@the-librarian/cli 1.0.0-rc.21

package/dist/server/update.d.ts

@@ -0,0 +1,35 @@
+export interface UpdateOptions {
+    /** Pinned ref (`vX.Y.Z` tag or `main`). Default: the latest release tag. */
+    ref?: string | undefined;
+    /** Auto-accept prompts (none today; wired for surface parity with `up`). */
+    yes?: boolean | undefined;
+    /** Deploy dir override. Default: `~/.librarian/server`. */
+    dir?: string | undefined;
+    /** Override home (tests). */
+    home?: string | undefined;
+    /** Platform for preflight's daemon hint. Default `process.platform`. */
+    platform?: NodeJS.Platform | undefined;
+    /** Health-wait bound: how many polls before declaring failure (small in tests). */
+    healthAttempts?: number | undefined;
+    /** Milliseconds between health polls (0 in tests). */
+    healthIntervalMs?: number | undefined;
+    /** Lines of `docker logs` to surface on a failed health-wait. */
+    logTailLines?: number | undefined;
+}
+/** A teaching error from `update`; the runtime renders `.message` as one stderr line. */
+export declare class UpdateError extends Error {
+    constructor(message: string);
+}
+export interface UpdateResult {
+    /** Human-readable report for stdout (carries a FRESH agent token at most once). */
+    output: string;
+}
+/**
+ * Run `server update`. Throws `UpdateError` (teaching message) on a failure
+ * before/around the recreate; a failed health-wait throws the (already
+ * secret-redacted) `UpError` from `waitForHealthy` after rolling the new
+ * container back. deploy-state is advanced ONLY after a confirmed-healthy
+ * recreate, so a failed update never records the new ref.
+ */
+export declare function runUpdate(options?: UpdateOptions): Promise<UpdateResult>;
+//# sourceMappingURL=update.d.ts.map

package/dist/server/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/server/update.ts"],"names":[],"mappings":"AA6EA,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IACvC,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,yFAAyF;AACzF,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FlF"}

package/dist/server/update.js

@@ -0,0 +1,308 @@
+// `librarian server update` — re-pin forward, rebuild, recreate, migrate.
+//
+// The tag-pinned, deploy-dir-owning successor to `pull-and-restart.sh` (the
+// stash/branch dance is gone — the CLI owns its deploy dir, so it just fetches
+// tags and checks out the resolved ref). The flow (spec §8, success criterion 5):
+//
+//   1. Resolve the target ref: `--ref <tag|main>` pins it; default = the latest
+//      release tag (`fetchLatestVersion`).
+//   2. IDEMPOTENCY FIRST: read deploy-state (current ref) + the container's
+//      health. Already at the resolved ref AND healthy → a CLEAN no-op (no
+//      build, no run, no recreate). When `--ref` is given, compare against it.
+//   3. Otherwise update, IN THE DEPLOY DIR:
+//        git fetch --tags origin → git checkout <ref>
+//        → docker build -f docker/all-in-one.Dockerfile -t the-librarian:<ref> .
+//        → read back the EXISTING agent token + master key from the running
+//          container's env (so clients keep working AND secrets stay
+//          decryptable) BEFORE removing it
+//        → docker stop → docker rm <container>   (NEVER `-v`, NEVER `volume rm`)
+//        → write the 0600 deploy env-file (preserved/fresh token + preserved-or-
+//          omitted master key + loopback ALLOW_NO_AUTH) then docker run …
+//          (buildRunArgs with the SAME host + dataVolume from deploy-state, via
+//          `--env-file`)
+//        → waitForHealthy (rolls back with `docker rm -f` on failure — reusing
+//          up's pattern, so a failed recreate leaves no half-up container and
+//          does NOT advance deploy-state)
+//        → docker exec the-librarian the-librarian migrate-data-dir
+//          (server boot only WARNS about pending data-dir migrations; the admin
+//           CLI APPLIES them — see packages/cli/src/commands/migrate-data-dir.ts.
+//           The `the-librarian` runtime binary is bundled into the image in S7;
+//           this slice asserts the argv, the runtime target arrives with S7.)
+//   4. writeDeployState with the new ref/imageTag (host/dataVolume unchanged).
+//
+// SECRETS ON UPDATE (decision): recreating the container needs the agent token
+// AND — ADR 0008 P4 — the master key (`LIBRARIAN_SECRET_KEY`) again. Both are
+// correctly NOT persisted host-side except in the 0600 deploy env-file. We read
+// BOTH back from the running container's env via `docker inspect` BEFORE we
+// remove it (P4 put the master key there via `--env-file`, so it's in
+// `.Config.Env`), then recreate with them — clients keep working AND every
+// settings.json secret stays decryptable.
+//
+//   - AGENT TOKEN: prefer the read-back token; only if the old container is
+//     gone/unreadable do we mint a FRESH token and surface it ONCE with a
+//     "clients must update their token" note.
+//   - MASTER KEY: prefer the read-back key. If it can't be read back we DO NOT
+//     mint a fresh one — re-minting would orphan every secret encrypted under
+//     the old key. Instead we OMIT `LIBRARIAN_SECRET_KEY` from the new env-file
+//     so the server resolves it from `/data/secret.key` (env → file → generate),
+//     which preserves a pre-P4 on-disk key (and only generates when the data dir
+//     is genuinely fresh — nothing to orphan).
+//
+// Both secrets ride ONLY in the 0600 deploy env-file fed to `docker run
+// --env-file` — never inline on argv, never in any other host file or log (the
+// spec's no-leak boundary; tests scan for them).
+//
+// The DATA VOLUME is sacred: recreate removes the CONTAINER only (`docker rm`),
+// never the named volume (the `-v` flag / `docker volume rm` never appear), so
+// `up`/`update`/`down` all recall the same memories from the untouched volume.
+//
+// Everything goes through the injectable `docker.ts` runner + the injectable
+// latest-release fetcher, so tests assert the exact argv (and its order) WITHOUT
+// a real daemon, network, or git.
+import path from "node:path";
+import { librarianDir } from "../paths.js";
+import { fetchLatestVersion } from "../status.js";
+import { readDeployState, writeDeployState } from "./deploy-state.js";
+import { run } from "./docker.js";
+import { preflight } from "./preflight.js";
+import { redactSecrets } from "./redact.js";
+import { buildRunArgs, CONTAINER_NAME, mintAgentToken, waitForHealthy, writeDeployEnvFile, } from "./up.js";
+/** A teaching error from `update`; the runtime renders `.message` as one stderr line. */
+export class UpdateError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UpdateError";
+    }
+}
+/**
+ * Run `server update`. Throws `UpdateError` (teaching message) on a failure
+ * before/around the recreate; a failed health-wait throws the (already
+ * secret-redacted) `UpError` from `waitForHealthy` after rolling the new
+ * container back. deploy-state is advanced ONLY after a confirmed-healthy
+ * recreate, so a failed update never records the new ref.
+ */
+export async function runUpdate(options = {}) {
+    // 1) Preflight: docker (daemon reachable) + git, or a teaching error.
+    await preflight(options.platform ? { platform: options.platform } : {});
+    const deployDir = options.dir ?? path.join(librarianDir(options.home), "server");
+    // The deploy-state is authoritative for the bind host + data volume to reuse.
+    // Without it we cannot recreate the container with the same config — teach.
+    const state = readDeployState(deployDir);
+    if (!state) {
+        throw new UpdateError(`No deploy-state found at ${deployDir} — this host has not run \`librarian server up\` ` +
+            "(or the deploy dir is wrong). Run `librarian server up` first, " +
+            "or pass `--dir <path>` to point at an existing deploy dir.");
+    }
+    // 2) Resolve the target ref (explicit `--ref` wins; else the latest tag).
+    const targetRef = await resolveRef(options.ref);
+    // 3) IDEMPOTENCY FIRST: already at the resolved ref AND healthy → clean no-op.
+    if (state.ref === targetRef && (await isHealthy())) {
+        return {
+            output: [
+                `Already up to date (${targetRef}) — the container is healthy.`,
+                "Nothing to do. Pin a different ref with `--ref <tag|main>` to change it.",
+            ].join("\n"),
+        };
+    }
+    // 4) Update, in the deploy dir: fetch tags → checkout the resolved ref.
+    await git(["-C", deployDir, "fetch", "--tags", "origin"]);
+    await checkoutRef(deployDir, targetRef);
+    // 5) Build the new image from the deploy dir.
+    await dockerInDir(["build", "-f", "docker/all-in-one.Dockerfile", "-t", `${CONTAINER_NAME}:${targetRef}`, "."], deployDir);
+    // 6) Read the EXISTING secrets back from the running container's env BEFORE
+    //    removal (one `docker inspect`; ADR 0008 P4 put the master key there via
+    //    `--env-file`). PREFER reusing both:
+    //      - agent token: reuse, else mint fresh (clients re-paste).
+    //      - master key: reuse, else OMIT (server resolves /data/secret.key) —
+    //        NEVER mint a fresh key, which would orphan encrypted secrets.
+    const existingEnv = await readExistingContainerEnv();
+    const existingToken = existingEnv.get("LIBRARIAN_AGENT_TOKEN") ?? null;
+    const existingKey = existingEnv.get("LIBRARIAN_SECRET_KEY") ?? null;
+    const agentToken = existingToken ?? mintAgentToken();
+    const tokenIsFresh = existingToken === null;
+    // 7) Recreate — CONTAINER ONLY. `docker stop` then `docker rm <name>`:
+    //    NEVER `-v`, NEVER `docker volume rm`. The named data volume persists.
+    await dockerStop();
+    await dockerRm();
+    // 8) Write the 0600 deploy env-file, then run the new container with the SAME
+    //    host + data volume from deploy-state, secrets via `--env-file` (ADR 0008
+    //    P4 — never inline on argv). The master key is the preserved one, or
+    //    omitted (then the server resolves it from /data/secret.key).
+    const envFile = writeDeployEnvFile(deployDir, {
+        agentToken,
+        secretKey: existingKey ?? undefined,
+        host: state.host,
+    });
+    await dockerInDir(buildRunArgs({
+        host: state.host,
+        dataVolume: state.dataVolume,
+        tag: targetRef,
+        envFile,
+    }), deployDir);
+    // 9) Wait for health (rolls back with `docker rm -f` on failure — up's
+    //    pattern). If this throws, deploy-state is NOT advanced below.
+    await waitForHealthy(options);
+    // 10) Apply pending data-dir migrations via the bundled admin CLI (S7 bundles
+    //     the `the-librarian` binary into the image; this slice asserts the argv).
+    await dockerExecMigrate();
+    // 11) Persist the new ref/imageTag — host/dataVolume/containerName unchanged.
+    writeDeployState(deployDir, {
+        containerName: state.containerName,
+        host: state.host,
+        dataVolume: state.dataVolume,
+        ref: targetRef,
+        imageTag: `${CONTAINER_NAME}:${targetRef}`,
+    });
+    return { output: renderSuccess(targetRef, tokenIsFresh ? agentToken : null) };
+}
+// --- ref + health probes -------------------------------------------------
+/** Resolve the target ref: an explicit `--ref` wins; else the latest tag. */
+async function resolveRef(ref) {
+    if (ref && ref.trim().length > 0)
+        return ref.trim();
+    const latest = await fetchLatestVersion();
+    if (!latest) {
+        throw new UpdateError("Could not resolve the latest release tag from GitHub. " +
+            "Check your network, or pin a ref with `--ref <tag|main>`.");
+    }
+    // `fetchLatestVersion` strips the leading `v`; the tag we check out keeps it.
+    return `v${latest}`;
+}
+/**
+ * True iff the container exists AND reports `healthy`. Used by the idempotency
+ * check — already at the ref but unhealthy means we still recreate. A failing
+ * `docker inspect` (no such container) → not healthy.
+ */
+async function isHealthy() {
+    const status = await run("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME]);
+    if (status.code !== 0 || status.stdout.trim() !== "running")
+        return false;
+    const health = await run("docker", [
+        "inspect",
+        "--format",
+        "{{.State.Health.Status}}",
+        CONTAINER_NAME,
+    ]);
+    return health.code === 0 && health.stdout.trim() === "healthy";
+}
+// --- secret read-back (clients keep working; secrets stay decryptable) ----
+/**
+ * Read the running container's env (`docker inspect .Config.Env`) into a map,
+ * BEFORE the container is removed, so an `update` reuses the existing secrets
+ * rather than silently breaking clients or orphaning encrypted settings. Returns
+ * an EMPTY map when the container is gone/unreadable (a non-zero inspect) — the
+ * caller then mints a fresh agent token and omits the master key. Empty values
+ * are dropped (treated as "not present"). The values are returned for reuse on
+ * recreate — never logged.
+ */
+async function readExistingContainerEnv() {
+    const env = new Map();
+    const result = await run("docker", [
+        "inspect",
+        "--format",
+        "{{range .Config.Env}}{{println .}}{{end}}",
+        CONTAINER_NAME,
+    ]);
+    if (result.code !== 0)
+        return env;
+    for (const line of result.stdout.split("\n")) {
+        const trimmed = line.trim();
+        const eq = trimmed.indexOf("=");
+        if (eq <= 0)
+            continue; // no `=`, or a leading `=` (no name) → skip
+        const name = trimmed.slice(0, eq);
+        const value = trimmed.slice(eq + 1);
+        if (value.length > 0)
+            env.set(name, value);
+    }
+    return env;
+}
+// --- thin runner wrappers (teaching errors on a non-zero exit) ----------
+/** Run a `git …` command; a non-zero exit is a teaching error. */
+async function git(args) {
+    const result = await run("git", args);
+    failIfNonZero("git", args, result);
+}
+/**
+ * Check out `ref` in `dir` without letting a `--…`-shaped ref inject a git
+ * option (S-1). `git checkout` does NOT honor `--end-of-options` — it reads the
+ * marker itself as a pathspec (verified on git 2.43) — so we resolve the ref to
+ * a commit SHA with `git rev-parse` (which DOES honor it, the injection guard
+ * that works), then check out that SHA — a hex object id can't be an option.
+ */
+async function checkoutRef(dir, ref) {
+    const resolved = await run("git", [
+        "-C",
+        dir,
+        "rev-parse",
+        "--verify",
+        "--end-of-options",
+        `${ref}^{commit}`,
+    ]);
+    failIfNonZero("git", ["-C", dir, "rev-parse", ref], resolved);
+    await git(["-C", dir, "checkout", resolved.stdout.trim()]);
+}
+/** Run a `docker …` command from the deploy dir; non-zero exit → teaching error. */
+async function dockerInDir(args, cwd) {
+    const result = await run("docker", args, { cwd });
+    failIfNonZero("docker", args, result);
+}
+/** Stop the old container. A not-running/not-found container is fine (we recreate). */
+async function dockerStop() {
+    const result = await run("docker", ["stop", CONTAINER_NAME]);
+    if (result.code === 0)
+        return;
+    if (isNotFound(result.stderr))
+        return; // nothing to stop — proceed to rm/run
+    failIfNonZero("docker", ["stop", CONTAINER_NAME], result);
+}
+/**
+ * Remove the old CONTAINER (NOT the volume). `docker rm <name>` — never `-v`,
+ * never `docker volume rm`. A not-found container is fine (we recreate).
+ */
+async function dockerRm() {
+    const result = await run("docker", ["rm", CONTAINER_NAME]);
+    if (result.code === 0)
+        return;
+    if (isNotFound(result.stderr))
+        return; // already gone — proceed to run
+    failIfNonZero("docker", ["rm", CONTAINER_NAME], result);
+}
+/** Apply pending data-dir migrations inside the (now-healthy) container. */
+async function dockerExecMigrate() {
+    const args = ["exec", CONTAINER_NAME, CONTAINER_NAME, "migrate-data-dir"];
+    const result = await run("docker", args);
+    failIfNonZero("docker", args, result);
+}
+/** True when a docker error means the container simply isn't there. */
+function isNotFound(stderr) {
+    return /no such container|no such object|is not running/i.test(stderr);
+}
+function failIfNonZero(cmd, args, result) {
+    if (result.code === 0)
+        return;
+    // Redact in case a non-zero docker step echoed a secret-shaped line.
+    const detail = redactSecrets(result.stderr.trim() || result.stdout.trim());
+    throw new UpdateError(`\`${cmd} ${args[0]}\` failed (exit ${result.code ?? "signal"})` +
+        (detail ? `:\n${detail}` : ".") +
+        "\n\nResolve the error above, then re-run `librarian server update`.");
+}
+// --- success report ------------------------------------------------------
+/**
+ * The success report. `freshToken` is non-null ONLY when we had to mint a new
+ * agent token (the old container's token was unreadable) — then we surface it
+ * ONCE with a clients-must-update note. When the existing token was reused,
+ * nothing about the token is printed (clients keep working untouched).
+ */
+function renderSuccess(ref, freshToken) {
+    const lines = [
+        `Updated The Librarian server to ${ref} — the container is healthy.`,
+        "The data volume was preserved; pending data-dir migrations were applied.",
+    ];
+    if (freshToken) {
+        lines.push("", "NOTE: the previous container's agent token could not be read back, so a " +
+            "FRESH agent token was minted. Existing clients must update their token:", `  Agent token: ${freshToken}`, "Paste it into `librarian install` / `librarian config --token <token>` on your clients.");
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=update.js.map

package/dist/server/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/server/update.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,kFAAkF;AAClF,EAAE;AACF,gFAAgF;AAChF,2CAA2C;AAC3C,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,4CAA4C;AAC5C,sDAAsD;AACtD,iFAAiF;AACjF,4EAA4E;AAC5E,qEAAqE;AACrE,2CAA2C;AAC3C,iFAAiF;AACjF,iFAAiF;AACjF,0EAA0E;AAC1E,gFAAgF;AAChF,yBAAyB;AACzB,+EAA+E;AAC/E,8EAA8E;AAC9E,0CAA0C;AAC1C,oEAAoE;AACpE,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,sEAAsE;AACtE,2EAA2E;AAC3E,0CAA0C;AAC1C,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,8CAA8C;AAC9C,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,iFAAiF;AACjF,kCAAkC;AAElC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,GAAG,EAAkB,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,SAAS,CAAC;AAqBjB,yFAAyF;AACzF,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAyB,EAAE;IACzD,sEAAsE;IACtE,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAExE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEjF,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,WAAW,CACnB,4BAA4B,SAAS,mDAAmD;YACtF,iEAAiE;YACjE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEhD,+EAA+E;IAC/E,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,MAAM,EAAE;gBACN,uBAAuB,SAAS,+BAA+B;gBAC/D,0EAA0E;aAC3E,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1D,MAAM,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAExC,8CAA8C;IAC9C,MAAM,WAAW,CACf,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,GAAG,cAAc,IAAI,SAAS,EAAE,EAAE,GAAG,CAAC,EAC5F,SAAS,CACV,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,yCAAyC;IACzC,iEAAiE;IACjE,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,WAAW,GAAG,MAAM,wBAAwB,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;IACvE,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;IACpE,MAAM,UAAU,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,aAAa,KAAK,IAAI,CAAC;IAE5C,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,UAAU,EAAE,CAAC;IACnB,MAAM,QAAQ,EAAE,CAAC;IAEjB,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,kEAAkE;IAClE,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,EAAE;QAC5C,UAAU;QACV,SAAS,EAAE,WAAW,IAAI,SAAS;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;IACH,MAAM,WAAW,CACf,YAAY,CAAC;QACX,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,EAAE,SAAS;QACd,OAAO;KACR,CAAC,EACF,SAAS,CACV,CAAC;IAEF,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAE9B,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,iBAAiB,EAAE,CAAC;IAE1B,8EAA8E;IAC9E,gBAAgB,CAAC,SAAS,EAAE;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,EAAE,SAAS;QACd,QAAQ,EAAE,GAAG,cAAc,IAAI,SAAS,EAAE;KAC3C,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,4EAA4E;AAE5E,6EAA6E;AAC7E,KAAK,UAAU,UAAU,CAAC,GAAuB;IAC/C,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,WAAW,CACnB,wDAAwD;YACtD,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,OAAO,IAAI,MAAM,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE;QACjC,SAAS;QACT,UAAU;QACV,0BAA0B;QAC1B,cAAc;KACf,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AACjE,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;GAQG;AACH,KAAK,UAAU,wBAAwB;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE;QACjC,SAAS;QACT,UAAU;QACV,2CAA2C;QAC3C,cAAc;KACf,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS,CAAC,4CAA4C;QACnE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAE3E,kEAAkE;AAClE,KAAK,UAAU,GAAG,CAAC,IAAc;IAC/B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IACjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE;QAChC,IAAI;QACJ,GAAG;QACH,WAAW;QACX,UAAU;QACV,kBAAkB;QAClB,GAAG,GAAG,WAAW;KAClB,CAAC,CAAC;IACH,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,GAAW;IACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,UAAU;IACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAC9B,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,sCAAsC;IAC7E,aAAa,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ;IACrB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAC9B,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,gCAAgC;IACvE,aAAa,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,iBAAiB;IAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,kDAAkD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAc,EAAE,MAAiB;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAC9B,qEAAqE;IACrE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,WAAW,CACnB,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;QAC9D,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,qEAAqE,CACxE,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,UAAyB;IAC3D,MAAM,KAAK,GAAG;QACZ,mCAAmC,GAAG,8BAA8B;QACpE,0EAA0E;KAC3E,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CACR,EAAE,EACF,0EAA0E;YACxE,yEAAyE,EAC3E,kBAAkB,UAAU,EAAE,EAC9B,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/status.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Resolve the monorepo's latest release version (the tag, `v`-stripped), or
+ * `null` on ANY failure (offline, timeout, non-2xx, unparseable). Injectable
+ * so tests never hit the network.
+ */
+export type LatestFetcher = () => Promise<string | null>;
+/** Override the latest-version fetcher (tests inject a canned/failing one). */
+export declare function setLatestFetcher(next: LatestFetcher): void;
+/** Restore the default (network) latest-version fetcher (tests). */
+export declare function resetLatestFetcher(): void;
+/** The default fetcher, exported for direct use / testing of the GET itself. */
+export declare const fetchLatestVersion: LatestFetcher;
+/**
+ * Probe every harness in parallel and the latest version once, returning the
+ * rendered table. `home` is injectable for tests.
+ */
+export declare function status(home?: string): Promise<string>;
+//# sourceMappingURL=status.d.ts.map

package/dist/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AA0BzD,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAE1D;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,EAAE,aAAqC,CAAC;AAWvE;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3D"}

package/dist/status.js

@@ -0,0 +1,113 @@
+// `librarian status` — live-probe every harness and render a plain table.
+//
+// Columns: harness · installed · version · latest · update? · url.
+//   - installed/version come from each harness's live `detect()` (never a
+//     cached file — spec §9);
+//   - `latest` is the monorepo's latest GitHub release tag, fetched once and
+//     shared across rows;
+//   - `update?` is `yes`/`no`/`?` — `?` whenever the installed version or the
+//     latest version is unknown, so an offline run never lies;
+//   - `url` is the configured MCP URL (from `readConfig`), shown only when a
+//     harness is installed.
+//
+// The "latest" fetch is INJECTABLE (`setLatestFetcher`) and OFFLINE-TOLERANT:
+// any failure resolves to `null`, latest renders `unknown`, and `update?`
+// renders `?`. The CLI never crashes because GitHub was unreachable.
+import { readConfig } from "./config.js";
+import { allHarnesses } from "./harnesses/index.js";
+import { isBehind } from "./semver.js";
+/** GitHub releases API for the monorepo (latest published release). */
+const LATEST_RELEASE_URL = "https://api.github.com/repos/JimJafar/the-librarian/releases/latest";
+/** A short timeout so an unreachable network never hangs `status`. */
+const FETCH_TIMEOUT_MS = 3000;
+const defaultLatestFetcher = async () => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetch(LATEST_RELEASE_URL, {
+            redirect: "error",
+            signal: controller.signal,
+            headers: { Accept: "application/vnd.github+json" },
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const tag = typeof body.tag_name === "string" ? body.tag_name.trim() : "";
+        if (!tag)
+            return null;
+        return tag.replace(/^v/i, "");
+    }
+    catch {
+        // Offline, DNS failure, timeout, redirect, bad JSON — all → unknown.
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+};
+let latestFetcher = defaultLatestFetcher;
+/** Override the latest-version fetcher (tests inject a canned/failing one). */
+export function setLatestFetcher(next) {
+    latestFetcher = next;
+}
+/** Restore the default (network) latest-version fetcher (tests). */
+export function resetLatestFetcher() {
+    latestFetcher = defaultLatestFetcher;
+}
+/** The default fetcher, exported for direct use / testing of the GET itself. */
+export const fetchLatestVersion = () => latestFetcher();
+/**
+ * Probe every harness in parallel and the latest version once, returning the
+ * rendered table. `home` is injectable for tests.
+ */
+export async function status(home) {
+    const [detections, latest] = await Promise.all([
+        Promise.all(allHarnesses.map((h) => h.detect())),
+        fetchLatestVersion(),
+    ]);
+    const cfg = readConfig(home);
+    const mcpUrl = cfg?.mcpUrl ?? "";
+    const rows = allHarnesses.map((h, i) => toRow(h, detections[i] ?? { installed: false }, latest, mcpUrl));
+    return renderTable(rows, latest);
+}
+function toRow(harness, detect, latest, mcpUrl) {
+    const version = detect.version ?? "";
+    const update = !detect.installed
+        ? "no"
+        : !version || !latest
+            ? "?"
+            : isBehind(version, latest)
+                ? "yes"
+                : "no";
+    return {
+        harness: harness.displayName,
+        installed: detect.installed,
+        version: detect.installed ? version || "(unknown)" : "—",
+        latest: latest ?? "unknown",
+        update,
+        url: detect.installed ? mcpUrl || "—" : "—",
+    };
+}
+// --- plain-text table rendering (aligned, no table lib) ------------------
+const HEADERS = ["HARNESS", "INSTALLED", "VERSION", "LATEST", "UPDATE?", "URL"];
+function renderTable(rows, latest) {
+    const cells = rows.map((r) => [
+        r.harness,
+        r.installed ? "yes" : "no",
+        r.version,
+        r.latest,
+        r.update,
+        r.url,
+    ]);
+    const widths = HEADERS.map((h, col) => Math.max(h.length, ...cells.map((row) => (row[col] ?? "").length)));
+    const line = (parts) => parts
+        .map((part, col) => part.padEnd(widths[col] ?? part.length))
+        .join("  ")
+        .trimEnd();
+    const out = [line(HEADERS), ...cells.map(line)];
+    if (latest === null) {
+        out.push("", "latest version unknown (could not reach GitHub) — update column shows ?");
+    }
+    return out.join("\n");
+}
+//# sourceMappingURL=status.js.map

package/dist/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,mEAAmE;AACnE,0EAA0E;AAC1E,8BAA8B;AAC9B,6EAA6E;AAC7E,0BAA0B;AAC1B,8EAA8E;AAC9E,+DAA+D;AAC/D,6EAA6E;AAC7E,4BAA4B;AAC5B,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,qEAAqE;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAyC,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,qEAAqE,CAAC;AACjG,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAS9B,MAAM,oBAAoB,GAAkB,KAAK,IAAI,EAAE;IACrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;YAC1C,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC1D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,aAAa,GAAkB,oBAAoB,CAAC;AAExD,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,kBAAkB;IAChC,aAAa,GAAG,oBAAoB,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAkB,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;AAWvE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAa;IACxC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,kBAAkB,EAAE;KACrB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;IAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAChE,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,KAAK,CACZ,OAAsB,EACtB,MAAoB,EACpB,MAAqB,EACrB,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAwB,CAAC,MAAM,CAAC,SAAS;QACnD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM;YACnB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBACzB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,CAAC;IACb,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,WAAW;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,GAAG;QACxD,MAAM,EAAE,MAAM,IAAI,SAAS;QAC3B,MAAM;QACN,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG;KAC5C,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAEzF,SAAS,WAAW,CAAC,IAAiB,EAAE,MAAqB;IAC3D,MAAM,KAAK,GAAe,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACxC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC1B,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,GAAG;KACN,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CACpC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CACnE,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAwB,EAAU,EAAE,CAChD,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;SAC3D,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,EAAE,CAAC;IAEf,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,yEAAyE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare function cliVersion(): string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAUA,wBAAgB,UAAU,IAAI,MAAM,CASnC"}

package/dist/version.js

@@ -0,0 +1,20 @@
+// Resolve the CLI's own version from its package.json.
+//
+// At runtime the built bin lives at `dist/bin.js`, so package.json is one
+// directory up. Reading it (rather than baking the version in) keeps the
+// reported version in lockstep with the published package — the phase gate
+// owns the actual version bump.
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+export function cliVersion() {
+    try {
+        const pkgUrl = new URL("../package.json", import.meta.url);
+        const raw = fs.readFileSync(fileURLToPath(pkgUrl), "utf8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed.version === "string" ? parsed.version : "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,gCAAgC;AAEhC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACxD,OAAO,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@the-librarian/cli",
+  "version": "1.0.0-rc.21",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "description": "Cross-harness installer CLI for The Librarian. Bin: librarian.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "librarian": "dist/bin.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  },
+  "license": "Apache-2.0",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test:vitest": "vitest run",
+    "test": "pnpm run build && pnpm run test:vitest",
+    "typecheck": "tsc --noEmit"
+  }
+}