@zivis/cli 0.1.0-alpha.40 → 0.1.0-alpha.41

package/dist/commands/app/index.js

@@ -16,7 +16,8 @@ export function registerAppCommands(program) {
         .option("--json", "emit raw JSON")
         .action(async (opts) => {
         const client = buildClient(opts);
-        const apps = await client.request("GET", "/api/rt/applications");
+        const result = await client.request("GET", "/api/rt/applications");
+        const apps = result.applications;
         if (opts.json) {
             process.stdout.write(JSON.stringify(apps, null, 2) + "\n");
             return;
@@ -85,7 +86,8 @@ export function registerAppCommands(program) {
         }
         const client = buildClient(opts);
         try {
-            const created = await client.request("POST", "/api/rt/applications", body);
+            const result = await client.request("POST", "/api/rt/applications", body);
+            const created = result.application;
             if (opts.json) {
                 process.stdout.write(JSON.stringify(created, null, 2) + "\n");
                 return;

package/dist/commands/assurance/index.d.ts

@@ -0,0 +1,33 @@
+import type { Command } from "commander";
+export interface CategoryPosture {
+    categoryId: string;
+    categoryName: string;
+    scoreRaw: number | null;
+    coverage: number | null;
+    determinedCount: number;
+    totalCount: number;
+}
+export interface AssuranceStatusResponse {
+    applicationId: string;
+    model: {
+        key: string;
+        displayName: string;
+        frameworkId: string | null;
+        version: string | null;
+    };
+    evaluationJobId: string | null;
+    evaluatedAt: string | null;
+    lastEvaluatedGitSha: string | null;
+    overall: {
+        scoreRaw: number | null;
+        coverage: number | null;
+        determinedCount: number;
+        totalCount: number;
+    };
+    categories: CategoryPosture[];
+    risk: {
+        openCritical: number;
+        openHigh: number;
+    };
+}
+export declare function registerAssuranceCommands(program: Command): void;

package/dist/commands/assurance/index.js

@@ -0,0 +1,149 @@
+import { ApiClient, ApiError } from "@zivis/mcp/api-client";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { requireApplicationId } from "@zivis/mcp/resolve-application-id";
+import { jsonEnvelope, printJson, failCommand, EXIT } from "../../internal/cli-output.js";
+function buildClient(opts) {
+    const config = opts.session
+        ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session }
+        : resolveConfigFromBinding(process.cwd());
+    return new ApiClient(config);
+}
+function resolveApp(opts, command, json) {
+    const resolved = requireApplicationId(opts.app, process.cwd());
+    if (!resolved.ok) {
+        if (json) {
+            printJson(jsonEnvelope(command, { result: "error", error: resolved.message }));
+        }
+        else {
+            console.error(`zivis ${command}: ${resolved.message}`);
+        }
+        process.exit(EXIT.INVALID_OR_INDETERMINATE);
+    }
+    return resolved.id;
+}
+function fmtScore(v) {
+    return v === null ? "—" : v.toFixed(2);
+}
+function fmtPct(v) {
+    return v === null ? "—" : `${Math.round(v * 100)}%`;
+}
+export function registerAssuranceCommands(program) {
+    const assurance = program.command("assurance").description("read current assurance/ZAM posture and issued Trust Marks");
+    assurance
+        .command("status")
+        .description("current Application/ZAM posture — live working state, not a signed claim")
+        .option("--app <id>", "Application id (defaults to the bound Application)")
+        .option("--model <zamId>", "assurance model key — required when more than one model is bound to the Application")
+        .option("--category <categoryId>", "show only this category")
+        .option("--provenance", "include evaluation/provenance detail in human-readable output")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (opts) => {
+        const json = !!opts.json;
+        const appId = resolveApp(opts, "assurance status", json);
+        const client = buildClient(opts);
+        try {
+            const query = new URLSearchParams({ applicationId: appId });
+            if (opts.model)
+                query.set("model", opts.model);
+            if (opts.category)
+                query.set("category", opts.category);
+            const status = await client.get(`/api/assurance/status?${query.toString()}`);
+            if (json) {
+                printJson(jsonEnvelope("assurance status", { result: "ok", ...status }));
+                return;
+            }
+            console.log(`Model: ${status.model.displayName} (${status.model.key})${status.model.version ? ` v${status.model.version}` : ""}`);
+            if (!status.evaluatedAt) {
+                console.log("No completed evaluation for this Application/model yet.");
+                return;
+            }
+            console.log(`Overall: score_raw=${fmtScore(status.overall.scoreRaw)} coverage=${fmtPct(status.overall.coverage)} (${status.overall.determinedCount}/${status.overall.totalCount} determined)`);
+            for (const c of status.categories) {
+                console.log(`  ${c.categoryId.padEnd(16)} score_raw=${fmtScore(c.scoreRaw)} coverage=${fmtPct(c.coverage)}`);
+            }
+            console.log(`Risk: ${status.risk.openCritical} open critical, ${status.risk.openHigh} open high`);
+            console.log(`Evaluated: ${status.evaluatedAt}`);
+            if (opts.provenance) {
+                console.log(`Evaluation job: ${status.evaluationJobId ?? "—"}`);
+                console.log(`Last evaluated git SHA: ${status.lastEvaluatedGitSha ?? "unknown"}`);
+                console.log(`Framework id: ${status.model.frameworkId ?? "—"}`);
+            }
+        }
+        catch (err) {
+            if (isAmbiguousModelError(err)) {
+                return handleAmbiguous("assurance status", err, json);
+            }
+            failCommand("assurance status", err, json);
+        }
+    });
+    assurance
+        .command("mark [markId]")
+        .description("read an issued Trust Mark/ZAT — a signed snapshot, distinct from live status")
+        .option("--latest", "resolve the latest mark for the bound Application")
+        .option("--app <id>", "Application id (with --latest; defaults to the bound Application)")
+        .option("--model <zamId>", "assurance model key — required when more than one model has a mark for the Application")
+        .option("--raw", "include the full signed token in the output")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (markId, opts) => {
+        const json = !!opts.json;
+        const client = buildClient(opts);
+        if (!markId && !opts.latest) {
+            const message = "Pass a markId, or use --latest to resolve the current Application's latest mark.";
+            if (json)
+                printJson(jsonEnvelope("assurance mark", { result: "error", error: message }));
+            else
+                console.error(`zivis assurance mark: ${message}`);
+            process.exit(EXIT.INVALID_OR_INDETERMINATE);
+        }
+        try {
+            let mark;
+            if (markId) {
+                const query = opts.raw ? "?raw=true" : "";
+                mark = await client.get(`/api/zat/marks/${encodeURIComponent(markId)}${query}`);
+            }
+            else {
+                const appId = resolveApp(opts, "assurance mark", json);
+                const query = new URLSearchParams({ applicationId: appId });
+                if (opts.model)
+                    query.set("model", opts.model);
+                if (opts.raw)
+                    query.set("raw", "true");
+                mark = await client.get(`/api/zat/marks/latest?${query.toString()}`);
+            }
+            if (json) {
+                printJson(jsonEnvelope("assurance mark", { result: "ok", ...mark }));
+                return;
+            }
+            console.log(`Mark: ${mark.mark_id}`);
+            console.log(`Issuer: ${mark.issuer}   Subject: ${mark.subject}`);
+            const fw = mark.framework;
+            if (fw) {
+                console.log(`Framework: ${fw.id} v${fw.version}   basis=${fw.basis}`);
+            }
+            console.log(`Score: ${fmtScore(mark.score_raw)} (display ${mark.score_display ?? "—"})  tier=${mark.tier_label ?? "—"}  scoring_profile=${mark.scoring_profile ?? "—"}`);
+            const sig = mark.signature;
+            console.log(`Signature: ${sig?.alg ?? "—"} — ${sig?.verified ? "VERIFIED" : "NOT VERIFIED"}`);
+            console.log(`Issued: ${mark.issued_at}   Expires: ${mark.expires_at}${mark.expired ? " (EXPIRED)" : ""}${mark.revoked ? "  (REVOKED)" : ""}`);
+        }
+        catch (err) {
+            if (isAmbiguousModelError(err)) {
+                return handleAmbiguous("assurance mark", err, json);
+            }
+            failCommand("assurance mark", err, json);
+        }
+    });
+}
+function isAmbiguousModelError(err) {
+    return err instanceof ApiError && err.status === 409;
+}
+function handleAmbiguous(command, err, json) {
+    if (json) {
+        printJson(jsonEnvelope(command, { result: "error", error: "ambiguous_model", message: err.message }));
+    }
+    else {
+        console.error(`zivis ${command}: ${err.message}`);
+    }
+    process.exit(EXIT.INVALID_OR_INDETERMINATE);
+}

package/dist/commands/auth/index.js

@@ -19,6 +19,7 @@ export function registerAuthCommands(program) {
         .description("interactive setup: authenticate, pick org, and bind this repo")
         .option("-s, --session <name>", "named session for multi-tenant")
         .option("--skip-mint-key", "skip MCP API key mint after successful OAuth")
+        .option("--application <name-or-id>", "select an existing Application by id or exact name (fails if not found — never creates one)")
         .action(async (opts) => {
         await initCommand(opts);
     });

package/dist/commands/auth/init.d.ts

@@ -1,5 +1,6 @@
 export interface InitCmdOpts {
     session?: string;
     skipMintKey?: boolean;
+    application?: string;
 }
 export declare function initCommand(opts: InitCmdOpts): Promise<void>;

package/dist/commands/auth/init.js

@@ -4,6 +4,7 @@ import { credentialStorageFromConfig, DEFAULT_CONFIG } from "@zivis/mcp/types";
 import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 import { fetchUserOrgs, extractEmail } from "../../internal/orgs.js";
 import { ensureProjectBinding } from "../../internal/project-binding.js";
+import { ensureApplicationBinding } from "../../internal/application-binding.js";
 import { discardOauthAfterLogin, tryAutoMintBindingTokenAfterLogin, } from "../../internal/binding-token-mint.js";
 import { decodeJwtPayload } from "@zivis/mcp/auth/jwt";
 import { detectIdesInRepo, writeGuidance } from "../../internal/ide-setup.js";
@@ -28,26 +29,26 @@ async function prompt(question) {
 }
 async function offerGuidanceInstall(cwd) {
     const detectedIdes = detectIdesInRepo(cwd);
-    if (detectedIdes.length === 0)
-        return;
+    const otherIdes = detectedIdes.filter((ide) => ide !== "claude-code-cli");
+    const targets = ["claude-code-cli", ...otherIdes];
     const ideLabels = {
         cursor: "Cursor",
-        "claude-code-cli": "Claude Code (CLAUDE.md)",
+        "claude-code-cli": "Claude Code (CLAUDE.md) / Codex (AGENTS.md)",
         "vscode-copilot": "VS Code (Copilot)",
         "vscode-claude": "VS Code (Claude)",
         cline: "Cline",
         windsurf: "Windsurf",
     };
-    const ideNames = detectedIdes.map((ide) => ideLabels[ide] ?? ide).join(", ");
-    console.log(`\nDetected IDE configs in this repo: ${ideNames}`);
-    const ans = await prompt("Add ZIVIS guidance so your AI assistant suggests security checks at the right moments?\n" +
-        "(Adds a rule/instruction file. You can edit or remove it anytime.) [Y/n] ");
+    const ideNames = targets.map((ide) => ideLabels[ide] ?? ide).join(", ");
+    console.log(`\nSet up AI agent guidance for: ${ideNames}`);
+    const ans = await prompt("Add ZIVIS guidance so your AI agent knows to run `zivis test` / `zivis threatmodel` when asked?\n" +
+        "(Adds a small managed block — your own content is preserved, remove anytime with `zivis mcp uninstall`.) [Y/n] ");
     if (ans.toLowerCase() === "n" || ans.toLowerCase() === "no") {
         console.log("  Skipped. Run 'zivis mcp install --client <ide> --with-guidance' anytime to add later.");
         return;
     }
     const written = [];
-    for (const ide of detectedIdes) {
+    for (const ide of targets) {
         try {
             const files = writeGuidance({ cwd, client: ide });
             written.push(...files);
@@ -148,6 +149,7 @@ export async function initCommand(opts) {
                     config, session, accessToken: retryTokens.access_token,
                     organizationId: retryOrgId, cwd: process.cwd(), autoBind: true, skipBind: false, force: true,
                 });
+                await ensureApplicationBinding({ config, accessToken: retryTokens.access_token, cwd: process.cwd(), explicitApplication: opts.application });
                 await tryAutoMintBindingTokenAfterLogin({
                     cwd: process.cwd(),
                     sessionName: session,
@@ -177,6 +179,7 @@ export async function initCommand(opts) {
             skipBind: false,
             force: true,
         });
+        await ensureApplicationBinding({ config, accessToken: tokens.access_token, cwd: process.cwd(), explicitApplication: opts.application });
         await tryAutoMintBindingTokenAfterLogin({
             cwd: process.cwd(),
             sessionName: session,
@@ -241,6 +244,7 @@ export async function initCommand(opts) {
                     skipBind: false,
                     force: true,
                 });
+                await ensureApplicationBinding({ config, accessToken: scopedTokens.access_token, cwd: process.cwd(), explicitApplication: opts.application });
                 await tryAutoMintBindingTokenAfterLogin({
                     cwd: process.cwd(),
                     sessionName: session,

package/dist/commands/gate/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerGateCommand(program: Command): void;

package/dist/commands/gate/index.js

@@ -0,0 +1,171 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import { ApiClient, ApiError } from "@zivis/mcp/api-client";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { requireApplicationId } from "@zivis/mcp/resolve-application-id";
+import { getCurrentGitSha } from "../../internal/git.js";
+import { parsePolicyFile, PolicyValidationError } from "../../internal/gate-policy.js";
+import { evaluateGate } from "../../internal/gate-evaluate.js";
+import { jsonEnvelope, printJson, EXIT, exitCodeForError, errorMessage } from "../../internal/cli-output.js";
+const DEFAULT_POLICY_PATH = ".zivis/policy.yaml";
+export function registerGateCommand(program) {
+    program
+        .command("gate [name]")
+        .description("evaluate a committed release/ship policy deterministically against current Zivis state")
+        .option("--file <path>", `policy file path (default: ${DEFAULT_POLICY_PATH})`)
+        .option("--app <id>", "Application id (defaults to the bound Application)")
+        .option("--model <zamId>", "ad-hoc form: assurance model key")
+        .option("--category <categoryId>", "ad-hoc form: category id to threshold")
+        .option("--min-score <0..1>", "ad-hoc form: minimum normalized score_raw")
+        .option("--min-coverage <0..1>", "ad-hoc form: minimum coverage")
+        .option("-s, --session <name>", "named session")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (name, opts) => {
+        const json = !!opts.json;
+        try {
+            const { gateName, policy, policyHash } = await resolvePolicy(name, opts);
+            const config = opts.session
+                ? { ...resolveConfigFromBinding(process.cwd()), session: opts.session }
+                : resolveConfigFromBinding(process.cwd());
+            const client = new ApiClient(config);
+            const resolvedApp = requireApplicationId(opts.app, process.cwd());
+            if (!resolvedApp.ok) {
+                throw new PolicyValidationError(resolvedApp.message);
+            }
+            const applicationId = resolvedApp.id;
+            const [currentGitSha, statusResult] = await Promise.all([
+                getCurrentGitSha(process.cwd()),
+                fetchStatus(client, applicationId, policy),
+            ]);
+            let mark = null;
+            let markLookupFailed = false;
+            let markId = null;
+            let assessorVersion = null;
+            if (policy.provenance) {
+                try {
+                    const query = new URLSearchParams({ applicationId, model: policy.model });
+                    const raw = await client.get(`/api/zat/marks/latest?${query.toString()}`);
+                    markId = raw.mark_id ?? null;
+                    const methodology = raw.methodology;
+                    assessorVersion = methodology?.assessor_version ?? null;
+                    mark = {
+                        basis: raw.framework?.basis,
+                        expired: !!raw.expired,
+                        revoked: !!raw.revoked,
+                        signature: { verified: !!raw.signature?.verified },
+                    };
+                }
+                catch (err) {
+                    if (!(err instanceof ApiError && err.status === 404)) {
+                        markLookupFailed = true;
+                    }
+                }
+            }
+            const evaluation = evaluateGate({
+                policy,
+                status: statusResult,
+                mark,
+                markLookupFailed,
+                currentGitSha,
+                now: new Date(),
+            });
+            const output = jsonEnvelope("gate", {
+                gate: gateName,
+                result: evaluation.result,
+                application_id: applicationId,
+                git_sha: currentGitSha ?? null,
+                policy_hash: policyHash,
+                evaluated_at: new Date().toISOString(),
+                scoring_profile: policy.scoring_profile ?? null,
+                checks: evaluation.checks,
+                provenance: {
+                    source: policy.source,
+                    latest_mark_id: markId,
+                    basis: mark?.basis ?? null,
+                    assessor_version: assessorVersion,
+                    last_evaluated_sha: statusResult?.lastEvaluatedGitSha ?? null,
+                },
+            });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                printHuman(gateName, evaluation, output);
+            }
+            process.exit(evaluation.result === "pass" ? EXIT.OK : evaluation.result === "fail" ? EXIT.POLICY_FAIL : EXIT.INVALID_OR_INDETERMINATE);
+        }
+        catch (err) {
+            const code = err instanceof PolicyValidationError ? EXIT.INVALID_OR_INDETERMINATE : exitCodeForError(err);
+            const message = errorMessage(err);
+            if (json) {
+                printJson(jsonEnvelope("gate", { gate: name ?? null, result: "indeterminate", error: message }));
+            }
+            else {
+                console.error(`zivis gate: ${message}`);
+            }
+            process.exit(code);
+        }
+    });
+}
+async function resolvePolicy(name, opts) {
+    const isAdHoc = !!(opts.model && opts.category && opts.minScore !== undefined);
+    if (isAdHoc) {
+        const minScore = Number(opts.minScore);
+        if (Number.isNaN(minScore) || minScore < 0 || minScore > 1) {
+            throw new PolicyValidationError("--min-score must be a number between 0.0 and 1.0.");
+        }
+        const policy = {
+            source: "current",
+            model: opts.model,
+            assurance: { categories: [{ id: opts.category, min_score_raw: minScore }] },
+        };
+        if (opts.minCoverage !== undefined) {
+            const minCoverage = Number(opts.minCoverage);
+            if (Number.isNaN(minCoverage) || minCoverage < 0 || minCoverage > 1) {
+                throw new PolicyValidationError("--min-coverage must be a number between 0.0 and 1.0.");
+            }
+            policy.assurance.categories[0].min_coverage = minCoverage;
+        }
+        return { gateName: "ad-hoc", policy, policyHash: "sha256:" + crypto.createHash("sha256").update(JSON.stringify(policy)).digest("hex") };
+    }
+    if (!name) {
+        throw new PolicyValidationError("A gate name is required (e.g. `zivis gate ship`), or pass --model/--category/--min-score for the ad-hoc debugging form.");
+    }
+    const filePath = path.resolve(process.cwd(), opts.file ?? DEFAULT_POLICY_PATH);
+    let raw;
+    try {
+        raw = await fs.readFile(filePath, "utf8");
+    }
+    catch {
+        throw new PolicyValidationError(`Policy file not found: ${filePath}`);
+    }
+    const parsed = parsePolicyFile(raw);
+    const policy = parsed.gates[name];
+    if (!policy) {
+        const available = Object.keys(parsed.gates).join(", ") || "(none defined)";
+        throw new PolicyValidationError(`Gate '${name}' is not defined in ${filePath}. Available gates: ${available}`);
+    }
+    const policyHash = "sha256:" + crypto.createHash("sha256").update(raw).digest("hex");
+    return { gateName: name, policy, policyHash };
+}
+async function fetchStatus(client, applicationId, policy) {
+    const query = new URLSearchParams({ applicationId, model: policy.model });
+    try {
+        return await client.get(`/api/assurance/status?${query.toString()}`);
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 404)
+            return null;
+        throw err;
+    }
+}
+function printHuman(gateName, evaluation, _full) {
+    const symbol = evaluation.result === "pass" ? "✓" : evaluation.result === "fail" ? "✗" : "?";
+    console.log(`Gate '${gateName}': ${symbol} ${evaluation.result.toUpperCase()}`);
+    for (const c of evaluation.checks) {
+        const label = c.category_id ? `${c.type}[${c.category_id}]` : c.type;
+        const mark = c.result === "pass" ? "✓" : c.result === "fail" ? "✗" : "?";
+        console.log(`  ${mark} ${label}: actual=${JSON.stringify(c.actual)} required=${JSON.stringify(c.required)}`);
+    }
+}

package/dist/commands/mcp/index.js

@@ -2,7 +2,7 @@ import * as path from "node:path";
 import * as readline from "node:readline/promises";
 import { startServer } from "@zivis/mcp/server";
 import { DEFAULT_CONFIG } from "@zivis/mcp/types";
-import { setupCursorWorkspace, setupVsCodeCopilot, setupVsCodeClaude, setupClaudeCodeCli, setupCline, setupWindsurf, printClaudeCodeManual, writeGuidance, } from "../../internal/ide-setup.js";
+import { setupCursorWorkspace, setupVsCodeCopilot, setupVsCodeClaude, setupClaudeCodeCli, setupCline, setupWindsurf, printClaudeCodeManual, writeGuidance, removeGuidance, } from "../../internal/ide-setup.js";
 const KNOWN_CLIENTS = [
     "cursor",
     "claude-code",
@@ -134,4 +134,36 @@ export function registerMcpCommands(program) {
             }
         }
     });
+    mcp
+        .command("uninstall")
+        .description("remove ONLY the ZIVIS-managed guidance block/files for a client (run from your project root)")
+        .option("--client <name>", `target client (${KNOWN_CLIENTS.join(" | ")})`)
+        .action(async (opts) => {
+        const client = opts.client?.toLowerCase();
+        if (!client) {
+            console.error("Specify a client with --client <name>:");
+            for (const c of KNOWN_CLIENTS)
+                console.error(`  zivis mcp uninstall --client ${c}`);
+            process.exit(1);
+        }
+        const guidanceClient = toGuidanceClient(client);
+        if (!guidanceClient) {
+            console.log(`Nothing to remove for "${client}" — no guidance files are written for this client.`);
+            return;
+        }
+        try {
+            const removed = removeGuidance({ cwd: process.cwd(), client: guidanceClient });
+            if (removed.length === 0) {
+                console.log("No ZIVIS-managed guidance found — nothing to remove.");
+                return;
+            }
+            console.log(`✓ Removed ZIVIS guidance:`);
+            for (const f of removed)
+                console.log(`  ${f}`);
+        }
+        catch (err) {
+            console.error("Uninstall failed:", err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+    });
 }

package/dist/commands/run/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerRunCommands(program: Command): void;

package/dist/commands/run/index.js

@@ -0,0 +1,111 @@
+import * as fs from "node:fs/promises";
+import { ApiClient } from "@zivis/mcp/api-client";
+import { resolveConfigFromBinding } from "@zivis/mcp/project-binding";
+import { DEVX_RUN_CONTRACT_VERSION, completeDevXRunRemote, cancelDevXRunRemote, isRetryableDevXRunError, } from "../../internal/devx-run.js";
+import { writeDevXRunCompleteOutboxEntry } from "../../internal/sync-outbox.js";
+import { jsonEnvelope, printJson, EXIT, errorMessage, failCommand } from "../../internal/cli-output.js";
+async function readInput(inputArg) {
+    const raw = inputArg === "-" ? await readStdin() : await fs.readFile(inputArg, "utf-8");
+    try {
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`--input is not valid JSON: ${errorMessage(err)}`);
+    }
+}
+async function readStdin() {
+    let data = "";
+    process.stdin.setEncoding("utf-8");
+    for await (const chunk of process.stdin) {
+        data += chunk;
+    }
+    return data;
+}
+export function registerRunCommands(program) {
+    const run = program.command("run").description("resolve a DevX run started by a run producer (e.g. `zivis test`)");
+    run
+        .command("complete <runId>")
+        .description("complete a pending run with its result envelope")
+        .requiredOption("--input <path>", "path to a JSON result file, or '-' for stdin")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (runId, opts) => {
+        const json = !!opts.json;
+        let result;
+        try {
+            result = await readInput(opts.input);
+        }
+        catch (err) {
+            failCommand("run complete", err, json);
+        }
+        const config = resolveConfigFromBinding(process.cwd());
+        const client = new ApiClient(config);
+        try {
+            const response = await completeDevXRunRemote(client, {
+                runId,
+                contractVersion: DEVX_RUN_CONTRACT_VERSION,
+                result,
+            });
+            const output = jsonEnvelope("run complete", {
+                run_id: runId,
+                outcome: response.outcome,
+                status: response.run.status,
+                completed_at: response.run.completedAt,
+            });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                console.log(`zivis run complete: ${response.outcome} (run ${runId} is now ${response.run.status})`);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            if (isRetryableDevXRunError(err)) {
+                const message = errorMessage(err);
+                const outboxPath = writeDevXRunCompleteOutboxEntry(process.cwd(), {
+                    runId,
+                    contractVersion: DEVX_RUN_CONTRACT_VERSION,
+                    result,
+                    error: message,
+                });
+                if (json) {
+                    printJson(jsonEnvelope("run complete", { run_id: runId, outcome: "queued", queued_at: outboxPath, error: message }));
+                }
+                else {
+                    console.error(`zivis run complete: Cloud unreachable (${message})\nQueued for retry: ${outboxPath}\nRun \`zivis sync --flush\` once the issue is resolved.`);
+                }
+                process.exit(EXIT.CLOUD_UNAVAILABLE);
+            }
+            failCommand("run complete", err, json);
+        }
+    });
+    run
+        .command("cancel <runId>")
+        .description("cancel a pending run")
+        .option("--reason <text>", "optional human-readable cancellation reason")
+        .option("--json", "emit JSON only on stdout")
+        .action(async (runId, opts) => {
+        const json = !!opts.json;
+        const config = resolveConfigFromBinding(process.cwd());
+        const client = new ApiClient(config);
+        try {
+            const response = await cancelDevXRunRemote(client, { runId, reason: opts.reason ?? null });
+            const output = jsonEnvelope("run cancel", {
+                run_id: runId,
+                outcome: response.outcome,
+                status: response.run.status,
+                cancelled_at: response.run.cancelledAt,
+            });
+            if (json) {
+                printJson(output);
+            }
+            else {
+                console.log(`zivis run cancel: ${response.outcome} (run ${runId} is now ${response.run.status})`);
+            }
+            process.exit(EXIT.OK);
+        }
+        catch (err) {
+            failCommand("run cancel", err, json);
+        }
+    });
+}

package/dist/commands/sync/index.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerSyncCommands(program: Command): void;