@apex-actions/cli 0.67.0

package/dist/src/infrastructure/engine-binary.js

@@ -0,0 +1,164 @@
+// infrastructure layer — see ../../../../docs/conventions.md §1
+import { execFile, spawn } from 'node:child_process';
+import { readdir, readFile } from 'node:fs/promises';
+import { basename, join, resolve } from 'node:path';
+const BIN_ENV = 'APEX_ENGINE_BIN';
+const DEFAULT_BIN = 'apex-engine';
+const missingDetail = (bin) => `engine binary ${bin} not found — install apex-engine on your PATH or set ${BIN_ENV}`;
+/** Adapter: shells out to `apex-engine validate --json` (engine ADR-0004). */
+export class EngineBinaryValidator {
+    #bin;
+    constructor(bin = process.env[BIN_ENV] ?? DEFAULT_BIN) {
+        this.#bin = bin;
+    }
+    async validate(files) {
+        const bin = this.#bin;
+        return await new Promise((resolve, reject) => {
+            execFile(bin, ['validate', '--json', ...files], { maxBuffer: 64 * 1024 * 1024 }, (error, stdout, stderr) => {
+                const code = typeof error?.code === 'number' ? error.code : error ? -1 : 0;
+                if (error && 'code' in error && error.code === 'ENOENT') {
+                    resolve({ kind: 'engine-missing', detail: missingDetail(bin) });
+                    return;
+                }
+                if (code !== 0 && code !== 1) {
+                    reject(new Error(`${bin} validate failed: ${stderr.toString().trim() || `exit ${code}`}`));
+                    return;
+                }
+                try {
+                    resolve({ kind: 'report', report: JSON.parse(stdout.toString()) });
+                }
+                catch {
+                    reject(new Error(`${bin} validate produced unparseable output`));
+                }
+            });
+        });
+    }
+}
+/**
+ * Adapter: shells out to `apex-engine compat --manifest --json` (engine ADR-0013).
+ *
+ * The manifest goes down stdin rather than into a temp directory. These are
+ * somebody else's workflow files, fetched to answer a question that needs them
+ * only in memory, and writing them to our disk to pass a path would also
+ * replace the repository-relative paths the report has to name with temp paths
+ * nobody can act on.
+ *
+ * Exit 1 means the engine found blockers or unreadable files — a report, not a
+ * failure — so it is read the same way as exit 0.
+ */
+export class EngineBinaryCompat {
+    #bin;
+    constructor(bin = process.env[BIN_ENV] ?? DEFAULT_BIN) {
+        this.#bin = bin;
+    }
+    async assess(org, documents) {
+        const bin = this.#bin;
+        const manifest = JSON.stringify({ organization: org, documents });
+        return await new Promise((resolve, reject) => {
+            const child = execFile(bin, ['compat', '--manifest', '--json'], { maxBuffer: 64 * 1024 * 1024 }, (error, stdout, stderr) => {
+                const code = typeof error?.code === 'number' ? error.code : error ? -1 : 0;
+                if (error && 'code' in error && error.code === 'ENOENT') {
+                    resolve({ kind: 'engine-missing', detail: missingDetail(bin) });
+                    return;
+                }
+                if (code !== 0 && code !== 1) {
+                    reject(new Error(`${bin} compat failed: ${stderr.toString().trim() || `exit ${code}`}`));
+                    return;
+                }
+                try {
+                    resolve({ kind: 'report', report: JSON.parse(stdout.toString()) });
+                }
+                catch {
+                    reject(new Error(`${bin} compat produced unparseable output`));
+                }
+            });
+            child.on('error', () => undefined);
+            child.stdin?.end(manifest);
+        });
+    }
+}
+/**
+ * Adapter: a checkout on this machine, scanned as one repository.
+ *
+ * It exists because the first thing somebody evaluating a migration wants is
+ * an answer about a repository they already have, without handing anybody a
+ * token — and because it is the path the tests can drive end to end.
+ */
+export class LocalWorkflowSource {
+    #root;
+    #slug;
+    constructor(root) {
+        this.#root = root;
+        this.#slug = basename(resolve(root)) || root;
+    }
+    async repositories() {
+        return [{ slug: this.#slug, archived: false }];
+    }
+    async workflows() {
+        const dir = join(this.#root, '.github', 'workflows');
+        let entries;
+        try {
+            entries = await readdir(dir);
+        }
+        catch {
+            return [];
+        }
+        const documents = [];
+        for (const name of entries.filter((f) => f.endsWith('.yml') || f.endsWith('.yaml')).sort()) {
+            documents.push({
+                path: join('.github', 'workflows', name),
+                repo: this.#slug,
+                source: await readFile(join(dir, name), 'utf8'),
+            });
+        }
+        return documents;
+    }
+}
+/**
+ * Adapter: runs `apex-engine lsp` with this process's stdio inherited.
+ *
+ * `inherit` rather than pipes, and that is the whole adapter: an editor talks
+ * to its language server down the child's own stdin and stdout, and copying
+ * every byte through this process would add a buffer, a backpressure question
+ * and a place for the framing to be corrupted, in exchange for nothing.
+ */
+export class EngineBinaryLanguageServer {
+    #bin;
+    constructor(bin = process.env[BIN_ENV] ?? DEFAULT_BIN) {
+        this.#bin = bin;
+    }
+    async serve() {
+        const bin = this.#bin;
+        return await new Promise((resolve, reject) => {
+            const child = spawn(bin, ['lsp'], { stdio: 'inherit' });
+            child.on('error', (error) => {
+                if (error.code === 'ENOENT') {
+                    resolve({ code: 2, missing: missingDetail(bin) });
+                    return;
+                }
+                reject(error);
+            });
+            child.on('exit', (code) => resolve({ code: code ?? 0 }));
+        });
+    }
+}
+/** Adapter: finds `.github/workflows/*.yml|yaml` under the working directory. */
+export class GitHubWorkflowLocator {
+    #root;
+    constructor(root = process.cwd()) {
+        this.#root = root;
+    }
+    async defaultWorkflows() {
+        const dir = join(this.#root, '.github', 'workflows');
+        try {
+            const entries = await readdir(dir);
+            return entries
+                .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))
+                .sort()
+                .map((f) => join(dir, f));
+        }
+        catch {
+            return [];
+        }
+    }
+}

package/dist/src/infrastructure/github-api.js

@@ -0,0 +1,154 @@
+const TOKEN_ENVS = ['GITHUB_TOKEN', 'GH_TOKEN'];
+const API_ENV = 'GITHUB_API_URL';
+const DEFAULT_API = 'https://api.github.com';
+const WORKFLOW_DIR = '.github/workflows';
+export class NoTokenError extends Error {
+    constructor() {
+        super(`set ${TOKEN_ENVS.join(' or ')} to a token that can read the organization's repositories`);
+        this.name = 'NoTokenError';
+    }
+}
+/**
+ * Adapter: the GitHub REST API, for reading somebody else's workflows before
+ * they have moved anything.
+ *
+ * Read-only, and deliberately narrow. It fetches workflow documents and the
+ * **names** of secrets and variables, and there is no method here that could
+ * return a value. That is not an accident of what GitHub exposes:
+ * `/actions/secrets` genuinely has no value field, because a secret can only
+ * be written — but `/actions/variables` **does** carry `value`, and this
+ * adapter drops it. Importing values was never the deliverable, a variable is
+ * not reliably non-sensitive, and §11's write-only rule is easiest to keep
+ * when the value never enters the process at all.
+ */
+export class GitHubApi {
+    #token;
+    #baseUrl;
+    #fetch;
+    constructor(config = {}) {
+        const token = config.token ?? TOKEN_ENVS.map((e) => process.env[e]).find((v) => v !== undefined && v !== '');
+        if (token === undefined || token === '')
+            throw new NoTokenError();
+        this.#token = token;
+        this.#baseUrl = (config.baseUrl ?? process.env[API_ENV] ?? DEFAULT_API).replace(/\/+$/, '');
+        this.#fetch = config.fetchImpl ?? fetch;
+    }
+    async repositories(org) {
+        const repos = await this.#paged(`/orgs/${encodeURIComponent(org)}/repos?per_page=100&type=all`);
+        return repos.map((r) => ({ slug: r.full_name, archived: r.archived === true }));
+    }
+    async workflows(repo) {
+        const listing = await this.#json(`/repos/${repo}/contents/${WORKFLOW_DIR}`, { allow404: true });
+        if (listing === undefined)
+            return [];
+        const files = listing.filter((e) => e.type === 'file' && (e.name.endsWith('.yml') || e.name.endsWith('.yaml')));
+        const documents = [];
+        for (const file of files.sort((a, b) => a.name.localeCompare(b.name))) {
+            const source = await this.#raw(`/repos/${repo}/contents/${file.path}`);
+            if (source !== undefined)
+                documents.push({ path: file.path, repo, source });
+        }
+        return documents;
+    }
+    /**
+     * The names configured on GitHub: organization-wide first, then each
+     * repository's own.
+     *
+     * A repository whose secrets the token may not read is skipped rather than
+     * fatal. A checklist missing one repository's names is still worth having;
+     * an error instead of a report is not.
+     */
+    async configuredNames(org, repos) {
+        const names = [];
+        names.push(...(await this.#secretNames(`/orgs/${encodeURIComponent(org)}/actions/secrets`, 'organization')));
+        names.push(...(await this.#variableNames(`/orgs/${encodeURIComponent(org)}/actions/variables`, 'organization')));
+        for (const repo of repos) {
+            names.push(...(await this.#secretNames(`/repos/${repo}/actions/secrets`, 'repository', repo)));
+            names.push(...(await this.#variableNames(`/repos/${repo}/actions/variables`, 'repository', repo)));
+        }
+        return names;
+    }
+    /**
+     * Every property is named. A spread of the response would copy whatever
+     * GitHub sends, which for a variable is its value.
+     */
+    async #secretNames(path, scope, repo) {
+        const body = await this.#json(`${path}?per_page=100`, {
+            allow404: true,
+            allowForbidden: true,
+        });
+        return (body?.secrets ?? []).map((s) => ({
+            name: s.name,
+            kind: 'secret',
+            scope,
+            ...(repo === undefined ? {} : { repo }),
+            ...(s.updated_at === undefined ? {} : { updatedAt: s.updated_at }),
+        }));
+    }
+    async #variableNames(path, scope, repo) {
+        const body = await this.#json(`${path}?per_page=100`, {
+            allow404: true,
+            allowForbidden: true,
+        });
+        // `value` is present on this response and is deliberately not read.
+        return (body?.variables ?? []).map((v) => ({
+            name: v.name,
+            kind: 'variable',
+            scope,
+            ...(repo === undefined ? {} : { repo }),
+            ...(v.updated_at === undefined ? {} : { updatedAt: v.updated_at }),
+        }));
+    }
+    async #paged(path) {
+        const out = [];
+        let next = `${this.#baseUrl}${path}`;
+        while (next !== undefined) {
+            const response = await this.#fetch(next, { headers: this.#headers() });
+            if (!response.ok)
+                throw new Error(`GET ${next} → ${response.status}`);
+            out.push(...(await response.json()));
+            next = nextLink(response.headers.get('link'));
+        }
+        return out;
+    }
+    async #json(path, options = {}) {
+        const url = `${this.#baseUrl}${path}`;
+        const response = await this.#fetch(url, { headers: this.#headers() });
+        if (response.status === 404 && options.allow404 === true)
+            return undefined;
+        if ((response.status === 403 || response.status === 401) && options.allowForbidden === true)
+            return undefined;
+        if (!response.ok)
+            throw new Error(`GET ${url} → ${response.status}`);
+        return (await response.json());
+    }
+    async #raw(path) {
+        const url = `${this.#baseUrl}${path}`;
+        const response = await this.#fetch(url, {
+            headers: { ...this.#headers(), Accept: 'application/vnd.github.raw' },
+        });
+        if (response.status === 404)
+            return undefined;
+        if (!response.ok)
+            throw new Error(`GET ${url} → ${response.status}`);
+        return await response.text();
+    }
+    #headers() {
+        return {
+            Authorization: `Bearer ${this.#token}`,
+            Accept: 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28',
+        };
+    }
+}
+/** `<https://…?page=2>; rel="next", <…>; rel="last"` → the next URL. */
+export const nextLink = (header) => {
+    if (header === null)
+        return undefined;
+    for (const part of header.split(',')) {
+        const match = /^\s*<([^>]+)>\s*;\s*rel="next"\s*$/.exec(part);
+        if (match?.[1] !== undefined)
+            return match[1];
+    }
+    return undefined;
+};

package/dist/src/infrastructure/index.js

@@ -0,0 +1,2 @@
+export {};
+// infrastructure layer — see ../../../../docs/conventions.md §1

package/dist/src/infrastructure/loopback-login.js

@@ -0,0 +1,136 @@
+// infrastructure layer — see ../../../../docs/conventions.md §1
+import { createHash, randomBytes } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { judgeCallback, normaliseUrl } from '../domain/credentials.js';
+/**
+ * Adapters for `apex login`: the PKCE pair, the loopback listener, the
+ * browser, and the code exchange (RFC 8252, RFC 7636; control-plane ADR-0064).
+ */
+/** base64url(sha256(verifier)) — RFC 7636's S256. */
+export const s256 = (verifier) => createHash('sha256').update(verifier, 'ascii').digest('base64url');
+/**
+ * A fresh pair. 32 random bytes base64url-encode to 43 characters, all of
+ * them in RFC 7636's unreserved set, which is the verifier's minimum length
+ * and the whole of its alphabet.
+ */
+export const newPkcePair = () => {
+    const verifier = randomBytes(32).toString('base64url');
+    return { verifier, challenge: s256(verifier), state: randomBytes(16).toString('base64url') };
+};
+/** How long a person has to finish in the browser. */
+export const LOGIN_TIMEOUT_MS = 5 * 60_000;
+const page = (title, body) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${title}</title>` +
+    `<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;line-height:1.5}</style>` +
+    `</head><body><h1>${title}</h1><p>${body}</p></body></html>`;
+const answer = (res, status, html) => {
+    res.writeHead(status, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', connection: 'close' });
+    res.end(html);
+};
+/**
+ * Listen on `127.0.0.1` on a port the kernel picks, for exactly one callback.
+ *
+ * Only the loopback address: nothing off this machine can reach it. The first
+ * request to `/callback` settles the login either way — a `state` that does
+ * not match ends it rather than waiting on, because a second tab racing the
+ * real one is not something to paper over.
+ */
+export const listenForCallback = async (expectedState, timeoutMs = LOGIN_TIMEOUT_MS) => {
+    let settle = () => undefined;
+    const settled = new Promise((resolve) => {
+        settle = resolve;
+    });
+    let done = false;
+    const finish = (result) => {
+        if (done)
+            return;
+        done = true;
+        settle(result);
+    };
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (req.method !== 'GET' || url.pathname !== '/callback' || done) {
+            answer(res, 404, page('Not found', 'This address only answers the <code>apex login</code> callback.'));
+            return;
+        }
+        const verdict = judgeCallback(url.searchParams, expectedState);
+        switch (verdict.kind) {
+            case 'code':
+                answer(res, 200, page('Signed in', 'The <code>apex</code> CLI is signed in. You can close this tab.'));
+                break;
+            case 'denied':
+                answer(res, 200, page('Not signed in', 'The request was declined. You can close this tab.'));
+                break;
+            case 'state-mismatch':
+                answer(res, 400, page('Not signed in', 'This callback does not belong to the login waiting in your terminal, so it was refused.'));
+                break;
+            case 'malformed':
+                answer(res, 400, page('Not signed in', 'The callback carried no code. Run <code>apex login</code> again.'));
+                break;
+        }
+        finish(verdict);
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const timer = setTimeout(() => finish({ kind: 'timeout' }), timeoutMs);
+    timer.unref();
+    return {
+        port: server.address().port,
+        wait: async () => await settled,
+        close: async () => {
+            clearTimeout(timer);
+            finish({ kind: 'timeout' });
+            server.closeAllConnections();
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+};
+/**
+ * The platform's opener, spawned with the URL as one argument — never through
+ * a shell, so nothing in the URL is ever interpreted. Windows' `start` is a
+ * `cmd` builtin that would re-parse the `&`s, so it gets the URL handler
+ * directly. A failure is silent: the URL is already on the terminal.
+ */
+export const openInBrowser = (url, platform = process.platform) => {
+    const [command, args] = platform === 'darwin' ? ['open', [url]] : platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]] : ['xdg-open', [url]];
+    try {
+        const child = spawn(command, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => undefined);
+        child.unref();
+    }
+    catch {
+        // no opener on this machine; the printed URL is the fallback
+    }
+};
+/** Adapter: `POST /api/v1/cli/token` — the one call made with no credential but the code and verifier. */
+export class HttpLoginExchange {
+    #baseUrl;
+    #fetch;
+    constructor(baseUrl, fetchImpl = fetch) {
+        this.#baseUrl = normaliseUrl(baseUrl);
+        this.#fetch = fetchImpl;
+    }
+    async redeem(code, verifier) {
+        let response;
+        try {
+            response = await this.#fetch(`${this.#baseUrl}/api/v1/cli/token`, {
+                method: 'POST',
+                headers: { accept: 'application/json', 'content-type': 'application/json' },
+                body: JSON.stringify({ code, codeVerifier: verifier }),
+                signal: AbortSignal.timeout(30_000),
+            });
+        }
+        catch (err) {
+            throw new Error(`${this.#baseUrl} is unreachable: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+        const body = (await response.json().catch(() => ({})));
+        if (!response.ok)
+            throw new Error(typeof body.error === 'string' ? body.error : `the code exchange failed with ${response.status}`);
+        if (typeof body.token !== 'string' || typeof body.login !== 'string' || typeof body.expiresAt !== 'string') {
+            throw new Error('the control plane answered the code exchange without a token');
+        }
+        return { token: body.token, login: body.login, expiresAt: body.expiresAt };
+    }
+}

package/dist/src/infrastructure/runner-binary.js

@@ -0,0 +1,74 @@
+// infrastructure layer — see ../../../../docs/conventions.md §1
+import { spawn } from 'node:child_process';
+const BIN_ENV = 'APEX_RUNNER_BIN';
+const DEFAULT_BIN = 'apex-runner';
+const missingDetail = (bin) => `runner binary ${bin} not found — install apex-runner on your PATH or set ${BIN_ENV}`;
+/** Builds the `apex-runner --local` argv for a request (pure, tested). */
+export const runnerArgs = (request) => {
+    const args = ['--local', '--workflow', request.workflow];
+    if (request.job !== undefined)
+        args.push('--job', request.job);
+    if (request.event !== undefined)
+        args.push('--event', request.event);
+    if (request.payload !== undefined)
+        args.push('--payload', request.payload);
+    if (request.image !== undefined)
+        args.push('--image', request.image);
+    for (const s of request.secrets)
+        args.push('--secret', s);
+    for (const v of request.vars)
+        args.push('--var', v);
+    for (const i of request.inputs)
+        args.push('--input', i);
+    for (const c of request.changedFiles)
+        args.push('--changed-file', c);
+    if (request.json)
+        args.push('--json');
+    return args;
+};
+/** Builds the remote-mode argv for `apex runner register` (pure, tested). */
+export const registerArgs = (request) => {
+    const args = ['--server', request.server, '--registration-token', request.token, '--labels', request.labels.join(',')];
+    if (request.name !== undefined)
+        args.push('--name', request.name);
+    if (request.workDir !== undefined)
+        args.push('--work-dir', request.workDir);
+    if (request.idleTimeout !== undefined)
+        args.push('--idle-timeout', request.idleTimeout);
+    if (request.ephemeral)
+        args.push('--ephemeral');
+    return args;
+};
+/**
+ * Adapter: spawns `apex-runner` with inherited stdio so logs stream
+ * straight to the terminal (runner ADR-0003). `--local` runs one workflow here;
+ * remote mode registers this machine and leases work until stopped.
+ */
+export class RunnerBinaryExecutor {
+    #bin;
+    constructor(bin = process.env[BIN_ENV] ?? DEFAULT_BIN) {
+        this.#bin = bin;
+    }
+    async run(request) {
+        return await this.#spawn(runnerArgs(request));
+    }
+    async register(request) {
+        return await this.#spawn(registerArgs(request));
+    }
+    async #spawn(args) {
+        const bin = this.#bin;
+        return await new Promise((resolve, reject) => {
+            const child = spawn(bin, args, { stdio: 'inherit' });
+            child.on('error', (error) => {
+                if (error.code === 'ENOENT') {
+                    resolve({ kind: 'runner-missing', detail: missingDetail(bin) });
+                    return;
+                }
+                reject(error);
+            });
+            child.on('exit', (code, signal) => {
+                resolve({ kind: 'exit', code: code ?? (signal === null ? 0 : 1) });
+            });
+        });
+    }
+}

package/dist/src/infrastructure/secret-input.js

@@ -0,0 +1,52 @@
+// infrastructure layer — see ../../../../docs/conventions.md §1
+import { readFile } from 'node:fs/promises';
+import inquirer from 'inquirer';
+import { trimOneNewline } from '../domain/secrets.js';
+/**
+ * Where a secret's value comes from — anywhere but argv (BUG-0157: argv is
+ * readable in `ps` by every user on the machine, and lands in shell history).
+ *
+ * Every error here names the source and never the content: a file that turns
+ * out not to be the one somebody meant may still hold something private.
+ */
+export class ValueInputError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ValueInputError';
+    }
+}
+/** Everything on a stream, to EOF, as UTF-8, with one trailing newline off. */
+export const readToEnd = async (stream) => {
+    const chunks = [];
+    for await (const chunk of stream)
+        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk);
+    return trimOneNewline(Buffer.concat(chunks).toString('utf8'));
+};
+/** A file's bytes as UTF-8, one trailing newline off. */
+export const readValueFile = async (path) => {
+    try {
+        return trimOneNewline(await readFile(path, 'utf8'));
+    }
+    catch (err) {
+        const code = err.code;
+        throw new ValueInputError(`cannot read ${path}${typeof code === 'string' ? ` (${code})` : ''}`);
+    }
+};
+/**
+ * A no-echo prompt, asked twice: a typo in a value nobody can read back is
+ * otherwise discovered by the job that fails with it.
+ */
+export const promptHidden = async (name) => {
+    const answers = await inquirer.prompt([
+        { type: 'password', name: 'value', message: `value for ${name} (not echoed)`, mask: false },
+        { type: 'password', name: 'again', message: 'again, to confirm', mask: false },
+    ]);
+    if (answers.value !== answers.again)
+        throw new ValueInputError('the two entries differ; nothing was set');
+    return answers.value;
+};
+/** A yes/no on the terminal, defaulting to no. */
+export const confirm = async (message) => {
+    const answers = await inquirer.prompt([{ type: 'confirm', name: 'ok', message, default: false }]);
+    return answers.ok;
+};

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@apex-actions/cli",
+  "version": "0.67.0",
+  "license": "SEE LICENSE IN LICENSE",
+  "//files": "Without this npm ships src, test and the CI config alongside the binary a user installs.",
+  "files": [
+    "dist",
+    "THIRD-PARTY-NOTICES.md"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Apex-Actions/cli.git"
+  },
+  "description": "apex — developer and operator CLI for Apex Actions",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "bin": {
+    "apex": "dist/cli/main.js"
+  },
+  "dependencies": {
+    "chalk": "^5.4.1",
+    "commander": "^14.0.0",
+    "inquirer": "^12.6.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^24.0.0",
+    "dependency-cruiser": "^16.10.0",
+    "eslint": "^9.28.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^16.1.0",
+    "tsx": "^4.19.4",
+    "typescript": "^5.8.3",
+    "typescript-eslint": "^8.67.0",
+    "vitest": "^3.2.0"
+  },
+  "lint-staged": {
+    "*.ts": "eslint --max-warnings=0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "lint": "eslint . --max-warnings=0",
+    "lint:arch": "depcruise src cli --config .dependency-cruiser.cjs",
+    "apex": "tsx cli/main.ts"
+  }
+}