@popoverai/dotrequirements 0.14.0 → 0.15.0

package/README.md

@@ -114,8 +114,19 @@ Sync requirements from dot•requirements cloud to local `.requirements/` files.
 dotreq pull
 dotreq pull --project <project-id>
 dotreq pull --document <document-id>
+dotreq pull --share <token>
 ```
 
+**First-time setup with a share token:**
+
+If a team member shares a pull command with you, you can pull requirements without creating an account:
+
+```bash
+npx @popoverai/dotrequirements pull --share drt_abc123...
+```
+
+This gives you read-only access to view requirements. To push changes or report coverage, run `dotreq link` afterward.
+
 ### `dotreq push`
 
 Push local requirements to dot•requirements cloud.
@@ -421,7 +432,7 @@ Follow the prompts to configure for your AI assistant (Claude Code, Cursor, etc.
 **Authoring:**
 - `create_requirement_document` — Get a Markdown template with format examples
 - `validate_requirements` — Validate file schema (works offline)
-- `style_check` — AI-powered style feedback on requirements
+- `style_check` — AI-powered style feedback on requirements (supports optional `requirementKeys` filter)
 - `review_test` — Comprehensive test review (style + semantic correctness)
 
 **Cloud:**
@@ -432,6 +443,39 @@ Follow the prompts to configure for your AI assistant (Claude Code, Cursor, etc.
 **Diagnostic:**
 - `debug_mcp_environment` — Debug MCP server configuration
 
+### CI/CD Mode
+
+For CI/CD environments (GitHub Actions, etc.), use the `--auth-from-env` flag to read credentials from environment variables instead of `project-settings.json`:
+
+```bash
+node packages/cli/dist/mcp/index.js --auth-from-env
+```
+
+Required environment variables:
+- `DOTREQ_PROJECT_ID` — Your project slug
+- `DOTREQ_PROJECT_SECRET` — Your project secret
+
+**Important:** Without `--auth-from-env`, these environment variables are ignored. This explicit opt-in prevents credential conflicts between local and CI environments.
+
+Example MCP config for GitHub Actions:
+
+```json
+{
+  "mcpServers": {
+    "dotrequirements": {
+      "command": "node",
+      "args": ["packages/cli/dist/mcp/index.js", "--auth-from-env"],
+      "env": {
+        "DOTREQ_PROJECT_ID": "${DOTREQ_PROJECT_ID}",
+        "DOTREQ_PROJECT_SECRET": "${DOTREQ_PROJECT_SECRET}"
+      }
+    }
+  }
+}
+```
+
+See the [CI/CD Integration docs](https://dotrequirements.io/tools/ai/ci-cd) for complete examples.
+
 ---
 
 ## Package Exports

package/dist/cli.js

@@ -57,6 +57,7 @@ program
     .description('Sync requirements from cloud to local .requirements/ files')
     .option('-p, --project <id>', 'Project ID to sync')
     .option('-d, --document <id>', 'Specific document ID to sync')
+    .option('-s, --share <token>', 'Read-only share token for quick onboarding (no setup required)')
     .action(wrapCommand(pullCommand));
 program
     .command('push [file]')

package/dist/commands/pull.d.ts

@@ -1,6 +1,7 @@
 interface PullOptions {
     project?: string;
     document?: string;
+    share?: string;
 }
 export declare function pullCommand(options: PullOptions): Promise<void>;
 export {};

package/dist/commands/pull.js

@@ -9,43 +9,75 @@ import { findRequirementsFiles } from '../mcp/requirements.js';
 import { getProjectCredentials } from '../utils/project-settings.js';
 export async function pullCommand(options) {
     try {
-        console.log(`Syncing requirements from ${brand} cloud...`);
         // Connect to Convex
         const convexUrl = getConvexUrl();
         const client = new ConvexHttpClient(convexUrl);
-        // Get project credentials from .requirements/project-settings.json
-        // This throws helpful errors if project not found or not connected to cloud
-        const credentials = getProjectCredentials();
-        // Allow --project flag to override, but still need secret from settings
-        const projectId = options.project ?? credentials.projectId;
-        const projectSecret = credentials.projectSecret;
-        // Fetch documents
         let documents;
-        if (options.document) {
-            // Fetch specific document
-            const doc = await client.query(api.documents.queries.exportForCli, {
-                projectAuth: {
-                    projectSlug: projectId,
-                    projectSecret,
-                },
-                target: { type: 'document', id: options.document },
-                documentId: options.document,
-            });
-            documents = doc ? [doc] : [];
-        }
-        else if (projectId) {
-            // Fetch all documents for project
-            // SYNC-ARCH-3.1: Use projectSlug (not projectId) since env stores the slug
-            documents = await client.query(api.documents.queries.exportProjectForCli, {
-                projectAuth: {
-                    projectSlug: projectId,
-                    projectSecret,
-                },
-                target: { type: 'project', slug: projectId },
-            });
+        let projectName;
+        let isShareTokenFlow = false;
+        // SHARE-TOKEN-CLI-1: Handle share token flow (no project config needed)
+        if (options.share) {
+            isShareTokenFlow = true;
+            console.log(`Pulling requirements with share token...`);
+            try {
+                // SHARE-TOKEN-CLI-1.1: Pass only projectSecret, no projectSlug
+                // The authzQueryReadOnly wrapper will resolve project from the token
+                const result = await client.query(api.documents.queries.exportProjectForCli, {
+                    projectAuth: {
+                        projectSecret: options.share,
+                    },
+                });
+                documents = result.documents;
+                projectName = result.projectName;
+                // SHARE-TOKEN-CLI-1.2: Display project name in output
+                console.log(`\nProject: "${projectName}"`);
+            }
+            catch (error) {
+                // SHARE-TOKEN-CLI-2: Handle invalid/revoked tokens gracefully
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                if (errorMessage.includes('Invalid share token')) {
+                    throw new Error('Invalid share token. The token may be incorrect or has been revoked.\n' +
+                        'Please request a new share token from your team.');
+                }
+                throw error;
+            }
         }
         else {
-            throw new Error('Either --project or --document must be specified');
+            console.log(`Syncing requirements from ${brand} cloud...`);
+            // Get project credentials from .requirements/project-settings.json
+            // This throws helpful errors if project not found or not connected to cloud
+            const credentials = getProjectCredentials();
+            // Allow --project flag to override, but still need secret from settings
+            const projectId = options.project ?? credentials.projectId;
+            const projectSecret = credentials.projectSecret;
+            // Fetch documents
+            if (options.document) {
+                // Fetch specific document
+                const doc = await client.query(api.documents.queries.exportForCli, {
+                    projectAuth: {
+                        projectSlug: projectId,
+                        projectSecret,
+                    },
+                    target: { type: 'document', id: options.document },
+                    documentId: options.document,
+                });
+                documents = doc ? [doc] : [];
+            }
+            else if (projectId) {
+                // Fetch all documents for project
+                // SYNC-ARCH-3.1: Use projectSlug (not projectId) since env stores the slug
+                const result = await client.query(api.documents.queries.exportProjectForCli, {
+                    projectAuth: {
+                        projectSlug: projectId,
+                        projectSecret,
+                    },
+                });
+                documents = result.documents;
+                projectName = result.projectName;
+            }
+            else {
+                throw new Error('Either --project or --document must be specified');
+            }
         }
         if (documents.length === 0) {
             console.log('No documents found.');
@@ -82,6 +114,13 @@ export async function pullCommand(options) {
             console.log(`✓ Synced: ${fileName} (version ${doc.version})`);
         }
         console.log(`\nSuccessfully synced ${documents.length} document(s) to .requirements/`);
+        // SHARE-TOKEN-CLI-3: Show next steps for share token users
+        if (isShareTokenFlow) {
+            console.log('\n─────────────────────────────────────────────────────────');
+            console.log('Next steps to get full access (push, coverage):');
+            console.log('  Run: dotrequirements link');
+            console.log('─────────────────────────────────────────────────────────');
+        }
     }
     catch (error) {
         // Re-throw to let the CLI error handler display it cleanly

package/dist/config.js

@@ -7,10 +7,6 @@ const CONVEX_URL = 'https://data.dotrequirements.io';
  * Get the Convex deployment URL
  */
 export function getConvexUrl() {
-    // Show deprecation warning if user has CONVEX_URL in their env
-    if (process.env.CONVEX_URL) {
-        console.warn('⚠️  CONVEX_URL is no longer needed and will be ignored. You can safely remove it from your .env.local');
-    }
     return CONVEX_URL;
 }
 //# sourceMappingURL=config.js.map

package/dist/mcp/convexClient.d.ts

@@ -1,3 +1,7 @@
+/**
+ * Production Convex deployment URL
+ */
+export declare const CONVEX_URL = "https://data.dotrequirements.io";
 /**
  * Convex configuration for cloud operations
  */

package/dist/mcp/convexClient.js

@@ -2,7 +2,7 @@ import { getProjectCredentials } from '../utils/project-settings.js';
 /**
  * Production Convex deployment URL
  */
-const CONVEX_URL = 'https://data.dotrequirements.io';
+export const CONVEX_URL = 'https://data.dotrequirements.io';
 /**
  * Load Convex configuration from project settings.
  * Returns null if credentials are not configured.

package/dist/mcp/index.js

@@ -2,12 +2,13 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
-import { loadAllRequirements, searchRequirements, getRequirementById, getRequirementTree, formatRequirementTree, } from './requirements.js';
+import { loadAllRequirements, searchRequirements, getRequirementById, getRequirementTree, formatRequirementTree, filterRequirementsByKeys, } from './requirements.js';
 import { findAllTestReferences, getReferencedRequirementIds, } from './grep.js';
 import { findTestCodeForRequirement, findFilesWithRequirement, } from './testCodeExtractor.js';
 import { glob } from 'glob';
-import { loadConvexConfig, getRequirementCoverage as queryRequirementCoverage, getProjectCoverage as queryProjectCoverage, } from './convexClient.js';
+import { CONVEX_URL, getRequirementCoverage as queryRequirementCoverage, getProjectCoverage as queryProjectCoverage, } from './convexClient.js';
 import { discoverProjects, resolveProject, } from '../utils/project-discovery.js';
+import { getCredentialsFromEnv } from '../utils/project-settings.js';
 import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
@@ -32,6 +33,9 @@ function getProjectPathsFromEnv() {
 // Get workspace root from environment or default to cwd
 const WORKSPACE_ROOT = process.env.REQUIREMENTS_DIR || process.cwd();
 const PROJECT_PATHS = getProjectPathsFromEnv();
+// Parse --auth-from-env flag for CI/CD environments
+// When set, credentials are read from DOTREQ_PROJECT_ID and DOTREQ_PROJECT_SECRET env vars
+const USE_ENV_AUTH = process.argv.includes('--auth-from-env');
 const STYLE_CHECK_GUIDANCE = `
 
 ---
@@ -57,6 +61,20 @@ async function getRequirements(projectId) {
 }
 async function getProjectFromDiscovery(projectId) {
     const { isConfiguredProject } = await import('../utils/project-discovery.js');
+    // If --auth-from-env flag is set, use credentials from environment variables
+    // This is the explicit opt-in for CI/CD environments
+    if (USE_ENV_AUTH) {
+        const envCredentials = getCredentialsFromEnv();
+        if (!envCredentials) {
+            throw new Error('--auth-from-env flag requires DOTREQ_PROJECT_ID and DOTREQ_PROJECT_SECRET environment variables to be set');
+        }
+        // Return a synthetic project using env credentials and workspace root
+        return {
+            path: WORKSPACE_ROOT,
+            projectId: envCredentials.projectId,
+            projectSecret: envCredentials.projectSecret,
+        };
+    }
     // If we have PROJ_* env vars, use those instead of filesystem discovery
     if (PROJECT_PATHS.size > 0) {
         const projects = [];
@@ -300,7 +318,7 @@ const tools = [
     },
     {
         name: 'style_check',
-        description: 'Check requirements files or test files for style issues and best practices. Uses AI to provide actionable feedback on writing style, clarity, and conventions. Supports requirements files (*.requirements.md) and test files (*.test.*, *.spec.*). Requires project to be linked to cloud (run `dotrequirements link`).',
+        description: 'Check requirements files or test files for style issues and best practices. Uses AI to provide actionable feedback on writing style, clarity, and conventions. Supports requirements files (*.requirements.md) and test files (*.test.*, *.spec.*). For requirements files, you can optionally specify requirement keys to check only those requirements instead of the entire file. Requires project to be linked to cloud (run `dotrequirements link`).',
         inputSchema: {
             type: 'object',
             properties: {
@@ -308,6 +326,11 @@ const tools = [
                     type: 'string',
                     description: 'Path to the file to check (e.g., ".requirements/auth.requirements.md" or "src/auth.test.ts")',
                 },
+                requirementKeys: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Optional: Array of requirement keys to check (e.g., ["AUTH-1", "AUTH-2"]). Only valid for requirements files (*.requirements.md). When provided, only these requirements are checked instead of the entire file.',
+                },
                 model: {
                     type: 'string',
                     description: 'Optional: AI model to use for style checking (default: "anthropic/claude-haiku-4.5"). Supported models: "anthropic/claude-haiku-4.5", "google/gemini-3-flash"',
@@ -899,19 +922,7 @@ ${projectList || '(none found)'}`,
             case 'get_requirement_coverage': {
                 const { requirementKey, projectId } = args;
                 const project = await getProjectFromDiscovery(projectId);
-                const config = loadConvexConfig(project.path);
-                if (!config) {
-                    return {
-                        content: [
-                            {
-                                type: 'text',
-                                text: 'Coverage queries require project credentials. Run `dotrequirements link` to connect to cloud.',
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
-                const coverage = await queryRequirementCoverage(requirementKey, config.projectId, config.projectSecret, config.convexUrl);
+                const coverage = await queryRequirementCoverage(requirementKey, project.projectId, project.projectSecret, CONVEX_URL);
                 if (!coverage.lastTestedAt) {
                     return {
                         content: [
@@ -946,19 +957,7 @@ ${projectList || '(none found)'}`,
             case 'get_project_coverage_summary': {
                 const { branch, sinceTimestamp, projectId } = args;
                 const project = await getProjectFromDiscovery(projectId);
-                const config = loadConvexConfig(project.path);
-                if (!config) {
-                    return {
-                        content: [
-                            {
-                                type: 'text',
-                                text: 'Coverage queries require project credentials. Run `dotrequirements link` to connect to cloud.',
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
-                const coverage = await queryProjectCoverage(config.projectId, config.projectSecret, config.convexUrl, { branch, sinceTimestamp });
+                const coverage = await queryProjectCoverage(project.projectId, project.projectSecret, CONVEX_URL, { branch, sinceTimestamp });
                 const total = coverage.tested.length + coverage.untested.length;
                 const percentage = total > 0 ? ((coverage.tested.length / total) * 100).toFixed(1) : '0.0';
                 let filterInfo = '';
@@ -1286,23 +1285,11 @@ describe(requirement('AUTH-LOGIN-1'), () => {
                 const path = await import('path');
                 const { parseRequirementsFromFile, getAllRequirements } = await import('../schema/index.js');
                 const { ConvexHttpClient } = await import('convex/browser');
-                // Get project
+                // Get project (credentials come from project object, works with both file and env auth)
                 const project = await getProjectFromDiscovery(projectIdParam);
-                const config = loadConvexConfig(project.path);
-                if (!config) {
-                    return {
-                        content: [
-                            {
-                                type: 'text',
-                                text: 'Push requires project credentials. Run `dotrequirements link` to connect to cloud.',
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
-                const convexUrl = config.convexUrl;
-                const projectId = config.projectId;
-                const projectSecret = config.projectSecret;
+                const convexUrl = CONVEX_URL;
+                const projectId = project.projectId;
+                const projectSecret = project.projectSecret;
                 // Determine files to push
                 const requirementsDir = path.resolve(project.path, '.requirements');
                 let filesToPush;
@@ -1411,7 +1398,7 @@ describe(requirement('AUTH-LOGIN-1'), () => {
                 }
             }
             case 'style_check': {
-                const { filePath, model } = args;
+                const { filePath, model, requirementKeys } = args;
                 const fs = await import('fs');
                 const path = await import('path');
                 const fullPath = path.resolve(WORKSPACE_ROOT, filePath);
@@ -1443,22 +1430,73 @@ describe(requirement('AUTH-LOGIN-1'), () => {
                     };
                 }
                 const fileType = isRequirementsFile ? 'requirements' : 'test';
+                // If requirementKeys provided, filter the file to only those requirements
+                let fileContentsToCheck = fileContents;
+                let scopeNote = '';
+                if (requirementKeys && requirementKeys.length > 0) {
+                    if (!isRequirementsFile) {
+                        return {
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `requirementKeys can only be used with requirements files (*.requirements.md), not test files.`,
+                                },
+                            ],
+                            isError: true,
+                        };
+                    }
+                    try {
+                        const { filteredContent, foundKeys, missingKeys } = filterRequirementsByKeys(fileContents, requirementKeys);
+                        if (foundKeys.length === 0) {
+                            return {
+                                content: [
+                                    {
+                                        type: 'text',
+                                        text: `None of the specified requirement keys were found in ${filePath}: ${requirementKeys.join(', ')}`,
+                                    },
+                                ],
+                                isError: true,
+                            };
+                        }
+                        fileContentsToCheck = filteredContent;
+                        if (missingKeys.length > 0) {
+                            scopeNote = `\n\n> **Note:** Some specified keys were not found in the file: ${missingKeys.join(', ')}`;
+                        }
+                    }
+                    catch (error) {
+                        return {
+                            content: [
+                                {
+                                    type: 'text',
+                                    text: `Failed to filter requirements: ${error instanceof Error ? error.message : String(error)}`,
+                                },
+                            ],
+                            isError: true,
+                        };
+                    }
+                }
                 // Get Convex config for credentials - walk up from file's directory to find project
                 const fileDir = path.dirname(fullPath);
                 let project;
                 try {
-                    // Try to find a project starting from the file's directory
-                    const result = await discoverProjects(fileDir);
-                    if (result.type === 'none') {
-                        // If no project found from file dir, try from WORKSPACE_ROOT
+                    // If using env auth, go straight to getProjectFromDiscovery (handles env credentials)
+                    if (USE_ENV_AUTH) {
                         project = await getProjectFromDiscovery();
                     }
-                    else if (result.type === 'single') {
-                        project = result.project;
-                    }
                     else {
-                        // Multiple projects - can't auto-detect which one to use
-                        throw new Error('Multiple projects found - cannot auto-detect for this file');
+                        // Try to find a project starting from the file's directory
+                        const result = await discoverProjects(fileDir);
+                        if (result.type === 'none') {
+                            // If no project found from file dir, try from WORKSPACE_ROOT
+                            project = await getProjectFromDiscovery();
+                        }
+                        else if (result.type === 'single') {
+                            project = result.project;
+                        }
+                        else {
+                            // Multiple projects - can't auto-detect which one to use
+                            throw new Error('Multiple projects found - cannot auto-detect for this file');
+                        }
                     }
                 }
                 catch (error) {
@@ -1472,18 +1510,8 @@ describe(requirement('AUTH-LOGIN-1'), () => {
                         isError: true,
                     };
                 }
-                const config = loadConvexConfig(project.path);
-                if (!config) {
-                    return {
-                        content: [
-                            {
-                                type: 'text',
-                                text: 'Style check requires project credentials. Run `dotrequirements link` to connect to cloud.',
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
+                // Use credentials from project (works with both file-based and env-based auth)
+                const { projectId: projId, projectSecret: projSecret } = project;
                 // Call Vercel API endpoint for style checking
                 // Default to production, allow override via env var for local dev
                 const apiBaseUrl = process.env.DOTREQUIREMENTS_API_URL || 'https://app.dotrequirements.io';
@@ -1494,9 +1522,9 @@ describe(requirement('AUTH-LOGIN-1'), () => {
                             'Content-Type': 'application/json',
                         },
                         body: JSON.stringify({
-                            projectId: config.projectId,
-                            projectSecret: config.projectSecret,
-                            fileContents,
+                            projectId: projId,
+                            projectSecret: projSecret,
+                            fileContents: fileContentsToCheck,
                             fileType,
                             model,
                         }),
@@ -1514,11 +1542,14 @@ describe(requirement('AUTH-LOGIN-1'), () => {
                         };
                     }
                     const data = await response.json();
+                    const scopeLabel = requirementKeys && requirementKeys.length > 0
+                        ? ` (${requirementKeys.join(', ')})`
+                        : '';
                     return {
                         content: [
                             {
                                 type: 'text',
-                                text: `# Style Check Results for \`${filePath}\`\n\n${data.feedback}${STYLE_CHECK_GUIDANCE}`,
+                                text: `# Style Check Results for \`${filePath}\`${scopeLabel}\n\n${data.feedback}${scopeNote}${STYLE_CHECK_GUIDANCE}`,
                             },
                         ],
                     };
@@ -1614,18 +1645,8 @@ describe(requirement('AUTH-LOGIN-1'), () => {
                     });
                 }
                 // Get Convex config
-                const config = loadConvexConfig(project.path);
-                if (!config) {
-                    return {
-                        content: [
-                            {
-                                type: 'text',
-                                text: 'Test review requires project credentials. Run `dotrequirements link` to connect to cloud.',
-                            },
-                        ],
-                        isError: true,
-                    };
-                }
+                // Use credentials from project (works with both file-based and env-based auth)
+                const { projectId: projId, projectSecret: projSecret } = project;
                 // Call Vercel API endpoint for test review
                 // Default to production, allow override via env var for local dev
                 const apiBaseUrl = process.env.DOTREQUIREMENTS_API_URL || 'https://app.dotrequirements.io';
@@ -1636,8 +1657,8 @@ describe(requirement('AUTH-LOGIN-1'), () => {
                             'Content-Type': 'application/json',
                         },
                         body: JSON.stringify({
-                            projectId: config.projectId,
-                            projectSecret: config.projectSecret,
+                            projectId: projId,
+                            projectSecret: projSecret,
                             testFileContents,
                             requirements,
                         }),

package/dist/mcp/requirements.d.ts

@@ -40,6 +40,16 @@ export declare function getRequirementTree(requirements: FlattenedRequirement[],
  * Format a requirement for display
  */
 export declare function formatRequirement(req: FlattenedRequirement): string;
+/**
+ * Filter a requirements file's content to only include specified requirement keys.
+ * Parses the file content, filters top-level requirements by key, and rebuilds as
+ * markdown requirement blocks (without frontmatter).
+ */
+export declare function filterRequirementsByKeys(fileContents: string, keys: string[]): {
+    filteredContent: string;
+    foundKeys: string[];
+    missingKeys: string[];
+};
 /**
  * Format a requirement tree for display
  */

package/dist/mcp/requirements.js

@@ -1,6 +1,6 @@
 import * as path from 'path';
 import { glob } from 'glob';
-import { parseRequirementsFromFile, getAllRequirements, } from '../schema/index.js';
+import { parseRequirementsFromFile, parseRequirementsFile, buildRequirementMarkdown, getAllRequirements, } from '../schema/index.js';
 /**
  * Find all *.requirements.md files in the workspace.
  * Supports both .requirements/ directories and colocated files.
@@ -114,6 +114,20 @@ export function formatRequirement(req) {
     const label = req.label ? ` (${req.label})` : '';
     return `${indent}${req.id}${label}: ${req.content}`;
 }
+/**
+ * Filter a requirements file's content to only include specified requirement keys.
+ * Parses the file content, filters top-level requirements by key, and rebuilds as
+ * markdown requirement blocks (without frontmatter).
+ */
+export function filterRequirementsByKeys(fileContents, keys) {
+    const { requirements } = parseRequirementsFile(fileContents);
+    const upperKeys = keys.map(k => k.toUpperCase());
+    const filtered = requirements.filter(r => upperKeys.includes(r.id.toUpperCase()));
+    const foundKeys = filtered.map(r => r.id);
+    const missingKeys = upperKeys.filter(k => !foundKeys.map(f => f.toUpperCase()).includes(k));
+    const filteredContent = filtered.map(buildRequirementMarkdown).join('\n');
+    return { filteredContent, foundKeys, missingKeys };
+}
 /**
  * Format a requirement tree for display
  */

package/dist/utils/project-settings.d.ts

@@ -20,6 +20,15 @@ export interface ProjectInfo {
     /** Credentials if cloud-connected */
     credentials?: ProjectSettings;
 }
+/**
+ * Get project credentials from environment variables.
+ * Used in CI/CD environments where credentials are passed via env vars
+ * rather than stored in project-settings.json.
+ *
+ * Requires both DOTREQ_PROJECT_ID and DOTREQ_PROJECT_SECRET to be set.
+ * Returns undefined if either is missing.
+ */
+export declare function getCredentialsFromEnv(): ProjectSettings | undefined;
 /**
  * Find the project root by walking up from startDir looking for .requirements/ folder
  * Returns the directory containing .requirements/, or undefined if not found

package/dist/utils/project-settings.js

@@ -2,6 +2,22 @@ import * as fs from 'fs';
 import * as path from 'path';
 const REQUIREMENTS_DIR = '.requirements';
 const SETTINGS_FILE = 'project-settings.json';
+/**
+ * Get project credentials from environment variables.
+ * Used in CI/CD environments where credentials are passed via env vars
+ * rather than stored in project-settings.json.
+ *
+ * Requires both DOTREQ_PROJECT_ID and DOTREQ_PROJECT_SECRET to be set.
+ * Returns undefined if either is missing.
+ */
+export function getCredentialsFromEnv() {
+    const projectId = process.env.DOTREQ_PROJECT_ID;
+    const projectSecret = process.env.DOTREQ_PROJECT_SECRET;
+    if (projectId && projectSecret) {
+        return { projectId, projectSecret };
+    }
+    return undefined;
+}
 /**
  * Find the project root by walking up from startDir looking for .requirements/ folder
  * Returns the directory containing .requirements/, or undefined if not found

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@popoverai/dotrequirements",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Requirements tracking CLI, test harness, and MCP server",
   "type": "module",
   "bin": {