primitive-admin 1.1.0-alpha.82 → 1.1.0-alpha.84

package/dist/src/commands/documents.js

@@ -1,15 +1,38 @@
+import { snapshotBuildRows } from "../lib/snapshot-build-rows.js";
+import { driveSnapshotBuild } from "../lib/snapshot-build.js";
+import { ingestClientRows, ingestSessionRows, } from "../lib/document-ingest-rows.js";
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
-import { success, error, info, formatTable, formatId, formatDate, json, keyValue, result as printResult, warn, } from "../lib/output.js";
+import { success, error, info, formatTable, formatId, formatDate, json, keyValue, result as printResult, warn, flushOutput, } from "../lib/output.js";
 import { confirmPrompt } from "../lib/confirm-prompt.js";
+import { resolveOwnerUserId } from "../lib/resolve-owner.js";
 import { parseDataOption } from "../lib/data-input.js";
 import { parseFilterOptions } from "../lib/record-filter.js";
 import { buildPermissionsExport } from "../lib/document-export-permissions.js";
 import { chunkAddressOf, renumberManifestForExport, } from "../lib/snapshot-manifest-layout.js";
 import { validateSnapshotManifest } from "js-bao";
+import { auditSnapshotChain, } from "../lib/snapshot-audit.js";
+import { createAuditApiSource } from "../lib/snapshot-audit-source.js";
+import { createAuditLocalStore, createChainFingerprintReader, } from "../lib/snapshot-audit-store.js";
+import { discoverIngestInput, } from "../lib/document-ingest-input.js";
+import { buildIngestArtifact, ingestSchemaFromIntrospection, } from "../lib/document-ingest-artifact.js";
+import { driveDocumentIngest, summariseIngestPlan, assertIngestConfirmable, } from "../lib/document-ingest.js";
 import { ulid } from "ulid";
 import * as fs from "fs";
 import * as path from "path";
+/**
+ * One bulk-load session as rows (#3434, #3435, #3598).
+ *
+ * Shared by `documents ingests get` and by `documents ingest`'s own terminal
+ * report, so an operator reads the same thing however they arrived at it. The
+ * rows themselves are decided in `document-ingest-rows`, where they can be
+ * checked without a live server holding a session in the right state.
+ */
+function printIngestSession(session) {
+    for (const [label, value] of ingestSessionRows(session)) {
+        printResult(label, value);
+    }
+}
 /**
  * Report a document's format (#2816) — but only when it is a large document.
  *
@@ -25,22 +48,85 @@ function printDocumentFormat(doc) {
     }
 }
 /**
- * Resolve a `--owner` value to a userId. A value containing "@" is looked up
- * by exact email through the member-accessible `users/lookup` endpoint
- * (issue #2763); anything else is already a user id and is passed through.
- * Failures throw with the server's own message — a permission problem must
- * not read as "no such user", which is how the old admin-only lookup
- * reported it.
+ * What `documents records bulk` reports when the write is refused (#3619).
+ *
+ * The command used to catch every failure with `error(err.message)` while
+ * `ApiError` carried the code and the status on separate fields, so the stable
+ * code the server answers never reached the output and `--json` handled
+ * successes only. An operator driving a multi-hour load had to read human text
+ * to tell "ask again" from "somebody look at the log" (finding 3619-SO-04).
+ *
+ * The status is read from `statusCode` FIRST: that is where
+ * `cli/src/lib/api-client.ts`'s `ApiError` keeps it, and a reader that asks for
+ * `status` alone sees `undefined` on every error the client raises and prints
+ * nothing at all — #3597 paid for that once already. `status` is the fallback,
+ * for an error that came from somewhere else.
+ *
+ * Its own function so both surfaces are composed once and can be graded
+ * without spawning a process: the human line and the `--json` envelope must
+ * agree about which failure happened.
  */
-async function resolveOwnerUserId(client, appId, owner) {
-    if (!owner.includes("@"))
-        return owner;
-    const lookup = await client.lookupUserByEmail(appId, owner);
-    if (!lookup?.exists || !lookup.user) {
-        throw new Error(`No app user found with email "${owner}" in app ${appId}.`);
-    }
-    info(`Resolved owner email to userId: ${lookup.user.userId}`);
-    return lookup.user.userId;
+export function describeBulkFailure(err) {
+    const message = (typeof err?.message === "string" && err.message) || String(err);
+    const code = typeof err?.code === "string" && err.code ? err.code : undefined;
+    const raw = err?.statusCode ?? err?.status;
+    const status = Number.isFinite(Number(raw)) ? Number(raw) : undefined;
+    return {
+        line: `${message}${code ? ` [${code}]` : ""}${status !== undefined ? ` (${status})` : ""}`,
+        envelope: {
+            ok: false,
+            ...(code ? { code } : {}),
+            ...(status !== undefined ? { status } : {}),
+            error: message,
+        },
+    };
+}
+/**
+ * A document's tags as a list, from whatever the wire handed back (#3644).
+ *
+ * `tags` is absent when the document has none — the server's presence rule,
+ * shared by the app API's list shape and the admin inventory — so every
+ * reader here has to cope with `undefined`. A stray non-array (an older
+ * server, a hand-edited fixture) is read as "no tags" rather than printed
+ * raw.
+ */
+function documentTagList(tags) {
+    return Array.isArray(tags)
+        ? tags.filter((tag) => typeof tag === "string" && tag !== "")
+        : [];
+}
+/**
+ * Tag text a terminal prints rather than obeys (#3644).
+ *
+ * A tag is app-user text. The write-side validator
+ * (`validateTag` in `src/app-api/controllers/documents-controller.ts`) trims
+ * it, caps it at 48 characters and refuses dynamo-bao's key separator, but
+ * every other byte survives — including the escape character. Printed raw
+ * into an operator's terminal, a 15-character tag such as
+ * `\x1b[2J\x1b[Hrestored` clears the screen and homes the cursor while
+ * the listing is being written, so a member with write access to one document
+ * could hide or falsify what `documents list` and `documents get` appear to
+ * report about the rest. The C0 range, DEL and the C1 range are therefore
+ * rendered as their `\uXXXX` source escapes: readable, one line and one cell
+ * per tag, and inert. Ordinary text — accents, CJK, emoji — is untouched.
+ */
+function escapeForTerminal(tag) {
+    return tag.replace(/[\x00-\x1f\x7f-\x9f]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+ * A document's tags as printable text, in the order the wire reported them.
+ *
+ * Only the plain-text surfaces come through here: `--json` on both commands
+ * returns the server's object untouched, so a migration diffing tags against
+ * what it wrote still reads the stored bytes.
+ */
+export function displayTags(tags) {
+    return documentTagList(tags).map(escapeForTerminal);
+}
+/** The tags cell of a documents table: comma-joined, or `-` when there are none. */
+export function formatTags(tags) {
+    const list = displayTags(tags);
+    return list.length > 0 ? list.join(", ") : "-";
 }
 export function registerDocumentsCommands(program) {
     const documents = program
@@ -95,6 +181,10 @@ Examples:
             console.log(formatTable(list, [
                 { header: "DOCUMENT_ID", key: "documentId", format: formatId },
                 { header: "TITLE", key: "title", flex: true },
+                // #3644 — the tags the route now reports. An app migration that
+                // regenerates tags on import verifies them from here; a document
+                // with none shows `-` rather than an empty cell.
+                { header: "TAGS", key: "tags", format: formatTags },
                 { header: "PERMISSION", key: "permission" },
                 { header: "GRANTED", key: "grantedAt", format: formatDate },
             ]));
@@ -126,6 +216,15 @@ Examples:
             keyValue("Created", formatDate(doc.createdAt));
             keyValue("Modified", formatDate(doc.modifiedAt ?? doc.lastModified));
             printDocumentFormat(doc);
+            // #3644 — tags, when the document has any. The endpoint has returned
+            // them since #3096 but only `--json` showed them, so a migration
+            // verifying restored tags had to parse JSON to see its own work.
+            // Printed only when present, by the same rule the response uses: an
+            // untagged document's output is unchanged, and escaped the same way
+            // the table's cell is so a crafted tag cannot drive the terminal.
+            const tags = displayTags(doc.tags);
+            if (tags.length > 0)
+                keyValue("Tags", tags.join(", "));
             // `GET documents/:id` reports the caller's own access, not the
             // document's grant/alias/collection inventory — printing counts for
             // fields the endpoint never returns read as a definitive "0" for
@@ -827,7 +926,11 @@ Permissions (enforced by the server, not the CLI):
                 `${result.added.length} added, ${result.updated.length} updated, ${result.deleted} deleted.`);
         }
         catch (err) {
-            error(err.message);
+            const report = describeBulkFailure(err);
+            if (options.json)
+                json(report.envelope);
+            else
+                error(report.line);
             process.exit(1);
         }
     });
@@ -900,6 +1003,214 @@ Permissions (enforced by the server, not the CLI):
             process.exit(1);
         }
     });
+    // The action verb (#3435, criterion 9): a directory of records becomes a
+    // chunked, digested, uploaded artifact and one atomic swap of the
+    // document's tables. `documents ingests list|get` below is how an operator
+    // watches one afterwards.
+    //
+    // Destructive by nature — a bulk load deletes and overwrites records in a
+    // live document with no undo — so it confirms unless `-y`, which is what
+    // `docs/cli-design.md` reserves the destructive default for.
+    documents
+        .command("ingest")
+        .description("Bulk-load records into a large document from a directory")
+        .argument("<document-id>", "Document ID")
+        .requiredOption("--input <dir>", "Directory of <model>.ndjson[.gz] files, or a `documents export` output")
+        .option("--app <app-id>", "App ID")
+        .option("-y, --yes", "Skip the confirmation prompt")
+        .option("--no-wait", "Exit once the session is committed")
+        .option("--timeout <seconds>", "Give up waiting after this many seconds")
+        .option("--json", "Output as JSON")
+        .action(async (documentId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        let plan = null;
+        // The exit code is carried out of here rather than taken inside: a
+        // `process.exit` does not unwind, so ending the process in the try block
+        // would skip the cleanup in the finally and leave the compressed
+        // artifact — up to the whole input, gzipped — in the OS temp directory
+        // on every run, successful or not (finding 3435-FROZEN-05).
+        const run = async () => {
+            // The preflight, in this order and before a byte is read from disk:
+            // the schema read says whether this caller may see the document's
+            // declarations at all and hands over the ones the lines are checked
+            // against, and the session reader says whether this is a large
+            // document. Both are READS on the arm the ingest routes admit, so a
+            // caller who would be refused halfway is refused at once, and neither
+            // opens a session.
+            const introspection = await client.getDocumentSchema(resolvedAppId, documentId);
+            await client.listDocumentIngests(resolvedAppId, documentId, { limit: 1 });
+            const schema = ingestSchemaFromIntrospection(introspection);
+            const input = discoverIngestInput(options.input, documentId);
+            for (const ignored of input.ignored) {
+                info(`Ignoring ${ignored}: a bulk load reads the snapshot only.`);
+            }
+            // #3598 — reading, checking, sorting, cutting and gzipping is this
+            // side's biggest phase on a large input, and it used to be invisible
+            // inside one wall-clock number that also covered the platform's work.
+            const buildStartedAt = Date.now();
+            plan = await buildIngestArtifact({ input, schema });
+            const buildMs = Date.now() - buildStartedAt;
+            info(`Built artifact in ${(buildMs / 1000).toFixed(1)}s.`);
+            for (const line of summariseIngestPlan(plan))
+                info(line);
+            assertIngestConfirmable({
+                yes: Boolean(options.yes),
+                isTTY: Boolean(process.stdin.isTTY),
+            });
+            if (!options.yes) {
+                const confirmed = await confirmPrompt(`Bulk-load ${plan.rows} records into ${documentId}? ` +
+                    "This replaces records in a live document and cannot be undone.");
+                if (!confirmed) {
+                    info("Nothing was uploaded.");
+                    return 1;
+                }
+            }
+            // Ctrl-C is a decision the driver makes differently depending on
+            // where it lands, so it is handed the signal rather than killing the
+            // process: mid-upload the session is aborted, mid-poll it is left
+            // running, because by then the document is already being changed.
+            const interrupt = new AbortController();
+            const onSignal = () => interrupt.abort();
+            process.on("SIGINT", onSignal);
+            let outcome;
+            try {
+                outcome = await driveDocumentIngest({
+                    client: {
+                        createIngest: (id) => client.createDocumentIngest(resolvedAppId, id),
+                        uploadIngestChunk: (id, sessionId, chunk) => client.uploadDocumentIngestChunk(resolvedAppId, id, sessionId, chunk),
+                        commitIngest: (id, sessionId) => client.commitDocumentIngest(resolvedAppId, id, sessionId),
+                        abortIngest: (id, sessionId) => client.abortDocumentIngest(resolvedAppId, id, sessionId),
+                        getIngest: (id, sessionId) => client.getDocumentIngest(resolvedAppId, id, sessionId),
+                    },
+                    documentId,
+                    plan,
+                    wait: options.wait !== false,
+                    timeoutMs: options.timeout ? Number(options.timeout) * 1000 : null,
+                    signal: interrupt.signal,
+                    onProgress: (line) => info(line),
+                });
+            }
+            finally {
+                process.off("SIGINT", onSignal);
+            }
+            if (outcome.message)
+                error(outcome.message);
+            // #3598 — the two sides, side by side. The session's own `timings`
+            // say where the platform's share went; `client` says what this
+            // process spent before and around it, so a slow load can be blamed on
+            // the side that was actually slow.
+            const clientTimings = { buildMs, ...outcome.timings };
+            if (options.json) {
+                json({
+                    ...(outcome.session ?? { sessionId: outcome.sessionId }),
+                    client: clientTimings,
+                });
+            }
+            else {
+                if (outcome.session) {
+                    printIngestSession(outcome.session);
+                }
+                else if (outcome.sessionId) {
+                    printResult("Session", outcome.sessionId);
+                }
+                for (const [label, value] of ingestClientRows(clientTimings)) {
+                    printResult(label, value);
+                }
+            }
+            return outcome.exitCode;
+        };
+        let code = 1;
+        try {
+            code = await run();
+        }
+        catch (err) {
+            error(err.message);
+            code = 1;
+        }
+        finally {
+            await plan?.cleanup().catch(() => undefined);
+        }
+        // The result has to reach the pipe before the process ends: stdout to a
+        // pipe is asynchronous and `process.exit` does not wait for it.
+        await flushOutput();
+        process.exit(code);
+    });
+    // Bulk-load sessions of a large document (#3434, criterion 9): a data noun
+    // with `list` and `get` readers, per docs/cli-design.md, beside `snapshots`
+    // below. The ACTION verb `documents ingest` is #3435's; these two are how an
+    // operator sees what a session did and why one stopped.
+    const ingests = documents
+        .command("ingests")
+        .description("Inspect a large document's bulk-load sessions");
+    ingests
+        .command("list")
+        .description("List a large document's bulk-load sessions, newest first")
+        .argument("<document-id>", "Document ID")
+        .option("--app <app-id>", "App ID")
+        .option("--limit <n>", "Page size (1–100)", "20")
+        .option("--cursor <cursor>", "Continue from a previous page's nextCursor")
+        .option("--json", "Output as JSON")
+        .action(async (documentId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const page = await client.listDocumentIngests(resolvedAppId, documentId, {
+                limit: Number(options.limit),
+                ...(options.cursor ? { cursor: options.cursor } : {}),
+            });
+            if (options.json) {
+                json(page);
+                return;
+            }
+            if (page.items.length === 0) {
+                info("No ingest sessions yet.");
+                return;
+            }
+            console.log(formatTable(page.items, [
+                { header: "SESSION", key: "sessionId" },
+                { header: "STATE", key: "state" },
+                { header: "CREATED", key: "createdAt", format: formatDate },
+                { header: "CHUNKS", key: "chunks" },
+                { header: "ROWS", key: "rows" },
+                {
+                    header: "COMPLETED",
+                    key: "completedAt",
+                    format: (at) => (at ? formatDate(at) : "—"),
+                },
+            ]));
+            if (page.hasMore && page.nextCursor) {
+                info(`More sessions: --cursor ${page.nextCursor}`);
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    ingests
+        .command("get")
+        .description("Show one bulk-load session, its progress and why it stopped")
+        .argument("<document-id>", "Document ID")
+        .argument("<session-id>", "Session ID")
+        .option("--app <app-id>", "App ID")
+        .option("--json", "Output as JSON")
+        .action(async (documentId, sessionId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const session = await client.getDocumentIngest(resolvedAppId, documentId, sessionId);
+            if (options.json) {
+                json(session);
+                return;
+            }
+            printIngestSession(session);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
     // Snapshot builds of a large document (#3432, criterion 9): a data noun
     // with `list` and `get` readers, per docs/cli-design.md, over the app API's
     // read-only inspection routes.
@@ -974,47 +1285,11 @@ Permissions (enforced by the server, not the CLI):
                 json(build);
                 return;
             }
-            printResult("Build", build.buildId);
-            printResult("Epoch", build.epoch);
-            printResult("State", build.state);
-            printResult("Source", build.source);
-            printResult("Manifest version", build.manifestVersion);
-            printResult("Started", formatDate(build.startedAt));
-            printResult("Completed", build.completedAt ? formatDate(build.completedAt) : "—");
-            printResult("Rows", build.rows);
-            printResult("Bytes", build.bytes);
-            printResult("Chunks", build.chunks);
-            const verification = build.verification;
-            printResult("Verification", verification ? verification.state : "not started");
-            if (verification) {
-                printResult("Checked at", formatDate(verification.checkedAt));
-                printResult("Chunks checked", verification.chunksChecked);
-                if (verification.code)
-                    printResult("Code", verification.code);
-                if (verification.reason)
-                    printResult("Reason", verification.reason);
-            }
-            if (build.failure) {
-                printResult("Failed at", formatDate(build.failure.at));
-                if (build.failure.chunk) {
-                    printResult("Failed on", `${build.failure.chunk.model} chunk ${build.failure.chunk.ordinal}`);
-                }
-            }
-            const timings = build.timings ?? { ticks: 0, totals: {} };
-            printResult("Ticks", timings.ticks);
-            const stages = [
-                ["Read (ms)", "readMs"],
-                ["Encode (ms)", "encodeMs"],
-                ["Compress (ms)", "compressMs"],
-                ["Hash (ms)", "hashMs"],
-                ["Upload (ms)", "uploadMs"],
-                ["Manifest (ms)", "manifestMs"],
-                ["Verify read (ms)", "verifyReadMs"],
-                ["Verify digest (ms)", "verifyDigestMs"],
-                ["Verify coverage (ms)", "verifyCoverageMs"],
-            ];
-            for (const [label, key] of stages) {
-                printResult(label, timings.totals?.[key] ?? 0);
+            // The rows are composed by a pure function (#3435), so what a
+            // terminal shows is checkable without spawning one; the command still
+            // owns the printing.
+            for (const [label, value] of snapshotBuildRows(build)) {
+                printResult(label, value);
             }
         }
         catch (err) {
@@ -1022,13 +1297,178 @@ Permissions (enforced by the server, not the CLI):
             process.exit(1);
         }
     });
+    // #3666, criterion 7 — the one ACTION verb in this group: snapshot the
+    // document now instead of waiting for the size or age trigger. Its exit
+    // codes are `documents ingest`'s, as `docs/cli-design.md` records them, and
+    // for the same reason: giving up on WATCHING a build is not the build
+    // failing.
+    //
+    // Not destructive, so it does not confirm: a seal rotates the overlay the
+    // room is writing to and loses nothing, which is what the size trigger does
+    // on its own several times a day.
+    snapshots
+        .command("build")
+        .description("Snapshot a large document now: seal the open epoch and build a base")
+        .argument("<document-id>", "Document ID")
+        .option("--app <app-id>", "App ID")
+        .option("--wait", "Poll until the build has verified or failed")
+        .option("--timeout <seconds>", "Give up waiting after this many seconds")
+        .option("--json", "Output as JSON")
+        .action(async (documentId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        const run = async () => {
+            // Ctrl-C while polling leaves the build running — by then the room is
+            // already building it and giving up on watching is not giving up on
+            // the build — so the signal is handed to the driver rather than
+            // killing the process.
+            const interrupt = new AbortController();
+            const onSignal = () => interrupt.abort();
+            process.on("SIGINT", onSignal);
+            let outcome;
+            try {
+                outcome = await driveSnapshotBuild({
+                    client: {
+                        requestSnapshot: (id) => client.requestDocumentSnapshot(resolvedAppId, id),
+                        getSnapshot: (id, buildId) => client.getDocumentSnapshot(resolvedAppId, id, buildId),
+                    },
+                    documentId,
+                    wait: Boolean(options.wait),
+                    timeoutMs: options.timeout ? Number(options.timeout) * 1000 : null,
+                    signal: interrupt.signal,
+                    onProgress: (line) => info(line),
+                });
+            }
+            finally {
+                process.off("SIGINT", onSignal);
+            }
+            if (outcome.message)
+                error(outcome.message);
+            if (options.json) {
+                // The route's answer as received, with the build the wait settled
+                // on beside it when there was one — so a script branches on the
+                // verdict rather than on an exit code alone.
+                json(outcome.build ? { ...outcome.response, build: outcome.build } : outcome.response);
+                return outcome.exitCode;
+            }
+            if (outcome.response?.sealed === false) {
+                printResult("Sealed", "no — the open epoch carried nothing");
+                printResult("Reason", outcome.response.reason);
+                printResult("Covering build", outcome.response.coveringBuildId ?? "—");
+                return outcome.exitCode;
+            }
+            printResult("Sealed epoch", outcome.response.sealedEpoch);
+            printResult("Open epoch", outcome.response.nextEpoch);
+            printResult("Build", outcome.response.buildId);
+            if (outcome.build) {
+                for (const [label, value] of snapshotBuildRows(outcome.build)) {
+                    printResult(label, value);
+                }
+            }
+            return outcome.exitCode;
+        };
+        let code = 1;
+        try {
+            code = await run();
+        }
+        catch (err) {
+            // The server's own sentence, plus the code a script branches on
+            // (#3403) — a refused loop that only says "too young to seal" leaves
+            // a caller parsing prose to tell it from a permission refusal.
+            error(err.code ? `${err.message} (${err.code})` : err.message);
+            const retryAfterMs = err.details?.retryAfterMs;
+            if (typeof retryAfterMs === "number") {
+                error(`Ask again in ${Math.ceil(retryAfterMs / 1000)}s.`);
+            }
+            code = 1;
+        }
+        // The result has to reach the pipe before the process ends: stdout to a
+        // pipe is asynchronous and `process.exit` does not wait for it.
+        await flushOutput();
+        process.exit(code);
+    });
+    // #3433, criterion 10 — the operator audit: `snapshot ⊕ overlays == table`,
+    // recomputed on this side with the CLIENT's loader and fold and compared
+    // with the authoritative table page by page. The one check that can catch a
+    // DO/client fold divergence, which per-build verification runs on one side
+    // of and therefore cannot see.
+    snapshots
+        .command("audit")
+        .description("Recompute a large document's snapshot chain locally and compare it with the table")
+        .argument("<document-id>", "Document ID")
+        .option("--app <app-id>", "App ID")
+        .option("--retries <n>", "Attempts before giving up on a document that keeps changing", "3")
+        .option("--json", "Output as JSON")
+        .action(async (documentId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        const report = await auditDocumentChain(client, resolvedAppId, documentId, Number(options.retries));
+        if (options.json) {
+            json(report);
+        }
+        else if (report.verdict === "none") {
+            // No verdict is not a clean bill of health, so nothing that could be
+            // read as one is printed: the reason, and nothing else.
+            error(`No verdict: ${report.reason}`);
+        }
+        else {
+            printResult("Document", documentId);
+            printResult("Base build", report.buildId);
+            printResult("Base epoch", report.epoch);
+            printResult("Attempts", report.attempts);
+            printResult("Verdict", report.verdict === "match"
+                ? "match — the table is the chain"
+                : "DIVERGENCE");
+            console.log(formatTable(report.models, [
+                { header: "MODEL", key: "model" },
+                { header: "COMPARED", key: "compared" },
+                {
+                    header: "ONLY IN CHAIN",
+                    key: "onlyRecomputed",
+                    format: (ids) => (ids.length ? ids.join(", ") : "-"),
+                },
+                {
+                    header: "ONLY IN TABLE",
+                    key: "onlyTable",
+                    format: (ids) => (ids.length ? ids.join(", ") : "-"),
+                },
+                {
+                    header: "DIFFERING",
+                    key: "differing",
+                    format: (rows) => rows.length
+                        ? rows.map((row) => `${row.id} (${row.fields.join(", ")})`).join("; ")
+                        : "-",
+                },
+            ]));
+            if (report.models.some((model) => model.truncated)) {
+                info("Some lists were truncated; re-run with --json for the full report.");
+            }
+            if (report.verdict === "match")
+                success("snapshot ⊕ overlays == table");
+        }
+        // The report has to reach the pipe before the process ends: stdout to a
+        // pipe is asynchronous and `process.exit` does not wait for it, so a
+        // large report piped into anything that is not reading as fast as this
+        // writes used to arrive cut off mid-document (3433-C12).
+        await flushOutput();
+        // 0 match, 1 divergence, 2 no verdict — so the validation child can
+        // script on "no verdict" without reading the text.
+        process.exit(report.verdict === "match" ? 0 : report.verdict === "divergence" ? 1 : 2);
+    });
     // Transfer document ownership
     documents
         .command("transfer-owner")
         .description("Transfer document ownership to another user")
+        // Every positional is declared optional and the action decides which is
+        // which (#3645). A required positional AFTER an optional one makes the
+        // optional one mandatory: commander binds the first value it sees to
+        // `[app-id]` and then reports the required argument missing, so
+        // `transfer-owner <document-id> <new-owner-id>` never reached the action.
+        // What each slot actually requires is enforced below, where the shift is
+        // already known.
         .argument("[app-id]", "App ID (uses current app if not specified)")
-        .argument("<document-id>", "Document ID")
-        .argument("<new-owner-id>", "User ID of the new owner")
+        .argument("[document-id]", "Document ID (required)")
+        .argument("[new-owner-id]", "User ID of the new owner (required)")
         .option("--app <app-id>", "App ID")
         .option("-y, --yes", "Skip confirmation prompt")
         .option("--json", "Output as JSON")
@@ -1230,8 +1670,11 @@ Permissions (enforced by the server, not the CLI):
     documents
         .command("export")
         .description("Export a document (Yjs state, blobs, permissions, aliases)")
+        // Optional in commander, required in the action (#3645) — see
+        // `transfer-owner` above for why a `<...>` here would make `[app-id]`
+        // mandatory.
         .argument("[app-id]", "App ID (uses current app if not specified)")
-        .argument("<document-id>", "Document ID to export")
+        .argument("[document-id]", "Document ID to export (required)")
         .option("--app <app-id>", "App ID")
         .option("--output <dir>", "Output directory", "./primitive-export")
         .option("--no-blobs", "Skip blob data")
@@ -1342,8 +1785,9 @@ Permissions (enforced by the server, not the CLI):
     documents
         .command("import")
         .description("Import documents from an export directory")
+        // Optional in commander, required in the action (#3645).
         .argument("[app-id]", "App ID (uses current app if not specified)")
-        .argument("<path>", "Path to export directory or single document directory")
+        .argument("[path]", "Path to export directory or single document directory (required)")
         .option("--app <app-id>", "App ID")
         .option("--aliases <mode>", "Alias conflict handling: overwrite or skip", "skip")
         // `--overwrite` has never replaced a document: the import path issues no
@@ -2360,4 +2804,33 @@ async function importRootDocument(client, appId, docDir, metadata, plan, overwri
             `root document ${targetRootDocId}`);
     }
 }
+/**
+ * Wire the audit to the app API (#3433, criterion 10).
+ *
+ * Two permissions, not one (3433-C08): the chain export takes the app-admin
+ * arm, and the schema and records reads it is compared against take the
+ * console arm or a read grant on the document — the documents surface grants
+ * no app-role bypass on a read (#3279, D3279-002). The schema is read first,
+ * so a caller holding only the first is refused before anything is exported.
+ */
+async function auditDocumentChain(client, appId, documentId, retries) {
+    // One page's worth of records is the audit's whole working set on the
+    // server side; everything else lives in the local store.
+    const AUDIT_PAGE_SIZE = 200;
+    const fingerprint = await createChainFingerprintReader();
+    // Nothing the server answers is carried from one attempt to the next: the
+    // attempt a moved document discards is exactly the one whose schema has
+    // changed under it (3433-C09).
+    const source = createAuditApiSource(client, {
+        appId,
+        documentId,
+        pageSize: AUDIT_PAGE_SIZE,
+    });
+    return await auditSnapshotChain(source, {
+        store: () => createAuditLocalStore(documentId),
+        fingerprint,
+        retries,
+        pageSize: AUDIT_PAGE_SIZE,
+    });
+}
 //# sourceMappingURL=documents.js.map