draftgo-cli 1.0.4

package/resources/skill/references/services.md

@@ -0,0 +1,32 @@
+# 自定义 Go 服务
+
+底座现有操作无法表达所需业务逻辑时读取。通用发现与调用规则见 `mcp.md`；服务管理使用 `draftgo api search "custom service"` 发现能力。
+
+## 当前 CLI 能力边界
+
+CLI 能发现服务接口并执行 inline operation。底座将源码和 SDK 接口标为 checkout_commit workflow，但当前 CLI checkout 仅支持 pages/nav/docs，api call 对 workflow 返回 WORKFLOW_REQUIRED，不会执行传输。因此当前 CLI 尚不能独立完成源码/SDK 获取与保存闭环；不要反复调用或声称已实现服务。需要源码传输时明确报告此缺口，保留本地工作，其他 inline 配置和查询可继续。
+
+## 底座开发链
+
+
+1. 搜索服务相关能力，确认 SDK、草稿、验证、试运行、策略与发布入口。已有服务先唯一定位，新服务通过创建 operation 获取 ID。
+2. 获取当前实例 SDK 和草稿，完整内容落到本地文件编辑，避免大响应进入对话。源码使用单文件 main.go，通过 Register 注册入口；签名、支持方法与依赖方式以当前 SDK 为准。
+3. 保存源码仅提交 source 和读取的 base_revision；策略独立版本管理，不能随源码携带空 config 重置权限。保存后回读草稿 revision。
+4. 验证准确草稿版本，再通过草稿执行检查业务结果和日志。发布使用已验证的 revision，回读发布版本；仅要求草稿时不扩大为上线。
+5. 按任务范围验证实际入口与权限，记录执行 ID、版本和结果。
+
+源码和 SDK 使用专用 API，不传给只支持 pages/nav/docs 的 checkout。MCP 对长响应返回 workflow 指引时，沿其允许流程获取完整文件；缺少可执行传输入口时报告具体 operation 和响应，不用摘要代替源码或声称完成。
+
+## 策略与运行
+
+服务默认要求登录，公开访问依据明确产品需求。先读取策略与版本，使用 base_version 保存；平台共享配置走独立接口。访问范围、角色顺序、个人限制和服务运行限制按实时 schema 配置，以后端预览核对匿名、目标用户和多角色结果。
+
+入口允许调用不代表业务数据全部可访问。SDK 使用调用者身份；受信任服务有明确业务需要并验证条件后才显式使用 ctx.Admin.*。CLI 不注入系统身份。
+
+每次执行独立子进程。goroutine、channel 与请求内并行在 handler 返回前收束；持久任务使用底座可靠执行机制。依赖通过平台声明、验证和锁定流程获取，不替换托管 SDK。
+
+## 失败与完成证据
+
+401/403 检查身份、操作权限和策略；409 检查版本或幂等冲突并保留源码；429 检查调用限制；503 检查服务和容量；504 检查超时。执行结果不明先查记录，不重复有副作用调用。
+
+完成证据：草稿 revision、验证结果、试运行执行 ID；涉及发布时补充发布版本和真实调用结果。HTTP 路由存在而 MCP 搜不到时检查 OpenAPI/Registry 登记，不据此断言模块不存在。

package/src/apiContractCache.js

@@ -0,0 +1,120 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const SCHEMA_VERSION = 1;
+const WAIT = new Int32Array(new SharedArrayBuffer(4));
+
+function cachePath(projectDir) {
+  return path.join(projectDir, '.draftgo', 'api-contract-cache.json');
+}
+
+function emptyCache(server) {
+  return { schema_version: SCHEMA_VERSION, server, operations: {} };
+}
+
+function readCache(projectDir, server) {
+  const file = cachePath(projectDir);
+  if (!fs.existsSync(file)) return emptyCache(server);
+  try {
+    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (!value || value.schema_version !== SCHEMA_VERSION || value.server !== server
+        || !value.operations || Array.isArray(value.operations)) return emptyCache(server);
+    return value;
+  } catch {
+    return emptyCache(server);
+  }
+}
+
+function normalizeDescription(value, fallbackRevision = '') {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const operation = value.operation && typeof value.operation === 'object' ? value.operation : value;
+  const registryRevision = String(value.registry_revision || operation.registry_revision || fallbackRevision).trim();
+  const contractHash = String(value.contract_hash || operation.contract_hash || '').trim();
+  const operationId = String(operation.operation_id || '').trim();
+  if (!operationId || !registryRevision) return null;
+  const normalized = { ...operation };
+  delete normalized.registry_revision;
+  delete normalized.contract_hash;
+  const resolvedHash = contractHash || crypto.createHash('sha256')
+    .update(JSON.stringify(canonicalValue(normalized))).digest('hex');
+  return { operation: normalized, registry_revision: registryRevision, contract_hash: resolvedHash };
+}
+
+function canonicalValue(value) {
+  if (Array.isArray(value)) return value.map(canonicalValue);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalValue(value[key])]));
+}
+
+function cachedDescription(projectDir, server, operationId) {
+  const cached = readCache(projectDir, server).operations[String(operationId)];
+  return normalizeDescription(cached);
+}
+
+function acquire(file) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const lock = `${file}.lock`;
+  const started = Date.now();
+  while (true) {
+    try {
+      const descriptor = fs.openSync(lock, 'wx', 0o600);
+      fs.closeSync(descriptor);
+      return lock;
+    } catch (error) {
+      if (!error || error.code !== 'EEXIST') throw error;
+    }
+    try {
+      if (Date.now() - fs.statSync(lock).mtimeMs > 30_000) {
+        fs.rmSync(lock, { force: true });
+        continue;
+      }
+    } catch (error) {
+      if (!error || error.code !== 'ENOENT') throw error;
+      continue;
+    }
+    if (Date.now() - started >= 2000) return null;
+    Atomics.wait(WAIT, 0, 0, 10);
+  }
+}
+
+function writeAtomic(file, value) {
+  const temporary = `${file}.tmp-${process.pid}-${crypto.randomBytes(8).toString('hex')}`;
+  try {
+    fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    fs.renameSync(temporary, file);
+  } finally {
+    try { fs.rmSync(temporary, { force: true }); } catch { /* Best-effort cleanup. */ }
+  }
+}
+
+function storeDescription(projectDir, server, value, fallbackRevision = '') {
+  const normalized = normalizeDescription(value, fallbackRevision);
+  if (!normalized) return null;
+  const file = cachePath(projectDir);
+  const lock = acquire(file);
+  if (!lock) return normalized;
+  try {
+    const cache = readCache(projectDir, server);
+    cache.operations[normalized.operation.operation_id] = {
+      ...normalized,
+      described_at: new Date().toISOString(),
+    };
+    cache.updated_at = new Date().toISOString();
+    writeAtomic(file, cache);
+  } finally {
+    try { fs.rmSync(lock, { force: true }); } catch { /* Cache writes are best effort. */ }
+  }
+  return normalized;
+}
+
+module.exports = {
+  SCHEMA_VERSION,
+  cachePath,
+  readCache,
+  normalizeDescription,
+  cachedDescription,
+  storeDescription,
+};

package/src/cli.js

@@ -0,0 +1,100 @@
+'use strict';
+
+// Tiny, dependency-free argv parser tailored for draftgo-cli.
+// Supports: subcommand, positional args, --flag, --key value, --key=value.
+
+const VALUE_FLAGS = new Set([
+  'project',
+  'target',
+  'server',
+  'mcp-url',
+  'api-key',
+  'token',
+  'output',
+  'url',
+  'browser',
+  'browser-path',
+  'ui',
+  'frame',
+  'viewport',
+  'screenshot',
+  'selector',
+  'width',
+  'height',
+  'wait-ms',
+  'delivery',
+  'assignee',
+  'assignee-id',
+  'timeout',
+  'operation-id',
+  'params',
+  'input',
+  'type',
+  'route',
+  'title',
+  'limit',
+  'offset',
+  'cursor',
+  'date',
+  'page',
+  'instance',
+  'note',
+  'file',
+  'library',
+  'name',
+  'slug',
+  'category',
+  'description',
+  'tags',
+  'source-type',
+  'status',
+  'module',
+  'resource-type',
+  'method',
+  'risk',
+  'permission',
+]);
+
+function parse(argv) {
+  const args = argv.slice();
+  const out = { command: null, positional: [], flags: {}, errors: [] };
+  while (args.length) {
+    const a = args.shift();
+    if (a === '--') {
+      out.positional.push(...args);
+      break;
+    }
+    if (a.startsWith('--')) {
+      const raw = a.slice(2);
+      const eq = raw.indexOf('=');
+      if (eq >= 0) {
+        const key = raw.slice(0, eq);
+        const value = raw.slice(eq + 1);
+        if (VALUE_FLAGS.has(key) && !value) out.errors.push(`Option --${key} requires a value.`);
+        else out.flags[key] = value;
+      } else {
+        const next = args[0];
+        if (VALUE_FLAGS.has(raw)) {
+          // A declared value flag must never silently become boolean true.
+          if (next === undefined || next === '--' || next.startsWith('--')) {
+            out.errors.push(`Option --${raw} requires a value.`);
+          } else {
+            out.flags[raw] = next;
+            args.shift();
+          }
+        } else {
+          out.flags[raw] = true;
+        }
+      }
+    } else if (a.startsWith('-') && a.length > 1) {
+      out.flags[a.slice(1)] = true;
+    } else if (!out.command) {
+      out.command = a;
+    } else {
+      out.positional.push(a);
+    }
+  }
+  return out;
+}
+
+module.exports = { parse, VALUE_FLAGS };

package/src/commandRegistry.js

@@ -0,0 +1,46 @@
+'use strict';
+
+// Keep command names, aliases, and dispatch behavior in one place. This avoids
+// aliases silently drifting away from the implementation as the CLI grows.
+const commands = [
+  { name: 'init', run: (dir, args, flags) => require('./commands/init')(dir, args, flags) },
+  { name: 'update', run: (dir, args, flags) => require('./commands/update')(dir, args, flags) },
+  { name: 'uninstall', run: (dir, args, flags) => require('./commands/uninstall')(dir, args, flags) },
+  { name: 'status', run: (dir, args, flags) => require('./commands/status')(dir, args, flags) },
+  { name: 'work', run: (dir, args, flags) => require('./commands/worklog')(dir, args, flags) },
+  { name: 'clean', run: (dir, args, flags) => require('./commands/clean')(dir, args, flags) },
+  { name: 'map', run: (dir, _args, flags) => require('./commands/map')(dir, flags) },
+  { name: 'check', run: (dir, args, flags) => require('./commands/check')(dir, args, flags) },
+  { name: 'verify', run: (dir, args, flags) => require('./commands/verify')(dir, args, flags) },
+  { name: 'mcp', run: (dir, args, flags) => require('./commands/mcp')(dir, args, flags) },
+  { name: 'checkout', run: (dir, args, flags) => require('./commands/checkout')(dir, args, flags) },
+  { name: 'refresh', run: (dir, args, flags) => require('./commands/checkout')(dir, args, flags) },
+  { name: 'commit', run: (dir, args, flags) => require('./commands/commit')(dir, args, flags) },
+  { name: 'reconcile', run: (dir, args, flags) => require('./commands/reconcile')(dir, args, flags) },
+  { name: 'diff', run: (dir, args, flags) => require('./commands/diff')(dir, args, flags) },
+  { name: 'conflicts', run: (dir, args, flags) => require('./commands/conflicts')(dir, args, flags) },
+  { name: 'conflict', run: (dir, args, flags) => require('./commands/conflict')(dir, args, flags) },
+  { name: 'api', run: (dir, args, flags) => require('./commands/api')(dir, args, flags) },
+  { name: 'group', run: (dir, args, flags) => require('./commands/group')(dir, args, flags) },
+  { name: 'api-key', run: (dir, args, flags) => require('./commands/apiKey')(dir, args, flags) },
+  { name: 'role', run: (dir, args, flags) => require('./commands/role')(dir, args, flags) },
+  { name: 'delete', run: (dir, args, flags) => require('./commands/delete')(dir, args, flags) },
+  { name: 'deploy', run: (dir, args, flags) => require('./commands/deploy')(dir, args, flags) },
+  { name: 'auto-push', run: (dir, args, flags) => require('./commands/autoPush')(dir, args, flags) },
+  { name: 'local', run: (dir, args, flags) => require('./commands/local')(dir, args, flags) },
+  { name: 'list-targets', run: () => require('./commands/listTargets')() },
+  { name: 'connect', run: (dir, args, flags) => require('./commands/connect')(dir, args, flags) },
+  { name: 'components', run: (dir, args, flags) => require('./commands/components')(dir, args, flags) },
+  { name: 'capabilities', run: (dir, args, flags) => require('./commands/capabilities')(dir, args, flags) },
+];
+
+const aliases = new Map();
+for (const command of commands) {
+  for (const alias of [command.name, ...(command.aliases || [])]) aliases.set(alias, command);
+}
+
+function resolveCommand(name) {
+  return aliases.get(name);
+}
+
+module.exports = { commands, resolveCommand };

package/src/commands/api.js

@@ -0,0 +1,244 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const log = require('../logger');
+const { confirm } = require('../prompt');
+const { loadProjectConfig } = require('../projectConfig');
+const { TOOL_NAMES, openToolSession, callStructured } = require('../mcp/tools');
+const { cachedDescription, normalizeDescription, storeDescription } = require('../apiContractCache');
+const {
+  isContractCompatibilityError,
+  isHardContractIncompatibility,
+  isDangerousOperation,
+  sameOperationContract,
+  canRetryAfterContractChange,
+  incompatibleOperationError,
+} = require('../contractCompatibility');
+
+async function registryRevision(session, operationId) {
+  const result = await callStructured(session, TOOL_NAMES.apiSearch, {
+    query: operationId,
+    limit: 100,
+  });
+  const items = result && Array.isArray(result.items) ? result.items : [];
+  const operation = items.find((item) => item && item.operation_id === operationId);
+  const revision = String(result && result.registry_revision || '').trim();
+  if (!operation || !revision) {
+    throw new Error(`DraftGo Registry could not resolve operation ${operationId} with a revision.`);
+  }
+  return revision;
+}
+
+async function describeOperation(projectDir, config, session, operationId, knownRevision = '') {
+  let revision = String(knownRevision || '').trim();
+  if (!revision) revision = await registryRevision(session, operationId);
+  const described = await callStructured(session, TOOL_NAMES.apiDescribe, {
+    operation_id: operationId,
+    registry_revision: revision,
+  });
+  return storeDescription(projectDir, config.server, described, revision)
+    || normalizeDescription(described, revision);
+}
+
+async function descriptionForRevision(projectDir, config, session, operationId, knownRevision = '') {
+  const revision = String(knownRevision || '').trim() || await registryRevision(session, operationId);
+  const cached = cachedDescription(projectDir, config.server, operationId);
+  if (cached && cached.registry_revision === revision) return cached;
+  return describeOperation(projectDir, config, session, operationId, revision);
+}
+
+function readCallInput(projectDir, flags) {
+  if (flags.input && flags.params) throw new Error('Use either --input or --params, not both.');
+  const raw = flags.input
+    ? fs.readFileSync(path.resolve(projectDir, String(flags.input)))
+    : flags.params ? Buffer.from(String(flags.params), 'utf8') : Buffer.from('{}', 'utf8');
+  const text = new TextDecoder('utf-8', { fatal: true }).decode(raw);
+  const value = JSON.parse(text);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('API call input must be a UTF-8 JSON object.');
+  }
+  return value;
+}
+
+function diagnosticResult(operationId, result) {
+  const source = result && typeof result === 'object' ? result : { data: result };
+  const statusCode = source.status_code ?? source.statusCode ?? source.status ?? null;
+  const headerRequestId = source.headers
+    && (source.headers['x-request-id'] || source.headers['X-Request-Id']);
+  const rawRequestId = source.request_id ?? source.requestId ?? headerRequestId ?? null;
+  const requestId = Array.isArray(rawRequestId) ? rawRequestId[0] || null : rawRequestId;
+  const data = source.data && typeof source.data === 'object' ? source.data : {};
+  const error = source.error || data.error || {};
+  return {
+    operation_id: operationId,
+    status_code: statusCode,
+    server_code: error.code || data.code || source.code || null,
+    request_id: requestId,
+    result,
+  };
+}
+
+function assertInvocationResult(operationId, result) {
+  const diagnostic = diagnosticResult(operationId, result);
+  if (result && result.workflow && result.workflow.required) {
+    const error = new Error(`Operation ${operationId} requires the ${result.workflow.workflow || result.workflow.mode} workflow; it has not executed.`);
+    error.code = 'WORKFLOW_REQUIRED';
+    error.details = { ...diagnostic, workflow: result.workflow };
+    throw error;
+  }
+  if (Number(diagnostic.status_code) >= 400) {
+    const data = result.data || {};
+    const error = new Error(data.error && data.error.message || data.message || `DraftGo returned HTTP ${diagnostic.status_code}.`);
+    error.code = diagnostic.server_code || 'HTTP_ERROR';
+    error.status = diagnostic.status_code;
+    error.details = { ...data, request_id: diagnostic.request_id };
+    throw error;
+  }
+  return result;
+}
+
+function diagnosticError(operationId, error) {
+  const source = error && (error.details || error.data) || {};
+  const nested = source.error && typeof source.error === 'object' ? source.error : {};
+  return {
+    operation_id: operationId,
+    status_code: (error && error.status) ?? source.status_code ?? source.status ?? null,
+    server_code: nested.code || source.code || error && error.code || null,
+    request_id: source.request_id || source.requestId || nested.request_id || null,
+    error: { message: error && error.message || String(error) },
+  };
+}
+
+function printCallError(operationId, error, flags) {
+  const diagnostic = diagnosticError(operationId, error);
+  if (flags.output === 'json') console.log(JSON.stringify(diagnostic, null, 2));
+  else {
+    log.err(`DraftGo operation failed: ${operationId}`);
+    log.info(`status=${diagnostic.status_code ?? '-'} code=${diagnostic.server_code ?? '-'} request_id=${diagnostic.request_id ?? '-'}`);
+    log.err(diagnostic.error.message);
+  }
+  return 1;
+}
+
+async function callOperation(projectDir, operationId, flags = {}) {
+  if (!operationId) {
+    log.err('Usage: draftgo api call <operation_id> --input <json-file>');
+    return 1;
+  }
+  let session;
+  let description;
+  let input;
+  let config;
+  try {
+	config = loadProjectConfig(projectDir);
+    session = await openToolSession(config, [
+      TOOL_NAMES.apiSearch, TOOL_NAMES.apiDescribe, TOOL_NAMES.apiCall,
+    ]);
+    description = cachedDescription(projectDir, config.server, operationId);
+    if (!description) {
+      description = await describeOperation(projectDir, config, session, operationId);
+    }
+    if (!description) throw new Error('DraftGo API description is missing contract revision metadata.');
+    input = readCallInput(projectDir, flags);
+  } catch (error) {
+    return printCallError(operationId, error, flags);
+  }
+  const dangerous = isDangerousOperation(description);
+  if (dangerous && !flags.yes && !flags.y) {
+    if (flags.output === 'json' || !process.stdin.isTTY) {
+      console.log(JSON.stringify({
+        operation_id: operationId,
+        error: { code: 'CONFIRMATION_REQUIRED', message: 'Dangerous operations require --yes in JSON output mode.' },
+      }, null, 2));
+      return 1;
+    }
+    const approved = await confirm(`Call destructive DraftGo operation ${operationId}?`, { default: false });
+    if (!approved) return 1;
+  }
+  let result;
+  try {
+    const invoke = (contract, confirmed) => callStructured(session, TOOL_NAMES.apiCall, {
+      ...input, operation_id: operationId, registry_revision: contract.registry_revision,
+      ...(confirmed ? { confirm: true } : {}),
+    });
+    try {
+      result = await invoke(description, dangerous);
+    } catch (error) {
+      if (!isContractCompatibilityError(error)) throw error;
+      if (isHardContractIncompatibility(error)) {
+        throw incompatibleOperationError(operationId, error);
+      }
+      const previousDescription = description;
+      const revision = await registryRevision(session, operationId);
+      description = await describeOperation(projectDir, config, session, operationId, revision);
+      if (!description) throw new Error('DraftGo API description is missing contract revision metadata.');
+      const changedDangerous = isDangerousOperation(description);
+      if ((dangerous || changedDangerous) && !sameOperationContract(previousDescription, description)) {
+        throw incompatibleOperationError(operationId, error);
+      }
+      if (!canRetryAfterContractChange(previousDescription, description)) {
+        throw incompatibleOperationError(operationId, error);
+      }
+      result = await invoke(description, changedDangerous);
+    }
+    assertInvocationResult(operationId, result);
+  } catch (error) {
+    return printCallError(operationId, error, flags);
+  }
+  const diagnostic = diagnosticResult(operationId, result);
+  if (flags.output === 'json') console.log(JSON.stringify(diagnostic, null, 2));
+  else {
+    log.ok(`DraftGo operation completed: ${operationId}`);
+    log.info(`status=${diagnostic.status_code ?? '-'} code=${diagnostic.server_code ?? '-'} request_id=${diagnostic.request_id ?? '-'}`);
+    console.log(JSON.stringify(result, null, 2));
+  }
+  return 0;
+}
+
+function printResult(title, result) {
+  log.title(title);
+  if (Array.isArray(result)) {
+    for (const item of result) log.plain(`  ${JSON.stringify(item)}`);
+    return;
+  }
+  if (result && Array.isArray(result.items)) {
+    for (const item of result.items) log.plain(`  ${JSON.stringify(item)}`);
+    return;
+  }
+  console.log(JSON.stringify(result, null, 2));
+}
+
+async function apiCommand(projectDir, positional, flags = {}) {
+  const first = String(positional[0] || '').toLowerCase();
+  if (first === 'call') return callOperation(projectDir, String(positional[1] || ''), flags);
+  const describe = first === 'describe';
+  const queryParts = first === 'search' || describe ? positional.slice(1) : positional;
+  const query = queryParts.join(' ').trim();
+  if (!query) {
+    log.err('Usage: draftgo api <query> | draftgo api search <query> | draftgo api describe <operation_id>');
+    return 1;
+  }
+
+  const config = loadProjectConfig(projectDir);
+  const expected = describe ? [TOOL_NAMES.apiSearch, TOOL_NAMES.apiDescribe] : [TOOL_NAMES.apiSearch];
+  const session = await openToolSession(config, expected);
+  const result = describe
+    ? await describeOperation(projectDir, config, session, query)
+    : await callStructured(session, TOOL_NAMES.apiSearch,
+      require('./capabilities').searchArguments(query, flags, flags.cursor));
+  if (flags.output === 'json') console.log(JSON.stringify(result, null, 2));
+  else printResult(describe ? `DraftGo API ${query}` : `DraftGo API search: ${query}`, result);
+  return 0;
+}
+
+module.exports = apiCommand;
+module.exports.readCallInput = readCallInput;
+module.exports.diagnosticResult = diagnosticResult;
+module.exports.diagnosticError = diagnosticError;
+module.exports.printCallError = printCallError;
+module.exports.callOperation = callOperation;
+module.exports.registryRevision = registryRevision;
+module.exports.describeOperation = describeOperation;
+module.exports.descriptionForRevision = descriptionForRevision;
+module.exports.assertInvocationResult = assertInvocationResult;

package/src/commands/apiKey.js

@@ -0,0 +1,30 @@
+'use strict';
+
+const log = require('../logger');
+const { callOperation } = require('./api');
+
+const OPERATIONS = Object.freeze({
+  status: 'getCurrentUserAPIKey',
+  create: 'createCurrentUserAPIKey',
+  update: 'setCurrentUserAPIKeyActive',
+  delete: 'deleteCurrentUserAPIKey',
+  rotate: 'rotateCurrentUserAPIKey',
+});
+
+function operationKey(value) {
+  const action = String(value || 'status').trim().toLowerCase();
+  return OPERATIONS[action] ? action : '';
+}
+
+async function apiKeyCommand(projectDir, positional, flags = {}) {
+  const action = operationKey(positional[0]);
+  if (!action) {
+    log.err('Usage: draftgo api-key status|create|update|delete|rotate [--input <json-file>]');
+    return 1;
+  }
+  return callOperation(projectDir, OPERATIONS[action], flags);
+}
+
+module.exports = apiKeyCommand;
+module.exports.OPERATIONS = OPERATIONS;
+module.exports.operationKey = operationKey;

package/src/commands/autoPush.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const fs = require('fs');
+const { loadProjectConfig } = require('../projectConfig');
+const { loadManifest, absolutePath } = require('../worktree/manifest');
+const { hashFile } = require('../worktree/streams');
+const { targetsFrom, deliverTargets, outputResult } = require('./deploy');
+
+async function changedEntries(projectDir, manifest) {
+  const changed = [];
+  for (const entry of Object.values(manifest.entries)) {
+    const local = absolutePath(projectDir, entry.local_path);
+    // Missing files must be validated, not silently dropped from delivery.
+    if (!fs.existsSync(local) || (await hashFile(local)).hash !== entry.base_hash) changed.push(entry);
+  }
+  return changed;
+}
+
+async function autoPush(projectDir, positional, flags = {}) {
+  try {
+    let config;
+    try { config = loadProjectConfig(projectDir); }
+    catch (error) {
+      if (fs.existsSync(require('path').join(projectDir, '.draftgo', 'config.json'))) throw error;
+      return outputResult({ skipped: 'auto-push skipped: this project is not connected to DraftGo.' }, flags);
+    }
+    if (config.auto_push !== true) return outputResult({ skipped: 'auto-push skipped: auto_push is not enabled.' }, flags);
+    const targets = positional.length ? targetsFrom(positional)
+      : (await changedEntries(projectDir, loadManifest(projectDir))).map(({ resource_type, resource_id }) => ({ resource_type, resource_id }));
+    if (!targets.length) return outputResult({ skipped: 'auto-push: no checked-out content changed.' }, flags);
+    const value = await deliverTargets(projectDir, targets, { ...flags, delivery: 'deploy' }, { config });
+    return outputResult({ ...value, delivery: 'auto-push' }, flags);
+  } catch (error) { return outputResult({ error: { code: error.code || 'AUTO_PUSH_FAILED', message: error.message } }, flags); }
+}
+
+module.exports = autoPush;