@xylabs/aries 0.1.1

package/dist/commands/datalakeCommand.mjs

@@ -0,0 +1,1637 @@
+// src/actions/datalake/audit/auditLog.ts
+import { spawn } from "child_process";
+import {
+  createReadStream,
+  existsSync,
+  readdirSync,
+  statSync,
+  unlinkSync
+} from "fs";
+import path2 from "path";
+import { createInterface } from "readline";
+import { createDatalakeClient } from "@xylabs/aries-datalake-client";
+import chalk from "chalk";
+
+// src/actions/datalake/dev/paths.ts
+import { homedir } from "os";
+import path from "path";
+function getAriesHome() {
+  return process.env.ARIES_HOME ?? path.join(homedir(), ".aries");
+}
+function getDevDir() {
+  return path.join(getAriesHome(), "dev");
+}
+function getDevStatePath() {
+  return path.join(getDevDir(), "state.json");
+}
+function getDevPidPath() {
+  return path.join(getDevDir(), "pid");
+}
+function getDevLogPath() {
+  return path.join(getDevDir(), "server.log");
+}
+
+// src/actions/datalake/audit/auditLog.ts
+var AUDIT_FILE_PATTERN = /^audit-\d{4}-\d{2}-\d{2}\.log$/;
+function defaultSingleFile() {
+  return path2.join(getDevDir(), "audit.log");
+}
+function defaultRotationDir() {
+  return path2.join(getDevDir(), "audit");
+}
+function listRotatedFiles(directory) {
+  if (!existsSync(directory)) return [];
+  return readdirSync(directory).filter((file) => AUDIT_FILE_PATTERN.test(file)).toSorted().map((file) => path2.join(directory, file));
+}
+function resolveSource(override) {
+  if (override) {
+    if (!existsSync(override)) return void 0;
+    const stat = statSync(override);
+    if (stat.isDirectory()) {
+      const files2 = listRotatedFiles(override);
+      if (files2.length === 0) return void 0;
+      return {
+        files: files2,
+        tailFile: files2.at(-1),
+        description: override
+      };
+    }
+    return {
+      files: [override],
+      tailFile: override,
+      description: override
+    };
+  }
+  const single = defaultSingleFile();
+  if (existsSync(single)) {
+    return {
+      files: [single],
+      tailFile: single,
+      description: single
+    };
+  }
+  const rotDir = defaultRotationDir();
+  const files = listRotatedFiles(rotDir);
+  if (files.length === 0) return void 0;
+  return {
+    files,
+    tailFile: files.at(-1),
+    description: rotDir
+  };
+}
+async function resolveDatalakeId(target) {
+  if (target.startsWith("dl_")) return target;
+  const client = createDatalakeClient();
+  const descriptor = await client.describe(target);
+  return descriptor.id;
+}
+async function buildFilters(options) {
+  return {
+    datalakeId: options.datalake ? await resolveDatalakeId(options.datalake) : void 0,
+    statusPrefix: options.status,
+    method: options.method?.toUpperCase(),
+    authenticated: options.authenticated === void 0 ? void 0 : options.authenticated === "true",
+    grepRegex: options.grep ? new RegExp(options.grep) : void 0
+  };
+}
+function matchesFilters(line, entry, filters) {
+  if (filters.datalakeId && entry.datalakeId !== filters.datalakeId) return false;
+  if (filters.statusPrefix && !String(entry.statusCode).startsWith(filters.statusPrefix)) return false;
+  if (filters.method && entry.method !== filters.method) return false;
+  if (filters.authenticated !== void 0 && entry.authenticated !== filters.authenticated) return false;
+  if (filters.grepRegex && !filters.grepRegex.test(line)) return false;
+  return true;
+}
+function formatEntry(entry) {
+  const when = entry.time.slice(11, 19);
+  const status = entry.statusCode >= 500 ? chalk.red(String(entry.statusCode)) : entry.statusCode >= 400 ? chalk.yellow(String(entry.statusCode)) : chalk.green(String(entry.statusCode));
+  const subject = entry.authenticated ? chalk.magenta(entry.subject) : chalk.gray(entry.subject);
+  const duration = chalk.gray(`${entry.durationMs}ms`);
+  return `${chalk.gray(when)} ${status} ${entry.method.padEnd(6)} ${entry.path} ${subject} ${duration}`;
+}
+function parseLine(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    return void 0;
+  }
+}
+async function auditLog(options = {}) {
+  const source = resolveSource(options.file);
+  if (!source) {
+    const location = options.file ?? `${defaultSingleFile()} or ${defaultRotationDir()}`;
+    console.log(chalk.yellow(`no audit log at ${location}`));
+    console.log(chalk.gray("enable with `aries datalake dev up --audit` (or --audit --audit-rotate)"));
+    process.exitCode = 3;
+    return;
+  }
+  const filters = await buildFilters(options);
+  if (options.follow) {
+    await followLog(source.tailFile, filters, options.lines ?? 0);
+    return;
+  }
+  await dumpTail(source.files, filters, options.lines ?? 50);
+}
+async function dumpTail(files, filters, limit) {
+  const ring = [];
+  for (const filePath of files) {
+    const stream = createReadStream(filePath, { encoding: "utf8" });
+    const rl = createInterface({ input: stream, crlfDelay: Infinity });
+    for await (const line of rl) {
+      if (!line.trim()) continue;
+      const entry = parseLine(line);
+      if (!entry) continue;
+      if (!matchesFilters(line, entry, filters)) continue;
+      ring.push(formatEntry(entry));
+      if (ring.length > limit) ring.shift();
+    }
+  }
+  for (const row of ring) console.log(row);
+}
+async function followLog(filePath, filters, initialLines) {
+  if (initialLines > 0) {
+    await dumpTail([filePath], filters, initialLines);
+  }
+  const startOffset = statSync(filePath).size;
+  const child = spawn("tail", ["-f", "-c", "+0", filePath], { stdio: ["ignore", "pipe", "inherit"] });
+  child.stdout.setEncoding("utf8");
+  let buffer = "";
+  let bytesSeen = 0;
+  child.stdout.on("data", (chunk) => {
+    bytesSeen += Buffer.byteLength(chunk, "utf8");
+    buffer += chunk;
+    const lines = buffer.split("\n");
+    buffer = lines.pop() ?? "";
+    if (bytesSeen < startOffset) return;
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      const entry = parseLine(line);
+      if (!entry) continue;
+      if (!matchesFilters(line, entry, filters)) continue;
+      console.log(formatEntry(entry));
+    }
+  });
+  await new Promise((resolve) => {
+    child.on("exit", (code) => {
+      process.exitCode = code ?? 0;
+      resolve();
+    });
+  });
+}
+function purgeAuditLog(options) {
+  const directory = options.directory ?? defaultRotationDir();
+  if (!existsSync(directory)) return [];
+  const cutoff = Date.now() - options.maxAgeDays * 864e5;
+  const removed = [];
+  for (const file of readdirSync(directory)) {
+    if (!AUDIT_FILE_PATTERN.test(file)) continue;
+    const fullPath = path2.join(directory, file);
+    const stat = statSync(fullPath);
+    if (stat.mtimeMs >= cutoff) continue;
+    if (!options.dryRun) unlinkSync(fullPath);
+    removed.push(fullPath);
+  }
+  return removed;
+}
+
+// src/commands/datalakeAuditCommand.ts
+var viewCommand = {
+  command: ["view", "$0"],
+  describe: "Print audit log rows (default)",
+  builder: (yargs) => yargs.option("follow", {
+    alias: "f",
+    type: "boolean",
+    default: false,
+    describe: "Stream new rows as they arrive (tails the most recent file)"
+  }).option("lines", {
+    alias: "n",
+    type: "number",
+    default: 50,
+    describe: "Tail this many rows (0 = start fresh in --follow mode)"
+  }).option("datalake", {
+    alias: "d",
+    type: "string",
+    describe: "Filter by datalake name or id"
+  }).option("status", {
+    type: "string",
+    describe: "Status code prefix filter (e.g. 4 matches 4xx)"
+  }).option("method", {
+    type: "string",
+    describe: "HTTP method filter (GET, POST, etc.)"
+  }).option("authenticated", {
+    type: "string",
+    choices: ["true", "false"],
+    describe: "Show only authenticated or only anonymous requests"
+  }).option("grep", {
+    type: "string",
+    describe: "Regex pattern applied to the raw JSON line"
+  }).option("file", {
+    type: "string",
+    describe: "File or directory (auto-detects rotation layout)"
+  }),
+  handler: async (argv) => {
+    await auditLog({
+      follow: argv.follow,
+      lines: argv.lines,
+      datalake: argv.datalake,
+      status: argv.status,
+      method: argv.method,
+      authenticated: argv.authenticated,
+      grep: argv.grep,
+      file: argv.file
+    });
+  }
+};
+var purgeCommand = {
+  command: "purge",
+  describe: "Delete rotated audit files older than --max-age-days",
+  builder: (yargs) => yargs.option("max-age-days", {
+    type: "number",
+    demandOption: true,
+    describe: "Retention window; files older than this are deleted"
+  }).option("directory", {
+    type: "string",
+    describe: "Rotation directory (defaults to <ARIES_HOME>/dev/audit)"
+  }).option("dry-run", {
+    type: "boolean",
+    default: false,
+    describe: "Report what would be deleted without removing anything"
+  }),
+  handler: (argv) => {
+    const removed = purgeAuditLog({
+      maxAgeDays: argv["max-age-days"],
+      directory: argv.directory,
+      dryRun: argv["dry-run"]
+    });
+    const verb = argv["dry-run"] ? "would remove" : "removed";
+    console.log(`${verb} ${removed.length} file(s):`);
+    for (const file of removed) console.log(`  ${file}`);
+  }
+};
+var datalakeAuditCommand = {
+  command: "audit",
+  describe: "Inspect or prune the data-plane audit log (dev server)",
+  builder: (yargs) => yargs.command(viewCommand).command(purgeCommand),
+  // eslint-disable-next-line @typescript-eslint/no-empty-function
+  handler: () => {
+  }
+};
+
+// src/commands/datalakeCreateCommand.ts
+import { DATALAKE_REGIONS, DATALAKE_TIERS } from "@xylabs/aries-datalake-core";
+
+// src/actions/datalake/createDatalake.ts
+import { createDatalakeClient as createDatalakeClient2 } from "@xylabs/aries-datalake-client";
+import chalk3 from "chalk";
+
+// src/actions/datalake/formatters.ts
+import chalk2 from "chalk";
+var STATUS_COLORS = {
+  pending: chalk2.gray,
+  provisioning: chalk2.yellow,
+  ready: chalk2.green,
+  resizing: chalk2.yellow,
+  deprovisioning: chalk2.yellow,
+  deleted: chalk2.gray,
+  error: chalk2.red
+};
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 ** 2) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 ** 3) return `${(bytes / 1024 ** 2).toFixed(1)} MB`;
+  if (bytes < 1024 ** 4) return `${(bytes / 1024 ** 3).toFixed(1)} GB`;
+  return `${(bytes / 1024 ** 4).toFixed(1)} TB`;
+}
+function formatStatus(status) {
+  const colorize = STATUS_COLORS[status] ?? chalk2.white;
+  return colorize(status);
+}
+function printDatalakeRow(datalake) {
+  const size = datalake.config.sizeBytes ? formatBytes(datalake.config.sizeBytes) : "\u2014";
+  const name = chalk2.white(datalake.name.padEnd(20));
+  const tier = chalk2.cyan(datalake.config.tier.padEnd(8));
+  const region = chalk2.gray((datalake.config.region ?? "\u2014").padEnd(12));
+  const status = formatStatus(datalake.status).padEnd(14);
+  console.log(`  ${name} ${tier} ${region} ${size.padStart(8)}  ${status}`);
+}
+function printRateLimits(limits) {
+  const parts = [];
+  if (limits.authenticatedPerMinute !== void 0) parts.push(`auth=${limits.authenticatedPerMinute}/min`);
+  if (limits.anonymousPerMinute !== void 0) parts.push(`anon=${limits.anonymousPerMinute}/min`);
+  if (limits.burstFactor !== void 0) parts.push(`burst=${limits.burstFactor}x`);
+  if (parts.length > 0) {
+    console.log(`  ${chalk2.gray("limits:")}     ${parts.join(" ")}`);
+  }
+}
+function printUsage(usage) {
+  console.log();
+  console.log(chalk2.cyan("  usage"));
+  console.log(`    ${chalk2.gray("payloads:")}   ${usage.payloadCount}`);
+  console.log(`    ${chalk2.gray("stored:")}     ${formatBytes(usage.bytesStored)} / ${formatBytes(usage.bytesStoredLimit)}`);
+  console.log(`    ${chalk2.gray("reads 24h:")}  ${usage.readsLast24h}`);
+  console.log(`    ${chalk2.gray("writes 24h:")} ${usage.writesLast24h}`);
+}
+function printAcl(acl) {
+  if (acl.length === 0) return;
+  console.log();
+  console.log(chalk2.cyan("  access"));
+  for (const entry of acl) {
+    const principal = entry.principal === "public" ? chalk2.yellow("public") : entry.principal;
+    console.log(`    ${principal.padEnd(24)} ${chalk2.magenta(entry.role)}  ${chalk2.gray(entry.grantedAt)}`);
+  }
+}
+function printDatalakeDetail(datalake) {
+  console.log(chalk2.cyan(`
+${datalake.name}`));
+  console.log(`  ${chalk2.gray("id:")}         ${datalake.id}`);
+  console.log(`  ${chalk2.gray("status:")}     ${formatStatus(datalake.status)}`);
+  if (datalake.url) {
+    console.log(`  ${chalk2.gray("url:")}        ${datalake.url}`);
+  }
+  console.log(`  ${chalk2.gray("owner:")}      ${datalake.ownerId}`);
+  console.log(`  ${chalk2.gray("tier:")}       ${datalake.config.tier}`);
+  console.log(`  ${chalk2.gray("region:")}     ${datalake.config.region ?? "\u2014"}`);
+  console.log(`  ${chalk2.gray("size:")}       ${datalake.config.sizeBytes ? formatBytes(datalake.config.sizeBytes) : "\u2014"}`);
+  console.log(`  ${chalk2.gray("iops:")}       ${datalake.config.iops ?? "\u2014"}`);
+  console.log(`  ${chalk2.gray("retention:")}  ${datalake.config.retentionDays ?? "forever"}`);
+  if (datalake.config.verifyHashes) {
+    console.log(`  ${chalk2.gray("verify:")}     ${chalk2.green("hashes enforced")}`);
+  }
+  if (datalake.config.rateLimits) printRateLimits(datalake.config.rateLimits);
+  console.log(`  ${chalk2.gray("created:")}    ${datalake.createdAt}`);
+  console.log(`  ${chalk2.gray("updated:")}    ${datalake.updatedAt}`);
+  if (datalake.usage) printUsage(datalake.usage);
+  printAcl(datalake.acl);
+  if (datalake.errorMessage) {
+    console.log();
+    console.log(`  ${chalk2.red("error:")} ${datalake.errorMessage}`);
+  }
+}
+
+// src/actions/datalake/parseSize.ts
+var SIZE_UNITS = {
+  b: 1,
+  kb: 1024,
+  mb: 1024 ** 2,
+  gb: 1024 ** 3,
+  tb: 1024 ** 4
+};
+function parseSize(input) {
+  const match = /^(\d+(?:\.\d+)?)\s*([a-zA-Z]+)?$/.exec(input.trim());
+  if (!match) throw new Error(`Invalid size: ${input}`);
+  const value = Number(match[1]);
+  const unitRaw = (match[2] ?? "b").toLowerCase();
+  const unit = SIZE_UNITS[unitRaw];
+  if (unit === void 0) throw new Error(`Unknown size unit: ${match[2]}`);
+  return Math.round(value * unit);
+}
+
+// src/actions/datalake/createDatalake.ts
+function buildRateLimits(options) {
+  if (options.rateAuthPerMinute === void 0 && options.rateAnonPerMinute === void 0 && options.rateBurstFactor === void 0) return void 0;
+  return {
+    authenticatedPerMinute: options.rateAuthPerMinute,
+    anonymousPerMinute: options.rateAnonPerMinute,
+    burstFactor: options.rateBurstFactor
+  };
+}
+async function createDatalake(options) {
+  const client = createDatalakeClient2();
+  const config = {
+    tier: options.tier,
+    sizeBytes: options.size === void 0 ? void 0 : parseSize(options.size),
+    iops: options.iops,
+    region: options.region,
+    retentionDays: options.retentionDays,
+    verifyHashes: options.verifyHashes,
+    rateLimits: buildRateLimits(options)
+  };
+  console.log(chalk3.gray(`provisioning ${options.name} (tier=${options.tier})...`));
+  const descriptor = await client.create({ name: options.name, config });
+  console.log(chalk3.green(`created ${descriptor.name} (${descriptor.id})`));
+  printDatalakeDetail(descriptor);
+}
+
+// src/actions/datalake/describeDatalake.ts
+import { createDatalakeClient as createDatalakeClient4 } from "@xylabs/aries-datalake-client";
+import chalk4 from "chalk";
+
+// src/actions/datalake/payloads/mintAndConnect.ts
+import { createDatalakeClient as createDatalakeClient3, RestPayloadsClient } from "@xylabs/aries-datalake-client";
+import { XyoPayloadsClient } from "@xylabs/aries-datalake-xl1-adapter";
+
+// src/actions/datalake/resolveTarget.ts
+import { getDefaultDatalake } from "@xylabs/aries-datalake-client";
+function resolveTarget(argValue) {
+  const target = argValue ?? getDefaultDatalake();
+  if (!target) {
+    throw new Error(
+      "No datalake specified and no default set. Pass <name> or run `aries datalake use <name>`."
+    );
+  }
+  return target;
+}
+
+// src/actions/datalake/payloads/mintAndConnect.ts
+async function mintAndConnect(options) {
+  const controlClient = createDatalakeClient3();
+  const target = resolveTarget(options.idOrName);
+  const descriptor = await controlClient.describe(target);
+  if (!descriptor.url) {
+    throw new Error(`Datalake ${descriptor.name} has no URL yet (status=${descriptor.status})`);
+  }
+  const token = await controlClient.mintToken({
+    datalakeId: descriptor.id,
+    role: options.role,
+    ttlSeconds: options.ttlSeconds ?? 3600
+  });
+  const clientOptions = {
+    baseUrl: token.url,
+    datalakeId: descriptor.id,
+    authToken: token.token
+  };
+  return {
+    client: options.useXl1Sdk ? new XyoPayloadsClient(clientOptions) : new RestPayloadsClient(clientOptions),
+    datalakeName: descriptor.name,
+    datalakeId: descriptor.id,
+    url: token.url,
+    transport: options.useXl1Sdk ? "xl1-sdk" : "native"
+  };
+}
+
+// src/actions/datalake/describeDatalake.ts
+async function describeDatalake(idOrName) {
+  const client = createDatalakeClient4();
+  const target = resolveTarget(idOrName);
+  const descriptor = await client.describe(target);
+  printDatalakeDetail(descriptor);
+  if (descriptor.status !== "ready") return;
+  try {
+    const connection = await mintAndConnect({ idOrName: target, role: "viewer" });
+    const usage = await connection.client.usage();
+    printLiveUsage(usage);
+  } catch (error) {
+    console.log();
+    console.log(chalk4.gray(
+      `  (live quota unavailable: ${error instanceof Error ? error.message : String(error)})`
+    ));
+  }
+}
+function printLiveUsage(usage) {
+  console.log();
+  console.log(chalk4.cyan("  live"));
+  console.log(`    ${chalk4.gray("payloads:")}       ${usage.payloadCount}`);
+  const limits = usage.rateLimits;
+  if (limits?.authenticated) {
+    const { remaining, limit } = limits.authenticated;
+    console.log(`    ${chalk4.gray("auth quota:")}     ${remaining}/${limit}`);
+  }
+  if (limits?.anonymous) {
+    const { remaining, limit } = limits.anonymous;
+    console.log(`    ${chalk4.gray("anon quota:")}     ${remaining}/${limit}`);
+  }
+}
+
+// src/actions/datalake/destroyDatalake.ts
+import { createDatalakeClient as createDatalakeClient5 } from "@xylabs/aries-datalake-client";
+import chalk5 from "chalk";
+async function destroyDatalake(options) {
+  const client = createDatalakeClient5();
+  const target = resolveTarget(options.idOrName);
+  if (!options.force) {
+    console.log(chalk5.yellow(
+      `Refusing to destroy ${target} without --force. This operation permanently deletes the datalake and all its payloads.`
+    ));
+    process.exitCode = 1;
+    return;
+  }
+  await client.destroy(target);
+  console.log(chalk5.green(`destroyed ${target}`));
+}
+
+// src/actions/datalake/grantAccess.ts
+import { createDatalakeClient as createDatalakeClient6 } from "@xylabs/aries-datalake-client";
+import chalk6 from "chalk";
+async function grantAccess(options) {
+  const client = createDatalakeClient6();
+  const target = resolveTarget(options.idOrName);
+  if (options.principal === "public" && options.role === "runner" && !options.confirmPublic) {
+    console.log(chalk6.yellow(
+      "Granting `public runner` makes anonymous writes possible. Re-run with --confirm-public to proceed."
+    ));
+    process.exitCode = 1;
+    return;
+  }
+  const descriptor = await client.describe(target);
+  const updated = await client.grant({
+    datalakeId: descriptor.id,
+    principal: options.principal,
+    role: options.role
+  });
+  console.log(chalk6.green(`granted ${options.role} to ${options.principal} on ${updated.name}`));
+  printDatalakeDetail(updated);
+}
+
+// src/actions/datalake/listDatalakes.ts
+import { createDatalakeClient as createDatalakeClient7 } from "@xylabs/aries-datalake-client";
+import chalk7 from "chalk";
+async function listDatalakes() {
+  const client = createDatalakeClient7();
+  const datalakes = await client.list();
+  if (datalakes.length === 0) {
+    console.log(chalk7.yellow("No datalakes yet. Create one with `aries datalake create <name>`."));
+    return;
+  }
+  console.log(
+    chalk7.gray("  ") + chalk7.gray("name".padEnd(20)) + " " + chalk7.gray("tier".padEnd(8)) + " " + chalk7.gray("region".padEnd(12)) + " " + chalk7.gray("    size") + "  " + chalk7.gray("status")
+  );
+  for (const datalake of datalakes) {
+    printDatalakeRow(datalake);
+  }
+}
+
+// src/actions/datalake/login.ts
+import { saveCredentials } from "@xylabs/aries-datalake-client";
+import chalk8 from "chalk";
+async function login(options) {
+  const baseUrl = options.baseUrl ?? process.env.ARIES_DATALAKE_API;
+  const token = options.token ?? process.env.ARIES_DATALAKE_TOKEN;
+  if (!baseUrl || !token) {
+    console.log(chalk8.yellow(
+      "P0 login requires --base-url and --token (or ARIES_DATALAKE_API + ARIES_DATALAKE_TOKEN). OAuth device-flow lands in P1."
+    ));
+    process.exitCode = 1;
+    return;
+  }
+  saveCredentials({ baseUrl, authToken: token });
+  console.log(chalk8.green(`credentials saved for ${baseUrl}`));
+}
+
+// src/actions/datalake/logout.ts
+import { clearCredentials } from "@xylabs/aries-datalake-client";
+import chalk9 from "chalk";
+async function logout() {
+  clearCredentials();
+  console.log(chalk9.green("signed out"));
+}
+
+// src/actions/datalake/mintToken.ts
+import { createDatalakeClient as createDatalakeClient8 } from "@xylabs/aries-datalake-client";
+import chalk10 from "chalk";
+async function mintToken(options) {
+  const client = createDatalakeClient8();
+  const target = resolveTarget(options.idOrName);
+  const descriptor = await client.describe(target);
+  const token = await client.mintToken({
+    datalakeId: descriptor.id,
+    role: options.role,
+    ttlSeconds: options.ttlSeconds
+  });
+  console.log(chalk10.cyan("datalake token"));
+  console.log(`  ${chalk10.gray("url:")}    ${token.url}`);
+  console.log(`  ${chalk10.gray("role:")}   ${token.role}`);
+  console.log(`  ${chalk10.gray("exp:")}    ${token.expiresAt}`);
+  console.log();
+  console.log(token.token);
+}
+
+// src/actions/datalake/revokeAccess.ts
+import { createDatalakeClient as createDatalakeClient9 } from "@xylabs/aries-datalake-client";
+import chalk11 from "chalk";
+async function revokeAccess(options) {
+  const client = createDatalakeClient9();
+  const target = resolveTarget(options.idOrName);
+  const descriptor = await client.describe(target);
+  const updated = await client.revoke({
+    datalakeId: descriptor.id,
+    principal: options.principal
+  });
+  console.log(chalk11.green(`revoked access for ${options.principal} on ${updated.name}`));
+  printDatalakeDetail(updated);
+}
+
+// src/actions/datalake/useDatalake.ts
+import {
+  clearDefaultDatalake,
+  createDatalakeClient as createDatalakeClient10,
+  setDefaultDatalake
+} from "@xylabs/aries-datalake-client";
+import chalk12 from "chalk";
+async function useDatalake(name) {
+  if (!name) {
+    clearDefaultDatalake();
+    console.log(chalk12.green("cleared default datalake"));
+    return;
+  }
+  const client = createDatalakeClient10();
+  const descriptor = await client.describe(name);
+  setDefaultDatalake(descriptor.name, descriptor.id);
+  console.log(chalk12.green(`default datalake set to ${descriptor.name} (${descriptor.id})`));
+}
+
+// src/commands/datalakeCreateCommand.ts
+var datalakeCreateCommand = {
+  command: "create <name>",
+  describe: "Provision a new datalake",
+  builder: (yargs) => yargs.positional("name", {
+    type: "string",
+    describe: "Human-friendly name (unique per owner)",
+    demandOption: true
+  }).option("tier", {
+    alias: "t",
+    type: "string",
+    choices: DATALAKE_TIERS,
+    default: "small",
+    describe: "Service tier"
+  }).option("size", {
+    alias: "s",
+    type: "string",
+    describe: "Capacity (e.g. 10GB, 100GB, 1TB)"
+  }).option("iops", {
+    type: "number",
+    describe: "Provisioned IOPS target"
+  }).option("region", {
+    alias: "r",
+    type: "string",
+    choices: DATALAKE_REGIONS,
+    describe: "Deployment region"
+  }).option("retention-days", {
+    type: "number",
+    describe: "Retention in days (omit for tier default)"
+  }).option("verify-hashes", {
+    type: "boolean",
+    default: false,
+    describe: "Reject inserts whose $hash does not match the content digest"
+  }).option("rate-auth-per-minute", {
+    type: "number",
+    describe: "Override: authenticated requests per minute"
+  }).option("rate-anon-per-minute", {
+    type: "number",
+    describe: "Override: anonymous requests per minute"
+  }).option("rate-burst-factor", {
+    type: "number",
+    describe: "Override: rate-limit burst factor (1 = no burst)"
+  }),
+  handler: async (argv) => {
+    await createDatalake({
+      name: argv.name,
+      tier: argv.tier,
+      size: argv.size,
+      iops: argv.iops,
+      region: argv.region,
+      retentionDays: argv["retention-days"],
+      verifyHashes: argv["verify-hashes"],
+      rateAuthPerMinute: argv["rate-auth-per-minute"],
+      rateAnonPerMinute: argv["rate-anon-per-minute"],
+      rateBurstFactor: argv["rate-burst-factor"]
+    });
+  }
+};
+
+// src/commands/datalakeDescribeCommand.ts
+var datalakeDescribeCommand = {
+  command: "describe [name]",
+  describe: "Show details for a datalake (falls back to the default)",
+  builder: (yargs) => yargs.positional("name", {
+    type: "string",
+    describe: "Datalake name or id"
+  }),
+  handler: async (argv) => {
+    await describeDatalake(argv.name);
+  }
+};
+
+// src/commands/datalakeDestroyCommand.ts
+var datalakeDestroyCommand = {
+  command: "destroy [name]",
+  describe: "Permanently delete a datalake",
+  builder: (yargs) => yargs.positional("name", {
+    type: "string",
+    describe: "Datalake name or id"
+  }).option("force", {
+    alias: "f",
+    type: "boolean",
+    default: false,
+    describe: "Required confirmation flag"
+  }),
+  handler: async (argv) => {
+    await destroyDatalake({
+      idOrName: argv.name,
+      force: argv.force
+    });
+  }
+};
+
+// src/actions/datalake/dev/downDevServer.ts
+import { clearCredentials as clearCredentials2, loadCredentials } from "@xylabs/aries-datalake-client";
+import chalk13 from "chalk";
+
+// src/actions/datalake/dev/state.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync,
+  readFileSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync
+} from "fs";
+function readDevState() {
+  const filePath = getDevStatePath();
+  if (!existsSync2(filePath)) return void 0;
+  try {
+    return JSON.parse(readFileSync(filePath, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function writeDevState(state) {
+  const dir = getDevDir();
+  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(getDevStatePath(), JSON.stringify(state, void 0, 2), "utf8");
+  writeFileSync(getDevPidPath(), String(state.pid), "utf8");
+}
+function clearDevState() {
+  for (const filePath of [getDevStatePath(), getDevPidPath()]) {
+    if (existsSync2(filePath)) unlinkSync2(filePath);
+  }
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = error.code;
+    return code === "EPERM";
+  }
+}
+
+// src/actions/datalake/dev/downDevServer.ts
+var DEFAULT_GRACE_MS = 2e3;
+var POLL_MS = 50;
+async function downDevServer(options = {}) {
+  const state = readDevState();
+  if (!state) {
+    console.log(chalk13.yellow("dev server is not running"));
+    return;
+  }
+  const graceMs = options.gracePeriodMs ?? DEFAULT_GRACE_MS;
+  if (!isProcessAlive(state.pid)) {
+    cleanup(state.controlUrl);
+    console.log(chalk13.green(`dev server pid ${state.pid} was already stopped \u2014 cleaned up state`));
+    return;
+  }
+  try {
+    process.kill(state.pid, "SIGTERM");
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ESRCH") throw error;
+  }
+  const deadline = Date.now() + graceMs;
+  while (Date.now() < deadline && isProcessAlive(state.pid)) {
+    await delay(POLL_MS);
+  }
+  if (isProcessAlive(state.pid)) {
+    try {
+      process.kill(state.pid, "SIGKILL");
+    } catch {
+    }
+  }
+  cleanup(state.controlUrl);
+  console.log(chalk13.green(`dev server pid ${state.pid} stopped`));
+}
+function cleanup(controlUrl) {
+  const credentials = loadCredentials();
+  if (credentials?.baseUrl === controlUrl) {
+    clearCredentials2();
+  }
+  clearDevState();
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/actions/datalake/dev/logsDevServer.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import chalk14 from "chalk";
+async function logsDevServer(options = {}) {
+  const logPath = getDevLogPath();
+  if (!existsSync3(logPath)) {
+    console.log(chalk14.yellow("no dev server log file yet"));
+    return;
+  }
+  if (options.follow) {
+    const child = spawn2("tail", ["-n", String(options.lines ?? 50), "-f", logPath], { stdio: "inherit" });
+    await new Promise((resolve) => {
+      child.on("exit", (code) => {
+        process.exitCode = code ?? 0;
+        resolve();
+      });
+    });
+    return;
+  }
+  const lines = readFileSync2(logPath, "utf8").split("\n");
+  const tail = lines.slice(-(options.lines ?? 50));
+  process.stdout.write(tail.join("\n"));
+  if (!tail.at(-1)?.endsWith("\n")) process.stdout.write("\n");
+}
+
+// src/actions/datalake/dev/resetDevServer.ts
+import { existsSync as existsSync4, rmSync } from "fs";
+import chalk15 from "chalk";
+async function resetDevServer() {
+  await downDevServer();
+  const dir = getDevDir();
+  if (!existsSync4(dir)) {
+    console.log(chalk15.green("nothing to reset"));
+    return;
+  }
+  rmSync(dir, { recursive: true, force: true });
+  console.log(chalk15.green(`reset ${dir}`));
+}
+
+// src/actions/datalake/dev/statusDevServer.ts
+import chalk16 from "chalk";
+async function statusDevServer() {
+  const state = readDevState();
+  if (!state) {
+    console.log(chalk16.yellow("dev server not running"));
+    process.exitCode = 3;
+    return;
+  }
+  const alive = isProcessAlive(state.pid);
+  const healthy = alive ? await pingHealth(state.controlUrl) : false;
+  const uptime = formatUptime(state.startedAt);
+  console.log(chalk16.cyan("dev server status"));
+  console.log(`  ${chalk16.gray("state:")}    ${statusLabel(alive, healthy)}`);
+  console.log(`  ${chalk16.gray("pid:")}      ${state.pid}`);
+  console.log(`  ${chalk16.gray("control:")}  ${state.controlUrl}`);
+  console.log(`  ${chalk16.gray("data:")}     ${state.planeUrl}`);
+  console.log(`  ${chalk16.gray("user:")}     ${state.userId}`);
+  console.log(`  ${chalk16.gray("started:")}  ${state.startedAt}${uptime ? ` (${uptime})` : ""}`);
+  console.log(`  ${chalk16.gray("log:")}      ${getDevLogPath()}`);
+  if (alive && !healthy) {
+    process.exitCode = 2;
+  } else if (!alive) {
+    process.exitCode = 3;
+  }
+}
+function statusLabel(alive, healthy) {
+  if (alive && healthy) return chalk16.green("running + healthy");
+  if (alive) return chalk16.yellow("running but unresponsive");
+  return chalk16.red("stale state (process gone)");
+}
+async function pingHealth(controlUrl) {
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 1e3);
+    const response = await fetch(`${controlUrl}/v1/health`, { signal: controller.signal });
+    clearTimeout(timeout);
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+function formatUptime(startedAt) {
+  const started = new Date(startedAt).getTime();
+  if (Number.isNaN(started)) return "";
+  const seconds = Math.max(0, Math.floor((Date.now() - started) / 1e3));
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `${minutes}m ${seconds % 60}s`;
+  const hours = Math.floor(minutes / 60);
+  return `${hours}h ${minutes % 60}m`;
+}
+
+// src/actions/datalake/dev/upDevServer.ts
+import { spawn as spawn3 } from "child_process";
+import { randomBytes } from "crypto";
+import {
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync2,
+  openSync
+} from "fs";
+import path4 from "path";
+import { saveCredentials as saveCredentials2 } from "@xylabs/aries-datalake-client";
+import chalk17 from "chalk";
+
+// src/actions/datalake/dev/resolveServerBin.ts
+import { existsSync as existsSync5 } from "fs";
+import { createRequire } from "module";
+import path3 from "path";
+var require2 = createRequire(import.meta.url);
+function resolveServerBin() {
+  let packageJsonPath;
+  try {
+    packageJsonPath = require2.resolve("@xylabs/aries-datalake-plane/package.json");
+  } catch {
+    throw new Error(
+      "@xylabs/aries-datalake-plane is not installed. Install it as a dev dependency to use `aries datalake dev` locally."
+    );
+  }
+  const binPath = path3.join(path3.dirname(packageJsonPath), "dist", "bin", "devServer.mjs");
+  if (!existsSync5(binPath)) {
+    throw new Error(
+      `Dev server binary not found at ${binPath}. Run \`pnpm xy compile\` to build it.`
+    );
+  }
+  return binPath;
+}
+
+// src/actions/datalake/dev/waitForHealth.ts
+var POLL_INTERVAL_MS = 100;
+async function waitForHealth(baseUrl, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const url = `${baseUrl.replace(/\/$/, "")}/v1/health`;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(url);
+      if (response.ok) return true;
+    } catch {
+    }
+    await delay2(POLL_INTERVAL_MS);
+  }
+  return false;
+}
+function delay2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/actions/datalake/dev/upDevServer.ts
+var DEFAULT_CONTROL_PORT = 8787;
+var DEFAULT_PLANE_PORT = 8788;
+var DEFAULT_TIMEOUT_SECONDS = 10;
+function resolveOptions(options) {
+  const controlPort = options.controlPort ?? DEFAULT_CONTROL_PORT;
+  const planePort = options.planePort ?? DEFAULT_PLANE_PORT;
+  const rotate = options.auditRotate === true;
+  return {
+    controlPort,
+    planePort,
+    controlUrl: `http://127.0.0.1:${controlPort}`,
+    planeUrl: `http://127.0.0.1:${planePort}`,
+    userId: options.userId ?? "dev-user",
+    authToken: options.authToken ?? randomBytes(16).toString("hex"),
+    signingSecret: options.signingSecret ?? randomBytes(32).toString("hex"),
+    timeoutMs: (options.timeoutSeconds ?? DEFAULT_TIMEOUT_SECONDS) * 1e3,
+    persistDir: options.persist ? path4.join(getDevDir(), "store") : void 0,
+    auditLogPath: options.audit && !rotate ? path4.join(getDevDir(), "audit.log") : void 0,
+    auditDir: options.audit && rotate ? path4.join(getDevDir(), "audit") : void 0,
+    auditKeepDays: rotate ? options.auditKeepDays : void 0
+  };
+}
+function spawnDaemon(binPath, resolved) {
+  const devDir = getDevDir();
+  if (!existsSync6(devDir)) mkdirSync2(devDir, { recursive: true });
+  const logFd = openSync(getDevLogPath(), "a");
+  const env = {
+    ...process.env,
+    CONTROL_PORT: String(resolved.controlPort),
+    PLANE_PORT: String(resolved.planePort),
+    HOST: "127.0.0.1",
+    DATALAKE_CONTROL_TOKENS: `${resolved.authToken}=${resolved.userId}`,
+    TOKEN_SIGNING_SECRET: resolved.signingSecret,
+    DATALAKE_ORIGIN_URL: resolved.planeUrl,
+    LOG_LEVEL: process.env.LOG_LEVEL ?? "info"
+  };
+  if (resolved.persistDir) env.DATALAKE_PERSIST_DIR = resolved.persistDir;
+  if (resolved.auditLogPath) env.DATALAKE_AUDIT_LOG = resolved.auditLogPath;
+  if (resolved.auditDir) env.DATALAKE_AUDIT_DIR = resolved.auditDir;
+  if (resolved.auditKeepDays !== void 0) env.DATALAKE_AUDIT_MAX_AGE_DAYS = String(resolved.auditKeepDays);
+  const child = spawn3(process.execPath, [binPath], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    env
+  });
+  child.unref();
+  return child;
+}
+function describeAudit(resolved) {
+  if (resolved.auditDir) {
+    return `rotating ${resolved.auditDir}${resolved.auditKeepDays ? ` (keep ${resolved.auditKeepDays}d)` : ""}`;
+  }
+  return resolved.auditLogPath ?? "disabled";
+}
+function printReadyBanner(state, resolved) {
+  console.log(chalk17.green("dev server ready"));
+  console.log(`  ${chalk17.gray("control:")}  ${state.controlUrl}`);
+  console.log(`  ${chalk17.gray("data:")}     ${state.planeUrl}`);
+  console.log(`  ${chalk17.gray("user:")}     ${state.userId}`);
+  console.log(`  ${chalk17.gray("log:")}      ${getDevLogPath()}`);
+  console.log(`  ${chalk17.gray("store:")}    ${resolved.persistDir ? `persisted (${resolved.persistDir})` : "in-memory"}`);
+  console.log(`  ${chalk17.gray("audit:")}    ${describeAudit(resolved)}`);
+  console.log(chalk17.gray("\nCLI is configured \u2014 try `aries datalake list`"));
+}
+async function upDevServer(options = {}) {
+  const existing = readDevState();
+  if (existing && isProcessAlive(existing.pid)) {
+    console.log(chalk17.yellow(`dev server already running (pid ${existing.pid}) at ${existing.controlUrl}`));
+    return existing;
+  }
+  if (existing) clearDevState();
+  const resolved = resolveOptions(options);
+  const child = spawnDaemon(resolveServerBin(), resolved);
+  if (!child.pid) throw new Error("Failed to spawn dev server process");
+  console.log(chalk17.gray(`starting dev server (pid ${child.pid})...`));
+  const healthy = await waitForHealth(resolved.controlUrl, resolved.timeoutMs);
+  if (!healthy) {
+    try {
+      process.kill(child.pid, "SIGTERM");
+    } catch {
+    }
+    throw new Error(
+      `Dev server did not become healthy within ${resolved.timeoutMs / 1e3}s. Check logs at ${getDevLogPath()}`
+    );
+  }
+  const state = {
+    pid: child.pid,
+    controlUrl: resolved.controlUrl,
+    planeUrl: resolved.planeUrl,
+    controlPort: resolved.controlPort,
+    planePort: resolved.planePort,
+    userId: resolved.userId,
+    authToken: resolved.authToken,
+    signingSecret: resolved.signingSecret,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeDevState(state);
+  saveCredentials2({
+    baseUrl: resolved.controlUrl,
+    authToken: resolved.authToken,
+    userId: resolved.userId
+  });
+  printReadyBanner(state, resolved);
+  return state;
+}
+
+// src/commands/datalakeDevDownCommand.ts
+var datalakeDevDownCommand = {
+  command: "down",
+  describe: "Stop the local dev server (if running) and clear its credentials",
+  handler: async () => {
+    await downDevServer();
+  }
+};
+
+// src/commands/datalakeDevLogsCommand.ts
+var datalakeDevLogsCommand = {
+  command: "logs",
+  describe: "Print recent dev server log output",
+  builder: (yargs) => yargs.option("follow", {
+    alias: "f",
+    type: "boolean",
+    default: false,
+    describe: "Stream new lines as they arrive"
+  }).option("lines", {
+    alias: "n",
+    type: "number",
+    default: 50,
+    describe: "Number of tail lines to show"
+  }),
+  handler: async (argv) => {
+    await logsDevServer({
+      follow: argv.follow,
+      lines: argv.lines
+    });
+  }
+};
+
+// src/commands/datalakeDevResetCommand.ts
+var datalakeDevResetCommand = {
+  command: "reset",
+  describe: "Stop the dev server and wipe all its local state",
+  handler: async () => {
+    await resetDevServer();
+  }
+};
+
+// src/commands/datalakeDevStatusCommand.ts
+var datalakeDevStatusCommand = {
+  command: "status",
+  describe: "Report whether the local dev server is running and healthy",
+  handler: async () => {
+    await statusDevServer();
+  }
+};
+
+// src/commands/datalakeDevUpCommand.ts
+var datalakeDevUpCommand = {
+  command: "up",
+  describe: "Start the local control + data plane dev server and wire the CLI to it",
+  builder: (yargs) => yargs.option("control-port", {
+    type: "number",
+    default: 8787,
+    describe: "Control-plane port"
+  }).option("plane-port", {
+    type: "number",
+    default: 8788,
+    describe: "Data-plane port"
+  }).option("timeout", {
+    type: "number",
+    default: 10,
+    describe: "Seconds to wait for health"
+  }).option("persist", {
+    type: "boolean",
+    default: false,
+    describe: "Persist store state to disk so it survives restarts"
+  }).option("audit", {
+    type: "boolean",
+    default: false,
+    describe: "Write a JSONL audit log of every data-plane request"
+  }).option("audit-rotate", {
+    type: "boolean",
+    default: false,
+    describe: "Rotate the audit log daily (writes to <home>/dev/audit/)"
+  }).option("audit-keep-days", {
+    type: "number",
+    describe: "Prune rotated audit files older than this many days"
+  }),
+  handler: async (argv) => {
+    await upDevServer({
+      controlPort: argv["control-port"],
+      planePort: argv["plane-port"],
+      timeoutSeconds: argv.timeout,
+      persist: argv.persist,
+      audit: argv.audit,
+      auditRotate: argv["audit-rotate"],
+      auditKeepDays: argv["audit-keep-days"]
+    });
+  }
+};
+
+// src/commands/datalakeDevCommand.ts
+var datalakeDevCommand = {
+  command: "dev",
+  describe: "Run a local datalake control + data plane for development & testing",
+  builder: (yargs) => yargs.command(datalakeDevUpCommand).command(datalakeDevDownCommand).command(datalakeDevStatusCommand).command(datalakeDevLogsCommand).command(datalakeDevResetCommand).demandCommand(1).strictCommands(),
+  // eslint-disable-next-line @typescript-eslint/no-empty-function
+  handler: () => {
+  }
+};
+
+// src/actions/datalake/payloads/fetchPayload.ts
+import { DatalakeApiError } from "@xylabs/aries-datalake-core";
+import chalk18 from "chalk";
+async function fetchPayload(options) {
+  const connection = await mintAndConnect({
+    idOrName: options.idOrName,
+    role: "viewer",
+    useXl1Sdk: options.xl1Sdk
+  });
+  try {
+    const payload = await connection.client.get(options.hash);
+    if (options.raw) {
+      process.stdout.write(`${JSON.stringify(payload)}
+`);
+      return;
+    }
+    console.log(chalk18.cyan(`${connection.datalakeName} / ${options.hash}`));
+    console.log(JSON.stringify(payload, void 0, 2));
+  } catch (error) {
+    if (error instanceof DatalakeApiError && error.code === "not_found") {
+      console.log(chalk18.yellow(`payload not found: ${options.hash}`));
+      process.exitCode = 3;
+      return;
+    }
+    throw error;
+  }
+}
+
+// src/actions/datalake/payloads/parsePayloadsFile.ts
+import { readFileSync as readFileSync3 } from "fs";
+import path5 from "path";
+function parsePayloadsFile(filePath) {
+  const absolute = path5.resolve(filePath);
+  const raw = readFileSync3(absolute, "utf8");
+  const ext = path5.extname(absolute).toLowerCase();
+  if (ext === ".jsonl" || ext === ".ndjson") {
+    return parseJsonl(raw);
+  }
+  if (ext === ".json") {
+    return parseJson(raw);
+  }
+  const trimmed = raw.trim();
+  if (trimmed.startsWith("{") && trimmed.endsWith("}") && trimmed.includes("\n{")) {
+    return parseJsonl(raw);
+  }
+  return parseJson(raw);
+}
+function parseJson(raw) {
+  const parsed = JSON.parse(raw);
+  const candidates = Array.isArray(parsed) ? parsed : isPayloadsEnvelope(parsed) ? parsed.payloads : void 0;
+  if (!candidates) {
+    throw new Error('Expected an array of payloads or { "payloads": [...] }');
+  }
+  const result = [];
+  for (const [index, candidate] of candidates.entries()) {
+    validatePayload(candidate, `index ${index}`);
+    result.push(candidate);
+  }
+  return result;
+}
+function parseJsonl(raw) {
+  const lines = raw.split("\n");
+  const payloads = [];
+  for (const [i, line_] of lines.entries()) {
+    const line = line_?.trim();
+    if (!line) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Line ${i + 1}: invalid JSON (${message})`, { cause: error });
+    }
+    validatePayload(parsed, `line ${i + 1}`);
+    payloads.push(parsed);
+  }
+  return payloads;
+}
+function isPayloadsEnvelope(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value;
+  return Array.isArray(record.payloads);
+}
+function validatePayload(value, where) {
+  if (typeof value !== "object" || value === null) {
+    throw new Error(`${where}: not an object`);
+  }
+  const record = value;
+  if (typeof record.schema !== "string" || record.schema.length === 0) {
+    throw new Error(`${where}: missing or invalid \`schema\``);
+  }
+  if (typeof record.$hash !== "string" || record.$hash.length === 0) {
+    throw new Error(`${where}: missing or invalid \`$hash\``);
+  }
+}
+
+// src/actions/datalake/payloads/pushPayloads.ts
+import { xyoVerifyPayloadHash } from "@xylabs/aries-datalake-core";
+import chalk19 from "chalk";
+var DEFAULT_BATCH_SIZE = 500;
+function printRejectedList(label, hashes, cap, color) {
+  console.log(color(label));
+  for (const hash of hashes.slice(0, cap)) {
+    console.log(`  ${hash}`);
+  }
+  if (hashes.length > cap) {
+    console.log(chalk19.gray(`  ... and ${hashes.length - cap} more`));
+  }
+}
+async function verifyLocally(payloads) {
+  const mismatches = [];
+  for (const payload of payloads) {
+    if (!await xyoVerifyPayloadHash(payload)) mismatches.push(payload.$hash);
+  }
+  if (mismatches.length === 0) {
+    console.log(chalk19.gray(`verified ${payloads.length} payload hashes locally (XL1-canonical)`));
+    return true;
+  }
+  printRejectedList(
+    `refusing to push: ${mismatches.length} payload(s) have mismatched $hash`,
+    mismatches,
+    10,
+    chalk19.red
+  );
+  process.exitCode = 1;
+  return false;
+}
+async function pushPayloads(options) {
+  const payloads = parsePayloadsFile(options.file);
+  if (payloads.length === 0) {
+    console.log(chalk19.yellow(`${options.file} contained 0 payloads \u2014 nothing to push`));
+    return;
+  }
+  if (options.verify && !await verifyLocally(payloads)) return;
+  const connection = await mintAndConnect({
+    idOrName: options.idOrName,
+    role: "runner",
+    useXl1Sdk: options.xl1Sdk
+  });
+  console.log(chalk19.gray(
+    `pushing ${payloads.length} payloads to ${connection.datalakeName} (${connection.datalakeId}) via ${connection.transport}...`
+  ));
+  const batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
+  let inserted = 0;
+  let duplicates = 0;
+  const rejected = [];
+  for (let offset = 0; offset < payloads.length; offset += batchSize) {
+    const batch = payloads.slice(offset, offset + batchSize);
+    const result = await connection.client.insert(batch);
+    inserted += result.inserted;
+    duplicates += result.duplicates;
+    rejected.push(...result.rejected);
+  }
+  console.log(chalk19.green(
+    `push complete: inserted=${inserted} duplicates=${duplicates} rejected=${rejected.length}`
+  ));
+  if (rejected.length > 0) {
+    printRejectedList("rejected hashes:", rejected, 20, chalk19.yellow);
+  }
+}
+
+// src/actions/datalake/payloads/tailPayloads.ts
+import chalk20 from "chalk";
+var DEFAULT_LIMIT = 50;
+var DEFAULT_POLL_MS = 1e3;
+async function tailPayloads(options) {
+  const connection = await mintAndConnect({ idOrName: options.idOrName, role: "viewer" });
+  const limit = options.limit ?? DEFAULT_LIMIT;
+  let cursor = options.cursor;
+  let totalSeen = 0;
+  while (true) {
+    const page = await connection.client.next({
+      limit,
+      cursor,
+      schemas: options.schemas
+    });
+    for (const payload of page.payloads) {
+      printPayload(payload);
+      totalSeen += 1;
+    }
+    if (!options.follow) {
+      if (totalSeen === 0) {
+        console.log(chalk20.yellow(`${connection.datalakeName}: no payloads yet`));
+      }
+      return;
+    }
+    if (page.payloads.length < limit) {
+      cursor = page.nextCursor ?? cursor;
+      break;
+    }
+    cursor = page.nextCursor ?? cursor;
+  }
+  const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_MS;
+  console.log(chalk20.gray(`following ${connection.datalakeName} (Ctrl+C to stop)`));
+  let polls = 0;
+  while (options.maxPolls === void 0 || polls < options.maxPolls) {
+    await delay3(pollIntervalMs);
+    polls += 1;
+    const page = await connection.client.next({
+      limit,
+      cursor,
+      schemas: options.schemas
+    });
+    for (const payload of page.payloads) {
+      printPayload(payload);
+      totalSeen += 1;
+    }
+    if (page.nextCursor) cursor = page.nextCursor;
+  }
+}
+function printPayload(payload) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  console.log(`${chalk20.gray(timestamp)} ${chalk20.cyan(payload.$hash.slice(0, 12))} ${chalk20.magenta(payload.schema)}`);
+  console.log(`  ${JSON.stringify(payload)}`);
+}
+function delay3(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/commands/datalakeFetchCommand.ts
+var datalakeFetchCommand = {
+  command: "fetch <hash> [name]",
+  describe: "Fetch a single payload by content hash",
+  builder: (yargs) => yargs.positional("hash", {
+    type: "string",
+    describe: "Content hash of the payload to fetch",
+    demandOption: true
+  }).positional("name", {
+    type: "string",
+    describe: "Datalake name or id (defaults to current)"
+  }).option("raw", {
+    type: "boolean",
+    default: false,
+    describe: "Print only the raw JSON payload (no header)"
+  }).option("xl1-sdk", {
+    type: "boolean",
+    default: false,
+    describe: "Use the real @xyo-network/xl1-protocol-sdk RestDataLakeViewer"
+  }),
+  handler: async (argv) => {
+    await fetchPayload({
+      hash: argv.hash,
+      idOrName: argv.name,
+      raw: argv.raw,
+      xl1Sdk: argv["xl1-sdk"]
+    });
+  }
+};
+
+// src/commands/datalakeGrantCommand.ts
+var datalakeGrantCommand = {
+  command: "grant <name> <principal>",
+  describe: 'Grant a role on a datalake (principal=user-id or "public")',
+  builder: (yargs) => yargs.positional("name", {
+    type: "string",
+    describe: "Datalake name or id",
+    demandOption: true
+  }).positional("principal", {
+    type: "string",
+    describe: 'User id, or the literal "public"',
+    demandOption: true
+  }).option("role", {
+    alias: "r",
+    type: "string",
+    choices: ["viewer", "runner"],
+    default: "viewer",
+    describe: "Role to grant"
+  }).option("confirm-public", {
+    type: "boolean",
+    default: false,
+    describe: "Required to grant `public runner` (anonymous writes)"
+  }),
+  handler: async (argv) => {
+    await grantAccess({
+      idOrName: argv.name,
+      principal: argv.principal,
+      role: argv.role,
+      confirmPublic: argv["confirm-public"]
+    });
+  }
+};
+
+// src/commands/datalakeListCommand.ts
+var datalakeListCommand = {
+  command: "list",
+  describe: "List your datalakes",
+  handler: async () => {
+    await listDatalakes();
+  }
+};
+
+// src/commands/datalakeLoginCommand.ts
+var datalakeLoginCommand = {
+  command: "login",
+  describe: "Sign in to the datalake control plane",
+  builder: (yargs) => yargs.option("base-url", {
+    type: "string",
+    describe: "Control-plane base URL (P0: required)"
+  }).option("token", {
+    type: "string",
+    describe: "Pre-issued auth token (P0: required; OAuth lands in P1)"
+  }),
+  handler: async (argv) => {
+    await login({
+      baseUrl: argv["base-url"],
+      token: argv.token
+    });
+  }
+};
+
+// src/commands/datalakeLogoutCommand.ts
+var datalakeLogoutCommand = {
+  command: "logout",
+  describe: "Clear stored datalake credentials",
+  handler: async () => {
+    await logout();
+  }
+};
+
+// src/commands/datalakePushCommand.ts
+var datalakePushCommand = {
+  command: "push <file> [name]",
+  describe: "Insert payloads from a JSON or JSONL file into a datalake",
+  builder: (yargs) => yargs.positional("file", {
+    type: "string",
+    describe: "Path to a .json (array) or .jsonl (one payload per line) file",
+    demandOption: true
+  }).positional("name", {
+    type: "string",
+    describe: "Target datalake name or id (defaults to current)"
+  }).option("batch-size", {
+    type: "number",
+    default: 500,
+    describe: "Max payloads per HTTP request"
+  }).option("verify", {
+    type: "boolean",
+    default: false,
+    describe: "Verify each payload's $hash against content locally before pushing"
+  }).option("xl1-sdk", {
+    type: "boolean",
+    default: false,
+    describe: "Use the real @xyo-network/xl1-protocol-sdk RestDataLakeRunner"
+  }),
+  handler: async (argv) => {
+    await pushPayloads({
+      file: argv.file,
+      idOrName: argv.name,
+      batchSize: argv["batch-size"],
+      verify: argv.verify,
+      xl1Sdk: argv["xl1-sdk"]
+    });
+  }
+};
+
+// src/commands/datalakeRevokeCommand.ts
+var datalakeRevokeCommand = {
+  command: "revoke <name> <principal>",
+  describe: "Revoke a principal's access to a datalake",
+  builder: (yargs) => yargs.positional("name", {
+    type: "string",
+    describe: "Datalake name or id",
+    demandOption: true
+  }).positional("principal", {
+    type: "string",
+    describe: 'User id, or the literal "public"',
+    demandOption: true
+  }),
+  handler: async (argv) => {
+    await revokeAccess({
+      idOrName: argv.name,
+      principal: argv.principal
+    });
+  }
+};
+
+// src/commands/datalakeTailCommand.ts
+var datalakeTailCommand = {
+  command: "tail [name]",
+  describe: "Stream payloads from a datalake (Ctrl+C to stop with --follow)",
+  builder: (yargs) => yargs.positional("name", {
+    type: "string",
+    describe: "Datalake name or id (defaults to current)"
+  }).option("follow", {
+    alias: "f",
+    type: "boolean",
+    default: false,
+    describe: "Keep polling for new payloads after draining the backlog"
+  }).option("limit", {
+    alias: "n",
+    type: "number",
+    default: 50,
+    describe: "Max payloads per page"
+  }).option("cursor", {
+    type: "string",
+    describe: "Resume after this hash (exclusive)"
+  }).option("schemas", {
+    type: "string",
+    describe: "Comma-separated list of schemas to include"
+  }).option("poll-interval", {
+    type: "number",
+    default: 1e3,
+    describe: "Poll interval in ms when following"
+  }),
+  handler: async (argv) => {
+    await tailPayloads({
+      idOrName: argv.name,
+      follow: argv.follow,
+      limit: argv.limit,
+      cursor: argv.cursor,
+      schemas: argv.schemas ? argv.schemas.split(",") : void 0,
+      pollIntervalMs: argv["poll-interval"]
+    });
+  }
+};
+
+// src/commands/datalakeTokenCommand.ts
+var datalakeTokenCommand = {
+  command: "token [name]",
+  describe: "Mint a scoped JWT for SDK use",
+  builder: (yargs) => yargs.positional("name", {
+    type: "string",
+    describe: "Datalake name or id (defaults to current)"
+  }).option("role", {
+    alias: "r",
+    type: "string",
+    choices: ["viewer", "runner"],
+    default: "viewer",
+    describe: "Role encoded in the token"
+  }).option("ttl", {
+    type: "number",
+    describe: "Lifetime in seconds (server-capped)"
+  }),
+  handler: async (argv) => {
+    await mintToken({
+      idOrName: argv.name,
+      role: argv.role,
+      ttlSeconds: argv.ttl
+    });
+  }
+};
+
+// src/commands/datalakeUseCommand.ts
+var datalakeUseCommand = {
+  command: "use [name]",
+  describe: "Set the default datalake for subsequent commands (omit name to clear)",
+  builder: (yargs) => yargs.positional("name", {
+    type: "string",
+    describe: "Datalake name or id"
+  }),
+  handler: async (argv) => {
+    await useDatalake(argv.name);
+  }
+};
+
+// src/commands/datalakeCommand.ts
+var datalakeCommand = {
+  command: "datalake",
+  describe: "Provision and manage on-demand XL1 datalakes",
+  builder: (yargs) => yargs.command(datalakeLoginCommand).command(datalakeLogoutCommand).command(datalakeCreateCommand).command(datalakeListCommand).command(datalakeDescribeCommand).command(datalakeDestroyCommand).command(datalakeGrantCommand).command(datalakeRevokeCommand).command(datalakeTokenCommand).command(datalakeUseCommand).command(datalakePushCommand).command(datalakeFetchCommand).command(datalakeTailCommand).command(datalakeAuditCommand).command(datalakeDevCommand).demandCommand(1).strictCommands(),
+  // eslint-disable-next-line @typescript-eslint/no-empty-function
+  handler: () => {
+  }
+};
+export {
+  datalakeCommand
+};
+//# sourceMappingURL=datalakeCommand.mjs.map