@cleocode/cleo 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/cli/chunk-PSJ33WVO.js

@@ -0,0 +1,56 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+
+// packages/cleo/src/cli/commands/doctor-malformed-ids.ts
+import { scanMalformedTaskIds } from "@cleocode/core/doctor/malformed-task-ids.js";
+import { getProjectRoot } from "@cleocode/core/project-scope";
+var doctorMalformedIdsCommand = defineCommand({
+  meta: {
+    name: "malformed-ids",
+    description: "Report task rows whose id is not a valid task identifier \u2014 rows that `cleo list` returns but `show`/`update`/`delete` cannot address. Read-only unless --fix is given; --fix refuses any row other tables still reference, and reports them instead."
+  },
+  args: {
+    fix: {
+      type: "boolean",
+      description: "Delete unaddressable rows in one transaction. Refuses any row still referenced by another table \u2014 deleting those would manufacture the orphans `doctor fk-check` detects."
+    },
+    json: { type: "boolean", description: "Output as JSON" },
+    human: { type: "boolean", description: "Force human-readable output" },
+    quiet: { type: "boolean", description: "Suppress non-essential output" }
+  },
+  async run({ args }) {
+    const report = await scanMalformedTaskIds(getProjectRoot(), { fix: args.fix === true });
+    cliOutput(report, {
+      command: "doctor",
+      operation: "doctor.malformed-ids.run"
+    });
+    const unresolved = report.rows.length > 0 && !report.deleted;
+    if (unresolved && (process.exitCode === void 0 || process.exitCode === 0)) {
+      process.exitCode = 1;
+    }
+  }
+});
+
+export {
+  doctorMalformedIdsCommand
+};
+//# sourceMappingURL=chunk-PSJ33WVO.js.map

package/dist/cli/chunk-QA6T2LQ5.js

@@ -0,0 +1,71 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/cli/lib/collect-input.ts
+import { readFile } from "node:fs/promises";
+var PARSE_ERROR_SNIPPET_MAX_LENGTH = 80;
+function wrapParseError(rawInput, parseErr, sourceLabel) {
+  const snippet = rawInput.length > PARSE_ERROR_SNIPPET_MAX_LENGTH ? `${rawInput.slice(0, PARSE_ERROR_SNIPPET_MAX_LENGTH)}\u2026` : rawInput;
+  return new Error(`Invalid JSON in ${sourceLabel}: ${parseErr.message} (got: ${snippet})`);
+}
+function readStdinJson(stdin) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    stdin.on("data", (chunk) => {
+      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    });
+    stdin.on("error", (err) => {
+      reject(err);
+    });
+    stdin.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      try {
+        resolve(JSON.parse(raw));
+      } catch (err) {
+        reject(wrapParseError(raw, err, "stdin"));
+      }
+    });
+  });
+}
+async function collectMutateInput(args, stdin) {
+  if (typeof args.params === "string" && args.params.length > 0) {
+    try {
+      return JSON.parse(args.params);
+    } catch (err) {
+      throw wrapParseError(args.params, err, "--params");
+    }
+  }
+  if (typeof args.file === "string" && args.file.length > 0) {
+    const raw = await readFile(args.file, "utf8");
+    try {
+      return JSON.parse(raw);
+    } catch (err) {
+      throw wrapParseError(raw, err, `--file ${args.file}`);
+    }
+  }
+  if (stdin.isTTY !== true) {
+    return readStdinJson(stdin);
+  }
+  if (args.positional !== void 0 && args.positional.length > 0) {
+    return args.positional;
+  }
+  return void 0;
+}
+
+export {
+  collectMutateInput
+};
+//# sourceMappingURL=chunk-QA6T2LQ5.js.map

package/dist/cli/chunk-QJJWWCIC.js

@@ -0,0 +1,288 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput,
+  humanLine
+} from "./chunk-4RGSNUUP.js";
+
+// packages/cleo/src/cli/commands/backup-inspect.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import zlib from "node:zlib";
+import { ExitCode } from "@cleocode/contracts/exit-codes.js";
+import {
+  BackupObservationInspectionError,
+  detectEncryption,
+  ENC_MIN_LENGTH,
+  ENC_VERSION_OFFSET,
+  ENC_VERSION_SUPPORTED,
+  extractManifestFromTar,
+  fmtBytes,
+  inspectBackupObservation,
+  verifyManifestHash
+} from "@cleocode/core/store/backup-inspect.js";
+function printInspectReport(bundlePath, bundleSize, encrypted, manifest, integrityOk) {
+  const backup = manifest["backup"] ?? {};
+  const databases = manifest["databases"] ?? [];
+  const jsonFiles = manifest["json"] ?? [];
+  const manifestVersion = manifest["manifestVersion"] ?? "unknown";
+  const scope = backup["scope"] ?? "unknown";
+  const createdAt = backup["createdAt"] ?? "unknown";
+  const createdBy = backup["createdBy"] ?? "unknown";
+  const machineFingerprint = backup["machineFingerprint"] ?? "unknown";
+  const projectName = backup["projectName"] ?? "";
+  const projectFingerprint = backup["projectFingerprint"] ?? null;
+  const machineSame = false;
+  const lines = [
+    `Bundle:         ${bundlePath} (${fmtBytes(bundleSize)})`,
+    `Format:         CLEO Backup Bundle v${manifestVersion}`,
+    `Scope:          ${scope}`,
+    `Created:        ${createdAt} by ${createdBy}`,
+    `Encrypted:      ${encrypted ? "yes" : "no"}`,
+    `Source machine: ${machineFingerprint} (${machineSame ? "same" : "different"} as this machine)`
+  ];
+  if (projectName) {
+    lines.push(
+      `Project:        ${projectName}${projectFingerprint ? ` (${projectFingerprint})` : ""}`
+    );
+  }
+  if (databases.length > 0) {
+    lines.push("");
+    lines.push("Databases:");
+    for (const db of databases) {
+      const filename = db["filename"] ?? "";
+      const basename = path.basename(filename);
+      const size = db["size"] ?? 0;
+      const schemaVersion = db["schemaVersion"] ?? "unknown";
+      const rowCounts = db["rowCounts"] ?? {};
+      const rowSummary = Object.entries(rowCounts).map(([tbl, count]) => `${tbl}: ${count}`).join(", ");
+      const rowPart = rowSummary ? `   ${rowSummary}` : "";
+      lines.push(
+        `  ${basename.padEnd(20)} ${fmtBytes(size).padEnd(10)} schema: ${schemaVersion}${rowPart}`
+      );
+    }
+  }
+  if (jsonFiles.length > 0) {
+    lines.push("");
+    lines.push("JSON files:");
+    for (const jf of jsonFiles) {
+      const filename = jf["filename"] ?? "";
+      const basename = path.basename(filename);
+      const size = jf["size"] ?? 0;
+      lines.push(`  ${basename.padEnd(30)} ${fmtBytes(size)}`);
+    }
+  }
+  lines.push("");
+  lines.push(`Manifest integrity: [${integrityOk ? "OK" : "TAMPERED"}]`);
+  humanLine(lines.join("\n"));
+}
+async function inspectAction(bundlePath) {
+  const resolved = path.resolve(bundlePath);
+  if (!fs.existsSync(resolved)) {
+    cliError(`Bundle not found: ${bundlePath}`, 4, { name: "E_NOT_FOUND" });
+    process.exitCode = 4;
+    return;
+  }
+  const encrypted = detectEncryption(resolved);
+  if (encrypted) {
+    const passphrase = process.env["CLEO_BACKUP_PASSPHRASE"];
+    if (!passphrase) {
+      humanLine(
+        [
+          `Bundle:    ${bundlePath}`,
+          "Encrypted: yes",
+          "",
+          "Bundle is encrypted. Set the CLEO_BACKUP_PASSPHRASE environment variable",
+          "to decrypt and inspect the manifest contents.",
+          "",
+          "Example:",
+          `  CLEO_BACKUP_PASSPHRASE=<passphrase> cleo backup inspect ${bundlePath}`
+        ].join("\n")
+      );
+      process.exitCode = 0;
+      return;
+    }
+    const { decryptBundle } = await import("@cleocode/core/internal");
+    const encrypted_buf = fs.readFileSync(resolved);
+    if (encrypted_buf.length < ENC_MIN_LENGTH) {
+      cliError("Encrypted bundle payload too short", 70, { name: "E_DECRYPT_FAILED" });
+      process.exitCode = 70;
+      return;
+    }
+    const versionByte = encrypted_buf[ENC_VERSION_OFFSET];
+    if (versionByte !== ENC_VERSION_SUPPORTED) {
+      cliError(
+        `Unsupported encrypted bundle version ${versionByte ?? "undefined"}; expected ${ENC_VERSION_SUPPORTED}`,
+        70,
+        { name: "E_DECRYPT_FAILED" }
+      );
+      process.exitCode = 70;
+      return;
+    }
+    let decryptedBuf;
+    try {
+      decryptedBuf = decryptBundle(encrypted_buf, passphrase);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      cliError(`Decryption failed: ${msg}`, 70, {
+        name: "E_DECRYPT_FAILED",
+        fix: "Verify CLEO_BACKUP_PASSPHRASE matches the bundle."
+      });
+      process.exitCode = 70;
+      return;
+    }
+    const tmpPath = path.join(os.tmpdir(), `cleo-inspect-${process.pid}-${Date.now()}.tar.gz`);
+    try {
+      fs.writeFileSync(tmpPath, decryptedBuf);
+      await inspectTarball(tmpPath, resolved, encrypted);
+    } finally {
+      try {
+        fs.unlinkSync(tmpPath);
+      } catch {
+      }
+    }
+    return;
+  }
+  await inspectTarball(resolved, resolved, false);
+}
+async function inspectTarball(tarPath, displayPath, encrypted) {
+  const compressedBuf = fs.readFileSync(tarPath);
+  let tarBuf;
+  try {
+    tarBuf = zlib.gunzipSync(compressedBuf);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    cliError(`Failed to decompress bundle: ${msg}`, 71, { name: "E_DECOMPRESS_FAILED" });
+    process.exitCode = 71;
+    return;
+  }
+  const manifestContent = extractManifestFromTar(tarBuf);
+  if (!manifestContent) {
+    cliError("manifest.json not found in bundle", 74, { name: "E_MANIFEST_MISSING" });
+    process.exitCode = 74;
+    return;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(manifestContent);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    cliError(`Failed to parse manifest.json: ${msg}`, 71, { name: "E_MANIFEST_PARSE" });
+    process.exitCode = 71;
+    return;
+  }
+  const integrityOk = verifyManifestHash(manifestContent, manifest);
+  const stat = fs.statSync(displayPath);
+  printInspectReport(displayPath, stat.size, encrypted, manifest, integrityOk);
+  process.exitCode = 0;
+}
+function resolveSnapshotPath(input) {
+  const absolute = path.resolve(input);
+  try {
+    return path.join(fs.realpathSync(path.dirname(absolute)), path.basename(absolute));
+  } catch {
+    return absolute;
+  }
+}
+var backupInspectSubCommand = defineCommand({
+  meta: {
+    name: "inspect",
+    description: "Inspect a bundle manifest or an exact observation in a read-only SQLite snapshot"
+  },
+  args: {
+    bundle: {
+      type: "positional",
+      description: "Path to a backup bundle, or SQLite snapshot when --record-id is supplied",
+      required: true
+    },
+    "record-id": {
+      type: "string",
+      description: "Exact observation ID to inspect in the supplied SQLite snapshot"
+    },
+    "expected-project-id": {
+      type: "string",
+      description: "Expected stable identity; absent historical provenance remains unknown"
+    },
+    label: {
+      type: "string",
+      description: "Advisory original snapshot label; does not establish ownership"
+    },
+    "max-snapshot-bytes": {
+      type: "string",
+      description: "Positive integer source byte ceiling (default 512 MiB, maximum 1 GiB)"
+    },
+    "max-payload-bytes": {
+      type: "string",
+      description: "Positive integer payload byte ceiling (default 1 MiB, maximum 16 MiB)"
+    },
+    json: { type: "boolean", description: "Output structured JSON" },
+    human: { type: "boolean", description: "Force human-readable output" },
+    quiet: { type: "boolean", description: "Suppress non-essential output" }
+  },
+  async run({ args }) {
+    const recordId = args["record-id"];
+    if (recordId === void 0) {
+      if ([
+        args["expected-project-id"],
+        args.label,
+        args["max-snapshot-bytes"],
+        args["max-payload-bytes"]
+      ].some((value) => value !== void 0)) {
+        cliError(
+          "Snapshot inspection flags require --record-id.",
+          ExitCode.VALIDATION_ERROR,
+          { name: "E_BACKUP_INSPECT_INVALID_INPUT" },
+          { operation: "backup.inspect" }
+        );
+        process.exitCode = ExitCode.VALIDATION_ERROR;
+        return;
+      }
+      await inspectAction(args.bundle);
+      return;
+    }
+    try {
+      const result = await inspectBackupObservation({
+        snapshotPath: resolveSnapshotPath(args.bundle),
+        recordId,
+        expectedProjectId: args["expected-project-id"],
+        label: args.label,
+        maxSnapshotBytes: args["max-snapshot-bytes"] === void 0 ? void 0 : Number(args["max-snapshot-bytes"]),
+        maxPayloadBytes: args["max-payload-bytes"] === void 0 ? void 0 : Number(args["max-payload-bytes"])
+      });
+      cliOutput(result, { command: "backup", operation: "backup.inspect" });
+    } catch (error) {
+      cliError(
+        error instanceof Error ? error.message : String(error),
+        ExitCode.VALIDATION_ERROR,
+        {
+          name: error instanceof BackupObservationInspectionError ? `E_BACKUP_INSPECT_${error.code}` : "E_BACKUP_INSPECT_FAILED"
+        },
+        { operation: "backup.inspect" }
+      );
+      process.exitCode = ExitCode.VALIDATION_ERROR;
+    }
+  }
+});
+
+export {
+  backupInspectSubCommand
+};
+//# sourceMappingURL=chunk-QJJWWCIC.js.map

package/dist/cli/chunk-QKMBWYAS.js

@@ -0,0 +1,93 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/cli/describe-context.ts
+var describeRequested = false;
+function setDescribeMode(requested) {
+  describeRequested = requested;
+}
+function isDescribeMode() {
+  return describeRequested;
+}
+
+// packages/cleo/src/cli/idempotency-context.ts
+var currentIdempotencyKey;
+function setIdempotencyKeyContext(key) {
+  currentIdempotencyKey = key;
+}
+function getIdempotencyKeyContext() {
+  return currentIdempotencyKey;
+}
+function extractIdempotencyKeyArg(argv) {
+  const sanitized = [];
+  let idempotencyKey;
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i];
+    if (token === "--") {
+      sanitized.push(...argv.slice(i));
+      break;
+    }
+    if (token === "--idempotency-key") {
+      const next = argv[i + 1];
+      if (next !== void 0 && !next.startsWith("--")) {
+        idempotencyKey = next;
+        i++;
+      }
+      continue;
+    }
+    if (token?.startsWith("--idempotency-key=")) {
+      idempotencyKey = token.slice("--idempotency-key=".length);
+      continue;
+    }
+    if (token !== void 0) sanitized.push(token);
+  }
+  return { argv: sanitized, idempotencyKey };
+}
+
+// packages/cleo/src/cli/lib/settle-then-exit.ts
+async function settleThenExit(code, settle = settleWithCore, exit = (c) => process.exit(c)) {
+  process.exitCode = code;
+  try {
+    await settle();
+  } catch {
+  }
+  return exit(code);
+}
+async function settleWithCore() {
+  const { settleBeforeExit } = await import("@cleocode/core/shutdown");
+  return settleBeforeExit();
+}
+
+// packages/cleo/src/cli/projection-context.ts
+var currentOptOut = false;
+function setProjectionOptOut(optOut) {
+  currentOptOut = optOut;
+}
+function getProjectionOptOut() {
+  return currentOptOut;
+}
+
+export {
+  setDescribeMode,
+  isDescribeMode,
+  setIdempotencyKeyContext,
+  getIdempotencyKeyContext,
+  extractIdempotencyKeyArg,
+  settleThenExit,
+  setProjectionOptOut,
+  getProjectionOptOut
+};
+//# sourceMappingURL=chunk-QKMBWYAS.js.map

package/dist/cli/chunk-QWNKLLLG.js

@@ -0,0 +1,84 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+
+// packages/cleo/src/dispatch/adapters/typed.ts
+async function typedDispatch(handler, op, rawParams) {
+  return handler.operations[op](rawParams);
+}
+function defineTypedHandler(domain, operations) {
+  return { domain, operations };
+}
+function lafsSuccess(data, _operation, extra) {
+  return {
+    success: true,
+    data,
+    ...extra?.page ? { page: extra.page } : {}
+  };
+}
+function lafsError(code, message, _operation, fix, details) {
+  const error = { code, message };
+  if (fix !== void 0) error.fix = fix;
+  if (details !== void 0) error.details = details;
+  return {
+    success: false,
+    error
+  };
+}
+function wrapCoreResult(result, opName, fallback) {
+  if (!result.success) {
+    const e = result.error;
+    const errorObj = {
+      code: String(e?.code ?? "E_INTERNAL"),
+      message: e?.message ?? "Unknown error"
+    };
+    if (e?.exitCode !== void 0) errorObj.exitCode = e.exitCode;
+    if (e?.details !== void 0) errorObj.details = e.details;
+    if (e?.fix !== void 0) errorObj.fix = e.fix;
+    if (e?.alternatives) {
+      errorObj.alternatives = e.alternatives;
+    }
+    if (e?.problemDetails !== void 0) errorObj.problemDetails = e.problemDetails;
+    return { success: false, error: errorObj };
+  }
+  return lafsSuccess(result.data ?? fallback, opName);
+}
+async function wrapConduitImpl(fn, opName) {
+  try {
+    const result = await fn();
+    if (!result.success) {
+      return lafsError(
+        String(result.error?.code ?? "E_CONDUIT"),
+        result.error?.message ?? "Unknown error",
+        opName
+      );
+    }
+    return lafsSuccess(result.data ?? {}, opName);
+  } catch (error) {
+    if (!(error instanceof Error)) return lafsError("E_CONDUIT", String(error), opName);
+    const code = "code" in error && typeof error.code === "string" ? error.code : "";
+    return lafsError(/^E_[A-Z0-9_]+$/.test(code) ? code : "E_CONDUIT", error.message, opName);
+  }
+}
+
+export {
+  typedDispatch,
+  defineTypedHandler,
+  lafsSuccess,
+  lafsError,
+  wrapCoreResult,
+  wrapConduitImpl
+};
+//# sourceMappingURL=chunk-QWNKLLLG.js.map

package/dist/cli/chunk-QWUFFDL3.js

@@ -0,0 +1,85 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+
+// packages/cleo/src/cli/commands/auth/remove.ts
+function emitLlmCredentialRemoval(outcome, command, operation) {
+  if (!outcome.ok) {
+    cliError(outcome.message, outcome.exitCode, { name: outcome.code, fix: outcome.fix });
+    process.exit(outcome.exitCode);
+  }
+  for (const path of outcome.result.cleaned) process.stderr.write(`cleaned: ${path}
+`);
+  for (const hint of outcome.result.hints) process.stderr.write(`hint: ${hint}
+`);
+  cliOutput(outcome.result, { command, operation });
+}
+var authRemoveCommand = defineCommand({
+  meta: {
+    name: "remove",
+    description: "Remove a credential by (provider, label) and suppress its source from future re-seeding. Dispatches to the per-source RemovalStep so claude-code (et al.) entries are handled correctly without deleting external files."
+  },
+  args: {
+    provider: {
+      type: "positional",
+      description: "Provider id (e.g. anthropic, openai, gemini)",
+      required: true
+    },
+    label: {
+      type: "positional",
+      description: "Label of the credential to remove (unique within provider)",
+      required: true
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON envelope"
+    }
+  },
+  async run({ args }) {
+    const a = args;
+    const provider = String(a["provider"] ?? "");
+    const label = String(a["label"] ?? "");
+    if (!provider) {
+      cliError("provider is required", 6, { name: "E_INVALID_INPUT" });
+      process.exit(6);
+    }
+    if (!label) {
+      cliError("label is required", 6, { name: "E_INVALID_INPUT" });
+      process.exit(6);
+    }
+    const { removeLlmCredential } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/llm/credential-remove-entry.js"
+    );
+    emitLlmCredentialRemoval(
+      await removeLlmCredential(provider, label),
+      "auth-remove",
+      "auth.remove"
+    );
+  }
+});
+
+export {
+  emitLlmCredentialRemoval,
+  authRemoveCommand
+};
+//# sourceMappingURL=chunk-QWUFFDL3.js.map