@wayai/cli 0.3.40 → 0.3.41

package/dist/commands/admin.js

@@ -1,913 +0,0 @@
-// Platform-admin DO read-only inspection — audits to Loki as admin_debug_read; 403 non-admin; 60/hour.
-import { requireAuth } from '../lib/auth.js';
-import { ApiClient, ApiError } from '../lib/api-client.js';
-import { runDebugObservability } from './observability.js';
-import { parseReportEditArgs } from '../lib/report-edit-args.js';
-// Runtime list is duplicated (not imported from shared) because the CLI is
-// npm-published and @wayai/shared is a workspace devDependency — pulling in
-// the full shared bundle for five strings isn't worth it, and a type-only
-// import keeps the type side as the single source of truth.
-const VALID_TYPES = ['hub', 'org', 'conversation', 'user', 'platform'];
-// Same rationale as VALID_TYPES — kept as `satisfies` so the type side stays canonical.
-// Drift between this and the backend allowlist is caught by admin.test.ts (cross-file invariant).
-const VALID_ANALYTICS_TABLES = [
-    'conversation',
-    'message',
-    'billing_event',
-    'schedule_event',
-];
-export async function adminCommand(args) {
-    const [group, ...afterGroup] = args;
-    if (!group) {
-        printHelp();
-        process.exit(1);
-    }
-    if (group === 'archive') {
-        // `archive` has no sub — all remaining args are positional/flags.
-        const { positional, flagArgs } = splitArgs(afterGroup);
-        await runArchiveRead(positional, flagArgs);
-        return;
-    }
-    if (group === 'observability') {
-        const { positional, flagArgs } = splitArgs(afterGroup);
-        await runObservabilityRead(positional, flagArgs);
-        return;
-    }
-    const [sub, ...rest] = afterGroup;
-    const { positional, flagArgs } = splitArgs(rest);
-    if (group === 'do') {
-        if (!sub) {
-            printHelp();
-            process.exit(1);
-        }
-        switch (sub) {
-            case 'tables':
-                await runDoTables(positional);
-                return;
-            case 'read':
-                await runDoRead(positional, flagArgs);
-                return;
-            default:
-                printHelp();
-                process.exit(1);
-        }
-    }
-    if (group === 'analytics') {
-        if (!sub) {
-            printHelp();
-            process.exit(1);
-        }
-        switch (sub) {
-            case 'tables':
-                await runAnalyticsTables();
-                return;
-            case 'read':
-                await runAnalyticsRead(positional, flagArgs);
-                return;
-            default:
-                printHelp();
-                process.exit(1);
-        }
-    }
-    if (group === 'report') {
-        if (!sub) {
-            printHelp();
-            process.exit(1);
-        }
-        switch (sub) {
-            case 'list':
-                await runReportList(flagArgs);
-                return;
-            case 'show':
-                await runReportShow(positional);
-                return;
-            case 'group':
-                await runReportGroup(positional);
-                return;
-            case 'ungroup':
-                await runReportUngroup(positional);
-                return;
-            case 'escalate':
-                await runReportEscalate(positional, flagArgs);
-                return;
-            case 'shipped':
-                await runReportShipped(positional, flagArgs);
-                return;
-            case 'addressed':
-                await runReportAddressed(positional);
-                return;
-            case 'dismiss':
-                await runReportDismiss(positional, flagArgs);
-                return;
-            case 'hold':
-                await runReportHold(positional, flagArgs);
-                return;
-            case 'update':
-                await runReportUpdate(positional, flagArgs);
-                return;
-            default:
-                printHelp();
-                process.exit(1);
-        }
-    }
-    if (group === 'notice') {
-        if (!sub) {
-            printHelp();
-            process.exit(1);
-        }
-        switch (sub) {
-            case 'create':
-                await runNoticeCreate(flagArgs);
-                return;
-            case 'list':
-                await runNoticeList(flagArgs);
-                return;
-            case 'resolve':
-                await runNoticeResolve(positional);
-                return;
-            default:
-                printHelp();
-                process.exit(1);
-        }
-    }
-    printHelp();
-    process.exit(1);
-}
-function splitArgs(args) {
-    const positional = [];
-    const flagArgs = [];
-    for (const a of args) {
-        if (a.startsWith('--') || flagArgs.length > 0) {
-            flagArgs.push(a);
-        }
-        else {
-            positional.push(a);
-        }
-    }
-    return { positional, flagArgs };
-}
-// ---------------------------------------------------------------------------
-// Subcommands — DO
-// ---------------------------------------------------------------------------
-async function runDoTables(positional) {
-    if (positional.length < 2) {
-        console.error('wayai admin do tables <type> <id>');
-        process.exit(1);
-    }
-    const type = validateType(positional[0]);
-    const id = positional[1];
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    let response;
-    try {
-        response = await client.debugListTables(type, id);
-    }
-    catch (err) {
-        exitOnApiError(err);
-        throw err; // unreachable
-    }
-    const { tables } = response.data;
-    if (tables.length === 0) {
-        console.log('(no allowlisted tables found on this DO)');
-        return;
-    }
-    for (const t of tables)
-        console.log(t);
-}
-async function runDoRead(positional, flagArgs) {
-    if (positional.length < 3) {
-        console.error('wayai admin do read <type> <id> <table> [--limit N] [--id X] [--json]');
-        process.exit(1);
-    }
-    const type = validateType(positional[0]);
-    const id = positional[1];
-    const table = positional[2];
-    const { limit, filterId, jsonOutput } = parseFlags(flagArgs, ['--limit', '--id', '--json']);
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    let response;
-    try {
-        response = await client.debugReadTable(type, id, table, { limit, id: filterId });
-    }
-    catch (err) {
-        exitOnApiError(err);
-        throw err;
-    }
-    printDebugRowsResult(response.data, jsonOutput);
-}
-// ---------------------------------------------------------------------------
-// Subcommands — Analytics (ClickHouse)
-// ---------------------------------------------------------------------------
-async function runAnalyticsTables() {
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    let response;
-    try {
-        response = await client.debugListAnalyticsTables();
-    }
-    catch (err) {
-        exitOnApiError(err);
-        throw err;
-    }
-    const { tables } = response.data;
-    if (tables.length === 0) {
-        console.log('(no analytics tables available)');
-        return;
-    }
-    for (const t of tables)
-        console.log(t);
-}
-async function runAnalyticsRead(positional, flagArgs) {
-    if (positional.length < 1) {
-        console.error('wayai admin analytics read <table> [--conversation-id X] [--hub-id Y] [--message-id Z] [--limit N] [--json]');
-        process.exit(1);
-    }
-    const table = validateAnalyticsTable(positional[0]);
-    const flags = parseFlags(flagArgs, ['--limit', '--json', '--conversation-id', '--hub-id', '--message-id']);
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    let response;
-    try {
-        response = await client.debugReadAnalyticsTable(table, {
-            conversationId: flags.conversationId,
-            hubId: flags.hubId,
-            messageId: flags.messageId,
-            limit: flags.limit,
-        });
-    }
-    catch (err) {
-        exitOnApiError(err);
-        throw err;
-    }
-    printDebugRowsResult(response.data, flags.jsonOutput);
-}
-// ---------------------------------------------------------------------------
-// Subcommands — Archive (R2)
-// ---------------------------------------------------------------------------
-async function runArchiveRead(positional, flagArgs) {
-    if (positional.length < 2) {
-        console.error('wayai admin archive <hub_id> <conversation_id> [--message-id X] [--json]');
-        process.exit(1);
-    }
-    const hubId = positional[0];
-    const conversationId = positional[1];
-    const flags = parseFlags(flagArgs, ['--json', '--message-id']);
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    let response;
-    try {
-        response = await client.debugReadArchive(hubId, conversationId, {
-            messageId: flags.messageId,
-        });
-    }
-    catch (err) {
-        // Archive-specific 404 copy: an admin reading an archive expects "purged or never written"
-        // rather than a generic "not found." Only this subcommand has the context to say that.
-        if (err instanceof ApiError && err.status === 404) {
-            console.error('Archive not found. The conversation may not be ended yet, or the R2 blob may have been purged.');
-            process.exit(1);
-        }
-        exitOnApiError(err);
-        throw err;
-    }
-    const data = response.data;
-    if (flags.jsonOutput) {
-        console.log(JSON.stringify(data, null, 2));
-        return;
-    }
-    // Default pretty-print: archive metadata + a one-line message digest.
-    // Admins who need full content pass --json.
-    const archive = data.archive;
-    console.log(`hub_id:         ${data.hub_id}`);
-    console.log(`conversation_id:${data.conversation_id}`);
-    if (data.message_filtered)
-        console.log('(messages filtered by --message-id)');
-    const messages = Array.isArray(archive.messages) ? archive.messages : [];
-    const files = Array.isArray(archive.files) ? archive.files.length : 0;
-    console.log(`messages:       ${messages.length}`);
-    console.log(`files:          ${files}`);
-    if (messages.length > 0) {
-        console.log('');
-        console.log('messages (id | sender | created_at | text):');
-        for (const m of messages) {
-            const id = String(m.message_id ?? '');
-            const sender = String(m.sender_type ?? '');
-            const ts = String(m.created_at ?? '');
-            const text = truncate(String(m.message_text ?? ''), 80);
-            console.log(`  ${id} | ${sender} | ${ts} | ${text}`);
-        }
-    }
-}
-// ---------------------------------------------------------------------------
-// Subcommands — Observability (R2)
-// ---------------------------------------------------------------------------
-async function runObservabilityRead(positional, flagArgs) {
-    if (positional.length < 2) {
-        console.error('wayai admin observability <hub_id> <conversation_id> [--message-id X] [--json]');
-        process.exit(1);
-    }
-    const hubId = positional[0];
-    const conversationId = positional[1];
-    const flags = parseFlags(flagArgs, ['--json', '--message-id']);
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        await runDebugObservability(client, hubId, conversationId, {
-            messageId: flags.messageId,
-            jsonOutput: flags.jsonOutput,
-        });
-    }
-    catch (err) {
-        if (err instanceof ApiError && err.status === 404) {
-            console.error('Observability data not found. Either the conversation has no LLM turns yet, or R2 entries were purged.');
-            process.exit(1);
-        }
-        exitOnApiError(err);
-        throw err;
-    }
-}
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-function validateType(raw) {
-    if (!raw || !VALID_TYPES.includes(raw)) {
-        console.error(`type must be one of: ${VALID_TYPES.join(', ')}`);
-        process.exit(1);
-    }
-    return raw;
-}
-function validateAnalyticsTable(raw) {
-    if (!raw || !VALID_ANALYTICS_TABLES.includes(raw)) {
-        console.error(`table must be one of: ${VALID_ANALYTICS_TABLES.join(', ')}`);
-        process.exit(1);
-    }
-    return raw;
-}
-function parseFlags(flagArgs, allowed) {
-    const out = { jsonOutput: false };
-    for (let i = 0; i < flagArgs.length; i++) {
-        const arg = flagArgs[i];
-        if (!allowed.includes(arg)) {
-            console.error(`Unknown flag: ${arg}`);
-            process.exit(1);
-        }
-        if (arg === '--json') {
-            out.jsonOutput = true;
-            continue;
-        }
-        const v = flagArgs[++i];
-        if (!v) {
-            console.error(`${arg} requires a value`);
-            process.exit(1);
-        }
-        if (arg === '--limit') {
-            const n = Number.parseInt(v, 10);
-            if (!Number.isFinite(n)) {
-                console.error('--limit must be an integer');
-                process.exit(1);
-            }
-            if (n < 1) {
-                console.error('--limit must be >= 1');
-                process.exit(1);
-            }
-            out.limit = n;
-        }
-        else if (arg === '--id') {
-            out.filterId = v;
-        }
-        else if (arg === '--conversation-id') {
-            out.conversationId = v;
-        }
-        else if (arg === '--hub-id') {
-            out.hubId = v;
-        }
-        else if (arg === '--message-id') {
-            out.messageId = v;
-        }
-    }
-    return out;
-}
-function exitOnApiError(err) {
-    if (err instanceof ApiError) {
-        if (err.status === 401) {
-            console.error('Authentication failed. Run `wayai login` again.');
-            process.exit(1);
-        }
-        if (err.status === 403) {
-            console.error('Access denied. `wayai admin` requires platform-admin access.');
-            console.error('Run `wayai whoami` to check your identity and platform-admin status.');
-            process.exit(1);
-        }
-        if (err.status === 404) {
-            console.error('Not found.');
-            process.exit(1);
-        }
-        if (err.status === 429) {
-            console.error('Rate limited. `wayai admin` is capped at 60 reads/hour per user.');
-            process.exit(1);
-        }
-        if (err.status === 503) {
-            console.error('Admin debug reads are currently disabled (platform kill switch).');
-            process.exit(1);
-        }
-        if (err.status === 400) {
-            console.error(`Bad request: ${err.body || err.message}`);
-            process.exit(1);
-        }
-        console.error(err.message);
-        process.exit(1);
-    }
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
-}
-/**
- * Render the standard debug rows result: --json passes through the raw payload;
- * default mode prints the table + footer with row count, truncation marker, and
- * the redacted-columns summary.
- */
-function printDebugRowsResult(data, jsonOutput) {
-    if (jsonOutput) {
-        console.log(JSON.stringify(data, null, 2));
-        return;
-    }
-    if (data.rows.length === 0) {
-        console.log('(no rows)');
-        if (data.redacted_columns.length > 0) {
-            console.log(`\nredacted columns: ${data.redacted_columns.join(', ')}`);
-        }
-        return;
-    }
-    printRowsTable(data.rows);
-    console.log('');
-    console.log(`rows: ${data.rows.length}${data.truncated ? ` (truncated to ${data.limit})` : ''}`);
-    if (data.redacted_columns.length > 0) {
-        console.log(`redacted columns: ${data.redacted_columns.join(', ')}`);
-    }
-}
-/**
- * Pretty-print rows as a columnar text table. Columns are the union of keys
- * across all rows, ordered by first appearance. Values are coerced to strings
- * and truncated at a per-column width so a single row with a huge blob doesn't
- * blow up the whole table.
- */
-function printRowsTable(rows) {
-    const COL_MAX = 80;
-    const cols = [];
-    for (const row of rows)
-        for (const k of Object.keys(row))
-            if (!cols.includes(k))
-                cols.push(k);
-    const widths = {};
-    for (const c of cols)
-        widths[c] = Math.min(COL_MAX, Math.max(c.length, ...rows.map((r) => formatValue(r[c]).length)));
-    const header = cols.map((c) => c.padEnd(widths[c])).join(' | ');
-    const divider = cols.map((c) => '-'.repeat(widths[c])).join('-+-');
-    console.log(header);
-    console.log(divider);
-    for (const row of rows) {
-        console.log(cols.map((c) => truncate(formatValue(row[c]), widths[c]).padEnd(widths[c])).join(' | '));
-    }
-}
-function formatValue(v) {
-    if (v === null || v === undefined)
-        return 'null';
-    if (typeof v === 'string')
-        return v;
-    return JSON.stringify(v);
-}
-function truncate(s, n) {
-    return s.length > n ? s.slice(0, Math.max(1, n - 1)) + '…' : s;
-}
-// ---------------------------------------------------------------------------
-// Subcommands — Report (platform_report triage queue)
-//
-// Consumed by Claude Code Desktop's 15-min triage routine and by humans
-// running ad-hoc triage. Mutations (group/escalate/addressed/dismiss) drive
-// the state machine in PlatformDO, which is the sole owner of email side
-// effects (escalation, resolution, dismissal — `cli` (human) rows only).
-// ---------------------------------------------------------------------------
-function parseReportFlags(flagArgs) {
-    const out = {};
-    for (let i = 0; i < flagArgs.length; i++) {
-        const flag = flagArgs[i];
-        if (!flag.startsWith('--'))
-            continue;
-        const key = flag.slice(2);
-        const next = flagArgs[i + 1];
-        if (next === undefined || next.startsWith('--')) {
-            out[key] = 'true';
-        }
-        else {
-            out[key] = next;
-            i++;
-        }
-    }
-    return out;
-}
-async function runReportList(flagArgs) {
-    const flags = parseReportFlags(flagArgs);
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.listAdminReports({
-            status: flags.status,
-            source: flags.source,
-            limit: flags.limit ? Number(flags.limit) : undefined,
-            offset: flags.offset ? Number(flags.offset) : undefined,
-            since: flags.since,
-        });
-        if (flags.json === 'true') {
-            console.log(JSON.stringify(result, null, 2));
-            return;
-        }
-        console.log(`Reports: ${result.data.length}/${result.total}`);
-        for (const r of result.data) {
-            const age = Math.floor((Date.now() - r.created_at) / 1000 / 60);
-            const meta = [
-                r.source,
-                r.status,
-                // Surface a broken Sentry reference (set at escalation) — these never auto-resolve.
-                r.sentry_ref_status && r.sentry_ref_status !== 'valid' ? `sentry_ref:${r.sentry_ref_status}` : null,
-                r.gh_issue_url ? `gh:${r.gh_issue_url}` : null,
-            ]
-                .filter(Boolean)
-                .join(' · ');
-            console.log(`  ${r.report_id}  [${meta}]  ${age}m ago`);
-        }
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportShow(positional) {
-    const reportId = positional[0];
-    if (!reportId) {
-        console.error('wayai admin report show <report_id>');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.getAdminReport(reportId);
-        console.log(JSON.stringify(result.data, null, 2));
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportGroup(positional) {
-    const [canonicalId, ...memberIds] = positional;
-    if (!canonicalId || memberIds.length === 0) {
-        console.error('wayai admin report group <canonical_id> <member_id> [<member_id> ...]');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.groupAdminReports(canonicalId, memberIds);
-        console.log(`Grouped ${result.grouped} member(s) under ${result.canonical_id}`);
-        for (const s of result.skipped) {
-            const reason = s.reason === 'different_gh_issue'
-                ? `linked to a different GitHub issue (${s.detail})`
-                : s.reason === 'grouped_elsewhere'
-                    ? `already grouped under ${s.detail}`
-                    : s.reason === 'terminal'
-                        ? `already ${s.detail} (terminal)`
-                        : 'not found';
-            console.log(`  skipped ${s.report_id} — ${reason}`);
-        }
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportUngroup(positional) {
-    const memberId = positional[0];
-    if (!memberId) {
-        console.error('wayai admin report ungroup <member_id>');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.ungroupAdminReport(memberId);
-        console.log(`Detached ${result.report.report_id} → ${result.report.status}`);
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportEscalate(positional, flagArgs) {
-    const reportId = positional[0];
-    const flags = parseReportFlags(flagArgs);
-    const ghUrl = flags.gh;
-    if (!reportId || !ghUrl) {
-        console.error('wayai admin report escalate <report_id> --gh <github_issue_url> [--verdict <text>]');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.transitionAdminReport(reportId, {
-            target: 'escalated',
-            gh_issue_url: ghUrl,
-            ai_verdict: flags.verdict,
-        });
-        console.log(`Report ${result.report.report_id} → ${result.report.status}`);
-        // The backend cross-checks a sentry-sourced report's captured reference
-        // against the live Sentry issue at escalation. A broken ref still escalates
-        // (the bug may be real) but won't auto-resolve on close — flag it loudly.
-        const refStatus = result.report.sentry_ref_status;
-        if (refStatus === 'not_found') {
-            console.log(`  ⚠ Sentry reference not_found — the cited issue does not exist on Sentry. Auto-resolve on close is skipped; verify the reference.`);
-        }
-        else if (refStatus === 'mismatch') {
-            console.log(`  ⚠ Sentry reference mismatch — issue_id resolves but its short_id ≠ the captured one. Auto-resolve on close is skipped.`);
-        }
-        else if (refStatus === 'unverified') {
-            console.log(`  ℹ Sentry reference unverified — could not reach Sentry (no token / API error). Auto-resolve on close is skipped.`);
-        }
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportShipped(positional, flagArgs) {
-    const reportId = positional[0];
-    const flags = parseReportFlags(flagArgs);
-    if (!reportId) {
-        console.error('wayai admin report shipped <report_id> [--note <what shipped, for the reporter>]');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        // `--note` is a value-flag; if omitted, parseReportFlags leaves it undefined and the
-        // backend records a default. Don't pass the literal "true" from a value-less `--note`.
-        const note = flags.note && flags.note !== 'true' ? flags.note : undefined;
-        const result = await client.transitionAdminReport(reportId, { target: 'shipped', note });
-        console.log(`Report ${result.report.report_id} → ${result.report.status} (awaiting reporter verification)`);
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportAddressed(positional) {
-    const reportId = positional[0];
-    if (!reportId) {
-        console.error('wayai admin report addressed <report_id>');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.transitionAdminReport(reportId, { target: 'addressed' });
-        console.log(`Report ${result.report.report_id} → ${result.report.status}`);
-        if (result.cascaded_report_ids.length > 0) {
-            console.log(`Cascaded ${result.cascaded_report_ids.length} grouped member(s).`);
-        }
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportDismiss(positional, flagArgs) {
-    const reportId = positional[0];
-    const flags = parseReportFlags(flagArgs);
-    const reason = flags.reason;
-    if (!reportId || !reason) {
-        console.error('wayai admin report dismiss <report_id> --reason <text> [--verdict <text>] [--final]');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        // `--final` makes the dismissal non-contestable (the reporter can't dispute it). Use it to
-        // settle a clearly-wrong reporter without waiting for the contest cap.
-        const result = await client.transitionAdminReport(reportId, {
-            target: 'dismissed',
-            dismissal_reason: reason,
-            ai_verdict: flags.verdict,
-            final: flags.final === 'true',
-        });
-        console.log(`Report ${result.report.report_id} → ${result.report.status}${flags.final === 'true' ? ' (final — non-contestable)' : ''}`);
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportHold(positional, flagArgs) {
-    const reportId = positional[0];
-    const flags = parseReportFlags(flagArgs);
-    const reason = flags.reason;
-    // Reason is mandatory: a hold with no recorded rationale defeats the whole point (an
-    // auditable, dateable record of *why* this row is waiting another cycle).
-    if (!reportId || !reason || reason === 'true') {
-        console.error('wayai admin report hold <report_id> --reason <text>');
-        console.error('Defers a pending report one triage cycle (records a note + bumps hold_count). Silent — no email.');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.holdAdminReport(reportId, reason);
-        console.log(`Report ${result.report.report_id} held (cycle ${result.report.hold_count}) — remains ${result.report.status}.`);
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runReportUpdate(positional, flagArgs) {
-    const reportId = positional[0];
-    // Use the dedicated content-flag parser (not parseReportFlags): it errors on a
-    // value-less flag and keeps an explicit "" as a clear, so a malformed
-    // `--error` can't silently persist the literal "true" into a content field.
-    const { patch, error } = parseReportEditArgs(flagArgs);
-    if (error) {
-        console.error(error);
-        process.exit(1);
-    }
-    if (!reportId || Object.keys(patch).length === 0) {
-        console.error('wayai admin report update <report_id> [--title <t>] [--description <d>] [--error <e>] [--steps <s>] [--context <c>]');
-        console.error('At least one field to change is required. Pass "" to clear error/steps/context.');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.updateAdminReport(reportId, patch);
-        console.log(`Report ${result.report_id} content updated (status: ${result.status}).`);
-        if (result.status === 'escalated') {
-            console.log('Note: this edit is queue-local — the linked GitHub issue body is NOT updated.');
-        }
-        console.log(JSON.stringify(result.raw_payload, null, 2));
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-// ---------------------------------------------------------------------------
-// Subcommands — Notices (platform broadcasts, feed 2)
-// ---------------------------------------------------------------------------
-const VALID_NOTICE_SEVERITIES = ['critical', 'warn', 'info'];
-async function runNoticeCreate(flagArgs) {
-    const flags = parseReportFlags(flagArgs);
-    const title = flags.title;
-    if (!title || title === 'true') {
-        console.error('wayai admin notice create --title <text> [--severity critical|warn|info] [--scope <scope>] [--body <text>] [--link <url>] [--starts <ISO>] [--ends <ISO>]');
-        console.error('Authors a platform broadcast (feed 2). Severity defaults to info, scope to global.');
-        process.exit(1);
-    }
-    const severity = (flags.severity ?? 'info');
-    if (!VALID_NOTICE_SEVERITIES.includes(severity)) {
-        console.error(`--severity must be one of: ${VALID_NOTICE_SEVERITIES.join(', ')}`);
-        process.exit(1);
-    }
-    // Guard the value-less-flag sentinel (parseReportFlags maps a bare `--scope` to 'true')
-    // so it fails locally with a clear message instead of as a backend regex 400.
-    if (flags.scope === 'true') {
-        console.error('--scope requires a value (e.g. global, provider:gemini, service:analytics)');
-        process.exit(1);
-    }
-    const body = {
-        severity,
-        scope: flags.scope ?? 'global',
-        title,
-        ...(flags.body && flags.body !== 'true' ? { body: flags.body } : {}),
-        ...(flags.link && flags.link !== 'true' ? { link: flags.link } : {}),
-        ...(flags.starts && flags.starts !== 'true' ? { starts_at: flags.starts } : {}),
-        ...(flags.ends && flags.ends !== 'true' ? { ends_at: flags.ends } : {}),
-    };
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.createAdminNotice(body);
-        const n = result.data;
-        console.log(`Created notice ${n.notice_id} — [${n.severity} · ${n.scope}] ${n.title}`);
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runNoticeList(flagArgs) {
-    const flags = parseReportFlags(flagArgs);
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.listAdminNotices({
-            status: flags.status,
-            limit: flags.limit ? Number(flags.limit) : undefined,
-            offset: flags.offset ? Number(flags.offset) : undefined,
-        });
-        if (flags.json === 'true') {
-            console.log(JSON.stringify(result, null, 2));
-            return;
-        }
-        console.log(`Notices: ${result.data.length}/${result.total}`);
-        for (const n of result.data) {
-            const meta = [n.severity, n.scope, n.status, n.ends_at ? `ends:${n.ends_at}` : null]
-                .filter(Boolean)
-                .join(' · ');
-            console.log(`  ${n.notice_id}  [${meta}]  ${n.title}`);
-        }
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-async function runNoticeResolve(positional) {
-    const noticeId = positional[0];
-    if (!noticeId) {
-        console.error('wayai admin notice resolve <notice_id>');
-        process.exit(1);
-    }
-    const { config, accessToken } = await requireAuth();
-    const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-    try {
-        const result = await client.resolveAdminNotice(noticeId);
-        console.log(`Notice ${result.data.notice_id} resolved.`);
-    }
-    catch (err) {
-        exitOnApiError(err);
-    }
-}
-function printHelp() {
-    console.error(`
-wayai admin — platform-admin diagnostic commands
-
-Usage:
-  wayai admin do tables <type> <id>
-  wayai admin do read <type> <id> <table> [--limit N] [--id X] [--json]
-
-  wayai admin analytics tables
-  wayai admin analytics read <table> [--conversation-id X] [--hub-id Y] [--message-id Z] [--limit N] [--json]
-
-  wayai admin archive <hub_id> <conversation_id> [--message-id X] [--json]
-
-  wayai admin observability <hub_id> <conversation_id> [--message-id X] [--json]
-
-  wayai admin report list [--status STATUS] [--source SOURCE] [--limit N] [--offset N] [--since ISO] [--json]
-  wayai admin report show <report_id>
-  wayai admin report group <canonical_id> <member_id> [<member_id> ...]
-  wayai admin report ungroup <member_id>
-  wayai admin report escalate <report_id> --gh <github_issue_url> [--verdict <text>]
-  wayai admin report shipped <report_id> [--note <what shipped, for the reporter>]
-  wayai admin report addressed <report_id>
-  wayai admin report dismiss <report_id> --reason <text> [--verdict <text>] [--final]
-  wayai admin report hold <report_id> --reason <text>
-  wayai admin report update <report_id> [--title <t>] [--description <d>] [--error <e>] [--steps <s>] [--context <c>]
-
-  wayai admin notice create --title <text> [--severity critical|warn|info] [--scope <scope>] [--body <text>] [--link <url>] [--starts <ISO>] [--ends <ISO>]
-  wayai admin notice list [--status active|resolved] [--limit N] [--offset N] [--json]
-  wayai admin notice resolve <notice_id>
-
-Sources:
-  do             Live DO SQLite (existing conversation, hub config, etc.).
-  analytics      ClickHouse projections (conversation, message, billing_event, schedule_event).
-  archive        R2 archive blob — canonical content for ended conversations after DO cleanup.
-  observability  R2 LLM observability — per-message OTel GenAI records (prompts, completions,
-                 tool calls, tokens, latency). Default lists all records for the conversation;
-                 --message-id drills into one. Use this admin variant when the caller has no
-                 hub access; otherwise prefer \`wayai conversations <id> observability\`.
-  report         platform_report triage queue. \`list/show\` are reads; \`group/ungroup/
-                 escalate/addressed/dismiss\` drive the state machine (which owns email
-                 fanout for cli (human) rows). \`ungroup\` detaches a grouped member back
-                 to pending (inverse of \`group\`). \`hold\` defers a pending row one cycle
-                 (records an internal note + bumps hold_count) without transitioning it —
-                 silent for every source. \`update\` amends content fields
-                 (title/description/error/steps/context) while pending/escalated — the
-                 dedup fingerprint stays frozen and no email fires. Agent/Sentry rows
-                 never trigger emails.
-  notice         platform_notice broadcasts (Status & Notices feed 2) — operator-authored
-                 "Gemini degraded" / "Analytics delayed" notices. \`create\` authors one
-                 (severity defaults to info, scope to global); \`list\` reads them
-                 (--status active|resolved); \`resolve\` ends an active notice.
-
-Types (do): ${VALID_TYPES.join(' | ')}
-Tables (analytics): ${VALID_ANALYTICS_TABLES.join(' | ')}
-
-Entity id forms (do):
-  <uuid>          Domain entity id (hub_id, org_id, conversation_id, user_id) —
-                  hashed via idFromName, same path as every other route.
-  hex:<64-hex>    Raw CF DO hex id — resolved via idFromString. Use when you
-                  only have the CF-level id (e.g. from orphan-audit logs, CF
-                  traces, zombie instances with no registry entry).
-  platform        Singleton — literal string, hex: form not supported.
-
-Examples:
-  wayai admin do tables hub 018fab...
-  wayai admin do read conversation <conv-id> message --limit 5 --json
-  wayai admin analytics read message --conversation-id <conv-id>
-  wayai admin analytics read conversation --conversation-id <conv-id>
-  wayai admin archive <hub-id> <conv-id>
-  wayai admin archive <hub-id> <conv-id> --message-id <msg-id> --json
-  wayai admin observability <hub-id> <conv-id>
-  wayai admin observability <hub-id> <conv-id> --message-id <msg-id> --json
-
-Audit + rate limit:
-  Every successful read is logged as admin_debug_read (queryable in Grafana
-  Loki — info-level events are NOT sent to Sentry). Capped at 60 reads/hour/user
-  across all sources. Platform-admin grant required.
-`.trim());
-}
-//# sourceMappingURL=admin.js.map