@wattsonclub/wattson-cli 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+## 0.1.1 — 2026-11-12
+
+- Complete current MCP action/research parity, including sharing, all course sources, discovery and onboarding.
+- Add `tool list`, `tool schema` and MCP-name invocation, with registration/behavior parity tests.
+- Expand public workout authoring reference with exact primitives, constraints, revision behavior and verified composition examples.
+- Harden OAuth/API redirects and diagnostics; restrict packaged files to reviewed executable, notices and guides.
+
+- Align CLI with the offline-first saved-workout library: list, schedule, unschedule and retire.
+- Add signed-in Strava route and starred-segment discovery plus route/segment course import.
+- Remove retired Today/current-plan and remote ride-control commands from CLI help and dispatch.
+
+## 0.1.0
+
+- Standalone bundled `wattson` executable for Node.js 22+.
+- Browser OAuth and remote device authorization with automatic token refresh.
+- Production API defaults, structured JSON output, legacy command compatibility.
+- Bundled self-contained agent skill and third-party notices.

package/README.md

@@ -1,3 +1,159 @@
-# Temporary Holding Version
+# Wattson CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Training-planner commands for people and agents. Requires Node.js 22 or newer.
+
+```sh
+npm install -g @wattsonclub/wattson-cli
+wattson auth login
+wattson --json athlete profile
+```
+
+## Remote login (SSH, servers, containers)
+
+```sh
+wattson auth login --remote
+```
+
+Open the verification URL on your phone or laptop, check the displayed code,
+sign in, and explicitly approve access. No callback port or SSH forwarding is
+needed. The command waits up to 300 seconds; use `--timeout <seconds>` to change
+that. Never share a verification code or approval URL publicly.
+
+`wattson auth status` checks saved login state; `wattson auth logout` removes local
+credentials. Tokens refresh automatically. Signed-out status exits with code 1.
+
+## Documentation
+
+Public guide: https://wattson.club/cli
+
+Agent discovery: https://wattson.club/llms.txt
+
+## Agents
+
+Use `--json` for machine-readable output. Remote login instructions go to stderr;
+final JSON goes to stdout without tokens. The bundled `skill/SKILL.md` and
+`skill/references/` explain workflows and command coverage. The public skill is
+hosted at https://wattson.club/skills/wattson/SKILL.md after deployment.
+
+Manage the offline-first app's saved workout library with `wattson workout list`,
+`wattson workout schedule <id> --date YYYY-MM-DD`,
+`wattson workout unschedule <id>`, and `wattson workout retire <id>`. Scheduling does not start a ride.
+Signed-in Strava discovery and course import are available through `strava`
+and `course` commands. The app itself executes and uploads rides.
+
+Use `wattson --help` for commands. The production API is the default. Override it
+with `--base-url`, `WATTSON_API_BASE_URL`, or legacy `PLANNER_API_BASE_URL` (in that
+order). `WATTSON_AUTH_FILE` selects a credential file; existing trainer-planner
+credentials remain compatible. The `trainer-planner` command alias is retained.
+
+## Distribution
+
+Project code is UNLICENSED (all rights reserved); public distribution does not
+grant an open-source license. Bundled dependency licenses are included in
+`dist/THIRD-PARTY-NOTICES.txt`.
+
+## Complete MCP capability parity
+
+Every current default/authenticated MCP tool has a human CLI command, plus the
+research surface's search and fetch. `tool list` is the canonical discovery list.
+`tool schema NAME` describes all fields, defaults, nested structures, unions,
+bounds and enums for the current authentication surface. Contract refinements
+(such as exactly one GPX source) are enforced during invocation.
+
+```sh
+wattson --json tool list
+wattson --json tool schema validate_workout
+wattson --json tool validate_workout --input-file workout-validation.json
+wattson course lookup "Mont Ventoux" --effort-pct-ftp 0.8
+wattson course import-gpx --gpx-file ride.gpx --name "My ride"
+wattson course import-gpx --gpx-url https://example.org/ride.gpx
+wattson course generate-terrain --distance-m 12000 --average-grade-pct 6 --shape hairpins
+wattson course build-road --start.place "Bédoin" --end.place "Mont Ventoux"
+wattson course history --course-id ventoux --limit 20
+wattson strava explore --place Girona --radius-km 15
+wattson strava favourite-climbs --limit 3 --recent-rides 6
+wattson recommend first --answers.ideal-minutes 45 --answers.max-minutes 60 --use-strava false
+wattson share create WORKOUT_ID --workout-version 1
+wattson share preview SHARE_UUID
+wattson share import SHARE_UUID
+wattson research search "climbing"
+wattson research fetch profile:ATHLETE_ID
+```
+
+The new course/Strava/sharing/onboarding commands accept every contract field as
+`--kebab-case`; nested fields use dots (e.g. `--start.latitude 44.17`). Arrays accept
+JSON or repeated flags (`--climb-course-ids first --climb-course-ids second`).
+Booleans take explicit `true` or `false`. Complex payloads can use
+`--input-json '{...}'` or `--input-file path.json`, exclusively: do not mix these
+with field flags or positional arguments. `tool NAME` uses the exact MCP input
+object and supports the same field flags for **all** tools. Numbers, defaults,
+enums and input refinements use the shared API contract schemas.
+
+Signed-in commands select the `/me` client routes, with the same ownership checks
+as authenticated MCP. Generic/new commands reject an explicit `athleteId` where
+the authenticated schema does not accept it; they never switch to an internal
+route because of an input field. Signed-out internal course commands may accept
+`--athlete-id` for estimates/history. Strava, sharing, onboarding and research
+require login. Research uses the same shared corpus, ranking, eight-result limit,
+partial-source handling and document IDs as MCP.
+
+`WATTSON_STRAVA_LIMITED_ACCESS=true` (or the legacy
+`PLANNER_MCP_STRAVA_LIMITED_ACCESS`) hides and rejects the same seven restricted
+Strava read operations as MCP. Segment-name lookup and segment import remain
+available. The server remains the enforcing authority for account ownership and
+Strava access; disabling a local flag cannot grant server access.
+
+Sharing is a separate, explicit action: create exposes a sanitized template;
+preview does not import; import saves a separate workout. No command starts or
+controls a device ride remotely. `recommend daily` remains an additional CLI
+convenience, not a current MCP registration.
+
+### MCP → CLI mapping
+
+The source-of-truth map is `src/parity.ts`, with research entries in
+`src/tool-command.ts`. Tests compare actual registrations on public/internal,
+full/limited and research surfaces, their complete schema shapes, and method
+routing/payloads for the added operations.
+
+| MCP tool | CLI command |
+| --- | --- |
+| `list_saved_workouts` | `workout list` |
+| `health` | `health` |
+| `get_athlete_profile` | `athlete profile` |
+| `get_readiness_snapshot` | `athlete readiness latest` |
+| `get_recent_sessions` | `athlete sessions` |
+| `get_saved_workout` | `workout get` |
+| `get_workout_runtime_plan` | `workout runtime-plan` |
+| `list_saved_workout_revisions` | `workout revisions` |
+| `summarize_session` | `session summary` |
+| `get_session_telemetry` | `session telemetry` |
+| `get_session_artifacts` | `session artifacts` |
+| `get_session_fit_export` | `session fit` |
+| `lookup_climb` | `course lookup` |
+| `find_my_strava_segments` | `strava find-segments` |
+| `import_strava_segment` | `course import-strava-segment` |
+| `import_gpx_course` | `course import-gpx` |
+| `generate_terrain_course` | `course generate-terrain` |
+| `import_strava_activity_course` | `course import-strava-activity` |
+| `build_road_course` | `course build-road` |
+| `import_climb_page` | `course import-climb-page` |
+| `get_my_climb_history` | `course history` |
+| `explore_strava_segments` | `strava explore` |
+| `get_my_strava_segment_efforts` | `strava segment-efforts` |
+| `list_my_strava_starred_segments` | `strava starred-segments` |
+| `list_my_favourite_strava_climbs` | `strava favourite-climbs` |
+| `recommend_first_workout` | `recommend first` |
+| `list_my_strava_routes` | `strava routes` |
+| `import_strava_route` | `course import-strava-route` |
+| `draft_workout` | `workout draft` |
+| `revise_workout` | `workout revise` |
+| `validate_workout` | `workout validate` |
+| `save_workout` | `workout save` |
+| `schedule_saved_workout` | `workout schedule` |
+| `retire_saved_workout` | `workout retire` |
+| `trigger_session_strava_sync` | `session strava-sync` |
+| `create_workout_share` | `share create` |
+| `preview_workout_share` | `share preview` |
+| `import_workout_share` | `share import` |
+| `search` | `research search` |
+| `fetch` | `research fetch` |

package/dist/THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,23 @@
+Zod (MIT)
+
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.