@trydreamstate/cli 1.3.4 → 1.3.6

package/dist/gatedRun.js

@@ -7,6 +7,7 @@ exports.parameterIdempotencyKey = parameterIdempotencyKey;
 exports.cliSurfaceRefusal = cliSurfaceRefusal;
 exports.planFingerprint = planFingerprint;
 exports.runGated = runGated;
+exports.refusalFromRunResult = refusalFromRunResult;
 exports.readCapability = readCapability;
 const node_crypto_1 = require("node:crypto");
 const client_1 = require("./client");
@@ -147,11 +148,103 @@ function quoteFromResult(value, depth = 0) {
     }
     return null;
 }
-function quoteSummary(capabilityId, body, quote) {
+function quotePriced(capabilityId, body, quote) {
     const params = body.params && typeof body.params === 'object' ? body.params : {};
     const rows = typeof params.max_rows === 'number' ? `${params.max_rows} rows` : 'rows not stated';
     const credits = quote.maximum_credits === null ? 'credits not stated' : `up to ${quote.maximum_credits} credits`;
-    return `Dry run of ${capabilityId} priced: ${rows}, ${credits}. Running live on that quote.`;
+    return `Dry run of ${capabilityId} priced: ${rows}, ${credits}.`;
+}
+/** A known price of 0 spends nothing. An unknown price or a positive price is sent only after the caller passes the approval flag. */
+function spendNeedsApproval(maximum, approved) {
+    if (approved)
+        return false;
+    if (maximum === 0)
+        return false;
+    return true;
+}
+const CREDENTIALS_REQUIRED_SENTENCE = 'A connected credential is required before this run can continue.';
+function readinessRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+}
+function blockerSentence(blocker) {
+    if (typeof blocker === 'string' && blocker.trim())
+        return blocker.trim();
+    const record = readinessRecord(blocker);
+    const message = record?.message;
+    return typeof message === 'string' && message.trim() ? message.trim() : null;
+}
+function blockerCodeOf(blocker) {
+    const record = readinessRecord(blocker);
+    const code = record?.code;
+    return typeof code === 'string' && /^[a-z][a-z0-9_]*$/.test(code) ? code : null;
+}
+/**
+ * HTTP 200 can still be a refusal: smoke and dry_run succeed without spending
+ * and attach run_blockers or readiness.blockers. Only those top-level buckets
+ * count. A row skip_reason is not a refusal of the command.
+ */
+function readinessRefusal(value) {
+    const root = readinessRecord(value);
+    const data = readinessRecord(root?.data) ?? root;
+    if (!data)
+        return null;
+    const run = readinessRecord(data.run);
+    const outputs = readinessRecord(run?.outputs);
+    const buckets = [];
+    const states = [];
+    const take = (readiness) => {
+        if (!readiness)
+            return;
+        if (Array.isArray(readiness.blockers))
+            buckets.push(...readiness.blockers);
+        if (typeof readiness.state === 'string')
+            states.push(readiness.state);
+    };
+    // Dry runs put readiness on run.outputs. Durable and polled runs put the
+    // same object on run.steps[].outputs. A blocked rehearsal is an array of
+    // { status:'blocked', blocked_by, next_action }, not { blockers, state }.
+    const absorbSurface = (surface) => {
+        if (!surface)
+            return;
+        if (Array.isArray(surface.run_blockers))
+            buckets.push(...surface.run_blockers);
+        absorbReadiness(surface.readiness);
+    };
+    const absorbReadiness = (readiness) => {
+        if (Array.isArray(readiness)) {
+            for (const entry of readiness) {
+                const row = readinessRecord(entry);
+                if (!row || row.status !== 'blocked')
+                    continue;
+                const blockedBy = Array.isArray(row.blocked_by)
+                    ? row.blocked_by.filter((item) => typeof item === 'string' && /^[a-z][a-z0-9_]*$/.test(item))
+                    : [];
+                const nextAction = typeof row.next_action === 'string' && row.next_action.trim() ? row.next_action.trim() : null;
+                const message = typeof row.message === 'string' && row.message.trim() ? row.message.trim() : null;
+                buckets.push({
+                    ...(blockedBy[0] ? { code: blockedBy[0] } : {}),
+                    message: nextAction ?? message ?? 'This run is blocked until the workspace is ready.',
+                });
+            }
+            return;
+        }
+        take(readinessRecord(readiness));
+    };
+    absorbSurface(outputs);
+    if (Array.isArray(run?.steps)) {
+        for (const step of run.steps)
+            absorbSurface(readinessRecord(readinessRecord(step)?.outputs));
+    }
+    absorbReadiness(run?.readiness);
+    absorbReadiness(data.readiness);
+    const codes = buckets.map(blockerCodeOf).filter((code) => Boolean(code));
+    const sentences = buckets.map(blockerSentence).filter((sentence) => Boolean(sentence));
+    const credentials = codes.includes('credentials_required') || states.includes('credentials_required');
+    if (!credentials && codes.length === 0 && sentences.length === 0)
+        return null;
+    const sentence = sentences[0] ?? (credentials ? CREDENTIALS_REQUIRED_SENTENCE : 'This run is blocked until the workspace is ready.');
+    const code = credentials ? 'credentials_required' : codes[0] ?? 'not_ready';
+    return new client_1.CliError(sentence, code, 409, { retryable: false });
 }
 /** Adds the idempotency key to the printed meta, so a user can see which key to re-run with. */
 function withIdempotencyMeta(value, key) {
@@ -222,11 +315,15 @@ async function runGated(context, input) {
     let turnToken = input.turnToken ?? pending ?? (inlineRead ? undefined : optionalToolTurnToken(fetched));
     // Only a quote the caller named or a dry run of this exact input returned.
     // The server's refusal also shows a price, but that one is information, not consent.
-    let quoteHash = typeof body.quote_hash === 'string'
+    const explicitQuote = typeof body.quote_hash === 'string';
+    let quoteHash = explicitQuote
         ? body.quote_hash
         : live ? cached?.quote_hash ?? undefined : undefined;
+    // null means the price was not stated (or the flag named a hash with no ceiling).
+    let quotedMaximum = !explicitQuote && cached?.quote_hash ? cached.maximum_credits : undefined;
     let ranDryRun = false;
     let sentKey = null;
+    const approvalRequired = () => new client_1.CliError('This run spends credits. Rerun the same command with --approved.', 'approval_required', 409, { retryable: false, repair: { kind: 'ask_user', hint: 'Rerun the same command with --approved.' } });
     const requestBody = () => ({
         ...body,
         ...(turnToken ? { tool_turn_token: turnToken } : {}),
@@ -259,6 +356,16 @@ async function runGated(context, input) {
     let result;
     try {
         try {
+            if (live && quoteHash) {
+                const maximum = explicitQuote ? null : quotedMaximum ?? null;
+                if (spendNeedsApproval(maximum, body.approved === true)) {
+                    stderr.write(`${quotePriced(capabilityId, body, { quote_hash: quoteHash, maximum_credits: maximum })}\n`);
+                    throw approvalRequired();
+                }
+                if (body.approved === true || maximum === 0) {
+                    stderr.write(`${quotePriced(capabilityId, body, { quote_hash: quoteHash, maximum_credits: maximum })}\nRunning live on that quote.\n`);
+                }
+            }
             result = await run();
         }
         catch (error) {
@@ -294,8 +401,12 @@ async function runGated(context, input) {
                 }
                 ranDryRun = true;
                 quoteHash = quote.quote_hash;
-                stderr.write(`${quoteSummary(capabilityId, body, quote)}\n`);
-                await (0, turnCache_1.rememberTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, turnToken, Date.now(), warnTurnCache, { quote_hash: quote.quote_hash, fingerprint });
+                quotedMaximum = quote.maximum_credits;
+                stderr.write(`${quotePriced(capabilityId, body, quote)}\n`);
+                await (0, turnCache_1.rememberTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, turnToken, Date.now(), warnTurnCache, { quote_hash: quote.quote_hash, fingerprint, maximum_credits: quote.maximum_credits });
+                if (spendNeedsApproval(quote.maximum_credits, body.approved === true))
+                    throw approvalRequired();
+                stderr.write('Running live on that quote.\n');
                 result = await run();
             }
             else {
@@ -310,7 +421,7 @@ async function runGated(context, input) {
             if (code(error) === 'approval_required') {
                 stderr.write('This run needs a person\'s approval. Show them the rows and cost above; when they agree, rerun the same command with --approved.\n');
             }
-            await (0, turnCache_1.rememberTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, turnToken, Date.now(), warnTurnCache, quoteHash ? { quote_hash: quoteHash, fingerprint } : undefined);
+            await (0, turnCache_1.rememberTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, turnToken, Date.now(), warnTurnCache, quoteHash ? { quote_hash: quoteHash, fingerprint, ...(quotedMaximum !== undefined ? { maximum_credits: quotedMaximum } : {}) } : undefined);
         }
         // Only an unknown or transient result may resume an attempt. A server
         // refusal with retryable:false is terminal and must receive a new key.
@@ -322,10 +433,8 @@ async function runGated(context, input) {
     if (!input.turnToken) {
         if (body.mode === 'dry_run' && turnToken) {
             const quote = quoteFromResult(result);
-            await (0, turnCache_1.rememberTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, turnToken, Date.now(), warnTurnCache, quote ? { quote_hash: quote.quote_hash, fingerprint } : undefined);
+            await (0, turnCache_1.rememberTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, turnToken, Date.now(), warnTurnCache, quote ? { quote_hash: quote.quote_hash, fingerprint, maximum_credits: quote.maximum_credits } : undefined);
         }
-        else if (pending || ranDryRun)
-            await (0, turnCache_1.forgetTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, warnTurnCache);
     }
     let timedOut = false;
     if (!input.noWait && !posture?.returnsRunId) {
@@ -333,12 +442,24 @@ async function runGated(context, input) {
         result = waited.value;
         timedOut = waited.timedOut;
     }
+    // A timeout still owns the quote and the idempotency key. Forgetting the
+    // turn here made the rerun hash a body with no quote_hash and start a second run.
+    if (!input.turnToken && body.mode !== 'dry_run' && (pending || ranDryRun) && !timedOut) {
+        await (0, turnCache_1.forgetTurnToken)(context.turnsPath, context.baseUrl, context.turnKey, capabilityId, warnTurnCache);
+    }
     // A run still active after waiting has unknown outcome; retain its key for
     // the read-back/retry rule. A terminal response completes this attempt.
     if (attemptIdentity && !timedOut)
         await (0, idempotency_1.finishIdempotencyAttempt)(idempotencyPath, attemptIdentity);
+    const blocked = readinessRefusal(result);
+    if (blocked)
+        throw blocked;
     return { value: withIdempotencyMeta(result, explicitKey ? null : sentKey), timedOut, idempotencyKey: sentKey, turnToken: turnToken ?? null };
 }
+/** Blocker refusal for a run envelope that did not go through runGated (runs wait). */
+function refusalFromRunResult(value) {
+    return readinessRefusal(value);
+}
 /** A read the CLI needs before it can form a write, run through the same gate as any other run. */
 async function readCapability(context, capabilityId, params, waitTimeout) {
     const outcome = await runGated(context, { capabilityId, body: { params }, waitTimeout });

package/dist/generated/packVerbs.generated.json

@@ -1,6 +1,6 @@
 {
     "generated_by": "packages/cli/scripts/generate-pack-verbs.mjs from apps/backend/src/services/v1/capabilityRegistry/catalog.snapshot.json; do not edit by hand",
-    "registry_hash": "a92deba405d5474a601c4781448cfead03ca6320d45744c0dcea4a723f9fee23",
+    "registry_hash": "0919f010ebbbf4a46e5c0e68f9f8f3026abc6420aa325716911cd528c59568ea",
     "verbs": [
         {
             "command": "sequences analytics",

package/dist/index.d.ts

@@ -155,9 +155,15 @@ export type CliCommand = {
     command: 'runs_get';
     runId: string;
     jsonOutput?: boolean;
+} | {
+    command: 'runs_wait';
+    runId: string;
+    waitTimeout: number;
+    jsonOutput?: boolean;
 } | {
     command: 'runs_events';
     runId: string;
+    query?: Record<string, unknown>;
     jsonOutput?: boolean;
 } | {
     command: 'runs_cancel';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AA8BA,OAAO,EAA0F,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAInK,OAAO,EAA0I,KAAK,iBAAiB,EAA6C,MAAM,UAAU,CAAC;AACrO,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAwC,MAAM,UAAU,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAwC,MAAM,YAAY,CAAC;AAG5F,OAAO,EAAqK,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE7N,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAI9C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAC;AA+C7D,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7D;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACrH;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClD;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACrD;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACpD;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAChF;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/E;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClF;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACpI;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClG;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACjF;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACpE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACvM;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAC/D,YAAY,EAAE,wBAAwB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,GAAC,MAAM,GAAC,YAAY,CAAC;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IACjH,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3H;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACnO;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9E;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5D;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErK,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAsVD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAqEvD;AAmCD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoBzF;AAED,KAAK,SAAS,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KAAK;IAAE,KAAK,IAAI,IAAI,CAAC;IAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;CAAE,CAAC;AAEhN,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,SAAiB,GAAG,IAAI,CAyB1E;AA4FD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBvD;AAwBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAkB3F;AAOD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB7G;AA6GD,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAA0B,EAAE,OAAO,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA0Y5G"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AA8BA,OAAO,EAA0F,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAKnK,OAAO,EAA0I,KAAK,iBAAiB,EAA6C,MAAM,UAAU,CAAC;AACrO,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAwC,MAAM,UAAU,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAA8D,MAAM,YAAY,CAAC;AAGlH,OAAO,EAAqK,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE7N,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAI9C,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAC;AAkD7D,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7D;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACrH;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClD;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACrD;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACpD;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAChF;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/E;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClF;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACpI;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClG;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACjF;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACpE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACvM;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAC/D,YAAY,EAAE,wBAAwB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,GAAC,MAAM,GAAC,YAAY,CAAC;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IACjH,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3H;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GACnO;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9E;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5D;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAClF;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAChG;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErK,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAyXD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA2EvD;AAiCD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBzF;AAED,KAAK,SAAS,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,KAAK;IAAE,KAAK,IAAI,IAAI,CAAC;IAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;CAAE,CAAC;AAEhN,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,SAAiB,GAAG,IAAI,CAyB1E;AA4FD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBvD;AAwBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAkB3F;AAwBD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB7G;AAiHD,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAA0B,EAAE,OAAO,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA6Z5G"}

package/dist/index.js

@@ -20,6 +20,7 @@ const config_1 = require("./config");
 const pluginInstaller_1 = require("./pluginInstaller");
 const turnCache_1 = require("./turnCache");
 const idempotency_1 = require("./idempotency");
+const money_1 = require("./money");
 const runWait_1 = require("./runWait");
 const client_1 = require("./client");
 const errors_1 = require("./errors");
@@ -44,6 +45,7 @@ Usage:
   dreamstate status [--json-output|--json]
   dreamstate profiles <list|use|current|remove|env> [name] [--json-output|--json]
   dreamstate whoami [--json-output|--json]
+  dreamstate credits [--json-output|--json]
   dreamstate workspaces list [--json-output|--json]
   dreamstate workspaces use <id|slug>
   dreamstate auth login [--api-key-file <path>] [--no-skills]
@@ -51,13 +53,13 @@ Usage:
   dreamstate packs list [--json-output|--json]
   dreamstate packs get <pack_id> [--json-output|--json]
   dreamstate packs route --goal <text> [--json-output|--json]
-  dreamstate skills list [--query <query>] [--limit <n>] [--json-output|--json]
+  dreamstate skills list [--query <query>] [--limit <n>] [--cursor <cursor>] [--json-output|--json]
   dreamstate skills get <skill_id> [--file <path>] [--json-output|--json]
   dreamstate skills search <query> [--limit <n>] [--json-output|--json]
   dreamstate skills install [--skill <skill_id|*>] [--agents <codex claude-code cursor>] [--project] [--copy] [--json-output|--json]
   dreamstate skills doctor [--agents <codex claude-code cursor>] [--project] [--json-output|--json]
   dreamstate commands search <term> [--json-output|--json]
-  dreamstate tools search --goal <goal> [--terms <csv>] [--limit <n>] [--toolset <pack_id>] [--json-output|--json]
+  dreamstate tools search --goal <goal> [--terms <csv>] [--limit <n>] [--cursor <cursor>] [--toolset <pack_id>] [--json-output|--json]
   dreamstate tools get <capability_id> [--json-output|--json]
   dreamstate tools run <capability_id> [--params <object>|--json <body>] [--turn-token <token>] (--live | --dry-run | --mode <smoke_test|dry_run|live>) [--approved] [--approval-id <uuid>] [--approved-effect-unknown] [--max-credits <n>] [--max-live-sends <n>] [--quote-hash <sha256:...>] [--idempotency-key <key>] [--wait-timeout <seconds>] [--no-wait] [--open] [--json-output]
   dreamstate sequences <verb> [args] [flags]
@@ -65,14 +67,16 @@ Usage:
   dreamstate tables import --table-id <uuid> --file <path> [--format <csv|json|jsonl|xlsx>] [--preview] [--upsert-key <header>] [--row-kind <person|company>] [--keep-unmapped-columns <true|false>] [--json-output|--json]
   dreamstate runs list [--limit <n>] [--cursor <cursor>] [--json <query>] [--json-output|--json]
   dreamstate runs get <run_id> [--json-output|--json]
-  dreamstate runs events <run_id> [--json-output|--json]
+  dreamstate runs status <run_id> [--json-output|--json]
+  dreamstate runs wait <run_id> [--wait-timeout <seconds>] [--json-output|--json]
+  dreamstate runs events <run_id> [--limit <n>] [--cursor <cursor>] [--json-output|--json]
   dreamstate runs cancel <run_id> [--state-version <n>] [--reason <text>] [--json <body>] [--idempotency-key <key>] [--json-output|--json]
 
-All catalog discovery reads live API records. Set DREAMSTATE_API_URL and DREAMSTATE_API_KEY.
+All catalog discovery reads live API records. Run dreamstate login to connect.
 Run responses wait for terminal run status by default, timeout default is 120 seconds, --no-wait returns immediate response. Timeout prints latest run envelope and exits ${runWait_1.RUN_WAIT_TIMEOUT_EXIT_CODE}.
 A write you re-run unchanged presents the same Idempotency-Key (printed as meta.idempotency_key), so the server replays instead of running it twice; --idempotency-key sets one yourself. Exit codes: 0 ok, 2 usage, 3 auth, 4 not found, 5 server failure, 6 rate limited, 7 repair.kind ask_user, 8 CLI update required, 9 refused, 10 transport, 11 timeout.
 login opens browser approval and installs Dreamstate skills for detected agents; --no-skills skips installation. login --token stores a ds_user_ session or ds_live_ key (for SSH or remote machines) after verifying it with whoami.
-Global flag --workspace <id|slug> (any command) or DREAMSTATE_WORKSPACE picks the workspace for one call; workspaces use stores a default. Flag beats env beats stored. A ds_live_ key is bound to one workspace and cannot switch.
+Global flag --workspace <id|slug> (any command) picks the workspace for one call; workspaces use stores a default. Flag beats connection settings, which beat stored defaults. A ds_live_ key is bound to one workspace and cannot switch.
 logout deletes the stored credentials file. --agents takes space-separated, comma-separated or repeated values.
 `;
 function outputOption(values) {
@@ -147,8 +151,13 @@ function parsePacks(argv) {
         return { command: 'packs_list', ...outputOption(values) };
     if (positionals[0] === 'get')
         return { command: 'packs_get', packId: requireOne(positionals, 'dreamstate packs get <pack_id>'), ...outputOption(values) };
-    if (positionals.length === 1 && positionals[0] === 'route' && values.goal?.trim())
-        return { command: 'packs_route', goal: values.goal.trim(), ...outputOption(values) };
+    if (positionals[0] === 'route') {
+        // `packs route "find work emails"` used to fall through to the generic
+        // usage line, which never said the goal belongs in --goal.
+        if (positionals.length === 1 && values.goal?.trim())
+            return { command: 'packs_route', goal: values.goal.trim(), ...outputOption(values) };
+        throw new errors_1.CliUsageError('Usage: dreamstate packs route --goal <text>. Pass the goal as --goal, not as a positional argument.');
+    }
     throw new errors_1.CliUsageError('Usage: dreamstate packs <list|get|route>');
 }
 /** Rewrites `--agents a b c` into `--agents=a --agents=b --agents=c` so parseArgs sees every value. */
@@ -171,7 +180,7 @@ function spaceSeparatedAgents(argv) {
     return out;
 }
 function parseSkills(argv) {
-    const { values, positionals } = (0, node_util_1.parseArgs)({ args: spaceSeparatedAgents(argv), options: { query: { type: 'string' }, limit: { type: 'string' }, skill: { type: 'string' }, file: { type: 'string' }, agents: { type: 'string', multiple: true }, project: { type: 'boolean' }, copy: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
+    const { values, positionals } = (0, node_util_1.parseArgs)({ args: spaceSeparatedAgents(argv), options: { query: { type: 'string' }, limit: { type: 'string' }, cursor: { type: 'string' }, skill: { type: 'string' }, file: { type: 'string' }, agents: { type: 'string', multiple: true }, project: { type: 'boolean' }, copy: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
     if (values.help)
         return { command: 'help' };
     const agents = () => {
@@ -189,8 +198,16 @@ function parseSkills(argv) {
             query.query = values.query;
         if (values.limit !== undefined)
             query.limit = nonNegativeInteger(values.limit, '--limit');
+        if (values.cursor !== undefined) {
+            const cursor = values.cursor.trim();
+            if (!cursor)
+                throw new errors_1.CliUsageError('--cursor must be a non-empty string');
+            query.cursor = cursor;
+        }
         return { command: 'skills_list', query, ...outputOption(values) };
     }
+    if (values.cursor !== undefined)
+        throw new errors_1.CliUsageError('--cursor is only valid on skills list');
     if (positionals[0] === 'get')
         return { command: 'skills_get', skillId: requireOne(positionals, 'dreamstate skills get <skill_id>'), ...(values.file?.trim() ? { file: values.file.trim() } : {}), ...outputOption(values) };
     if (positionals[0] === 'search' && positionals.length > 1) {
@@ -242,7 +259,7 @@ function toolsRunMode(values) {
 function parseTools(argv) {
     const { values, positionals } = (0, node_util_1.parseArgs)({ args: argv, options: {
             json: { type: 'string' }, params: { type: 'string' }, goal: { type: 'string' }, terms: { type: 'string' },
-            limit: { type: 'string' }, toolset: { type: 'string' },
+            limit: { type: 'string' }, cursor: { type: 'string' }, toolset: { type: 'string' },
             'idempotency-key': { type: 'string' }, 'json-output': { type: 'boolean' }, open: { type: 'boolean' },
             'dry-run': { type: 'boolean' }, live: { type: 'boolean' }, mode: { type: 'string' },
             approved: { type: 'boolean' }, 'approved-effect-unknown': { type: 'boolean' },
@@ -260,12 +277,20 @@ function parseTools(argv) {
             query.query_terms = csv(values.terms);
         if (values.limit !== undefined)
             query.limit = nonNegativeInteger(values.limit, '--limit');
+        if (values.cursor !== undefined) {
+            const cursor = values.cursor.trim();
+            if (!cursor)
+                throw new errors_1.CliUsageError('--cursor must be a non-empty string');
+            query.cursor = cursor;
+        }
         if (values.toolset !== undefined)
             query.toolset = values.toolset;
         if (typeof query.goal !== 'string' && !Array.isArray(query.query_terms))
             throw new errors_1.CliUsageError('tools search requires --goal, --terms, or --json query fields');
         return { command: 'tools_search', query, ...output };
     }
+    if (values.cursor !== undefined)
+        throw new errors_1.CliUsageError('--cursor is only valid on tools search');
     if (positionals[0] === 'get')
         return { command: 'tools_get', capabilityId: requireOne(positionals, 'dreamstate tools get <capability_id>'), ...output };
     if (positionals[0] === 'run') {
@@ -390,7 +415,7 @@ function runsListLimit(raw) {
     return value;
 }
 function parseRuns(argv) {
-    const { values, positionals } = (0, node_util_1.parseArgs)({ args: argv, options: { json: { type: 'string' }, limit: { type: 'string' }, cursor: { type: 'string' }, reason: { type: 'string' }, 'state-version': { type: 'string' }, 'idempotency-key': { type: 'string' }, open: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
+    const { values, positionals } = (0, node_util_1.parseArgs)({ args: argv, options: { json: { type: 'string' }, limit: { type: 'string' }, cursor: { type: 'string' }, reason: { type: 'string' }, 'state-version': { type: 'string' }, 'idempotency-key': { type: 'string' }, 'wait-timeout': { type: 'string' }, open: { type: 'boolean' }, 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
     if (values.help)
         return { command: 'help' };
     const output = outputOption(values);
@@ -406,19 +431,39 @@ function parseRuns(argv) {
         }
         return { command: 'runs_list', query, ...output };
     }
+    if (positionals[0] === 'events') {
+        const runId = requireOne(positionals, 'dreamstate runs events <run_id>');
+        const query = {};
+        if (values.limit !== undefined)
+            query.limit = runsListLimit(values.limit);
+        if (values.cursor !== undefined) {
+            const cursor = values.cursor.trim();
+            if (!cursor)
+                throw new errors_1.CliUsageError('--cursor must be a non-empty string');
+            query.cursor = cursor;
+        }
+        return { command: 'runs_events', runId, ...(Object.keys(query).length ? { query } : {}), ...output };
+    }
     if (values.limit !== undefined || values.cursor !== undefined) {
-        throw new errors_1.CliUsageError('--limit and --cursor are only valid on runs list');
+        throw new errors_1.CliUsageError('--limit and --cursor are only valid on runs list and runs events');
     }
     if (positionals[0] === 'resume') {
         // The server retired generic run resume (verifyExecutionDoorCollapse.ts blocks the
         // route), so there is nothing to call. Say where the replacement is.
         throw new errors_1.CliUsageError('runs resume was retired: the server has no generic run resume. A table run checkpoint resumes with: dreamstate tools run tables.table_runs.resume --params \'{...}\' --live. Start a new run for anything else.');
     }
-    const runId = requireOne(positionals, `dreamstate runs ${positionals[0] ?? '<get|events|cancel>'} <run_id>`);
-    if (positionals[0] === 'get')
+    const runId = requireOne(positionals, `dreamstate runs ${positionals[0] ?? '<get|status|wait|events|cancel>'} <run_id>`);
+    if (positionals[0] === 'get' || positionals[0] === 'status') {
+        if (values['wait-timeout'] !== undefined)
+            throw new errors_1.CliUsageError('--wait-timeout is only valid on runs wait');
         return { command: 'runs_get', runId, ...output };
-    if (positionals[0] === 'events')
-        return { command: 'runs_events', runId, ...output };
+    }
+    if (positionals[0] === 'wait') {
+        const waitTimeout = values['wait-timeout'] === undefined ? 120 : nonNegativeNumber(values['wait-timeout'], '--wait-timeout');
+        return { command: 'runs_wait', runId, waitTimeout, ...output };
+    }
+    if (values['wait-timeout'] !== undefined)
+        throw new errors_1.CliUsageError('--wait-timeout is only valid on runs wait');
     if (positionals[0] === 'cancel') {
         const idempotency = values['idempotency-key'] ? { idempotencyKey: values['idempotency-key'] } : {};
         if (values.json && (values['state-version'] !== undefined || values.reason)) {
@@ -435,7 +480,7 @@ function parseRuns(argv) {
             ...output,
         };
     }
-    throw new errors_1.CliUsageError('Usage: dreamstate runs <list|get|events|cancel> <run_id>');
+    throw new errors_1.CliUsageError('Usage: dreamstate runs <list|get|status|wait|events|cancel> <run_id>');
 }
 function sequencesCommands() {
     return require('./commands/sequences');
@@ -512,6 +557,14 @@ function parseCliArgs(argv) {
             return { command: 'whoami', ...outputOption(values) };
         throw new errors_1.CliUsageError('Usage: dreamstate whoami [--json-output]');
     }
+    if (group === 'credits') {
+        const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
+        if (values.help)
+            return { command: 'help' };
+        if (positionals.length)
+            throw new errors_1.CliUsageError('Usage: dreamstate credits [--json-output]');
+        return parseTools(['run', 'workspace.usage.status_get', '--params', '{}', ...rest]);
+    }
     if (group === 'workspaces') {
         const { values, positionals } = (0, node_util_1.parseArgs)({ args: rest, options: { 'json-output': { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
         if (values.help)
@@ -549,11 +602,9 @@ function parseCliArgs(argv) {
     throw new errors_1.CliUsageError(`Unknown command: ${group}`);
 }
 function print(value, stdout, compact) {
-    // Printed exactly as the server returned it. tool_turn_token used to be stripped
-    // here, which made --turn-token impossible to use: a caller could never read the
-    // token from `tools get` to pass back. The token is a short-lived fetch fence tied
-    // to the caller's own session, not a credential, and MCP and REST return it too.
-    stdout.write(`${JSON.stringify(value, null, compact ? 0 : 2)}\n`);
+    // tool_turn_token stays: it is a short-lived fetch fence, not a credential.
+    // Provider USD does not. Customer maps (values, cells, params, ...) are left whole.
+    stdout.write(`${JSON.stringify((0, money_1.scrubCliOutput)(value), null, compact ? 0 : 2)}\n`);
 }
 function printPackRoute(value, stdout) {
     const data = value && typeof value === 'object' && !Array.isArray(value)
@@ -579,7 +630,7 @@ function printPackRoute(value, stdout) {
             continue;
         const { pack_id: packId, reason } = alternate;
         if (typeof packId === 'string')
-            stdout.write(`${packId}${typeof reason === 'string' ? `: ${reason}` : ''}\n`);
+            stdout.write(`${(0, money_1.scrubDollarText)(packId)}${typeof reason === 'string' ? `: ${(0, money_1.scrubDollarText)(reason)}` : ''}\n`);
     }
 }
 /**
@@ -600,6 +651,7 @@ function refusalEnvelope(error, exitCode) {
             // The client keeps the server's retry decision and repair; dropping them
             // here left CLI automation without the recovery Architect and MCP get.
             ...(cliError?.repair === undefined ? {} : { repair: cliError.repair }),
+            ...(!cliError ? { repair: { kind: 'fix_input', hint: error instanceof config_1.MissingApiKeyError ? 'Run dreamstate login, then retry.' : 'Run dreamstate --help, correct the input or connection settings, then retry.' } } : {}),
             ...(cliError?.details === undefined ? {} : { details: cliError.details }),
         },
         meta: {
@@ -782,7 +834,7 @@ async function readLoginKey(command, runtime) {
     }
     if (runtime.promptHidden)
         return runtime.promptHidden('API key (input hidden): ');
-    throw new errors_1.CliUsageError('No API key provided. Pipe it on stdin, set DREAMSTATE_API_KEY, or pass --api-key-file.');
+    throw new errors_1.CliUsageError('No API key provided. Run dreamstate login, pipe a key on stdin, or pass --api-key-file.');
 }
 function deviceState() {
     return (0, node_crypto_1.randomBytes)(32).toString('base64url');
@@ -821,6 +873,23 @@ function whoamiData(value) {
     const data = value && typeof value === 'object' ? value.data : undefined;
     return data && typeof data === 'object' ? data : {};
 }
+const WORKSPACE_MISMATCH_MESSAGE = 'The server acted in a different workspace than the one you approved.';
+/** Canonical workspace id the whoami request actually acted in, or a refusal. */
+function workspacePinFromWhoami(whoami, requested) {
+    const data = whoamiData(whoami);
+    const acted = typeof data.workspace_id === 'string' ? data.workspace_id : '';
+    const wanted = requested.trim().toLowerCase();
+    const rows = data.workspaces ?? [];
+    const match = rows.find((row) => row.id.toLowerCase() === wanted || row.slug?.toLowerCase() === wanted);
+    if (match) {
+        if (acted !== match.id)
+            throw new client_1.CliError(WORKSPACE_MISMATCH_MESSAGE, 'workspace_mismatch', 400);
+        return match.id;
+    }
+    if (rows.length === 0 && acted.toLowerCase() === wanted)
+        return acted;
+    throw new client_1.CliError(WORKSPACE_MISMATCH_MESSAGE, 'workspace_mismatch', 400);
+}
 /**
  * What `dreamstate status` reports. The release identity comes from the server's
  * own answers (envelope meta and X-Dreamstate-* headers on every response), so
@@ -922,17 +991,21 @@ async function loginWithDeviceAuthorization(runtime, stdout, stderr, profile, no
     for (;;) {
         const claim = await (0, client_1.claimDeviceAuthorization)(baseUrl, authorization.device_code);
         if (claim.status === 'ready') {
-            if (profile)
-                await (0, config_1.storeCredentialProfile)(profile, claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
-            else
-                await (0, config_1.storeApiKey)(claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
             const client = new client_1.DreamstateClient({
                 baseUrl,
                 apiKey: claim.token,
+                workspace: claim.workspace.id,
                 requestTimeoutMs: runtime.requestTimeoutMs,
                 onVersionWarning: (message) => (runtime.stderr ?? process.stderr).write(`${message}\n`),
             });
             const whoami = await client.getWhoami();
+            if (whoamiData(whoami).workspace_id !== claim.workspace.id) {
+                throw new client_1.CliError(WORKSPACE_MISMATCH_MESSAGE, 'workspace_mismatch', 400);
+            }
+            if (profile)
+                await (0, config_1.storeCredentialProfile)(profile, claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
+            else
+                await (0, config_1.storeApiKey)(claim.token, runtimeCredentialsPath(runtime), claim.workspace.id);
             const skills = await installLoginSkills(client, runtime, noSkills, stderr);
             print(loginResult(whoami, skills), stdout, jsonOutput);
             return;
@@ -1051,10 +1124,11 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 onVersionWarning: (message) => stderr.write(`${message}\n`),
             });
             const whoami = await client.getWhoami();
+            const pinned = requested ? workspacePinFromWhoami(whoami, requested) : null;
             if (command.profile)
-                await (0, config_1.storeCredentialProfile)(command.profile, token, runtimeCredentialsPath(runtime));
+                await (0, config_1.storeCredentialProfile)(command.profile, token, runtimeCredentialsPath(runtime), pinned);
             else
-                await (0, config_1.storeApiKey)(token, runtimeCredentialsPath(runtime));
+                await (0, config_1.storeApiKey)(token, runtimeCredentialsPath(runtime), pinned);
             const skills = await installLoginSkills(client, runtime, Boolean(command.noSkills), stderr);
             print(loginResult(whoami, skills), stdout, Boolean(command.jsonOutput));
             process.exitCode = errors_1.CLI_EXIT.SUCCESS;
@@ -1096,10 +1170,19 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
                 const key = await readLoginKey(command, runtime);
                 if (!(0, config_1.isDreamstateToken)(key))
                     throw new errors_1.CliUsageError('Dreamstate API keys must start with ds_user_ or ds_live_.');
+                const environment = runtime.env ?? process.env;
+                const requested = extracted.workspace ?? environment.DREAMSTATE_WORKSPACE?.trim();
+                const client = new client_1.DreamstateClient({
+                    baseUrl: (0, config_1.resolveApiBaseUrl)(environment),
+                    apiKey: key,
+                    ...(requested ? { workspace: requested } : {}),
+                    requestTimeoutMs: runtime.requestTimeoutMs,
+                    onVersionWarning: (message) => stderr.write(`${message}\n`),
+                });
+                const pinned = requested ? workspacePinFromWhoami(await client.getWhoami(), requested) : null;
                 const path = command.profile
-                    ? await (0, config_1.storeCredentialProfile)(command.profile, key, runtimeCredentialsPath(runtime))
-                    : await (0, config_1.storeApiKey)(key, runtimeCredentialsPath(runtime));
-                const client = new client_1.DreamstateClient({ baseUrl: (0, config_1.resolveApiBaseUrl)(runtime.env ?? process.env), apiKey: key, requestTimeoutMs: runtime.requestTimeoutMs, onVersionWarning: (message) => stderr.write(`${message}\n`) });
+                    ? await (0, config_1.storeCredentialProfile)(command.profile, key, runtimeCredentialsPath(runtime), pinned)
+                    : await (0, config_1.storeApiKey)(key, runtimeCredentialsPath(runtime), pinned);
                 const skills = await installLoginSkills(client, runtime, Boolean(command.noSkills), stderr);
                 print({ ok: true, data: { credentials_path: path, skills }, meta: {} }, stdout, Boolean(command.jsonOutput));
                 process.exitCode = errors_1.CLI_EXIT.SUCCESS;
@@ -1362,8 +1445,19 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
             case 'runs_get':
                 result = await client.getRun(command.runId);
                 break;
+            case 'runs_wait': {
+                const initial = await client.getRun(command.runId);
+                const waited = await (0, runWait_1.waitForRun)(client, initial, command.waitTimeout, runtime.sleep ?? wait);
+                const blocked = (0, gatedRun_1.refusalFromRunResult)(waited.value);
+                if (blocked)
+                    throw blocked;
+                result = waited.value;
+                if (waited.timedOut)
+                    process.exitCode = runWait_1.RUN_WAIT_TIMEOUT_EXIT_CODE;
+                break;
+            }
             case 'runs_events':
-                result = await client.getRunEvents(command.runId);
+                result = await client.getRunEvents(command.runId, command.query ?? {});
                 break;
             case 'runs_cancel': {
                 const body = command.body ?? {
@@ -1407,7 +1501,7 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
     }
     catch (error) {
         const exitCode = exitCodeForError(error);
-        stdout.write(`${JSON.stringify(refusalEnvelope(error, exitCode))}\n`);
+        stdout.write(`${JSON.stringify((0, money_1.scrubCliOutput)(refusalEnvelope(error, exitCode)))}\n`);
         process.exitCode = exitCode;
         throw error;
     }

package/dist/money.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Customers see credits. Provider USD (a key that pairs usd with a cost word,
+ * a cogs key other than cogs_credits, or a provider_cost / provider_spend
+ * prefix) is dropped. Dollar amounts in our own sentences become "an amount".
+ * Customer maps are not entered: annual_revenue_usd and price_usd stay.
+ */
+export declare function isProviderCostKey(key: string): boolean;
+export declare function scrubDollarText(text: string): string;
+export declare function scrubCliOutput(value: unknown, depth?: number): unknown;
+//# sourceMappingURL=money.d.ts.map

package/dist/money.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"money.d.ts","sourceRoot":"","sources":["../src/money.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQtD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD;AAeD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAWjE"}