> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bijection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# atelier

> Operate one workspace through its governed HTTP API.

`atelier` is the operator surface — the same public HTTP API the web application
uses. It never receives a database, storage, or connector credential.

The generated Atelier SDK is built from the independently reviewed
`api/atelier.openapi.json` contract and defaults to `http://127.0.0.1:8080`.
The reviewed CLI policy alone excludes browser
authentication ceremony such as `/api/atelier/auth/**` from Atelier commands. Eclipse has
its own public product SDK for Eclipse lifecycle and product authoring; neither
SDK can invoke Axiom, Mothership, or Panopticon.

```bash theme={null}
go build -o atelier ./cmd/atelier
go run ./cmd/atelier commands --query action --effect read --compact --json
go run ./cmd/atelier describe actions plan --json
go run ./cmd/atelier context --json
```

Tagged CLI releases contain signed checksums, SBOMs, macOS/Linux/Windows
archives, and `deb`, `rpm`, and `apk` packages. Source installs remain available
from a repository checkout with `go install ./cmd/atelier`.

For a deployed workspace, import one issued WorkOS access token over stdin and
verify it before storing it in macOS Keychain, Linux Secret Service, or Windows
Credential Manager:

```bash theme={null}
printf '%s' "$WORKOS_ACCESS_TOKEN" | atelier login --server https://workspace.example
atelier whoami --server https://workspace.example
atelier logout --server https://workspace.example
```

`axiom login` reads and writes the same origin-keyed vault entry, so signing in
through either product CLI signs the other into that exact workspace. The
commands and route contracts remain separate. `--token-file` is retained only
as an explicit automation override or login import; normal interactive use has
no credential file.

## Codex and MCP

Atelier publishes one MCP server in two transports. Local stdio uses the CLI's
origin-keyed vault credential:

```bash theme={null}
export ATELIER_URL=https://workspace.example
codex mcp add atelier -- atelier mcp serve
```

A deployed workspace also serves stateless Streamable HTTP with standard OAuth
protected-resource discovery, dynamic public-client registration, S256 PKCE,
browser approval, and token revocation:

```bash theme={null}
codex mcp add atelier --url https://workspace.example/api/atelier/mcp
codex mcp login atelier --scopes atelier
```

Both transports publish the same server instructions, typed input and output
schemas, structured results, tool-effect annotations, and versioned JSON error
content carrying the ordinary API code and request ID. Start with
`get_context`, use `search_catalog` and `get_contract` instead of loading the
complete ontology, retain the returned dataset transaction across pages, and
cross `plan_action` then `execute_action` for every mutation. Every tool is an
ordinary `/api/atelier/**` call; MCP owns no credential, policy, review state,
database path, or connector path.

The repository plugin at `plugins/bijection` bundles this stdio server with the
Bijection operating skill for Codex distribution.

## SDK quick start

The generated packages expose product-owned client names and ship from the same
reviewed contract:

```ts theme={null}
import { AtelierClient } from "@bijection/atelier";

const atelier = new AtelierClient({
  token: process.env.ATELIER_TOKEN!,
  baseURL: "https://workspace.example",
});
const page = await atelier.objects.objectsObjectTypeQuery({ objectType: "Vendor", limit: 25n });
```

```python theme={null}
from atelier import AtelierClient

atelier = AtelierClient(token=token, base_url="https://workspace.example")
page = atelier.objects.objects_object_type_query("Vendor", limit=25)
```

```go theme={null}
client := atelier.NewClient(token, atelier.WithBaseURL("https://workspace.example"))
page, err := client.Objects().ObjectsTypeQuery(ctx, "Vendor", &atelier.ObjectsTypeQueryParams{})
```

`eclipse model client` generates a product-specific layer over these packages:
typed object query/get helpers, Function parameter and row types, Action
plan/execute helpers, and the model/catalog hashes the source was generated
from. Its Go, Python, and TypeScript outputs are compile-tested against the
current Atelier SDK.

## Inspect

```bash theme={null}
atelier whoami
atelier ontology
atelier automations signals
atelier objects query Vendor
atelier objects get Vendor V-1
atelier functions list
atelier functions run vendors_unbooked
```

Administrators can ask the same live authorization engine that serves the
workspace to explain a member's effective access. Principal IDs come from the
bounded live membership collection; target names come from the running product
catalog and the closed Atelier/Axiom capability catalog.

```bash theme={null}
atelier access principals --filter jane
atelier access targets
atelier access check user_01H... action BookVendor
atelier access check user_01H... workflow ReconcileOrder
```

A refused decision is a successful explanation. The response is a standing,
point-in-time access-check resource with the evaluation time, live WorkOS
membership revision, authority and evaluation fingerprints, explicit limits,
and the nested policy explanation. It separates the platform
role/profile/capability gate from the product-policy gate and includes bounded
`why_not` paths without reading source rows or property values. `--filter`
filters only the current provider page; page with `--cursor` to inspect the live
organization without creating a member mirror in Atelier.

Ad-hoc SQL addresses the policy-scoped `ontology.*` relations only:

```bash theme={null}
atelier sql 'SELECT * FROM "ontology.Vendor" WHERE vendor_id = $1' --arg V-1
```

## Change the world

All mutation goes through named actions.

```bash theme={null}
atelier actions plan BookVendor --target V-1 --input comment='confirmed' > plan.json
atelier actions execute plan.json
atelier reviews list
atelier events list
atelier events list --category audit
```

A plan is stateless and shows exact effects. Execution re-resolves the
authoritative dataset transaction and refuses a stale plan.

## Files

```bash theme={null}
atelier files upload invoice.pdf
atelier files list
atelier files lineage 4d1eb7a9-2f67-4f8c-9590-8a1dcf54a338
atelier files impact 4d1eb7a9-2f67-4f8c-9590-8a1dcf54a338
atelier files download 4d1eb7a9-2f67-4f8c-9590-8a1dcf54a338 -o restored.pdf

# Create an explicit successor; equal names alone never create versions.
atelier files upload corrected-invoice.pdf \
  --supersedes 4d1eb7a9-2f67-4f8c-9590-8a1dcf54a338
```

## Arrow output

For analytics as code, the same governed table is available in an explicit Arrow
representation — without adding a second query doorway:

```bash theme={null}
atelier functions run vendors_unbooked \
  --dataset-transaction "$DATASET_TRANSACTION" \
  --arrow
```

The Go SDK supports incremental batch consumption (Go 1.25 or later):

```go theme={null}
batches, err := client.Functions().RunArrowBatches(ctx, "vendors_unbooked", nil)
if err != nil {
    return err
}
defer batches.Close()

// The schema retains the governed basis and protection metadata.
fmt.Println(batches.Schema().Metadata())
for batches.Next() {
    batch := batches.RecordBatch()
    fmt.Println(batch.NumRows())
}
if err := batches.Err(); err != nil {
    return err
}
```

Each batch remains valid until the next `Next` or `Close`. To keep a batch
longer, call its `Retain` method and release that reference with `Release` when
finished. Close the reader when stopping early; cancellation stops the active
request without replaying partially delivered data.

`RunArrowStream` exposes a closeable byte reader, and `RunArrowTo` writes to an
`io.Writer`. Comparison, SQL, and ObjectSet services provide equivalent stream
and batch methods. `FileContent().ReadStream` and `ReadTo` consume the same
contextual file ticket as `Read`, support `Range` through `WithHeader`, and
preserve the response headers. Python and TypeScript clients expose their
existing `stream_run_function_arrow` and `streamRunFunctionArrow` iterators.

Select one active Project for an invocation with `--work-scope kind/key`.
`atelier work-scopes list` lists the available choices. The server keeps your
full identity and intersects every governed read with the selected Project.
Plans, files, and durable work retain that context.

```bash theme={null}
atelier work-scopes list --json
atelier --work-scope audit/A-1 objects query Invoice
```