@aikdna/kdna-studio-cli 0.7.0 → 0.8.1

package/README.md

@@ -56,7 +56,7 @@ kdna-studio export my_domain --format v1 --out dist/my_domain.kdna
 Candidate promotion is scope-gated: only candidates with `status == accepted` and `scope_fit == true` are promoted to cards by default. Use `kdna-studio candidate override <project> <candidate-id>` only when a human intentionally overrides the scope gate.
 
 The current Studio CLI export workflow uses approved cards as release evidence.
-This is Studio project policy, not a Core GA format-validity rule. Human
+This is Studio project policy, not a KDNA Core v1 format-validity rule. Human
 Lock and other provenance records are optional review evidence, not validity
 requirements.
 
@@ -75,10 +75,10 @@ loading existing `.kdna` assets.
 ## Runtime Export Contract
 
 `kdna-studio export --format v1` is the canonical runtime export path. It uses
-`@aikdna/kdna-studio-core` to compile the Studio project into a Core GA
+`@aikdna/kdna-studio-core` to compile the Studio project into a KDNA Core v1
 runtime asset and then packs it with `@aikdna/kdna-core`.
 
-A Core GA runtime export contains only these top-level entries:
+A KDNA Core v1 runtime export contains only these top-level entries:
 
 - `mimetype`
 - `kdna.json`

package/bin/kdna-studio.js

@@ -63,7 +63,7 @@ Authoring:
   kdna-studio card approve <project> <card-id|--all> --by <id> --statement <text> [--sign] [--passphrase <pass>]
   kdna-studio card unlock <project> <card-id> --by <id> --statement <text>
   kdna-studio compile <project> --out <dir>
-  kdna-studio export <project> --format v1 --out <file.kdna> [--allow-incomplete]
+  kdna-studio export <project> --format v1 --out <file.kdna> [--allow-incomplete] [--password <pw>|--password-stdin]
 
 AI Authoring (requires LLM config: kdna-studio llm config):
   kdna-studio distill <project> --ai                             # AI-driven candidate extraction from evidence
@@ -1415,6 +1415,7 @@ function exportProjectV1(project, name, outPath, opts = {}) {
       created_at: manifestDefaults.created_at,
       updated_at: manifestDefaults.updated_at,
       access: project.release?.access || project.source_manifest?.access || 'public',
+      password: opts.password || undefined,
     });
     writeFiles(v1Dir, runtimeAsset.files);
     fs.mkdirSync(path.dirname(outPath), { recursive: true });
@@ -1605,7 +1606,24 @@ function cmdExport(args) {
   if (!projectInput || !out) fail('Usage: kdna-studio export <project> --out <file.kdna> [--format v1] [--sign] [--allow-incomplete]');
   if (option(args, '--format') === 'v1') {
     const { project } = readProject(projectInput);
-    exportProjectV1(project, option(args, '--name') || project.name, path.resolve(out), { allowIncomplete: args.includes('--allow-incomplete') });
+    // BUG-11 (2026-06-27): previous logic required --password to be set
+    // before --password-stdin would take effect. That meant callers using
+    // `--password-stdin` alone (the recommended path) got `password = null`
+    // and the export ran unencrypted. Resolve the two flags independently:
+    //   - --password-stdin  → read password from stdin (preferred)
+    //   - --password <pw>   → take password from the flag (insecure)
+    //   - --passphrase <pw> → legacy alias for --password
+    // If both are given, --password-stdin wins (it is the explicit intent).
+    // Use args.includes() for --password-stdin since it is a boolean flag
+    // (option() rejects it for "missing value").
+    const useStdin = args.includes('--password-stdin');
+    const password = useStdin
+      ? fs.readFileSync(0, 'utf8').trim()
+      : option(args, '--password') || option(args, '--passphrase');
+    exportProjectV1(project, option(args, '--name') || project.name, path.resolve(out), {
+      allowIncomplete: args.includes('--allow-incomplete'),
+      password,
+    });
     return;
   }
   const { project, result } = compileProject(projectInput);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-studio-cli",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Official KDNA Studio command-line authoring entry for creating, reviewing, compiling, and exporting .kdna judgment assets through the KDNA toolchain.",
   "type": "commonjs",
   "bin": {
@@ -39,12 +39,12 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@aikdna/kdna-studio-core": "^1.5.11",
+    "@aikdna/kdna-studio-core": "^1.7.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "cbor-x": "^1.6.4"
   },
   "devDependencies": {
-    "@aikdna/kdna-core": "^0.12.5"
+    "@aikdna/kdna-core": "^0.15.0"
   }
 }