@alessandroraffa/tangyr 0.11.0 → 0.12.0

package/README.md

@@ -4,6 +4,10 @@ CLI for the Tangyr discipline — install and manage operating kits for AI codin
 
 An operating kit is a self-contained package of agents, skills, commands, rules, and templates that implements the Tangyr discipline for a specific AI coding context. The CLI places kit artifacts into the environments consumed by supported tools.
 
+## Requirements
+
+Node.js `>=22`. Running `tangyr` on an older Node.js version prints a clear error to stderr and exits without attempting to run any command.
+
 ## Install / run
 
 ```sh
@@ -49,6 +53,16 @@ tangyr <command>
 | `tangyr config`   | Display or edit Tangyr configuration                  |
 | `tangyr validate` | Validate the kit against kitFormat 1 conformity rules |
 
+### Authentication
+
+| Command              | Description                                                     |
+| -------------------- | --------------------------------------------------------------- |
+| `tangyr auth login`  | Store a client ID/secret credential pair, validating by default |
+| `tangyr auth status` | Show current credential validation state                        |
+| `tangyr auth logout` | Remove the stored credential                                    |
+
+Resolved environment-first (`TANGYR_ACCESS_CLIENT_ID`/`TANGYR_ACCESS_CLIENT_SECRET`), then from the stored file, then interactively. A full quickstart (configuring a remote kit origin and installing against it) lands once remote kit resolution ships.
+
 ## Global flags
 
 | Flag                         | Description                                                                                           |

package/dist/index.js

@@ -14,7 +14,11 @@ var __require = /* @__PURE__ */ ((x2) => typeof require !== "undefined" ? requir
   throw Error('Dynamic require of "' + x2 + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -14761,6 +14765,60 @@ var dist_default6 = createPrompt((config, done) => {
   ];
 });
 
+// node_modules/@inquirer/password/dist/index.js
+var passwordTheme = {
+  style: {
+    maskedText: "[input is masked]"
+  }
+};
+var dist_default7 = createPrompt((config, done) => {
+  const { validate = () => true } = config;
+  const theme = makeTheme(passwordTheme, config.theme);
+  const [status, setStatus] = useState("idle");
+  const [errorMsg, setError] = useState();
+  const [value, setValue] = useState("");
+  const prefix = usePrefix({ status, theme });
+  useKeypress(async (key, rl) => {
+    if (status !== "idle") {
+      return;
+    }
+    if (isEnterKey(key)) {
+      const answer = value;
+      setStatus("loading");
+      const isValid = await validate(answer);
+      if (isValid === true) {
+        setValue(answer);
+        setStatus("done");
+        done(answer);
+      } else {
+        rl.write(value);
+        setError(isValid || "You must provide a valid value");
+        setStatus("idle");
+      }
+    } else {
+      setValue(rl.line);
+      setError(void 0);
+    }
+  });
+  const message = theme.style.message(config.message, status);
+  let formattedValue = "";
+  let helpTip;
+  if (config.mask) {
+    const maskChar = typeof config.mask === "string" ? config.mask : "*";
+    formattedValue = maskChar.repeat(value.length);
+  } else if (status !== "done") {
+    helpTip = `${theme.style.help(theme.style.maskedText)}${cursorHide}`;
+  }
+  if (status === "done") {
+    formattedValue = theme.style.answer(formattedValue);
+  }
+  let error = "";
+  if (errorMsg) {
+    error = theme.style.error(errorMsg);
+  }
+  return [[prefix, message, config.mask ? formattedValue : helpTip].join(" "), error];
+});
+
 // node_modules/@inquirer/select/dist/index.js
 import { styleText as styleText4 } from "util";
 var selectTheme = {
@@ -14806,7 +14864,7 @@ function normalizeChoices2(choices) {
     return normalizedChoice;
   });
 }
-var dist_default7 = createPrompt((config, done) => {
+var dist_default8 = createPrompt((config, done) => {
   const { loop = true, pageSize = 7 } = config;
   const theme = makeTheme(selectTheme, config.theme);
   const { keybindings } = theme;
@@ -15093,9 +15151,12 @@ function getPackageRoot(importMetaUrl) {
     current = parent;
   }
 }
+function computeBytesHash(content) {
+  return `sha256:${crypto.createHash("sha256").update(content).digest("hex")}`;
+}
 function computeSourceHash(filePath) {
   const content = fs2.readFileSync(filePath);
-  return `sha256:${crypto.createHash("sha256").update(content).digest("hex")}`;
+  return computeBytesHash(content);
 }
 function formatProvenanceMarker(format, source, hash, target) {
   if (format === "markdown") {
@@ -15404,6 +15465,11 @@ var EXIT_ERROR_SEVERITY_LOSS = 3;
 var EXIT_TARGET_NOT_DETECTED = 4;
 var EXIT_CONFIG_MISSING = 10;
 var EXIT_USER_INTERRUPT = 130;
+var EXIT_AUTH_REQUIRED = 5;
+var EXIT_REMOTE_UNAVAILABLE = 6;
+var EXIT_INTEGRITY_FAILURE = 7;
+var EXIT_OFFLINE_CACHE_MISS = 8;
+var EXIT_INCOMPATIBLE_VERSION = 9;
 var ConflictError = class extends Error {
   constructor(message) {
     super(message);
@@ -15416,6 +15482,44 @@ var TargetNotDetectedError = class extends Error {
     this.name = "TargetNotDetectedError";
   }
 };
+var AuthenticationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthenticationError";
+  }
+};
+var RemoteUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RemoteUnavailableError";
+  }
+};
+var IntegrityError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IntegrityError";
+  }
+};
+var OfflineCacheMissError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OfflineCacheMissError";
+  }
+};
+var IncompatibleVersionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "IncompatibleVersionError";
+  }
+};
+var CredentialsLegacyError = class extends Error {
+  constructor() {
+    super(
+      "Legacy single-key credential file detected. The credential-store layout changed to store a client ID/secret pair (the credential-pair format). Run 'tangyr auth login' to re-authenticate and store the new format."
+    );
+    this.name = "CredentialsLegacyError";
+  }
+};
 function handleFatalError(err, logger) {
   const error = err instanceof Error ? err : new Error(String(err));
   logger.error(error.message);
@@ -15428,6 +15532,24 @@ function handleFatalError(err, logger) {
   if (error instanceof TargetNotDetectedError) {
     process.exit(EXIT_TARGET_NOT_DETECTED);
   }
+  if (error instanceof AuthenticationError) {
+    process.exit(EXIT_AUTH_REQUIRED);
+  }
+  if (error instanceof CredentialsLegacyError) {
+    process.exit(EXIT_AUTH_REQUIRED);
+  }
+  if (error instanceof RemoteUnavailableError) {
+    process.exit(EXIT_REMOTE_UNAVAILABLE);
+  }
+  if (error instanceof IntegrityError) {
+    process.exit(EXIT_INTEGRITY_FAILURE);
+  }
+  if (error instanceof OfflineCacheMissError) {
+    process.exit(EXIT_OFFLINE_CACHE_MISS);
+  }
+  if (error instanceof IncompatibleVersionError) {
+    process.exit(EXIT_INCOMPATIBLE_VERSION);
+  }
   process.exit(EXIT_FAILURE);
 }
 function exitOnErrorSeverityLoss(report, logger, opts = {}) {
@@ -15444,6 +15566,28 @@ function exitOnErrorSeverityLoss(report, logger, opts = {}) {
   }
 }
 
+// src/core/runtime-guard.ts
+var MINIMUM_SUPPORTED_NODE_MAJOR = 22;
+function checkNodeRuntime(nodeVersion) {
+  const match = /^v?(\d+)\./.exec(nodeVersion);
+  const major = match ? Number.parseInt(match[1], 10) : Number.NaN;
+  if (Number.isNaN(major) || major < MINIMUM_SUPPORTED_NODE_MAJOR) {
+    return {
+      supported: false,
+      message: `tangyr requires Node.js >=${MINIMUM_SUPPORTED_NODE_MAJOR}. Detected ${nodeVersion}. Install Node.js ${MINIMUM_SUPPORTED_NODE_MAJOR} or later (e.g. via nvm: "nvm install ${MINIMUM_SUPPORTED_NODE_MAJOR}") and retry.`
+    };
+  }
+  return { supported: true };
+}
+function assertSupportedNodeRuntime(nodeVersion = process.version) {
+  const result = checkNodeRuntime(nodeVersion);
+  if (!result.supported) {
+    process.stderr.write(`${result.message}
+`);
+    process.exit(EXIT_FAILURE);
+  }
+}
+
 // src/commands/assess.ts
 import fs11 from "fs";
 import path12 from "path";
@@ -16926,63 +17070,364 @@ function resolveKitPath(config, configDir) {
 import fs12 from "fs";
 import os3 from "os";
 import path13 from "path";
+
+// src/core/transport.ts
+var KIT_CONTRACT_VERSION = "1";
+var CONTRACT_VERSION_HEADER = "X-Tangyr-Contract-Version";
+var ACCESS_CLIENT_ID_HEADER = "CF-Access-Client-Id";
+var ACCESS_CLIENT_SECRET_HEADER = "CF-Access-Client-Secret";
+var REDACTED = "[redacted]";
+function assertHttps(originUrl) {
+  const parsed = new URL(originUrl);
+  if (parsed.protocol !== "https:") {
+    throw new IntegrityError(
+      `KitTransport rejected a non-HTTPS origin "${originUrl}" \u2014 only https:// origins are permitted (REQ-INT-006).`
+    );
+  }
+}
+async function performRequest(originUrl, requestPath, credentials, logger) {
+  assertHttps(originUrl);
+  const headers = {
+    [ACCESS_CLIENT_ID_HEADER]: credentials.clientId,
+    [ACCESS_CLIENT_SECRET_HEADER]: credentials.clientSecret,
+    [CONTRACT_VERSION_HEADER]: KIT_CONTRACT_VERSION
+  };
+  logger?.verbose(
+    `KitTransport GET ${originUrl}${requestPath} \u2014 headers: ${ACCESS_CLIENT_ID_HEADER}=${REDACTED}, ${ACCESS_CLIENT_SECRET_HEADER}=${REDACTED}, ${CONTRACT_VERSION_HEADER}=${KIT_CONTRACT_VERSION}`
+  );
+  const response = await fetch(`${originUrl}${requestPath}`, {
+    method: "GET",
+    redirect: "manual",
+    headers
+  });
+  if (response.status >= 300 && response.status < 400) {
+    throw new IntegrityError(
+      `KitTransport rejected a redirect response (HTTP ${response.status}) from ${originUrl}${requestPath} \u2014 redirects are never followed; every redirect is rejected fail-closed (REQ-INT-006, resolved reject-all-redirects policy).`
+    );
+  }
+  if (response.status === 426) {
+    throw new IncompatibleVersionError(
+      `The origin rejected this CLI's contract version (HTTP 426) at ${originUrl}${requestPath}. Upgrade tangyr to the latest release and retry.`
+    );
+  }
+  return response;
+}
+function createFetchKitTransport(options = {}) {
+  return {
+    async probe(originUrl, credentials) {
+      const response = await performRequest(
+        originUrl,
+        "/v1/probe",
+        credentials,
+        options.logger
+      );
+      const contentType = response.headers.get("content-type") ?? "";
+      const metadata = contentType.includes("application/json") ? await response.json() : {};
+      return { status: response.status, metadata };
+    },
+    async fetchObject(originUrl, objectPath, credentials) {
+      const response = await performRequest(
+        originUrl,
+        objectPath,
+        credentials,
+        options.logger
+      );
+      const body = Buffer.from(await response.arrayBuffer());
+      return { status: response.status, body };
+    }
+  };
+}
+
+// src/commands/auth.ts
 var CREDENTIALS_DIR = path13.join(os3.homedir(), ".tangyr");
 var CREDENTIALS_PATH = path13.join(CREDENTIALS_DIR, "credentials.json");
-async function runAuthLoginCommand(options, logger) {
-  let key = options.key;
-  if (!key) {
-    key = await dist_default6({ message: "Enter your Tangyr license key:" });
+function isCurrentCredentialRecord(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
   }
-  if (!key || key.trim().length === 0) {
-    logger.error("No license key provided.");
-    process.exit(1);
+  const record = value;
+  return record.schema === 2 && typeof record.clientId === "string" && record.clientId.length > 0 && typeof record.clientSecret === "string" && record.clientSecret.length > 0 && (record.validation === "validated" || record.validation === "unvalidated") && typeof record.storedAt === "string";
+}
+function readStoredCredentials() {
+  if (!fs12.existsSync(CREDENTIALS_PATH)) {
+    return null;
   }
-  fs12.mkdirSync(CREDENTIALS_DIR, { recursive: true });
-  const credentials = {
-    key: key.trim(),
-    storedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  fs12.writeFileSync(
-    CREDENTIALS_PATH,
-    `${JSON.stringify(credentials, null, 2)}
-`,
-    { mode: 384 }
-  );
+  const raw = fs12.readFileSync(CREDENTIALS_PATH, "utf8");
+  const parsed = JSON.parse(raw);
+  if (!isCurrentCredentialRecord(parsed)) {
+    throw new CredentialsLegacyError();
+  }
+  return parsed;
+}
+function ensureCredentialsDir(logger) {
   try {
-    fs12.chmodSync(CREDENTIALS_PATH, 384);
+    fs12.mkdirSync(CREDENTIALS_DIR, { recursive: true, mode: 448 });
+  } catch (err) {
+    if (err.code !== "EEXIST") {
+      throw err;
+    }
+  }
+  if (fs12.lstatSync(CREDENTIALS_DIR).isSymbolicLink()) {
+    throw new Error(
+      `Refusing to write credentials: "${CREDENTIALS_DIR}" already exists as a symbolic link, not a directory. Remove it and run 'tangyr auth login' again.`
+    );
+  }
+  try {
+    fs12.chmodSync(CREDENTIALS_DIR, 448);
   } catch {
+    logger.warn(
+      "Could not set owner-only (0700) permissions on the credentials directory on this platform; at-rest protection is reduced (REQ-AUT-007)."
+    );
   }
-  const masked = `${key.trim().slice(0, 4)}...${key.trim().slice(-4)}`;
-  logger.info(`License key stored (${masked}).`);
-  logger.info(
-    "Remote validation is not yet implemented \u2014 key stored locally only."
+}
+function writeStoredCredentials(record, logger) {
+  ensureCredentialsDir(logger);
+  const content = `${JSON.stringify(record, null, 2)}
+`;
+  const tmpPath = `${CREDENTIALS_PATH}.tmp`;
+  try {
+    fs12.writeFileSync(tmpPath, content, { mode: 384, flag: "wx" });
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      fs12.unlinkSync(tmpPath);
+      fs12.writeFileSync(tmpPath, content, { mode: 384, flag: "wx" });
+    } else {
+      throw err;
+    }
+  }
+  try {
+    fs12.renameSync(tmpPath, CREDENTIALS_PATH);
+  } catch (renameErr) {
+    try {
+      try {
+        const destStat = fs12.lstatSync(CREDENTIALS_PATH);
+        if (destStat.isSymbolicLink()) {
+          fs12.unlinkSync(CREDENTIALS_PATH);
+        }
+      } catch {
+      }
+      fs12.copyFileSync(tmpPath, CREDENTIALS_PATH);
+      try {
+        fs12.chmodSync(CREDENTIALS_PATH, 384);
+      } catch {
+        logger.warn(
+          "Could not set owner-only (0600) permissions on the credentials file on this platform; at-rest protection is reduced (REQ-AUT-007)."
+        );
+      }
+      try {
+        fs12.unlinkSync(tmpPath);
+      } catch {
+      }
+    } catch (copyErr) {
+      try {
+        fs12.unlinkSync(tmpPath);
+      } catch {
+      }
+      throw new Error(
+        `writeStoredCredentials: failed to write ${CREDENTIALS_PATH} \u2014 ${String(renameErr)} / fallback copy failed \u2014 ${String(copyErr)}`
+      );
+    }
+  }
+}
+var ADVANCE_EXPIRY_WARNING_DAYS = 30;
+var DEFINITIVE_DENIAL_STATUSES = /* @__PURE__ */ new Set([401, 403]);
+async function resolveCredentialForLogin(options, logger) {
+  const envClientId = process.env.TANGYR_ACCESS_CLIENT_ID?.trim();
+  const envClientSecret = process.env.TANGYR_ACCESS_CLIENT_SECRET?.trim();
+  if (envClientId && envClientSecret) {
+    logger.verbose(
+      "Resolved credential from TANGYR_ACCESS_CLIENT_ID / TANGYR_ACCESS_CLIENT_SECRET."
+    );
+    return {
+      pair: { clientId: envClientId, clientSecret: envClientSecret },
+      source: "env"
+    };
+  }
+  if (envClientId || envClientSecret) {
+    throw new AuthenticationError(
+      "Both TANGYR_ACCESS_CLIENT_ID and TANGYR_ACCESS_CLIENT_SECRET must be set together. Set both environment variables, or unset both and run 'tangyr auth login' interactively."
+    );
+  }
+  const stored = readStoredCredentials();
+  if (stored) {
+    logger.verbose("Resolved credential from the stored credential file.");
+    return {
+      pair: { clientId: stored.clientId, clientSecret: stored.clientSecret },
+      source: "stored"
+    };
+  }
+  if (options.nonInteractive) {
+    throw new AuthenticationError(
+      "No credential available under --non-interactive. Set TANGYR_ACCESS_CLIENT_ID and TANGYR_ACCESS_CLIENT_SECRET, or drop --non-interactive and run 'tangyr auth login' again from an interactive terminal."
+    );
+  }
+  const clientId = await dist_default6({
+    message: "Enter your Tangyr access client ID:"
+  });
+  const clientSecret = await dist_default7({
+    message: "Enter your Tangyr access client secret:"
+  });
+  if (clientId.trim().length === 0 || clientSecret.trim().length === 0) {
+    throw new AuthenticationError("No credential provided.");
+  }
+  return {
+    pair: { clientId: clientId.trim(), clientSecret: clientSecret.trim() },
+    source: "interactive"
+  };
+}
+function resolveOriginUrl(configPath) {
+  let config;
+  try {
+    ({ config } = resolveConfig(configPath));
+  } catch (err) {
+    if (err instanceof ConfigNotFoundError) {
+      return void 0;
+    }
+    throw err;
+  }
+  const source = config.source;
+  return typeof source.url === "string" && source.url.length > 0 ? source.url : void 0;
+}
+async function validateAgainstOrigin(originUrl, pair, transport, logger) {
+  if (!originUrl) {
+    logger.verbose(
+      "No remote origin configured (source.url) \u2014 treating as unreachable for validation purposes."
+    );
+    return { outcome: "unreachable" };
+  }
+  try {
+    const result = await transport.probe(originUrl, pair);
+    if (DEFINITIVE_DENIAL_STATUSES.has(result.status)) {
+      return { outcome: "denied" };
+    }
+    if (result.status >= 200 && result.status < 300) {
+      return { outcome: "success", metadata: result.metadata };
+    }
+    return { outcome: "unreachable" };
+  } catch (err) {
+    if (err instanceof IntegrityError || err instanceof IncompatibleVersionError) {
+      throw err;
+    }
+    logger.verbose(
+      `Origin probe failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return { outcome: "unreachable" };
+  }
+}
+async function runAuthLoginCommand(options, logger, transport = createFetchKitTransport({ logger })) {
+  const resolved = await resolveCredentialForLogin(options, logger);
+  if (options.skipValidation) {
+    writeStoredCredentials(
+      {
+        schema: 2,
+        clientId: resolved.pair.clientId,
+        clientSecret: resolved.pair.clientSecret,
+        validation: "unvalidated",
+        storedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      logger
+    );
+    logger.info(
+      "Credential stored (validation skipped via --skip-validation)."
+    );
+    logger.warn(
+      "Validation state: stored, unvalidated. It will be revalidated on the next command that reaches the configured origin."
+    );
+    return;
+  }
+  const originUrl = resolveOriginUrl(options.config);
+  const outcome = await validateAgainstOrigin(
+    originUrl,
+    resolved.pair,
+    transport,
+    logger
+  );
+  if (outcome.outcome === "denied") {
+    throw new AuthenticationError(
+      "The configured origin denied this credential. The credential was not stored. Obtain a valid client ID/secret pair and run 'tangyr auth login' again."
+    );
+  }
+  writeStoredCredentials(
+    {
+      schema: 2,
+      clientId: resolved.pair.clientId,
+      clientSecret: resolved.pair.clientSecret,
+      validation: outcome.outcome === "success" ? "validated" : "unvalidated",
+      storedAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    logger
   );
+  if (outcome.outcome === "success") {
+    logger.info("Credential validated and stored (stored, validated).");
+  } else {
+    logger.warn(
+      "Could not reach the configured origin to validate this credential. Credential stored as stored, unvalidated \u2014 it will be revalidated on the next command that reaches the origin."
+    );
+  }
 }
-function runAuthStatusCommand(_options, logger) {
-  if (!fs12.existsSync(CREDENTIALS_PATH)) {
+async function runAuthStatusCommand(options, logger, transport = createFetchKitTransport({ logger })) {
+  const stored = readStoredCredentials();
+  if (!stored) {
     logger.info(
-      "Not authenticated. Run 'tangyr auth login' to configure a license key."
+      "Not authenticated. Run 'tangyr auth login' to configure a credential."
     );
     return;
   }
-  try {
-    const raw = fs12.readFileSync(CREDENTIALS_PATH, "utf8");
-    const credentials = JSON.parse(raw);
-    const masked = `${credentials.key.slice(0, 4)}...${credentials.key.slice(-4)}`;
-    logger.info(`Authenticated: ${masked}`);
-    logger.info(`Stored at: ${credentials.storedAt}`);
-    logger.info("Remote validation: not yet implemented.");
-  } catch {
-    logger.error("Failed to read credentials file. It may be corrupted.");
+  const originUrl = resolveOriginUrl(options.config);
+  const outcome = await validateAgainstOrigin(
+    originUrl,
+    { clientId: stored.clientId, clientSecret: stored.clientSecret },
+    transport,
+    logger
+  );
+  if (outcome.outcome === "denied") {
+    throw new AuthenticationError(
+      "The configured origin denied the stored credential \u2014 it has likely been revoked. Run 'tangyr auth login' with a new credential."
+    );
+  }
+  if (outcome.outcome === "unreachable") {
+    logger.info(`Credential status: stored, ${stored.validation}.`);
+    logger.info(
+      "The configured origin was not reached \u2014 label and expiry are not reported."
+    );
+    return;
+  }
+  if (stored.validation === "unvalidated") {
+    writeStoredCredentials(
+      {
+        ...stored,
+        validation: "validated",
+        storedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      logger
+    );
+  }
+  logger.info("Credential status: stored, validated.");
+  const label = outcome.metadata.label;
+  if (typeof label === "string" && label.length > 0) {
+    logger.info(`Label: ${label}`);
+  }
+  const expiresAtRaw = outcome.metadata.expiresAt;
+  if (typeof expiresAtRaw === "string") {
+    const expiresAt = new Date(expiresAtRaw);
+    if (!Number.isNaN(expiresAt.getTime())) {
+      logger.info(`Expires: ${expiresAt.toISOString()}`);
+      const daysUntilExpiry = (expiresAt.getTime() - Date.now()) / (24 * 60 * 60 * 1e3);
+      if (daysUntilExpiry <= ADVANCE_EXPIRY_WARNING_DAYS) {
+        logger.warn(
+          `Credential expires in ${Math.max(0, Math.ceil(daysUntilExpiry))} day(s) (${expiresAt.toISOString()}) \u2014 renew it soon.`
+        );
+      }
+    }
   }
 }
 function runAuthLogoutCommand(_options, logger) {
   if (!fs12.existsSync(CREDENTIALS_PATH)) {
-    logger.info("No credentials found. Nothing to remove.");
+    logger.info("No credential found. Nothing to remove.");
     return;
   }
   fs12.unlinkSync(CREDENTIALS_PATH);
-  logger.info("License key removed.");
+  logger.info("Credential removed.");
 }
 
 // src/commands/cleanup.ts
@@ -20139,7 +20584,7 @@ import path17 from "path";
 var import_yaml5 = __toESM(require_dist(), 1);
 import fs16 from "fs";
 import path16 from "path";
-function resolveKitHookNames(sourceRoot) {
+function resolveKitComponentNames(sourceRoot, category) {
   const manifestPath = path16.resolve(sourceRoot, "tangyr-kit.yaml");
   if (!fs16.existsSync(manifestPath)) {
     return void 0;
@@ -20149,10 +20594,10 @@ function resolveKitHookNames(sourceRoot) {
     const doc = (0, import_yaml5.parse)(raw);
     if (doc && typeof doc === "object" && !Array.isArray(doc) && "components" in doc) {
       const components = doc.components;
-      if (components && typeof components === "object" && !Array.isArray(components) && "hooks" in components) {
-        const hooks = components.hooks;
-        if (Array.isArray(hooks) && hooks.every((h) => typeof h === "string")) {
-          return hooks;
+      if (components && typeof components === "object" && !Array.isArray(components) && category in components) {
+        const names = components[category];
+        if (Array.isArray(names) && names.every((n7) => typeof n7 === "string")) {
+          return names;
         }
       }
     }
@@ -20160,6 +20605,12 @@ function resolveKitHookNames(sourceRoot) {
   }
   return void 0;
 }
+function resolveKitHookNames(sourceRoot) {
+  return resolveKitComponentNames(sourceRoot, "hooks");
+}
+function resolveKitSkillNames(sourceRoot) {
+  return resolveKitComponentNames(sourceRoot, "skills");
+}
 function resolveHooksSourceFile(sourceRoot, config) {
   return path16.resolve(sourceRoot, config.source.hooks, "hooks.json");
 }
@@ -21692,14 +22143,14 @@ ${JSON.stringify(config, null, 2)}`);
       checked: enabled
     }))
   });
-  const selectedConflict = await dist_default7({
+  const selectedConflict = await dist_default8({
     message: "Conflict policy",
     choices: ["ask", "skip", "backup", "overwrite"].map((value) => ({
       name: value,
       value
     }))
   });
-  const selectedVerbosity = await dist_default7({
+  const selectedVerbosity = await dist_default8({
     message: "Verbosity",
     choices: ["quiet", "normal", "verbose"].map((value) => ({
       name: value,
@@ -21771,9 +22222,17 @@ var bundledCopilotManifestPathsByPlatform = {
 };
 function detectTargets(logger) {
   const result = {
-    "claude-code": commandExists(process.platform === "win32" ? "where.exe" : "which", ["claude"], logger),
+    "claude-code": commandExists(
+      process.platform === "win32" ? "where.exe" : "which",
+      ["claude"],
+      logger
+    ),
     copilot: detectsCopilot(logger),
-    codex: commandExists(process.platform === "win32" ? "where.exe" : "which", ["codex"], logger)
+    codex: commandExists(
+      process.platform === "win32" ? "where.exe" : "which",
+      ["codex"],
+      logger
+    )
   };
   return result;
 }
@@ -21803,9 +22262,16 @@ function detectCopilot(logger, dependencies = {}) {
     ...bundledCopilotEditorCommandsByPlatform[platform] ?? []
   ];
   for (const command of commandCandidates) {
-    const result = spawnSyncImpl(command, ["--list-extensions", "--show-versions"]);
+    const result = spawnSyncImpl(command, [
+      "--list-extensions",
+      "--show-versions"
+    ]);
     if (result.error) {
-      logDetectionError(`${command} --list-extensions --show-versions`, result.error, logger);
+      logDetectionError(
+        `${command} --list-extensions --show-versions`,
+        result.error,
+        logger
+      );
       continue;
     }
     if (result.status !== 0) {
@@ -21886,10 +22352,14 @@ function commandExists(command, args, logger) {
 }
 function logDetectionError(attemptedCommand, error, logger) {
   if (error.code === "ENOENT") {
-    logger?.verbose(`${attemptedCommand}: executable not found while detecting target`);
+    logger?.verbose(
+      `${attemptedCommand}: executable not found while detecting target`
+    );
     return;
   }
-  logger?.verbose(`${attemptedCommand} failed: ${error.message ?? "unknown spawn error"}`);
+  logger?.verbose(
+    `${attemptedCommand} failed: ${error.message ?? "unknown spawn error"}`
+  );
 }
 
 // src/commands/doctor.ts
@@ -22204,7 +22674,7 @@ async function runInitCommand(_options, logger) {
       checked: detected
     }))
   });
-  const onConflict = await dist_default7({
+  const onConflict = await dist_default8({
     message: "Conflict policy",
     choices: ["ask", "skip", "backup", "overwrite"].map((value) => ({
       name: value,
@@ -26201,7 +26671,7 @@ async function runInstallCommand(options, logger) {
       );
       process.exit(1);
     } else {
-      action = await dist_default7({
+      action = await dist_default8({
         message: "Existing installation found. Choose an action:",
         choices: [
           {
@@ -26330,7 +26800,7 @@ Found ${conflictingFindings.length} conflicting target(s). Please choose an acti
 `
       );
       for (const finding of conflictingFindings) {
-        const choice = await dist_default7({
+        const choice = await dist_default8({
           message: `Conflict: ${finding.path} (${finding.tool})
   Choose an action:`,
           choices: [
@@ -28419,12 +28889,6 @@ function buildDirectComponents(profile) {
       destination: profile.agents,
       type: "dir"
     },
-    {
-      component: "skills",
-      sourceKey: "skills",
-      destination: profile.skills,
-      type: "dir"
-    },
     {
       component: "commands",
       sourceKey: "commands",
@@ -28490,6 +28954,19 @@ function syncClaudeCode(config, sourceRoot, options, logger, mappings, manifest,
       )
     );
   }
+  if (!shouldSkipComponent6(options, "skills")) {
+    outcomes.push(
+      ...syncClaudeCodeSkills(
+        config,
+        sourceRoot,
+        options,
+        logger,
+        profile.skills,
+        manifest,
+        scopePath
+      )
+    );
+  }
   if (!shouldSkipComponent6(options, "instructions") && manifest && scopePath) {
     const shimPath = profile.instructions_shim;
     const agentsMdPath = path36.resolve(sourceRoot, config.source.instructions);
@@ -28662,6 +29139,128 @@ function syncDirectComponent(config, sourceRoot, options, logger, directComponen
     path: destination
   };
 }
+function syncClaudeCodeSkills(config, sourceRoot, options, logger, destination, manifest, scopePath) {
+  const source = path36.resolve(sourceRoot, config.source.skills);
+  if (!fs34.existsSync(source)) {
+    return [skippedMissingSource6("skills", source)];
+  }
+  const declaredNames = resolveKitSkillNames(sourceRoot);
+  const isLegacyWholesaleSymlink = isSymlinkPath(destination);
+  if (options.dryRun) {
+    const outcomes2 = [];
+    if (isLegacyWholesaleSymlink) {
+      for (const name of foreignSkillNames(source, declaredNames)) {
+        logger.info(
+          `[dry-run] skills: migrate foreign skill ${path36.join(source, name)} -> ${path36.join(destination, name)}`
+        );
+      }
+      logger.info(
+        `[dry-run] skills: replace wholesale symlink with real directory ${destination}`
+      );
+    }
+    for (const name of declaredNames ?? listSkillDirNames(source)) {
+      const skillDestination = path36.join(destination, name);
+      logger.info(
+        `[dry-run] skills: symlink ${path36.join(source, name)} -> ${skillDestination}`
+      );
+      outcomes2.push({
+        component: "skills",
+        status: "dry-run",
+        path: skillDestination
+      });
+    }
+    return outcomes2;
+  }
+  if (isLegacyWholesaleSymlink) {
+    migrateWholesaleSkillsSymlink(source, destination, declaredNames, logger);
+  }
+  ensureDir(destination);
+  const outcomes = [];
+  for (const name of declaredNames ?? listSkillDirNames(source)) {
+    outcomes.push(
+      syncSingleSkill(
+        config,
+        sourceRoot,
+        options,
+        logger,
+        source,
+        destination,
+        name,
+        manifest,
+        scopePath
+      )
+    );
+  }
+  return outcomes;
+}
+function syncSingleSkill(config, sourceRoot, options, logger, source, destination, name, manifest, scopePath) {
+  const skillSource = path36.join(source, name);
+  const skillDestination = path36.join(destination, name);
+  if (!fs34.existsSync(skillSource)) {
+    return skippedMissingSource6("skills", skillSource);
+  }
+  const artifactClass = classifyArtifact(skillDestination, config, sourceRoot);
+  if (artifactClass === "managed-symlink" && isSymlinkTo6(skillDestination, skillSource)) {
+    return {
+      component: "skills",
+      status: "skipped-current",
+      path: skillDestination
+    };
+  }
+  if (artifactClass === "managed-stale" && isOurStaleSymlink(skillDestination, /* @__PURE__ */ new Set([skillDestination]), config)) {
+    fs34.unlinkSync(skillDestination);
+  } else if (artifactClass === "unmanaged-conflict" && !handleConflict6(
+    skillDestination,
+    config,
+    options,
+    logger,
+    manifest,
+    scopePath
+  )) {
+    return { component: "skills", status: "conflict", path: skillDestination };
+  } else if (artifactClass === "managed-symlink") {
+    fs34.unlinkSync(skillDestination);
+  }
+  createRelativeSymlink(skillSource, skillDestination, "dir");
+  return { component: "skills", status: "success", path: skillDestination };
+}
+function migrateWholesaleSkillsSymlink(source, destination, declaredNames, logger) {
+  const foreignNames = foreignSkillNames(source, declaredNames);
+  fs34.unlinkSync(destination);
+  ensureDir(destination);
+  for (const name of foreignNames) {
+    const from = path36.join(source, name);
+    const to = path36.join(destination, name);
+    if (fs34.existsSync(to)) {
+      logger.warn(
+        `skills migration: ${to} already exists \u2014 skipping move of ${from} to avoid overwrite`
+      );
+      continue;
+    }
+    fs34.renameSync(from, to);
+    logger.info(`skills migration: moved ${from} -> ${to}`);
+  }
+}
+function foreignSkillNames(source, declaredNames) {
+  if (!declaredNames) {
+    return [];
+  }
+  const declaredSet = new Set(declaredNames);
+  return listSkillDirNames(source).filter((name) => !declaredSet.has(name));
+}
+function listSkillDirNames(dir) {
+  if (!fs34.existsSync(dir)) {
+    return [];
+  }
+  return fs34.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name);
+}
+function isSymlinkPath(filePath) {
+  try {
+    return fs34.lstatSync(filePath).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
 function syncHookScriptsBridge(config, sourceRoot, options, logger, destination, manifest, scopePath) {
   const source = path36.resolve(sourceRoot, config.source.hooks);
   if (!fs34.existsSync(source)) {
@@ -29946,6 +30545,7 @@ var commandNames = [
   "probe"
 ];
 async function main() {
+  assertSupportedNodeRuntime();
   process.on("SIGINT", () => {
     process.exit(EXIT_USER_INTERRUPT);
   });
@@ -29976,6 +30576,9 @@ function buildProgram() {
   ).option(
     "-y, --yes",
     "Skip interactive confirmation and apply non-interactive conflict handling"
+  ).option(
+    "--non-interactive",
+    "Never prompt; fail closed when a required input is missing (auth login)"
   ).option("-v, --verbose", "Emit detailed output").option("-q, --quiet", "Emit errors only").option("--no-color", "Disable colorized output").option(
     "--claude-config-dir <path>",
     "Claude Code global root directory (repeatable; overrides claudeCodeGlobalPaths in config)",
@@ -30002,19 +30605,23 @@ function buildProgram() {
       );
     }
   );
-  const authCmd = program2.command("auth").description("License key management");
-  authCmd.command("login").description("Authenticate with a license key").option("--key <key>", "License key").action(async (options) => {
+  const authCmd = program2.command("auth").description("Credential management");
+  authCmd.command("login").description("Authenticate with a client ID/secret credential pair").option(
+    "--skip-validation",
+    "Store the credential without contacting the configured origin"
+  ).action(async (options) => {
     const context = commandContext(program2);
+    const nonInteractive = context.options.nonInteractive === true || !process.stdin.isTTY;
     await runAuthLoginCommand(
-      { ...context.options, ...options },
+      { ...context.options, ...options, nonInteractive },
       context.logger
     );
   });
-  authCmd.command("status").description("Show current authentication status").action(() => {
+  authCmd.command("status").description("Show current authentication status").action(async () => {
     const context = commandContext(program2);
-    runAuthStatusCommand({ ...context.options }, context.logger);
+    await runAuthStatusCommand({ ...context.options }, context.logger);
   });
-  authCmd.command("logout").description("Remove stored license key").action(() => {
+  authCmd.command("logout").description("Remove stored credential").action(() => {
     const context = commandContext(program2);
     runAuthLogoutCommand({ ...context.options }, context.logger);
   });
@@ -30103,7 +30710,7 @@ function buildProgram() {
   return program2;
 }
 async function runInteractiveMenu(program2, logger) {
-  const choice = await dist_default7({
+  const choice = await dist_default8({
     message: "Select a Tangyr command",
     choices: [
       { name: "Assess", value: "assess" },

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@alessandroraffa/tangyr",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "CLI for the Tangyr discipline — install and manage operating kits for AI coding tools",
   "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
   "type": "module",
   "bin": {
     "tangyr": "./dist/index.js"
@@ -33,9 +36,13 @@
   "bugs": {
     "url": "https://github.com/alessandroraffa/tangyr-cli/issues"
   },
+  "overrides": {
+    "esbuild": "^0.28.1"
+  },
   "devDependencies": {
     "@iarna/toml": "^2.2.5",
     "@inquirer/prompts": "^8.4.1",
+    "@types/node": "^22.20.1",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "execa": "^9.0.0",
@@ -46,6 +53,5 @@
     "typescript": "^5.0.0",
     "vitest": "^3.0.0",
     "yaml": "^2.8.3"
-  },
-  "dependencies": {}
+  }
 }