@alter-ai/cli 0.1.0 → 0.3.1

package/README.md

@@ -1,208 +1,45 @@
-# `@alter-ai/cli` — the Alter Vault command-line interface
+# `@alter-ai/cli`
 
-`alter` is a command-line client for the Alter Vault dev portal. It authenticates with a Personal Access Token (PAT) minted from the dashboard and exposes the same dashboard operations as scriptable commands.
+Command-line client for the Alter Vault dev portal. Authenticates with a Personal Access Token (PAT) and exposes the dashboard's resource model as scriptable commands.
+
+📖 **Full docs:** [docs.alterauth.com/reference/cli](https://docs.alterauth.com/reference/cli)
 
 ## Install
 
 ```bash
 npm install -g @alter-ai/cli
-# verify
 alter --version
 ```
 
-## Quick start
-
-The fastest interactive sign-in is the browser-dance flow — `alter auth login` opens the dashboard, you click **Authorize**, and the CLI receives the freshly-minted token on a localhost listener:
-
-```bash
-alter auth login
-# alter: opening browser at https://dashboard.alterauth.com/cli-auth
-#        (waiting up to 2 minutes for you to approve)…
-# alter: signed in via browser-dance flow.
-
-alter auth status
-```
-
-For headless / CI environments, mint a PAT manually from the dashboard (**Settings → Personal Access Tokens → New token**) and feed it to the CLI through one of the channels below:
-
-**Token file (recommended for local headless use):** keeps the value out of `process.argv` (visible to other users via `ps`) and out of shell history.
-
-```bash
-umask 077 && echo "alter_pat_xxxxxxxxxxxxxxxxxxxxxxxx_yyyyyy" > ~/alter-pat.txt
-alter auth login --token-file ~/alter-pat.txt
-```
-
-**Stdin:**
-
-```bash
-pbpaste | alter auth login --token-stdin                       # macOS
-xclip -o -selection clipboard | alter auth login --token-stdin  # Linux
-```
-
-**Env var (CI):** skip persistence entirely. The SDK reads `ALTER_PAT` directly; it never lands in argv.
+## Sign in
 
 ```bash
-export ALTER_PAT="alter_pat_xxxxxxxxxxxxxxxxxxxxxxxx_yyyyyy"
-alter apps list
+alter auth login                          # interactive browser flow
+ALTER_PAT=alter_pat_... alter apps list   # headless / CI
 ```
 
-**Inline `--token <pat>` is supported but discouraged** — the value lands in `process.argv` (visible to other local users via `ps aux`) and shell history. Use only on single-user machines and rotate afterwards.
-
 ## Commands
 
-The CLI mirrors the dashboard's resource model. Every namespace lives at `alter <namespace> <verb>`:
-
-```
-auth        login | status | logout                       Sign in / out + token introspection
-apps        list | create | show | update | delete         Manage applications
-keys        list | mint | show | rotate | revoke | rename  Manage runtime API keys
-agents      list | create | show | update | revoke         Managed-agent identities (+ mint-key, list-keys, revoke-key)
-providers   list | list-catalog | create | show | update | delete   OAuth provider integrations per app
-managed-secrets
-            templates | list | show | create | delete | rotate | access | users |
-            grants {list, list-for-agent, create, update, revoke} |
-            groups {list, show}                            Managed-secret credentials, grants, and access (CRUD + autocomplete helpers)
-policy      show-app                                       View app-level policy (org-wide policy is dashboard-only)
-audit       list | show | portal-actions | grant-events | traces   Dev-portal audit log
-pats        whoami                                         Same as `auth status`, under the `pats` namespace
-link        <app-id> | --status                            Pin an app to the current directory tree
-unlink                                                    Clear the workspace pin
-completion  install | print                               Generate shell completions (bash/zsh/fish)
-self-update --to <v> | --dry-run                          Upgrade the CLI via npm
-sdk-passthrough request <method> <path> [...]             Raw authenticated request (escape hatch for routes the CLI doesn't model)
-```
-
-PAT lifecycle (mint, revoke) remains **dashboard-only** in v1 — a PAT cannot mint or revoke another PAT, including its own. Operators use the dashboard for those actions. Org-wide policy and identity-provider configuration are also dashboard-only per the destructive-action policy in CLAUDE.md.
-
-Every list / show command accepts `--output=json|table|jsonl` (default: `json` for pipelines, `table` for interactive). Object commands default to `json`. Use `--fields a,b,c` at the top level to project to specific keys (see [Field selection](#field-selection---fields)).
-
-## Authentication
-
-The CLI resolves credentials in this order (highest precedence first):
-
-1. **`ALTER_PAT` environment variable** — canonical CI / headless source.
-2. **OS keychain** (macOS Keychain, Linux Secret Service / `gnome-keyring`, Windows Credential Manager) via the optional `keytar` native module. This is the default location after a successful `alter auth login`.
-3. **Plaintext file** `~/.config/alter/auth.toml` (XDG-compliant, mode `0600`). Used as the fallback when `keytar` failed to build on the host (e.g. missing `libsecret-1-dev` on Linux). The CLI prints a warning at login time when it falls back to this path.
-
-The `--base-url` flag and the `ALTER_BASE_URL` environment variable both require an `https://` URL — non-HTTPS schemes (`http`, `file`, `gopher`, etc.) are rejected at login time so a misconfigured backend URL cannot exfiltrate the PAT in clear text or to an unintended target.
-
-If keytar isn't loading on your host, install the native build tools and re-install:
-
-```bash
-# macOS
-xcode-select --install
-# Linux (Debian/Ubuntu — adjust for your distro)
-sudo apt install libsecret-1-dev gnome-keyring
-# Windows — install windows-build-tools or VS Build Tools
-
-npm install -g @alter-ai/cli
-```
-
-## Workspace config (`alter link`)
-
-If you work primarily on one app, run `alter link <app-id>` once in the project root. The CLI writes a tiny `.alter/config.yaml` that pins the default app for every subsequent `alter keys`, `alter agents`, `alter providers`, and `alter policy show-app` invocation in that directory tree. No more retyping the UUID.
-
-```bash
-cd ~/code/my-product
-alter link app_abc123
-# alter: pinned app_id=app_abc123 in /Users/me/code/my-product/.alter/config.yaml
-# alter: appended `.alter/` to .gitignore so the pin isn't committed.
-
-# from anywhere in this tree, --app becomes optional:
-alter keys list
-alter agents create --name worker --type service
-alter policy show-app
-
-# show the current pin
-alter link --status
-
-# clear the pin
-alter unlink
 ```
-
-`app_id` precedence (highest first):
-
-1. `--app <id>` on the command line
-2. `ALTER_APP_ID` env var
-3. The nearest `.alter/config.yaml` found by walking up from `process.cwd()`
-4. Error: `no app selected` (exit code 2)
-
-Discovery walks up the directory tree until it finds an `.alter/` directory OR crosses your home directory (whichever comes first). The home-dir bound prevents a misplaced config in `$HOME` from silently pinning every shell.
-
-If your project lives in a git repo, `alter link` appends `.alter/` to `.gitignore` so the workspace pin doesn't get committed — same posture as `vercel link`. The pin is personal-to-the-checkout.
-
-## Field selection (`--fields`)
-
-Narrow the JSON / JSONL output to specific top-level keys with `--fields a,b,c` at the top level — useful for scripts that only need one or two columns. Inert when paired with `--output=table` (the table columns are already a pre-defined slice). Missing fields render as `null` to keep the column visible.
-
-```bash
-# List apps, keep only id + name
-alter apps list --fields id,name
-# [
-#   { "id": "app_abc", "name": "demo" },
-#   ...
-# ]
-
-# Single object — same projection rule
-alter apps show app_abc --fields id,name,environment
-
-# JSONL — one projected object per line
-alter audit list --fields timestamp,action --output=jsonl
+auth              login | status | logout
+apps              list | create | show | update | archive | unarchive | delete
+keys              list | mint | show | rotate | revoke | rename
+agents            list | create | show | update | revoke (+ mint-key, list-keys, revoke-key)
+providers         list | list-catalog | create | show | update | delete
+managed-secrets   list | show | create | rotate | delete | templates | access | users
+                  grants {list, list-for-agent, create, update, revoke}
+                  groups {list, show}
+policy            show-app
+audit             list | show | portal-actions | grant-events | traces
+pats              whoami
+link / unlink     pin an app to the current directory
+completion        install | print
+self-update       --to <v>
+sdk-passthrough   request <grant-id> --url <url>
 ```
 
-The `--fields` value is `,`-separated. Spaces around commas are ignored; spaces INSIDE a field name are rejected up front (catches the common `--fields 'id name'` typo with a clear error rather than silently dropping the second name).
-
-## Exit codes
-
-`alter` returns a structured exit code so scripts can branch on the failure mode without parsing stderr text. Codes are stable contract — operators can rely on them across releases.
-
-| Code | Name             | Meaning                                                                                       |
-|------|------------------|-----------------------------------------------------------------------------------------------|
-| 0    | OK               | Command succeeded.                                                                            |
-| 1    | ERROR            | Generic runtime failure (uncategorized — including unknown SDK / network errors).             |
-| 2    | USAGE            | Bad flag, arg, or input format. Always paired with a stderr line naming the offending input.  |
-| 3    | AUTH             | Not signed in, or PAT revoked / expired. **Remediation:** re-run `alter auth login`.          |
-| 4    | NOT_FOUND        | Resource not found — 404 from the backend, or a referenced local file is missing.             |
-| 5    | CONFLICT         | 409 from the backend — most commonly a type-to-confirm mismatch or dependent-resource block.  |
-| 6    | RATE_LIMIT       | 429 from the backend — retry with backoff.                                                    |
-| 7    | FORBIDDEN        | 403 from the backend — PAT is valid but lacks the required scope. **Remediation:** re-mint the PAT with broader scopes (or switch PATs); `alter auth login` alone does NOT help. |
-| 8    | CANCELLED        | Operator declined an interactive prompt (type-to-confirm mismatch on a destructive action, "no" at a y/N gate). Distinct from `ERROR` (1) — the CLI did nothing wrong, the operator chose not to proceed. Pass `--yes` or `--confirm <name>` in CI to skip the prompt. |
-
-Example:
-
-```bash
-# Probe whether an app exists without erroring on the not-found case.
-# Capture $? into a local variable BEFORE running anything else; ``$?``
-# is clobbered by every command, so a stray ``log_attempt`` between the
-# ``if`` and ``elif`` would silently break the not-found branch.
-alter apps show "$APP_ID" --output=json > /dev/null 2>&1
-status=$?
-if [ "$status" -eq 0 ]; then
-  echo "app exists"
-elif [ "$status" -eq 4 ]; then
-  echo "app not found"
-elif [ "$status" -eq 7 ]; then
-  echo "PAT lacks dashboard_apps:read — re-mint with broader scopes"
-else
-  echo "unexpected error" && exit 1
-fi
-```
-
-Backend-thrown errors flow through `withClient` and get mapped from HTTP status to exit code automatically (401 → 3, 403 → 7, 404 → 4, 409 → 5, 429 → 6, everything else → 1). Validation errors raised by the CLI itself (e.g. malformed `--limit`) exit 2.
-
-## Scope
-
-This CLI ships the full dev-portal command surface — `auth`, `apps`, `keys`, `agents`, `providers`, `managed-secrets`, `policy` (read-only at the app level), `audit`, `pats`, `link` / `unlink`, `completion`, `self-update`, and `sdk-passthrough` as a typed-route escape hatch. Backend routes are PAT-callable via `dashboard_*` scopes (see the [scope catalog](https://docs.alterauth.com/api-reference/scopes) for the full list).
-
-**Managed secrets — destructive verb tier:** `alter managed-secrets delete <secret-id>` cascade-revokes every grant and delegation tied to the secret, removes the stored credential from secret storage, and writes cascade audit log entries — irrecoverable. The route is gated by `dashboard_secrets:delete` (NOT bundled into `:write` or `:admin`) AND requires `?confirm=<slug>` matching the target secret's slug. The CLI prompts interactively when stdin is a TTY; CI must pass `--confirm <slug>` explicitly. Mirrors `alter apps delete`. Soft-delete operations on grants (`grants revoke`) use the recoverable `:write` tier.
-
-**Managed secrets — credential intake:** `create` and `rotate` accept the credential value through three channels, in decreasing safety order: `--credential-value -` reads one line from stdin (preferred for CI piping), `--credential-value @/path/to/file` reads from a file, and `--credential-value <value>` accepts the value inline with a stderr warning about shell-history leakage. Multi-field templates (those whose backend Pydantic model requires more than a single primary credential string) take `--credentials @file.json` (a JSON object of string fields, takes precedence) or repeated `--credential-field key=value` flags.
-
-**Dashboard-only operations** (intentional, not scope gaps):
+All commands accept `--output=json|table|jsonl` and `--fields a,b,c`. See [scripting](https://docs.alterauth.com/reference/cli/scripting) for exit codes and CI patterns, and [authentication](https://docs.alterauth.com/reference/cli/authentication) for token storage details.
 
-- PAT mint / revoke — a PAT cannot manage another PAT, including its own.
-- Org-wide key policy (`/organizations/current/key-policy`) — reading the response body is a security-posture fingerprint, so the route refuses PAT auth on both reads and writes.
-- Identity-provider configuration — affects every grant in the org; never settable by a single scripted call.
-- App-level policy *writes* / *deletes* — only `policy show-app` is exposed by the CLI; mutations remain dashboard-only until a CLI use case emerges.
+## License
 
-When the CLI doesn't model a route you need, drop down to `alter sdk-passthrough request <METHOD> <path>` — it forwards the request with the current PAT and prints the raw JSON.
+MIT

package/dist/cli.js

@@ -1,8 +1,5 @@
 #!/usr/bin/env node
 
-// src/cli.ts
-import { Command as Command14 } from "commander";
-
 // src/exit-codes.ts
 var EXIT_ERROR = 1;
 var EXIT_USAGE = 2;
@@ -176,7 +173,7 @@ async function maybePrintUpdateBanner(currentVersion, argv2 = process.argv.slice
 // package.json
 var package_default = {
   name: "@alter-ai/cli",
-  version: "0.1.0",
+  version: "0.3.1",
   description: "Command-line interface for the Alter Vault dev portal \u2014 scripted dashboard automation.",
   type: "module",
   bin: {
@@ -192,7 +189,9 @@ var package_default = {
     dev: "tsx src/cli.ts",
     test: "vitest run",
     "test:watch": "vitest",
-    typecheck: "tsc --noEmit",
+    "docs:check": "tsx scripts/check-docs-drift.ts",
+    "docs:print": "tsx scripts/check-docs-drift.ts --print",
+    typecheck: "tsc --noEmit && tsc -p tsconfig.scripts.json",
     lint: "eslint src/ tests/ --ext .ts",
     format: "prettier --write 'src/**/*.ts' 'tests/**/*.ts'"
   },
@@ -224,6 +223,9 @@ var package_default = {
   }
 };
 
+// src/program.ts
+import { Command as Command14 } from "commander";
+
 // src/commands/agents.ts
 import { Command } from "commander";
 
@@ -440,10 +442,23 @@ var GrantRevokedError = class extends ReAuthRequiredError {
 };
 var CredentialRevokedError = class extends ReAuthRequiredError {
   grantId;
-  constructor(message, grantId, details) {
+  // Recovery-context fields. Populated by the backend at the raise
+  // site in token_service so callers can mint a Connect session for
+  // the same (user, provider) without re-fetching the grant. See
+  // docs/planning/CONNECT_RECOVERY_CONTEXT.md.
+  providerId;
+  appUserId;
+  // Recovery context is appended AFTER `details` so the existing
+  // positional contract `new CredentialRevokedError("msg", "g-1",
+  // detailsObj)` keeps compiling AND keeps assigning detailsObj to
+  // the `details` slot — only the wire-parsing site uses the new
+  // positional slots.
+  constructor(message, grantId, details, providerId, appUserId) {
     super(message, details);
     this.name = "CredentialRevokedError";
     this.grantId = grantId;
+    this.providerId = providerId;
+    this.appUserId = appUserId;
   }
 };
 var GrantDeletedError = class extends ReAuthRequiredError {
@@ -453,9 +468,19 @@ var GrantDeletedError = class extends ReAuthRequiredError {
   }
 };
 var GrantNotFoundError = class extends BackendError {
-  constructor(message, details) {
+  providerId;
+  agentId;
+  appUserId;
+  // Recovery context is appended AFTER `details` so the existing
+  // positional contract `new GrantNotFoundError("msg", detailsObj)`
+  // keeps compiling AND keeps assigning detailsObj to the `details`
+  // slot — only the wire-parsing site uses the new positional slots.
+  constructor(message, details, providerId, agentId, appUserId) {
     super(message, details);
     this.name = "GrantNotFoundError";
+    this.providerId = providerId;
+    this.agentId = agentId;
+    this.appUserId = appUserId;
   }
 };
 var AmbiguousGrantError = class extends BackendError {
@@ -468,23 +493,43 @@ var AmbiguousGrantError = class extends BackendError {
   // UUIDs only (no emails / names) — same backend hygiene rule that
   // applies to the rest of the cross-tenant probe surface.
   appUserIds;
-  constructor(message, providerId, accountIdentifiers, accountWasProvided, appUserIds, details) {
+  // Populated for the managed-secret grant-level flavor: one user
+  // delegated multiple managed-secret grants sharing the same
+  // template to the same agent. The SDK caller picks one via
+  // `grantId=` on the next request. UUIDs only.
+  grantIds;
+  constructor(message, providerId, accountIdentifiers, accountWasProvided, appUserIds, details, grantIds) {
     super(message, details);
     this.name = "AmbiguousGrantError";
     this.providerId = providerId;
     this.accountIdentifiers = accountIdentifiers ?? [];
     this.accountWasProvided = accountWasProvided ?? false;
     this.appUserIds = appUserIds ?? [];
+    this.grantIds = grantIds ?? [];
   }
 };
 var NoDelegatedGrantError = class extends BackendError {
+  // `providerId` + `agentId` shipped in the pre-recovery PR, so they
+  // KEEP their positional slots. `appUserId` is new in this PR and
+  // appended AFTER `details` so the existing 4-arg call shape
+  // `new NoDelegatedGrantError(msg, providerId, agentId, details)`
+  // continues to work — only the wire-parsing site uses the new
+  // appUserId slot.
   providerId;
   agentId;
-  constructor(message, providerId, agentId, details) {
+  // Populated when the resolution applied a user filter. Diagnostic /
+  // correlation field only — the recovery helper does NOT auto-bind
+  // the session to the user. Pass `userToken=` to
+  // `createConnectSessionForError` (or configure `userTokenGetter` on
+  // the client) when user binding is required. See
+  // docs/planning/CONNECT_RECOVERY_CONTEXT.md.
+  appUserId;
+  constructor(message, providerId, agentId, details, appUserId) {
     super(message, details);
     this.name = "NoDelegatedGrantError";
     this.providerId = providerId;
     this.agentId = agentId;
+    this.appUserId = appUserId;
   }
 };
 var PolicyViolationError = class extends BackendError {
@@ -2895,7 +2940,7 @@ function _extractAdditionalCredentials(token) {
   return _additionalCredsStore.get(token);
 }
 var _fetch;
-var SDK_VERSION = "0.14.0";
+var SDK_VERSION = "0.15.0";
 var SDK_USER_AGENT = `alter-sdk-node/${SDK_VERSION}`;
 var HTTP_FORBIDDEN = 403;
 var HTTP_NO_CONTENT2 = 204;
@@ -3506,7 +3551,10 @@ ${effectiveConstraints}`;
       if (errorCode === "credential_revoked") {
         throw new CredentialRevokedError(
           errorData.message ?? "Credential has been revoked. User must re-authorize.",
-          errorData.grant_id
+          errorData.grant_id,
+          errorData,
+          typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
+          typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
         );
       }
       if (errorData.error === "scope_mismatch") {
@@ -3546,13 +3594,17 @@ ${effectiveConstraints}`;
         const appUserIds = Array.isArray(errorData.app_user_ids) ? errorData.app_user_ids.filter(
           (v) => typeof v === "string"
         ) : [];
+        const grantIds = Array.isArray(errorData.grant_ids) ? errorData.grant_ids.filter(
+          (v) => typeof v === "string"
+        ) : [];
         throw new AmbiguousGrantError(
           errorData.message ?? "JWT identity resolved to multiple grants. Pass the 'account' parameter to disambiguate.",
           typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
           accountIdentifiers,
           errorData.account_was_provided === true,
           appUserIds,
-          errorData
+          errorData,
+          grantIds
         );
       }
       if (errorData.error === "no_delegated_grant") {
@@ -3560,7 +3612,8 @@ ${effectiveConstraints}`;
           errorData.message ?? "Agent has no active delegation or managed-secret grant for this provider.",
           typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
           typeof errorData.agent_id === "string" ? errorData.agent_id : void 0,
-          errorData
+          errorData,
+          typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
         );
       }
       throw new BackendError(
@@ -3577,9 +3630,21 @@ ${effectiveConstraints}`;
     }
     if (response.status === HTTP_NOT_FOUND) {
       const errorData = await __VaultClient.#safeParseJson(response);
+      if (errorData.error === "no_delegated_grant") {
+        throw new NoDelegatedGrantError(
+          errorData.message ?? "Agent has no active delegation or managed-secret grant for this provider.",
+          typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
+          typeof errorData.agent_id === "string" ? errorData.agent_id : void 0,
+          errorData,
+          typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
+        );
+      }
       throw new GrantNotFoundError(
         errorData.message ?? "OAuth grant not found for the given grant_id",
-        errorData
+        errorData,
+        typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
+        typeof errorData.agent_id === "string" ? errorData.agent_id : void 0,
+        typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
       );
     }
     if (response.status === HTTP_BAD_REQUEST || response.status === HTTP_BAD_GATEWAY) {
@@ -3595,7 +3660,9 @@ ${effectiveConstraints}`;
         throw new CredentialRevokedError(
           errorData.message ?? "Underlying credential has been revoked. User must re-authorize.",
           errorData.grant_id,
-          errorData
+          errorData,
+          typeof errorData.provider_id === "string" ? errorData.provider_id : void 0,
+          typeof errorData.app_user_id === "string" ? errorData.app_user_id : void 0
         );
       }
       throw new BackendError(
@@ -4787,7 +4854,14 @@ ${effectiveConstraints}`;
       }
       sessionBody.agent = options.agent;
     }
-    if (this.#userTokenGetter) {
+    if (options.userToken !== void 0) {
+      if (typeof options.userToken !== "string" || options.userToken.length === 0) {
+        throw new AlterValueError(
+          "userToken must be a non-empty string when provided"
+        );
+      }
+      sessionBody.user_token = options.userToken;
+    } else if (this.#userTokenGetter) {
       sessionBody.user_token = await this.#getUserToken();
     }
     const sessionPath = "/sdk/oauth/connect/session";
@@ -4951,10 +5025,43 @@ ${effectiveConstraints}`;
     } else {
       console.log(`Open this URL to authorize: ${session.connectUrl}`);
     }
+    return await this.pollConnectSession(session.sessionToken, {
+      timeoutMs,
+      pollIntervalMs
+    });
+  }
+  /**
+   * Poll a Connect session to completion.
+   *
+   * Use this when your code minted the Connect session itself (e.g.,
+   * via {@link createConnectSession} for a custom UI flow, or via
+   * {@link createConnectSessionForError} for a recovery flow) and
+   * you need to block until the user finishes the consent screen.
+   * {@link connect} is the all-in-one convenience that mints + opens
+   * the browser + polls; this method is the polling half on its own.
+   *
+   * @param sessionToken - A session token from
+   *     {@link createConnectSession} or
+   *     {@link createConnectSessionForError}.
+   * @param options - `timeoutMs` (default 300000 = 5 min) and
+   *     `pollIntervalMs` (default 2000). Milliseconds per ecosystem
+   *     convention; the Python SDK's equivalent uses seconds.
+   * @returns One `ConnectResult` per provider the user completed
+   *     within the session (multi-provider Connect sessions yield
+   *     multiple results).
+   * @throws ConnectTimeoutError if the session didn't complete within
+   *     `timeoutMs`.
+   * @throws ConnectFlowError / ConnectDeniedError / ConnectConfigError
+   *     for user denial, session expiry, or unrecognized status.
+   * @throws AlterSDKError if the SDK instance has been closed.
+   */
+  async pollConnectSession(sessionToken, options) {
+    this.#assertNotClosed();
+    const timeoutMs = options?.timeoutMs ?? 3e5;
+    const pollIntervalMs = options?.pollIntervalMs ?? 2e3;
     const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      await new Promise((resolve2) => setTimeout(resolve2, pollIntervalMs));
-      const pollResult = await this.#pollSession(session.sessionToken);
+    while (true) {
+      const pollResult = await this.#pollSession(sessionToken);
       const pollStatus = pollResult.status;
       if (pollStatus === "completed") {
         const grantsData = pollResult.grants ?? [];
@@ -4997,12 +5104,95 @@ ${effectiveConstraints}`;
           { status: pollStatus }
         );
       }
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) break;
+      const sleepMs = Math.min(pollIntervalMs, remaining);
+      await new Promise((resolve2) => setTimeout(resolve2, sleepMs));
     }
     throw new ConnectTimeoutError(
       `OAuth flow did not complete within ${Math.round(timeoutMs / 1e3)} seconds. The user may not have finished authorizing in the browser.`,
       { timeoutMs }
     );
   }
+  /**
+   * Mint a recovery Connect session from a typed error.
+   *
+   * Use this in the catch block of an identity-mode or agent-mode
+   * request that failed because the user hasn't authorized the
+   * provider yet ({@link NoDelegatedGrantError}), or because the
+   * underlying credential is permanently broken
+   * ({@link CredentialRevokedError}), or because the resolved grant
+   * doesn't exist ({@link GrantNotFoundError} with identity-mode
+   * context).
+   *
+   * What the method reuses from the error:
+   * - `providerId` → threaded into `allowedProviders=[...]`. Required;
+   *   missing context throws `AlterValueError`.
+   * - `agentId` → threaded into `agent=` so the recovery session
+   *   re-binds the same delegation target. Required for
+   *   `NoDelegatedGrantError` recovery; absent on
+   *   `GrantNotFoundError` / `CredentialRevokedError` for user-direct
+   *   grants, in which case the call falls through to non-delegated
+   *   recovery.
+   *
+   * What the method does NOT reuse from the error:
+   * - `appUserId` is exposed on the typed error for caller use
+   *   (logging, audit correlation, deciding which user to re-prompt)
+   *   but is NOT threaded into the recovery session.
+   *   `createConnectSession` binds the session via `userToken` (JWT),
+   *   not `appUserId`. To bind the session, pass `userToken=`
+   *   explicitly or configure `userTokenGetter` on the SDK client.
+   *
+   * @example
+   * ```ts
+   * try {
+   *   await vault.request(HttpMethod.GET, "https://...", { provider: "<provider-id>" });
+   * } catch (e) {
+   *   if (e instanceof NoDelegatedGrantError) {
+   *     const session = await vault.createConnectSessionForError(e, {
+   *       allowedOrigin: "https://app.example.com",
+   *     });
+   *     redirectUser(session.connectUrl);
+   *     const results = await vault.pollConnectSession(session.sessionToken);
+   *     // Retry with results[0].grantId
+   *   }
+   * }
+   * ```
+   *
+   * @param error - The typed exception. Must carry `providerId`; if
+   *     `undefined` (direct-mode 404 from a stale grant_id), recovery
+   *     isn't derivable and this method throws `AlterValueError`
+   *     rather than guessing.
+   * @param options - Standard `createConnectSession` options. Supplied
+   *     per call so the recovery session matches the deployment
+   *     shape (popup, mobile redirect, headless). The convenience
+   *     method doesn't infer these from the error.
+   * @throws AlterValueError if `error.providerId` is `undefined`.
+   */
+  async createConnectSessionForError(error, options) {
+    const providerId = error.providerId;
+    if (providerId === void 0) {
+      throw new AlterValueError(
+        "Cannot mint a recovery Connect session: the typed error has no providerId context. This usually means the original call used direct grantId mode and the grantId was stale \u2014 there's no (user, provider) tuple to recover. Catch GrantNotFoundError separately and call createConnectSession() directly with the providers the user should re-authorize."
+      );
+    }
+    const agentId = error.agentId;
+    if (error instanceof NoDelegatedGrantError && agentId === void 0) {
+      throw new AlterValueError(
+        "Cannot mint a delegated recovery Connect session: the typed NoDelegatedGrantError has no agentId context. The backend may be on a version predating the recovery-context fields, or the wire payload was malformed. Upgrade the backend, or catch this and call createConnectSession() explicitly with the right agent=."
+      );
+    }
+    return await this.createConnectSession({
+      allowedProviders: [providerId],
+      allowedOrigin: options?.allowedOrigin,
+      returnUrl: options?.returnUrl,
+      metadata: options?.metadata,
+      grantPolicy: options?.grantPolicy,
+      requiredScopes: options?.requiredScopes,
+      agent: agentId,
+      userToken: options?.userToken
+    });
+  }
   /**
    * Trigger IDP login for end user via browser.
    *
@@ -6539,8 +6729,13 @@ var _keytarCache;
 async function loadKeytar() {
   if (_keytarCache !== void 0) return _keytarCache;
   try {
-    const mod = await import("keytar");
-    _keytarCache = mod;
+    const raw = await import("keytar");
+    const candidate = raw.default ?? raw;
+    if (typeof candidate.getPassword === "function" && typeof candidate.setPassword === "function" && typeof candidate.deletePassword === "function") {
+      _keytarCache = candidate;
+    } else {
+      _keytarCache = null;
+    }
   } catch {
     _keytarCache = null;
   }
@@ -6548,7 +6743,7 @@ async function loadKeytar() {
 }
 function printPlaintextFallbackWarning() {
   process.stderr.write(
-    "alter: WARNING \u2014 saving the PAT to a plaintext file (~/.config/alter/auth.toml).\n       The OS keychain (keytar) is not available on this host. Install the\n       native build tools and re-run `npm install -g @alter-ai/cli` to enable\n       secure storage:\n         macOS:   xcode-select --install\n         Linux:   sudo apt install libsecret-1-dev gnome-keyring  (or distro equivalent)\n         Windows: install windows-build-tools or VS Build Tools\n"
+    "alter: WARNING \u2014 saving the PAT to a plaintext file (~/.config/alter/auth.toml, mode 0600).\n       The OS keychain (keytar) is not usable on this host. Common causes:\n         - keytar's native module failed to install (Linux: install libsecret-1-dev +\n           gnome-keyring; Windows: install VS Build Tools; macOS: usually pre-installed).\n         - The native module is present but its API surface doesn't match what the CLI\n           expects (file a bug against @alter-ai/cli with your node + npm versions).\n       If the cleartext fallback is unacceptable on this host, revoke the PAT from the\n       dashboard's `Personal Access Tokens` page after use.\n"
   );
 }
 async function loadStoredAuth2() {
@@ -6642,11 +6837,11 @@ async function clearStoredAuth2() {
 
 // src/portal-client.ts
 import { platform, release } from "os";
-var DEFAULT_BASE_URL = "https://api.alterauth.com";
+var DEFAULT_BASE_URL = "https://backend.alterauth.com";
 var PAT_API_PREFIX = "/api/v1/dev-portal";
 var HTTP_ERROR_THRESHOLD = 400;
 var DEFAULT_TIMEOUT_MS = 3e4;
-var CLI_VERSION = "0.1.0";
+var CLI_VERSION = "0.3.1";
 var USER_AGENT = buildUserAgent();
 function buildUserAgent() {
   let osTag = "";
@@ -7577,6 +7772,31 @@ var ManagedSecretsNamespace = class {
     );
     return expectDict(body, "managed_secrets.rotate", 200);
   }
+  /**
+   * Set the per-secret user → agent delegation policy. Requires
+   * ``dashboard_secrets:write``. Controls whether a group-typed grant on
+   * this secret may be delegated to an agent (``allow_group_source``) and
+   * the per-delegation TTL ceiling (``max_delegation_ttl_days``).
+   *
+   * REPLACE semantics — the backend overwrites the whole policy object,
+   * so the command always sends the full intended state (omitting
+   * ``max_delegation_ttl_days`` lets the backend apply its 90-day default).
+   */
+  async setDelegationPolicy(appId, secretId, options) {
+    const app = encodePathParam(appId, "appId");
+    const secret = encodePathParam(secretId, "secretId");
+    const payload = filterUndefined({
+      allow_group_source: options.allow_group_source,
+      max_delegation_ttl_days: options.max_delegation_ttl_days
+    });
+    const body = await this.#client._call(
+      "PUT",
+      `/apps/${app}/managed-secrets/${secret}/delegation-policy`,
+      "managed_secrets.set_delegation_policy",
+      { jsonBody: payload }
+    );
+    return expectDict(body, "managed_secrets.set_delegation_policy", 200);
+  }
   /**
    * List grants on a managed secret. Requires ``dashboard_secrets:read``.
    *
@@ -9383,7 +9603,7 @@ var DEFAULT_SCOPES = [
   "dashboard_secrets:write"
 ];
 function deriveDashboardUrl(baseUrl) {
-  return baseUrl.replace(/^https:\/\/api\./, "https://dashboard.");
+  return baseUrl.replace(/^https:\/\/backend\./, "https://portal.");
 }
 function defaultOpenBrowser(url) {
   let command;
@@ -9500,7 +9720,7 @@ async function runBrowserDance(options) {
         server.close();
         reject(
           new Error(
-            "browser-dance callback came from an unexpected origin \u2014 refusing to accept. Re-run ``alter auth login`` and verify the dashboard URL."
+            `browser-dance callback came from an unexpected origin \u2014 refusing to accept. Expected origin ${JSON.stringify(dashboardOrigin)}; received Origin: ${JSON.stringify(origin || "(none)")}, Referer: ${JSON.stringify(referer || "(none)")}. If your dashboard isn't at the regex-derived host, re-run with --dashboard-url <https-url> pointing at the actual dashboard origin.`
           )
         );
         return;
@@ -9634,8 +9854,21 @@ async function runBrowserDance(options) {
     pat,
     ...options.baseUrl ? { baseUrl: options.baseUrl } : {}
   });
+  const smokeTest = options.smokeTest ?? defaultSmokeTest;
+  await smokeTest(pat, options.baseUrl);
   process.stdout.write("alter: signed in via browser-dance flow.\n");
 }
+async function defaultSmokeTest(pat, baseUrl) {
+  const client = new DashboardClient({
+    pat,
+    ...baseUrl ? { baseUrl } : {}
+  });
+  try {
+    await client.pats.whoami();
+  } finally {
+    await client.close();
+  }
+}
 
 // src/scope-catalog.ts
 var DASHBOARD_RESOURCE_VERBS = {
@@ -9849,7 +10082,7 @@ async function loginCommand(options) {
     let resolvedBaseUrl2;
     try {
       const envBaseUrl = process.env.ALTER_BASE_URL?.trim() || null;
-      resolvedBaseUrl2 = options.baseUrl ? validateBaseUrl(options.baseUrl) : envBaseUrl ? validateBaseUrl(envBaseUrl) : "https://api.alterauth.com";
+      resolvedBaseUrl2 = options.baseUrl ? validateBaseUrl(options.baseUrl) : envBaseUrl ? validateBaseUrl(envBaseUrl) : "https://backend.alterauth.com";
     } catch (e) {
       err(e instanceof Error ? e.message : String(e));
       process.exit(EXIT_USAGE);
@@ -9875,10 +10108,8 @@ async function loginCommand(options) {
         process.exit(EXIT_USAGE);
       }
     }
-    let bindOverride = null;
-    if (options.bindIp === false) {
-      bindOverride = { bind: "none" };
-    } else if (typeof options.bindIp === "string") {
+    let bindOverride = { bind: "none" };
+    if (typeof options.bindIp === "string") {
       let normalisedCidr;
       try {
         normalisedCidr = validateBindIpFlag(options.bindIp);
@@ -9897,6 +10128,19 @@ async function loginCommand(options) {
       });
       return;
     } catch (e) {
+      if (e instanceof PortalBackendError) {
+        const isAuthTier = e.statusCode === 401 || e.statusCode === 403;
+        if (isAuthTier) {
+          err(`PAT was minted but cannot authenticate: ${e.message}`);
+        } else {
+          err(`PAT was minted but the backend rejected the smoke test: ${e.message}`);
+        }
+        process.exit(exitCodeForHttpStatus(e.statusCode));
+      }
+      if (e instanceof NetworkError) {
+        err(`PAT was minted but the backend is unreachable: ${e.message}. Check connectivity and retry.`);
+        process.exit(EXIT_ERROR);
+      }
       err(e instanceof Error ? e.message : String(e));
       process.exit(EXIT_ERROR);
     }
@@ -10061,16 +10305,16 @@ function buildAuthCommand() {
     "Override the backend URL (must be https://). Defaults to ALTER_BASE_URL or production."
   ).option(
     "--dashboard-url <url>",
-    "Override the dashboard URL used by the browser-dance flow. Defaults to the backend URL with the leftmost `api.` subdomain swapped for `dashboard.`. Use this when the dashboard isn't at the regex-derivable host (e.g. staging / self-hosted setups). Must use https://."
+    "Override the dashboard URL used by the browser-dance flow. Defaults to the backend URL with the leftmost `backend.` subdomain swapped for `portal.`. Use this when the dashboard isn't at the regex-derivable host (e.g. staging / self-hosted setups). Must use https://."
   ).option(
     "--scopes <list>",
     "Comma-separated scope list to request on the browser-dance consent page (e.g. 'dashboard_apps:read,dashboard_keys:write'). Defaults to the full read+write set across the CLI surface \u2014 enough for every non-destructive day-to-day command. Opt in to admin / delete tiers explicitly: 'dashboard_keys:admin' for runtime-key admin ops, 'dashboard_apps:delete' for cascade-delete an app (note: dashboard_apps does NOT support :admin \u2014 the Destructive-Action Policy separates :delete as its own verb). Each entry is validated client-side against the dashboard scope catalog \u2014 typos fail fast. Mutually exclusive with --token / --token-file / --token-stdin \u2014 pre-minted PATs have their scope set baked at mint time on the dashboard's Settings page; combining the flags is a usage error."
   ).option(
     "--no-bind-ip",
-    "Mint the PAT WITHOUT an IP allowlist. The resulting token works from any source IP \u2014 useful when the dashboard sits behind a CDN whose edge IPs aren't yet trusted by the backend (in that case the default 'bind to caller IP' resolves to the CDN edge instead of the operator's real IP, leaving the PAT unusable from the CLI). Browser-dance flow only."
+    "Explicit opt-out of IP binding. This is now the DEFAULT for the browser-dance flow, so the flag is a no-op alias retained for scripts that pass it explicitly. The resulting PAT works from any source IP. Browser-dance flow only."
   ).option(
     "--bind-ip <cidr>",
-    "Mint the PAT bound to the operator-supplied IP / CIDR (e.g. '203.0.113.5' for a single host, '203.0.113.0/24' for a range, or an IPv6 equivalent). The backend's automatic caller-IP bind is bypassed; the supplied range becomes the entire allowlist. Use this when the operator's egress IP is known but the dashboard sits behind a CDN whose trusted-proxy list isn't yet populated on the backend. If both --bind-ip and --no-bind-ip appear, the one that appears LAST on the command line takes effect (Commander last-wins). Browser-dance flow only."
+    "Mint the PAT bound to the operator-supplied IP / CIDR (e.g. '203.0.113.5' for a single host, '203.0.113.0/24' for a range, or an IPv6 equivalent). The supplied range becomes the entire allowlist on the minted PAT. Use this when the egress IP is known and stable \u2014 e.g. minting a token for a CI runner whose outbound CIDR you control. Interactive developer-laptop logins should leave this unset (default is now unbound; see --no-bind-ip). If both --bind-ip and --no-bind-ip appear, the one that appears LAST on the command line takes effect (Commander last-wins). Browser-dance flow only."
   ).action(async (options) => {
     await loginCommand(options);
   });
@@ -10469,7 +10713,7 @@ function buildKeysCommand() {
     }
   );
   keys.command("rotate").description(
-    "Rotate a key (new plaintext returned ONCE; old key enters grace until revoke). Requires dashboard_keys:admin scope."
+    "Rotate a key (new plaintext returned ONCE; old key enters grace until revoke). Requires dashboard_keys:write scope."
   ).option("--app <app-id>", "App ID. Falls back to ALTER_APP_ID env or .alter/config.yaml").requiredOption("--key <key-id>", "Key ID", parseUuidArgument("--key")).option(
     "--scopes <list>",
     "Optional new scope set (defaults to the key's current scopes)"
@@ -11478,7 +11722,14 @@ function buildManagedSecretsCommand() {
   ).option(
     "--injection-rule <@file.json>",
     "Path-prefixed JSON file containing the additional_injections array"
-  ).option("--label <label>", "Base-grant display label").option("--account-identifier <id>", "Optional account identifier metadata").option("--account-display-name <name>", "Optional account display name metadata").option("--output <format>", "Output format: json|table (default: json)", "json").action(
+  ).option("--label <label>", "Base-grant display label").option("--account-identifier <id>", "Optional account identifier metadata").option("--account-display-name <name>", "Optional account display name metadata").option(
+    "--allow-group-delegation",
+    "Allow members of a group-typed grant on this secret to delegate it to an agent (default: off)"
+  ).option(
+    "--max-delegation-ttl-days <days>",
+    "Cap on a single delegation's lifetime, in days (1..1825, default 90)",
+    parseBoundedInt("--max-delegation-ttl-days", 1, 5 * 365)
+  ).option("--output <format>", "Output format: json|table (default: json)", "json").action(
     async (options) => {
       const format = coerceOutputFormat(options.output);
       const appId = resolveAppIdOrExit(options.app);
@@ -11501,7 +11752,9 @@ function buildManagedSecretsCommand() {
           "injectionRule",
           "label",
           "accountIdentifier",
-          "accountDisplayName"
+          "accountDisplayName",
+          "allowGroupDelegation",
+          "maxDelegationTtlDays"
         ].filter((k) => {
           if (k === "credentialType") return options.credentialType !== "bearer_token";
           return options[k] !== void 0;
@@ -11587,6 +11840,16 @@ function buildManagedSecretsCommand() {
       if (options.accountDisplayName !== void 0) {
         body.account_display_name = options.accountDisplayName;
       }
+      if (options.allowGroupDelegation !== void 0 || options.maxDelegationTtlDays !== void 0) {
+        const delegationPolicy = {};
+        if (options.allowGroupDelegation !== void 0) {
+          delegationPolicy.allow_group_source = options.allowGroupDelegation;
+        }
+        if (options.maxDelegationTtlDays !== void 0) {
+          delegationPolicy.max_delegation_ttl_days = options.maxDelegationTtlDays;
+        }
+        body.delegation_policy = delegationPolicy;
+      }
       await withClient(async (client) => {
         const row = await client.managedSecrets.create(
           resolveAppIdOrExit(options.app),
@@ -11596,6 +11859,29 @@ function buildManagedSecretsCommand() {
       });
     }
   );
+  root.command("set-delegation-policy <secret-id>").description(
+    "Set the user \u2192 agent delegation policy on a managed secret. REPLACES the current policy (omitting --allow-group-delegation turns group delegation OFF). Requires dashboard_secrets:write."
+  ).option("--app <app-id>", "App ID. Falls back to ALTER_APP_ID env or .alter/config.yaml").option(
+    "--allow-group-delegation",
+    "Allow members of a group-typed grant on this secret to delegate it to an agent (default: off)"
+  ).option(
+    "--max-delegation-ttl-days <days>",
+    "Cap on a single delegation's lifetime, in days (1..1825; omit for the 90-day default)",
+    parseBoundedInt("--max-delegation-ttl-days", 1, 5 * 365)
+  ).option("--output <format>", "Output format: json|table (default: json)", "json").action(
+    async (rawSecretId, options) => {
+      const format = coerceOutputFormat(options.output);
+      const appId = resolveAppIdOrExit(options.app);
+      const secretId = parseUuidArgument("<secret-id>")(rawSecretId);
+      await withClient(async (client) => {
+        const row = await client.managedSecrets.setDelegationPolicy(appId, secretId, {
+          allow_group_source: options.allowGroupDelegation === true,
+          max_delegation_ttl_days: options.maxDelegationTtlDays
+        });
+        emit(format, row);
+      });
+    }
+  );
   root.command("delete <secret-id>").description(
     "Cascade-delete a managed secret. Requires dashboard_secrets:delete scope (NOT bundled into :write). Cascade-revokes grants + delegations + audit anchors and vault-deletes the credential."
   ).option("--app <app-id>", "App ID").option(
@@ -12348,6 +12634,46 @@ function buildSelfUpdateCommand() {
   });
 }
 
+// src/program.ts
+function buildProgram() {
+  const program2 = new Command14();
+  program2.name("alter").description("Alter Vault command-line interface").version(package_default.version);
+  program2.option(
+    "--fields <list>",
+    "Comma-separated top-level keys to keep in JSON output (e.g. ``--fields id,name``). Inert with --output=table."
+  );
+  program2.hook("preAction", (thisCommand) => {
+    setGlobalFields(void 0);
+    const raw = thisCommand.opts().fields;
+    if (raw !== void 0) {
+      try {
+        setGlobalFields(parseFieldsList(raw));
+      } catch (e) {
+        process.stderr.write(
+          `alter: ${e instanceof Error ? e.message : String(e)}
+`
+        );
+        process.exit(EXIT_USAGE);
+      }
+    }
+  });
+  program2.addCommand(buildAuthCommand());
+  program2.addCommand(buildAppsCommand());
+  program2.addCommand(buildKeysCommand());
+  program2.addCommand(buildAgentsCommand());
+  program2.addCommand(buildProvidersCommand());
+  program2.addCommand(buildManagedSecretsCommand());
+  program2.addCommand(buildPolicyCommand());
+  program2.addCommand(buildAuditCommand());
+  program2.addCommand(buildPatsCommand());
+  program2.addCommand(buildLinkCommand());
+  program2.addCommand(buildUnlinkCommand());
+  program2.addCommand(buildCompletionCommand());
+  program2.addCommand(buildSdkPassthroughCommand());
+  program2.addCommand(buildSelfUpdateCommand());
+  return program2;
+}
+
 // src/cli.ts
 var COMMANDER_USAGE_CODES = /* @__PURE__ */ new Set([
   "commander.missingArgument",
@@ -12411,41 +12737,7 @@ function rewriteLegacySelfUpdateVersionFlag(argv2) {
   }
   return rewritten;
 }
-var program = new Command14();
-program.name("alter").description("Alter Vault command-line interface").version(package_default.version);
-program.option(
-  "--fields <list>",
-  "Comma-separated top-level keys to keep in JSON output (e.g. ``--fields id,name``). Inert with --output=table."
-);
-program.hook("preAction", (thisCommand) => {
-  setGlobalFields(void 0);
-  const raw = thisCommand.opts().fields;
-  if (raw !== void 0) {
-    try {
-      setGlobalFields(parseFieldsList(raw));
-    } catch (e) {
-      process.stderr.write(
-        `alter: ${e instanceof Error ? e.message : String(e)}
-`
-      );
-      process.exit(EXIT_USAGE);
-    }
-  }
-});
-program.addCommand(buildAuthCommand());
-program.addCommand(buildAppsCommand());
-program.addCommand(buildKeysCommand());
-program.addCommand(buildAgentsCommand());
-program.addCommand(buildProvidersCommand());
-program.addCommand(buildManagedSecretsCommand());
-program.addCommand(buildPolicyCommand());
-program.addCommand(buildAuditCommand());
-program.addCommand(buildPatsCommand());
-program.addCommand(buildLinkCommand());
-program.addCommand(buildUnlinkCommand());
-program.addCommand(buildCompletionCommand());
-program.addCommand(buildSdkPassthroughCommand());
-program.addCommand(buildSelfUpdateCommand());
+var program = buildProgram();
 applyExitOverride(program);
 var argv = rewriteLegacySelfUpdateVersionFlag(process.argv);
 async function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alter-ai/cli",
-  "version": "0.1.0",
+  "version": "0.3.1",
   "description": "Command-line interface for the Alter Vault dev portal — scripted dashboard automation.",
   "type": "module",
   "bin": {
@@ -16,7 +16,9 @@
     "dev": "tsx src/cli.ts",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
+    "docs:check": "tsx scripts/check-docs-drift.ts",
+    "docs:print": "tsx scripts/check-docs-drift.ts --print",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.scripts.json",
     "lint": "eslint src/ tests/ --ext .ts",
     "format": "prettier --write 'src/**/*.ts' 'tests/**/*.ts'"
   },