@intutic/cli 2.5.0 → 2.5.1

package/dist/commands/sops.d.ts

@@ -1,74 +1,85 @@
+/**
+ * What `sops push <name>` reads: the folder `.intutic/sops/<name>/` when
+ * there is one, else the single file `.intutic/sops/<name>.md` (or `<name>`
+ * given with its `.md`). The file form is the layout `sops pull` writes and
+ * the proxy enforces, so a pulled, edited SOP pushes back by its file name.
+ */
+export declare function resolvePushTarget(sopsRoot: string, name: string): Promise<{
+    dir: string;
+    files: string[];
+} | {
+    error: string;
+}>;
 /**
  * `intutic sops push <name>` — one control-plane SOP per file under
- * `.intutic/sops/<name>/*.md`, each carrying that file's own declared
- * `title:`/`risk_tier:`/`version:` front matter rather than the folder's
- * name and two hardcoded constants.
+ * `.intutic/sops/<name>/*.md` (or the single file `.intutic/sops/<name>.md`),
+ * each carrying that file's own declared `title:`/`risk_tier:`/`version:`
+ * front matter.
  *
- * Previously concatenated every file in the folder into one blob under one
- * title derived from the folder name, and always sent `risk_tier: 'LOW'`,
- * `version: '1.0.0'` regardless of what the files declared — a folder of
- * five SOPs at five different risk tiers pushed as one LOW-tier SOP whose
- * title named none of them. Per-file push is what the DB plane can actually
- * represent faithfully: `sop_registry` has no concept of "a folder of SOPs,"
- * only individual rows.
+ * A file that records the SOP it was synced with (`intutic_id:`, written by
+ * `sops pull` and by a previous push) updates that SOP in place through
+ * `PUT /api/v1/sops/:id`, the same edit path as the dashboard: a DRAFT is
+ * edited in place, and an approved SOP gets a new DRAFT version while the
+ * approved one keeps enforcing until the draft is promoted. The recorded
+ * `intutic_revision:` goes along as `version_counter`, so an edit made on the
+ * server since the file was synced is refused (409) instead of overwritten;
+ * `--force` sends the server's current counter instead. A file with no record
+ * creates a new SOP. Either way, a successful push writes the SOP's id and
+ * counter back into the file's front matter (a forked DRAFT's id, when the
+ * edit forked one), keeping every other line of the file.
  *
- * Front matter is stripped before the body is sent as `markdownContent` —
- * `formatOrgSopConstraints` in `routes/judge.ts` interpolates that field
- * verbatim into the judge's system prompt, and a `---\nrisk_tier: HIGH\n---`
- * block in the middle of it is noise no judge prompt should carry.
- * Declarative enforcement keys (`deny_tools:`, `requires_before:`, ...) have
- * no `sop_registry` column, so they are lost from the DB-plane row exactly
- * as they always were — this fixes what already had somewhere to go
- * (title, risk tier, version), not what does not.
+ * Front matter is stripped before the body is sent as `markdown_content` —
+ * the judge reads that field verbatim. Declarative enforcement keys
+ * (`deny_tools:`, `requires_before:`, ...) have no `sop_registry` column, so
+ * they stay file-plane only.
  */
 export declare function runSopsPush(name: string, opts: {
     dev?: boolean;
     org?: boolean;
+    force?: boolean;
+    create?: boolean;
 }): Promise<void>;
 /**
- * `intutic sops pull` — the round trip `push` never had: every workspace SOP
- * on the control plane, written to `.intutic/sops/<slug-of-title>.md` with
- * front matter reconstructed from the row (`title:`, `risk_tier:`,
- * `version:`).
+ * `intutic sops pull` — every workspace SOP on the control plane, written
+ * with front matter reconstructed from the row (`title:`, `risk_tier:`,
+ * `version:`) plus the sync record `sops push` reads: `intutic_id:` (the
+ * SOP) and `intutic_revision:` (its `version_counter`).
+ *
+ * A SOP lands in the local file that already records its id — flat or in a
+ * `<name>/` folder — and otherwise in `.intutic/sops/<slug-of-title>.md`. An
+ * existing file keeps its other front-matter lines (the enforcing keys the
+ * proxy reads); only the synced keys and the body are replaced. An approved
+ * version is skipped when a local file already tracks its DRAFT successor,
+ * so a push that forked a draft does not come back as a second file.
  *
  * Refuses to overwrite a file it did not itself write most recently, unless
  * `--force` is passed. The check is a recorded hash, not a live diff: every
- * file this command writes carries `content_hash: sha256(body)` in its own
- * front matter (see `renderSopFile`), and a later pull compares that
- * recorded value against the CURRENT local body's hash — not against the
- * control plane's. A mismatch means a human edited the file since the last
- * pull; a match means nothing local changed, so pulling fresh content from
- * the plane (which may itself have changed) is safe. A file with no
- * recorded hash at all — hand-authored, or only ever pushed — is treated as
- * unverifiable and always requires `--force`, since overwriting a
- * hand-written SOP the first time this command sees it would be the
- * expensive direction to get wrong.
+ * file this command writes carries `content_hash: sha256(body)`, and a later
+ * pull compares that against the CURRENT local body's hash. A mismatch means
+ * a human edited the file since; a file with no recorded hash at all —
+ * hand-authored — is treated as unverifiable and always requires `--force`.
  */
 export declare function runSopsPull(opts: {
     dev?: boolean;
     force?: boolean;
 }): Promise<void>;
 /**
- * `intutic sops status` — drift between `.intutic/sops/*.md` and the
- * control plane, read-only against the file system (the comparison itself
- * never writes a local file).
+ * `intutic sops status` — drift between the local SOP files (flat and
+ * `<name>/` folders) and the control plane, read-only against the file
+ * system.
  *
- * Matched by title, the same heuristic `pull` uses to name files: neither
- * plane has a stable identifier the other side carries (a pushed file has
- * no `sopId` until after the fact; a filename is not a title). A file
- * `pull` has never touched carries no `content_hash:` marker, so this
- * cannot tell "hand-authored, never pushed" apart from "hand-authored,
- * edited after an old pull" — both report `diverged` rather than guessing.
+ * A file that records its SOP (`intutic_id:`) is compared with that SOP; a
+ * file without one is matched by title, the heuristic `pull` used before
+ * files carried ids. `intutic_revision:` tells whether the server moved since
+ * the file was synced, so a file edited on both sides reports `diverged`
+ * rather than `local-ahead`. A file with no `content_hash:` marker cannot be
+ * told apart as "never pulled" or "edited after an old pull", so it reports
+ * `diverged` when its content differs.
  *
- * The comparison itself is computed entirely client-side, same as always.
- * What's new: once computed, every matched (non-`push-only`) result is
- * reported to `POST /api/v1/sops/git-drift-report`, best-effort — a live
- * sync-daemon reconciliation loop is still not attempted here (still "a
- * second project", per `apps/docs/guide/gitops-sops.md`), but a human or CI
- * job running this command on a schedule now leaves the compliance probe
- * (`sop_git_drift`) something to read instead of nothing. Report failures
- * never fail the command — the read-only status output above is already
- * complete and correct on its own.
+ * Every matched (non-`push-only`) result is reported to
+ * `POST /api/v1/sops/git-drift-report`, best-effort, so the compliance probe
+ * (`sop_git_drift`) has something to read. Report failures never fail the
+ * command.
  */
 export declare function runSopsStatus(opts: {
     dev?: boolean;

package/dist/commands/sops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/commands/sops.ts"],"names":[],"mappings":"AAsBA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoGrG;AAeD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EzF;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgG1E;AAUD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB3E;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3F"}
+{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/commands/sops.ts"],"names":[],"mappings":"AA6BA;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB/D;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACxE,OAAO,CAAC,IAAI,CAAC,CAgCf;AAiWD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+GzF;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoG1E;AAUD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB3E;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAa3F"}