monday-cli 0.2.0

package/dist/utils/output/json.js

@@ -0,0 +1,12 @@
+/**
+ * JSON renderer (`cli-design.md` §3.1, §6).
+ *
+ * Pretty-prints with 2-space indent, trailing newline. Indentation
+ * keeps casual `cat`'d output readable; `jq` and other consumers
+ * tolerate whitespace fine. JSON output **never truncates** — that's
+ * the whole point of the format-vs-presentation split (§3.2).
+ */
+export const renderJson = (envelope, stream) => {
+    stream.write(`${JSON.stringify(envelope, null, 2)}\n`);
+};
+//# sourceMappingURL=json.js.map

package/dist/utils/output/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/utils/output/json.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,QAAiB,EACjB,MAA6B,EACvB,EAAE;IACR,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC"}

package/dist/utils/output/ndjson.d.ts

@@ -0,0 +1,92 @@
+import type { Meta, Warning } from './envelope.js';
+/**
+ * NDJSON renderer for collections (`cli-design.md` §6.3).
+ *
+ * Streaming-friendly shape: one resource per line, no envelope
+ * wrapping. Final line is a `{"_meta": ...}` trailer carrying the
+ * pagination state and source so agents can pin behaviour without
+ * a second request.
+ *
+ * §6.3 fixes the trailer shape exactly: `{"_meta":{...}}` — one
+ * key, one object, nothing else. NDJSON has no envelope, so it has
+ * no `warnings` array; surfacing them out-of-band would mean a
+ * consumer keeps reading after the trailer to look for them, which
+ * defeats "trailer = stream-end sentinel". If a future milestone
+ * needs to deliver warnings in the streaming path, the agreed home
+ * is `_meta.warnings` (additive, contract-clean) — extend the
+ * `Meta` type, don't add a sibling key here.
+ *
+ * NDJSON **never truncates**: streaming exists so agents can start
+ * processing without waiting for the whole walk, not so the
+ * presentation layer can drop bytes.
+ *
+ * Two surfaces:
+ *
+ * - `renderNdjson` (collect-then-emit) — used when the caller
+ *   already has the full data array. Single function, no streaming
+ *   semantics.
+ *
+ * - `startNdjsonStream` (R52, M18 lift) — used when the caller is
+ *   walking a paginated source (`paginate.onItem` /
+ *   `walkPages.onItem`). Returns a `{ onItem, writeTrailer }`
+ *   handle so the caller can emit per-item-arrival and write the
+ *   trailer after the walk completes. Three consumers: `item list`
+ *   (M7), `item search` (M18), `update list` (M18). Was previously
+ *   a private helper in `src/commands/item/list.ts`; lifted at the
+ *   3-consumer trigger.
+ */
+export interface NdjsonInput {
+    readonly data: readonly unknown[];
+    readonly meta: Meta;
+    /**
+     * Warnings are accepted on the input for symmetry with other
+     * renderers but are NOT written to the trailer — see the comment
+     * above. They're consumed by the table/JSON path on TTY mode and
+     * may be surfaced via `meta.warnings` in a later milestone.
+     */
+    readonly warnings: readonly Warning[];
+}
+export declare const renderNdjson: (input: NdjsonInput, stream: NodeJS.WritableStream) => void;
+/**
+ * Inputs to `startNdjsonStream`. Three fields — well below the
+ * >4-parameter heuristic that deferred R44 / R49 / R50:
+ *
+ * - `stream` — the writable stream items + trailer write to
+ *   (typically `ctx.stdout`).
+ * - `secrets` — token bytes the redactor scrubs from every emitted
+ *   line (per `.claude/rules/security.md` "value-scanning filter").
+ *   Caller passes `collectSecrets(ctx.env)`.
+ * - `project` — per-item projection callback. Decouples the helper
+ *   from per-noun output shape: item list/search projects raw
+ *   Monday rows through `projectFromRaw`; update list runs items
+ *   through `normaliseReplies` + the per-update zod parse.
+ *
+ * The trailer-side `Meta` is built by the caller (`buildMeta(...)`)
+ * and passed into `writeTrailer`. This keeps the per-noun trailer-
+ * shape variance at the call site — item list/search carries
+ * `meta.columns`, `update list` does not — without parameterising
+ * a `meta` builder inside the helper.
+ */
+export interface NdjsonStreamInputs<T> {
+    readonly stream: NodeJS.WritableStream;
+    readonly secrets: readonly string[];
+    readonly project: (item: T) => unknown;
+}
+export interface NdjsonStreamHandle<T> {
+    /**
+     * Per-item callback for the stream. Returns a `Promise<void>`
+     * that resolves once the bytes are flushed (or, when
+     * `stream.write` returns `false`, once the stream's `'drain'`
+     * event fires). Threaded through `paginate.onItem` /
+     * `walkPages.onItem` so a slow downstream consumer (a piped
+     * `jq`, an open-ended `tee`) backpressures the cursor walk
+     * for real — not just in spirit. Without the await on `'drain'`,
+     * a fast walker against a slow stdout would buffer items in
+     * Node's internal write queue and the "backpressure" comment in
+     * `walk-pages.ts` / `pagination.ts` would be aspirational.
+     */
+    readonly onItem: (item: T) => Promise<void>;
+    readonly writeTrailer: (meta: Meta) => void;
+}
+export declare const startNdjsonStream: <T>(inputs: NdjsonStreamInputs<T>) => NdjsonStreamHandle<T>;
+//# sourceMappingURL=ndjson.d.ts.map

package/dist/utils/output/ndjson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ndjson.d.ts","sourceRoot":"","sources":["../../../src/utils/output/ndjson.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC;AAED,eAAO,MAAM,YAAY,GACvB,OAAO,WAAW,EAClB,QAAQ,MAAM,CAAC,cAAc,KAC5B,IAKF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;CAC7C;AAgBD,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,QAAQ,kBAAkB,CAAC,CAAC,CAAC,KAC5B,kBAAkB,CAAC,CAAC,CAatB,CAAC"}

package/dist/utils/output/ndjson.js

@@ -0,0 +1,33 @@
+import { redact } from '../redact.js';
+export const renderNdjson = (input, stream) => {
+    for (const resource of input.data) {
+        stream.write(`${JSON.stringify(resource)}\n`);
+    }
+    stream.write(`${JSON.stringify({ _meta: input.meta })}\n`);
+};
+const writeAndDrain = async (stream, bytes) => {
+    if (stream.write(bytes))
+        return;
+    // High-water mark hit; wait for the next 'drain' before resolving.
+    // The walker awaits this, so the next item waits with us.
+    await new Promise((resolve) => {
+        stream.once('drain', () => {
+            resolve();
+        });
+    });
+};
+export const startNdjsonStream = (inputs) => {
+    const { stream, secrets, project } = inputs;
+    return {
+        onItem: async (item) => {
+            const projected = project(item);
+            const redacted = redact(projected, { secrets });
+            await writeAndDrain(stream, `${JSON.stringify(redacted)}\n`);
+        },
+        writeTrailer: (meta) => {
+            const trailer = redact({ _meta: meta }, { secrets });
+            stream.write(`${JSON.stringify(trailer)}\n`);
+        },
+    };
+};
+//# sourceMappingURL=ndjson.js.map

package/dist/utils/output/ndjson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ndjson.js","sourceRoot":"","sources":["../../../src/utils/output/ndjson.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAkDtC,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,KAAkB,EAClB,MAA6B,EACvB,EAAE;IACR,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC,CAAC;AA6CF,MAAM,aAAa,GAAG,KAAK,EACzB,MAA6B,EAC7B,KAAa,EACE,EAAE;IACjB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO;IAChC,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAA6B,EACN,EAAE;IACzB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC5C,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/utils/output/select.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Output-format selection (`cli-design.md` §3.1 #2, §4.4).
+ *
+ * Resolution priority (first match wins):
+ *  1. `--json` / `--table` shorthand flags (mutually exclusive).
+ *  2. `--output <fmt>` explicit choice.
+ *  3. `MONDAY_OUTPUT` env override (sticky agent contexts).
+ *  4. `process.stdout.isTTY` — table when typing in a terminal,
+ *     JSON when piped or redirected so `monday item list | jq`
+ *     just works.
+ */
+export declare const OUTPUT_FORMATS: readonly ["json", "table", "text", "ndjson"];
+export type OutputFormat = (typeof OUTPUT_FORMATS)[number];
+export interface SelectOutputInput {
+    readonly json?: boolean;
+    readonly table?: boolean;
+    readonly output?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly isTTY: boolean;
+}
+export declare const selectOutput: (input: SelectOutputInput) => OutputFormat;
+//# sourceMappingURL=select.d.ts.map

package/dist/utils/output/select.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.d.ts","sourceRoot":"","sources":["../../../src/utils/output/select.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,8CAA+C,CAAC;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAKD,eAAO,MAAM,YAAY,GAAI,OAAO,iBAAiB,KAAG,YA6CvD,CAAC"}

package/dist/utils/output/select.js

@@ -0,0 +1,47 @@
+import { UsageError } from '../errors.js';
+/**
+ * Output-format selection (`cli-design.md` §3.1 #2, §4.4).
+ *
+ * Resolution priority (first match wins):
+ *  1. `--json` / `--table` shorthand flags (mutually exclusive).
+ *  2. `--output <fmt>` explicit choice.
+ *  3. `MONDAY_OUTPUT` env override (sticky agent contexts).
+ *  4. `process.stdout.isTTY` — table when typing in a terminal,
+ *     JSON when piped or redirected so `monday item list | jq`
+ *     just works.
+ */
+export const OUTPUT_FORMATS = ['json', 'table', 'text', 'ndjson'];
+const isOutputFormat = (value) => OUTPUT_FORMATS.includes(value);
+export const selectOutput = (input) => {
+    const { json = false, table = false, output, env, isTTY } = input;
+    if (json && table) {
+        throw new UsageError('--json and --table are mutually exclusive');
+    }
+    if (output !== undefined && !isOutputFormat(output)) {
+        throw new UsageError(`--output must be one of ${OUTPUT_FORMATS.join(', ')} (got "${output}")`);
+    }
+    if (json && output !== undefined && output !== 'json') {
+        throw new UsageError(`--json conflicts with --output ${output} (use one or the other)`);
+    }
+    if (table && output !== undefined && output !== 'table') {
+        throw new UsageError(`--table conflicts with --output ${output} (use one or the other)`);
+    }
+    if (json) {
+        return 'json';
+    }
+    if (table) {
+        return 'table';
+    }
+    if (output !== undefined) {
+        return output;
+    }
+    const fromEnv = env?.MONDAY_OUTPUT;
+    if (fromEnv !== undefined && fromEnv !== '') {
+        if (!isOutputFormat(fromEnv)) {
+            throw new UsageError(`MONDAY_OUTPUT must be one of ${OUTPUT_FORMATS.join(', ')} (got "${fromEnv}")`);
+        }
+        return fromEnv;
+    }
+    return isTTY ? 'table' : 'json';
+};
+//# sourceMappingURL=select.js.map

package/dist/utils/output/select.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select.js","sourceRoot":"","sources":["../../../src/utils/output/select.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAW3E,MAAM,cAAc,GAAG,CAAC,KAAa,EAAyB,EAAE,CAC7D,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAgB,EAAE;IACrE,MAAM,EAAE,IAAI,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAElE,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAClB,2BAA2B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,IAAI,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAClB,kCAAkC,MAAM,yBAAyB,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,UAAU,CAClB,mCAAmC,MAAM,yBAAyB,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,EAAE,aAAa,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAClB,gCAAgC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,IAAI,CAC/E,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAClC,CAAC,CAAC"}

package/dist/utils/output/table.d.ts

@@ -0,0 +1,32 @@
+export declare const COLUMN_FLOOR = 12;
+export interface TableOptions {
+    /** Disable truncation (the `--full` flag). */
+    readonly full?: boolean;
+    /** Target terminal width. Falls back to 80 when not provided. */
+    readonly width?: number;
+    /**
+     * Restrict to these columns, by key. Order is preserved. Unknown
+     * keys are silently dropped — the command-layer caller validated
+     * already, and a truncated header is more useful than an error here.
+     */
+    readonly columns?: readonly string[];
+}
+export interface SingleResourceTableInput {
+    readonly kind: 'single';
+    readonly data: Readonly<Record<string, unknown>>;
+    readonly options?: TableOptions;
+}
+export interface CollectionTableInput {
+    readonly kind: 'collection';
+    readonly data: readonly Readonly<Record<string, unknown>>[];
+    readonly options?: TableOptions;
+}
+export type TableInput = SingleResourceTableInput | CollectionTableInput;
+/**
+ * Truncates `value` to fit within `width` characters. The width
+ * floor (per `cli-design.md` §3.2) is honoured by callers — this
+ * function only does the cut.
+ */
+export declare const truncate: (value: string, width: number) => string;
+export declare const renderTable: (input: TableInput, stream: NodeJS.WritableStream) => void;
+//# sourceMappingURL=table.d.ts.map

package/dist/utils/output/table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../src/utils/output/table.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,YAAY,KAAK,CAAC;AAI/B,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACjC;AAED,MAAM,MAAM,UAAU,GAAG,wBAAwB,GAAG,oBAAoB,CAAC;AAkBzE;;;;GAIG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,MAQvD,CAAC;AAiGF,eAAO,MAAM,WAAW,GACtB,OAAO,UAAU,EACjB,QAAQ,MAAM,CAAC,cAAc,KAC5B,IAGF,CAAC"}

package/dist/utils/output/table.js

@@ -0,0 +1,133 @@
+import Table from 'cli-table3';
+/**
+ * Table renderer for TTY output (`cli-design.md` §3.2).
+ *
+ * Two layouts:
+ *  - **Single resource** — key/value rows (one row per top-level
+ *    field of `data`).
+ *  - **Collection** — N-column table; columns are the union of keys
+ *    across rows, in first-seen order; header row is the column names.
+ *
+ * Truncation is honoured here and only here — JSON / NDJSON callers
+ * never reach this code, so the §3.2 invariant "truncation never
+ * affects JSON output" is enforced by construction.
+ *
+ * Truncation rules (matching the design):
+ *  - Per-column floor of 12 chars before the ellipsis kicks in.
+ *  - Trailing ellipsis is a single `…` character (U+2026).
+ *  - `--full` disables truncation.
+ *  - `--width <N>` forces the target terminal width.
+ *  - `--columns <c1,c2,...>` restricts the visible column set.
+ */
+const ELLIPSIS = '…';
+export const COLUMN_FLOOR = 12;
+const FALLBACK_WIDTH = 80;
+const DEFAULT_PADDING = 2;
+const formatCell = (value) => {
+    if (value === null) {
+        return 'null';
+    }
+    if (value === undefined) {
+        return '';
+    }
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean') {
+        return String(value);
+    }
+    return JSON.stringify(value);
+};
+/**
+ * Truncates `value` to fit within `width` characters. The width
+ * floor (per `cli-design.md` §3.2) is honoured by callers — this
+ * function only does the cut.
+ */
+export const truncate = (value, width) => {
+    if (value.length <= width) {
+        return value;
+    }
+    if (width <= 1) {
+        return ELLIPSIS;
+    }
+    return value.slice(0, width - 1) + ELLIPSIS;
+};
+/**
+ * Splits the available horizontal budget across `columnCount`
+ * columns, each at least `COLUMN_FLOOR` wide. Returns the per-column
+ * width (in characters of cell content). cli-table3 adds borders +
+ * padding around what we hand it; account for that up front so the
+ * rendered table actually fits.
+ */
+const computeColumnWidth = (columnCount, width) => {
+    // Each cell carries 2 padding chars + 1 border char; an extra +1
+    // border closes off the right edge.
+    const overhead = columnCount * (DEFAULT_PADDING + 1) + 1;
+    const usable = Math.max(width - overhead, columnCount * COLUMN_FLOOR);
+    return Math.max(Math.floor(usable / columnCount), COLUMN_FLOOR);
+};
+const filterAndOrderKeys = (keys, selected) => {
+    if (selected === undefined) {
+        return keys;
+    }
+    const present = new Set(keys);
+    return selected.filter((k) => present.has(k));
+};
+const collectKeysInOrder = (rows) => {
+    const seen = new Set();
+    const ordered = [];
+    for (const row of rows) {
+        for (const key of Object.keys(row)) {
+            if (!seen.has(key)) {
+                seen.add(key);
+                ordered.push(key);
+            }
+        }
+    }
+    return ordered;
+};
+const renderSingle = (input) => {
+    const { data, options = {} } = input;
+    const { full = false, width = FALLBACK_WIDTH, columns } = options;
+    const allKeys = Object.keys(data);
+    const keys = filterAndOrderKeys(allKeys, columns);
+    const valueColWidth = full ? Number.POSITIVE_INFINITY : computeColumnWidth(2, width);
+    const table = new Table({
+        head: ['field', 'value'],
+    });
+    for (const key of keys) {
+        const cell = formatCell(data[key]);
+        table.push([
+            full ? key : truncate(key, valueColWidth),
+            full ? cell : truncate(cell, valueColWidth),
+        ]);
+    }
+    return table.toString();
+};
+const renderCollection = (input) => {
+    const { data, options = {} } = input;
+    const { full = false, width = FALLBACK_WIDTH, columns } = options;
+    const allKeys = collectKeysInOrder(data);
+    const keys = filterAndOrderKeys(allKeys, columns);
+    if (keys.length === 0) {
+        // Empty collection still emits a table-shaped sentinel; an empty
+        // string would let the renderer-selection bug ride silently.
+        return new Table({ head: [] }).toString();
+    }
+    const colWidth = full ? Number.POSITIVE_INFINITY : computeColumnWidth(keys.length, width);
+    const table = new Table({
+        head: full ? [...keys] : keys.map((k) => truncate(k, colWidth)),
+    });
+    for (const row of data) {
+        table.push(keys.map((key) => {
+            const formatted = formatCell(row[key]);
+            return full ? formatted : truncate(formatted, colWidth);
+        }));
+    }
+    return table.toString();
+};
+export const renderTable = (input, stream) => {
+    const text = input.kind === 'single' ? renderSingle(input) : renderCollection(input);
+    stream.write(`${text}\n`);
+};
+//# sourceMappingURL=table.js.map

package/dist/utils/output/table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.js","sourceRoot":"","sources":["../../../src/utils/output/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAC/B,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,eAAe,GAAG,CAAC,CAAC;AA6B1B,MAAM,UAAU,GAAG,CAAC,KAAc,EAAU,EAAE;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,KAAa,EAAU,EAAE;IAC/D,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CACzB,WAAmB,EACnB,KAAa,EACL,EAAE;IACV,iEAAiE;IACjE,oCAAoC;IACpC,MAAM,QAAQ,GAAG,WAAW,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,QAAQ,EAAE,WAAW,GAAG,YAAY,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,IAAuB,EACvB,QAAuC,EACpB,EAAE;IACrB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CACzB,IAAkD,EAC/B,EAAE;IACrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAA+B,EAAU,EAAE;IAC/D,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,IAAI,GAAG,KAAK,EAAE,KAAK,GAAG,cAAc,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAElE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAElD,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAErF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAA2B,EAAU,EAAE;IAC/D,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,IAAI,GAAG,KAAK,EAAE,KAAK,GAAG,cAAc,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAElE,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAElD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,iEAAiE;QACjE,6DAA6D;QAC7D,OAAO,IAAI,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;KAChE,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,KAAiB,EACjB,MAA6B,EACvB,EAAE;IACR,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC"}

package/dist/utils/output/text.d.ts

@@ -0,0 +1,5 @@
+export interface TextInput {
+    readonly data: Readonly<Record<string, unknown>>;
+}
+export declare const renderText: (input: TextInput, stream: NodeJS.WritableStream) => void;
+//# sourceMappingURL=text.d.ts.map

package/dist/utils/output/text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../src/utils/output/text.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAClD;AAED,eAAO,MAAM,UAAU,GACrB,OAAO,SAAS,EAChB,QAAQ,MAAM,CAAC,cAAc,KAC5B,IAIF,CAAC"}

package/dist/utils/output/text.js

@@ -0,0 +1,32 @@
+/**
+ * Text renderer for single-resource commands (`cli-design.md` §3.2,
+ * §4 DoD #8).
+ *
+ * Flat `key: value` dump — one line per top-level field. Nested
+ * objects (column values, etc.) get JSON-stringified inline since
+ * a deeper indent-tree usually hurts more than helps for typical
+ * `monday <noun> get` callers reading in a terminal. Tables are the
+ * shape humans want for collections; text is the fallback for
+ * single-resource calls when JSON looks too noisy.
+ */
+const formatValue = (value) => {
+    if (value === null) {
+        return 'null';
+    }
+    if (value === undefined) {
+        return '';
+    }
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean') {
+        return String(value);
+    }
+    return JSON.stringify(value);
+};
+export const renderText = (input, stream) => {
+    for (const [key, value] of Object.entries(input.data)) {
+        stream.write(`${key}: ${formatValue(value)}\n`);
+    }
+};
+//# sourceMappingURL=text.js.map

package/dist/utils/output/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../../src/utils/output/text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE;IAC7C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAAgB,EAChB,MAA6B,EACvB,EAAE;IACR,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;AACH,CAAC,CAAC"}

package/dist/utils/parse-boundary.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Parse-boundary helper (R18).
+ *
+ * Per `.claude/rules/validation.md` "Never bubble raw ZodError out of
+ * a parse boundary": a raw `ZodError` reaching the runner's catch-all
+ * does map to `internal_error` (right semantic code) but loses the
+ * `details.issues` array — agents debugging a malformed Monday
+ * response see only the bare message. Wrapping every parse boundary
+ * with `safeParse` + `ApiError(internal_error)` carrying
+ * `details.issues` keeps the failing field path visible in the
+ * envelope.
+ *
+ * R17 fixed `userByEmail`'s parse boundary; the M5a-closing dry-run
+ * commit extended the same pattern to its `rawItemSchema.parse`
+ * boundary. R18 sweeps the remaining ZodError surfaces in:
+ *   - `api/board-metadata.ts` (live-fetch `responseSchema.parse` +
+ *     per-board `boardMetadataSchema.parse`);
+ *   - `api/item-helpers.ts` (the new `parseRawItem` helper that the
+ *     four item commands consume);
+ *   - `commands/emit.ts` (`schema.parse` drift catch).
+ *
+ * Cache-read parse callbacks (`board-metadata.ts parseCacheEntry`,
+ * `resolvers.ts readDirectoryCache`) intentionally swallow ZodError
+ * via the surrounding cache-miss try/catch — a corrupt cache file
+ * is treated as a miss and a live fetch follows. Wrapping there
+ * would not change behaviour; left as-is to keep the surface narrow.
+ */
+import type { z } from 'zod';
+export interface WrapZodErrorOptions {
+    /**
+     * Free-form context — populates the error message and lands on
+     * `details` so agents see the failing operation. Keep short; the
+     * `issues` array carries the per-field detail.
+     */
+    readonly context: string;
+    /** Optional `details` extras merged alongside `issues`. */
+    readonly details?: Readonly<Record<string, unknown>>;
+    /** Override hint text. Default points at "Monday response shape drift / schema mismatch". */
+    readonly hint?: string;
+}
+/**
+ * Returns the parsed value when `result.success` is true; otherwise
+ * throws a typed `ApiError(internal_error)` carrying
+ * `details.issues` (path + message + zod code per failing field).
+ *
+ * Use at every parse boundary that consumes data from outside the
+ * compiled bundle (live API responses, freshly-projected types
+ * returned from action bodies, on-disk JSON). Cache parses
+ * deliberately don't use this — they fall through to a live fetch
+ * on parse failure rather than surfacing the drift.
+ */
+export declare const unwrapOrThrow: <T>(result: z.ZodSafeParseResult<T>, options: WrapZodErrorOptions) => T;
+//# sourceMappingURL=parse-boundary.d.ts.map

package/dist/utils/parse-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-boundary.d.ts","sourceRoot":"","sources":["../../src/utils/parse-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAC7B,QAAQ,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAC/B,SAAS,mBAAmB,KAC3B,CAyBF,CAAC"}

package/dist/utils/parse-boundary.js

@@ -0,0 +1,62 @@
+/**
+ * Parse-boundary helper (R18).
+ *
+ * Per `.claude/rules/validation.md` "Never bubble raw ZodError out of
+ * a parse boundary": a raw `ZodError` reaching the runner's catch-all
+ * does map to `internal_error` (right semantic code) but loses the
+ * `details.issues` array — agents debugging a malformed Monday
+ * response see only the bare message. Wrapping every parse boundary
+ * with `safeParse` + `ApiError(internal_error)` carrying
+ * `details.issues` keeps the failing field path visible in the
+ * envelope.
+ *
+ * R17 fixed `userByEmail`'s parse boundary; the M5a-closing dry-run
+ * commit extended the same pattern to its `rawItemSchema.parse`
+ * boundary. R18 sweeps the remaining ZodError surfaces in:
+ *   - `api/board-metadata.ts` (live-fetch `responseSchema.parse` +
+ *     per-board `boardMetadataSchema.parse`);
+ *   - `api/item-helpers.ts` (the new `parseRawItem` helper that the
+ *     four item commands consume);
+ *   - `commands/emit.ts` (`schema.parse` drift catch).
+ *
+ * Cache-read parse callbacks (`board-metadata.ts parseCacheEntry`,
+ * `resolvers.ts readDirectoryCache`) intentionally swallow ZodError
+ * via the surrounding cache-miss try/catch — a corrupt cache file
+ * is treated as a miss and a live fetch follows. Wrapping there
+ * would not change behaviour; left as-is to keep the surface narrow.
+ */
+import { ApiError } from './errors.js';
+/**
+ * Returns the parsed value when `result.success` is true; otherwise
+ * throws a typed `ApiError(internal_error)` carrying
+ * `details.issues` (path + message + zod code per failing field).
+ *
+ * Use at every parse boundary that consumes data from outside the
+ * compiled bundle (live API responses, freshly-projected types
+ * returned from action bodies, on-disk JSON). Cache parses
+ * deliberately don't use this — they fall through to a live fetch
+ * on parse failure rather than surfacing the drift.
+ */
+export const unwrapOrThrow = (result, options) => {
+    if (result.success)
+        return result.data;
+    const issues = result.error.issues.map((i) => ({
+        path: i.path.join('.'),
+        message: i.message,
+        code: i.code,
+    }));
+    const hint = options.hint ??
+        'this is a data-integrity error in Monday\'s response (or a ' +
+            'schema drift); verify the response shape and update the ' +
+            'schema if Monday\'s contract has changed.';
+    throw new ApiError('internal_error', `${options.context} — schema rejected the payload at ` +
+        `${String(issues.length)} issue${issues.length === 1 ? '' : 's'}.`, {
+        cause: result.error,
+        details: {
+            ...(options.details ?? {}),
+            issues,
+            hint,
+        },
+    });
+};
+//# sourceMappingURL=parse-boundary.js.map

package/dist/utils/parse-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-boundary.js","sourceRoot":"","sources":["../../src/utils/parse-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAgBvC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAA+B,EAC/B,OAA4B,EACzB,EAAE;IACL,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC,CAAC,CAAC;IACJ,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,6DAA6D;YAC3D,0DAA0D;YAC1D,2CAA2C,CAAC;IAChD,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,GAAG,OAAO,CAAC,OAAO,oCAAoC;QACpD,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EACpE;QACE,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE;YACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1B,MAAM;YACN,IAAI;SACL;KACF,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/utils/redact.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Deep-clone-and-redact helper.
+ *
+ * The CLI holds a Monday API token with the user's full account
+ * permissions; the security rules in `.claude/rules/security.md`
+ * forbid that token appearing in *any* emitted byte — log lines,
+ * error messages, debug payloads, JSON envelopes. Every output
+ * path funnels through this function.
+ *
+ * Two independent layers (a key-based filter alone is not enough —
+ * Codex review §1 caught this gap):
+ *
+ *  - **Key-based filter.** Values under sensitive keys (`apiToken`,
+ *    `Authorization`, `MONDAY_API_TOKEN`, plus a generic
+ *    `(token|secret|password|api[-_]?key)` regex) are replaced
+ *    wholesale.
+ *  - **Value-scanning filter.** When the caller provides a `secrets`
+ *    list (typically the literal Monday API token loaded at startup),
+ *    every string in the tree is scanned and any occurrence of any
+ *    listed secret is replaced with the placeholder. This catches
+ *    `Error.message`, `Error.stack`, fetch URLs, debug payloads —
+ *    anywhere a token could land outside a sensitively-named key.
+ *
+ * Circular references are tracked via a `WeakSet` and replaced
+ * with a `[Circular]` marker — never the original value, never a
+ * thrown error that could leak in a stack trace.
+ */
+export interface RedactOptions {
+    /** Extra exact-match key names to redact (case-insensitive). */
+    readonly extraKeys?: readonly string[];
+    /** Additional regex applied to keys (case-insensitive recommended). */
+    readonly extraPattern?: RegExp;
+    /** Marker substituted in place of the redacted value. */
+    readonly placeholder?: string;
+    /**
+     * Literal secret values to scrub from any string anywhere in the
+     * tree. Typically the loaded Monday API token; the runner threads
+     * it through so a token landing in `Error.message` or a fetch URL
+     * still gets redacted before emit. Entries shorter than 8 chars
+     * are ignored (false-positive risk).
+     */
+    readonly secrets?: readonly string[];
+}
+/**
+ * Deep-clone `value`, replacing values under sensitive keys with
+ * `[REDACTED]` and any literal secrets in `options.secrets` with
+ * the same placeholder. The input is never mutated. Circular
+ * references resolve to `[Circular]`. Returns `unknown` because the
+ * redaction step erases type information about which keys were
+ * present — callers cast at the consumption point if they know the
+ * shape.
+ */
+export declare const redact: (value: unknown, options?: RedactOptions) => unknown;
+//# sourceMappingURL=redact.d.ts.map

package/dist/utils/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA+BH,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,uEAAuE;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AA0GD;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,OAAO,EAAE,UAAS,aAAkB,KAAG,OASpE,CAAC"}