@tiangong-lca/cli 0.1.7 → 0.1.9

package/README.md

@@ -31,14 +31,14 @@ checkPaths:
   - test/auth-identity*.test.ts
   - test/public-auth-identity-receipt.test.ts
   - test/lca-release*.test.ts
-lastReviewedAt: 2026-08-31
-lastReviewedCommit: 499c910d07bb6a5e2e1cd8e4403a5a617d4269bb
-lastReviewedNote: 'Reviewed for Issue #260: CLI 0.1.7 removes the password-equivalent API-key bootstrap and historical runner; OAuth or an explicit verified headless token is required for every user-authenticated remote command.'
+lastReviewedAt: 2026-09-04
+lastReviewedCommit: b15c074b1f10314e4835fd64cb7079c8aa9fec3d
+lastReviewedNote: 'Reviewed for CLI #272: release-only 0.1.9 after support export #270; runtime, dependencies, lock bytes, public exports and publication mechanics are unchanged.'
 ---
 
 # TianGong LCA CLI
 
-Package: `@tiangong-lca/cli` Executable: `tiangong-lca` Current package version: `0.1.7` Node: `24.19.0`
+Package: `@tiangong-lca/cli` Executable: `tiangong-lca` Current package version: `0.1.8` Node: `24.19.0`
 
 Repository development is single-track on pnpm `11.24.0` and TypeScript `7.0.2`. The published package remains a clean, package-manager-neutral consumer artifact: it contains runtime files only, not pnpm, TypeScript, Oxlint, tests, source-only tooling, or repository lockfiles.
 
@@ -104,7 +104,8 @@ One-off published run:
 
 ```bash
 pnpm dlx @tiangong-lca/cli@latest --help
-pnpm dlx @tiangong-lca/cli@latest doctor
+pnpm dlx @tiangong-lca/cli@latest auth login
+pnpm dlx @tiangong-lca/cli@latest auth doctor-auth --json
 pnpm dlx @tiangong-lca/cli@latest flow --help
 ```
 
@@ -113,7 +114,8 @@ Install the published CLI:
 ```bash
 pnpm add --global @tiangong-lca/cli
 tiangong-lca --help
-tiangong-lca doctor
+tiangong-lca auth login
+tiangong-lca auth doctor-auth --json
 tiangong-lca flow --help
 ```
 
@@ -138,12 +140,17 @@ The packed ESM, CJS dynamic-import, and TypeScript consumers exercise every publ
 
 ## Env
 
-Remote commands require:
+Official Production requires **no environment setup**. Run `tiangong-lca auth login` from a trusted terminal and finish authorization in your browser. The CLI bundles the public Production project URL, publishable key, CLI OAuth client ID, registered loopback callback, and region as one profile in `src/lib/env.ts`. These are application configuration, not user credentials; no client secret is used. Skills and external consumers must reuse the CLI rather than copy this profile.
+
+Before the first login, `auth status --json` and `auth doctor-auth --json` return `login-required` (exit 1), not a missing-client configuration error. `doctor --json` reports the public profile fields as `source: "default"`; this is configuration readiness, not proof of a logged-in user.
+
+Only Dev, self-hosted, or a custom public client needs explicit configuration. Supply the complete matching tuple from that environment's administrator:
 
 ```bash
-TIANGONG_LCA_API_BASE_URL=
-TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY=
-TIANGONG_LCA_OAUTH_CLIENT_ID=
+TIANGONG_LCA_API_BASE_URL=https://<your-project>.supabase.co/functions/v1
+TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY=<that-project-publishable-key>
+TIANGONG_LCA_OAUTH_CLIENT_ID=<that-project-registered-public-client-id>
+TIANGONG_LCA_OAUTH_REDIRECT_URI=http://127.0.0.1:49191/oauth/callback
 TIANGONG_LCA_REGION=us-east-1
 ```
 
@@ -151,8 +158,10 @@ Notes:
 
 - `TIANGONG_LCA_API_BASE_URL` accepts the project root, `/functions/v1`, or `/rest/v1`.
 - `TIANGONG_LCA_OAUTH_CLIENT_ID` is the environment-specific registered public CLI client; it is not a secret.
+- Blank public fields and the exact official Production URL aliases use the bundled profile. Any non-Production URL, client, key, or callback disables profile completion; incomplete custom configuration fails before browser/network access. An explicit custom URL cannot be combined with the known Production key or client. Changing `--base-url` also requires a matching complete environment.
 - Run `tiangong-lca auth login` once in a trusted terminal. All Edge Function and direct Supabase commands then reuse the OAuth access token and rotate the refresh token on demand.
-- For approved headless execution, set `TIANGONG_LCA_AUTH_MODE=access-token` and inject one short-lived `TIANGONG_LCA_ACCESS_TOKEN`. It is verified online, kept only in process memory, and never refreshed.
+- For approved headless execution, explicitly set the destination `TIANGONG_LCA_API_BASE_URL`, its `TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY`, and `TIANGONG_LCA_AUTH_MODE=access-token`, then inject one short-lived `TIANGONG_LCA_ACCESS_TOKEN`. A token alone never selects Production. It is verified online, kept only in process memory, and never refreshed.
+- Bundled configuration does not enable implicit remote publishing. Local-first publish executor selection still requires explicit configured remote runtime; existing `--commit`, remote-lookup, identity, and approval gates are unchanged.
 
 Optional session control:
 
@@ -180,6 +189,16 @@ The callback URI must exactly match the URI registered with the selected Supabas
 
 Local logout does not revoke the server grant. To invalidate every refresh token for the CLI client, open Account → Connected applications and disconnect TianGong CLI.
 
+## Canonical support export
+
+```sh
+tiangong-lca dataset support-cache export --out-dir ./new-support-export --expected-project-ref <project-ref> --expected-user-id <user-id> --json
+```
+
+Export visible flow properties and unit groups through the CLI OAuth session. The default state filter is `100`; repeat `--state-code` to request other RLS-scoped states. The directory must be new. Two complete ordered reads must agree before private row files and an atomic `export-report.json` completion marker are published. The report includes identity, counts and file hashes; its observed stability is not a database transaction snapshot.
+
+Limits are 100,000 rows per table, 1,000 pages per table scan, 8 MiB per response, 64 MiB total response bytes and a 120-second operation deadline. An incomplete or changed read fails without publishing a completion marker. Use a fresh directory for a new attempt; no business data is written.
+
 ## Auth Identity Receipt
 
 Use the identity receipt before a production-backed case or any later owner-draft write gate:

package/dist/src/cli.d.ts

@@ -1,5 +1,6 @@
 import type { DotEnvLoadResult } from './lib/dotenv.js';
 import type { FetchLike } from './lib/http.js';
+import { type RunDatasetSupportCacheExportOptions, type DatasetSupportCacheExportReport } from './lib/dataset-support-cache.js';
 import { inspectSupabaseAuthStatus, loginWithSupabaseOAuth, logoutSupabaseUserSession } from './lib/supabase-session.js';
 import { type AuthIdentityReceipt, type RunAuthIdentityReceiptOptions } from './lib/auth-identity-receipt.js';
 import { type LifecyclemodelAutoBuildReport, type RunLifecyclemodelAutoBuildOptions } from './lib/lifecyclemodel-auto-build.js';
@@ -68,6 +69,7 @@ import { runFlowIdentity } from './lib/dataset-maintenance-flow-identity-run.js'
 import { verifyFlowIdentity } from './lib/dataset-maintenance-flow-identity-verify.js';
 import { type DatasetSourceUploadAttachmentsReport, type RunDatasetSourceUploadAttachmentsOptions } from './lib/dataset-source-upload-attachments.js';
 export type CliDeps = {
+    runDatasetSupportCacheExportImpl?: (options: RunDatasetSupportCacheExportOptions) => Promise<DatasetSupportCacheExportReport>;
     env: NodeJS.ProcessEnv;
     dotEnvStatus: DotEnvLoadResult;
     fetchImpl: FetchLike;

package/dist/src/cli.js

@@ -3,6 +3,7 @@ import { buildDoctorReport, readRuntimeEnv } from './lib/env.js';
 import { CliError, toErrorPayload } from './lib/errors.js';
 import { stringifyJson } from './lib/io.js';
 import { loadCliPackageVersion } from './lib/package-version.js';
+import { runDatasetSupportCacheExport, } from './lib/dataset-support-cache.js';
 import { requireSupabaseRestRuntime } from './lib/supabase-client.js';
 import { inspectSupabaseAuthStatus, loginWithSupabaseOAuth, logoutSupabaseUserSession, } from './lib/supabase-session.js';
 import { OAUTH_LOGIN_TIMEOUT_MAX_MS } from './lib/oauth-loopback.js';
@@ -93,7 +94,7 @@ Implemented Commands:
   auth       login | status | whoami | doctor-auth | logout | identity-receipt
   search     flow | process | lifecyclemodel
   process    get | list | identity-preflight | build-plan | scope-statistics | dedup-review | auto-build | resume-build | publish-build | complete-required-fields | save-draft | batch-build | refresh-references | verify-rows
-  dataset    contract get | context-pack | classification children/path/audit/apply | curation-queue build/next/verify | import-lca convert | author | patch apply | save-draft | source upload-attachments | validate | verify-remote | bilingual extract/apply/validate | evidence-search plan/run | references rewrite/refresh-remote | maintenance clear-account/plan/apply/verify/flow-identity
+  dataset    support-cache export | contract get | context-pack | classification children/path/audit/apply | curation-queue build/next/verify | import-lca convert | author | patch apply | save-draft | source upload-attachments | validate | verify-remote | bilingual extract/apply/validate | evidence-search plan/run | references rewrite/refresh-remote | maintenance clear-account/plan/apply/verify/flow-identity
   flow       get | list | identity-preflight | build-plan | fetch-rows | materialize-decisions | remediate | publish-version | publish-reviewed-data | build-alias-map | scan-process-flow-refs | plan-process-flow-repairs | apply-process-flow-repairs | regen-product | validate-processes
   lifecyclemodel auto-build | validate-build | publish-build | save-draft | graph | build-resulting-process | publish-resulting-process | orchestrate
   qa         process | flow | lifecyclemodel
@@ -243,7 +244,8 @@ Options:
   --json            Print compact JSON; default output is pretty JSON
   -h, --help
 
-Required env:
+Official Production requires no environment configuration. Run auth login directly.
+For a custom environment, configure its complete public tuple (never mix projects):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
   TIANGONG_LCA_OAUTH_CLIENT_ID
@@ -287,7 +289,8 @@ Safety:
   tokens, full email addresses, session paths, or credential-derived fingerprints. Production guards
   must pass both expected assertions and require assertions.mode="intent-bound".
 
-Required env:
+Official Production uses the bundled public profile and a prior "tiangong-lca auth login".
+For a custom environment, configure:
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
@@ -323,7 +326,8 @@ Options:
   --timeout-ms <n> Request timeout in milliseconds
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
@@ -345,7 +349,8 @@ Options:
   --timeout-ms <n> Request timeout in milliseconds
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
@@ -388,7 +393,8 @@ Options:
   --timeout-ms <n>        Request timeout in milliseconds (default 60000)
   -h, --help
 
-Required environment:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
@@ -445,6 +451,7 @@ function renderDatasetHelp() {
   tiangong-lca dataset <subcommand> [options]
 
 Implemented Subcommands:
+  support-cache export Export complete observed canonical support rows through OAuth
   contract get        Write TIDAS schema / methodology / ruleset contract artifacts
   context-pack        Write an AI-ready TIDAS contract context pack
   classification       Navigate bundled TIDAS classification schemas or apply selected classifications
@@ -1049,7 +1056,7 @@ Options:
   -h, --help
 
 Environment:
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
 
 Outputs written under --out-dir:
   - outputs/remote-verification-report.json
@@ -1265,7 +1272,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
   when --commit executes remote writes
 
 Outputs written under --out-dir:
@@ -1379,7 +1386,8 @@ Options:
   --json                Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
@@ -1407,7 +1415,8 @@ Options:
   --json                          Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
@@ -1448,7 +1457,8 @@ Options:
   --json                     Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
@@ -1495,7 +1505,8 @@ Options:
   --json                    Print compact JSON
   -h, --help
 
-Environment:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
@@ -1527,7 +1538,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
   when --commit publishes prepared rows
 
 Outputs written under --out-dir:
@@ -1761,6 +1772,8 @@ Options:
   -h, --help
 
 Remote lookup env (only when process_sources.allow_remote_lookup=true):
+  Official Production uses its bundled profile and a prior "tiangong-lca auth login".
+  A custom environment requires the complete matching tuple:
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
@@ -1792,7 +1805,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
   when --commit executes remote writes
 
 Local gate:
@@ -1956,7 +1969,8 @@ Options:
   --json               Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
@@ -1983,7 +1997,8 @@ Options:
   --json                          Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
@@ -2135,7 +2150,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
   when --commit executes remote writes
 
 Local gate:
@@ -2189,7 +2204,8 @@ Options:
   --json               Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
@@ -6307,6 +6323,46 @@ export async function executeCli(argv, deps) {
                 stderr: '',
             };
         }
+        if (command === 'dataset' && subcommand === 'support-cache') {
+            const help = 'Usage: tiangong-lca dataset support-cache export --out-dir <fresh-dir> [--state-code <int>] [--page-size <1..5000>] [--timeout-ms <1..120000>] [--expected-project-ref <ref>] [--expected-user-id <uuid>] [--json]';
+            const action = commandArgs[0];
+            if (!action || action === '--help' || action === '-h')
+                return { exitCode: 0, stdout: help + '\n', stderr: '' };
+            if (action !== 'export')
+                throw new CliError('dataset support-cache action must be export.', {
+                    code: 'DATASET_SUPPORT_CACHE_ACTION_INVALID',
+                    exitCode: 2,
+                });
+            const { values } = parseArgs({
+                args: commandArgs.slice(1),
+                strict: true,
+                allowPositionals: false,
+                options: {
+                    'out-dir': { type: 'string' },
+                    'state-code': { type: 'string', multiple: true },
+                    'page-size': { type: 'string' },
+                    'timeout-ms': { type: 'string' },
+                    'expected-project-ref': { type: 'string' },
+                    'expected-user-id': { type: 'string' },
+                    json: { type: 'boolean' },
+                    help: { type: 'boolean', short: 'h' },
+                },
+            });
+            if (values.help)
+                return { exitCode: 0, stdout: help + '\n', stderr: '' };
+            const report = await (deps.runDatasetSupportCacheExportImpl ?? runDatasetSupportCacheExport)({
+                outDir: values['out-dir'] ?? '',
+                env: deps.env,
+                fetchImpl: deps.fetchImpl,
+                cliVersion: loadCliPackageVersion(import.meta.url),
+                stateCodes: values['state-code']?.map((value) => value.trim() ? Number(value) : Number.NaN),
+                pageSize: values['page-size'] === undefined ? undefined : Number(values['page-size']),
+                timeoutMs: values['timeout-ms'] === undefined ? undefined : Number(values['timeout-ms']),
+                expectedProjectRef: values['expected-project-ref'],
+                expectedUserId: values['expected-user-id'],
+            });
+            return { exitCode: 0, stdout: stringifyJson(report, values.json ?? false), stderr: '' };
+        }
         if (command === 'dataset' && subcommand === 'verify-remote') {
             const datasetFlags = parseDatasetRemoteVerifyFlags(commandArgs);
             if (datasetFlags.help) {