codebyplan 1.13.65 → 1.13.67

package/dist/dispatch.d.ts

@@ -0,0 +1,64 @@
+/**
+ * CLI command dispatch.
+ *
+ * A single `COMMANDS` table maps each top-level command to a lazy handler, and
+ * one `runCli` wrapper owns the cross-cutting concerns that the previous
+ * 44-branch if/else router got subtly wrong per-branch:
+ *   - exit codes ALWAYS honor `process.exitCode` (a handler that fails by
+ *     setting `process.exitCode = 1` and returning is never masked as exit 0),
+ *   - a top-level try/catch turns an unexpected throw into a friendly one-line
+ *     error (full stack only with --verbose / DEBUG=1) instead of a raw trace,
+ *   - `--help` / `-h` is intercepted uniformly so a command never runs its
+ *     (possibly destructive) side effects when the user only asked for help.
+ *
+ * Handlers keep the lazy dynamic-import pattern so the CLI startup cost stays
+ * proportional to the one command being run.
+ *
+ * `runCli` takes its command table and process bindings (exit/log/error/env) as
+ * parameters so the routing + exit-code + help behavior is unit-testable
+ * without spawning a process — see dispatch.test.ts.
+ */
+type CommandResult = number | void;
+export type CommandHandler = (rest: string[]) => Promise<CommandResult> | CommandResult;
+export interface Command {
+    run: CommandHandler;
+    /**
+     * The command renders its own `--help` (e.g. a sub-command router with a rich
+     * usage block). When true, `runCli` does NOT intercept `--help`; the handler
+     * is responsible for it. Only `claude` and `supabase` set this.
+     */
+    ownsHelp?: boolean;
+}
+export declare const COMMANDS: Record<string, Command>;
+export interface RunCliDeps {
+    /** Terminate the process. Defaults to `process.exit`. */
+    exit?: (code: number) => never;
+    log?: (msg: string) => void;
+    error?: (msg: string) => void;
+    env?: NodeJS.ProcessEnv;
+    /** Read the ambient deferred exit code. Defaults to `() => process.exitCode`. */
+    getExitCode?: () => number | undefined;
+}
+/**
+ * Resolve a command from `argv` and run it under uniform exit-code, error, and
+ * `--help` handling.
+ */
+export declare function runCli(argv: string[], commands?: Record<string, Command>, deps?: RunCliDeps): Promise<void>;
+interface ClaudeParsedFlags {
+    opts: {
+        yes: boolean;
+        dryRun: boolean;
+        verbose: boolean;
+        scope: "user" | "project";
+        renderer?: "bash" | "node" | "python";
+    };
+    projectDir: string | null;
+}
+/**
+ * Parse flags from the `claude` sub-command argv tail (everything from the
+ * sub-command name onward). Order-insensitive; unknown flags are ignored for
+ * forward compatibility. Returns `null` (and writes to stderr) on a conflict.
+ */
+export declare function parseClaudeFlags(rest: string[]): ClaudeParsedFlags | null;
+export {};
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,KAAK,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;AAEnC,MAAM,MAAM,cAAc,GAAG,CAC3B,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;AAE5C,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,cAAc,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAMD,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAqS5C,CAAC;AAMF,MAAM,WAAW,UAAU;IACzB,yDAAyD;IACzD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;IAC/B,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAY,EAC5C,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,IAAI,CAAC,CAwDf;AAMD,UAAU,iBAAiB;IACzB,IAAI,EAAE;QACJ,GAAG,EAAE,OAAO,CAAC;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;KACvC,CAAC;IACF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,iBAAiB,GAAG,IAAI,CA2DzE"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/lib/agents-generator.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Pure, side-effect-free library for generating AGENTS.md — the cross-tool
+ * bridge that inlines repo structure context for non-Claude coding agents
+ * (Cursor, Copilot, etc.).
+ *
+ * Source of truth: .claude/CLAUDE.md (the canonical Claude Code context).
+ * This file is generated for cross-tool compatibility only — hand-edits
+ * will be overwritten on the next `codebyplan claude generate`.
+ *
+ * Uses the same managed-marker + drift-hash machinery as readme-generator.ts:
+ *   <!-- codebyplan:managed:start:agents-context -->
+ *   ...content...
+ *   <!-- codebyplan:managed:end:agents-context -->
+ *   <!-- codebyplan:hash:sha256:... -->
+ *
+ * DETERMINISTIC: no I/O, no Date.now/random.
+ * Two calls with identical structureContent produce byte-identical output.
+ */
+/** The managed section name used for the agents context block. */
+export declare const AGENTS_SECTION_NAME = "agents-context";
+/**
+ * Generate the full AGENTS.md file content from structure.md output.
+ *
+ * Accepts the raw string produced by `generateStructureMd` (including its
+ * `<!-- @codebyplan-generated: structure start/end -->` sentinels). The
+ * sentinels are stripped before embedding; the clean markdown is inlined into
+ * a hardcoded curated-guidance template.
+ *
+ * The returned string is the COMPLETE file content — write it directly to
+ * `{rootDir}/AGENTS.md` with no further transformation.
+ *
+ * DETERMINISTIC — no I/O, no Date.now/random.
+ */
+export declare function generateAgentsMd(structureContent: string): string;
+/**
+ * Extract the current drift hash from AGENTS.md content, or null if absent.
+ *
+ * Thin alias of `extractManagedHash` kept for API stability.
+ * Delegates to the canonical implementation in readme-generator.ts.
+ */
+export declare function extractAgentsHash(content: string): string | null;
+//# sourceMappingURL=agents-generator.d.ts.map

package/dist/lib/agents-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-generator.d.ts","sourceRoot":"","sources":["../../src/lib/agents-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAeH,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAyGpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAsBjE;AAMD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEhE"}

package/dist/lib/api.d.ts

@@ -0,0 +1,54 @@
+export declare class ApiError extends Error {
+    status: number;
+    code?: string;
+    constructor(message: string, status: number, code?: string);
+}
+/**
+ * Validate that a legacy CODEBYPLAN_API_KEY is present in the environment.
+ * Synchronous; does NOT check OAuth tokens.
+ *
+ * @deprecated Prefer {@link validateAuth} for new callers — it accepts OAuth
+ * bearer tokens as well as the legacy API key, so it works for all
+ * authenticated users. validateApiKey() is kept for callers that explicitly
+ * require a legacy env-key check. No internal callers remain as of CHK-160
+ * (every CLI command now uses validateAuth); retained as a public export for
+ * external consumers pinned to the legacy flow — removal candidate in a future
+ * major version.
+ */
+export declare function validateApiKey(): void;
+/**
+ * OAuth-aware auth pre-check. Resolves when EITHER an OAuth bearer token
+ * (getAccessToken) OR a legacy CODEBYPLAN_API_KEY is available; throws
+ * noAuthHint() when neither is present. Prefer this over validateApiKey()
+ * for commands that should work for OAuth-authenticated users.
+ *
+ * Implementation note: this delegates to getAuthHeaders() purely as a
+ * fail-fast pre-check and discards the headers. The subsequent apiGet/apiPost
+ * calls invoke getAuthHeaders() again, so getAccessToken() runs twice per
+ * command — this is intentional and cheap: token-refresh caches the resolved
+ * access token, so the second call is a cache hit (no double network refresh).
+ * Do NOT "optimise" this away by removing the pre-check; the early throw is
+ * what gives commands a clean "Not authenticated" message before any work.
+ * Note it does NOT swallow non-NoTokenError failures — getAuthHeaders rethrows
+ * those (e.g. a network error during refresh), so validateAuth surfaces them.
+ */
+export declare function validateAuth(): Promise<void>;
+interface AuthHeaders {
+    headers: Record<string, string>;
+    via: "bearer" | "api_key";
+}
+export declare function getAuthHeaders(): Promise<AuthHeaders>;
+export declare function validateConnectivity(): Promise<void>;
+export declare function apiGet<T>(path: string, params?: Record<string, string | undefined>): Promise<T>;
+export declare function apiPost<T>(path: string, body: unknown): Promise<T>;
+export declare function apiPut<T>(path: string, body: unknown): Promise<T>;
+export declare function apiPatch<T>(path: string, body: unknown): Promise<T>;
+export declare function apiDelete(path: string, params?: Record<string, string | undefined>): Promise<void>;
+/**
+ * Call an MCP tool via JSON-RPC 2.0 over HTTP. Best-effort — callers should
+ * wrap in try/catch and treat failures as non-blocking (used for fire-and-
+ * forget enqueue_todo_job and bind_worktree_user from CLI sync paths).
+ */
+export declare function callMcpTool(toolName: string, params: Record<string, unknown>): Promise<unknown>;
+export {};
+//# sourceMappingURL=api.d.ts.map

package/dist/lib/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/lib/api.ts"],"names":[],"mappings":"AAQA,qBAAa,QAAS,SAAQ,KAAK;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;CAM3D;AAqBD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAIrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAElD;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,GAAG,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC3B;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAgB3D;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiC1D;AAuGD,wBAAsB,MAAM,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAC1C,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,wBAAsB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAExE;AAED,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAEvE;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAEzE;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,OAAO,CAAC,CAsClB"}

package/dist/lib/atomic-write.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared atomic JSON-write utility.
+ *
+ * Used by ci-init.ts, gh-required-checks.ts, and the OAuth credential store to
+ * write JSON files to disk atomically via a tmp-file rename, ensuring no partial
+ * or corrupt writes are left behind if the process is interrupted or the write
+ * fails.
+ */
+export interface WriteJsonAtomicOptions {
+    /**
+     * POSIX file mode to apply to the file (e.g. `0o600` for credentials). Applied
+     * at tmp-file creation (and re-asserted before the rename), so the bytes never
+     * sit world-readable and the final file is never briefly world-readable.
+     * Ignored on win32. When omitted, the file inherits the default umask-derived mode.
+     */
+    mode?: number;
+}
+/**
+ * Write `value` as pretty JSON to `filePath` atomically (tmp + rename),
+ * removing the tmp file if the write fails so no stale `.tmp` artefact is left.
+ *
+ * Pass `opts.mode` to set the final file's permissions atomically (chmod the
+ * tmp file before the rename) — used by the credential store to keep
+ * `credentials.json` at `0600` even across a torn write.
+ */
+export declare function writeJsonAtomic(filePath: string, value: unknown, opts?: WriteJsonAtomicOptions): void;
+//# sourceMappingURL=atomic-write.d.ts.map

package/dist/lib/atomic-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.d.ts","sourceRoot":"","sources":["../../src/lib/atomic-write.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,sBAA2B,GAChC,IAAI,CA2BN"}

package/dist/lib/branch-checkout.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Deterministic branch checkout helper.
+ *
+ * Replicates cbp-task-start Step 3.3 (branch auto-handling) so the behaviour
+ * is testable, versionable, and available in every consumer repo via the
+ * codebyplan npm package.
+ *
+ * All git operations accept an injectable RunFn so tests never touch the
+ * real filesystem or git. No top-level side effects.
+ */
+/** Synchronous command runner — returns stdout on success, throws on non-zero exit. */
+export type RunFn = (cmd: string, args: string[]) => string;
+export type CheckoutAction = "checked_out_local" | "checked_out_tracking" | "created_from_production" | "error";
+export interface CheckoutBranchOpts {
+    /** Branch to switch to (required). */
+    target: string;
+    /** Production branch to create from when target doesn't exist. Defaults to readGitConfig().production. */
+    production?: string;
+    /** Skip `git fetch origin <production>` before creating from production. Useful in tests / offline. */
+    skipFetch?: boolean;
+    /** Working directory for git commands. Defaults to process.cwd(). */
+    cwd?: string;
+    /** Injectable git runner. */
+    run?: RunFn;
+}
+export interface CheckoutBranchResult {
+    action: CheckoutAction;
+    branch: string;
+    /** Branch that was active before the switch (undefined when action is 'error'). */
+    previous?: string;
+    /** Raw git stderr when action is 'error'. */
+    error?: string;
+}
+/**
+ * Switch to `target` branch using the same three-case logic as cbp-task-start Step 3.3:
+ *
+ *   (a) target exists locally → git checkout target
+ *   (b) target exists on origin → git checkout -t origin/target
+ *   (c) otherwise → git fetch origin <production> (best-effort), then
+ *         git checkout -b target origin/<production>
+ *         fallback: git checkout -b target <production>
+ *
+ * Captures `previous` branch before switching.
+ * Non-zero checkout exit (e.g. "would clobber") → action 'error' with raw stderr verbatim.
+ */
+export declare function checkoutBranch(opts: CheckoutBranchOpts): CheckoutBranchResult;
+//# sourceMappingURL=branch-checkout.d.ts.map

package/dist/lib/branch-checkout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-checkout.d.ts","sourceRoot":"","sources":["../../src/lib/branch-checkout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,uFAAuF;AACvF,MAAM,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;AAE5D,MAAM,MAAM,cAAc,GACtB,mBAAmB,GACnB,sBAAsB,GACtB,yBAAyB,GACzB,OAAO,CAAC;AAEZ,MAAM,WAAW,kBAAkB;IACjC,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAqED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,oBAAoB,CAoG7E"}

package/dist/lib/branch-port-resolver.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Branch-based port-allocation resolver.
+ *
+ * Replaces the deleted worktree-port-resolver.ts (CHK-225 TASK-3).
+ * Instead of resolving a worktree_id via device+path+branch tuple, this helper
+ * derives the current git branch and filters port_allocations by their `branch`
+ * column (a new column added in CHK-225).  The server does not yet support
+ * server-side branch filtering, so we fetch all allocations for the repo and
+ * filter client-side.  NULL branch rows are treated as no-match.
+ *
+ * ALLOWED_FIELDS is the canonical projection allowlist for the
+ * port-allocation rows written to .codebyplan/server.local.json.
+ * Previously it lived in worktree-port-resolver.ts; types.ts ServerLocalConfig
+ * JSDoc now points here.
+ *
+ * Used by:
+ *   src/cli/ports.ts   — codebyplan ports --write-local
+ *   src/cli/config.ts  — codebyplan config (server.json port overlay)
+ */
+import type { PortAllocation } from "./types.js";
+/**
+ * Page-size hint when fetching all allocations for a repo.
+ * Kept large enough that paginated truncation is unlikely in practice.
+ */
+export declare const PORT_ALLOCATIONS_FETCH_LIMIT = "500";
+/**
+ * Canonical field allowlist for port-allocation rows written to local config.
+ * Single source of truth — ServerLocalConfig.port_allocations is typed as
+ * Partial<PortAllocation>[] to reflect that only these fields are present.
+ */
+export declare const ALLOWED_FIELDS: readonly ["id", "repo_id", "port", "label", "server_type", "auto_start", "command", "working_dir", "env_vars", "external_refs", "worktree_id", "created_at", "updated_at"];
+export interface BranchPortResolution {
+    /** The current git branch (empty string when unavailable). */
+    currentBranch: string;
+    /** Allowlist-projected allocations whose branch matches the current branch. */
+    portAllocations: Partial<PortAllocation>[];
+    /** First matching allocation, or undefined when none matched. */
+    matchingAlloc: Partial<PortAllocation> | undefined;
+}
+/**
+ * Resolve port allocations for the current git branch.
+ *
+ * Semantics:
+ *   1. Read the current git branch (fall back to "" on detached HEAD / non-repo).
+ *   2. Fetch GET /port-allocations?repo_id={repoId}&limit=500.
+ *   3. Filter client-side: keep rows whose `branch` field === currentBranch.
+ *      Rows with NULL branch are treated as no-match.
+ *   4. Apply ALLOWED_FIELDS projection.
+ *   5. matchingAlloc = portAllocations[0].
+ *
+ * API failure (step 2) is warn-and-continue: returns empty portAllocations,
+ * undefined matchingAlloc.  Never throws.
+ *
+ * @param repoId       Repo UUID (from .codebyplan/repo.json or env)
+ * @param projectPath  Absolute path to the project root
+ */
+export declare function resolveBranchPortAllocations(repoId: string, projectPath: string): Promise<BranchPortResolution>;
+//# sourceMappingURL=branch-port-resolver.d.ts.map

package/dist/lib/branch-port-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-port-resolver.d.ts","sourceRoot":"","sources":["../../src/lib/branch-port-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,cAAc,4KAcjB,CAAC;AAMX,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,eAAe,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;IAC3C,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC;CACpD;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,CAAC,CA6C/B"}

package/dist/lib/bump.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Changed-package detection + patch-bump engine.
+ *
+ * Repo-agnostic: works in any pnpm-workspace consuming repo, not just this
+ * monorepo. Reads pnpm-workspace.yaml globs, maps git-changed files to their
+ * owning packages, patch-bumps version files, and prepends CHANGELOG entries.
+ *
+ * Does NOT commit or push — pure version-file + changelog edits.
+ * Idempotent: skips packages whose working-tree version already exceeds base.
+ */
+export type BumpOptions = {
+    /** Override cwd for testing. Default: process.cwd(). */
+    cwd?: string;
+    /** If true, compute bumps but do NOT write any files. */
+    dryRun?: boolean;
+    /** Injectable date string for CHANGELOG entries (YYYY-MM-DD). Default: today. */
+    now?: string;
+    /**
+     * When set, cut or iterate a prerelease with this identifier (e.g. "beta", "rc").
+     * X.Y.Z → X.(Y+1).0-{id}.1; X.(Y+1).0-{id}.N → X.(Y+1).0-{id}.N+1.
+     * Bypasses the compareSemver idempotency guard so that a working-tree prerelease
+     * version that already exceeds the stable base is still incremented.
+     */
+    prereleaseId?: string;
+};
+export type BumpEntry = {
+    /** Workspace package name (from package.json `name` field, or the dir path). */
+    name: string;
+    /** Absolute path to the package directory. */
+    packageDir: string;
+    /** Current (working-tree) version, before bump. */
+    currentVersion: string;
+    /** Next (patch-bumped) version. */
+    nextVersion: string;
+    /** Relative paths of the version files that were updated. */
+    versionFiles: string[];
+    /** Relative paths of version-file candidates that had no version field and were skipped. */
+    skippedVersionFiles?: string[];
+    /** Whether the CHANGELOG was updated. */
+    changelogUpdated: boolean;
+    /** Whether this entry was a no-op (already bumped / idempotent). */
+    skipped: boolean;
+    /** Human-readable reason for skipping (present when skipped=true). */
+    skipReason?: string;
+};
+export type BumpResult = {
+    /** Configured base branch NAME from .codebyplan/git.json (e.g. "main"). */
+    baseBranch: string;
+    /** The git ref actually compared against (e.g. "origin/main" when it exists). */
+    baseRef: string;
+    entries: BumpEntry[];
+    /** true when dryRun=true (files NOT written). */
+    dryRun: boolean;
+};
+/**
+ * Patch-bump a semver string: increment the LAST numeric segment.
+ * Examples:
+ *   1.2.3       → 1.2.4
+ *   1.2.3-beta.4 → 1.2.4   (pre-release: bump the patch segment, drop pre-release tag)
+ *   0.0.1       → 0.0.2
+ */
+export declare function patchBump(version: string): string;
+/**
+ * Prerelease-bump a semver string.
+ *
+ * Rules (id = the caller-supplied identifier, e.g. "beta", "rc"):
+ *   - version carries `-{id}.{N}` with matching id  → increment N.
+ *     e.g.  "1.14.0-beta.1", "beta" → "1.14.0-beta.2"
+ *   - version carries bare `-{id}` with no number    → append ".1".
+ *     e.g.  "1.14.0-beta",   "beta" → "1.14.0-beta.1"
+ *   - version is stable OR carries a DIFFERENT id    → minor-bump the numeric
+ *     core (major.(minor+1).0) and append -{id}.1.
+ *     e.g.  "1.13.40",       "beta" → "1.14.0-beta.1"
+ *           "1.14.0-beta.3", "rc"   → "1.15.0-rc.1"
+ * Preserves a leading "v" prefix (same contract as patchBump).
+ * Non-semver / unrecognisable input → returned unchanged.
+ */
+export declare function prereleaseBump(version: string, id: string): string;
+/**
+ * Compare two semver strings. Returns positive if a > b, 0 if equal, negative if a < b.
+ * Handles:
+ *   - Leading "v" prefix (stripped before comparison)
+ *   - Pre-release suffixes (e.g. "1.2.3-beta.1"): a pre-release ranks BELOW its release
+ *     when numeric cores are equal (semver spec: 1.2.3-beta.1 < 1.2.3)
+ *   - Non-semver strings: parseCore returns [-1,-1,-1] sentinel (distinct from real 0.0.0)
+ */
+export declare function compareSemver(a: string, b: string): number;
+/**
+ * Run the bump engine.
+ *
+ * 1. Resolve base branch from .codebyplan/git.json.
+ * 2. Compute git diff --name-only <base>...HEAD (three-dot / merge-base).
+ * 3. Map changed files to owning workspace packages.
+ * 4. For each changed package: check idempotency, patch-bump, update CHANGELOG.
+ */
+export declare function runBump(opts?: BumpOptions): Promise<BumpResult>;
+//# sourceMappingURL=bump.d.ts.map

package/dist/lib/bump.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bump.d.ts","sourceRoot":"","sources":["../../src/lib/bump.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,MAAM,MAAM,WAAW,GAAG;IACxB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,4FAA4F;IAC5F,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,yCAAyC;IACzC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iDAAiD;IACjD,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAiIF;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAejD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CA2ClE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAsB1D;AAsGD;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAmNrE"}

package/dist/lib/cd-init.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Library for `codebyplan cd init`.
+ *
+ * Reads `.codebyplan/shipment.json` to discover which CD surfaces are
+ * configured for this repo, builds a default CdConfig from the discovered
+ * surface keys, and writes it to `.codebyplan/cd.json`. Idempotent — deep-
+ * merges newly discovered surfaces into an existing config, never overwriting
+ * existing surface keys unless --force is set.
+ *
+ * Surface detection is policy-explicit (driven by shipment.json surface keys),
+ * NOT filesystem-inferred. This is the key difference from ci-init.ts which
+ * probes files/directories to detect platforms.
+ *
+ * Credential values are NEVER written — only env var NAMES are recorded.
+ */
+import type { CdConfig, CdSurface } from "./types.js";
+/**
+ * Default CD surface configuration per well-known surface slug.
+ *
+ * Credentials carry only the env-var NAMES that are conventionally expected
+ * for each surface — never actual secret values. Unknown surface slugs fall
+ * back to the `_default` entry.
+ */
+export declare const SURFACE_DEFAULTS: Record<string, CdSurface>;
+/**
+ * Read `.codebyplan/shipment.json` and return the set of surface keys defined
+ * under `shipment.surfaces`. Returns an empty array when the file is absent,
+ * malformed, or has no surfaces block.
+ *
+ * Surface keys from shipment.json may contain platform prefixes (e.g.
+ * "railway-todo-worker"). The function normalises them to well-known
+ * CdSurfaceId slugs when possible, otherwise keeps the raw key.
+ */
+export declare function detectSurfaces(projectDir: string): string[];
+/**
+ * Map a raw shipment.json surface key to a canonical CdSurfaceId (or keep the
+ * raw key when it does not match any well-known prefix).
+ *
+ * Matching rules (first match wins):
+ *   - Exact match against a known CdSurfaceId → use it as-is.
+ *   - Key starts with a known platform prefix (e.g. "railway-" → "railway",
+ *     "vercel_" → "vercel") → return the prefix.
+ *   - No match → return the raw key (custom surface).
+ */
+export declare function normaliseSurfaceKey(key: string): string;
+/**
+ * Build a default CdConfig from a list of raw shipment.json surface keys.
+ *
+ * Each key is normalised to a canonical CdSurfaceId before looking up the
+ * defaults. Unknown slugs fall back to DEFAULT_SURFACE.
+ */
+export declare function buildDefaultCdConfig(rawSurfaceKeys: string[]): CdConfig;
+export interface CdInitOptions {
+    /** If true, compute the operation but do NOT write any files. */
+    dryRun?: boolean;
+    /**
+     * If true, overwrite existing surface keys rather than deep-merging.
+     * Without --force, only NEW surfaces (not already in the config) are added.
+     */
+    force?: boolean;
+    /**
+     * Override the project root directory (default: process.cwd()).
+     */
+    projectDir?: string;
+}
+export interface CdInitResult {
+    /** `written` — file was created or updated. `skipped` — all surfaces already present.
+     *  `dry_run` — computed what would change but wrote nothing. */
+    status: "written" | "skipped" | "dry_run";
+    /** Absolute path to `.codebyplan/cd.json`. */
+    path: string;
+    /**
+     * For `written`/`dry_run` — the detected (normalised) surface slugs.
+     * For `skipped` — the already-present surface slugs (no-op).
+     */
+    surfaces: string[];
+}
+/**
+ * Detect CD surfaces from `.codebyplan/shipment.json` and write (or update)
+ * `.codebyplan/cd.json`.
+ *
+ * Idempotent deep-merge: newly detected surfaces are added to the existing
+ * config; existing surface keys are left unchanged unless `force` is set.
+ */
+export declare function runCdInit(opts?: CdInitOptions): Promise<CdInitResult>;
+//# sourceMappingURL=cd-init.d.ts.map

package/dist/lib/cd-init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cd-init.d.ts","sourceRoot":"","sources":["../../src/lib/cd-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAOnE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAmEtD,CAAC;AAeF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAuB3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAwBvD;AAMD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,QAAQ,CAqBvE;AAMD,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B;oEACgE;IAChE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC1C,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAyE3E"}

package/dist/lib/check-baseline.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Baseline file management for `codebyplan check`.
+ *
+ * The baseline records the set of known-failing packages per check (lint,
+ * typecheck, tests) and known GHSA advisory IDs for audit. A check only
+ * hard-fails when a NEW package fails (not in the baseline) or a NEW GHSA
+ * advisory appears (not in the allowlist).
+ *
+ * This module is deliberately PURE for diff/parse functions — no process
+ * spawning and disk I/O isolated to loadBaseline/saveBaseline so the logic
+ * can be unit-tested without disk.
+ */
+export interface BaselineCheckEntry {
+    /** Package names (e.g. "@codebyplan/web") that are known to fail. */
+    known_failing: string[];
+}
+export interface BaselineFile {
+    lint: BaselineCheckEntry;
+    typecheck: BaselineCheckEntry;
+    tests: BaselineCheckEntry;
+    audit: {
+        /** GHSA advisory IDs that are known/allowlisted (e.g. "GHSA-49rj-9fvp-4h2h"). */
+        ghsa_ids: string[];
+    };
+}
+export type BaselineCheckName = "lint" | "typecheck" | "tests";
+/**
+ * Load the baseline file from the project root.
+ * Returns an empty-shaped default if the file is missing or malformed.
+ */
+export declare function loadBaseline(projectRoot: string): BaselineFile;
+/**
+ * Write the baseline file to the project root (overwrites any existing file).
+ */
+export declare function saveBaseline(projectRoot: string, baseline: BaselineFile): void;
+/**
+ * Return the NEW failing packages for a given check.
+ * "New" means the package is in currentFailingPackages but NOT in the
+ * baseline's known_failing list for that check.
+ *
+ * @param check - Which check (lint | typecheck | tests)
+ * @param currentFailingPackages - Package names that failed this run
+ * @param baseline - The loaded baseline file
+ * @returns Array of package names that are NEW failures (not baselined)
+ */
+export declare function diffBaseline(check: BaselineCheckName, currentFailingPackages: string[], baseline: BaselineFile): string[];
+/**
+ * Sentinel returned by parseAuditJson when stdout is NON-EMPTY but the JSON
+ * cannot be parsed or the shape is unrecognised. Exported so callers can
+ * distinguish "parse failed" from "parsed OK, no advisories" (the latter still
+ * returns []).
+ *
+ * Keep as a const so tests can reference the exported symbol rather than a
+ * string literal.
+ */
+export declare const AUDIT_PARSE_FAILED = "__audit_parse_failed__";
+/**
+ * Parse GHSA advisory IDs from `pnpm audit --json` stdout.
+ *
+ * `pnpm audit --json` emits a single JSON object with an `advisories` map
+ * keyed by numeric advisory ID. Each entry has a `github_advisory_id` field
+ * containing the GHSA-* identifier (may be null for non-GitHub advisories).
+ *
+ * Example structure:
+ * {
+ *   "advisories": {
+ *     "1120063": {
+ *       "github_advisory_id": "GHSA-49rj-9fvp-4h2h",
+ *       ...
+ *     }
+ *   }
+ * }
+ *
+ * Returns deduplicated GHSA IDs in sorted order for determinism.
+ *
+ * FAIL-CLOSED: when stdout is non-empty but cannot be parsed or the recognised
+ * shape is absent, returns [AUDIT_PARSE_FAILED] so the caller can surface a
+ * failure rather than silently treating it as "no advisories".
+ * Empty / whitespace-only stdout fast-paths to [] (genuine "no advisories").
+ */
+export declare function parseAuditJson(stdout: string): string[];
+/**
+ * Return GHSA IDs in currentGhsaIds that are NOT in the allowlist.
+ * "New advisory" = a GHSA id present in the current run but absent from the baseline.
+ *
+ * @param currentGhsaIds - GHSA IDs found in this audit run
+ * @param allowlist - GHSA IDs from the baseline (known/allowed advisories)
+ * @returns Array of new (unallowlisted) GHSA IDs
+ */
+export declare function diffAudit(currentGhsaIds: string[], allowlist: string[]): string[];
+//# sourceMappingURL=check-baseline.d.ts.map

package/dist/lib/check-baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-baseline.d.ts","sourceRoot":"","sources":["../../src/lib/check-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,kBAAkB,CAAC;IACzB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE;QACL,iFAAiF;QACjF,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC;AAqB/D;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,CA4B9D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,YAAY,GACrB,IAAI,CAGN;AAMD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,iBAAiB,EACxB,sBAAsB,EAAE,MAAM,EAAE,EAChC,QAAQ,EAAE,YAAY,GACrB,MAAM,EAAE,CAGV;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CA0CvD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,cAAc,EAAE,MAAM,EAAE,EACxB,SAAS,EAAE,MAAM,EAAE,GAClB,MAAM,EAAE,CAGV"}