@maadb/core 0.0.1 → 0.7.9

package/dist/backend/sqlite/schema.d.ts

@@ -0,0 +1,2 @@
+export declare const SCHEMA_SQL = "\n-- Documents table: one row per markdown file\nCREATE TABLE IF NOT EXISTS documents (\n  doc_id       TEXT PRIMARY KEY,\n  doc_type     TEXT NOT NULL,\n  schema_ref   TEXT NOT NULL,\n  file_path    TEXT NOT NULL UNIQUE,\n  file_hash    TEXT NOT NULL,\n  version      INTEGER NOT NULL DEFAULT 1,\n  deleted      INTEGER NOT NULL DEFAULT 0,\n  indexed_at   TEXT NOT NULL,\n  updated_at   TEXT NOT NULL DEFAULT ''\n);\nCREATE INDEX IF NOT EXISTS idx_documents_type ON documents(doc_type);\nCREATE INDEX IF NOT EXISTS idx_documents_path ON documents(file_path);\nCREATE INDEX IF NOT EXISTS idx_documents_deleted ON documents(deleted);\n\n-- Extracted objects table: inline annotations and indexed fields\nCREATE TABLE IF NOT EXISTS objects (\n  id               INTEGER PRIMARY KEY AUTOINCREMENT,\n  primitive        TEXT NOT NULL,\n  subtype          TEXT NOT NULL,\n  value            TEXT NOT NULL,\n  normalized_value TEXT,\n  label            TEXT NOT NULL,\n  role             TEXT,\n  doc_id           TEXT NOT NULL REFERENCES documents(doc_id) ON DELETE CASCADE,\n  source_line      INTEGER NOT NULL,\n  block_id         TEXT\n);\nCREATE INDEX IF NOT EXISTS idx_objects_primitive ON objects(primitive);\nCREATE INDEX IF NOT EXISTS idx_objects_subtype ON objects(subtype);\nCREATE INDEX IF NOT EXISTS idx_objects_value ON objects(value);\nCREATE INDEX IF NOT EXISTS idx_objects_doc_id ON objects(doc_id);\nCREATE INDEX IF NOT EXISTS idx_objects_normalized ON objects(normalized_value);\n\n-- Relationships table: edges between documents\nCREATE TABLE IF NOT EXISTS relationships (\n  id              INTEGER PRIMARY KEY AUTOINCREMENT,\n  source_doc_id   TEXT NOT NULL REFERENCES documents(doc_id) ON DELETE CASCADE,\n  target_doc_id   TEXT NOT NULL,\n  field           TEXT NOT NULL,\n  relation_type   TEXT NOT NULL CHECK(relation_type IN ('ref', 'mention'))\n);\nCREATE INDEX IF NOT EXISTS idx_rel_source ON relationships(source_doc_id);\nCREATE INDEX IF NOT EXISTS idx_rel_target ON relationships(target_doc_id);\nCREATE INDEX IF NOT EXISTS idx_rel_type ON relationships(relation_type);\n\n-- Blocks table: heading-delimited sections\nCREATE TABLE IF NOT EXISTS blocks (\n  id           INTEGER PRIMARY KEY AUTOINCREMENT,\n  doc_id       TEXT NOT NULL REFERENCES documents(doc_id) ON DELETE CASCADE,\n  block_id     TEXT,\n  heading      TEXT NOT NULL,\n  level        INTEGER NOT NULL,\n  start_line   INTEGER NOT NULL,\n  end_line     INTEGER NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_blocks_doc_id ON blocks(doc_id);\nCREATE INDEX IF NOT EXISTS idx_blocks_block_id ON blocks(block_id);\n\n-- Field index: denormalized frontmatter fields for fast filtering\nCREATE TABLE IF NOT EXISTS field_index (\n  id            INTEGER PRIMARY KEY AUTOINCREMENT,\n  doc_id        TEXT NOT NULL REFERENCES documents(doc_id) ON DELETE CASCADE,\n  field_name    TEXT NOT NULL,\n  field_value   TEXT,\n  numeric_value REAL,\n  field_type    TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_field_doc ON field_index(doc_id);\nCREATE INDEX IF NOT EXISTS idx_field_name_value ON field_index(field_name, field_value);\nCREATE INDEX IF NOT EXISTS idx_field_name_numeric ON field_index(field_name, numeric_value);\n\n-- Engine meta key/value store (0.7.4, fup-2026-093). Holds per-type schema\n-- index fingerprints so indexAll can detect \"indexed-field set changed since\n-- last run\" and force-rebuild affected types regardless of file-hash skip.\n-- Keys are namespaced (e.g. schema_index_fp:<doc_type>).\nCREATE TABLE IF NOT EXISTS engine_meta (\n  key   TEXT PRIMARY KEY,\n  value TEXT NOT NULL\n);\n";
+//# sourceMappingURL=schema.d.ts.map

package/dist/backend/sqlite/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/backend/sqlite/schema.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,UAAU,ohHAkFtB,CAAC"}

package/dist/backend/sqlite/schema.js

@@ -0,0 +1,88 @@
+// ============================================================================
+// SQLite Schema
+// CREATE TABLE statements and migrations for the MAAD backend.
+// ============================================================================
+export const SCHEMA_SQL = `
+-- Documents table: one row per markdown file
+CREATE TABLE IF NOT EXISTS documents (
+  doc_id       TEXT PRIMARY KEY,
+  doc_type     TEXT NOT NULL,
+  schema_ref   TEXT NOT NULL,
+  file_path    TEXT NOT NULL UNIQUE,
+  file_hash    TEXT NOT NULL,
+  version      INTEGER NOT NULL DEFAULT 1,
+  deleted      INTEGER NOT NULL DEFAULT 0,
+  indexed_at   TEXT NOT NULL,
+  updated_at   TEXT NOT NULL DEFAULT ''
+);
+CREATE INDEX IF NOT EXISTS idx_documents_type ON documents(doc_type);
+CREATE INDEX IF NOT EXISTS idx_documents_path ON documents(file_path);
+CREATE INDEX IF NOT EXISTS idx_documents_deleted ON documents(deleted);
+
+-- Extracted objects table: inline annotations and indexed fields
+CREATE TABLE IF NOT EXISTS objects (
+  id               INTEGER PRIMARY KEY AUTOINCREMENT,
+  primitive        TEXT NOT NULL,
+  subtype          TEXT NOT NULL,
+  value            TEXT NOT NULL,
+  normalized_value TEXT,
+  label            TEXT NOT NULL,
+  role             TEXT,
+  doc_id           TEXT NOT NULL REFERENCES documents(doc_id) ON DELETE CASCADE,
+  source_line      INTEGER NOT NULL,
+  block_id         TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_objects_primitive ON objects(primitive);
+CREATE INDEX IF NOT EXISTS idx_objects_subtype ON objects(subtype);
+CREATE INDEX IF NOT EXISTS idx_objects_value ON objects(value);
+CREATE INDEX IF NOT EXISTS idx_objects_doc_id ON objects(doc_id);
+CREATE INDEX IF NOT EXISTS idx_objects_normalized ON objects(normalized_value);
+
+-- Relationships table: edges between documents
+CREATE TABLE IF NOT EXISTS relationships (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  source_doc_id   TEXT NOT NULL REFERENCES documents(doc_id) ON DELETE CASCADE,
+  target_doc_id   TEXT NOT NULL,
+  field           TEXT NOT NULL,
+  relation_type   TEXT NOT NULL CHECK(relation_type IN ('ref', 'mention'))
+);
+CREATE INDEX IF NOT EXISTS idx_rel_source ON relationships(source_doc_id);
+CREATE INDEX IF NOT EXISTS idx_rel_target ON relationships(target_doc_id);
+CREATE INDEX IF NOT EXISTS idx_rel_type ON relationships(relation_type);
+
+-- Blocks table: heading-delimited sections
+CREATE TABLE IF NOT EXISTS blocks (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  doc_id       TEXT NOT NULL REFERENCES documents(doc_id) ON DELETE CASCADE,
+  block_id     TEXT,
+  heading      TEXT NOT NULL,
+  level        INTEGER NOT NULL,
+  start_line   INTEGER NOT NULL,
+  end_line     INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_blocks_doc_id ON blocks(doc_id);
+CREATE INDEX IF NOT EXISTS idx_blocks_block_id ON blocks(block_id);
+
+-- Field index: denormalized frontmatter fields for fast filtering
+CREATE TABLE IF NOT EXISTS field_index (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  doc_id        TEXT NOT NULL REFERENCES documents(doc_id) ON DELETE CASCADE,
+  field_name    TEXT NOT NULL,
+  field_value   TEXT,
+  numeric_value REAL,
+  field_type    TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_field_doc ON field_index(doc_id);
+CREATE INDEX IF NOT EXISTS idx_field_name_value ON field_index(field_name, field_value);
+CREATE INDEX IF NOT EXISTS idx_field_name_numeric ON field_index(field_name, numeric_value);
+
+-- Engine meta key/value store (0.7.4, fup-2026-093). Holds per-type schema
+-- index fingerprints so indexAll can detect "indexed-field set changed since
+-- last run" and force-rebuild affected types regardless of file-hash skip.
+-- Keys are namespaced (e.g. schema_index_fp:<doc_type>).
+CREATE TABLE IF NOT EXISTS engine_meta (
+  key   TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+`;
+//# sourceMappingURL=schema.js.map

package/dist/backend/sqlite/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/backend/sqlite/schema.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gBAAgB;AAChB,+DAA+D;AAC/D,+EAA+E;AAE/E,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkFzB,CAAC"}

package/dist/claude-md.d.ts

@@ -0,0 +1,2 @@
+export declare function generateClaudeMd(): string;
+//# sourceMappingURL=claude-md.d.ts.map

package/dist/claude-md.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-md.d.ts","sourceRoot":"","sources":["../src/claude-md.ts"],"names":[],"mappings":"AAKA,wBAAgB,gBAAgB,IAAI,MAAM,CA2FzC"}

package/dist/claude-md.js

@@ -0,0 +1,97 @@
+// ============================================================================
+// CLAUDE.md Generator — Agent instructions for MCP-first MAAD workflow
+// Generated on init. Tells the LLM how to work with this project.
+// ============================================================================
+export function generateClaudeMd() {
+    return `# MAAD Project — Agent Instructions
+
+## How to work with this project
+
+This is a MAAD project. You have MCP tools for all data operations.
+
+**Use MAAD MCP tools for everything.** Do not use bash, shell commands, or direct file reads for data access. If a tool fails, report the error — do not fall back to shell.
+
+## Boot sequence
+
+1. Run \`maad_summary\` to see what's in this project
+2. If summary shows **zero types and zero documents** → this is an empty project. Read \`_skills/architect-core.md\` and enter Architect mode to design and deploy the database.
+3. If summary shows existing types and documents → this is a live project. Proceed with normal operations below.
+4. Use \`maad_schema <type>\` to understand record structure before writing
+5. Use \`maad_health\` if something seems wrong
+
+## Empty project → Architect mode
+
+When this project has no types defined:
+1. Read \`_skills/architect-core.md\` for the full Architect role specification
+2. Read \`_skills/schema-guide.md\` for field type reference
+3. Read \`_skills/import-guide.md\` if importing existing data
+4. Follow the Architect workflow: discover requirements → design schema → present plan → build
+
+The Architect role handles: schema design, registry creation, data import, troubleshooting, and handoff to normal operations.
+
+## Live project → User mode
+
+### Reading data
+
+- \`maad_summary\` — project snapshot (start here)
+- \`maad_get\` — read a record (hot/warm/cold/full)
+- \`maad_query\` — find records by type, filters, and field projection
+- \`maad_search\` — find extracted objects across all records
+- \`maad_related\` — traverse relationships between records
+- \`maad_aggregate\` — count/sum/avg/min/max grouped by a field. Supports multi-hop ref chains (\`a->b->c\`) for cross-doctype aggregates. **Use instead of iterating records to compute totals.**
+- \`maad_join\` — query + follow refs + project fields from both sides in one call. **Use instead of \`query\` → \`get\` → \`get\` chains.**
+
+### Writing data
+
+- **Always** call \`maad_schema <type>\` before creating or updating records
+- \`maad_create\` — new record (engine validates against schema)
+- \`maad_update\` — modify fields or body (use expectedVersion for safe writes)
+- \`maad_bulk_create\` — create multiple records in one call (much faster for imports)
+- \`maad_bulk_update\` — update multiple records in one call
+- **Execute individual writes sequentially** — do not parallelize single create/update calls
+
+### Importing raw data
+
+When onboarding new data into this project:
+
+1. Read the raw files to understand the data
+2. Read \`_skills/architect-core.md\` for schema design guidance
+3. Design the registry and schemas
+4. Call \`maad_reload\` to pick up the new registry and schemas
+5. Create records using \`maad_create\` (master) or \`maad_update --append\` (transaction)
+6. Call \`maad_reindex\` after bulk creation
+7. Call \`maad_summary\` to confirm
+
+### Frontmatter format
+
+Every markdown record must have a YAML frontmatter header:
+
+\`\`\`yaml
+---
+doc_id: <unique-id>
+doc_type: <registered-type>
+schema: <type.version>
+field1: value1
+field2: value2
+---
+\`\`\`
+
+### Server management
+
+- \`maad_reload\` — reload registry and schemas after config changes (no restart needed)
+- \`maad_health\` — check engine status
+- \`maad_reindex\` — rebuild index after bulk file changes
+
+## Rules
+
+1. MCP tools only — no bash for data operations
+2. Schema first — call \`maad_schema\` before writes
+3. Reload after config changes — call \`maad_reload\` after editing registry or schemas
+4. Sequential writes — never parallelize create/update/delete operations
+5. Report errors — if a tool returns \`ok: false\`, report what happened
+6. Empty project = Architect mode — read the skill files and design the database
+7. Use \`maad_aggregate\` for group-by totals — don't page through records to compute counts, sums, or averages. Ref chains like \`client->industry\` enable cross-doctype groupings in one call.
+8. Use \`maad_join\` to follow refs and collect fields in one call — don't chain query/get loops.
+`;
+}
+//# sourceMappingURL=claude-md.js.map

package/dist/claude-md.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-md.js","sourceRoot":"","sources":["../src/claude-md.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uEAAuE;AACvE,kEAAkE;AAClE,+EAA+E;AAE/E,MAAM,UAAU,gBAAgB;IAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyFR,CAAC;AACF,CAAC"}

package/dist/cli/commands/audit.d.ts

@@ -0,0 +1,4 @@
+import type { CliContext } from '../helpers.js';
+export declare function cmdHistory(ctx: CliContext): Promise<void>;
+export declare function cmdAudit(ctx: CliContext): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/cli/commands/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/audit.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB/D;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB7D"}

package/dist/cli/commands/audit.js

@@ -0,0 +1,39 @@
+// ============================================================================
+// Audit commands — history, audit
+// ============================================================================
+import { docId } from '../../types.js';
+import { initEngine } from '../helpers.js';
+export async function cmdHistory(ctx) {
+    const id = ctx.args[1];
+    if (!id) {
+        console.error('Usage: maad history <doc_id>');
+        process.exit(1);
+    }
+    const engine = await initEngine(ctx);
+    const result = await engine.history(docId(id));
+    if (!result.ok) {
+        console.error('History failed:');
+        for (const e of result.errors)
+            console.error(`  ${e.code}: ${e.message}`);
+        engine.close();
+        process.exit(1);
+    }
+    console.log(JSON.stringify(result.value, null, 2));
+    engine.close();
+}
+export async function cmdAudit(ctx) {
+    const sinceIdx = ctx.args.indexOf('--since');
+    const since = sinceIdx >= 0 ? ctx.args[sinceIdx + 1] : undefined;
+    const engine = await initEngine(ctx);
+    const result = await engine.audit(since ? { since } : {});
+    if (!result.ok) {
+        console.error('Audit failed:');
+        for (const e of result.errors)
+            console.error(`  ${e.code}: ${e.message}`);
+        engine.close();
+        process.exit(1);
+    }
+    console.log(JSON.stringify(result.value, null, 2));
+    engine.close();
+}
+//# sourceMappingURL=audit.js.map

package/dist/cli/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/cli/commands/audit.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAe;IAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAe;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC"}

package/dist/cli/commands/auth.d.ts

@@ -0,0 +1,8 @@
+interface AuthCliOptions {
+    instancePath: string | undefined;
+    args: string[];
+}
+/** Shared dispatcher — called from the top-level CLI router. */
+export declare function cmdAuth(opts: AuthCliOptions): Promise<void>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/cli/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":"AAuBA,UAAU,cAAc;IACtB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,gEAAgE;AAChE,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBjE"}

package/dist/cli/commands/auth.js

@@ -0,0 +1,242 @@
+// ============================================================================
+// CLI auth subcommands — 0.7.0 Scoped Auth & Identity (P3)
+//
+//   maad auth issue-token   --role=... --projects=... [--name] [--agent]
+//                            [--user] [--expires]
+//   maad auth revoke-token  --id=tok-...
+//   maad auth rotate-token  --id=tok-...
+//   maad auth list-tokens   [--include-revoked]
+//   maad auth show-token    --id=tok-...
+//
+// All commands operate on `<instance-root>/_auth/tokens.yaml`. Requires
+// --instance (or MAAD_INSTANCE env) — synthetic single-project mode has no
+// token registry. Plaintext is printed ONCE to stdout at issue/rotate time
+// and never again recoverable from the registry.
+// ============================================================================
+import path from 'node:path';
+import { loadInstance } from '../../instance/config.js';
+import { TokenStore } from '../../auth/token-store.js';
+import { tokenId } from '../../auth/types.js';
+/** Shared dispatcher — called from the top-level CLI router. */
+export async function cmdAuth(opts) {
+    const sub = opts.args[1];
+    if (!sub) {
+        printAuthHelp();
+        return;
+    }
+    const store = await openStore(opts.instancePath);
+    switch (sub) {
+        case 'issue-token':
+            await cmdIssue(store, opts.args.slice(2));
+            break;
+        case 'revoke-token':
+            await cmdRevoke(store, opts.args.slice(2));
+            break;
+        case 'rotate-token':
+            await cmdRotate(store, opts.args.slice(2));
+            break;
+        case 'list-tokens':
+            cmdList(store, opts.args.slice(2));
+            break;
+        case 'show-token':
+            cmdShow(store, opts.args.slice(2));
+            break;
+        case 'help':
+        case '--help':
+        case '-h':
+            printAuthHelp();
+            break;
+        default:
+            console.error(`Unknown auth subcommand: ${sub}`);
+            printAuthHelp();
+            process.exit(1);
+    }
+}
+// --- Individual handlers ---------------------------------------------------
+async function cmdIssue(store, args) {
+    const flags = parseFlags(args);
+    const role = flags['role'];
+    const projectsRaw = flags['projects'];
+    if (!role || !projectsRaw) {
+        console.error('Usage: maad auth issue-token --role=<reader|writer|admin> --projects=<csv-or-*> [--name=<label>] [--agent=<id>] [--user=<id>] [--expires=<iso>]');
+        process.exit(1);
+    }
+    if (role !== 'reader' && role !== 'writer' && role !== 'admin') {
+        console.error(`--role must be reader|writer|admin (got "${role}")`);
+        process.exit(1);
+    }
+    const projects = parseProjects(projectsRaw);
+    const spec = { role: role, projects };
+    if (flags['name'])
+        spec.name = flags['name'];
+    if (flags['agent'])
+        spec.agentId = flags['agent'];
+    if (flags['user'])
+        spec.userId = flags['user'];
+    if (flags['expires'])
+        spec.expiresAt = flags['expires'];
+    const result = await store.issue(spec);
+    if (!result.ok) {
+        console.error('issue-token failed:');
+        for (const e of result.errors)
+            console.error(`  ${e.code}: ${e.message}`);
+        process.exit(1);
+    }
+    // Plaintext on stdout ONCE; record metadata as structured stderr note so
+    // scripts can `maad auth issue-token ... | tee -a client.token`.
+    console.log(result.value.plaintext);
+    console.error('\n⚠️  Store this token now — it will not be shown again.');
+    console.error('Record:');
+    console.error(JSON.stringify(result.value.record, null, 2));
+}
+async function cmdRevoke(store, args) {
+    const flags = parseFlags(args);
+    const id = flags['id'];
+    if (!id) {
+        console.error('Usage: maad auth revoke-token --id=<tok-xxx>');
+        process.exit(1);
+    }
+    const result = await store.revoke(tokenId(id));
+    if (!result.ok) {
+        console.error('revoke-token failed:');
+        for (const e of result.errors)
+            console.error(`  ${e.code}: ${e.message}`);
+        process.exit(1);
+    }
+    console.log(JSON.stringify(result.value, null, 2));
+}
+async function cmdRotate(store, args) {
+    const flags = parseFlags(args);
+    const id = flags['id'];
+    if (!id) {
+        console.error('Usage: maad auth rotate-token --id=<tok-xxx>');
+        process.exit(1);
+    }
+    const result = await store.rotate(tokenId(id));
+    if (!result.ok) {
+        console.error('rotate-token failed:');
+        for (const e of result.errors)
+            console.error(`  ${e.code}: ${e.message}`);
+        process.exit(1);
+    }
+    console.log(result.value.plaintext);
+    console.error('\n⚠️  Store this new token — old token is revoked and will not be shown again.');
+    console.error('New record:');
+    console.error(JSON.stringify(result.value.record, null, 2));
+}
+function cmdList(store, args) {
+    const flags = parseFlags(args);
+    const includeRevoked = flags['include-revoked'] !== undefined;
+    const list = store.list().filter(r => includeRevoked || r.revokedAt === undefined);
+    // Strip the hash from listing output — consumers never need to see it.
+    const sanitized = list.map(r => { const { hash, ...rest } = r; void hash; return rest; });
+    console.log(JSON.stringify(sanitized, null, 2));
+}
+function cmdShow(store, args) {
+    const flags = parseFlags(args);
+    const id = flags['id'];
+    if (!id) {
+        console.error('Usage: maad auth show-token --id=<tok-xxx>');
+        process.exit(1);
+    }
+    const record = store.lookupById(tokenId(id));
+    if (!record) {
+        console.error(`show-token: TOKEN_NOT_FOUND: No token with id ${id}`);
+        process.exit(1);
+    }
+    const { hash, ...rest } = record;
+    void hash;
+    console.log(JSON.stringify(rest, null, 2));
+}
+// --- Helpers ---------------------------------------------------------------
+async function openStore(instancePath) {
+    if (!instancePath) {
+        console.error('auth commands require --instance <path> (or MAAD_INSTANCE env)');
+        console.error('Legacy --project single-project mode has no token registry.');
+        process.exit(1);
+    }
+    // Validate the instance file exists + is parseable; we don't need the instance
+    // itself but want a clean error if the operator pointed at a wrong path.
+    const instance = await loadInstance(instancePath);
+    if (!instance.ok) {
+        console.error('Failed to load instance:');
+        for (const e of instance.errors)
+            console.error(`  ${e.code}: ${e.message}`);
+        process.exit(1);
+    }
+    const instanceRoot = path.dirname(path.resolve(instancePath));
+    const loaded = await TokenStore.load(instanceRoot);
+    if (!loaded.ok) {
+        console.error('Failed to load token registry:');
+        for (const e of loaded.errors)
+            console.error(`  ${e.code}: ${e.message}`);
+        process.exit(1);
+    }
+    return loaded.value;
+}
+function parseFlags(args) {
+    const out = {};
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.startsWith('--')) {
+            const eq = a.indexOf('=');
+            if (eq > 0) {
+                const key = a.slice(2, eq);
+                const val = a.slice(eq + 1);
+                out[key] = val;
+            }
+            else {
+                const key = a.slice(2);
+                const next = args[i + 1];
+                if (next !== undefined && !next.startsWith('--')) {
+                    out[key] = next;
+                    i++;
+                }
+                else {
+                    out[key] = '';
+                }
+            }
+        }
+    }
+    return out;
+}
+function parseProjects(raw) {
+    return raw.split(',').map(s => s.trim()).filter(Boolean).map(entry => {
+        // Support per-project role syntax: `proj-a:reader`
+        const colon = entry.indexOf(':');
+        if (colon > 0) {
+            const name = entry.slice(0, colon);
+            const role = entry.slice(colon + 1);
+            if (role !== 'reader' && role !== 'writer' && role !== 'admin') {
+                console.error(`Invalid per-project role "${role}" in --projects; expected reader|writer|admin`);
+                process.exit(1);
+            }
+            return { name, role: role };
+        }
+        return { name: entry };
+    });
+}
+function printAuthHelp() {
+    console.error(`maad auth — token registry operations
+
+Subcommands:
+  issue-token   --role=... --projects=... [--name] [--agent] [--user] [--expires]
+  revoke-token  --id=tok-...
+  rotate-token  --id=tok-...
+  list-tokens   [--include-revoked]
+  show-token    --id=tok-...
+
+All commands require --instance <path> (or MAAD_INSTANCE env) pointing at the
+instance config. Registry lives at <instance-root>/_auth/tokens.yaml.
+
+Examples:
+  maad --instance /etc/maad/instance.yaml auth issue-token \\
+       --role=admin --name='brain-app-gateway' --projects='*' --agent=agt-brain-app
+
+  maad --instance /etc/maad/instance.yaml auth issue-token \\
+       --role=writer --projects='proj-a,proj-b:reader' --agent=agt-scoped
+
+  maad --instance /etc/maad/instance.yaml auth rotate-token --id=tok-abc123
+`);
+}
+//# sourceMappingURL=auth.js.map

package/dist/cli/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2DAA2D;AAC3D,EAAE;AACF,yEAAyE;AACzE,kDAAkD;AAClD,yCAAyC;AACzC,yCAAyC;AACzC,gDAAgD;AAChD,yCAAyC;AACzC,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,iDAAiD;AACjD,+EAA+E;AAE/E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAQ9C,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,aAAa,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,aAAa;YAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM;QACtE,KAAK,cAAc;YAAE,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM;QACvE,KAAK,cAAc;YAAE,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM;QACvE,KAAK,aAAa;YAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM;QAC/D,KAAK,YAAY;YAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM;QAC/D,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,aAAa,EAAE,CAAC;YAChB,MAAM;QACR;YACE,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;YACjD,aAAa,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,KAAK,UAAU,QAAQ,CAAC,KAAiB,EAAE,IAAc;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,iJAAiJ,CAAC,CAAC;QACjK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,4CAA4C,IAAI,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAc,EAAE,IAAI,EAAE,IAAY,EAAE,QAAQ,EAAE,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAiB,EAAE,IAAc;IACxD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAiB,EAAE,IAAc;IACxD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAChG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,KAAiB,EAAE,IAAc;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,SAAS,CAAC;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACnF,uEAAuE;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,KAAiB,EAAE,IAAc;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IACjC,KAAK,IAAI,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAE9E,KAAK,UAAU,SAAS,CAAC,YAAgC;IACvD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChF,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;oBAChB,CAAC,EAAE,CAAC;gBACN,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACnE,mDAAmD;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC/D,OAAO,CAAC,KAAK,CAAC,6BAA6B,IAAI,+CAA+C,CAAC,CAAC;gBAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAY,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;CAoBf,CAAC,CAAC;AACH,CAAC"}

package/dist/cli/commands/discover.d.ts

@@ -0,0 +1,5 @@
+import type { CliContext } from '../helpers.js';
+export declare function cmdScan(ctx: CliContext): Promise<void>;
+export declare function cmdSummary(ctx: CliContext): Promise<void>;
+export declare function cmdDescribe(ctx: CliContext): Promise<void>;
+//# sourceMappingURL=discover.d.ts.map

package/dist/cli/commands/discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/discover.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,wBAAsB,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B5D;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/D;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhE"}

package/dist/cli/commands/discover.js

@@ -0,0 +1,48 @@
+// ============================================================================
+// Discover commands — scan, summary, describe
+// ============================================================================
+import path from 'node:path';
+import { scanFile, scanDirectory } from '../../scanner.js';
+import { initEngine } from '../helpers.js';
+export async function cmdScan(ctx) {
+    const target = ctx.args[1];
+    if (!target) {
+        console.error('Usage: maad scan <file.md|directory>');
+        process.exit(1);
+    }
+    const absTarget = path.resolve(target);
+    const { statSync } = await import('node:fs');
+    let stat;
+    try {
+        stat = statSync(absTarget);
+    }
+    catch {
+        console.error(`Not found: ${absTarget}`);
+        process.exit(1);
+    }
+    if (stat.isFile()) {
+        const result = await scanFile(absTarget);
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else if (stat.isDirectory()) {
+        const result = await scanDirectory(absTarget);
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        console.error('Target must be a file or directory');
+        process.exit(1);
+    }
+}
+export async function cmdSummary(ctx) {
+    const engine = await initEngine(ctx);
+    const result = engine.summary();
+    console.log(JSON.stringify(result, null, 2));
+    engine.close();
+}
+export async function cmdDescribe(ctx) {
+    const engine = await initEngine(ctx);
+    const desc = engine.describe();
+    console.log(JSON.stringify(desc, null, 2));
+    engine.close();
+}
+//# sourceMappingURL=discover.js.map

package/dist/cli/commands/discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/cli/commands/discover.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8CAA8C;AAC9C,+EAA+E;AAE/E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAe;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAE7C,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAe;IAC9C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAe;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC"}

package/dist/cli/commands/maintain.d.ts

@@ -0,0 +1,6 @@
+import type { CliContext } from '../helpers.js';
+export declare function cmdInit(ctx: CliContext): Promise<void>;
+export declare function cmdValidate(ctx: CliContext): Promise<void>;
+export declare function cmdReindex(ctx: CliContext): Promise<void>;
+export declare function cmdParse(ctx: CliContext): Promise<void>;
+//# sourceMappingURL=maintain.d.ts.map

package/dist/cli/commands/maintain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintain.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/maintain.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,wBAAsB,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAsD5D;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhE;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD/D;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC7D"}