@cleocode/cleo 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/cli/sequence-H7DSAJPF.js

@@ -0,0 +1,94 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  dispatchFromCli
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import "./chunk-QKMBWYAS.js";
+import {
+  cliOutput
+} from "./chunk-4RGSNUUP.js";
+import "./chunk-6JSJNYH2.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
+
+// packages/cleo/src/cli/commands/sequence.ts
+import { getProjectRoot } from "@cleocode/core/internal";
+var showCommand = defineCommand({
+  meta: { name: "show", description: "Display current sequence state" },
+  async run() {
+    await dispatchFromCli(
+      "query",
+      "admin",
+      "sequence",
+      { action: "show" },
+      { command: "sequence" }
+    );
+  }
+});
+var checkCommand = defineCommand({
+  meta: { name: "check", description: "Verify counter >= max(todo + archive)" },
+  async run() {
+    await dispatchFromCli(
+      "query",
+      "admin",
+      "sequence",
+      { action: "check" },
+      { command: "sequence" }
+    );
+  }
+});
+var repairCommand = defineCommand({
+  meta: { name: "repair", description: "Reset counter to max + 1 if behind" },
+  async run() {
+    const { repairSequence } = await import("@cleocode/core/internal");
+    const projectRoot = getProjectRoot();
+    const repair = await repairSequence(projectRoot);
+    const result = {
+      repaired: repair.repaired,
+      message: repair.message,
+      counter: repair.counter,
+      oldCounter: repair.oldCounter,
+      newCounter: repair.newCounter
+    };
+    cliOutput(result, { command: "sequence", operation: "admin.sequence.repair" });
+  }
+});
+var sequenceCommand = defineCommand({
+  meta: {
+    name: "sequence",
+    description: "Inspect and manage task ID sequence (show/check/repair)"
+  },
+  subCommands: {
+    show: showCommand,
+    check: checkCommand,
+    repair: repairCommand
+  },
+  async run({ cmd, rawArgs }) {
+    const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+    if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+    await showUsage(cmd);
+  }
+});
+export {
+  sequenceCommand
+};
+//# sourceMappingURL=sequence-H7DSAJPF.js.map

package/dist/cli/service-EK5MGB2D.js

@@ -0,0 +1,156 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import "./chunk-C3B7C43W.js";
+import {
+  dispatchFromCli
+} from "./chunk-L7ONYSV6.js";
+import "./chunk-6N6WGLXE.js";
+import "./chunk-4VASFLUW.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import "./chunk-QKMBWYAS.js";
+import "./chunk-4RGSNUUP.js";
+import "./chunk-6JSJNYH2.js";
+import "./chunk-D7BAQNV2.js";
+import "./chunk-TYC7G5LF.js";
+
+// packages/cleo/src/cli/commands/service.ts
+function makeServiceSubcommand(opts) {
+  const mergedArgs = {
+    ...opts.args,
+    json: { type: "boolean", description: "Output as JSON" }
+  };
+  return defineCommand({
+    meta: { name: opts.name, description: opts.description },
+    args: mergedArgs,
+    async run({ args }) {
+      const params = opts.paramBuilder(args);
+      await dispatchFromCli(opts.gateway, "service", opts.operation, params, {
+        command: `service-${opts.name}`,
+        operation: `service.${opts.operation}`
+      });
+    }
+  });
+}
+function str(v) {
+  return typeof v === "string" && v !== "" ? v : void 0;
+}
+var connectCommand = makeServiceSubcommand({
+  name: "connect",
+  description: "Connect a service credential. Token-direct: `--token <t>` (browser-free). OAuth paste-code: `--paste-code <code> --code-verifier <v> --redirect-uri <u>`. The secret is encrypted at rest and NEVER printed.",
+  args: {
+    provider: {
+      type: "positional",
+      description: "Service provider key (e.g. github)",
+      required: true
+    },
+    label: {
+      type: "string",
+      description: "Connection label, unique within provider (default 'default')"
+    },
+    token: {
+      type: "string",
+      description: "Direct access token to store (token-direct mode). SECRET."
+    },
+    "refresh-token": {
+      type: "string",
+      description: "Optional refresh token paired with --token. SECRET."
+    },
+    "expires-at": {
+      type: "string",
+      description: "ISO-8601 access-token expiry (token-direct mode)."
+    },
+    "paste-code": {
+      type: "string",
+      description: "OAuth authorization code from the redirect callback."
+    },
+    "code-verifier": {
+      type: "string",
+      description: "PKCE code verifier from `cleo service auth-url`."
+    },
+    "redirect-uri": { type: "string", description: "Redirect URI used in auth-url; must match." }
+  },
+  gateway: "mutate",
+  operation: "connect",
+  paramBuilder: (a) => ({
+    provider: a["provider"],
+    ...str(a["label"]) !== void 0 ? { label: str(a["label"]) } : {},
+    ...str(a["token"]) !== void 0 ? { token: str(a["token"]) } : {},
+    ...str(a["refresh-token"]) !== void 0 ? { refreshToken: str(a["refresh-token"]) } : {},
+    ...str(a["expires-at"]) !== void 0 ? { expiresAt: str(a["expires-at"]) } : {},
+    ...str(a["paste-code"]) !== void 0 ? { code: str(a["paste-code"]) } : {},
+    ...str(a["code-verifier"]) !== void 0 ? { codeVerifier: str(a["code-verifier"]) } : {},
+    ...str(a["redirect-uri"]) !== void 0 ? { redirectUri: str(a["redirect-uri"]) } : {}
+  })
+});
+var listCommand = makeServiceSubcommand({
+  name: "list",
+  description: "List service connections as NON-SECRET views (provider/label/status/scopes/expires/hasCredentials). The decrypted token is never shown.",
+  args: {
+    provider: { type: "positional", description: "Optional provider filter", required: false }
+  },
+  gateway: "query",
+  operation: "list",
+  paramBuilder: (a) => ({
+    ...str(a["provider"]) !== void 0 ? { provider: str(a["provider"]) } : {}
+  })
+});
+var revokeCommand = makeServiceSubcommand({
+  name: "revoke",
+  description: "Delete a service connection and cascade its agent_service_grants.",
+  args: {
+    provider: { type: "positional", description: "Service provider key", required: true },
+    label: { type: "positional", description: "Connection label to revoke", required: true }
+  },
+  gateway: "mutate",
+  operation: "revoke",
+  paramBuilder: (a) => ({ provider: a["provider"], label: a["label"] })
+});
+var statusCommand = makeServiceSubcommand({
+  name: "status",
+  description: "Report connection health \u2014 each connection adds `expired` + `needsRefresh` booleans from expires_at. NON-SECRET.",
+  args: {
+    provider: { type: "positional", description: "Optional provider filter", required: false }
+  },
+  gateway: "query",
+  operation: "status",
+  paramBuilder: (a) => ({
+    ...str(a["provider"]) !== void 0 ? { provider: str(a["provider"]) } : {}
+  })
+});
+var serviceCommand = defineCommand({
+  meta: {
+    name: "service",
+    description: "Connect, list, revoke, and inspect service-vault credentials (github, google, \u2026)"
+  },
+  subCommands: {
+    connect: connectCommand,
+    list: listCommand,
+    revoke: revokeCommand,
+    status: statusCommand
+  },
+  async run({ cmd, rawArgs }) {
+    const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+    if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+    await showUsage(cmd);
+  }
+});
+export {
+  serviceCommand
+};
+//# sourceMappingURL=service-EK5MGB2D.js.map

package/dist/cli/service-GLOMZWPQ.js

@@ -0,0 +1,437 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  errorResult,
+  unsupportedOp,
+  wrapResult
+} from "./chunk-XHRZ7OYZ.js";
+
+// packages/cleo/src/dispatch/domains/service.ts
+import {
+  connectService,
+  deleteConnectionCascade,
+  listConnections
+} from "@cleocode/core";
+import {
+  buildAuthUrl,
+  exchangeCode,
+  selfHealConnection
+} from "@cleocode/core/internal";
+var ServiceHandler = class {
+  /**
+   * Handle service queries.
+   *
+   * Supported: `auth-url` — build a PKCE OAuth authorization URL. The result
+   * carries the `codeVerifier` + `state` the caller round-trips into `exchange`;
+   * these are NOT persisted secrets (they are short-lived flow material the user
+   * already controls), so returning them is the contract of the verb.
+   */
+  async query(operation, params) {
+    const startTime = Date.now();
+    switch (operation) {
+      case "auth-url": {
+        const provider = typeof params?.provider === "string" ? params.provider : void 0;
+        if (!provider) {
+          return errorResult(
+            "query",
+            "service",
+            operation,
+            "E_INVALID_INPUT",
+            "provider is required",
+            startTime
+          );
+        }
+        const opts = {
+          ...typeof params?.state === "string" ? { state: params.state } : {},
+          ...typeof params?.scope === "string" ? { scope: params.scope } : {},
+          ...typeof params?.redirectUri === "string" ? { redirectUri: params.redirectUri } : {}
+        };
+        try {
+          const result = await buildAuthUrl(provider, opts);
+          return wrapResult(
+            { success: true, data: result },
+            "query",
+            "service",
+            operation,
+            startTime
+          );
+        } catch (err) {
+          return errorResult(
+            "query",
+            "service",
+            operation,
+            "E_INTERNAL",
+            messageOf(err),
+            startTime
+          );
+        }
+      }
+      case "list":
+        return this.list(params, startTime);
+      case "status":
+        return this.status(params, startTime);
+      default:
+        return unsupportedOp("query", "service", operation, startTime);
+    }
+  }
+  /** Delegate `service.list` to CORE `listConnections` — redacted views only. */
+  async list(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    try {
+      const connections = await listConnections(provider);
+      return wrapResult(
+        { success: true, data: { connections } },
+        "query",
+        "service",
+        "list",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("query", "service", "list", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.status` to CORE `listConnections` + map to health views. */
+  async status(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    try {
+      const views = await listConnections(provider);
+      const connections = views.map((v) => toHealthView(v));
+      return wrapResult(
+        { success: true, data: { connections } },
+        "query",
+        "service",
+        "status",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("query", "service", "status", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /**
+   * Handle service mutations.
+   *
+   * Supported: `exchange` (persist tokens), `refresh` (renew tokens),
+   * `self-heal` (resolve + transparent refresh). All delegate to CORE and return
+   * the NON-SECRET result — the plaintext token NEVER crosses this boundary.
+   */
+  async mutate(operation, params) {
+    const startTime = Date.now();
+    switch (operation) {
+      case "connect":
+        return this.connect(params, startTime);
+      case "exchange":
+        return this.exchange(params, startTime);
+      case "refresh":
+        return this.refresh(params, startTime);
+      case "revoke":
+        return this.revoke(params, startTime);
+      case "self-heal":
+        return this.selfHeal(params, startTime);
+      default:
+        return unsupportedOp("mutate", "service", operation, startTime);
+    }
+  }
+  /**
+   * Delegate `service.connect` — store a credential. Two modes:
+   *   - token-direct: `token` (+ optional refreshToken/expiresAt/scopes) →
+   *     CORE `connectService` encrypts + persists the blob.
+   *   - paste-code: `code` + `codeVerifier` + `redirectUri` → CORE `exchangeCode`
+   *     runs the OAuth dance. The plaintext token NEVER crosses this boundary.
+   */
+  async connect(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    if (!provider) {
+      return errorResult(
+        "mutate",
+        "service",
+        "connect",
+        "E_INVALID_INPUT",
+        "provider is required",
+        startTime
+      );
+    }
+    const label = typeof params?.label === "string" ? params.label : "default";
+    const token = typeof params?.token === "string" ? params.token : void 0;
+    const code = typeof params?.code === "string" ? params.code : void 0;
+    try {
+      if (token !== void 0) {
+        const connectionId = await connectService(
+          buildConnectParams(provider, label, params, token)
+        );
+        return wrapResult(
+          {
+            success: true,
+            data: {
+              count: 1,
+              created: [String(connectionId)],
+              connection: { connectionId, provider, label, expiresAt: expiryOf(params) }
+            }
+          },
+          "mutate",
+          "service",
+          "connect",
+          startTime
+        );
+      }
+      if (code !== void 0) {
+        const opts = buildExchangeOpts(params, code, label);
+        if (opts === null) {
+          return errorResult(
+            "mutate",
+            "service",
+            "connect",
+            "E_INVALID_INPUT",
+            "paste-code mode requires --code, --code-verifier, and --redirect-uri",
+            startTime
+          );
+        }
+        const result = await exchangeCode(provider, opts);
+        return wrapResult(
+          {
+            success: true,
+            data: { count: 1, created: [String(result.connectionId)], connection: result }
+          },
+          "mutate",
+          "service",
+          "connect",
+          startTime
+        );
+      }
+      return errorResult(
+        "mutate",
+        "service",
+        "connect",
+        "E_INVALID_INPUT",
+        "connect requires either --token (token-direct) or --code + --code-verifier + --redirect-uri (paste-code)",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "connect", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.revoke` to CORE `deleteConnectionCascade` (hard delete + cascade). */
+  async revoke(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    const label = typeof params?.label === "string" ? params.label : void 0;
+    if (!provider || !label) {
+      return errorResult(
+        "mutate",
+        "service",
+        "revoke",
+        "E_INVALID_INPUT",
+        "provider and label are required",
+        startTime
+      );
+    }
+    try {
+      const result = await deleteConnectionCascade(provider, label);
+      return wrapResult(
+        {
+          success: true,
+          data: {
+            count: result.deleted ? 1 : 0,
+            deleted: result.deleted ? [`${provider}:${label}`] : [],
+            grantsRemoved: result.grantsRemoved
+          }
+        },
+        "mutate",
+        "service",
+        "revoke",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "revoke", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.exchange` to CORE `exchangeCode`. */
+  async exchange(params, startTime) {
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    const code = typeof params?.code === "string" ? params.code : void 0;
+    const codeVerifier = typeof params?.codeVerifier === "string" ? params.codeVerifier : void 0;
+    const redirectUri = typeof params?.redirectUri === "string" ? params.redirectUri : void 0;
+    if (!provider || !code || !codeVerifier || !redirectUri) {
+      return errorResult(
+        "mutate",
+        "service",
+        "exchange",
+        "E_INVALID_INPUT",
+        "provider, code, codeVerifier, redirectUri are required",
+        startTime
+      );
+    }
+    const opts = {
+      code,
+      codeVerifier,
+      redirectUri,
+      ...typeof params?.label === "string" ? { label: params.label } : {}
+    };
+    try {
+      const result = await exchangeCode(provider, opts);
+      return wrapResult(
+        {
+          success: true,
+          data: { count: 1, created: [String(result.connectionId)], connection: result }
+        },
+        "mutate",
+        "service",
+        "exchange",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "exchange", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.refresh` to CORE `refreshAccessToken` via the self-heal persist path. */
+  async refresh(params, startTime) {
+    const agentId = typeof params?.agentId === "string" ? params.agentId : void 0;
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    const label = typeof params?.label === "string" ? params.label : void 0;
+    if (!agentId || !provider || !label) {
+      return errorResult(
+        "mutate",
+        "service",
+        "refresh",
+        "E_INVALID_INPUT",
+        "agentId, provider, label are required",
+        startTime
+      );
+    }
+    try {
+      const result = await selfHealConnection({
+        agentId,
+        provider,
+        label,
+        skewSeconds: Number.MAX_SAFE_INTEGER / 1e3,
+        ...params?.approved === true ? { approved: true } : {}
+      });
+      if (result.sealed === null) {
+        return errorResult(
+          "mutate",
+          "service",
+          "refresh",
+          "E_NOT_FOUND",
+          "connection not found, not active, or access denied",
+          startTime
+        );
+      }
+      return wrapResult(
+        {
+          success: true,
+          data: {
+            count: 1,
+            updated: [`${provider}:${label}`],
+            refreshed: result.refreshed,
+            expiresAt: result.expiresAt
+          }
+        },
+        "mutate",
+        "service",
+        "refresh",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "refresh", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Delegate `service.self-heal` to CORE `selfHealConnection`. */
+  async selfHeal(params, startTime) {
+    const agentId = typeof params?.agentId === "string" ? params.agentId : void 0;
+    const provider = typeof params?.provider === "string" ? params.provider : void 0;
+    const label = typeof params?.label === "string" ? params.label : void 0;
+    if (!agentId || !provider || !label) {
+      return errorResult(
+        "mutate",
+        "service",
+        "self-heal",
+        "E_INVALID_INPUT",
+        "agentId, provider, label are required",
+        startTime
+      );
+    }
+    try {
+      const result = await selfHealConnection({
+        agentId,
+        provider,
+        label,
+        ...params?.approved === true ? { approved: true } : {}
+      });
+      return wrapResult(
+        {
+          success: true,
+          data: {
+            count: result.refreshed ? 1 : 0,
+            updated: result.refreshed ? [`${provider}:${label}`] : [],
+            resolved: result.sealed !== null,
+            refreshed: result.refreshed,
+            expiresAt: result.expiresAt
+          }
+        },
+        "mutate",
+        "service",
+        "self-heal",
+        startTime
+      );
+    } catch (err) {
+      return errorResult("mutate", "service", "self-heal", "E_INTERNAL", messageOf(err), startTime);
+    }
+  }
+  /** Return declared operations for introspection and registry validation. */
+  getSupportedOperations() {
+    return {
+      query: ["auth-url", "list", "status"],
+      mutate: ["connect", "exchange", "refresh", "revoke", "self-heal"]
+    };
+  }
+};
+function messageOf(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function expiryOf(params) {
+  return typeof params?.expiresAt === "string" ? params.expiresAt : null;
+}
+function buildConnectParams(provider, label, params, token) {
+  const refreshToken = typeof params?.refreshToken === "string" ? params.refreshToken : void 0;
+  const scopes = Array.isArray(params?.scopes) ? params.scopes.filter((s) => typeof s === "string") : void 0;
+  return {
+    provider,
+    label,
+    tokens: { accessToken: token, ...refreshToken !== void 0 ? { refreshToken } : {} },
+    ...scopes !== void 0 ? { scopes } : {},
+    ...typeof params?.expiresAt === "string" ? { expiresAt: params.expiresAt } : {}
+  };
+}
+function buildExchangeOpts(params, code, label) {
+  const codeVerifier = typeof params?.codeVerifier === "string" ? params.codeVerifier : void 0;
+  const redirectUri = typeof params?.redirectUri === "string" ? params.redirectUri : void 0;
+  if (codeVerifier === void 0 || redirectUri === void 0) return null;
+  return { code, codeVerifier, redirectUri, label };
+}
+function toHealthView(v) {
+  const expired = v.status === "expired" || v.expiresAt !== null && Number.isFinite(Date.parse(v.expiresAt)) && Date.parse(v.expiresAt) <= Date.now();
+  return {
+    provider: v.provider,
+    label: v.label,
+    status: v.status,
+    expiresAt: v.expiresAt,
+    expired,
+    needsRefresh: expired && v.hasCredentials,
+    hasCredentials: v.hasCredentials
+  };
+}
+export {
+  ServiceHandler
+};
+//# sourceMappingURL=service-GLOMZWPQ.js.map