@aventara/cli 0.0.0-stage → 0.1.0-pilot.1

package/LICENSE

@@ -0,0 +1,91 @@
+Required Notice: Copyright 2026 Mohamed Ragheb
+
+# PolyForm Shield License 1.0.0
+
+<https://polyformproject.org/licenses/shield/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose.  However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software.  Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncompete
+
+Any purpose is a permitted purpose, except for providing any product that competes with the software or any product the licensor or any of its affiliates provides using the software.
+
+## Competition
+
+Goods and services compete even when they provide functionality through different kinds of interfaces or for different technical platforms.  Applications can compete with services, libraries with plugins, frameworks with development tools, and so on, even if they're written in different programming languages or for different computer architectures.  Goods and services compete even when provided free of charge.  If you market a product as a practical substitute for the software or another product, it definitely competes.
+
+## New Products
+
+If you are using the software to provide a product that does not compete, but the licensor or any of its affiliates brings your product into competition by providing a new version of the software or another product using the software, you may continue using versions of the software available under these terms beforehand to provide your competing product, but not any later versions.
+
+## Discontinued Products
+
+You may begin using the software to compete with a product or service that the licensor or any of its affiliates has stopped providing, unless the licensor includes a plain-text line beginning with `Licensor Line of Business:` with the software that mentions that line of business.  For example:
+
+> Licensor Line of Business: YoyodyneCMS Content Management System (http://example.com/cms)
+
+## Sales of Business
+
+If the licensor or any of its affiliates sells a line of business developing the software or using the software to provide a product, the buyer can also enforce [Noncompete](#noncompete) for that product.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+A **product** can be a good or service, or a combination of them.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all its affiliates.
+
+**Affiliates** means the other organizations than an organization has control over, is under the control of, or is under common control with.
+
+**Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

package/LICENSE-ADDITIONAL-PERMISSION.md

@@ -0,0 +1,9 @@
+# Additional Permission — Aventara
+
+Copyright 2026 Mohamed Ragheb
+
+In addition to the permissions of the PolyForm Shield License 1.0.0 in `LICENSE`, the licensor grants the following additional permission:
+
+The Noncompete section applies only to providing a product that competes with the software itself — the Aventara framework, its packages and its tooling. Providing a product that competes with any other product the licensor or its affiliates provide using the software is a permitted purpose.
+
+This additional permission only adds to your permissions; it does not restrict or replace any term of `LICENSE`.

package/README.md

@@ -1,3 +1,121 @@
-# Temporary Holding Version
+# `@aventara/cli`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The `aventara` command: it scaffolds an Aventara server on NestJS 12.
+
+```bash
+npm i -g @aventara/cli@pilot  # or run it once: npx @aventara/cli@pilot <command>
+aventara new my-api           # a new NestJS project with Aventara
+aventara init                 # Aventara added to the NestJS 12 project in this directory
+```
+
+It is run once, globally or through `npx`; it is not a dependency of the projects it writes. The frontend's side —
+`framework.client.mts` and the generated client — is `@aventara/client`'s (`npx @aventara/client@pilot init`).
+
+## `aventara new <name>`
+
+Runs the pinned `nest new` (`npx -y @nestjs/cli@12.0.8 new …`, or `pnpm dlx …` under pnpm), checks that its
+`src/app.module.ts` is what that version writes, then runs exactly `aventara init`'s pipeline over the new project and
+installs it. A directory that exists and is not empty is refused before anything runs.
+
+## `aventara init`
+
+Runs inside an existing **NestJS 12** project (refused: no `package.json`, another Nest major, TypeScript 7, a yarn-only
+lockfile, a project already initialized).
+
+- **No ORM yet:** the ORM and the database are asked (or taken from the flags), and everything below is written.
+- **Prisma already there:** the installed Prisma must be one an Aventara adapter supports — today Prisma 7, `^7.10.0`,
+  SQLite or PostgreSQL, a driver adapter, the `prisma-client` generator — or the run is refused in one sentence, with
+  nothing written. Your schema, Prisma config, `.env` and service are **reused and never written**; init finds the class
+  extending `PrismaClient` and the module exporting it, or asks.
+
+### Questions and flags
+
+Every question has a flag. On a terminal, unanswered questions are asked; anywhere else (CI, a script) pass the flags
+or `--yes`, or the run stops in one sentence naming what is missing, before writing anything. A question with one
+possible answer is shown, not asked.
+
+| Flag | Question | Default |
+|---|---|---|
+| `<name>` (`new` only) | The project directory. | — (required) |
+| `--orm <family>@<major>` | The ORM, from the adapters that exist (`prisma@7`; `prisma` = its newest). | the only one there is |
+| `--db <provider>` | The database: the adapter's providers (`sqlite`, `postgresql`). | `sqlite` |
+| `--package-manager <npm\|pnpm>` | — | the lockfile's, else the one that launched the CLI, else npm |
+| `--prisma-service <path#Export>` (`init`) | Your Prisma service, when more than one, or none, is found. | the one found; none → write `src/prisma.service.ts` |
+| `--prisma-module <path#Export>` (`init`) | The Nest module that provides and exports it. | the one found |
+| `--skip-install` | Write the files; print the install instead of running it. | |
+| `--skip-git` (`new`) | Passed to `nest new`. | |
+| `-y`, `--yes` | Accept every unanswered default **and** replace existing content that differs. | |
+
+Existing content that differs from what would be written (a `.env` key, a script, a file) is listed, and replaced only
+when you confirm, or with `--yes`; where nobody can be asked, the run stops and touches nothing.
+
+### What it writes (no ORM yet, SQLite, npm)
+
+| Path | Owner afterwards |
+|---|---|
+| `prisma/schema.prisma` — `prisma-client` generating into `src/generated/prisma`, a `User` model | you |
+| `prisma.config.ts` — loads `.env` itself (Prisma does not) | you |
+| `src/prisma.service.ts` — `PrismaService` extending the client with the driver adapter, refusing a missing `DATABASE_URL` before the server listens; `PrismaModule` | you |
+| `src/aventara.config.ts` — `aventaraConfig(prisma)`: the entrypoint (`/api`), and the restrictions and pipelines you add | you |
+| `src/app.module.ts` — one edit: the imports, `PrismaModule` and `AventaraModule.forRootAsync({ … })`; printed instead when the file is not the shape expected | you |
+| `test/app.e2e-spec.ts` — one edit: a `GET /api/_contract` → 200 test after Nest's `GET /` test; left alone when the file is not Nest's | you |
+| `.env` (`DATABASE_URL`), `.gitignore` (`/src/generated/`, `/dev.db*`) | you |
+| `package.json` — `@aventara/*` at this CLI's version, `prisma`, `@prisma/client` and the driver at `7.10.0`; `aventara:prepare`, `postinstall`, and the `.env` on the start scripts and `test:e2e` (`--env-file`, `--env-file-if-exists`) | you |
+| `pnpm-workspace.yaml` (pnpm only) — `allowBuilds` for Prisma's and SQLite's install scripts | you |
+| `src/generated/prisma/**`, `src/generated/aventara/discovery.artifact.ts` | **generated** by `aventara:prepare` (run on every install); never edit |
+
+### Next steps it prints
+
+```bash
+npx prisma db push          # create the tables (init never touches a database); pnpm: pnpm exec prisma db push
+npm run start:dev           # GET http://localhost:3000/api/_contract
+npx @aventara/client@pilot init   # in your frontend; pnpm: pnpm dlx @aventara/client@pilot init
+```
+
+The frontend command is the package manager's own runner (`npx`, or `pnpm dlx` under pnpm) and, while the CLI is a
+prerelease, carries its dist-tag (`@pilot`), so the client comes from the same release.
+
+With PostgreSQL, set `DATABASE_URL` in `.env` first (init writes Prisma's placeholder, and never asks for a secret).
+
+### Calling it by hand
+
+With the server running, the starter `User` model answers at `/api`:
+
+<!-- pilot-gate:curl -->
+```bash
+# 1. The contract. Its protocol.hash is what every resource request sends as Aventara-Contract-Hash.
+HASH=$(curl -s http://localhost:3000/api/_contract | node -p 'JSON.parse(require("fs").readFileSync(0, "utf8")).protocol.hash')
+
+# 2. find.many on User, with both identity headers.
+curl -s -X POST http://localhost:3000/api/_resources/User/find/many \
+  -H 'Content-Type: application/json' \
+  -H 'Aventara-Protocol-Version: 1' \
+  -H "Aventara-Contract-Hash: $HASH" \
+  -d '{}'
+# {"data":[],"code":"A1000","cause":null}
+```
+<!-- /pilot-gate:curl -->
+
+Leave out an identity header and the answer is `400 A2000`, naming the header that is missing. The hash changes
+whenever the schema or the configuration does: fetch it again, and regenerate the client.
+
+- **Resource keys are the model names, as written.** `model User` is `User` everywhere: on the wire
+  (`/_resources/User/find/many`) and in the generated client (`avClient.User.find.many({})`). Nothing is renamed,
+  lower-cased or pluralized.
+- **Results are read-only.** A list result is a `readonly` array: type it `readonly User[]`, not `User[]` —
+  `const users: readonly User[] = await avClient.User.find.many({});`.
+
+## Supported
+
+NestJS 12; Node `^22.18.0 || >=24.2.0` (measured; on any other Node the bin refuses in one sentence naming that range;
+on Node 22 use npm ≥ 11 — Node 22's bundled npm 10 cannot install Nest 12's own scaffold; a CommonJS project's jest
+e2e needs Node ≥ 24.9, Nest's and Jest's limit); npm and pnpm (yarn is not supported); ESM and
+CommonJS projects; Prisma 7 (`^7.10.0`) on SQLite and PostgreSQL. The ORMs, majors, databases and drivers on offer are
+**generated** from the Aventara adapter packages that exist (`src/catalog/adapter.catalog.generated.ts`), never listed
+by hand: a future
+`@aventara/prisma8-adapter` appears by existing.
+
+## License
+
+PolyForm Shield 1.0.0 with an additional permission — free to use, including in commercial applications; you may not
+use it to build a product that competes with Aventara itself. See `LICENSE` and `LICENSE-ADDITIONAL-PERMISSION.md`.

package/dist/apply/app-module.anchor.d.ts

@@ -0,0 +1,30 @@
+/**
+ * R2 — the one edit `aventara init` makes to code the developer owns:
+ * `src/app.module.ts` gains import lines and `imports:` entries for
+ * `AventaraModule`, spliced at an **anchor** — the `imports: [ … ]` array of the
+ * one `@Module({ … })` that decorates `AppModule`.
+ *
+ * The scan is string- and comment-aware (a `@Module(` or an `imports: [` inside
+ * a comment, a string or a template literal is not code), and it never
+ * reformats: everything outside the two insertion points keeps its bytes. When
+ * the anchor is not found exactly once — two `@Module`s, a computed `imports`,
+ * no `imports` at all — nothing is edited and the caller prints the lines to
+ * add instead.
+ */
+export type AppModuleWiring = {
+    /** Complete import declarations, one per line. */
+    readonly imports: readonly string[];
+    /** `imports:` entries, each possibly multi-line, each ending with a comma. */
+    readonly entries: readonly string[];
+};
+export type AppModuleEdit = {
+    readonly kind: "edited";
+    readonly text: string;
+} | {
+    readonly kind: "not-anchored";
+    readonly reason: string;
+};
+/** Splices `wiring` into `text` at the anchor, or says why there is no anchor. */
+export declare function spliceAppModule(text: string, wiring: AppModuleWiring): AppModuleEdit;
+/** What to add by hand when there is no anchor. */
+export declare function wiringInstructions(wiring: AppModuleWiring): string;

package/dist/apply/app-module.anchor.js

@@ -0,0 +1,185 @@
+/**
+ * R2 — the one edit `aventara init` makes to code the developer owns:
+ * `src/app.module.ts` gains import lines and `imports:` entries for
+ * `AventaraModule`, spliced at an **anchor** — the `imports: [ … ]` array of the
+ * one `@Module({ … })` that decorates `AppModule`.
+ *
+ * The scan is string- and comment-aware (a `@Module(` or an `imports: [` inside
+ * a comment, a string or a template literal is not code), and it never
+ * reformats: everything outside the two insertion points keeps its bytes. When
+ * the anchor is not found exactly once — two `@Module`s, a computed `imports`,
+ * no `imports` at all — nothing is edited and the caller prints the lines to
+ * add instead.
+ */
+import { closing, codeIndexes, codeMask, nextCode, OPENERS, } from "../project/source.scanner.js";
+function indentOf(text, at) {
+    const lineStart = text.lastIndexOf("\n", at - 1) + 1;
+    return /^[ \t]*/.exec(text.slice(lineStart))?.[0] ?? "";
+}
+function indented(block, indent) {
+    return block
+        .split("\n")
+        .map((line) => (line === "" ? line : `${indent}${line}`))
+        .join("\n");
+}
+/** The local names a file's import declarations bind. */
+function importedNames(text, code) {
+    const names = new Set();
+    for (const at of codeIndexes(text, code, /^import\b/gm)) {
+        const end = text.indexOf(" from ", at);
+        if (end === -1) {
+            continue;
+        }
+        const clause = text
+            .slice(at + "import".length, end)
+            .replace(/\btype\b/g, "");
+        for (const part of clause.replace(/[{}]/g, ",").split(",")) {
+            const local = part
+                .trim()
+                .split(/\s+as\s+/)
+                .pop()
+                ?.trim();
+            if (local !== undefined && /^[A-Za-z_$][\w$]*$/.test(local)) {
+                names.add(local);
+            }
+        }
+    }
+    return names;
+}
+/** Splices `wiring` into `text` at the anchor, or says why there is no anchor. */
+export function spliceAppModule(text, wiring) {
+    const code = codeMask(text);
+    const decorators = codeIndexes(text, code, /@Module\s*\(/g);
+    if (decorators.length !== 1) {
+        return {
+            kind: "not-anchored",
+            reason: `it has ${decorators.length} @Module decorators, not one`,
+        };
+    }
+    const open = text.indexOf("(", decorators[0]);
+    const close = closing(text, code, open);
+    const after = nextCode(text, code, close + 1);
+    if (close === -1 ||
+        !/^(?:export\s+)?class\s+AppModule\b/.test(text.slice(after))) {
+        return {
+            kind: "not-anchored",
+            reason: "its @Module decorator does not decorate class AppModule",
+        };
+    }
+    const object = nextCode(text, code, open + 1);
+    if (text[object] !== "{") {
+        return {
+            kind: "not-anchored",
+            reason: "@Module is not given an object literal",
+        };
+    }
+    const objectEnd = closing(text, code, object);
+    // `imports` at the object's own level: not inside a nested bracket.
+    let depth = 0;
+    let key = -1;
+    for (let at = object + 1; at < objectEnd; at += 1) {
+        if (!code[at]) {
+            continue;
+        }
+        const char = text[at];
+        if (OPENERS[char] !== undefined) {
+            depth += 1;
+        }
+        else if (char === ")" || char === "]" || char === "}") {
+            depth -= 1;
+        }
+        else if (depth === 0 &&
+            /^imports\s*:/.test(text.slice(at)) &&
+            !/[\w$]/.test(text[at - 1])) {
+            if (key !== -1) {
+                return { kind: "not-anchored", reason: "it has two imports keys" };
+            }
+            key = at;
+        }
+    }
+    if (key === -1) {
+        return {
+            kind: "not-anchored",
+            reason: "AppModule's @Module has no imports array",
+        };
+    }
+    const array = nextCode(text, code, text.indexOf(":", key) + 1);
+    if (text[array] !== "[") {
+        return {
+            kind: "not-anchored",
+            reason: "AppModule's imports is computed, not an array literal",
+        };
+    }
+    const arrayEnd = closing(text, code, array);
+    if (arrayEnd === -1) {
+        return { kind: "not-anchored", reason: "its imports array does not close" };
+    }
+    const base = indentOf(text, key);
+    const element = `${base}  `;
+    // An entry the developer already lists (their own `PrismaModule`) is not added twice.
+    const listed = text.slice(array + 1, arrayEnd);
+    const entries = wiring.entries
+        .filter((entry) => {
+        const name = /^[A-Za-z_$][\w$]*/.exec(entry)?.[0];
+        return (name === undefined ||
+            !new RegExp(`(^|[\\s,\\[])${name}\\s*,?\\s*($|\\])`, "m").test(listed));
+    })
+        .map((entry) => indented(entry, element));
+    // The last element needs a trailing comma: placed after its last code
+    // character, so a comment after it stays a comment.
+    let lastCode = arrayEnd - 1;
+    while (lastCode > array &&
+        (!code[lastCode] || /\s/.test(text[lastCode]))) {
+        lastCode -= 1;
+    }
+    const content = lastCode === array || text[lastCode] === ","
+        ? text.slice(array + 1, arrayEnd)
+        : `${text.slice(array + 1, lastCode + 1)},${text.slice(lastCode + 1, arrayEnd)}`;
+    const existing = content.trim();
+    const lines = [
+        ...(existing === "" ? [] : [`${element}${existing}`]),
+        ...entries,
+    ];
+    const spliced = `[\n${lines.join("\n")}\n${base}]`;
+    // The import lines go after the last import declaration.
+    const declarations = codeIndexes(text, code, /^import\b/gm);
+    let insertAt = 0;
+    for (const declaration of declarations) {
+        const end = text.indexOf(";", declaration);
+        const lineEnd = text.indexOf("\n", end === -1 ? declaration : end);
+        insertAt = lineEnd === -1 ? text.length : lineEnd + 1;
+    }
+    // A name the file already imports is not imported twice: a wiring line keeps
+    // only the names still missing, and is dropped when none are.
+    const imported = importedNames(text, code);
+    const missing = wiring.imports.flatMap((line) => {
+        const named = /^import\s+(type\s+)?\{([^}]*)\}(\s*from\s*.*)$/.exec(line);
+        if (named === null) {
+            return [...importedNames(line, codeMask(line))].some((name) => !imported.has(name))
+                ? [line]
+                : [];
+        }
+        const names = named[2]
+            .split(",")
+            .map((name) => name.trim())
+            .filter((name) => name !== "" && !imported.has(name.split(/\s+as\s+/).pop()));
+        return names.length === 0
+            ? []
+            : [`import ${named[1] ?? ""}{ ${names.join(", ")} }${named[3]}`];
+    });
+    const imports = missing.length === 0 ? "" : `${missing.join("\n")}\n`;
+    const edited = text.slice(0, array) + spliced + text.slice(arrayEnd + 1);
+    return {
+        kind: "edited",
+        text: edited.slice(0, insertAt) + imports + edited.slice(insertAt),
+    };
+}
+/** What to add by hand when there is no anchor. */
+export function wiringInstructions(wiring) {
+    return [
+        "Add to src/app.module.ts:",
+        ...wiring.imports.map((line) => `  ${line}`),
+        "and to AppModule's @Module({ imports: [ … ] }):",
+        ...wiring.entries.map((entry) => indented(entry, "  ")),
+    ].join("\n");
+}

package/dist/apply/conflict.confirmer.d.ts

@@ -0,0 +1,24 @@
+import type { Prompter } from "../wizard/answer.resolver.js";
+/**
+ * The `generateAt` rule (architect, 2026-10-04; R5 makes it every wizard's
+ * conflict rule; P7 — implemented here and in `@aventara/client`, which this
+ * package does not import, in the same sentence shape): content the tool did not
+ * produce is listed with a warning and replaced only once someone confirms;
+ * `--yes` confirms in advance; where nobody can be asked (stdin is not a
+ * terminal) the run cancels in one sentence naming `--yes`, exit 1, with
+ * nothing touched.
+ */
+/** Nobody confirmed replacing existing content. A refusal: nothing was touched. */
+export declare class ConflictsNotConfirmedError extends Error {
+    readonly name = "ConflictsNotConfirmedError";
+}
+export declare function conflictWarning(conflicts: readonly string[]): string;
+/**
+ * Resolves when `conflicts` may be replaced; throws when they may not.
+ *
+ * @throws ConflictsNotConfirmedError
+ */
+export declare function confirmConflicts(conflicts: readonly string[], consent: {
+    readonly yes: boolean;
+    readonly prompter: Prompter;
+}): Promise<void>;

package/dist/apply/conflict.confirmer.js

@@ -0,0 +1,39 @@
+/**
+ * The `generateAt` rule (architect, 2026-10-04; R5 makes it every wizard's
+ * conflict rule; P7 — implemented here and in `@aventara/client`, which this
+ * package does not import, in the same sentence shape): content the tool did not
+ * produce is listed with a warning and replaced only once someone confirms;
+ * `--yes` confirms in advance; where nobody can be asked (stdin is not a
+ * terminal) the run cancels in one sentence naming `--yes`, exit 1, with
+ * nothing touched.
+ */
+/** Nobody confirmed replacing existing content. A refusal: nothing was touched. */
+export class ConflictsNotConfirmedError extends Error {
+    name = "ConflictsNotConfirmedError";
+}
+export function conflictWarning(conflicts) {
+    return `${conflicts.join(", ")} already ${conflicts.length === 1 ? "has" : "have"} other content, and initializing will replace ${conflicts.length === 1 ? "it" : "them"}`;
+}
+/**
+ * Resolves when `conflicts` may be replaced; throws when they may not.
+ *
+ * @throws ConflictsNotConfirmedError
+ */
+export async function confirmConflicts(conflicts, consent) {
+    if (conflicts.length === 0 || consent.yes) {
+        return;
+    }
+    const them = conflicts.length === 1 ? "it" : "them";
+    if (!consent.prompter.interactive) {
+        throw new ConflictsNotConfirmedError(`not initializing, and nothing was touched: ${conflicts.join(", ")} already ${conflicts.length === 1 ? "has" : "have"} other content and nobody can be asked (stdin is not a terminal); run \`aventara init --yes\` to replace ${them}`);
+    }
+    consent.prompter.say(`aventara: warning: ${conflictWarning(conflicts)}.`);
+    const answer = await consent.prompter.ask({
+        label: "Replace them and initialize",
+        choices: ["y", "N"],
+        defaultValue: "N",
+    });
+    if (!/^y(?:es)?$/i.test(answer.trim())) {
+        throw new ConflictsNotConfirmedError(`cancelled, and nothing was touched; run again and answer yes to replace ${them}`);
+    }
+}

package/dist/apply/e2e-spec.anchor.d.ts

@@ -0,0 +1,18 @@
+/**
+ * pilot.1 — the scaffold's own e2e spec also proves the protocol is mounted.
+ *
+ * `nest new`'s `test/app.e2e-spec.ts` (`@nestjs/schematics` 12's template, ESM
+ * and CommonJS alike) tests `GET /` and nothing else. Like the `app.module.ts`
+ * edit, this one is anchored on Nest's exact text: the `/ (GET)` test is found
+ * exactly once, and a `GET <entrypoint>/_contract` test is added right after
+ * it, through the spec's own `app` and `request`. A spec that is not Nest's —
+ * the developer's own — is left as it is, and nothing is said: the test is a
+ * convenience, and the developer's tests are theirs.
+ */
+/** The e2e spec `nest new` writes. */
+export declare const E2E_SPEC = "test/app.e2e-spec.ts";
+/**
+ * `spec` with the contract test after Nest's `GET /` test, or `undefined` when
+ * the anchor is not there exactly once, or the contract test already is.
+ */
+export declare function spliceContractTest(spec: string, entrypoint: string): string | undefined;

package/dist/apply/e2e-spec.anchor.js

@@ -0,0 +1,40 @@
+/**
+ * pilot.1 — the scaffold's own e2e spec also proves the protocol is mounted.
+ *
+ * `nest new`'s `test/app.e2e-spec.ts` (`@nestjs/schematics` 12's template, ESM
+ * and CommonJS alike) tests `GET /` and nothing else. Like the `app.module.ts`
+ * edit, this one is anchored on Nest's exact text: the `/ (GET)` test is found
+ * exactly once, and a `GET <entrypoint>/_contract` test is added right after
+ * it, through the spec's own `app` and `request`. A spec that is not Nest's —
+ * the developer's own — is left as it is, and nothing is said: the test is a
+ * convenience, and the developer's tests are theirs.
+ */
+/** The e2e spec `nest new` writes. */
+export const E2E_SPEC = "test/app.e2e-spec.ts";
+/** `nest new`'s `GET /` test, byte for byte: the anchor. */
+const ROOT_TEST = `  it('/ (GET)', () => {
+    return request(app.getHttpServer())
+      .get('/')
+      .expect(200)
+      .expect('Hello World!');
+  });
+`;
+/**
+ * `spec` with the contract test after Nest's `GET /` test, or `undefined` when
+ * the anchor is not there exactly once, or the contract test already is.
+ */
+export function spliceContractTest(spec, entrypoint) {
+    const path = `${entrypoint}/_contract`;
+    const at = spec.indexOf(ROOT_TEST);
+    if (at === -1 ||
+        spec.indexOf(ROOT_TEST, at + 1) !== -1 ||
+        spec.includes(`'${path}'`)) {
+        return undefined;
+    }
+    const end = at + ROOT_TEST.length;
+    return `${spec.slice(0, end)}
+  it('${path} (GET)', () => {
+    return request(app.getHttpServer()).get('${path}').expect(200);
+  });
+${spec.slice(end)}`;
+}

package/dist/apply/manifest.merger.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The merges `aventara init` makes into files a project already has —
+ * `package.json`, `.env`, `.gitignore`, `pnpm-workspace.yaml` — each answering
+ * the merged text and the **conflicts**: values already there that differ from
+ * what would be written (the `generateAt` rule's "content the tool did not
+ * produce"). A value already equal to what would be written is no change (P3);
+ * a conflict is replaced only once confirmed (`conflict.confirmer.ts`), so each
+ * merge is computed with conflicts both kept and replaced.
+ */
+export type Merge = {
+    readonly text: string;
+    /** What differs, named for the person asked: `package.json's scripts["postinstall"]`. */
+    readonly conflicts: readonly string[];
+};
+export type PackageManifest = {
+    readonly [key: string]: unknown;
+    readonly dependencies?: Readonly<Record<string, string>>;
+    readonly devDependencies?: Readonly<Record<string, string>>;
+    readonly scripts?: Readonly<Record<string, string>>;
+};
+export type ManifestChanges = {
+    readonly dependencies: Readonly<Record<string, string>>;
+    readonly devDependencies: Readonly<Record<string, string>>;
+    /** Scripts to set; a different existing value is a conflict. */
+    readonly scripts: Readonly<Record<string, string>>;
+    /**
+     * Scripts to rewrite only from a known value (D3): `from` → `to`. Any other
+     * existing value is a conflict; an absent script is left absent.
+     */
+    readonly rewrites: Readonly<Record<string, {
+        readonly from: string;
+        readonly to: string;
+    }>>;
+};
+/** `package.json`, in npm's own layout: two-space JSON, dependencies sorted. */
+export declare function mergePackageManifest(text: string, changes: ManifestChanges, replaceConflicts: boolean): Merge;
+/** `.env`: a missing key is appended as `KEY="value"`, after a final newline (B5). */
+export declare function mergeEnvFile(text: string | undefined, entries: Readonly<Record<string, string>>, replaceConflicts: boolean): Merge;
+/** `.gitignore`: missing lines appended, nothing else touched. */
+export declare function mergeGitignore(text: string | undefined, additions: readonly string[]): Merge;
+/**
+ * `pnpm-workspace.yaml`'s `allowBuilds:` (B9: pnpm 12 refuses install scripts
+ * until they are allowed — what `pnpm approve-builds` writes). Keys missing
+ * under an existing `allowBuilds:` are added there; otherwise the block is
+ * appended.
+ */
+export declare function mergePnpmWorkspace(text: string | undefined, packages: readonly string[]): Merge;