@spec0/cli 0.4.1 → 0.6.0

package/dist/lib/errors.js

@@ -0,0 +1,99 @@
+/**
+ * One place to turn a failed platform call into a diagnosable error.
+ *
+ * Before this, command catch-blocks printed a bare `(err as Error).message` —
+ * e.g. `api list failed: Not Found` — with no HTTP status, no URL, and no hint
+ * about which org/base was targeted. A developer literally could not tell what
+ * went wrong. `failApi` classifies the error into a stable exit code and surfaces:
+ *
+ *   - the server's own message (from the response body when present),
+ *   - the HTTP status (or a network label when the request never completed),
+ *   - the method + URL that failed,
+ *   - the active org + API base, and
+ *   - a code-specific hint.
+ *
+ * In `--output json|yaml` mode the request/org context rides in `details` so the
+ * document stays a single clean object; in text mode it is appended to the
+ * message so a human sees it inline.
+ */
+import { errorStatusCode, errorRequestInfo, extractErrorMessage } from "./api-client.js";
+import { ExitCode, exitCodeForHttpStatus } from "./exit-codes.js";
+import { fail } from "./output/index.js";
+const HINTS = {
+    [ExitCode.AUTH_MISSING]: "Run 'spec0 auth login', or refresh SPEC0_TOKEN.",
+    [ExitCode.PERMISSION_DENIED]: "Your account lacks permission for this resource.",
+    [ExitCode.NOT_FOUND]: "Check the name/id, or confirm SPEC0_API_URL points at the right backend.",
+    [ExitCode.CONFLICT]: "A resource with that name/version already exists.",
+    [ExitCode.VALIDATION]: "The request was rejected as invalid — see the message above.",
+    [ExitCode.RATE_LIMITED]: "Rate limit hit — wait a moment and retry.",
+    [ExitCode.SERVER_ERROR]: "Server error — retry shortly; if it persists, contact support.",
+    [ExitCode.NETWORK_ERROR]: "Could not reach the platform. Check connectivity, then SPEC0_API_URL (run 'spec0 doctor').",
+};
+/**
+ * Best-effort label for a request that never produced an HTTP response.
+ * `got` puts the code on the error itself; the SDK uses `fetch`, which wraps the
+ * real cause (so the visible message is an unhelpful "fetch failed" and the code
+ * lives on `err.cause`). Check both.
+ */
+function networkLabel(err) {
+    // A `fetch` timeout/cancellation is a DOMException with no `code` — it
+    // identifies itself by `name` ("TimeoutError" / "AbortError") instead.
+    const name = err?.name ?? err?.cause?.name;
+    if (name === "TimeoutError")
+        return "timed out";
+    if (name === "AbortError")
+        return "request aborted";
+    const code = err?.code ?? err?.cause?.code;
+    if (!code)
+        return undefined;
+    if (code === "ECONNREFUSED")
+        return "connection refused";
+    if (code === "ENOTFOUND" || code === "EAI_AGAIN")
+        return "host not found";
+    if (code === "ETIMEDOUT" || code === "ETIME")
+        return "timed out";
+    return code;
+}
+/**
+ * Pure classification of a failed platform call into an exit code, message,
+ * hint and structured details. Separated from `failApi` so it can be unit
+ * tested without `process.exit`.
+ */
+export function buildApiError(err, info, format = "text") {
+    const status = errorStatusCode(err);
+    const code = exitCodeForHttpStatus(status);
+    const netLabel = status === undefined ? networkLabel(err) : undefined;
+    const serverMsg = extractErrorMessage(err);
+    const base = serverMsg ?? netLabel ?? err?.message ?? String(err);
+    const { method, url } = errorRequestInfo(err);
+    const statusPart = status !== undefined ? `HTTP ${status}` : undefined;
+    let message = `${info.action} failed: ${base}` + (statusPart ? ` (${statusPart})` : "");
+    const requestLine = url ? `${method ?? "GET"} ${url}` : undefined;
+    if (format === "text") {
+        const extra = [
+            requestLine ? `  ${requestLine}` : undefined,
+            info.org ? `  org: ${info.org}` : undefined,
+        ].filter(Boolean);
+        if (extra.length)
+            message += "\n" + extra.join("\n");
+    }
+    return {
+        code,
+        message,
+        hint: HINTS[code],
+        details: {
+            ...(status !== undefined ? { status } : {}),
+            ...(requestLine ? { request: requestLine } : {}),
+            ...(info.org ? { org: info.org } : {}),
+            ...(info.apiUrl ? { apiUrl: info.apiUrl } : {}),
+        },
+    };
+}
+/**
+ * Report a failed platform call and exit. Never returns.
+ */
+export function failApi(ctx, err, info) {
+    const report = buildApiError(err, info, ctx.format);
+    fail(ctx, report.code, report.message, { hint: report.hint, details: report.details });
+}
+//# sourceMappingURL=errors.js.map

package/dist/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAsB,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,IAAI,EAAsB,MAAM,mBAAmB,CAAC;AAW7D,MAAM,KAAK,GAA2C;IACpD,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,iDAAiD;IAC1E,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,kDAAkD;IAChF,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,0EAA0E;IAChG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mDAAmD;IACxE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,8DAA8D;IACrF,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,2CAA2C;IACpE,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,gEAAgE;IACzF,CAAC,QAAQ,CAAC,aAAa,CAAC,EACtB,4FAA4F;CAC/F,CAAC;AAEF;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,IAAI,GACP,GAAyB,EAAE,IAAI,IAAK,GAAqC,EAAE,KAAK,EAAE,IAAI,CAAC;IAC1F,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,WAAW,CAAC;IAChD,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,iBAAiB,CAAC;IAEpD,MAAM,IAAI,GACP,GAAyB,EAAE,IAAI,IAAK,GAAqC,EAAE,KAAK,EAAE,IAAI,CAAC;IAC1F,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,oBAAoB,CAAC;IACzD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,gBAAgB,CAAC;IAC1E,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAY,EACZ,IAAqB,EACrB,SAAkC,MAAM;IAExC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,SAAS,IAAI,QAAQ,IAAK,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,YAAY,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAExF,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG;YACZ,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;YAC5C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAC5C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO;QACL,IAAI;QACJ,OAAO;QACP,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QACjB,OAAO,EAAE;YACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,GAAkB,EAAE,GAAY,EAAE,IAAqB;IAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AACzF,CAAC"}

package/dist/lib/http-trace.d.ts

@@ -0,0 +1,37 @@
+/**
+ * HTTP instrumentation: a default request timeout (always on) plus opt-in
+ * `--verbose` request tracing.
+ *
+ * The CLI talks to the platform over two transports: raw `got` (see
+ * `api-client.ts`) and the generated `@spec0/sdk-public-platform`, which issues
+ * calls through the global `fetch`. Neither had a timeout, so a silently
+ * dropped connection could hang the CLI forever, and neither printed anything,
+ * so a failing command could not show *which URL* it hit.
+ *
+ * `installHttpInstrumentation()` wraps the global `fetch` once at startup to
+ *   - apply a default timeout (combined with any signal the SDK already passes,
+ *     so cancellation still works), and
+ *   - trace each request/response when `--verbose` is on.
+ * `got` gets the same timeout via its own options and calls `traceRequest` /
+ * `traceResponse` from its hooks.
+ *
+ * All trace output goes to **stderr** so stdout stays a clean single document
+ * for `--output json|yaml` consumers.
+ */
+/**
+ * Default per-request timeout in milliseconds. Override with
+ * `SPEC0_HTTP_TIMEOUT_MS`; falls back to 30s for any unset/invalid value.
+ */
+export declare function httpTimeoutMs(): number;
+/** Enable/disable `--verbose` request tracing. */
+export declare function setHttpTrace(on: boolean): void;
+export declare function httpTraceEnabled(): boolean;
+export declare function traceRequest(method: string, url: string): void;
+export declare function traceResponse(status: number, url: string): void;
+export declare function traceError(method: string, url: string, message: string): void;
+/**
+ * Wrap the global `fetch` once (covers all SDK calls) to apply the default
+ * timeout and trace when verbose. Idempotent; safe to call at startup.
+ */
+export declare function installHttpInstrumentation(): void;
+//# sourceMappingURL=http-trace.d.ts.map

package/dist/lib/http-trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-trace.d.ts","sourceRoot":"","sources":["../../src/lib/http-trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED,kDAAkD;AAClD,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAE9C;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAMD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7E;AAgBD;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CA2BjD"}

package/dist/lib/http-trace.js

@@ -0,0 +1,101 @@
+/**
+ * HTTP instrumentation: a default request timeout (always on) plus opt-in
+ * `--verbose` request tracing.
+ *
+ * The CLI talks to the platform over two transports: raw `got` (see
+ * `api-client.ts`) and the generated `@spec0/sdk-public-platform`, which issues
+ * calls through the global `fetch`. Neither had a timeout, so a silently
+ * dropped connection could hang the CLI forever, and neither printed anything,
+ * so a failing command could not show *which URL* it hit.
+ *
+ * `installHttpInstrumentation()` wraps the global `fetch` once at startup to
+ *   - apply a default timeout (combined with any signal the SDK already passes,
+ *     so cancellation still works), and
+ *   - trace each request/response when `--verbose` is on.
+ * `got` gets the same timeout via its own options and calls `traceRequest` /
+ * `traceResponse` from its hooks.
+ *
+ * All trace output goes to **stderr** so stdout stays a clean single document
+ * for `--output json|yaml` consumers.
+ */
+import chalk from "chalk";
+const DEFAULT_TIMEOUT_MS = 30_000;
+let enabled = false;
+let installed = false;
+/**
+ * Default per-request timeout in milliseconds. Override with
+ * `SPEC0_HTTP_TIMEOUT_MS`; falls back to 30s for any unset/invalid value.
+ */
+export function httpTimeoutMs() {
+    const raw = process.env.SPEC0_HTTP_TIMEOUT_MS;
+    const n = raw ? Number(raw) : NaN;
+    return Number.isFinite(n) && n > 0 ? n : DEFAULT_TIMEOUT_MS;
+}
+/** Enable/disable `--verbose` request tracing. */
+export function setHttpTrace(on) {
+    enabled = on;
+}
+export function httpTraceEnabled() {
+    return enabled;
+}
+function line(text) {
+    process.stderr.write(chalk.gray(text.endsWith("\n") ? text : `${text}\n`));
+}
+export function traceRequest(method, url) {
+    if (enabled)
+        line(`→ ${method} ${url}`);
+}
+export function traceResponse(status, url) {
+    if (enabled)
+        line(`← ${status} ${url}`);
+}
+export function traceError(method, url, message) {
+    if (enabled)
+        line(`✗ ${method} ${url} — ${message}`);
+}
+/**
+ * Combine the SDK's own abort signal (if any) with a timeout signal so a hung
+ * request fails fast while explicit cancellation still works.
+ */
+function withTimeout(init) {
+    const timeout = AbortSignal.timeout(httpTimeoutMs());
+    const existing = init?.signal ?? undefined;
+    const signal = existing && typeof AbortSignal.any === "function"
+        ? AbortSignal.any([existing, timeout])
+        : (existing ?? timeout);
+    return { ...init, signal };
+}
+/**
+ * Wrap the global `fetch` once (covers all SDK calls) to apply the default
+ * timeout and trace when verbose. Idempotent; safe to call at startup.
+ */
+export function installHttpInstrumentation() {
+    if (installed)
+        return;
+    const original = globalThis.fetch;
+    if (typeof original !== "function")
+        return;
+    globalThis.fetch = (async (input, init) => {
+        const method = init?.method ??
+            (typeof input === "object" && input !== null && "method" in input
+                ? input.method
+                : "GET");
+        const url = typeof input === "string"
+            ? input
+            : input instanceof URL
+                ? input.toString()
+                : input.url;
+        traceRequest(method, url);
+        try {
+            const res = await original(input, withTimeout(init));
+            traceResponse(res.status, url);
+            return res;
+        }
+        catch (err) {
+            traceError(method, url, err.message);
+            throw err;
+        }
+    });
+    installed = true;
+}
+//# sourceMappingURL=http-trace.js.map

package/dist/lib/http-trace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-trace.js","sourceRoot":"","sources":["../../src/lib/http-trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC9D,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,YAAY,CAAC,EAAW;IACtC,OAAO,GAAG,EAAE,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IACtD,IAAI,OAAO;QAAE,IAAI,CAAC,KAAK,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,GAAW;IACvD,IAAI,OAAO;QAAE,IAAI,CAAC,KAAK,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,GAAW,EAAE,OAAe;IACrE,IAAI,OAAO;QAAE,IAAI,CAAC,KAAK,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAkB;IACrC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC;IAC3C,MAAM,MAAM,GACV,QAAQ,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,UAAU;QAC/C,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;IAC5B,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,SAAS;QAAE,OAAO;IACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO;IAC3C,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAkC,EAAE,IAAkB,EAAE,EAAE;QACnF,MAAM,MAAM,GACV,IAAI,EAAE,MAAM;YACZ,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK;gBAC/D,CAAC,CAAE,KAAiB,CAAC,MAAM;gBAC3B,CAAC,CAAC,KAAK,CAAC,CAAC;QACb,MAAM,GAAG,GACP,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,YAAY,GAAG;gBACpB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAClB,CAAC,CAAE,KAAiB,CAAC,GAAG,CAAC;QAC/B,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/B,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,MAAM,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAiB,CAAC;IACnB,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}

package/dist/lib/output.d.ts

@@ -27,6 +27,10 @@ export declare function formatPublishText(output: {
     versionUnchanged?: boolean;
     versionUnchangedHint?: string;
     created?: boolean;
+    governanceWarnings?: Array<{
+        section?: string;
+        message?: string;
+    }>;
 }): string;
 export declare function formatGitHubAnnotation(file: string, line: number, level: "error" | "warning", message: string): string;
 //# sourceMappingURL=output.d.ts.map

package/dist/lib/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtD,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnE,GAAG,MAAM,CAsBT;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAgCT;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,GAAG,SAAS,EAC1B,OAAO,EAAE,MAAM,GACd,MAAM,CAER"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtD,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnE,GAAG,MAAM,CAsBT;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE,GAAG,MAAM,CA2CT;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,GAAG,SAAS,EAC1B,OAAO,EAAE,MAAM,GACd,MAAM,CAER"}

package/dist/lib/output.js

@@ -56,6 +56,14 @@ export function formatPublishText(output) {
             chalk.yellow(output.versionUnchangedHint ??
                 `Spec changed but version is still ${output.version}. Pass --semver to auto-bump.`));
     }
+    const warnings = output.governanceWarnings ?? [];
+    if (warnings.length > 0) {
+        lines.push("");
+        lines.push(chalk.yellow(`⚠ ${warnings.length} governance warning${warnings.length === 1 ? "" : "s"}:`));
+        for (const w of warnings) {
+            lines.push(chalk.yellow(`  [${w.section ?? "policy"}] ${w.message ?? ""}`));
+        }
+    }
     return lines.join("\n");
 }
 export function formatGitHubAnnotation(file, line, level, message) {

package/dist/lib/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,MAAM,UAAU,cAAc,CAAC,MAI9B;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,iCAAiC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAYjC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAEhE,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YAChB,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,oBAAoB;gBACzB,qCAAqC,MAAM,CAAC,OAAO,+BAA+B,CACrF,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,IAAY,EACZ,KAA0B,EAC1B,OAAe;IAEf,OAAO,KAAK,KAAK,SAAS,IAAI,SAAS,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;AAClF,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,MAAM,UAAU,cAAc,CAAC,MAI9B;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,iCAAiC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAajC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAEnE,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAEhE,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YAChB,KAAK,CAAC,MAAM,CACV,MAAM,CAAC,oBAAoB;gBACzB,qCAAqC,MAAM,CAAC,OAAO,+BAA+B,CACrF,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM,sBAAsB,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAC5F,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,IAAY,EACZ,KAA0B,EAC1B,OAAe;IAEf,OAAO,KAAK,KAAK,SAAS,IAAI,SAAS,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;AAClF,CAAC"}

package/dist/lib/platform-defaults.d.ts

@@ -8,20 +8,45 @@
  *   lint, search, registry, …). Stored on login as `org.apiUrl` and used by
  *   `createOrgApiClient` / `createApiClient`.
  *
- * Defaults below match local dev (Next :3000, Spring :8080 + context path). Override both for
+ * Defaults below match local dev (Next :3000, backend :8080 at the host root). Override both for
  * staging/production. `SPEC0_API_URL` should align with `NEXT_PUBLIC_API_BASE_URL` in
- * api-management-ui, not the Next.js site origin alone.
+ * the web UI, not the Next.js site origin alone.
  *
  * Legacy: `PLATFORM_APP_URL` / `PLATFORM_API_URL` are still accepted as fallbacks.
  */
 /** Next.js / browser app — CLI auth (`/cli-auth`) and push output links. */
 export declare const DEFAULT_PLATFORM_APP_URL = "https://app.spec0.io";
 /**
- * Spring Boot API base (include servlet context path if your deploy uses one).
+ * Backend API base. The platform serves at the host root, so this is a bare host
+ * with no path suffix; the SDK and raw call sites append their own service paths.
  */
-export declare const DEFAULT_PLATFORM_API_URL = "https://api.spec0.io/api-management";
+export declare const DEFAULT_PLATFORM_API_URL = "https://api.spec0.io";
+/**
+ * Canonical MCP (Model Context Protocol) server endpoint. This is the single
+ * Streamable HTTP endpoint that MCP clients (Cursor, Claude) connect to over
+ * HTTP POST. A bearer token is optional: anonymous access exposes the public
+ * docs tools, and an authenticated token unlocks the org-scoped tools. It is a
+ * different surface from the REST API base, so it has its own default and its
+ * own override env var.
+ */
+export declare const DEFAULT_PLATFORM_MCP_URL = "https://api.spec0.io/mcp";
 /** Web app origin for auth + UI links — never used as the REST base. */
 export declare function resolvedPlatformAppUrl(): string;
 /** Backend base for all CLI REST calls — never derived from the app URL. */
 export declare function resolvedPlatformApiUrl(): string;
+/**
+ * Canonical MCP Streamable HTTP endpoint clients connect to. Override with
+ * `SPEC0_MCP_URL` (legacy `PLATFORM_MCP_URL` accepted as a fallback) for
+ * staging/self-hosted.
+ */
+export declare function resolvedPlatformMcpUrl(): string;
+/**
+ * MCP base used as the root for sibling MCP paths such as the health probe
+ * behind `spec0 mcp test`. With the single Streamable HTTP endpoint the URL is
+ * already the base, so for back-compat we only trim a legacy trailing `/sse`
+ * (older overrides may still carry it) and otherwise return the endpoint as-is.
+ * Derived from the same default/override as {@link resolvedPlatformMcpUrl} so
+ * the two never drift apart — e.g. `…/mcp` → `…/mcp/health`.
+ */
+export declare function resolvedPlatformMcpBaseUrl(): string;
 //# sourceMappingURL=platform-defaults.d.ts.map

package/dist/lib/platform-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-defaults.d.ts","sourceRoot":"","sources":["../../src/lib/platform-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,wBAAwB,wCAAwC,CAAC;AAM9E,wEAAwE;AACxE,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C"}
+{"version":3,"file":"platform-defaults.d.ts","sourceRoot":"","sources":["../../src/lib/platform-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAMnE,wEAAwE;AACxE,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAG/C;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD"}

package/dist/lib/platform-defaults.js

@@ -8,18 +8,28 @@
  *   lint, search, registry, …). Stored on login as `org.apiUrl` and used by
  *   `createOrgApiClient` / `createApiClient`.
  *
- * Defaults below match local dev (Next :3000, Spring :8080 + context path). Override both for
+ * Defaults below match local dev (Next :3000, backend :8080 at the host root). Override both for
  * staging/production. `SPEC0_API_URL` should align with `NEXT_PUBLIC_API_BASE_URL` in
- * api-management-ui, not the Next.js site origin alone.
+ * the web UI, not the Next.js site origin alone.
  *
  * Legacy: `PLATFORM_APP_URL` / `PLATFORM_API_URL` are still accepted as fallbacks.
  */
 /** Next.js / browser app — CLI auth (`/cli-auth`) and push output links. */
 export const DEFAULT_PLATFORM_APP_URL = "https://app.spec0.io";
 /**
- * Spring Boot API base (include servlet context path if your deploy uses one).
+ * Backend API base. The platform serves at the host root, so this is a bare host
+ * with no path suffix; the SDK and raw call sites append their own service paths.
  */
-export const DEFAULT_PLATFORM_API_URL = "https://api.spec0.io/api-management";
+export const DEFAULT_PLATFORM_API_URL = "https://api.spec0.io";
+/**
+ * Canonical MCP (Model Context Protocol) server endpoint. This is the single
+ * Streamable HTTP endpoint that MCP clients (Cursor, Claude) connect to over
+ * HTTP POST. A bearer token is optional: anonymous access exposes the public
+ * docs tools, and an authenticated token unlocks the org-scoped tools. It is a
+ * different surface from the REST API base, so it has its own default and its
+ * own override env var.
+ */
+export const DEFAULT_PLATFORM_MCP_URL = "https://api.spec0.io/mcp";
 function normalizeOrigin(url) {
     return url.trim().replace(/\/$/, "");
 }
@@ -33,4 +43,24 @@ export function resolvedPlatformApiUrl() {
     const raw = (process.env.SPEC0_API_URL ?? process.env.PLATFORM_API_URL)?.trim();
     return normalizeOrigin(raw || DEFAULT_PLATFORM_API_URL);
 }
+/**
+ * Canonical MCP Streamable HTTP endpoint clients connect to. Override with
+ * `SPEC0_MCP_URL` (legacy `PLATFORM_MCP_URL` accepted as a fallback) for
+ * staging/self-hosted.
+ */
+export function resolvedPlatformMcpUrl() {
+    const raw = (process.env.SPEC0_MCP_URL ?? process.env.PLATFORM_MCP_URL)?.trim();
+    return normalizeOrigin(raw || DEFAULT_PLATFORM_MCP_URL);
+}
+/**
+ * MCP base used as the root for sibling MCP paths such as the health probe
+ * behind `spec0 mcp test`. With the single Streamable HTTP endpoint the URL is
+ * already the base, so for back-compat we only trim a legacy trailing `/sse`
+ * (older overrides may still carry it) and otherwise return the endpoint as-is.
+ * Derived from the same default/override as {@link resolvedPlatformMcpUrl} so
+ * the two never drift apart — e.g. `…/mcp` → `…/mcp/health`.
+ */
+export function resolvedPlatformMcpBaseUrl() {
+    return resolvedPlatformMcpUrl().replace(/\/sse$/, "");
+}
 //# sourceMappingURL=platform-defaults.js.map

package/dist/lib/platform-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-defaults.js","sourceRoot":"","sources":["../../src/lib/platform-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AAE9E,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChF,OAAO,eAAe,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;AAC1D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChF,OAAO,eAAe,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"platform-defaults.js","sourceRoot":"","sources":["../../src/lib/platform-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChF,OAAO,eAAe,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;AAC1D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChF,OAAO,eAAe,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IAChF,OAAO,eAAe,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,sBAAsB,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spec0/cli",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Spec0 CLI — publish API specs, create mock servers, lint, and interact with the Spec0 platform",
   "main": "dist/index.js",
   "bin": {
@@ -54,16 +54,16 @@
   },
   "homepage": "https://github.com/spec-0/cli#readme",
   "dependencies": {
-    "@inquirer/prompts": "^7.2.0",
-    "@spec0/sdk-public-platform": "^1.2.0",
+    "@inquirer/prompts": "^8.5.2",
+    "@spec0/sdk-public-platform": "^1.3.1",
     "@stoplight/spectral-core": "^1.22.0",
     "@stoplight/spectral-parsers": "^1.0.0",
     "@stoplight/spectral-rulesets": "^1.22.1",
     "chalk": "^5.3.0",
     "cli-table3": "^0.6.5",
-    "commander": "^12.1.0",
+    "commander": "^14.0.3",
     "conf": "^13.0.0",
-    "diff": "^7.0.0",
+    "diff": "^9.0.0",
     "got": "^14.4.1",
     "open": "^10.0.0",
     "ora": "^8.1.0",
@@ -71,7 +71,7 @@
   },
   "devDependencies": {
     "@commitlint/cli": "^20.5.0",
-    "@commitlint/config-conventional": "^20.5.0",
+    "@commitlint/config-conventional": "^21.0.0",
     "@eslint/js": "^9.39.4",
     "@types/diff": "^7.0.0",
     "@types/jest": "^30.0.0",