@bitmagic/cli 0.1.46-dev.1 → 0.1.46-dev.3

package/dist/commands/login.js

@@ -44,6 +44,12 @@ export const loginCommand = defineCommand({
         // subscribed yet — otherwise the first thing a new creator would meet is a 403.
         const me = await fetchWhoami(environment, credentials.accessToken, defaultSubscribeDeps);
         output.info(`Logged in to ${environment.name} as ${me.userId}.`);
+        // The terms notice. Placed here rather than behind a prompt on purpose: logging in IS the
+        // assenting act (api-server records which terms version this account accepted, keyed to the
+        // date on the page), so what this line owes the creator is notice, not another keystroke.
+        // The engine licence lives in section 5 of those terms and ships in full as engine/LICENSE.md.
+        // See docs/engine-license.md.
+        output.info('By using Bitmagic you agree to the terms at https://bitmagic.ai/terms-of-service');
         if (me.pro) {
             // Says "renews on X" — or warns when it will not, which is the only
             // chance to mention that before a command is refused mid-work.
@@ -58,10 +64,10 @@ export const loginCommand = defineCommand({
         // greeted as though they had never subscribed.
         if (me.proUntil)
             output.info(describeProStatus(me));
-        // Not subscribed: carry straight on into checkout rather than ending on an
-        // error the creator has to decode. They are already in a browser — they
-        // just approved a device code in one.
-        const subscribed = await runSubscribeFlow(environment, credentials.accessToken, output, {
+        // Not subscribed: carry straight on to the Bitmagic Pro storefront rather
+        // than ending on an error the creator has to decode. They are already in a
+        // browser — they just approved a device code in one.
+        const subscribed = await runSubscribeFlow(environment, credentials.accessToken, me, output, {
             noOpen: args.json === true,
         });
         output.result({
@@ -70,7 +76,7 @@ export const loginCommand = defineCommand({
             userId: me.userId,
             roles: me.roles,
             pro: subscribed.pro,
-            ...(subscribed.checkoutUrl ? { checkoutUrl: subscribed.checkoutUrl } : {}),
+            ...(subscribed.subscribeUrl ? { subscribeUrl: subscribed.subscribeUrl } : {}),
         });
     },
 });

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,KAAK,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CAC/E,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC;IACxC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,8CAA8C,EAAE;IACpF,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8CAA8C,EAAE;QACpF,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,2BAA2B,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC1C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAEnD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEnE,4FAA4F;QAC5F,sFAAsF;QACtF,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAErC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3E,gBAAgB,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,4FAA4F;QAC5F,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,2FAA2F;QAC3F,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;YAAE,uBAAuB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAE9E,wFAAwF;QACxF,4FAA4F;QAC5F,wFAAwF;QACxF,gFAAgF;QAChF,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,gBAAgB,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAEjE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;YACX,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC;gBACZ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK;gBAC3E,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,IAAI,KAAK;aACnF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,+CAA+C;QAC/C,IAAI,EAAE,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpD,2EAA2E;QAC3E,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE;YACtF,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC;YACZ,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,KAAK,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CAC/E,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC;IACxC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,8CAA8C,EAAE;IACpF,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8CAA8C,EAAE;QACpF,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,2BAA2B,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;QAC1C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAEnD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEnE,4FAA4F;QAC5F,sFAAsF;QACtF,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAErC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3E,gBAAgB,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,4FAA4F;QAC5F,8FAA8F;QAC9F,6FAA6F;QAC7F,+FAA+F;QAC/F,2FAA2F;QAC3F,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;YAAE,uBAAuB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAE9E,wFAAwF;QACxF,4FAA4F;QAC5F,wFAAwF;QACxF,gFAAgF;QAChF,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,gBAAgB,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACjE,0FAA0F;QAC1F,4FAA4F;QAC5F,0FAA0F;QAC1F,+FAA+F;QAC/F,8BAA8B;QAC9B,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QAEhG,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;YACX,oEAAoE;YACpE,+DAA+D;YAC/D,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC;gBACZ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK;gBAC3E,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,IAAI,KAAK;aACnF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,+CAA+C;QAC/C,IAAI,EAAE,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpD,0EAA0E;QAC1E,2EAA2E;QAC3E,qDAAqD;QACrD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE;YAC1F,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC;YACZ,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,WAAW,CAAC,IAAI;YAC7B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/commands/reset-account.d.ts

@@ -0,0 +1,90 @@
+import { type Output } from '../output.js';
+/**
+ * `bitmagic reset-account` — put your own account back to never-seen-before, so
+ * the first-run path can be walked again.
+ *
+ * Everything a new creator meets happens exactly once per identity: the device
+ * code, the terms notice, "no Bitmagic Pro subscription", Stripe checkout, the
+ * first `bitmagic init` and its 500 sparks. Testing a change to any of it used
+ * to mean finding a fresh Auth0 account. This deletes the account server-side
+ * instead, so the next `bitmagic login` provisions it from scratch.
+ *
+ * ── Why this cannot touch prod ──────────────────────────────────────────────
+ *
+ * The endpoint behind it is not registered on the production api-server at all,
+ * so the path does not exist there. This command refuses `--env prod` before it
+ * opens a socket anyway: the server would answer with a status code, and a
+ * sentence is a better thing to read than a 404.
+ *
+ * ── Why it asks ─────────────────────────────────────────────────────────────
+ *
+ * The confirmation wants the ENVIRONMENT NAME typed back, not a y/n. The whole
+ * hazard here is running the right command against the wrong environment, and
+ * "y" is the same keystroke whichever one you are pointed at. `--yes` skips it
+ * for scripts, and a non-interactive shell must pass `--yes` explicitly rather
+ * than have the prompt silently pass — an agent should not be able to delete a
+ * creator's account by running a command it read in a doc.
+ */
+/** What the api-server says a reset would destroy. */
+export interface ResetPreview {
+    userId: string;
+    email: string;
+    publicId: string | null;
+    games: number;
+    sparkBalance: number;
+    hasProSubscription: boolean;
+    stripeSubscriptionId: string | null;
+    hasProGrant: boolean;
+    /** vip_users is keyed by email and survives the reset — worth saying out loud. */
+    vip: boolean;
+}
+export interface ResetAccountDeps {
+    fetch: typeof globalThis.fetch;
+    sleep: (ms: number) => Promise<void>;
+    /** Whether a human is at the keyboard; injected so the rule is testable. */
+    interactive: () => boolean;
+    /** Reads one line of confirmation. */
+    ask: (question: string) => Promise<string>;
+    /** Removes the globally installed CLI. Returns false if it could not. */
+    uninstall: () => boolean;
+}
+export declare const defaultResetDeps: ResetAccountDeps;
+/** PURE. The lines shown before the confirmation. */
+export declare function formatResetPreview(preview: ResetPreview, environmentName: string): string;
+export interface ResetAccountOptions {
+    env?: string;
+    yes?: boolean;
+    uninstall?: boolean;
+    deps?: ResetAccountDeps;
+    /** Test-only credentials-directory override, matching the rest of the CLI. */
+    baseDir?: string;
+}
+export interface ResetAccountResult {
+    environment: string;
+    userId: string;
+    stripeSubscriptionCanceled: boolean;
+    deleted: Record<string, number>;
+    credentialsCleared: boolean;
+    cliUninstalled: boolean;
+}
+export declare function runResetAccount(options: ResetAccountOptions, output: Output): Promise<ResetAccountResult>;
+/** PURE. What to do next, given what the reset just did. */
+export declare function formatNextSteps(result: ResetAccountResult): string;
+export declare const resetAccountCommand: import("citty").CommandDef<{
+    readonly env: {
+        readonly type: "string";
+        readonly description: "Environment to reset in (dev, local). Never prod.";
+    };
+    readonly yes: {
+        readonly type: "boolean";
+        readonly description: "Skip the confirmation. Required in a non-interactive shell.";
+    };
+    readonly uninstall: {
+        readonly type: "boolean";
+        readonly description: "Also `npm uninstall -g @bitmagic/cli` afterwards, so the next run starts at the install.";
+    };
+    readonly json: {
+        readonly type: "boolean";
+        readonly description: "Print the result as JSON on stdout; all progress goes to stderr.";
+    };
+}>;

package/dist/commands/reset-account.js

@@ -0,0 +1,211 @@
+import { defineCommand } from 'citty';
+import { spawnSync } from 'child_process';
+import { createInterface } from 'readline/promises';
+import { selectEnvironmentForCommand, resolveAuth0ClientId } from '../config/environments.js';
+import { clearCredentials } from '../config/credentials.js';
+import { getAccessToken } from '../auth/session.js';
+import { createOutput } from '../output.js';
+import { CliError } from '../errors.js';
+async function askOnStdin(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return (await rl.question(question)).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+function uninstallGlobally() {
+    const result = spawnSync('npm', ['uninstall', '-g', '@bitmagic/cli'], { stdio: 'inherit' });
+    return !result.error && result.status === 0;
+}
+export const defaultResetDeps = {
+    fetch: globalThis.fetch,
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    interactive: () => process.stdin.isTTY === true,
+    ask: askOnStdin,
+    uninstall: uninstallGlobally,
+};
+/**
+ * This command does NOT go through http/client.ts, and that is deliberate.
+ *
+ * Its shared mapping turns 503 into "this feature is unavailable in this
+ * environment" and everything else into "api-server returned HTTP n" — fine for
+ * the twenty routes that only ever fail one way, useless for this one, whose
+ * three interesting failures each need their own sentence: the endpoint is not
+ * deployed here, Stripe could not be reached so NOTHING was deleted, and Stripe
+ * is not configured so the subscription cannot be cancelled. The server sends
+ * the reason in the body; this reads it.
+ */
+async function resetRequest(environment, path, token, method, deps) {
+    let response;
+    try {
+        response = await deps.fetch(`${environment.apiUrl}${path}`, {
+            method,
+            headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+        });
+    }
+    catch {
+        throw new CliError(`Cannot reach api-server at ${environment.apiUrl}.`);
+    }
+    if (response.ok)
+        return (await response.json());
+    let serverMessage = null;
+    try {
+        const body = (await response.json());
+        if (typeof body.error === 'string')
+            serverMessage = body.error;
+    }
+    catch {
+        // No body, or not JSON. The status alone still has to produce a sentence.
+    }
+    if (response.status === 401) {
+        throw new CliError('Your session has expired. Run `bitmagic login`.');
+    }
+    if (response.status === 404) {
+        // Two very different things share this status: the account is already gone
+        // (the server says so in the body) or the route was never mounted, which is
+        // what production looks like from out here.
+        if (serverMessage)
+            throw new CliError(serverMessage);
+        throw new CliError(`The "${environment.name}" api-server has no account-reset endpoint. It exists only outside ` +
+            'production, and only on api-servers new enough to have it.');
+    }
+    if (response.status === 403) {
+        throw new CliError(`The "${environment.name}" api-server refused the reset. It exists only outside production.`);
+    }
+    throw new CliError(serverMessage ?? `api-server returned HTTP ${response.status} for ${path}. Nothing was deleted.`);
+}
+/** PURE. The lines shown before the confirmation. */
+export function formatResetPreview(preview, environmentName) {
+    const lines = [
+        `This DELETES your Bitmagic account on ${environmentName}.`,
+        '',
+        `  account   ${preview.userId} (${preview.email})`,
+        `  games     ${preview.games}`,
+        `  sparks    ${preview.sparkBalance.toLocaleString('en-US')}`,
+    ];
+    if (preview.hasProSubscription) {
+        lines.push('  pro       subscription — WILL BE CANCELLED IN STRIPE, then deleted');
+    }
+    else if (preview.hasProGrant) {
+        lines.push('  pro       comped grant — deleted');
+    }
+    else {
+        lines.push('  pro       none');
+    }
+    lines.push('');
+    lines.push('Also removed: your profile, terms acceptance, XP, likes, follows, comments and');
+    lines.push('published game entries. Your next `bitmagic login` starts over from nothing.');
+    if (preview.vip) {
+        // Says so up front rather than letting it read as a failed reset later.
+        lines.push('');
+        lines.push('NOTE: this email is on the VIP list, which is keyed by email and is NOT reset.');
+        lines.push('      The new account will not start on the free tier.');
+    }
+    return lines.join('\n');
+}
+export async function runResetAccount(options, output) {
+    const deps = options.deps ?? defaultResetDeps;
+    const { environment } = selectEnvironmentForCommand({
+        explicit: options.env,
+        ...(options.baseDir !== undefined ? { baseDir: options.baseDir } : {}),
+    });
+    // Before anything else, including reading a token: pointing this at prod is
+    // the mistake worth catching with a sentence rather than a status code.
+    if (environment.name === 'prod') {
+        throw new CliError('There is no account reset on prod — the endpoint is not deployed there. ' +
+            'Run this against dev or local (`bitmagic reset-account --env dev`).');
+    }
+    const clientId = resolveAuth0ClientId(environment);
+    const token = await getAccessToken(environment, clientId, deps, options.baseDir);
+    const { preview } = await resetRequest(environment, '/api/cli/v1/account/reset/preview', token, 'GET', deps);
+    output.info(formatResetPreview(preview, environment.name));
+    output.info('');
+    if (options.yes !== true) {
+        if (!deps.interactive()) {
+            throw new CliError('Deleting an account has to be confirmed by a person, and this shell has no terminal. ' +
+                'Run it yourself, or pass --yes if you meant it.');
+        }
+        // The environment name, not y/n: the hazard is doing the right thing to the
+        // wrong environment, and "y" reads identically whichever one you are on.
+        const answer = await deps.ask(`Type "${environment.name}" to confirm: `);
+        if (answer !== environment.name) {
+            throw new CliError('Not confirmed — nothing was deleted.');
+        }
+    }
+    const result = await resetRequest(environment, '/api/cli/v1/account/reset', token, 'POST', deps);
+    if (result.stripeSubscriptionCanceled)
+        output.info('Cancelled the Bitmagic Pro subscription in Stripe.');
+    output.info(`Deleted the account on ${environment.name}.`);
+    // A cached access token outliving the user row would leave the CLI looking
+    // logged in as an account that no longer exists — and the first command to
+    // notice would fail somewhere unrelated.
+    clearCredentials(environment.name, options.baseDir);
+    output.info(`Cleared the stored ${environment.name} credentials.`);
+    // Last, because it removes the code this process is running from. Safe where
+    // it matters: every module is already loaded by the time this line runs, and
+    // nothing after it does a dynamic import — only already-resident code and Node
+    // builtins. Do not add an `await import()` below this point.
+    let cliUninstalled = false;
+    if (options.uninstall === true) {
+        cliUninstalled = deps.uninstall();
+    }
+    return {
+        environment: environment.name,
+        userId: result.userId,
+        stripeSubscriptionCanceled: result.stripeSubscriptionCanceled,
+        deleted: result.deleted,
+        credentialsCleared: true,
+        cliUninstalled,
+    };
+}
+/** PURE. What to do next, given what the reset just did. */
+export function formatNextSteps(result) {
+    const lines = [
+        '',
+        'Next:',
+    ];
+    if (result.cliUninstalled) {
+        // The full first run starts at the install, which is why --uninstall exists.
+        lines.push('  npm install -g @bitmagic/cli');
+    }
+    lines.push(`  bitmagic login${result.environment === 'dev' ? '' : ` --env ${result.environment}`}`);
+    lines.push('  bitmagic init <a new directory>');
+    lines.push('');
+    lines.push('Any project you scaffolded earlier still names a gameId that no longer exists —');
+    lines.push('nothing on disk was touched, so start the fresh run in a new directory.');
+    return lines.join('\n');
+}
+export const resetAccountCommand = defineCommand({
+    meta: {
+        name: 'reset-account',
+        description: 'Delete your account on dev or local so the first-run experience can be tested again.',
+    },
+    args: {
+        env: { type: 'string', description: 'Environment to reset in (dev, local). Never prod.' },
+        yes: { type: 'boolean', description: 'Skip the confirmation. Required in a non-interactive shell.' },
+        uninstall: {
+            type: 'boolean',
+            description: 'Also `npm uninstall -g @bitmagic/cli` afterwards, so the next run starts at the install.',
+        },
+        json: {
+            type: 'boolean',
+            description: 'Print the result as JSON on stdout; all progress goes to stderr.',
+        },
+    },
+    async run({ args }) {
+        const output = createOutput(args.json === true);
+        const result = await runResetAccount({ env: args.env, yes: args.yes === true, uninstall: args.uninstall === true }, output);
+        output.info(formatNextSteps(result));
+        output.result({ ok: true, ...result });
+        if (args.uninstall === true && !result.cliUninstalled) {
+            // A warning, not a failure: the account IS reset, and the JSON document
+            // above already said so. Only the last step did not happen.
+            output.info('');
+            output.info('Warning: `npm uninstall -g @bitmagic/cli` did not succeed. If you installed the CLI with ' +
+                'pnpm, yarn or npx, remove it the same way you added it.');
+        }
+    },
+});
+//# sourceMappingURL=reset-account.js.map

package/dist/commands/reset-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-account.js","sourceRoot":"","sources":["../../src/commands/reset-account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAoB,MAAM,2BAA2B,CAAC;AAChH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAe,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAoExC,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,KAAK,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;IAC/C,GAAG,EAAE,UAAU;IACf,SAAS,EAAE,iBAAiB;CAC7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CACzB,WAAwB,EACxB,IAAY,EACZ,KAAa,EACb,MAAsB,EACtB,IAAsB;IAEtB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,IAAI,EAAE,EAAE;YAC1D,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,8BAA8B,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IAErD,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC5D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,iDAAiD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,2EAA2E;QAC3E,4EAA4E;QAC5E,4CAA4C;QAC5C,IAAI,aAAa;YAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,IAAI,QAAQ,CAChB,QAAQ,WAAW,CAAC,IAAI,qEAAqE;YAC3F,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAChB,QAAQ,WAAW,CAAC,IAAI,oEAAoE,CAC7F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,QAAQ,CAChB,aAAa,IAAI,4BAA4B,QAAQ,CAAC,MAAM,QAAQ,IAAI,wBAAwB,CACjG,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAAC,OAAqB,EAAE,eAAuB;IAC/E,MAAM,KAAK,GAAG;QACZ,yCAAyC,eAAe,GAAG;QAC3D,EAAE;QACF,eAAe,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,GAAG;QAClD,eAAe,OAAO,CAAC,KAAK,EAAE;QAC9B,eAAe,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE;KAC9D,CAAC;IACF,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC7F,KAAK,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,wEAAwE;QACxE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAC7F,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA4B,EAC5B,MAAc;IAEd,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;IAC9C,MAAM,EAAE,WAAW,EAAE,GAAG,2BAA2B,CAAC;QAClD,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC,CAAC;IAEH,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAChB,0EAA0E;YACxE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CACpC,WAAW,EACX,mCAAmC,EACnC,KAAK,EACL,KAAK,EACL,IAAI,CACL,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAChB,uFAAuF;gBACrF,iDAAiD,CACpD,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,IAAI,gBAAgB,CAAC,CAAC;QACzE,IAAI,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,WAAW,EACX,2BAA2B,EAC3B,KAAK,EACL,MAAM,EACN,IAAI,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,0BAA0B;QAAE,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACzG,MAAM,CAAC,IAAI,CAAC,0BAA0B,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,2EAA2E;IAC3E,yCAAyC;IACzC,gBAAgB,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,IAAI,eAAe,CAAC,CAAC;IAEnE,6EAA6E;IAC7E,6EAA6E;IAC7E,+EAA+E;IAC/E,6DAA6D;IAC7D,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC/B,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC;IAED,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,IAAI;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,0BAA0B,EAAE,MAAM,CAAC,0BAA0B;QAC7D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,kBAAkB,EAAE,IAAI;QACxB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,MAA0B;IACxD,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,OAAO;KACR,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC9F,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;IAC/C,IAAI,EAAE;QACJ,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,sFAAsF;KACpG;IACD,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mDAAmD,EAAE;QACzF,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,6DAA6D,EAAE;QACpG,SAAS,EAAE;YACT,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,0FAA0F;SACxG;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,EAC7E,MAAM,CACP,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAEvC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACtD,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,CAAC,IAAI,CACT,2FAA2F;gBACzF,yDAAyD,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/commands/subscribe.d.ts

@@ -5,7 +5,7 @@ export declare const subscribeCommand: import("citty").CommandDef<{
     };
     readonly 'no-wait': {
         readonly type: "boolean";
-        readonly description: "Open checkout and exit instead of waiting for it to complete.";
+        readonly description: "Open the Bitmagic Pro page and exit instead of waiting for it to complete.";
     };
     readonly json: {
         readonly type: "boolean";

package/dist/commands/subscribe.js

@@ -7,17 +7,20 @@ import { createOutput } from '../output.js';
  * `bitmagic subscribe` — start (or finish) a Bitmagic Pro subscription.
  *
  * `login` already runs this flow for a creator who has not subscribed, so this
- * command exists for the second attempt: someone who closed the checkout tab,
- * whose card was declined, or whose subscription has since lapsed. Same code
- * path, so the recovery looks exactly like the first run rather than being a
- * differently-worded special case.
+ * command exists for the second attempt: someone who closed the tab, whose card
+ * was declined, or whose subscription has since lapsed. Same code path, so the
+ * recovery looks exactly like the first run rather than being a differently-worded
+ * special case.
+ *
+ * It opens the Bitmagic Pro storefront, which sells a subscription AND redeems a
+ * Pro voucher — so this is the command to reach for with a comped-Pro code too.
  */
 const deviceFlowDeps = { fetch: globalThis.fetch, sleep: (ms) => new Promise((r) => setTimeout(r, ms)) };
 export const subscribeCommand = defineCommand({
     meta: { name: 'subscribe', description: 'Start a Bitmagic Pro subscription, which the CLI requires.' },
     args: {
         env: { type: 'string', description: 'Environment to subscribe in (dev, prod, local).' },
-        'no-wait': { type: 'boolean', description: 'Open checkout and exit instead of waiting for it to complete.' },
+        'no-wait': { type: 'boolean', description: 'Open the Bitmagic Pro page and exit instead of waiting for it to complete.' },
         json: {
             type: 'boolean',
             description: 'Print the result as JSON on stdout; all progress goes to stderr.',
@@ -40,7 +43,7 @@ export const subscribeCommand = defineCommand({
         if (me.proUntil) {
             output.info(`Your previous Bitmagic Pro subscription ended on ${me.proUntil.slice(0, 10)}.`);
         }
-        const result = await runSubscribeFlow(environment, token, output, {
+        const result = await runSubscribeFlow(environment, token, me, output, {
             noOpen: args.json === true,
             noWait: args['no-wait'] === true,
         });
@@ -48,7 +51,7 @@ export const subscribeCommand = defineCommand({
             ok: true,
             pro: result.pro,
             userId: me.userId,
-            ...(result.checkoutUrl ? { checkoutUrl: result.checkoutUrl } : {}),
+            ...(result.subscribeUrl ? { subscribeUrl: result.subscribeUrl } : {}),
             ...(result.reason ? { reason: result.reason } : {}),
         });
     },

package/dist/commands/subscribe.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscribe.js","sourceRoot":"","sources":["../../src/commands/subscribe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;AAEvH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;IAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,4DAA4D,EAAE;IACtG,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE;QACvF,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,+DAA+D,EAAE;QAC5G,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAE1E,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;QACvE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;YACX,wEAAwE;YACxE,6CAA6C;YAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;YACxE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;YAChE,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YAC1B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC;YACZ,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"subscribe.js","sourceRoot":"","sources":["../../src/commands/subscribe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;AAEvH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;IAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,4DAA4D,EAAE;IACtG,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE;QACvF,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,4EAA4E,EAAE;QACzH,IAAI,EAAE;YACJ,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kEAAkE;SAChF;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAE1E,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;QACvE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;YACX,wEAAwE;YACxE,6CAA6C;YAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;YACxE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE;YACpE,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI;YAC1B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC;YACZ,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/scaffold/claude-settings.js

@@ -36,17 +36,23 @@ function reloadMatcher() {
 /**
  * The `bitmagic` commands a new project pre-approves, so the agent is not prompted for them.
  *
- * Every entry is free, local and idempotent, and every one is something AGENTS.md tells the agent
- * to run repeatedly — `check` after each edit, `reload` at the end of each turn, `verify` before
- * declaring anything done. A prompt on those is pure friction.
+ * The local, idempotent ones are here because AGENTS.md tells the agent to run them repeatedly —
+ * `check` after each edit, `reload` at the end of each turn, `verify` before declaring anything
+ * done. A prompt on those is pure friction.
  *
- * What is deliberately ABSENT is the point of the list. A blanket `Bash(bitmagic:*)` would also
- * cover `generate`, `forge` and `cover`, which spend the creator's sparks, and `publish`, which
- * with `--visibility public` lists their game on bitmagic.ai. The permission prompt is currently
- * the only human gate on that spending — AGENTS.md leans on it explicitly ("Generation costs the
- * creator real money. Do not call these in a loop to explore options"), so widening this list
- * removes a safeguard rather than a nuisance. `upgrade` is out too: it replaces `engine/`
- * wholesale, which the creator should see coming.
+ * `generate`, `cover` and `forge` are here for a different reason: they are funded by the rolling
+ * spark allowance the creator already bought with Bitmagic Pro, and prompting per asset does not
+ * protect them from a bill — it just produces a game full of placeholders instead of the assets
+ * they are paying to have generated. The boundary worth defending is the SPILL past that allowance
+ * into their purchased spark balance, and that one is enforced in code rather than in prose:
+ * `bitmagic allowance --allow-sparks` refuses without a TTY, so an agent cannot self-authorise it
+ * (see `../commands/allowance.ts`, and `docs/pro-subscription.md` on why a doc rule saying "the
+ * agent must not run this" does not survive an agent that reads the exact command in a refusal).
+ *
+ * What remains deliberately ABSENT: `publish`, because `--visibility public` lists the game on
+ * bitmagic.ai; `upgrade`, because it replaces `engine/` wholesale and the creator should see that
+ * coming; `subscribe` and `allowance`, which are money and consent. A blanket `Bash(bitmagic:*)`
+ * would swallow all four, so the list stays explicit.
  */
 const ALLOWED_COMMANDS = [
     'Bash(bitmagic check:*)',
@@ -59,6 +65,11 @@ const ALLOWED_COMMANDS = [
     // to run WITHOUT interrupting the human — the whole point is checking what
     // something will cost before committing to it.
     'Bash(bitmagic usage:*)',
+    // Allowance-funded content generation. See the note above: the gate that
+    // matters is the TTY-only `allowance --allow-sparks`, not a prompt per asset.
+    'Bash(bitmagic generate:*)',
+    'Bash(bitmagic cover:*)',
+    'Bash(bitmagic forge:*)',
 ];
 /**
  * The settings a project with no `.claude/settings.json` at all gets.

package/dist/scaffold/claude-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-settings.js","sourceRoot":"","sources":["../../src/scaffold/claude-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAkBrD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,QAAiB;IAClC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,8CAA8C;AAC9C,SAAS,aAAa;IACpB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,gBAAgB,GAAG;IACvB,wBAAwB;IACxB,sBAAsB;IACtB,yBAAyB;IACzB,yBAAyB;IACzB,wBAAwB;IACxB,yBAAyB;IACzB,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,wBAAwB;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,SAAS,CAAC;QACf,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACxC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE;KACnC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,OAAgB;IAClC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAI,OAAuB,CAAC,KAAK,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAa,EAAE,EAAE;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,OAAO,GAAI,IAAkB,CAAC,OAAO,CAAC;QAC5C,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,oBAAoB,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,qCAAqC,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,2CAA2C,EAAE,CAAC;IACzG,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,gDAAgD,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAErD,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC;YAClB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE;SACtD,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"claude-settings.js","sourceRoot":"","sources":["../../src/scaffold/claude-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAkBrD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,QAAiB;IAClC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,8CAA8C;AAC9C,SAAS,aAAa;IACpB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,gBAAgB,GAAG;IACvB,wBAAwB;IACxB,sBAAsB;IACtB,yBAAyB;IACzB,yBAAyB;IACzB,wBAAwB;IACxB,yBAAyB;IACzB,4EAA4E;IAC5E,2EAA2E;IAC3E,+CAA+C;IAC/C,wBAAwB;IACxB,yEAAyE;IACzE,8EAA8E;IAC9E,2BAA2B;IAC3B,wBAAwB;IACxB,wBAAwB;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,SAAS,CAAC;QACf,WAAW,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACxC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE;KACnC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,OAAgB;IAClC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAI,OAAuB,CAAC,KAAK,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAa,EAAE,EAAE;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,MAAM,OAAO,GAAI,IAAkB,CAAC,OAAO,CAAC;QAC5C,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,oBAAoB,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,qCAAqC,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,2CAA2C,EAAE,CAAC;IACzG,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,gDAAgD,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAErD,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC;YAClB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE;SACtD,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/scaffold/engine-download.js

@@ -38,6 +38,18 @@ export async function downloadAndVerify(tarballUrl, expectedSha256, targetPath,
     fs.mkdirSync(path.dirname(targetPath), { recursive: true });
     fs.writeFileSync(targetPath, body);
 }
+/**
+ * Tarball entries that are single files sitting directly under `game/` rather than inside one of
+ * the vendored directories. They share `game/agent-docs/`'s strip depth, so they ride its pass.
+ *
+ * `sw-cache-buster.js` is a runtime file the scaffolder later moves to the project root, and the
+ * two licence files are the terms the engine ships under (see docs/engine-license.md).
+ */
+const ENGINE_ROOT_FILES = [
+    'game/sw-cache-buster.js',
+    'game/LICENSE.md',
+    'game/THIRD-PARTY-NOTICES.md',
+];
 /**
  * The tarball stores three prefixes at different depths — game/src/<root>, game/agent-docs (plus
  * the sibling game/sw-cache-buster.js, which shares its strip depth) and templates — so it takes
@@ -67,11 +79,13 @@ export async function extractEngine(tarballPath, engineDir, templatesDir) {
     // engine-api/ signature digest and samples/ subdirectories.
     // game/sw-cache-buster.js -> <engineDir>/sw-cache-buster.js (rides this pass because it needs
     // the same strip depth as game/agent-docs/, even though it isn't under it)
+    // game/LICENSE.md and game/THIRD-PARTY-NOTICES.md ride it for the same reason, and land next to
+    // the code they license as <engineDir>/LICENSE.md and <engineDir>/THIRD-PARTY-NOTICES.md.
     await tar.extract({
         file: tarballPath,
         cwd: engineDir,
         strip: 1,
-        filter: (entryPath) => entryPath.startsWith('game/agent-docs/') || entryPath === 'game/sw-cache-buster.js',
+        filter: (entryPath) => entryPath.startsWith('game/agent-docs/') || ENGINE_ROOT_FILES.includes(entryPath),
     });
     // templates/index.json -> <templatesDir>/index.json
     await tar.extract({

package/dist/scaffold/engine-download.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-download.js","sourceRoot":"","sources":["../../src/scaffold/engine-download.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,MAAM,EAAgB,MAAM,mBAAmB,CAAC;AAczD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAwB,EACxB,WAAmB,EACnB,IAAa;IAEb,OAAO,MAAM,CAAiB,WAAW,EAAE,6BAA6B,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAC/F,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,cAAsB,EACtB,UAAkB,EAClB,IAAkB;IAElB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,4DAA4D,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,2CAA2C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAChB,0EAA0E;YACxE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,SAAiB,EACjB,YAAoB;IAEpB,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,kDAAkD;IAClD,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC;KACjE,CAAC,CAAC;IAEH,8FAA8F;IAC9F,4DAA4D;IAC5D,8FAA8F;IAC9F,2EAA2E;IAC3E,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,CAAC,SAAiB,EAAE,EAAE,CAC5B,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,SAAS,KAAK,yBAAyB;KACtF,CAAC,CAAC;IAEH,oDAAoD;IACpD,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC;KAClE,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"engine-download.js","sourceRoot":"","sources":["../../src/scaffold/engine-download.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,GAAG,MAAM,KAAK,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,MAAM,EAAgB,MAAM,mBAAmB,CAAC;AAczD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAwB,EACxB,WAAmB,EACnB,IAAa;IAEb,OAAO,MAAM,CAAiB,WAAW,EAAE,6BAA6B,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAC/F,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,cAAsB,EACtB,UAAkB,EAClB,IAAkB;IAElB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,4DAA4D,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,2CAA2C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAChB,0EAA0E;YACxE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG;IACxB,yBAAyB;IACzB,iBAAiB;IACjB,6BAA6B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,SAAiB,EACjB,YAAoB;IAEpB,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,kDAAkD;IAClD,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC;KACjE,CAAC,CAAC;IAEH,8FAA8F;IAC9F,4DAA4D;IAC5D,8FAA8F;IAC9F,2EAA2E;IAC3E,gGAAgG;IAChG,0FAA0F;IAC1F,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,CAAC,SAAiB,EAAE,EAAE,CAC5B,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;KACpF,CAAC,CAAC;IAEH,oDAAoD;IACpD,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC;KAClE,CAAC,CAAC;AACL,CAAC"}

package/dist/scaffold/project-files.d.ts

@@ -1,4 +1,22 @@
 import type { EnvironmentName } from '../config/environments.js';
+/**
+ * The legal notice stamped into every game this project publishes.
+ *
+ * **A licence obligation, not decoration.** A published game is one file with the engine and its
+ * third-party dependencies inlined, so distributing a game distributes part of the engine.
+ * PolyForm Shield's Notices section requires that anyone receiving any part of the software also
+ * receives the terms and every `Required Notice:` line; MIT and ISC require their copyright and
+ * permission notices to travel with copies; Apache-2.0 section 4 requires the licence to accompany
+ * derivative distributions. One banner satisfies all of them. See `engine/LICENSE.md`.
+ *
+ * This is a second copy of `game/publish-notice.js` — deliberately, because a scaffolded project
+ * on a creator's machine cannot import from the Bitmagic monorepo. `__tests__/publish-notice.test.ts`
+ * holds it to the content that actually has to be there.
+ *
+ * Kept small on purpose: `ENGINE_BUILD_MARKERS` in `@bitmagic/asset-core/publish-source` are
+ * matched only in a published bundle's first 64KB, and everything here pushes the import map down.
+ */
+export declare const PUBLISHED_BUNDLE_BANNER = "/*!\n * Made with Bitmagic \u2014 https://bitmagic.ai\n *\n * This bundle includes the Bitmagic engine.\n * Required Notice: Copyright Bitmagic Oy (https://bitmagic.ai)\n * Licensed under the PolyForm Shield License 1.0.0\n * <https://polyformproject.org/licenses/shield/1.0.0>, with an additional permission\n * granting the right to build, modify, sell and distribute games. Full terms:\n * https://bitmagic.ai/terms-of-service\n *\n * Third-party software included in this bundle:\n *   three.js \u2014 MIT \u2014 Copyright (c) 2010-2026 three.js authors\n *   @dimforge/rapier2d-compat, @dimforge/rapier3d-compat \u2014 Apache License 2.0\n *   @msgpack/msgpack \u2014 ISC \u2014 Copyright 2019 The MessagePack Community\n *   fflate \u2014 MIT \u2014 Copyright (c) 2023 Arjun Barrett\n *   i18next, i18next-browser-languagedetector \u2014 MIT \u2014 Copyright (c) 2025 i18next\n *   JSZip \u2014 MIT (elected) \u2014 Copyright (c) 2009-2016 Stuart Knightley and contributors\n * Full licence texts: THIRD-PARTY-NOTICES.md in the Bitmagic engine distribution.\n */";
 /**
  * Mirrors game/package.json so the pro lane resolves exactly what CI builds against.
  *