@software-dlc/cli 0.157.2

package/dist/cli-health.js

@@ -0,0 +1,73 @@
+import { applyHealthPolicy } from './local/health-policy.js';
+import { inspectLocalHealth } from './local/health-inspection.js';
+import { context_health_options_schema } from './local/health-schema.js';
+/** Dispatch before ordinary context bootstrap; the inspector owns the sole budget. */
+export async function runCliHealth(args) {
+    if (args.includes('--help') || args.includes('-h'))
+        return false;
+    if (!args.some((arg) => arg === '--health' || arg.startsWith('--health=')))
+        return false;
+    const usage = 'Usage: sdlc <context|status> --health [--timeout-ms <1000..600000>]';
+    if (args[0] !== 'context' && args[0] !== 'status')
+        throw new Error(usage);
+    const inspection = args[0];
+    let health = false;
+    let timeout_ms;
+    for (let index = 1; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === '--health' && !health) {
+            health = true;
+            continue;
+        }
+        if ((arg === '--timeout-ms' || arg.startsWith('--timeout-ms=')) &&
+            timeout_ms === undefined) {
+            const value = arg === '--timeout-ms' ? args[++index] : arg.slice(13);
+            if (!value || !/^\d+$/.test(value))
+                throw new Error(usage);
+            timeout_ms = Number(value);
+            continue;
+        }
+        throw new Error(usage);
+    }
+    const options = context_health_options_schema.safeParse({
+        health,
+        timeout_ms
+    });
+    if (!options.success || !health)
+        throw new Error(usage);
+    const controller = new AbortController();
+    let exit_code = 124;
+    const interrupt = () => {
+        exit_code = 130;
+        controller.abort();
+    };
+    const terminate = () => {
+        exit_code = 143;
+        controller.abort();
+    };
+    process.once('SIGINT', interrupt);
+    process.once('SIGTERM', terminate);
+    try {
+        const observations = await inspectLocalHealth({
+            cwd: process.cwd(),
+            inspection,
+            timeout_ms: options.data.timeout_ms,
+            signal: controller.signal,
+            on_cleanup_timeout: () => {
+                process.stderr.write('Health inspection cleanup did not settle. Restart before further work.\n');
+                process.exit(exit_code);
+            }
+        });
+        const report = applyHealthPolicy(observations, { kind: 'cli' });
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+        if (controller.signal.aborted ||
+            report.diagnostics.entries.some((entry) => entry.code === 'cancelled' || entry.code === 'deadline_exceeded'))
+            process.exitCode = exit_code;
+        return true;
+    }
+    finally {
+        process.removeListener('SIGINT', interrupt);
+        process.removeListener('SIGTERM', terminate);
+    }
+}
+//# sourceMappingURL=cli-health.js.map

package/dist/cli-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-health.js","sourceRoot":"","sources":["../src/cli-health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAEzE,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,MAAM,KAAK,GACT,qEAAqE,CAAC;IACxE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,UAA8B,CAAC;IACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IACE,CAAC,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAC3D,UAAU,KAAK,SAAS,EACxB,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3D,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,6BAA6B,CAAC,SAAS,CAAC;QACtD,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,SAAS,GAAG,GAAG,CAAC;IACpB,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,SAAS,GAAG,GAAG,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,SAAS,GAAG,GAAG,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC;YAC5C,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,UAAU;YACV,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;YACnC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,kBAAkB,EAAE,GAAG,EAAE;gBACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0EAA0E,CAC3E,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,IACE,UAAU,CAAC,MAAM,CAAC,OAAO;YACzB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACnE;YAED,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/cli-help.d.ts

@@ -0,0 +1,21 @@
+export declare const RESET_USAGE = "Usage: sdlc reset --discard-proposal";
+export declare const SDLC_CLI_USAGE = "Usage: sdlc connection add <name> --url <origin> --credential-env <ENV_NAME> | connection list | env add <profile> --connection <name> --repository-id <uuid> | env migrate --connection <name> | env use <profile> | env recover | env current | env list | init --connection <name> --repository-id <uuid> [--profile <name>] | reconnect --expected-project-id <uuid> --project-id <uuid> --branch-id <uuid> --adopt-projection | context [--health] | task-context --task-id <id> [--execution-id <id>] [--registry-id <expected-id>] | branches | branch bind --branch-id <uuid> [--worktree-id <uuid>] | session start --revision <n> | checkout [--force] [--work-dir <path>] [--upgrade-evidence] | refresh [--force] [--work-dir <path>] [--upgrade-evidence] | status [--health] | diff | compare [--include-entities] [--no-fields] [--entity-id=<id>] [--require-auto-merge-clean] [--scope-recipes-file <path>] [--target-graph-file <path> [--source-graph-file <path>] [--merge-base-graph-file <path>]] [--base-url <url>] | snapshot inspect --snapshot-id <uuid> [--timeout-ms <1000..600000>] | scope-impact (--impact-node-id <id> | --impact-edge-id <id>) [--path-id <id>] [--path-tree-root-id <id>] [--node-id <id>] [--edge-id <id>] | compare-subgraph --seed-entity-id <id> [--require-unchanged] [--connection-hops <0..3>] [--connection-direction <incoming|outgoing|both>] [--descendants <none|direct|all>] [--related-path-hops <0..1>] [--no-intersecting-paths] [--max-nodes <1..240>] [--max-edges <0..480>] [--max-paths <0..240>] [--max-path-relations <0..240>] | validate | rebuild [--node <uuid>] [--without-projection] | reset --discard-proposal | rm <entity-relative-path> | media upload <image-path> | save [--graph-file <path> [--save-mode patch|replace]] [--base-url <url>] | sync [--base-url <url>] [--recover-stale-pending [--discard-unapplied-pending] --expected-remote-revision <n> --expected-remote-sync-revision <n> --expected-remote-sync-root-hash <sha256>] | branch commit --message <text> --expected-head <commit-uuid> [--branch-id <uuid>] | branch apply --idempotency-key <key> [--expected-workspace-revision <n>] ... | pr review|approve|merge --pr-id <uuid> ...";
+/** Top-level help: the local-first commands, then the hosted ones. */
+export declare const SDLC_CLI_HELP = "Local graph (start here; no account needed):\n  sdlc workspace init    start a local graph in this repository\n  sdlc workspace ...     create, commit and inspect local plan workspaces\n  sdlc integrate ...     merge child workspaces into a coordinator\n  sdlc handoff ...       hand a child's changes back to its source\n  sdlc topology ...      inspect, move, export or clone local graph state\n  sdlc workspace attach  join another repository to an existing local graph\n  sdlc org ...           plan the local org: teams, job functions, posts and who holds them\nRun sdlc workspace|integrate|handoff|topology --help for their subcommands. Also local, described in the package README: viewer, remote, branch, merge, portable and resolver. Local only: no SoftwareDLC account or credential, and no network unless --allow-network-resolver is given. sdlc/ and .sdlc/ must be ignored by Git; list them in .git/info/exclude to leave tracked files unchanged. Graph state lives under the Git common directory unless the global --repository-state-dir <path> (with --graph-repository-id <id>) or SDLC_REPOSITORY_STATE_DIR names another.\n\nPublic graph packages (no account needed; using packages in a local graph comes in a later release):\n  sdlc packages list|show|diff  browse the bundled and downloaded packages, offline\n  sdlc packages fetch    download newer versions of public packages\n  sdlc packages lock ... pin, update or remove the public packages a build bundles (for maintainers of the sdlc and plugin builds)\n\nPlugin:\n  sdlc allow-mcp         let the SoftwareDLC plugin run this repository's own install (--revoke, --list)\n\nSign-in (macOS; for hosted Tasks and queues):\n  sdlc login             sign this machine in to SoftwareDLC through the browser\n  sdlc auth token|status print a current access token, or the sign-in's state\n  sdlc logout            revoke and remove the sign-in\n\nDeployments (CI, with an API key in SDLC_API_KEY):\n  sdlc deploy record     record that a project's Environment began running a revision\n\nHosted project (needs a SoftwareDLC connection):\nUsage: sdlc connection add <name> --url <origin> --credential-env <ENV_NAME> | connection list | env add <profile> --connection <name> --repository-id <uuid> | env migrate --connection <name> | env use <profile> | env recover | env current | env list | init --connection <name> --repository-id <uuid> [--profile <name>] | reconnect --expected-project-id <uuid> --project-id <uuid> --branch-id <uuid> --adopt-projection | context [--health] | task-context --task-id <id> [--execution-id <id>] [--registry-id <expected-id>] | branches | branch bind --branch-id <uuid> [--worktree-id <uuid>] | session start --revision <n> | checkout [--force] [--work-dir <path>] [--upgrade-evidence] | refresh [--force] [--work-dir <path>] [--upgrade-evidence] | status [--health] | diff | compare [--include-entities] [--no-fields] [--entity-id=<id>] [--require-auto-merge-clean] [--scope-recipes-file <path>] [--target-graph-file <path> [--source-graph-file <path>] [--merge-base-graph-file <path>]] [--base-url <url>] | snapshot inspect --snapshot-id <uuid> [--timeout-ms <1000..600000>] | scope-impact (--impact-node-id <id> | --impact-edge-id <id>) [--path-id <id>] [--path-tree-root-id <id>] [--node-id <id>] [--edge-id <id>] | compare-subgraph --seed-entity-id <id> [--require-unchanged] [--connection-hops <0..3>] [--connection-direction <incoming|outgoing|both>] [--descendants <none|direct|all>] [--related-path-hops <0..1>] [--no-intersecting-paths] [--max-nodes <1..240>] [--max-edges <0..480>] [--max-paths <0..240>] [--max-path-relations <0..240>] | validate | rebuild [--node <uuid>] [--without-projection] | reset --discard-proposal | rm <entity-relative-path> | media upload <image-path> | save [--graph-file <path> [--save-mode patch|replace]] [--base-url <url>] | sync [--base-url <url>] [--recover-stale-pending [--discard-unapplied-pending] --expected-remote-revision <n> --expected-remote-sync-revision <n> --expected-remote-sync-root-hash <sha256>] | branch commit --message <text> --expected-head <commit-uuid> [--branch-id <uuid>] | branch apply --idempotency-key <key> [--expected-workspace-revision <n>] ... | pr review|approve|merge --pr-id <uuid> ...";
+export declare const BRANCH_APPLY_USAGE = "Usage: sdlc branch apply --idempotency-key <key> [--expected-workspace-revision <n>] [--expected-workspace-id <uuid>] [--expected-branch-revision <n>] [--branch-id <uuid>]";
+export declare const BRANCH_COMMIT_USAGE = "Usage: sdlc branch commit --message <text> --expected-head <commit-uuid> [--branch-id <uuid>]";
+export declare const PULL_REQUEST_USAGE = "Usage: sdlc pr review --pr-id <uuid> [--comparison-diff-id <uuid> --comparison-manifest-hash <sha256:hex> --expected-source <commit-uuid> --expected-target <commit-uuid>] | pr approve --pr-id <uuid> --expected-source <commit-uuid> --expected-target <commit-uuid> --review-hash <hash> | pr merge --pr-id <uuid>";
+/**
+ * How `sdlc save --graph-file` applies its graph. `patch` (the default) merges a
+ * partial graph. `replace` treats the file as the complete proposal, so the save
+ * uploads only what differs from the acknowledged base, as a projection save does.
+ */
+export declare function parseGraphFileSaveMode(value: string | null | undefined): 'patch' | 'replace';
+export declare const SDLC_CLI_VERSION: string;
+/** Whether the arguments ask for sdlc view's usage, which the view's own code holds in full. */
+export declare function viewHelpRequested(args: string[]): boolean;
+/** `viewUsage` is sdlc view's full usage where its code loaded; without it help prints the public line. */
+export declare function runCliMetaCommand(args: string[], { viewUsage }?: {
+    viewUsage?: string;
+}): boolean;
+//# sourceMappingURL=cli-help.d.ts.map

package/dist/cli-help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,WAAW,yCAAyC,CAAC;AAkDlE,eAAO,MAAM,cAAc,snEAC0lE,CAAC;AAatnE,sEAAsE;AACtE,eAAO,MAAM,aAAa,uqIAAstD,CAAC;AAEjvD,eAAO,MAAM,kBAAkB,gLACgJ,CAAC;AAChL,eAAO,MAAM,mBAAmB,kGACiE,CAAC;AAClG,eAAO,MAAM,kBAAkB,0TAC0R,CAAC;AAI1T;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,OAAO,GAAG,SAAS,CAKrB;AA4DD,eAAO,MAAM,gBAAgB,QAAmC,CAAC;AAMjE,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAGzD;AAED,2GAA2G;AAC3G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CA8BrG"}

package/dist/cli-help.js

@@ -0,0 +1,176 @@
+import { createRequire } from 'node:module';
+import { SDLC_DEPLOY_HELP } from './cli-deploy.js';
+import { SDLC_LOGIN_HELP } from './cli-login.js';
+import { SDLC_VIEW_PUBLIC_USAGE } from './view-seam.js';
+import { ORG_USAGE } from './cli-org.js';
+import { ALLOW_MCP_USAGE } from './local/allow-mcp.js';
+import { PACKAGES_USAGE } from './packages-cli.js';
+export const RESET_USAGE = 'Usage: sdlc reset --discard-proposal';
+const require = createRequire(import.meta.url);
+const package_metadata = require('../package.json');
+const CLI_COMMANDS = new Set([
+    'allow-mcp',
+    'auth',
+    'branch',
+    'branches',
+    'checkout',
+    'compare',
+    'compare-subgraph',
+    'connection',
+    'context',
+    'task-context',
+    'deploy',
+    'diff',
+    'env',
+    'handoff',
+    'init',
+    'integrate',
+    'login',
+    'logout',
+    'media',
+    'merge',
+    'org',
+    'packages',
+    'portable',
+    'pr',
+    'rebuild',
+    'reconnect',
+    'refresh',
+    'remote',
+    'reset',
+    'resolver',
+    'rm',
+    'save',
+    'scope-impact',
+    'session',
+    'snapshot',
+    'status',
+    'sync',
+    'topology',
+    'validate',
+    'view',
+    'viewer',
+    'workspace'
+]);
+export const SDLC_CLI_USAGE = 'Usage: sdlc connection add <name> --url <origin> --credential-env <ENV_NAME> | connection list | env add <profile> --connection <name> --repository-id <uuid> | env migrate --connection <name> | env use <profile> | env recover | env current | env list | init --connection <name> --repository-id <uuid> [--profile <name>] | reconnect --expected-project-id <uuid> --project-id <uuid> --branch-id <uuid> --adopt-projection | context [--health] | task-context --task-id <id> [--execution-id <id>] [--registry-id <expected-id>] | branches | branch bind --branch-id <uuid> [--worktree-id <uuid>] | session start --revision <n> | checkout [--force] [--work-dir <path>] [--upgrade-evidence] | refresh [--force] [--work-dir <path>] [--upgrade-evidence] | status [--health] | diff | compare [--include-entities] [--no-fields] [--entity-id=<id>] [--require-auto-merge-clean] [--scope-recipes-file <path>] [--target-graph-file <path> [--source-graph-file <path>] [--merge-base-graph-file <path>]] [--base-url <url>] | snapshot inspect --snapshot-id <uuid> [--timeout-ms <1000..600000>] | scope-impact (--impact-node-id <id> | --impact-edge-id <id>) [--path-id <id>] [--path-tree-root-id <id>] [--node-id <id>] [--edge-id <id>] | compare-subgraph --seed-entity-id <id> [--require-unchanged] [--connection-hops <0..3>] [--connection-direction <incoming|outgoing|both>] [--descendants <none|direct|all>] [--related-path-hops <0..1>] [--no-intersecting-paths] [--max-nodes <1..240>] [--max-edges <0..480>] [--max-paths <0..240>] [--max-path-relations <0..240>] | validate | rebuild [--node <uuid>] [--without-projection] | reset --discard-proposal | rm <entity-relative-path> | media upload <image-path> | save [--graph-file <path> [--save-mode patch|replace]] [--base-url <url>] | sync [--base-url <url>] [--recover-stale-pending [--discard-unapplied-pending] --expected-remote-revision <n> --expected-remote-sync-revision <n> --expected-remote-sync-root-hash <sha256>] | branch commit --message <text> --expected-head <commit-uuid> [--branch-id <uuid>] | branch apply --idempotency-key <key> [--expected-workspace-revision <n>] ... | pr review|approve|merge --pr-id <uuid> ...';
+const LOCAL_ONLY_NOTE = 'Local only: no SoftwareDLC account or credential, and no network unless --allow-network-resolver is given. sdlc/ and .sdlc/ must be ignored by Git; list them in .git/info/exclude to leave tracked files unchanged. Graph state lives under the Git common directory unless the global --repository-state-dir <path> (with --graph-repository-id <id>) or SDLC_REPOSITORY_STATE_DIR names another.';
+const WORKSPACE_USAGE = "Usage: sdlc workspace init [--actor human|ai] [--source-association <id>] [--source-remote <name>] [--storage-mode machine_shared|self_contained] | attach (--source-workspace <id> --expected-graph-head <revision> --source-association <id> --scope-file <json-file> [--source-remote <name>] | --all-members) [--actor human|ai] [--storage-mode machine_shared|self_contained] [--full-projection] | context | detach | create [--from <workspace-id>] --path <absolute-path> --scope-file <json-file> [--actor human|ai] | status [--workspace <workspace-id>] | list | authority | scope --scope-file <json-file> [--workspace <workspace-id>] | commit [--workspace <workspace-id>] --message <message> | recover [--workspace <workspace-id>] --expected-head <commit-id> (--expected-projection-root <root-hash> | --discard-unreadable) | rm <entity-relative-path> | export --output <path> [--workspace <workspace-id>] [--commit <commit-id>] [--view <view>] | overlap [--coordinator <workspace-id>] | claims [--workspace <workspace-id>] | claim-status [--workspace <workspace-id>] [--view <view>] [--commit <commit-id>] [--environment <environment>]... [--cites-code <types>] [--node <id>]... [--status <status>] [--stale] [--behind] | blast-radius --files-from <file|-> [--workspace <workspace-id>] [--view <view>] | find <term>... [--type <type>[,<type>]] [--origin built|shelf] [--limit <n>] [--workspace <workspace-id>] [--view <view>] | show <id>... [--budget <chars>] [--full] [--workspace <workspace-id>] [--view <view>] | close [--workspace <workspace-id>] | prune [--min-age-hours <n>] [--apply --expected-plan-hash <sha256>] | doc | decision | pick | test | journey | evidence (each prints its own usage)\nblast-radius reads one changed file per line: a path in this repository, or <owner>/<name>:<path> for another repository of the graph (<name>:<path> when one repository has that name); a file naming a repository no source reference names is listed under unknown_repositories. A file maps to the nodes citing it or a folder holding it.\nfind takes an argument holding spaces as its words; once a find has several words, each loses edge punctuation and a trailing 's, and words under 3 characters and common words are left out unless none would remain. It ranks a label holding a several-word argument whole first, then labels holding more terms, then nodes matching more terms, then by where (label, id, description, acceptance criteria, other data); each row is id, t (type), l (label), d (description), p (parent), pl (parent label), o (origin), r (where it matched); an id matches from its start, a --type no node has is warned about, and words after -- may start with dashes. An architecture node's origin is built (built here) or shelf (off the shelf), derived from external markers on it and its ancestors; --origin keeps only that origin, and the summary counts both either way. show reads nodes or edges compactly: domain data without layout, a long text field cut to --budget characters with its size and a long other field replaced by its size, acceptance criteria whole, cited files, the origin and why, and up to 50 relations each way; --full gives each as stored, with the origin beside it. With --view built, both mark what a merged plan removes.\nIn a second repository that joins an existing local graph, run workspace context in the first and workspace attach in the second, not init: init starts a separate graph. Attach writes only the entities its scope names into sdlc/; --full-projection writes the whole graph. In a folder of repositories, attach --all-members in the home's plan coordinator attaches every other repository of the folder at once, each with the nodes whose source references name it and the edges touching them.";
+const INTEGRATE_USAGE = 'Usage: sdlc integrate enqueue [--coordinator <workspace-id>] --workspace <child-id> [--commit <commit-id>] [--gate plan|design] | run [--coordinator <workspace-id>] [--max-retries <0..16>] [--resolve-conflicts] [--allow-network-resolver] | reconcile [--coordinator <workspace-id>] --source <workspace-id> [--max-retries <0..16>] [--resolve-conflicts] [--allow-network-resolver]\n--resolve-conflicts uses the resolver set with sdlc resolver configure.';
+const HANDOFF_USAGE = 'Usage: sdlc handoff prepare [--workspace <child-id>] --source <workspace-id> [--max-retries <0..16>] [--resolve-conflicts] [--allow-network-resolver] | list [--workspace <workspace-id>] | inspect [--workspace <workspace-id>] --handoff <handoff-id> | apply [--workspace <source-id>] --handoff <handoff-id>';
+const TOPOLOGY_USAGE = 'Usage: sdlc topology inspect | relocate --state-dir <absolute-path> --storage-mode <machine_shared|self_contained> [--apply --expected-plan-hash <sha256>] | export --path <directory> | recover | clone --from <directory> --state-dir <absolute-path> --graph-repository-id <id>';
+/** Top-level help: the local-first commands, then the hosted ones. */
+export const SDLC_CLI_HELP = `Local graph (start here; no account needed):\n  sdlc workspace init    start a local graph in this repository\n  sdlc workspace ...     create, commit and inspect local plan workspaces\n  sdlc integrate ...     merge child workspaces into a coordinator\n  sdlc handoff ...       hand a child's changes back to its source\n  sdlc topology ...      inspect, move, export or clone local graph state\n  sdlc workspace attach  join another repository to an existing local graph\n  sdlc org ...           plan the local org: teams, job functions, posts and who holds them\nRun sdlc workspace|integrate|handoff|topology --help for their subcommands. Also local, described in the package README: viewer, remote, branch, merge, portable and resolver. ${LOCAL_ONLY_NOTE}\n\nPublic graph packages (no account needed; using packages in a local graph comes in a later release):\n  sdlc packages list|show|diff  browse the bundled and downloaded packages, offline\n  sdlc packages fetch    download newer versions of public packages\n  sdlc packages lock ... pin, update or remove the public packages a build bundles (for maintainers of the sdlc and plugin builds)\n\nPlugin:\n  sdlc allow-mcp         let the SoftwareDLC plugin run this repository's own install (--revoke, --list)\n\nSign-in (macOS; for hosted Tasks and queues):\n  sdlc login             sign this machine in to SoftwareDLC through the browser\n  sdlc auth token|status print a current access token, or the sign-in's state\n  sdlc logout            revoke and remove the sign-in\n\nDeployments (CI, with an API key in SDLC_API_KEY):\n  sdlc deploy record     record that a project's Environment began running a revision\n\nHosted project (needs a SoftwareDLC connection):\n${SDLC_CLI_USAGE}`;
+export const BRANCH_APPLY_USAGE = 'Usage: sdlc branch apply --idempotency-key <key> [--expected-workspace-revision <n>] [--expected-workspace-id <uuid>] [--expected-branch-revision <n>] [--branch-id <uuid>]';
+export const BRANCH_COMMIT_USAGE = 'Usage: sdlc branch commit --message <text> --expected-head <commit-uuid> [--branch-id <uuid>]';
+export const PULL_REQUEST_USAGE = 'Usage: sdlc pr review --pr-id <uuid> [--comparison-diff-id <uuid> --comparison-manifest-hash <sha256:hex> --expected-source <commit-uuid> --expected-target <commit-uuid>] | pr approve --pr-id <uuid> --expected-source <commit-uuid> --expected-target <commit-uuid> --review-hash <hash> | pr merge --pr-id <uuid>';
+const BRANCH_HISTORY_HELP = "These commands change user-owned branch history through the API, acting as the API key's user. They work only with a key its user created for themselves that carries the scope (branch:write, branch:commit, pull-request:approve, pull-request:merge), in an organization whose owner allows API branch writes (Organization Settings, API access). Branch permission, pull-request protection, required approvals and review readiness all apply. Each first reads its branch or pull request (graph:read) and refuses one outside this checkout's project. Without evidence options, pr review reads the pull request's current heads and merge base and builds its comparison evidence itself. Exit 0: done; 2: commit accepted but graph validation is still running, retry; 1: refused or invalid, with the refusal reason on stderr.";
+/**
+ * How `sdlc save --graph-file` applies its graph. `patch` (the default) merges a
+ * partial graph. `replace` treats the file as the complete proposal, so the save
+ * uploads only what differs from the acknowledged base, as a projection save does.
+ */
+export function parseGraphFileSaveMode(value) {
+    if (value === undefined || value === null || value === 'patch')
+        return 'patch';
+    if (value === 'replace')
+        return 'replace';
+    throw new Error('--save-mode must be patch or replace.');
+}
+function commandUsage(command, subcommand, viewUsage) {
+    if (command === 'allow-mcp')
+        return ALLOW_MCP_USAGE;
+    if (command === 'view')
+        return viewUsage ?? SDLC_VIEW_PUBLIC_USAGE;
+    if (command === 'packages')
+        return PACKAGES_USAGE;
+    if (command === 'org')
+        return ORG_USAGE;
+    if (command === 'login' || command === 'logout' || command === 'auth')
+        return SDLC_LOGIN_HELP;
+    if (command === 'deploy')
+        return SDLC_DEPLOY_HELP;
+    if (command === 'workspace')
+        return `${WORKSPACE_USAGE}\n${LOCAL_ONLY_NOTE}`;
+    if (command === 'integrate')
+        return `${INTEGRATE_USAGE}\n${LOCAL_ONLY_NOTE}`;
+    if (command === 'handoff')
+        return `${HANDOFF_USAGE}\n${LOCAL_ONLY_NOTE}`;
+    if (command === 'topology')
+        return `${TOPOLOGY_USAGE}\n${LOCAL_ONLY_NOTE}`;
+    if (command === 'branch' && subcommand === 'commit')
+        return `${BRANCH_COMMIT_USAGE}\nCommits the bound branch (or --branch-id) after graph validation passes. --expected-head is the branch's current head commit; a moved head is refused. It commits the Working graph, not the AI workspace: changes from sdlc save need sdlc branch apply first, and a commit that finds no changes on a branch with an AI workspace prints the apply command (hint, apply_command). ${BRANCH_HISTORY_HELP}`;
+    if (command === 'branch' && subcommand === 'apply')
+        return `${BRANCH_APPLY_USAGE}\nApplies the bound branch's (or --branch-id's) AI workspace proposal to its Working graph: the server builds the auto-merge plan, saves it as the key's user, and reconciles the workspace builds. --expected-workspace-revision is the proposal revision you approved, by default the one this checkout last saved or synced; a changed proposal, a moved Working graph, conflicts, or a protected branch are refused without writing. The workspace and Working revision default to the branch's current ones. Retrying with the same --idempotency-key finishes or replays the earlier apply. ${BRANCH_HISTORY_HELP}`;
+    if (command === 'pr')
+        return `${PULL_REQUEST_USAGE}\nreview binds the pull request's review to comparison evidence from POST /api/v1/graph/comparison/commits and prints its review_hash; approve approves that review at that hash; merge merges a ready, approved pull request (needs project manage). ${BRANCH_HISTORY_HELP}`;
+    if (command === 'save')
+        return "Usage: sdlc save [--graph-file <path> [--save-mode patch|replace]] [--base-url <url>] [--timeout-ms <1000..600000>]\nWithout --graph-file, saves the managed projection. --graph-file defaults to patch, which merges a partial graph and uploads it whole. Use --save-mode replace for a complete graph, such as a planning coordinator export: entities the file omits are removed, and only the changes from the acknowledged base are uploaded. When most nodes would be placed anew, such as a first save into an empty worktree, a replace save lays the graph out (or uses the file's positions when every node has one) and sends the geometry, so the server keeps it instead of laying out the whole graph; progress goes to standard error and the result's client_layout says what was sent. The server keeps the positions of nodes whose IDs and parents are unchanged, so keep node IDs stable across exports.";
+    if (command === 'reset')
+        return `${RESET_USAGE}\nResets the bound hosted AI worktree onto its branch's current Working graph: the hosted proposal is discarded and Working becomes the worktree's base. The active session then adopts the worktree's new revision as its acknowledged base, and the managed projection is neither read nor updated. Use it before a complete --save-mode replace save when the proposal's base fell behind Working, for example after the proposal was applied. Refused while a save is pending; run sdlc sync first.`;
+    if (command === 'branches')
+        return "Usage: sdlc branches [--timeout-ms <1000..600000>]\nLists the active project's hosted branches: id, name, whether it is the default, head commit, Working revision, and whether this Git ref is bound to it. Read-only; it needs no binding. Bind one with sdlc branch bind --branch-id <id>. The local-first sdlc branch list lists local-workspace branches instead.";
+    if (command === 'snapshot')
+        return 'Usage: sdlc snapshot inspect --snapshot-id <uuid> [--timeout-ms <1000..600000>]\nRead-only verified snapshot manifest and objects, preserving Path schema versions 1, 2 and 3. Uses the selected trusted connection and project association. Does not materialize or update the editable projection or enable v3 writes.';
+    if (command === 'task-context')
+        return 'Usage: sdlc task-context --task-id <id> [--execution-id <id>] [--registry-id <expected-id>] [--request-id <id>] [--response-bytes <256..32768>] [--timeout-ms <1000..30000>]\nRead-only local ownership context. Requires a named committed Git checkout; no SDLC setup, credentials or network. Registry identity is local-registry:<sha256 of canonical Git common directory>, shared by linked worktrees. Omit --registry-id to select the current local registry. Reports are observations, never mutation permission. Exit 0: known/absent ownership; 2: unavailable/stale; 1: invalid/discovery failure; 124: deadline; 130/143: cancelled.';
+    if (command === 'context') {
+        return 'Usage: sdlc context [--health] [--timeout-ms <1000..600000>]\n--health returns bounded local observations without setup or network access. Includes installed capabilities and advisory next action. WAL inspection and projection content remain explicitly unchecked/unsupported.';
+    }
+    if (command === 'status')
+        return 'Usage: sdlc status [--health] [--timeout-ms <1000..600000>]\n--health inspects bounded registered projection content and its acknowledged local base without setup, repair or network. WAL state remains explicitly unsupported.';
+    if (command === 'connection') {
+        if (subcommand === 'add') {
+            return 'Usage: sdlc connection add <name> --url <origin> --credential-env <ENV_NAME>';
+        }
+        return 'Usage: sdlc connection add <name> --url <origin> --credential-env <ENV_NAME> | sdlc connection list';
+    }
+    if (command === 'env') {
+        return 'Usage: sdlc env add <profile> --connection <name> --repository-id <uuid> | env migrate --connection <name> | env use <profile> | env recover | env current | env list';
+    }
+    return `Usage: sdlc ${command} [options]\nCovered read commands, checkout, refresh, save, sync, rebuild and media upload accept --timeout-ms <1000..600000>.\n\n${SDLC_CLI_USAGE}`;
+}
+function packageVersion(value) {
+    if (typeof value === 'object' &&
+        value !== null &&
+        'version' in value &&
+        typeof value.version === 'string' &&
+        value.version.trim()) {
+        return value.version;
+    }
+    throw new Error('Unable to read the SDLC CLI version from package metadata.');
+}
+export const SDLC_CLI_VERSION = packageVersion(package_metadata);
+function isHelpFlag(value) {
+    return value === '--help' || value === '-h';
+}
+/** Whether the arguments ask for sdlc view's usage, which the view's own code holds in full. */
+export function viewHelpRequested(args) {
+    const [command, subcommand] = args;
+    return command === 'help' ? subcommand === 'view' : command === 'view' && (isHelpFlag(subcommand) || isHelpFlag(args[2]));
+}
+/** `viewUsage` is sdlc view's full usage where its code loaded; without it help prints the public line. */
+export function runCliMetaCommand(args, { viewUsage } = {}) {
+    const [command, subcommand] = args;
+    if (args.length === 0 || isHelpFlag(command)) {
+        process.stdout.write(`${SDLC_CLI_HELP}\n`);
+        return true;
+    }
+    if ((command === '--version' || command === '-V' || command === 'version') &&
+        args.length === 1) {
+        process.stdout.write(`${SDLC_CLI_VERSION}\n`);
+        return true;
+    }
+    const help_command = command === 'help' ? subcommand : command;
+    const help_subcommand = command === 'help' ? args[2] : subcommand;
+    const help_requested = command === 'help' || isHelpFlag(subcommand) || isHelpFlag(args[2]);
+    if (command === 'help' && !subcommand) {
+        process.stdout.write(`${SDLC_CLI_HELP}\n`);
+        return true;
+    }
+    if (help_requested && help_command && CLI_COMMANDS.has(help_command)) {
+        process.stdout.write(`${commandUsage(help_command, help_subcommand, viewUsage)}\n`);
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=cli-help.js.map

package/dist/cli-help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,CAAC,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAElE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,gBAAgB,GAAY,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAE7D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,WAAW;IACX,MAAM;IACN,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,kBAAkB;IAClB,YAAY;IACZ,SAAS;IACT,cAAc;IACd,QAAQ;IACR,MAAM;IACN,KAAK;IACL,SAAS;IACT,MAAM;IACN,WAAW;IACX,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,UAAU;IACV,IAAI;IACJ,SAAS;IACT,WAAW;IACX,SAAS;IACT,QAAQ;IACR,OAAO;IACP,UAAU;IACV,IAAI;IACJ,MAAM;IACN,cAAc;IACd,SAAS;IACT,UAAU;IACV,QAAQ;IACR,MAAM;IACN,UAAU;IACV,UAAU;IACV,MAAM;IACN,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GACzB,mnEAAmnE,CAAC;AAEtnE,MAAM,eAAe,GACnB,qYAAqY,CAAC;AACxY,MAAM,eAAe,GACnB,qqHAAqqH,CAAC;AACxqH,MAAM,eAAe,GACnB,ocAAoc,CAAC;AACvc,MAAM,aAAa,GACjB,kTAAkT,CAAC;AACrT,MAAM,cAAc,GAClB,oRAAoR,CAAC;AAEvR,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,yuBAAyuB,eAAe,28BAA28B,cAAc,EAAE,CAAC;AAEjvD,MAAM,CAAC,MAAM,kBAAkB,GAC7B,6KAA6K,CAAC;AAChL,MAAM,CAAC,MAAM,mBAAmB,GAC9B,+FAA+F,CAAC;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAC7B,uTAAuT,CAAC;AAC1T,MAAM,mBAAmB,GACvB,8yBAA8yB,CAAC;AAEjzB;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAgC;IAEhC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,OAAO;QAC5D,OAAO,OAAO,CAAC;IACjB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,UAAmB,EAAE,SAAkB;IAC5E,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,eAAe,CAAC;IACpD,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,IAAI,sBAAsB,CAAC;IACnE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,cAAc,CAAC;IAClD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM;QACnE,OAAO,eAAe,CAAC;IACzB,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC;IAClD,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,GAAG,eAAe,KAAK,eAAe,EAAE,CAAC;IAC7E,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,GAAG,eAAe,KAAK,eAAe,EAAE,CAAC;IAC7E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,aAAa,KAAK,eAAe,EAAE,CAAC;IACzE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,GAAG,cAAc,KAAK,eAAe,EAAE,CAAC;IAC3E,IAAI,OAAO,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ;QACjD,OAAO,GAAG,mBAAmB,yXAAyX,mBAAmB,EAAE,CAAC;IAC9a,IAAI,OAAO,KAAK,QAAQ,IAAI,UAAU,KAAK,OAAO;QAChD,OAAO,GAAG,kBAAkB,qkBAAqkB,mBAAmB,EAAE,CAAC;IACznB,IAAI,OAAO,KAAK,IAAI;QAClB,OAAO,GAAG,kBAAkB,yPAAyP,mBAAmB,EAAE,CAAC;IAC7S,IAAI,OAAO,KAAK,MAAM;QACpB,OAAO,+3BAA+3B,CAAC;IACz4B,IAAI,OAAO,KAAK,OAAO;QACrB,OAAO,GAAG,WAAW,yeAAye,CAAC;IACjgB,IAAI,OAAO,KAAK,UAAU;QACxB,OAAO,wWAAwW,CAAC;IAClX,IAAI,OAAO,KAAK,UAAU;QACxB,OAAO,0TAA0T,CAAC;IACpU,IAAI,OAAO,KAAK,cAAc;QAC5B,OAAO,mnBAAmnB,CAAC;IAC7nB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,qRAAqR,CAAC;IAC/R,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QACtB,OAAO,kOAAkO,CAAC;IAC5O,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,8EAA8E,CAAC;QACxF,CAAC;QACD,OAAO,qGAAqG,CAAC;IAC/G,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,uKAAuK,CAAC;IACjL,CAAC;IACD,OAAO,eAAe,OAAO,qIAAqI,cAAc,EAAE,CAAC;AACrL,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,SAAS,IAAI,KAAK;QAClB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EACpB,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;AAEjE,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAC9C,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;IACnC,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5H,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,iBAAiB,CAAC,IAAc,EAAE,EAAE,SAAS,KAA6B,EAAE;IAC1F,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,CAAC,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC;QACtE,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,gBAAgB,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/D,MAAM,eAAe,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAClE,MAAM,cAAc,GAClB,OAAO,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli-login.d.ts

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+export declare const SDLC_LOGIN_CLIENT_ID = "b8a3f1c2-6d4e-4a7b-9c1d-2e5f8a0b3c64";
+export declare const SDLC_LOGIN_PORTS: readonly [41521, 41522, 41523, 41524, 41525];
+export declare const SDLC_LOGIN_DEFAULT_ORIGIN = "https://www.softwaredlc.com";
+export declare const SDLC_LOGIN_USAGE = "Usage: sdlc login [--url <origin> | --connection <name>] [--no-browser] | logout [--url <origin> | --connection <name>] | auth token [--url <origin> | --connection <name>] | auth status [--url <origin> | --connection <name>]";
+export declare const SDLC_LOGIN_HELP = "Usage: sdlc login [--url <origin> | --connection <name>] [--no-browser] | logout [--url <origin> | --connection <name>] | auth token [--url <origin> | --connection <name>] | auth status [--url <origin> | --connection <name>]\nlogin signs this machine in through the browser and keeps the sign-in in the macOS Keychain, one per origin (default https://www.softwaredlc.com); a new login revokes the origin's previous sign-in. auth token prints a current access token for the Task API, refreshing it first when it expires within a minute; local tools read the token this way, never from the Keychain. auth status prints the origin, scope and expiry, never a token. logout revokes the sign-in and removes it. Trusted connections keep using their API key variable. macOS only in this release; elsewhere, and on CI, use an API key.";
+declare const stored_sign_in_schema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    origin: z.ZodString;
+    client_id: z.ZodString;
+    access_token: z.ZodString;
+    refresh_token: z.ZodString;
+    scope: z.ZodString;
+    access_expires_at: z.ZodNumber;
+    signed_in_at: z.ZodNumber;
+}, z.core.$strict>;
+export type StoredSignIn = z.infer<typeof stored_sign_in_schema>;
+/** Where sign-ins are kept, one secret per origin. */
+export type SecretStore = {
+    read(origin: string): Promise<string | null>;
+    write(origin: string, value: string): Promise<void>;
+    remove(origin: string): Promise<void>;
+};
+export type LoginDeps = {
+    platform: NodeJS.Platform;
+    fetch: typeof fetch;
+    store: SecretStore;
+    now: () => number;
+    lock_dir: string;
+    open_browser: (url: string) => Promise<void>;
+    device_label: () => Promise<string>;
+    ports: readonly number[];
+    timeout_ms: number;
+    connection_origin: (name: string) => Promise<string>;
+    out: (text: string) => void;
+    note: (text: string) => void;
+};
+/**
+ * Runs sdlc login, logout, auth token and auth status. Returns false for any
+ * other command. Results are JSON on standard output, except auth token,
+ * which prints the token alone.
+ */
+export declare function runCliLogin(args: string[], overrides?: Partial<LoginDeps>): Promise<boolean>;
+/**
+ * The current access token for the origin, refreshed first when it expires
+ * within a minute. The refresh runs under the origin's lock, so concurrent
+ * callers on this machine refresh once: the server revokes a grant whose
+ * rotated refresh token is used again.
+ */
+export declare function currentAccessToken(origin: string, deps: LoginDeps): Promise<string>;
+type CallbackListener = {
+    redirect_uri: string;
+    code: Promise<string>;
+    close: () => void;
+};
+/**
+ * A one-shot listener on the first free registered port of 127.0.0.1. Its
+ * code settles with the authorization code of the first callback carrying
+ * this login's state, and fails on an error callback or after the timeout.
+ */
+export declare function listenForCallback(ports: readonly number[], state: string, timeout_ms: number): Promise<CallbackListener>;
+/**
+ * Runs fn holding the origin's lock file, which other sdlc processes on this
+ * machine wait for. The file names its holder's process and a token; it is
+ * abandoned only once that process has exited, so a slow or sleeping holder
+ * keeps it. Only the holder removes a live lock, and only while it is theirs.
+ */
+export declare function withLoginLock<T>(origin: string, deps: Pick<LoginDeps, 'lock_dir' | 'now'>, fn: () => Promise<T>): Promise<T>;
+/**
+ * The macOS login Keychain, through the security command. Writes go through
+ * security -i on standard input, so the secret never appears in a process
+ * argument list.
+ */
+export declare function keychainStore(): SecretStore;
+export {};
+//# sourceMappingURL=cli-login.d.ts.map

package/dist/cli-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-login.d.ts","sourceRoot":"","sources":["../src/cli-login.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,eAAO,MAAM,oBAAoB,yCAAyC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,8CAA+C,CAAC;AAC7E,eAAO,MAAM,yBAAyB,gCAAgC,CAAC;AACvE,eAAO,MAAM,gBAAgB,qOACuM,CAAC;AACrO,eAAO,MAAM,eAAe,8zBAAknB,CAAC;AAc/oB,QAAA,MAAM,qBAAqB;;;;;;;;;kBAYhB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AASjE,sDAAsD;AACtD,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC1B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,KAAK,EAAE,WAAW,CAAC;IACnB,GAAG,EAAE,MAAM,MAAM,CAAC;IAElB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAErD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B,CAAC;AAIF;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,GAAE,OAAO,CAAC,SAAS,CAAM,GACjC,OAAO,CAAC,OAAO,CAAC,CA+BlB;AA8HD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAuID,KAAK,gBAAgB,GAAG;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,CAAC,CAyD3B;AA6BD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,KAAK,CAAC,EACzC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CA+CZ;AA4ED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,WAAW,CA0C3C"}