@wattsonclub/wattson-cli 0.1.0 → 0.1.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wattsonclub/wattson-cli",
   "private": false,
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "bin": {
     "wattson": "./dist/bin.js",
@@ -19,8 +19,13 @@
     "node": ">=22"
   },
   "files": [
-    "dist",
-    "skill",
+    "dist/bin.js",
+    "dist/bin.js.LEGAL.txt",
+    "dist/THIRD-PARTY-NOTICES.txt",
+    "skill/SKILL.md",
+    "skill/references/commands.md",
+    "skill/references/workout-building-blocks.md",
+    "skill/references/workout-text-format.md",
     "README.md",
     "CHANGELOG.md"
   ],

package/skill/SKILL.md

@@ -9,6 +9,8 @@ description: Use the Wattson CLI to authenticate a local or remote agent, inspec
 
 Requires Node.js 22 or newer. Install `npm install -g @wattsonclub/wattson-cli`, then run `wattson --help`. Use the commands advertised by the installed version; do not invent MCP-equivalent commands.
 
+Human guide: [wattson.club/cli](https://wattson.club/cli). Agent discovery: [llms.txt](https://wattson.club/llms.txt). Full supported command families and copyable payload transformations: [commands](references/commands.md).
+
 The default API is `https://api.wattson.club`. Override with `--base-url`, `WATTSON_API_BASE_URL` or legacy `PLANNER_API_BASE_URL` only for an explicitly chosen environment. Confirm `wattson health` succeeds before continuing.
 
 ## 2. Authenticate
@@ -18,9 +20,9 @@ Run `wattson auth status` (exit 1 means signed out, including with `--json`). If
 - On the user's own computer: `wattson auth login` opens browser OAuth with a localhost callback.
 - On an SSH host, server, container, or agent runtime: `wattson auth login --remote` prints a verification URL and a short-lived user code and waits for approval. The user opens that URL on their own phone/laptop, signs in, checks the code and explicitly approves. No inbound port or SSH tunnel is needed.
 
-Deliver login URLs and codes privately to the requesting user, never in a shared group. Never request their password, copy browser cookies, approve on their behalf, or expose access/refresh tokens. A timeout or denial means not authenticated; start a new login only at the user's request. For an unattended agent, complete the initial approval interactively; subsequent token refresh is automatic.
+Deliver login URLs and codes privately to the requesting user, never in a shared group. Never request their password, copy browser cookies, approve on their behalf, or expose access/refresh tokens. A timeout or denial means not authenticated; start a new login only at the user's request. For an unattended agent, complete the initial approval interactively; both flows request `planner:read planner:write`. Subsequent API requests automatically refresh and retry once on HTTP 401; a failed refresh-token request clears saved login. `--timeout <seconds>` overrides the five-minute login timeout.
 
-Verify `wattson auth status` and `wattson --json athlete profile`. `wattson auth logout` clears local credentials. Do not assume that local logout revokes other sessions. Keep the credential directory persistent and private for containers; do not bake credentials into an image.
+Verify `wattson auth status` and `wattson --json athlete profile`. `wattson auth logout` attempts server logout, ignores server errors, then removes local credentials. It does not guarantee OAuth-token revocation or logout of other sessions. Tokens are unencrypted in a file with mode `0600` (new parent directory `0700`); JSON auth output omits tokens but includes identity metadata. See the reference for paths and overrides. Keep the credential directory persistent and private for containers; do not bake credentials into an image.
 
 ## 3. Inspect before changing
 
@@ -39,7 +41,7 @@ Omit athlete IDs to use the authenticated athlete. Do not infer permission to ac
 
 ## 4. Draft, validate, save
 
-Translate natural language into structured inputs. Read [workout building blocks](references/workout-building-blocks.md) for payload structure and [workout text format](references/workout-text-format.md) for readable previews.
+Translate natural language into structured inputs. Read [workout building blocks](references/workout-building-blocks.md) for the complete field/primitive reference, exact composition examples, constraints and revision options, and [workout text format](references/workout-text-format.md) for readable previews.
 
 ```sh
 wattson --json workout draft --objective vo2max --duration-min 20 --execution-mode erg --style-hint "3 hard intervals"
@@ -47,14 +49,14 @@ wattson --json workout validate --input-file validate.json
 wattson --json workout save --input-file save.json
 ```
 
-Draft output is not a save request: construct the appropriate payload described in [command examples](references/commands.md). A draft alone is not published. Fix validation errors before saving. FTP-relative values are fractions: `0.55` means 55%, not `55`.
+Draft output is not a save request: construct the appropriate payload described in [command examples](references/commands.md). A draft alone is not published. Inspect `validation.status`: validation can exit 0 even for `fail`. Fix failures and review warnings before saving; the reference example requires `pass`. FTP-relative values are fractions: `0.55` means 55%, not `55`.
 
-Only save when the user's task authorizes publishing the workout. After saving, verify the returned workout ID/version with `workout get`. Report “saved to your library, ready for the app to download,” not confirmed device delivery. Revisions require validation and save too.
+Only save when the user's task authorizes adding or updating the workout in their library. After saving, verify the returned workout ID/version with `workout get`. Report “saved to your library, ready for the app to download,” not confirmed device delivery. Revisions require validation and save too.
 
 ## 5. Respect the offline ride model
 
-The rider's app downloads saved workouts and runs the selected ride locally. A suspended/offline app syncs when it returns online. Uploaded rides can then be reviewed with `athlete sessions`, `session summary`, `session telemetry` and `session artifacts`.
+The rider's app downloads saved workouts and runs the selected ride locally. A suspended/offline app syncs when it returns online. Uploaded rides can then be reviewed with `athlete sessions`, `session summary`, `session telemetry` and `session artifacts`. FIT export returns inline base64, not a downloaded file. Enqueue/retry `session strava-sync` only when the user authorizes Strava publication; acceptance is asynchronous, not delivery confirmation.
 
-Legacy CLI `plan schedule`, `session load-workout`, `session adapt` and `session complete` are compatibility APIs, not remote start/control of the current app. Do not synthesize a ride completion. The CLI is not full MCP parity: use MCP for library listing/retirement/calendar scheduling and course discovery/import when those commands are absent from `wattson --help`.
+Use `workout list`, `workout schedule ID --date YYYY-MM-DD`, `workout unschedule ID`, and `workout retire ID` for library management. Strava routes and starred segments can be listed and imported as courses (see reference). The former Today-plan and session load/adapt/complete commands have been removed. Do not synthesize ride completion. The CLI also exposes MCP-equivalent sharing, course discovery, onboarding and research operations. Use the command reference to translate a tool call; preserve its input fields and inspect the same response. A server restriction (such as limited Strava access) applies regardless of interface.
 
 Finish by verifying the affected read endpoint and summarizing the result. Distinguish a successful local command from device acknowledgement or Strava delivery.