@farthershore/cli 0.35.0 → 0.37.0

package/CHANGELOG.md

@@ -1,9 +1,98 @@
 # Changelog — @farthershore/cli
 
-All notable changes to the `farthershore` CLI and its MCP server
-(`farthershore-mcp`) are documented here. The CLI versions independently from
-the SDKs. Pre-1.0: minor versions may include breaking changes. Releases
-before 0.35.0 are recorded only in the git history.
+All notable changes to the `farthershore` CLI are documented here. The CLI
+versions independently from the SDKs. Pre-1.0: minor versions may include
+breaking changes. Releases before 0.35.0 are recorded only in the git history.
+
+## [Unreleased]
+
+## [0.37.0] - 2026-10-14
+
+### Changed
+
+- `business status` reports `serving` (`status`, `coherent`, `message`) in
+  place of `edgeCoherence` (no generations, epochs or digests), and
+  `latestDeployment.publishStatus` in place of `edgePublishStatus`.
+  `business routes` lists each route once (no compiled row id);
+  `business contract` and `business config-attempts` print the closed public
+  shapes (no raw proposal text or payload). `validate --business` no longer
+  echoes the server's spec hash; a failure's `irHash` is the locally built IR's.
+- `auth whoami` no longer prints a maker token's `authVersion` or a dashboard
+  session's identity-provider user id.
+- `agents`, `bulletin`, `automation`, `knowledge`, `resource-count`,
+  `denial`, `dependents` and `workflow-control` print the closed public
+  shapes: an agent run names a failure by code with a fixed message and
+  carries no trace object key; a denial carries no internal decision or ledger
+  ids; a rollback preview reports `currentCommitSha`.
+- The webhook commands print only the public webhook fields. Every endpoint
+  result carries the same fields (`failCount`, `disabledAt` and `updatedAt`
+  included); the signing secret appears only in `webhook create`,
+  `webhook rotate` and `webhook listen --print-secret`. A delivery's
+  `status` is `pending`, `success`, `failed` or `dead`, and `webhook test` /
+  `webhook trigger` results (and their `WEBHOOK_DELIVERY_FAILED` /
+  `WEBHOOK_REDIRECTED` errors) carry `deliveryId`, null when the attempt
+  could not be recorded.
+- New `webhook delivery <business> <webhookId> <deliveryId>` shows one
+  delivery's status, attempts and HTTP status.
+- `analytics log` events carry `request` (path, status code, subscriber, deny
+  code, gateway / backend timing) instead of the raw archived `payload`.
+  `usage summary` reports `activeApiKeys` (was `activeRuntimeKeys`) and no
+  business id. `stripe status` no longer prints the Stripe account id, and
+  `source` reads `business` | `organization`. `tax-settings show|update` print
+  `{ status, defaults: { taxBehavior, taxCode }, headOffice, missingFields }`
+  instead of the payment provider's settings object. `plan list` reads the
+  plan's `kind` and `isActive`.
+- `variables` mutations and `variables status` print the public operation
+  (no `mutationId`, `state` or `result`; `impact` is integrations and
+  subscriber count; a failed attempt shows fixed copy; `generation` is
+  `version`, also on `variables list`). `frontend status`
+  prints `activeReleaseId` and each build's `releaseId`; `frontend rollback`
+  prints the release now serving with its `environmentId`.
+
+- `agreements`, `promo-code` and `persona` print the closed public shapes:
+  no payment-provider ids on promo codes, no plan-version, user or membership
+  ids on personas, and `agreements pins` names the plan by key and version.
+- `apply-timeline list` / `inspect` print the public entry: no build id, IR
+  hash or internal trigger; apply phases are `publish` and `billing`, and a
+  failed platform step reads as a code plus the id to quote to support.
+  `proposal create|preview|list|get` print the public ChangeSet (no rollback
+  plan, correlation id or simulation fingerprint; `resetReason` replaces
+  `failureReason`), and `proposal create --dry-run` prints what it would record.
+  An unknown `--env` name on the `apply-timeline` and `proposal` commands now
+  fails with `ENVIRONMENT_NOT_FOUND` (apply-timeline used to show production
+  entries).
+- `env create` prints the full environment (now including `portalHostname`)
+  with `created` and `branchCreated`, and says when the environment already
+  existed. A failed `env delete` reports which cleanup steps did not finish
+  (`runtime`, `docs`, `branch`) instead of the underlying error text.
+- `backend list` prints each backend's `status` straight from the server; the
+  backend and runtime-token commands print only the public fields (a backend's
+  internal origin host and raw provisioning / readiness state are no longer
+  returned). `backend tokens create` / `rotate` results carry `envVar` and the
+  one-time `token` as the server returns them.
+- `business show`, `business list` and the other business reads print only the
+  public business fields. Internal platform state the server used to include
+  (release and sync bookkeeping, accepted specs, frontend activation details,
+  …) is no longer returned.
+
+## [0.36.0] - 2026-10-13
+
+### Changed
+
+- **Breaking:** `farthershore create api` is now `farthershore backend scaffold`
+  (same flags), so it no longer reads like `farthershore api`. The top-level
+  `create` group is gone, and its error codes are renamed from `CREATE_API_*`
+  to `BACKEND_SCAFFOLD_*` (for example `BACKEND_SCAFFOLD_EXISTS`).
+- Every command calls the `@farthershore/client` operation surface directly;
+  command output and flags are unchanged.
+
+### Removed
+
+- **Breaking:** the local stdio MCP server and its `farthershore-mcp` binary
+  are gone. MCP launch configurations that run `farthershore-mcp` (or
+  `npx -p @farthershore/cli farthershore-mcp`) stop working on upgrade. Use
+  `farthershore code run` or `farthershore api` from an agent until the hosted
+  MCP server ships.
 
 ## [0.35.0] - 2026-10-12
 

package/README.md

@@ -3,7 +3,7 @@
 Create and operate [FartherShore](https://farthershore.com) software businesses
 from the terminal.
 
-**Status: `0.35.0`.** Pre-1.0 — the command surface is stable but may still
+**Status: `0.37.0`.** Pre-1.0 — the command surface is stable but may still
 change between minor versions. Pin an exact version in CI.
 
 FartherShore lets you define a software business as code, then sells, meters,
@@ -15,25 +15,18 @@ This CLI is the tool layer around that repo: provision a managed business repo,
 validate it locally before you push, inspect publication state, and run
 day-to-day operations (consumers, secrets, backends, webhooks, promo codes,
 usage). It is designed to be safe for both humans and agents — every command
-takes `--format json` for non-interactive scripting, and the MCP server exposes
-the explicitly agent-operable subset of the CLI surface.
+takes `--format json` for non-interactive scripting.
 
 ## Install
 
 ```bash
-npm install -g @farthershore/cli@0.35.0
+npm install -g @farthershore/cli@0.37.0
 ```
 
 Or run it directly with npx:
 
 ```bash
-npx -p @farthershore/cli@0.35.0 farthershore --help
-```
-
-The package also ships an MCP stdio server for agents:
-
-```bash
-npx -p @farthershore/cli@0.35.0 farthershore-mcp
+npx -p @farthershore/cli@0.37.0 farthershore --help
 ```
 
 ## Authentication
@@ -209,17 +202,17 @@ before pagination; the CLI does not sort or filter a partial page locally.
 Each command rejects fields outside its endpoint-specific allowlist shown by
 `--help`.
 
-### `farthershore create`
+### `farthershore backend scaffold`
 
-Create local project components inside a managed builder repo. `create api`
-scaffolds a starter backend into `api/` by downloading the public Node template
-tarball, then patches the repo root `.gitignore`.
+Scaffold a starter backend into `api/` inside a managed builder repo, by
+downloading the public Node template tarball, then patch the repo root
+`.gitignore`. It runs locally and needs no login.
 
 ```bash
-farthershore create api
-farthershore create api --path ../weather-api
-farthershore create api --force
-farthershore create api --node --ref v0.1.0 --format json
+farthershore backend scaffold
+farthershore backend scaffold --path ../weather-api
+farthershore backend scaffold --force
+farthershore backend scaffold --node --ref v0.1.0 --format json
 ```
 
 `--node` is the default language today: Node (TypeScript + Express). `--ref`
@@ -385,8 +378,7 @@ default, and `--org <id>` overrides it for one command.
 
 Create and administer organization-owned MakerTokens. These commands require a
 signed-in user CLI session (`farthershore login`); an existing MakerToken cannot
-list, mint, approve, rotate, revoke, or otherwise administer credentials. The
-entire group is CLI-only and is deliberately absent from `farthershore-mcp`.
+list, mint, approve, rotate, revoke, or otherwise administer credentials.
 
 ```bash
 # Exact permissions a human may delegate — read this before choosing --permissions.
@@ -470,8 +462,8 @@ never print `plaintext`. ACTIVE creates
 and rotations print the one-time key once. If one of these commands times out,
 run `service-account list` before trying again.
 
-This group is direct CLI-only and deliberately has no MCP projection: the MCP
-operation registry carries builder principals, not portal consumer sessions.
+This group is registered directly rather than through the operation registry:
+that registry carries builder principals, not portal consumer sessions.
 
 ### `farthershore limit`
 
@@ -522,8 +514,17 @@ portal renders locally exactly as it serves in production. Pass `--mock` to
 inject `{ mock: true }` instead of Core/Clerk config for local page inspection
 with placeholder data and auth bypassed.
 
+A build is published only when its output ships the SDK's managed sign-in.
+A refused build never replaces what is live; `frontend status` shows the
+reason, and `builds[].diagnostics[].code` is `FRONTEND_SIGN_IN_MISSING` (mount
+`<FartherShoreRoot>` and render `<FsSignIn />`) or `FRONTEND_SDK_TOO_OLD`
+(upgrade `@farthershore/farthershore-js`). `--wait` exits `BUILD_FAILED` with
+that code in `details.reasonCode`. Mock mode is for this local preview only: a
+hosted portal ignores it, and always uses the platform's sign-in.
+
 ```bash
 farthershore frontend status weather-api --format json
+farthershore frontend status weather-api --wait --ref <commitSha> --format json
 farthershore frontend rollback weather-api --release-id <hash> --yes --format json
 
 # Local preview (shells out to vite; needs a frontend/ project)
@@ -707,6 +708,7 @@ farthershore webhook update weather-api <webhookId> --disable --format json
 farthershore webhook test weather-api <webhookId> --format json
 farthershore webhook trigger weather-api <webhookId> --type payment.failed --format json
 farthershore webhook deliveries weather-api <webhookId> --limit 20 --format json
+farthershore webhook delivery weather-api <webhookId> <deliveryId> --format json
 farthershore webhook rotate weather-api <webhookId> --yes --format json
 farthershore webhook delete weather-api <webhookId> --yes --format json
 ```
@@ -719,6 +721,13 @@ in the receiving app. In human mode they also print it as an
 sends a signed, realistic sample of one catalog event (the deliveries log
 records it under that type) so every handler branch can be exercised locally.
 
+`webhook deliveries` lists recent attempts; `webhook delivery` shows one by its
+id (the `webhook-id` header your endpoint received, also the `deliveryId` that
+`webhook test` / `webhook trigger` return): its status, attempts, last HTTP
+status and when the next attempt is due. A `failed` delivery with no next
+attempt (a test send) is final. Neither returns the event payload or your
+endpoint's response body.
+
 For a receiver on your machine, `webhook listen` is the Stripe-CLI-style loop:
 it opens a Cloudflare quick tunnel to `--forward-to`, creates a temporary
 endpoint on it, prints the endpoint id / tunnel URL / (with `--print-secret`)
@@ -734,8 +743,8 @@ farthershore webhook listen weather-api --forward-to localhost:3000/webhooks \
 ```
 
 `listen` needs `cloudflared` — bundled as an optional
-`@farthershore/cloudflared-<platform>` dependency, or on your PATH. It has no
-MCP tool (long-running, process-owning). A listener killed hard leaves an
+`@farthershore/cloudflared-<platform>` dependency, or on your PATH. A listener
+killed hard leaves an
 endpoint with a `*.trycloudflare.com` URL; `webhook delete --yes` removes it.
 
 ### `farthershore promo-code`
@@ -763,18 +772,18 @@ Use `--all-plans` to clear plan scoping.
 Install or refresh the platform-verified skills bundle together. The platform
 pins this immutable release, and CI plus a daily repository check compare it to
 GitHub's latest stable release so the guidance cannot silently drift.
-This command requires `@farthershore/cli` 0.35.0 or newer.
+This command requires `@farthershore/cli` 0.37.0 or newer.
 
 ```bash
 set -euo pipefail
 CLI_VERSION=$(farthershore --version)
-printf '%s' "$CLI_VERSION" | node -e 'let v=""; process.stdin.on("data", c => v += c).on("end", () => { const m = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:\+[0-9A-Za-z.-]+)?$/.exec(v.trim()); if (!m || !(+m[1] > 0 || +m[2] > 35 || (+m[2] === 35 && +m[3] >= 0))) { console.error("Stop: CLI 0.35.0 or newer is required; ask the human to upgrade."); process.exitCode = 1; } })'
+printf '%s' "$CLI_VERSION" | node -e 'let v=""; process.stdin.on("data", c => v += c).on("end", () => { const m = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:\+[0-9A-Za-z.-]+)?$/.exec(v.trim()); if (!m || !(+m[1] > 0 || +m[2] > 37 || (+m[2] === 37 && +m[3] >= 0))) { console.error("Stop: CLI 0.37.0 or newer is required; ask the human to upgrade."); process.exitCode = 1; } })'
 farthershore skills install --help
 farthershore skills install
 ```
 
 If either prerequisite fails, stop and ask the human to run
-`npm install -g @farthershore/cli@0.35.0`, then repeat the checks.
+`npm install -g @farthershore/cli@0.37.0`, then repeat the checks.
 Do not install or upgrade global tooling autonomously.
 
 The Farther Shore CLI downloads the exact installer archive and verifies this
@@ -904,7 +913,8 @@ until, deadlineMs })`, `console`, `setTimeout` / `clearTimeout` and
 One-time secrets (minted or rotated credentials) come back to the script as
 `{ redacted: true, last4 }` unless you pass `--reveal-secrets`; a redacted
 secret cannot be shown again, so rotate with `--reveal-secrets` when you need
-the value. Other results pass the same credential masking as the MCP server.
+the value. In every other result, credential-shaped strings (tokens, API keys,
+JWTs) and known secret fields are masked before the script sees them.
 
 **Budgets:** `--max-calls` (200), `--max-writes` (20), `--timeout` (60s; `60`,
 `60s`, `500ms`, `2m`) and at most 4 calls in flight. Exceeding one stops the
@@ -973,25 +983,6 @@ MakerToken through `FARTHERSHORE_TOKEN`. Device login waits for human approval;
 `farthershore validate --local-only` need no network or auth and are safe to
 run in CI.
 
-## MCP server
-
-The MCP server (`farthershore-mcp`) projects its tools from the same operation
-registry that defines the CLI commands. Every MCP tool has a CLI sibling, but
-not every CLI command is exposed through MCP. Tool names use the `fs_*` prefix
-and cover only operations explicitly marked agent-operable in that registry.
-Organization, role, member, invitation, and org MakerToken administration
-requires a live-user CLI session and is not projected into MCP; audit logs,
-notifications, and apply timelines are also CLI-only.
-
-The server resolves its target exactly as the CLI does: the stored login,
-`FARTHERSHORE_API_URL` (else the configured API URL), and the organization
-linked to its working directory, else the one chosen with
-`farthershore auth organization use`.
-
-```bash
-farthershore-mcp
-```
-
 ## Learn more
 
 - Platform documentation: [farthershore.com](https://farthershore.com)