server sanitization differences remain visible in the next diff. No command publishes, watches files, runs a preview server or stores credentials in a source package.
 
 ```sh
 indiana operations list --available --json
@@ -159,9 +210,9 @@ Scope priority is explicit flags → `indiana.config.json` → selected profile.
 
 Rename existing `grow.config.json` files to `indiana.config.json`; the JSON format is unchanged.
 
-The user directory defaults to `.config/indiana` (Windows: `LOCALAPPDATA/Indiana/cli`). Override with **`INDIANA_CLI_CONFIG_DIR`**; 0.2.0 no longer reads `GROW_CLI_CONFIG_DIR`. Existing configuration formats are unchanged. Credentials default to the system keychain, with no implicit file fallback. Explicit `--credential-store file` requires POSIX 0600 files/0700 directories and is unavailable on Windows. Locks and atomic replacement protect writes. New locks record the local owner process and recover automatically only after that process is confirmed stopped. A live PID, an unverifiable owner or another host keeps the lock occupied regardless of age. Older versions left empty `.lock` files without ownership metadata: stop all Indiana CLI commands using that configuration, then remove only the reported `.lock` file and retry; preserve the configuration and credentials. This recovery is unreleased source until a new CLI distribution is published.
+The user directory defaults to `.config/indiana` (Windows: `LOCALAPPDATA/Indiana/cli`). Override with **`INDIANA_CLI_CONFIG_DIR`**; 0.2.0 no longer reads `GROW_CLI_CONFIG_DIR`. Existing configuration formats are unchanged. Credentials default to the system keychain, with no implicit file fallback. Explicit `--credential-store file` requires POSIX 0600 files/0700 directories and is unavailable on Windows. Locks and atomic replacement protect writes. New locks record the local owner process and recover automatically only after that process is confirmed stopped. A live PID, an unverifiable owner or another host keeps the lock occupied regardless of age. Older versions left empty `.lock` files without ownership metadata: stop all Indiana CLI commands using that configuration, then remove only the reported `.lock` file and retry; preserve the configuration and credentials.
 
-Credentials are saved only after the exact requested authorization is active. Refresh preserves user/client/session/grant identity and requires an active, unexpired grant. whoami verifies the current Supabase user/session and active grant without outputting tokens. Logout without a saved credential succeeds without a network call. With a saved credential, logout confirms revocation of the exact Indiana authorization and termination of its own Supabase Auth session (`scope=local`) before removing local credentials. Both results are reported separately. A failed or incomplete response retains credentials for retry; termination can refresh the same native session after the grant is revoked, without enabling business commands. `logout --local` explicitly leaves both server authorization and native session unchanged. Server and CLI support for this logout contract must be released together; older servers cannot confirm native cleanup.
+Credentials are saved only after the exact requested authorization is active. Refresh preserves user/client/session/grant identity and requires an active, unexpired grant. whoami verifies the current native Better Auth user/session and active grant without outputting tokens. Logout without a saved credential succeeds without a network call. With a saved credential, logout confirms revocation of the exact Indiana authorization and termination of its own native Auth session before removing local credentials. Both results are reported separately. A failed or incomplete response retains credentials for retry; termination can refresh the same native session after the grant is revoked, without enabling business commands. `logout --local` explicitly leaves both server authorization and native session unchanged. Server and CLI support for this logout contract must be released together; older servers cannot confirm native cleanup.
 
 ## Local document tools
 
@@ -173,7 +224,7 @@ indiana offerings diff --against before.json --file after.json --json
 cat funnel.json | indiana funnels validate --file - --json
 ```
 
-Funnel input is the current editable draft; publish mode uses its publication-structure validator rather than the immutable delivery snapshot schema. Paywall input uses its current document schema, including the required published Offering reference for publication. Offering input is exactly `{ lookupKey, displayName, items, metadata }`: Product leaves at levels 1–3, groups at 1–2, at most 20 distinct Products, and empty groups only in draft mode. Offering has no invented schemaVersion or Package wrapper.
+Funnel input is the current editable format-5 draft: screens choose Page/Popup content versions or Paywall Versions, and the compiled delivery snapshot with embedded screens is not accepted. Publish mode uses the draft's publication-structure validator, which also requires each Page/Popup choice to pin a version. Paywall input uses its current document schema, including the required published Offering reference for publication. Offering input is exactly `{ lookupKey, displayName, items, metadata }`: Product leaves at levels 1–3, groups at 1–2, at most 20 distinct Products, and empty groups only in draft mode. Offering has no invented schemaVersion or Package wrapper.
 
 All inputs use strict UTF-8/JSON and the existing 1,000,000-byte document budget. Validation reports `validation: local` and `serverChecks: not_run`; Product existence, Offering terms/membership, permissions and publication require the server. Diff emits escaped JSON Pointers and hashes, omits values, and caps displayed changes at 100 while preserving total/truncated counts.
 
@@ -187,7 +238,7 @@ The current source distinguishes transport failures from HTTP responses in `doct
 
 `doctor` identifies whether management metadata or OAuth discovery failed. Check the hostname/DNS for `dns`, host/port and proxy address for `connection_refused`, routing/VPN/firewall for `unreachable`, and the system clock/certificate trust for `tls`. HTTP 407 indicates proxy authentication; an unclassified proxy tunnel failure can remain `unknown`. If your network requires a proxy, check `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY`. On Node.js 22.21+ within 22.x or Node.js 24+, `NODE_USE_ENV_PROXY=1 indiana doctor --json` enables environment proxies for that invocation. This switch does not create a proxy or configure its address, and the CLI never changes shell configuration automatically.
 
-Read-only transport failures use `check_availability`; writes and OAuth token exchanges use `recover_operation` with `retryable: false`, because the remote operation may have completed. Inspect the original operation/session before retrying. A network failure during refresh preserves the saved credential and does not by itself require deleting it or logging in again. Genuine HTTP service failures retain `SERVICE_UNAVAILABLE` with their status and available request ID. These diagnostics are unreleased source until a new CLI distribution is published.
+Read-only transport failures use `check_availability`; writes and OAuth token exchanges use `recover_operation` with `retryable: false`, because the remote operation may have completed. Inspect the original operation/session before retrying. A network failure during refresh preserves the saved credential and does not by itself require deleting it or logging in again. Genuine HTTP service failures retain `SERVICE_UNAVAILABLE` with their status and available request ID.
 
 | Exit | Meaning                                                   |
 | ---- | --------------------------------------------------------- |
@@ -207,7 +258,7 @@ See [CHANGELOG](CHANGELOG.md), [architecture design](../../docs/cli-management-d
 
 ## Configuration, results and finance reads
 
-The current source adds 28 finite GrowthBook read models to `capabilities.growthReaders`, each with `list` and `get <id>` aliases. For example:
+The current source adds 28 finite experimentation read models to `capabilities.growthReaders`, each with `list` and `get <id>` aliases. For example:
 
 ```sh
 indiana growth features list --query limit=25 --json
@@ -228,7 +279,7 @@ indiana events list --query name=payment.failed --json
 
 Configuration requires App `platform.read`. Environment results additionally require the exact environment's `platform.read` and `analytics.read`. A write grant implies read only while the original grant remains valid under the current native role. Private objects retain their original ownership/share rules. The finite reader removes configuration analysis summaries and Data Source connection secrets, without expanding direct OAuth table access.
 
-GrowthBook lists return `{resource, rows, ids, nextCursor}`. Pass the unchanged `nextCursor` as `--query after=...`; default page size is 25, maximum 100, and a response-size boundary can end a page earlier. `parentId` filters child collections. The parallel `ids` array supplies the exact identity for each row, including collision-free composite revision/reference identities. Use `ids[n]` with `get` for `rows[n]`. Parent-filtered lists are the normal way to read those collections. Invoice pages keep their `after` cursor. Statement pages require the original `snapshotAt` plus all three cursor fields `afterAt`, `afterId`, `afterPosition`. Event pages require both `before` (timestamp) and `after` (event ID). Overview and event UTC date ranges are bounded to 90 days.
+Experimentation lists return `{resource, rows, ids, nextCursor}`. Pass the unchanged `nextCursor` as `--query after=...`; default page size is 25, maximum 100, and a response-size boundary can end a page earlier. `parentId` filters child collections. The parallel `ids` array supplies the exact identity for each row, including collision-free composite revision/reference identities. Use `ids[n]` with `get` for `rows[n]`. Parent-filtered lists are the normal way to read those collections. Invoice pages keep their `after` cursor. Statement pages require the original `snapshotAt` plus all three cursor fields `afterAt`, `afterId`, `afterPosition`. Event pages require both `before` (timestamp) and `after` (event ID). Overview and event UTC date ranges are bounded to 90 days.
 
 This source expansion requires the matching server/database reader release. Local capability discovery does not assert that an older deployed server contains it. Apple/Google configuration and bindings remain deferred; SDK runtime calls and retired coupon subscription commands are outside this expansion.
 

package/dist/{chunk-A5HJK2OY.js → chunk-HTY75R4M.js}

@@ -106,6 +106,7 @@ var localErrorRecovery = {
   SERVER_ONLY: "fix_request",
   PROTOCOL_MISMATCH: "upgrade_sdk",
   IDENTITY_CHANGED: "reload_state",
+  INVALID_STATE: "reload_state",
   EVENT_QUEUE_FULL: "retry_same_request",
   // The original command or decision still owns the outcome.
   COMMAND_PENDING: "recover_operation",
@@ -121,6 +122,7 @@ var localErrorRecovery = {
   CONFIGURATION_DISPOSED: "reload_state",
   UNSUPPORTED_SCHEMA: "upgrade_sdk",
   FUNNEL_STOPPED: "check_availability",
+  PAYWALL_UNAVAILABLE: "check_availability",
   EVALUATION_MODE: "reload_state",
   SERVER_REQUIRED: "fix_request",
   STICKY_SAVE_FAILED: "retry_same_request",
@@ -263,10 +265,17 @@ function cliErrorCause(error) {
 }
 function schemaError(error, code, message) {
   if (error instanceof ZodError)
-    return new CliError(code, message, 2, {
-      fields: error.issues.slice(0, 50).map(({ code: code2, path, message: message2 }) => ({ code: code2, path, message: message2 })),
-      truncated: error.issues.length > 50
-    });
+    return new CliError(
+      code,
+      message,
+      2,
+      {
+        fields: error.issues.slice(0, 50).map(({ code: code2, path, message: message2 }) => ({ code: code2, path, message: message2 })),
+        truncated: error.issues.length > 50
+      },
+      false,
+      { recovery: "fix_request" }
+    );
   return error;
 }
 function errorResult(error) {

package/dist/{io-COF7BMWZ.js → io-LMWZQURK.js}

@@ -1,7 +1,7 @@
 import {
   readJsonFile,
   readJsonStream
-} from "./chunk-A5HJK2OY.js";
+} from "./chunk-HTY75R4M.js";
 export {
   readJsonFile,
   readJsonStream