@trydreamstate/cli 1.3.3 → 1.3.5

package/agent-plugin/skills/workflows/lifecycle-and-enrollment.md

@@ -6,6 +6,6 @@ Missing connections never block building, editing, saving a draft or validating.
 
 Enrollment, activation and delivery are different events. Read the result after each one. After an unclear result, check current state before retrying, and never enroll twice or replay an effect that already happened.
 
-Preview first. Activation needs `params.max_credits` on `workflow.workflows.activate`: read exact `required_caps.max_credits` from preview, then resend that value unchanged. Live enrollment takes no send cap: every eligible selected row is enrolled. The activation ceiling is a caller input, not user approval. Never guess it or ask the user to approve it.
+Preview first. Activation stores `params.max_credits` on `workflow.workflows.activate`: read exact `required_caps.max_credits` from preview, then resend that value unchanged. This persisted per-delivery ceiling is a declared domain input, not run `max_credits`; put run gating fields at door. Live enrollment takes no send cap: every eligible selected row is enrolled. Never guess it or ask user to approve it.
 
 An active worksheet trigger snapshots its saved view on periodic ticks and idempotently enrolls rows that arrive later; draft, paused, and inactive workflows never refill.

package/agent-plugin/skills/worksheet-tidy/SKILL.md

@@ -3,7 +3,7 @@ name: worksheet-tidy
 description: "Review a workbook worksheet's structure and values, including duplicate or overlapping columns, column order, types and formatting, columns to hide, criteria and run conditions that never vary, and suspicious values, then apply reversible fixes. Use it when a worksheet has grown messy, before sharing it, or before enrolling it into a sequence. It does not merge CRM records across the workspace, rebuild the list's source (list-building does) or explain failed runs (diagnostics does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Worksheet Tidy
 
@@ -59,3 +59,5 @@ Search the workbook tool for each change. The search returns runnable schemas fo
 ## Check it works
 
 Done means checked, not built. Before you report, read back everything you made or changed, and run, test or preview it where that is offered; publish or send only when the user asked. An empty, failed or wrong result means an input or setting is wrong: find which from the error or the output, correct it and check again, until it is right or a real blocker stops it. Report what you checked and what it showed.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/writing/SKILL.md

@@ -3,7 +3,7 @@ name: writing
 description: "Draft, revise and publish articles and landing copy grounded in workspace context and a target query."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # Writing
 
@@ -14,10 +14,6 @@ Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabiliti
 - Short-form social posts: [`social`].
 - The `social` pack lists the tools and their exact inputs.
 
-<!-- architect-operation-contract
-{"required_capability_ids":[]}
--->
-
 Own the draft, review, revise, and publish lifecycle for long-form articles and landing copy. Every factual claim traces to a workspace-wiki fact, cited evidence, or a dated external source; the voice matches what the workspace has already published; and each lifecycle step is a deliberate, verifiable state change. Traditional keyword, ranking, and generative-citation evidence belongs to `visibility`; current external evidence and durable facts about the business belong to `knowledge`. Never re-derive those measurements or restate a business fact from memory.
 
 Authoring: prepare brief, evidence ledger, novelty decision, destination, and voice; compose internally; discover owner and hydrate schema; save complete artifact; read result before showing or advancing. Unsaved long-form copy in chat is not an article. Preserve exact user-named title. A rewrite is not persisted until live result says save succeeded.
@@ -82,3 +78,5 @@ Report the missing source, stale revision, failed destination, or missing publis
 ## Check it works
 
 Done means checked, not built. Before you report, read back everything you made or changed, and run, test or preview it where that is offered; publish or send only when the user asked. An empty, failed or wrong result means an input or setting is wrong: find which from the error or the output, correct it and check again, until it is right or a real blocker stops it. Report what you checked and what it showed.
+
+Paid and outward runs follow the paid-run consent rule.

package/agent-plugin/skills/x-posts/SKILL.md

@@ -3,7 +3,7 @@ name: x-posts
 description: "Write and revise X posts and threads: the first line, single post versus thread, weighted length and Premium limits, thread structure, post types, replies and links, and phrases to avoid. Use it for the copy of any post going to X. It does not cover scheduling, publishing or automations (social does)."
 ---
 
-Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own. If the server asks you to sign in, approve it in the browser.
+Run this through the Dreamstate MCP tools: `packs_get` for the pack's capabilities, `tools_get` for the exact input schema, then `tools_run`. Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`. The paid-run consent rule is one sentence in the MCP server instructions, rendered from consentRule.json and PAID_RUN_APPROVAL_THRESHOLDS: rows and credits, with no provider prices. If the server asks you to sign in, approve it in the browser.
 
 # X posts
 
@@ -71,3 +71,5 @@ Change what was asked and keep the rest verbatim. If a thread post runs long, sp
 ## Check it works
 
 Read the saved draft back: the hook alone justifies post two, each post is under the account's limit, each thread post stands alone, every number traces to something real, and nothing contains an em dash.
+
+Paid and outward runs follow the paid-run consent rule.

package/dist/agentGuidance.generated.json

@@ -1,9 +1,9 @@
 {
     "generated_by": "packages/cli/scripts/build-agent-plugin.mjs from apps/backend/src/services/mcp/consentRule.json; do not edit by hand",
     "consent": {
-        "summary": "Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. A larger paid run also needs the user's yes before you send approved: true; never send it on your own.",
-        "paid_run": "Anything that writes, spends credits or reaches a real person: run mode dry_run first, show the user the preview, the row count and the credit estimate, then run live with the quote_hash that dry_run returned, a max_credits ceiling and an idempotency_key. A live run that spends credits states max_rows, the number of rows the user asked for. A quote returned by a refused live call is only a price, never a confirmation.",
-        "human_approval": "A paid run above the server's row or provider-spend limit, or that turns on a recurring trigger, also needs the user's yes. Ask them, and only then send approved: true with the same quote_hash. You are asserting that you asked a person; never send it on your own."
+        "summary": "Anything that writes, spends credits or reaches a person: dry_run first, then live with the quote_hash the dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A larger paid run, or a live external send above the server's recipient threshold, also needs the user's yes before you send approved: true; never send it on your own.",
+        "paid_run": "Anything that writes, spends credits or reaches a real person: run mode dry_run first, show the user the preview, the row count and the credit estimate, then run live with the quote_hash that dry_run returned, a max_credits ceiling and an idempotency_key. max_credits 0 is valid only when that quote is 0. A live paid run states max_rows; an external send states max_live_sends of at least the dry_run recipient_count. A quote returned by a refused live call is only a price, never a confirmation.",
+        "human_approval": "A paid run above the server's row or provider-spend limit, a live external send above the server's recipient threshold, or a run that turns on a recurring trigger, also needs the user's yes. Ask them, and only then send approved: true with the same quote_hash. You are asserting that you asked a person; never send it on your own."
     },
     "router_steps": [
         {
@@ -24,7 +24,7 @@
         {
             "mcp": "tools_run",
             "cli": "dreamstate tools run <capability_id> --params '{...}' --mode <dry_run|live> --json",
-            "text": "runs it with `capability_id` and `params`. The gating inputs (`mode`, `max_credits`, `idempotency_key`, `quote_hash`, `max_rows`, `approved`) go on the run call itself, never inside `params`."
+            "text": "runs it with `capability_id` and `params`. The gating inputs (`mode`, `max_credits`, `idempotency_key`, `quote_hash`, `approved`) go on the run call itself, never inside `params`. `max_rows` is a param of `tables.columns.run` and `tables.table_sources.run`, not of `tools_run`. `max_live_sends` is a param of the external-send sequence capabilities (`sequence.sequences.activate_audience`, `sequence.sequences.resume`, and the rest of that family), sent inside `params`, not a gating input of `tools_run`."
         },
         {
             "mcp": "runs_get",

package/dist/capabilityPosture.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Inline-read and column-run hand-off, derived from the tools-get capability
+ * record. No capability id list: a free synchronous read omits the turn token,
+ * and a queued external test run (column runs and the same posture class)
+ * returns without waiting.
+ */
+export interface CapabilityPosture {
+    inlineRead: boolean;
+    returnsRunId: boolean;
+}
+export declare function postureFromContract(fetched: unknown): CapabilityPosture;
+//# sourceMappingURL=capabilityPosture.d.ts.map

package/dist/capabilityPosture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilityPosture.d.ts","sourceRoot":"","sources":["../src/capabilityPosture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;CACvB;AAaD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAkBvE"}

package/dist/capabilityPosture.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * Inline-read and column-run hand-off, derived from the tools-get capability
+ * record. No capability id list: a free synchronous read omits the turn token,
+ * and a queued external test run (column runs and the same posture class)
+ * returns without waiting.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.postureFromContract = postureFromContract;
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function capabilityOf(fetched) {
+    const root = record(fetched);
+    if (!root)
+        return null;
+    const data = record(root.data);
+    return record(data?.capability) ?? record(root.capability);
+}
+function postureFromContract(fetched) {
+    const capability = capabilityOf(fetched);
+    if (!capability)
+        return { inlineRead: false, returnsRunId: false };
+    const asyncPolicy = record(capability.async_policy);
+    const asyncMode = typeof asyncPolicy?.mode === 'string' ? asyncPolicy.mode : undefined;
+    const credit = typeof capability.credit_class === 'string' ? capability.credit_class : undefined;
+    const consequence = typeof capability.consequence === 'string' ? capability.consequence : undefined;
+    const effect = typeof capability.effect_class === 'string' ? capability.effect_class : undefined;
+    // Missing async_policy is unknown. Do not guess sync, and do not treat it as a hand-off.
+    const inlineRead = capability.mutates !== true
+        && asyncMode === 'sync'
+        && (credit === 'free' || credit === undefined)
+        && (consequence === 'read_only' || consequence === 'test_run');
+    const returnsRunId = asyncMode === 'async'
+        && consequence === 'test_run'
+        && credit === 'dynamic'
+        && effect === 'external';
+    return { inlineRead, returnsRunId };
+}

package/dist/client.d.ts

@@ -3,9 +3,10 @@ export declare const CLI_VERSION: string;
 export declare const CLI_UPDATE_COMMAND = "npm install -g @trydreamstate/cli@latest";
 /**
  * Release identity the server stamps on every /api/v1 response (contract C2):
- * meta.server_version, meta.minimum_cli_version and meta.release_sha in the
- * JSON envelope, and X-Dreamstate-Server-Version / -Minimum-Cli-Version /
- * -Release-Sha as response headers. The client reads both so a server that
+ * meta.server_version, meta.minimum_cli_version, meta.release_sha and
+ * meta.registry_hash in the JSON envelope (whoami also puts registry_hash on
+ * data), and X-Dreamstate-Server-Version / -Minimum-Cli-Version / -Release-Sha
+ * / -Registry-Hash as response headers. The client reads both so a server that
  * only sets one of them (a proxy that rewrites bodies, an error page with no
  * envelope) still reports skew.
  */
@@ -13,6 +14,7 @@ export interface ServerReleaseInfo {
     server_version: string | null;
     minimum_cli_version: string | null;
     release_sha: string | null;
+    registry_hash: string | null;
 }
 export interface DreamstateClientOptions {
     apiKey: string;
@@ -135,6 +137,10 @@ export declare class DreamstateClient {
     routePack(goal: string): Promise<unknown>;
     listSkills(query?: Record<string, unknown>): Promise<unknown>;
     searchSkillDocuments(query: Record<string, unknown>): Promise<unknown>;
+    /**
+     * Every skill, across pages. The route defaults to 20 and caps a page at 50.
+     * skills install and skills doctor both call this; one page drops the rest.
+     */
     listAllSkills(): Promise<unknown>;
     getSkill(skillId: string, query?: Record<string, unknown>): Promise<unknown>;
     listTools(query?: Record<string, unknown>): Promise<unknown>;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,EAAE,MAA2C,CAAC;AAEtE,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,6CAA6C,CAAC;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;IAC7C,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAiBD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,EAAE,MAAM,CAAC;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAahF,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,2HAA2H;IAC3H,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAGtC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC3B;CAeT;AAWD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAQ5F;AAED,6DAA6D;AAC7D,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,SAAS,CAAC;AAE/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,EAAE,UAAU,GAAE,MAAoB,GAAG,WAAW,CAI1G;AAsBD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAoB1E;AAqED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACrF,OAAO,CAAC,mBAAmB,CAAC,CAK9B;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,CAAC,CAKnC;AAkDD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA4B;IAC9D,OAAO,CAAC,WAAW,CAA6F;IAEhH,wEAAwE;IACxE,IAAI,UAAU,IAAI,iBAAiB,CAElC;gBAEW,OAAO,EAAE,uBAAuB;IAQ5C,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAG7B,4FAA4F;IAC5F,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAGnC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAG7B,SAAS,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGhE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAG9E,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGzC,UAAU,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGjE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAGtE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IAGjC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGhF,SAAS,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGhE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpF,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,iBAAiB,EACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC;IAYnB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGpC,QAAQ,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAG/D,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAG/E,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW/F,OAAO,CAAC,cAAc;YAQR,OAAO;CAkJtB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,WAAW,EAAE,MAA2C,CAAC;AAEtE,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,6CAA6C,CAAC;AAE7E;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAED,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAKtD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;IAC7C,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAiBD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,EAAE,MAAM,CAAC;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAahF,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,2HAA2H;IAC3H,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAGtC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;QACP,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC3B;CAeT;AAcD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAU5F;AAED,6DAA6D;AAC7D,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,SAAS,CAAC;AAE/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,EAAE,UAAU,GAAE,MAAoB,GAAG,WAAW,CAI1G;AAsBD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAoB1E;AA4GD,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACrF,OAAO,CAAC,mBAAmB,CAAC,CAK9B;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,CAAC,CAKnC;AAkDD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA4B;IAC9D,OAAO,CAAC,WAAW,CAAkH;IAErI,wEAAwE;IACxE,IAAI,UAAU,IAAI,iBAAiB,CAElC;gBAEW,OAAO,EAAE,uBAAuB;IAQ5C,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAG7B,4FAA4F;IAC5F,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAGnC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAG7B,SAAS,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGhE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAG9E,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGzC,UAAU,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGjE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAGtE;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IAgCvC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGhF,SAAS,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGhE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpF,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,iBAAiB,EACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC;IAYnB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAGpC,QAAQ,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAG/D,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAG/E,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW/F,OAAO,CAAC,cAAc;YAUR,OAAO;CAuGtB"}

package/dist/client.js

@@ -8,11 +8,15 @@ exports.requestDeviceAuthorization = requestDeviceAuthorization;
 exports.claimDeviceAuthorization = claimDeviceAuthorization;
 const idempotency_1 = require("./idempotency");
 const errors_1 = require("./errors");
+const registryManifest_1 = require("./registryManifest");
 exports.CLI_VERSION = require('../package.json').version;
 /** Command that updates the CLI. One constant so every surface prints the same one. */
 exports.CLI_UPDATE_COMMAND = 'npm install -g @trydreamstate/cli@latest';
 exports.DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
 exports.TOOL_AND_RUN_REQUEST_TIMEOUT_MS = 60_000;
+/** Same ceiling as the server's SKILLS_LIST_MAX_LIMIT. */
+const SKILL_LIST_PAGE_LIMIT = 50;
+const SKILL_LIST_MAX_PAGES = 40;
 /**
  * Next steps for server workspace refusals. The server's message is forwarded
  * unchanged; the CLI's own guidance travels beside it as details.cli_hint, so
@@ -60,9 +64,11 @@ class CliError extends Error {
     }
 }
 exports.CliError = CliError;
+function objectRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
 function metaRecord(payload) {
-    const meta = payload && typeof payload === 'object' ? payload.meta : undefined;
-    return meta && typeof meta === 'object' && !Array.isArray(meta) ? meta : undefined;
+    return objectRecord(objectRecord(payload)?.meta);
 }
 function nonEmptyString(value) {
     return typeof value === 'string' && value.trim() ? value.trim() : null;
@@ -75,10 +81,12 @@ function nonEmptyString(value) {
 function readServerReleaseInfo(payload, headers) {
     const meta = metaRecord(payload);
     const header = (name) => nonEmptyString(typeof headers?.get === 'function' ? headers.get(name) : null);
+    const data = objectRecord(objectRecord(payload)?.data);
     return {
         server_version: nonEmptyString(meta?.server_version) ?? header('X-Dreamstate-Server-Version'),
         minimum_cli_version: nonEmptyString(meta?.minimum_cli_version) ?? header('X-Dreamstate-Minimum-Cli-Version'),
         release_sha: nonEmptyString(meta?.release_sha) ?? header('X-Dreamstate-Release-Sha'),
+        registry_hash: nonEmptyString(meta?.registry_hash) ?? nonEmptyString(data?.registry_hash) ?? header('X-Dreamstate-Registry-Hash'),
     };
 }
 function describeVersionSkew(info, cliVersion = exports.CLI_VERSION) {
@@ -161,24 +169,61 @@ function waitForRetryAfter(value) {
 function versionAtMost(current, target) {
     return !isVersionGreater(current, target);
 }
-function responseError(payload, status) {
-    if (isApiErrorBody(payload)) {
-        return new CliError(payload.error.message, payload.error.code, status, {
-            details: payload.error.details,
-            ...(typeof payload.error.retryable === 'boolean'
-                ? { retryable: payload.error.retryable }
-                : {}),
-            ...(payload.error.repair && typeof payload.error.repair === 'object'
-                ? { repair: payload.error.repair }
-                : {}),
+function errorEnvelope(payload) {
+    return isApiErrorBody(payload) ? payload : null;
+}
+/**
+ * The one parser for an error envelope. request() and the public login
+ * requests both use it, so rate-limit receipts, cli_update_required, repair,
+ * trace, meta and the idempotency key are not a second copy.
+ */
+function cliErrorFromEnvelope(payload, status, extras = {}) {
+    const meta = metaRecord(payload);
+    const envelope = errorEnvelope(payload);
+    if (envelope) {
+        const retryAfterValue = extras.response ? retryAfter(extras.response, envelope) : undefined;
+        const repair = envelope.error.repair && typeof envelope.error.repair === 'object' ? { repair: envelope.error.repair } : {};
+        if (envelope.error.code === 'cli_update_required') {
+            const minimum = extras.info?.minimum_cli_version ?? '';
+            const serverDetails = envelope.error.details;
+            return new CliError(envelope.error.message, 'cli_update_required', status, {
+                details: {
+                    ...(serverDetails && typeof serverDetails === 'object' && !Array.isArray(serverDetails) ? serverDetails : {}),
+                    ...(minimum ? { minimum_cli_version: minimum } : {}),
+                    cli_version: exports.CLI_VERSION,
+                    update_command: exports.CLI_UPDATE_COMMAND,
+                },
+                retryAfter: retryAfterValue,
+                traceId: readToolEnvelopeTraceId(payload),
+                idempotencyKey: extras.idempotencyKey,
+                retryable: false,
+                ...repair,
+                ...(meta ? { meta } : {}),
+            });
+        }
+        const hint = WORKSPACE_ERROR_HINTS[envelope.error.code];
+        const serverDetails = envelope.error.details;
+        return new CliError(envelope.error.message, envelope.error.code, status, {
+            ...(hint
+                ? { details: { ...(serverDetails && typeof serverDetails === 'object' && !Array.isArray(serverDetails) ? serverDetails : {}), cli_hint: hint } }
+                : { details: serverDetails }),
+            retryAfter: retryAfterValue,
+            traceId: readToolEnvelopeTraceId(payload),
+            idempotencyKey: extras.idempotencyKey,
+            ...(typeof envelope.error.retryable === 'boolean' ? { retryable: envelope.error.retryable } : {}),
+            ...repair,
+            ...(meta ? { meta } : {}),
         });
     }
     const error = payload && typeof payload === 'object' ? payload.error : null;
-    if (error &&
-        typeof error === 'object' &&
-        typeof error.code === 'string') {
+    if (error && typeof error === 'object' && typeof error.code === 'string') {
         const code = error.code;
-        return new CliError(code, code, status);
+        const message = typeof error.message === 'string' ? error.message : code;
+        return new CliError(message, code, status, {
+            idempotencyKey: extras.idempotencyKey,
+            traceId: readToolEnvelopeTraceId(payload),
+            ...(meta ? { meta } : {}),
+        });
     }
     return null;
 }
@@ -217,7 +262,7 @@ async function requestPublic(baseUrl, path, init) {
     catch {
         throw new CliError(`Dreamstate API returned invalid JSON (HTTP ${response.status})`, 'invalid_response', response.status);
     }
-    const apiError = responseError(payload, response.status);
+    const apiError = cliErrorFromEnvelope(payload, response.status, { response });
     if (apiError)
         throw apiError;
     if (!response.ok)
@@ -233,7 +278,7 @@ class DreamstateClient {
     workspace;
     requestTimeoutMs;
     onVersionWarning;
-    releaseInfo = { server_version: null, minimum_cli_version: null, release_sha: null };
+    releaseInfo = { server_version: null, minimum_cli_version: null, release_sha: null, registry_hash: null };
     /** Release identity from the most recent response, success or error. */
     get serverInfo() {
         return { ...this.releaseInfo };
@@ -270,8 +315,43 @@ class DreamstateClient {
     searchSkillDocuments(query) {
         return this.request(`/skills/search${queryString(query)}`);
     }
-    listAllSkills() {
-        return this.listSkills();
+    /**
+     * Every skill, across pages. The route defaults to 20 and caps a page at 50.
+     * skills install and skills doctor both call this; one page drops the rest.
+     */
+    async listAllSkills() {
+        const pages = [];
+        const seenCursors = new Set();
+        const seenIds = new Set();
+        let cursor;
+        let last;
+        for (let page = 0; page < SKILL_LIST_MAX_PAGES; page += 1) {
+            last = await this.listSkills({ limit: SKILL_LIST_PAGE_LIMIT, ...(cursor ? { cursor } : {}) });
+            const data = last && typeof last === 'object' ? last.data : undefined;
+            const record = data && typeof data === 'object' ? data : null;
+            if (!record || !Array.isArray(record.skills))
+                return last;
+            const skills = record.skills;
+            for (const skill of skills) {
+                const id = skill && typeof skill === 'object' ? skill.id : undefined;
+                if (typeof id === 'string') {
+                    if (seenIds.has(id))
+                        continue;
+                    seenIds.add(id);
+                }
+                pages.push(skill);
+            }
+            const next = typeof record.next_cursor === 'string' ? record.next_cursor.trim() : '';
+            if (!next) {
+                return { ...last, data: { ...record, skills: pages, next_cursor: null } };
+            }
+            if (seenCursors.has(next)) {
+                throw new CliError('Dreamstate API repeated a skill list cursor.', 'invalid_response', 200);
+            }
+            seenCursors.add(next);
+            cursor = next;
+        }
+        throw new CliError('Dreamstate API skill list did not end.', 'invalid_response', 200);
     }
     getSkill(skillId, query = {}) {
         return this.request(`/skills/${encodeURIComponent(skillId)}${queryString(query)}`);
@@ -310,10 +390,12 @@ class DreamstateClient {
         });
     }
     noteServerInfo(info) {
+        (0, registryManifest_1.noteRegistryHash)(info.registry_hash);
         this.releaseInfo = {
             server_version: info.server_version ?? this.releaseInfo.server_version,
             minimum_cli_version: info.minimum_cli_version ?? this.releaseInfo.minimum_cli_version,
             release_sha: info.release_sha ?? this.releaseInfo.release_sha,
+            registry_hash: info.registry_hash ?? this.releaseInfo.registry_hash,
         };
     }
     async request(path, init = {}, defaultTimeoutMs = exports.DEFAULT_REQUEST_TIMEOUT_MS, allowIncompatibleCli = false) {
@@ -342,7 +424,7 @@ class DreamstateClient {
                 if (controller.signal.aborted) {
                     throw new CliError(errors_1.CLI_LOCAL_ERROR_CODES.request_timeout, 'request_timeout', 0, { idempotencyKey, repair: errors_1.CLI_LOCAL_ERROR_REPAIRS.request_timeout });
                 }
-                throw new CliError(`Request failed: ${error instanceof Error ? error.message : String(error)}`, 'network_error', 0, { repair: errors_1.CLI_LOCAL_ERROR_REPAIRS.network_error });
+                throw new CliError(`Request failed: ${error instanceof Error ? error.message : String(error)}`, 'network_error', 0, { idempotencyKey, repair: errors_1.CLI_LOCAL_ERROR_REPAIRS.network_error });
             }
             finally {
                 clearTimeout(timeout);
@@ -358,53 +440,18 @@ class DreamstateClient {
             const info = readServerReleaseInfo(payload, response.headers);
             this.noteServerInfo(info);
             const meta = metaRecord(payload);
-            if (isApiErrorBody(payload)) {
-                const retryAfterValue = retryAfter(response, payload);
-                if (!retriedRateLimit &&
-                    response.status === 429 &&
-                    retryAfterValue &&
-                    retryAfterDelayMs(retryAfterValue) !== null) {
+            const envelopeError = errorEnvelope(payload);
+            if (envelopeError && response.status === 429 && !retriedRateLimit) {
+                const retryAfterValue = retryAfter(response, envelopeError);
+                if (retryAfterValue && retryAfterDelayMs(retryAfterValue) !== null) {
                     retriedRateLimit = true;
                     await waitForRetryAfter(retryAfterValue);
                     continue;
                 }
-                if (payload.error.code === 'cli_update_required') {
-                    // The server refused before executing anything (contract C3). Its own
-                    // message is kept; the update command rides beside it.
-                    const minimum = info.minimum_cli_version ?? '';
-                    throw new CliError(payload.error.message, 'cli_update_required', response.status, {
-                        details: {
-                            ...(payload.error.details && typeof payload.error.details === 'object' ? payload.error.details : {}),
-                            ...(minimum ? { minimum_cli_version: minimum } : {}),
-                            cli_version: exports.CLI_VERSION,
-                            update_command: exports.CLI_UPDATE_COMMAND,
-                        },
-                        retryAfter: retryAfterValue,
-                        traceId: readToolEnvelopeTraceId(payload),
-                        idempotencyKey,
-                        retryable: false,
-                        ...(payload.error.repair && typeof payload.error.repair === 'object' ? { repair: payload.error.repair } : {}),
-                        ...(meta ? { meta } : {}),
-                    });
-                }
-                const hint = WORKSPACE_ERROR_HINTS[payload.error.code];
-                const serverDetails = payload.error.details;
-                throw new CliError(payload.error.message, payload.error.code, response.status, {
-                    ...(hint
-                        ? { details: { ...(serverDetails && typeof serverDetails === 'object' && !Array.isArray(serverDetails) ? serverDetails : {}), cli_hint: hint } }
-                        : { details: serverDetails }),
-                    retryAfter: retryAfterValue,
-                    traceId: readToolEnvelopeTraceId(payload),
-                    idempotencyKey,
-                    ...(typeof payload.error.retryable === 'boolean'
-                        ? { retryable: payload.error.retryable }
-                        : {}),
-                    ...(payload.error.repair && typeof payload.error.repair === 'object'
-                        ? { repair: payload.error.repair }
-                        : {}),
-                    ...(meta ? { meta } : {}),
-                });
             }
+            const parsed = cliErrorFromEnvelope(payload, response.status, { idempotencyKey, response, info });
+            if (parsed)
+                throw parsed;
             if (!response.ok)
                 throw new CliError(`Dreamstate API request failed (HTTP ${response.status})`, 'request_failed', response.status, { idempotencyKey, ...(meta ? { meta } : {}) });
             const minimum = info.minimum_cli_version;

package/dist/commands/sequences.d.ts

@@ -1,7 +1,8 @@
-import { runPackCommand, type PackVerbSpec } from './shared';
+import { type PackVerbSpec } from './shared';
 import type { CliCommand } from '../index';
+import type { GatedRunContext } from '../gatedRun';
 export declare const SEQUENCE_VERBS: PackVerbSpec[];
 export declare const SEQUENCES_USAGE: string;
 export declare const parseSequencesCommand: (argv: string[]) => CliCommand;
-export declare function runSequencesCommand(context: Parameters<typeof runPackCommand>[0], command: CliCommand, stdout: NodeJS.WritableStream): Promise<void>;
+export declare function runSequencesCommand(context: GatedRunContext | undefined, command: CliCommand, stdout: NodeJS.WritableStream): Promise<void>;
 //# sourceMappingURL=sequences.d.ts.map

package/dist/commands/sequences.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sequences.d.ts","sourceRoot":"","sources":["../../src/commands/sequences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,cAAc,EAAe,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAO3C,eAAO,MAAM,cAAc,EAAE,YAAY,EA8BxC,CAAC;AAEF,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,qBAAqB,gCAA4E,CAAC;AAC/G,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1J"}
+{"version":3,"file":"sequences.d.ts","sourceRoot":"","sources":["../../src/commands/sequences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,eAAO,MAAM,cAAc,EAAE,YAAY,EAMpC,CAAC;AAEN,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,qBAAqB,gCAA4E,CAAC;AAC/G,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjJ"}

package/dist/commands/sequences.js

@@ -1,47 +1,29 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseSequencesCommand = exports.SEQUENCES_USAGE = exports.SEQUENCE_VERBS = void 0;
 exports.runSequencesCommand = runSequencesCommand;
 const shared_1 = require("./shared");
-const automation = [{ name: 'id', into: 'automation_id' }];
-const sequence = [{ name: 'id', into: 'sequence_id' }];
-// Route map only. `tools get` owns every remote parameter, type, requirement and
-// description. Positionals are documented CLI aliases for canonical input fields.
-exports.SEQUENCE_VERBS = [
-    { verb: 'create-from-worksheet', capabilityId: 'sequence.sequences.create_from_worksheet' },
-    { verb: 'list', capabilityId: 'workflow.automations.list' },
-    { verb: 'init', capabilityId: 'workflow.automations.lint', local: 'init' },
-    { verb: 'get', capabilityId: 'workflow.automations.get', positional: automation },
-    { verb: 'create', capabilityId: 'workflow.automations.compose' },
-    { verb: 'update', capabilityId: 'workflow.automations.update', positional: automation },
-    { verb: 'lint', capabilityId: 'workflow.automations.lint', positional: automation },
-    { verb: 'preview', capabilityId: 'workflow.automations.preview', positional: automation },
-    { verb: 'variables', capabilityId: 'workflow.automations.variables_list', positional: automation },
-    { verb: 'node-catalog', capabilityId: 'workflow.automations.node_catalog' },
-    { verb: 'node-inspect', capabilityId: 'workflow.automations.node_inspect', positional: [{ name: 'id', into: 'automation_id', optional: true }] },
-    { verb: 'node-add', capabilityId: 'workflow.automations.node_add', positional: automation },
-    { verb: 'node-patch', capabilityId: 'workflow.automations.node_patch', positional: automation },
-    { verb: 'node-remove', capabilityId: 'workflow.automations.node_remove', positional: automation },
-    { verb: 'node-move', capabilityId: 'workflow.automations.node_move', positional: automation },
-    { verb: 'field-options', capabilityId: 'workflow.automations.field_options', positional: [{ name: 'id', into: 'automation_id', optional: true }] },
-    { verb: 'publish', capabilityId: 'sequence.sequences.publish', positional: sequence },
-    { verb: 'enroll', capabilityId: 'sequence.sequences.enroll_selection', positional: sequence },
-    { verb: 'enrollments', capabilityId: 'sequence.sequences.contacts_list', positional: sequence },
-    { verb: 'launch', capabilityId: 'sequence.sequences.launch', positional: sequence },
-    { verb: 'start', capabilityId: 'sequence.sequences.start', positional: sequence },
-    { verb: 'pause', capabilityId: 'sequence.sequences.pause', positional: sequence },
-    { verb: 'resume', capabilityId: 'sequence.sequences.resume', positional: sequence },
-    { verb: 'stats', capabilityId: 'sequence.sequences.step_counts_get', positional: sequence },
-    { verb: 'analytics', capabilityId: 'sequence.sequences.analytics_get', positional: sequence },
-    { verb: 'duplicate', capabilityId: 'workflow.automations.duplicate', positional: automation },
-    { verb: 'archive', capabilityId: 'workflow.automations.archive', positional: automation },
-    { verb: 'export', capabilityId: 'workflow.automations.export', positional: automation },
-    { verb: 'import', capabilityId: 'workflow.automations.import' },
-];
+const errors_1 = require("../errors");
+const packVerbs_generated_json_1 = __importDefault(require("../generated/packVerbs.generated.json"));
+exports.SEQUENCE_VERBS = packVerbs_generated_json_1.default.verbs
+    .filter(({ command }) => command.startsWith('sequences '))
+    .map(({ command, capabilityId, positional, local }) => ({
+    verb: command.slice('sequences '.length), capabilityId,
+    ...(positional ? { positional } : {}),
+    ...(local === 'init' ? { local: 'init' } : {}),
+}));
 exports.SEQUENCES_USAGE = (0, shared_1.renderPackUsage)('sequences', exports.SEQUENCE_VERBS);
 exports.parseSequencesCommand = (0, shared_1.buildPackParser)('sequences', 'sequence', exports.SEQUENCE_VERBS, exports.SEQUENCES_USAGE);
 async function runSequencesCommand(context, command, stdout) {
-    if (command.command === 'pack' && command.verb === 'init')
-        return (0, shared_1.runPackInit)('sequence', command, stdout);
+    // init writes a local file and calls no API, so it has no gated context.
+    if (command.command === 'pack' && command.verb === 'init') {
+        (0, shared_1.runPackInit)('sequence', command, stdout);
+        return;
+    }
+    if (!context)
+        throw new errors_1.CliUsageError('sequences commands other than init require an authenticated session.');
     await (0, shared_1.runPackCommand)(context, command, stdout);
 }

package/dist/commands/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/commands/shared.ts"],"names":[],"mappings":"AAKA,OAAO,EAAc,KAAK,UAAU,EAAiC,MAAM,UAAU,CAAC;AAEtF,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAO7E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAClE,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA4CD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,WAAW,GAAC,WAAW,EAAE,IAAI,EAAE,UAAU,GAAC,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,GAC/F,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,UAAU,CA8EhC;AAGD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+BjG;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,IAAI,CAuBN;AAYD,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,OAAO,CAAC,IAAI,CAAC,CA2Df;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,CAK3E"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/commands/shared.ts"],"names":[],"mappings":"AAKA,OAAO,EAAc,KAAK,UAAU,EAAiC,MAAM,UAAU,CAAC;AAEtF,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAS7E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAClE,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA4CD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,WAAW,GAAC,WAAW,EAAE,IAAI,EAAE,UAAU,GAAC,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,GAC/F,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,UAAU,CAsFhC;AAGD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKjG;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,IAAI,CAuBN;AAYD,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,OAAO,CAAC,IAAI,CAAC,CAoDf;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,CAK3E"}