@trydreamstate/cli 1.3.3 → 1.3.5

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toolTurnToken = exports.omitsToolTurnForInlineTableRead = exports.capabilityIdempotencyKey = exports.CliUsageError = exports.CLI_EXIT = void 0;
+exports.capabilityIdempotencyKey = exports.CliUsageError = exports.CLI_EXIT = void 0;
 exports.parseCliArgs = parseCliArgs;
 exports.refusalEnvelope = refusalEnvelope;
 exports.openWebUrl = openWebUrl;
@@ -20,6 +20,7 @@ const config_1 = require("./config");
 const pluginInstaller_1 = require("./pluginInstaller");
 const turnCache_1 = require("./turnCache");
 const idempotency_1 = require("./idempotency");
+const money_1 = require("./money");
 const runWait_1 = require("./runWait");
 const client_1 = require("./client");
 const errors_1 = require("./errors");
@@ -27,12 +28,10 @@ Object.defineProperty(exports, "CLI_EXIT", { enumerable: true, get: function ()
 Object.defineProperty(exports, "CliUsageError", { enumerable: true, get: function () { return errors_1.CliUsageError; } });
 const gatedRun_1 = require("./gatedRun");
 Object.defineProperty(exports, "capabilityIdempotencyKey", { enumerable: true, get: function () { return gatedRun_1.capabilityIdempotencyKey; } });
-Object.defineProperty(exports, "omitsToolTurnForInlineTableRead", { enumerable: true, get: function () { return gatedRun_1.omitsToolTurnForInlineTableRead; } });
-Object.defineProperty(exports, "toolTurnToken", { enumerable: true, get: function () { return gatedRun_1.toolTurnToken; } });
 const tablesImport_1 = require("./tablesImport");
 const commandTable_1 = require("./commandTable");
 const skillInstaller_1 = require("./skillInstaller");
-const TOOLS_RUN_MODES = ['smoke_test', 'dry_run', 'live'];
+const runContract_1 = require("./runContract");
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const USAGE = `Dreamstate CLI
 
@@ -53,26 +52,28 @@ Usage:
   dreamstate packs list [--json-output|--json]
   dreamstate packs get <pack_id> [--json-output|--json]
   dreamstate packs route --goal <text> [--json-output|--json]
-  dreamstate skills list [--query <query>] [--limit <n>] [--json-output|--json]
+  dreamstate skills list [--query <query>] [--limit <n>] [--cursor <cursor>] [--json-output|--json]
   dreamstate skills get <skill_id> [--file <path>] [--json-output|--json]
   dreamstate skills search <query> [--limit <n>] [--json-output|--json]
   dreamstate skills install [--skill <skill_id|*>] [--agents <codex claude-code cursor>] [--project] [--copy] [--json-output|--json]
   dreamstate skills doctor [--agents <codex claude-code cursor>] [--project] [--json-output|--json]
   dreamstate commands search <term> [--json-output|--json]
-  dreamstate tools search --goal <goal> [--terms <csv>] [--limit <n>] [--toolset <pack_id>] [--json-output|--json]
+  dreamstate tools search --goal <goal> [--terms <csv>] [--limit <n>] [--cursor <cursor>] [--toolset <pack_id>] [--json-output|--json]
   dreamstate tools get <capability_id> [--json-output|--json]
-  dreamstate tools run <capability_id> [--params <object>|--json <body>] [--turn-token <token>] (--live | --dry-run | --mode <smoke_test|dry_run|live>) [--approved] [--approval-id <uuid>] [--approved-effect-unknown] [--max-credits <n>] [--quote-hash <sha256:...>] [--idempotency-key <key>] [--wait-timeout <seconds>] [--no-wait] [--open] [--json-output|--json]
+  dreamstate tools run <capability_id> [--params <object>|--json <body>] [--turn-token <token>] (--live | --dry-run | --mode <smoke_test|dry_run|live>) [--approved] [--approval-id <uuid>] [--approved-effect-unknown] [--max-credits <n>] [--max-live-sends <n>] [--quote-hash <sha256:...>] [--idempotency-key <key>] [--wait-timeout <seconds>] [--no-wait] [--open] [--json-output]
   dreamstate sequences <verb> [args] [flags]
   dreamstate workflows <verb> [args] [flags]
   dreamstate tables import --table-id <uuid> --file <path> [--format <csv|json|jsonl|xlsx>] [--preview] [--upsert-key <header>] [--row-kind <person|company>] [--keep-unmapped-columns <true|false>] [--json-output|--json]
   dreamstate runs list [--limit <n>] [--cursor <cursor>] [--json <query>] [--json-output|--json]
   dreamstate runs get <run_id> [--json-output|--json]
-  dreamstate runs events <run_id> [--json-output|--json]
+  dreamstate runs status <run_id> [--json-output|--json]
+  dreamstate runs wait <run_id> [--wait-timeout <seconds>] [--json-output|--json]
+  dreamstate runs events <run_id> [--limit <n>] [--cursor <cursor>] [--json-output|--json]
   dreamstate runs cancel <run_id> [--state-version <n>] [--reason <text>] [--json <body>] [--idempotency-key <key>] [--json-output|--json]
 
 All catalog discovery reads live API records. Set DREAMSTATE_API_URL and DREAMSTATE_API_KEY.
 Run responses wait for terminal run status by default, timeout default is 120 seconds, --no-wait returns immediate response. Timeout prints latest run envelope and exits ${runWait_1.RUN_WAIT_TIMEOUT_EXIT_CODE}.
-A write you re-run unchanged presents the same Idempotency-Key (printed as meta.idempotency_key), so the server replays instead of running it twice; --idempotency-key sets one yourself. Exit codes: 0 ok, 2 usage, 3 auth, 4 not found, 5 server failure, 6 rate limited, 7 approval/consent/spend gate required, 8 CLI update required, 9 refused, 10 transport, 11 timeout.
+A write you re-run unchanged presents the same Idempotency-Key (printed as meta.idempotency_key), so the server replays instead of running it twice; --idempotency-key sets one yourself. Exit codes: 0 ok, 2 usage, 3 auth, 4 not found, 5 server failure, 6 rate limited, 7 repair.kind ask_user, 8 CLI update required, 9 refused, 10 transport, 11 timeout.
 login opens browser approval and installs Dreamstate skills for detected agents; --no-skills skips installation. login --token stores a ds_user_ session or ds_live_ key (for SSH or remote machines) after verifying it with whoami.
 Global flag --workspace <id|slug> (any command) or DREAMSTATE_WORKSPACE picks the workspace for one call; workspaces use stores a default. Flag beats env beats stored. A ds_live_ key is bound to one workspace and cannot switch.
 logout deletes the stored credentials file. --agents takes space-separated, comma-separated or repeated values.
@@ -103,7 +104,7 @@ function csv(raw, flag = '--terms') {
     return [...new Set(values)];
 }
 function requireToolsRunMode(body) {
-    if (TOOLS_RUN_MODES.includes(body.mode))
+    if (runContract_1.RUN_MODES.includes(body.mode))
         return;
     throw new errors_1.CliUsageError('mode must be one of: smoke_test, dry_run, live.');
 }
@@ -119,6 +120,12 @@ function nonNegativeInteger(raw, flag) {
         throw new errors_1.CliUsageError(`${flag} must be a non-negative integer`);
     return value;
 }
+function positiveInteger(raw, flag) {
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new errors_1.CliUsageError(`${flag} must be an integer greater than or equal to 1`);
+    return value;
+}
 // runs.get returns { data: { run: { state_version } } }. Cancel posts
 // expected_state_version, and a missing read must not invent 0.
 function stateVersionFromRunRead(payload) {
@@ -143,8 +150,13 @@ function parsePacks(argv) {
         return { command: 'packs_list', ...outputOption(values) };
     if (positionals[0] === 'get')
         return { command: 'packs_get', packId: requireOne(positionals, 'dreamstate packs get <pack_id>'), ...outputOption(values) };
-    if (positionals.length === 1 && positionals[0] === 'route' && values.goal?.trim())
-        return { command: 'packs_route', goal: values.goal.trim(), ...outputOption(values) };
+    if (positionals[0] === 'route') {
+        // `packs route "find work emails"` used to fall through to the generic
+        // usage line, which never said the goal belongs in --goal.
+        if (positionals.length === 1 && values.goal?.trim())
+            return { command: 'packs_route', goal: values.goal.trim(), ...outputOption(values) };
+        throw new errors_1.CliUsageError('Usage: dreamstate packs route --goal <text>. Pass the goal as --goal, not as a positional argument.');
+    }
     throw new errors_1.CliUsageError('Usage: dreamstate packs <list|get|route>');
 }
 /** Rewrites `--agents a b c` into `--agents=a --agents=b --agents=c` so parseArgs sees every value. */
@@ -167,7 +179,7 @@ function spaceSeparatedAgents(argv) {
     return out;
 }
 function parseSkills(argv) {
-    const { values, positionals } = (0, node_util_1.parseArgs)({ args: spaceSeparatedAgents(argv), options: { query: { type: 'string' }, limit: { type: 'string' }, skill: { type: 'string' }, file: { type: 'string' }, agents: { type: 'string', multiple: true }, project: { type: 'boolean' }, copy: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
+    const { values, positionals } = (0, node_util_1.parseArgs)({ args: spaceSeparatedAgents(argv), options: { query: { type: 'string' }, limit: { type: 'string' }, cursor: { type: 'string' }, skill: { type: 'string' }, file: { type: 'string' }, agents: { type: 'string', multiple: true }, project: { type: 'boolean' }, copy: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
     if (values.help)
         return { command: 'help' };
     const agents = () => {
@@ -185,8 +197,16 @@ function parseSkills(argv) {
             query.query = values.query;
         if (values.limit !== undefined)
             query.limit = nonNegativeInteger(values.limit, '--limit');
+        if (values.cursor !== undefined) {
+            const cursor = values.cursor.trim();
+            if (!cursor)
+                throw new errors_1.CliUsageError('--cursor must be a non-empty string');
+            query.cursor = cursor;
+        }
         return { command: 'skills_list', query, ...outputOption(values) };
     }
+    if (values.cursor !== undefined)
+        throw new errors_1.CliUsageError('--cursor is only valid on skills list');
     if (positionals[0] === 'get')
         return { command: 'skills_get', skillId: requireOne(positionals, 'dreamstate skills get <skill_id>'), ...(values.file?.trim() ? { file: values.file.trim() } : {}), ...outputOption(values) };
     if (positionals[0] === 'search' && positionals.length > 1) {
@@ -225,8 +245,8 @@ function toolsRunMode(values) {
         chosen.add('live');
     if (values.mode !== undefined) {
         const mode = values.mode.trim();
-        if (!TOOLS_RUN_MODES.includes(mode)) {
-            throw new errors_1.CliUsageError(`--mode must be one of: ${TOOLS_RUN_MODES.join(', ')}`);
+        if (!runContract_1.RUN_MODES.includes(mode)) {
+            throw new errors_1.CliUsageError(`--mode must be one of: ${runContract_1.RUN_MODES.join(', ')}`);
         }
         chosen.add(mode);
     }
@@ -238,12 +258,12 @@ function toolsRunMode(values) {
 function parseTools(argv) {
     const { values, positionals } = (0, node_util_1.parseArgs)({ args: argv, options: {
             json: { type: 'string' }, params: { type: 'string' }, goal: { type: 'string' }, terms: { type: 'string' },
-            limit: { type: 'string' }, toolset: { type: 'string' },
+            limit: { type: 'string' }, cursor: { type: 'string' }, toolset: { type: 'string' },
             'idempotency-key': { type: 'string' }, 'json-output': { type: 'boolean' }, open: { type: 'boolean' },
             'dry-run': { type: 'boolean' }, live: { type: 'boolean' }, mode: { type: 'string' },
             approved: { type: 'boolean' }, 'approved-effect-unknown': { type: 'boolean' },
             'quote-hash': { type: 'string' }, 'approval-id': { type: 'string' },
-            'max-credits': { type: 'string' }, 'turn-token': { type: 'string' }, 'wait-timeout': { type: 'string' }, 'no-wait': { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
+            'max-credits': { type: 'string' }, 'max-live-sends': { type: 'string' }, 'turn-token': { type: 'string' }, 'wait-timeout': { type: 'string' }, 'no-wait': { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
         }, allowPositionals: true, strict: true });
     if (values.help)
         return { command: 'help' };
@@ -256,12 +276,20 @@ function parseTools(argv) {
             query.query_terms = csv(values.terms);
         if (values.limit !== undefined)
             query.limit = nonNegativeInteger(values.limit, '--limit');
+        if (values.cursor !== undefined) {
+            const cursor = values.cursor.trim();
+            if (!cursor)
+                throw new errors_1.CliUsageError('--cursor must be a non-empty string');
+            query.cursor = cursor;
+        }
         if (values.toolset !== undefined)
             query.toolset = values.toolset;
         if (typeof query.goal !== 'string' && !Array.isArray(query.query_terms))
             throw new errors_1.CliUsageError('tools search requires --goal, --terms, or --json query fields');
         return { command: 'tools_search', query, ...output };
     }
+    if (values.cursor !== undefined)
+        throw new errors_1.CliUsageError('--cursor is only valid on tools search');
     if (positionals[0] === 'get')
         return { command: 'tools_get', capabilityId: requireOne(positionals, 'dreamstate tools get <capability_id>'), ...output };
     if (positionals[0] === 'run') {
@@ -293,8 +321,17 @@ function parseTools(argv) {
             body.approved_effect_unknown = true;
         if (values['max-credits'] !== undefined)
             body.max_credits = nonNegativeNumber(values['max-credits'], '--max-credits');
+        if (body.max_live_sends !== undefined) {
+            throw new errors_1.CliUsageError('max_live_sends is a capability parameter. Put it in params.max_live_sends or pass --max-live-sends.');
+        }
+        if (values['max-live-sends'] !== undefined) {
+            const params = body.params;
+            if (!params || typeof params !== 'object' || Array.isArray(params))
+                throw new errors_1.CliUsageError('tools run params must be an object');
+            params.max_live_sends = positiveInteger(values['max-live-sends'], '--max-live-sends');
+        }
         if (values['quote-hash'] !== undefined) {
-            if (!/^sha256:[a-f0-9]{64}$/.test(values['quote-hash']))
+            if (!runContract_1.QUOTE_HASH_PATTERN.test(values['quote-hash']))
                 throw new errors_1.CliUsageError('--quote-hash must be the sha256:<64 hex> quote_hash a dry run returned');
             body.quote_hash = values['quote-hash'];
         }
@@ -317,6 +354,9 @@ function parseTools(argv) {
         if (body.mode !== undefined)
             requireToolsRunMode(body);
         const waitTimeout = values['wait-timeout'] === undefined ? 120 : nonNegativeNumber(values['wait-timeout'], '--wait-timeout');
+        if (values['idempotency-key'] !== undefined && values['idempotency-key'].length > runContract_1.IDEMPOTENCY_KEY_MAX_LENGTH) {
+            throw new errors_1.CliUsageError(`--idempotency-key must be at most ${runContract_1.IDEMPOTENCY_KEY_MAX_LENGTH} characters`);
+        }
         return { command: 'tools_run', capabilityId, body, waitTimeout, ...(values['no-wait'] ? { noWait: true } : {}), ...(values['turn-token'] ? { turnToken: values['turn-token'] } : {}), ...(values['idempotency-key'] ? { idempotencyKey: values['idempotency-key'] } : {}), ...(values.open ? { open: true } : {}), ...output };
     }
     throw new errors_1.CliUsageError('Usage: dreamstate tools <search|get|run>');
@@ -374,7 +414,7 @@ function runsListLimit(raw) {
     return value;
 }
 function parseRuns(argv) {
-    const { values, positionals } = (0, node_util_1.parseArgs)({ args: argv, options: { json: { type: 'string' }, limit: { type: 'string' }, cursor: { type: 'string' }, reason: { type: 'string' }, 'state-version': { type: 'string' }, 'idempotency-key': { type: 'string' }, open: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
+    const { values, positionals } = (0, node_util_1.parseArgs)({ args: argv, options: { json: { type: 'string' }, limit: { type: 'string' }, cursor: { type: 'string' }, reason: { type: 'string' }, 'state-version': { type: 'string' }, 'idempotency-key': { type: 'string' }, 'wait-timeout': { type: 'string' }, open: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
     if (values.help)
         return { command: 'help' };
     const output = outputOption(values);
@@ -390,19 +430,39 @@ function parseRuns(argv) {
         }
         return { command: 'runs_list', query, ...output };
     }
+    if (positionals[0] === 'events') {
+        const runId = requireOne(positionals, 'dreamstate runs events <run_id>');
+        const query = {};
+        if (values.limit !== undefined)
+            query.limit = runsListLimit(values.limit);
+        if (values.cursor !== undefined) {
+            const cursor = values.cursor.trim();
+            if (!cursor)
+                throw new errors_1.CliUsageError('--cursor must be a non-empty string');
+            query.cursor = cursor;
+        }
+        return { command: 'runs_events', runId, ...(Object.keys(query).length ? { query } : {}), ...output };
+    }
     if (values.limit !== undefined || values.cursor !== undefined) {
-        throw new errors_1.CliUsageError('--limit and --cursor are only valid on runs list');
+        throw new errors_1.CliUsageError('--limit and --cursor are only valid on runs list and runs events');
     }
     if (positionals[0] === 'resume') {
         // The server retired generic run resume (verifyExecutionDoorCollapse.ts blocks the
         // route), so there is nothing to call. Say where the replacement is.
         throw new errors_1.CliUsageError('runs resume was retired: the server has no generic run resume. A table run checkpoint resumes with: dreamstate tools run tables.table_runs.resume --params \'{...}\' --live. Start a new run for anything else.');
     }
-    const runId = requireOne(positionals, `dreamstate runs ${positionals[0] ?? '<get|events|cancel>'} <run_id>`);
-    if (positionals[0] === 'get')
+    const runId = requireOne(positionals, `dreamstate runs ${positionals[0] ?? '<get|status|wait|events|cancel>'} <run_id>`);
+    if (positionals[0] === 'get' || positionals[0] === 'status') {
+        if (values['wait-timeout'] !== undefined)
+            throw new errors_1.CliUsageError('--wait-timeout is only valid on runs wait');
         return { command: 'runs_get', runId, ...output };
-    if (positionals[0] === 'events')
-        return { command: 'runs_events', runId, ...output };
+    }
+    if (positionals[0] === 'wait') {
+        const waitTimeout = values['wait-timeout'] === undefined ? 120 : nonNegativeNumber(values['wait-timeout'], '--wait-timeout');
+        return { command: 'runs_wait', runId, waitTimeout, ...output };
+    }
+    if (values['wait-timeout'] !== undefined)
+        throw new errors_1.CliUsageError('--wait-timeout is only valid on runs wait');
     if (positionals[0] === 'cancel') {
         const idempotency = values['idempotency-key'] ? { idempotencyKey: values['idempotency-key'] } : {};
         if (values.json && (values['state-version'] !== undefined || values.reason)) {
@@ -419,7 +479,13 @@ function parseRuns(argv) {
             ...output,
         };
     }
-    throw new errors_1.CliUsageError('Usage: dreamstate runs <list|get|events|cancel> <run_id>');
+    throw new errors_1.CliUsageError('Usage: dreamstate runs <list|get|status|wait|events|cancel> <run_id>');
+}
+function sequencesCommands() {
+    return require('./commands/sequences');
+}
+function workflowsCommands() {
+    return require('./commands/workflows');
 }
 function normalizeJsonOutputAlias(argv) {
     return argv.map((argument, index) => argument === '--json' && (index === argv.length - 1 || argv[index + 1]?.startsWith('-'))
@@ -521,17 +587,15 @@ function parseCliArgs(argv) {
     if (group === 'runs')
         return parseRuns(rest);
     if (group === 'sequences')
-        return require('./commands/sequences').parseSequencesCommand(rest);
+        return sequencesCommands().parseSequencesCommand(rest);
     if (group === 'workflows')
-        return require('./commands/workflows').parseWorkflowsCommand(rest);
+        return workflowsCommands().parseWorkflowsCommand(rest);
     throw new errors_1.CliUsageError(`Unknown command: ${group}`);
 }
 function print(value, stdout, compact) {
-    // Printed exactly as the server returned it. tool_turn_token used to be stripped
-    // here, which made --turn-token impossible to use: a caller could never read the
-    // token from `tools get` to pass back. The token is a short-lived fetch fence tied
-    // to the caller's own session, not a credential, and MCP and REST return it too.
-    stdout.write(`${JSON.stringify(value, null, compact ? 0 : 2)}\n`);
+    // tool_turn_token stays: it is a short-lived fetch fence, not a credential.
+    // Provider USD does not. Customer maps (values, cells, params, ...) are left whole.
+    stdout.write(`${JSON.stringify((0, money_1.scrubCliOutput)(value), null, compact ? 0 : 2)}\n`);
 }
 function printPackRoute(value, stdout) {
     const data = value && typeof value === 'object' && !Array.isArray(value)
@@ -557,7 +621,7 @@ function printPackRoute(value, stdout) {
             continue;
         const { pack_id: packId, reason } = alternate;
         if (typeof packId === 'string')
-            stdout.write(`${packId}${typeof reason === 'string' ? `: ${reason}` : ''}\n`);
+            stdout.write(`${(0, money_1.scrubDollarText)(packId)}${typeof reason === 'string' ? `: ${(0, money_1.scrubDollarText)(reason)}` : ''}\n`);
     }
 }
 /**
@@ -721,12 +785,16 @@ function exitCodeForError(error) {
     // "a person has to decide", and an update-required refusal is 426.
     if (errorCode === 'cli_update_required')
         return errors_1.CLI_EXIT.UPDATE_REQUIRED;
-    if ((0, errors_1.isApprovalGateCode)(errorCode))
-        return errors_1.CLI_EXIT.APPROVAL;
+    // Local transport failures stamp repair.kind ask_user (read the target back,
+    // then ask a person). Their published exits win over that repair.
     if (errorCode === 'request_timeout')
         return errors_1.CLI_EXIT.TIMEOUT;
+    if (errorCode === 'network_error')
+        return errors_1.CLI_EXIT.TRANSPORT;
     if ((0, errors_1.isLocalRefusalCode)(errorCode))
         return errors_1.CLI_EXIT.REFUSED;
+    if ((0, errors_1.isApprovalRepair)(error))
+        return errors_1.CLI_EXIT.APPROVAL;
     const status = error instanceof client_1.CliError ? error.status : 0;
     if (status === 401 || status === 403)
         return errors_1.CLI_EXIT.AUTH;
@@ -734,8 +802,6 @@ function exitCodeForError(error) {
         return errors_1.CLI_EXIT.NOT_FOUND;
     if (status === 429)
         return errors_1.CLI_EXIT.RATE_LIMITED;
-    if (errorCode === 'network_error')
-        return errors_1.CLI_EXIT.TRANSPORT;
     if (status >= 500 || errorCode === 'invalid_response')
         return errors_1.CLI_EXIT.SERVER;
     if (status >= 400)
@@ -797,6 +863,23 @@ function whoamiData(value) {
     const data = value && typeof value === 'object' ? value.data : undefined;
     return data && typeof data === 'object' ? data : {};
 }
+const WORKSPACE_MISMATCH_MESSAGE = 'The server acted in a different workspace than the one you approved.';
+/** Canonical workspace id the whoami request actually acted in, or a refusal. */
+function workspacePinFromWhoami(whoami, requested) {
+    const data = whoamiData(whoami);
+    const acted = typeof data.workspace_id === 'string' ? data.workspace_id : '';
+    const wanted = requested.trim().toLowerCase();
+    const rows = data.workspaces ?? [];
+    const match = rows.find((row) => row.id.toLowerCase() === wanted || row.slug?.toLowerCase() === wanted);
+    if (match) {
+        if (acted !== match.id)
+            throw new client_1.CliError(WORKSPACE_MISMATCH_MESSAGE, 'workspace_mismatch', 400);
+        return match.id;
+    }
+    if (rows.length === 0 && acted.toLowerCase() === wanted)
+        return acted;
+    throw new client_1.CliError(WORKSPACE_MISMATCH_MESSAGE, 'workspace_mismatch', 400);
+}
 /**
  * What `dreamstate status` reports. The release identity comes from the server's
  * own answers (envelope meta and X-Dreamstate-* headers on every response), so
@@ -804,16 +887,15 @@ function whoamiData(value) {
  * "unknown", never "compatible".
  */
 function statusData(whoami, health, info) {
-    const healthData = health && typeof health === 'object' ? health.data : null;
-    const healthVersion = healthData && typeof healthData === 'object' ? healthData.version : null;
-    const serverVersion = info.server_version ?? (typeof healthVersion === 'string' ? healthVersion : null);
-    const resolved = { ...info, server_version: serverVersion };
-    const skew = (0, client_1.describeVersionSkew)(resolved);
+    // health.data.version is not the release. server_version comes only from envelope meta.
+    const serverVersion = info.server_version;
+    const skew = (0, client_1.describeVersionSkew)(info);
     const compatible = skew !== 'cli_below_minimum';
     return {
         cli_version: client_1.CLI_VERSION,
         api_version: serverVersion,
         server_version: serverVersion,
+        registry_hash: info.registry_hash,
         release_sha: info.release_sha,
         minimum_cli_version: info.minimum_cli_version,
         minimum_cli_version_published: info.minimum_cli_version !== null,
@@ -899,17 +981,21 @@ async function loginWithDeviceAuthorization(runtime, stdout, stderr, profile, no
     for (;;) {
         const claim = await (0, client_1.claimDeviceAuthorization)(baseUrl, authorization.device_code);
         if (claim.status === 'ready') {
-            if (profile)
-                await (0, config_1.storeCredentialProfile)(profile, claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
-            else
-                await (0, config_1.storeApiKey)(claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
             const client = new client_1.DreamstateClient({
                 baseUrl,
                 apiKey: claim.token,
+                workspace: claim.workspace.id,
                 requestTimeoutMs: runtime.requestTimeoutMs,
                 onVersionWarning: (message) => (runtime.stderr ?? process.stderr).write(`${message}\n`),
             });
             const whoami = await client.getWhoami();
+            if (whoamiData(whoami).workspace_id !== claim.workspace.id) {
+                throw new client_1.CliError(WORKSPACE_MISMATCH_MESSAGE, 'workspace_mismatch', 400);
+            }
+            if (profile)
+                await (0, config_1.storeCredentialProfile)(profile, claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
+            else
+                await (0, config_1.storeApiKey)(claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
             const skills = await installLoginSkills(client, runtime, noSkills, stderr);
             print(loginResult(whoami, skills), stdout, jsonOutput);
             return;
@@ -1028,10 +1114,11 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 onVersionWarning: (message) => stderr.write(`${message}\n`),
             });
             const whoami = await client.getWhoami();
+            const pinned = requested ? workspacePinFromWhoami(whoami, requested) : null;
             if (command.profile)
-                await (0, config_1.storeCredentialProfile)(command.profile, token, runtimeCredentialsPath(runtime));
+                await (0, config_1.storeCredentialProfile)(command.profile, token, runtimeCredentialsPath(runtime), pinned);
             else
-                await (0, config_1.storeApiKey)(token, runtimeCredentialsPath(runtime));
+                await (0, config_1.storeApiKey)(token, runtimeCredentialsPath(runtime), pinned);
             const skills = await installLoginSkills(client, runtime, Boolean(command.noSkills), stderr);
             print(loginResult(whoami, skills), stdout, Boolean(command.jsonOutput));
             process.exitCode = errors_1.CLI_EXIT.SUCCESS;
@@ -1073,10 +1160,19 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 const key = await readLoginKey(command, runtime);
                 if (!(0, config_1.isDreamstateToken)(key))
                     throw new errors_1.CliUsageError('Dreamstate API keys must start with ds_user_ or ds_live_.');
+                const environment = runtime.env ?? process.env;
+                const requested = extracted.workspace ?? environment.DREAMSTATE_WORKSPACE?.trim();
+                const client = new client_1.DreamstateClient({
+                    baseUrl: (0, config_1.resolveApiBaseUrl)(environment),
+                    apiKey: key,
+                    ...(requested ? { workspace: requested } : {}),
+                    requestTimeoutMs: runtime.requestTimeoutMs,
+                    onVersionWarning: (message) => stderr.write(`${message}\n`),
+                });
+                const pinned = requested ? workspacePinFromWhoami(await client.getWhoami(), requested) : null;
                 const path = command.profile
-                    ? await (0, config_1.storeCredentialProfile)(command.profile, key, runtimeCredentialsPath(runtime))
-                    : await (0, config_1.storeApiKey)(key, runtimeCredentialsPath(runtime));
-                const client = new client_1.DreamstateClient({ baseUrl: (0, config_1.resolveApiBaseUrl)(runtime.env ?? process.env), apiKey: key, requestTimeoutMs: runtime.requestTimeoutMs, onVersionWarning: (message) => stderr.write(`${message}\n`) });
+                    ? await (0, config_1.storeCredentialProfile)(command.profile, key, runtimeCredentialsPath(runtime), pinned)
+                    : await (0, config_1.storeApiKey)(key, runtimeCredentialsPath(runtime), pinned);
                 const skills = await installLoginSkills(client, runtime, Boolean(command.noSkills), stderr);
                 print({ ok: true, data: { credentials_path: path, skills }, meta: {} }, stdout, Boolean(command.jsonOutput));
                 process.exitCode = errors_1.CLI_EXIT.SUCCESS;
@@ -1168,12 +1264,10 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
         // Resolving credentials first would refuse it with not_authenticated.
         if (command.command === 'pack' && command.verb === 'init') {
             if (command.pack === 'sequences') {
-                await require('./commands/sequences')
-                    .runSequencesCommand(undefined, command, stdout);
+                await sequencesCommands().runSequencesCommand(undefined, command, stdout);
             }
             else {
-                await require('./commands/workflows')
-                    .runWorkflowsCommand(undefined, command, stdout);
+                await workflowsCommands().runWorkflowsCommand(undefined, command, stdout);
             }
             process.exitCode = errors_1.CLI_EXIT.SUCCESS;
             return;
@@ -1341,8 +1435,19 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
             case 'runs_get':
                 result = await client.getRun(command.runId);
                 break;
+            case 'runs_wait': {
+                const initial = await client.getRun(command.runId);
+                const waited = await (0, runWait_1.waitForRun)(client, initial, command.waitTimeout, runtime.sleep ?? wait);
+                const blocked = (0, gatedRun_1.refusalFromRunResult)(waited.value);
+                if (blocked)
+                    throw blocked;
+                result = waited.value;
+                if (waited.timedOut)
+                    process.exitCode = runWait_1.RUN_WAIT_TIMEOUT_EXIT_CODE;
+                break;
+            }
             case 'runs_events':
-                result = await client.getRunEvents(command.runId);
+                result = await client.getRunEvents(command.runId, command.query ?? {});
                 break;
             case 'runs_cancel': {
                 const body = command.body ?? {
@@ -1366,10 +1471,10 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
             }
             case 'pack': {
                 if (command.pack === 'sequences') {
-                    await require('./commands/sequences').runSequencesCommand(gatedContext(), command, stdout);
+                    await sequencesCommands().runSequencesCommand(gatedContext(), command, stdout);
                 }
                 else {
-                    await require('./commands/workflows').runWorkflowsCommand(gatedContext(), command, stdout);
+                    await workflowsCommands().runWorkflowsCommand(gatedContext(), command, stdout);
                 }
                 return;
             }
@@ -1386,7 +1491,7 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
     }
     catch (error) {
         const exitCode = exitCodeForError(error);
-        stdout.write(`${JSON.stringify(refusalEnvelope(error, exitCode))}\n`);
+        stdout.write(`${JSON.stringify((0, money_1.scrubCliOutput)(refusalEnvelope(error, exitCode)))}\n`);
         process.exitCode = exitCode;
         throw error;
     }

package/dist/money.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Customers see credits. Provider USD (a key that pairs usd with a cost word,
+ * a cogs key other than cogs_credits, or a provider_cost / provider_spend
+ * prefix) is dropped. Dollar amounts in our own sentences become "an amount".
+ * Customer maps are not entered: annual_revenue_usd and price_usd stay.
+ */
+export declare function isProviderCostKey(key: string): boolean;
+export declare function scrubDollarText(text: string): string;
+export declare function scrubCliOutput(value: unknown, depth?: number): unknown;
+//# sourceMappingURL=money.d.ts.map

package/dist/money.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.d.ts","sourceRoot":"","sources":["../src/money.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQtD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD;AAeD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAWjE"}

package/dist/money.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * Customers see credits. Provider USD (a key that pairs usd with a cost word,
+ * a cogs key other than cogs_credits, or a provider_cost / provider_spend
+ * prefix) is dropped. Dollar amounts in our own sentences become "an amount".
+ * Customer maps are not entered: annual_revenue_usd and price_usd stay.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isProviderCostKey = isProviderCostKey;
+exports.scrubDollarText = scrubDollarText;
+exports.scrubCliOutput = scrubCliOutput;
+const PROVIDER_COST_WORDS = new Set([
+    'provider', 'cost', 'spend', 'spent', 'worst', 'reserved', 'counted', 'settled', 'ledger',
+    'snapshot', 'actual', 'platform', 'vendor', 'upstream', 'internal',
+]);
+const MARGIN_CONTEXT = new Set(['provider', 'platform', 'cogs', 'vendor']);
+const CUSTOMER_DATA_CONTAINERS = new Set([
+    'values', 'cells', 'cell_values', 'row_values', 'field_values', 'record_values',
+    'fields', 'custom_fields', 'attributes', 'payload', 'params',
+]);
+const SCHEMA_KEYWORDS = new Set([
+    'type', '$ref', 'anyOf', 'oneOf', 'allOf', 'enum', 'const', 'properties', 'items', 'description', 'not',
+]);
+const DOLLAR_AMOUNT_TEXT = /(?:US\$|\$)\s?\d[\d,]*(?:\.\d+)?(?:\s?(?:USD|dollars?))?|\b\d[\d,]*(?:\.\d+)?\s?(?:USD|dollars?)\b|\bUSD\s?\d[\d,]*(?:\.\d+)?/gi;
+function snake(key) {
+    return key.replace(/([a-z0-9])([A-Z])/g, '$1_$2').replace(/[-\s.]+/g, '_').toLowerCase();
+}
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function isProviderCostKey(key) {
+    const normalized = snake(key);
+    const tokens = normalized.split('_');
+    if (tokens.includes('cogs') && !tokens.includes('credits'))
+        return true;
+    if (normalized.startsWith('provider_cost') || normalized.startsWith('provider_spend'))
+        return true;
+    if (tokens.includes('usd') && tokens.some((token) => PROVIDER_COST_WORDS.has(token)))
+        return true;
+    if (tokens.includes('margin') && tokens.some((token) => MARGIN_CONTEXT.has(token)))
+        return true;
+    return false;
+}
+function scrubDollarText(text) {
+    DOLLAR_AMOUNT_TEXT.lastIndex = 0;
+    return text.replace(DOLLAR_AMOUNT_TEXT, 'an amount').replace(/\s{2,}/g, ' ');
+}
+function looksLikeSchemaProperties(value) {
+    if (!isPlainObject(value))
+        return false;
+    const entries = Object.values(value);
+    return entries.length > 0 && entries.every((entry) => isPlainObject(entry) && Object.keys(entry).some((key) => SCHEMA_KEYWORDS.has(key)));
+}
+function isCustomerContainer(key, value) {
+    if (key === 'properties')
+        return !looksLikeSchemaProperties(value);
+    return CUSTOMER_DATA_CONTAINERS.has(snake(key)) && isPlainObject(value);
+}
+function scrubCliOutput(value, depth = 0) {
+    if (depth > 32)
+        return value;
+    if (typeof value === 'string')
+        return scrubDollarText(value);
+    if (Array.isArray(value))
+        return value.map((entry) => scrubCliOutput(entry, depth + 1));
+    if (!isPlainObject(value))
+        return value;
+    const output = {};
+    for (const [key, child] of Object.entries(value)) {
+        if (isProviderCostKey(key))
+            continue;
+        output[key] = isCustomerContainer(key, child) ? child : scrubCliOutput(child, depth + 1);
+    }
+    return output;
+}

package/dist/registryManifest.d.ts

@@ -0,0 +1,6 @@
+import type { CapabilityPosture } from './capabilityPosture';
+export declare function lookupPosture(capabilityId: string): CapabilityPosture | null;
+export declare function rememberPosture(capabilityId: string, posture: CapabilityPosture): void;
+/** Records the hash from a response. A change clears cached postures. */
+export declare function noteRegistryHash(hash: string | null): void;
+//# sourceMappingURL=registryManifest.d.ts.map

package/dist/registryManifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registryManifest.d.ts","sourceRoot":"","sources":["../src/registryManifest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAuD7D,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAE5E;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAItF;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAK1D"}