@nolto/cli 0.11.0 → 0.12.0

package/README.md

@@ -79,18 +79,25 @@ paths, and sends an idempotent full upsert to the bound project. A legacy
 `.roadmap/roadmap.json` is migrated by `nolto sync` when no canonical roadmap
 exists; `nolto watch` only warns and never migrates.
 
+Timestamp fields (`updatedAt`, `startedAt`, and `completedAt`) must be RFC 3339 with a timezone offset (`2026-09-02T10:00:00+09:00` or `2026-09-02T01:00:00Z`); offset-less and date-only values are rejected. `dependsOn` items must be unique strings matching `^[a-z0-9][a-z0-9._-]*$`, and names, titles, and IDs must be actual strings.
+
+The shared proxy rejects a sync request body over 10 MB with HTTP `413`. Free
+plan documents are already limited to 2 MB per roadmap before that shared cap.
+
 `watch` uses the repository registry maintained by `nolto init`. Missing registered
 repositories are skipped with a warning.
 The CLI warns when an installed `roadmap-progress` skill version differs from the
 CLI version; run `nolto init` in that repository to refresh it.
 
-Use `nolto diff [slug]` before pushing to review structural task, phase, and
-metadata differences. It exits with code 1 when differences are found and does
-not change either side. `nolto pull [slug]` downloads all server roadmaps, or one
-named roadmap, and intentionally overwrites the corresponding local files after
-validation. It never deletes local-only roadmaps. Add `--merge` to preserve valid
-local changes using a deterministic structural merge, and review the result with
-`git diff` before committing.
+Use `nolto diff [slug]` before pushing to compare task status changes, added or
+removed tasks and phases, and roadmap `updatedAt`, `currentTaskId`, and `summary`.
+It does not compare `title`, `note`, `plan`, `dependsOn`, project metadata, or
+ordering; use `git diff` for those. It exits with code 1 when differences are
+found and does not change either side. `nolto pull [slug]` downloads all server
+roadmaps, or one named roadmap, and intentionally overwrites the corresponding
+local files after validation. It never deletes local-only roadmaps. Add `--merge`
+to preserve valid local changes using a deterministic structural merge, and review
+the result with `git diff` before committing.
 
 ## Merging roadmap conflicts
 
@@ -109,6 +116,32 @@ again for an existing repository. Git invokes the underlying command as:
 nolto merge-file <ours> <theirs> --base <ancestor>
 ```
 
+### Silent resolution rules
+
+The merge driver emits no conflict markers and exits `0` unless the merged
+output fails validation, in which case it exits `1`. Resolution is deterministic:
+
+- For fields changed on both sides, the side with the newer `updatedAt` wins.
+- `currentTaskId` comes from the newer side while it still points to an
+  `in-progress` task; otherwise the older side's value is used if it still
+  points to an `in-progress` task, and it is omitted when neither does.
+- Task status priority is `done` (with `completedAt`) > `blocked` >
+  `in-progress` > `todo`.
+- `startedAt` keeps the earliest value, `completedAt` keeps the latest value,
+  and `dependsOn` is a deduplicated union.
+- A deletion is honored only when both sides deleted the item.
+- Phase order is ours first, followed by phases found only in theirs; phase
+  status is re-derived from the merged tasks.
+
+Full diff coverage and interactive conflict display are tracked in
+[#475](https://github.com/uruca-kk/nolto/issues/475).
+
+### Legacy roadmap schema v1
+
+Schema v1 remains accepted with a warning and has no sunset date. The next
+`roadmap-progress` mutation upgrades it to v2 automatically. This compatibility
+policy remains in place through CLI 1.0 and will be reconsidered then.
+
 The result is written to `<ours>` as required by Git. Use
 `nolto pull --merge [slug]` when the server has changes that should be combined
 with a valid local roadmap before syncing.
@@ -177,7 +210,7 @@ Errors are written to stderr:
 | 1 | Roadmap differences found (`nolto diff`) or unexpected command failure |
 | 2 | Local input or file validation error |
 | 3 | Authentication or authorization error |
-| 4 | Rate limit response |
+| 4 | Rate limit response, or plan / quota limit (HTTP 402) |
 | 5 | Network, DNS, or server error |
 
 ## License

package/dist/index.js

@@ -531,6 +531,7 @@ function normalizeRemote(raw) {
 // ../roadmap-schema/src/index.ts
 var STATUSES = /* @__PURE__ */ new Set(["todo", "in-progress", "done", "blocked"]);
 var ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+var DATE_TIME_PATTERN = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:[Zz]|([+-])(\d{2}):(\d{2}))$/;
 var ALLOWED_KEYS = {
   roadmap: /* @__PURE__ */ new Set(["schemaVersion", "project", "updatedAt", "currentTaskId", "summary", "phases"]),
   project: /* @__PURE__ */ new Set(["id", "name", "repository"]),
@@ -551,6 +552,39 @@ function isValidPlanPath(value) {
   if (value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:/.test(value)) return false;
   return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
 }
+function daysInMonth(year, month) {
+  if (month === 2) {
+    const leap = year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+    return leap ? 29 : 28;
+  }
+  return [4, 6, 9, 11].includes(month) ? 30 : 31;
+}
+function isValidDateTime(value) {
+  if (typeof value !== "string") return false;
+  const m = DATE_TIME_PATTERN.exec(value);
+  if (m === null) return false;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  const hour = Number(m[4]);
+  const minute = Number(m[5]);
+  const second = Number(m[6]);
+  if (month < 1 || month > 12) return false;
+  if (day < 1 || day > daysInMonth(year, month)) return false;
+  if (hour > 23 || minute > 59 || second > 59) return false;
+  if (m[7] !== void 0) {
+    const offsetHour = Number(m[8]);
+    const offsetMinute = Number(m[9]);
+    if (offsetHour > 23 || offsetMinute > 59) return false;
+  }
+  return true;
+}
+function validateDateTime(value, at) {
+  if (!isValidDateTime(value)) {
+    return [`${at} must be an RFC 3339 date-time with timezone offset, e.g. 2026-09-02T10:00:00+09:00.`];
+  }
+  return [];
+}
 function validatePlanPath(value, at) {
   if (typeof value !== "string" || value.length === 0) {
     return [`${at} must be a non-empty string.`];
@@ -586,10 +620,10 @@ function validateRoadmap(value) {
   const project = value["project"];
   checkKeys(project, ALLOWED_KEYS.project, "project", errors);
   const projectRecord = isRecord(project) ? project : {};
-  if (!ID_PATTERN.test(String(projectRecord["id"] ?? ""))) errors.push("project.id is invalid.");
-  if (projectRecord["name"] == null || projectRecord["name"] === "") errors.push("project.name is required.");
-  if (projectRecord["repository"] == null || projectRecord["repository"] === "") errors.push("project.repository is required.");
-  if (Number.isNaN(Date.parse(String(value["updatedAt"])))) errors.push("updatedAt must be a valid date-time.");
+  if (typeof projectRecord["id"] !== "string" || !ID_PATTERN.test(projectRecord["id"])) errors.push("project.id is invalid.");
+  if (typeof projectRecord["name"] !== "string" || projectRecord["name"].length === 0) errors.push("project.name must be a non-empty string.");
+  if (typeof projectRecord["repository"] !== "string" || projectRecord["repository"].length === 0) errors.push("project.repository must be a non-empty string.");
+  errors.push(...validateDateTime(value["updatedAt"], "updatedAt"));
   if (typeof value["summary"] !== "string") errors.push("summary must be a string.");
   if (!Array.isArray(value["phases"])) errors.push("phases must be an array.");
   const allIds = /* @__PURE__ */ new Set();
@@ -599,11 +633,14 @@ function validateRoadmap(value) {
     const at = `phases[${phaseIndex}]`;
     checkKeys(rawPhase, ALLOWED_KEYS.phase, at, errors);
     const phase = isRecord(rawPhase) ? rawPhase : {};
-    const phaseId = String(phase["id"] ?? "");
-    if (!ID_PATTERN.test(phaseId)) errors.push(`${at}.id is invalid.`);
-    if (allIds.has(phaseId)) errors.push(`Duplicate id "${phaseId}".`);
-    allIds.add(phaseId);
-    if (phase["title"] == null || phase["title"] === "") errors.push(`${at}.title is required.`);
+    const phaseId = typeof phase["id"] === "string" ? phase["id"] : "";
+    if (typeof phase["id"] !== "string" || !ID_PATTERN.test(phase["id"])) {
+      errors.push(`${at}.id is invalid.`);
+    } else {
+      if (allIds.has(phaseId)) errors.push(`Duplicate id "${phaseId}".`);
+      allIds.add(phaseId);
+    }
+    if (typeof phase["title"] !== "string" || phase["title"].length === 0) errors.push(`${at}.title must be a non-empty string.`);
     if (!STATUSES.has(String(phase["status"]))) errors.push(`${at}.status is invalid.`);
     checkPlan(phase["plan"], at, errors);
     if (!Array.isArray(phase["tasks"])) errors.push(`${at}.tasks must be an array.`);
@@ -612,34 +649,64 @@ function validateRoadmap(value) {
       const taskAt = `${at}.tasks[${taskIndex}]`;
       checkKeys(rawTask, ALLOWED_KEYS.task, taskAt, errors);
       const task = isRecord(rawTask) ? rawTask : {};
-      const taskId = String(task["id"] ?? "");
-      if (!ID_PATTERN.test(taskId)) errors.push(`${taskAt}.id is invalid.`);
-      if (allIds.has(taskId)) errors.push(`Duplicate id "${taskId}".`);
-      allIds.add(taskId);
-      tasks.set(taskId, task);
-      if (task["title"] == null || task["title"] === "") errors.push(`${taskAt}.title is required.`);
+      const taskId = typeof task["id"] === "string" ? task["id"] : "";
+      if (typeof task["id"] !== "string" || !ID_PATTERN.test(task["id"])) {
+        errors.push(`${taskAt}.id is invalid.`);
+      } else {
+        if (allIds.has(taskId)) errors.push(`Duplicate id "${taskId}".`);
+        allIds.add(taskId);
+        tasks.set(taskId, task);
+      }
+      if (typeof task["title"] !== "string" || task["title"].length === 0) errors.push(`${taskAt}.title must be a non-empty string.`);
       if (!STATUSES.has(String(task["status"]))) errors.push(`${taskAt}.status is invalid.`);
       checkPlan(task["plan"], taskAt, errors);
+      if (task["startedAt"] !== void 0 && task["startedAt"] !== null) {
+        errors.push(...validateDateTime(task["startedAt"], `${taskAt}.startedAt`));
+      }
+      if (task["completedAt"] !== void 0 && task["completedAt"] !== null) {
+        errors.push(...validateDateTime(task["completedAt"], `${taskAt}.completedAt`));
+      }
       if (task["status"] === "done" && task["completedAt"] == null) warnings.push(`${taskId} is done without completedAt.`);
       if (task["status"] === "in-progress" && task["startedAt"] == null) warnings.push(`${taskId} is in-progress without startedAt.`);
-      if (task["dependsOn"] !== void 0 && !Array.isArray(task["dependsOn"])) errors.push(`${taskAt}.dependsOn must be an array.`);
+      if (task["dependsOn"] !== void 0 && !Array.isArray(task["dependsOn"])) {
+        errors.push(`${taskAt}.dependsOn must be an array.`);
+      } else if (Array.isArray(task["dependsOn"])) {
+        const seenDeps = /* @__PURE__ */ new Set();
+        for (const [i, dep] of task["dependsOn"].entries()) {
+          if (typeof dep !== "string") {
+            errors.push(`${taskAt}.dependsOn[${i}] must be a string.`);
+            continue;
+          }
+          if (!ID_PATTERN.test(dep)) {
+            errors.push(`${taskAt}.dependsOn[${i}] is invalid.`);
+            continue;
+          }
+          if (seenDeps.has(dep)) errors.push(`${taskAt}.dependsOn contains duplicate id "${dep}".`);
+          seenDeps.add(dep);
+        }
+      }
     }
-    if (Array.isArray(phase["tasks"]) && STATUSES.has(String(phase["status"]))) {
+    if (Array.isArray(phase["tasks"]) && rawTasks.every(isRecord) && STATUSES.has(String(phase["status"]))) {
       const expected = derivePhaseStatus({ ...phase, tasks: rawTasks });
       if (phase["status"] !== expected) warnings.push(`${phaseId} status is ${String(phase["status"])}; task states derive ${expected}.`);
     }
   }
   for (const task of tasks.values()) {
     for (const dependency of task.dependsOn ?? []) {
+      if (typeof dependency !== "string") continue;
       if (!tasks.has(dependency)) warnings.push(`${task.id} depends on unknown task ${dependency}.`);
       if (task.id === dependency) errors.push(`${task.id} cannot depend on itself.`);
     }
   }
   const currentTaskId = value["currentTaskId"];
   if (currentTaskId !== null && currentTaskId !== void 0) {
-    const current = tasks.get(String(currentTaskId));
-    if (current == null) errors.push(`currentTaskId ${String(currentTaskId)} does not exist.`);
-    else if (current.status !== "in-progress") warnings.push(`currentTaskId ${String(currentTaskId)} is not in-progress.`);
+    if (typeof currentTaskId !== "string") {
+      errors.push("currentTaskId must be a string id or null.");
+    } else {
+      const current = tasks.get(currentTaskId);
+      if (current == null) errors.push(`currentTaskId ${String(currentTaskId)} does not exist.`);
+      else if (current.status !== "in-progress") warnings.push(`currentTaskId ${String(currentTaskId)} is not in-progress.`);
+    }
   }
   return { errors, warnings };
 }

package/dist/skill/roadmap-progress/SKILL.md

@@ -78,6 +78,7 @@ Use direct JSON edits to add, remove, rename, or reorder phases and tasks, then
 - Preserve task IDs across title changes so `dependsOn` remains stable.
 - Keep exactly one `currentTaskId`; it must point to an `in-progress` task. Use `null` when nothing is active.
 - Require `completedAt` for done tasks and `startedAt` for in-progress tasks.
+- Timestamps must be RFC 3339 with a timezone offset (`2026-09-02T10:00:00+09:00` or `2026-09-02T01:00:00Z`; never `2026-09-02T10:00:00`); `dependsOn` items must be plain task ID strings and unique.
 - Keep notes factual and current; replace stale implementation notes instead of accumulating a log.
 - Never rewrite repository history or source code solely to make the roadmap appear complete.
 - Finish every mutation by running `validate` and reporting the task status changed.

package/dist/skill/roadmap-progress/references/schema.md

@@ -54,7 +54,7 @@ Use this reference when creating or structurally editing `.nolto/roadmaps/<slug>
 - `project.id`: Stable lowercase identifier matching `^[a-z0-9][a-z0-9._-]*$`.
 - `project.name`: Display name.
 - `project.repository`: Absolute repository path when known.
-- `updatedAt`: Date-time of the last meaningful roadmap mutation.
+- `updatedAt`: RFC 3339 date-time with a timezone offset (for example, `2026-07-20T14:30:00+09:00` or `2026-07-20T05:30:00Z`). Offset-less values (`2026-07-20T14:30:00`) and date-only values (`2026-07-20`) are rejected.
 - `currentTaskId`: One active task ID or `null`.
 - `summary`: One or two current sentences; do not use as a changelog.
 - `phases`: Ordered delivery phases.
@@ -63,10 +63,10 @@ Use this reference when creating or structurally editing `.nolto/roadmaps/<slug>
 - `tasks`: Ordered work items. Each must be small enough to verify clearly.
 - `task.status`: `todo`, `in-progress`, `done`, or `blocked`.
 - `task.plan`: Optional repository-relative path (`/`-separated) to a Markdown plan document, for example `docs/plans/auth.md`. Absolute paths, backslashes, and `.`/`..` segments are rejected.
-- `startedAt`: Required in practice for `in-progress` tasks.
-- `completedAt`: Required in practice for `done` tasks.
+- `startedAt`: Required in practice for `in-progress` tasks. Uses the same RFC 3339 date-time format as `updatedAt`.
+- `completedAt`: Required in practice for `done` tasks. Uses the same RFC 3339 date-time format as `updatedAt`.
 - `note`: Current implementation detail or blocker. Omit when it adds no value.
-- `dependsOn`: IDs of prerequisite tasks in the same roadmap.
+- `dependsOn`: IDs of prerequisite tasks in the same roadmap. Each item must be a string matching `^[a-z0-9][a-z0-9._-]*$`; duplicates are rejected.
 
 ## Phase status derivation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nolto/cli",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "CLI for syncing repository roadmaps with Nolto.",
   "license": "MIT",
   "type": "module",