procesio-cli 0.1.1__py3-none-any.whl

procesio_cli/tools/procesio/handlers/processes.py

@@ -0,0 +1,416 @@
+"""Curated process + instance actions (the heart of PROCESIO automation).
+
+Paths are the exact Web-API v1.19 routes (tag ProcessTemplate/ProcessInstance):
+  list      GET    /api/Projects
+  get       GET    /api/Projects/{id}
+  payload   GET    /api/Projects/{id}/payload
+  run       POST   /api/Projects/{id}/run
+  instances GET    /api/Projects/{id}/instances
+  status    GET    /api/Projects/instances/{id}/status
+  output    GET    /api/Projects/instances/{id}/output
+  stop      POST   /api/Projects/instances/{id}/stop
+"""
+from __future__ import annotations
+
+import argparse
+
+from tools._lib.io import log
+from tools.procesio import reliability
+from tools.procesio.actiondef import ActionDef
+from tools.procesio.client import parse_json_arg
+from tools.procesio.errors import ProcesioAPIError, UsageError
+from tools.procesio.handlers.common import add_paging_args, add_profile_arg
+
+
+# -- list / get -------------------------------------------------------------
+
+def _list_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    add_paging_args(p)
+    p.add_argument("--search", help="filter by process name (searchName)")
+
+
+def list_processes(client, args) -> dict:
+    q = {"pageNumber": args.page, "pageItemCount": args.page_size,
+         "searchName": args.search}
+    return {"result": client.get("/api/Projects", q)}
+
+
+def _id_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    p.add_argument("--id", required=True, help="process (project) id")
+
+
+def _get_process_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    p.add_argument("--id", required=True, help="process (project) id")
+    p.add_argument("--compact", action="store_true",
+                   help="a structural summary (nodes, edges, variables) instead of the "
+                        "full flow DTO - the full DTO can be tens of KB and bloats a "
+                        "small context; use the default for editing/validation")
+
+
+def _ci(d, *keys):
+    if not isinstance(d, dict):
+        return None
+    low = {k.lower(): k for k in d}
+    for k in keys:
+        if k.lower() in low:
+            return d[low[k.lower()]]
+    return None
+
+
+def get_process(client, args) -> dict:
+    res = client.get(f"/api/Projects/{args.id}")
+    if not getattr(args, "compact", False):
+        return {"result": res}
+    flow = _ci(res, "flow") if isinstance(res, dict) and _ci(res, "flow") else res
+    actions = _ci(flow, "actions") or []
+    nodes = [{"name": _ci(a, "actionName") or _ci(a, "actionTemplateName"),
+              "template": _ci(a, "actionTemplateName")}
+             for a in actions if isinstance(a, dict)]
+    variables = [_ci(v, "name") for v in (_ci(flow, "variables") or [])
+                 if isinstance(v, dict)]
+    ports = _ci(flow, "ports") or _ci(flow, "connections") or []
+    return {"result": {
+        "id": _ci(flow, "id"), "title": _ci(flow, "title") or _ci(flow, "name"),
+        "isValid": _ci(flow, "isValid"),
+        "node_count": len(nodes), "nodes": nodes,
+        "edge_count": len(ports) if isinstance(ports, list) else None,
+        "variables": variables,
+    }}
+
+
+def get_process_payload(client, args) -> dict:
+    """The input-variable shape expected by run-process for this process."""
+    return {"result": client.get(f"/api/Projects/{args.id}/payload")}
+
+
+# -- run --------------------------------------------------------------------
+
+def _run_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    p.add_argument("--id", required=True, help="process (project) id to run")
+    p.add_argument("--payload", help="input variables as a JSON object")
+    p.add_argument("--connection-id", dest="connection_id",
+                   help="connectionid value (default null)")
+    p.add_argument("--synchronous", action="store_true",
+                   help="wait for completion (runSynchronous=true)")
+    p.add_argument("--timeout", type=int, help="secondsTimeOut for synchronous runs")
+    p.add_argument("--dry-run", dest="dry_run", action="store_true",
+                   help="show the request that WOULD be sent; do not run")
+
+
+def run_process(client, args) -> dict:
+    payload = parse_json_arg(args.payload, "payload") or {}
+    body = {"payload": payload, "connectionid": args.connection_id}
+    query = {"runSynchronous": "true" if args.synchronous else None,
+             "secondsTimeOut": args.timeout}
+    query = {k: v for k, v in query.items() if v is not None}
+    if args.dry_run:
+        return {"dry_run": True, "method": "POST",
+                "path": f"/api/Projects/{args.id}/run", "query": query, "body": body}
+    # An execution is EXEMPT from the client's total wall-clock deadline: a
+    # synchronous run of a many-action process legitimately takes minutes, and
+    # aborting it client-side does NOT stop the server run (it keeps executing and
+    # writing its side effects). Instead give the socket a per-read timeout matched
+    # to the requested --timeout (+buffer), or no read timeout at all when a
+    # synchronous run has no --timeout (wait for it). See PROCESIO-API-NOTES.md.
+    read_timeout = reliability.READ_TIMEOUT
+    if args.synchronous:
+        read_timeout = (args.timeout + 30) if args.timeout else None
+    return {"result": client.post(f"/api/Projects/{args.id}/run", body, query,
+                                  deadline=None, read_timeout=read_timeout)}
+
+
+# -- run with FILE inputs ---------------------------------------------------
+#
+# The one-call /run endpoint cannot carry file bytes: its body is JSON, and a File
+# process variable expects a materialised file behind a fileId. So a run with a file
+# input is a four-step sequence against three endpoints (verified live 2026-07-03,
+# and again 10/08/2026):
+#
+#   publish  POST /api/Projects/{id}/instances/publish   file var = METADATA only,
+#                                                        carrying a client-made GUID
+#   upload   POST /api/File/upload/flow                  bytes in multipart 'package',
+#                                                        ids in HEADERS (variableNAME)
+#   launch   POST /api/Projects/instances/{iid}/launch
+#   poll     GET  /api/Projects/instances/{iid}/status -> /output
+#
+# Publishing WITHOUT launching leaves a zombie instance in "starting", so the launch
+# leg is not optional once publish has run.
+
+_STATUS_LABELS = {1: "starting", 5: "inactive", 6: "stopped_by_user",
+                  15: "initializing", 30: "running",
+                  40: "finished_with_errors", 50: "finished"}
+_TERMINAL_STATUSES = {6, 40, 50}
+
+
+def _parse_file_bindings(raw: "list[str] | None") -> "dict[str, str]":
+    """`--file VARNAME=PATH` (repeatable) -> {variable name: local path}."""
+    out: "dict[str, str]" = {}
+    for item in raw or []:
+        name, sep, path = (item or "").partition("=")
+        if not sep or not name.strip() or not path.strip():
+            raise UsageError(f"--file expects VARNAME=PATH, got {item!r}")
+        out[name.strip()] = path.strip()
+    return out
+
+
+def _instance_id_from_publish(published) -> str:
+    """The publish response carries the new instance id at the TOP level as `id`;
+    older shapes nested it under `flows`. Try both before giving up."""
+    if isinstance(published, dict):
+        for key in ("id", "instanceId", "instanceID"):
+            if published.get(key):
+                return str(published[key])
+        flows = published.get("flows")
+        if isinstance(flows, list) and flows and isinstance(flows[0], dict):
+            for key in ("id", "instanceId"):
+                if flows[0].get(key):
+                    return str(flows[0][key])
+    raise ProcesioAPIError(0, "could not find the instance id in the publish response",
+                           {"response": published})
+
+
+def _run_with_files_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    p.add_argument("--id", required=True, help="process (project) id to run")
+    p.add_argument("--file", action="append", metavar="VARNAME=PATH",
+                   help="bind a local file to a File input variable; repeatable")
+    p.add_argument("--payload", help="the NON-file input variables as a JSON object")
+    p.add_argument("--timeout", type=int, default=300,
+                   help="seconds to wait for a terminal status (default 300)")
+    p.add_argument("--poll-interval", dest="poll_interval", type=float, default=3.0,
+                   help="seconds between status polls (default 3)")
+    p.add_argument("--no-wait", dest="no_wait", action="store_true",
+                   help="launch and return the instance id without polling")
+
+
+def run_process_with_files(client, args) -> dict:
+    """Run a process that takes one or more File input variables."""
+    import mimetypes
+    import os
+    import time
+    import uuid
+
+    bindings = _parse_file_bindings(args.file)
+    if not bindings:
+        raise UsageError("run-process-with-file needs at least one --file VARNAME=PATH "
+                         "(a run with no file input is just run-process)")
+
+    payload = parse_json_arg(args.payload, "payload") or {}
+    staged = []
+    for var_name, path in bindings.items():
+        if not os.path.isfile(path):
+            raise UsageError(f"--file {var_name}: no such file: {path}")
+        name = os.path.basename(path)
+        size = os.path.getsize(path)
+        mime = mimetypes.guess_type(name)[0] or "application/octet-stream"
+        file_id = str(uuid.uuid4())
+        # The publish payload carries METADATA ONLY; the bytes follow in step 2.
+        payload[var_name] = {"path": "", "size": size, "mimeType": mime,
+                             "name": name, "id": file_id, "hash": ""}
+        staged.append({"var": var_name, "path": path, "name": name,
+                       "size": size, "mime": mime, "file_id": file_id})
+
+    published = client.post(f"/api/Projects/{args.id}/instances/publish", payload)
+    instance_id = _instance_id_from_publish(published)
+    log(f"published instance {instance_id}")
+
+    for f in staged:
+        with open(f["path"], "rb") as fh:
+            content = fh.read()
+        client.request_multipart(
+            "/api/File/upload/flow",
+            files={"package": (f["name"], content, f["mime"])},
+            headers={"flowInstanceId": instance_id, "flowTemplateId": args.id,
+                     "variableName": f["var"], "fileId": f["file_id"]})
+        log(f"uploaded {f['name']} ({f['size']} bytes) -> {f['var']}")
+
+    client.post(f"/api/Projects/instances/{instance_id}/launch",
+                {"flowTemplateId": args.id, "connectionId": None})
+    log("launched")
+
+    result = {"instance_id": instance_id,
+              "files": [{"variable": f["var"], "name": f["name"], "size": f["size"]}
+                        for f in staged]}
+    if args.no_wait:
+        return {"result": {**result, "status": None, "status_label": "launched"}}
+
+    deadline = time.monotonic() + args.timeout
+    status_val = None
+    while True:
+        # The poll reads `status` only. Every flag below defaults to true server-side, and
+        # `addExtras` alone costs several backend look-ups per call (starter, webhook,
+        # schedule, form names, resource usage), so each poll asks for none of it. The
+        # final read below is /output, which is unaffected.
+        st = client.get(f"/api/Projects/instances/{instance_id}/status",
+                        {"flowTemplateId": args.id, "getActions": "false",
+                         "getVariables": "false", "getInternalVariables": "false",
+                         "addExtras": "false"})
+        inst = st.get("instance") if isinstance(st, dict) else None
+        status_val = (inst or st or {}).get("status")
+        if status_val in _TERMINAL_STATUSES:
+            break
+        if time.monotonic() > deadline:
+            raise ProcesioAPIError(
+                0, f"instance {instance_id} did not reach a terminal status within "
+                   f"{args.timeout}s; read it later with get-instance-output",
+                {"instance_id": instance_id, "last_status": status_val})
+        time.sleep(args.poll_interval)
+
+    output = client.get(f"/api/Projects/instances/{instance_id}/output",
+                        {"flowTemplateId": args.id})
+    inst = output.get("instance") if isinstance(output, dict) else None
+    return {"result": {**result,
+                       "status": status_val,
+                       "status_label": _STATUS_LABELS.get(status_val, str(status_val)),
+                       "variable": (inst or {}).get("variable"),
+                       "error": (inst or {}).get("error"),
+                       "output": output}}
+
+
+# -- instances --------------------------------------------------------------
+
+def _instances_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    p.add_argument("--id", required=True, help="process (project) id")
+    add_paging_args(p)
+    p.add_argument("--status", dest="filter_status", help="filterStatus value")
+
+
+def list_instances(client, args) -> dict:
+    q = {"pageNumber": args.page, "pageItemCount": args.page_size,
+         "filterStatus": args.filter_status}
+    return {"result": client.get(f"/api/Projects/{args.id}/instances", q)}
+
+
+def _instance_status_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    p.add_argument("--id", required=True, help="instance id")
+    p.add_argument("--flow-template-id", dest="flow_template_id",
+                   help="flowTemplateId (the process id)")
+    p.add_argument("--variables", action="store_true",
+                   help="include variables (getVariables=true)")
+    p.add_argument("--actions", action="store_true",
+                   help="include actions (getActions=true)")
+
+
+def get_instance_status(client, args) -> dict:
+    q = {"flowTemplateId": args.flow_template_id,
+         "getVariables": "true" if args.variables else None,
+         "getActions": "true" if args.actions else None}
+    return {"result": client.get(f"/api/Projects/instances/{args.id}/status", q)}
+
+
+def _instance_id_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    p.add_argument("--id", required=True, help="instance id")
+    p.add_argument("--flow-template-id", dest="flow_template_id",
+                   help="flowTemplateId (the process id)")
+
+
+def get_instance_output(client, args) -> dict:
+    q = {"flowTemplateId": args.flow_template_id}
+    return {"result": client.get(f"/api/Projects/instances/{args.id}/output", q)}
+
+
+def stop_instance(client, args) -> dict:
+    q = {"flowTemplateId": args.flow_template_id}
+    return {"result": client.post(f"/api/Projects/instances/{args.id}/stop", None, q)}
+
+
+# -- put-projects (curated: empty-body echo hardening) ----------------------
+
+_EMPTY_PUT_WARNING = (
+    "PUT /api/Projects returned a SUCCESS status with an EMPTY body. An empty-body "
+    "success has been observed to LIE: the response looked fine while the change did "
+    "NOT land server-side (see PROCESIO-API-NOTES.md 'Empirical reliability profile', "
+    "O4). Do NOT trust this echo — verify behaviourally: run the process "
+    "(run-process) and observe the effect, or re-read the definition and compare."
+)
+
+
+def _put_projects_args(p: argparse.ArgumentParser) -> None:
+    add_profile_arg(p)
+    p.add_argument("--body", help="request body as JSON (object or array)")
+    p.add_argument("--dry-run", dest="dry_run", action="store_true",
+                   help="compose and return the request without sending it")
+
+
+def _is_empty_echo(parsed) -> bool:
+    """The PROCESIO empty-body shape: no JSON body -> _parse_body returns
+    {"raw_text": ""}; also treat {} / None as empty."""
+    if parsed is None or parsed == {}:
+        return True
+    if isinstance(parsed, dict) and set(parsed) <= {"raw_text"}:
+        return not parsed.get("raw_text")
+    return False
+
+
+def put_projects(client, args) -> dict:
+    """Curated PUT /api/Projects: same passthrough as the generated action, but it
+    reports the HTTP status/elapsed/body-length and WARNS when the body is empty,
+    because an empty-body success can silently fail to persist (O4). Shadows the
+    autogenerated put-projects (curated names win in main.collect_actions)."""
+    body = parse_json_arg(args.body, "body")
+    if args.dry_run:
+        return {"dry_run": True, "method": "PUT", "path": "/api/Projects", "body": body}
+    result = client.put("/api/Projects", body)
+    meta = client.last_meta or {}
+    out = {
+        "result": result,
+        "http": {"status": meta.get("status"),
+                 "elapsed_s": meta.get("elapsed_s"),
+                 "body_len": meta.get("body_len")},
+    }
+    if _is_empty_echo(result) or meta.get("body_len") == 0:
+        out["warning"] = _EMPTY_PUT_WARNING
+    return out
+
+
+ACTIONS = {
+    "list-processes": ActionDef(
+        func=list_processes, add_args=_list_args, needs_client=True,
+        description="List processes (GET /api/Projects).",
+    ),
+    "get-process": ActionDef(
+        func=get_process, add_args=_get_process_args, needs_client=True,
+        description="Get one process by id (GET /api/Projects/{id}).",
+    ),
+    "get-process-payload": ActionDef(
+        func=get_process_payload, add_args=_id_args, needs_client=True,
+        description="Get a process's input-variable payload shape for run-process.",
+    ),
+    "run-process": ActionDef(
+        func=run_process, add_args=_run_args, needs_client=True,
+        description="Run a process (POST /api/Projects/{id}/run). Supports --dry-run.",
+    ),
+    "run-process-with-file": ActionDef(
+        func=run_process_with_files, add_args=_run_with_files_args, needs_client=True,
+        description="Run a process that takes File input variable(s): publish -> upload "
+                    "bytes -> launch -> poll -> output. --file VARNAME=PATH (repeatable).",
+    ),
+    "list-instances": ActionDef(
+        func=list_instances, add_args=_instances_args, needs_client=True,
+        description="List a process's run instances (GET /api/Projects/{id}/instances).",
+    ),
+    "get-instance-status": ActionDef(
+        func=get_instance_status, add_args=_instance_status_args, needs_client=True,
+        description="Get an instance's status/variables (GET /api/Projects/instances/{id}/status).",
+    ),
+    "get-instance-output": ActionDef(
+        func=get_instance_output, add_args=_instance_id_args, needs_client=True,
+        description="Get an instance's output (GET /api/Projects/instances/{id}/output).",
+    ),
+    "stop-instance": ActionDef(
+        func=stop_instance, add_args=_instance_id_args, needs_client=True,
+        description="Stop a running instance (POST /api/Projects/instances/{id}/stop).",
+    ),
+    "put-projects": ActionDef(
+        func=put_projects, add_args=_put_projects_args, needs_client=True,
+        description="Update a process (PUT /api/Projects). Reports HTTP status/elapsed "
+                    "and WARNS on an empty-body success (which can silently not persist).",
+    ),
+}

procesio_cli/tools/procesio/handlers/profile_admin.py

@@ -0,0 +1,184 @@
+"""Profile-management actions (no HTTP - they only touch Credential Manager).
+
+These let the user keep MANY credentials: several API keys (one per workspace)
+and one or more username/password accounts, switching between them with
+--profile or a stored default.
+"""
+from __future__ import annotations
+
+import argparse
+import getpass
+import sys
+
+from tools.procesio import environments, profiles
+from tools.procesio.actiondef import ActionDef
+from tools.procesio.errors import UsageError
+
+
+# -- add-credential ---------------------------------------------------------
+
+def _add_args(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--name", required=True, help="profile name, e.g. 'personal'")
+    p.add_argument("--type", required=True, choices=["apikey", "userpass"])
+    # apikey fields. PROCESIO's docs call these the API "key name" and "key value";
+    # keep --key/--value for compatibility, but use the product wording at prompts.
+    p.add_argument("--key", help="apikey: the key NAME header value (omit to be prompted without echoing)")
+    p.add_argument("--value", help="apikey: the key VALUE header value (omit to be prompted without echoing)")
+    p.add_argument("--workspace-id", dest="workspace_id",
+                   help="apikey: workspace GUID (sent as the workspaceid header)")
+    p.add_argument("--workspace", help="apikey: a human label for the workspace")
+    # userpass fields
+    p.add_argument("--username", help="userpass: account email/username")
+    p.add_argument("--password", help="userpass: account password (omit to be prompted without echoing)")
+    p.add_argument("--realm", help="userpass: override realm (default procesio01)")
+    p.add_argument("--client-id", dest="client_id",
+                   help="userpass: override client_id (default procesio-ui)")
+    # environment binding: which PROCESIO installation this credential authenticates
+    # against. Its host URLs come from that environment; unbound == Internal-PROD.
+    p.add_argument("--environment", dest="environment",
+                   help="bind this credential to an environment, e.g. Internal-QA "
+                        "(default: Internal-PROD). Add a client env first with add-environment.")
+    # shared optional base overrides (rare — normally the environment supplies these)
+    p.add_argument("--web-base", dest="web_base", help="override Web API base URL")
+    p.add_argument("--auth-base", dest="auth_base", help="override Proxy API base URL")
+    p.add_argument("--make-default", action="store_true",
+                   help="set this profile as the default")
+
+
+def _secret_arg(value, label: str, flag: str):
+    """Return the secret, prompting for it when the flag was omitted.
+
+    Passing a key/token/password as a CLI flag leaks it into shell history and into
+    every process listing on the box, which defeats the point of storing it in the OS
+    credential manager. So the flags stay OPTIONAL and an interactive terminal is
+    prompted via getpass (never echoed) — same contract as scripts/set-credential.py.
+    Non-interactive callers (CI, another tool) still pass the flag and are unaffected;
+    only a non-interactive caller that ALSO omits the flag gets the usage error.
+
+    The usage error names AAT_RUNNER_DIRECT because the common way to hit it is NOT
+    being non-interactive: run-tool routes tools through the persistent runner by
+    default, so the tool executes inside a daemon worker with no TTY and the prompt
+    is unreachable even for a human at a real console. "Run interactively" alone is
+    unactionable advice for someone who already is.
+    """
+    if value:
+        return value
+    if not sys.stdin.isatty():
+        raise UsageError(f"{label} is required: pass {flag}, or re-run with the "
+                         f"runner bypassed so it can prompt without echoing "
+                         f"(PowerShell: $env:AAT_RUNNER_DIRECT=1)")
+    entered = getpass.getpass(f"{label}: ").strip()
+    if not entered:
+        raise UsageError(f"{label} cannot be empty")
+    return entered
+
+
+def add_credential(args) -> dict:
+    blob: dict = {"type": args.type}
+    if args.type == "apikey":
+        blob["key"] = _secret_arg(args.key, "PROCESIO API key name", "--key")
+        blob["value"] = _secret_arg(
+            args.value, "PROCESIO API key value (shown once)", "--value"
+        )
+        if args.workspace_id:
+            blob["workspace_id"] = args.workspace_id
+        if args.workspace:
+            blob["workspace"] = args.workspace
+    else:  # userpass
+        if not args.username:
+            raise UsageError("userpass profiles need --username")
+        blob["username"] = args.username
+        blob["password"] = _secret_arg(args.password, "password", "--password")
+        if args.realm:
+            blob["realm"] = args.realm
+        if args.client_id:
+            blob["client_id"] = args.client_id
+    if getattr(args, "environment", None):
+        canon = environments.canonical_name(args.environment)
+        if not canon:
+            raise UsageError(
+                f"unknown environment '{args.environment}'. "
+                f"Known: {', '.join(sorted(environments.all_environments()))}. "
+                f"Add a client environment first with: run-tool procesio add-environment ..."
+            )
+        blob["environment"] = canon
+    for opt in ("web_base", "auth_base"):
+        if getattr(args, opt):
+            blob[opt] = getattr(args, opt)
+    profiles.save_profile(args.name, blob)
+    if args.make_default:
+        profiles.set_default(args.name)
+    return {
+        "saved": True,
+        "profile": profiles.public_view(blob, args.name),
+        "environment": blob.get("environment", environments.DEFAULT_ENV_NAME),
+        "default": profiles.get_default(),
+        "note": "secret values stored in Windows Credential Manager, never on disk",
+    }
+
+
+# -- list-credentials -------------------------------------------------------
+
+def list_credentials(_args) -> dict:
+    default = profiles.get_default()
+    out = []
+    for name in profiles.profile_names():
+        blob = profiles.get_profile(name)
+        view = profiles.public_view(blob, name)
+        view["is_default"] = (name == default)
+        # An unbound credential belongs to Internal-PROD (backward-compatible).
+        view["environment"] = blob.get("environment") or environments.DEFAULT_ENV_NAME
+        out.append(view)
+    return {
+        "count": len(out),
+        "default": default,
+        "default_environment": environments.get_default(),
+        "profiles": out,
+    }
+
+
+# -- set-default ------------------------------------------------------------
+
+def _name_arg(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--name", required=True, help="profile name")
+
+
+def set_default(args) -> dict:
+    profiles.set_default(args.name)
+    return {"default": args.name}
+
+
+def remove_credential(args) -> dict:
+    profiles.remove_profile(args.name)
+    return {"removed": args.name, "default": profiles.get_default(),
+            "remaining": profiles.profile_names()}
+
+
+def show_credential(args) -> dict:
+    """Non-secret view of one profile (secret fields shown only as has_*)."""
+    blob = profiles.get_profile(args.name)
+    return profiles.public_view(blob, args.name)
+
+
+ACTIONS = {
+    "add-credential": ActionDef(
+        func=add_credential, add_args=_add_args,
+        description="Store a new credential profile (apikey or userpass) in Credential Manager.",
+    ),
+    "list-credentials": ActionDef(
+        func=list_credentials,
+        description="List stored credential profiles (names/types/workspaces only - no secrets).",
+    ),
+    "set-default": ActionDef(
+        func=set_default, add_args=_name_arg,
+        description="Set the default profile used when --profile is omitted.",
+    ),
+    "remove-credential": ActionDef(
+        func=remove_credential, add_args=_name_arg,
+        description="Delete a credential profile and its cached token.",
+    ),
+    "show-credential": ActionDef(
+        func=show_credential, add_args=_name_arg,
+        description="Show one profile's non-secret fields (secrets shown only as has_*).",
+    ),
+}