@tinkerlandai/indiana-cli 0.3.13 → 0.3.14

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.3.14 — 2026-10-29
+
+- Funnel commands accept only schema 5 author drafts; `funnels create` writes schema 5. Published Funnel snapshots (execution format) are not accepted as input.
+- Preserve rotated credentials as pending until the original device authorization is verified, allowing recovery after an interrupted authorization read.
+- Report management moves to an HTTPS subdomain with `MANAGEMENT_ORIGIN_MOVED` and the new server origin so users can sign in again explicitly.
+- Remove retired subscription discount command stubs and refresh bundled management contracts.
+
 ## 0.3.13 — 2026-10-26
 
 - Remove the `indiana iam` commands. IAM files are generated by the `@tinkerlandai/indiana-iam` build package; `indiana-iam validate` replaces `indiana iam check`.

package/README.md

@@ -1,6 +1,6 @@
 # Indiana CLI
 
-Indiana CLI **0.3.13**, Node.js 22+. The executable is `indiana`. CLI versions are independent of the Customer SDKs.
+Indiana CLI **0.3.14**, Node.js 22+. The executable is `indiana`. CLI versions are independent of the Customer SDKs.
 
 Install the public npm package:
 
@@ -11,7 +11,7 @@ indiana doctor --server https://tinker.cash --json
 indiana login --server https://tinker.cash
 ```
 
-For a reproducible installation, use `npm install -g @tinkerlandai/indiana-cli@0.3.13`. Uninstall with `npm uninstall -g @tinkerlandai/indiana-cli`. Node.js 22+ must be on PATH; the package includes the `indiana` command and npm installs its runtime dependencies.
+For a reproducible installation, use `npm install -g @tinkerlandai/indiana-cli@0.3.14`. Uninstall with `npm uninstall -g @tinkerlandai/indiana-cli`. Node.js 22+ must be on PATH; the package includes the `indiana` command and npm installs its runtime dependencies.
 
 The existing website installation channel remains available on macOS and Linux:
 
@@ -51,7 +51,7 @@ Better Auth in the Indiana Admin issues and refreshes CLI tokens through Authori
 
 Implemented remote command surfaces include `login`, `whoami`, `auth status`, `logout`, `projects list`, and scoped `coupons`, `rewards` and `referral-programs` catalog/code/lifecycle operations. Their execution still requires current server registration, membership, role/App access and explicit resource grants. No local command proves those permissions.
 
-`coupons subscription`, `coupons subscription-state` and `coupons subscription-recover` are unavailable in the current management runtime. They return `CAPABILITY_UNAVAILABLE` (exit 7) before reading files or credentials or making requests. `capabilities` reports these separately; `--only-supported` excludes them. Customer/Feature/Product management and Offering/Paywall/Funnel authoring now have connected scoped operations. Scoped balances, usage, ledger, billing controls, analytics and Sandbox Stripe refunds also use the original Console handlers. Organization governance, GrowthBook administration, profile images and compatible integration configuration use explicit layered grants. The generated catalog records connected operations individually; App Manifest/consent scope remains unconnected, browser-only previews stay unavailable, and Apple/Google provider configuration and native Product bindings remain deferred. Inspect the operation catalog for exact availability; it does not certify every provider/business branch.
+Customer/Feature/Product management and Offering/Paywall/Funnel authoring now have connected scoped operations. Scoped balances, usage, ledger, billing controls, analytics and Sandbox Stripe refunds also use the original Console handlers. Organization governance, experimentation administration, profile images and compatible integration configuration use explicit layered grants. The generated catalog records connected operations individually; App Manifest/consent scope remains unconnected, browser-only previews stay unavailable, and Apple/Google provider configuration and native Product bindings remain deferred. Inspect the operation catalog for exact availability; it does not certify every provider/business branch.
 
 Production OAuth and the scoped business slice are deployed at `https://tinker.cash`; `https://dev.tinker.cash` remains the separate Indiana-test deployment. Credentials and native OAuth clients are origin-bound and cannot be shared between them. See production acceptance for exact verified coverage and remaining gaps.
 
@@ -160,7 +160,7 @@ indiana code push ./template --json
 
 Use a new output directory. `indiana.source.json` freezes the target, App/environment, revision and baseline; `screen.json` holds the complete structured design and copy. HTML/CSS contents live under `html/<node-id>/<locale>.html` and `html/<node-id>/style.css`, with empty declarations in `screen.json`. Edit these files with your editor or AI agent. Exported JSON bundles from the Web editor are also accepted by check/diff/push. The Web editor imports either a bundle or the source directory, with a review before applying changes.
 
-Check and diff are offline; remote guards still apply when pushing. Pull requires `platform.read`; push requires `platform.write` and the existing native authoring role. Push saves a draft with its original revision, preserving all other Paywall/Funnel configuration. A template target creates a private copy. A revision conflict preserves local files. Successful pushes update the local baseline while retaining working files, including edits made during the request; server sanitization differences remain visible in the next diff. No command publishes, watches files, runs a preview server or stores credentials in a source package.
+Check and diff are offline; remote guards still apply when pushing. Pull requires `platform.read`; push requires `platform.write` and the existing native authoring role. Push saves a draft with its original revision, preserving the target's other configuration. A template target creates a private copy. A revision conflict preserves local files. Successful pushes update the local baseline while retaining working files, including edits made during the request; server sanitization differences remain visible in the next diff. No command publishes, watches files, runs a preview server or stores credentials in a source package.
 
 ```sh
 indiana operations list --available --json
@@ -224,7 +224,7 @@ indiana offerings diff --against before.json --file after.json --json
 cat funnel.json | indiana funnels validate --file - --json
 ```
 
-Funnel input is the current editable draft; publish mode uses its publication-structure validator rather than the immutable delivery snapshot schema. Paywall input uses its current document schema, including the required published Offering reference for publication. Offering input is exactly `{ lookupKey, displayName, items, metadata }`: Product leaves at levels 1–3, groups at 1–2, at most 20 distinct Products, and empty groups only in draft mode. Offering has no invented schemaVersion or Package wrapper.
+Funnel input is the current editable format-5 draft: screens choose Page/Popup content versions or Paywall Versions, and the compiled delivery snapshot with embedded screens is not accepted. Publish mode uses the draft's publication-structure validator, which also requires each Page/Popup choice to pin a version. Paywall input uses its current document schema, including the required published Offering reference for publication. Offering input is exactly `{ lookupKey, displayName, items, metadata }`: Product leaves at levels 1–3, groups at 1–2, at most 20 distinct Products, and empty groups only in draft mode. Offering has no invented schemaVersion or Package wrapper.
 
 All inputs use strict UTF-8/JSON and the existing 1,000,000-byte document budget. Validation reports `validation: local` and `serverChecks: not_run`; Product existence, Offering terms/membership, permissions and publication require the server. Diff emits escaped JSON Pointers and hashes, omits values, and caps displayed changes at 100 while preserving total/truncated counts.
 
@@ -258,7 +258,7 @@ See [CHANGELOG](CHANGELOG.md), [architecture design](../../docs/cli-management-d
 
 ## Configuration, results and finance reads
 
-The current source adds 28 finite GrowthBook read models to `capabilities.growthReaders`, each with `list` and `get <id>` aliases. For example:
+The current source adds 28 finite experimentation read models to `capabilities.growthReaders`, each with `list` and `get <id>` aliases. For example:
 
 ```sh
 indiana growth features list --query limit=25 --json
@@ -279,7 +279,7 @@ indiana events list --query name=payment.failed --json
 
 Configuration requires App `platform.read`. Environment results additionally require the exact environment's `platform.read` and `analytics.read`. A write grant implies read only while the original grant remains valid under the current native role. Private objects retain their original ownership/share rules. The finite reader removes configuration analysis summaries and Data Source connection secrets, without expanding direct OAuth table access.
 
-GrowthBook lists return `{resource, rows, ids, nextCursor}`. Pass the unchanged `nextCursor` as `--query after=...`; default page size is 25, maximum 100, and a response-size boundary can end a page earlier. `parentId` filters child collections. The parallel `ids` array supplies the exact identity for each row, including collision-free composite revision/reference identities. Use `ids[n]` with `get` for `rows[n]`. Parent-filtered lists are the normal way to read those collections. Invoice pages keep their `after` cursor. Statement pages require the original `snapshotAt` plus all three cursor fields `afterAt`, `afterId`, `afterPosition`. Event pages require both `before` (timestamp) and `after` (event ID). Overview and event UTC date ranges are bounded to 90 days.
+Experimentation lists return `{resource, rows, ids, nextCursor}`. Pass the unchanged `nextCursor` as `--query after=...`; default page size is 25, maximum 100, and a response-size boundary can end a page earlier. `parentId` filters child collections. The parallel `ids` array supplies the exact identity for each row, including collision-free composite revision/reference identities. Use `ids[n]` with `get` for `rows[n]`. Parent-filtered lists are the normal way to read those collections. Invoice pages keep their `after` cursor. Statement pages require the original `snapshotAt` plus all three cursor fields `afterAt`, `afterId`, `afterPosition`. Event pages require both `before` (timestamp) and `after` (event ID). Overview and event UTC date ranges are bounded to 90 days.
 
 This source expansion requires the matching server/database reader release. Local capability discovery does not assert that an older deployed server contains it. Apple/Google configuration and bindings remain deferred; SDK runtime calls and retired coupon subscription commands are outside this expansion.
 

package/dist/{chunk-VEDX3X5S.js → chunk-HTY75R4M.js}

@@ -106,6 +106,7 @@ var localErrorRecovery = {
   SERVER_ONLY: "fix_request",
   PROTOCOL_MISMATCH: "upgrade_sdk",
   IDENTITY_CHANGED: "reload_state",
+  INVALID_STATE: "reload_state",
   EVENT_QUEUE_FULL: "retry_same_request",
   // The original command or decision still owns the outcome.
   COMMAND_PENDING: "recover_operation",

package/dist/{io-KD7VVAPB.js → io-LMWZQURK.js}

@@ -1,7 +1,7 @@
 import {
   readJsonFile,
   readJsonStream
-} from "./chunk-VEDX3X5S.js";
+} from "./chunk-HTY75R4M.js";
 export {
   readJsonFile,
   readJsonStream