@solidnumber/cli 1.9.28 → 1.10.0

package/dist/lib/mcp-client-config.js

@@ -0,0 +1,166 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MCP_PACKAGE = exports.SUPPORTED_CLIENTS = void 0;
+exports.isSupportedClient = isSupportedClient;
+exports.configPathForClient = configPathForClient;
+exports.buildServerEntry = buildServerEntry;
+exports.mergeIntoConfig = mergeIntoConfig;
+exports.removeFromConfig = removeFromConfig;
+exports.serializeConfig = serializeConfig;
+/**
+ * MCP client config helpers (Sprint 1 T1.5).
+ *
+ * Write/update the client-side JSON that tells Claude Desktop / Cursor /
+ * Windsurf how to launch the Solid# MCP server. All pure — no fs here,
+ * no network. Callers in src/commands/mcp.ts handle I/O.
+ *
+ * Supported client shapes (as of 2026-04):
+ *
+ *   Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
+ *     {
+ *       "mcpServers": {
+ *         "solid": { "command": "npx", "args": ["@solidnumber/mcp"],
+ *                     "env": { "SOLID_API_KEY": "sk_..." } }
+ *       }
+ *     }
+ *
+ *   Cursor (~/.cursor/mcp.json): same shape as Claude Desktop
+ *
+ *   Windsurf (~/.codeium/windsurf/mcp_config.json): same shape
+ */
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+exports.SUPPORTED_CLIENTS = ['claude', 'cursor', 'windsurf'];
+/** Returns true if the string is a known supported client. */
+function isSupportedClient(value) {
+    return !!value && exports.SUPPORTED_CLIENTS.includes(value);
+}
+/**
+ * Per-OS default path for each supported client. Returns the path
+ * relative to `homeDir` so callers can pass their own for testing.
+ */
+function configPathForClient(client, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    const home = opts.homeDir ?? os.homedir();
+    switch (client) {
+        case 'claude':
+            if (platform === 'darwin') {
+                return path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+            }
+            if (platform === 'win32') {
+                // %APPDATA% → fall back to ~/AppData/Roaming when not set
+                const appdata = opts.platform === undefined ? process.env.APPDATA : undefined;
+                const base = appdata ?? path.join(home, 'AppData', 'Roaming');
+                return path.join(base, 'Claude', 'claude_desktop_config.json');
+            }
+            // Linux — Claude Desktop isn't officially supported there but keep
+            // a sane default so tests have something to assert.
+            return path.join(home, '.config', 'Claude', 'claude_desktop_config.json');
+        case 'cursor':
+            return path.join(home, '.cursor', 'mcp.json');
+        case 'windsurf':
+            if (platform === 'darwin' || platform === 'linux') {
+                return path.join(home, '.codeium', 'windsurf', 'mcp_config.json');
+            }
+            if (platform === 'win32') {
+                const appdata = opts.platform === undefined ? process.env.APPDATA : undefined;
+                const base = appdata ?? path.join(home, 'AppData', 'Roaming');
+                return path.join(base, 'Codeium', 'Windsurf', 'mcp_config.json');
+            }
+            return path.join(home, '.codeium', 'windsurf', 'mcp_config.json');
+    }
+}
+/** Default package that ships the stdio MCP server. */
+exports.DEFAULT_MCP_PACKAGE = '@solidnumber/mcp';
+/**
+ * Build the `mcpServers.solid` entry. Pure — no I/O, no env reads.
+ */
+function buildServerEntry(input = {}) {
+    const env = {};
+    if (input.apiKey)
+        env.SOLID_API_KEY = input.apiKey;
+    if (input.apiUrl)
+        env.SOLID_API_URL = input.apiUrl;
+    if (input.companyId !== undefined && input.companyId !== null && input.companyId !== '') {
+        env.SOLID_COMPANY_ID = String(input.companyId);
+    }
+    if (input.extraEnv) {
+        for (const [k, v] of Object.entries(input.extraEnv)) {
+            if (typeof v === 'string' && v.length > 0)
+                env[k] = v;
+        }
+    }
+    const entry = {
+        command: 'npx',
+        args: ['-y', input.packageName ?? exports.DEFAULT_MCP_PACKAGE],
+    };
+    if (Object.keys(env).length > 0)
+        entry.env = env;
+    return entry;
+}
+/**
+ * Merge a new `solid` server entry into an existing config file.
+ * Preserves any other mcpServers keys and any top-level keys we don't
+ * recognize. Returns a NEW object — input is not mutated.
+ */
+function mergeIntoConfig(existing, entry, serverKey = 'solid') {
+    const base = existing && typeof existing === 'object' ? { ...existing } : {};
+    const servers = { ...(base.mcpServers ?? {}) };
+    servers[serverKey] = entry;
+    base.mcpServers = servers;
+    return base;
+}
+/**
+ * Remove the `solid` entry from a config, preserving other keys.
+ * Returns the NEW config (unmutated input). When only `solid` existed
+ * in mcpServers, keeps an empty `mcpServers: {}` to be explicit.
+ */
+function removeFromConfig(existing, serverKey = 'solid') {
+    const base = existing && typeof existing === 'object' ? { ...existing } : {};
+    if (base.mcpServers && typeof base.mcpServers === 'object') {
+        const { [serverKey]: _, ...rest } = base.mcpServers;
+        base.mcpServers = rest;
+    }
+    return base;
+}
+/**
+ * Pretty-print a config with stable key order + 2-space indent. Writes
+ * this string is the caller's responsibility.
+ */
+function serializeConfig(cfg) {
+    return JSON.stringify(cfg, null, 2) + '\n';
+}
+//# sourceMappingURL=mcp-client-config.js.map

package/dist/lib/mcp-client-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-client-config.js","sourceRoot":"","sources":["../../src/lib/mcp-client-config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,8CAEC;AAkBD,kDAoCC;AAqBD,4CAkBC;AAOD,0CAUC;AAOD,4CAUC;AAMD,0CAEC;AAtKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,uCAAyB;AACzB,2CAA6B;AAIhB,QAAA,iBAAiB,GAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAE/E,8DAA8D;AAC9D,SAAgB,iBAAiB,CAAC,KAAgC;IAChE,OAAO,CAAC,CAAC,KAAK,IAAK,yBAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAcD;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,MAAiB,EACjB,OAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAE1C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,0DAA0D;gBAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9E,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YACjE,CAAC;YACD,mEAAmE;YACnE,oDAAoD;YACpD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QAE5E,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAEhD,KAAK,UAAU;YACb,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9E,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC9D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAeD,uDAAuD;AAC1C,QAAA,mBAAmB,GAAG,kBAAkB,CAAC;AAEtD;;GAEG;AACH,SAAgB,gBAAgB,CAAC,QAAyB,EAAE;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM;QAAE,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM;QAAE,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC;IACnD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QACxF,GAAG,CAAC,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,2BAAmB,CAAC;KACvD,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,QAA0C,EAC1C,KAAkB,EAClB,YAAoB,OAAO;IAE3B,MAAM,IAAI,GAAkB,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,MAAM,OAAO,GAAgC,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAC9B,QAA0C,EAC1C,YAAoB,OAAO;IAE3B,MAAM,IAAI,GAAkB,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,GAAkB;IAChD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7C,CAAC"}

package/dist/lib/program-registry.d.ts

@@ -0,0 +1,19 @@
+/**
+ * program-registry — lazy handle on the root Commander program so any
+ * command module can introspect the full verb tree without creating an
+ * import cycle with index.ts.
+ *
+ * Sprint 1 T1.3: `solid schema verbs --json` needs to walk every
+ * subcommand. Without this registry, schema.ts would have to import
+ * program from index.ts, which already imports schemaCommand from
+ * schema.ts — cycle.
+ *
+ * Pure module state: one writer (index.ts) + many readers (schema,
+ * doctor, etc.). No async, no I/O.
+ */
+import type { Command } from 'commander';
+export declare function setProgram(p: Command): void;
+export declare function getProgram(): Command | null;
+/** Reset for tests. */
+export declare function resetProgramForTest(): void;
+//# sourceMappingURL=program-registry.d.ts.map

package/dist/lib/program-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"program-registry.d.ts","sourceRoot":"","sources":["../../src/lib/program-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAE3C;AAED,wBAAgB,UAAU,IAAI,OAAO,GAAG,IAAI,CAE3C;AAED,uBAAuB;AACvB,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/dist/lib/program-registry.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setProgram = setProgram;
+exports.getProgram = getProgram;
+exports.resetProgramForTest = resetProgramForTest;
+let _program = null;
+function setProgram(p) {
+    _program = p;
+}
+function getProgram() {
+    return _program;
+}
+/** Reset for tests. */
+function resetProgramForTest() {
+    _program = null;
+}
+//# sourceMappingURL=program-registry.js.map

package/dist/lib/program-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"program-registry.js","sourceRoot":"","sources":["../../src/lib/program-registry.ts"],"names":[],"mappings":";;AAiBA,gCAEC;AAED,gCAEC;AAGD,kDAEC;AAbD,IAAI,QAAQ,GAAmB,IAAI,CAAC;AAEpC,SAAgB,UAAU,CAAC,CAAU;IACnC,QAAQ,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,UAAU;IACxB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uBAAuB;AACvB,SAAgB,mBAAmB;IACjC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/lib/scope-diagnostic.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Scope/feature-gap diagnostic (Sprint 1 T1.6).
+ *
+ * Compares the scopes currently granted on an API key against the scopes
+ * the tenant's enabled features *should* grant (per backend service
+ * services/scope_expansion.py, Sprint 0 T0.5). Surfaces mismatches so
+ * `solid doctor` can tell the operator: "your key is missing agents:read
+ * because your tenant enabled the agents feature after the key was
+ * issued — rotate the key and you'll pick up the new scopes."
+ *
+ * Pure — takes primitives, returns primitives. No HTTP, no fs. The
+ * backend has the same map in services/scope_expansion.py; this is a
+ * narrow client-side mirror so operators see drift without a round-trip.
+ * Kept small on purpose: if it diverges from the backend map, the only
+ * impact is a diagnostic miss — enforcement is still server-side.
+ */
+/**
+ * Feature key → scopes it should grant on issuance.
+ * MUST stay in lock-step with solid-backend/services/scope_expansion.py
+ * FEATURE_TO_SCOPES. Keep small — every entry is a permission decision.
+ */
+export declare const FEATURE_TO_SCOPES: Readonly<Record<string, readonly string[]>>;
+/**
+ * Given the key's current scopes and the tenant's feature flags, return
+ * a sorted list of scopes that SHOULD be granted but aren't.
+ *
+ * Pure — no I/O.
+ */
+export declare function computeScopeGap(currentScopes: readonly string[] | null | undefined, featureSettings: Record<string, unknown> | null | undefined, featureToScopes?: Readonly<Record<string, readonly string[]>>): string[];
+export interface ScopeDiagnosticFinding {
+    severity: 'ok' | 'warn' | 'fail';
+    code: 'SCOPE_GAP' | 'NO_FEATURES' | 'NO_SCOPES' | 'ALL_GRANTED';
+    message: string;
+    missing_scopes: string[];
+    hint?: string;
+}
+/**
+ * Wrap computeScopeGap with a pre-canned diagnostic payload — the shape
+ * `solid doctor` surfaces to the operator. Pure.
+ */
+export declare function diagnoseScopeGap(currentScopes: readonly string[] | null | undefined, featureSettings: Record<string, unknown> | null | undefined): ScopeDiagnosticFinding;
+//# sourceMappingURL=scope-diagnostic.d.ts.map

package/dist/lib/scope-diagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-diagnostic.d.ts","sourceRoot":"","sources":["../../src/lib/scope-diagnostic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAGzE,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EACnD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAC3D,eAAe,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAqB,GAC/E,MAAM,EAAE,CAgBV;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,IAAI,EAAE,WAAW,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,CAAC;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EACnD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAC1D,sBAAsB,CAkCxB"}

package/dist/lib/scope-diagnostic.js

@@ -0,0 +1,104 @@
+"use strict";
+/**
+ * Scope/feature-gap diagnostic (Sprint 1 T1.6).
+ *
+ * Compares the scopes currently granted on an API key against the scopes
+ * the tenant's enabled features *should* grant (per backend service
+ * services/scope_expansion.py, Sprint 0 T0.5). Surfaces mismatches so
+ * `solid doctor` can tell the operator: "your key is missing agents:read
+ * because your tenant enabled the agents feature after the key was
+ * issued — rotate the key and you'll pick up the new scopes."
+ *
+ * Pure — takes primitives, returns primitives. No HTTP, no fs. The
+ * backend has the same map in services/scope_expansion.py; this is a
+ * narrow client-side mirror so operators see drift without a round-trip.
+ * Kept small on purpose: if it diverges from the backend map, the only
+ * impact is a diagnostic miss — enforcement is still server-side.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FEATURE_TO_SCOPES = void 0;
+exports.computeScopeGap = computeScopeGap;
+exports.diagnoseScopeGap = diagnoseScopeGap;
+/**
+ * Feature key → scopes it should grant on issuance.
+ * MUST stay in lock-step with solid-backend/services/scope_expansion.py
+ * FEATURE_TO_SCOPES. Keep small — every entry is a permission decision.
+ */
+exports.FEATURE_TO_SCOPES = {
+    agents: ['agents:read', 'agents:write', 'agents:data', 'agents:converse'],
+    'ai-agents-platform': ['agents:read', 'agents:write', 'agents:data', 'agents:converse'],
+};
+function isTruthy(v) {
+    if (typeof v === 'boolean')
+        return v;
+    if (typeof v === 'number')
+        return v !== 0;
+    if (typeof v === 'string')
+        return /^(1|true|yes|on)$/i.test(v.trim());
+    return false;
+}
+/**
+ * Given the key's current scopes and the tenant's feature flags, return
+ * a sorted list of scopes that SHOULD be granted but aren't.
+ *
+ * Pure — no I/O.
+ */
+function computeScopeGap(currentScopes, featureSettings, featureToScopes = exports.FEATURE_TO_SCOPES) {
+    const current = new Set(currentScopes ?? []);
+    const implied = new Set();
+    if (featureSettings) {
+        for (const [feature, scopes] of Object.entries(featureToScopes)) {
+            if (isTruthy(featureSettings[feature])) {
+                for (const s of scopes)
+                    implied.add(s);
+            }
+        }
+    }
+    const gap = [];
+    for (const s of implied) {
+        if (!current.has(s))
+            gap.push(s);
+    }
+    gap.sort();
+    return gap;
+}
+/**
+ * Wrap computeScopeGap with a pre-canned diagnostic payload — the shape
+ * `solid doctor` surfaces to the operator. Pure.
+ */
+function diagnoseScopeGap(currentScopes, featureSettings) {
+    if (!featureSettings || Object.keys(featureSettings).length === 0) {
+        return {
+            severity: 'warn',
+            code: 'NO_FEATURES',
+            message: 'Tenant feature flags not available; cannot check scope gap.',
+            missing_scopes: [],
+        };
+    }
+    const gap = computeScopeGap(currentScopes, featureSettings);
+    if (gap.length === 0) {
+        return {
+            severity: 'ok',
+            code: 'ALL_GRANTED',
+            message: 'Key scopes match tenant features.',
+            missing_scopes: [],
+        };
+    }
+    if (!currentScopes || currentScopes.length === 0) {
+        return {
+            severity: 'fail',
+            code: 'NO_SCOPES',
+            message: 'Current API key has no scopes — every tenant feature is under-privileged.',
+            missing_scopes: gap,
+            hint: 'Rotate with: solid keys rotate --scopes "' + gap.join(',') + '"',
+        };
+    }
+    return {
+        severity: 'fail',
+        code: 'SCOPE_GAP',
+        message: `API key is missing ${gap.length} scope(s) that tenant features imply.`,
+        missing_scopes: gap,
+        hint: 'Rotate with: solid keys rotate --add-scope ' + gap.join(' --add-scope '),
+    };
+}
+//# sourceMappingURL=scope-diagnostic.js.map

package/dist/lib/scope-diagnostic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-diagnostic.js","sourceRoot":"","sources":["../../src/lib/scope-diagnostic.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAyBH,0CAoBC;AAcD,4CAqCC;AA9FD;;;;GAIG;AACU,QAAA,iBAAiB,GAAgD;IAC5E,MAAM,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC;IACzE,oBAAoB,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC;CACxF,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,aAAmD,EACnD,eAA2D,EAC3D,kBAA+D,yBAAiB;IAEhF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAChE,IAAI,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACvC,KAAK,MAAM,CAAC,IAAI,MAAM;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,GAAG,CAAC,IAAI,EAAE,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,aAAmD,EACnD,eAA2D;IAE3D,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,6DAA6D;YACtE,cAAc,EAAE,EAAE;SACnB,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,mCAAmC;YAC5C,cAAc,EAAE,EAAE;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,2EAA2E;YACpF,cAAc,EAAE,GAAG;YACnB,IAAI,EAAE,2CAA2C,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;SACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,sBAAsB,GAAG,CAAC,MAAM,uCAAuC;QAChF,cAAc,EAAE,GAAG;QACnB,IAAI,EAAE,6CAA6C,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;KAChF,CAAC;AACJ,CAAC"}

package/dist/lib/verb-manifest.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Pure verb-manifest walker.
+ *
+ * Walks a Commander tree and emits a flat list of {path, description,
+ * options, args, subcommands} entries. Used by `solid schema verbs
+ * --json` so agents (Claude Code, Cursor) can discover every verb the
+ * CLI exposes without scraping --help.
+ *
+ * No I/O, no commander parsing — just tree traversal + field
+ * extraction. Unit-tested in src/__tests__/verb-manifest.test.ts.
+ */
+import type { Command } from 'commander';
+export interface VerbOption {
+    flags: string;
+    description: string;
+    required: boolean;
+    default?: unknown;
+}
+export interface VerbArg {
+    name: string;
+    required: boolean;
+    description?: string;
+    variadic?: boolean;
+}
+export interface VerbEntry {
+    /** Short name — e.g. "pages". */
+    verb: string;
+    /** Full invocation path — e.g. "solid schema pages". */
+    path: string;
+    /** One-line description from .description(). */
+    description: string;
+    /** How deep in the tree (0 = root children, 1 = grandchildren, ...). */
+    depth: number;
+    /** Options on this command (NOT inherited). */
+    options: VerbOption[];
+    /** Positional args declared on this command. */
+    args: VerbArg[];
+    /** Subcommand names (not full paths). */
+    subcommands: string[];
+    /** True when this command has no subcommands and can be invoked directly. */
+    is_leaf: boolean;
+}
+export interface WalkOptions {
+    /** Prefix prepended to every path. Defaults to "solid". */
+    prefix?: string;
+    /** Skip the root cmd itself — emit only its descendants. Default true. */
+    skipRoot?: boolean;
+    /** Include hidden commands (commander hides some with .hidden()). Default false. */
+    includeHidden?: boolean;
+}
+/**
+ * Recursively walk a Commander tree and return a flat manifest.
+ *
+ * Pure — depends only on properties accessible through Commander's public
+ * surface plus tolerant fallbacks for its internal fields.
+ */
+export declare function walkVerbs(root: Command, opts?: WalkOptions): VerbEntry[];
+/** Build the wire payload for `solid schema verbs --json`. */
+export interface VerbManifest {
+    version: '1.0';
+    cli_version: string;
+    count: number;
+    verbs: VerbEntry[];
+}
+export declare function buildVerbManifest(root: Command, cliVersion: string, opts?: WalkOptions): VerbManifest;
+//# sourceMappingURL=verb-manifest.d.ts.map

package/dist/lib/verb-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verb-manifest.d.ts","sourceRoot":"","sources":["../../src/lib/verb-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,gDAAgD;IAChD,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,yCAAyC;IACzC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;CAClB;AAwDD,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,GAAE,WAAgB,GAAG,SAAS,EAAE,CAgD5E;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,WAAW,GACjB,YAAY,CAQd"}

package/dist/lib/verb-manifest.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkVerbs = walkVerbs;
+exports.buildVerbManifest = buildVerbManifest;
+/** Safely extract option metadata, tolerant of both commander v7 and v10 shapes. */
+function toOption(o) {
+    const entry = {
+        flags: o.flags ?? '',
+        description: o.description ?? '',
+        required: Boolean(o.required ?? o.mandatory ?? false),
+    };
+    if (o.defaultValue !== undefined) {
+        entry.default = o.defaultValue;
+    }
+    return entry;
+}
+/** Safely extract arg metadata from commander's Argument class. */
+function toArg(a) {
+    // commander v7 stores args as { _name, required, description, variadic }
+    // commander v10 Argument class has a .name() method
+    let name = '';
+    if (typeof a.name === 'function') {
+        try {
+            name = a.name();
+        }
+        catch {
+            name = '';
+        }
+    }
+    else if (typeof a.name === 'string') {
+        name = a.name;
+    }
+    else if (a._name) {
+        name = a._name;
+    }
+    const entry = {
+        name,
+        required: Boolean(a.required ?? false),
+    };
+    if (a.description)
+        entry.description = a.description;
+    if (a.variadic)
+        entry.variadic = true;
+    return entry;
+}
+/**
+ * Recursively walk a Commander tree and return a flat manifest.
+ *
+ * Pure — depends only on properties accessible through Commander's public
+ * surface plus tolerant fallbacks for its internal fields.
+ */
+function walkVerbs(root, opts = {}) {
+    const prefix = opts.prefix ?? 'solid';
+    const skipRoot = opts.skipRoot ?? true;
+    const includeHidden = opts.includeHidden ?? false;
+    const out = [];
+    function visit(cmd, pathPrefix, depth) {
+        // commander exposes _hidden (v7) or cmd._hidden — tolerant access.
+        const hidden = Boolean(cmd._hidden);
+        if (hidden && !includeHidden)
+            return;
+        const name = cmd.name();
+        const thisPath = pathPrefix ? `${pathPrefix} ${name}` : name;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const rawArgs = cmd._args ?? cmd.registeredArguments ?? [];
+        const options = (cmd.options || []).map(toOption);
+        const args = rawArgs.map(toArg);
+        const subcommands = (cmd.commands || []).map((sc) => sc.name());
+        out.push({
+            verb: name,
+            path: thisPath,
+            description: cmd.description() || '',
+            depth,
+            options,
+            args,
+            subcommands,
+            is_leaf: subcommands.length === 0,
+        });
+        for (const sc of cmd.commands || []) {
+            visit(sc, thisPath, depth + 1);
+        }
+    }
+    if (skipRoot) {
+        // Emit the root's children only — typical for a CLI where the root IS
+        // the program name and has no verb of its own.
+        for (const sc of root.commands || []) {
+            visit(sc, prefix, 0);
+        }
+    }
+    else {
+        visit(root, '', 0);
+    }
+    return out;
+}
+function buildVerbManifest(root, cliVersion, opts) {
+    const verbs = walkVerbs(root, opts);
+    return {
+        version: '1.0',
+        cli_version: cliVersion,
+        count: verbs.length,
+        verbs,
+    };
+}
+//# sourceMappingURL=verb-manifest.js.map

package/dist/lib/verb-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verb-manifest.js","sourceRoot":"","sources":["../../src/lib/verb-manifest.ts"],"names":[],"mappings":";;AAmHA,8BAgDC;AAUD,8CAYC;AA3HD,oFAAoF;AACpF,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,KAAK,GAAe;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;QAChC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;KACtD,CAAC;IACF,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,SAAS,KAAK,CAAC,CAAa;IAC1B,yEAAyE;IACzE,oDAAoD;IACpD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAI,CAAC,CAAC,IAAqB,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;SAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAY;QACrB,IAAI;QACJ,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;KACvC,CAAC;IACF,IAAI,CAAC,CAAC,WAAW;QAAE,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACrD,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC;AAWD;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,IAAa,EAAE,OAAoB,EAAE;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC;IAElD,MAAM,GAAG,GAAgB,EAAE,CAAC;IAE5B,SAAS,KAAK,CAAC,GAAY,EAAE,UAAkB,EAAE,KAAa;QAC5D,mEAAmE;QACnE,MAAM,MAAM,GAAG,OAAO,CAAE,GAAwC,CAAC,OAAO,CAAC,CAAC;QAC1E,IAAI,MAAM,IAAI,CAAC,aAAa;YAAE,OAAO;QAErC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAE7D,8DAA8D;QAC9D,MAAM,OAAO,GAAkB,GAAW,CAAC,KAAK,IAAK,GAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAC3F,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhE,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE;YACpC,KAAK;YACL,OAAO;YACP,IAAI;YACJ,WAAW;YACX,OAAO,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;SAClC,CAAC,CAAC;QAEH,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,sEAAsE;QACtE,+CAA+C;QAC/C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,SAAgB,iBAAiB,CAC/B,IAAa,EACb,UAAkB,EAClB,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,UAAU;QACvB,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,KAAK;KACN,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidnumber/cli",
-  "version": "1.9.28",
+  "version": "1.10.0",
   "description": "AI business infrastructure from the terminal — CRM, payments, voice AI, 116 agents, 52 industry templates. solid clone plumber → instant business. Also: programmatic TS SDK via @solidnumber/cli/sdk.",
   "main": "dist/index.js",
   "bin": {