@cleocode/cleo 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/cli/project-YZEC7GYF.js

@@ -0,0 +1,331 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  NEXUS_API_URL_ARG,
+  emitNexusResult,
+  failNexus,
+  nexusApiUrlArg,
+  writeNexusWarnings
+} from "./chunk-GRU74UE4.js";
+import "./chunk-47JYZAMS.js";
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  cliError,
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+import {
+  getFormatContext
+} from "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/commands/project.ts
+import { resolve } from "node:path";
+import { ExitCode } from "@cleocode/contracts/exit-codes.js";
+import {
+  CleoError,
+  getProjectRoot,
+  moveProject,
+  projectLifecycle,
+  renameProject,
+  rerootProject
+} from "@cleocode/core";
+function formatSuccessSection(header, icon, items) {
+  const prefix = icon ? `${icon} ` : "";
+  return { kind: "section", data: { header: `${prefix}${header}`, items } };
+}
+function emitEngineFailure(error, operation) {
+  const exitCode = error.exitCode ?? ExitCode.GENERAL_ERROR;
+  cliError(
+    error.message,
+    exitCode,
+    { name: error.code, fix: error.fix, details: error.details },
+    { operation }
+  );
+  process.exitCode = exitCode;
+}
+function resolveRootOrFail(operation) {
+  try {
+    return getProjectRoot();
+  } catch (err) {
+    const code = err instanceof CleoError && typeof err.details?.["code"] === "string" ? err.details["code"] : "E_NOT_CLEO_PROJECT";
+    emitEngineFailure(
+      {
+        code,
+        message: err.message,
+        exitCode: err instanceof CleoError ? err.code : ExitCode.CONFIG_ERROR,
+        fix: err instanceof CleoError ? err.fix : void 0
+      },
+      operation
+    );
+    return null;
+  }
+}
+function planItems(plan) {
+  const r = plan.registry;
+  return [
+    `Source:      ${plan.source}`,
+    `Target:      ${plan.target}`,
+    `Rename:      ${plan.entries.join(", ") || "(nothing)"}`,
+    ...plan.excluded.map((e) => `Left:        ${e.entry} (${e.reason})`),
+    `Writes:      ${plan.writes.join(", ") || "(nothing)"}`,
+    `Registry:    ${r.livePath} live; ${r.demotedPath} ${r.demotedState}`,
+    `Checkpoint:  ${plan.checkpoint}`,
+    ...plan.blockers.map((b) => `BLOCKER:     ${b}`),
+    ...plan.deferredChecks.map((c) => `Checked at apply time: ${c}`),
+    "Nothing was changed. Run without --dry-run to apply."
+  ];
+}
+function resultItems(r) {
+  const [from, to] = "oldPath" in r ? [r.oldPath, r.newPath] : [r.oldRoot, r.newRoot];
+  return [
+    `Project ID:  ${r.projectId}`,
+    `Old root:    ${from}`,
+    `New root:    ${to}`,
+    ..."renamed" in r ? [`Renamed:     ${r.renamed.join(", ") || "(resumed)"}`] : [],
+    `Checkpoint:  ${r.checkpointPath || "(none: resumed)"}`,
+    `Registry:    ${r.reconcileStatus}`,
+    ..."notes" in r ? r.notes.map((n) => `Next:        ${n}`) : []
+  ];
+}
+function emitRelocation(data, operation) {
+  if (getFormatContext().format !== "human") {
+    cliOutput(data, { command: "project", operation });
+    return;
+  }
+  const verb = operation === "project.move" ? "move" : "reroot";
+  cliOutput(
+    data.dryRun ? formatSuccessSection(`Dry Run: project ${verb}`, void 0, [
+      `Project ID:  ${data.projectId}`,
+      ...planItems(data)
+    ]) : formatSuccessSection(
+      verb === "move" ? "Project Moved" : "Project Rerooted",
+      "\u2705",
+      resultItems(data)
+    ),
+    { command: "project", operation }
+  );
+}
+var moveSubCommand = defineCommand({
+  meta: {
+    name: "move",
+    description: "Move this project to a new path on the same device by RENAMING its root: .git, the database and everything else move together, nothing is copied and no old copy is left. The registry is rebound to the new path. Refuses a cross-device target (use a plain `mv`, then any cleo command), a target inside the project (use `cleo project reroot`), and any move while sessions are active or worktrees exist (end them first)."
+  },
+  args: {
+    newPath: {
+      type: "positional",
+      description: "New project root: absent or an empty directory, outside this project.",
+      required: true
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Print the plan (renames, blockers, registry action) and change nothing.",
+      default: false
+    },
+    json: { type: "boolean", description: "Output raw JSON envelope.", default: false }
+  },
+  async run({ args }) {
+    const operation = "project.move";
+    const root = resolveRootOrFail(operation);
+    if (root === null) return;
+    const result = await moveProject(resolve(args["newPath"]), root, {
+      dryRun: args["dry-run"] === true
+    });
+    if (!result.success) {
+      emitEngineFailure(result.error, operation);
+      return;
+    }
+    emitRelocation(result.data, operation);
+  }
+});
+var rerootSubCommand = defineCommand({
+  meta: {
+    name: "reroot",
+    description: "Make a subdirectory of this project the project root. Checkpoints, then RENAMES CLEO's own top-level entries into it (.cleo/, .worktreeinclude, and .github/ when it holds only CLEO's init templates), keeps the same project id, leaves a .cleo-moved.json tombstone at the old root and rebinds the registry. Everything else stays. Refuses while a session or worktree is active. Run `cleo project reroot .` from the child to finish an interrupted reroot."
+  },
+  args: {
+    childDir: {
+      type: "positional",
+      description: "Existing subdirectory of the current project root (`.` from the child resumes).",
+      required: true
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Print the plan and change nothing (no disk, no registry).",
+      default: false
+    },
+    json: { type: "boolean", description: "Output raw JSON envelope.", default: false }
+  },
+  async run({ args }) {
+    const operation = "project.reroot";
+    const root = resolveRootOrFail(operation);
+    if (root === null) return;
+    const result = await rerootProject(resolve(args["childDir"]), root, {
+      dryRun: args["dry-run"] === true
+    });
+    if (!result.success) {
+      emitEngineFailure(result.error, operation);
+      return;
+    }
+    emitRelocation(result.data, operation);
+  }
+});
+var renameSubCommand = defineCommand({
+  meta: {
+    name: "rename",
+    description: "Rename this project: the committed .cleo/project.json name, the registry label, and a Cleo Nexus relink hint (the id never changes)."
+  },
+  args: {
+    newName: { type: "positional", description: "New project name.", required: true },
+    "dry-run": { type: "boolean", description: "Validate without applying.", default: false },
+    json: { type: "boolean", description: "Output raw JSON envelope.", default: false }
+  },
+  async run({ args }) {
+    const newName = args["newName"];
+    const dryRun = args["dry-run"] ?? false;
+    const nameRe = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$/;
+    if (!newName || !nameRe.test(newName)) {
+      emitEngineFailure(
+        {
+          code: "E_VALIDATION",
+          message: `Invalid project name: "${newName}".`,
+          exitCode: ExitCode.INVALID_INPUT,
+          fix: 'Use 1-100 characters: letters, digits, "_" or "-", starting with a letter or digit'
+        },
+        "project.rename"
+      );
+      return;
+    }
+    if (dryRun) {
+      cliOutput(
+        formatSuccessSection("Dry Run", void 0, [
+          `Would rename project to "${newName}".`,
+          "Run without --dry-run to apply."
+        ]),
+        { command: "project", operation: "project.rename" }
+      );
+      return;
+    }
+    const result = await renameProject(newName, process.cwd());
+    if (result.success) {
+      const r = result.data;
+      cliOutput(
+        formatSuccessSection("Project Renamed", "\u2705", [
+          `Project ID:   ${r.projectId}`,
+          `Old name:     ${r.oldName}`,
+          `New name:     ${r.newName}`,
+          `Project hash: ${r.newProjectHash}`,
+          ...r.recordedIn ? [`Recorded in:  .cleo/${r.recordedIn}`] : [],
+          ...r.registry ? [`Registry:     ${r.registry}`] : [],
+          ...r.nexusLabel ? [`Nexus label:  ${r.nexusLabel}`] : [],
+          ...r.hint ? [`Next:         ${r.hint}`] : []
+        ]),
+        { command: "project", operation: "project.rename" }
+      );
+    } else {
+      emitEngineFailure(result.error, "project.rename");
+    }
+  }
+});
+var reregisterSubCommand = defineCommand({
+  meta: { name: "re-register", description: "Re-register project with NEXUS." },
+  args: {
+    fix: { type: "boolean", description: "Auto-heal path_updated drift.", default: false },
+    json: { type: "boolean", description: "Output raw JSON envelope.", default: false }
+  },
+  async run() {
+    const result = await projectLifecycle.reregisterProject(process.cwd());
+    if (result.success) {
+      const r = result.data;
+      const icon = r.drifted ? "\u26A0\uFE0F" : "\u2705";
+      const items = [
+        `Project ID:  ${r.projectId}`,
+        `Project root: ${r.projectRoot}`,
+        `Hash:        ${r.projectHash}`,
+        `Status:      ${r.reconcileStatus}`
+      ];
+      if (r.drifted && r.oldPath) items.push(`Old path:    ${r.oldPath}`);
+      cliOutput(
+        formatSuccessSection(
+          r.drifted ? "Project Re-registered (Drift Detected)" : "Project Re-registered",
+          icon,
+          items
+        ),
+        { command: "project", operation: "project.re-register" }
+      );
+    } else {
+      emitEngineFailure(result.error, "project.re-register");
+    }
+  }
+});
+var linkSubCommand = defineCommand({
+  meta: {
+    name: "link",
+    description: "Register this project with Cleo Nexus under its project id (.cleo/project-id) with its name as a plaintext label (--label overrides; never a filesystem path). Idempotent: re-linking after a rename updates the label. Requires cleo login nexus."
+  },
+  args: {
+    label: {
+      type: "string",
+      description: "Name shown in Nexus, sent in plaintext (default: the project name). A name, never a path."
+    },
+    rebind: {
+      type: "boolean",
+      description: "Use only after E_NEXUS_REPLICA_COPIED: give this copy of the project a new replica id before attaching it (this machine was re-enrolled, or the store was copied). Each run mints a new id and leaves the old one on the server as stale history."
+    },
+    "api-url": NEXUS_API_URL_ARG,
+    json: { type: "boolean", description: "Output raw JSON envelope.", default: false }
+  },
+  async run({ args }) {
+    const { linkProjectToNexus } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-link.js"
+    );
+    let result;
+    try {
+      result = await linkProjectToNexus({
+        apiUrl: nexusApiUrlArg(args),
+        ...typeof args["label"] === "string" && args["label"] ? { label: args["label"] } : {},
+        ...args["rebind"] === true ? { rebind: true } : {}
+      });
+    } catch (err) {
+      failNexus(err, "project.link");
+    }
+    const { link, replica } = result;
+    const verb = result.alreadyLinked ? "Already linked" : "Linked";
+    const attached = replica ? ` This machine (device ${replica.deviceId}) holds it as replica ${replica.replicaId}${replica.reboundFrom ? ` (rebound from ${replica.reboundFrom})` : ""}${replica.presenceAt ? "; presence reported" : ""}.` : "";
+    const keyed = result.initialKeyVersion !== null ? ` Its encryption key (version ${result.initialKeyVersion}) was stored with the registration.` : "";
+    const summary = `${verb}: project ${link.localProjectId} as "${link.label ?? ""}" on ${link.apiUrl}.${attached}${keyed}`;
+    writeNexusWarnings(result.warnings);
+    emitNexusResult(result, summary, "project", "project.link");
+  }
+});
+var projectCommand = defineCommand({
+  meta: {
+    name: "project",
+    description: "Project lifecycle management (move, reroot, rename, re-register, link)."
+  },
+  subCommands: {
+    link: linkSubCommand,
+    move: moveSubCommand,
+    reroot: rerootSubCommand,
+    rename: renameSubCommand,
+    "re-register": reregisterSubCommand
+  }
+});
+export {
+  projectCommand
+};
+//# sourceMappingURL=project-YZEC7GYF.js.map

package/dist/cli/promote-FINF4HVK.js

@@ -0,0 +1,53 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  dispatchFromCli
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import "./chunk-QKMBWYAS.js";
+import "./chunk-4RGSNUUP.js";
+import "./chunk-6JSJNYH2.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
+
+// packages/cleo/src/cli/commands/promote.ts
+var promoteCommand = defineCommand({
+  meta: { name: "promote", description: "Remove parent from task, making it root-level" },
+  args: {
+    taskId: {
+      type: "positional",
+      description: "Task ID to promote to root level",
+      required: true
+    }
+  },
+  async run({ args }) {
+    await dispatchFromCli(
+      "mutate",
+      "tasks",
+      "reparent",
+      { taskId: args.taskId, newParentId: null },
+      { command: "promote" }
+    );
+  }
+});
+export {
+  promoteCommand
+};
+//# sourceMappingURL=promote-FINF4HVK.js.map

package/dist/cli/provenance-3TUWVBFR.js

@@ -0,0 +1,141 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  errorResult,
+  handleErrorResult,
+  unsupportedOp,
+  wrapResult
+} from "./chunk-XHRZ7OYZ.js";
+
+// packages/cleo/src/dispatch/domains/provenance.ts
+import {
+  getLogger,
+  getProjectRoot,
+  provenanceBackfill,
+  verifyProvenance
+} from "@cleocode/core/internal";
+var log = getLogger("domain:provenance");
+var ProvenanceHandler = class {
+  // -----------------------------------------------------------------------
+  // Query
+  // -----------------------------------------------------------------------
+  /**
+   * Provenance query operations. Currently only `verify` is implemented.
+   *
+   * @param operation - The provenance query op name (`verify`).
+   * @param params    - The dispatch params object: `version`, `all`, `limit`.
+   */
+  async query(operation, params) {
+    const startTime = Date.now();
+    try {
+      switch (operation) {
+        // ------------------------------------------------------------------
+        // provenance.verify — T9529 / SPEC-T9345 §4.6
+        // ------------------------------------------------------------------
+        case "verify": {
+          const version = typeof params?.["version"] === "string" ? params["version"] : void 0;
+          const all = typeof params?.["all"] === "boolean" ? params["all"] : false;
+          const limit = typeof params?.["limit"] === "number" ? params["limit"] : void 0;
+          if (!version && !all) {
+            return errorResult(
+              "query",
+              "provenance",
+              operation,
+              "E_INVALID_INPUT",
+              "verify requires either <version> or --all",
+              startTime
+            );
+          }
+          const result = await verifyProvenance({
+            ...version ? { version } : {},
+            all,
+            ...limit !== void 0 ? { limit } : {},
+            projectRoot: getProjectRoot()
+          });
+          return wrapResult(result, "query", "provenance", operation, startTime);
+        }
+        default:
+          return unsupportedOp("query", "provenance", operation, startTime);
+      }
+    } catch (err) {
+      log.error({ err, operation }, "ProvenanceHandler query error");
+      return handleErrorResult("query", "provenance", operation, err, startTime);
+    }
+  }
+  // -----------------------------------------------------------------------
+  // Mutate
+  // -----------------------------------------------------------------------
+  /**
+   * Provenance mutate operations. Currently only `backfill` is implemented.
+   *
+   * @param operation - The provenance mutate op name (`backfill`).
+   * @param params    - The dispatch params object: `since`, `forceOverwrite`,
+   *                    `dryRun`, `resetCheckpoint`.
+   */
+  async mutate(operation, params) {
+    const startTime = Date.now();
+    try {
+      switch (operation) {
+        // ------------------------------------------------------------------
+        // provenance.backfill — T9528 / SPEC-T9345 §8.3
+        // ------------------------------------------------------------------
+        case "backfill": {
+          const since = typeof params?.["since"] === "string" ? params["since"] : void 0;
+          if (since === void 0) {
+            return errorResult(
+              "mutate",
+              "provenance",
+              operation,
+              "E_INVALID_INPUT",
+              'since is required (use --since "" to walk every reachable tag)',
+              startTime
+            );
+          }
+          const forceOverwrite = typeof params?.["forceOverwrite"] === "boolean" ? params["forceOverwrite"] : false;
+          const dryRun = typeof params?.["dryRun"] === "boolean" ? params["dryRun"] : false;
+          const resetCheckpoint = typeof params?.["resetCheckpoint"] === "boolean" ? params["resetCheckpoint"] : false;
+          const result = await provenanceBackfill({
+            since,
+            projectRoot: getProjectRoot(),
+            forceOverwrite,
+            dryRun,
+            resetCheckpoint
+          });
+          return wrapResult(result, "mutate", "provenance", operation, startTime);
+        }
+        default:
+          return unsupportedOp("mutate", "provenance", operation, startTime);
+      }
+    } catch (err) {
+      log.error({ err, operation }, "ProvenanceHandler mutate error");
+      return handleErrorResult("mutate", "provenance", operation, err, startTime);
+    }
+  }
+  // -----------------------------------------------------------------------
+  // getSupportedOperations
+  // -----------------------------------------------------------------------
+  /** Return declared operations for introspection and registry validation. */
+  getSupportedOperations() {
+    return {
+      query: ["verify"],
+      mutate: ["backfill"]
+    };
+  }
+};
+export {
+  ProvenanceHandler
+};
+//# sourceMappingURL=provenance-3TUWVBFR.js.map

package/dist/cli/provenance-YZG33JGM.js

@@ -0,0 +1,129 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  dispatchFromCli
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import "./chunk-QKMBWYAS.js";
+import "./chunk-4RGSNUUP.js";
+import "./chunk-6JSJNYH2.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
+
+// packages/cleo/src/cli/commands/provenance.ts
+var backfillCommand = defineCommand({
+  meta: {
+    name: "backfill",
+    description: "Walk historical git tags from --since and populate the 11 provenance tables"
+  },
+  args: {
+    since: {
+      type: "string",
+      description: "Lower-bound version (exclusive). Tags newer than this are reconciled. Empty string = all tags.",
+      required: true
+    },
+    "force-overwrite": {
+      type: "boolean",
+      description: "UPDATE existing rows on conflict (audit-logged). Default: UPSERT-on-insert only."
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Enumerate the tag set + return the plan without writing to the DB"
+    },
+    "reset-checkpoint": {
+      type: "boolean",
+      description: "Clear the existing .cleo/release/backfill-state.json before starting (do NOT resume)"
+    },
+    json: { type: "boolean", description: "Emit LAFS envelope" }
+  },
+  async run({ args }) {
+    await dispatchFromCli(
+      "mutate",
+      "provenance",
+      "backfill",
+      {
+        since: args.since,
+        forceOverwrite: args["force-overwrite"] === true,
+        dryRun: args["dry-run"] === true,
+        resetCheckpoint: args["reset-checkpoint"] === true
+      },
+      { command: "provenance" }
+    );
+  }
+});
+var verifyCommand = defineCommand({
+  meta: {
+    name: "verify",
+    description: "Audit the 11 provenance tables for a release (FK integrity, orphans, evidence staleness)"
+  },
+  args: {
+    version: {
+      type: "positional",
+      description: "Release version to verify (e.g. v2026.6.0). Optional when --all is set.",
+      required: false
+    },
+    all: {
+      type: "boolean",
+      description: "Verify the most-recent N releases instead of a single version"
+    },
+    limit: {
+      type: "string",
+      description: "How many releases to verify in --all mode (default 5)"
+    },
+    json: { type: "boolean", description: "Emit LAFS envelope" }
+  },
+  async run({ args }) {
+    const version = typeof args.version === "string" ? args.version : void 0;
+    const all = args.all === true;
+    const limitArg = typeof args.limit === "string" ? args.limit : void 0;
+    const limit = limitArg ? Number.parseInt(limitArg, 10) : void 0;
+    await dispatchFromCli(
+      "query",
+      "provenance",
+      "verify",
+      {
+        ...version ? { version } : {},
+        all,
+        ...limit && Number.isFinite(limit) ? { limit } : {}
+      },
+      { command: "provenance" }
+    );
+  }
+});
+var provenanceCommand = defineCommand({
+  meta: {
+    name: "provenance",
+    description: "Provenance-graph maintenance: backfill, verify, repair"
+  },
+  subCommands: {
+    backfill: backfillCommand,
+    verify: verifyCommand
+  },
+  async run({ cmd, rawArgs }) {
+    const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+    if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+    await showUsage(cmd);
+  }
+});
+export {
+  provenanceCommand
+};
+//# sourceMappingURL=provenance-YZG33JGM.js.map