docs: comprehensive README audit, package.json standardization, and source fixes

[cs-raj]

Summary

Full audit of all READMEs, package.json metadata, and source files in the cli monorepo. Code and manifests were used as the source of truth throughout.

---

Root README.md

• Updated Node.js prerequisite from v16 → v22
• Fixed cm namespace link: bulk-publish → bulk-operations (package was renamed)
• Fixed broken link syntax for export-to-csv and seed (erroneous space before ()
• Updated stale docs URL: /docs/developers/cli → /docs/headless-cms/cli
• Fixed tsgen Useful Plugins link from archived Contentstack-Solutions fork → cli-plugins monorepo

---

package.json — all 5 packages

Standardized repository field from bare strings / empty values to npm-recommended monorepo format:

{
"type": "git",
"url": "git+https://github.com/contentstack/cli.git",
"directory": "packages/<pkg>"
}

Package	Issue
contentstack-utilities	url was an empty string
contentstack-auth	bare string "contentstack/cli"
contentstack-command	bare string "contentstack/cli"
contentstack-config	bare string "contentstack/cli"
contentstack	bare string "https://github.com/contentstack/cli" (no directory)

---

contentstack-auth

README:

• Added missing auth:tokens:list command section (full FLAGS, DESCRIPTION, EXAMPLES, _See code_)
• Removed phantom csdx tokens alias section generated by oclif (corrupt USAGE line)
• Removed non-existent -i, --ignore flag from auth:tokens:remove
• Updated auth:tokens description and examples to reflect list as a subcommand

Source — auth/whoami.ts:

• Fixed typo: "Display current users email address" → "Display current user's email address"

---

contentstack-config

Source — config/set/early-access-header.ts + README:

• Fixed swapped flag descriptions: --header was describing the alias; --header-alias was describing the value — both corrected in source and README
• Renamed --asset-management → --cs-assets in config:set:region (matches renamed flag in code)
• Removed short -n flag from --name in config:set:region
• Fixed stale docs URL in package intro text

---

contentstack (aggregate CLI README)

This is the largest change — the aggregate README documents all 17 bundled plugins.

Broken _See code_ links fixed — 13 total

Command(s)	Old	Fixed
bootstrap, clone, export, import, import-setup, migration, seed	cli/blob/main/packages/...	cli-plugins/blob/main/packages/...
cm:branches (×6)	cli/blob/main/packages/contentstack-export/...	cli-plugins/blob/main/packages/contentstack-branches/...
cm:stacks:migration	.js extension + wrong repo	.ts + cli-plugins
cm:stacks:audit, audit:fix	contentstack/audit/blob/main/...	cli-plugins/blob/main/packages/contentstack-audit/...

Missing command sections added

• auth:tokens:list — sourced from auth manifest
• cm:branches:merge-status — was lost in a merge conflict
• launch:rollback — new command, not yet documented

New flags documented

• launch --response-mode=<buffered|streaming>
• cm:stacks:import --skip-taxonomy-publish

Stale / wrong content removed

• All legacy cm:bulk-publish, cm:stacks:publish, cm:stacks:publish-revert sections (package removed)
• Phantom csdx tokens alias section
• All merge conflict markers (<<<<<<<, =======, >>>>>>>) from TOC and body

Flag corrections

Command	Fix
cm:stacks:import-setup	--modules → --module in TOC, heading, USAGE, and EXAMPLE
cm:stacks:export	--module updated from =<value> to =<option> with full enum list
cm:stacks:import	same as export; added --skip-taxonomy-publish
cm:stacks:seed	USAGE + FLAGS corrected to match manifest (--yes is boolean; -o/-r/-s short flags removed)
config:set:region	--asset-management → --cs-assets; removed -n short flag

Other

• @oclif/plugin-help and @oclif/plugin-plugins_See code_ version numbers bumped
• All usage-block version strings updated (node v22.13.1 → v22.21.1, package versions)

---

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	2	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 2
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	2	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 0
• Medium without fixes: 2
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed