@trydreamstate/cli 1.3.3 → 1.3.5

package/dist/commands/shared.js

@@ -14,8 +14,9 @@ const index_1 = require("../index");
 const errors_1 = require("../errors");
 const gatedRun_1 = require("../gatedRun");
 const node_fs_1 = require("node:fs");
+const money_1 = require("../money");
 const runWait_1 = require("../runWait");
-const MODES = ['dry_run', 'live', 'smoke_test'];
+const runContract_1 = require("../runContract");
 function parseObject(raw, flag) {
     try {
         const value = JSON.parse(raw);
@@ -68,9 +69,9 @@ function takeSchemaFlags(argv, known) {
 function parseMode(value) {
     if (value === undefined)
         return undefined;
-    if (MODES.includes(value))
+    if (runContract_1.RUN_MODES.includes(value))
         return value;
-    throw new errors_1.CliUsageError(`--mode must be one of: ${MODES.join(', ')}`);
+    throw new errors_1.CliUsageError(`--mode must be one of: ${runContract_1.RUN_MODES.join(', ')}`);
 }
 function buildPackParser(pack, kind, specs, usage) {
     return (argv) => {
@@ -82,6 +83,7 @@ function buildPackParser(pack, kind, specs, usage) {
         const options = {
             mode: { type: 'string' }, 'dry-run': { type: 'boolean' }, live: { type: 'boolean' },
             'idempotency-key': { type: 'string' }, 'max-credits': { type: 'string' }, params: { type: 'string' },
+            'max-live-sends': { type: 'string' },
             approved: { type: 'boolean' }, 'approval-id': { type: 'string' }, 'approved-effect-unknown': { type: 'boolean' },
             'quote-hash': { type: 'string' }, 'turn-token': { type: 'string' },
             'wait-timeout': { type: 'string' }, 'no-wait': { type: 'boolean' }, 'json-output': { type: 'boolean' }, open: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
@@ -102,8 +104,12 @@ function buildPackParser(pack, kind, specs, usage) {
         const dryRun = values['dry-run'];
         const live = values.live;
         const idempotencyKey = values['idempotency-key'];
+        if (idempotencyKey !== undefined && idempotencyKey.length > runContract_1.IDEMPOTENCY_KEY_MAX_LENGTH) {
+            throw new errors_1.CliUsageError(`--idempotency-key must be at most ${runContract_1.IDEMPOTENCY_KEY_MAX_LENGTH} characters`);
+        }
         const rawParams = values.params;
         const rawMaxCredits = values['max-credits'];
+        const rawMaxLiveSends = values['max-live-sends'];
         const rawWaitTimeout = values['wait-timeout'];
         if (values.help)
             return { command: 'pack_help', usage, ...(values['json-output'] ? { jsonOutput: true } : {}) };
@@ -135,8 +141,11 @@ function buildPackParser(pack, kind, specs, usage) {
         const maxCredits = rawMaxCredits === undefined ? undefined : Number(rawMaxCredits);
         if (maxCredits !== undefined && (!Number.isFinite(maxCredits) || maxCredits < 0))
             throw new errors_1.CliUsageError('--max-credits must be a non-negative number');
+        const maxLiveSends = rawMaxLiveSends === undefined ? undefined : Number(rawMaxLiveSends);
+        if (maxLiveSends !== undefined && (!Number.isInteger(maxLiveSends) || maxLiveSends < 1))
+            throw new errors_1.CliUsageError('--max-live-sends must be an integer greater than or equal to 1');
         const quoteHash = values['quote-hash'];
-        if (quoteHash !== undefined && !/^sha256:[a-f0-9]{64}$/.test(quoteHash))
+        if (quoteHash !== undefined && !runContract_1.QUOTE_HASH_PATTERN.test(quoteHash))
             throw new errors_1.CliUsageError('--quote-hash must be the sha256:<64 hex> quote_hash a dry run returned');
         const approvalId = values['approval-id'];
         if (approvalId !== undefined && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(approvalId))
@@ -156,6 +165,7 @@ function buildPackParser(pack, kind, specs, usage) {
             ...(values['turn-token'] ? { turnToken: values['turn-token'] } : {}),
             ...(idempotencyKey ? { idempotencyKey } : {}),
             ...(maxCredits === undefined ? {} : { maxCredits }), ...(values['json-output'] ? { jsonOutput: true } : {}),
+            ...(maxLiveSends === undefined ? {} : { maxLiveSends }),
             waitTimeout, ...(values['no-wait'] ? { noWait: true } : {}),
             ...(values.open ? { open: true } : {}),
         };
@@ -168,36 +178,10 @@ function buildPackParser(pack, kind, specs, usage) {
  * usefully, rather than to guess a valid sequence on the caller's behalf.
  */
 function packScaffold(kind, name) {
-    // The step fields are FLAT and the step carries an id. An earlier scaffold nested
-    // channel/action under `fields` and omitted the id, and the document it wrote was
-    // refused by our own lint with `node_contract_unresolved: Node unknown has no
-    // canonical node-contract mapping`, because canonicalSequenceStepContractNode reads
-    // step.kind and step.action off the step itself. A scaffold whose output the next
-    // command in its own printed next_steps rejects is worse than no scaffold.
+    // Empty graph. Step and node shapes belong to the server contract, not a second copy here.
     return kind === 'sequence'
-        ? {
-            kind: 'sequence',
-            name,
-            steps: [
-                {
-                    id: 'step_1',
-                    kind: 'email',
-                    channel: 'email',
-                    action: 'send_email',
-                    subject_template: 'Quick question, {{first_name}}',
-                    body_template: 'Hi {{first_name}},\n\nWould this be useful to you?',
-                },
-            ],
-        }
-        : {
-            kind: 'workflow',
-            name,
-            nodes: [
-                { id: 'trigger-root', type: 'trigger', position: { x: 0, y: 0 }, data: { kind: 'trigger', subtype: 'table', config: {} } },
-                { id: 'action-example', type: 'action', position: { x: 0, y: 160 }, data: { kind: 'action', subtype: 'send_connection_request_to_contact', config: {} } },
-            ],
-            edges: [{ id: 'edge-trigger-action', source: 'trigger-root', target: 'action-example' }],
-        };
+        ? { kind: 'sequence', name, steps: [] }
+        : { kind: 'workflow', name, nodes: [], edges: [] };
 }
 function runPackInit(kind, command, stdout) {
     if (command.command !== 'pack')
@@ -254,7 +238,10 @@ async function runPackCommand(context, command, stdout) {
     const outcome = await (0, gatedRun_1.runGated)(context, {
         capabilityId: command.capabilityId,
         body: {
-            params: command.input,
+            params: {
+                ...command.input,
+                ...(command.maxLiveSends === undefined ? {} : { max_live_sends: command.maxLiveSends }),
+            },
             ...(command.mode ? { mode: command.mode } : {}),
             ...(maxCredits === undefined ? {} : { max_credits: maxCredits }),
             ...(command.approved ? { approved: true } : {}),
@@ -267,16 +254,6 @@ async function runPackCommand(context, command, stdout) {
         waitTimeout: command.waitTimeout,
         ...(command.noWait ? { noWait: true } : {}),
         coerceParams: true,
-        // Bridge for a capability that still lists max_credits among its params (contract C6 keeps
-        // the ceiling at the door). The value is copied only while the live schema declares it, so
-        // the day the catalog removes the param this stops sending it with no change here.
-        adjustParams: (params, capability) => {
-            const schema = capability?.input_json_schema;
-            const properties = schema && typeof schema === 'object' ? schema.properties : undefined;
-            return maxCredits !== undefined && properties && 'max_credits' in properties && params.max_credits === undefined
-                ? { ...params, max_credits: maxCredits }
-                : params;
-        },
     });
     const result = outcome.value;
     if (outcome.timedOut)
@@ -284,7 +261,7 @@ async function runPackCommand(context, command, stdout) {
     const output = command.mode === 'dry_run' && result && typeof result === 'object' && !Array.isArray(result)
         ? { ...result, meta: { ...(result.meta ?? {}), dry_run: true, note: 'dry_run: true, rerun with --live to apply' } }
         : result;
-    stdout.write(`${JSON.stringify(output, null, command.jsonOutput ? 0 : 2)}\n`);
+    stdout.write(`${JSON.stringify((0, money_1.scrubCliOutput)(output), null, command.jsonOutput ? 0 : 2)}\n`);
     if (!command.jsonOutput) {
         const root = result && typeof result === 'object' ? result : {};
         const webUrl = root.web_url ?? root.data?.web_url;

package/dist/commands/workflows.d.ts

@@ -1,7 +1,8 @@
-import { runPackCommand, type PackVerbSpec } from './shared';
+import { type PackVerbSpec } from './shared';
 import type { CliCommand } from '../index';
+import type { GatedRunContext } from '../gatedRun';
 export declare const WORKFLOW_VERBS: PackVerbSpec[];
 export declare const WORKFLOWS_USAGE: string;
 export declare const parseWorkflowsCommand: (argv: string[]) => CliCommand;
-export declare function runWorkflowsCommand(context: Parameters<typeof runPackCommand>[0], command: CliCommand, stdout: NodeJS.WritableStream): Promise<void>;
+export declare function runWorkflowsCommand(context: GatedRunContext | undefined, command: CliCommand, stdout: NodeJS.WritableStream): Promise<void>;
 //# sourceMappingURL=workflows.d.ts.map

package/dist/commands/workflows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/commands/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,cAAc,EAAe,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAO3C,eAAO,MAAM,cAAc,EAAE,YAAY,EA4BxC,CAAC;AAEF,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,qBAAqB,gCAA4E,CAAC;AAC/G,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1J"}
+{"version":3,"file":"workflows.d.ts","sourceRoot":"","sources":["../../src/commands/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAInD,eAAO,MAAM,cAAc,EAAE,YAAY,EAMpC,CAAC;AAEN,eAAO,MAAM,eAAe,QAA+C,CAAC;AAC5E,eAAO,MAAM,qBAAqB,gCAA4E,CAAC;AAC/G,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjJ"}

package/dist/commands/workflows.js

@@ -1,45 +1,29 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseWorkflowsCommand = exports.WORKFLOWS_USAGE = exports.WORKFLOW_VERBS = void 0;
 exports.runWorkflowsCommand = runWorkflowsCommand;
 const shared_1 = require("./shared");
-const automation = [{ name: 'id', into: 'automation_id' }];
-const workflow = [{ name: 'id', into: 'workflow_id' }];
-// Route map only. `tools get` owns every remote parameter, type, requirement and
-// description. Positionals are documented CLI aliases for canonical input fields.
-exports.WORKFLOW_VERBS = [
-    { verb: 'list', capabilityId: 'workflow.automations.list' },
-    { verb: 'init', capabilityId: 'workflow.automations.lint', local: 'init' },
-    { verb: 'get', capabilityId: 'workflow.automations.get', positional: automation },
-    { verb: 'create', capabilityId: 'workflow.automations.compose' },
-    { verb: 'update', capabilityId: 'workflow.automations.update', positional: automation },
-    { verb: 'lint', capabilityId: 'workflow.automations.lint', positional: automation },
-    { verb: 'preview', capabilityId: 'workflow.automations.preview', positional: automation },
-    { verb: 'variables', capabilityId: 'workflow.automations.variables_list', positional: automation },
-    { verb: 'node-catalog', capabilityId: 'workflow.automations.node_catalog' },
-    { verb: 'node-inspect', capabilityId: 'workflow.automations.node_inspect' },
-    { verb: 'node-add', capabilityId: 'workflow.automations.node_add', positional: automation },
-    { verb: 'node-patch', capabilityId: 'workflow.automations.node_patch', positional: automation },
-    { verb: 'node-remove', capabilityId: 'workflow.automations.node_remove', positional: automation },
-    { verb: 'node-move', capabilityId: 'workflow.automations.node_move', positional: automation },
-    { verb: 'field-options', capabilityId: 'workflow.automations.field_options' },
-    { verb: 'draft-save', capabilityId: 'workflow.workflows.draft_save', positional: workflow },
-    { verb: 'publish', capabilityId: 'workflow.workflows.draft_publish', positional: workflow },
-    { verb: 'activate', capabilityId: 'workflow.workflows.activate', positional: workflow },
-    { verb: 'deactivate', capabilityId: 'workflow.workflows.deactivate', positional: workflow },
-    { verb: 'enroll', capabilityId: 'workflow.workflows.enroll_selection', positional: workflow },
-    { verb: 'runs', capabilityId: 'workflow.workflows.runs_list', positional: workflow },
-    { verb: 'run', capabilityId: 'workflow.workflows.run_trace_get', positional: workflow },
-    { verb: 'retry', capabilityId: 'workflow.workflows.run_retry', positional: workflow },
-    { verb: 'duplicate', capabilityId: 'workflow.automations.duplicate', positional: automation },
-    { verb: 'archive', capabilityId: 'workflow.automations.archive', positional: automation },
-    { verb: 'export', capabilityId: 'workflow.automations.export', positional: automation },
-    { verb: 'import', capabilityId: 'workflow.automations.import' },
-];
+const errors_1 = require("../errors");
+const packVerbs_generated_json_1 = __importDefault(require("../generated/packVerbs.generated.json"));
+exports.WORKFLOW_VERBS = packVerbs_generated_json_1.default.verbs
+    .filter(({ command }) => command.startsWith('workflows '))
+    .map(({ command, capabilityId, positional, local }) => ({
+    verb: command.slice('workflows '.length), capabilityId,
+    ...(positional ? { positional } : {}),
+    ...(local === 'init' ? { local: 'init' } : {}),
+}));
 exports.WORKFLOWS_USAGE = (0, shared_1.renderPackUsage)('workflows', exports.WORKFLOW_VERBS);
 exports.parseWorkflowsCommand = (0, shared_1.buildPackParser)('workflows', 'workflow', exports.WORKFLOW_VERBS, exports.WORKFLOWS_USAGE);
 async function runWorkflowsCommand(context, command, stdout) {
-    if (command.command === 'pack' && command.verb === 'init')
-        return (0, shared_1.runPackInit)('workflow', command, stdout);
+    // init writes a local file and calls no API, so it has no gated context.
+    if (command.command === 'pack' && command.verb === 'init') {
+        (0, shared_1.runPackInit)('workflow', command, stdout);
+        return;
+    }
+    if (!context)
+        throw new errors_1.CliUsageError('workflows commands other than init require an authenticated session.');
     await (0, shared_1.runPackCommand)(context, command, stdout);
 }

package/dist/config.d.ts

@@ -40,7 +40,11 @@ export declare function removeCredentialProfile(name: string, path?: string): Pr
  */
 export declare function readStoredCredentials(path: string): Promise<StoredCredentials | null>;
 export declare function resolveApiKey(environment?: NodeJS.ProcessEnv, path?: string): Promise<string>;
-/** Workspace precedence: --workspace flag, then DREAMSTATE_WORKSPACE, then the stored default. */
+/**
+ * Workspace precedence: --workspace flag, then DREAMSTATE_WORKSPACE, then the
+ * stored default for the same token. DREAMSTATE_API_KEY replaces the stored
+ * token, so a different key must not inherit the other credential's workspace.
+ */
 export declare function resolveWorkspace(flag: string | undefined, environment?: NodeJS.ProcessEnv, path?: string): Promise<string | undefined>;
 export declare function readApiKeyFile(path: string): Promise<string>;
 export declare function storeApiKey(apiKey: string, path?: string, workspace?: string | null): Promise<string>;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,qBAAqB;gBAEtB,OAAO,SAA8C;CAIlE;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,qBAAqB;gBAEtB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,uBAAuB;gBACxB,OAAO,EAAE,MAAM;CAC5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,uBAAuB;gBAGlC,OAAO,SAA6E;CAKvF;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,eAAe,CAC7B,aAAa,SAAY,EACzB,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,MAAM,CAGR;AAED,wBAAgB,iBAAiB,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CA+BtF;AAWD,eAAO,MAAM,gBAAgB,mCAAoC,CAAC;AAElE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIxD;AAcD,wBAAsB,wBAAwB,CAAC,IAAI,SAAoB,EAAE,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAU7I;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShG;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzH;AAED,wBAAsB,sBAAsB,CAAC,IAAI,SAAoB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAanG;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAUtG;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAoB3F;AAED,wBAAsB,aAAa,CACjC,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,kGAAkG;AAClG,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBlE;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,SAAoB,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAW5H;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,SAAoB,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrJ"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,qBAAqB;gBAEtB,OAAO,SAA8C;CAIlE;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,qBAAqB;gBAEtB,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,uBAAuB;gBACxB,OAAO,EAAE,MAAM;CAC5B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,uBAAuB;gBAGlC,OAAO,SAA6E;CAKvF;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,eAAe,CAC7B,aAAa,SAAY,EACzB,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,MAAM,CAGR;AAED,wBAAgB,iBAAiB,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CA+BtF;AAWD,eAAO,MAAM,gBAAgB,mCAAoC,CAAC;AAElE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,IAAI,EAAE,MAAM,CAAC;CACd;AAID,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIxD;AAcD,wBAAsB,wBAAwB,CAAC,IAAI,SAAoB,EAAE,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAU7I;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShG;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzH;AAED,wBAAsB,sBAAsB,CAAC,IAAI,SAAoB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAanG;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAUtG;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAoB3F;AAED,wBAAsB,aAAa,CACjC,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW7B;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBlE;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,SAAoB,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAW5H;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,SAAoB,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrJ"}

package/dist/config.js

@@ -230,7 +230,11 @@ async function resolveApiKey(environment = process.env, path) {
         return stored.token;
     throw new MissingApiKeyError();
 }
-/** Workspace precedence: --workspace flag, then DREAMSTATE_WORKSPACE, then the stored default. */
+/**
+ * Workspace precedence: --workspace flag, then DREAMSTATE_WORKSPACE, then the
+ * stored default for the same token. DREAMSTATE_API_KEY replaces the stored
+ * token, so a different key must not inherit the other credential's workspace.
+ */
 async function resolveWorkspace(flag, environment = process.env, path) {
     const fromFlag = flag?.trim();
     if (fromFlag)
@@ -239,7 +243,13 @@ async function resolveWorkspace(flag, environment = process.env, path) {
     if (fromEnvironment)
         return fromEnvironment;
     const credentials = await selectedCredentialsPath(path ?? credentialsPath(undefined, environment), environment);
-    return (await readStoredCredentials(credentials))?.workspace ?? undefined;
+    const stored = await readStoredCredentials(credentials);
+    if (!stored?.workspace)
+        return undefined;
+    const environmentKey = environment.DREAMSTATE_API_KEY?.trim();
+    if (environmentKey && environmentKey !== stored.token)
+        return undefined;
+    return stored.workspace;
 }
 async function readApiKeyFile(path) {
     let file;

package/dist/errors.d.ts

@@ -6,7 +6,7 @@ export declare class CliUsageError extends Error {
  * with a major version. `dreamstate --help` renders their stable meanings.
  *
  * Contract C5 (cross-surface): 0 ok, 1 generic, 2 usage, 3 auth, 4 not found,
- * 5 conflict/validation, 6 rate limited, 7 approval/consent/spend gate required,
+ * 5 conflict/validation, 6 rate limited, 7 repair.kind ask_user (a person must decide),
  * 8 cli_update_required, 9 other refusal. Where this CLI had already published a
  * different meaning it kept the published one and the mapping is documented:
  *
@@ -52,10 +52,6 @@ export declare const CLI_LOCAL_ERROR_REPAIRS: {
         readonly kind: "server_defect";
         readonly hint: "The API response was not a Dreamstate envelope; report the trace id if one was returned.";
     };
-    readonly invalid_tool_turn_token: {
-        readonly kind: "server_defect";
-        readonly hint: "The API did not provide a runnable tool turn; retry after reporting the response trace id.";
-    };
     readonly invalid_web_url: {
         readonly kind: "server_defect";
         readonly hint: "The API returned an invalid web URL; report the response trace id.";
@@ -73,6 +69,6 @@ export declare const CLI_LOCAL_ERROR_REPAIRS: {
         readonly hint: "Sign in with dreamstate login, then retry.";
     };
 };
-export declare function isApprovalGateCode(code: string | undefined): boolean;
+export declare function isApprovalRepair(error: unknown): boolean;
 export declare function isLocalRefusalCode(code: string | undefined): boolean;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;CAaX,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASlE,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAS1B,CAAC;AAyCX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE;AAQD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;CAaX,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQlE,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQ1B,CAAC;AAEX,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMxD;AAQD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEpE"}

package/dist/errors.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_LOCAL_ERROR_REPAIRS = exports.CLI_LOCAL_ERROR_CODES = exports.CLI_EXIT = exports.CliUsageError = void 0;
-exports.isApprovalGateCode = isApprovalGateCode;
+exports.isApprovalRepair = isApprovalRepair;
 exports.isLocalRefusalCode = isLocalRefusalCode;
 class CliUsageError extends Error {
     constructor(message) {
@@ -15,7 +15,7 @@ exports.CliUsageError = CliUsageError;
  * with a major version. `dreamstate --help` renders their stable meanings.
  *
  * Contract C5 (cross-surface): 0 ok, 1 generic, 2 usage, 3 auth, 4 not found,
- * 5 conflict/validation, 6 rate limited, 7 approval/consent/spend gate required,
+ * 5 conflict/validation, 6 rate limited, 7 repair.kind ask_user (a person must decide),
  * 8 cli_update_required, 9 other refusal. Where this CLI had already published a
  * different meaning it kept the published one and the mapping is documented:
  *
@@ -50,7 +50,6 @@ exports.CLI_LOCAL_ERROR_CODES = {
     network_error: 'The request never reached the server (DNS, connection refused, TLS). Nothing executed.',
     request_timeout: 'The server did not answer in time. The effect may have happened. Read the target back first. If the effect is there, report it done. If not, repeat the identical call once with the first attempt\'s idempotency key, never a new one. If the read-back is inconclusive, or the repeat is refused pending acknowledgement, ask the person.',
     invalid_response: 'The server answered with something that is not a Dreamstate envelope.',
-    invalid_tool_turn_token: 'tools get returned no tool_turn_token to run with.',
     invalid_web_url: 'The API returned a web_url that is not a safe http(s) URL.',
     web_url_unavailable: '--open was given but the response carries no web_url.',
     plugin_install_failed: 'dreamstate install could not install the plugin for any agent.',
@@ -61,51 +60,19 @@ exports.CLI_LOCAL_ERROR_REPAIRS = {
     network_error: { kind: 'wait', hint: 'Retry the unchanged request when network connectivity is available.' },
     request_timeout: { kind: 'ask_user', hint: 'Read the target back first. If absent, repeat once with the same idempotency key; otherwise ask the person.' },
     invalid_response: { kind: 'server_defect', hint: 'The API response was not a Dreamstate envelope; report the trace id if one was returned.' },
-    invalid_tool_turn_token: { kind: 'server_defect', hint: 'The API did not provide a runnable tool turn; retry after reporting the response trace id.' },
     invalid_web_url: { kind: 'server_defect', hint: 'The API returned an invalid web URL; report the response trace id.' },
     web_url_unavailable: { kind: 'not_possible', hint: 'This result has no web URL to open.' },
     plugin_install_failed: { kind: 'ask_user', hint: 'Install a supported agent, then retry plugin installation.' },
     skills_authentication_required: { kind: 'ask_user', hint: 'Sign in with dreamstate login, then retry.' },
 };
-/**
- * Refusals that mean a person (or the caller's own spend decision) must supply
- * something before the run can proceed: an approval, a consent, a quote or a
- * spend ceiling. They exit 7, whatever HTTP status carried them, so a script
- * can stop and ask instead of retrying.
- */
-const GATE_CODES = new Set([
-    'approval_required',
-    'standing_approval_required',
-    'destructive_approval_required',
-    'owner_approval_required',
-    'knowledge_approval_required',
-    'content_approval_required',
-    'effect_unknown_approval_required',
-    'approval_cap_exceeded',
-    'approval_stale',
-    'agent_tool_policy_ask_before_changes',
-    'publish_confirmation_required',
-    'launch_authorization_required',
-    'publish_permission_required',
-    'delegation_grant_required',
-    'creator_consent_required',
-    'csv_replace_confirmation_required',
-    'quote_required',
-    'quote_mismatch',
-    'quote_stale',
-    'quote_already_used',
-    'spend_cap',
-    'spend_cap_required',
-    'spend_cap_too_low',
-    'cost_cap_exceeded',
-    'agent_paid_capability_requires_max_credits',
-    'max_rows_required',
-    'mode_required',
-    'sequence_send_cap_required',
-]);
-const GATE_CODE_PATTERN = /(?:approval|consent|confirmation|authorization)_required$|requires_approval$/;
-function isApprovalGateCode(code) {
-    return Boolean(code) && (GATE_CODES.has(code) || GATE_CODE_PATTERN.test(code));
+function isApprovalRepair(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const repair = error.repair;
+    if (!repair || typeof repair !== 'object')
+        return false;
+    const kind = repair.kind;
+    return kind === 'ask_user';
 }
 /**
  * Refusals the CLI decides locally, before running anything, that are not usage

package/dist/gatedRun.d.ts

@@ -1,8 +1,6 @@
 import { CliError, type DreamstateClient } from './client';
 import { type IdempotencyIdentity } from './idempotency';
 export declare function code(error: unknown): string | undefined;
-export declare function toolTurnToken(value: unknown): string;
-export declare function omitsToolTurnForInlineTableRead(capabilityId: string): boolean;
 /** The capability record inside a tools get response, or null when the shape is unknown. */
 export declare function capabilityRecord(fetched: unknown): Record<string, unknown> | null;
 /**
@@ -76,6 +74,8 @@ export interface GatedRunOutcome {
     turnToken: string | null;
 }
 export declare function runGated(context: GatedRunContext, input: GatedRunInput): Promise<GatedRunOutcome>;
+/** Blocker refusal for a run envelope that did not go through runGated (runs wait). */
+export declare function refusalFromRunResult(value: unknown): CliError | null;
 /** A read the CLI needs before it can form a write, run through the same gate as any other run. */
 export declare function readCapability(context: GatedRunContext, capabilityId: string, params: Record<string, unknown>, waitTimeout: number): Promise<unknown>;
 //# sourceMappingURL=gatedRun.d.ts.map

package/dist/gatedRun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatedRun.d.ts","sourceRoot":"","sources":["../src/gatedRun.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAA0B,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEnF,OAAO,EAA4F,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAiBnJ,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIvD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKpD;AA+BD,wBAAgB,+BAA+B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAE7E;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAKjF;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAKrI;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAKzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAazF;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAMrE;AAoCD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qGAAqG;IACrG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AASD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAgKvG;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAGlB"}
+{"version":3,"file":"gatedRun.d.ts","sourceRoot":"","sources":["../src/gatedRun.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAA0B,KAAK,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEnF,OAAO,EAA4F,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAoBnJ,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIvD;AAUD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAKjF;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAKrI;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAKzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAazF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAMrE;AA0HD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qGAAqG;IACrG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AASD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAmMvG;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAEpE;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAClC,OAAO,EAAE,eAAe,EACxB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAGlB"}